gateway: policy filter implementation (#1067)

Watch our custom PolicyFilter objects. Update a "Valid" status condition
to report on whether the PPL could be parsed successfully. Add logic to
apply policies to the generated Pomerium routes.

Add the PolicyFilter CRD to the list of CRDs in the install kustomization.

cmd/common.go

@@ -20,6 +20,7 @@ import (
 	gateway_v1 "sigs.k8s.io/gateway-api/apis/v1"
 	gateway_v1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
 
+	icgv1alpha1 "github.com/pomerium/ingress-controller/apis/gateway/v1alpha1"
 	icsv1 "github.com/pomerium/ingress-controller/apis/ingress/v1"
 )
 
@@ -59,6 +60,7 @@ func getScheme() (*runtime.Scheme, error) {
 		{"settings", icsv1.AddToScheme},
 		{"gateway_v1", gateway_v1.Install},
 		{"gateway_v1beta1", gateway_v1beta1.Install},
+		{"gateway.pomerium.io", icgv1alpha1.AddToScheme},
 	} {
 		if err := apply.fn(scheme); err != nil {
 			return nil, fmt.Errorf("%s: %w", apply.name, err)

config/crd/kustomization.yaml

@@ -5,6 +5,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - bases/ingress.pomerium.io_pomerium.yaml
+- bases/gateway.pomerium.io_policyfilters.yaml
 #+kubebuilder:scaffold:crdkustomizeresource
 
 # the following config is for teaching kustomize how to do kustomization for CRDs.

controllers/gateway/controller.go

@@ -16,6 +16,7 @@ import (
 	gateway_v1 "sigs.k8s.io/gateway-api/apis/v1"
 	gateway_v1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
 
+	icgv1alpha1 "github.com/pomerium/ingress-controller/apis/gateway/v1alpha1"
 	"github.com/pomerium/ingress-controller/pomerium"
 )
 
@@ -50,6 +51,8 @@ type gatewayController struct {
 	client.Client
 	pomerium.GatewayReconciler
 	ControllerConfig
+
+	extensionFilters map[refKey]objectAndFilter
 }
 
 // NewGatewayController creates and registers a new controller for Gateway objects.
@@ -63,6 +66,7 @@ func NewGatewayController(
 		Client:            mgr.GetClient(),
 		GatewayReconciler: pgr,
 		ControllerConfig:  config,
+		extensionFilters:  make(map[refKey]objectAndFilter),
 	}
 
 	err := mgr.GetFieldIndexer().IndexField(ctx, &corev1.Secret{}, "type",
@@ -97,6 +101,7 @@ func NewGatewayController(
 		Watches(&corev1.Namespace{}, enqueueRequest).
 		Watches(&corev1.Service{}, enqueueRequest).
 		Watches(&gateway_v1beta1.ReferenceGrant{}, enqueueRequest).
+		Watches(&icgv1alpha1.PolicyFilter{}, enqueueRequest).
 		Complete(gtc)
 	if err != nil {
 		return fmt.Errorf("build controller: %w", err)

controllers/gateway/extensionfilters.go

@@ -0,0 +1,79 @@
+package gateway
+
+import (
+	context "context"
+	"fmt"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	icgv1alpha1 "github.com/pomerium/ingress-controller/apis/gateway/v1alpha1"
+	"github.com/pomerium/ingress-controller/model"
+	"github.com/pomerium/ingress-controller/pomerium/gateway"
+)
+
+func (c *gatewayController) processExtensionFilters(
+	ctx context.Context,
+	config *model.GatewayConfig,
+	o *objects,
+) error {
+	for _, pf := range o.PolicyFilters {
+		if err := c.processPolicyFilter(ctx, pf); err != nil {
+			return err
+		}
+	}
+	config.ExtensionFilters = makeExtensionFilterMap(c.extensionFilters)
+	return nil
+}
+
+func (c *gatewayController) processPolicyFilter(
+	ctx context.Context,
+	pf *icgv1alpha1.PolicyFilter,
+) error {
+	// Check to see if we already have a parsed representation of this filter.
+	k := refKeyForObject(pf)
+	f := c.extensionFilters[k]
+	if f.object != nil && f.object.GetGeneration() == pf.Generation {
+		return nil
+	}
+
+	filter, err := gateway.NewPolicyFilter(pf)
+
+	// Set a "Valid" condition with information about whether the policy could be parsed.
+	validCondition := metav1.Condition{
+		Type: "Valid",
+	}
+	if err == nil {
+		validCondition.Status = metav1.ConditionTrue
+		validCondition.Reason = "Valid"
+	} else {
+		validCondition.Status = metav1.ConditionFalse
+		validCondition.Reason = "Invalid"
+		validCondition.Message = err.Error()
+	}
+	if upsertCondition(&pf.Status.Conditions, pf.Generation, validCondition) {
+		if err := c.Status().Update(ctx, pf); err != nil {
+			return fmt.Errorf("couldn't update status for PolicyFilter %q: %w", pf.Name, err)
+		}
+	}
+
+	c.extensionFilters[k] = objectAndFilter{pf, filter}
+
+	return nil
+}
+
+type objectAndFilter struct {
+	object client.Object
+	filter model.ExtensionFilter
+}
+
+func makeExtensionFilterMap(
+	extensionFilters map[refKey]objectAndFilter,
+) map[model.ExtensionFilterKey]model.ExtensionFilter {
+	m := make(map[model.ExtensionFilterKey]model.ExtensionFilter)
+	for k, f := range extensionFilters {
+		key := model.ExtensionFilterKey{Kind: k.Kind, Namespace: k.Namespace, Name: k.Name}
+		m[key] = f.filter
+	}
+	return m
+}

controllers/gateway/fetch.go

@@ -10,6 +10,7 @@ import (
 	gateway_v1 "sigs.k8s.io/gateway-api/apis/v1"
 	gateway_v1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
 
