fix(api): use apiextensionsv1.JSON for Lua filterContext

norman-zon · norman-zon · commit c01f433bd68b · 2026-05-05T11:01:41.000+02:00
Address review feedback on #8730: - Change FilterContext field type from map[string]string to *apiextensionsv1.JSON in both the API (lua_types.go) and IR (xds.go), matching the existing pattern used by Wasm.Config and DynamicModule.Config. - Drop json/yaml struct tags from ir.Lua.FilterContext, consistent with the other untagged fields on that struct. - Update the xDS translator to unmarshal FilterContext.Raw into structpb.Struct via protojson.Unmarshal, replacing the previous string-only map iteration. - Regenerate deepcopy, CRD manifests, and test fixtures. Users can now pass non-string JSON values (numbers, bools, nested objects) in filterContext without stringifying them. Signed-off-by: Norman Stetter <85173861+norman-zon@users.noreply.github.com>
diff --git a/api/v1alpha1/lua_types.go b/api/v1alpha1/lua_types.go
@@ -5,7 +5,10 @@
 
 package v1alpha1
 
-import gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+import (
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
 
 // LuaValueType defines the types of values for Lua supported by Envoy Gateway.
 // +kubebuilder:validation:Enum=Inline;ValueRef
@@ -45,10 +48,11 @@ type Lua struct {
 	// +optional
 	// +unionMember
 	ValueRef *gwapiv1.LocalObjectReference `json:"valueRef,omitempty"`
-	// FilterContext is a set of key/value pairs that are made available to the Lua script
-	// via request_handle:filterContext(). This allows a shared script to be
-	// parameterized differently per EnvoyExtensionPolicy/route.
+	// FilterContext is the filter context configuration for the Lua script.
+	// This must be a JSON object (key/value pairs). The values are made available
+	// to the Lua script via request_handle:filterContext(). This allows a shared
+	// script to be parameterized differently per EnvoyExtensionPolicy/route.
 	//
 	// +optional
-	FilterContext map[string]string `json:"filterContext,omitempty"`
+	FilterContext *apiextensionsv1.JSON `json:"filterContext,omitempty"`
 }
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
@@ -1601,13 +1601,12 @@ spec:
                     Only one of Inline or ValueRef must be set
                   properties:
                     filterContext:
-                      additionalProperties:
-                        type: string
                       description: |-
-                        FilterContext is a set of key/value pairs that are made available to the Lua script
-                        via request_handle:filterContext(). This allows a shared script to be
-                        parameterized differently per EnvoyExtensionPolicy/route.
-                      type: object
+                        FilterContext is the filter context configuration for the Lua script.
+                        This must be a JSON object (key/value pairs). The values are made available
+                        to the Lua script via request_handle:filterContext(). This allows a shared
+                        script to be parameterized differently per EnvoyExtensionPolicy/route.
+                      x-kubernetes-preserve-unknown-fields: true
                     inline:
                       description: Inline contains the source code as an inline string.
                       type: string
diff --git a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml
@@ -1600,13 +1600,12 @@ spec:
                     Only one of Inline or ValueRef must be set
                   properties:
                     filterContext:
-                      additionalProperties:
-                        type: string
                       description: |-
-                        FilterContext is a set of key/value pairs that are made available to the Lua script
-                        via request_handle:filterContext(). This allows a shared script to be
-                        parameterized differently per EnvoyExtensionPolicy/route.
-                      type: object
+                        FilterContext is the filter context configuration for the Lua script.
+                        This must be a JSON object (key/value pairs). The values are made available
+                        to the Lua script via request_handle:filterContext(). This allows a shared
+                        script to be parameterized differently per EnvoyExtensionPolicy/route.
+                      x-kubernetes-preserve-unknown-fields: true
                     inline:
                       description: Inline contains the source code as an inline string.
                       type: string
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-disabled.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-disabled.out.yaml
@@ -215,6 +215,7 @@ xdsIR:
                   print("Value is greater than 5")
                 end
               end
+            FilterContext: null
             Name: envoyextensionpolicy/default/policy-for-http-route/lua/0
         hostname: www.example.com
         isHTTP2: false
