feat: Wasm extension HTTP code source

api/v1alpha1/envoyextensionypolicy_types.go

@@ -46,12 +46,12 @@ type EnvoyExtensionPolicySpec struct {
 	// TargetRef
 	TargetRef gwapiv1a2.PolicyTargetReferenceWithSectionName `json:"targetRef"`
 
-	// WASM is a list of Wasm extensions to be loaded by the Gateway.
+	// Wasm is a list of Wasm extensions to be loaded by the Gateway.
 	// Order matters, as the extensions will be loaded in the order they are
 	// defined in this list.
 	//
 	// +optional
-	WASM []Wasm `json:"wasm,omitempty"`
+	Wasm []Wasm `json:"wasm,omitempty"`
 
 	// ExtProc is an ordered list of external processing filters
 	// that should added to the envoy filter chain

api/v1alpha1/wasm_types.go

@@ -31,14 +31,16 @@ type Wasm struct {
 	// RootID is a unique ID for a set of extensions in a VM which will share a
 	// RootContext and Contexts if applicable (e.g., an Wasm HttpFilter and an Wasm AccessLog).
 	// If left blank, all extensions with a blank root_id with the same vm_id will share Context(s).
-	// RootID *string `json:"rootID,omitempty"`
+	// RootID must match the root_id parameter used to register the Context in the Wasm code.
+	RootID *string `json:"rootID,omitempty"`
 
 	// Code is the wasm code for the extension.
 	Code WasmCodeSource `json:"code"`
 
 	// Config is the configuration for the Wasm extension.
 	// This configuration will be passed as a JSON string to the Wasm extension.
-	Config *apiextensionsv1.JSON `json:"config"`
+	// +optional
+	Config *apiextensionsv1.JSON `json:"config,omitempty"`
 
 	// FailOpen is a switch used to control the behavior when a fatal error occurs
 	// during the initialization or the execution of the Wasm extension.
@@ -61,7 +63,7 @@ type WasmCodeSource struct {
 	// Type is the type of the source of the wasm code.
 	// Valid WasmCodeSourceType values are "HTTP" or "Image".
 	//
-	// +kubebuilder:validation:Enum=HTTP;Image
+	// +kubebuilder:validation:Enum=HTTP;Image;ConfigMap
 	// +unionDiscriminator
 	Type WasmCodeSourceType `json:"type"`
 
@@ -78,8 +80,9 @@ type WasmCodeSource struct {
 	Image *ImageWasmCodeSource `json:"image,omitempty"`
 
 	// SHA256 checksum that will be used to verify the wasm code.
-	// +optional
-	// SHA256 *string `json:"sha256,omitempty"`
+	//
+	// kubebuilder:validation:Pattern=`^[a-f0-9]{64}$`
+	SHA256 string `json:"sha256"`
 }
 
 // WasmCodeSourceType specifies the types of sources for the wasm code.
@@ -92,6 +95,9 @@ const (
 
 	// ImageWasmCodeSourceType allows the user to specify the wasm code in an OCI image.
 	ImageWasmCodeSourceType WasmCodeSourceType = "Image"
+
+	// ConfigMapCodeSourceType allows the user to specify the wasm code in a ConfigMap.
+	ConfigMapWasmCodeSourceType WasmCodeSourceType = "ConfigMap"
 )
 
 // HTTPWasmCodeSource defines the HTTP URL containing the wasm code.

charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml

@@ -308,7 +308,7 @@ spec:
                   rule: '!has(self.sectionName)'
               wasm:
                 description: |-
-                  WASM is a list of Wasm extensions to be loaded by the Gateway.
+                  Wasm is a list of Wasm extensions to be loaded by the Gateway.
                   Order matters, as the extensions will be loaded in the order they are
                   defined in this list.
                 items:
@@ -394,6 +394,13 @@ spec:
                           - pullSecret
                           - url
                           type: object
+                        sha256:
+                          description: |-
+                            SHA256 checksum that will be used to verify the wasm code.
+
+
+                            kubebuilder:validation:Pattern=`^[a-f0-9]{64}$`
+                          type: string
                         type:
                           allOf:
                           - enum:
@@ -402,11 +409,13 @@ spec:
                           - enum:
                             - HTTP
                             - Image
+                            - ConfigMap
                           description: |-
                             Type is the type of the source of the wasm code.
                             Valid WasmCodeSourceType values are "HTTP" or "Image".
                           type: string
                       required:
+                      - sha256
                       - type
                       type: object
                     config:
@@ -430,9 +439,15 @@ spec:
                         Wasm extension if multiple extensions are handled by the same vm_id and root_id.
                         It's also used for logging/debugging.
                       type: string
+                    rootID:
+                      description: |-
+                        RootID is a unique ID for a set of extensions in a VM which will share a
+                        RootContext and Contexts if applicable (e.g., an Wasm HttpFilter and an Wasm AccessLog).
+                        If left blank, all extensions with a blank root_id with the same vm_id will share Context(s).
+                        RootID must match the root_id parameter used to register the Context in the Wasm code.
+                      type: string
                   required:
                   - code
-                  - config
                   - name
                   type: object
                 type: array

internal/gatewayapi/envoyextensionpolicy.go

@@ -6,6 +6,7 @@
 package gatewayapi
 
 import (
+	"errors"
 	"fmt"
 	"sort"
 	"strings"
@@ -293,24 +294,34 @@ func resolveEEPolicyRouteTargetRef(policy *egv1a1.EnvoyExtensionPolicy, routes m
 
 func (t *Translator) translateEnvoyExtensionPolicyForRoute(policy *egv1a1.EnvoyExtensionPolicy, route RouteContext,
 	xdsIR XdsIRMap, resources *Resources) error {
+	var (
+		extProcs  []ir.ExtProc
+		wasms     []ir.Wasm
+		err, errs error
+	)
+
+	if extProcs, err = t.buildExtProcs(policy, resources); err != nil {
+		errs = errors.Join(errs, err)
+	}
+	if wasms, err = t.buildWasms(policy); err != nil {
+		errs = errors.Join(errs, err)
+	}
+
 	// Apply IR to all relevant routes
 	prefix := irRoutePrefix(route)
 	for _, ir := range xdsIR {
 		for _, http := range ir.HTTP {
 			for _, r := range http.Routes {
 				// Apply if there is a match
 				if strings.HasPrefix(r.Name, prefix) {
-					if extProcs, err := t.buildExtProcs(policy, resources); err == nil {
-						r.ExtProcs = extProcs
-					} else {
-						return err
-					}
+					r.ExtProcs = extProcs
+					r.Wasms = wasms
 				}
 			}
 		}
 	}
 
-	return nil
+	return errs
 }
 
 func (t *Translator) buildExtProcs(policy *egv1a1.EnvoyExtensionPolicy, resources *Resources) ([]ir.ExtProc, error) {
@@ -320,21 +331,24 @@ func (t *Translator) buildExtProcs(policy *egv1a1.EnvoyExtensionPolicy, resource
 		return nil, nil
 	}
 
-	if len(policy.Spec.ExtProc) > 0 {
-		for idx, ep := range policy.Spec.ExtProc {
-			name := irConfigNameForEEP(policy, idx)
-			extProcIR, err := t.buildExtProc(name, utils.NamespacedName(policy), ep, idx, resources)
-			if err != nil {
-				return nil, err
-			}
-			extProcIRList = append(extProcIRList, *extProcIR)
+	for idx, ep := range policy.Spec.ExtProc {
+		name := irConfigNameForEEP(policy, idx)
+		extProcIR, err := t.buildExtProc(name, utils.NamespacedName(policy), ep, idx, resources)
+		if err != nil {
+			return nil, err
 		}
+		extProcIRList = append(extProcIRList, *extProcIR)
 	}
 	return extProcIRList, nil
 }
 
