Implement ProxySettingsPolicy

.yamllint.yaml

@@ -29,6 +29,7 @@ rules:
     check-multi-line-strings: true
     ignore: |
       operators/**/*
+      examples/proxy-settings-policy/app.yaml
   key-duplicates: enable
   key-ordering: disable
   line-length:

charts/nginx-gateway-fabric/templates/clusterrole.yaml

@@ -129,6 +129,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - proxysettingspolicies
   {{- if .Values.nginxGateway.snippetsFilters.enable }}
   - snippetsfilters
   {{- end }}
@@ -142,6 +143,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - proxysettingspolicies/status
   {{- if .Values.nginxGateway.snippetsFilters.enable }}
   - snippetsfilters/status
   {{- end }}

deploy/azure/deploy.yaml

@@ -169,6 +169,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - proxysettingspolicies
   verbs:
   - list
   - watch
@@ -179,6 +180,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - proxysettingspolicies/status
   verbs:
   - update
 - apiGroups:

deploy/default/deploy.yaml

@@ -169,6 +169,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - proxysettingspolicies
   verbs:
   - list
   - watch
@@ -179,6 +180,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - proxysettingspolicies/status
   verbs:
   - update
 - apiGroups:

deploy/experimental-nginx-plus/deploy.yaml

@@ -171,6 +171,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - proxysettingspolicies
   verbs:
   - list
   - watch
@@ -181,6 +182,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - proxysettingspolicies/status
   verbs:
   - update
 - apiGroups:

deploy/experimental/deploy.yaml

@@ -171,6 +171,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - proxysettingspolicies
   verbs:
   - list
   - watch
@@ -181,6 +182,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - proxysettingspolicies/status
   verbs:
   - update
 - apiGroups:

deploy/inference-nginx-plus/deploy.yaml

@@ -169,6 +169,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - proxysettingspolicies
   verbs:
   - list
   - watch
@@ -179,6 +180,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - proxysettingspolicies/status
   verbs:
   - update
 - apiGroups:

deploy/inference/deploy.yaml

@@ -169,6 +169,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - proxysettingspolicies
   verbs:
   - list
   - watch
@@ -179,6 +180,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - proxysettingspolicies/status
   verbs:
   - update
 - apiGroups:

deploy/nginx-plus/deploy.yaml

@@ -169,6 +169,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - proxysettingspolicies
   verbs:
   - list
   - watch
@@ -179,6 +180,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - proxysettingspolicies/status
   verbs:
   - update
 - apiGroups:

deploy/nodeport/deploy.yaml

@@ -169,6 +169,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - proxysettingspolicies
   verbs:
   - list
   - watch
@@ -179,6 +180,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - proxysettingspolicies/status
   verbs:
   - update
 - apiGroups:

deploy/openshift/deploy.yaml

@@ -169,6 +169,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - proxysettingspolicies
   verbs:
   - list
   - watch
@@ -179,6 +180,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - proxysettingspolicies/status
   verbs:
   - update
 - apiGroups:

deploy/snippets-filters-nginx-plus/deploy.yaml

@@ -169,6 +169,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - proxysettingspolicies
   - snippetsfilters
   verbs:
   - list
@@ -180,6 +181,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - proxysettingspolicies/status
   - snippetsfilters/status
   verbs:
   - update

deploy/snippets-filters/deploy.yaml

@@ -169,6 +169,7 @@ rules:
   - clientsettingspolicies
   - observabilitypolicies
   - upstreamsettingspolicies
+  - proxysettingspolicies
   - snippetsfilters
   verbs:
   - list
@@ -180,6 +181,7 @@ rules:
   - clientsettingspolicies/status
   - observabilitypolicies/status
   - upstreamsettingspolicies/status
+  - proxysettingspolicies/status
   - snippetsfilters/status
   verbs:
   - update

examples/proxy-settings-policy/README.md

@@ -0,0 +1,3 @@
+# Proxy Settings Policy
+
+This directory contains the YAML files used in the [ProxySettingsPolicy](https://docs.nginx.com/nginx-gateway-fabric/traffic-management/proxy-settings/) guide.

