Add ExtensionFilter API to extensions#3650
Open
liamawhite wants to merge 5 commits intoistio:masterfrom
Open
Conversation
istio-testing
added
the
do-not-merge/work-in-progress
|
😊 Welcome @liamawhite! This is either your first contribution to the Istio api repo, or it's been You can learn more about the Istio working groups, Code of Conduct, and contribution guidelines Thanks for contributing! Courtesy of your friendly welcome wagon. |
istio-testing
added
the
size/XL
- Move top-level TrafficSelector to extension_filter.proto - Keep WasmPlugin.TrafficSelector nested for backward compat - Remove targetRef from ExtensionFilter - Add release notes
istio-policy-bot
added
the
lifecycle/stale
liamawhite
commented
Mar 17, 2026
istio-policy-bot
removed
the
lifecycle/stale
liamawhite
changed the title
liamawhite
removed
the
do-not-merge/work-in-progress
keithmattix
reviewed
Mar 17, 2026
…mment - Renumber ExtensionFilter fields to be contiguous (targetRefs=2, phase=3, priority=4, match=5) - Wrap wasm/lua in oneof filter_config for type-safe mutual exclusion - Clarify priority tiebreaker ordering (creationTimestamp, then name/namespace) - Regenerate pb.go, pb.html, and CRD YAML
keithmattix
approved these changes
Mar 20, 2026
Contributor
ramaraochavali
left a comment
ramaraochavali
left a comment
There was a problem hiding this comment.
LGTM. Couple of naming questions for discussion
| // --> | ||
| // +kubebuilder:validation:XValidation:message="only one of targetRefs or selector can be set",rule="(has(self.selector)?1:0)+(has(self.targetRefs)?1:0)<=1" | ||
| // +kubebuilder:validation:XValidation:message="exactly one of wasm or lua must be set",rule="has(self.wasm) != has(self.lua)" | ||
| message ExtensionFilter { |
Contributor
There was a problem hiding this comment.
Filter in the name seems an implementation detail. Can we call it more generic like TrafficExtension/MeshExtension/ProxyExtensoin/ExtensionPolicy?
| // +kubebuilder:validation:XValidation:message="exactly one of wasm or lua must be set",rule="has(self.wasm) != has(self.lua)" | ||
| message ExtensionFilter { | ||
| // Optional. Criteria used to select the specific set of pods/VMs on which | ||
| // this plugin configuration should be applied. If omitted, this |
Contributor
There was a problem hiding this comment.
nit: "this plugin" needs to change
| repeated istio.type.v1beta1.PolicyTargetReference targetRefs = 2; | ||
|
|
||
| // Determines where in the filter chain this `ExtensionFilter` is to be injected. | ||
| PluginPhase phase = 3; |
Contributor
There was a problem hiding this comment.
Again the PluginPhase seems WASM plugin specific. Should we call ExecutionPhase or Phase?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Please provide a description of this PR:
Adds native support for Lua filters as described in the following design doc.
Related implementation PR is here.