Introduce a new stateful session extension. This is a change after #17848#17290.
In #17290, we added a new cross-priority host map for fast host searching. In #17848, we extend `LoadBalancerContext` interface to provide an override host and to select the upstream host by the override host.
Finally, in this change, we expand a new API to allow users to extract the state of the session from the request and change the result of load balancing by setting the override host value.
Related doc: https://docs.google.com/document/d/1IU4b76AgOXijNa4sew1gfBfSiOMbZNiEt5Dhis8QpYg/edit?usp=sharing.
Risk Level: Medium
Testing: Added
Docs Changes: Added
Release Notes: Added
Platform-Specific Features: N/A.
Signed-off-by: wbpcode <wbphub@live.com>
Mirrored from https://github.com/envoyproxy/envoy @ fb2aad0303bbbcb0daabf6940c6ad97252995b98
This is an implementation based on the discussion in #19198.
When application/x-protobuf is used the filter will prepend the payload with the gRPC header, as defined by the wire format. Before returning the response the frame is also trimmed. This functionality is behind a configuration setting.
Risk Level: Medium
Testing: Unit tests
Docs Changes: Added
Fixes#19198
Signed-off-by: Stefan Puhlmann <stefanp@spotify.com>
Mirrored from https://github.com/envoyproxy/envoy @ 8feaee6e5801bdbe0837158e5fc499a723b1a108
This allows matching the more lenient behavior of other client-side
networking libraries such as OkHttp or URLSession, especially in cases
where the remote server is not under the client developer's control.
Risk Level: Low, defaults are unaffected, change is opt-in.
Testing: Added unit tests for existing no-transform behavior (there was none) and a new test validating the new configuration flag.
Docs Changes: Updated.
Release Notes: Added.
Signed-off-by: JP Simard <jp@jpsim.com>
Mirrored from https://github.com/envoyproxy/envoy @ 2afb9573ab1915ed57ac8d42203286b224ce95ae
* Fix whitespace typo in transcoder documentation.
The documentation for `convert_grpc_status` had two leading spaces in the text
following a code block, causing the text to be rendered as part of the code block.
* Remove whitespace from transcoder.proto.
Signed-off-by: Pras Velagapudi <psigen@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ e9f36d2c49a3c9176340303b44ef593bd0b78c35
Commit Message: c-ares resolver: add option to use name servers as fallback.
Risk Level: low - opt in behavior
Testing: existing and additional tests
Docs Changes: added
Release Notes: added
Signed-off-by: Jose Nino <jnino@lyft.com>
Mirrored from https://github.com/envoyproxy/envoy @ b1219ef0decc22040d45fe8bf2fa86bd16ea4e3c
Mainly update the grpcJsonTranscoder to include the latest path matcher filter change for always checking custom verb no matter if it is registered or not.
Risk Level: Low
Testing: added the unit test
Docs Changes: None
Release Notes: Yes
Signed-off-by: Xuyang Tao <taoxuy@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ c68cf0dddfcea6c9ccf6346ff47b518837b0ca0d
This was caused by a merge race
Signed-off-by: Keith Smiley <keithbsmiley@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ 70a5f295da789610b9d078015f43e39c6a76d4b6
This change introduces a MetaProtocol proxy that provides a framework for layer-7 protocols. The common capabilities, including routing, tracing, metrics, logging, etc., will be built into the MetaProtocol proxy.
Signed-off-by: zhaohuabing <zhaohuabing@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ de51441bfe1b6b5eeab8981037d66cde9ac5b0d7
This PR establishes the ability to filter access log production via CEL expressions over the set of Envoy attributes. This can simply the creation of Envoy access log filters, allowing complex tailoring.
