feat(ext_proc): add support for observability mode

api/v1alpha1/ext_proc_types.go

@@ -69,6 +69,7 @@ type ExtProcProcessingMode struct {
 // +kubebuilder:validation:XValidation:message="BackendRefs only supports Service, ServiceImport, and Backend kind.",rule="has(self.backendRefs) ? self.backendRefs.all(f, f.kind == 'Service' || f.kind == 'ServiceImport' || f.kind == 'Backend') : true"
 // +kubebuilder:validation:XValidation:message="BackendRefs only supports Core, multicluster.x-k8s.io, and gateway.envoyproxy.io groups.",rule="has(self.backendRefs) ? (self.backendRefs.all(f, f.group == \"\" || f.group == 'multicluster.x-k8s.io' || f.group == 'gateway.envoyproxy.io')) : true"
 // +kubebuilder:validation:XValidation:message="If FullDuplexStreamed body processing mode is used, FailOpen must be false.",rule="!(has(self.failOpen) && self.failOpen == true && has(self.processingMode) && ((has(self.processingMode.request) && has(self.processingMode.request.body) && self.processingMode.request.body == 'FullDuplexStreamed') || (has(self.processingMode.response) && has(self.processingMode.response.body) && self.processingMode.response.body == 'FullDuplexStreamed')))"
+// +kubebuilder:validation:XValidation:message="If shadowMode is enabled, body processing mode must be Streamed or unset.",rule="!(has(self.shadowMode) && self.shadowMode == true && has(self.processingMode) && ((has(self.processingMode.request) && has(self.processingMode.request.body) && self.processingMode.request.body != 'Streamed') || (has(self.processingMode.response) && has(self.processingMode.response.body) && self.processingMode.response.body != 'Streamed')))"
 type ExtProc struct {
 	BackendCluster `json:",inline"`
 
@@ -97,6 +98,15 @@ type ExtProc struct {
 	// +optional
 	ProcessingMode *ExtProcProcessingMode `json:"processingMode,omitempty"`
 
+	// ShadowMode sets if envoy gateway should treat this external processor as "send and go".
+	// When enabled, Envoy forwards request/response data to the external processor but does
+	// not wait for or apply any response from it. This maps to Envoy's `observability_mode`
+	// on the ext_proc filter.
+	// Defaults to false.
+	//
+	// +optional
+	ShadowMode *bool `json:"shadowMode,omitempty"`
+
 	// Metadata defines options related to the sending and receiving of dynamic metadata.
 	// These options define which metadata namespaces would be sent to the processor and which dynamic metadata
 	// namespaces the processor would be permitted to emit metadata to.

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml

@@ -1609,6 +1609,14 @@ spec:
                               type: string
                           type: object
                       type: object
+                    shadowMode:
+                      description: |-
+                        ShadowMode sets if envoy gateway should treat this external processor as "send and go".
+                        When enabled, Envoy forwards request/response data to the external processor but does
+                        not wait for or apply any response from it. This maps to Envoy's `observability_mode`
+                        on the ext_proc filter.
+                        Defaults to false.
+                      type: boolean
                     statusOnError:
                       description: |-
                         Sets the HTTP status that is returned to the client when the external processor returns an error
@@ -1675,6 +1683,13 @@ spec:
                       && self.processingMode.request.body == ''FullDuplexStreamed'')
                       || (has(self.processingMode.response) && has(self.processingMode.response.body)
                       && self.processingMode.response.body == ''FullDuplexStreamed'')))'
+                  - message: If shadowMode is enabled, body processing mode must be
+                      Streamed or unset.
+                    rule: '!(has(self.shadowMode) && self.shadowMode == true && has(self.processingMode)
+                      && ((has(self.processingMode.request) && has(self.processingMode.request.body)
+                      && self.processingMode.request.body != ''Streamed'') || (has(self.processingMode.response)
+                      && has(self.processingMode.response.body) && self.processingMode.response.body
+                      != ''Streamed'')))'
                 maxItems: 16
                 type: array
               lua:

charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml

@@ -1608,6 +1608,14 @@ spec:
                               type: string
                           type: object
                       type: object
+                    shadowMode:
+                      description: |-
+                        ShadowMode sets if envoy gateway should treat this external processor as "send and go".
+                        When enabled, Envoy forwards request/response data to the external processor but does
+                        not wait for or apply any response from it. This maps to Envoy's `observability_mode`
+                        on the ext_proc filter.
+                        Defaults to false.
+                      type: boolean
                     statusOnError:
                       description: |-
                         Sets the HTTP status that is returned to the client when the external processor returns an error
@@ -1674,6 +1682,13 @@ spec:
                       && self.processingMode.request.body == ''FullDuplexStreamed'')
                       || (has(self.processingMode.response) && has(self.processingMode.response.body)
                       && self.processingMode.response.body == ''FullDuplexStreamed'')))'
+                  - message: If shadowMode is enabled, body processing mode must be
+                      Streamed or unset.
+                    rule: '!(has(self.shadowMode) && self.shadowMode == true && has(self.processingMode)
+                      && ((has(self.processingMode.request) && has(self.processingMode.request.body)
+                      && self.processingMode.request.body != ''Streamed'') || (has(self.processingMode.response)
+                      && has(self.processingMode.response.body) && self.processingMode.response.body
+                      != ''Streamed'')))'
                 maxItems: 16
                 type: array
               lua:

internal/gatewayapi/envoyextensionpolicy.go

@@ -890,6 +890,10 @@ func (t *Translator) buildExtProc(
 		extProcIR.MessageTimeout = ir.MetaV1DurationPtr(d)
 	}
 
+	if extProc.ShadowMode != nil {
+		extProcIR.ShadowMode = extProc.ShadowMode
+	}
+
 	if extProc.FailOpen != nil {
 		extProcIR.FailOpen = extProc.FailOpen
 	}

internal/gatewayapi/testdata/envoyextensionpolicy-shadowmode.in.yaml

@@ -0,0 +1,85 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: default
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - namespace: default
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: /foo
+      backendRefs:
+      - name: service-1
+        port: 8080
+services:
+- apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: default
+    name: grpc-backend
+  spec:
+    ports:
+    - port: 9000
+      name: grpc
+      protocol: TCP
+endpointSlices:
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-grpc-backend
+    namespace: default
+    labels:
+      kubernetes.io/service-name: grpc-backend
+  addressType: IPv4
+  ports:
+  - name: grpc
+    protocol: TCP
+    port: 9000
+  endpoints:
+  - addresses:
+    - 8.8.8.8
+    conditions:
+      ready: true
+envoyExtensionPolicies:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: EnvoyExtensionPolicy
+  metadata:
+    namespace: default
+    name: policy-for-http-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+    extProc:
+    - backendRefs:
+      - Name: grpc-backend
+        Port: 9000
+      shadowMode: true
+      processingMode:
+        request:
+          body: Streamed
+        response:
+          body: Streamed