Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/gateway-extension/Chart.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ type: application
# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 0.2.1
version: 0.2.2

# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
Expand Down
4 changes: 2 additions & 2 deletions charts/gateway-extension/values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -257,8 +257,8 @@ config:
labels: {}

# Feature Gates
# featureGates:
# DisableJWTProviderComputation: true
featureGates:
disable-jwt-provider-computation: false

listener:
type: "tcp" # one of: tcp, unix
Expand Down
2 changes: 1 addition & 1 deletion config.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ application:
environment: development

featureGates:
DisableJWTProviderComputation: true
disable-jwt-provider-computation: true

listener:
type: "tcp" # one of: tcp, unix
Expand Down
2 changes: 1 addition & 1 deletion go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,6 @@ require (
github.com/samber/oops v1.19.0
github.com/stretchr/testify v1.10.0
github.com/veqryn/slog-context v0.8.0
google.golang.org/grpc v1.74.2
google.golang.org/protobuf v1.36.6
k8s.io/apimachinery v0.34.0-beta.0
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397
Expand Down Expand Up @@ -100,6 +99,7 @@ require (
golang.org/x/text v0.26.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
google.golang.org/grpc v1.74.2 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/api v0.33.0 // indirect
Expand Down
20 changes: 0 additions & 20 deletions internal/extensions/extension_server.go
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,6 @@ import (

"github.com/openkcm/gateway-extension/api"
gev1a1 "github.com/openkcm/gateway-extension/api/v1alpha1"
"github.com/openkcm/gateway-extension/internal/flags"
)

type GatewayExtension struct {
Expand Down Expand Up @@ -67,11 +66,6 @@ func (s *GatewayExtension) PostHTTPListenerModify(ctx context.Context, req *pb.P

switch generic.Kind {
case api.JWTProviderKind:
// Do nothing if the feature gate is set
if s.features.IsFeatureEnabled(flags.DisableJWTProviderComputation) {
continue
}

switch generic.APIVersion {
case api.JWTProviderV1Alpha1:
{
Expand Down Expand Up @@ -99,11 +93,6 @@ func (s *GatewayExtension) PostHTTPListenerModify(ctx context.Context, req *pb.P
for key, ext := range resources {
switch key {
case api.JWTProviderKind:
// Do nothing if the feature gate is set
if s.features.IsFeatureEnabled(flags.DisableJWTProviderComputation) {
continue
}

err := s.ProcessJWTProviders(ctx, req.GetListener(), ext)
if err != nil {
return nil, err
Expand All @@ -129,10 +118,6 @@ func (s *GatewayExtension) PostTranslateModify(ctx context.Context, req *pb.Post
Clusters: req.GetClusters(),
Secrets: req.GetSecrets(),
}
// Return response with same data if the feature gate is set
if s.features.IsFeatureEnabled(flags.DisableJWTProviderComputation) {
return resp, nil
}

slogctx.Info(ctx, "Calling ...")

Expand Down Expand Up @@ -161,11 +146,6 @@ func (s *GatewayExtension) PostVirtualHostModify(ctx context.Context, req *pb.Po
VirtualHost: req.GetVirtualHost(),
}

// Return response with same data if the feature gate is set
if s.features.IsFeatureEnabled(flags.DisableJWTProviderComputation) {
return resp, nil
}

if req.GetVirtualHost() == nil {
slogctx.Warn(ctx, "Nil VirtualHost")
return resp, nil
Expand Down
6 changes: 6 additions & 0 deletions internal/extensions/listener_jwt_authn.go
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ import (
slogctx "github.com/veqryn/slog-context"

