Skip to content

Commit d458767

Browse files
yuval-kyuval-k
authored
Per port config for ListenerPolicy (#13038)
Signed-off-by: Yuval Kohavi <[email protected]>
1 parent 57fbc1e commit d458767

File tree

34 files changed

+1095
-73
lines changed

34 files changed

+1095
-73
lines changed

‎api/v1alpha1/kgateway/listener_policy_types.go‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,42 @@ type ListenerPolicySpec struct {
5454
// +kubebuilder:validation:XValidation:rule="self.all(r, r.kind == 'Gateway' && (!has(r.group) || r.group == 'gateway.networking.k8s.io'))",message="targetSelectors may only reference Gateway resource"
5555
TargetSelectors []shared.LocalPolicyTargetSelector `json:"targetSelectors,omitempty"`
5656

57+
// Default specifies default listener configuration for all Listeners, unless a per-port
58+
// configuration is defined.
59+
// +optional
60+
Default *ListenerConfig `json:"default,omitempty"`
61+
62+
// Per port configuration allows overriding the listener config per port. Once set, this
63+
// configuration completely replaces the default configuration for all listeners handling traffic
64+
// that match this port. Unspecified fields in per-port configuration will not inherit values from default.
65+
//
66+
// +optional
67+
// +listType=map
68+
// +listMapKey=port
69+
// +kubebuilder:validation:MaxItems=64
70+
// +kubebuilder:validation:XValidation:message="Port for listener configuration must be unique within the Gateway",rule="self.all(t1, self.exists_one(t2, t1.port == t2.port))"
71+
PerPort []ListenerPortConfig `json:"perPort,omitempty"`
72+
}
73+
74+
type ListenerPortConfig struct {
75+
// The Port indicates the Port Number to which the Listener configuration will be
76+
// applied. This configuration will be applied to all Listeners handling
77+
// traffic that match this port.
78+
//
79+
// +required
80+
// +kubebuilder:validation:Minimum=1
81+
// +kubebuilder:validation:Maximum=65535
82+
Port int32 `json:"port"`
83+
84+
// Listener stores the configuration that will be applied to all Listeners handling
85+
// matching the given port.
86+
//
87+
// +required
88+
Listener ListenerConfig `json:"listener"`
89+
}
90+
91+
type ListenerConfig struct {
92+
5793
// ProxyProtocol configures the PROXY protocol listener filter.
5894
// When set, Envoy will expect connections to include the PROXY protocol header.
5995
// This is commonly used when kgateway is behind a load balancer that preserves client IP information.

‎api/v1alpha1/kgateway/zz_generated.deepcopy.go‎

Lines changed: 51 additions & 8 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎examples/plugin/main.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -189,7 +189,7 @@ func (s *ourPolicyPass) ApplyForRoute(pCtx *ir.RouteContext, out *envoyroutev3.R
189189
return nil
190190
}
191191

192-
func (s *ourPolicyPass) HttpFilters(fc ir.FilterChainCommon) ([]filters.StagedHttpFilter, error) {
192+
func (s *ourPolicyPass) HttpFilters(_ ir.HttpFiltersContext, fc ir.FilterChainCommon) ([]filters.StagedHttpFilter, error) {
193193
if !s.filterNeeded[fc.FilterChainName] {
194194
return nil, nil
195195
}

‎install/helm/kgateway-crds/templates/gateway.kgateway.dev_listenerpolicies.yaml‎

