Skip to content

Commit a67ac30

Browse files
zhaohuabingzhaohuabing
authored
chore: add missing filters in the filter order configuration (#7404)
* add missing filters in the filter order configuration Signed-off-by: Huabing Zhao <[email protected]> * fix wrong filter name Signed-off-by: Huabing Zhao <[email protected]>
1 parent fec6824 commit a67ac30

File tree

16 files changed

+193
-75
lines changed

16 files changed

+193
-75
lines changed

‎api/v1alpha1/envoyproxy_types.go‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,8 @@ type EnvoyProxySpec struct {
106106
//
107107
// - envoy.filters.http.ext_authz
108108
//
109+
// - envoy.filters.http.api_key_auth
110+
//
109111
// - envoy.filters.http.basic_auth
110112
//
111113
// - envoy.filters.http.oauth2
@@ -114,6 +116,8 @@ type EnvoyProxySpec struct {
114116
//
115117
// - envoy.filters.http.stateful_session
116118
//
119+
// - envoy.filters.http.buffer
120+
//
117121
// - envoy.filters.http.lua
118122
//
119123
// - envoy.filters.http.ext_proc
@@ -126,8 +130,16 @@ type EnvoyProxySpec struct {
126130
//
127131
// - envoy.filters.http.ratelimit
128132
//
133+
// - envoy.filters.http.grpc_web
134+
//
135+
// - envoy.filters.http.grpc_stats
136+
//
129137
// - envoy.filters.http.custom_response
130138
//
139+
// - envoy.filters.http.credential_injector
140+
//
141+
// - envoy.filters.http.compressor
142+
//
131143
// - envoy.filters.http.router
132144
//
133145
// Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain.
@@ -222,7 +234,7 @@ type FilterPosition struct {
222234
}
223235

224236
// EnvoyFilter defines the type of Envoy HTTP filter.
225-
// +kubebuilder:validation:Enum=envoy.filters.http.health_check;envoy.filters.http.fault;envoy.filters.http.cors;envoy.filters.http.ext_authz;envoy.filters.http.api_key_auth;envoy.filters.http.basic_auth;envoy.filters.http.oauth2;envoy.filters.http.jwt_authn;envoy.filters.http.stateful_session;envoy.filters.http.lua;envoy.filters.http.ext_proc;envoy.filters.http.wasm;envoy.filters.http.rbac;envoy.filters.http.local_ratelimit;envoy.filters.http.ratelimit;envoy.filters.http.custom_response;envoy.filters.http.compressor
237+
// +kubebuilder:validation:Enum=envoy.filters.http.health_check;envoy.filters.http.fault;envoy.filters.http.cors;envoy.filters.http.ext_authz;envoy.filters.http.api_key_auth;envoy.filters.http.basic_auth;envoy.filters.http.oauth2;envoy.filters.http.jwt_authn;envoy.filters.http.stateful_session;envoy.filters.http.buffer;envoy.filters.http.lua;envoy.filters.http.ext_proc;envoy.filters.http.wasm;envoy.filters.http.rbac;envoy.filters.http.local_ratelimit;envoy.filters.http.ratelimit;envoy.filters.http.grpc_web;envoy.filters.http.grpc_stats;envoy.filters.http.custom_response;envoy.filters.http.credential_injector;envoy.filters.http.compressor
226238
type EnvoyFilter string
227239

228240
const (

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -292,6 +292,8 @@ spec:
292292

293293
- envoy.filters.http.ext_authz
294294

295+
- envoy.filters.http.api_key_auth
296+
295297
- envoy.filters.http.basic_auth
296298

297299
- envoy.filters.http.oauth2
@@ -300,6 +302,8 @@ spec:
300302

301303
- envoy.filters.http.stateful_session
302304

305+
- envoy.filters.http.buffer
306+
303307
- envoy.filters.http.lua
304308

305309
- envoy.filters.http.ext_proc
@@ -312,8 +316,16 @@ spec:
312316

313317
- envoy.filters.http.ratelimit
314318

319+
- envoy.filters.http.grpc_web
320+
321+
- envoy.filters.http.grpc_stats
322+
315323
- envoy.filters.http.custom_response
316324

