feat: Support for Gateway-level Access Policies and Multi-level Enforcement by chuangw6 · Pull Request #127 · kubernetes-sigs/kube-agentic-networking

chuangw6 · 2026-03-02T18:08:28Z

What type of PR is this?

/kind feature

What this PR does / why we need it:

This PR implements support for AccessPolicy resources targeting
Gateway objects, enabling global policy enforcement alongside specific Backend
policies. It introduces a hierarchical evaluation model where requests are
validated at both the Gateway (entry) and Backend (service) levels.

Key changes:

API: Allow 'Gateway' as a valid TargetRef in XAccessPolicy with cross-kind
validation rules.
Controller:
- Added logic to re-enqueue Gateways directly targeted by AccessPolicies,
  as well as all root Gateways of XBackends targeted by AccessPolicies.
- Implement seniority-based policy acceptance (limit 5 policies per target).
- Accepted policies are reflected in the resource status via PolicyAncestorStatus.
Translator:
- Gateway-level policies are translated into top-level Envoy HTTP RBAC
  filters.
- Backend-level policies use Envoy's 'TypedPerFilterConfig' to override
  placeholder filters at the cluster level.
- Enforced correct filter ordering: MCP -> Gateway RBAC -> Backend RBAC
  -> Router.
E2E: Added a multi-level test case verifying that a request must satisfy
both Gateway and Backend policies, and that policies fallback correctly
when modified or deleted.
- No policy (allow all)
- Backend-only policy
- Gateway-only policy
- Multi-level denial (sequential AND logic)
- Multi-level allow after patching

Which issue(s) this PR fixes:

Fixes #55

Does this PR introduce a user-facing change?:

Support for Gateway-level Access Policies and Multi-level Enforcement

Users can now apply `XAccessPolicy` resources directly to a `Gateway`. This allows for global authorization rules that apply to all traffic entering the Gateway.

**Key Features for Users:**
*   **Gateway Targeting:** `XAccessPolicy` now accepts `Gateway` (gateway.networking.k8s.io) as a valid `targetRef`.
*   **Hierarchical Enforcement:** When both Gateway and Backend policies exist, they are enforced sequentially. A request must be authorized by both levels to succeed.
*   **Improved Status Visibility:** Policy acceptance status and troubleshooting information (e.g., missing targets) are now correctly reflected in the `XAccessPolicy` status field using standard Gateway API conditions.
*   **Seniority-based Acceptance:** Up to 5 policies can be applied per target, prioritized by creation timestamp.

k8s-ci-robot · 2026-03-02T18:08:36Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: chuangw6
Once this PR has been reviewed and has the lgtm label, please assign david-martin for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2026-03-02T18:08:39Z

Hi @chuangw6. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

netlify · 2026-03-02T18:08:46Z

✅ Deploy Preview for kube-agentic-networking ready!

Name	Link
🔨 Latest commit	`f9347c4`
🔍 Latest deploy log	https://app.netlify.com/projects/kube-agentic-networking/deploys/69b1db1521461e000810148a
😎 Deploy Preview	https://deploy-preview-127--kube-agentic-networking.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

haiyanmeng · 2026-03-02T18:20:51Z

/ok-to-test

haiyanmeng · 2026-03-03T14:08:50Z

/cc @guicassolato
/cc @david-martin

guicassolato · 2026-03-03T14:44:02Z

Lots of conflicts with #83 😞

haiyanmeng · 2026-03-03T14:46:22Z

Lots of conflicts with #83 😞

@guicassolato , can you elaborate more regarding the conflicts? Are the conflicts reconcilable?

guicassolato · 2026-03-03T14:54:22Z

Lots of conflicts with #83 😞

@guicassolato , can you elaborate more regarding the conflicts? Are the conflicts reconcilable?

They sure can be reconciled. It's just a lot of rework due to both PRs touching the same sections in parallel, somewhat heavily. We could probably have coordinated these two changes better IMO.

haiyanmeng · 2026-03-03T15:03:34Z

Lots of conflicts with #83 😞

@guicassolato , can you elaborate more regarding the conflicts? Are the conflicts reconcilable?

