feat: ip range control

pkg/i2gw/emitter_intermediate/intermediate_representation.go

@@ -70,6 +70,10 @@ type HTTPRouteContext struct {
 	// applied by the CommonEmitter. This separation allows the CORS logic to be provider-neutral
 	// and consistently applied across different providers, subject to feature gating.
 	CorsPolicyByRuleIdx map[int]*gatewayv1.HTTPCORSFilter
+
+	// IPRangeControlByRuleIdx maps HTTPRoute rule indices to IP range control intent.
+	// This is provider-neutral and applied by each custom emitter.
+	IPRangeControlByRuleIdx map[int]*IPRangeControl
 }
 
 // TCPTimeouts holds TCP-level timeout configuration for a single HTTPRoute rule.
@@ -94,6 +98,12 @@ type BodySize struct {
 	MaxSize    *resource.Quantity
 }
 
+// IPRangeControl represents provider-neutral IP range control intent.
+type IPRangeControl struct {
+	AllowList []string
+	DenyList  []string
+}
+
 type GatewayClassContext struct {
 	gatewayv1.GatewayClass
 }

pkg/i2gw/emitters/envoygateway/buffer.go

@@ -30,6 +30,10 @@ import (
 
 func (e *Emitter) EmitBuffer(ir emitterir.EmitterIR, gwResources *i2gw.GatewayResources) {
 	for nn, ctx := range ir.HTTPRoutes {
+		if ctx.BodySizeByRuleIdx == nil {
+			continue
+		}
+
 		MergeBodySizeIR(&ctx)
 
 		for idx, bs := range ctx.BodySizeByRuleIdx {
@@ -64,11 +68,10 @@ func (e *Emitter) EmitBuffer(ir emitterir.EmitterIR, gwResources *i2gw.GatewayRe
 				ruleInfo = fmt.Sprintf(" rule %s", *sectionName)
 			}
 			notify(notifications.InfoNotification, fmt.Sprintf("applied Buffer feature for HTTPRoute%s", ruleInfo), &ctx.HTTPRoute)
-
-			// mark Buffer IR as processed
-			ctx.BodySizeByRuleIdx[idx] = nil
 		}
 
+		// mark Buffer IR as processed
+		ctx.BodySizeByRuleIdx = nil
 		ir.HTTPRoutes[nn] = ctx
 	}
 }

pkg/i2gw/emitters/envoygateway/builder.go

@@ -29,11 +29,13 @@ import (
 
 type BuilderMap struct {
 	BackendTrafficPolicies map[types.NamespacedName]*egapiv1a1.BackendTrafficPolicy
+	SecurityPolicies       map[types.NamespacedName]*egapiv1a1.SecurityPolicy
 }
 
 func NewBuilderMap() *BuilderMap {
 	return &BuilderMap{
 		BackendTrafficPolicies: make(map[types.NamespacedName]*egapiv1a1.BackendTrafficPolicy),
+		SecurityPolicies:       make(map[types.NamespacedName]*egapiv1a1.SecurityPolicy),
 	}
 }
 
@@ -76,3 +78,43 @@ func (e *Emitter) getOrBuildBackendTrafficPolicy(ctx emitterir.HTTPRouteContext,
 	e.builderMap.BackendTrafficPolicies[key] = backendTrafficPolicy
 	return backendTrafficPolicy
 }
+
+func (e *Emitter) getOrBuildSecurityPolicy(ctx emitterir.HTTPRouteContext, sectionName *gwapiv1.SectionName, ruleIdx int) *egapiv1a1.SecurityPolicy {
+	name := fmt.Sprintf("%s-%d", ctx.Name, ruleIdx)
+	if ruleIdx == RouteRuleAllIndex {
+		name = ctx.Name
+	}
+	key := types.NamespacedName{
+		Name:      name,
+		Namespace: ctx.Namespace,
+	}
+	policy, exist := e.builderMap.SecurityPolicies[key]
+	if exist {
+		return policy
+	}
+
+	securityPolicy := &egapiv1a1.SecurityPolicy{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: ctx.Namespace,
+		},
+		Spec: egapiv1a1.SecurityPolicySpec{
+			PolicyTargetReferences: egapiv1a1.PolicyTargetReferences{
+				TargetRefs: []gwapiv1.LocalPolicyTargetReferenceWithSectionName{
+					{
+						LocalPolicyTargetReference: gwapiv1.LocalPolicyTargetReference{
+							Group: gwapiv1.Group(HTTPRouteGVK.Group),
+							Kind:  gwapiv1.Kind(HTTPRouteGVK.Kind),
+							Name:  gwapiv1.ObjectName(ctx.Name),
+						},
+						SectionName: sectionName,
+					},
+				},
+			},
+		},
+	}
+	securityPolicy.SetGroupVersionKind(SecurityPolicyGVK)
+
+	e.builderMap.SecurityPolicies[key] = securityPolicy
+	return securityPolicy
+}

pkg/i2gw/emitters/envoygateway/emitter.go

@@ -53,6 +53,7 @@ func (e *Emitter) Emit(ir emitterir.EmitterIR) (i2gw.GatewayResources, field.Err
 
 func (e *Emitter) ToEnvoyGatewayResources(ir emitterir.EmitterIR, gwResources *i2gw.GatewayResources) {
 	e.EmitBuffer(ir, gwResources)
+	e.EmitIPRangeControl(ir, gwResources)
 
