Skip to content

Commit fddff27

Browse files
daanvinkendaanvinken
committed
feat: support Filesystem Wasm code source via EnvoyProxy allowlist
Register Wasm modules on EnvoyProxy.spec.wasmModules and reference them by name from EnvoyExtensionPolicy with type Filesystem. Envoy loads the local file via AsyncDataSource.local and skips the control-plane fetch/cache path used by HTTP and Image sources. Includes generated CRD/helm fixtures, API docs, and the jwt DnsCluster fixture update needed for gen-check. Fixes #9448 Signed-off-by: daanvinken <daanvinken@tythus.com>
1 parent 6c72ce4 commit fddff27

31 files changed

Lines changed: 2149 additions & 61 deletions

‎api/v1alpha1/envoyproxy_types.go‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,20 @@ type EnvoyProxySpec struct {
204204
// +optional
205205
DynamicModules []DynamicModuleEntry `json:"dynamicModules,omitempty"`
206206

207+
// WasmModules defines the set of Wasm modules that are allowed to be used by
208+
// EnvoyExtensionPolicy resources with a Filesystem code source. Each entry
209+
// registers a module by a logical name and the absolute path on the Envoy proxy.
210+
//
211+
// The EnvoyProxy owner is responsible for ensuring the Wasm files are available
212+
// on the proxy container's filesystem (e.g., via init containers, custom images,
213+
// or shared volumes). EnvoyExtensionPolicy never carries a raw filesystem path.
214+
//
215+
// +kubebuilder:validation:MaxItems=16
216+
// +listType=map
217+
// +listMapKey=name
218+
// +optional
219+
WasmModules []WasmModuleEntry `json:"wasmModules,omitempty"`
220+
207221
// GeoIP defines shared GeoIP provider configuration for this EnvoyProxy fleet.
208222
//
209223
// +optional

‎api/v1alpha1/wasm_types.go‎

Lines changed: 52 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -74,11 +74,13 @@ type Wasm struct {
7474
//
7575
// +kubebuilder:validation:XValidation:rule="self.type == 'HTTP' ? has(self.http) : !has(self.http)",message="If type is HTTP, http field needs to be set."
7676
// +kubebuilder:validation:XValidation:rule="self.type == 'Image' ? has(self.image) : !has(self.image)",message="If type is Image, image field needs to be set."
77+
// +kubebuilder:validation:XValidation:rule="self.type == 'Filesystem' ? has(self.filesystem) : !has(self.filesystem)",message="If type is Filesystem, filesystem field needs to be set."
78+
// +kubebuilder:validation:XValidation:rule="self.type == 'Filesystem' ? !has(self.pullPolicy) : true",message="PullPolicy is only valid for HTTP and Image code sources."
7779
type WasmCodeSource struct {
7880
// Type is the type of the source of the Wasm code.
79-
// Valid WasmCodeSourceType values are "HTTP" or "Image".
81+
// Valid WasmCodeSourceType values are "HTTP", "Image", or "Filesystem".
8082
//
81-
// +kubebuilder:validation:Enum=HTTP;Image;ConfigMap
83+
// +kubebuilder:validation:Enum=HTTP;Image;Filesystem
8284
// +unionDiscriminator
8385
Type WasmCodeSourceType `json:"type"`
8486

@@ -94,6 +96,16 @@ type WasmCodeSource struct {
9496
// +optional
9597
Image *ImageWasmCodeSource `json:"image,omitempty"`
9698

99+
// Filesystem loads Wasm code from a module registered on the EnvoyProxy
100+
// wasmModules allowlist. The policy references the module by name only;
101+
// the filesystem path is configured by the infrastructure operator on EnvoyProxy.
102+
//
103+
// This source skips the control-plane fetch/cache path used by HTTP and Image
104+
// sources. The operator must ensure the file is present on the Envoy proxy
105+
// (for example via a custom image or volume mount).
106+
// +optional
107+
Filesystem *FilesystemWasmCodeSource `json:"filesystem,omitempty"`
108+
97109
// PullPolicy is the policy to use when pulling the Wasm module by either the HTTP or Image source.
98110
// This field is only applicable when the SHA256 field is not set.
99111
//
@@ -102,12 +114,14 @@ type WasmCodeSource struct {
102114
// Note: EG does not update the Wasm module every time an Envoy proxy requests
103115
// the Wasm module even if the pull policy is set to Always.
104116
// It only updates the Wasm module when the EnvoyExtension resource version changes.
117+
//
118+
// PullPolicy must not be set when Type is Filesystem.
105119
// +optional
106120
PullPolicy *ImagePullPolicy `json:"pullPolicy,omitempty"`
107121
}
108122

109123
// WasmCodeSourceType specifies the types of sources for the Wasm code.
110-
// +kubebuilder:validation:Enum=HTTP;Image
124+
// +kubebuilder:validation:Enum=HTTP;Image;Filesystem
111125
type WasmCodeSourceType string
112126

