Merge branch 'develop' into bo/chore/wrappers-0.4.2

Author: burmecia

ansible/files/envoy_config/cds.yaml

@@ -10,6 +10,16 @@ resources:
                   socket_address:
                     address: 127.0.0.1
                     port_value: 8085
+    circuit_breakers:
+      thresholds:
+        - priority: DEFAULT
+          max_connections: 10000
+          max_pending_requests: 10000
+          max_requests: 10000
+          retry_budget:
+            budget_percent:
+              value: 100
+            min_retry_concurrency: 100
   - '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     name: gotrue
     load_assignment:
@@ -21,6 +31,16 @@ resources:
                   socket_address:
                     address: 127.0.0.1
                     port_value: 9999
+    circuit_breakers:
+      thresholds:
+        - priority: DEFAULT
+          max_connections: 10000
+          max_pending_requests: 10000
+          max_requests: 10000
+          retry_budget:
+            budget_percent:
+              value: 100
+            min_retry_concurrency: 100
   - '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     name: postgrest
     load_assignment:
@@ -32,6 +52,16 @@ resources:
                   socket_address:
                     address: 127.0.0.1
                     port_value: 3000
+    circuit_breakers:
+      thresholds:
+        - priority: DEFAULT
+          max_connections: 10000
+          max_pending_requests: 10000
+          max_requests: 10000
+          retry_budget:
+            budget_percent:
+              value: 100
+            min_retry_concurrency: 100
   - '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
     name: postgrest_admin
     load_assignment:
@@ -43,4 +73,14 @@ resources:
                   socket_address:
                     address: 127.0.0.1
                     port_value: 3001
+    circuit_breakers:
+      thresholds:
+        - priority: DEFAULT
+          max_connections: 10000
+          max_pending_requests: 10000
+          max_requests: 10000
+          retry_budget:
+            budget_percent:
+              value: 100
+            min_retry_concurrency: 100
 

ansible/files/envoy_config/lds.yaml

@@ -87,8 +87,23 @@ resources:
                     '@type': >-
                       type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
                     source_codes:
-                      remove_apikey_query_parameter:
-                        filename: /etc/envoy/remove_apikey_query_parameter.lua
+                      remove_apikey_and_empty_key_query_parameters:
+                        inline_string: |-
+                          function envoy_on_request(request_handle)
+                            local path = request_handle:headers():get(":path")
+                            request_handle
+                              :headers()
+                              :replace(":path", path:gsub("&=[^&]*", ""):gsub("?=[^&]*$", ""):gsub("?=[^&]*&", "?"))
+                              :replace(":path", path:gsub("&apikey=[^&]*", ""):gsub("?apikey=[^&]*$", ""):gsub("?apikey=[^&]*&", "?"))
+                          end
+                      remove_empty_key_query_parameters:
+                        inline_string: |-
+                          function envoy_on_request(request_handle)
+                            local path = request_handle:headers():get(":path")
+                            request_handle
+                              :headers()
+                              :replace(":path", path:gsub("&=[^&]*", ""):gsub("?=[^&]*$", ""):gsub("?=[^&]*&", "?"))
+                          end
                 - name: envoy.filters.http.router
                   typed_config:
                     '@type': >-
@@ -181,12 +196,14 @@ resources:
                           retry_policy:
                             num_retries: 3
                             retry_on: 5xx
+                          timeout: 35s
                         typed_per_filter_config: *ref_0
                       - match:
                           prefix: /auth/v1/
                         route:
                           cluster: gotrue
                           prefix_rewrite: /
+                          timeout: 35s
                       - match:
                           prefix: /rest/v1/
                           query_parameters:
@@ -197,20 +214,25 @@ resources:
                         route:
                           cluster: postgrest
                           prefix_rewrite: /
-                          timeout: 120s
+                          timeout: 125s
                         typed_per_filter_config:
                           envoy.filters.http.lua:
                             '@type': >-
                               type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute
-                            name: remove_apikey_query_parameter
+                            name: remove_apikey_and_empty_key_query_parameter
                       - match:
                           prefix: /rest/v1/
                         request_headers_to_remove:
                           - apikey
                         route:
                           cluster: postgrest
                           prefix_rewrite: /
-                          timeout: 120s
+                          timeout: 125s
+                        typed_per_filter_config:
+                          envoy.filters.http.lua:
+                            '@type': >-
+                              type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute
+                            name: remove_empty_key_query_parameter
                       - match:
                           prefix: /rest-admin/v1/
                           query_parameters:
@@ -225,7 +247,7 @@ resources:
                           envoy.filters.http.lua:
                             '@type': >-
                               type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute
-                            name: remove_apikey_query_parameter
+                            name: remove_apikey_and_empty_key_query_parameters
                       - match:
                           prefix: /rest-admin/v1/
                         request_headers_to_remove:
@@ -242,7 +264,7 @@ resources:
                         route:
                           cluster: postgrest
                           prefix_rewrite: /rpc/graphql
-                          timeout: 120s
+                          timeout: 125s
                       - match:
                           prefix: /admin/v1/
                         route:
@@ -293,6 +315,13 @@ resources:
                                           direct_remote_ip:
                                             address_prefix: 10.0.0.0
                                             prefix_len: 8
+                    include_attempt_count_in_response: true
+                    retry_policy:
+                      num_retries: 5
+                      retry_back_off:
+                        base_interval: 0.1s
+                        max_interval: 1s
+                      retry_on: gateway-error
               stat_prefix: ingress_http
   - '@type': type.googleapis.com/envoy.config.listener.v3.Listener
     name: https_listener

ansible/files/envoy_config/remove_apikey_query_parameter.lua

@@ -50,7 +50,7 @@ postgres_exporter_release_checksum:
   arm64: sha256:29ba62d538b92d39952afe12ee2e1f4401250d678ff4b354ff2752f4321c87a0
   amd64: sha256:cb89fc5bf4485fb554e0d640d9684fae143a4b2d5fa443009bd29c59f9129e84
 
-adminapi_release: 0.66.2
+adminapi_release: 0.68.0
 adminmgr_release: 0.22.1
 
 # Postgres Extensions

ansible/vars.yml

@@ -1 +1 @@
-postgres-version = "15.6.1.116"
+postgres-version = "15.6.1.117"

common-nix.vars.pkr.hcl

@@ -6,9 +6,12 @@
 2. For instance, if we were updating https://github.com/supabase/postgres/blob/develop/nix/ext/supautils.nix we would:
    1. change the `version = "2.2.1";` to whatever our git tag release version is that we want to update to
    2. temporarily empty the `hash = "sha256-wSUEG0at00TPAoHv6+NMzuUE8mfW6fnHH0MNxvBdUiE=";` to `hash = "";` and save `supautils.nix` and `git add  .`
-   3. run `nix build .#psql_15/exts/supautils` or the name of the extension to update, nix will print the calculated sha256 value that you can add back the the `hash` variable, save the file again, and re-run nix build .#psql_15/exts/supautils. 
-   4. Add any needed migrations into the `supabase/postgres` migrations directory
-   5. You can then run tests locally to verify that the update of the package succeeded. 
-   6. Now it's ready for PR review.
+   3. run `nix build .#psql_15/exts/supautils` or the name of the extension to update, nix will print the calculated sha256 value that you can add back the the `hash` variable, save the file again, and re-run nix build .#psql_15/exts/supautils.
+   4. NOTE: This step is only necessary for `buildPgrxExtension` packages, which includes supabase-wrappers, pg_jsonschema, and pg_graphql. Otherwise you can skip this step. For our packages that are build with `buildPgrxExtension` you will need to prepend the previous version to the `previousVersions` variable before updating the version in the package (for instance if you are updating `supabase-wrappers` extension from `0.4.1` to `0.4.2` then you would prepend `0.4.1` to this line https://github.com/supabase/postgres/blob/develop/nix/ext/wrappers/default.nix#L18 ). 
+   5. Add any needed migrations into the `supabase/postgres` migrations directory
+   6. update the version in `ansible/vars.yml` as usual
+   7. You can then run the `nix flake check -L` tests locally to verify that the update of the package succeeded. 
+   8. Now it's ready for PR review.
+   9. Once the PR is approved, if you want the change to go out in a release, update the common-nix.vars.yml file with the new version prior to merging.
 
