feat: implement Lua EnvoyExtensionPolicy

[rudrakhp]

What type of PR is this?

feat: implement Lua feature in EnvoyExtensionPolicy

What this PR does / why we need it:
Implement API introduced in #4932

Which issue(s) this PR fixes:

Related #4627

Release Notes: No

[rudrakhp]

@arkodg @zhaohuabing Wanted to get an initial buy in regarding the approach while I add more unit tests and E2E, please do review. Thanks!

[codecov]

Codecov Report

Attention: Patch coverage is 63.25581% with 79 lines in your changes missing coverage. Please review.

Project coverage is 66.87%. Comparing base (48459d4) to head (fc6d094).
Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/xds/translator/lua.go	69.69%	20 Missing and 10 partials ⚠️
internal/gatewayapi/envoyextensionpolicy.go	63.88%	23 Missing and 3 partials ⚠️
internal/provider/kubernetes/controller.go	0.00%	13 Missing and 1 partial ⚠️
internal/xds/translator/utils.go	0.00%	6 Missing ⚠️
internal/gatewayapi/luavalidator/lua_validator.go	87.50%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5171      +/-   ##
==========================================
+ Coverage   66.85%   66.87%   +0.02%     
==========================================
  Files         210      212       +2     
  Lines       32998    33213     +215     
==========================================
+ Hits        22061    22212     +151     
- Misses       9595     9646      +51     
- Partials     1342     1355      +13     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[arkodg]

hey @rudrakhp the code looks great !

please feel free to continue with unit tests and e2e

[arkodg]

any reason why this is secret ?

[rudrakhp]

SecretObjectReference is not only for Secret. It's for referring to any K8s object, by default it's Secret type. Here is it's documentation:

// SecretObjectReference identifies an API object including its namespace,
// defaulting to Secret.
//
// The API object must be valid in the cluster; the Group and Kind must
// be registered in the cluster for this reference to be valid.
//
// References to objects with invalid Group and Kind are not valid, and must
// be rejected by the implementation, with appropriate Conditions set
// on the containing object.

[rudrakhp]

Reason for preferring this is to reuse the function for processing config maps:

gateway/internal/provider/kubernetes/controller.go

Lines 753 to 764 in 54ca51b

	// processConfigMapRef adds the referenced ConfigMap to the resourceTree if it's valid.
	// - If it exists in the same namespace as the owner.
	// - If it exists in a different namespace, and there is a ReferenceGrant.
	func (r *gatewayAPIReconciler) processConfigMapRef(
	ctx context.Context,
	resourceMap *resourceMappings,
	resourceTree *resource.Resources,
	ownerKind string,
	ownerNS string,
	ownerName string,
	configMapRef gwapiv1.SecretObjectReference,
	) error {

[arkodg]

check out the code flow for

gateway/api/v1alpha1/shared_types.go

Line 746 in 36fdc0b

ValueRef *gwapiv1.LocalObjectReference `json:"valueRef,omitempty"`

[rudrakhp]

@arkodg will do. One additional caveat here is LocalObjectReference let's you locate resources in same namespace only, do we want to have that restriction?

// LocalObjectReference contains enough information to let you locate the
// referenced object inside the same namespace.