Support Lua Filters in EnvoyExtensionPolicy

[arkodg]

Description:

Describe the desired behavior, what scenario it enables and how it
would be used.

Allow users to configure Lua filters using the EnvoyExtensionPolicy https://gateway.envoyproxy.io/docs/api/extension_types/#envoyextensionpolicyspec

relates to #2025

[optional Relevant Links:]

Any extra documentation required to understand the issue.

[zhaohuabing]

+1 Lua support is essential for users migrating from the Nginx ecosystem.

[arkodg]

Here's a workaround until this is implemented using EnvoyPatchPolicy which needs to be enabled https://gateway.envoyproxy.io/docs/tasks/extensibility/envoy-patch-policy/

This patch assumes the Gateway installed is the same as the one from the Quickstart https://gateway.envoyproxy.io/docs/tasks/quickstart/

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyPatchPolicy
metadata:
  name: lua-header-patch-policy 
  namespace: default 
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: eg
  type: JSONPatch
  jsonPatches:
    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
      # The listener name is of the form <GatewayNamespace>/<GatewayName>/<GatewayListenerName>
      name: default/eg/http
      operation:
        op: add
        path: "/default_filter_chain/filters/0/typed_config/http_filters/0"
        value:
          name: "envoy.filters.http.lua"
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
            inline_code: |
              function envoy_on_request(request_handle)
                print("Hello World")
              end

You will need to also enable info logging in the proxy if testing this example

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: envoyproxy-logging-config
spec:
  logging:
    level:
      default: info

Note if linking this to a HTTPS listener, the path prefix will need to be updated to /filter_chains/0 instead of default_filter_chain

[rudrakhp]

Is this issue open for contributions? I could start with an API PR.

[arkodg]

go for it @rudrakhp !

would be great to think about how the Lua config can be validated before pushing it to the proxy
https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/lua_filter

[rudrakhp]

@arkodg IMO we have two options here:

1. Use a Go based Lua compiler to run the user provided script. We will need to mock the APIs defined in the Envoy documentation to ensure Lua run succeeds for a valid script. This will be more thorough but might be trickier to implement.
2. Parse the script and validate basic assumptions (like it should contain one of envoy_on_response or envoy_on_request). Easier to implement but less thorough.

WDYT?

[arkodg]

+1 for 1, the list of methods available on the stream handle doesnt seem very long
https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/lua_filter#stream-handle-api

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.