Skip to content

feat: support route rule in SecurityPolicy target#6335

Merged
arkodg merged 8 commits intoenvoyproxy:mainfrom
kkk777-7:feat-security-policy-section-for-route
Jul 22, 2025
Merged

feat: support route rule in SecurityPolicy target#6335
arkodg merged 8 commits intoenvoyproxy:mainfrom
kkk777-7:feat-security-policy-section-for-route

Conversation

@kkk777-7
Copy link
Copy Markdown
Member

@kkk777-7 kkk777-7 commented Jun 17, 2025 •
edited
Loading

What this PR does / why we need it:
It allows to target only a specific route rule in a Security Policy.

According to the Gateway API specification: https://gateway-api.sigs.k8s.io/geps/gep-2648/#section-names

  • If the target resource does not have the section name specified by the policy, the policy attachment will fail.
  • If multiple policies are attached to the same section name, they are processed according to the standard conflict resolution rules.
  • When multiple Policies of the same type target the same object, one with a sectionName and one without, the more specific policy will have its entire spec applied to the named section. The less specific policy will have its spec applied to all other sections of the target that are not targeted by any other more specific policies.

overriding/merging strategy

overrides are applied in the following order of precedence:
Route Rule > xRoute > Listener > Gateway
(Due to the third rule of the Gateway API specification above, the combination of Route Rule/xRoute and Listener/Gateway can also be interpreted as a merge.)

Related Issue

#4085
remain issue open as all policies have not been addressed.

@codecov
Copy link
Copy Markdown

codecov bot commented Jun 17, 2025 •
edited
Loading

Codecov Report

Attention: Patch coverage is 93.93939% with 10 lines in your changes missing coverage. Please review.

Project coverage is 71.17%. Comparing base (b58edd7) to head (938c9f1).
Report is 17 commits behind head on main.

Files with missing lines Patch % Lines
internal/gatewayapi/securitypolicy.go 93.93% 9 Missing and 1 partial ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #6335      +/-   ##
==========================================
+ Coverage   71.12%   71.17%   +0.05%     
==========================================
  Files         220      220              
  Lines       37971    38056      +85     
==========================================
+ Hits        27005    27086      +81     
- Misses       9393     9396       +3     
- Partials     1573     1574       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

kkk777-7 added 2 commits June 18, 2025 02:45
@kkk777-7
feat: section name to route rule in security policy
2955e08 
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
@kkk777-7
add gatewayapi testdata
e48670a 
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
@kkk777-7 kkk777-7 force-pushed the feat-security-policy-section-for-route branch from 76d8ff7 to e48670a Compare June 17, 2025 17:45
@kkk777-7 kkk777-7 marked this pull request as ready for review June 17, 2025 17:49
@kkk777-7 kkk777-7 requested a review from a team as a code owner June 17, 2025 17:49
kkk777-7 added 2 commits June 18, 2025 21:31
@kkk777-7
update error status message
e613626 
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
@kkk777-7
update error policy status reason
f6bdc30 
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
@arkodg arkodg mentioned this pull request Jun 26, 2025
Closed
@ion-elgreco ion-elgreco mentioned this pull request Jul 7, 2025
Closed
@arkodg arkodg added this to the v1.5.0-rc.1 Release milestone Jul 7, 2025
@kkk777-7
Merge branch 'main' into feat-security-policy-section-for-route
790b957 
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
@zhaohuabing
Copy link
Copy Markdown
Member

zhaohuabing commented Jul 18, 2025 •
edited
Loading

Hi @kkk777-7 thanks for working on this - this PR looks great!

Could you please also add an e2e test to verify the route rule level SecurityPolicy? (you could update an existing SP test, such as basic auth or API key auth, to set the SP at route rule level)

zhaohuabing
zhaohuabing previously approved these changes Jul 18, 2025
View reviewed changes
@kkk777-7
Merge branch 'main' into feat-security-policy-section-for-route
a02f5c4 
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
@zhaohuabing
Copy link
Copy Markdown
Member

zhaohuabing commented Jul 21, 2025

/retest

@kkk777-7
add e2e for route rule level sp
0104bd0 
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
@kkk777-7
Copy link
Copy Markdown
Member Author

kkk777-7 commented Jul 21, 2025

@zhaohuabing
thanks for review!
I've added e2e test, please check when you have a moment.

@kkk777-7
fix yaml lint
938c9f1 
Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com>
arkodg
arkodg reviewed Jul 21, 2025
View reviewed changes
internal/gatewayapi/securitypolicy.go
// 1. First translate Policies targeting xRoutes
// 2. Then translate Policies targeting Listeners
// 3. Finally, the policies targeting Gateways
// 1. First translate Policies targeting RouteRules
Copy link
Copy Markdown
Contributor

@arkodg arkodg Jul 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if we dont support 4 levels of replacement for other policies like BTP and EEP, can we raise a GH issue to track that work ?

Copy link
Copy Markdown
Member

@zhaohuabing zhaohuabing Jul 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@arkodg 👉 #4085

arkodg
arkodg approved these changes Jul 21, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@arkodg arkodg left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM thanks

@arkodg arkodg requested review from a team and zhaohuabing July 21, 2025 21:46
@arkodg
Copy link
Copy Markdown
Contributor

arkodg commented Jul 21, 2025 •
edited
Loading

thanks @kkk777-7, would be great if we can have 1 testdata showing 4 level replace

@arkodg arkodg merged commit c3abe4e into envoyproxy:main Jul 22, 2025
28 checks passed
This was referenced Jul 27, 2025
Closed
Merged
@arkodg arkodg mentioned this pull request Jul 28, 2025
Closed
3 tasks
@arkodg arkodg mentioned this pull request Oct 1, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zhaohuabing zhaohuabing zhaohuabing approved these changes

@arkodg arkodg arkodg approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

v1.5.0-rc.1 Release

Development

Successfully merging this pull request may close these issues.

4 participants

@kkk777-7 @zhaohuabing @arkodg @nacx