Envoy jwt #12811

puertomontt · 2025-11-04T15:51:43Z

Description

Add envoy JWT policy using GatewayExtension. Based on Nina's work in #11445.

Adds new JWT Authentication API on TrafficPolicy
Adds new JWT Provider type to GatewayExtension

Co-authored by: npolshakova [email protected]

Change Type

/kind feature

Changelog

Added JWT Authentication configuration to the TrafficPolicy and support for JWT Providers to the GatewayExtension.

Additional Notes

Signed-off-by: omar <[email protected]>

Copilot

Pull Request Overview

This PR adds comprehensive JWT authentication functionality to the kgateway project, enabling JWT validation for HTTP routes and gateways.

Adds JWT provider configuration through GatewayExtension CRD
Implements JWT validation policies attachable to gateways and routes
Supports JWKS from inline keys, files, or Kubernetes secrets

Reviewed Changes

Copilot reviewed 27 out of 28 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
api/v1alpha1/jwt.go	New API types for JWT validation configuration including providers, token sources, and JWKS
api/v1alpha1/gateway_extensions_types.go	Adds JWTProviders extension type to GatewayExtension spec
api/v1alpha1/traffic_policy_types.go	Adds JWT field to TrafficPolicySpec
internal/kgateway/extensions2/plugins/trafficpolicy/jwt.go	Core JWT translation logic converting CRD specs to Envoy JWT auth filters
internal/kgateway/extensions2/plugins/trafficpolicy/jtw_test.go	Unit tests for JWT translation functions
internal/kgateway/extensions2/plugins/trafficpolicy/gateway_extension.go	Resolves JWT providers into Envoy configuration
internal/kgateway/extensions2/plugins/trafficpolicy/traffic_policy_plugin.go	Integrates JWT handling into traffic policy plugin
test/e2e/features/jwt/suite.go	E2E test suite for JWT authentication
install/helm/kgateway-crds/templates/*.yaml	CRD definitions for JWT configuration
go.mod / go.sum	Adds go-jose/v3 dependency for JWT/JWKS handling

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-11-04T16:02:31Z

test/e2e/features/jwt/suite.go

+	err = s.testInstallation.Actions.Kubectl().ApplyFile(s.ctx, testdefaults.HttpbinManifest)
+	s.Require().NoError(err)
+
+	// Apply curl pod for testing
+	err = s.testInstallation.Actions.Kubectl().ApplyFile(s.ctx, testdefaults.CurlPodManifest)


Comment on line 119 says 'Apply curl pod for testing' but it's actually applying the httpbin manifest. Comment on line 122 is correct. Update line 119 comment to 'Apply httpbin for testing' or similar.

internal/kgateway/extensions2/plugins/trafficpolicy/jwt_test.go

test/e2e/features/jwt/suite.go

Signed-off-by: omar <[email protected]>

howardjohn

None of my comments are blocking.

howardjohn · 2025-11-04T17:57:29Z

api/v1alpha1/jwt_types.go

+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:MaxItems=100
+	// +optional
+	HeaderSource []HeaderSource `json:"headers,omitempty"`


do we need a list for this and query params? seems like you only want to fetch from one place generally?

howardjohn · 2025-11-04T17:57:46Z

api/v1alpha1/jwt_types.go

+	// Name is the JWT claim name, for example, "sub".
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=2048
+	Name string `json:"name"`


claims can be nested (they are JSON). do we support that?

I think it technically would work using dot-separated paths

api/v1alpha1/jwt_types.go

howardjohn · 2025-11-04T17:58:44Z

api/v1alpha1/jwt_types.go

+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=2048
+	// +optional
+	InlineKey *string `json:"key,omitempty"`


nit: key is probably an inaccurate name. Its a keyset, not a key

howardjohn · 2025-11-04T17:59:30Z

api/v1alpha1/jwt_types.go

+
+	// SecretRef configures storing the JWK in a Kubernetes secret in the same namespace as the JWTValidationPolicy.
+	// +optional
+	SecretRef *corev1.LocalObjectReference `json:"secretRef,omitempty"`


Secret may be a bit odd given its not really secret.. configMap may be appropriate?

technically a jwks can contain a private key, but I can't think where we'd need it? ConfigMap should be ok, but maybe with a note in the doc re: private keys (should someone copy-paste jwks from an IdP)

changed to ConfigMap

api/v1alpha1/jwt.go

Signed-off-by: omar <[email protected]>

npolshakova · 2025-11-04T21:38:12Z

test/e2e/features/jwt/testdata/jwt.yaml

@@ -0,0 +1,77 @@
+---


Let's add an e2e test to check jwt is working with rbac like this example: https://github.com/npolshakova/kgateway/blob/d7da5dfb9b2e626c6ce2ff764d85d768b1f042c2/test/kubernetes/e2e/features/jwt/testdata/jwt-rbac.yaml#L50
from the additional notes section: #11923

npolshakova · 2025-11-04T21:40:26Z

api/v1alpha1/jwt_types.go

+	// +required
+	ExtensionRef *NamespacedObjectReference `json:"extensionRef"`
+
+	// TODO: add support for ValidationMode here (REQUIRE_VALID,ALLOW_MISSING,ALLOW_MISSING_OR_FAILED)


I think we should add the allow_missing.required/allow_missing_or_failed option here as well.

npolshakova · 2025-11-04T21:41:05Z

api/v1alpha1/jwt_types.go

+
+	// TODO: add support for ValidationMode here (REQUIRE_VALID,ALLOW_MISSING,ALLOW_MISSING_OR_FAILED)
+
+	// TODO(npolshak): Add option to disable all jwt filters.


