Skip to content

Commit 7feaa29

Browse files
KSmigielskiKSmigielski
committed
Merge branch 'master' into remove_xds_support
# Conflicts: # CHANGELOG.md # envoy-control-core/src/main/resources/lua/ingress_rbac_logging.lua # envoy-control-tests/src/main/kotlin/pl/allegro/tech/servicemesh/envoycontrol/routing/ServiceTagsAndCanaryTest.kt
2 parents 6a9f16d + 072d286 commit 7feaa29

File tree

19 files changed

+279
-46
lines changed

19 files changed

+279
-46
lines changed

‎.github/workflows/ci-min-envoy-version.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
name: CI - min envoy version
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
ci:
8+
uses: ./.github/workflows/ci.yaml
9+
with:
10+
envoyVersion: min
11+
secrets: inherit

‎.github/workflows/ci.yaml‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,22 @@ name: CI
22

33
on:
44
workflow_dispatch:
5+
inputs:
6+
envoyVersion:
7+
type: string
8+
description: "envoy version to run tests on, e.g. 'v1.24.0'. Special values: 'max' - max supported version, 'min' - min supported version"
9+
default: max
510

611
push:
712
paths-ignore:
813
- 'readme.md'
914

15+
workflow_call:
16+
inputs:
17+
envoyVersion:
18+
type: string
19+
default: max
20+
1021
jobs:
1122
ci:
1223
name: CI
@@ -37,8 +48,8 @@ jobs:
3748
restore-keys: |
3849
${{ runner.os }}-gradle-
3950
40-
- name: Test with Gradle
41-
run: ./gradlew clean check
51+
- name: Test with Gradle (envoyVersion=${{ inputs.envoyVersion }})
52+
run: ./gradlew clean check -PenvoyVersion=${{ inputs.envoyVersion }}
4253

4354
- name: Junit report
4455
uses: mikepenz/action-junit-report@v2

‎CHANGELOG.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,20 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
88
### Changed
99
- Remove xds support
1010

11+
## [0.19.31]
12+
13+
### Changed
14+
- move min & max envoy versions inside artifact to be accessible for dependant projects
15+
- add x-service-tag-preference header to upstream request
16+
17+
## [0.19.30]
18+
19+
### Changed
20+
- add possibility to log custom header in RBAC
21+
- add token information to RBAC logs
22+
- specify min and max supported envoy version
23+
- add option to run tests on specific envoy version, including min and max supported version
24+
1125
## [0.19.29]
1226

1327
### Changed

‎docs/configuration.md‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -137,16 +137,17 @@ Property
137137
**envoy-control.envoy.snapshot.load-balancing.use-keys-subset-fallback-policy** | KEYS_SUBSET fallback policy is used by default when canary and service-tags are enabled. It is not supported in Envoy <= 1.12.x. Set to false for compatibility with Envoy 1.12.x | true
138138

139139
## Routing
140-
Property | Description | Default value
141-
------------------------------------------------------------------------------------------- |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ---------
142-
**envoy-control.envoy.snapshot.routing.service-tags.enabled** | If set to true, service tags routing will be enabled | false
143-
**envoy-control.envoy.snapshot.routing.service-tags.metadata-key** | What key to use in endpoint metadata to store its service tags | tag
144-
**envoy-control.envoy.snapshot.routing.service-tags.header** | What header to use in service tag rules | x-service-tag
140+
Property | Description | Default value
141+
------------------------------------------------------------------------------------------- |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| ---------
142+
**envoy-control.envoy.snapshot.routing.service-tags.enabled** | If set to true, service tags routing will be enabled | false
143+
**envoy-control.envoy.snapshot.routing.service-tags.metadata-key** | What key to use in endpoint metadata to store its service tags | tag
144+
**envoy-control.envoy.snapshot.routing.service-tags.header** | What header to use in service tag rules | x-service-tag
145+
**envoy-control.envoy.snapshot.routing.service-tags.preference-header** | What header to use for service tag preference list. Used for sending info to upstream if 'auto service tags' is in force. In the future also read from downstream request. | x-service-tag-preference
145146
**envoy-control.envoy.snapshot.routing.service-tags.routing-excluded-tags** | List of tags predicates that cannot be used for routing. This supports an exact matching (just "string" - EXACT matching) prefixes (PREFIX matching) and regexes (REGEX matching) | empty list
146-
**envoy-control.envoy.snapshot.routing.service-tags.allowed-tags-combinations** | List of rules, which tags can be conbined together and requested together. Details below | empty list
147-
**(...).allowed-tags-combinations[].service-name** | The rule will apply only for this service | ""
148-
**(...).allowed-tags-combinations[].tags** | List of tag patterns, that can be combined and requested together | empty list
149-
**envoy-control.envoy.snapshot.routing.service-tags.auto-service-tag-enabled** | Enable auto service tag feature. (`enabled` needs also be true) | false
147+
**envoy-control.envoy.snapshot.routing.service-tags.allowed-tags-combinations** | List of rules, which tags can be conbined together and requested together. Details below | empty list
148+
**(...).allowed-tags-combinations[].service-name** | The rule will apply only for this service | ""
149+
**(...).allowed-tags-combinations[].tags** | List of tag patterns, that can be combined and requested together | empty list
150+
**envoy-control.envoy.snapshot.routing.service-tags.auto-service-tag-enabled** | Enable auto service tag feature. (`enabled` needs also be true) | false
150151

