TapDS API (#7287)

Signed-off-by: Yuval Kohavi <yuval.kohavi@gmail.com>

Mirrored from https://github.com/envoyproxy/envoy @ 154d7a0fc31d279a07f10f33ccdabb136ea25413

envoy/config/common/tap/v2alpha/BUILD

@@ -7,6 +7,7 @@ api_proto_library_internal(
     srcs = ["common.proto"],
     visibility = ["//visibility:public"],
     deps = [
+        "//envoy/api/v2/core:config_source",
         "//envoy/service/tap/v2alpha:common",
     ],
 )

envoy/config/common/tap/v2alpha/common.proto

@@ -1,8 +1,10 @@
 syntax = "proto3";
 
 import "envoy/service/tap/v2alpha/common.proto";
+import "envoy/api/v2/core/config_source.proto";
 
 import "validate/validate.proto";
+import "gogoproto/gogo.proto";
 
 package envoy.config.common.tap.v2alpha;
 
@@ -14,6 +16,17 @@ option java_package = "io.envoyproxy.envoy.config.common.tap.v2alpha";
 
 // Common configuration for all tap extensions.
 message CommonExtensionConfig {
+
+  // [#not-implemented-hide:]
+  message TapDSConfig {
+    // Configuration for the source of TapDS updates for this Cluster.
+    envoy.api.v2.core.ConfigSource config_source = 1
+        [(validate.rules).message.required = true, (gogoproto.nullable) = false];
+
+    // Tap config to request from XDS server.
+    string name = 2 [(validate.rules).string.min_bytes = 1];
+  }
+
   oneof config_type {
     option (validate.required) = true;
 
@@ -23,6 +36,9 @@ message CommonExtensionConfig {
     // If specified, the tap filter will be configured via a static configuration that cannot be
     // changed.
     service.tap.v2alpha.TapConfig static_config = 2;
+
+    // [#not-implemented-hide:] Configuration to use for TapDS updates for the filter.
+    TapDSConfig tapds_config = 3;
   }
 }
 

envoy/data/tap/v2alpha/BUILD

@@ -28,8 +28,10 @@ api_proto_library_internal(
 api_proto_library_internal(
     name = "wrapper",
     srcs = ["wrapper.proto"],
+    visibility = ["//visibility:public"],
     deps = [
         ":http",
         ":transport",
+        "//envoy/api/v2/core:address",
     ],
 )

envoy/service/tap/v2alpha/BUILD

@@ -7,6 +7,31 @@ api_proto_library_internal(
     srcs = ["common.proto"],
     visibility = ["//visibility:public"],
     deps = [
+        "//envoy/api/v2/core:base",
+        "//envoy/api/v2/core:grpc_service",
         "//envoy/api/v2/route",
+        "//envoy/type/matcher:string",
+    ],
+)
+
+api_proto_library_internal(
+    name = "tap",
+    srcs = ["tap.proto"],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//envoy/api/v2:discovery",
+        "//envoy/api/v2/core:base",
+        "//envoy/data/tap/v2alpha:wrapper",
+    ],
+)
+
+api_proto_library_internal(
+    name = "tapds",
+    srcs = ["tapds.proto"],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//envoy/api/v2:discovery",
+        "//envoy/api/v2/core:base",
+        "//envoy/service/tap/v2alpha:common",
     ],
 )

envoy/service/tap/v2alpha/common.proto

@@ -1,6 +1,9 @@
 syntax = "proto3";
 
 import "envoy/api/v2/route/route.proto";
+import "envoy/api/v2/core/base.proto";
+import "envoy/api/v2/core/grpc_service.proto";
+import "envoy/type/matcher/string.proto";
 
 import "google/protobuf/wrappers.proto";
 
@@ -24,6 +27,16 @@ message TapConfig {
   // a tap will occur and the data will be written to the configured output.
   OutputConfig output_config = 2 [(validate.rules).message.required = true];
 
+  // [#not-implemented-hide:] Specify if Tap matching is enabled. The % of requests\connections for
+  // which the tap matching is enabled. When not enabled, the request\connection will not be
+  // recorded.
+  //
+  // .. note::
+  //
+  //   This field defaults to 100/:ref:`HUNDRED
+  //   <envoy_api_enum_type.FractionalPercent.DenominatorType>`.
+  envoy.api.v2.core.RuntimeFractionalPercent tap_enabled = 3;
+
   // [#comment:TODO(mattklein123): Rate limiting]
 }
 