113127
const (
@@ -116,8 +130,43 @@ const (
116130

117131
// ImageWasmCodeSourceType allows the user to specify the Wasm code in an OCI image.
118132
ImageWasmCodeSourceType WasmCodeSourceType = "Image"
133+
134+
// FilesystemWasmCodeSourceType loads Wasm code from a module registered on EnvoyProxy.
135+
FilesystemWasmCodeSourceType WasmCodeSourceType = "Filesystem"
119136
)
120137

138+
// FilesystemWasmCodeSource references a Wasm module registered in EnvoyProxy.spec.wasmModules.
139+
type FilesystemWasmCodeSource struct {
140+
// Name is the logical name of a module in the EnvoyProxy wasmModules allowlist.
141+
//
142+
// +kubebuilder:validation:MinLength=1
143+
// +kubebuilder:validation:MaxLength=253
144+
// +kubebuilder:validation:Pattern=`^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$`
145+
Name string `json:"name"`
146+
}
147+
148+
// WasmModuleEntry defines a Wasm module that is registered and allowed for use
149+
// by EnvoyExtensionPolicy resources with a Filesystem code source.
150+
type WasmModuleEntry struct {
151+
// Name is the logical name for this module. EnvoyExtensionPolicy resources
152+
// reference modules by this name.
153+
//
154+
// +kubebuilder:validation:MinLength=1
155+
// +kubebuilder:validation:MaxLength=253
156+
// +kubebuilder:validation:Pattern=`^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$`
157+
Name string `json:"name"`
158+
159+
// Path is the absolute filesystem path to the Wasm module on the Envoy proxy.
160+
//
161+
// The EnvoyProxy owner is responsible for ensuring the file is available on
162+
// the proxy container's filesystem (for example via a custom image or volume mount).
163+
//
164+
// +kubebuilder:validation:MinLength=1
165+
// +kubebuilder:validation:MaxLength=4096
166+
// +kubebuilder:validation:Pattern=`^/.*`
167+
Path string `json:"path"`
168+
}
169+
121170
// HTTPWasmCodeSource defines the HTTP URL containing the Wasm code.
122171
type HTTPWasmCodeSource struct {
123172
// URL is the URL containing the Wasm code.

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 40 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml‎

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2025,6 +2025,26 @@ spec:
20252025
code:
20262026
description: Code is the Wasm code for the extension.
20272027
properties:
2028+
filesystem:
2029+
description: |-
2030+
Filesystem loads Wasm code from a module registered on the EnvoyProxy
2031+
wasmModules allowlist. The policy references the module by name only;
2032+
the filesystem path is configured by the infrastructure operator on EnvoyProxy.
2033+
2034+
This source skips the control-plane fetch/cache path used by HTTP and Image
2035+
sources. The operator must ensure the file is present on the Envoy proxy
2036+
(for example via a custom image or volume mount).
2037+
properties:
2038+
name:
2039+
description: Name is the logical name of a module in
2040+
the EnvoyProxy wasmModules allowlist.
2041+
maxLength: 253
2042+
minLength: 1
2043+
pattern: ^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$
2044+
type: string
2045+
required:
2046+
- name
2047+
type: object
20282048
http:
20292049
description: |-
20302050
HTTP is the HTTP URL containing the Wasm code.
@@ -2234,6 +2254,8 @@ spec:
22342254
Note: EG does not update the Wasm module every time an Envoy proxy requests
22352255
the Wasm module even if the pull policy is set to Always.
22362256
It only updates the Wasm module when the EnvoyExtension resource version changes.
2257+
2258+
PullPolicy must not be set when Type is Filesystem.
22372259
enum:
22382260
- IfNotPresent
22392261
- Always
@@ -2243,13 +2265,14 @@ spec:
22432265
- enum:
22442266
- HTTP
22452267
- Image
2268+
- Filesystem
22462269
- enum:
22472270
- HTTP
22482271
- Image
2249-
- ConfigMap
2272+
- Filesystem
22502273
description: |-
22512274
Type is the type of the source of the Wasm code.
2252-
Valid WasmCodeSourceType values are "HTTP" or "Image".
2275+
Valid WasmCodeSourceType values are "HTTP", "Image", or "Filesystem".
22532276
type: string
22542277
required:
22552278
- type
@@ -2259,6 +2282,14 @@ spec:
22592282
rule: 'self.type == ''HTTP'' ? has(self.http) : !has(self.http)'
22602283
- message: If type is Image, image field needs to be set.
22612284
rule: 'self.type == ''Image'' ? has(self.image) : !has(self.image)'
2285+
- message: If type is Filesystem, filesystem field needs to
2286+
be set.
2287+
rule: 'self.type == ''Filesystem'' ? has(self.filesystem)
2288+
: !has(self.filesystem)'
2289+
- message: PullPolicy is only valid for HTTP and Image code
2290+
sources.
2291+
rule: 'self.type == ''Filesystem'' ? !has(self.pullPolicy)
2292+
: true'
22622293
config:
22632294
description: |-
22642295
Config is the configuration for the Wasm extension.

