feat: use filter_chain to avoid listener drain for per route lua.

internal/gatewayapi/envoyextensionpolicy.go

@@ -667,7 +667,17 @@ func (t *Translator) translateEnvoyExtensionPolicyForGateway(
 
 	policyTarget := irStringKey(policy.Namespace, string(target.Name))
 
-	routesWithDirectResponse := sets.New[string]()
+	failed := luaError != nil
+	if wasmError != nil {
+		failed = failed || !wasmFailOpen
+	}
+	if extProcError != nil {
+		failed = failed || !extProcFailOpen
+	}
+	if dynamicModuleError != nil {
+		failed = true
+	}
+
 	for _, http := range x.HTTP {
 		gatewayName := extractGatewayNameFromListener(http.Name)
 		if t.MergeGateways && gatewayName != policyTarget {
@@ -678,6 +688,21 @@ func (t *Translator) translateEnvoyExtensionPolicyForGateway(
 			continue
 		}
 
+		// if already set - there's a specific level policy, so skip
+		if http.EnvoyExtensions != nil {
+			continue
+		}
+
+		// TODO: move other extensions to listener level.
+		// Only attach listener-level Lua when the policy succeeds; a fail-closed error in
+		// any other extension makes every route return a 500, so the Lua filter must not
+		// run on those synthetic error responses.
+		if len(luas) > 0 && !failed {
+			http.EnvoyExtensions = &ir.EnvoyExtensionFeatures{
+				Luas: luas,
+			}
+		}
+
 		// A Policy targeting the specific scope(xRoute rule, xRoute, Gateway listener) wins over a policy
 		// targeting a lesser specific scope(Gateway).
 		for _, r := range http.Routes {
@@ -686,43 +711,20 @@ func (t *Translator) translateEnvoyExtensionPolicyForGateway(
 				continue
 			}
 
-			failRoute := false
-			// Lua extension doesn't have a fail open option, so fail the route if there is a lua error
-			// TODO: we may also add fail open option for Lua extension to align with other extensions
-			if luaError != nil {
-				failRoute = true
-			}
-			if wasmError != nil {
-				failRoute = failRoute || !wasmFailOpen
-			}
-			if extProcError != nil {
-				failRoute = failRoute || !extProcFailOpen
-			}
-			if dynamicModuleError != nil {
-				failRoute = true
-			}
-			if failRoute {
+			if failed {
 				r.DirectResponse = &ir.CustomResponse{
 					StatusCode: new(uint32(500)),
 				}
-				routesWithDirectResponse.Insert(r.Name)
 			} else {
 				r.EnvoyExtensions = &ir.EnvoyExtensionFeatures{
-					ExtProcs:       extProcs,
-					Wasms:          wasms,
-					Luas:           luas,
-					DynamicModules: dynamicModules,
+					ExtProcs:          extProcs,
+					Wasms:             wasms,
+					DynamicModules:    dynamicModules,
+					FromGatewayPolicy: new(true),
 				}
 			}
 		}
 	}
-	if len(routesWithDirectResponse) > 0 {
-		t.Logger.Info("setting 500 direct response in routes due to errors in EnvoyExtensionPolicy",
-			"policy", fmt.Sprintf("%s/%s", policy.Namespace, policy.Name),
-			"routes", sets.List(routesWithDirectResponse),
-			"error", errs,
-		)
-	}
 
 	return errs
 }

internal/gatewayapi/testdata/custom-filter-order.out.yaml

@@ -291,6 +291,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         envoyExtensions:
+          fromGatewayPolicy: true
           wasms:
           - config:
               parameter1:

internal/gatewayapi/testdata/envoyextensionpolicy-override-replace.out.yaml

@@ -410,6 +410,7 @@ xdsIR:
                 protocol: GRPC
                 weight: 1
             name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/extproc/0
+          fromGatewayPolicy: true
         hostname: gateway.envoyproxy.io
         isHTTP2: false
         metadata:

internal/gatewayapi/testdata/envoyextensionpolicy-section-name-override.out.yaml

@@ -525,6 +525,7 @@ xdsIR:
                 protocol: GRPC
                 weight: 1
             name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1-listener-1/extproc/0
+          fromGatewayPolicy: true
         hostname: gateway.envoyproxy.io
         isHTTP2: false
         metadata:
@@ -595,6 +596,7 @@ xdsIR:
                 protocol: GRPC
                 weight: 1
             name: envoyextensionpolicy/envoy-gateway/policy-for-gateway-1/extproc/0
+          fromGatewayPolicy: true
         hostname: gateway.envoyproxy.io
         isHTTP2: false
         metadata:

internal/gatewayapi/testdata/envoyextensionpolicy-with-dynamicmodule.out.yaml

@@ -434,6 +434,7 @@ xdsIR:
               sha256: abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789
               url: https://modules.example.com/libremote_auth.so
             terminalFilter: false
+          fromGatewayPolicy: true
         hostname: www.example.com
         isHTTP2: false
         metadata:

internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-backendtlspolicy.out.yaml

