feat: add Original Destination Backend support

api/v1alpha1/backend_types.go

@@ -134,12 +134,31 @@ type BackendSpec struct {
 	// Endpoints defines the endpoints to be used when connecting to the backend.
 	//
 	// +kubebuilder:validation:MinItems=1
-	// +kubebuilder:validation:MaxItems=64
-	// +kubebuilder:validation:XValidation:rule="self.all(f, has(f.fqdn)) || !self.exists(f, has(f.fqdn))",message="fqdn addresses cannot be mixed with other address types"
-	Endpoints []BackendEndpoint `json:"endpoints,omitempty"`
+        // +kubebuilder:validation:MaxItems=4
+        // +kubebuilder:validation:XValidation:rule="self.all(f, has(f.fqdn)) || !self.exists(f, has(f.fqdn))",message="fqdn addresses cannot be mixed with other address types"
+        // +optional	Endpoints []BackendEndpoint `json:"endpoints,omitempty"`
 
 	// AppProtocols defines the application protocols to be supported when connecting to the backend.
-	//
+        //
+        // +optional
+        AppProtocols []AppProtocolType `json:"appProtocols,omitempty"`
+
+        // FQDN defines the FQDN used to contact the backend.
+        //
+        // +kubebuilder:validation:MaxLength=253
+        // +optional
+        FQDN *string `json:"fqdn,omitempty"`
+
+        // Fallback indicates whether the backend is designated as a fallback.
+        // It is highly recommended to configure active or passive health checks to ensure that failover can be detected
+        // when the active backends become unhealthy and to automatically readjust once the primary backends are healthy again.
+        // The overprovisioning factor is set to 1.4, meaning the fallback backends will only start receiving traffic when
+        // the health of the active backends falls below 72%.
+        //
+        // +optional
+        Fallback *bool `json:"fallback,omitempty"`
+
+        // TLS defines the TLS configuration for the backend.	//
 	// +optional
 	AppProtocols []AppProtocolType `json:"appProtocols,omitempty"`
 
@@ -152,10 +171,26 @@ type BackendSpec struct {
 	// +optional
 	Fallback *bool `json:"fallback,omitempty"`
 
-	// TLS defines the TLS settings for the backend.
-	// TLS.CACertificateRefs and TLS.WellKnownCACertificates can only be specified for DynamicResolver backends.
-	// TLS.InsecureSkipVerify can be specified for any Backends
-	//
+        //
+        // +optional
+        AppProtocols []AppProtocolType `json:"appProtocols,omitempty"`
+
+        // FQDN defines the FQDN used to contact the backend.
+        //
+        // +kubebuilder:validation:MaxLength=253
+        // +optional
+        FQDN *string `json:"fqdn,omitempty"`
+
+        // Fallback indicates whether the backend is designated as a fallback.
+        // It is highly recommended to configure active or passive health checks to ensure that failover can be detected
+        // when the active backends become unhealthy and to automatically readjust once the primary backends are healthy again.
+        // The overprovisioning factor is set to 1.4, meaning the fallback backends will only start receiving traffic when
+        // the health of the active backends falls below 72%.
+        //
+        // +optional
+        Fallback *bool `json:"fallback,omitempty"`
+
+        // TLS defines the TLS configuration for the backend.	//
 	// +optional
 	TLS *BackendTLSSettings `json:"tls,omitempty"`
 }

