feat: typed spec.extensionProviders[] for ext_authz registrations

[patrickleet]

Adds a typed surface on IstioStack for registering Istio MeshConfig ExtensionProviders (HTTP + gRPC). Per-namespace oauth2-proxy bridges declare themselves once; AuthorizationPolicy.CUSTOM rules in any consumer namespace reference the registered name. Render fails with actionable messages on missing name, duplicate name, both modes set, or neither mode set. Status surface exposes the configured provider list so consumers can gate AuthorizationPolicy MRs on readiness.

End-to-end verified on pat-local: registered smoke-test-ext-authz points at a deny-403 nginx; waypoint Envoy access log shows "302 UAEX ext_authz_denied" via the registered provider.

Implements [[tasks/istio-stack-extension-providers]] Pattern: [[specs/platform-public-exposure]]

[coderabbitai]

Warning

Review limit reached

@patrickleet, we couldn't start this review because you've used your available PR reviews for now.

Your plan includes 1 review of capacity. Refill in 46 minutes and 6 seconds.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more review capacity refills, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 00ff5fed-9155-4fea-9ea6-d807ca0bc6a2

📥 Commits

Reviewing files that changed from the base of the PR and between 73bb360 and 1e4d817.

📒 Files selected for processing (8)

• Makefile
• apis/istiostacks/definition.yaml
• examples/istiostacks/with-extensionproviders.yaml
• functions/render/000-state-init.yaml.gotmpl
• functions/render/010-state-status.yaml.gotmpl
• functions/render/210-istiod.yaml.gotmpl
• functions/render/999-status.yaml.gotmpl
• tests/test-render/main.k

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/extension-providers-surface

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Published Crossplane Package

The following Crossplane package was published as part of this PR:

Package: ghcr.io/hops-ops/istio-stack:pr-32-1a506c9cf30ba8778b5253629c27a2a7296bf4e1

View Package