@@ -409,6 +409,7 @@ xdsIR:
             - connection.requested_server_name
             responseBodyProcessingMode: Streamed
             responseHeaderProcessing: true
+          fromGatewayPolicy: true
         hostname: www.foo.com
         isHTTP2: false
         metadata:
@@ -484,6 +485,7 @@ xdsIR:
             - connection.requested_server_name
             responseBodyProcessingMode: Streamed
             responseHeaderProcessing: true
+          fromGatewayPolicy: true
         hostname: www.bar.com
         isHTTP2: false
         metadata:

internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-disabled.out.yaml

@@ -208,15 +208,14 @@ xdsIR:
             weight: 1
         envoyExtensions:
           luas:
-          - Code: |
+          - code: |
               function envoy_on_response(response_handle)
                 local value = 10
                 if value > 5
                   print("Value is greater than 5")
                 end
               end
-            FilterContext: null
-            Name: envoyextensionpolicy/default/policy-for-http-route/lua/0
+            name: envoyextensionpolicy/default/policy-for-http-route/lua/0
         hostname: www.example.com
         isHTTP2: false
         metadata:

internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua-validation-syntax.out.yaml

@@ -298,7 +298,7 @@ xdsIR:
             weight: 1
         envoyExtensions:
           luas:
-          - Code: |
+          - code: |
               local json = require("json")
               function envoy_on_response(response_handle)
                   local content_type = response_handle:headers():get("content-type")
@@ -317,8 +317,7 @@ xdsIR:
                   end
                   return envoy.lua.ResponseStatus.Continue
               end
-            FilterContext: null
-            Name: envoyextensionpolicy/default/policy-for-http-route/lua/0
+            name: envoyextensionpolicy/default/policy-for-http-route/lua/0
         hostname: www.example.com
         isHTTP2: false
         metadata:

internal/gatewayapi/testdata/envoyextensionpolicy-with-invalid-lua.out.yaml

@@ -253,6 +253,11 @@ xdsIR:
           protocol: TCP
     http:
     - address: 0.0.0.0
+      envoyExtensions:
+        luas:
+        - code: function envoy_on_request(request_handle) request_handle:logInfo('Goodbye.')
+            end
+          name: envoyextensionpolicy/envoy-gateway/policy-for-gateway/lua/0
       externalPort: 80
       hostnames:
       - '*'
@@ -289,11 +294,7 @@ xdsIR:
         directResponse:
           statusCode: 500
         envoyExtensions:
-          luas:
-          - Code: function envoy_on_request(request_handle) request_handle:logInfo('Goodbye.')
-              end
-            FilterContext: null
-            Name: envoyextensionpolicy/envoy-gateway/policy-for-gateway/lua/0
+          fromGatewayPolicy: true
         hostname: www.example.com
         isHTTP2: false
         metadata:
@@ -325,11 +326,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         envoyExtensions:
-          luas:
-          - Code: function envoy_on_request(request_handle) request_handle:logInfo('Goodbye.')
-              end
-            FilterContext: null
-            Name: envoyextensionpolicy/envoy-gateway/policy-for-gateway/lua/0
+          fromGatewayPolicy: true
         hostname: www.example.com
         isHTTP2: false
         metadata:

internal/gatewayapi/testdata/envoyextensionpolicy-with-lua-configmap.out.yaml

@@ -425,6 +425,13 @@ xdsIR:
           protocol: TCP
     http:
     - address: 0.0.0.0
+      envoyExtensions:
+        luas:
+        - code: |
+            function envoy_on_request(request_handle)
+            request_handle:logInfo('Goodbye.')
+            end
+          name: envoyextensionpolicy/envoy-gateway/policy-for-gateway/lua/0
       externalPort: 80
       hostnames:
       - '*'
@@ -461,13 +468,7 @@ xdsIR:
         directResponse:
           statusCode: 500
         envoyExtensions:
-          luas:
-          - Code: |
-              function envoy_on_request(request_handle)
-              request_handle:logInfo('Goodbye.')
-              end
-            FilterContext: null
-            Name: envoyextensionpolicy/envoy-gateway/policy-for-gateway/lua/0
+          fromGatewayPolicy: true
         hostname: www.example.com
         isHTTP2: false
         metadata:
@@ -501,13 +502,7 @@ xdsIR:
         directResponse:
           statusCode: 500
         envoyExtensions:
-          luas:
-          - Code: |
-              function envoy_on_request(request_handle)
-              request_handle:logInfo('Goodbye.')
-              end
-            FilterContext: null
-            Name: envoyextensionpolicy/envoy-gateway/policy-for-gateway/lua/0
+          fromGatewayPolicy: true
         hostname: www.example.com
         isHTTP2: false
         metadata:
@@ -541,13 +536,7 @@ xdsIR:
         directResponse:
           statusCode: 500
         envoyExtensions:
-          luas:
-          - Code: |
-              function envoy_on_request(request_handle)
-              request_handle:logInfo('Goodbye.')
-              end
-            FilterContext: null
-            Name: envoyextensionpolicy/envoy-gateway/policy-for-gateway/lua/0
+          fromGatewayPolicy: true
         hostname: www.example.com
         isHTTP2: false
         metadata:
@@ -580,13 +569,13 @@ xdsIR:
             weight: 1
         envoyExtensions:
           luas:
-          - Code: |
+          - code: |
               function envoy_on_response(response_handle)
               response_handle:logWarn('Goodbye.')
               end
-            FilterContext:
+            filterContext:
               token_header: x-session-token
-            Name: envoyextensionpolicy/default/policy-for-http-route/lua/0
+            name: envoyextensionpolicy/default/policy-for-http-route/lua/0
         hostname: www.example.com
         isHTTP2: false
         metadata:
@@ -618,13 +607,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         envoyExtensions:
-          luas:
-          - Code: |
-              function envoy_on_request(request_handle)
-              request_handle:logInfo('Goodbye.')
-              end
-            FilterContext: null
-            Name: envoyextensionpolicy/envoy-gateway/policy-for-gateway/lua/0
+          fromGatewayPolicy: true
         hostname: www.example.com
         isHTTP2: false
         metadata: