Repository navigation
api: support HTTP and Image sources for EnvoyProxy wasmModules, deprecate inline Wasm code - #10167
Draft
zhaohuabing wants to merge 4 commits into
Draft
zhaohuabing wants to merge 4 commits into
zhaohuabing wants to merge 4 commits into
Conversation
✅ Deploy Preview for cerulean-figolla-1f9435 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
zhaohuabing
force-pushed
the
wasm-module-remote-sources
branch
from
October 2, 2026 12:55
957e8e7 to
c8c8cf5
Compare
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #10167 +/- ##
========================================
Coverage 82.20% 82.21%
========================================
Files 277 277
Lines 44014 44164 +150
========================================
+ Hits 36183 36308 +125
- Misses 7830 7855 +25
Partials 1 1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
zhaohuabing
force-pushed
the
wasm-module-remote-sources
branch
from
October 2, 2026 13:07
c8c8cf5 to
91b4f17
Compare
zhaohuabing
force-pushed
the
wasm-module-remote-sources
branch
3 times, most recently
from
October 8, 2026 07:28
46e9306 to
21e340d
Compare
…cate inline Wasm code EnvoyProxy.spec.wasmModules only accepted Local sources, so HTTP and OCI modules still had to be defined inline in each EnvoyExtensionPolicy. Add HTTP and Image source types to the registry, reusing the existing HTTPWasmCodeSource and ImageWasmCodeSource shapes plus pullPolicy, with CEL rules that keep exactly one source set per type. Registered HTTP and Image modules go through the existing Wasm cache, sharing one code path with inline wasm[].code. Each module is resolved against the EnvoyProxy level that declares it, not the merged EnvoyProxy: its pull secret and CA certificate must be in that EnvoyProxy's namespace, and its cache entry follows that EnvoyProxy's resource version for the Always pull policy. Modules in the EnvoyGateway default spec resolve refs in the controller namespace. The Kubernetes provider fetches those Secrets, ConfigMaps and ClusterTrustBundles and indexes them so a change triggers a reconcile. Deprecate EnvoyExtensionPolicy.wasm[].code in favor of registering the module centrally and referencing it by wasm[].name. Policies that still use it get a DeprecatedField warning. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io>
zhaohuabing
force-pushed
the
wasm-module-remote-sources
branch
from
October 8, 2026 07:38
21e340d to
68a87e8
Compare
zhaohuabing
marked this pull request as ready for review
October 8, 2026 07:45
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Member
|
Gernal LGTM from my side, should we add warning message in status to help the migration? |
zhaohuabing
marked this pull request as draft
October 8, 2026 23:03
Resolve conflict in internal/provider/kubernetes/controller.go: main moved the per-GatewayClass reconcile loop body into reconcileGatewayClass, so re-apply the default EnvoyProxy spec Wasm module ref processing there. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
Member
Author
|
/retest |
Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io>
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #9530.
EnvoyProxywasmModulescan now register HTTP and OCI Image modules as well as Local ones, so every Wasm source can be managed centrally and referenced from anEnvoyExtensionPolicyby name.Inline
wasm[].codeonEnvoyExtensionPolicyis now deprecated in favor of the registry.