Merge branch 'main' into oauth-cookie-names

api/v1alpha1/backendtrafficpolicy_types.go

@@ -82,6 +82,11 @@ type BackendTrafficPolicySpec struct {
 	// +optional
 	CircuitBreaker *CircuitBreaker `json:"circuitBreaker,omitempty"`
 
+	// Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+	// If not set, retry will be disabled.
+	// +optional
+	Retry *Retry `json:"retry,omitempty"`
+
 	// Timeout settings for the backend connections.
 	//
 	// +optional

api/v1alpha1/healthcheck_types.go

@@ -160,12 +160,6 @@ type TCPActiveHealthChecker struct {
 	Receive *ActiveHealthCheckPayload `json:"receive,omitempty" yaml:"receive,omitempty"`
 }
 
-// HTTPStatus defines the http status code.
-// +kubebuilder:validation:Minimum=100
-// +kubebuilder:validation:Maximum=600
-// +kubebuilder:validation:ExclusiveMaximum=true
-type HTTPStatus int
-
 // ActiveHealthCheckPayloadType is the type of the payload.
 // +kubebuilder:validation:Enum=Text;Binary
 type ActiveHealthCheckPayloadType string

api/v1alpha1/retry_types.go

@@ -0,0 +1,111 @@
+// Copyright Envoy Gateway Authors
+// SPDX-License-Identifier: Apache-2.0
+// The full text of the Apache license is available in the LICENSE file at
+// the root of the repo.
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// Retry defines the retry strategy to be applied.
+type Retry struct {
+	// NumRetries is the number of retries to be attempted. Defaults to 2.
+	//
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:default=2
+	NumRetries *int32 `json:"numRetries,omitempty"`
+
+	// RetryOn specifies the retry trigger condition.
+	//
+	// If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+	// +optional
+	RetryOn *RetryOn `json:"retryOn,omitempty"`
+
+	// PerRetry is the retry policy to be applied per retry attempt.
+	//
+	// +optional
+	PerRetry *PerRetryPolicy `json:"perRetry,omitempty"`
+}
+
+type RetryOn struct {
+	// Triggers specifies the retry trigger condition(Http/Grpc).
+	//
+	// +optional
+	Triggers []TriggerEnum `json:"triggers,omitempty"`
+
+	// HttpStatusCodes specifies the http status codes to be retried.
+	//
+	// +optional
+	HTTPStatusCodes []HTTPStatus `json:"httpStatusCodes,omitempty"`
+}
+
+// TriggerEnum specifies the conditions that trigger retries.
+// +kubebuilder:validation:Enum={"5xx","gateway-error","disconnect-reset","connect-failure","retriable-4xx","refused-stream","retriable-status-codes","cancelled","deadline-exceeded","internal","resource-exhausted","unavailable"}
+type TriggerEnum string
+
+const (
+	// HTTP events.
+	// For additional details, see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#x-envoy-retry-on
+
+	// The upstream server responds with any 5xx response code, or does not respond at all (disconnect/reset/read timeout).
+	// Includes connect-failure and refused-stream.
+	Error5XX TriggerEnum = "5xx"
+	// The response is a gateway error (502,503 or 504).
+	GatewayError TriggerEnum = "gateway-error"
+	// The upstream server does not respond at all (disconnect/reset/read timeout.)
+	DisconnectRest TriggerEnum = "disconnect-reset"
+	// Connection failure to the upstream server (connect timeout, etc.). (Included in *5xx*)
+	ConnectFailure TriggerEnum = "connect-failure"
+	// The upstream server responds with a retriable 4xx response code.
+	// Currently, the only response code in this category is 409.
+	Retriable4XX TriggerEnum = "retriable-4xx"
+	// The upstream server resets the stream with a REFUSED_STREAM error code.
+	RefusedStream TriggerEnum = "refused-stream"
+	// The upstream server responds with any response code matching one defined in the RetriableStatusCodes.
+	RetriableStatusCodes TriggerEnum = "retriable-status-codes"
+
+	// GRPC events, currently only supported for gRPC status codes in response headers.
+	// For additional details, see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#x-envoy-retry-grpc-on
+
+	// The gRPC status code in the response headers is “cancelled”.
+	Cancelled TriggerEnum = "cancelled"
+	// The gRPC status code in the response headers is “deadline-exceeded”.
+	DeadlineExceeded TriggerEnum = "deadline-exceeded"
+	// The gRPC status code in the response headers is “internal”.
+	Internal TriggerEnum = "internal"
+	// The gRPC status code in the response headers is “resource-exhausted”.
+	ResourceExhausted TriggerEnum = "resource-exhausted"
+	// The gRPC status code in the response headers is “unavailable”.
+	Unavailable TriggerEnum = "unavailable"
+)
+
+type PerRetryPolicy struct {
+	// Timeout is the timeout per retry attempt.
+	//
+	// +optional
+	// +kubebuilder:validation:Format=duration
+	Timeout *metav1.Duration `json:"timeout,omitempty"`
+	// Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+	// back-off algorithm for retries. For additional details,
+	// see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+	//
+	// +optional
+	BackOff *BackOffPolicy `json:"backOff,omitempty"`
+}
+
+type BackOffPolicy struct {
+	// BaseInterval is the base interval between retries.
+	//
+	// +kubebuilder:validation:Format=duration
+	BaseInterval *metav1.Duration `json:"baseInterval,omitempty"`
+	// MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+	// The default is 10 times the base_interval
+	//
+	// +optional
+	// +kubebuilder:validation:Format=duration
+	MaxInterval *metav1.Duration `json:"maxInterval,omitempty"`
+	// we can add rate limited based backoff config here if we want to.
+}

