Skip to content

Commit e098b7f

Browse files
albsga4albsga4
authored
Merge branch 'main' into feat/securitypolicy-csrf-filter
2 parents 8bf374d + 4628260 commit e098b7f

29 files changed

Lines changed: 1693 additions & 35 deletions

‎api/v1alpha1/shared_types.go‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -780,6 +780,19 @@ type GRPCSettings struct {
780780
EnableWeb *bool `json:"enableWeb,omitempty"`
781781
}
782782

783+
// ResponseOverrideSource specifies the source of responses to override.
784+
// +kubebuilder:validation:Enum=All;Local;Backend
785+
type ResponseOverrideSource string
786+
787+
const (
788+
// ResponseOverrideSourceAll overrides both Envoy-generated and upstream responses.
789+
ResponseOverrideSourceAll ResponseOverrideSource = "All"
790+
// ResponseOverrideSourceLocal overrides only Envoy-generated responses (e.g. auth failures, rate limits).
791+
ResponseOverrideSourceLocal ResponseOverrideSource = "Local"
792+
// ResponseOverrideSourceBackend overrides only upstream/backend responses.
793+
ResponseOverrideSourceBackend ResponseOverrideSource = "Backend"
794+
)
795+
783796
// ResponseOverride defines the configuration to override specific responses with a custom one.
784797
// +kubebuilder:validation:XValidation:rule="(has(self.response) && !has(self.redirect)) || (!has(self.response) && has(self.redirect))",message="exactly one of response or redirect must be specified"
785798
type ResponseOverride struct {
@@ -789,6 +802,14 @@ type ResponseOverride struct {
789802
Response *CustomResponse `json:"response,omitempty"`
790803
// Redirect configuration
791804
Redirect *CustomRedirect `json:"redirect,omitempty"`
805+
806+
// Source specifies which responses this rule applies to.
807+
// Local overrides only Envoy-generated responses (e.g. auth failures).
808+
// Backend overrides only upstream responses.
809+
// All (default) overrides both.
810+
//
811+
// +optional
812+
Source *ResponseOverrideSource `json:"source,omitempty"`
792813
}
793814

794815
// CustomResponseMatch defines the configuration for matching a user response to return a custom one.

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2538,6 +2538,17 @@ spec:
25382538
If unset, does not override the status of response.
25392539
type: integer
25402540
type: object
2541+
source:
2542+
description: |-
2543+
Source specifies which responses this rule applies to.
2544+
Local overrides only Envoy-generated responses (e.g. auth failures).
2545+
Backend overrides only upstream responses.
2546+
All (default) overrides both.
2547+
enum:
2548+
- All
2549+
- Local
2550+
- Backend
2551+
type: string
25412552
required:
25422553
- match
25432554
type: object

‎charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2537,6 +2537,17 @@ spec:
25372537
If unset, does not override the status of response.
25382538
type: integer
25392539
type: object
2540+
source:
2541+
description: |-
2542+
Source specifies which responses this rule applies to.
2543+
Local overrides only Envoy-generated responses (e.g. auth failures).
2544+
Backend overrides only upstream responses.
2545+
All (default) overrides both.
2546+
enum:
2547+
- All
2548+
- Local
2549+
- Backend
2550+
type: string
25402551
required:
25412552
- match
25422553
type: object

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ require (
5353
go.opentelemetry.io/otel/sdk/metric v1.43.0
5454
go.opentelemetry.io/otel/trace v1.43.0
5555
go.opentelemetry.io/proto/otlp v1.10.0
56-
go.uber.org/zap v1.27.1
56+
go.uber.org/zap v1.28.0
5757
golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
5858
golang.org/x/sync v0.20.0
5959
gomodules.xyz/jsonpatch/v2 v2.5.0

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -699,8 +699,8 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
699699
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
700700
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
701701
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
702-
go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
703-
go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
702+
go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=
703+
go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q=
704704
go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
705705
go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
706706
go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=

‎internal/gatewayapi/backendtrafficpolicy.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1876,6 +1876,7 @@ func (t *Translator) buildResponseOverride(policy *egv1a1.BackendTrafficPolicy)
18761876
Name: defaultResponseOverrideRuleName(policy, index),
18771877
Match: match,
18781878
Redirect: redirect,
1879+
Source: sourceFromAPI(ro.Source),
18791880
})
18801881
} else {
18811882
response := &ir.CustomResponse{
@@ -1914,6 +1915,7 @@ func (t *Translator) buildResponseOverride(policy *egv1a1.BackendTrafficPolicy)
19141915
Name: defaultResponseOverrideRuleName(policy, index),
19151916
Match: match,
19161917
Response: response,
1918+
Source: sourceFromAPI(ro.Source),
19171919
})
19181920
}
19191921
}
@@ -2003,6 +2005,13 @@ func (t *Translator) resolveLocalObjectRefsInPolicy(policy *egv1a1.BackendTraffi
20032005
return nil
20042006
}
20052007

