[Feat]: Mirror request plugins execution to the response path by abdallahsamabd · Pull Request #2369 · kubernetes-sigs/gateway-api-inference-extension

abdallahsamabd · 2026-02-18T13:05:48Z

Add response plugin execution support to the BBR (Body-Based Router) system, mirroring the existing request plugin path. This enables use cases like response guardrails and content filtering before returning responses to the user.

Changes:

Add responsePlugins field to BBR Server struct and NewServer constructor
Implement HandleResponseBody to execute response plugins on the response body
Add processResponseBody for streaming response body buffering (mirrors processRequestBody)
Thread ResponsePlugins through ExtProcServerRunner
Update integration test harness to accept response plugins
Add unit tests (6) and gRPC integration tests (2) for response plugin execution

Note: Plugins are executed for validation, logging, and side effects, but mutated body/headers are not yet applied to the ext_proc response. Applying mutations (including updating dependent headers like content-length) is deferred to a follow-up to avoid inconsistencies

Note: Configuration of response plugins (CLI flags, Helm chart values) is intentionally left out of scope, as the project is converging on file-based configuration.

What type of PR is this?

/kind feature

What this PR does / why we need it:
The BBR plugin system currently only supports executing plugins on the request path. This PR mirrors that execution to the response path, allowing plugins implementing the PayloadProcessor interface to inspect and mutate response bodies before they are returned to the client. This is useful for response guardrails, content filtering, auditing, and other post-processing use cases.

Which issue(s) this PR fixes:
Ref #2354

Does this PR introduce a user-facing change?:

NONE

netlify · 2026-02-18T13:05:55Z

✅ Deploy Preview for gateway-api-inference-extension ready!

Name	Link
🔨 Latest commit	`26471c5`
🔍 Latest deploy log	https://app.netlify.com/projects/gateway-api-inference-extension/deploys/69a6f5fbb33130000756b471
😎 Deploy Preview	https://deploy-preview-2369--gateway-api-inference-extension.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

linux-foundation-easycla · 2026-02-18T13:05:56Z

The committers listed above are authorized under a signed CLA.

✅ login: abdallahsamabd / name: abdallahsamabd (26471c5)

k8s-ci-robot · 2026-02-18T13:05:58Z

Welcome @abdallahsamabd!

It looks like this is your first PR to kubernetes-sigs/gateway-api-inference-extension 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/gateway-api-inference-extension has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2026-02-18T13:05:59Z

Hi @abdallahsamabd. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

abdallahsamabd · 2026-02-18T22:52:40Z

/retest

k8s-ci-robot · 2026-02-18T22:52:55Z

@abdallahsamabd: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/retest

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

nirrozenbaum · 2026-02-19T11:34:16Z

 This extension works by parsing the request body. If it finds a `model` parameter in the
 request body, it will copy the value of that parameter into a request header.
+
+## Pluggable BBR Plugins


can we revert the change in the README.md?
on the one hand, yes we're starting the add the pluging support.
but on the other hand, this is still not wired properly, so we still don't want to expose it to users (we don't want a user to try and don't understand why it is still not working).

ok sure
done

nirrozenbaum · 2026-02-19T11:41:06Z

@abdallahsamabd a general comment that spreads across multiple files:
can we keep this PR focused on response plugins execution while keeping how we set them plugins out of scope?

more concretely - if we can leave the --response plugins out of runner, as well as the helm chart updates.
the main reason is that, we should converge on configuration from file. so these are going to be removed soon.

nirrozenbaum · 2026-02-19T11:48:16Z

/ok-to-test

abdallahsamabd · 2026-02-19T11:48:31Z

@nirrozenbaum
both review comments were fixed
thanks

Add response plugin support to the pluggable BBR system, enabling use cases like response guardrails and content filtering. Changes: - Add responsePlugins to BBR Server struct - Implement response plugin execution loop in HandleResponseBody - Add processResponseBody for streaming response body buffering - Add --response-plugin CLI flag (mirrors --plugin) - Thread response plugins through ExtProcServerRunner - Update Helm chart templates and values for responsePlugins - Add unit tests (6) and gRPC integration tests (2) - Update pkg/bbr/README.md and chart README with plugin docs Signed-off-by: abdallahsamabd <abdallahsamabd@gmail.com> Signed-off-by: Abdallah Samara <abdallahsamabd@gmail.com>

nirrozenbaum · 2026-03-03T15:33:40Z

+	noopPlugin := &fakeResponsePlugin{
+		name: "noop",
+		mutateFn: func(_ context.Context, headers map[string]string, body map[string]any) (map[string]string, map[string]any, error) {
+			return headers, body, nil
+		},
+	}


can you explain what is this text with noop plugin? why is it needed?

