kernel

package
v0.0.0-...-e5ae371 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 10, 2026 License: Apache-2.0 Imports: 38 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	Wso2MetadataPrefix = "x-wso2-"
	APIIDKey           = Wso2MetadataPrefix + "api-id"
	APINameKey         = Wso2MetadataPrefix + "api-name"
	APIVersionKey      = Wso2MetadataPrefix + "api-version"
	APITypeKey         = Wso2MetadataPrefix + "api-type"
	APIContextKey      = Wso2MetadataPrefix + "api-context"
	OperationPathKey   = Wso2MetadataPrefix + "operation-path"
	APIKindKey         = Wso2MetadataPrefix + "api-kind"
	ProjectIDKey       = Wso2MetadataPrefix + "project-id"
)

Constants for analytics metadata

Variables

This section is empty.

Functions

func TranslateRequestBodyActions 

func TranslateRequestBodyActions(result *executor.RequestExecutionResult, chain *registry.PolicyChain, execCtx *PolicyExecutionContext) (*extprocv3.ProcessingResponse, error)

TranslateRequestBodyActions converts request body execution result to ext_proc response

func TranslateRequestHeaderActions 

func TranslateRequestHeaderActions(result *executor.RequestHeaderExecutionResult, chain *registry.PolicyChain, execCtx *PolicyExecutionContext) (*extprocv3.ProcessingResponse, error)

TranslateRequestHeaderActions converts a RequestHeaderExecutionResult (from ExecuteRequestHeaderPolicies) to an ext_proc response. The ModeOverride instructs Envoy on how to deliver the remaining phases.

func TranslateRequestHeaderActionsWithBodyMerge 

func TranslateRequestHeaderActionsWithBodyMerge(
	headerResult *executor.RequestHeaderExecutionResult,
	bodyResult *executor.RequestExecutionResult,
	execCtx *PolicyExecutionContext,
) (*extprocv3.ProcessingResponse, error)

TranslateRequestHeaderActionsWithBodyMerge merges results from both the request-headers phase and the request-body phase into a single RequestHeaders ext_proc response. This is used when a request carries no body (GET, Content-Length: 0, EndOfStream in headers) so body policies are executed inline during the headers phase.

The caller must set execCtx.requestBodyProcessedInline = true before calling this function so that getModeOverride() instructs Envoy to skip the RequestBody phase (mode = NONE).

func TranslateRequestHeadersActions 

func TranslateRequestHeadersActions(result *executor.RequestExecutionResult, chain *registry.PolicyChain, execCtx *PolicyExecutionContext) (*extprocv3.ProcessingResponse, error)

TranslateRequestHeadersActions converts request headers execution result to ext_proc response

func TranslateResponseBodyActions 

func TranslateResponseBodyActions(result *executor.ResponseExecutionResult, execCtx *PolicyExecutionContext) (*extprocv3.ProcessingResponse, error)

TranslateResponseBodyActions converts response body execution result to ext_proc response

func TranslateResponseHeaderActions 

func TranslateResponseHeaderActions(result *executor.ResponseHeaderExecutionResult, execCtx *PolicyExecutionContext) (*extprocv3.ProcessingResponse, error)

TranslateResponseHeaderActions converts a ResponseHeaderExecutionResult (from ExecuteResponseHeaderPolicies) to an ext_proc response. The ModeOverride instructs Envoy on how to deliver the response body. Callers may further override ModeOverride for streaming (FULL_DUPLEX_STREAMED).

func TranslateResponseHeaderActionsWithBodyMerge 

func TranslateResponseHeaderActionsWithBodyMerge(
	headerResult *executor.ResponseHeaderExecutionResult,
	bodyResult *executor.ResponseExecutionResult,
	execCtx *PolicyExecutionContext,
) (*extprocv3.ProcessingResponse, error)

TranslateResponseHeaderActionsWithBodyMerge merges the results of both response-headers and response-body phase policy execution into a single ResponseHeaders ext_proc response. This is called during the response-headers phase for bodyless responses where Envoy will not deliver a separate ResponseBody phase.

func TranslateResponseHeadersActions 

func TranslateResponseHeadersActions(result *executor.ResponseExecutionResult, execCtx *PolicyExecutionContext) (*extprocv3.ProcessingResponse, error)

TranslateResponseHeadersActions converts response headers execution result to ext_proc response

func TranslateStreamingRequestChunkAction 

func TranslateStreamingRequestChunkAction(result *executor.StreamingRequestExecutionResult, originalChunk *policy.StreamBody, execCtx *PolicyExecutionContext) (*extprocv3.ProcessingResponse, error)

TranslateStreamingRequestChunkAction converts a streaming request execution result into an ext_proc StreamedBodyResponse.

func TranslateStreamingResponseChunkAction 

func TranslateStreamingResponseChunkAction(result *executor.StreamingResponseExecutionResult, originalChunk *policy.StreamBody, execCtx *PolicyExecutionContext) (*extprocv3.ProcessingResponse, error)

TranslateStreamingResponseChunkAction converts a streaming response execution result into an ext_proc StreamedBodyResponse.