@@ -158,6 +171,10 @@ message OutputSink {
 
     // Tap output will be written to a file per tap sink.
     FilePerTapSink file_per_tap = 3;
+
+    // [#not-implemented-hide:]
+    // GrpcService to stream data to. The format argument must be PROTO_BINARY.
+    StreamingGrpcSink streaming_grpc = 4;
   }
 }
 
@@ -172,3 +189,13 @@ message FilePerTapSink {
   // connection ID, HTTP stream ID, etc.).
   string path_prefix = 1 [(validate.rules).string.min_bytes = 1];
 }
+
+// [#not-implemented-hide:] Streaming gRPC sink configuration sends the taps to an external gRPC
+// server.
+message StreamingGrpcSink {
+  // Opaque identifier, that will be sent back to the streaming grpc server.
+  string tap_id = 1;
+
+  // The gRPC server that hosts the Tap Sink Service.
+  envoy.api.v2.core.GrpcService grpc_service = 2 [(validate.rules).message.required = true];
+}

envoy/service/tap/v2alpha/tap.proto

@@ -0,0 +1,50 @@
+syntax = "proto3";
+
+import "envoy/api/v2/core/base.proto";
+import "envoy/data/tap/v2alpha/wrapper.proto";
+
+package envoy.service.tap.v2alpha;
+
+import "validate/validate.proto";
+
+option java_outer_classname = "CommonProto";
+option java_multiple_files = true;
+option java_package = "io.envoyproxy.envoy.service.tap.v2alpha";
+
+// [#protodoc-title: Tap Sink Service]
+
+// [#not-implemented-hide:] Stream message for the Tap API. Envoy will open a stream to the server
+// and stream taps without ever expecting a response.
+message StreamTapsRequest {
+  message Identifier {
+    // The node sending taps over the stream.
+    envoy.api.v2.core.Node node = 1 [(validate.rules).message.required = true];
+    // The opaque identifier that was set in the :ref:`output config
+    // <envoy_api_field_service.tap.v2alpha.StreamingGrpcSink.tap_id>`.
+    string tap_id = 2;
+  }
+
+  // Identifier data effectively is a structured metadata. As a performance optimization this will
+  // only be sent in the first message on the stream.
+  Identifier identifier = 1;
+  // The trace id. this can be used to merge together a streaming trace. Note that the trace_id
+  // is not guaranteed to be spatially or temporally unique.
+  uint64 trace_id = 2;
+  // The trace data.
+  envoy.data.tap.v2alpha.TraceWrapper trace = 3;
+}
+
+// [#not-implemented-hide:]
+message StreamTapsResponse {
+}
+
+// [#not-implemented-hide:] A tap service to receive incoming taps. Envoy will call
+// StreamTaps to deliver captured taps to the server
+service TapSinkService {
+
+  // Envoy will connect and send StreamTapsRequest messages forever. It does not expect any
+  // response to be sent as nothing would be done in the case of failure. The server should
+  // disconnect if it expects Envoy to reconnect.
+  rpc StreamTaps(stream StreamTapsRequest) returns (StreamTapsResponse) {
+  }
+}

envoy/service/tap/v2alpha/tapds.proto

@@ -0,0 +1,43 @@
+syntax = "proto3";
+
+import "envoy/api/v2/discovery.proto";
+import "envoy/service/tap/v2alpha/common.proto";
+import "validate/validate.proto";
+
+package envoy.service.tap.v2alpha;
+
+import "google/api/annotations.proto";
+
+option java_outer_classname = "CommonProto";
+option java_multiple_files = true;
+option java_package = "io.envoyproxy.envoy.service.tap.v2alpha";
+
+// [#protodoc-title: Tap discovery service]
+
+// [#not-implemented-hide:] Tap discovery service.
+service TapDiscoveryService {
+  rpc StreamTapConfigs(stream envoy.api.v2.DiscoveryRequest)
+      returns (stream envoy.api.v2.DiscoveryResponse) {
+  }
+
+  rpc DeltaTapConfigs(stream envoy.api.v2.DeltaDiscoveryRequest)
+      returns (stream envoy.api.v2.DeltaDiscoveryResponse) {
+  }
+
+  rpc FetchTapConfigs(envoy.api.v2.DiscoveryRequest) returns (envoy.api.v2.DiscoveryResponse) {
+    option (google.api.http) = {
+      post: "/v2/discovery:tap_configs"
+      body: "*"
+    };
+  }
+}
+
+// [#not-implemented-hide:] A tap resource is essentially a tap configuration with a name
+// The filter TapDS config references this name.
+message TapResource {
+  // The name of the tap configuration.
+  string name = 1 [(validate.rules).string.min_bytes = 1];
+
+  // Tap config to apply
+  TapConfig config = 2;
+}