The noop plugin is needed to bypass the len(s.responsePlugins) == 0 early return in HandleResponseBody. Without it, the test would only exercise the no-plugins shortcut path. The noop ensures we go through the full code path (JSON unmarshal → plugin execution → response construction) in streaming mode, validating it completes without errors.

"Noop" stands for no operation — it's a plugin that does nothing. It receives the headers and body, and returns them unchanged. It exists purely to satisfy the "has plugins" condition so the code doesn't take the early-return shortcut.

got it. maybe it would be good to reuse the mutating plugin, so we can check that plugin is actually executed correctly in streaming mode.

since mutations are not yet applied to the response in this PR, we can't verify the plugin's effect from the returned response. Once we add mutation in the follow-up we'll update this test to use a mutating plugin

nirrozenbaum

/lgtm
/approve

Thanks!

k8s-ci-robot · 2026-03-03T22:43:30Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: abdallahsamabd, nirrozenbaum

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [nirrozenbaum]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Follow-up to kubernetes-sigs#2354 / PR kubernetes-sigs#2369. Exercises the full Process loop (request body -> response headers -> response body) to validate that response plugins can mutate the response body over a real gRPC ext_proc stream. Covers: - Unary mode: response plugin mutates the response body - Unary mode: no response plugins results in passthrough behavior Signed-off-by: Abdallah Samara <abdallahsamabd@gmail.com>

…s#2369) Add response plugin support to the pluggable BBR system, enabling use cases like response guardrails and content filtering. Changes: - Add responsePlugins to BBR Server struct - Implement response plugin execution loop in HandleResponseBody - Add processResponseBody for streaming response body buffering - Add --response-plugin CLI flag (mirrors --plugin) - Thread response plugins through ExtProcServerRunner - Update Helm chart templates and values for responsePlugins - Add unit tests (6) and gRPC integration tests (2) - Update pkg/bbr/README.md and chart README with plugin docs Signed-off-by: abdallahsamabd <abdallahsamabd@gmail.com> Signed-off-by: Abdallah Samara <abdallahsamabd@gmail.com>

Follow-up to kubernetes-sigs#2354 / PR kubernetes-sigs#2369. Exercises the full Process loop (request body -> response headers -> response body) to validate that response plugins can mutate the response body over a real gRPC ext_proc stream. Covers: - Unary mode: response plugin mutates the response body - Unary mode: no response plugins results in passthrough behavior Signed-off-by: Abdallah Samara <abdallahsamabd@gmail.com>

Follow-up to kubernetes-sigs#2354 / PR kubernetes-sigs#2369. Exercises the full Process loop (request body -> response headers -> response body) to validate that response plugins can mutate the response body over a real gRPC ext_proc stream. Covers: - Unary mode: response plugin mutates the response body - Unary mode: no response plugins results in passthrough behavior Signed-off-by: Abdallah Samara <abdallahsamabd@gmail.com> Made-with: Cursor

Follow-up to #2354 / PR #2369. Exercises the full Process loop (request body -> response headers -> response body) to validate that response plugins can mutate the response body over a real gRPC ext_proc stream. Covers: - Unary mode: response plugin mutates the response body - Unary mode: no response plugins results in passthrough behavior Made-with: Cursor Signed-off-by: Abdallah Samara <abdallahsamabd@gmail.com>

…s/gateway-api-inference-extension#2369) Add response plugin support to the pluggable BBR system, enabling use cases like response guardrails and content filtering. Changes: - Add responsePlugins to BBR Server struct - Implement response plugin execution loop in HandleResponseBody - Add processResponseBody for streaming response body buffering - Add --response-plugin CLI flag (mirrors --plugin) - Thread response plugins through ExtProcServerRunner - Update Helm chart templates and values for responsePlugins - Add unit tests (6) and gRPC integration tests (2) - Update pkg/bbr/README.md and chart README with plugin docs Signed-off-by: abdallahsamabd <abdallahsamabd@gmail.com> Signed-off-by: Abdallah Samara <abdallahsamabd@gmail.com>