325+
- envoy.filters.http.credential_injector
326+
327+
- envoy.filters.http.compressor
328+
317329
- envoy.filters.http.router
318330

319331
Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain.
@@ -335,13 +347,17 @@ spec:
335347
- envoy.filters.http.oauth2
336348
- envoy.filters.http.jwt_authn
337349
- envoy.filters.http.stateful_session
350+
- envoy.filters.http.buffer
338351
- envoy.filters.http.lua
339352
- envoy.filters.http.ext_proc
340353
- envoy.filters.http.wasm
341354
- envoy.filters.http.rbac
342355
- envoy.filters.http.local_ratelimit
343356
- envoy.filters.http.ratelimit
357+
- envoy.filters.http.grpc_web
358+
- envoy.filters.http.grpc_stats
344359
- envoy.filters.http.custom_response
360+
- envoy.filters.http.credential_injector
345361
- envoy.filters.http.compressor
346362
type: string
347363
before:
@@ -358,13 +374,17 @@ spec:
358374
- envoy.filters.http.oauth2
359375
- envoy.filters.http.jwt_authn
360376
- envoy.filters.http.stateful_session
377+
- envoy.filters.http.buffer
361378
- envoy.filters.http.lua
362379
- envoy.filters.http.ext_proc
363380
- envoy.filters.http.wasm
364381
- envoy.filters.http.rbac
365382
- envoy.filters.http.local_ratelimit
366383
- envoy.filters.http.ratelimit
384+
- envoy.filters.http.grpc_web
385+
- envoy.filters.http.grpc_stats
367386
- envoy.filters.http.custom_response
387+
- envoy.filters.http.credential_injector
368388
- envoy.filters.http.compressor
369389
type: string
370390
name:
@@ -379,13 +399,17 @@ spec:
379399
- envoy.filters.http.oauth2
380400
- envoy.filters.http.jwt_authn
381401
- envoy.filters.http.stateful_session
402+
- envoy.filters.http.buffer
382403
- envoy.filters.http.lua
383404
- envoy.filters.http.ext_proc
384405
- envoy.filters.http.wasm
385406
- envoy.filters.http.rbac
386407
- envoy.filters.http.local_ratelimit
387408
- envoy.filters.http.ratelimit
409+
- envoy.filters.http.grpc_web
410+
- envoy.filters.http.grpc_stats
388411
- envoy.filters.http.custom_response
412+
- envoy.filters.http.credential_injector
389413
- envoy.filters.http.compressor
390414
type: string
391415
required:

‎charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -291,6 +291,8 @@ spec:
291291

292292
- envoy.filters.http.ext_authz
293293

294+
- envoy.filters.http.api_key_auth
295+
294296
- envoy.filters.http.basic_auth
295297

296298
- envoy.filters.http.oauth2
@@ -299,6 +301,8 @@ spec:
299301

300302
- envoy.filters.http.stateful_session
301303

304+
- envoy.filters.http.buffer
305+
302306
- envoy.filters.http.lua
303307

304308
- envoy.filters.http.ext_proc
@@ -311,8 +315,16 @@ spec:
311315

312316
- envoy.filters.http.ratelimit
313317

318+
- envoy.filters.http.grpc_web
319+
320+
- envoy.filters.http.grpc_stats
321+
314322
- envoy.filters.http.custom_response
315323

324+
- envoy.filters.http.credential_injector
325+
326+
- envoy.filters.http.compressor
327+
316328
- envoy.filters.http.router
317329

