Documentation
¶
Overview ¶
Package httpfilter holds the controller's admission webhook for the HTTPFilter CRD (proposal 025, the proxy-extension escape hatch). It validates the opaque spec.typedConfig fail-closed, IN-PROCESS — no Envoy binary — by resolving the `@type` against the linked Envoy protos and running protoc-gen-validate, plus the filter allow-list. A bad escape-hatch payload is rejected at CRD apply instead of NACKing the proxy fleet (the Istio EnvoyFilter footgun, made fail-closed).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Validator ¶
type Validator struct {
// Reader lists existing HTTPFilters for the one-CHAIN-filter-per-service check
// (025 M4). Use the manager's APIReader (uncached — correct regardless of cache
// scope). Optional: when nil the dup check is skipped (the projector still
// tie-breaks deterministically).
Reader client.Reader
Log *slog.Logger
}
Validator is served by the controller's shared /validate dispatcher, keyed by the HTTPFilter Kind.
Source Files
Click to show internal directories.
Click to hide internal directories.