 

nix/docs/update-extension.md

@@ -343,7 +343,7 @@ def test_postgrest_can_connect_to_db(host):
 # There would be an error if the `apikey` query parameter isn't removed,
 # since PostgREST treats query parameters as conditions.
 #
-# Worth testing since remove_apikey_query_parameter.lua uses regexp instead
+# Worth testing since remove_apikey_query_parameters uses regexp instead
 # of parsed query parameters.
 def test_postgrest_starting_apikey_query_parameter_is_removed(host):
     res = requests.get(
@@ -388,3 +388,52 @@ def test_postgrest_ending_apikey_query_parameter_is_removed(host):
         },
     )
     assert res.ok
+
+# There would be an error if the empty key query parameter isn't removed,
+# since PostgREST treats empty key query parameters as malformed input.
+#
+# Worth testing since remove_apikey_and_empty_key_query_parameters uses regexp instead
+# of parsed query parameters.
+def test_postgrest_starting_empty_key_query_parameter_is_removed(host):
+    res = requests.get(
+        f"http://{host.backend.get_hostname()}/rest/v1/buckets",
+        headers={
+            "accept-profile": "storage",
+        },
+        params={
+            "": "empty_key",
+            "id": "eq.absent",
+            "apikey": service_role_key,
+        },
+    )
+    assert res.ok
+
+
+def test_postgrest_middle_empty_key_query_parameter_is_removed(host):
+    res = requests.get(
+        f"http://{host.backend.get_hostname()}/rest/v1/buckets",
+        headers={
+            "accept-profile": "storage",
+        },
+        params={
+            "apikey": service_role_key,
+            "": "empty_key",
+            "id": "eq.absent",
+        },
+    )
+    assert res.ok
+
+
+def test_postgrest_ending_empty_key_query_parameter_is_removed(host):
+    res = requests.get(
+        f"http://{host.backend.get_hostname()}/rest/v1/buckets",
+        headers={
+            "accept-profile": "storage",
+        },
+        params={
+            "id": "eq.absent",
+            "apikey": service_role_key,
+            "": "empty_key",
+        },
+    )
+    assert res.ok

testinfra/test_ami.py

@@ -343,7 +343,7 @@ def test_postgrest_can_connect_to_db(host):
 # There would be an error if the `apikey` query parameter isn't removed,
 # since PostgREST treats query parameters as conditions.
 #
-# Worth testing since remove_apikey_query_parameter.lua uses regexp instead
+# Worth testing since remove_apikey_query_parameters uses regexp instead
 # of parsed query parameters.
 def test_postgrest_starting_apikey_query_parameter_is_removed(host):
     res = requests.get(
@@ -387,4 +387,53 @@ def test_postgrest_ending_apikey_query_parameter_is_removed(host):
             "apikey": service_role_key,
         },
     )
-    assert res.ok
+    assert res.ok
+
+# There would be an error if the empty key query parameter isn't removed,
+# since PostgREST treats empty key query parameters as malformed input.
+#
+# Worth testing since remove_apikey_and_empty_key_query_parameters uses regexp instead
+# of parsed query parameters.
+def test_postgrest_starting_empty_key_query_parameter_is_removed(host):
+    res = requests.get(
+        f"http://{host.backend.get_hostname()}/rest/v1/buckets",
+        headers={
+            "accept-profile": "storage",
+        },
+        params={
+            "": "empty_key",
+            "id": "eq.absent",
+            "apikey": service_role_key,
+        },
+    )
+    assert res.ok
+
+
+def test_postgrest_middle_empty_key_query_parameter_is_removed(host):
+    res = requests.get(
+        f"http://{host.backend.get_hostname()}/rest/v1/buckets",
+        headers={
+            "accept-profile": "storage",
+        },
+        params={
+            "apikey": service_role_key,
+            "": "empty_key",
+            "id": "eq.absent",
+        },
+    )
+    assert res.ok
+
+
+def test_postgrest_ending_empty_key_query_parameter_is_removed(host):
+    res = requests.get(
+        f"http://{host.backend.get_hostname()}/rest/v1/buckets",
+        headers={
+            "accept-profile": "storage",
+        },
+        params={
+            "id": "eq.absent",
+            "apikey": service_role_key,
+            "": "empty_key",
+        },
+    )
+    assert res.ok