318330
Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain.
@@ -334,13 +346,17 @@ spec:
334346
- envoy.filters.http.oauth2
335347
- envoy.filters.http.jwt_authn
336348
- envoy.filters.http.stateful_session
349+
- envoy.filters.http.buffer
337350
- envoy.filters.http.lua
338351
- envoy.filters.http.ext_proc
339352
- envoy.filters.http.wasm
340353
- envoy.filters.http.rbac
341354
- envoy.filters.http.local_ratelimit
342355
- envoy.filters.http.ratelimit
356+
- envoy.filters.http.grpc_web
357+
- envoy.filters.http.grpc_stats
343358
- envoy.filters.http.custom_response
359+
- envoy.filters.http.credential_injector
344360
- envoy.filters.http.compressor
345361
type: string
346362
before:
@@ -357,13 +373,17 @@ spec:
357373
- envoy.filters.http.oauth2
358374
- envoy.filters.http.jwt_authn
359375
- envoy.filters.http.stateful_session
376+
- envoy.filters.http.buffer
360377
- envoy.filters.http.lua
361378
- envoy.filters.http.ext_proc
362379
- envoy.filters.http.wasm
363380
- envoy.filters.http.rbac
364381
- envoy.filters.http.local_ratelimit
365382
- envoy.filters.http.ratelimit
383+
- envoy.filters.http.grpc_web
384+
- envoy.filters.http.grpc_stats
366385
- envoy.filters.http.custom_response
386+
- envoy.filters.http.credential_injector
367387
- envoy.filters.http.compressor
368388
type: string
369389
name:
@@ -378,13 +398,17 @@ spec:
378398
- envoy.filters.http.oauth2
379399
- envoy.filters.http.jwt_authn
380400
- envoy.filters.http.stateful_session
401+
- envoy.filters.http.buffer
381402
- envoy.filters.http.lua
382403
- envoy.filters.http.ext_proc
383404
- envoy.filters.http.wasm
384405
- envoy.filters.http.rbac
385406
- envoy.filters.http.local_ratelimit
386407
- envoy.filters.http.ratelimit
408+
- envoy.filters.http.grpc_web
409+
- envoy.filters.http.grpc_stats
387410
- envoy.filters.http.custom_response
411+
- envoy.filters.http.credential_injector
388412
- envoy.filters.http.compressor
389413
type: string
390414
required:

‎internal/gatewayapi/testdata/custom-filter-order.in.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ envoyProxyForGatewayClass:
1717
- name: envoy.filters.http.wasm
1818
before: envoy.filters.http.jwt_authn
1919
- name: envoy.filters.http.cors
20-
after: envoy.filters.http.basic_authn
20+
after: envoy.filters.http.basic_auth
2121
gateways:
2222
- apiVersion: gateway.networking.k8s.io/v1
2323
kind: Gateway

‎internal/gatewayapi/testdata/custom-filter-order.out.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ infraIR:
135135
filterOrder:
136136
- before: envoy.filters.http.jwt_authn
137137
name: envoy.filters.http.wasm
138-
- after: envoy.filters.http.basic_authn
138+
- after: envoy.filters.http.basic_auth
139139
name: envoy.filters.http.cors
140140
logging: {}
141141
status: {}
@@ -221,7 +221,7 @@ xdsIR:
221221
filterOrder:
222222
- before: envoy.filters.http.jwt_authn
223223
name: envoy.filters.http.wasm
224-
- after: envoy.filters.http.basic_authn
224+
- after: envoy.filters.http.basic_auth
225225
name: envoy.filters.http.cors
226226
globalResources:
227227
envoyClientCertificate:

‎internal/xds/translator/testdata/in/xds-ir/custom-filter-order.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
filterOrder:
22
- before: envoy.filters.http.jwt_authn
33
name: envoy.filters.http.wasm
4-
- after: envoy.filters.http.basic_authn
4+
- after: envoy.filters.http.basic_auth
55
name: envoy.filters.http.cors
66
http:
77
- address: 0.0.0.0

