Non-Gateway API resources in Standalone mode

[bstasz-bonrepublic]

Hello,

I am trying to set up Envoy Gateway 1.3.0 in Standalone mode using docker-compose.
I would like to add an OIDC protected route but have an issue with the SecurityPolicy OIDC task. The clientSecret needs to reference an existing K8s Secret. I have added the Secret to the watched resources but seems like it is not created. When trying to access the protected route, I get a direct_response 500 error.

SecurityPolicy and Secret resources:

apiVersion: v1
kind: Secret
metadata:
  name: echo-oidc-secret
  namespace: envoy-gateway-system
type: Opaque
data:
  client-secret: bXljbGllbnQtc2VjcmV0Cg==
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: echo-oidc-sp
  namespace: envoy-gateway-system
spec:
  targetRefs:
     - group: "gateway.networking.k8s.io"
       kind: HTTPRoute
       name: echo-oidc
  oidc:
    provider:
      issuer: "https://placeholder/auth/realms/myrealm"
      authorizationEndpoint: "https://placeholder/auth/realms/myrealm/protocol/openid-connect/auth"
      tokenEndpoint: "https://placeholder/auth/realms/myrealm/protocol/openid-connect/token"
    clientID: "myclient"
    clientSecret:
      group: ""
      kind: Secret
      name: "echo-oidc-secret"
    redirectURL: "/oidc/oauth2/callback"
    logoutPath: "/oidc/logout"

Result of egctl experimental translate --to ir --file resources.yaml

- kind: SecurityPolicy
  metadata:
    creationTimestamp: null
    name: echo-oidc-sp
    namespace: envoy-gateway-system
  spec:
    oidc:
      clientID: myclient
      clientSecret:
        group: ""
        kind: Secret
        name: echo-oidc-secret
      logoutPath: /oidc/logout
      provider:
        authorizationEndpoint: https:/placeholder/auth/realms/myrealm/protocol/openid-connect/auth
        issuer: https://placeholder/auth/realms/myrealm
        tokenEndpoint: https://placeholder/auth/realms/myrealm/protocol/openid-connect/token
      redirectURL: /oidc/oauth2/callback
    targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: echo-oidc
  status:
    ancestors:
    - ancestorRef:
        group: gateway.networking.k8s.io
        kind: Gateway
        name: eg
        namespace: envoy-gateway-system
      conditions:
      - lastTransitionTime: "2025-02-09T12:43:05Z"
        message: 'OIDC: secret envoy-gateway-system/echo-oidc-secret does not exist.'
        reason: Invalid
        status: "False"
        type: Accepted
      controllerName: gateway.envoyproxy.io/gatewayclass-controller

Is it possible to use non-Envoy or non-GatewayAPI resources in Standalone mode? If not, is there any workaround for passing a Secret?

Thank you!

[arkodg]

cc @shawnh2 @zhaohuabing

[shawnh2]

Currently in standalone mode, the Secret is not being processed

gateway/internal/gatewayapi/resource/load.go

Line 102 in 8ea091c

switch gvk.Kind {

Maybe we should add the Secret kind

[arkodg]

ah and ConfigMap as well

[bstasz-bonrepublic]

Thank you for the explanation!

I have looked into the code and added the Secret and ConfigMap mappings locally. Can I just create a PR after I test it properly?

[arkodg]

Sure, thanks, can you also raise a GH issue / bug to track this