feat: Wasm OCI image

api/v1alpha1/authorization_types.go

@@ -27,7 +27,8 @@ type Authorization struct {
 
 // AuthorizationRule defines a single authorization rule.
 type AuthorizationRule struct {
-	// Name is a user-friendly name for the rule. It's just for display purposes.
+	// Name is a user-friendly name for the rule.
+	// If not specified, Envoy Gateway will generate a unique name for the rule.n
 	// +optional
 	Name *string `json:"name,omitempty"`
 

api/v1alpha1/wasm_types.go

@@ -18,20 +18,16 @@ type Wasm struct {
 	// Name is a unique name for this Wasm extension. It is used to identify the
 	// Wasm extension if multiple extensions are handled by the same vm_id and root_id.
 	// It's also used for logging/debugging.
-	Name string `json:"name"`
-
-	// VMID is an ID that will be used along with a hash of the wasm code to
-	// determine which VM will be used to load the Wasm extension. All extensions
-	// that have the same vm_id and code will use the same VM.
+	// If not specified, EG will generate a unique name for the Wasm extension.
 	//
-	// Note that sharing a VM between plugins can reduce memory utilization and
-	// make sharing of data easier, but it may have security implications.
-	// VMID *string `json:"vmID,omitempty"`
+	// +optional
+	Name *string `json:"name,omitempty"`
 
 	// RootID is a unique ID for a set of extensions in a VM which will share a
 	// RootContext and Contexts if applicable (e.g., an Wasm HttpFilter and an Wasm AccessLog).
 	// If left blank, all extensions with a blank root_id with the same vm_id will share Context(s).
-	// RootID must match the root_id parameter used to register the Context in the Wasm code.
+	//
+	// Note: RootID must match the root_id parameter used to register the Context in the Wasm code.
 	RootID *string `json:"rootID,omitempty"`
 
 	// Code is the wasm code for the extension.
@@ -59,6 +55,10 @@ type Wasm struct {
 }
 
 // WasmCodeSource defines the source of the wasm code.
+// +union
+//
+// +kubebuilder:validation:XValidation:rule="self.type == 'HTTP' ? has(self.http) : !has(self.http)",message="If type is HTTP, http field needs to be set."
+// +kubebuilder:validation:XValidation:rule="self.type == 'Image' ? has(self.image) : !has(self.image)",message="If type is Image, image field needs to be set."
 type WasmCodeSource struct {
 	// Type is the type of the source of the wasm code.
 	// Valid WasmCodeSourceType values are "HTTP" or "Image".
@@ -81,8 +81,21 @@ type WasmCodeSource struct {
 
 	// SHA256 checksum that will be used to verify the wasm code.
 	//
+	// If not specified, Envoy Gateway will not verify the downloaded wasm code.
 	// kubebuilder:validation:Pattern=`^[a-f0-9]{64}$`
-	SHA256 string `json:"sha256"`
+	// +optional
+	SHA256 *string `json:"sha256"`
+
+	// PullPolicy is the policy to use when pulling the Wasm module by either the HTTP or Image source.
+	// This field is only applicable when the SHA256 field is not set.
+	//
+	// If not specified, the default policy is IfNotPresent except for OCI images whose tag is latest.
+	//
+	// Note: EG does not update the Wasm module every time an Envoy proxy requests
+	// the Wasm module even if the pull policy is set to Always.
+	// It only updates the Wasm module when the EnvoyExtension resource version changes.
+	// +optional
+	PullPolicy *ImagePullPolicy `json:"pullPolicy,omitempty"`
 }
 
 // WasmCodeSourceType specifies the types of sources for the wasm code.
@@ -100,31 +113,35 @@ const (
 // HTTPWasmCodeSource defines the HTTP URL containing the wasm code.
 type HTTPWasmCodeSource struct {
 	// URL is the URL containing the wasm code.
+	// +kubebuilder:validation:Pattern=`^((https?:)(\/\/\/?)([\w]*(?::[\w]*)?@)?([\d\w\.-]+)(?::(\d+))?)?([\/\\\w\.()-]*)?(?:([?][^#]*)?(#.*)?)*`
 	URL string `json:"url"`
 }
 