‎internal/xds/translator/testdata/out/xds-ir/custom-filter-order.listeners.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,15 @@
1414
initialStreamWindowSize: 65536
1515
maxConcurrentStreams: 100
1616
httpFilters:
17-
- name: envoy.filters.http.cors
18-
typedConfig:
19-
'@type': type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors
2017
- disabled: true
2118
name: envoy.filters.http.basic_auth/securitypolicy/envoy-gateway/policy-for-gateway
2219
typedConfig:
2320
'@type': type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuth
2421
users:
2522
inlineBytes: dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo=
23+
- name: envoy.filters.http.cors
24+
typedConfig:
25+
'@type': type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors
2626
- disabled: true
2727
name: envoy.filters.http.wasm/envoyextensionpolicy/envoy-gateway/policy-for-gateway/0
2828
typedConfig:

‎site/content/en/latest/api/extension_types.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1755,7 +1755,7 @@ _Appears in:_
17551755
| `extraArgs` | _string array_ | false | | ExtraArgs defines additional command line options that are provided to Envoy.<br />More info: https://www.envoyproxy.io/docs/envoy/latest/operations/cli#command-line-options<br />Note: some command line options are used internally(e.g. --log-level) so they cannot be provided here. |
17561756
| `mergeGateways` | _boolean_ | false | | MergeGateways defines if Gateway resources should be merged onto the same Envoy Proxy Infrastructure.<br />Setting this field to true would merge all Gateway Listeners under the parent Gateway Class.<br />This means that the port, protocol and hostname tuple must be unique for every listener.<br />If a duplicate listener is detected, the newer listener (based on timestamp) will be rejected and its status will be updated with a "Accepted=False" condition. |
17571757
| `shutdown` | _[ShutdownConfig](#shutdownconfig)_ | false | | Shutdown defines configuration for graceful envoy shutdown process. |
1758-
| `filterOrder` | _[FilterPosition](#filterposition) array_ | false | | FilterOrder defines the order of filters in the Envoy proxy's HTTP filter chain.<br />The FilterPosition in the list will be applied in the order they are defined.<br />If unspecified, the default filter order is applied.<br />Default filter order is:<br />- envoy.filters.http.health_check<br />- envoy.filters.http.fault<br />- envoy.filters.http.cors<br />- envoy.filters.http.ext_authz<br />- envoy.filters.http.basic_auth<br />- envoy.filters.http.oauth2<br />- envoy.filters.http.jwt_authn<br />- envoy.filters.http.stateful_session<br />- envoy.filters.http.lua<br />- envoy.filters.http.ext_proc<br />- envoy.filters.http.wasm<br />- envoy.filters.http.rbac<br />- envoy.filters.http.local_ratelimit<br />- envoy.filters.http.ratelimit<br />- envoy.filters.http.custom_response<br />- envoy.filters.http.router<br />Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain. |
1758+
| `filterOrder` | _[FilterPosition](#filterposition) array_ | false | | FilterOrder defines the order of filters in the Envoy proxy's HTTP filter chain.<br />The FilterPosition in the list will be applied in the order they are defined.<br />If unspecified, the default filter order is applied.<br />Default filter order is:<br />- envoy.filters.http.health_check<br />- envoy.filters.http.fault<br />- envoy.filters.http.cors<br />- envoy.filters.http.ext_authz<br />- envoy.filters.http.api_key_auth<br />- envoy.filters.http.basic_auth<br />- envoy.filters.http.oauth2<br />- envoy.filters.http.jwt_authn<br />- envoy.filters.http.stateful_session<br />- envoy.filters.http.buffer<br />- envoy.filters.http.lua<br />- envoy.filters.http.ext_proc<br />- envoy.filters.http.wasm<br />- envoy.filters.http.rbac<br />- envoy.filters.http.local_ratelimit<br />- envoy.filters.http.ratelimit<br />- envoy.filters.http.grpc_web<br />- envoy.filters.http.grpc_stats<br />- envoy.filters.http.custom_response<br />- envoy.filters.http.credential_injector<br />- envoy.filters.http.compressor<br />- envoy.filters.http.router<br />Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain. |
17591759
| `backendTLS` | _[BackendTLSConfig](#backendtlsconfig)_ | false | | BackendTLS is the TLS configuration for the Envoy proxy to use when connecting to backends.<br />These settings are applied on backends for which TLS policies are specified. |
17601760
| `ipFamily` | _[IPFamily](#ipfamily)_ | false | | IPFamily specifies the IP family for the EnvoyProxy fleet.<br />This setting only affects the Gateway listener port and does not impact<br />other aspects of the Envoy proxy configuration.<br />If not specified, the system will operate as follows:<br />- It defaults to IPv4 only.<br />- IPv6 and dual-stack environments are not supported in this default configuration.<br />Note: To enable IPv6 or dual-stack functionality, explicit configuration is required. |
17611761
| `preserveRouteOrder` | _boolean_ | false | | PreserveRouteOrder determines if the order of matching for HTTPRoutes is determined by Gateway-API<br />specification (https://gateway-api.sigs.k8s.io/reference/1.4/spec/#httprouterule)<br />or preserves the order defined by users in the HTTPRoute's HTTPRouteRule list.<br />Default: False |