…gateway-api-inference-extension#2450) Follow-up to kubernetes-sigs/gateway-api-inference-extension#2354 / PR kubernetes-sigs/gateway-api-inference-extension#2369. Exercises the full Process loop (request body -> response headers -> response body) to validate that response plugins can mutate the response body over a real gRPC ext_proc stream. Covers: - Unary mode: response plugin mutates the response body - Unary mode: no response plugins results in passthrough behavior Made-with: Cursor Signed-off-by: Abdallah Samara <abdallahsamabd@gmail.com>

k8s-ci-robot added the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Feb 18, 2026

k8s-ci-robot requested review from elevran and liu-cong February 18, 2026 13:05

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 18, 2026

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Feb 18, 2026

abdallahsamabd force-pushed the feat/2354 branch from cbe0448 to 0e97f0e Compare February 18, 2026 13:32

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 18, 2026

abdallahsamabd force-pushed the feat/2354 branch from 0e97f0e to 3270c9a Compare February 18, 2026 22:44

k8s-ci-robot removed the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Feb 18, 2026

abdallahsamabd force-pushed the feat/2354 branch from 3270c9a to bf72793 Compare February 19, 2026 10:45

nirrozenbaum reviewed Feb 19, 2026

View reviewed changes

abdallahsamabd force-pushed the feat/2354 branch from bf72793 to 2fe818f Compare February 19, 2026 11:40

abdallahsamabd force-pushed the feat/2354 branch from 2fe818f to 5456972 Compare February 19, 2026 11:47

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Feb 19, 2026

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Feb 19, 2026

abdallahsamabd force-pushed the feat/2354 branch from e74d362 to 26471c5 Compare March 3, 2026 14:53

nirrozenbaum reviewed Mar 3, 2026

View reviewed changes

abdallahsamabd mentioned this pull request Mar 3, 2026

[pluggable bbr] apply response plugin body/header mutations to ext_proc response #2470

Closed

nirrozenbaum approved these changes Mar 3, 2026

View reviewed changes

k8s-ci-robot assigned nirrozenbaum Mar 3, 2026

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 3, 2026

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 3, 2026

k8s-ci-robot merged commit cefd0d9 into kubernetes-sigs:main Mar 3, 2026
11 checks passed

abdallahsamabd mentioned this pull request Mar 4, 2026

[bbr] Apply response plugin body/header mutations to ext_proc response #2477

Merged

nirrozenbaum mentioned this pull request Mar 12, 2026

[pluggable bbr] mirror request plugins execution to the response path #2354

Closed

abdallahsamabd mentioned this pull request Mar 12, 2026

fix(bbr): enable response header/body processing in Istio EnvoyFilter #2557

Merged

Conversation

abdallahsamabd commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for gateway-api-inference-extension ready!

Uh oh!

linux-foundation-easycla Bot commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Feb 18, 2026

Uh oh!

k8s-ci-robot commented Feb 18, 2026

Uh oh!

abdallahsamabd commented Feb 18, 2026

Uh oh!

k8s-ci-robot commented Feb 18, 2026

Uh oh!

nirrozenbaum Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

abdallahsamabd Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nirrozenbaum commented Feb 19, 2026

Uh oh!

nirrozenbaum commented Feb 19, 2026

Uh oh!

abdallahsamabd commented Feb 19, 2026

Uh oh!

nirrozenbaum Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

abdallahsamabd Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nirrozenbaum Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

abdallahsamabd Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

nirrozenbaum left a comment

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Mar 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

abdallahsamabd commented Feb 18, 2026 •

edited

Loading

netlify Bot commented Feb 18, 2026 •

edited

Loading

linux-foundation-easycla Bot commented Feb 18, 2026 •

edited

Loading

abdallahsamabd Feb 19, 2026 •

edited

Loading

abdallahsamabd Mar 3, 2026 •

edited

Loading