add tests for agentgateway extproc

Signed-off-by: Sibasish Behera <[email protected]>

Author: TheRealSibasishBehera

api/v1alpha1/ext_proc_types.go

@@ -17,24 +17,32 @@ type ExtProcProvider struct {
 	FailOpen bool `json:"failOpen,omitempty"`
 
 	// ProcessingMode defines how the filter should interact with the request/response streams.
+	// Envoy: Supported
+	// Agentgateway: Not Supported (ignored)
 	// +optional
 	ProcessingMode *ProcessingMode `json:"processingMode,omitempty"`
 
 	// MessageTimeout is the timeout for each message sent to the external processing server.
+	// Envoy: Supported
+	// Agentgateway: Not Supported (ignored)
 	// +optional
 	// +kubebuilder:validation:XValidation:rule="matches(self, '^([0-9]{1,5}(h|m|s|ms)){1,4}$')",message="invalid timeout value"
 	// +kubebuilder:validation:XValidation:rule="duration(self) >= duration('1ms')",message="timeout must be at least 1ms."
 	MessageTimeout *metav1.Duration `json:"messageTimeout,omitempty"`
 
 	// MaxMessageTimeout specifies the upper bound of override_message_timeout that may be sent from the external processing server.
 	// The default value 0, which effectively disables the override_message_timeout API.
+	// Envoy: Supported
+	// Agentgateway: Not Supported (ignored)
 	// +optional
 	// +kubebuilder:validation:XValidation:rule="matches(self, '^([0-9]{1,5}(h|m|s|ms)){1,4}$')",message="invalid timeout value"
 	// +kubebuilder:validation:XValidation:rule="duration(self) >= duration('1ms')",message="timeout must be at least 1ms."
 	MaxMessageTimeout *metav1.Duration `json:"maxMessageTimeout,omitempty"`
 
 	// StatPrefix is an optional prefix to include when emitting stats from the extproc filter,
 	// enabling different instances of the filter to have unique stats.
+	// Envoy: Supported
+	// Agentgateway: Not Supported (ignored)
 	// +optional
 	// +kubebuilder:validation:MinLength=1
 	StatPrefix *string `json:"statPrefix,omitempty"`
@@ -43,13 +51,17 @@ type ExtProcProvider struct {
 	// external processor response is received in response to request headers.
 	// The default behavior is "FromResponse" which will only clear the route cache when
 	// an external processing response has the clear_route_cache field set.
+	// Envoy: Supported
+	// Agentgateway: Not Supported (ignored)
 	// +optional
 	// +kubebuilder:validation:Enum=FromResponse;Clear;Retain
 	// +kubebuilder:default=FromResponse
 	RouteCacheAction ExtProcRouteCacheAction `json:"routeCacheAction,omitempty"`
 
 	// MetadataOptions allows configuring metadata namespaces to forwarded or received from the external
 	// processing server.
+	// Envoy: Supported
+	// Agentgateway: Not Supported (ignored)
 	// +optional
 	MetadataOptions *MetadataOptions `json:"metadataOptions,omitempty"`
 }
@@ -77,11 +89,15 @@ type ExtProcPolicy struct {
 	ExtensionRef *NamespacedObjectReference `json:"extensionRef,omitempty"`
 
 	// ProcessingMode defines how the filter should interact with the request/response streams
+	// Envoy: Supported
+	// Agentgateway: Not Supported (ignored)
 	// +optional
 	ProcessingMode *ProcessingMode `json:"processingMode,omitempty"`
 
 	// Disable all external processing filters.
 	// Can be used to disable external processing policies applied at a higher level in the config hierarchy.
+	// Envoy: Supported
+	// Agentgateway: Not Supported (ignored)
 	// +optional
 	Disable *PolicyDisable `json:"disable,omitempty"`
 }

go.mod

@@ -646,7 +646,12 @@ require (
 )
 
 // Remove once https://github.com/kubernetes-sigs/controller-tools/pull/1224 merges
-replace sigs.k8s.io/controller-tools => github.com/shashankram/controller-tools v0.0.0-20250626172831-f7be064a9132
+replace (
+	// TODO: remove local replace path on merge of PR https://github.com/agentgateway/agentgateway/pull/535
+	// and new release based on that 
+	github.com/agentgateway/agentgateway => /home/void/programming/agentgateway
+	sigs.k8s.io/controller-tools => github.com/shashankram/controller-tools v0.0.0-20250626172831-f7be064a9132
+)
 
 tool (
 	github.com/golang/mock/mockgen

go.sum

@@ -208,8 +208,6 @@ github.com/a8m/envsubst v1.4.3 h1:kDF7paGK8QACWYaQo6KtyYBozY2jhQrTuNNuUxQkhJY=
 github.com/a8m/envsubst v1.4.3/go.mod h1:4jjHWQlZoaXPoLQUb7H2qT4iLkZDdmEQiOUogdUmqVU=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
-github.com/agentgateway/agentgateway v0.10.3 h1:z5HcuNuiz+NTZR87sU91xsjxvBD9bRP2xOhJwGbgW8Y=
-github.com/agentgateway/agentgateway v0.10.3/go.mod h1:geHd31xH5d8OrCRuRyvnDxBeqSZ9+O9VhL8VJAfcA+E=
 github.com/agnivade/levenshtein v1.2.1 h1:EHBY3UOn1gwdy/VbFwgo4cxecRznFk7fKWN1KOX7eoM=
 github.com/agnivade/levenshtein v1.2.1/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU=
 github.com/alcortesm/tgz v0.0.0-20161220082320-9c5fe88206d7/go.mod h1:6zEj6s6u/ghQa61ZWa/C2Aw3RkjiTBOix7dkqa1VLIs=

install/helm/kgateway-crds/templates/gateway.kgateway.dev_gatewayextensions.yaml

@@ -439,15 +439,19 @@ spec:
                     description: |-
                       MaxMessageTimeout specifies the upper bound of override_message_timeout that may be sent from the external processing server.
                       The default value 0, which effectively disables the override_message_timeout API.
+                      Envoy: Supported
+                      Agentgateway: Not Supported (ignored)
                     type: string
                     x-kubernetes-validations:
                     - message: invalid timeout value
                       rule: matches(self, '^([0-9]{1,5}(h|m|s|ms)){1,4}$')
                     - message: timeout must be at least 1ms.
                       rule: duration(self) >= duration('1ms')
                   messageTimeout:
-                    description: MessageTimeout is the timeout for each message sent
-                      to the external processing server.
+                    description: |-
+                      MessageTimeout is the timeout for each message sent to the external processing server.
+                      Envoy: Supported
+                      Agentgateway: Not Supported (ignored)
                     type: string
                     x-kubernetes-validations:
                     - message: invalid timeout value
@@ -458,6 +462,8 @@ spec:
                     description: |-
                       MetadataOptions allows configuring metadata namespaces to forwarded or received from the external
                       processing server.
+                      Envoy: Supported
+                      Agentgateway: Not Supported (ignored)
                     properties:
                       forwarding:
                         description: Forwarding defines the typed or untyped dynamic
@@ -477,8 +483,10 @@ spec:
                         type: object
                     type: object
                   processingMode:
-                    description: ProcessingMode defines how the filter should interact
-                      with the request/response streams.
+                    description: |-
+                      ProcessingMode defines how the filter should interact with the request/response streams.
+                      Envoy: Supported
+                      Agentgateway: Not Supported (ignored)
                     properties:
                       requestBodyMode:
                         default: NONE
@@ -546,6 +554,8 @@ spec:
                       external processor response is received in response to request headers.
                       The default behavior is "FromResponse" which will only clear the route cache when
                       an external processing response has the clear_route_cache field set.
+                      Envoy: Supported
+                      Agentgateway: Not Supported (ignored)
                     enum:
                     - FromResponse
                     - Clear
@@ -555,6 +565,8 @@ spec:
                     description: |-
                       StatPrefix is an optional prefix to include when emitting stats from the extproc filter,
                       enabling different instances of the filter to have unique stats.
+                      Envoy: Supported
+                      Agentgateway: Not Supported (ignored)
                     minLength: 1
                     type: string
                 required:

