Skip to content

Commit 4e765fa

Browse files
authored
Merge branch 'main' into feat-dm-certpckr
Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>
2 parents cef5baa + 77542c5 commit 4e765fa

File tree

60 files changed

+4049
-73
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

60 files changed

+4049
-73
lines changed

.github/config.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,7 @@ checks:
110110
- precheck-external
111111
- precheck-format
112112
- precheck-publish
113+
- precheck-publish-config
113114
required: true
114115
# yamllint disable rule:line-length
115116
advice:
@@ -358,6 +359,9 @@ run:
358359
precheck-publish:
359360
paths:
360361
- "**/*"
362+
precheck-publish-config:
363+
paths:
364+
- "**/*"
361365
release:
362366
paths:
363367
- .bazelrc

.github/workflows/_precheck_publish.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ jobs:
4545
ERROR
4646
error:
4747
Error:
48+
skip: ${{ matrix.skip != false && true || false }}
4849
steps-post: ${{ matrix.steps-post }}
4950
target: ${{ matrix.target }}
5051
target-suffix: ${{ matrix.target-suffix }}
@@ -72,6 +73,7 @@ jobs:
7273
bazel-cache: true
7374
bazel-cache-output-base: docs
7475
rbe: true
76+
skip: ${{ ! fromJSON(inputs.request).run.precheck-publish-config }}
7577
- target: docs
7678
name: Docs
7779
bazel-cache: true

.github/workflows/_publish_release_container.yml

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -141,8 +141,17 @@ jobs:
141141
with:
142142
input-format: yaml
143143
filter: >-
144-
{manifests: .}
144+
.version as $v
145+
| {manifests:
146+
[.manifests[]
147+
| select(
148+
(.tag | test("contrib-distroless") | not)
149+
or ($v.major > 1 or ($v.major == 1 and $v.minor >= 37)))]}
145150
input: |
151+
version:
152+
major: ${{ inputs.version-major }}
153+
minor: ${{ inputs.version-minor }}
154+
manifests:
146155
- name: ${{ inputs.dockerhub-repo }}
147156
tag: v${{ inputs.version-major }}.${{ inputs.version-minor }}.${{ inputs.version-patch }}
148157
registry: docker.io/envoyproxy

.github/workflows/_request.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,18 @@ jobs:
202202
docker:
203203
x64: ${{ steps.cache-exists-docker-x64.outputs.cache-hit || 'false' }}
204204
arm64: ${{ steps.cache-exists-docker-arm64.outputs.cache-hit || 'false' }}
205+
target-branch: ${{ fromJSON(steps.env.outputs.data).request.target-branch }}
206+
filter: |
207+
.["target-branch"] as $branch
208+
| if ($branch | test("^release/v[0-9]+\\.[0-9]+$")) then
209+
($branch | sub("^release/v"; "") + ".0") as $version_str
210+
| ($version_str | utils::version) as $version
211+
| if ($version.major < 1 or ($version.major == 1 and $version.minor <= 37)) then
212+
.bazel["docs-x64"] = "skip"
213+
| .bazel["external-x64"] = "skip"
214+
else . end
215+
else . end
216+
| del(.["target-branch"])
205217
206218
cache:
207219
permissions:

.github/workflows/request.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,31 @@ concurrency:
2828

2929

3030
jobs:
31+
# Envoy (and mirror repos) have an environment setup that requires maintainer approval
32+
# to use it. This CI checks if the request is from a first-time contributor, and in that
33+
# case it uses the environment and requires the permission to proceed.
34+
authorize:
35+
if: >-
36+
${{ github.repository == 'envoyproxy/envoy'
37+
|| (vars.ENVOY_CI && github.event_name != 'schedule')
38+
|| (vars.ENVOY_SCHEDULED_CI && github.event_name == 'schedule') }}
39+
runs-on: ubuntu-24.04
40+
environment: >-
41+
${{ github.event_name == 'pull_request_target'
42+
&& github.event.pull_request.author_association != 'MEMBER'
43+
&& github.event.pull_request.author_association != 'COLLABORATOR'
44+
&& github.event.pull_request.author_association != 'CONTRIBUTOR'
45+
&& github.event.pull_request.author_association != 'OWNER'
46+
&& 'external-contributors'
47+
|| '' }}
48+
steps:
49+
- run: |
50+
echo "Authorized"
51+
echo " Event: ${{ github.event_name }}"
52+
echo " Author association: ${{ github.event.pull_request.author_association }}"
53+
3154
request:
55+
needs: authorize
3256
permissions:
3357
actions: write
3458
contents: read