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-syntax.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-syntax.out.yaml
@@ -317,6 +317,7 @@ xdsIR:
                   end
                   return envoy.lua.ResponseStatus.Continue
               end
+            FilterContext: null
             Name: envoyextensionpolicy/default/policy-for-http-route/lua/0
         hostname: www.example.com
         isHTTP2: false
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua.out.yaml
@@ -292,6 +292,7 @@ xdsIR:
           luas:
           - Code: function envoy_on_request(request_handle) request_handle:logInfo('Goodbye.')
               end
+            FilterContext: null
             Name: envoyextensionpolicy/envoy-gateway/policy-for-gateway/lua/0
         hostname: www.example.com
         isHTTP2: false
@@ -327,6 +328,7 @@ xdsIR:
           luas:
           - Code: function envoy_on_request(request_handle) request_handle:logInfo('Goodbye.')
               end
+            FilterContext: null
             Name: envoyextensionpolicy/envoy-gateway/policy-for-gateway/lua/0
         hostname: www.example.com
         isHTTP2: false
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua-configmap.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua-configmap.out.yaml
@@ -466,6 +466,7 @@ xdsIR:
               function envoy_on_request(request_handle)
               request_handle:logInfo('Goodbye.')
               end
+            FilterContext: null
             Name: envoyextensionpolicy/envoy-gateway/policy-for-gateway/lua/0
         hostname: www.example.com
         isHTTP2: false
@@ -505,6 +506,7 @@ xdsIR:
               function envoy_on_request(request_handle)
               request_handle:logInfo('Goodbye.')
               end
+            FilterContext: null
             Name: envoyextensionpolicy/envoy-gateway/policy-for-gateway/lua/0
         hostname: www.example.com
         isHTTP2: false
@@ -544,6 +546,7 @@ xdsIR:
               function envoy_on_request(request_handle)
               request_handle:logInfo('Goodbye.')
               end
+            FilterContext: null
             Name: envoyextensionpolicy/envoy-gateway/policy-for-gateway/lua/0
         hostname: www.example.com
         isHTTP2: false
@@ -581,9 +584,9 @@ xdsIR:
               function envoy_on_response(response_handle)
               response_handle:logWarn('Goodbye.')
               end
-            Name: envoyextensionpolicy/default/policy-for-http-route/lua/0
-            filterContext:
+            FilterContext:
               token_header: x-session-token
+            Name: envoyextensionpolicy/default/policy-for-http-route/lua/0
         hostname: www.example.com
         isHTTP2: false
         metadata:
@@ -620,6 +623,7 @@ xdsIR:
               function envoy_on_request(request_handle)
               request_handle:logInfo('Goodbye.')
               end
+            FilterContext: null
             Name: envoyextensionpolicy/envoy-gateway/policy-for-gateway/lua/0
         hostname: www.example.com
         isHTTP2: false
diff --git a/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua.out.yaml b/internal/gatewayapi/testdata/envoyextensionpolicy-with-lua.out.yaml
@@ -281,10 +281,10 @@ xdsIR:
           luas:
           - Code: function envoy_on_response(response_handle) response_handle:logWarn('Goodbye.')
               end
-            Name: envoyextensionpolicy/default/policy-for-http-route/lua/0
-            filterContext:
+            FilterContext:
               mode: strict
               token_header: x-api-key
+            Name: envoyextensionpolicy/default/policy-for-http-route/lua/0
         hostname: www.example.com
         isHTTP2: false
         metadata:
@@ -319,6 +319,7 @@ xdsIR:
           luas:
           - Code: function envoy_on_request(request_handle) request_handle:logInfo('Goodbye.')
               end
+            FilterContext: null
             Name: envoyextensionpolicy/envoy-gateway/policy-for-gateway/lua/0
         hostname: www.example.com
         isHTTP2: false
diff --git a/internal/ir/xds.go b/internal/ir/xds.go
@@ -3685,9 +3685,9 @@ type Lua struct {
 	Name string
 	// Code is the Lua source code
 	Code *string
-	// FilterContext is a set of key/value pairs passed to the Lua script
-	// via request_handle:filterContext().
-	FilterContext map[string]string `json:"filterContext,omitempty" yaml:"filterContext,omitempty"`
+	// FilterContext is the filter context configuration for the Lua script.
+	// This is a JSON object passed to the Lua script via request_handle:filterContext().
+	FilterContext *apiextensionsv1.JSON
 }
 
 // Wasm holds the information associated with the Wasm extensions.
diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go
diff --git a/internal/xds/translator/lua.go b/internal/xds/translator/lua.go
@@ -14,6 +14,7 @@ import (
 	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
 	luafilterv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/lua/v3"
 	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	"google.golang.org/protobuf/encoding/protojson"
 	"google.golang.org/protobuf/types/known/anypb"
 	"google.golang.org/protobuf/types/known/structpb"
 