They sure can be reconciled. It's just a lot of rework due to both PRs touching the same sections in parallel, somewhat heavily. We could probably have coordinated these two changes better IMO.

Thanks for the explanation. If the conflicts can be reconciled, we should merge #83 first. Then we can work with @chuangw6 to make sure this PR still works.

haiyanmeng · 2026-03-03T15:04:03Z

/hold Let us merge #83 first.

haiyanmeng · 2026-03-10T18:20:52Z

Thanks for the great work and multiple rounds of labor-intensive rebase effort, @chuangw6 .

/lgtm

haiyanmeng · 2026-03-10T19:48:35Z

/lgtm

chuangw6 · 2026-03-10T20:10:36Z

Thanks for the great work and multiple rounds of labor-intensive rebase effort, @chuangw6 .

/lgtm

Thanks @haiyanmeng.

Regarding the ext auth discussion above, this feels out of scope for the current PR, and seems like a great candidate for a follow-up issue. I'd like to move forward with this PR to avoid further merge conflicts. @guicassolato , does that sound reasonable to you?

LiorLieberman

Thanks @chuangw6 !

LiorLieberman · 2026-03-10T21:02:14Z

api/v0alpha0/accesspolicy_types.go

+	PolicyConditionAccepted gwapiv1.PolicyConditionType = "Accepted"
+
+	// PolicyReasonExceededLimit indicates that the policy was rejected because the maximum number of policies per target was exceeded.
+	PolicyReasonExceededLimit gwapiv1.PolicyConditionReason = "ExceededLimit"


nit: Would something more verbal be better here? I.e PolicyLimitExceeded or PolicyLimitPerTargetExceeded?

Renamed to PolicyLimitPerTargetExceeded

LiorLieberman · 2026-03-10T21:04:36Z

pkg/controller/accesspolicy.go

+
+	// Initial check for policy limit per target.
+	if !c.isPolicyUnderTargetLimit(context.Background(), policy) {
+		return


isPolicyUnderTargetLimit already logs the details

LiorLieberman · 2026-03-10T21:05:15Z

pkg/controller/accesspolicy.go

+	specChanged := newPolicy.Generation != oldPolicy.Generation || !reflect.DeepEqual(newPolicy.Annotations, oldPolicy.Annotations)
+	deletionTimestampChanged := newPolicy.DeletionTimestamp != oldPolicy.DeletionTimestamp
+	acceptanceChanged := newPolicy.IsAccepted() != oldPolicy.IsAccepted()
+
+	if specChanged || deletionTimestampChanged || acceptanceChanged {


would highly benefit from a helper function

LiorLieberman · 2026-03-10T21:05:44Z

pkg/controller/accesspolicy.go

+	acceptanceChanged := newPolicy.IsAccepted() != oldPolicy.IsAccepted()
+
+	if specChanged || deletionTimestampChanged || acceptanceChanged {
+		klog.V(4).InfoS("Updating AccessPolicy", "accesspolicy", klog.KObj(oldPolicy), "specChanged", specChanged, "acceptanceChanged", acceptanceChanged)


this just prints true/false for spec Changed and acceptance Change etc, is this useful?

Updated, but logging Updating AccessPolicy is still helpful imo to show it's reconciled and align with other onAccessPolicyxxx. lmk otherwise

LiorLieberman · 2026-03-10T21:06:15Z

pkg/controller/accesspolicy.go

+		// If targets changed, we must re-evaluate the limit as it's equivalent to an 'Add' for the new target.
+		if !reflect.DeepEqual(oldPolicy.Spec.TargetRefs, newPolicy.Spec.TargetRefs) {
+			if !c.isPolicyUnderTargetLimit(context.Background(), newPolicy) {
+				return


isPolicyUnderTargetLimit already logs the details

LiorLieberman · 2026-03-10T21:14:48Z

pkg/translator/accesspolicy.go

-	// It's deny-by-default (a.k.a ALLOW action), we explicitly allow necessary
-	// MCP operations for all backends. These policies are essential for MCP


are we allowing or denying traffic by default? (assuming no policy exist)

If no policy exists for the target, it's allow-by-default.

