If set, the resolver will avoid the system's heuristics to only return
IPv4 or IPv6 addresses that it considers to be "routable", instead
returning all possible IPv4 or IPv6 addresses. This setting is
ignored if the DNS lookup family is set to v4-only or v6-only.
This may be a useful setting to specify if the addresses considered
unroutable by the system's heuristics may in practice be routable.
Signed-off-by: JP Simard <jp@jpsim.com>
Mirrored from https://github.com/envoyproxy/envoy @ 60a13f30a4e425c907607fab96efee0ed2afcf22
ComparisonFilter's value now marked as required in validate to ensure valid
input to fuzz tests.
Signed-off-by: Andre Vehreschild <vehre@x41-dsec.de>
Mirrored from https://github.com/envoyproxy/envoy @ 8df3136bcc00c701bf5c30d090937e5f37585652
This adds the ability to change the GrpcService used by the ext_proc filter on a per-route basis.
Risk Level: Low. Not triggered unless configured.
Testing: New unit and integration tests added.
Docs Changes: Addition of new config field.
Signed-off-by: Michael Warres <mpw@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 0e8899c90213b39d8f4a1a083d4fd31e9c2fe8c1
Add unified matcher for network streams, as a replacement for filter chain match.
See previous discussion in #18871
Signed-off-by: Kuat Yessenov <kuat@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 7eb3a87b8757e030aedfdc4959adc509e89ac788
This change introduces a new output sink type for admin /tap requests which buffers traces internally before responding to the client.
This sink is best used to collect traces for requests that are frequently matched, or to work around system limitations such as improper support for streaming HTTP responses.
Signed-off-by: David Peet <davidpeet@tutanota.com>
Mirrored from https://github.com/envoyproxy/envoy @ 0fd80eef63bc9770186c4f4aa345ee63e464cab3
Use type_url to look up extensions. This prevents the undesirable practice of putting invalid protobufs to avoid a type lookup or duplicating the type URL.
Risk Level: medium, affects extensions with duplicated type URLs or no configuration
Testing: yes
Docs Changes: yes, this has been the recommendation for awhile.
Release Notes: yes
Runtime Guard: envoy.reloadable_features.no_extension_lookup_by_name
Signed-off-by: Kuat Yessenov <kuat@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 8cb6862fe6099cd8583a64ff037ecdeaf0e939fa
Add an extra async cluster look up. The continuation of the cluster look up is establishUpstreamConnection().
To establishConnection() is also the callback of upstream connection failure.
Additional Description:
Risk Level: LOW if odcds is disabled, the code path remains the same.
Testing: Added integration tests and existing unit test is untouched.
Docs Changes: n/a
Release Notes: inline
Signed-off-by: Yuchen Dai <silentdai@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ 0a587f23b21ab34b28d9c53428af259b3f7b0970
Added option to limit the number of certificates parsed during verification.
Signed-off-by: Deepti Gupta <deepti_gupta2@apple.com>
Mirrored from https://github.com/envoyproxy/envoy @ b130ee612018cf099a91b3f2bc1225f70f49e48c
The new field would allow more efficient generation of routes, replacing pairs of path+prefix routes into one path_separated_prefix route
Risk Level: Low
Testing: Unit test
Docs Changes: inline
Release Notes: Added
Fixes#18148
Signed-off-by: Toma Petkov <tpetkov@vmware.com>
Mirrored from https://github.com/envoyproxy/envoy @ 8f9e11247a07cc6df0ecd62689fe290f12a9013d
This begins the deprecation process for TTwitter.
Fixes#20466.
Signed-off-by: Raul Gutierrez Segales <rgs@pinterest.com>
Mirrored from https://github.com/envoyproxy/envoy @ 9e67f1e2461e965c0269c69356d608e39c23902b
filter_metadata is already forwarded to external auth service
but typed_filter_metadata is not, this commit fixes this.
Signed-off-by: Wanli Li <wanlil@netflix.com>
Mirrored from https://github.com/envoyproxy/envoy @ 9cce4a61851069f025493726f0b6cef87489f394
When deploying a new cluster specifier plugin, it is often necessary to add it to the configuration before all clients can be updated to support it, with routing rules configured to prevent clients without support from selecting any routes referencing the plugin. This field will allow those clients to suppress the default behavior of NACKing any resource containing the unknown plugin.
Risk Level: None
Testing: None
Docs Changes: None
Release Notes: None
Platform Specific Features: None
Signed-off-by: Doug Fawley <dfawley@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 55539d34f6ad5771f17ba04a64e1c7d24aa3c055
add envoy.extensions.transport_sockets.quic.v3.QuicDownstreamTransport.enable_early_data to turn on/off early data support in EnvoyQuicServerSession.
