feat: typed spec.extensionProviders[] for ext_authz registrations

[patrickleet]

Summary

Adds a typed spec.extensionProviders[] surface on IstioStack so per-namespace oauth2-proxy bridges (and any future ext_authz consumer) can register themselves with the mesh declaratively. Each entry maps 1:1 onto a meshConfig.extensionProviders[] element rendered into the istiod Helm release. AuthorizationPolicy.CUSTOM rules in any consumer namespace then reference the registered provider name.

The render-time validator fails fast with actionable messages on:

• missing name
• duplicate names in the list
• both envoyExtAuthzHttp and envoyExtAuthzGrpc set on the same entry
• neither mode set

Status surface exposes status.extensionProviders.{configured[], ready} so consumers can gate their AuthorizationPolicy MRs on readiness (per [[feedback_crossplane_composition_gates]]).

This is the prerequisite primitive for [[tasks/observe-stack-public-exposure]] and the wider [[specs/platform-public-exposure]] pattern.

End-to-end verification on pat-local

Built + installed via hops config install --path .. Added smoke-test-ext-authz pointing at a deny-403 nginx, then attached an AuthorizationPolicy.CUSTOM(provider=smoke-test-ext-authz) to a sister Service routed through an ambient Waypoint:

$ kubectl exec -n extauthz-demo <pod> -- curl -sS -D - -o /dev/null http://echoserver-waypointed/
HTTP/1.1 403 Forbidden
body: denied by smoke-test-ext-authz

Waypoint access log: 403 UAEX ext_authz_denied — the canonical Envoy ext_authz_denied response flag, proving the waypoint really called the registered ext_authz upstream.

Test plan

• make test — 10/10 pass (existing 6 + 4 new: HTTP, gRPC, multiple-in-order, empty-leaves-meshconfig-clean)
• make validate:* — all 4 examples validate
• Negative-path renders: duplicate name / both modes / neither mode all fail with actionable messages
• Live install on pat-local: live MeshConfig contains the registered entry; istiod accepts AuthorizationPolicy.CUSTOM referencing it
• Full end-to-end ambient ext_authz curl proves the path

🤖 Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@patrickleet has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 25 minutes and 33 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4bb1903c-be0e-4368-90e1-196bf6be4d96

📥 Commits

Reviewing files that changed from the base of the PR and between 1fbe110 and 1e4d817.

📒 Files selected for processing (8)

• Makefile
• apis/istiostacks/definition.yaml
• examples/istiostacks/with-extensionproviders.yaml
• functions/render/000-state-init.yaml.gotmpl
• functions/render/010-state-status.yaml.gotmpl
• functions/render/210-istiod.yaml.gotmpl
• functions/render/999-status.yaml.gotmpl
• tests/test-render/main.k

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/extension-providers-surface

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Published Crossplane Package

The following Crossplane package was published as part of this PR:

Package: ghcr.io/hops-ops/istio-stack:pr-30-f54205989d91346b16410c203f4bd9d452e68aa6

View Package