 // ImageWasmCodeSource defines the OCI image containing the wasm code.
 type ImageWasmCodeSource struct {
 	// URL is the URL of the OCI image.
+	// URL can be in the format of `registry/image:tag` or `registry/image@sha256:digest`.
+	// The image format must follow the Wasm Artifact Image Specification or the Compat Specification.
+	// - Wasm Artifact Image Specification: https://github.com/solo-io/wasm/blob/master/spec/spec.md
+	// - Compat Specification: https://github.com/solo-io/wasm/blob/master/spec/spec-compat.md
 	URL string `json:"url"`
 
 	// PullSecretRef is a reference to the secret containing the credentials to pull the image.
-	PullSecretRef gwapiv1b1.SecretObjectReference `json:"pullSecret"`
-
-	// PullPolicy is the policy to use when pulling the image.
-	// If not specified, the default policy is IfNotPresent for images whose tag is not latest,
-	// and Always for images whose tag is latest.
+	// Only support Kubernetes Secret resource from the same namespace.
+	// +kubebuilder:validation:XValidation:message="only support Secret kind.",rule="self.kind == 'Secret'"
 	// +optional
-	// PullPolicy *PullPolicy `json:"pullPolicy,omitempty"`
+	PullSecretRef *gwapiv1b1.SecretObjectReference `json:"pullSecretRef,omitempty"`
 }
 
-// PullPolicy defines the policy to use when pulling an OIC image.
-/* type PullPolicy string
+// ImagePullPolicy defines the policy to use when pulling an OIC image.
+// +kubebuilder:validation:Enum=IfNotPresent;Always
+type ImagePullPolicy string
 
 const (
-	// PullPolicyIfNotPresent will only pull the image if it does not already exist.
-	PullPolicyIfNotPresent PullPolicy = "IfNotPresent"
+	// ImagePullPolicyIfNotPresent will only pull the image if it does not already exist in the EG cache.
+	ImagePullPolicyIfNotPresent ImagePullPolicy = "IfNotPresent"
 
-	// PullPolicyAlways will always pull the image.
-	PullPolicyAlways PullPolicy = "Always"
-)*/
+	// ImagePullPolicyAlways will pull the image when the EnvoyExtension resource version changes.
+	// Note: EG does not update the Wasm module every time an Envoy proxy requests the Wasm module.
+	ImagePullPolicyAlways ImagePullPolicy = "Always"
+)

charts/gateway-helm/README.md

@@ -84,9 +84,12 @@ To uninstall the chart:
 | deployment.ports[1].name | string | `"ratelimit"` |  |
 | deployment.ports[1].port | int | `18001` |  |
 | deployment.ports[1].targetPort | int | `18001` |  |
-| deployment.ports[2].name | string | `"metrics"` |  |
-| deployment.ports[2].port | int | `19001` |  |
-| deployment.ports[2].targetPort | int | `19001` |  |
+| deployment.ports[2].name | string | `"wasm"` |  |
+| deployment.ports[2].port | int | `18002` |  |
+| deployment.ports[2].targetPort | int | `18002` |  |
+| deployment.ports[3].name | string | `"metrics"` |  |
+| deployment.ports[3].port | int | `19001` |  |
+| deployment.ports[3].targetPort | int | `19001` |  |
 | deployment.replicas | int | `1` |  |
 | global.images.envoyGateway.image | string | `nil` |  |
 | global.images.envoyGateway.pullPolicy | string | `nil` |  |

charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml

@@ -326,6 +326,7 @@ spec:
                           properties:
                             url:
                               description: URL is the URL containing the wasm code.
+                              pattern: ^((https?:)(\/\/\/?)([\w]*(?::[\w]*)?@)?([\d\w\.-]+)(?::(\d+))?)?([\/\\\w\.()-]*)?(?:([?][^#]*)?(#.*)?)*
                               type: string
                           required:
                           - url
@@ -337,9 +338,10 @@ spec:
 