Lines changed: 75 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -57,24 +57,83 @@ spec:
5757
description: ListenerPolicySpec defines the desired state of a listener
5858
policy.
5959
properties:
60-
perConnectionBufferLimitBytes:
60+
default:
6161
description: |-
62-
PerConnectionBufferLimitBytes sets the per-connection buffer limit for all listeners on the gateway.
63-
This controls the maximum size of read and write buffers for new connections.
64-
When using Envoy as an edge proxy, configuring the listener buffer limit is important to guard against
65-
potential attacks or misconfigured downstreams that could hog the proxy's resources.
66-
If unspecified, an implementation-defined default is applied (1MiB).
67-
See here for more information: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener.proto#envoy-v3-api-field-config-listener-v3-listener-per-connection-buffer-limit-bytes
68-
format: int32
69-
minimum: 0
70-
type: integer
71-
proxyProtocol:
72-
description: |-
73-
ProxyProtocol configures the PROXY protocol listener filter.
74-
When set, Envoy will expect connections to include the PROXY protocol header.
75-
This is commonly used when kgateway is behind a load balancer that preserves client IP information.
76-
See here for more information: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/listener/proxy_protocol/v3/proxy_protocol.proto
62+
Default specifies default listener configuration for all Listeners, unless a per-port
63+
configuration is defined.
64+
properties:
65+
perConnectionBufferLimitBytes:
66+
description: |-
67+
PerConnectionBufferLimitBytes sets the per-connection buffer limit for all listeners on the gateway.
68+
This controls the maximum size of read and write buffers for new connections.
69+
When using Envoy as an edge proxy, configuring the listener buffer limit is important to guard against
70+
potential attacks or misconfigured downstreams that could hog the proxy's resources.
71+
If unspecified, an implementation-defined default is applied (1MiB).
72+
See here for more information: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener.proto#envoy-v3-api-field-config-listener-v3-listener-per-connection-buffer-limit-bytes
73+
format: int32
74+
minimum: 0
75+
type: integer
76+
proxyProtocol:
77+
description: |-
78+
ProxyProtocol configures the PROXY protocol listener filter.
79+
When set, Envoy will expect connections to include the PROXY protocol header.
80+
This is commonly used when kgateway is behind a load balancer that preserves client IP information.
81+
See here for more information: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/listener/proxy_protocol/v3/proxy_protocol.proto
82+
type: object
7783
type: object
84+
perPort:
85+
description: |-
86+
Per port configuration allows overriding the listener config per port. Once set, this
87+
configuration completely replaces the default configuration for all listeners handling traffic
88+
that match this port. Unspecified fields in per-port configuration will not inherit values from default.
89+
items:
90+
properties:
91+
listener:
92+
description: |-
93+
Listener stores the configuration that will be applied to all Listeners handling
94+
matching the given port.
95+
properties:
96+
perConnectionBufferLimitBytes:
97+
description: |-
98+
PerConnectionBufferLimitBytes sets the per-connection buffer limit for all listeners on the gateway.
99+
This controls the maximum size of read and write buffers for new connections.
100+
When using Envoy as an edge proxy, configuring the listener buffer limit is important to guard against
101+
potential attacks or misconfigured downstreams that could hog the proxy's resources.
102+
If unspecified, an implementation-defined default is applied (1MiB).
103+
See here for more information: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener.proto#envoy-v3-api-field-config-listener-v3-listener-per-connection-buffer-limit-bytes
104+
format: int32
105+
minimum: 0
106+
type: integer
107+
proxyProtocol:
108+
description: |-
109+
ProxyProtocol configures the PROXY protocol listener filter.
110+
When set, Envoy will expect connections to include the PROXY protocol header.
111+
This is commonly used when kgateway is behind a load balancer that preserves client IP information.
112+
See here for more information: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/listener/proxy_protocol/v3/proxy_protocol.proto
113+
type: object
114+
type: object
115+
port:
116+
description: |-
117+
The Port indicates the Port Number to which the Listener configuration will be
118+
applied. This configuration will be applied to all Listeners handling
119+
traffic that match this port.
120+
format: int32
121+
maximum: 65535
122+
minimum: 1
123+
type: integer
124+
required:
125+
- listener
126+
- port
127+
type: object
128+
maxItems: 64
129+
type: array
130+
x-kubernetes-list-map-keys:
131+
- port
132+
x-kubernetes-list-type: map
133+
x-kubernetes-validations:
134+
- message: Port for listener configuration must be unique within the
135+
Gateway
136+
rule: self.all(t1, self.exists_one(t2, t1.port == t2.port))
78137
targetRefs:
79138
description: |-
80139
TargetRefs specifies the target resources by reference to attach the policy to.

‎pkg/kgateway/agentgatewaysyncer/backend/inferencepool/plugin.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -268,7 +268,7 @@ func (p *endpointPickerPass) ApplyForBackend(
268268
}
269269

270270
// HttpFilters returns one ext_proc filter, using the well-known filter name.
271-
func (p *endpointPickerPass) HttpFilters(fc ir.FilterChainCommon) ([]filters.StagedHttpFilter, error) {
271+
func (p *endpointPickerPass) HttpFilters(_ ir.HttpFiltersContext, fc ir.FilterChainCommon) ([]filters.StagedHttpFilter, error) {
272272
if p == nil || len(p.usedPools) == 0 {
273273
return nil, nil
274274
}

‎pkg/kgateway/extensions2/plugins/backend/plugin.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -292,7 +292,7 @@ func (p *backendPlugin) ApplyForBackend(pCtx *ir.RouteBackendContext, in ir.Http
292292
// called 1 time per listener
293293
// if a plugin emits new filters, they must be with a plugin unique name.
294294
// any filter returned from route config must be disabled, so it doesnt impact other routes.
295-
func (p *backendPlugin) HttpFilters(fc ir.FilterChainCommon) ([]filters.StagedHttpFilter, error) {
295+
func (p *backendPlugin) HttpFilters(_ ir.HttpFiltersContext, fc ir.FilterChainCommon) ([]filters.StagedHttpFilter, error) {
296296
result := []filters.StagedHttpFilter{}
297297

298298
var errs []error

‎pkg/kgateway/extensions2/plugins/httplistenerpolicy/httplistener_plugin.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -408,7 +408,7 @@ func (p *httpListenerPolicyPluginGwPass) ApplyHCM(
408408
return nil
409409
}
410410

411-
func (p *httpListenerPolicyPluginGwPass) HttpFilters(fc ir.FilterChainCommon) ([]filters.StagedHttpFilter, error) {
411+
func (p *httpListenerPolicyPluginGwPass) HttpFilters(hCtx ir.HttpFiltersContext, fc ir.FilterChainCommon) ([]filters.StagedHttpFilter, error) {
412412
if p.healthCheckPolicy == nil {
413413
return nil, nil
414414
}

0 commit comments

Comments
 (0)