Skip to content

Commit b44ebce

Browse files
shivaspeaksshivaspeaks
authored
xds: Envoy proto sync to 2024-11-11 (#11816)
1 parent 4d8aff7 commit b44ebce

12 files changed

Lines changed: 174 additions & 41 deletions

File tree

‎repositories.bzl‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -141,10 +141,10 @@ def grpc_java_repositories(bzlmod = False):
141141
if not native.existing_rule("envoy_api"):
142142
http_archive(
143143
name = "envoy_api",
144-
sha256 = "f439add0cc01f718d53d6feb4d0972ac0d48b3e145c18b53439a3b5148a0cb6e",
145-
strip_prefix = "data-plane-api-55f8b2351962d84c84a6534da67da1dd9f671c50",
144+
sha256 = "ecf71817233eba19cc8b4ee14e126ffd5838065d5b5a92b2506258a42ac55199",
145+
strip_prefix = "data-plane-api-0bc95493c5e88b7b07e62758d23b39341813a827",
146146
urls = [
147-
"https://github.com/envoyproxy/data-plane-api/archive/55f8b2351962d84c84a6534da67da1dd9f671c50.tar.gz",
147+
"https://github.com/envoyproxy/data-plane-api/archive/0bc95493c5e88b7b07e62758d23b39341813a827.tar.gz",
148148
],
149149
)
150150

‎xds/src/test/java/io/grpc/xds/RbacFilterTest.java‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -219,14 +219,15 @@ public void headerParser_headerName() {
219219
@SuppressWarnings("unchecked")
220220
public void compositeRules() {
221221
MetadataMatcher metadataMatcher = MetadataMatcher.newBuilder().build();
222+
@SuppressWarnings("deprecation")
223+
Permission permissionMetadata = Permission.newBuilder().setMetadata(metadataMatcher).build();
222224
List<Permission> permissionList = Arrays.asList(
223225
Permission.newBuilder().setOrRules(Permission.Set.newBuilder().addRules(
224-
Permission.newBuilder().setMetadata(metadataMatcher).build()
225-
).build()).build());
226+
permissionMetadata).build()).build());
227+
@SuppressWarnings("deprecation")
228+
Principal principalMetadata = Principal.newBuilder().setMetadata(metadataMatcher).build();
226229
List<Principal> principalList = Arrays.asList(
227-
Principal.newBuilder().setNotId(
228-
Principal.newBuilder().setMetadata(metadataMatcher).build()
229-
).build());
230+
Principal.newBuilder().setNotId(principalMetadata).build());
230231
ConfigOrError<? extends FilterConfig> result = parse(permissionList, principalList);
231232
assertThat(result.errorDetail).isNull();
232233
assertThat(result.config).isInstanceOf(RbacConfig.class);

‎xds/third_party/envoy/import.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717

1818
set -e
1919
# import VERSION from the google internal copybara_version.txt for Envoy
20-
VERSION=742a3b02e3b2a9dfb877a7e378607c6ed0c2aa53
20+
VERSION=0b90f64539c88dc3d2a6792dc714e8207bce0c08
2121
DOWNLOAD_URL="https://github.com/envoyproxy/envoy/archive/${VERSION}.tar.gz"
2222
DOWNLOAD_BASE_DIR="envoy-${VERSION}"
2323
SOURCE_PROTO_BASE_DIR="${DOWNLOAD_BASE_DIR}/api"

‎xds/third_party/envoy/src/main/proto/envoy/config/core/v3/base.proto‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -453,6 +453,7 @@ message HeaderValueOption {
453453
message HeaderMap {
454454
option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.HeaderMap";
455455

456+
// A list of header names and their values.
456457
repeated HeaderValue headers = 1;
457458
}
458459

‎xds/third_party/envoy/src/main/proto/envoy/config/core/v3/protocol.proto‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,13 +123,19 @@ message UpstreamHttpProtocolOptions {
123123
// header when :ref:`override_auto_sni_header <envoy_v3_api_field_config.core.v3.UpstreamHttpProtocolOptions.override_auto_sni_header>`
124124
// is set, as seen by the :ref:`router filter <config_http_filters_router>`.
125125
// Does nothing if a filter before the http router filter sets the corresponding metadata.
126+
//
127+
// See :ref:`SNI configuration <start_quick_start_securing_sni_client>` for details on how this
128+
// interacts with other validation options.
126129
bool auto_sni = 1;
127130