Types

type BodyMode 

type BodyMode int

BodyMode represents ext_proc body processing mode 

const (
	// BodyModeSkip skips body processing entirely — only headers are exchanged with ext_proc.
	BodyModeSkip BodyMode = iota

	// BodyModeBuffered accumulates the entire body in memory before invoking policies.
	// Required when any policy in the chain needs the complete payload at once.
	BodyModeBuffered

	// BodyModeStreamed delivers the body as individual chunks via FULL_DUPLEX_STREAMED mode.
	// Used only when every body-processing policy in the chain implements the
	// corresponding streaming interface (StreamingRequestPolicy or StreamingResponsePolicy).
	BodyModeStreamed
)

type ConfigLoader 

type ConfigLoader struct {
	// contains filtered or unexported fields
}

ConfigLoader loads policy chain configurations T077: Implement file-based configuration loader as fallback

func NewConfigLoader 

func NewConfigLoader(kernel *Kernel, reg *registry.PolicyRegistry) *ConfigLoader

NewConfigLoader creates a new configuration loader

func (*ConfigLoader) LoadFromFile 

func (cl *ConfigLoader) LoadFromFile(path string) error

LoadFromFile loads policy chain configurations from a YAML file T077: File-based configuration loader implementation

type ExternalProcessorServer 

type ExternalProcessorServer struct {
	extprocv3.UnimplementedExternalProcessorServer
	// contains filtered or unexported fields
}

ExternalProcessorServer implements the Envoy external processor service T059: ExternalProcessorServer gRPC service struct

func NewExternalProcessorServer 

func NewExternalProcessorServer(kernel *Kernel, chainExecutor *executor.ChainExecutor, tracingConfig config.TracingConfig, tracingServiceName string) *ExternalProcessorServer

NewExternalProcessorServer creates a new ExternalProcessorServer

func (*ExternalProcessorServer) Process 

func (s *ExternalProcessorServer) Process(stream extprocv3.ExternalProcessor_ProcessServer) error

Process implements the bidirectional streaming RPC handler T060: Process(stream) bidirectional streaming RPC handler

type Kernel 

type Kernel struct {

	// RouteConfigs maps routeKey → RouteConfig (metadata, resolver, upstream info).
	// Populated from the RouteConfigTypeURL xDS cache.
	RouteConfigs map[string]*RouteConfig

	// PolicyChains maps policyChainKey → PolicyChain (executable chain).
	// Populated from the PolicyChainTypeURL xDS cache.
	PolicyChains map[string]*registry.PolicyChain
	// contains filtered or unexported fields
}

Kernel represents the integration layer between Envoy and the policy execution engine. It holds two separate maps: RouteConfigs (metadata + resolver) and PolicyChains (executable chains).

func NewKernel 

func NewKernel() *Kernel

NewKernel creates a new Kernel instance

func (*Kernel) ApplyWholeRouteConfigs 

func (k *Kernel) ApplyWholeRouteConfigs(newConfigs map[string]*RouteConfig)

ApplyWholeRouteConfigs atomically replaces all route configs.

func (*Kernel) ApplyWholeRoutes 

func (k *Kernel) ApplyWholeRoutes(newRoutes map[string]*registry.PolicyChain)

ApplyWholeRoutes atomically replaces all policy chain mappings.

func (*Kernel) ApplyWholeRoutesAndSensitiveValues 

func (k *Kernel) ApplyWholeRoutesAndSensitiveValues(newRoutes map[string]*registry.PolicyChain, values []string)

ApplyWholeRoutesAndSensitiveValues atomically replaces all policy chain mappings and sensitive values in a single lock acquisition. Use this instead of calling ApplyWholeRoutes and SetSensitiveValues separately to prevent a config dump from observing new routes with stale sensitive values, which would bypass secret redaction.

func (*Kernel) BuildPolicyChain 

func (k *Kernel) BuildPolicyChain(routeKey string, policySpecs []policy.PolicySpec, reg *registry.PolicyRegistry, apiMetadata policy.PolicyMetadata) (*registry.PolicyChain, error)

BuildPolicyChain creates a PolicyChain from PolicySpecs with body requirement computation. Phase participation is determined by Mode() — the authoritative source for all six phases. Type assertions are used only for streaming capability checks and method dispatch validation. Chain flags are computed once at startup, with zero per-request overhead.

func (*Kernel) DumpRouteConfigs 

func (k *Kernel) DumpRouteConfigs() map[string]*RouteConfig

DumpRouteConfigs returns a copy of all route configs for debugging.

func (*Kernel) DumpRouteKeys 

func (k *Kernel) DumpRouteKeys() []string

DumpRouteKeys returns the keys of all registered policy chains for debugging. Cheaper than DumpRoutes as it only copies keys, not chain structs.

