Adds a temporarily unused ExtAuthzLoggingInfo to
store stats in filter status. Also adds a field to ext_authz config
which will populate a filter_metadata field in the ExtAuthzLoggingInfo.
Signed-off-by: antoniovleonti <leonti@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ ff6ced12ef202a18f94186da898ea10329b618e9
<!--
!!!ATTENTION!!!
If you are fixing *any* crash or *any* potential security issue, *do
not*
open a pull request in this repo. Please report the issue via emailing
envoy-security@googlegroups.com where the issue will be triaged
appropriately.
Thank you in advance for helping to keep Envoy secure.
!!!ATTENTION!!!
For an explanation of how to fill out the fields, please see the
relevant section
in
[PULL_REQUESTS.md](https://github.com/envoyproxy/envoy/blob/main/PULL_REQUESTS.md)
-->
Commit Message:
Additional Description:
Risk Level:
Testing:
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional [API
Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md):]
---------
Signed-off-by: wbpcode <wbphub@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ 44ad1a7db101abe2d42752c21a24913060da8e06
Implementation for new trace resource detector.
This new Detector allows to use static config for resource attributes.
Risk Level: low
Testing: yes
Docs Changes: yes
Release Notes: yes
Platform Specific Features: No
---------
Signed-off-by: Juan Manuel Ollé <jolle@mulesoft.com>
Mirrored from https://github.com/envoyproxy/envoy @ f79b881883e862bc0f7dc7f09d3bc811fb0944f6
This reverts commit 6db316f25dc70b439c028beeaac31e6f33d3b2aa.
Signed-off-by: Ryan Northey <ryan@synca.io>
Mirrored from https://github.com/envoyproxy/envoy @ d84f707f8cc03d41a9f6bbffaf1b4f0105e7432b
Commit Message: conn pool: use hostnames of endpoints as SNI values
Additional Description: optional support for usage of upstream cluster
endpoints' hostnames as SNI values
Risk Level: Low
Testing: integration
Docs Changes: added information about new mechanism of SNI derivation
Release Notes:
b8e8a4537e/changelogs/current.yaml (L377)
Platform Specific Features: N/A
Fixes#15839
---------
Signed-off-by: Dmitriy Ilin <dmitry.m.ilyin@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ 6db316f25dc70b439c028beeaac31e6f33d3b2aa
Commit Message: tracer(datadog): improve remote configuration usability
Additional Description: Remote Configuration has been introduced in
https://github.com/envoyproxy/envoy/pull/33294.
It was enabled by default with the only way to configure the feature
being an environment variable. This commit disables the feature by
default and adds a new fields to enable and configure it from Envoy's
configuration.
Here's a snippet for enabling remote configuration with a 10s polling
interval:
```yaml
...
tracing:
provider:
name: envoy.tracers.datadog
typed_config:
"@type": type.googleapis.com/envoy.config.trace.v3.DatadogConfig
collector_cluster: datadog_agent
service_name: envoy-demo
remote_config:
enabled: true
polling_interval: "10s"
...
```
Changes:
- Add configuration options for remote configuration.
- Disable remote configuration by default.
Risk Level: Low.
Testing: unit test and manual testing.
Docs Changes: NA.
Release Notes: Updated.
Platform Specific Features: NA.
---------
Signed-off-by: Damien Mehala <damien.mehala@datadoghq.com>
Mirrored from https://github.com/envoyproxy/envoy @ bea314b7623ca29bd3f8b99756476177afd687eb
Commit Message: formatter: support for virtual host metadata
Additional Description:
This enables the access to the virtual host metadata introduced in
https://github.com/envoyproxy/envoy/pull/30175 from formatter.
Risk Level: low
Testing: : unit test
Docs Changes: done.
Release Notes:
Platform Specific Features:
[Optional Fixes #Issue] https://github.com/envoyproxy/envoy/issues/34900
---------
Signed-off-by: Takeshi Yoneda <t.y.mathetake@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ 1f79be9c21d4a343f68e8fba41f5a819300cb27f
Commit Message: Add UNIQUE_ID substitution string in the access log.
Additional Description: Envoy access log today doesn't have the concept
of unique log id which is guaranteed to be always present always when
emitting an access log record. This will ensure every access log record
when uses % UNIQUE_ID% in schema gets a UUID.
