Skip to content

Commit c429eac

Browse files
shreealtshreealt
authored
feat: support retry policy for http ext auth (#7326)
* feat: support retry policy for http ext auth Signed-off-by: Shreemaan Abhishek <[email protected]>
1 parent 273ce8d commit c429eac

File tree

10 files changed

+526
-16
lines changed

10 files changed

+526
-16
lines changed

‎go.mod‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@ require (
1515
github.com/docker/cli v28.5.1+incompatible
1616
github.com/docker/docker v28.3.3+incompatible
1717
github.com/dominikbraun/graph v0.23.0
18-
github.com/envoyproxy/go-control-plane v0.13.5-0.20250929230642-07d3df27ff4f
18+
github.com/envoyproxy/go-control-plane v0.13.5-0.20251022160057-de4316c523b7
1919
github.com/envoyproxy/go-control-plane/contrib v1.32.5-0.20250430092421-68a532e11403
20-
github.com/envoyproxy/go-control-plane/envoy v1.35.1-0.20250929230642-07d3df27ff4f
20+
github.com/envoyproxy/go-control-plane/envoy v1.35.1-0.20251022160057-de4316c523b7
2121
github.com/envoyproxy/go-control-plane/ratelimit v0.1.1-0.20250805143705-d51f8590a549
2222
github.com/envoyproxy/ratelimit v1.4.1-0.20230427142404-e2a87f41d3a7
2323
github.com/evanphx/json-patch v5.9.11+incompatible

‎go.sum‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -173,12 +173,12 @@ github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRr
173173
github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
174174
github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
175175
github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
176-
github.com/envoyproxy/go-control-plane v0.13.5-0.20250929230642-07d3df27ff4f h1:36vvJBe/wXWfD7qrTb1WnbPVPMxNFDfEygztH8wgebw=
177-
github.com/envoyproxy/go-control-plane v0.13.5-0.20250929230642-07d3df27ff4f/go.mod h1:PTY7yDlLxB4bW7rEOO7e79uTDr9yXzpuI1QGIDfxEzc=
176+
github.com/envoyproxy/go-control-plane v0.13.5-0.20251022160057-de4316c523b7 h1:JsOVlgacLOjgYWGb4V2E/d/c/o4+HEvYjr0+KnL4j4o=
177+
github.com/envoyproxy/go-control-plane v0.13.5-0.20251022160057-de4316c523b7/go.mod h1:Alz8LEClvR7xKsrq3qzoc4N0guvVNSS8KmSChGYr9hs=
178178
github.com/envoyproxy/go-control-plane/contrib v1.32.5-0.20250430092421-68a532e11403 h1:5wPocL1bGYhA4TtKZwcdVI5fsXo1JatkbcxPBcFQswc=
179179
github.com/envoyproxy/go-control-plane/contrib v1.32.5-0.20250430092421-68a532e11403/go.mod h1:Xkwx/TGvEKRCL2mitdiuQWOD1ECvfM5krWWVo2vI2Zk=
180-
github.com/envoyproxy/go-control-plane/envoy v1.35.1-0.20250929230642-07d3df27ff4f h1:4efYrIQgVRwCmwCveby6ck+VpxqzibdOL1Out1rJqqc=
181-
github.com/envoyproxy/go-control-plane/envoy v1.35.1-0.20250929230642-07d3df27ff4f/go.mod h1:2LcmvJoXsDSrsGZIxGM0Gah9ykiwTn/kgjyQdnNH8Jc=
180+
github.com/envoyproxy/go-control-plane/envoy v1.35.1-0.20251022160057-de4316c523b7 h1:Q4zISHdb9brRNvzmQl8Bwvap7GAtGrQjHyyw9OYmkFk=
181+
github.com/envoyproxy/go-control-plane/envoy v1.35.1-0.20251022160057-de4316c523b7/go.mod h1:ty89S1YCCVruQAm9OtKeEkQLTb+Lkz0k8v9W0Oxsv98=
182182
github.com/envoyproxy/go-control-plane/ratelimit v0.1.1-0.20250805143705-d51f8590a549 h1:5K0vH5H4dtCIO8+w/yq6vDaMcGn9RoPrHfmPAFAztwU=
183183
github.com/envoyproxy/go-control-plane/ratelimit v0.1.1-0.20250805143705-d51f8590a549/go.mod h1:KxtyvDAPIEkqUUvF9ooo5gSGVOtQ08wUTnQe5LsJC6c=
184184
github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=

