Adds AuthenticationFilter Support to IR.#813
Conversation
There was a problem hiding this comment.
It might be so, that this call is triggered multiple times for the same authentication filter, as multiple httproutes could use the same authn filter.
If we just store authentication filter NamespacedName as key in resourceMap then after processing all httproutes we can do the getAuthenticationFilter call for unique filters.
There was a problem hiding this comment.
Commit 07e3398 resolves this comment. I took a slightly different approach than what you suggested, PTAL.
internal/gatewayapi/testdata/httproute-with-valid-authenfilter.in.yaml
Outdated
Show resolved
Hide resolved
internal/ir/xds.go
Outdated
There was a problem hiding this comment.
shouldnt this be per HTTPRoute instead of per HTTPListener
There was a problem hiding this comment.
JWT is configured as an Envoy listener filter, specifically envoy.filters.http.jwt_authn. The request authentication design provides examples of how the AuthentictionFilter<>HTTPRoutre resources are translated into an xDS config. The authenticationfilter.spec.jwtProviders[] are translated into jwt providers of the xDS IR. The httproute.spec.rules[].matches[] associated to httproute.spec.rules[].filters[] (of type AuthenticationFilter) are translated into jwt matches of the xDS IR. The JWT filter associated to a listener processes the request before routing.
There was a problem hiding this comment.
would recommend looking into the route config here https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#config-route-v3-route which allows you to the same thing using the typed_per_filter_config field within Route. This eliminates the need to duplicate the info in httproute.spec.rules[].matches[] since it is already applicable to the route
There was a problem hiding this comment.
@arkodg thanks for the review and pointer. Commit cf98e95 updates RequestAuthentication to be a field of HTTPRoute instead of HTTPListener.
There was a problem hiding this comment.
thanks for incorporating this, this will continue to keep the mapping of GAPI resources to xDS resources easy to maintain
Codecov Report
@@ Coverage Diff @@
## main #813 +/- ##
==========================================
- Coverage 64.10% 63.38% -0.72%
==========================================
Files 52 53 +1
Lines 7170 7330 +160
==========================================
+ Hits 4596 4646 +50
- Misses 2290 2396 +106
- Partials 284 288 +4
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. |
Signed-off-by: danehans <daneyonhansen@gmail.com>
Signed-off-by: danehans <daneyonhansen@gmail.com>
Signed-off-by: danehans <daneyonhansen@gmail.com>
Adds AuthenticationFilter support to IR:
api/v1alpha1/validation/authenticationfilter.go: Adds validation package for validating the AuthenticationFilter type.internal/ir/xds.go: Adds internal Request Authentication types with initial support for JWT.Requires #804
xref: #790