Risk Level: Low
Testing: Unit test has been added to ensure the UNIQUE_ID provides
unique value for every invocation of parse. Local testing has also been
performed to ensure the UNIQUE_ID is emitted from all filter levels
(example - listener filter access log, http connection manager access
log, tcp_proxy access log) for good and bad requests (which are
malformed and expected to fail at http parser level).
Docs Changes: Updated Access log documentation to provide the new
UNIQUE_ID support.
Release Notes: N/A
Platform Specific Features: N/A
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional [API
Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md):]
---------
Signed-off-by: Chaitra Reddy Vontela <cvontela@microsoft.com>
Co-authored-by: Chaitra Reddy Vontela <cvontela@microsoft.com>
Mirrored from https://github.com/envoyproxy/envoy @ 6cb0b30d6be9302025e09248a4327bac7a7e8cf1
Commit Message: [grpc-transcoder] Add option to pack unknown parameters
into HttpBody extension
Additional Description: We've been using this behavior for years, with
PR #15338 as a patch. Finally getting around to trying to upstream the
behavior to make it available for others, and to make it so I don't have
to keep repositioning the patch. Unlike #15338 I'm also adding a
configuration option so that no behavior change will occur without a
corresponding configuration change.
Risk Level: Very low, guarded by a new config field.
Testing: Added positive unit tests, added conditions to other tests for
the negative case.
Docs Changes: Autogen
Fixes#14710
---------
Signed-off-by: Raven Black <ravenblack@dropbox.com>
Mirrored from https://github.com/envoyproxy/envoy @ f837c480adad94e8d1a05ef648c26ffce7ecd286
---------
Signed-off-by: Anton Kaymakchi <tonysignal@gmail.com>
Signed-off-by: Anton Kaymakchi <anton.kaymakchi@transferwise.com>
Mirrored from https://github.com/envoyproxy/envoy @ 61f36812a422cecf1e056fe398e014c45b358708
Looks like it broke prechecks
Signed-off-by: Alyssa Wilk <alyssar@chromium.org>
Mirrored from https://github.com/envoyproxy/envoy @ 6145b7e9cc68061aaaa1c003d6f995e3e4499269
Commit Message: generic proxy: move generic proxy from contrib into
extensions
Additional Description:
The generic proxy is designed as a framework to empower the developers
to develop new L7 proxy for various L7 protocols.
It's be used for multiple different private protocols now in the
production env of our users. And recently, I complete the last part of
generic proxy: the filter chain support to the variable length stream.
And except the private protocols, we use the generic proxy implement the
kafka proxing and pulsar proxing and conditional traffic routing. (part
of these works are contributed back to the envoy).
After an offline discussion with other maintainers, I prepare to move
the generic proxy to the extensions now.
Risk Level: low.
Testing: n/a.
Docs Changes: n/a.
Release Notes: n/a.
Platform Specific Features: n/a.
---------
Signed-off-by: wbpcode <wbphub@live.com>
Signed-off-by: wbpcode <wbphub@gmail.com>
Co-authored-by: wbpcode <wbphub@live.com>
Mirrored from https://github.com/envoyproxy/envoy @ 0dbd4418f6a4b2c649b7c88cff4ec2bec872a9c6
Add a config option to allow ejecting one host regardless of max_ejection_percentage
Risk Level: low
Testing: added test
Docs Changes: updated proto comment
Release Notes: todo
Fixes#34666
Signed-off-by: Pawan Bishnoi <pawanbishnoi@outlook.com>
Signed-off-by: Pawan Kumar <pawanbishnoi@outlook.com>
Mirrored from https://github.com/envoyproxy/envoy @ 36531d9a1852bec3df8eb171600fd4b2479159cf
Commit Message: oauth: add disable_id_token_set_cookie option
Additional Description: When this is enabled, Envoy will stop setting
the IdToken cookie. It will still take into account HMACs with IdTokens
if they are available (to support existing auth sessions) but new
authentication will not use the IdToken in the HMAC.
Risk Level: log
Testing: included
Docs Changes: included
Release Notes: included
Fixes#33825
---------
Signed-off-by: Derek Argueta <darguetap@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ 7f34be9c44ad75813730c5a1ed46b52eee27e321
This allows for cases when the control plane does not know the correct configuration for the server preferred address, but the needed addresses are available in the context Envoy is running in.