Risk Level: low
Testing: unit
Docs Changes: included
Release Notes: updated
Signed-off-by: Douglas Reid <douglas-reid@users.noreply.github.com>
Mirrored from https://github.com/envoyproxy/envoy @ 77ca6cc0d9aaf0892aec3e2025fe2ad7cf0c39ff
Signed-off-by: Max Kuznetsov <mkuznetsov@digitalocean.com>
Mirrored from https://github.com/envoyproxy/envoy @ 76a70b40f57bd9a75b50d4783d28dec0e0aa29ae
Add a retry mechanism to the grpc access logger. This retry mechanism currently only supports a simple retry count.
Also, at the moment, retries are only fired when the gRPC stream fails to be established, and nothing happens if the stream is successfully established once and a reset is issued.
Risk Level: Low
Testing: Unit
Signed-off-by: Shikugawa <rei@tetrate.io>
Mirrored from https://github.com/envoyproxy/envoy @ 3a5f7958afb161efd62dada8e6bbb77f96c4dd04
Commit Message: Allow cert validation by only leaf trusted CAs CRL
Additional Description: Close#18268. In the previous implementation, we don't have availability to validate certs when all trusted CAs don't have their own CRLs if any trusted CAs have that. This feature allows validating even if all trusted CAs don't have CRLs.
Risk Level: Low
Testing: Unit
Docs Changes: Required
Release Notes: Required
Signed-off-by: Shikugawa <rei@tetrate.io>
Mirrored from https://github.com/envoyproxy/envoy @ 56e8c45b1b340c4a4f8f02ec2488354c31806d59
- Add response trailers for the bandwidth limit filter delays.
- Add new metric request_enforced and response_enforced.
- Change the following metrics type from Gauge to Counter (request_incoming_size, response_incoming_size, request_allowed_size, response_allowed_size) to better calculate the network bytes per second.
This is useful when downstream want to understand how much delays that is caused by bandwidth limit filter.
Risk Level: Low
Testing: UT added.
Docs Changes: Updated.
Release Notes: Added.
Signed-off-by: gayang <gayang@microsoft.com>
Mirrored from https://github.com/envoyproxy/envoy @ 8b8ece8adb8c9282cbd9405151993fa1bc5cebee
Docs Changes: Removes an extra word
Signed-off-by: Peter Jausovec <peter.jausovec@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ dbb1f50ef340e565c5a495a17aac0afff5d9a4f9
This should reduce the binary size, which is particularly important for Envoy Mobile. Looking at a
local opt build with debug symbols, I'm seeing a drop from ~400MB to ~380MB, so maybe 5% saving. @Reflejo indicates that optimized Envoy Mobile without symbols is observing ~20% improvement.
Related to #10943
Risk level: Low
Testing: bazel query deps to confirm no more v2 API deps.
Signed-off-by: Harvey Tuch <htuch@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 53fca618e47702f6c8dbc323db9bd39d15725457
- Fix the session_timeout formatting so that it links to the RFC
reference correctly.
- Make some minor grammar improvements.
- Quote the session_timeout field name
Signed-off-by: James Peach <jpeach@apache.org>
Mirrored from https://github.com/envoyproxy/envoy @ bd1ac13275246c2a9a865912682ed9904ed7a78a
This adds a new transport socket wrapper for collecting OS-level TCP stats and publishing them as envoy metrics, in either the cluster or listener stats namespace (depending on upstream or downstream use). This allows attributing the TCP stats to specific listeners and clusters.
Signed-off-by: Greg Greenway <ggreenway@apple.com>
Mirrored from https://github.com/envoyproxy/envoy @ b959a46661ec87bba8268a1750506695125f2b06
Widen the Upstream::LoadBalancer interface to add methods which allow
a load balancer to optionally observe connection lifetime events and to
select a specific connection based on those events.
Implement this behavior in the DFP LoadBalancer to reuse HTTP/2 and HTTP/3
connections when the hash key, IP address, and certificate all match, conditional
on a new allow_coalesced_connections field in the DFP config.