2008+
func sourceFromAPI(s *egv1a1.ResponseOverrideSource) egv1a1.ResponseOverrideSource {
2009+
if s == nil {
2010+
return ""
2011+
}
2012+
return *s
2013+
}
2014+
20062015
func defaultResponseOverrideRuleName(policy *egv1a1.BackendTrafficPolicy, index int) string {
20072016
return fmt.Sprintf(
20082017
"%s/responseoverride/rule/%s",

‎internal/gatewayapi/testdata/backendtrafficpolicy-with-response-override-source.in.yaml‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
gateways:
2+
- apiVersion: gateway.networking.k8s.io/v1
3+
kind: Gateway
4+
metadata:
5+
namespace: default
6+
name: gateway-1
7+
spec:
8+
gatewayClassName: envoy-gateway-class
9+
listeners:
10+
- name: http
11+
protocol: HTTP
12+
port: 80
13+
allowedRoutes:
14+
namespaces:
15+
from: All
16+
httpRoutes:
17+
- apiVersion: gateway.networking.k8s.io/v1
18+
kind: HTTPRoute
19+
metadata:
20+
namespace: default
21+
name: httproute-local
22+
spec:
23+
hostnames:
24+
- local.envoyproxy.io
25+
parentRefs:
26+
- namespace: default
27+
name: gateway-1
28+
sectionName: http
29+
rules:
30+
- matches:
31+
- path:
32+
value: "/"
33+
backendRefs:
34+
- name: service-1
35+
port: 8080
36+
- apiVersion: gateway.networking.k8s.io/v1
37+
kind: HTTPRoute
38+
metadata:
39+
namespace: default
40+
name: httproute-backend
41+
spec:
42+
hostnames:
43+
- backend.envoyproxy.io
44+
parentRefs:
45+
- namespace: default
46+
name: gateway-1
47+
sectionName: http
48+
rules:
49+
- matches:
50+
- path:
51+
value: "/"
52+
backendRefs:
53+
- name: service-1
54+
port: 8080
55+
- apiVersion: gateway.networking.k8s.io/v1
56+
kind: HTTPRoute
57+
metadata:
58+
namespace: default
59+
name: httproute-all
60+
spec:
61+
hostnames:
62+
- all.envoyproxy.io
63+
parentRefs:
64+
- namespace: default
65+
name: gateway-1
66+
sectionName: http
67+
rules:
68+
- matches:
69+
- path:
70+
value: "/"
71+
backendRefs:
72+
- name: service-1
73+
port: 8080
74+
backendTrafficPolicies:
75+
- apiVersion: gateway.envoyproxy.io/v1alpha1
76+
kind: BackendTrafficPolicy
77+
metadata:
78+
namespace: default
79+
name: policy-local-source
80+
spec:
81+
targetRef:
82+
group: gateway.networking.k8s.io
83+
kind: Gateway
84+
name: gateway-1
85+
responseOverride:
86+
- match:
87+
statusCodes:
88+
- type: Value
89+
value: 401
90+
source: Local
91+
response:
92+
contentType: application/json
93+
body:
94+
type: Inline
95+
inline: '{"error": "Unauthorized"}'
96+
- apiVersion: gateway.envoyproxy.io/v1alpha1
97+
kind: BackendTrafficPolicy
98+
metadata:
99+
namespace: default
100+
name: policy-backend-source
101+
spec:
102+
targetRef:
103+
group: gateway.networking.k8s.io
104+
kind: HTTPRoute
105+
name: httproute-backend
106+
responseOverride:
107+
- match:
108+
statusCodes:
109+
- type: Value
110+
value: 500
111+
source: Backend
112+
response:
113+
contentType: application/json
114+
body:
115+
type: Inline
116+
inline: '{"error": "Internal Server Error"}'
117+
- apiVersion: gateway.envoyproxy.io/v1alpha1
118+
kind: BackendTrafficPolicy
119+
metadata:
120+
namespace: default
121+
name: policy-all-source
122+
spec:
123+
targetRef:
124+
group: gateway.networking.k8s.io
125+
kind: HTTPRoute
126+
name: httproute-all
127+
responseOverride:
128+
- match:
129+
statusCodes:
130+
- type: Value
131+
value: 404
132+
source: All
133+
response:
134+
contentType: text/plain
135+
body:
136+
type: Inline
137+
inline: "Not Found"

0 commit comments

Comments
 (0)