Signed-off-by: Greg Greenway <ggreenway@apple.com>
Mirrored from https://github.com/envoyproxy/envoy @ dbe8cca3787cc0e15f4c3b8d9bed9ab17816e5e3
Setting forward as false in JWT Authn filter config removes the JWT from headers, but doesn't remove JWT from query params or cookies. This change adds functionality to remove query parameters based on forward config
Risk Level: Low
Testing: Unit Testing
Signed-off-by: Arul Thileeban Sagayam <arul.thilee@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ ee075b7c2a5f8449bfc17fbab94010696d3ed052
This PR provides gRPC client level control over Envoy generated headers. It currently controls x-envoy-internal and x-forwarded-for (can be expanded if needed)
If false, header will be added. But it can be overridden by setting setSendInternal or setSendXff to false in
Http::AsyncClient::StreamOptions, as per stream control.
If true, header will be removed and can not be overridden by per stream option.
This logic is designed in this way because:
Preserve backwards compatible behavior:
Both headers are still sent by default
If any existing users remove them with StreamOptions, headers are still removed
Still provide the per stream override control
Override here implicitly means setting to false as their default value in AsyncClient::StreamOptions is true.
Thus, per stream override is still available, just in one-way direction: disable on per stream basis
The only thing is that now user can not set StreamOptions to true if they are disabled in config. But it should be fine because:
For existing user, no one should set them to true in StreamOptions as they are already default to true.
For future user, per stream control can still be achieved as stated above.
Signed-off-by: Tianyu Xia <tyxia@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 9ce333ba1c46cde9e1a7af5bef99aceea1a80d77
In the current SAN matcher, only DNS, URI, IP, EMAIL types are supported. This change adds support to match against OtherName. A new config field oid is added which helps define the type of OtherName SAN envoy needs to match against.
Signed-off-by: Arul Thileeban Sagayam <arul.thilee@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ aef38c45a33e7c6a292f4e432a2b4940955ed96b
* add knob disable_dynamic_metadata_ingestion
Signed-off-by: antoniovleonti <leonti@google.com>
* move changelog entry to a more appropriate section
Signed-off-by: antoniovleonti <leonti@google.com>
* ignore dynamic metadata rather than failing entire request
Signed-off-by: antoniovleonti <leonti@google.com>
* fix proto documentation for field
Signed-off-by: antoniovleonti <leonti@google.com>
* use BoolValue to get 'positive' bool name
Signed-off-by: antoniovleonti <leonti@google.com>
* adjust wording of proto field comment
Signed-off-by: antoniovleonti <leonti@google.com>
* add check that dynamic metadata is not being set
Signed-off-by: antoniovleonti <leonti@google.com>
* fix doc link
Signed-off-by: antoniovleonti <leonti@google.com>
* fix doc link
Signed-off-by: antoniovleonti <leonti@google.com>
* fix doc link
Signed-off-by: antoniovleonti <leonti@google.com>
* reword doc comment
Signed-off-by: antoniovleonti <leonti@google.com>
---------
Signed-off-by: antoniovleonti <leonti@google.com>
Signed-off-by: Antonio V. Leonti <53806445+antoniovleonti@users.noreply.github.com>
Mirrored from https://github.com/envoyproxy/envoy @ 8646385431c3b91b94a3727766813615eeeaca10
This patch adds a metadata field to the [LocalityLbEndpoints](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/endpoint/v3/endpoint_components.proto#config-endpoint-v3-localitylbendpoints) configuration. The new field can be used to perform transport socket matching for all endpoints in a locality:
```
load_assignment:
cluster_name: example_cluster
endpoints:
- metadata: # <----- This is new.
filter_metadata:
envoy.transport_socket_match:
network.id: vpc-1
lb_endpoints:
- endpoint:
address:
socket_address:
address: 10.1.1.1
port_value: 11337
- endpoint:
address:
socket_address:
address: 10.1.1.2
port_value: 11337
```
Notice the ability to add metadata alongside the collection of endpoints. The transport socket matcher will still check the `envoy.transport_socket_match` metadata for an endpoint, but now if there is no match it will look at that field in its locality's metadata. This essentially allows one to set a transport socket match for groups of endpoints with a single metadata field, which can significantly improve scalability for deployments with many endpoints as shown in https://github.com/envoyproxy/envoy/issues/34530.
Signed-off-by: Tony Allen <txallen@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ f0201e54683875efeecf09df7328ad374be52d2c
JWT Authentication filter returns a 401 response with the details of failure back to client. It also sets the WWWAuthenticate header with "invalid token". Addition of this config would allow stripping these response details and return a 401 which would help with limiting unintended data leakage.