CODEOWNERS

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
#* @envoyproxy/maintainers
44

55
# ci
6-
/.github/ @agrawroh @phlax
7-
/ci/ @agrawroh @phlax
6+
/.github/ @agrawroh @phlax @jwendell
7+
/ci/ @agrawroh @phlax @jwendell
88

99
# api
1010
/api/ @envoyproxy/api-shepherds
@@ -348,6 +348,8 @@ extensions/upstreams/tcp @ggreenway @mattklein123
348348
/*/extensions/filters/http/header_to_metadata @zuercher @JuniorHsu
349349
# Json to metadata
350350
/*/extensions/filters/http/json_to_metadata @cqi1217 @JuniorHsu @kbaichoo
351+
# SSE to metadata
352+
/*/extensions/filters/http/sse_to_metadata @JuniorHsu @PeterL328 @tyxia
351353
# zookeeper
352354
/*/extensions/filters/network/zookeeper_proxy @JuniorHsu @Winbobob @mattklein123
353355
# Custom response filter

api/BUILD

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -236,6 +236,7 @@ proto_library(
236236
"//envoy/extensions/filters/http/router/v3:pkg",
237237
"//envoy/extensions/filters/http/set_filter_state/v3:pkg",
238238
"//envoy/extensions/filters/http/set_metadata/v3:pkg",
239+
"//envoy/extensions/filters/http/sse_to_metadata/v3:pkg",
239240
"//envoy/extensions/filters/http/stateful_session/v3:pkg",
240241
"//envoy/extensions/filters/http/tap/v3:pkg",
241242
"//envoy/extensions/filters/http/thrift_to_metadata/v3:pkg",
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
2+
3+
load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
4+
5+
licenses(["notice"]) # Apache 2
6+
7+
api_proto_package(
8+
deps = [
9+
"//envoy/config/core/v3:pkg",
10+
"@xds//udpa/annotations:pkg",
11+
"@xds//xds/annotations/v3:pkg",
12+
],
13+
)
Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
syntax = "proto3";
2+
3+
package envoy.extensions.filters.http.sse_to_metadata.v3;
4+
5+
import "envoy/config/core/v3/extension.proto";
6+
7+
import "google/protobuf/wrappers.proto";
8+
9+
import "xds/annotations/v3/status.proto";
10+
11+
import "udpa/annotations/status.proto";
12+
import "validate/validate.proto";
13+
14+
option java_package = "io.envoyproxy.envoy.extensions.filters.http.sse_to_metadata.v3";
15+
option java_outer_classname = "SseToMetadataProto";
16+
option java_multiple_files = true;
17+
option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/sse_to_metadata/v3;sse_to_metadatav3";
18+
option (udpa.annotations.file_status).package_version_status = ACTIVE;
19+
option (xds.annotations.v3.file_status).work_in_progress = true;
20+
21+
// [#protodoc-title: SSE-To-Metadata Filter]
22+
//
23+
// The SSE-To-Metadata filter extracts values from Server-Sent Events (SSE) HTTP response bodies
24+
// and writes them to dynamic metadata. This is useful for LLM token usage tracking,
25+
// logging, and other observability use cases.
26+
//
27+
// The filter specifically handles SSE format (text/event-stream) and uses pluggable content
28+
// parsers to extract values from the SSE data fields. The content parser is a typed extension
29+
// that can be configured to handle different content types (JSON, plaintext, XML, etc.).
30+
//
31+
// The filter only processes responses with Content-Type "text/event-stream"
32+
// (the standard SSE content type). Content-Type parameters such as charset are ignored.
33+
//
34+
// See SSE-To-Metadata :ref:`configuration overview <config_http_filters_sse_to_metadata>` for more details.
35+
// [#extension: envoy.filters.http.sse_to_metadata]
36+
37+
message SseToMetadata {
38+
// Rules for processing SSE streams and extracting metadata.
39+
//
40+
// The filter parses the SSE protocol (events delimited by blank lines), then delegates
41+
// to a content parser to parse event content and extract metadata. The content parser
42+
// determines which values to extract and how to write them to metadata.
43+
message ProcessingRules {
44+
// Content parser configuration for parsing event content and extracting metadata.
45+
//
46+
// The content parser specifies:
47+
// - How to parse the event data (e.g., JSON, XML, plaintext)
48+
// - Which values to extract from the parsed content (e.g., JSON paths like usage.total_tokens)
49+
// - How to map extracted values to metadata (namespace, key, type conversions)
50+
// - When to write metadata (on_present, on_missing, on_error actions)
51+
// [#extension-category: envoy.content_parsers]
52+
config.core.v3.TypedExtensionConfig content_parser = 1
53+
[(validate.rules).message = {required: true}];
54+
55+
// Maximum size in bytes for a single SSE event before it's considered invalid
56+
// and discarded. This protects against unbounded memory growth from malicious
57+
// or malformed streams that never send event delimiters (blank lines).
58+
//
59+
// Default is 8192 bytes (8KB), which is sufficient for most legitimate events.
60+
// Set to 0 to disable the limit (not recommended for production).
61+
// Maximum allowed value is 10485760 bytes (10MB).
62+
google.protobuf.UInt32Value max_event_size = 2 [(validate.rules).uint32 = {lte: 10485760}];
63+
}
64+
65+
// Rules for processing SSE response streams.
66+
ProcessingRules response_rules = 1 [(validate.rules).message = {required: true}];
67+
}