Risk Level: Low
Testing: Unit
Signed-off-by: Ryan Hamilton <rch@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ b4047464f7e1c75d578f7b98db4d3d669dce9bd0
This patch adds cookie_names to credentials config to allow overriding
the default cookie names: `BearerToken`, `OauthHMAC`, and
`OauthExpires`.
Signed-off-by: Dhi Aurrahman <dio@rockybars.com>
Mirrored from https://github.com/envoyproxy/envoy @ 7323ddeb5011df73f5f42115cb644769d9dcab96
Changes the DNS cache to respect the advertised TTL, modulo a floor of 5s.
That part of the change is runtime guard. The part which is not, is that the backoff is done on a per-host basis not a global basis, so if one endpoint fails to resolve, it won't result in others backing off, and if one succeeds it won't result in changing backoff for failed hosts.
Risk Level: Medium
Testing: new unit tests
Docs Changes: inline
Release Notes: inline
Optional Runtime guard: envoy.reloadable_features.use_dns_ttl
Signed-off-by: Alyssa Wilk <alyssar@chromium.org>
Mirrored from https://github.com/envoyproxy/envoy @ bebd3e2c4700fb13132a34fcfa8b82b439249f3b
Support an inline RouteConfiguration in ScopedRouteConfiguration.
This change enables fully inlined scoped route configuration by
allowing users to specify an inline `RouteConfiguration` in the scope's
config, as opposed to requiring a `route_configuration_name` to use for
an RDS subscription.
Signed-off-by: Andres Guedez <aguedez@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ cbc05d480cc24fc96bbbbd476cc31b25402d6777
Framed was the only transport that supported payload passthrough. However the payload
of Header transport is the same as Framed. Therefore its possible to also use payload
passthrough with Header to Header, Framed to Header and Header to Framed. Therefore
allow those extra three combinations and add integration tests. Note that in future if Header
transforms become supported then passthroughData will need to undo any transforms.
New metrics request_passthrough and response_passthrough are added to show when payload
passthrough occurs. Note that previously response_success was always incremented when
performing payload passthrough, and that is corrected to only occur when parsing the
payload.
This will enable payload passthrough for combinations of downstream/upstream transports that did not
previously perform passthrough. If a private filter does not implement passthroughEnabled or passthroughData
correctly, has enabled payload passthrough and is using Header to Header, Framed to Header or Header to Framed
then the filter may have issues.
Risk Level: Medium
Testing: Extended existing integration tests and verified on local deployment.
Docs Changes: Updated ThriftProxy proto docs.
Release Notes: Minor behavior change.
Platform Specific Features: N/A
Signed-off-by: James Fish <jfish@pinterest.com>
Mirrored from https://github.com/envoyproxy/envoy @ 0f31648808783b1057c78ff0c90721b81d32e19c
To fix: #13965
grpc_json envoy filter adds a new field 'query_param_unescape_plus` to enable the support of converting "+" to space in query parameters.
The actual unescape code is implemented in grpc-httpjson-transcoding.
Risk Level: None
Testing: integration tests
Docs Changes: None
Release Notes: Yes
Signed-off-by: Wayne Zhang <qiwzhang@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 1ba355b5e9f00cda595d5b52e3390d473fa5ecce
Based on the dicsussion in the issue https://github.com/envoyproxy/envoy/issues/17410, this PR adds
implementation for ability to add rbac policy to filter upstream ip addresses for dynamically
resolved domains (by dynamic proxy filter).
Signed-off-by: Jojy George Varghese <jojy_varghese@apple.com>
Mirrored from https://github.com/envoyproxy/envoy @ 53f95570a7e9d7fa5414a4bc145852524fa017ed
This is a first step towards https://github.com/envoyproxy/envoy/issues/17920
A single proto (kafka mesh) has been swapped from using the udpa
file_status annotation to the xds file_status annotation to avoid a
large amount of churn and a forthcoming migration of many alpha/wip
protos to non alpha/wip. The rest will be audited and swapped in
future PRs. This single one was done to make sure the doc machinary
works properly.
