Updated `grpc-httpjson-transcoding` repo to have this [change](grpc-ecosystem/grpc-httpjson-transcoding#70).
Additional Description:
grpc_json_transcoder: to support reject request if binding and body value are conflict
Risk Level: Low
Testing: unit test
Docs Changes: N/A
Release Notes: Add an option in grpc_json_transcoder to support reject request if binding and body value are conflict.
Platform Specific Features: N/A
Signed-off-by: yangshuo <yangshuo@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ f40d62f6a2e11486f397c688ffc6c01a85738582
Part of #20389. Most of the formatters used in header manipulation are also present in substitution access log formatters. However, UPSTREAM_METADATA was not present in access log formatters.
Also, as noted in #17457 all xxxx_METADATA will be eventually replaced my METADATA(xxxx,...) so this PR also extends METADATA formatter.
api changes are trivial and limited to comments.
Risk Level: Low
Testing: Added unit tests.
Docs Changes: Yes.
Release Notes: Yes
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>
Mirrored from https://github.com/envoyproxy/envoy @ 380a328f7e32e4d18d31cba82bac7143904e0536
Implements a special transport socket for transferring state (metadata and filter state) over the internal connection.
This transport socket captures a subset of endpoint metadata, cluster metadata, and stream filter state in the user space socket. When an internal listener accepts a user space socket connection, it immediately merges this passthrough state into the connection stream info. Because the state can be transferred from HTTP stream to TCP stream, this transport socket also participates in the hashing decisions in the HTTP connection pools.
Commit Message: Add passhtrough state over internal connection.
Risk Level: low, new extension
Testing: WIP
Docs Changes: yes
Release Notes: yes
Platform Specific Features:
Fixes: #19274
Signed-off-by: Kuat Yessenov <kuat@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 637a92a56e2739b5f78441c337171968f18b46ee
Add support for injecting regex engine with its options on startup in a bootstrap option. These are some API, runtime and implementation changes.
* google_re2 in safe_regex will be deprecated and no longer be required. Regex::parseRegex will choose the registered regex engine to parse expressions into matchers.
* A new bootstrap option default_regex_engine will be introduced for regex engine selection.
* For compatibility, GoogleRE2 will be chosen as default regex engine if no regex engine is designated.
Signed-off-by: Xie Zhihao <zhihao.xie@intel.com>
Mirrored from https://github.com/envoyproxy/envoy @ 0a92cc86e7f8b88d5af0eb2e27b5c7ef64719e56
Signed-off-by: Xie Zhihao zhihao.xie@intel.com
Commit Message: rbac: add unified matcher for RBAC filters
Additional Description:
The patch add the matching API support for both RBAC network filter and HTTP filter. Users can configure rules and shadow rules in either policies or the matching API manner. There are some incompatibilities, TODOs and behavior changes compared to the policies way.
RBAC matchers are not compatible with the matching API.
URL path and CEL are not supported in the matching API. These matchers may come as custom matcher.
Metadata is not supported in the matching API. These matchers may come as inputs.
Connections and requests with no matcher matched will always be denied.
Risk Level: Medium
Testing: Unit and integration
Docs Changes: API and configuration
Release Notes: WIP
Platform Specific Features: N/A
Fixes#20623
Mirrored from https://github.com/envoyproxy/envoy @ 42cb84456d53d053eb1ae94680d07a74f4545a48
API for Unified Header Validators
Signed-off-by: Yan Avlasov <yavlasov@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ e569ce06101932cfe3ccb710c3c60b92dd09464b
Based off #20596, this preserves the current behavior by default.
Signed-off-by: Raul Gutierrez Segales <rgs@pinterest.com>
Co-authored-by: fishy
Mirrored from https://github.com/envoyproxy/envoy @ 53867ab5cc97c945f8c7f6a771d28443b1bcec43
udp: Add a udp_packet_packet_writer_config option to UdpListenerConfig.
Fixes#21200
Risk Level: Low
Testing: Existing and additional tests
Docs Changes: None
Release Notes: Added
Platform Specific Features: N/A
Signed-off-by: Ryan Hamilton <rch@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 3a7b26aa3909488a8561a232b82845b8b4cd38bb
Commit Message: make HTTP/3 upstream sends 0-RTT (early data) requests if it has cached 0-RTT credentials. Add a config knob in RouteAction to specify which request can be sent over early data, which by default are HTTP safe methods.
Risk Level: high, changes to conn pool behavior though should only take effect for h3 pool
Testing: added h3 upstream integration tests.
