Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion api/v1alpha1/traffic_policy_types.go
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ type TrafficPolicyList struct {
// TrafficPolicySpec defines the desired state of a traffic policy.
// Note: Backend attachment is only supported for agentgateway.
// +kubebuilder:validation:XValidation:rule="!has(self.autoHostRewrite) || ((has(self.targetRefs) && self.targetRefs.all(r, r.kind == 'HTTPRoute')) || (has(self.targetSelectors) && self.targetSelectors.all(r, r.kind == 'HTTPRoute')))",message="autoHostRewrite can only be used when targeting HTTPRoute resources"
// +kubebuilder:validation:XValidation:rule="has(self.retry) && has(self.timeouts) ? (has(self.retry.perTryTimeout) && has(self.timeouts.request) ? duration(self.retry.perTryTimeout) < duration(self.timeouts.request) : true) : true",message="retry.perTryTimeout must be lesser than timeouts.request"
// +kubebuilder:validation:XValidation:rule="has(self.retry) && has(self.timeouts) ? (has(self.retry.perTryTimeout) && has(self.timeouts.request) ? duration(self.retry.perTryTimeout) < duration(self.timeouts.request) : true) : true",message="retry.perTryTimeout must be less than timeouts.request"
// +kubebuilder:validation:XValidation:rule="has(self.retry) && has(self.targetRefs) ? self.targetRefs.all(r, (r.kind == 'Gateway' ? has(r.sectionName) : true )) : true",message="targetRefs[].sectionName must be set when targeting Gateway resources with retry policy"
// +kubebuilder:validation:XValidation:rule="has(self.retry) && has(self.targetSelectors) ? self.targetSelectors.all(r, (r.kind == 'Gateway' ? has(r.sectionName) : true )) : true",message="targetSelectors[].sectionName must be set when targeting Gateway resources with retry policy"
type TrafficPolicySpec struct {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -1981,7 +1981,7 @@ spec:
rule: '!has(self.autoHostRewrite) || ((has(self.targetRefs) && self.targetRefs.all(r,
r.kind == ''HTTPRoute'')) || (has(self.targetSelectors) && self.targetSelectors.all(r,
r.kind == ''HTTPRoute'')))'
- message: retry.perTryTimeout must be lesser than timeouts.request
- message: retry.perTryTimeout must be less than timeouts.request
rule: 'has(self.retry) && has(self.timeouts) ? (has(self.retry.perTryTimeout)
&& has(self.timeouts.request) ? duration(self.retry.perTryTimeout)
< duration(self.timeouts.request) : true) : true'
Expand Down
25 changes: 12 additions & 13 deletions pkg/pluginsdk/ir/iface.go
Original file line number Diff line number Diff line change
Expand Up @@ -120,21 +120,13 @@ type HcmContext struct {
// for the duration of the translation.
// Each of the functions here will be called in the order they appear in the interface.
type ProxyTranslationPass interface {
// Name() string
// called 1 time for each listener
// ApplyListenerPlugin is called 1 time for each listener
ApplyListenerPlugin(
pCtx *ListenerContext,
out *envoylistenerv3.Listener,
)

// called 1 time for all the routes in a filter chain. Use this to set default PerFilterConfig
// No policy is provided here.
ApplyRouteConfigPlugin(
pCtx *RouteConfigContext,
out *envoyroutev3.RouteConfiguration,
)

// no policy applied - this is called for every backend in a route.
// ApplyForBackend is called for every backend in a route. No policy is applied.
// For this to work the backend needs to register itself as a policy. TODO: rethink this.
// Note: TypedFilterConfig should be applied in the pCtx and is shared between ApplyForRoute, ApplyForBackend
// and ApplyForRouteBacken (do not apply on the output route directly)
Expand All @@ -144,16 +136,16 @@ type ProxyTranslationPass interface {
out *envoyroutev3.Route,
) error

// Applies a policy attached to a specific Backend (via extensionRef on the BackendRef).
// ApplyForRouteBackend applies a policy attached to a specific Backend (via extensionRef on the BackendRef).
// Note: TypedFilterConfig should be applied in the pCtx and is shared between ApplyForRoute, ApplyForBackend
// and ApplyForRouteBackend
ApplyForRouteBackend(
policy PolicyIR,
pCtx *RouteBackendContext,
) error

// called once per route rule if SupportsPolicyMerge returns false, otherwise this is called only
// once on the value returned by MergePolicies.
// ApplyForRoute is called once per route rule if SupportsPolicyMerge returns false,
// otherwise this is called only once on the value returned by MergePolicies.
// Applies policy for an HTTPRoute that has a policy attached via a targetRef.
// The output configures the envoyroutev3.Route
// Note: TypedFilterConfig should be applied in the pCtx and is shared between ApplyForRoute, ApplyForBackend
Expand All @@ -168,6 +160,13 @@ type ProxyTranslationPass interface {
out *envoyroutev3.VirtualHost,
)

// ApplyRouteConfigPlugin is called 1 time for all the routes in a filter chain. Use this to set default PerFilterConfig
// Applies policy for a Gateway that has a policy attached via a targetRef.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Applies policy for a Gateway that has a policy attached via a targetRef.

Is this fully correct? I think it is only called in certain circumstances, e.g. only for HTTP (or HTTPS) listeners? (as opposed to ApplyVHost)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not entirely sure. I think ApplyForVHost runs when section name is used, where ApplyRouteConfigPlugin runs when targeting whole gateway

Copy link
Contributor Author

@puertomontt puertomontt Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

feel free to check my work but this is what I noted in the code

  1. ComputeListener
  2. ApplyListenerPlugin
  3. ComputeRouteConfiguration
  4. computeVirtualHost
  5. envoyRoutes
  6. translateRouteAction
  7. ApplyForBackend
  8. ApplyForRouteBackend
  9. runRoutePlugins
  10. ApplyForRoute
  11. runVhostPlugins
  12. ApplyVhostPlugin
  13. ApplyRouteConfigPlugin
  14. HttpFilters

ApplyRouteConfigPlugin(
pCtx *RouteConfigContext,
out *envoyroutev3.RouteConfiguration,
)

NetworkFilters() ([]filters.StagedNetworkFilter, error)

// called 1 time per filter-chain.
Expand Down
4 changes: 2 additions & 2 deletions test/e2e/tests/api_validation_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -439,7 +439,7 @@ spec:
wantErrors: []string{"retryOn or statusCodes must be set"},
},
{
name: "TrafficPolicy: retry.perTryTimeout must be lesser than timeouts.request",
name: "TrafficPolicy: retry.perTryTimeout must be less than timeouts.request",
input: `---
apiVersion: gateway.kgateway.dev/v1alpha1
kind: TrafficPolicy
Expand All @@ -457,7 +457,7 @@ spec:
request: 5s
streamIdle: 60s
`,
wantErrors: []string{"retry.perTryTimeout must be lesser than timeouts.request"},
wantErrors: []string{"retry.perTryTimeout must be less than timeouts.request"},
},
{
name: "TrafficPolicy: retry.perTryTimeout must be at least 1ms",
Expand Down