We probably want this as well now that there is a pattern for it: https://github.com/kgateway-dev/kgateway/blob/main/api/v1alpha1/ext_auth_types.go#L27

this isn't straightforward for jwt. would require composite filter similar to extproc.

the alternative is to disable using RBAC

api/v1alpha1/jwt_types.go

yuval-k · 2025-11-05T14:51:44Z

api/v1alpha1/jwt_types.go

+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=2048
+	// +optional
+	InlineKey *string `json:"key,omitempty"`


do we support PEM format here? or only JWKS format?
(asking as gloo edge supported PEM)

api/v1alpha1/jwt_types.go

yuval-k · 2025-11-05T14:55:44Z

api/v1alpha1/gateway_extensions_types.go

+	// JWTProviders configures a map of unique JWTProvider name to JWTProviders
+	// +optional
+	// +kubebuilder:validation:MaxProperties=32
+	JWTProviders map[string]JWTProvider `json:"jwtProviders,omitempty"`


what is the name used for here?
can we use a list of map type instead of map? i think it renders more consistently?
is there a way to configure if this is pre or post ext auth?

I think the provider name needs to be unique, but that can be enforced at the plugin level. We might want to add a way to configure pre/post ext auth using the kgateway.dev/policy-weight?

you can validate uniqueness of a list in CEL as well FWIW

Signed-off-by: omar <[email protected]>

puertomontt added 5 commits November 4, 2025 09:25

jwt wip

fbacd5d

Signed-off-by: omar <[email protected]>

jwt per provider

7923b1d

Signed-off-by: omar <[email protected]>

wip

e0f2aaf

Signed-off-by: omar <[email protected]>

tests

3483987

Signed-off-by: omar <[email protected]>

e2e test

ca23c3f

Signed-off-by: omar <[email protected]>

Copilot AI review requested due to automatic review settings November 4, 2025 15:51

Merge branch 'main' of github.com:kgateway-dev/kgateway into envoy-jwt

7f41ea6

Signed-off-by: omar <[email protected]>

github-actions bot added do-not-merge/description-invalid do-not-merge/release-note-invalid Indicates that a PR should not merge because it's missing one of the release note labels. kind/feature Categorizes issue or PR as related to a new feature. labels Nov 4, 2025

Copilot AI reviewed Nov 4, 2025

View reviewed changes

puertomontt linked an issue Nov 4, 2025 that may be closed by this pull request

JWT validation policy #12229

Open

github-actions bot added release-note and removed do-not-merge/description-invalid do-not-merge/release-note-invalid Indicates that a PR should not merge because it's missing one of the release note labels. labels Nov 4, 2025

fixes

d3740ac

Signed-off-by: omar <[email protected]>

howardjohn reviewed Nov 4, 2025

View reviewed changes

chandler-solo reviewed Nov 4, 2025

View reviewed changes

api/v1alpha1/jwt.go Outdated Show resolved Hide resolved

api/v1alpha1/jwt.go Outdated Show resolved Hide resolved

puertomontt added 9 commits November 4, 2025 14:23

fix

f337862

Signed-off-by: omar <[email protected]>

rename

1a136fb

Signed-off-by: omar <[email protected]>

fix comments

b650b54

Signed-off-by: omar <[email protected]>

add test file

5bccb99

Signed-off-by: omar <[email protected]>

use base test suite

5d2c3f5

Signed-off-by: omar <[email protected]>

fix equals

c79de32

Signed-off-by: omar <[email protected]>

gosec:disable G101

b230261

Signed-off-by: omar <[email protected]>

lint: noKrtEquals for JwtProviders

ce91d6c

Signed-off-by: omar <[email protected]>

Merge branch 'main' of github.com:kgateway-dev/kgateway into envoy-jwt

0909445

Signed-off-by: omar <[email protected]>

npolshakova reviewed Nov 4, 2025

View reviewed changes

yuval-k reviewed Nov 5, 2025

View reviewed changes

api/v1alpha1/jwt_types.go Outdated Show resolved Hide resolved

yuval-k reviewed Nov 5, 2025

View reviewed changes

api/v1alpha1/jwt_types.go Outdated Show resolved Hide resolved

yuval-k reviewed Nov 5, 2025

View reviewed changes

api/v1alpha1/jwt_types.go Outdated Show resolved Hide resolved

yuval-k reviewed Nov 5, 2025

View reviewed changes

puertomontt added 4 commits November 6, 2025 19:31

rbac test

4353452

Signed-off-by: omar <[email protected]>

remove file

1259db7

Signed-off-by: omar <[email protected]>

remove unused provider names

62ce14b

Signed-off-by: omar <[email protected]>

configmap instead of secret for JWKS

0e0b13c

Signed-off-by: omar <[email protected]>


		// TODO: add support for ValidationMode here (REQUIRE_VALID,ALLOW_MISSING,ALLOW_MISSING_OR_FAILED)

		// TODO(npolshak): Add option to disable all jwt filters.

Envoy jwt #12811

Are you sure you want to change the base?

Envoy jwt #12811

Uh oh!

Conversation

puertomontt commented Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Change Type

Changelog

Additional Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Nov 4, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

howardjohn left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dmitri-d Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

puertomontt commented Nov 4, 2025 •

edited

Loading

dmitri-d Nov 4, 2025 •

edited

Loading