func (*Kernel) DumpRoutes 

func (k *Kernel) DumpRoutes() map[string]*registry.PolicyChain

DumpRoutes returns a copy of all policy chain mappings for debugging.

func (*Kernel) DumpRoutesAndSensitiveValues 

func (k *Kernel) DumpRoutesAndSensitiveValues() (map[string]*registry.PolicyChain, []string)

DumpRoutesAndSensitiveValues returns a consistent snapshot of all policy chain mappings and sensitive values in a single lock acquisition. Use this in config dumps to guarantee that the sensitive values used for redaction correspond to the same xDS generation as the routes.

func (*Kernel) GetPolicyChain 

func (k *Kernel) GetPolicyChain(policyChainKey string) *registry.PolicyChain

GetPolicyChain retrieves the policy chain for a given policy chain key.

func (*Kernel) GetPolicyChainForKey 

func (k *Kernel) GetPolicyChainForKey(key string) *registry.PolicyChain

GetPolicyChainForKey retrieves the policy chain for a given metadata key. Returns nil when no policy chain exists for the route (not an error condition).

func (*Kernel) GetRequestBodyMode 

func (k *Kernel) GetRequestBodyMode(routeKey string) BodyMode

GetRequestBodyMode returns the body mode for request phase

func (*Kernel) GetResponseBodyMode 

func (k *Kernel) GetResponseBodyMode(routeKey string) BodyMode

GetResponseBodyMode returns the body mode for response phase

func (*Kernel) GetRouteConfig 

func (k *Kernel) GetRouteConfig(routeKey string) *RouteConfig

GetRouteConfig retrieves the route config for a given route key.

func (*Kernel) GetSensitiveValues 

func (k *Kernel) GetSensitiveValues() []string

GetSensitiveValues returns a copy of the current sensitive values for use in config dump redaction.

func (*Kernel) RegisterRoute 

func (k *Kernel) RegisterRoute(metadataKey string, chain *registry.PolicyChain)

RegisterRoute registers a policy chain for a route.

func (*Kernel) SetSensitiveValues 

func (k *Kernel) SetSensitiveValues(values []string)

SetSensitiveValues atomically replaces the stored sensitive values under mu. Prefer ApplyWholeRoutesAndSensitiveValues when updating routes and values together.

func (*Kernel) UnregisterRoute 

func (k *Kernel) UnregisterRoute(metadataKey string)

UnregisterRoute removes a route mapping.

type Mutations 

type Mutations struct {
	HeaderMutation *extprocv3.HeaderMutation
	BodyMutation   *extprocv3.BodyMutation
}

Mutations holds header and body mutations for request/response processing

type PolicyDiscoveryService 

type PolicyDiscoveryService struct {
}

PolicyDiscoveryService would implement full xDS protocol T071-T074, T076: xDS service (stub for future implementation) For MVP, we use file-based configuration via ConfigLoader above

type PolicyExecutionContext 

type PolicyExecutionContext struct {
	// contains filtered or unexported fields
}

PolicyExecutionContext manages the lifecycle of a single request through the policy chain. This context is created when a request arrives and lives until the response is completed. It encapsulates all state needed for processing both request and response phases.

type RequestMutations 

type RequestMutations struct {
	Path   *string
	Method *string
	Host   *string
}

RequestMutations holds routing mutations (path, method, host) that are communicated to Envoy via dynamic metadata for Lua filter processing.

type RequestTranslationResult 

type RequestTranslationResult struct {
	HeaderMutation  *extprocv3.HeaderMutation
	BodyMutation    *extprocv3.BodyMutation
	AnalyticsData   map[string]any
	DynamicMetadata map[string]map[string]interface{}
	Mutations       RequestMutations
	ImmediateResp   *extprocv3.ProcessingResponse
}

RequestTranslationResult holds the output of translateRequestActionsCore.

type RouteConfig 

type RouteConfig struct {
	Metadata RouteMetadata
}

RouteConfig holds metadata and resolver info for a single route. Metadata is pre-populated at deploy time; no request-time parsing needed.

type RouteMapping 

type RouteMapping struct {
	MetadataKey string
	Chain       *registry.PolicyChain
}

RouteMapping maps Envoy metadata keys to PolicyChains for route-specific processing

type RouteMetadata 

type RouteMetadata struct {
	RouteName               string
	APIId                   string
	APIName                 string
	APIVersion              string
	Context                 string
	OperationPath           string
	Vhost                   string
	APIKind                 string
	TemplateHandle          string
	ProviderName            string
	ProjectID               string
	DefaultUpstreamCluster  string            // Default cluster for dynamic cluster routing
	UpstreamBasePath        string            // Base path for the upstream (e.g., /anything)
	UpstreamDefinitionPaths map[string]string // Maps upstream definition names to their URL base paths
}

RouteMetadata contains metadata about the route

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.