If a policy exists for the target but tool list is empty, it denies all tool access.

See unit tests.

LiorLieberman · 2026-03-10T21:15:13Z

pkg/translator/accesspolicy.go

-	allAccessPolicies, err := accessPolicyLister.XAccessPolicies(backend.Namespace).List(labels.Everything())
+// findAccessPoliciesForTarget finds all AccessPolicies that target the given resource.
+// It returns only accepted policies.
+func (t *Translator) findAccessPoliciesForTarget(group, kind, namespace, name string) ([]*agenticv0alpha0.XAccessPolicy, error) {


can we change this to work from an index? related to my previous comment about

can be a followup but lets add TODO() for both locations in the code

Sure, added todo and linked to #168

LiorLieberman · 2026-03-10T21:18:22Z

Makefile

 .PHONY: fmt
 fmt: ;$(info $(M)...Begin to run go fmt against code.)  @ ## Run go fmt against code.
-	gofmt -w ./pkg
+	gofmt -w ./api ./cmd ./pkg


Suggested change

gofmt -w ./api ./cmd ./pkg

go fmt ./...

go formatting should be done with .golangci.yml -- see https://github.com/kubernetes-sigs/gateway-api/blob/main/.golangci.yml#L99-L109

Updated to go fmt ./...

our https://github.com/kubernetes-sigs/kube-agentic-networking/blob/main/.golangci.yaml seems to have minimum checks only. It can be a follow up to update it, but it's out of scope for this PR.

LiorLieberman · 2026-03-10T21:19:39Z

Makefile

 .PHONY: vet
 vet: ;$(info $(M)...Begin to run go vet against code.)  @ ## Run go vet against code.
-	go vet ./pkg/...
+	go vet ./api/... ./cmd/... ./pkg/...


Suggested change

go vet ./api/... ./cmd/... ./pkg/...

go vet ./...

LiorLieberman · 2026-03-10T21:21:31Z

Makefile

 # Run go test against code
 .PHONY: test
-test: vet test-pkg test-cel test-crd ## Run all tests.
+test: vet test-unit test-cel test-crd ## Run all tests.


question: why do we need separate tests targets?

I'd defer the question to @haiyanmeng . They were added in #58

k8s-ci-robot · 2026-03-10T21:21:46Z

@LiorLieberman: GitHub didn't allow me to request PR reviews from the following users: thing, before, HarshithaMS005, as, she, did, a, similar.

Note that only kubernetes-sigs members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

can we have a todo to have an index of Target --> policies?

/cc @HarshithaMS005 as she did a similar thing before

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2026-03-11T20:55:34Z

New changes are detected. LGTM label has been removed.

Allow 'Gateway' as a valid TargetRef in XAccessPolicy with cross-kind validation rules. Signed-off-by: Chuang Wang <chuangw@google.com>

This change implements support for AccessPolicy resources targeting Gateway objects, enabling global authorization policies across all routes in a Gateway. It also introduces a multi-level policy evaluation model where both Gateway-level and Backend-level policies are enforced sequentially. Key changes: - Controller: Implement seniority-based policy acceptance (limit 5 policies per target by default). Accepted policies are reflected in the resource status via PolicyAncestorStatus. - Translator: - Gateway-level policies are translated into top-level Envoy HTTP RBAC filters. - Backend-level policies use Envoy's 'TypedPerFilterConfig' to override placeholder filters at the cluster level. - Enforced correct filter ordering: MCP -> Gateway RBAC -> Backend RBAC -> Router. Signed-off-by: Chuang Wang <chuangw@google.com>

haiyanmeng · 2026-03-11T21:12:37Z

/hold @chuangw6 , Let us work with @guicassolato to close the externalAuth gap in this PR.