@@ -154,12 +155,12 @@ func (*lua) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute, _ *ir.HTTPLi
 				},
 			},
 		}
-		if len(ep.FilterContext) > 0 {
-			fields := make(map[string]*structpb.Value, len(ep.FilterContext))
-			for k, v := range ep.FilterContext {
-				fields[k] = structpb.NewStringValue(v)
+		if ep.FilterContext != nil && ep.FilterContext.Raw != nil {
+			filterCtx := &structpb.Struct{}
+			if err := protojson.Unmarshal(ep.FilterContext.Raw, filterCtx); err != nil {
+				return err
 			}
-			luaPerRoute.FilterContext = &structpb.Struct{Fields: fields}
+			luaPerRoute.FilterContext = filterCtx
 		}
 		luaPerRouteAny, err := anypb.New(luaPerRoute)
 		if err != nil {
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
@@ -4105,7 +4105,7 @@ _Appears in:_
 | `type` | _[LuaValueType](#luavaluetype)_ |  true  | Inline | Type is the type of method to use to read the Lua value.<br />Valid values are Inline and ValueRef, default is Inline. |
 | `inline` | _string_ |  false  |  | Inline contains the source code as an inline string. |
 | `valueRef` | _[LocalObjectReference](#localobjectreference)_ |  false  |  | ValueRef has the source code specified as a local object reference.<br />Only a reference to ConfigMap is supported.<br />The value of key `lua` in the ConfigMap will be used.<br />If the key is not found, the first value in the ConfigMap will be used. |
-| `filterContext` | _object (keys:string, values:string)_ |  false  |  | FilterContext is a set of key/value pairs that are made available to the Lua script<br />via request_handle:filterContext(). This allows a shared script to be<br />parameterized differently per EnvoyExtensionPolicy/route. |
+| `filterContext` | _[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#json-v1-apiextensions-k8s-io)_ |  false  |  | FilterContext is the filter context configuration for the Lua script.<br />This must be a JSON object (key/value pairs). The values are made available<br />to the Lua script via request_handle:filterContext(). This allows a shared<br />script to be parameterized differently per EnvoyExtensionPolicy/route. |
 
 
 #### LuaValidation
diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml
@@ -29865,13 +29865,12 @@ spec:
                     Only one of Inline or ValueRef must be set
                   properties:
                     filterContext:
-                      additionalProperties:
-                        type: string
                       description: |-
-                        FilterContext is a set of key/value pairs that are made available to the Lua script
-                        via request_handle:filterContext(). This allows a shared script to be
-                        parameterized differently per EnvoyExtensionPolicy/route.
-                      type: object
+                        FilterContext is the filter context configuration for the Lua script.
+                        This must be a JSON object (key/value pairs). The values are made available
+                        to the Lua script via request_handle:filterContext(). This allows a shared
+                        script to be parameterized differently per EnvoyExtensionPolicy/route.
+                      x-kubernetes-preserve-unknown-fields: true
                     inline:
                       description: Inline contains the source code as an inline string.
                       type: string
diff --git a/test/helm/gateway-crds-helm/e2e.out.yaml b/test/helm/gateway-crds-helm/e2e.out.yaml
@@ -7838,13 +7838,12 @@ spec:
                     Only one of Inline or ValueRef must be set
                   properties:
                     filterContext:
-                      additionalProperties:
-                        type: string
                       description: |-
-                        FilterContext is a set of key/value pairs that are made available to the Lua script
-                        via request_handle:filterContext(). This allows a shared script to be
-                        parameterized differently per EnvoyExtensionPolicy/route.
-                      type: object
+                        FilterContext is the filter context configuration for the Lua script.
+                        This must be a JSON object (key/value pairs). The values are made available
+                        to the Lua script via request_handle:filterContext(). This allows a shared
+                        script to be parameterized differently per EnvoyExtensionPolicy/route.
+                      x-kubernetes-preserve-unknown-fields: true
                     inline:
                       description: Inline contains the source code as an inline string.
                       type: string
diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
@@ -7838,13 +7838,12 @@ spec:
                     Only one of Inline or ValueRef must be set
                   properties:
                     filterContext:
-                      additionalProperties:
-                        type: string
                       description: |-
-                        FilterContext is a set of key/value pairs that are made available to the Lua script
-                        via request_handle:filterContext(). This allows a shared script to be
-                        parameterized differently per EnvoyExtensionPolicy/route.
-                      type: object
+                        FilterContext is the filter context configuration for the Lua script.
+                        This must be a JSON object (key/value pairs). The values are made available
+                        to the Lua script via request_handle:filterContext(). This allows a shared
+                        script to be parameterized differently per EnvoyExtensionPolicy/route.
+                      x-kubernetes-preserve-unknown-fields: true
                     inline:
                       description: Inline contains the source code as an inline string.
                       type: string