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18111,6 +18111,47 @@ spec:
1811118111
specified
1811218112
rule: '!(has(self.samplingRate) && has(self.samplingFraction))'
1811318113
type: object
18114+
wasmModules:
18115+
description: |-
18116+
WasmModules defines the set of Wasm modules that are allowed to be used by
18117+
EnvoyExtensionPolicy resources with a Filesystem code source. Each entry
18118+
registers a module by a logical name and the absolute path on the Envoy proxy.
18119+
18120+
The EnvoyProxy owner is responsible for ensuring the Wasm files are available
18121+
on the proxy container's filesystem (e.g., via init containers, custom images,
18122+
or shared volumes). EnvoyExtensionPolicy never carries a raw filesystem path.
18123+
items:
18124+
description: |-
18125+
WasmModuleEntry defines a Wasm module that is registered and allowed for use
18126+
by EnvoyExtensionPolicy resources with a Filesystem code source.
18127+
properties:
18128+
name:
18129+
description: |-
18130+
Name is the logical name for this module. EnvoyExtensionPolicy resources
18131+
reference modules by this name.
18132+
maxLength: 253
18133+
minLength: 1
18134+
pattern: ^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$
18135+
type: string
18136+
path:
18137+
description: |-
18138+
Path is the absolute filesystem path to the Wasm module on the Envoy proxy.
18139+
18140+
The EnvoyProxy owner is responsible for ensuring the file is available on
18141+
the proxy container's filesystem (for example via a custom image or volume mount).
18142+
maxLength: 4096
18143+
minLength: 1
18144+
pattern: ^/.*
18145+
type: string
18146+
required:
18147+
- name
18148+
- path
18149+
type: object
18150+
maxItems: 16
18151+
type: array
18152+
x-kubernetes-list-map-keys:
18153+
- name
18154+
x-kubernetes-list-type: map
1811418155
type: object
1811518156
status:
1811618157
description: EnvoyProxyStatus defines the actual state of EnvoyProxy.

‎charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml‎

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2024,6 +2024,26 @@ spec:
20242024
code:
20252025
description: Code is the Wasm code for the extension.
20262026
properties:
2027+
filesystem:
2028+
description: |-
2029+
Filesystem loads Wasm code from a module registered on the EnvoyProxy
2030+
wasmModules allowlist. The policy references the module by name only;
2031+
the filesystem path is configured by the infrastructure operator on EnvoyProxy.
2032+
2033+
This source skips the control-plane fetch/cache path used by HTTP and Image
2034+
sources. The operator must ensure the file is present on the Envoy proxy
2035+
(for example via a custom image or volume mount).
2036+
properties:
2037+
name:
2038+
description: Name is the logical name of a module in
2039+
the EnvoyProxy wasmModules allowlist.
2040+
maxLength: 253
2041+
minLength: 1
2042+
pattern: ^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$
2043+
type: string
2044+
required:
2045+
- name
2046+
type: object
20272047
http:
20282048
description: |-
20292049
HTTP is the HTTP URL containing the Wasm code.
@@ -2233,6 +2253,8 @@ spec:
22332253
Note: EG does not update the Wasm module every time an Envoy proxy requests
22342254
the Wasm module even if the pull policy is set to Always.
22352255
It only updates the Wasm module when the EnvoyExtension resource version changes.
2256+
2257+
PullPolicy must not be set when Type is Filesystem.
22362258
enum:
22372259
- IfNotPresent
22382260
- Always
@@ -2242,13 +2264,14 @@ spec:
22422264
- enum:
22432265
- HTTP
22442266
- Image
2267+
- Filesystem
22452268
- enum:
22462269
- HTTP
22472270
- Image
2248-
- ConfigMap
2271+
- Filesystem
22492272
description: |-
22502273
Type is the type of the source of the Wasm code.
2251-
Valid WasmCodeSourceType values are "HTTP" or "Image".
2274+
Valid WasmCodeSourceType values are "HTTP", "Image", or "Filesystem".
22522275
type: string
22532276
required:
22542277
- type
@@ -2258,6 +2281,14 @@ spec:
22582281
rule: 'self.type == ''HTTP'' ? has(self.http) : !has(self.http)'
22592282
- message: If type is Image, image field needs to be set.
22602283
rule: 'self.type == ''Image'' ? has(self.image) : !has(self.image)'
2284+
- message: If type is Filesystem, filesystem field needs to
2285+
be set.
2286+
rule: 'self.type == ''Filesystem'' ? has(self.filesystem)
2287+
: !has(self.filesystem)'
2288+
- message: PullPolicy is only valid for HTTP and Image code
2289+
sources.
2290+
rule: 'self.type == ''Filesystem'' ? !has(self.pullPolicy)
2291+
: true'
22612292
config:
22622293
description: |-
22632294
Config is the configuration for the Wasm extension.

0 commit comments

Comments
 (0)