api/v1alpha1/shared_types.go

@@ -364,3 +364,9 @@ type KubernetesHorizontalPodAutoscalerSpec struct {
 	// +optional
 	Behavior *autoscalingv2.HorizontalPodAutoscalerBehavior `json:"behavior,omitempty"`
 }
+
+// HTTPStatus defines the http status code.
+// +kubebuilder:validation:Minimum=100
+// +kubebuilder:validation:Maximum=600
+// +kubebuilder:validation:ExclusiveMaximum=true
+type HTTPStatus int

charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml

@@ -740,6 +740,82 @@ spec:
                 required:
                 - type
                 type: object
+              retry:
+                description: Retry provides more advanced usage, allowing users to
+                  customize the number of retries, retry fallback strategy, and retry
+                  triggering conditions. If not set, retry will be disabled.
+                properties:
+                  numRetries:
+                    default: 2
+                    description: NumRetries is the number of retries to be attempted.
+                      Defaults to 2.
+                    format: int32
+                    minimum: 0
+                    type: integer
+                  perRetry:
+                    description: PerRetry is the retry policy to be applied per retry
+                      attempt.
+                    properties:
+                      backOff:
+                        description: Backoff is the backoff policy to be applied per
+                          retry attempt. gateway uses a fully jittered exponential
+                          back-off algorithm for retries. For additional details,
+                          see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+                        properties:
+                          baseInterval:
+                            description: BaseInterval is the base interval between
+                              retries.
+                            format: duration
+                            type: string
+                          maxInterval:
+                            description: MaxInterval is the maximum interval between
+                              retries. This parameter is optional, but must be greater
+                              than or equal to the base_interval if set. The default
+                              is 10 times the base_interval
+                            format: duration
+                            type: string
+                        type: object
+                      timeout:
+                        description: Timeout is the timeout per retry attempt.
+                        format: duration
+                        type: string
+                    type: object
+                  retryOn:
+                    description: "RetryOn specifies the retry trigger condition. \n
+                      If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503)."
+                    properties:
+                      httpStatusCodes:
+                        description: HttpStatusCodes specifies the http status codes
+                          to be retried.
+                        items:
+                          description: HTTPStatus defines the http status code.
+                          exclusiveMaximum: true
+                          maximum: 600
+                          minimum: 100
+                          type: integer
+                        type: array
+                      triggers:
+                        description: Triggers specifies the retry trigger condition(Http/Grpc).
+                        items:
+                          description: TriggerEnum specifies the conditions that trigger
+                            retries.
+                          enum:
+                          - 5xx
+                          - gateway-error
+                          - disconnect-reset
+                          - connect-failure
+                          - retriable-4xx
+                          - refused-stream
+                          - retriable-status-codes
+                          - cancelled
+                          - deadline-exceeded
+                          - internal
+                          - resource-exhausted
+                          - unavailable
+                          type: string
+                        type: array
+                    type: object
+                type: object
               targetRef:
                 description: targetRef is the name of the resource this policy is
                   being attached to. This Policy and the TargetRef MUST be in the

internal/gatewayapi/clienttrafficpolicy.go

@@ -290,7 +290,7 @@ func resolveCTPolicyTargetRef(policy *egv1a1.ClientTrafficPolicy, gateways []*Ga
 func (t *Translator) translateClientTrafficPolicyForListener(policy *egv1a1.ClientTrafficPolicy, l *ListenerContext,
 	xdsIR XdsIRMap, infraIR InfraIRMap, resources *Resources) error {
 	// Find IR
-	irKey := irStringKey(l.gateway.Namespace, l.gateway.Name)
+	irKey := t.getIRKey(l.gateway)
 	// It must exist since we've already finished processing the gateways
 	gwXdsIR := xdsIR[irKey]
 

internal/gatewayapi/testdata/securitypolicy-with-basic-auth.out.yaml

@@ -155,14 +155,3 @@ xdsIR:
           distinct: false
           name: ""
           prefix: /foo
-      - backendWeights:
-          invalid: 0
-          valid: 0
-        directResponse:
-          statusCode: 404
-        hostname: gateway.envoyproxy.io
-        name: gateway_envoyproxy_io/catch-all-return-404
-        pathMatch:
-          distinct: false
-          name: ""
-          prefix: /