feat: add admission control functionality

api/v1alpha1/admission_control.go

@@ -0,0 +1,119 @@
+// Copyright Envoy Gateway Authors
+// SPDX-License-Identifier: Apache-2.0
+// The full text of the Apache license is available in the LICENSE file at
+// the root of the repo.
+
+package v1alpha1
+
+import (
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// AdmissionControl defines the admission control policy to be applied.
+// This configuration probabilistically rejects requests based on the success rate
+// of previous requests in a configurable sliding time window.
+// All fields are optional and will use Envoy's defaults when not specified.
+//
+// +kubebuilder:validation:XValidation:rule="!has(self.successRateThreshold) || (self.successRateThreshold >= 1 && self.successRateThreshold <= 100)",message="successRateThreshold must be between 1 and 100"
+// +kubebuilder:validation:XValidation:rule="!has(self.maxRejectionProbability) || (self.maxRejectionProbability >= 0 && self.maxRejectionProbability <= 100)",message="maxRejectionProbability must be between 0 and 100"
+type AdmissionControl struct {
+	// SamplingWindow defines the time window over which request success rates are calculated.
+	// Defaults to 30s if not specified.
+	//
+	// +optional
+	SamplingWindow *gwapiv1.Duration `json:"samplingWindow,omitempty"`
+
+	// SuccessRateThreshold is the lowest request success rate, as a percentage in the
+	// range [1, 100], at which the filter will not reject requests. Defaults to 95 if
+	// not specified. Envoy rejects values below 1%, so values lower than 1 are not allowed.
+	//
+	// +optional
+	// +kubebuilder:validation:Minimum=1
+	// +kubebuilder:validation:Maximum=100
+	SuccessRateThreshold *uint32 `json:"successRateThreshold,omitempty"`
+
+	// Aggression controls the rejection probability curve. A value of 1 means a linear
+	// increase in rejection probability as the success rate decreases. Higher values
+	// result in more aggressive rejection at higher success rates.
+	// Envoy requires aggression to be greater than 0 and clamps values below 1 to 1.
+	// Defaults to 1 if not specified.
+	//
+	// +optional
+	// +kubebuilder:validation:Minimum=1
+	Aggression *uint32 `json:"aggression,omitempty"`
+
+	// RPSThreshold defines the minimum requests per second below which requests will
+	// pass through the filter without rejection. Defaults to 0 if not specified.
+	//
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	RPSThreshold *uint32 `json:"rpsThreshold,omitempty"`
+
+	// MaxRejectionProbability represents the upper limit of the rejection probability,
+	// expressed as a percentage in the range [0, 100]. Defaults to 80 if not specified.
+	//
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:validation:Maximum=100
+	MaxRejectionProbability *uint32 `json:"maxRejectionProbability,omitempty"`
+
+	// SuccessCriteria defines what constitutes a successful request for both HTTP and gRPC.
+	//
+	// +optional
+	SuccessCriteria *AdmissionControlSuccessCriteria `json:"successCriteria,omitempty"`
+}
+
+// AdmissionControlSuccessCriteria defines the criteria for determining successful requests.
+type AdmissionControlSuccessCriteria struct {
+	// HTTP defines success criteria for HTTP requests.
+	//
+	// +optional
+	HTTP *HTTPSuccessCriteria `json:"http,omitempty"`
+
+	// GRPC defines success criteria for gRPC requests.
+	//
+	// +optional
+	GRPC *GRPCSuccessCriteria `json:"grpc,omitempty"`
+}
+
+// HTTPSuccessCriteria defines success criteria for HTTP requests.
+type HTTPSuccessCriteria struct {
+	// HTTPSuccessStatus defines HTTP status codes that are considered successful.
+	//
+	// +optional
+	HTTPSuccessStatus []HTTPStatus `json:"httpSuccessStatus,omitempty"`
+}
+
+// GRPCSuccessCode defines gRPC status codes as defined in
+// https://github.com/grpc/grpc/blob/master/doc/statuscodes.md#status-codes-and-their-use-in-grpc.
+// +kubebuilder:validation:Enum=Ok;Cancelled;Unknown;InvalidArgument;DeadlineExceeded;NotFound;AlreadyExists;PermissionDenied;ResourceExhausted;FailedPrecondition;Aborted;OutOfRange;Unimplemented;Internal;Unavailable;DataLoss;Unauthenticated
+type GRPCSuccessCode string
+
+const (
+	GRPCSuccessCodeOk                 GRPCSuccessCode = "Ok"
+	GRPCSuccessCodeCancelled          GRPCSuccessCode = "Cancelled"
+	GRPCSuccessCodeUnknown            GRPCSuccessCode = "Unknown"
+	GRPCSuccessCodeInvalidArgument    GRPCSuccessCode = "InvalidArgument"
+	GRPCSuccessCodeDeadlineExceeded   GRPCSuccessCode = "DeadlineExceeded"
+	GRPCSuccessCodeNotFound           GRPCSuccessCode = "NotFound"
+	GRPCSuccessCodeAlreadyExists      GRPCSuccessCode = "AlreadyExists"
+	GRPCSuccessCodePermissionDenied   GRPCSuccessCode = "PermissionDenied"
+	GRPCSuccessCodeResourceExhausted  GRPCSuccessCode = "ResourceExhausted"
+	GRPCSuccessCodeFailedPrecondition GRPCSuccessCode = "FailedPrecondition"
+	GRPCSuccessCodeAborted            GRPCSuccessCode = "Aborted"
+	GRPCSuccessCodeOutOfRange         GRPCSuccessCode = "OutOfRange"
+	GRPCSuccessCodeUnimplemented      GRPCSuccessCode = "Unimplemented"
+	GRPCSuccessCodeInternal           GRPCSuccessCode = "Internal"
+	GRPCSuccessCodeUnavailable        GRPCSuccessCode = "Unavailable"
+	GRPCSuccessCodeDataLoss           GRPCSuccessCode = "DataLoss"
+	GRPCSuccessCodeUnauthenticated    GRPCSuccessCode = "Unauthenticated"
+)
+
+// GRPCSuccessCriteria defines success criteria for gRPC requests.
+type GRPCSuccessCriteria struct {
+	// GRPCSuccessStatus defines gRPC status codes that are considered successful.
+	// Status codes are defined in https://github.com/grpc/grpc/blob/master/doc/statuscodes.md#status-codes-and-their-use-in-grpc.
+	//
+	// +optional
+	GRPCSuccessStatus []GRPCSuccessCode `json:"grpcSuccessStatus,omitempty"`
+}

