Wildcard add Geo , Waf and L4 plugin functionality to the gateway - #147
Open
senner wants to merge 2 commits into
Open
Wildcard add Geo , Waf and L4 plugin functionality to the gateway#147senner wants to merge 2 commits into
senner wants to merge 2 commits into
Conversation
The upstream controller builds the Caddy config solely from Gateway/HTTPRoute resources and replaces the whole config on every admin-API /load. That discards the data plane's bootstrap pre-filter (geo-block via `blocker`, the Coraza WAF, and any `rate_limit`), so those edge policies never actually run once the controller reconciles. Add an optional pre-filter: when CADDY_PREFILTER_PATH names a file holding a JSON array of Caddy HTTP handler objects, prepend a single non-terminal, matcher-less Route carrying those handlers to every HTTP server. It runs before all route-derived handlers and falls through when it doesn't block, so geo/WAF/ rate_limit survive every reconcile. Handlers are emitted verbatim via a new RawHandler type (the plugins have no Go types here). Unset env = no-op (backwards compatible); a configured-but-unreadable/invalid file fails the reconcile loudly (data plane keeps its last-good config). Mount the policy as a ConfigMap and point CADDY_PREFILTER_PATH at it.
CheckGatewayRouteKindAllowed iterated every listener on the Gateway and
rejected a route as soon as ANY kind-restricted listener disallowed the
route's kind -- without checking whether the route actually targets that
listener. A single TCP listener with allowedRoutes.kinds=[TCPRoute] (e.g.
an LDAPS L4 listener) therefore rejected EVERY HTTPRoute on a shared
Gateway with reason NotAllowedByListeners ("route kind restrictions"),
taking down all L7 routing.
Skip listeners the route does not target via sectionName, mirroring the
existing guard in CheckGatewayAllowedForNamespace. Routes without a
sectionName keep their previous (evaluate-all) behavior.
Adds a table test reproducing the incident.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.