Risk Level: Low
Testing: Integration & Manual testing
Docs Changes: Done
Release Notes: Done
Fixes#34474
Signed-off-by: Arul Thileeban Sagayam <arul.thilee@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ 9df04137f02e1da97528bb739df462aaab983697
* api: Add total_{active,new,error}_connections to UpstreamLocalityStats
They are marked with `[#not-implemented-hide:]` and `work_in_progress`.
Implementation will be added later.
Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>
* Update api/envoy/config/endpoint/v3/load_report.proto
Co-authored-by: htuch <htuch@users.noreply.github.com>
Signed-off-by: AwesomePatrol <AwesomePatrol@users.noreply.github.com>
* Rename total_error_connections to total_fail_connections
Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>
* Add mention of metrics to docstring
Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>
* Mention Envoy when pointing out relation to metrics
Put metric names in `` (as in other parts of the file)
Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>
---------
Signed-off-by: Aleksander Mistewicz <amistewicz@google.com>
Signed-off-by: AwesomePatrol <AwesomePatrol@users.noreply.github.com>
Co-authored-by: htuch <htuch@users.noreply.github.com>
Mirrored from https://github.com/envoyproxy/envoy @ d2a20a02b6664c531e51cce04cc4283cb554ed4c
The extra dependency was introduced in 65273b2a9b. pgv.patch is only
used by envoy_api, so just moving the file avoids the dependency.
Signed-off-by: Eric Anderson <ejona@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 9fde867399cc7fcf97815995f8466f62172b26f6
Seems until now, we still have no a common key/value API that be applied to string-map-like structures. This PR add one.
Then we can use this API for query mutation, cookie mutation. And this could also be used by non-HTTP headers (like dubbo attachment) or any string-map-like structures.
Risk Level: low. API only.
Testing: n/a.
Signed-off-by: wbpcode <wbphub@live.com>
Mirrored from https://github.com/envoyproxy/envoy @ 3a0c2a4ffb5e199eed0be1738ff8e6590dcf94c6
Commit Message:
proxy_protocol_filter: Add field stat_prefix to the filter configuration
Additional Description:
This field allows for differentiating statistics when multiple proxy protocol listener filters are configured.
This PR is a follow-up from previous conversation: #32861 (comment)
Risk Level: Low
All client-facing behavior changes are guarded by new filter config field.
Testing:
Stats unit tests
Proxy protocol listener filter integration tests
Docs Changes:
Done
Release Notes:
Done
Platform Specific Features:
None
Signed-off-by: Teju Nareddy <tnareddy@confluent.io>
Mirrored from https://github.com/envoyproxy/envoy @ 69d4ef8d04678710ec1633e1e7effbda6623cc8d
Allows to preserve the exsting authorization header in oauth2 filter
Signed-off-by: Dennis Kniep <kniepdennis@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ 7fcc47414c9ebc3915616730612b0608031ea8e9
Commit Message: Add the ability to bypass overload manager for listeners
Additional Description: This flag can be used to disable overload manager on specific listeners where, for instance, we don't want to stop accepting requests. In my company, we implemented a CPU Utilization resource monitor that helps us drop requests when we hit a certain utilization percentage, but there are certain listeners that receive administrative traffic that we don't want overload manager to touch. Another use case is, we want to only throttle ingress traffic but not egress traffic going via Envoy. Another contributor authored #29781, but it has been marked as stale.
Risk Level: Low
Testing: Unit tests & Integration tests added
Docs Changes: No
Release Notes: Add bypass_overload_manager flag to Listener in order to prevent overload manager from taking actions on the traffic going through the said listener.
Platform Specific Features:
Signed-off-by: Fernando Cainelli <fernando.cainelli-external@getyourguide.com>
Signed-off-by: Can Cecen <ccecen@netflix.com>
Mirrored from https://github.com/envoyproxy/envoy @ ea982dc8dd1afc2d4cacbcbb484cf00bc48dab93
resource_api_version has also been removed from all tests and
examples, as it isn't used for anything.
Signed-off-by: Greg Greenway <ggreenway@apple.com>
Mirrored from https://github.com/envoyproxy/envoy @ 505a8603f7997ef7a8ddd81fcba382caa2be5867
update-envoy[bot]