‎site/content/en/latest/tasks/operations/customize-envoyproxy.md‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1025,17 +1025,27 @@ Under the hood, Envoy Gateway uses a series of [Envoy HTTP filters](https://www.
10251025
to process HTTP requests and responses, and to apply various policies.
10261026

10271027
By default, Envoy Gateway applies the following filters in the order shown:
1028+
* envoy.filters.http.health_check
10281029
* envoy.filters.http.fault
10291030
* envoy.filters.http.cors
10301031
* envoy.filters.http.ext_authz
1031-
* envoy.filters.http.basic_authn
1032+
* envoy.filters.http.api_key_auth
1033+
* envoy.filters.http.basic_auth
10321034
* envoy.filters.http.oauth2
10331035
* envoy.filters.http.jwt_authn
1036+
* envoy.filters.http.stateful_session
1037+
* envoy.filters.http.buffer
1038+
* envoy.filters.http.lua
10341039
* envoy.filters.http.ext_proc
10351040
* envoy.filters.http.wasm
10361041
* envoy.filters.http.rbac
10371042
* envoy.filters.http.local_ratelimit
10381043
* envoy.filters.http.ratelimit
1044+
* envoy.filters.http.grpc_web
1045+
* envoy.filters.http.grpc_stats
1046+
* envoy.filters.http.custom_response
1047+
* envoy.filters.http.credential_injector
1048+
* envoy.filters.http.compressor
10391049
* envoy.filters.http.router
10401050

10411051
The default order in which these filters are applied is opinionated and may not suit all use cases.
@@ -1047,7 +1057,7 @@ If a filter occurs in multiple configurations, the final order is the result of
10471057
To avoid conflicts, it is recommended to only specify one configuration per filter.
10481058

10491059
For example, the following configuration moves the `envoy.filters.http.wasm` filter before the `envoy.filters.http.jwt_authn`
1050-
filter and the `envoy.filters.http.cors` filter after the `envoy.filters.http.basic_authn` filter:
1060+
filter and the `envoy.filters.http.cors` filter after the `envoy.filters.http.basic_auth` filter:
10511061

10521062
{{< tabpane text=true >}}
10531063
{{% tab header="Apply from stdin" %}}
@@ -1064,7 +1074,7 @@ spec:
10641074
- name: envoy.filters.http.wasm
10651075
before: envoy.filters.http.jwt_authn
10661076
- name: envoy.filters.http.cors
1067-
after: envoy.filters.http.basic_authn
1077+
after: envoy.filters.http.basic_auth
10681078
EOF
10691079
```
10701080

@@ -1084,7 +1094,7 @@ spec:
10841094
- name: envoy.filters.http.wasm
10851095
before: envoy.filters.http.jwt_authn
10861096
- name: envoy.filters.http.cors
1087-
after: envoy.filters.http.basic_authn
1097+
after: envoy.filters.http.basic_auth
10881098
```
10891099

10901100
{{% /tab %}}

0 commit comments

Comments
 (0)