Stop honoring DESTINATION_GET_* configuration#696
Merged
Conversation
In a5e0b29, we extracted profile resolution so that each component (inbound/outbound/gateway) makes its own filtering decisions. This change does the same for endpoing resolution, moving the bulk of the logic out of `app:dst` and into `app::outbound::resolve`. The `app::dst` module is now only responsible for providing API clients that transparently retry/reconnect. Furthermore, the `...DESTINATION_GET_{SUFFIXES,NETWORKS}` environment variables are no longer honored. Now, endpoints are resolved for all addresses for which a profile lookup is successful. The `Resolve` API has been cleaned up slightly: we no longer rely on the `TryStream` alias (as it causes confusion + boilerplate), instead relying on the more general `Stream`.
Contributor
|
Looks like some tests aren't compiling? |
hawkw
approved these changes
Oct 7, 2020
Contributor
hawkw
left a comment
hawkw
left a comment
There was a problem hiding this comment.
this looks good to me (i'm assuming that the change to not send schemes in Destination.Get requests is expected on the controller side). the refactoring all makes sense.
i wonder if we want to rename the PROFILE_GET_xxx env variables, since they now configure both profile and destination discovery? but, that would require changing the proxy injector etc as well, so we should probably punt on that for the immediate future.
Comment on lines
+8
to
+9
| names: NameMatch, | ||
| nets: IpMatch, |
Comment on lines
+42
to
+45
| map_endpoint::Resolve::new( | ||
| endpoint::FromMetadata, | ||
| RecoverDefault(RequestFilter::new(filter, resolve.into_service())), | ||
| ) |
Contributor
There was a problem hiding this comment.
just a thought: it seems like, theoretically, we could compose a lot of the resolver stuff using a stack rather than a bunch of nested constructors...maybe a future refactor?
Member
Author
There was a problem hiding this comment.
I think stacks are preferable when we have to compose many orthogonal concerns. In this case, I think it's simpler/clearer to just construct the services manually.
Member
Author
Punt for now |
olix0r
added a commit
to linkerd/linkerd2
that referenced
this pull request
Oct 10, 2020
This release overhauls the discovery and routing logic implemented by the proxy: instead of looking at HTTP request metadata for service discovery, the outbound proxy now exclusively use each connection's target IP:PORT. This eager resolution eliminates per-request cache binding; and supports using TrafficSplit with non-HTTP services. This has a few side effects: - The `l5d-dst-override` header is no longer honored. - When the application attempts to connect to a pod IP, the proxy no longer load balances these requests among all pods in the service. The proxy will now honor session-stickiness as selected by an application-level load balancer. - `TrafficSplits` are only applied when a client targets a service's IP. - The proxy no longer performs DNS "canonicalization" to translate relative host header names to a fully-qualified form. --- * Unify RequestFilter and Admit middlewares (linkerd/linkerd2-proxy#692) * Only allow name-based profile discovery for inbound requests (linkerd/linkerd2-proxy#695) * outbound: initial tests for TCP mTLS (with fewer moving parts) (linkerd/linkerd2-proxy#693) * Stop honoring DESTINATION_GET_* configuration (linkerd/linkerd2-proxy#696) * stack: add SwitchReady service (linkerd/linkerd2-proxy#694) * telemetry: Remove trailing comma in build_info labels (linkerd/linkerd2-proxy#699) * Update Rust to 1.47.0 (linkerd/linkerd2-proxy#701)
olix0r
added a commit
to linkerd/linkerd2
that referenced
this pull request
Oct 12, 2020
This release overhauls the discovery and routing logic implemented by the proxy: instead of looking at HTTP request metadata for service discovery, the outbound proxy now exclusively use each connection's target IP:PORT. This eager resolution eliminates per-request cache binding; and supports using TrafficSplit with non-HTTP services. This has a few side effects: - The `l5d-dst-override` header is no longer honored. - When the application attempts to connect to a pod IP, the proxy no longer load balances these requests among all pods in the service. The proxy will now honor session-stickiness as selected by an application-level load balancer. - `TrafficSplits` are only applied when a client targets a service's IP. - The proxy no longer performs DNS "canonicalization" to translate relative host header names to a fully-qualified form. --- * Unify RequestFilter and Admit middlewares (linkerd/linkerd2-proxy#692) * Only allow name-based profile discovery for inbound requests (linkerd/linkerd2-proxy#695) * outbound: initial tests for TCP mTLS (with fewer moving parts) (linkerd/linkerd2-proxy#693) * Stop honoring DESTINATION_GET_* configuration (linkerd/linkerd2-proxy#696) * stack: add SwitchReady service (linkerd/linkerd2-proxy#694) * telemetry: Remove trailing comma in build_info labels (linkerd/linkerd2-proxy#699) * Update Rust to 1.47.0 (linkerd/linkerd2-proxy#701) * cache: Delete benchmarks (linkerd/linkerd2-proxy#705) * outbound: Discover profiles for each unique TCP target (linkerd/linkerd2-proxy#704)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In a5e0b29, we extracted profile resolution so that each component
(inbound/outbound/gateway) makes its own filtering decisions. This
change does the same for endpoing resolution, moving the bulk of the
logic out of
app:dstand intoapp::outbound::resolve.The
app::dstmodule is now only responsible for providing API clientsthat transparently retry/reconnect.
Furthermore, the
...DESTINATION_GET_{SUFFIXES,NETWORKS}environmentvariables are no longer honored. Now, endpoints are resolved for all
addresses for which a profile lookup is successful.
The
ResolveAPI has been cleaned up slightly: we no longer rely on theTryStreamalias (as it causes confusion + boilerplate), instead relyingon the more general
Stream.