Signed-off-by: Chuang Wang <chuangw@google.com>

k8s-ci-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Mar 2, 2026

k8s-ci-robot requested review from LiorLieberman and haiyanmeng March 2, 2026 18:08

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 2, 2026

k8s-ci-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Mar 2, 2026

chuangw6 force-pushed the gw-ap branch from 4782e1f to de19668 Compare March 2, 2026 18:18

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 2, 2026

chuangw6 force-pushed the gw-ap branch 3 times, most recently from 3f84403 to e9161f2 Compare March 2, 2026 19:34

chuangw6 changed the title ~~Support for Gateway-level Access Policies and Multi-level Enforcement~~ feat: Support for Gateway-level Access Policies and Multi-level Enforcement Mar 2, 2026

k8s-ci-robot requested review from david-martin and guicassolato March 3, 2026 14:08

k8s-ci-robot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Mar 3, 2026

chuangw6 force-pushed the gw-ap branch 3 times, most recently from b0cd4e2 to 1cf4699 Compare March 5, 2026 04:14

chuangw6 force-pushed the gw-ap branch 3 times, most recently from 7288765 to 7f9c627 Compare March 10, 2026 17:32

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 10, 2026

chuangw6 force-pushed the gw-ap branch from 7f9c627 to 9258b5b Compare March 10, 2026 17:35

chuangw6 requested a review from haiyanmeng March 10, 2026 17:36

k8s-ci-robot assigned haiyanmeng Mar 10, 2026

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 10, 2026

chuangw6 force-pushed the gw-ap branch from 9258b5b to e0c8552 Compare March 10, 2026 19:44

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 10, 2026

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 10, 2026

chuangw6 requested a review from guicassolato March 10, 2026 19:55

LiorLieberman reviewed Mar 10, 2026

View reviewed changes

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 10, 2026

chuangw6 force-pushed the gw-ap branch from e0c8552 to 48c3270 Compare March 11, 2026 20:55

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 11, 2026

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 11, 2026

chuangw6 force-pushed the gw-ap branch from 2cf2cba to 6d4fe5b Compare March 11, 2026 21:03

chuangw6 added 2 commits March 11, 2026 14:11

API: Allow Gateway-targeted XAccessPolicy

c3672aa

Allow 'Gateway' as a valid TargetRef in XAccessPolicy with cross-kind validation rules. Signed-off-by: Chuang Wang <chuangw@google.com>

chuangw6 force-pushed the gw-ap branch from 6d4fe5b to dcf48d1 Compare March 11, 2026 21:11

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 11, 2026

Address review comments

f9347c4

Signed-off-by: Chuang Wang <chuangw@google.com>

chuangw6 force-pushed the gw-ap branch from dcf48d1 to f9347c4 Compare March 11, 2026 21:13

		// It's deny-by-default (a.k.a ALLOW action), we explicitly allow necessary
		// MCP operations for all backends. These policies are essential for MCP

Conversation

chuangw6 commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Mar 2, 2026

Uh oh!

k8s-ci-robot commented Mar 2, 2026

Uh oh!

netlify bot commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kube-agentic-networking ready!

Uh oh!

haiyanmeng commented Mar 2, 2026

Uh oh!

haiyanmeng commented Mar 3, 2026

Uh oh!

guicassolato commented Mar 3, 2026

Uh oh!

haiyanmeng commented Mar 3, 2026

Uh oh!

guicassolato commented Mar 3, 2026

Uh oh!

haiyanmeng commented Mar 3, 2026

Uh oh!

haiyanmeng commented Mar 3, 2026

Uh oh!

haiyanmeng commented Mar 10, 2026

Uh oh!

haiyanmeng commented Mar 10, 2026

Uh oh!

chuangw6 commented Mar 10, 2026

Uh oh!

LiorLieberman left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Mar 10, 2026

Uh oh!

k8s-ci-robot commented Mar 11, 2026

chuangw6 commented Mar 2, 2026 •

edited

Loading

netlify bot commented Mar 2, 2026 •

edited

Loading