api/v1alpha1/backendtrafficpolicy_types.go

@@ -69,6 +69,12 @@ type BackendTrafficPolicySpec struct {
 	// +optional
 	FaultInjection *FaultInjection `json:"faultInjection,omitempty"`
 
+	// AdmissionControl defines the admission control policy to be applied. This configuration
+	// probabilistically rejects requests based on the success rate of previous requests in a
+	// configurable sliding time window.
+	// +optional
+	AdmissionControl *AdmissionControl `json:"admissionControl,omitempty"`
+
 	// UseClientProtocol configures Envoy to prefer sending requests to backends using
 	// the same HTTP protocol that the incoming request used. Defaults to false, which means
 	// that Envoy will use the protocol indicated by the attached BackendRef.

api/v1alpha1/envoyproxy_types.go

@@ -286,7 +286,7 @@ type FilterPosition struct {
 }
 
 // EnvoyFilter defines the type of Envoy HTTP filter.
-// +kubebuilder:validation:Enum=envoy.filters.http.custom_response;envoy.filters.http.health_check;envoy.filters.http.fault;envoy.filters.http.cors;envoy.filters.http.header_mutation;envoy.filters.http.ext_authz;envoy.filters.http.api_key_auth;envoy.filters.http.basic_auth;envoy.filters.http.oauth2;envoy.filters.http.jwt_authn;envoy.filters.http.stateful_session;envoy.filters.http.buffer;envoy.filters.http.lua;envoy.filters.http.ext_proc;envoy.filters.http.wasm;envoy.filters.http.dynamic_modules;envoy.filters.http.geoip;envoy.filters.http.rbac;envoy.filters.http.local_ratelimit;envoy.filters.http.ratelimit;envoy.filters.http.grpc_web;envoy.filters.http.grpc_stats;envoy.filters.http.credential_injector;envoy.filters.http.compressor;envoy.filters.http.dynamic_forward_proxy
+// +kubebuilder:validation:Enum=envoy.filters.http.custom_response;envoy.filters.http.health_check;envoy.filters.http.fault;envoy.filters.http.admission_control;envoy.filters.http.cors;envoy.filters.http.header_mutation;envoy.filters.http.ext_authz;envoy.filters.http.api_key_auth;envoy.filters.http.basic_auth;envoy.filters.http.oauth2;envoy.filters.http.jwt_authn;envoy.filters.http.stateful_session;envoy.filters.http.buffer;envoy.filters.http.lua;envoy.filters.http.ext_proc;envoy.filters.http.wasm;envoy.filters.http.dynamic_modules;envoy.filters.http.geoip;envoy.filters.http.rbac;envoy.filters.http.local_ratelimit;envoy.filters.http.ratelimit;envoy.filters.http.grpc_web;envoy.filters.http.grpc_stats;envoy.filters.http.credential_injector;envoy.filters.http.compressor;envoy.filters.http.dynamic_forward_proxy
 type EnvoyFilter string
 
 const (
@@ -299,6 +299,9 @@ const (
 	// EnvoyFilterFault defines the Envoy HTTP fault filter.
 	EnvoyFilterFault EnvoyFilter = "envoy.filters.http.fault"
 
+	// EnvoyFilterAdmissionControl defines the Envoy HTTP admission control filter.
+	EnvoyFilterAdmissionControl EnvoyFilter = "envoy.filters.http.admission_control"
+
 	// EnvoyFilterCORS defines the Envoy HTTP CORS filter.
 	EnvoyFilterCORS EnvoyFilter = "envoy.filters.http.cors"