api/envoy/extensions/geoip_providers/common/v3/common.proto

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
1919
message CommonGeoipProviderConfig {
2020
// The set of geolocation headers to add to request. If any of the configured headers is present
2121
// in the incoming request, it will be overridden by the :ref:`HTTP GeoIP filter <config_http_filters_geoip>`.
22-
// [#next-free-field: 13]
22+
// [#next-free-field: 14]
2323
//
2424
// .. attention::
2525
// This field is deprecated in favor of :ref:`geo_field_keys
@@ -39,9 +39,15 @@ message CommonGeoipProviderConfig {
3939
[(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME ignore_empty: true}];
4040

4141
// If set, the header will be used to populate the ASN associated with the IP address.
42+
// Note: If both ISP and ASN databases are configured, only the ASN database is used for lookup.
4243
string asn = 4
4344
[(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME ignore_empty: true}];
4445

46+
// If set, the header will be used to populate the autonomous system organization associated with the IP address.
47+
// Note: If both ISP and ASN databases are configured, only the ASN database is used for lookup.
48+
string asn_org = 13
49+
[(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME ignore_empty: true}];
50+
4551
// This field is deprecated; use ``anon`` instead.
4652
string is_anon = 5 [
4753
deprecated = true,
@@ -92,7 +98,7 @@ message CommonGeoipProviderConfig {
9298
// - The :ref:`Network GeoIP filter <config_network_filters_geoip>` stores results in the
9399
// connection's filter state under the well-known key ``envoy.geoip``.
94100
//
95-
// [#next-free-field: 12]
101+
// [#next-free-field: 13]
96102
message GeolocationFieldKeys {
97103
// If set, the key will be used to populate the country ISO code associated with the IP address.
98104
string country = 1;
@@ -107,6 +113,9 @@ message CommonGeoipProviderConfig {
107113
// If set, the key will be used to populate the ASN associated with the IP address.
108114
string asn = 4;
109115

116+
// If set, the key will be used to populate the autonomous system organization associated with the IP address.
117+
string asn_org = 12;
118+
110119
// If set, the IP address will be checked if it belongs to any type of anonymization network
111120
// (e.g., VPN, public proxy). The result will be stored with this key. Value will be set to
112121
// either ``true`` or ``false`` depending on the check result.

0 commit comments

Comments
 (0)