 func (t *Translator) translateEnvoyExtensionPolicyForGateway(policy *egv1a1.EnvoyExtensionPolicy,
 	gateway *GatewayContext, xdsIR XdsIRMap, resources *Resources) error {
+	var (
+		extProcs  []ir.ExtProc
+		wasms     []ir.Wasm
+		err, errs error
+	)
 
 	irKey := t.getIRKey(gateway.Gateway)
 	// Should exist since we've validated this
@@ -345,9 +359,11 @@ func (t *Translator) translateEnvoyExtensionPolicyForGateway(policy *egv1a1.Envo
 		string(policy.Spec.TargetRef.Name),
 	)
 
-	extProcs, err := t.buildExtProcs(policy, resources)
-	if err != nil {
-		return err
+	if extProcs, err = t.buildExtProcs(policy, resources); err != nil {
+		errs = errors.Join(errs, err)
+	}
+	if wasms, err = t.buildWasms(policy); err != nil {
+		errs = errors.Join(errs, err)
 	}
 
 	for _, http := range ir.HTTP {
@@ -360,13 +376,21 @@ func (t *Translator) translateEnvoyExtensionPolicyForGateway(policy *egv1a1.Envo
 		// targeting a lesser specific scope(Gateway).
 		for _, r := range http.Routes {
 			// if already set - there's a route level policy, so skip
+			if r.ExtProcs != nil ||
+				r.Wasms != nil {
+				continue
+			}
+
 			if r.ExtProcs == nil {
 				r.ExtProcs = extProcs
 			}
+			if r.Wasms == nil {
+				r.Wasms = wasms
+			}
 		}
 	}
 
-	return nil
+	return errs
 }
 
 func (t *Translator) buildExtProc(
@@ -428,3 +452,58 @@ func irConfigNameForEEP(policy *egv1a1.EnvoyExtensionPolicy, idx int) string {
 		utils.NamespacedName(policy).String(),
 		idx)
 }
+
+func (t *Translator) buildWasms(policy *egv1a1.EnvoyExtensionPolicy) ([]ir.Wasm, error) {
+	var wasmIRList []ir.Wasm
+
+	if policy == nil {
+		return nil, nil
+	}
+
+	for idx, wasm := range policy.Spec.Wasm {
+		name := irConfigNameForEEP(policy, idx)
+		wasmIR, err := t.buildWasm(name, wasm)
+		if err != nil {
+			return nil, err
+		}
+		wasmIRList = append(wasmIRList, *wasmIR)
+	}
+	return wasmIRList, nil
+}
+
+func (t *Translator) buildWasm(name string, wasm egv1a1.Wasm) (*ir.Wasm, error) {
+	var (
+		failOpen     = false
+		httpWasmCode *ir.HTTPWasmCode
+	)
+
+	if wasm.FailOpen != nil {
+		failOpen = *wasm.FailOpen
+	}
+
+	switch wasm.Code.Type {
+	case egv1a1.HTTPWasmCodeSourceType:
+		httpWasmCode = &ir.HTTPWasmCode{
+			URL:    wasm.Code.HTTP.URL,
+			SHA256: wasm.Code.SHA256,
+		}
+	case egv1a1.ConfigMapWasmCodeSourceType:
+		return nil, fmt.Errorf("ConfigMap Wasm code source is not supported yet")
+	case egv1a1.ImageWasmCodeSourceType:
+		return nil, fmt.Errorf("OCI image Wasm code source is not supported yet")
+	default:
+		// should never happen because of kubebuilder validation, just a sanity check
+		return nil, fmt.Errorf("unsupported Wasm code source type %q", wasm.Code.Type)
+	}
+
+	wasmIR := &ir.Wasm{
+		Name:         name,
+		RootID:       wasm.RootID,
+		WasmName:     wasm.Name,
+		Config:       wasm.Config,
+		FailOpen:     failOpen,
+		HTTPWasmCode: httpWasmCode,
+	}
+
+	return wasmIR, nil
+}