Docs Changes: N/A
Release Notes: changes to docs/root/version_history/current.rst
Platform Specific Features: N/A
Runtime guard: envoy.reloadable_features.http3_sends_early_data
Fixes#18715, #19542
Signed-off-by: Dan Zhang <danzh@google.com>
Signed-off-by: Dan Zhang <danzh@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 8ce13d75a982ddd347db5a333a4bb080922f7514
Note: support for logging headers (via %REQ()%) will happen in a follow-up.
Risk Level: medium
Testing: unit tests
Doc Changes: included
Release Notes: updated
Fixes#17898.
Signed-off-by: Raul Gutierrez Segales <rgs@pinterest.com>
Mirrored from https://github.com/envoyproxy/envoy @ 01a0ff52ed3a1e55b14c3bbff4daede6c61fd5fb
Allows users to opt-in to functionality to auto-detect proxy protocol if present, and skip the filter if it's not present.
Signed-off-by: Kevin Dorosh <kevin.dorosh@solo.io>
Mirrored from https://github.com/envoyproxy/envoy @ 18c59eaf1b78c5b6bbe4d6ad96009ec3ecd895e1
This adds an odcds_config field to the extension's config, and also allows the extension to be configured per-route. As it stands, it currently works only with routes using cluster-header config.
Risk Level: Medium, extending one extension in an opt-in way.
Testing: Added unit tests and integration tests.
Fixes#2500
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Mirrored from https://github.com/envoyproxy/envoy @ a41b254a4e8f1faf40033c50c7122aa654186f63
By default the router closes downstream connection if the current request is not routable or the upstream connection is broken. This causes oneway (or async) requests pending on wire or in kernel buffers will be also dropped even if they are routable and their target cluster is perfectly healthy.
Risk Level: low
Testing: unit test
Docs Changes: Comment added to the new API field.
Fixes#12836
Signed-off-by: Tamas Kovacs <tamas.2.kovacs@nokia-sbell.com>
Mirrored from https://github.com/envoyproxy/envoy @ 65a4fc4977c4e50e722461a1d68278d404610342
This is a continuation of #20577.
Additional Description:
Risk Level: low
Testing: unit test
Signed-off-by: kuochunghsu <kuochunghsu@pinterest.com>
Mirrored from https://github.com/envoyproxy/envoy @ 0be448e6d92dff8d609142a8e5492ebf03884779
Allow configs with both typed and non typed san matchers specified to allow config servers to use the same config for Envoys across multiple versions. The match_subject_alt_names field is ignored if match_typed_subject_alt_names is set.
Signed-off-by: Pradeep Rao <pcrao@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ ef08b1c3d0cf9c2af84d32529a11b3e2056e9dcb
If set, the resolver will avoid the system's heuristics to only return
IPv4 or IPv6 addresses that it considers to be "routable", instead
returning all possible IPv4 or IPv6 addresses. This setting is
ignored if the DNS lookup family is set to v4-only or v6-only.
This may be a useful setting to specify if the addresses considered
unroutable by the system's heuristics may in practice be routable.
Signed-off-by: JP Simard <jp@jpsim.com>
Mirrored from https://github.com/envoyproxy/envoy @ 60a13f30a4e425c907607fab96efee0ed2afcf22
This adds the ability to change the GrpcService used by the ext_proc filter on a per-route basis.
Risk Level: Low. Not triggered unless configured.
Testing: New unit and integration tests added.
Docs Changes: Addition of new config field.
Signed-off-by: Michael Warres <mpw@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 0e8899c90213b39d8f4a1a083d4fd31e9c2fe8c1
Use type_url to look up extensions. This prevents the undesirable practice of putting invalid protobufs to avoid a type lookup or duplicating the type URL.
Risk Level: medium, affects extensions with duplicated type URLs or no configuration
Testing: yes
Docs Changes: yes, this has been the recommendation for awhile.
Release Notes: yes
Runtime Guard: envoy.reloadable_features.no_extension_lookup_by_name
Signed-off-by: Kuat Yessenov <kuat@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 8cb6862fe6099cd8583a64ff037ecdeaf0e939fa
Add an extra async cluster look up. The continuation of the cluster look up is establishUpstreamConnection().
To establishConnection() is also the callback of upstream connection failure.
Additional Description:
Risk Level: LOW if odcds is disabled, the code path remains the same.
Testing: Added integration tests and existing unit test is untouched.
Docs Changes: n/a
Release Notes: inline
Signed-off-by: Yuchen Dai <silentdai@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ 0a587f23b21ab34b28d9c53428af259b3f7b0970
data-plane-api(Azure Pipelines)