Setting FailureMode from ENV

controllers/envoy_gateway_extension_reconciler.go

@@ -209,7 +209,7 @@ func (r *EnvoyGatewayExtensionReconciler) buildWasmConfigs(ctx context.Context,
 	wasmConfigs := lo.MapValues(wasmActionSets.Sorted(), func(configs kuadrantgatewayapi.SortableHTTPRouteMatchConfigs, _ string) wasm.Config {
 		return wasm.BuildConfigForActionSet(lo.Map(configs, func(c kuadrantgatewayapi.HTTPRouteMatchConfig, _ int) wasm.ActionSet {
 			return c.Config.(wasm.ActionSet)
-		}))
+		}), &logger)
 	})
 
 	return wasmConfigs, nil

controllers/istio_extension_reconciler.go

@@ -212,7 +212,7 @@ func (r *IstioExtensionReconciler) buildWasmConfigs(ctx context.Context, state *
 	wasmConfigs := lo.MapValues(wasmActionSets.Sorted(), func(configs kuadrantgatewayapi.SortableHTTPRouteMatchConfigs, _ string) wasm.Config {
 		return wasm.BuildConfigForActionSet(lo.Map(configs, func(c kuadrantgatewayapi.HTTPRouteMatchConfig, _ int) wasm.ActionSet {
 			return c.Config.(wasm.ActionSet)
-		}))
+		}), &logger)
 	})
 
 	return wasmConfigs, nil

pkg/wasm/utils.go

@@ -6,8 +6,11 @@
 	"encoding/json"
 	"errors"
 	"fmt"
+	"os"
 	"strings"
 
+	"github.com/go-logr/logr"
+
 	"github.com/kuadrant/policy-machinery/machinery"
 	"github.com/samber/lo"
 	"google.golang.org/protobuf/types/known/structpb"
@@ -30,27 +33,50 @@
 	return env.GetString("AUTH_SERVICE_TIMEOUT", "200ms")
 }
 
+func AuthServiceFailureMode(logger *logr.Logger) FailureModeType {
+	return parseFailureModeValue("AUTH_SERVICE_FAILURE_MODE", FailureModeDeny, logger)
+}
+
 func RatelimitServiceTimeout() string {
 	return env.GetString("RATELIMIT_SERVICE_TIMEOUT", "100ms")
 }
 
+func RatelimitServiceFailureMode(logger *logr.Logger) FailureModeType {
+	return parseFailureModeValue("RATELIMIT_SERVICE_FAILURE_MODE", FailureModeAllow, logger)
+}
+
+func parseFailureModeValue(envVarName string, defaultValue FailureModeType, logger *logr.Logger) FailureModeType {
+	value := os.Getenv(envVarName)
+	if value == "" {
+		return defaultValue
+	}
+
+	switch value {
+	case string(FailureModeAllow), string(FailureModeDeny):
+		return FailureModeType(value)
+	default:
+		logger.Info("Warning: Invalid FailureMode value '%s' for %s. Using default value '%s'.\n", value, envVarName, defaultValue)
+		return defaultValue
+	}
+}
+
 func ExtensionName(gatewayName string) string {
 	return fmt.Sprintf("kuadrant-%s", gatewayName)
 }
 
-func BuildConfigForActionSet(actionSets []ActionSet) Config {
+func BuildConfigForActionSet(actionSets []ActionSet, logger *logr.Logger) Config {
 	return Config{
 		Services: map[string]Service{
 			AuthServiceName: {
 				Type:        AuthServiceType,
 				Endpoint:    kuadrant.KuadrantAuthClusterName,
-				FailureMode: FailureModeDeny,
+				FailureMode: AuthServiceFailureMode(logger),
 				Timeout:     ptr.To(AuthServiceTimeout()),
 			},
 			RateLimitServiceName: {
 				Type:        RateLimitServiceType,
 				Endpoint:    kuadrant.KuadrantRateLimitClusterName,
-				FailureMode: FailureModeAllow,
+				FailureMode: RatelimitServiceFailureMode(logger),
 				Timeout:     ptr.To(RatelimitServiceTimeout()),
 			},
 		},

tests/envoygateway/extension_reconciler_test.go

@@ -7,7 +7,10 @@ import (
 	"strings"
 	"time"
 
+	"github.com/go-logr/logr"
+
 	egv1alpha1 "github.com/envoyproxy/gateway/api/v1alpha1"
+	"github.com/kuadrant/policy-machinery/controller"
 	"github.com/kuadrant/policy-machinery/machinery"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -37,6 +40,7 @@ var _ = Describe("wasm controller", func() {
 		gwHost        = fmt.Sprintf("*.toystore-%s.com", rand.String(4))
 		gatewayClass  *gatewayapiv1.GatewayClass
 		gateway       *gatewayapiv1.Gateway
+		logger        logr.Logger
 	)
 
 	BeforeEach(func(ctx SpecContext) {
@@ -49,6 +53,7 @@ var _ = Describe("wasm controller", func() {
 			Gateway
 		err = testClient().Create(ctx, gateway)
 		Expect(err).ToNot(HaveOccurred())
+		logger = controller.LoggerFromContext(ctx).WithName("EnvoyExtensionReconcilerTest")
 
 		Eventually(tests.GatewayIsReady(ctx, testClient(), gateway)).WithContext(ctx).Should(BeTrue())
 	})
@@ -171,13 +176,13 @@ var _ = Describe("wasm controller", func() {
 					wasm.AuthServiceName: {
 						Type:        wasm.AuthServiceType,
 						Endpoint:    kuadrant.KuadrantAuthClusterName,
-						FailureMode: wasm.FailureModeDeny,
+						FailureMode: wasm.AuthServiceFailureMode(&logger),
 						Timeout:     ptr.To(wasm.AuthServiceTimeout()),
 					},
 					wasm.RateLimitServiceName: {
 						Type:        wasm.RateLimitServiceType,
 						Endpoint:    kuadrant.KuadrantRateLimitClusterName,
-						FailureMode: wasm.FailureModeAllow,
+						FailureMode: wasm.RatelimitServiceFailureMode(&logger),
 						Timeout:     ptr.To(wasm.RatelimitServiceTimeout()),
 					},
 				},
@@ -337,13 +342,13 @@ var _ = Describe("wasm controller", func() {
 					wasm.AuthServiceName: {
 						Type:        wasm.AuthServiceType,
 						Endpoint:    kuadrant.KuadrantAuthClusterName,
-						FailureMode: wasm.FailureModeDeny,
+						FailureMode: wasm.AuthServiceFailureMode(&logger),
 						Timeout:     ptr.To(wasm.AuthServiceTimeout()),
 					},
 					wasm.RateLimitServiceName: {
 						Type:        wasm.RateLimitServiceType,
 						Endpoint:    kuadrant.KuadrantRateLimitClusterName,
-						FailureMode: wasm.FailureModeAllow,
+						FailureMode: wasm.RatelimitServiceFailureMode(&logger),
 						Timeout:     ptr.To(wasm.RatelimitServiceTimeout()),
 					},
 				},