+	icgv1alpha1 "github.com/pomerium/ingress-controller/apis/gateway/v1alpha1"
 	"github.com/pomerium/ingress-controller/util"
 )
 
@@ -22,6 +23,7 @@ type objects struct {
 	ReferenceGrants         referenceGrantMap
 	TLSSecrets              map[refKey]*corev1.Secret
 	Services                map[types.NamespacedName]*corev1.Service
+	PolicyFilters           map[types.NamespacedName]*icgv1alpha1.PolicyFilter
 }
 
 type httpRouteAndOriginalStatus struct {
@@ -120,6 +122,17 @@ func (c *gatewayController) fetchObjects(ctx context.Context) (*objects, error)
 		o.Services[util.GetNamespacedName(s)] = s
 	}
 
+	// Fetch all PolicyFilters.
+	var pfl icgv1alpha1.PolicyFilterList
+	if err := c.List(ctx, &pfl); err != nil {
+		return nil, err
+	}
+	o.PolicyFilters = make(map[types.NamespacedName]*icgv1alpha1.PolicyFilter, 0)
+	for i := range pfl.Items {
+		pf := &pfl.Items[i]
+		o.PolicyFilters[util.GetNamespacedName(pf)] = pf
+	}
+
 	return &o, nil
 }
 

controllers/gateway/gateway.go

@@ -20,6 +20,10 @@ func (c *gatewayController) processGateways(
 ) (*model.GatewayConfig, error) {
 	var config model.GatewayConfig
 
+	if err := c.processExtensionFilters(ctx, &config, o); err != nil {
+		return nil, err
+	}
+
 	for key := range o.Gateways {
 		if err := c.processGateway(ctx, &config, o, key); err != nil {
 			return nil, err

deployment.yaml

@@ -7,6 +7,140 @@ metadata:
 ---
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.14.0
+  labels:
+    app.kubernetes.io/name: pomerium
+  name: policyfilters.gateway.pomerium.io
+spec:
+  group: gateway.pomerium.io
+  names:
+    kind: PolicyFilter
+    listKind: PolicyFilterList
+    plural: policyfilters
+    singular: policyfilter
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          PolicyFilter represents a Pomerium policy that can be attached to a particular route defined
+          via the Kubernetes Gateway API.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: Spec defines the content of the policy.
+            properties:
+              ppl:
+                description: |-
+                  Policy rules in Pomerium Policy Language (PPL) syntax. May be expressed
+                  in either YAML or JSON format.
+                type: string
+            type: object
+          status:
+            description: Status contains the status of the policy (e.g. is the policy
+              valid).
+            properties:
+              conditions:
+                description: Conditions describe the current state of the PolicyFilter.
+                items:
+                  description: "Condition contains details for one aspect of the current
+                    state of this API Resource.\n---\nThis struct is intended for
+                    direct use as an array at the field path .status.conditions.  For
+                    example,\n\n\n\ttype FooStatus struct{\n\t    // Represents the
+                    observations of a foo's current state.\n\t    // Known .status.conditions.type
+                    are: \"Available\", \"Progressing\", and \"Degraded\"\n\t    //
+                    +patchMergeKey=type\n\t    // +patchStrategy=merge\n\t    // +listType=map\n\t
+                    \   // +listMapKey=type\n\t    Conditions []metav1.Condition `json:\"conditions,omitempty\"
+                    patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t
+                    \   // other fields\n\t}"
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: |-
+                        type of condition in CamelCase or in foo.example.com/CamelCase.
+                        ---
+                        Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
+                        useful (see .node.status.conditions), the ability to deconflict is important.
+                        The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.14.0

model/gateway_config.go

@@ -6,12 +6,15 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	gateway_v1 "sigs.k8s.io/gateway-api/apis/v1"
+
+	pb "github.com/pomerium/pomerium/pkg/grpc/config"
 )
 
 // GatewayConfig represents the entirety of the Gateway-defined configuration.
 type GatewayConfig struct {
-	Routes       []GatewayHTTPRouteConfig
-	Certificates []*corev1.Secret
+	Routes           []GatewayHTTPRouteConfig
+	Certificates     []*corev1.Secret
+	ExtensionFilters map[ExtensionFilterKey]ExtensionFilter
 }
 
 // GatewayHTTPRouteConfig represents a single Gateway-defined route together
@@ -34,3 +37,15 @@ type GatewayHTTPRouteConfig struct {
 type BackendRefChecker interface {
 	Valid(obj client.Object, r *gateway_v1.BackendRef) bool
 }
+
+// ExtensionFilter represents a custom Pomerium route filter.
+type ExtensionFilter interface {
+	ApplyToRoute(*pb.Route)
+}
+
+// ExtensionFilterKey is a look-up key for available custom filters.
+type ExtensionFilterKey struct {
+	Kind      string
+	Namespace string
+	Name      string
+}