128131
// Automatic validate upstream presented certificate for new upstream connections based on the
129132
// downstream HTTP host/authority header or any other arbitrary header when :ref:`override_auto_sni_header <envoy_v3_api_field_config.core.v3.UpstreamHttpProtocolOptions.override_auto_sni_header>`
130133
// is set, as seen by the :ref:`router filter <config_http_filters_router>`.
131134
// This field is intended to be set with ``auto_sni`` field.
132135
// Does nothing if a filter before the http router filter sets the corresponding metadata.
136+
//
137+
// See :ref:`validation configuration <start_quick_start_securing_validation>` for how this interacts with
138+
// other validation options.
133139
bool auto_san_validation = 2;
134140

135141
// An optional alternative to the host/authority header to be used for setting the SNI value.

‎xds/third_party/envoy/src/main/proto/envoy/config/listener/v3/listener_components.proto‎

Lines changed: 2 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -201,24 +201,9 @@ message FilterChainMatch {
201201
message FilterChain {
202202
option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.listener.FilterChain";
203203

204-
// The configuration for on-demand filter chain. If this field is not empty in FilterChain message,
205-
// a filter chain will be built on-demand.
206-
// On-demand filter chains help speedup the warming up of listeners since the building and initialization of
207-
// an on-demand filter chain will be postponed to the arrival of new connection requests that require this filter chain.
208-
// Filter chains that are not often used can be set as on-demand.
209-
message OnDemandConfiguration {
210-
// The timeout to wait for filter chain placeholders to complete rebuilding.
211-
// 1. If this field is set to 0, timeout is disabled.
212-
// 2. If not specified, a default timeout of 15s is used.
213-
// Rebuilding will wait until dependencies are ready, have failed, or this timeout is reached.
214-
// Upon failure or timeout, all connections related to this filter chain will be closed.
215-
// Rebuilding will start again on the next new connection.
216-
google.protobuf.Duration rebuild_timeout = 1;
217-
}
218-
219-
reserved 2;
204+
reserved 2, 8;
220205

221-
reserved "tls_context";
206+
reserved "tls_context", "on_demand_configuration";
222207

223208
// The criteria to use when matching a connection to this filter chain.
224209
FilterChainMatch filter_chain_match = 1;
@@ -269,11 +254,6 @@ message FilterChain {
269254
// <envoy_v3_api_field_config.listener.v3.Listener.filter_chain_matcher>`
270255
// requires that filter chains are uniquely named within a listener.
271256
string name = 7;
272-
273-
// [#not-implemented-hide:] The configuration to specify whether the filter chain will be built on-demand.
274-
// If this field is not empty, the filter chain will be built on-demand.
275-
// Otherwise, the filter chain will be built normally and block listener warming.
276-
OnDemandConfiguration on_demand_configuration = 8;
277257
}
278258

279259
// Listener filter chain match configuration. This is a recursive structure which allows complex

‎xds/third_party/envoy/src/main/proto/envoy/config/overload/v3/overload.proto‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,12 @@ message ScaleTimersOverloadActionConfig {
103103
// This affects the value of
104104
// :ref:`FilterChain.transport_socket_connect_timeout <envoy_v3_api_field_config.listener.v3.FilterChain.transport_socket_connect_timeout>`.
105105
TRANSPORT_SOCKET_CONNECT = 3;
106+
107+
// Adjusts the max connection duration timer for downstream HTTP connections.
108+
// This affects the value of
109+
// :ref:`HttpConnectionManager.common_http_protocol_options.max_connection_duration
110+
// <envoy_v3_api_field_config.core.v3.HttpProtocolOptions.max_connection_duration>`.
111+
HTTP_DOWNSTREAM_CONNECTION_MAX = 4;
106112
}
107113

