httpfilter

Documentation

Overview

Package httpfilter holds the controller's admission webhook for the HTTPFilter CRD (proposal 025, the proxy-extension escape hatch). It validates the opaque spec.typedConfig fail-closed, IN-PROCESS — no Envoy binary — by resolving the `@type` against the linked Envoy protos and running protoc-gen-validate, plus the filter allow-list. A bad escape-hatch payload is rejected at CRD apply instead of NACKing the proxy fleet (the Istio EnvoyFilter footgun, made fail-closed).

Index

• type Validator
  • func (v *Validator) Handle(ctx context.Context, req admission.Request) admission.Response

Types

type Validator

type Validator struct {
	// Reader lists existing HTTPFilters for the one-CHAIN-filter-per-service check
	// (025 M4). Use the manager's APIReader (uncached — correct regardless of cache
	// scope). Optional: when nil the dup check is skipped (the projector still
	// tie-breaks deterministically).
	Reader client.Reader
	Log    *slog.Logger
}

Validator is served by the controller's shared /validate dispatcher, keyed by the HTTPFilter Kind.

func (*Validator) Handle

func (v *Validator) Handle(ctx context.Context, req admission.Request) admission.Response

Handle validates the incoming HTTPFilter's spec.