feat: support HTTP CONNECT

api/v1alpha1/backendtrafficpolicy_types.go

@@ -117,14 +117,27 @@ type BackendTelemetry struct {
 	Tracing *Tracing `json:"tracing,omitempty"`
 }
 
+// ProtocolUpgradeConfig specifies the configuration for protocol upgrades.
+//
+// +kubebuilder:validation:XValidation:rule="!has(self.connect) || self.type == 'CONNECT'",message="The connect configuration is only allowed when the type is CONNECT."
 type ProtocolUpgradeConfig struct {
 	// Type is the case-insensitive type of protocol upgrade.
 	// e.g. `websocket`, `CONNECT`, `spdy/3.1` etc.
 	//
 	// +kubebuilder:validation:Required
 	Type string `json:"type"`
+	// Connect specifies the configuration for the CONNECT config.
+	// This is allowed only when type is CONNECT.
+	//
+	// +optional
+	Connect *ConnectConfig `json:"connect,omitempty"`
+}
 
-	// TODO: support more options for CONNECT
+type ConnectConfig struct {
+	// Terminate the CONNECT request, and forwards the payload as raw TCP data.
+	//
+	// +optional
+	Terminate *bool `json:"terminate,omitempty"`
 }
 
 type RequestBuffer struct {

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml

@@ -560,7 +560,19 @@ spec:
                   HTTPUpgrade defines the configuration for HTTP protocol upgrades.
                   If not specified, the default upgrade configuration(websocket) will be used.
                 items:
+                  description: ProtocolUpgradeConfig specifies the configuration for
+                    protocol upgrades.
                   properties:
+                    connect:
+                      description: |-
+                        Connect specifies the configuration for the CONNECT config.
+                        This is allowed only when type is CONNECT.
+                      properties:
+                        terminate:
+                          description: Terminate the CONNECT request, and forwards
+                            the payload as raw TCP data.
+                          type: boolean
+                      type: object
                     type:
                       description: |-
                         Type is the case-insensitive type of protocol upgrade.
@@ -569,6 +581,10 @@ spec:
                   required:
                   - type
                   type: object
+                  x-kubernetes-validations:
+                  - message: The connect configuration is only allowed when the type
+                      is CONNECT.
+                    rule: '!has(self.connect) || self.type == ''CONNECT'''
                 type: array
               loadBalancer:
                 description: |-

charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml

@@ -559,7 +559,19 @@ spec:
                   HTTPUpgrade defines the configuration for HTTP protocol upgrades.
                   If not specified, the default upgrade configuration(websocket) will be used.
                 items:
+                  description: ProtocolUpgradeConfig specifies the configuration for
+                    protocol upgrades.
                   properties:
+                    connect:
+                      description: |-
+                        Connect specifies the configuration for the CONNECT config.
+                        This is allowed only when type is CONNECT.
+                      properties:
+                        terminate:
+                          description: Terminate the CONNECT request, and forwards
+                            the payload as raw TCP data.
+                          type: boolean
+                      type: object
                     type:
                       description: |-
                         Type is the case-insensitive type of protocol upgrade.
@@ -568,6 +580,10 @@ spec:
                   required:
                   - type
                   type: object
+                  x-kubernetes-validations:
+                  - message: The connect configuration is only allowed when the type
+                      is CONNECT.
+                    rule: '!has(self.connect) || self.type == ''CONNECT'''
                 type: array
               loadBalancer:
                 description: |-

internal/gatewayapi/backendtrafficpolicy.go

@@ -564,7 +564,7 @@ func (t *Translator) buildTrafficFeatures(policy *egv1a1.BackendTrafficPolicy, r
 		ro          *ir.ResponseOverride
 		rb          *ir.RequestBuffer
 		cp          []*ir.Compression
-		httpUpgrade []string
+		httpUpgrade []ir.HTTPUpgradeConfig
 		err, errs   error
 	)
 
@@ -1174,14 +1174,22 @@ func buildCompression(compression []*egv1a1.Compression) []*ir.Compression {
 	return irCompression
 }
 
-func buildHTTPProtocolUpgradeConfig(cfgs []*egv1a1.ProtocolUpgradeConfig) []string {
+func buildHTTPProtocolUpgradeConfig(cfgs []*egv1a1.ProtocolUpgradeConfig) []ir.HTTPUpgradeConfig {
 	if len(cfgs) == 0 {
 		return nil
 	}
 
-	result := make([]string, 0, len(cfgs))
+	result := make([]ir.HTTPUpgradeConfig, 0, len(cfgs))
 	for _, cfg := range cfgs {
-		result = append(result, cfg.Type)
+		upgrade := ir.HTTPUpgradeConfig{
+			Type: cfg.Type,
+		}
+		if cfg.Connect != nil {
+			upgrade.Connect = &ir.ConnectConfig{
+				Terminate: ptr.Deref(cfg.Connect.Terminate, false),
+			}
+		}
+		result = append(result, upgrade)
 	}
 
 	return result

internal/gatewayapi/backendtrafficpolicy_test.go

@@ -137,7 +137,7 @@ func TestBuildHTTPProtocolUpgradeConfig(t *testing.T) {
 	cases := []struct {
 		name     string
 		cfgs     []*egv1a1.ProtocolUpgradeConfig
-		expected []string
+		expected []ir.HTTPUpgradeConfig
 	}{
 		{
 			name:     "empty",
@@ -151,7 +151,9 @@ func TestBuildHTTPProtocolUpgradeConfig(t *testing.T) {
 					Type: "spdy/3.1",
 				},
 			},
-			expected: []string{"spdy/3.1"},
+			expected: []ir.HTTPUpgradeConfig{
+				{Type: "spdy/3.1"},
+			},
 		},
 		{
 			name: "websockets-spdy",
@@ -163,7 +165,10 @@ func TestBuildHTTPProtocolUpgradeConfig(t *testing.T) {
 					Type: "spdy/3.1",
 				},
 			},
-			expected: []string{"websockets", "spdy/3.1"},
+			expected: []ir.HTTPUpgradeConfig{
+				{Type: "websockets"},
+				{Type: "spdy/3.1"},
+			},
 		},
 		{
 			name: "spdy-websockets",
@@ -175,7 +180,10 @@ func TestBuildHTTPProtocolUpgradeConfig(t *testing.T) {
 					Type: "websockets",
 				},
 			},
-			expected: []string{"spdy/3.1", "websockets"},
+			expected: []ir.HTTPUpgradeConfig{
+				{Type: "spdy/3.1"},
+				{Type: "websockets"},
+			},
 		},
 	}
 

internal/gatewayapi/testdata/backendtrafficpolicy-connect-proxy.in.yaml

@@ -0,0 +1,48 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - gateway.envoyproxy.io
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+backendTrafficPolicies:
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: BackendTrafficPolicy
+    metadata:
+      namespace: default
+      name: policy-for-route
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: HTTPRoute
+        name: httproute-1
+      httpUpgrade:
+        - type: CONNECT