HTTP Request Mirror

[ja20222]

As a user of NGF
I want to mirror my incoming request traffic to another destination
So that I can test using production traffic without impacting my users
And so that I can analyze incoming traffic for security issues.

Acceptance

• The HTTPRequestMirrorFilter is implemented as specified here for Kubernetes Services:

  BackendRef references a resource where mirrored requests are sent.

  Mirrored requests must be sent only to a single destination endpoint within this BackendRef, irrespective of how many endpoints are present within this BackendRef.

  If the referent cannot be found, this BackendRef is invalid and must be dropped from the Gateway. The controller must ensure the “ResolvedRefs” condition on the Route status is set to status: False and not configure this backend in the underlying implementation.

  If there is a cross-namespace reference to an existing object that is not allowed by a ReferenceGrant, the controller must ensure the “ResolvedRefs” condition on the Route is set to status: False, with the “RefNotPermitted” reason and not configure this backend in the underlying implementation.

  In either error case, the Message of the ResolvedRefs Condition should be used to provide more detail about the problem.

• The HTTPRequestMirrorFilter is supported in both HTTPRoute and GRPCRoute.

[mpstefan]

NGINX can support this, making this a lighter lift comparatively.