Risk Level: low, behavior change to h3 downstream handshake is behind the new config knob.
Testing: added new integration tests
Docs Changes: N/A
Release Notes: noted about the new config knob transport_sockets.quic.v3.QuicDownstreamTransport.enable_early_data
Fixes#19943
Mirrored from https://github.com/envoyproxy/envoy @ 7be30191816ef3cbdc2ca013560d9de6a3a2d5fb
* connection: add runtime guard to disable looking up local interface name for upstream connections
Signed-off-by: Jose Nino <jnino@lyft.com>
Mirrored from https://github.com/envoyproxy/envoy @ 8cbbf66dd3f46f3525e3950152d0c8bf666cbd57
If "issuer" in the JwtProvider config is specified, it has to match "iss" field in the JWT. But current implementation has a bug where if "iss" is empty, it is not checked.
Risk Level: Low, only impact users with empty "iss" JWT.
Testing: Unit-tested
Docs Changes: None
Release Notes: Yes
Signed-off-by: Wayne Zhang <qiwzhang@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 336fcf9b1105fcb2581a59811c0029f8899c63c2
Commit Message:
Additional Description:
Risk Level: low (off by default)
Testing: unit, integration
Docs Changes: in API
Release Notes: yes
Part of #20207
Signed-off-by: Alyssa Wilk <alyssar@chromium.org>
Mirrored from https://github.com/envoyproxy/envoy @ fc96a7683601321d3655b99d900cc8b9fd406992
Adding xDS routing discovery support for thrift proxy.
The routing discovery is supported only through ADS. No separate service endpoints added
for thrift routing config type url.
This PR is split from #17631
Risk Level: Low
Testing:
- Unittest
- Manual test with static routing from bootstrap config, static routing and dynamic routing from GRPC based xDS server.
Docs Changes: Comment added to the new API field.
Signed-off-by: Tamas Kovacs <tamas.2.kovacs@nokia-sbell.com>
Mirrored from https://github.com/envoyproxy/envoy @ ec7ef59ef36ccb5e2a9b20493ae23673504d75b9
TcpProxy ondemand vs http on demand
Why not a dedicated on demand filter prior to tcp_proxy?
A filter prior to tcp proxy cannot figure out the dest cluster before tcp_proxy establish the upstream connection.
In http stack, a route entry which contains the upstream cluster is offered to the potential on-demand filter before the router filter.
Why no per-route config in tcp_proxy?
TcpProxy provides single upstream cluster.
An alternative weighted_clusters can be used as tcp_proxy upstream cluster. However, it's probably too early to distinguish the
per cluster ondemand requirement within the weighted_cluster. We can always add in the future.
Risk Level: LOW
Signed-off-by: Yuchen Dai <silentdai@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ 824032e93ef295e22086f465d4c60a3aeea4ae13
* fix: slow start config add min_weight_percent field to avoid too big edf deadline
Signed-off-by: jiangshantao <jiangshantao-dbg@qq.com>
Mirrored from https://github.com/envoyproxy/envoy @ e3fede5b9374bca134ec546934335ab5cdeb7aef
ratelimit: add support for x-ratelimit-* headers in local rate limiting
Signed-off-by: Xie Zhihao <zhihao.xie@intel.com>
Mirrored from https://github.com/envoyproxy/envoy @ 5c56e45a041a4446411a8dccb5262b12323ff9be
Stateful session will try to parse upstream address from downstream request directly and override the result of load balancing algorithm by the LoadBalancerContext::overrideHostToSelect API.
To avoid the load balancer selecting hosts that in unexpected statuses, specifying some expected statuses are necessary.
In the previous design, we will provide expected statuses of override host by the LoadBalancerContext::overrideHostToSelect API.
And in the PR #18207, after some discussion with @htuch, we found may be cluster-level config may be more reasonable design and implementation.
Ref some more details: #18207 (comment)
So this PR try to close previous discussion in the #18207:
Refactoring LoadBalancerContext::overrideHostToSelect API to remove expected statuses for the return value.
Add new common lb config override_host_status and related implementation.
Risk Level: Mid.
Testing: N/A.
Docs Changes: N/A.
Release Notes: N/A.
Platform Specific Features: N/A.
@wbpcode
Signed-off-by: wbpcode <wbphub@live.com>
Mirrored from https://github.com/envoyproxy/envoy @ 1575185d14abc3bc508ce5a6ba45422393322551
data-plane-api(Azure Pipelines)