"github.com/openkcm/gateway-extension/api/v1alpha1"
"github.com/openkcm/gateway-extension/internal/flags"
)

const (
Expand Down Expand Up @@ -51,6 +52,11 @@ func (s *GatewayExtension) ProcessJWTProviders(ctx context.Context, listener *li
if !ok {
continue
}
// Do nothing if the feature gate is set making empty the jwt providers
if s.features.IsFeatureEnabled(flags.DisableJWTProviderComputation) {
slogctx.Warn(ctx, "Skipping JWTProvider as is disabled through flags", "name", jwtp.GetName())
continue
}

slogctx.Info(ctx, "Processing JWTProvider", "name", jwtp.Name)
slogctx.Debug(ctx, "Details on hte JWTProvider", "resource", jwtp)
Expand Down
33 changes: 24 additions & 9 deletions internal/extensions/translate_modify_clusters.go
Original file line number Diff line number Diff line change
Expand Up @@ -12,17 +12,11 @@ import (
endpointv3 "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
tlsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
slogctx "github.com/veqryn/slog-context"
)

func (s *GatewayExtension) TranslateModifyClusters(ctx context.Context, cls []*clusterv3.Cluster) ([]*clusterv3.Cluster, error) {
s.jwtAuthClustersMu.RLock()
defer s.jwtAuthClustersMu.RUnlock()

if len(s.jwtAuthClusters) == 0 {
slogctx.Info(ctx, "No updates on the cached clusters; Continue skip updates of clusters configuration.")
return cls, nil
}
"github.com/openkcm/gateway-extension/internal/flags"
)

func cleanUpClusters(cls []*clusterv3.Cluster) []*clusterv3.Cluster {
clusters := make([]*clusterv3.Cluster, 0)

// remove clusters that has as suffix name `openkcm`,
Expand All @@ -34,6 +28,27 @@ func (s *GatewayExtension) TranslateModifyClusters(ctx context.Context, cls []*c
clusters = append(clusters, c)
}

return clusters
}

func (s *GatewayExtension) TranslateModifyClusters(ctx context.Context, cls []*clusterv3.Cluster) ([]*clusterv3.Cluster, error) {
s.jwtAuthClustersMu.RLock()
defer s.jwtAuthClustersMu.RUnlock()

// Return response with same data if the feature gate is set
if s.features.IsFeatureEnabled(flags.DisableJWTProviderComputation) {
slogctx.Warn(ctx, "Skipping updating the clusters as is disabled through flags")
return cleanUpClusters(cls), nil
}

if len(s.jwtAuthClusters) == 0 {
slogctx.Info(ctx, "No updates on the cached clusters; Continue skip updates of clusters configuration.")
return cls, nil
}

// remove clusters that has as suffix name `openkcm`,
clusters := cleanUpClusters(cls)

// will be added new list of the clusters with the suffix name `openkcm`
for _, v := range s.jwtAuthClusters {
clusterName := v.CustomName()
Expand Down
10 changes: 10 additions & 0 deletions internal/extensions/visrtualhost_routes.go
Original file line number Diff line number Diff line change
Expand Up @@ -9,13 +9,23 @@ import (
routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
jwtauthnv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/jwt_authn/v3"
slogctx "github.com/veqryn/slog-context"

"github.com/openkcm/gateway-extension/internal/flags"
)

func (s *GatewayExtension) VirtualHostModifyRoutes(ctx context.Context, routes []*routev3.Route) error {
for _, r := range routes {
slogctx.Info(ctx, "Updated VirtualHost Route", "name", r.GetName())

filterCfg := r.GetTypedPerFilterConfig()
// Do nothing if the feature gate is set making empty the jwt providers
if s.features.IsFeatureEnabled(flags.DisableJWTProviderComputation) {
slogctx.Warn(ctx, "Skipping JWTProvider as is disabled through flags", "name", r.GetName())
r.TypedPerFilterConfig = make(map[string]*anypb.Any)

return nil
}

if _, ok := filterCfg[egv1a1.EnvoyFilterJWTAuthn.String()]; !ok {
routeCfgProto := &jwtauthnv3.PerRouteConfig{
RequirementSpecifier: &jwtauthnv3.PerRouteConfig_RequirementName{RequirementName: JwtAuthSecureMappingName},
Expand Down
2 changes: 1 addition & 1 deletion internal/flags/flags.go
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
package flags

const (
DisableJWTProviderComputation = "DisableJWTProviderComputation"
DisableJWTProviderComputation = "disable-jwt-provider-computation"
)