Signed-off-by: Matt Klein <mklein@lyft.com>
Mirrored from https://github.com/envoyproxy/envoy @ f0f17a3caa75106a9e28b99edc27dd09c1bed488
This allows for dynamic metadata when using an HTTP authorization service. Currently, it is only possible to set dynamic metadata using a gRPC authorization service.
Risk Level: low, new opt-in feature in an extension
Testing: unit tests
Docs Changes: proto definitions documented
Release Notes: ext_authz: added :ref:dynamic_metadata_from_headers <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.AuthorizationResponse.dynamic_metadata_from_headers> to support emitting dynamic metadata from headers returned by an external authorization service via HTTP.
Signed-off-by: John Esmet <john.esmet@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ 31f48ee7a3c32ed383b46c8940263af9dc9bdcd4
upstream: Make the Alt-Svc cache configuration required if HTTP/3 is enabled with AutoHttpConfig.
Risk Level: Low
Testing: Unit tests
Docs Changes: N/A
Release Notes: N/A
Platform Specific Features: N/A
Signed-off-by: Ryan Hamilton <rch@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 19102ffc814204d2d2f98747afa3af3a84a4024c
This patch adds header_to_metadata field to JwtProvider config to allow
setting the extracted header of a successfully verified JWT to dynamic
metadata.
Signed-off-by: Dhi Aurrahman <dio@rockybars.com>
Mirrored from https://github.com/envoyproxy/envoy @ 25622ce26532ad42d93a383d48b6c86d9e28d3d2
Removal of params or cookies after authentication is not implemented as of today.
authenticator.cc calls the removeJwt(...) if forward is set to false (default)
and this leads to an assertion failures caused by NOT_IMPLEMENTED_GCOVR_EXCL_LINE.
Changed removeJwt(...) for JwtCookieLocation to be empty, added test coverage
and updated proto doc to call-out this caveat.
Signed-off-by: Shubham Patil <theshubhamp@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ 5591dbc0f6d663641241f1919dc6135668c1da75
http: Unhide the AlternateProtocolCache configuration
and move some docs from http3_upstream.md to connection_pooling.rst
Risk Level: N/A - Docs only
Testing: N/A - Docs only
Docs Changes: Unhide the AlternateProtocolCache configuration and move some docs from http3_upstream.md to connection_pooling.rst
Release Notes: Added
Platform Specific Features: N/A
Signed-off-by: Ryan Hamilton <rch@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ d7fdbbc567b5e3175240c1fa9827255275c53c36
Today "disabled" and the processing mode are the two things supported
because that is what is currently supported in ext_proc.
Signed-off-by: Gregory Brail <gregbrail@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 01ea37b280d980c25bb9e2c8069d62e4aef37961
Field 2 in the `DnsFilterConfig` message was released in Envoy 1.18,
and repurposed in Envoy 1.19. Renumber the field, while leaving a
compatibility field so that control planes can gracefully migrate to a
subsequent 1.19 release.
This fixes#17921.
Signed-off-by: James Peach <jpeach@apache.org>
Mirrored from https://github.com/envoyproxy/envoy @ ff9704e502184c4415d38351795f0d5d11627fcd
Support extraction of JWT from Cookies in JWT Extension
Added "from_cookies" config directive to jwt_authn that enables JWT extraction from request cookies.
Risk Level: low
Testing: unit tests
Docs Changes: Updated `docs/root/configuration/http/http_filters/jwt_authn_filter.rst`
Release Notes: Updated `docs/root/version_history/current.rst`
Platform Specific Features: None
Fixes#17424
Signed-off-by: Shubham Patil <theshubhamp@gmail.com>
Mirrored from https://github.com/envoyproxy/envoy @ 143083c3c3e78c9252b644648ef5be5cf9158419
data-plane-api(Azure Pipelines)