                             Note that the image must be accessible from the Envoy Gateway.
                           properties:
-                            pullSecret:
-                              description: PullSecretRef is a reference to the secret
-                                containing the credentials to pull the image.
+                            pullSecretRef:
+                              description: |-
+                                PullSecretRef is a reference to the secret containing the credentials to pull the image.
+                                Only support Kubernetes Secret resource from the same namespace.
                               properties:
                                 group:
                                   default: ""
@@ -382,18 +384,42 @@ spec:
                               required:
                               - name
                               type: object
+                              x-kubernetes-validations:
+                              - message: only support Secret kind.
+                                rule: self.kind == 'Secret'
                             url:
-                              description: URL is the URL of the OCI image.
+                              description: |-
+                                URL is the URL of the OCI image.
+                                URL can be in the format of `registry/image:tag` or `registry/image@sha256:digest`.
+                                The image format must follow the Wasm Artifact Image Specification or the Compat Specification.
+                                - Wasm Artifact Image Specification: https://github.com/solo-io/wasm/blob/master/spec/spec.md
+                                - Compat Specification: https://github.com/solo-io/wasm/blob/master/spec/spec-compat.md
                               type: string
                           required:
-                          - pullSecret
                           - url
                           type: object
+                        pullPolicy:
+                          description: |-
+                            PullPolicy is the policy to use when pulling the Wasm module by either the HTTP or Image source.
+                            This field is only applicable when the SHA256 field is not set.
+
+
+                            If not specified, the default policy is IfNotPresent except for OCI images whose tag is latest.
+
+
+                            Note: EG does not update the Wasm module every time an Envoy proxy requests
+                            the Wasm module even if the pull policy is set to Always.
+                            It only updates the Wasm module when the EnvoyExtension resource version changes.
+                          enum:
+                          - IfNotPresent
+                          - Always
+                          type: string
                         sha256:
                           description: |-
                             SHA256 checksum that will be used to verify the wasm code.
 
 
+                            If not specified, Envoy Gateway will not verify the downloaded wasm code.
                             kubebuilder:validation:Pattern=`^[a-f0-9]{64}$`
                           type: string
                         type:
@@ -410,9 +436,13 @@ spec:
                             Valid WasmCodeSourceType values are "HTTP" or "Image".
                           type: string
                       required:
-                      - sha256
                       - type
                       type: object
+                      x-kubernetes-validations:
+                      - message: If type is HTTP, http field needs to be set.
+                        rule: 'self.type == ''HTTP'' ? has(self.http) : !has(self.http)'
+                      - message: If type is Image, image field needs to be set.
+                        rule: 'self.type == ''Image'' ? has(self.image) : !has(self.image)'
                     config:
                       description: |-
                         Config is the configuration for the Wasm extension.
@@ -433,17 +463,19 @@ spec:
                         Name is a unique name for this Wasm extension. It is used to identify the
                         Wasm extension if multiple extensions are handled by the same vm_id and root_id.
                         It's also used for logging/debugging.
+                        If not specified, EG will generate a unique name for the Wasm extension.
                       type: string
                     rootID:
                       description: |-
                         RootID is a unique ID for a set of extensions in a VM which will share a
                         RootContext and Contexts if applicable (e.g., an Wasm HttpFilter and an Wasm AccessLog).
                         If left blank, all extensions with a blank root_id with the same vm_id will share Context(s).
-                        RootID must match the root_id parameter used to register the Context in the Wasm code.
+
+
+                        Note: RootID must match the root_id parameter used to register the Context in the Wasm code.
                       type: string
                   required:
                   - code
-                  - name
                   type: object
                 maxItems: 16
                 type: array

charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml

@@ -81,8 +81,9 @@ spec:
                           - Deny
                           type: string
                         name:
-                          description: Name is a user-friendly name for the rule.
-                            It's just for display purposes.
+                          description: |-
+                            Name is a user-friendly name for the rule.
+                            If not specified, Envoy Gateway will generate a unique name for the rule.n
                           type: string
                         principal:
                           description: Principal specifies the client identity of

charts/gateway-helm/values.tmpl.yaml

@@ -41,6 +41,9 @@ deployment:
     - name: ratelimit
       port: 18001
       targetPort: 18001
+    - name: wasm
+      port: 18002
+      targetPort: 18002
     - name: metrics
       port: 19001
       targetPort: 19001
@@ -76,4 +79,4 @@ certgen:
     ttlSecondsAfterFinished: 30
   rbac:
     annotations: {}
-    labels: {}
+    labels: {}