108114
message ScaleTimer {

‎xds/third_party/envoy/src/main/proto/envoy/config/rbac/v3/rbac.proto‎

Lines changed: 45 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,14 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
2828

2929
// [#protodoc-title: Role Based Access Control (RBAC)]
3030

31+
enum MetadataSource {
32+
// Query :ref:`dynamic metadata <well_known_dynamic_metadata>`
33+
DYNAMIC = 0;
34+
35+
// Query :ref:`route metadata <envoy_v3_api_field_config.route.v3.Route.metadata>`
36+
ROUTE = 1;
37+
}
38+
3139
// Role Based Access Control (RBAC) provides service-level and method-level access control for a
3240
// service. Requests are allowed or denied based on the ``action`` and whether a matching policy is
3341
// found. For instance, if the action is ALLOW and a matching policy is found the request should be
@@ -193,8 +201,27 @@ message Policy {
193201
[(udpa.annotations.field_migrate).oneof_promotion = "expression_specifier"];
194202
}
195203

204+
// SourcedMetadata enables matching against metadata from different sources in the request processing
205+
// pipeline. It extends the base MetadataMatcher functionality by allowing specification of where the
206+
// metadata should be sourced from, rather than only matching against dynamic metadata.
207+
//
208+
// The matcher can be configured to look up metadata from:
209+
// * Dynamic metadata: Runtime metadata added by filters during request processing
210+
// * Route metadata: Static metadata configured on the route entry
211+
message SourcedMetadata {
212+
// Metadata matcher configuration that defines what metadata to match against. This includes the filter name,
213+
// metadata key path, and expected value.
214+
type.matcher.v3.MetadataMatcher metadata_matcher = 1
215+
[(validate.rules).message = {required: true}];
216+
217+
// Specifies which metadata source should be used for matching. If not set,
218+
// defaults to DYNAMIC (dynamic metadata). Set to ROUTE to match against
219+
// static metadata configured on the route entry.
220+
MetadataSource metadata_source = 2 [(validate.rules).enum = {defined_only: true}];
221+
}
222+
196223
// Permission defines an action (or actions) that a principal can take.
197-
// [#next-free-field: 14]
224+
// [#next-free-field: 15]
198225
message Permission {
199226
option (udpa.annotations.versioning).previous_message_type = "envoy.config.rbac.v2.Permission";
200227

@@ -237,8 +264,10 @@ message Permission {
237264
// A port number range that describes a range of destination ports connecting to.
238265
type.v3.Int32Range destination_port_range = 11;
239266

240-
// Metadata that describes additional information about the action.
241-
type.matcher.v3.MetadataMatcher metadata = 7;
267+
// Metadata that describes additional information about the action. This field is deprecated; please use
268+
// :ref:`sourced_metadata<envoy_v3_api_field_config.rbac.v3.Permission.sourced_metadata>` instead.
269+
type.matcher.v3.MetadataMatcher metadata = 7
270+
[deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
242271

243272
// Negates matching the provided permission. For instance, if the value of
244273
// ``not_rule`` would match, this permission would not match. Conversely, if
@@ -274,12 +303,16 @@ message Permission {
274303
// URI template path matching.
275304
// [#extension-category: envoy.path.match]
276305
core.v3.TypedExtensionConfig uri_template = 13;
306+
307+
// Matches against metadata from either dynamic state or route configuration. Preferred over the
308+
// ``metadata`` field as it provides more flexibility in metadata source selection.
309+
SourcedMetadata sourced_metadata = 14;
277310
}
278311
}
279312

280313
// Principal defines an identity or a group of identities for a downstream
281314
// subject.
282-
// [#next-free-field: 13]
315+
// [#next-free-field: 14]
283316
message Principal {
284317
option (udpa.annotations.versioning).previous_message_type = "envoy.config.rbac.v2.Principal";
285318

@@ -356,8 +389,10 @@ message Principal {
356389
// A URL path on the incoming HTTP request. Only available for HTTP.
357390
type.matcher.v3.PathMatcher url_path = 9;
358391