‎internal/xds/extensions/extensions.gen.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ import (
7676
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/clusters/dns/v3"
7777
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/clusters/dynamic_forward_proxy/v3"
7878
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/clusters/redis/v3"
79+
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/clusters/reverse_connection/v3"
7980
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/common/async_files/v3"
8081
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/common/aws/v3"
8182
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/common/dynamic_forward_proxy/v3"
@@ -140,6 +141,7 @@ import (
140141
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/kill_request/v3"
141142
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/local_ratelimit/v3"
142143
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/lua/v3"
144+
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/mcp/v3"
143145
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/oauth2/v3"
144146
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/on_demand/v3"
145147
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/original_src/v3"
@@ -224,6 +226,7 @@ import (
224226
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/http/custom_response/local_response_policy/v3"
225227
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/http/custom_response/redirect_policy/v3"
226228
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/http/early_header_mutation/header_mutation/v3"
229+
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/http/ext_proc/processing_request_modifiers/mapped_attribute_builder/v3"
227230
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/http/ext_proc/response_processors/save_processing_response/v3"
228231
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/http/header_formatters/preserve_case/v3"
229232
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/http/header_validators/envoy_default/v3"
@@ -253,6 +256,7 @@ import (
253256
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/matching/common_inputs/environment_variable/v3"
254257
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/matching/common_inputs/network/v3"
255258
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/matching/common_inputs/ssl/v3"
259+
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/matching/common_inputs/stats/v3"
256260
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/matching/input_matchers/consistent_hashing/v3"
257261
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/matching/input_matchers/ip/v3"
258262
_ "github.com/envoyproxy/go-control-plane/envoy/extensions/matching/input_matchers/metadata/v3"

‎internal/xds/translator/extauth.go‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -134,26 +134,32 @@ func extAuthConfig(extAuth *ir.ExtAuth) (*extauthv3.ExtAuthz, error) {
134134
timeout = durationpb.New(extAuth.Timeout.Duration)
135135
}
136136

137+
var rp *corev3.RetryPolicy
138+
// Set the retry policy if it exists.
139+
if extAuth.Traffic != nil && extAuth.Traffic.Retry != nil {
140+
var err error
141+
rp, err = buildNonRouteRetryPolicy(extAuth.Traffic.Retry)
142+
if err != nil {
143+
return nil, fmt.Errorf("build retry policy for http service: %w", err)
144+
}
145+
}
146+
137147
if extAuth.HTTP != nil {
148+
hs := httpService(extAuth.HTTP, timeout)
149+
hs.RetryPolicy = rp
150+
138151
config.Services = &extauthv3.ExtAuthz_HttpService{
139-
HttpService: httpService(extAuth.HTTP, timeout),
152+
HttpService: hs,
140153
}
141-
// Retry policy is not supported for HTTP service.
142154
} else if extAuth.GRPC != nil {
143155
service := &corev3.GrpcService{
144156
TargetSpecifier: &corev3.GrpcService_EnvoyGrpc_{
145157
EnvoyGrpc: grpcService(extAuth.GRPC),
146158
},
147159
Timeout: timeout,
148160
}
149-
// Set the retry policy if it exists.
150-
if extAuth.Traffic != nil && extAuth.Traffic.Retry != nil {
151-
rp, err := buildNonRouteRetryPolicy(extAuth.Traffic.Retry)
152-
if err != nil {
153-
return nil, fmt.Errorf("build retry policy for gRPC service: %w", err)
154-
}
155-
service.RetryPolicy = rp
156-
}
161+
service.RetryPolicy = rp
162+
157163
config.Services = &extauthv3.ExtAuthz_GrpcService{
158164
GrpcService: service,
159165
}

