Extension SDK Action Pipeline

[philbrookes]

Summary

Extension SDK API to orchestrate custom policies' Actions. Extension authors can register named gRPC action methods and compose them into ordered pipelines with request and response phases.

Goals

• Extension authors can register a named gRPC action method and invoke it from the data plane during request processing
• Extension authors can compose ordered pipelines of actions that run on inbound requests and outbound responses
• Request-phase actions can call a gRPC service and allow or deny the request based on the response, or allow/deny based on request attributes alone
• Response-phase actions can add headers or override the HTTP status code
• Invalid CEL expressions and schema mismatches are caught when registered, not at request time
• Demo: a ThreatPolicy extension registers a threat-scoring gRPC service, calls it on each request, denies requests that exceed a threshold, and adds a response header confirming the check ran

Design

extensions-SDK-action-pipeline-design.md

Builds on:

• Phase 1: RegisterUpstreamMethod
• Phase 2: gRPC Reflection / ProtoCache

Sub-issues

Work items are tracked as sub-issues of this issue.

Related: #1889