examples/proxy-settings-policy/app.yaml

@@ -0,0 +1,154 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: response-generator
+data:
+  main.go: |
+    package main
+
+    import (
+        "fmt"
+        "log"
+        "net/http"
+        "strings"
+        "time"
+    )
+
+    func coffeeHandler(w http.ResponseWriter, r *http.Request) {
+        // Returns a large response to demonstrate buffering requirements
+        // This generates a response larger than NGINX's default proxy_buffer_size (4k/8k)
+        // Without proper buffering configuration, this may cause errors
+        w.Header().Set("Content-Type", "text/plain")
+        w.Header().Set("X-Content-Type-Options", "nosniff")
+
+        // Generate a large header that exceeds default proxy_buffer_size
+        // Default is typically 4k-8k depending on platform
+        largeHeader := strings.Repeat("X", 10000)
+        w.Header().Set("X-Large-Header", largeHeader)
+
+        flusher, ok := w.(http.Flusher)
+        if !ok {
+            http.Error(w, "Streaming unsupported", http.StatusInternalServerError)
+            return
+        }
+
+        // Generate a large response body (5MB in chunks)
+        // This tests both proxy_buffer_size and proxy_buffers settings
+        chunkSize := 1024     // 1KB chunks
+        totalChunks := 5120   // 5MB total
+
+        for i := 0; i < totalChunks; i++ {
+            chunk := fmt.Sprintf("Coffee chunk %d: %s\n", i, strings.Repeat("x", chunkSize-20))
+            fmt.Fprint(w, chunk)
+            if i%10 == 0 {
+                flusher.Flush()
+            }
+            time.Sleep(100 * time.Microsecond) // Small delay to simulate slow backend
+        }
+    }
+
+    func healthHandler(w http.ResponseWriter, r *http.Request) {
+        w.WriteHeader(http.StatusOK)
+        fmt.Fprint(w, "OK")
+    }
+
+    func main() {
+        http.HandleFunc("/coffee", coffeeHandler)
+        http.HandleFunc("/health", healthHandler)
+
+        log.Println("Server starting on :8080")
+        if err := http.ListenAndServe(":8080", nil); err != nil {
+            log.Fatal(err)
+        }
+    }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: coffee
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: coffee
+  template:
+    metadata:
+      labels:
+        app: coffee
+    spec:
+      containers:
+      - name: coffee
+        image: golang:1.25-alpine
+        command: ["/bin/sh"]
+        args:
+          - -c
+          - |
+            cd /app
+            go run main.go
+        ports:
+        - containerPort: 8080
+        volumeMounts:
+        - name: app
+          mountPath: /app
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+          initialDelaySeconds: 5
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+          initialDelaySeconds: 5
+          periodSeconds: 5
+      volumes:
+      - name: app
+        configMap:
+          name: response-generator
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: coffee
+spec:
+  ports:
+  - port: 80
+    targetPort: 8080
+    protocol: TCP
+    name: http
+  selector:
+    app: coffee
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tea
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: tea
+  template:
+    metadata:
+      labels:
+        app: tea
+    spec:
+      containers:
+      - name: tea
+        image: nginxdemos/nginx-hello:plain-text
+        ports:
+        - containerPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: tea
+spec:
+  ports:
+  - port: 80
+    targetPort: 8080
+    protocol: TCP
+    name: http
+  selector:
+    app: tea

examples/proxy-settings-policy/coffee-proxy-settings.yaml

@@ -0,0 +1,19 @@
+apiVersion: gateway.nginx.org/v1alpha1
+kind: ProxySettingsPolicy
+metadata:
+  name: coffee-proxy-settings
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: coffee
+  buffering:
+    # Increase buffer size to handle large response headers (>10KB)
+    bufferSize: "16k"
+    # Configure more and larger buffers to handle 5MB response body
+    buffers:
+      number: 16
+      size: "64k"
+    # Set busy buffers size to allow more data to be sent to client
+    # while still receiving from upstream
+    busyBuffersSize: "128k"

examples/proxy-settings-policy/gateway-proxy-settings.yaml

@@ -0,0 +1,15 @@
+apiVersion: gateway.nginx.org/v1alpha1
+kind: ProxySettingsPolicy
+metadata:
+  name: gateway-proxy-settings
+spec:
+  targetRefs:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    name: gateway
+  buffering:
+    bufferSize: "4k"
+    buffers:
+      number: 8
+      size: "4k"
+    busyBuffersSize: "16k"