feat(event-gateway): Request rule validator policy - #7303
Open
lena-larionova wants to merge 2 commits into
Open
lena-larionova wants to merge 2 commits into
lena-larionova wants to merge 2 commits into
Conversation
✅ Deploy Preview for kongdeveloper ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
and tested it against .tech
fabianrbz
approved these changes
Sep 23, 2026
jakubdyszkiewicz
approved these changes
Sep 23, 2026
jakubdyszkiewicz
left a comment
jakubdyszkiewicz
left a comment
Contributor
There was a problem hiding this comment.
some nits, but looks good overall
I think we need more examples. This feature exposes quite a lot of things but we only put one example. I'll try to contribute it on followup PRs
| * Block changes to broker-level configuration. | ||
| * Prevent overly permissive ACL bindings, like granting `ALL` or using a wildcard principal. | ||
|
|
||
| Each rule describes the valid state of a request as a [CEL expression](/event-gateway/expressions/). When the expression evaluates to `false`, the rule's configured action runs. |
Contributor
There was a problem hiding this comment.
Suggested change
| Each rule describes the valid state of a request as a [CEL expression](/event-gateway/expressions/). When the expression evaluates to `false`, the rule's configured action runs. | |
| Each rule describes the valid state of a request as a [gateway expression](/event-gateway/expressions/). When the expression evaluates to `false`, the rule's configured action runs. |
remove CEL for now
| ### Request types and available values | ||
|
|
||
| You configure rules per Kafka request type. | ||
| Each request type exposes a different set of values to the rule's CEL expression, matching the fields of that request. |
Contributor
There was a problem hiding this comment.
Suggested change
| Each request type exposes a different set of values to the rule's CEL expression, matching the fields of that request. | |
| Each request type exposes a different set of values to the rule's expression, matching the fields of that request. |
| Each rule configures one of two actions, which runs when the rule's expression evaluates to `false`: | ||
|
|
||
| * `reject`: Fails the request, or the offending item in a batch, with the `POLICY_VIOLATION` error code. | ||
| * `passthrough`: Lets the request continue, but records the violation the same way `reject` does. |
Contributor
There was a problem hiding this comment.
Suggested change
| * `passthrough`: Lets the request continue, but records the violation the same way `reject` does. | |
| * `passthrough`: Lets the request continue, but records the violation the same way `reject` does (metrics and logs on a debug level). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
New event gateway policy in 1.3: request rule validator. This adds the policy ref doc and an example.
Note: can't test this yet, the API isn't updated in Konnect.
Preview Links
/event-gateway/policies/request-rule-validator/