api: ext-proc timeout, fail-open, backendRefs

api/v1alpha1/ext_proc_types.go

@@ -14,8 +14,21 @@ import (
 //
 // ExtProc defines the configuration for External Processing filter.
 type ExtProc struct {
-	// Service defines the configuration of the external processing service
+	// BackendRef defines the configuration of the external processing service
 	BackendRef ExtProcBackendRef `json:"backendRef"`
+
+	// MessageTimeout is the timeout for a response to be returned from the external processor
+	// Default: 200ms
+	//
+	// +optional
+	MessageTimeout *gwapiv1.Duration `json:"messageTimeout,omitempty"`
+
+	// FailOpen defines if requests or responses that cannot be processed due to connectivity to the
+	// external processor are terminated or passed-through.
+	// Default: false
+	//
+	// +optional
+	FailOpen *bool `json:"failOpen,omitempty"`
 }
 
 // ExtProcService defines the gRPC External Processing service using the envoy grpc client

charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml

@@ -58,7 +58,7 @@ spec:
                     filter.
                   properties:
                     backendRef:
-                      description: Service defines the configuration of the external
+                      description: BackendRef defines the configuration of the external
                         processing service
                       properties:
                         group:
@@ -134,6 +134,18 @@ spec:
                       - message: Must have port for Service reference
                         rule: '(size(self.group) == 0 && self.kind == ''Service'')
                           ? has(self.port) : true'
+                    failOpen:
+                      description: |-
+                        FailOpen defines if requests or responses that cannot be processed due to connectivity to the
+                        external processor are terminated or passed-through.
+                        Default: false
+                      type: boolean
+                    messageTimeout:
+                      description: |-
+                        MessageTimeout is the timeout for a response to be returned from the external processor
+                        Default: 200ms
+                      pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+                      type: string
                   required:
                   - backendRef
                   type: object

site/content/en/latest/api/extension_types.md

@@ -1018,7 +1018,9 @@ _Appears in:_
 
 | Field | Type | Required | Description |
 | ---   | ---  | ---      | ---         |
-| `backendRef` | _[ExtProcBackendRef](#extprocbackendref)_ |  true  | Service defines the configuration of the external processing service |
+| `backendRef` | _[ExtProcBackendRef](#extprocbackendref)_ |  true  | BackendRef defines the configuration of the external processing service |
+| `messageTimeout` | _[Duration](#duration)_ |  false  | MessageTimeout is the timeout for a response to be returned from the external processor<br />Default: 200ms |
+| `failOpen` | _boolean_ |  false  | FailOpen defines if requests or responses that cannot be processed due to connectivity to the<br />external processor are terminated or passed-through.<br />Default: false |
 
 
 #### ExtProcBackendRef

test/cel-validation/envoyextensionpolicy_test.go

@@ -11,6 +11,8 @@ package celvalidation
 import (
 	"context"
 	"fmt"
+	"k8s.io/utils/ptr"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 	"strings"
 	"testing"
 	"time"
@@ -151,6 +153,85 @@ func TestEnvoyExtensionPolicyTarget(t *testing.T) {
 				"spec.targetRef: Invalid value: \"object\": this policy does not yet support the sectionName field",
 			},
 		},
+
+		// ExtProc
+		{
+			desc: "ExtProc with BackendRef",
+			mutate: func(sp *egv1a1.EnvoyExtensionPolicy) {
+				sp.Spec = egv1a1.EnvoyExtensionPolicySpec{
+					ExtProc: []egv1a1.ExtProc{
+						{
+							BackendRef: egv1a1.ExtProcBackendRef{
+								BackendObjectReference: gwapiv1.BackendObjectReference{
+									Name: "grpc-proc-service",
+									Port: ptr.To(gwapiv1.PortNumber(80)),
+								},
+							},
+						},
+					},
+					TargetRef: gwapiv1a2.PolicyTargetReferenceWithSectionName{
+						PolicyTargetReference: gwapiv1a2.PolicyTargetReference{
+							Group: "gateway.networking.k8s.io",
+							Kind:  "Gateway",
+							Name:  "eg",
+						},
+					},
+				}
+			},
+			wantErrors: []string{},
+		},
+		{
+			desc: "ExtProc with invalid BackendRef Group",
+			mutate: func(sp *egv1a1.EnvoyExtensionPolicy) {
+				sp.Spec = egv1a1.EnvoyExtensionPolicySpec{
+					ExtProc: []egv1a1.ExtProc{
+						{
+							BackendRef: egv1a1.ExtProcBackendRef{
+								BackendObjectReference: gwapiv1.BackendObjectReference{
+									Group: ptr.To(gwapiv1.Group("unsupported")),
+									Name: "grpc-proc-service",
+									Port: ptr.To(gwapiv1.PortNumber(80)),
+								},
+							},
+						},
+					},
+					TargetRef: gwapiv1a2.PolicyTargetReferenceWithSectionName{
+						PolicyTargetReference: gwapiv1a2.PolicyTargetReference{
+							Group: "gateway.networking.k8s.io",
+							Kind:  "Gateway",
+							Name:  "eg",
+						},
+					},
+				}
+			},
+			wantErrors: []string{"spec.extProc[0]: Invalid value: \"object\": group is invalid, only the core API group (specified by omitting the group field or setting it to an empty string) is supported"},
+		},
+		{
+			desc: "ExtProc with invalid BackendRef Kind",
+			mutate: func(sp *egv1a1.EnvoyExtensionPolicy) {
+				sp.Spec = egv1a1.EnvoyExtensionPolicySpec{
+					ExtProc: []egv1a1.ExtProc{
+						{
+							BackendRef: egv1a1.ExtProcBackendRef{
+								BackendObjectReference: gwapiv1.BackendObjectReference{
+									Kind: ptr.To(gwapiv1.Kind("unsupported")),
+									Name: "grpc-proc-service",
+									Port: ptr.To(gwapiv1.PortNumber(80)),
+								},
+							},
+						},
+					},
+					TargetRef: gwapiv1a2.PolicyTargetReferenceWithSectionName{
+						PolicyTargetReference: gwapiv1a2.PolicyTargetReference{
+							Group: "gateway.networking.k8s.io",
+							Kind:  "Gateway",
+							Name:  "eg",
+						},
+					},
+				}
+			},
+			wantErrors: []string{"spec.extProc[0]: Invalid value: \"object\": kind is invalid, only Service (specified by omitting the kind field or setting it to 'Service') is supported"},
+		},
 	}
 
 	for _, tc := range cases {