 	for _, backendTrafficPolicy := range e.builderMap.BackendTrafficPolicies {
 		obj, err := i2gw.CastToUnstructured(backendTrafficPolicy)
@@ -62,4 +63,13 @@ func (e *Emitter) ToEnvoyGatewayResources(ir emitterir.EmitterIR, gwResources *i
 		}
 		gwResources.GatewayExtensions = append(gwResources.GatewayExtensions, *obj)
 	}
+
+	for _, securityPolicy := range e.builderMap.SecurityPolicies {
+		obj, err := i2gw.CastToUnstructured(securityPolicy)
+		if err != nil {
+			notify(notifications.ErrorNotification, "Failed to cast SecurityPolicy to unstructured", securityPolicy)
+			continue
+		}
+		gwResources.GatewayExtensions = append(gwResources.GatewayExtensions, *obj)
+	}
 }

pkg/i2gw/emitters/envoygateway/iprange.go

@@ -0,0 +1,85 @@
+/*
+Copyright 2026 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package envoygateway_emitter
+
+import (
+	"fmt"
+
+	egapiv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
+	"github.com/kubernetes-sigs/ingress2gateway/pkg/i2gw"
+	emitterir "github.com/kubernetes-sigs/ingress2gateway/pkg/i2gw/emitter_intermediate"
+	"github.com/kubernetes-sigs/ingress2gateway/pkg/i2gw/notifications"
+	"github.com/samber/lo"
+	"k8s.io/utils/ptr"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+func buildAuthRule(action egapiv1a1.AuthorizationAction, cidrs []string) egapiv1a1.AuthorizationRule {
+	return egapiv1a1.AuthorizationRule{
+		Action: action,
+		Principal: egapiv1a1.Principal{
+			ClientCIDRs: lo.Map(cidrs, func(a string, _ int) egapiv1a1.CIDR {
+				return egapiv1a1.CIDR(a)
+			}),
+		},
+	}
+}
+
+func (e *Emitter) EmitIPRangeControl(ir emitterir.EmitterIR, gwResources *i2gw.GatewayResources) {
+	for nn, ctx := range ir.HTTPRoutes {
+		if ctx.IPRangeControlByRuleIdx == nil {
+			continue
+		}
+
+		MergeIPRangeControlIR(&ctx)
+
+		for idx, ipCon := range ctx.IPRangeControlByRuleIdx {
+			var sectionName *gwapiv1.SectionName
+			if idx != RouteRuleAllIndex && idx < len(ctx.Spec.Rules) {
+				sectionName = ctx.Spec.Rules[idx].Name
+			}
+
+			securityPolicy := e.getOrBuildSecurityPolicy(ctx, sectionName, idx)
+
+			var rules []egapiv1a1.AuthorizationRule
+			defaultAction := egapiv1a1.AuthorizationActionAllow
+			if len(ipCon.AllowList) > 0 {
+				defaultAction = egapiv1a1.AuthorizationActionDeny
+			}
+			if len(ipCon.DenyList) > 0 {
+				rules = append(rules, buildAuthRule(egapiv1a1.AuthorizationActionDeny, ipCon.DenyList))
+			}
+			if len(ipCon.AllowList) > 0 {
+				rules = append(rules, buildAuthRule(egapiv1a1.AuthorizationActionAllow, ipCon.AllowList))
+			}
+			securityPolicy.Spec.Authorization = &egapiv1a1.Authorization{
+				DefaultAction: ptr.To(defaultAction),
+				Rules:         rules,
+			}
+
+			ruleInfo := ""
+			if sectionName != nil {
+				ruleInfo = fmt.Sprintf(" rule %s", *sectionName)
+			}
+			notify(notifications.InfoNotification, fmt.Sprintf("applied IP Range Control feature for HTTPRoute%s", ruleInfo), &ctx.HTTPRoute)
+		}
+
+		// mark IP Range Control IR as processed
+		ctx.IPRangeControlByRuleIdx = nil
+		ir.HTTPRoutes[nn] = ctx
+	}
+}

pkg/i2gw/emitters/envoygateway/utils.go

@@ -17,6 +17,8 @@ limitations under the License.
 package envoygateway_emitter
 
 import (
+	"reflect"
+
 	emitterir "github.com/kubernetes-sigs/ingress2gateway/pkg/i2gw/emitter_intermediate"
 )
 
@@ -31,21 +33,33 @@ func MergeBodySizeIR(ctx *emitterir.HTTPRouteContext) {
 			first = bs
 			continue
 		}
-		if (first.BufferSize == nil) != (bs.BufferSize == nil) {
-			return
-		}
-		if first.BufferSize != nil && !first.BufferSize.Equal(*bs.BufferSize) {
+		if !reflect.DeepEqual(first, bs) {
 			return
 		}
-		if (first.MaxSize == nil) != (bs.MaxSize == nil) {
-			return
+	}
+
+	ctx.BodySizeByRuleIdx = map[int]*emitterir.BodySize{
+		RouteRuleAllIndex: first,
+	}
+}
+
+func MergeIPRangeControlIR(ctx *emitterir.HTTPRouteContext) {
+	if len(ctx.IPRangeControlByRuleIdx) != len(ctx.Spec.Rules) {
+		return
+	}
+
+	var first *emitterir.IPRangeControl
+	for _, iprc := range ctx.IPRangeControlByRuleIdx {
+		if first == nil {
+			first = iprc
+			continue
 		}
-		if first.MaxSize != nil && !first.MaxSize.Equal(*bs.MaxSize) {
+		if !reflect.DeepEqual(first, iprc) {
 			return
 		}
 	}
 
-	ctx.BodySizeByRuleIdx = map[int]*emitterir.BodySize{
+	ctx.IPRangeControlByRuleIdx = map[int]*emitterir.IPRangeControl{
 		RouteRuleAllIndex: first,
 	}
 }