install/helm/kgateway-crds/templates/gateway.kgateway.dev_trafficpolicies.yaml

@@ -1042,6 +1042,8 @@ spec:
                     description: |-
                       Disable all external processing filters.
                       Can be used to disable external processing policies applied at a higher level in the config hierarchy.
+                      Envoy: Supported
+                      Agentgateway: Not Supported (ignored)
                     type: object
                   extensionRef:
                     description: ExtensionRef references the GatewayExtension that
@@ -1064,8 +1066,10 @@ spec:
                     - name
                     type: object
                   processingMode:
-                    description: ProcessingMode defines how the filter should interact
-                      with the request/response streams
+                    description: |-
+                      ProcessingMode defines how the filter should interact with the request/response streams
+                      Envoy: Supported
+                      Agentgateway: Not Supported (ignored)
                     properties:
                       requestBodyMode:
                         default: NONE

internal/kgateway/query/mocks/mock_queries.go

@@ -833,17 +833,16 @@ func processRateLimitPolicy(ctx krt.HandlerContext, gatewayExtensions krt.Collec
 }
 
 func processExtProcPolicy(ctx krt.HandlerContext, gatewayExtensions krt.Collection[*v1alpha1.GatewayExtension], trafficPolicy *v1alpha1.TrafficPolicy, policyName string, policyTarget *api.PolicyTarget) ([]AgwPolicy, error) {
-	if trafficPolicy.Spec.ExtProc.ExtensionRef == nil {
-		logger.Debug("skipping extproc policy with no extensionRef (likely disable policy)",
-			"policy", trafficPolicy.Name)
-		return nil, nil
-	}
-
+	// TODO: warn if unsupported policy parameters are used?
 	gwExt, err := lookupGatewayExtension(ctx, gatewayExtensions, *trafficPolicy.Spec.ExtProc.ExtensionRef, trafficPolicy.Namespace, v1alpha1.GatewayExtensionTypeExtProc)
 	if err != nil {
 		return nil, err
 	}
+
 	extProc := (*gwExt).Spec.ExtProc
+	if extProc == nil {
+		return nil, fmt.Errorf("extproc provider is missing from gateway extension %s/%s", gwExt.Namespace, gwExt.Namespace)
+	}
 
 	var extProcSvcTarget *api.BackendReference
 	if extProc.GrpcService != nil && extProc.GrpcService.BackendRef != nil {
@@ -867,33 +866,34 @@ func processExtProcPolicy(ctx krt.HandlerContext, gatewayExtensions krt.Collecti
 	}
 
 	if extProcSvcTarget == nil {
-		return nil, fmt.Errorf("extproc policy %s/%s missing grpcService.backendRef in GatewayExtension <place_holder>",
-			trafficPolicy.Namespace, trafficPolicy.Name)
+		return nil, fmt.Errorf("extproc policy %s/%s missing backendRef in gateway extension %s/%s",
+			trafficPolicy.Namespace, trafficPolicy.Name, (*gwExt).Namespace, (*gwExt).Name)
 	}
 
-	extProcPolicySpec := &api.PolicySpec_ExtProc{
-		Target:           extProcSvcTarget,
-		FailureModeAllow: extProc.FailOpen,
+	failureMode := api.PolicySpec_ExtProc_FAIL_CLOSED
+	if extProc.FailOpen {
+		failureMode = api.PolicySpec_ExtProc_FAIL_OPEN
 	}
 
 	extProcPolicy := &api.Policy{
 		Name:   policyName + extprocPolicySuffix + attachmentName(policyTarget),
 		Target: policyTarget,
 		Spec: &api.PolicySpec{
 			Kind: &api.PolicySpec_ExtProc_{
-				ExtProc: extProcPolicySpec,
+				ExtProc: &api.PolicySpec_ExtProc{
+					Target:      extProcSvcTarget,
+					FailureMode: failureMode,
+				},
 			},
 		},
 	}
+
 	logger.Debug("generated ExtProc policy",
 		"policy", trafficPolicy.Name,
 		"agentgateway_policy", extProcPolicy.Name,
 		"target", extProcSvcTarget)
-	return []AgwPolicy{
-		{
-			Policy: extProcPolicy,
-		},
-	}, nil
+
+	return []AgwPolicy{{Policy: extProcPolicy}}, nil
 }
 
 // processLocalRateLimitPolicy processes local rate limiting configuration