151152
## Outlier detection
152153
Property | Description | Default value

‎envoy-control-core/src/main/kotlin/pl/allegro/tech/servicemesh/envoycontrol/snapshot/SnapshotProperties.kt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,7 @@ class IncomingPermissionsProperties {
9696
var clientsAllowedToAllEndpoints = mutableListOf<String>()
9797
var clientsLists = ClientsListsProperties()
9898
var overlappingPathsFix = false // TODO: to be removed when proved it did not mess up anything
99+
var headersToLogInRbac: List<String> = emptyList()
99100
}
100101

101102
class SelectorMatching {
@@ -235,9 +236,12 @@ class ServiceTagsProperties {
235236
var enabled = false
236237
var metadataKey = "tag"
237238
var header = "x-service-tag"
239+
var preferenceHeader = "x-service-tag-preference"
238240
var routingExcludedTags: MutableList<StringMatcher> = mutableListOf()
239241
var allowedTagsCombinations: MutableList<ServiceTagsCombinationsProperties> = mutableListOf()
240242
var autoServiceTagEnabled = false
243+
244+
fun isAutoServiceTagEffectivelyEnabled() = enabled && autoServiceTagEnabled
241245
}
242246

243247
class StringMatcher {

‎envoy-control-core/src/main/kotlin/pl/allegro/tech/servicemesh/envoycontrol/snapshot/resource/endpoints/EnvoyEndpointsFactory.kt‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ class EnvoyEndpointsFactory(
5252
clusterLoadAssignment: ClusterLoadAssignment,
5353
routingPolicy: RoutingPolicy
5454
): ClusterLoadAssignment {
55-
if (!routingPolicy.autoServiceTag || !isAutoServiceTagEnabled()) {
55+
if (!routingPolicy.autoServiceTag || !properties.routing.serviceTags.isAutoServiceTagEffectivelyEnabled()) {
5656
return clusterLoadAssignment
5757
}
5858

@@ -67,8 +67,6 @@ class EnvoyEndpointsFactory(
6767
}
6868
}
6969

70-
private fun isAutoServiceTagEnabled() = properties.routing.serviceTags.run { enabled && autoServiceTagEnabled }
71-
7270
private fun filterEndpoints(loadAssignment: ClusterLoadAssignment, tag: String): ClusterLoadAssignment? {
7371
var allEndpointMatched = true
7472
val filteredEndpoints = loadAssignment.endpointsList.mapNotNull { localityLbEndpoint ->

‎envoy-control-core/src/main/kotlin/pl/allegro/tech/servicemesh/envoycontrol/snapshot/resource/listeners/filters/LuaFilterFactory.kt‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,9 @@ class LuaFilterFactory(private val incomingPermissionsProperties: IncomingPermis
6464
),
6565
"service_name" to StringPropertyLua(group.serviceName),
6666
"discovery_service_name" to StringPropertyLua(group.discoveryServiceName ?: ""),
67-
67+
"rbac_headers_to_log" to ListPropertyLua(
68+
incomingPermissionsProperties.headersToLogInRbac.map(::StringPropertyLua)
69+
),
6870
) + customLuaMetadata
6971
return Metadata.newBuilder()
7072
.putFilterMetadata("envoy.filters.http.lua", metadata.toValue().structValue)

‎envoy-control-core/src/main/kotlin/pl/allegro/tech/servicemesh/envoycontrol/snapshot/resource/routes/EnvoyEgressRoutesFactory.kt‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,24 @@ class EnvoyEgressRoutesFactory(
139139
.build()
140140
)
141141
}
142+
143+
if (properties.routing.serviceTags.isAutoServiceTagEffectivelyEnabled()) {
144+
val routingPolicy = routeSpecification.settings.routingPolicy
145+
if (routingPolicy.autoServiceTag) {
146+
val tagsPreferenceJoined = routingPolicy.serviceTagPreference.joinToString("|")
147+
virtualHost.addRequestHeadersToAdd(
148+
HeaderValueOption.newBuilder()
149+
.setHeader(
150+
HeaderValue.newBuilder()
151+
.setKey(properties.routing.serviceTags.preferenceHeader)
152+
.setValue(tagsPreferenceJoined)
153+
)
154+
.setAppendAction(HeaderValueOption.HeaderAppendAction.OVERWRITE_IF_EXISTS_OR_ADD)
155+
.setKeepEmptyValue(false)
156+
)
157+
}
158+
}
159+
142160
return virtualHost.build()
143161
}
144162

‎envoy-control-core/src/main/resources/lua/ingress_rbac_logging.lua‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,7 @@ function log_request(handle, lua_metadata, jwt_status, rbac_action)
128128
table.insert(message, ',"')
129129
table.insert(message, header)
130130
table.insert(message, '":"')
131-
table.insert(message, value)
131+
table.insert(message, tostring(escape(value)))
132132
table.insert(message, '"')
133133
end
134134
end

‎envoy-control-tests/build.gradle‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,3 +39,7 @@ task reliabilityTest(type: Test) {
3939
}
4040
testClassesDirs = project.sourceSets.main.output.classesDirs
4141
}
42+
43+
tasks.withType(Test).configureEach {
44+
project.findProperty("envoyVersion")?.with { systemProperty("pl.allegro.tech.servicemesh.envoyVersion", it) }
45+
}

0 commit comments

Comments
 (0)