359-
// Metadata that describes additional information about the principal.
360-
type.matcher.v3.MetadataMatcher metadata = 7;
392+
// Metadata that describes additional information about the principal. This field is deprecated; please use
393+
// :ref:`sourced_metadata<envoy_v3_api_field_config.rbac.v3.Principal.sourced_metadata>` instead.
394+
type.matcher.v3.MetadataMatcher metadata = 7
395+
[deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
361396

362397
// Identifies the principal using a filter state object.
363398
type.matcher.v3.FilterStateMatcher filter_state = 12;
@@ -366,6 +401,10 @@ message Principal {
366401
// ``not_id`` would match, this principal would not match. Conversely, if the
367402
// value of ``not_id`` would not match, this principal would match.
368403
Principal not_id = 8;
404+
405+
// Matches against metadata from either dynamic state or route configuration. Preferred over the
406+
// ``metadata`` field as it provides more flexibility in metadata source selection.
407+
SourcedMetadata sourced_metadata = 13;
369408
}
370409
}
371410

‎xds/third_party/envoy/src/main/proto/envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.proto‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,10 @@ package envoy.extensions.filters.http.gcp_authn.v3;
55
import "envoy/config/core/v3/base.proto";
66
import "envoy/config/core/v3/http_uri.proto";
77

8+
import "google/protobuf/duration.proto";
89
import "google/protobuf/wrappers.proto";
910

11+
import "envoy/annotations/deprecation.proto";
1012
import "udpa/annotations/status.proto";
1113
import "validate/validate.proto";
1214

@@ -21,20 +23,42 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
2123
// [#extension: envoy.filters.http.gcp_authn]
2224

2325
// Filter configuration.
26+
// [#next-free-field: 7]
2427
message GcpAuthnFilterConfig {
2528
// The HTTP URI to fetch tokens from GCE Metadata Server(https://cloud.google.com/compute/docs/metadata/overview).
2629
// The URL format is "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=[AUDIENCE]"
27-
config.core.v3.HttpUri http_uri = 1 [(validate.rules).message = {required: true}];
30+
//
31+
// This field is deprecated because it does not match the API surface provided by the google auth libraries.
32+
// Control planes should not attempt to override the metadata server URI.
33+
// The cluster and timeout can be configured using the ``cluster`` and ``timeout`` fields instead.
34+
// For backward compatibility, the cluster and timeout configured in this field will be used
35+
// if the new ``cluster`` and ``timeout`` fields are not set.
36+
config.core.v3.HttpUri http_uri = 1
37+
[deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
2838

29-
// Retry policy for fetching tokens. This field is optional.
39+
// Retry policy for fetching tokens.
40+
// Not supported by all data planes.
3041
config.core.v3.RetryPolicy retry_policy = 2;
3142

3243
// Token cache configuration. This field is optional.
3344
TokenCacheConfig cache_config = 3;
3445

3546
// Request header location to extract the token. By default (i.e. if this field is not specified), the token
3647
// is extracted to the Authorization HTTP header, in the format "Authorization: Bearer <token>".
48+
// Not supported by all data planes.
3749
TokenHeader token_header = 4;
50+
51+
// Cluster to send traffic to the GCE metadata server. Not supported
52+
// by all data planes; a data plane may instead have its own mechanism
53+
// for contacting the metadata server.
54+
string cluster = 5;
55+
56+
// Timeout for fetching the tokens from the GCE metadata server.
57+
// Not supported by all data planes.
58+
google.protobuf.Duration timeout = 6 [(validate.rules).duration = {
59+
lt {seconds: 4294967296}
60+
gte {}
61+
}];
3862
}
3963

4064
// Audience is the URL of the receiving service that performs token authentication.

‎xds/third_party/envoy/src/main/proto/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -691,7 +691,7 @@ message HttpConnectionManager {
691691
// information about internal/external addresses.
692692
//
693693
// .. warning::
694-
// In the next release, no IP addresses will be considered trusted. If you have tooling such as probes
694+
// As of Envoy 1.33.0 no IP addresses will be considered trusted. If you have tooling such as probes
695695
// on your private network which need to be treated as trusted (e.g. changing arbitrary x-envoy headers)
696696
// you will have to manually include those addresses or CIDR ranges like:
697697
//

0 commit comments

Comments
 (0)