‎internal/xds/translator/testdata/in/xds-ir/ext-auth-http-retry.yaml‎

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
http:
2+
- address: 0.0.0.0
3+
hostnames:
4+
- '*'
5+
isHTTP2: false
6+
name: default/gateway-1/http
7+
path:
8+
escapedSlashesAction: UnescapeAndRedirect
9+
mergeSlashes: true
10+
port: 10080
11+
routes:
12+
- name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
13+
hostname: www.foo.com
14+
isHTTP2: false
15+
pathMatch:
16+
distinct: false
17+
name: ""
18+
prefix: /foo1
19+
backendWeights:
20+
invalid: 0
21+
valid: 0
22+
destination:
23+
name: httproute/default/httproute-1/rule/0
24+
settings:
25+
- addressType: IP
26+
endpoints:
27+
- host: 7.7.7.7
28+
port: 8080
29+
protocol: HTTP
30+
weight: 1
31+
name: httproute/default/httproute-1/rule/0/backend/0
32+
security:
33+
extAuth:
34+
name: securitypolicy/default/policy-for-http-route-1
35+
traffic:
36+
retry:
37+
numRetries: 2
38+
perRetry:
39+
backOff:
40+
baseInterval: 200ms
41+
maxInterval: 3s
42+
timeout: 3s
43+
retryOn:
44+
triggers:
45+
- 5xx
46+
- deadline-exceeded
47+
- internal
48+
- unavailable
49+
failOpen: false
50+
http:
51+
authority: http-backend.default:9000
52+
destination:
53+
name: securitypolicy/default/policy-for-http-route-1/default/http-backend
54+
settings:
55+
- addressType: IP
56+
endpoints:
57+
- host: 8.8.4.4
58+
port: 9001
59+
protocol: HTTP
60+
weight: 1
61+
name: securitypolicy/default/policy-for-http-route-1/default/http-backend/backend/0
62+
- addressType: IP
63+
endpoints:
64+
- host: 8.8.8.8
65+
port: 9000
66+
protocol: HTTP
67+
weight: 1
68+
name: securitypolicy/default/policy-for-http-route-1/default/http-backend/backend/1
69+
headersToExtAuth:
70+
- header1
71+
- header2
72+
- name: httproute/default/httproute-1/rule/1/match/0/www_foo_com
73+
hostname: www.foo.com
74+
isHTTP2: false
75+
pathMatch:
76+
distinct: false
77+
name: ""
78+
prefix: /foo2
79+
backendWeights:
80+
invalid: 0
81+
valid: 0
82+
destination:
83+
name: httproute/default/httproute-1/rule/1
84+
settings:
85+
- addressType: IP
86+
endpoints:
87+
- host: 7.7.7.7
88+
port: 8080
89+
protocol: HTTP
90+
weight: 1
91+
name: httproute/default/httproute-1/rule/1/backend/0
92+
security:
93+
extAuth:
94+
name: securitypolicy/default/policy-for-http-route-1
95+
traffic:
96+
retry:
97+
numRetries: 2
98+
perRetry:
99+
backOff:
100+
baseInterval: 200ms
101+
maxInterval: 3s
102+
timeout: 3s
103+
retryOn:
104+
triggers:
105+
- 5xx
106+
- deadline-exceeded
107+
- internal
108+
- unavailable
109+
failOpen: false
110+
http:
111+
authority: http-backend.default:9000
112+
destination:
113+
name: securitypolicy/default/policy-for-http-route-1/default/http-backend
114+
settings:
115+
- addressType: IP
116+
endpoints:
117+
- host: 8.8.8.8
118+
port: 9000
119+
protocol: HTTP
120+
weight: 1
121+
name: securitypolicy/default/policy-for-http-route-1/default/http-backend/backend/0
122+
headersToExtAuth:
123+
- header1
124+
- header2
125+
- name: httproute/default/httproute-2/rule/0/match/0/www_bar_com
126+
hostname: www.bar.com
127+
isHTTP2: false
128+
pathMatch:
129+
distinct: false
130+
name: ""
131+
prefix: /bar
132+
backendWeights:
133+
invalid: 0
134+
valid: 0
135+
destination:
136+
name: httproute/default/httproute-2/rule/0
137+
settings:
138+
- addressType: IP
139+
endpoints:
140+
- host: 7.7.7.7
141+
port: 8080
142+
protocol: HTTP
143+
weight: 1
144+
name: httproute/default/httproute-2/rule/0/backend/0
145+
security:
146+
extAuth:
147+
name: securitypolicy/default/policy-for-gateway-1
148+
traffic:
149+
retry:
150+
numRetries: 2
151+
perRetry:
152+
backOff:
153+
baseInterval: 200ms
154+
maxInterval: 3s
155+
timeout: 3s
156+
retryOn:
157+
triggers:
158+
- 5xx
159+
- deadline-exceeded
160+
- internal
161+
- unavailable
162+
failOpen: true
163+
http:
164+
authority: http-backend.envoy-gateway:80
165+
destination:
166+
name: securitypolicy/default/policy-for-gateway-1/envoy-gateway/http-backend
167+
settings:
168+
- addressType: IP
169+
endpoints:
170+
- host: 7.7.7.7
171+
port: 80
172+
protocol: HTTP
173+
weight: 1
174+
name: securitypolicy/default/policy-for-gateway-1/envoy-gateway/http-backend/backend/0
175+
headersToBackend:
176+
- header1
177+
- header2
178+
path: /auth

0 commit comments

Comments
 (0)