feat: add TEG ExtendedSecurityPolicy WAF backend for TrafficProtectionPolicy - #141
Draft
zachsmith1 wants to merge 3 commits into
Draft
zachsmith1 wants to merge 3 commits into
zachsmith1 wants to merge 3 commits into
Conversation
zachsmith1
force-pushed
the
feat/teg-esp-waf-backend
branch
from
April 23, 2026 21:16
b236393 to
a3c9212
Compare
…nPolicy Adds a new teg-esp WAF backend mode to the TrafficProtectionPolicy controller that emits ExtendedSecurityPolicy resources (teg.tetrate.io/v1alpha1) for the Tetrate Enterprise Gateway WAF instead of the existing Coraza Go filter + EnvoyPatchPolicy approach. Controlled by gateway.coraza.backend in operator config: - coraza-epp (default): existing EPP path, no behavioral change - teg-esp: emits one ExtendedSecurityPolicy per Gateway targeting the downstream Gateway by name, with WAF directives as a flat SecLang string in spec.waf.directives Also restricts TPP targetRefs to Gateway/GatewayClass only (removes HTTPRoute), matching the per-gateway granularity of ESP, and regenerates the CRD manifest accordingly.
zachsmith1
force-pushed
the
feat/teg-esp-waf-backend
branch
from
April 23, 2026 21:17
a3c9212 to
622ad24
Compare
- add isTEGMode comment - fix error guard on ESP stale-cleanup List (drop !IsNotFound) - remove unreachable len==0 guard in getDesiredExtendedSecurityPolicies - fix misleading deduplication comment - introduce tppManagedLabelValue constant (goconst lint) - clean up legacy tpp-* EPPs when running in teg-esp mode (migration) - fix TestGetDesiredEnvoyPatchPolicies: use tppEnvoyPatchPolicyPrefix constant - fix TestTPPReconcileStaleCleanupTEGMode: register envoy scheme for migration - add TestTPPReconcileEPPToESPMigration covering coraza-epp → teg-esp switch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
teg-espas an alternative WAF backend for theTrafficProtectionPolicycontroller, enabling NSO to emit TEGExtendedSecurityPolicyresources instead ofEnvoyPatchPolicy+ Coraza Go filter.Tracking issue: datum-cloud/infra#2135
gateway.coraza.backend(coraza-eppdefault |teg-esp) switches which downstream resource is emitted — no behavioral change unless explicitly setteg-espmode emits oneteg.tetrate.io/v1alpha1 ExtendedSecurityPolicyper upstream Gateway, targeting the corresponding downstream Gateway by name, with WAF directives rendered as a flat SecLang string inspec.waf.directivescoraza-eppmode (default) is unchanged — existing EPP path, cert/listener readiness checks,coraza-tcp-80listener filter EPP all unaffectedtargetRefs[*].kindtoGatewayorGatewayClassonly (removesHTTPRoute), matching ESP's per-gateway granularity — runmake manifeststo regenerate the CRDteg-espmode uses label selector (tppManagedLabel) rather than name prefix, since ESPs are namespaced and not shared with other controllersWhat's not in this PR
coraza-tcp-80EPP, switching Envoy image fromcontribto Tetrate image) — those are separateTest plan
TestGetDesiredExtendedSecurityPolicies— 11 subtests covering basic ESP creation, all three modes, paranoia/threshold values, rule exclusions, route-level attachment skipping, name/namespace/targetRef shapeTestTPPReconcileStaleCleanupTEGMode— verifies labeled stale ESPs are deleted, unlabeled ESPs are preservedTestTPPReconcileStaleCleanupPreservesConnectorEPPs— existing regression test still passes on thecoraza-epppath🤖 Generated with Claude Code