api: add CSRF origin validation to SecurityPolicy

Add native CSRF protection to SecurityPolicy following the CORS pattern.
The CSRF filter validates the Origin header on mutating requests (POST,
PUT, DELETE, PATCH) against the destination and additional allowed origins.

API: SecurityPolicy.csrf with additionalOrigins []StringMatch
IR: CSRF struct in SecurityFeatures
xDS: csrf.go implementing httpFilter interface (disabled at HCM 0%,
enabled per-route 100%)

Fixes #8835

Signed-off-by: asalvador <asalvador@newrelic.com>

Author: albsga4

.github/workflows/build_and_test.yaml

@@ -181,10 +181,6 @@ jobs:
           ipFamily: ipv4
           profile: xds-name-scheme-v2
           gwapiChannel: experimental
-        - version: v1.35.0
-          ipFamily: ipv4
-          profile: watch-namespaces
-          gwapiChannel: experimental
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
     - uses: ./tools/github-actions/setup-deps
@@ -241,9 +237,6 @@ jobs:
         - version: v1.35.0
           ipFamily: ipv4
           profile: xds-name-scheme-v2
-        - version: v1.35.0
-          ipFamily: ipv4
-          profile: watch-namespaces
 
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2

.github/workflows/experimental_conformance.yaml

@@ -45,9 +45,6 @@ jobs:
             # only run dual test on latest version to save time
             ipFamily: dual
             profile: gateway-namespace-mode
-          - version: v1.35.0
-            ipFamily: ipv4
-            profile: watch-namespaces
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - uses: ./tools/github-actions/setup-deps

api/v1alpha1/csrf_types.go

@@ -0,0 +1,19 @@
+// Copyright Envoy Gateway Authors
+// SPDX-License-Identifier: Apache-2.0
+// The full text of the Apache license is available in the LICENSE file at
+// the root of the repo.
+
+package v1alpha1
+
+// CSRF defines the configuration for the Cross-Site Request Forgery (CSRF) filter.
+// The CSRF filter checks that the Origin header in HTTP requests matches the destination,
+// preventing cross-origin mutating requests (POST, PUT, DELETE, PATCH) from being processed.
+// GET and HEAD requests are always allowed.
+type CSRF struct {
+	// AdditionalOrigins specifies additional origins that are allowed to make requests.
+	// These are checked against the Origin header and if matched, the request is allowed.
+	// Each origin can be an exact, prefix, suffix, or regex match using StringMatch.
+	//
+	// +optional
+	AdditionalOrigins []StringMatch `json:"additionalOrigins,omitempty"`
+}

api/v1alpha1/fault_injection.go

@@ -53,8 +53,6 @@ type FaultInjectionAbort struct {
 	// GrpcStatus specifies the GRPC status code to be returned
 	//
 	// +optional
-	// +kubebuilder:validation:Minimum=0
-	// +kubebuilder:validation:Maximum=16
 	GrpcStatus *int32 `json:"grpcStatus,omitempty"`
 
 	// Percentage specifies the percentage of requests to be aborted. Default 100%, if set 0, no requests will be aborted. Accuracy to 0.0001%.

api/v1alpha1/securitypolicy_types.go

@@ -73,6 +73,13 @@ type SecurityPolicySpec struct {
 	// +optional
 	CORS *CORS `json:"cors,omitempty"`
 
+	// CSRF defines the configuration for Cross-Site Request Forgery (CSRF) protection.
+	// When enabled, the CSRF filter checks that the Origin header matches the destination
+	// or one of the additional allowed origins on mutating requests (POST, PUT, DELETE, PATCH).
+	//
+	// +optional
+	CSRF *CSRF `json:"csrf,omitempty"`
+
 	// BasicAuth defines the configuration for the HTTP Basic Authentication.
 	//
 	// +optional

api/v1alpha1/zz_generated.deepcopy.go

@@ -349,8 +349,6 @@ spec:
                         description: GrpcStatus specifies the GRPC status code to
                           be returned
                         format: int32
-                        maximum: 16
-                        minimum: 0
                         type: integer
                       httpStatus:
                         description: StatusCode specifies the HTTP status code to

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml

@@ -618,6 +618,43 @@ spec:
                     pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
                     type: string
                 type: object
+              csrf:
+                description: |-
+                  CSRF defines the configuration for Cross-Site Request Forgery (CSRF) protection.
+                  When enabled, the CSRF filter checks that the Origin header matches the destination
+                  or one of the additional allowed origins on mutating requests (POST, PUT, DELETE, PATCH).
+                properties:
+                  additionalOrigins:
+                    description: |-
+                      AdditionalOrigins specifies additional origins that are allowed to make requests.
+                      These are checked against the Origin header and if matched, the request is allowed.
+                      Each origin can be an exact, prefix, suffix, or regex match using StringMatch.
+                    items:
+                      description: |-
+                        StringMatch defines how to match any strings.
+                        This is a general purpose match condition that can be used by other EG APIs
+                        that need to match against a string.
+                      properties:
+                        type:
+                          default: Exact
+                          description: Type specifies how to match against a string.
+                          enum:
+                          - Exact
+                          - Prefix
+                          - Suffix
+                          - RegularExpression
+                          type: string
+                        value:
+                          description: Value specifies the string value that the match
+                            must have.
+                          maxLength: 1024
+                          minLength: 1
+                          type: string
+                      required:
+                      - value
+                      type: object
+                    type: array
+                type: object
               extAuth:
                 description: ExtAuth defines the configuration for External Authorization.
                 properties:

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml

@@ -88,8 +88,6 @@ helm uninstall eg -n envoy-gateway-system
 | deployment.pod.affinity | object | `{}` |  |
 | deployment.pod.annotations."prometheus.io/port" | string | `"19001"` |  |
 | deployment.pod.annotations."prometheus.io/scrape" | string | `"true"` |  |
-| deployment.pod.extraVolumeMounts | list | `[]` |  |
-| deployment.pod.extraVolumes | list | `[]` |  |
 | deployment.pod.labels | object | `{}` |  |
 | deployment.pod.nodeSelector | object | `{}` |  |
 | deployment.pod.tolerations | list | `[]` |  |

charts/gateway-helm/README.md

@@ -348,8 +348,6 @@ spec:
                         description: GrpcStatus specifies the GRPC status code to
                           be returned
                         format: int32
-                        maximum: 16
-                        minimum: 0
                         type: integer
                       httpStatus:
                         description: StatusCode specifies the HTTP status code to