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backends.yaml

@@ -140,7 +140,7 @@ spec:
                     rule: ((has(self.fqdn) && !(has(self.ip) || has(self.unix))) ||
                       (has(self.ip) && !(has(self.fqdn) || has(self.unix))) || (has(self.unix)
                       && !(has(self.ip) || has(self.fqdn))))
-                maxItems: 64
+                maxItems: 4
                 minItems: 1
                 type: array
                 x-kubernetes-validations:
@@ -154,11 +154,41 @@ spec:
                   The overprovisioning factor is set to 1.4, meaning the fallback backends will only start receiving traffic when
                   the health of the active backends falls below 72%.
                 type: boolean
-              tls:
+              fqdn:
+                description: FQDN defines the FQDN used to contact the backend.
+                maxLength: 253
+                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                type: string
+              originalDestinationSettings:
                 description: |-
-                  TLS defines the TLS settings for the backend.
-                  TLS.CACertificateRefs and TLS.WellKnownCACertificates can only be specified for DynamicResolver backends.
-                  TLS.InsecureSkipVerify can be specified for any Backends
+                  OriginalDestinationSettings defines settings for Original Destination backend type.
+                  This field is only valid when Type is "OriginalDestination".
+                properties:
+                  allowedDestinations:
+                    description: |-
+                      AllowedDestinations specifies CIDR blocks or hostnames that are permitted
+                      as routing destinations. If empty, all destinations are allowed.
+                      Use this for security to prevent routing to unintended endpoints.
+
+                      Examples:
+                      - "10.0.0.0/8" (private networks)
+                      - "backend.example.com" (specific hostname)
+                      - "*.example.com" (wildcard hostname)
+                    items:
+                      type: string
+                    maxItems: 20
+                    type: array
+                  header:
+                    default: x-envoy-original-dst-host
+                    description: |-
+                      Header specifies the header name containing the destination address.
+                      The header value must be in "host:port" format (e.g., "backend.example.com:8080").
+                      If not specified, defaults to "x-envoy-original-dst-host".
+                    pattern: ^[a-zA-Z0-9]([a-zA-Z0-9\-_]{0,61}[a-zA-Z0-9])?$
+                    type: string
+                type: object
+              tls:
+                description: TLS defines the TLS configuration for the backend.
                 properties:
                   caCertificateRefs:
                     description: |-
@@ -248,11 +278,16 @@ spec:
                 enum:
                 - Endpoints
                 - DynamicResolver
+                - OriginalDestination
                 type: string
             type: object
             x-kubernetes-validations:
             - message: DynamicResolver type cannot have endpoints specified
               rule: self.type != 'DynamicResolver' || !has(self.endpoints)
+            - message: OriginalDestination type cannot have endpoints specified
+              rule: self.type != 'OriginalDestination' || !has(self.endpoints)
+            - message: OriginalDestination type must specify originalDestinationSettings
+              rule: self.type != 'OriginalDestination' || has(self.originalDestinationSettings)
           status:
             description: Status defines the current status of Backend.
             properties:

charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backends.yaml

@@ -139,7 +139,7 @@ spec:
                     rule: ((has(self.fqdn) && !(has(self.ip) || has(self.unix))) ||
                       (has(self.ip) && !(has(self.fqdn) || has(self.unix))) || (has(self.unix)
                       && !(has(self.ip) || has(self.fqdn))))
-                maxItems: 64
+                maxItems: 4
                 minItems: 1
                 type: array
                 x-kubernetes-validations:
@@ -153,11 +153,41 @@ spec:
                   The overprovisioning factor is set to 1.4, meaning the fallback backends will only start receiving traffic when
                   the health of the active backends falls below 72%.
                 type: boolean
-              tls:
+              fqdn:
+                description: FQDN defines the FQDN used to contact the backend.
+                maxLength: 253
+                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                type: string
+              originalDestinationSettings:
                 description: |-
-                  TLS defines the TLS settings for the backend.
-                  TLS.CACertificateRefs and TLS.WellKnownCACertificates can only be specified for DynamicResolver backends.
-                  TLS.InsecureSkipVerify can be specified for any Backends
+                  OriginalDestinationSettings defines settings for Original Destination backend type.
+                  This field is only valid when Type is "OriginalDestination".
+                properties:
+                  allowedDestinations:
+                    description: |-
+                      AllowedDestinations specifies CIDR blocks or hostnames that are permitted
+                      as routing destinations. If empty, all destinations are allowed.
+                      Use this for security to prevent routing to unintended endpoints.
+
+                      Examples:
+                      - "10.0.0.0/8" (private networks)
+                      - "backend.example.com" (specific hostname)
+                      - "*.example.com" (wildcard hostname)
+                    items:
+                      type: string
+                    maxItems: 20
+                    type: array
+                  header:
+                    default: x-envoy-original-dst-host
+                    description: |-
+                      Header specifies the header name containing the destination address.
+                      The header value must be in "host:port" format (e.g., "backend.example.com:8080").
+                      If not specified, defaults to "x-envoy-original-dst-host".
+                    pattern: ^[a-zA-Z0-9]([a-zA-Z0-9\-_]{0,61}[a-zA-Z0-9])?$
+                    type: string
+                type: object
+              tls:
+                description: TLS defines the TLS configuration for the backend.
                 properties:
                   caCertificateRefs:
                     description: |-
@@ -247,11 +277,16 @@ spec:
                 enum:
                 - Endpoints
                 - DynamicResolver
+                - OriginalDestination
                 type: string
             type: object
             x-kubernetes-validations:
             - message: DynamicResolver type cannot have endpoints specified
               rule: self.type != 'DynamicResolver' || !has(self.endpoints)
+            - message: OriginalDestination type cannot have endpoints specified
+              rule: self.type != 'OriginalDestination' || !has(self.endpoints)
+            - message: OriginalDestination type must specify originalDestinationSettings
+              rule: self.type != 'OriginalDestination' || has(self.originalDestinationSettings)
           status:
             description: Status defines the current status of Backend.
             properties:

internal/gatewayapi/backend.go

@@ -41,25 +41,57 @@ func (t *Translator) ProcessBackends(backends []*egv1a1.Backend) []*egv1a1.Backe
 }
 
 func validateBackend(backend *egv1a1.Backend) status.Error {
-	if backend.Spec.Type != nil &&
-		*backend.Spec.Type == egv1a1.BackendTypeDynamicResolver {
-		if len(backend.Spec.Endpoints) > 0 {
-			return status.NewRouteStatusError(
-				fmt.Errorf("DynamicResolver type cannot have endpoints specified"),
-				status.RouteReasonInvalidBackendRef,
-			)
-		}
+	if backend.Spec.Type != nil {
+		switch *backend.Spec.Type {
+		case egv1a1.BackendTypeDynamicResolver:
+			if len(backend.Spec.Endpoints) > 0 {
+				return status.NewRouteStatusError(
+					fmt.Errorf("DynamicResolver type cannot have endpoints specified"),
+					status.RouteReasonInvalidBackendRef,
+				)
+			}
 
-		if backend.Spec.TLS != nil &&
-			!ptr.Deref(backend.Spec.TLS.InsecureSkipVerify, false) &&
-			backend.Spec.TLS.WellKnownCACertificates == nil &&
-			len(backend.Spec.TLS.CACertificateRefs) == 0 {
-			return status.NewRouteStatusError(
-				fmt.Errorf("must specify either CACertificateRefs or WellKnownCACertificates for DynamicResolver type when InsecureSkipVerify is unset or false"),
-				status.RouteReasonInvalidBackendRef,
-			)
-		}
+			if backend.Spec.TLS != nil &&
+				!ptr.Deref(backend.Spec.TLS.InsecureSkipVerify, false) &&
+				backend.Spec.TLS.WellKnownCACertificates == nil &&
+				len(backend.Spec.TLS.CACertificateRefs) == 0 {
+				return status.NewRouteStatusError(
+					fmt.Errorf("must specify either CACertificateRefs or WellKnownCACertificates for DynamicResolver type when InsecureSkipVerify is unset or false"),
+					status.RouteReasonInvalidBackendRef,
+				)
+			}
+
+		case egv1a1.BackendTypeOriginalDestination:
+			if len(backend.Spec.Endpoints) > 0 {
+				return status.NewRouteStatusError(
+					fmt.Errorf("OriginalDestination type cannot have endpoints specified"),
+					status.RouteReasonInvalidBackendRef,
+				)
+			}
 
+			if backend.Spec.OriginalDestinationSettings == nil {
+				return status.NewRouteStatusError(
+					fmt.Errorf("OriginalDestination type must have OriginalDestinationSettings specified"),
+					status.RouteReasonInvalidBackendRef,
+				)
+			}
+
+		default:
+			if backend.Spec.TLS != nil {
+				if backend.Spec.TLS.WellKnownCACertificates != nil {
+					return status.NewRouteStatusError(
+						fmt.Errorf("TLS.WellKnownCACertificates settings can only be specified for DynamicResolver backends"),
+						status.RouteReasonInvalidBackendRef,
+					)
+				}
+				if len(backend.Spec.TLS.CACertificateRefs) > 0 {
+					return status.NewRouteStatusError(
+						fmt.Errorf("TLS.CACertificateRefs settings can only be specified for DynamicResolver backends"),
+						status.RouteReasonInvalidBackendRef,
+					)
+				}
+			}
+		}
 	} else if backend.Spec.TLS != nil {
 		if backend.Spec.TLS.WellKnownCACertificates != nil {
 			return status.NewRouteStatusError(

internal/gatewayapi/testdata/accesslog-als-backend.out.yaml

@@ -183,7 +183,7 @@ xdsIR:
               name: backend-fqdn
               namespace: envoy-gateway
             name: accesslog_otel_0_0/backend/-1
-            protocol: HTTP2
+            protocol: TCP
           - addressType: IP
             endpoints:
             - host: 1.1.1.1

internal/gatewayapi/testdata/backend-with-fallback.out.yaml

@@ -184,7 +184,6 @@ xdsIR:
               name: backend-2
               namespace: default
             name: httproute/default/httproute-1/rule/0/backend/1
-            priority: 1
             protocol: HTTP
             weight: 1
         hostname: '*'