Skip to content

Initial commit of Envoy Dynamic Modules - #1535

Merged
Bowei Du (bowei) merged 12 commits into
agent-substrate:mainfrom
yanavlasov:sni-matcher-poc
Sep 24, 2026
Merged

Bowei Du (bowei) merged 12 commits into
agent-substrate:mainfrom
yanavlasov:sni-matcher-poc

Conversation

@yanavlasov

@yanavlasov yanavlasov commented Sep 8, 2026 •

Copy link
Copy Markdown
Collaborator

Collecting initial feedback on integrating Envoy dynamic modules for Substrate dataplane.

Envoy Dynamic Modules allow fast iteration and experimentation on Substrate dataplane. Dynamic modules are used to improve feature velocity. As requirements and solution are better understood they will be generalized and moved into Envoy's main repository.

Important points:

  • Dynamic modules introduce Rust toolchain into Substrate dev environment. This PR does not add GH actions for testing Dynamic Modules during CI builds. This will be added in a subsequent PR.

  • This change brings in Dockerfiles and docker buildx. It produces an image with a versioned Envoy binary (1.39) and accompanying dynamic modules.

  • Docker image registry URL in deployment spec for Envoy datplane is at this point hardcoded to localhost:5001. This will break for anyone using a different registry. Fixing this will require using envsubst or equivalent. I'm open to other suggestions.

  • Tests pass

  • Appropriate changes to documentation are included in the PR

@yanavlasov

Copy link
Copy Markdown
Collaborator Author

@LiorLieberman

Copy link
Copy Markdown
Collaborator

Thanks! Taking a look tomorrow

@yanavlasov yanavlasov changed the title Demo for SNI bypass policy plumbing Initial commit of Envoy Dynamic Modules Sep 22, 2026
@yanavlasov
yanavlasov marked this pull request as ready for review September 22, 2026 18:02
@bowei Bowei Du (bowei) self-assigned this Sep 22, 2026
@bowei

Copy link
Copy Markdown
Collaborator

FYI -- the shell will be deleted very soon. But it's ok to keep here for now.

@bowei

Copy link
Copy Markdown
Collaborator

I don't know rust organization well enough -- but is it better to put rust code in a multi language repo at the top level or to nest it inside?

@bowei

Copy link
Copy Markdown
Collaborator

Does Cargo.toml need to be at the root level

Comment thread hack/install-ate.sh Outdated
return
fi

# Build envoy dataplane image

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

how long does this take, on a cold CI machine?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

~5 minutes on my VM.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Even less than that. Just ran with a cold docker cache and full image build finished in just over 2 minutes.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI has relatively small VMs. We can see all of the e2e jobs are failing on this PR.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The failure was due to this problem: #1535 (comment) It is fixed after migrating to go based config

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ouch, FYI Bowei Du (@bowei)

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should consider what options we have to speed this up, e.g. caching in the actions, compiler flags, etc.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this ok for now, or we need to fix before merge. Benjamin Elder (@BenTheElder) isn't this a temporary issue that will be resolved post -donation.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That may take a bit, is there anything we can do to drive down the time? CI has become a bit of a bottleneck and 2 minutes is not a trivial addition.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What kind of caching is available? Isn't the action basically constrained in the same way as the CI?

Comment thread hack/install-ate.sh Resolved

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we should probably have e.g. clippy?

@BenTheElder

Copy link
Copy Markdown
Collaborator

Does Cargo.toml need to be at the root level

No, think of it like go.mod and cargo.lock like go.sum. A rust crate is sort of like a go module. Except they live in a flat namespace ...

@yanavlasov

Copy link
Copy Markdown
Collaborator Author

I don't know rust organization well enough -- but is it better to put rust code in a multi language repo at the top level or to nest it inside?

I does not really matter, other than clarity for maintainers. I put it where all other binaries live. Open to suggestions here.

@yanavlasov

Copy link
Copy Markdown
Collaborator Author

clippy

You mean THE clippy?

Comment thread cmd/dataplane/envoy/Dockerfile Resolved
Comment thread hack/install-ate.sh Resolved
Comment thread hack/install-ate.sh Resolved
@BenTheElder

Copy link
Copy Markdown
Collaborator

@yanavlasov

Copy link
Copy Markdown
Collaborator Author

You mean THE clippy?

the official linter of rust ... https://github.com/rust-lang/rust-clippy

I've run clippy on the code. In the followup PR I will add GH action to run unit tests and clippy on the changed code.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this looks good to me. this PR should be ~zero impact to envoy afaiu

will yield to Bowei to do final approval

Signed-off-by: Yan Avlasov <[email protected]>
@bowei
Bowei Du (bowei) added this pull request to the merge queue Sep 24, 2026
Merged via the queue into agent-substrate:main with commit 30e6d33 Sep 24, 2026
11 checks passed
pull Bot pushed a commit to warmchang/substrate that referenced this pull request Sep 25, 2026
Fixes the kind install on arm64 hosts (Apple Silicon), broken in agent-substrate#1535

- `BuildDockerfileImage` hard-codes `--platform=linux/amd64`, so the
dataplane image's Rust builder stage fails with `exec /bin/sh: exec
format
  error` on mac with arm64

The ko images already follow `KO_DEFAULTPLATFORMS`, which the kind
install
sets to the host architecture; the Dockerfile images did not.

**Changes**

- Pass `KO_DEFAULTPLATFORMS` through to `docker buildx build --platform`
for
  both Dockerfile images (envoy dataplane, claude-code-multiplex demo),
  defaulting to `linux/amd64` when unset.
- Pin the Envoy base image by its multi-platform index digest so
`--platform`
  selects the matching manifest.

- [x] Tested (`hack/install-ate-kind.sh --deploy-ate-system` on mac
succeed)
Julian Gutierrez Oschmann (juli4n) pushed a commit to juli4n/substrate that referenced this pull request Sep 29, 2026
…bstrate#1964)

## What

- A pre-built install (`ate-setup deploy --image-repo REPO --image-tag
TAG`) now pins `REPO/envoy-dataplane:TAG` like the ko images, instead of
building it with docker buildx.
- `make build-envoy-dataplane` publishes that image.
- `make build-release-images` publishes every image a pre-built install
needs (ko images, demos, envoy-dataplane), all tagged `$(VERSION)`.

## Why

envoy-dataplane (agent-substrate#1535) is built from a Dockerfile, and ate-setup built
it even for pre-built installs. Those installs have no registry to push
to, so they failed on the default envoy router after the control plane
was applied. It also couldn't join `ALL_IMAGES`, which only lists ko
builds, so nothing published it for a release.

## Testing

- New unit tests for pinning and rendering a pre-built egress manifest.
The rendering test fails on `main` with the production error (`invalid
tag "/envoy-dataplane:build-…"`).
- `make build-release-images` pushed all 13 images under one tag, and
`images.Prebuilt` pinned every one against the real registry.
- Cherry-picks cleanly onto `release-0.2`.

Fixes agent-substrate#1962

> It's a good idea to open an issue first for discussion.

- [ ] Tests pass
- [x] Appropriate changes to documentation are included in the PR

---------

Co-authored-by: Anna Pendleton <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/demos area/network kind/feature An enhancement / feature request or implementation

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants