diff --git a/.bazelversion b/.bazelversion index 5942a0d3a..df5119ec6 100644 --- a/.bazelversion +++ b/.bazelversion @@ -1 +1 @@ -7.7.1 +8.7.0 diff --git a/.github/renovate.json5 b/.github/renovate.json5 index fe3b1001e..731a9ee1e 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -180,11 +180,11 @@ ], }, { - groupName: 'envoy 1.38.x', + groupName: 'envoy 1.39.x', matchDepNames: [ 'envoyproxy/envoy', ], - allowedVersions: '<=1.38', + allowedVersions: '<=1.39', matchBaseBranches: [ 'main', ], diff --git a/ENVOY_VERSION b/ENVOY_VERSION index 832d9c127..a60aa32ee 100644 --- a/ENVOY_VERSION +++ b/ENVOY_VERSION @@ -1 +1 @@ -envoy-1.38.3 +envoy-1.39.0 diff --git a/WORKSPACE b/WORKSPACE index 6efad5d57..95987d273 100644 --- a/WORKSPACE +++ b/WORKSPACE @@ -12,8 +12,8 @@ ENVOY_REPO = "envoy" # # No other line in this file may have ENVOY_SHA followed by an equals sign! # -# renovate: datasource=github-releases depName=envoyproxy/envoy digestVersion=v1.38.3 -ENVOY_SHA = "0ebfcfe5b0484b89ca85b761da9e05ce75dbda8d" +# renovate: datasource=github-releases depName=envoyproxy/envoy digestVersion=v1.39.0 +ENVOY_SHA = "8eea3285d6bdb89f8ea34632cfe7ce1608a8f374" # // clang-format off: unexpected @bazel_tools reference, please indirect via a definition in //bazel load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository") @@ -34,17 +34,18 @@ local_repository( git_repository( name = "envoy", commit = ENVOY_SHA, - patch_args = ["apply"], - patch_tool = "git", + # Use Bazel's native patch implementation. `patch_tool = "git"` must not be + # used: since Bazel 8, `git_repository` carries a `patch_strip` attribute and + # prepends its `-pN` to `patch_args`, which `git apply` rejects as an unknown + # global option. + patch_strip = 1, patches = [ "@//patches:0001-network-Add-callback-for-upstream-authorization.patch", "@//patches:0002-listener-add-socket-options.patch", "@//patches:0003-original_dst_cluster-Avoid-multiple-hosts-for-the-sa.patch", "@//patches:0004-thread_local-reset-slot-in-worker-threads-first.patch", "@//patches:0005-http-header-expose-attribute.patch", - "@//patches:0006-test-integration-Defer-fake-upstream-read-enable-un.patch", - "@//patches:0007-config-add-grpc-mux-stream-event-callback.patch", - "@//patches:0008-repo-Make-yq-dependency-optional-for-CI-config-parsi.patch", + "@//patches:0006-config-add-grpc-mux-stream-event-callback.patch", ], # // clang-format off: Envoy's format check: Only repository_locations.bzl may contains URL references remote = "https://github.com/envoyproxy/envoy.git", diff --git a/cilium/BUILD b/cilium/BUILD index cc2fac167..f436d7e6a 100644 --- a/cilium/BUILD +++ b/cilium/BUILD @@ -135,6 +135,7 @@ envoy_cc_library( "//cilium:network_policy_lib", "//cilium/api:l7policy_cc_proto", "@envoy//envoy/config:subscription_interface", + "@envoy//envoy/upstream:host_description_interface", "@envoy//source/common/http:utility_lib", "@envoy//source/common/network:upstream_server_name_lib", "@envoy//source/common/network:upstream_subject_alt_names_lib", diff --git a/cilium/accesslog.cc b/cilium/accesslog.cc index 36cd02a01..4b719c5f0 100644 --- a/cilium/accesslog.cc +++ b/cilium/accesslog.cc @@ -65,7 +65,10 @@ void AccessLog::log(AccessLog::Entry& log_entry, ::cilium::EntryType entry_type) // encode protobuf std::string msg; - entry.SerializeToString(&msg); + if (!entry.SerializeToString(&msg)) { + ENVOY_LOG_MISC(warn, "cilium.AccessLog: Failed to serialize log entry, skipping it"); + return; + } UDSClient::log(msg); } diff --git a/cilium/bpf_metadata.cc b/cilium/bpf_metadata.cc index cb0c8817c..fa2f1a9a3 100644 --- a/cilium/bpf_metadata.cc +++ b/cilium/bpf_metadata.cc @@ -8,6 +8,7 @@ #include #include #include +#include #include #include #include @@ -37,7 +38,6 @@ #include "source/common/protobuf/utility.h" #include "absl/strings/string_view.h" -#include "absl/types/optional.h" #include "cilium/api/bpf_metadata.pb.h" #include "cilium/api/bpf_metadata.pb.validate.h" // IWYU pragma: keep #include "cilium/conntrack.h" @@ -397,7 +397,7 @@ const PolicyInstance& Config::getPolicy(const std::string& pod_ip) const { bool Config::exists(const std::string& pod_ip) const { return npmap_->exists(pod_ip); } -absl::optional +std::optional Config::extractSocketMetadata(Network::ConnectionSocket& socket) { Network::Address::InstanceConstSharedPtr src_address = socket.connectionInfoProvider().remoteAddress(); @@ -410,7 +410,7 @@ Config::extractSocketMetadata(Network::ConnectionSocket& socket) { if (!sip || !dip) { ENVOY_LOG(debug, "Non-IP addresses: src: {} dst: {}", src_address->asString(), dst_address->asString()); - return absl::nullopt; + return std::nullopt; } std::string pod_ip, other_ip, ingress_policy_name; @@ -459,7 +459,7 @@ Config::extractSocketMetadata(Network::ConnectionSocket& socket) { "cilium.bpf_metadata (east/west L7 LB): Non-local pod can not use original " "source address: {}", pod_ip); - return absl::nullopt; + return std::nullopt; } // Use original source address with L7 LB for local endpoint sources if requested, as policy // enforcement after the proxy depends on it (i.e., for "east/west" LB). @@ -479,7 +479,7 @@ Config::extractSocketMetadata(Network::ConnectionSocket& socket) { "cilium.bpf_metadata (north/south L7 LB): No local Ingress IP source address configured " "for the family of {}", sip->addressAsString()); - return absl::nullopt; + return std::nullopt; } // Enforce pod policy only for local pods. @@ -502,7 +502,7 @@ Config::extractSocketMetadata(Network::ConnectionSocket& socket) { "cilium.bpf_metadata (north/south L7 LB): Unknown local Ingress IP source address " "configured: {}", ingress_ip->addressAsString()); - return absl::nullopt; + return std::nullopt; } // Original source address is never used for north/south LB @@ -579,13 +579,13 @@ Network::FilterStatus Instance::onAccept(Network::ListenerFilterCallbacks& cb) { const auto policy_fs = socket_metadata->buildCiliumPolicyFilterState(); cb.filterState().setData( Cilium::CiliumPolicyFilterState::key(), policy_fs, - StreamInfo::FilterState::StateType::ReadOnly, StreamInfo::FilterState::LifeSpan::Connection, + StreamInfo::FilterState::LifeSpan::Connection, StreamInfo::StreamSharingMayImpactPooling::SharedWithUpstreamConnection); const auto dest_fs = socket_metadata->buildCiliumDestinationFilterState(); cb.filterState().setData( Cilium::CiliumDestinationFilterState::key(), dest_fs, - StreamInfo::FilterState::StateType::Mutable, StreamInfo::FilterState::LifeSpan::Connection, + StreamInfo::FilterState::LifeSpan::Connection, StreamInfo::StreamSharingMayImpactPooling::SharedWithUpstreamConnection); // Restoring original source address on the upstream socket diff --git a/cilium/bpf_metadata.h b/cilium/bpf_metadata.h index 8ba3c9e5b..918bb6f81 100644 --- a/cilium/bpf_metadata.h +++ b/cilium/bpf_metadata.h @@ -3,6 +3,7 @@ #include #include #include +#include #include #include #include @@ -18,7 +19,6 @@ #include "source/common/common/logger.h" #include "absl/strings/string_view.h" -#include "absl/types/optional.h" #include "cilium/api/bpf_metadata.pb.h" #include "cilium/conntrack.h" #include "cilium/filter_state_cilium_destination.h" @@ -156,7 +156,7 @@ class Config : public Cilium::PolicyResolver, const PolicyInstance& getPolicy(const std::string&) const override; bool exists(const std::string&) const override; - virtual absl::optional extractSocketMetadata(Network::ConnectionSocket& socket); + virtual std::optional extractSocketMetadata(Network::ConnectionSocket& socket); // Possibility to prevent socket options that require // NET_ADMIN privileges from being applied. Used by tests. diff --git a/cilium/grpc_subscription.cc b/cilium/grpc_subscription.cc index 988eb79d8..7c656aaf4 100644 --- a/cilium/grpc_subscription.cc +++ b/cilium/grpc_subscription.cc @@ -5,6 +5,7 @@ #include #include #include +#include #include #include #include @@ -38,7 +39,6 @@ #include "absl/status/statusor.h" #include "absl/strings/match.h" #include "absl/strings/string_view.h" -#include "absl/types/optional.h" namespace Envoy { namespace Cilium { @@ -176,8 +176,8 @@ void ManagedGrpcSubscription::create() { rate_limit_settings_or_error.value(), *scope_, std::move(nop_config_validators), - /*xds_resources_delegate_=*/absl::nullopt, - /*xds_config_tracker_=*/absl::nullopt, + /*xds_resources_delegate_=*/std::nullopt, + /*xds_config_tracker_=*/std::nullopt, std::make_unique( Config::SubscriptionFactory::RetryInitialDelayMs, Config::SubscriptionFactory::RetryMaxDelayMs, context_.api().randomGenerator()), diff --git a/cilium/health_check_sink.cc b/cilium/health_check_sink.cc index de7d78d22..90c68426e 100644 --- a/cilium/health_check_sink.cc +++ b/cilium/health_check_sink.cc @@ -52,7 +52,11 @@ void HealthCheckEventPipeSink::log(envoy::data::core::v3::HealthCheckEvent event return; } std::string msg; - event.SerializeToString(&msg); + if (!event.SerializeToString(&msg)) { + ENVOY_LOG_MISC(warn, "HealthCheckEventPipeSink: failed to serialize event, skipping it: {}", + event.DebugString()); + return; + } uds_client_->log(msg); }; diff --git a/cilium/l7policy.cc b/cilium/l7policy.cc index 6cb49750d..32fd1d35e 100644 --- a/cilium/l7policy.cc +++ b/cilium/l7policy.cc @@ -5,6 +5,7 @@ #include #include #include +#include #include #include @@ -31,7 +32,6 @@ #include "absl/status/statusor.h" #include "absl/strings/string_view.h" -#include "absl/types/optional.h" #include "cilium/accesslog.h" #include "cilium/api/accesslog.pb.h" #include "cilium/api/l7policy.pb.h" @@ -98,7 +98,7 @@ void AccessFilter::onDestroy() {} void AccessFilter::sendLocalError(absl::string_view details) { ENVOY_LOG(warn, details); - callbacks_->sendLocalReply(Http::Code::InternalServerError, "", nullptr, absl::nullopt, + callbacks_->sendLocalReply(Http::Code::InternalServerError, "", nullptr, std::nullopt, StringUtil::replaceAllEmptySpace(details)); } @@ -112,7 +112,6 @@ void AccessFilter::setDecoderFilterCallbacks(Http::StreamDecoderFilterCallbacks& auto log_entry = std::make_unique(); log_entry_ = log_entry.get(); callbacks_->streamInfo().filterState()->setData(AccessLogKey, std::move(log_entry), - StreamInfo::FilterState::StateType::Mutable, StreamInfo::FilterState::LifeSpan::Request); } @@ -202,7 +201,7 @@ Http::FilterHeadersStatus AccessFilter::decodeHeaders(Http::RequestHeaderMap& he if (!allowed) { config_->log(*log_entry_, ::cilium::EntryType::Denied); callbacks_->sendLocalReply(Http::Code::Forbidden, config_->denied_403_body_, nullptr, - absl::nullopt, absl::string_view()); + std::nullopt, absl::string_view()); return Http::FilterHeadersStatus::StopIteration; } @@ -272,7 +271,7 @@ Http::FilterHeadersStatus AccessFilter::decodeHeaders(Http::RequestHeaderMap& he if (!allowed) { config_->log(*log_entry_, ::cilium::EntryType::Denied); callbacks_->sendLocalReply(Http::Code::Forbidden, config_->denied_403_body_, nullptr, - absl::nullopt, absl::string_view()); + std::nullopt, absl::string_view()); return Http::FilterHeadersStatus::StopIteration; } } @@ -288,7 +287,7 @@ Http::FilterHeadersStatus AccessFilter::decodeHeaders(Http::RequestHeaderMap& he if (!allowed) { config_->log(*log_entry_, ::cilium::EntryType::Denied); callbacks_->sendLocalReply(Http::Code::Forbidden, config_->denied_403_body_, nullptr, - absl::nullopt, absl::string_view()); + std::nullopt, absl::string_view()); return Http::FilterHeadersStatus::StopIteration; } } diff --git a/cilium/l7policy.h b/cilium/l7policy.h index c3ff812d0..f1fc356b0 100644 --- a/cilium/l7policy.h +++ b/cilium/l7policy.h @@ -1,6 +1,7 @@ #pragma once #include +#include #include #include "envoy/buffer/buffer.h" @@ -11,11 +12,11 @@ #include "envoy/http/metadata_interface.h" #include "envoy/stats/scope.h" #include "envoy/stats/stats_macros.h" // IWYU pragma: keep +#include "envoy/upstream/host_description.h" #include "source/common/common/logger.h" #include "absl/strings/string_view.h" -#include "absl/types/optional.h" #include "cilium/accesslog.h" #include "cilium/api/accesslog.pb.h" #include "cilium/api/l7policy.pb.h" @@ -72,6 +73,9 @@ class AccessFilter : public Http::StreamFilter, AccessFilter(ConfigSharedPtr& config) : config_(config) {} // UpstreamCallbacks + // Upstream host authorization is enforced by the Cilium network filter via the network-level + // upstream authorization callbacks, so nothing is done here. + void onHostSelected(const Upstream::HostDescriptionConstSharedPtr&) override {} void onUpstreamConnectionEstablished() override; // Http::StreamFilterBase @@ -114,7 +118,7 @@ class AccessFilter : public Http::StreamFilter, AccessLog::Entry* log_entry_ = nullptr; OptRef latched_headers_; - absl::optional latched_end_stream_; + std::optional latched_end_stream_; }; } // namespace Cilium diff --git a/cilium/network_filter.cc b/cilium/network_filter.cc index 201aa65e9..6d3be35ef 100644 --- a/cilium/network_filter.cc +++ b/cilium/network_filter.cc @@ -12,7 +12,6 @@ #include "envoy/registry/registry.h" #include "envoy/server/factory_context.h" #include "envoy/server/filter_config.h" -#include "envoy/stream_info/filter_state.h" #include "envoy/stream_info/stream_info.h" #include "envoy/upstream/host_description.h" @@ -196,12 +195,10 @@ Network::FilterStatus Instance::onNewConnection() { Network::UpstreamSubjectAltNames::key()); if (!have_sni && !have_san) { filter_state->setData(Network::UpstreamServerName::key(), - std::make_unique(sni), - StreamInfo::FilterState::StateType::Mutable); + std::make_unique(sni)); filter_state->setData(Network::UpstreamSubjectAltNames::key(), std::make_unique( - std::vector{std::string(sni)}), - StreamInfo::FilterState::StateType::Mutable); + std::vector{std::string(sni)})); } } diff --git a/cilium/network_policy.cc b/cilium/network_policy.cc index 97ea85ca4..557542858 100644 --- a/cilium/network_policy.cc +++ b/cilium/network_policy.cc @@ -8,6 +8,7 @@ #include #include #include +#include #include #include #include @@ -57,6 +58,7 @@ #include "absl/status/status.h" #include "absl/strings/ascii.h" #include "absl/strings/match.h" +#include "absl/strings/str_join.h" #include "absl/strings/str_replace.h" #include "absl/strings/string_view.h" #include "cilium/accesslog.h" @@ -86,13 +88,18 @@ using RuleVerdict = enum { } // namespace Cilium } // namespace Envoy -namespace fmt { +// Envoy routes ENVOY_LOG() through spdlog, which is built with SPDLOG_USE_STD_FORMAT, so this +// has to be a std::formatter rather than a fmt::formatter. +namespace std { -template <> struct formatter { - constexpr auto parse(fmt::format_parse_context& ctx) { return ctx.begin(); } +// NOLINTNEXTLINE(readability-identifier-naming) +template <> struct formatter { + template constexpr ParseContext::iterator parse(ParseContext& ctx) { + return ctx.begin(); + } - template - auto format(Envoy::Cilium::RuleVerdict verdict, FormatContext& ctx) const { + template + FmtContext::iterator format(Envoy::Cilium::RuleVerdict verdict, FmtContext& ctx) const { absl::string_view name; switch (verdict) { case Envoy::Cilium::RuleVerdict::None: @@ -115,7 +122,7 @@ template <> struct formatter { } }; -} // namespace fmt +} // namespace std namespace Envoy { namespace Cilium { @@ -2086,7 +2093,7 @@ void NetworkPolicyMapImpl::removeInitManager() { warn, "Cilium NetworkPolicyMap parked init manager unexpectedly accumulated targets [{}]{}; " "replacing it before re-installing", - fmt::join(parked_dump.target_names(), ", "), + absl::StrJoin(parked_dump.target_names(), ", "), parked_wrong_state ? fmt::format(" in state {}", static_cast(parked_init_manager_->state())) : ""); diff --git a/cilium/socket_option_cilium_mark.h b/cilium/socket_option_cilium_mark.h index 494d71b00..07106522b 100644 --- a/cilium/socket_option_cilium_mark.h +++ b/cilium/socket_option_cilium_mark.h @@ -1,6 +1,7 @@ #pragma once #include +#include #include #include "envoy/config/core/v3/socket_option.pb.h" @@ -8,8 +9,6 @@ #include "source/common/common/logger.h" -#include "absl/types/optional.h" - namespace Envoy { namespace Cilium { @@ -21,10 +20,10 @@ class CiliumMarkSocketOption : public Network::Socket::Option, public Logger::Loggable { public: CiliumMarkSocketOption(uint32_t mark); - absl::optional + std::optional getOptionDetails(const Network::Socket&, envoy::config::core::v3::SocketOption::SocketState) const override { - return absl::nullopt; + return std::nullopt; } bool setOption(Network::Socket& socket, diff --git a/cilium/socket_option_ip_transparent.h b/cilium/socket_option_ip_transparent.h index 1f54fb9a5..7d0509ea4 100644 --- a/cilium/socket_option_ip_transparent.h +++ b/cilium/socket_option_ip_transparent.h @@ -1,6 +1,7 @@ #pragma once #include +#include #include #include "envoy/config/core/v3/socket_option.pb.h" @@ -8,8 +9,6 @@ #include "source/common/common/logger.h" -#include "absl/types/optional.h" - namespace Envoy { namespace Cilium { @@ -21,10 +20,10 @@ class IpTransparentSocketOption : public Network::Socket::Option, public: IpTransparentSocketOption(); - absl::optional + std::optional getOptionDetails(const Network::Socket&, envoy::config::core::v3::SocketOption::SocketState) const override { - return absl::nullopt; + return std::nullopt; } bool setOption(Network::Socket& socket, diff --git a/cilium/socket_option_source_address.h b/cilium/socket_option_source_address.h index 9a90b465f..2e256f4a3 100644 --- a/cilium/socket_option_source_address.h +++ b/cilium/socket_option_source_address.h @@ -2,6 +2,7 @@ #include #include +#include #include #include "envoy/config/core/v3/socket_option.pb.h" @@ -10,7 +11,6 @@ #include "source/common/common/logger.h" -#include "absl/types/optional.h" #include "cilium/filter_state_cilium_destination.h" #include "cilium/filter_state_cilium_policy.h" @@ -33,10 +33,10 @@ class SourceAddressSocketOption : public Network::Socket::Option, std::shared_ptr dest_fs = nullptr, std::shared_ptr policy_fs = nullptr); - absl::optional + std::optional getOptionDetails(const Network::Socket&, envoy::config::core::v3::SocketOption::SocketState) const override { - return absl::nullopt; + return std::nullopt; } bool setOption(Network::Socket& socket, diff --git a/cilium/tls_wrapper.cc b/cilium/tls_wrapper.cc index 416004c59..091aa8f9a 100644 --- a/cilium/tls_wrapper.cc +++ b/cilium/tls_wrapper.cc @@ -73,9 +73,9 @@ class SslSocketWrapper : public Network::TransportSocket, Logger::LoggablecloseSocket(type); + socket_->closeSocket(type, abort_reset); } } diff --git a/cilium/websocket.cc b/cilium/websocket.cc index c84a2b279..2506fee57 100644 --- a/cilium/websocket.cc +++ b/cilium/websocket.cc @@ -123,11 +123,9 @@ void Instance::initializeReadFilterCallbacks(Network::ReadFilterCallbacks& callb // Tell TcpProxy to not disable read so that we do WebSocket handshake before upstream // connection is established. - // Use Mutable StateType so that tests can have both client and server filters in the same - // filter chain. callbacks_->connection().streamInfo().filterState()->setData( TcpProxy::ReceiveBeforeConnectKey, std::make_unique(true), - StreamInfo::FilterState::StateType::Mutable, StreamInfo::FilterState::LifeSpan::Connection); + StreamInfo::FilterState::LifeSpan::Connection); } Network::FilterStatus Instance::onNewConnection() { diff --git a/cilium/websocket_config.cc b/cilium/websocket_config.cc index 1346e8be2..1a7d1bdb0 100644 --- a/cilium/websocket_config.cc +++ b/cilium/websocket_config.cc @@ -6,6 +6,7 @@ #include #include #include +#include #include #include "envoy/buffer/buffer.h" @@ -60,7 +61,7 @@ Config::Config(Server::Configuration::FactoryContext& context, bool client, handshake_timeout_(std::chrono::seconds(5)), ping_interval_(std::chrono::milliseconds(0)), ping_when_idle_(ping_when_idle), access_log_(nullptr) { envoy::extensions::filters::network::http_connection_manager::v3::RequestIDExtension x_rid_config; - x_rid_config.mutable_typed_config()->PackFrom( + std::ignore = x_rid_config.mutable_typed_config()->PackFrom( envoy::extensions::request_id::uuid::v3::UuidRequestIdConfig()); auto extension_or_error = Http::RequestIDExtensionFactory::fromProto(x_rid_config, context); THROW_IF_NOT_OK_REF(extension_or_error.status()); diff --git a/envoy.bazelrc b/envoy.bazelrc index 8a67880c1..935475d33 100644 --- a/envoy.bazelrc +++ b/envoy.bazelrc @@ -20,6 +20,10 @@ startup --host_jvm_args="-DBAZEL_TRACK_SOURCE_DIRECTORIES=1" ############################################################################# common --noenable_bzlmod +common --enable_workspace +common --noincompatible_disallow_empty_glob +common --noincompatible_disallow_ctx_resolve_tools +common --legacy_external_runfiles fetch --color=yes run --color=yes @@ -32,6 +36,8 @@ build --java_runtime_version=remotejdk_11 build --tool_java_runtime_version=remotejdk_11 build --java_language_version=11 build --tool_java_language_version=11 +# TODO(jwendell): Remove after https://github.com/protocolbuffers/protobuf/issues/20760 is fixed. +build --extra_toolchains=@envoy//bazel:envoy_java_toolchain_definition # silence absl logspam. build --copt=-DABSL_MIN_LOG_LEVEL=4 # Global C++ standard and common warning suppressions @@ -59,7 +65,7 @@ test --test_verbose_timeout_warnings test --experimental_ui_max_stdouterr_bytes=11712829 #default 1048576 # Allow tags to influence execution requirements -common --experimental_allow_tags_propagation +common --incompatible_allow_tags_propagation # Python common --@rules_python//python/config_settings:bootstrap_impl=script diff --git a/envoy_build_config/extensions_build_config.bzl b/envoy_build_config/extensions_build_config.bzl index 60a3431d4..3308a962d 100644 --- a/envoy_build_config/extensions_build_config.bzl +++ b/envoy_build_config/extensions_build_config.bzl @@ -71,11 +71,13 @@ EXTENSIONS = { # "envoy.bootstrap.reverse_tunnel.downstream_socket_interface": "//source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface:reverse_tunnel_initiator_lib", # "envoy.bootstrap.reverse_tunnel.upstream_socket_interface": "//source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface:reverse_tunnel_acceptor_lib", + # "envoy.filters.upstream_network.reverse_tunnel_lifecycle": "//source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface:reverse_tunnel_acceptor_lib", # # Health checkers # + # "envoy.health_checkers.dynamic_modules": "//source/extensions/health_checkers/dynamic_modules:config", "envoy.health_checkers.redis": "//source/extensions/health_checkers/redis:config", "envoy.health_checkers.thrift": "//source/extensions/health_checkers/thrift:config", "envoy.health_checkers.tcp": "//source/extensions/health_checkers/tcp:health_checker_lib", @@ -160,11 +162,13 @@ EXTENSIONS = { # "envoy.filters.http.a2a": "//source/extensions/filters/http/a2a:config", # "envoy.filters.http.adaptive_concurrency": "//source/extensions/filters/http/adaptive_concurrency:config", # "envoy.filters.http.admission_control": "//source/extensions/filters/http/admission_control:config", + # "envoy.filters.http.ai_protocol_manager": "//source/extensions/filters/http/ai_protocol_manager:config", # "envoy.filters.http.alternate_protocols_cache": "//source/extensions/filters/http/alternate_protocols_cache:config", # "envoy.filters.http.api_key_auth": "//source/extensions/filters/http/api_key_auth:config", # "envoy.filters.http.aws_lambda": "//source/extensions/filters/http/aws_lambda:config", # "envoy.filters.http.aws_request_signing": "//source/extensions/filters/http/aws_request_signing:config", # "envoy.filters.http.bandwidth_limit": "//source/extensions/filters/http/bandwidth_limit:config", + # "envoy.filters.http.bandwidth_share": "//source/extensions/filters/http/bandwidth_share:config", "envoy.filters.http.basic_auth": "//source/extensions/filters/http/basic_auth:config", "envoy.filters.http.buffer": "//source/extensions/filters/http/buffer:config", # "envoy.filters.http.cache": "//source/extensions/filters/http/cache:config", @@ -183,6 +187,7 @@ EXTENSIONS = { "envoy.filters.http.ext_proc": "//source/extensions/filters/http/ext_proc:config", # "envoy.filters.http.fault": "//source/extensions/filters/http/fault:config", # "envoy.filters.http.file_server": "//source/extensions/filters/http/file_server:config", + # "envoy.filters.http.filter_chain": "//source/extensions/filters/http/filter_chain:config", # "envoy.filters.http.file_system_buffer": "//source/extensions/filters/http/file_system_buffer:config", # "envoy.filters.http.gcp_authn": "//source/extensions/filters/http/gcp_authn:config", # "envoy.filters.http.geoip": "//source/extensions/filters/http/geoip:config", @@ -215,6 +220,7 @@ EXTENSIONS = { # "envoy.filters.http.proto_api_scrubber": "//source/extensions/filters/http/proto_api_scrubber:config", "envoy.filters.http.ratelimit": "//source/extensions/filters/http/ratelimit:config", "envoy.filters.http.rbac": "//source/extensions/filters/http/rbac:config", + # "envoy.filters.http.upstream_rbac": "//source/extensions/filters/http/upstream_rbac:config", "envoy.filters.http.router": "//source/extensions/filters/http/router:config", "envoy.filters.http.set_filter_state": "//source/extensions/filters/http/set_filter_state:config", "envoy.filters.http.set_metadata": "//source/extensions/filters/http/set_metadata:config", @@ -289,6 +295,7 @@ EXTENSIONS = { "envoy.filters.udp.session.http_capsule": "//source/extensions/filters/udp/udp_proxy/session_filters/http_capsule:config", "envoy.filters.udp.session.dynamic_forward_proxy": "//source/extensions/filters/udp/udp_proxy/session_filters/dynamic_forward_proxy:config", + # "envoy.filters.udp.session.ext_authz": "//source/extensions/filters/udp/udp_proxy/session_filters/ext_authz:config", # # Resource monitors @@ -305,6 +312,7 @@ EXTENSIONS = { # # "envoy.stat_sinks.dog_statsd": "//source/extensions/stat_sinks/dog_statsd:config", + # "envoy.stat_sinks.dynamic_modules": "//source/extensions/stat_sinks/dynamic_modules:config", # "envoy.stat_sinks.graphite_statsd": "//source/extensions/stat_sinks/graphite_statsd:config", # "envoy.stat_sinks.hystrix": "//source/extensions/stat_sinks/hystrix:config", "envoy.stat_sinks.metrics_service": "//source/extensions/stat_sinks/metrics_service:config", @@ -356,6 +364,7 @@ EXTENSIONS = { # # "envoy.transport_sockets.alts": "//source/extensions/transport_sockets/alts:config", + # "envoy.transport_sockets.dynamic_modules": "//source/extensions/transport_sockets/dynamic_modules:config", # "envoy.transport_sockets.http_11_proxy": "//source/extensions/transport_sockets/http_11_proxy:upstream_config", "envoy.transport_sockets.upstream_proxy_protocol": "//source/extensions/transport_sockets/proxy_protocol:upstream_config", "envoy.transport_sockets.raw_buffer": "//source/extensions/transport_sockets/raw_buffer:config", @@ -401,6 +410,7 @@ EXTENSIONS = { # "envoy.upstreams.http.dynamic_modules": "//source/extensions/upstreams/http/dynamic_modules:config", "envoy.upstreams.http.http": "//source/extensions/upstreams/http/http:config", + # "envoy.upstreams.http.reverse_tunnel": "//source/extensions/upstreams/http/reverse_tunnel:config", "envoy.upstreams.http.tcp": "//source/extensions/upstreams/http/tcp:config", "envoy.upstreams.http.udp": "//source/extensions/upstreams/http/udp:config", @@ -509,6 +519,7 @@ EXTENSIONS = { # # "envoy.formatter.cel": "//source/extensions/formatter/cel:config", + # "envoy.formatter.dynamic_modules": "//source/extensions/formatter/dynamic_modules:config", # "envoy.formatter.file_content": "//source/extensions/formatter/file_content:config", # "envoy.formatter.generic_secret": "//source/extensions/formatter/generic_secret:config", # "envoy.formatter.metadata": "//source/extensions/formatter/metadata:config", @@ -546,6 +557,12 @@ EXTENSIONS = { # Hickory DNS resolver extension uses a Rust-based DNS library with support for DoT, DoH, and `DNSSEC`. # "envoy.network.dns_resolver.hickory": "//source/extensions/network/dns_resolver/hickory:config", + # + # Socket interfaces + # + + # "envoy.extensions.network.socket_interface.sockmap": "//source/extensions/network/socket_interface/sockmap:config", + # # Address Resolvers # @@ -580,6 +597,7 @@ EXTENSIONS = { # Load balancing policies for upstream # "envoy.load_balancing_policies.least_request": "//source/extensions/load_balancing_policies/least_request:config", + # "envoy.load_balancing_policies.load_aware_locality": "//source/extensions/load_balancing_policies/load_aware_locality:config", "envoy.load_balancing_policies.random": "//source/extensions/load_balancing_policies/random:config", "envoy.load_balancing_policies.round_robin": "//source/extensions/load_balancing_policies/round_robin:config", "envoy.load_balancing_policies.maglev": "//source/extensions/load_balancing_policies/maglev:config", diff --git a/go/cilium/api/accesslog.pb.go b/go/cilium/api/accesslog.pb.go index 0dd4946ee..ecf71aa83 100644 --- a/go/cilium/api/accesslog.pb.go +++ b/go/cilium/api/accesslog.pb.go @@ -1,7 +1,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 +// protoc-gen-go v1.36.12 +// protoc v7.35.1 // source: cilium/api/accesslog.proto package cilium diff --git a/go/cilium/api/bpf_metadata.pb.go b/go/cilium/api/bpf_metadata.pb.go index 81281988a..fd8edbd42 100644 --- a/go/cilium/api/bpf_metadata.pb.go +++ b/go/cilium/api/bpf_metadata.pb.go @@ -1,7 +1,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 +// protoc-gen-go v1.36.12 +// protoc v7.35.1 // source: cilium/api/bpf_metadata.proto package cilium diff --git a/go/cilium/api/health_check_sink.pb.go b/go/cilium/api/health_check_sink.pb.go index 25312c94b..f040be7d9 100644 --- a/go/cilium/api/health_check_sink.pb.go +++ b/go/cilium/api/health_check_sink.pb.go @@ -1,7 +1,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 +// protoc-gen-go v1.36.12 +// protoc v7.35.1 // source: cilium/api/health_check_sink.proto package cilium diff --git a/go/cilium/api/l7policy.pb.go b/go/cilium/api/l7policy.pb.go index 78ff1e397..bcc170f1d 100644 --- a/go/cilium/api/l7policy.pb.go +++ b/go/cilium/api/l7policy.pb.go @@ -1,7 +1,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 +// protoc-gen-go v1.36.12 +// protoc v7.35.1 // source: cilium/api/l7policy.proto package cilium diff --git a/go/cilium/api/network_filter.pb.go b/go/cilium/api/network_filter.pb.go index 7ef0a00d0..74f594c08 100644 --- a/go/cilium/api/network_filter.pb.go +++ b/go/cilium/api/network_filter.pb.go @@ -1,7 +1,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 +// protoc-gen-go v1.36.12 +// protoc v7.35.1 // source: cilium/api/network_filter.proto package cilium diff --git a/go/cilium/api/npds.pb.go b/go/cilium/api/npds.pb.go index 5fad4195e..5e620550e 100644 --- a/go/cilium/api/npds.pb.go +++ b/go/cilium/api/npds.pb.go @@ -1,7 +1,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 +// protoc-gen-go v1.36.12 +// protoc v7.35.1 // source: cilium/api/npds.proto package cilium diff --git a/go/cilium/api/npds_grpc.pb.go b/go/cilium/api/npds_grpc.pb.go index 98ee186bf..fcad83429 100644 --- a/go/cilium/api/npds_grpc.pb.go +++ b/go/cilium/api/npds_grpc.pb.go @@ -1,7 +1,7 @@ // Code generated by protoc-gen-go-grpc. DO NOT EDIT. // versions: // - protoc-gen-go-grpc v1.6.2 -// - protoc v6.33.2 +// - protoc v7.35.1 // source: cilium/api/npds.proto package cilium diff --git a/go/cilium/api/nphds.pb.go b/go/cilium/api/nphds.pb.go index c05898ac0..25a3707e5 100644 --- a/go/cilium/api/nphds.pb.go +++ b/go/cilium/api/nphds.pb.go @@ -1,7 +1,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 +// protoc-gen-go v1.36.12 +// protoc v7.35.1 // source: cilium/api/nphds.proto package cilium diff --git a/go/cilium/api/nphds_grpc.pb.go b/go/cilium/api/nphds_grpc.pb.go index 63cd6c3fa..068003bc3 100644 --- a/go/cilium/api/nphds_grpc.pb.go +++ b/go/cilium/api/nphds_grpc.pb.go @@ -1,7 +1,7 @@ // Code generated by protoc-gen-go-grpc. DO NOT EDIT. // versions: // - protoc-gen-go-grpc v1.6.2 -// - protoc v6.33.2 +// - protoc v7.35.1 // source: cilium/api/nphds.proto package cilium diff --git a/go/cilium/api/tls_wrapper.pb.go b/go/cilium/api/tls_wrapper.pb.go index 7d8aa9f91..bbdd9c040 100644 --- a/go/cilium/api/tls_wrapper.pb.go +++ b/go/cilium/api/tls_wrapper.pb.go @@ -1,7 +1,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 +// protoc-gen-go v1.36.12 +// protoc v7.35.1 // source: cilium/api/tls_wrapper.proto package cilium diff --git a/go/cilium/api/websocket.pb.go b/go/cilium/api/websocket.pb.go index b391a530d..5f4cf6992 100644 --- a/go/cilium/api/websocket.pb.go +++ b/go/cilium/api/websocket.pb.go @@ -1,7 +1,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.11 -// protoc v6.33.2 +// protoc-gen-go v1.36.12 +// protoc v7.35.1 // source: cilium/api/websocket.proto package cilium diff --git a/patches/0001-network-Add-callback-for-upstream-authorization.patch b/patches/0001-network-Add-callback-for-upstream-authorization.patch index 18b911ee3..22307a170 100644 --- a/patches/0001-network-Add-callback-for-upstream-authorization.patch +++ b/patches/0001-network-Add-callback-for-upstream-authorization.patch @@ -1,7 +1,7 @@ -From 1c0419f207d59b764dca10e7f127efa3390d84f2 Mon Sep 17 00:00:00 2001 +From 4044a8fd8a2552319be18e04f88d78d69d1ca791 Mon Sep 17 00:00:00 2001 From: Jarno Rajahalme Date: Mon, 5 May 2025 11:15:52 +1000 -Subject: [PATCH 1/7] network: Add callback for upstream authorization +Subject: [PATCH 1/6] network: Add callback for upstream authorization Add new ReadFilterCallbacks addUpstreamCallback() and iterateUpstreamCallbacks(). Network filters can add callbacks using @@ -42,10 +42,10 @@ Signed-off-by: Jarno Rajahalme 15 files changed, 124 insertions(+) diff --git a/envoy/http/filter.h b/envoy/http/filter.h -index ef4d2aa7..90aab6b6 100644 +index e14eaef745..af5859fc02 100644 --- a/envoy/http/filter.h +++ b/envoy/http/filter.h -@@ -858,6 +858,14 @@ public: +@@ -915,6 +915,14 @@ public: virtual OptRef upstreamOverrideHost() const PURE; @@ -61,7 +61,7 @@ index ef4d2aa7..90aab6b6 100644 * @return true if the filter should shed load based on the system pressure, typically memory. */ diff --git a/envoy/network/filter.h b/envoy/network/filter.h -index a863eae8..75289a9a 100644 +index 494a60ca82..d61c948092 100644 --- a/envoy/network/filter.h +++ b/envoy/network/filter.h @@ -161,6 +161,22 @@ public: @@ -107,7 +107,7 @@ index a863eae8..75289a9a 100644 * Control the filter close status for read filters. * diff --git a/envoy/tcp/upstream.h b/envoy/tcp/upstream.h -index 78ba8b8c..1daa0e1f 100644 +index 78ba8b8c6a..1daa0e1fa9 100644 --- a/envoy/tcp/upstream.h +++ b/envoy/tcp/upstream.h @@ -84,6 +84,11 @@ public: @@ -123,10 +123,10 @@ index 78ba8b8c..1daa0e1f 100644 // An API for the UpstreamRequest to get callbacks from either an HTTP or TCP diff --git a/source/common/http/async_client_impl.h b/source/common/http/async_client_impl.h -index f73c462c..7bf49e95 100644 +index 6ce7b2d9c5..fd76fa1c3e 100644 --- a/source/common/http/async_client_impl.h +++ b/source/common/http/async_client_impl.h -@@ -293,6 +293,11 @@ private: +@@ -295,6 +295,11 @@ private: ResponseHeaderMapOptRef responseHeaders() override { return {}; } ResponseTrailerMapOptRef responseTrailers() override { return {}; } @@ -139,13 +139,13 @@ index f73c462c..7bf49e95 100644 void dumpState(std::ostream& os, int indent_level) const override { const char* spaces = spacesForLevel(indent_level); diff --git a/source/common/http/conn_manager_impl.h b/source/common/http/conn_manager_impl.h -index 0077c748..65fc1779 100644 +index 564f2f544b..6e26574091 100644 --- a/source/common/http/conn_manager_impl.h +++ b/source/common/http/conn_manager_impl.h -@@ -336,6 +336,12 @@ private: +@@ -343,6 +343,12 @@ private: } - absl::optional routeConfig(); + std::optional routeConfig(); + + bool iterateUpstreamCallbacks(Upstream::HostDescriptionConstSharedPtr host, + StreamInfo::StreamInfo& stream_info) const override { @@ -156,10 +156,10 @@ index 0077c748..65fc1779 100644 // Updates the snapped_route_config_ (by reselecting scoped route configuration), if a scope is diff --git a/source/common/http/filter_manager.cc b/source/common/http/filter_manager.cc -index 67b746f4..20dccfbc 100644 +index 170629b1be..5861b15c28 100644 --- a/source/common/http/filter_manager.cc +++ b/source/common/http/filter_manager.cc -@@ -2009,5 +2009,10 @@ ActiveStreamDecoderFilter::upstreamOverrideHost() const { +@@ -2048,5 +2048,10 @@ ActiveStreamDecoderFilter::upstreamOverrideHost() const { return parent_.upstream_override_host_; } @@ -171,10 +171,10 @@ index 67b746f4..20dccfbc 100644 } // namespace Http } // namespace Envoy diff --git a/source/common/http/filter_manager.h b/source/common/http/filter_manager.h -index a8670d67..93f796ba 100644 +index f52948b8b5..7ade3fddd7 100644 --- a/source/common/http/filter_manager.h +++ b/source/common/http/filter_manager.h -@@ -303,6 +303,8 @@ struct ActiveStreamDecoderFilter : public ActiveStreamFilterBase, +@@ -310,6 +310,8 @@ struct ActiveStreamDecoderFilter : public ActiveStreamFilterBase, void setUpstreamOverrideHost(Upstream::LoadBalancerContext::OverrideHost) override; OptRef upstreamOverrideHost() const override; bool shouldLoadShed() const override; @@ -183,7 +183,7 @@ index a8670d67..93f796ba 100644 void sendGoAwayAndClose(bool graceful = false) override; // Each decoder filter instance checks if the request passed to the filter is gRPC -@@ -592,6 +594,12 @@ public: +@@ -606,6 +608,12 @@ public: * This is used for HTTP/1.1 codec. */ virtual bool isHalfCloseEnabled() PURE; @@ -197,7 +197,7 @@ index a8670d67..93f796ba 100644 /** diff --git a/source/common/network/filter_manager_impl.h b/source/common/network/filter_manager_impl.h -index fff3f2ee..6dc2f867 100644 +index e2923755fd..d879a6e8f8 100644 --- a/source/common/network/filter_manager_impl.h +++ b/source/common/network/filter_manager_impl.h @@ -172,6 +172,13 @@ private: @@ -236,10 +236,10 @@ index fff3f2ee..6dc2f867 100644 const ConnectionSocket& socket_; Upstream::HostDescriptionConstSharedPtr host_description_; diff --git a/source/common/router/router.cc b/source/common/router/router.cc -index cb61c97f..e8d185fb 100644 +index 452f578665..bd6ccea120 100644 --- a/source/common/router/router.cc +++ b/source/common/router/router.cc -@@ -810,6 +810,14 @@ bool Filter::continueDecodeHeaders(Upstream::ThreadLocalCluster* cluster, +@@ -810,6 +810,14 @@ bool Filter::continueDecodeHeaders(Http::RequestHeaderMap& headers, bool end_str return false; } @@ -255,10 +255,10 @@ index cb61c97f..e8d185fb 100644 const Http::HeaderEntry* header_max_stream_duration_entry = headers.EnvoyUpstreamStreamDurationMs(); diff --git a/source/common/router/upstream_request.h b/source/common/router/upstream_request.h -index 8b095cd7..cecdacb7 100644 +index 3c3093ebc4..fb6698ddec 100644 --- a/source/common/router/upstream_request.h +++ b/source/common/router/upstream_request.h -@@ -355,6 +355,11 @@ public: +@@ -360,6 +360,11 @@ public: } OptRef upstreamCallbacks() override { return {*this}; } @@ -269,12 +269,12 @@ index 8b095cd7..cecdacb7 100644 + // Http::UpstreamStreamFilterCallbacks StreamInfo::StreamInfo& upstreamStreamInfo() override { return upstream_request_.streamInfo(); } - OptRef upstream() override { + OptRef downstreamWebTransportSession() override; diff --git a/source/common/tcp_proxy/tcp_proxy.cc b/source/common/tcp_proxy/tcp_proxy.cc -index 9b4597b1..67669507 100644 +index 36101861b5..baa76e24bd 100644 --- a/source/common/tcp_proxy/tcp_proxy.cc +++ b/source/common/tcp_proxy/tcp_proxy.cc -@@ -838,6 +838,13 @@ bool Filter::maybeTunnel(Upstream::ThreadLocalCluster& cluster) { +@@ -850,6 +850,13 @@ bool Filter::maybeTunnel(Upstream::ThreadLocalCluster& cluster) { upstream_decoder_filter_callbacks_, getStreamInfo()); } if (generic_conn_pool_) { @@ -289,10 +289,10 @@ index 9b4597b1..67669507 100644 connect_attempts_++; getStreamInfo().setAttemptCount(connect_attempts_); diff --git a/source/common/tcp_proxy/tcp_proxy.h b/source/common/tcp_proxy/tcp_proxy.h -index f6c82791..3b8267cd 100644 +index 7e2be743e0..ac99d09c75 100644 --- a/source/common/tcp_proxy/tcp_proxy.h +++ b/source/common/tcp_proxy/tcp_proxy.h -@@ -624,6 +624,10 @@ public: +@@ -634,6 +634,10 @@ public: return {}; } bool shouldLoadShed() const override { return false; } @@ -303,7 +303,7 @@ index f6c82791..3b8267cd 100644 void restoreContextOnContinue(ScopeTrackedObjectStack& tracked_object_stack) override { tracked_object_stack.add(*this); } -@@ -667,6 +671,7 @@ protected: +@@ -677,6 +681,7 @@ protected: NoHealthyUpstream, ResourceLimitExceeded, NoRoute, @@ -312,10 +312,10 @@ index f6c82791..3b8267cd 100644 // Callbacks for different error and success states during connection establishment diff --git a/source/common/tcp_proxy/upstream.cc b/source/common/tcp_proxy/upstream.cc -index ba48851e..0fb7be95 100644 +index b4010cf850..298e9f6e11 100644 --- a/source/common/tcp_proxy/upstream.cc +++ b/source/common/tcp_proxy/upstream.cc -@@ -341,6 +341,10 @@ void TcpConnPool::newStream(GenericConnectionPoolCallbacks& callbacks) { +@@ -345,6 +345,10 @@ void TcpConnPool::newStream(GenericConnectionPoolCallbacks& callbacks) { } } @@ -326,7 +326,7 @@ index ba48851e..0fb7be95 100644 void TcpConnPool::onPoolFailure(ConnectionPool::PoolFailureReason reason, absl::string_view failure_reason, Upstream::HostDescriptionConstSharedPtr host) { -@@ -447,6 +451,10 @@ void HttpConnPool::newStream(GenericConnectionPoolCallbacks& callbacks) { +@@ -451,6 +455,10 @@ void HttpConnPool::newStream(GenericConnectionPoolCallbacks& callbacks) { } } @@ -338,10 +338,10 @@ index ba48851e..0fb7be95 100644 absl::string_view failure_reason, Upstream::HostDescriptionConstSharedPtr host) { diff --git a/source/common/tcp_proxy/upstream.h b/source/common/tcp_proxy/upstream.h -index a9b05aaf..53cccdaa 100644 +index efce490a68..40aecea00a 100644 --- a/source/common/tcp_proxy/upstream.h +++ b/source/common/tcp_proxy/upstream.h -@@ -41,6 +41,7 @@ public: +@@ -42,6 +42,7 @@ public: // GenericConnPool void newStream(GenericConnectionPoolCallbacks& callbacks) override; @@ -349,7 +349,7 @@ index a9b05aaf..53cccdaa 100644 // Tcp::ConnectionPool::Callbacks void onPoolFailure(ConnectionPool::PoolFailureReason reason, -@@ -98,6 +99,7 @@ public: +@@ -99,6 +100,7 @@ public: // GenericConnPool void newStream(GenericConnectionPoolCallbacks& callbacks) override; @@ -358,7 +358,7 @@ index a9b05aaf..53cccdaa 100644 // Http::ConnectionPool::Callbacks, void onPoolFailure(ConnectionPool::PoolFailureReason reason, diff --git a/source/extensions/api_listeners/default_api_listener/api_listener_impl.h b/source/extensions/api_listeners/default_api_listener/api_listener_impl.h -index 918016a2..94ffa509 100644 +index 415670d67c..8c807f9d5b 100644 --- a/source/extensions/api_listeners/default_api_listener/api_listener_impl.h +++ b/source/extensions/api_listeners/default_api_listener/api_listener_impl.h @@ -81,6 +81,9 @@ protected: @@ -372,5 +372,5 @@ index 918016a2..94ffa509 100644 // Synthetic class that acts as a stub for the connection backing the // Network::ReadFilterCallbacks. -- -2.54.0 +2.55.0 diff --git a/patches/0002-listener-add-socket-options.patch b/patches/0002-listener-add-socket-options.patch index 2d0c6dcc1..aac653815 100644 --- a/patches/0002-listener-add-socket-options.patch +++ b/patches/0002-listener-add-socket-options.patch @@ -1,43 +1,41 @@ -From b25eed7816bed2a99a5d9b6a29b89cf532081025 Mon Sep 17 00:00:00 2001 +From 7eca64c432be0a808baaf9e6261eb41372a17926 Mon Sep 17 00:00:00 2001 From: Jarno Rajahalme Date: Mon, 14 Aug 2023 10:01:21 +0300 -Subject: [PATCH 2/7] listener: add socket options +Subject: [PATCH 2/6] listener: add socket options This reverts commit 170c89eb0b2afb7a39d44d0f8dfb77444ffc038f. Signed-off-by: Jarno Rajahalme --- - envoy/server/factory_context.h | 8 +++++++- + envoy/server/factory_context.h | 5 +++++ source/common/listener_manager/listener_impl.cc | 3 +++ source/common/listener_manager/listener_impl.h | 9 +++++++++ + source/server/factory_context_impl.h | 8 ++++++++ test/mocks/server/factory_context.h | 1 + test/mocks/server/listener_factory_context.h | 1 + - 5 files changed, 21 insertions(+), 1 deletion(-) + 6 files changed, 27 insertions(+) diff --git a/envoy/server/factory_context.h b/envoy/server/factory_context.h -index ee9fa056..d6b8c7e0 100644 +index e9fcd320fe..a11f7d8730 100644 --- a/envoy/server/factory_context.h +++ b/envoy/server/factory_context.h -@@ -341,7 +341,13 @@ public: - * An implementation of FactoryContext. The life time should cover the lifetime of the filter chains - * and connections. It can be used to create ListenerFilterChain. - */ --class ListenerFactoryContext : public virtual FactoryContext {}; -+class ListenerFactoryContext : public virtual FactoryContext { -+public: +@@ -363,6 +363,11 @@ public: + * @return ListenerInfo description of the listener. + */ + virtual const Network::ListenerInfo& listenerInfo() const PURE; ++ + /** + * Store socket options to be set on the listen socket before listening. + */ + virtual void addListenSocketOptions(const Network::Socket::OptionsSharedPtr& options) PURE; -+}; + }; /** - * FactoryContext for ProtocolOptionsFactory. diff --git a/source/common/listener_manager/listener_impl.cc b/source/common/listener_manager/listener_impl.cc -index 8883d241..74f42afe 100644 +index 82ebb4590e..74db624f77 100644 --- a/source/common/listener_manager/listener_impl.cc +++ b/source/common/listener_manager/listener_impl.cc -@@ -1007,6 +1007,9 @@ Configuration::ServerFactoryContext& PerListenerFactoryContextImpl::serverFactor +@@ -1056,6 +1056,9 @@ Stats::Scope& PerListenerFactoryContextImpl::prefixedScope() { Stats::Scope& PerListenerFactoryContextImpl::listenerScope() { return listener_factory_context_base_->listenerScope(); } @@ -48,11 +46,11 @@ index 8883d241..74f42afe 100644 bool ListenerImpl::createNetworkFilterChain( diff --git a/source/common/listener_manager/listener_impl.h b/source/common/listener_manager/listener_impl.h -index 416728bd..757886c2 100644 +index 4e89f24cde..f5d5ad06dd 100644 --- a/source/common/listener_manager/listener_impl.h +++ b/source/common/listener_manager/listener_impl.h -@@ -187,6 +187,8 @@ public: - +@@ -191,6 +191,8 @@ public: + Stats::Scope& prefixedScope() override; Stats::Scope& listenerScope() override; + void addListenSocketOptions(const Network::Socket::OptionsSharedPtr& options) override; @@ -60,7 +58,7 @@ index 416728bd..757886c2 100644 ListenerFactoryContextBaseImpl& parentFactoryContext() { return *listener_factory_context_base_; } friend class ListenerImpl; -@@ -337,6 +339,13 @@ public: +@@ -341,6 +343,13 @@ public: return listener_factory_context_->listener_factory_context_base_->listener_info_; } @@ -74,12 +72,38 @@ index 416728bd..757886c2 100644 void ensureSocketOptions(Network::Socket::OptionsSharedPtr& options) { if (options == nullptr) { options = std::make_shared>(); +diff --git a/source/server/factory_context_impl.h b/source/server/factory_context_impl.h +index 085f10e34b..ee0098f7ee 100644 +--- a/source/server/factory_context_impl.h ++++ b/source/server/factory_context_impl.h +@@ -3,6 +3,7 @@ + #include "envoy/server/factory_context.h" + #include "envoy/server/instance.h" + ++#include "source/common/common/assert.h" + #include "source/common/config/metadata.h" + + namespace Envoy { +@@ -27,6 +28,13 @@ public: + Stats::Scope& prefixedScope() override; + Stats::Scope& listenerScope() override; + ++ // Configuration::ListenerFactoryContext ++ // These contexts are not tied to a listen socket, so adding listen socket options is not ++ // supported. PerListenerFactoryContextImpl overrides this to forward to its ListenerImpl. ++ void addListenSocketOptions(const Network::Socket::OptionsSharedPtr&) override { ++ IS_ENVOY_BUG("Unexpected function call"); ++ } ++ + protected: + Server::Instance& server_; + ProtobufMessage::ValidationVisitor& validation_visitor_; diff --git a/test/mocks/server/factory_context.h b/test/mocks/server/factory_context.h -index 9fe92ab4..e36fdff5 100644 +index 1d2c8bb633..6fc365a905 100644 --- a/test/mocks/server/factory_context.h +++ b/test/mocks/server/factory_context.h -@@ -31,6 +31,7 @@ public: - MOCK_METHOD(const Network::DrainDecision&, drainDecision, ()); +@@ -38,6 +38,7 @@ public: + // Server::Configuration::ListenerFactoryContext MOCK_METHOD(Stats::Scope&, listenerScope, ()); MOCK_METHOD(const Network::ListenerInfo&, listenerInfo, (), (const)); + MOCK_METHOD(void, addListenSocketOptions, (const Network::Socket::OptionsSharedPtr&)); @@ -87,7 +111,7 @@ index 9fe92ab4..e36fdff5 100644 testing::NiceMock server_factory_context_; testing::NiceMock init_manager_; diff --git a/test/mocks/server/listener_factory_context.h b/test/mocks/server/listener_factory_context.h -index 8b2de57e..1fd30eaf 100644 +index cf2d40afac..ca3051a159 100644 --- a/test/mocks/server/listener_factory_context.h +++ b/test/mocks/server/listener_factory_context.h @@ -22,6 +22,7 @@ public: @@ -99,5 +123,5 @@ index 8b2de57e..1fd30eaf 100644 MOCK_METHOD(const Network::DrainDecision&, drainDecision, ()); MOCK_METHOD(Init::Manager&, initManager, ()); -- -2.54.0 +2.55.0 diff --git a/patches/0003-original_dst_cluster-Avoid-multiple-hosts-for-the-sa.patch b/patches/0003-original_dst_cluster-Avoid-multiple-hosts-for-the-sa.patch index 670095537..dc7ffac67 100644 --- a/patches/0003-original_dst_cluster-Avoid-multiple-hosts-for-the-sa.patch +++ b/patches/0003-original_dst_cluster-Avoid-multiple-hosts-for-the-sa.patch @@ -1,7 +1,7 @@ -From 435f56e14770f787d97b91c568b93eecb9206056 Mon Sep 17 00:00:00 2001 +From c560662bfd12e46100972f8c94741d810c04aadf Mon Sep 17 00:00:00 2001 From: Jarno Rajahalme Date: Fri, 24 May 2024 18:27:28 +0200 -Subject: [PATCH 3/7] original_dst_cluster: Avoid multiple hosts for the same +Subject: [PATCH 3/6] original_dst_cluster: Avoid multiple hosts for the same address Connection pool containers use HostSharedPtr as map keys, rather than the @@ -25,12 +25,12 @@ map updates. Signed-off-by: Jarno Rajahalme --- - .../original_dst/original_dst_cluster.cc | 259 +++++++++++------- - .../original_dst/original_dst_cluster.h | 47 ++-- - 2 files changed, 191 insertions(+), 115 deletions(-) + .../original_dst/original_dst_cluster.cc | 293 +++++++++++------- + .../original_dst/original_dst_cluster.h | 47 +-- + 2 files changed, 208 insertions(+), 132 deletions(-) diff --git a/source/extensions/clusters/original_dst/original_dst_cluster.cc b/source/extensions/clusters/original_dst/original_dst_cluster.cc -index 25362925..c8063ed8 100644 +index d8ef2862b1..5a8c3e2820 100644 --- a/source/extensions/clusters/original_dst/original_dst_cluster.cc +++ b/source/extensions/clusters/original_dst/original_dst_cluster.cc @@ -29,6 +29,19 @@ OriginalDstClusterHandle::~OriginalDstClusterHandle() { @@ -99,16 +99,16 @@ index 25362925..c8063ed8 100644 } } // TODO(ramaraochavali): add a stat and move this log line to debug. -@@ -198,7 +178,7 @@ OriginalDstCluster::OriginalDstCluster(const envoy::config::cluster::v3::Cluster +@@ -199,7 +179,7 @@ OriginalDstCluster::OriginalDstCluster( cleanup_interval_ms_( std::chrono::milliseconds(PROTOBUF_GET_MS_OR_DEFAULT(config, cleanup_interval, 5000))), cleanup_timer_(dispatcher_.createTimer([this]() -> void { cleanup(); })), - host_map_(std::make_shared()) { + host_map_(std::make_shared()), updates_map_(std::make_unique()) { - if (config.has_original_dst_lb_config()) { - const auto& lb_config = config.original_dst_lb_config(); - if (lb_config.use_http_header()) { -@@ -216,47 +196,146 @@ OriginalDstCluster::OriginalDstCluster(const envoy::config::cluster::v3::Cluster + if (original_dst_config.use_http_header()) { + http_header_name_ = original_dst_config.http_header_name().empty() + ? Http::Headers::get().EnvoyOriginalDstHost +@@ -214,30 +194,127 @@ OriginalDstCluster::OriginalDstCluster( cleanup_timer_->enableTimer(cleanup_interval_ms_); } @@ -144,9 +144,7 @@ index 25362925..c8063ed8 100644 + if (dst_ip == nullptr) { + ENVOY_LOG(debug, "Cannot create host for non-IP address {}.", address); + return nullptr; - } -- ENVOY_LOG(debug, "addHost() adding {} {}.", *host, address); -- setHostMap(new_host_map); ++ } + + // Scope the lock for reading the host_map_ + { @@ -211,7 +209,7 @@ index 25362925..c8063ed8 100644 + return host; +} + -+// updateHosts updates the host map and the priotiry sets of the cluster. ++// updateHosts updates the host map and the priority sets of the cluster. +void OriginalDstCluster::updateHosts() { + ASSERT_IS_MAIN_OR_TEST_THREAD(); + @@ -220,7 +218,6 @@ index 25362925..c8063ed8 100644 + auto new_host_map = std::make_shared(*getHostMap()); + auto empty_map = std::make_unique(); + HostVector new_hosts; -+ new_hosts.reserve(4); // try avoid allocation while holding locks below + + // Consolidate updates into the new host map + // Loadbalancers can not add any updates while we keep these locks, so keep this short! @@ -242,20 +239,33 @@ index 25362925..c8063ed8 100644 + // Make available for load balancers + host_map_ = new_host_map; + updates_map_.swap(empty_map); -+ } + } +- ENVOY_LOG(debug, "addHost() adding {} {}.", *host, address); +- setHostMap(new_host_map); -- // Given the current config, only EDS clusters support multiple priorities. + // Given the current config, only EDS clusters support multiple priorities. ASSERT(priority_set_.hostSetsPerPriority().size() == 1); const auto& first_host_set = priority_set_.getOrCreateHostSet(0); HostVectorSharedPtr all_hosts(new HostVector(first_host_set.hosts())); - all_hosts->emplace_back(host); -+ for (auto host : new_hosts) { ++ for (const auto& host : new_hosts) { + all_hosts->emplace_back(host); + } - priority_set_.updateHosts(0, - HostSetImpl::partitionHosts(all_hosts, HostsPerLocalityImpl::empty()), -- {}, {std::move(host)}, {}, absl::nullopt, absl::nullopt); -+ {}, {std::move(new_hosts)}, {}, absl::nullopt, absl::nullopt); + if (Runtime::runtimeFeatureEnabled( + "envoy.reloadable_features.skip_partition_original_dst_hosts")) { + // OriginalDstCluster::LoadBalancer selects the exact destination address from host_map_ and +@@ -252,26 +329,28 @@ void OriginalDstCluster::addHost(HostSharedPtr& host) { + std::move(healthy_hosts), HostsPerLocalityImpl::empty(), + std::move(degraded_hosts), HostsPerLocalityImpl::empty(), + std::move(excluded_hosts), HostsPerLocalityImpl::empty()), +- {}, {std::move(host)}, {}, std::nullopt, std::nullopt); ++ {}, {std::move(new_hosts)}, {}, std::nullopt, std::nullopt); + } else { + priority_set_.updateHosts(0, + HostSetImpl::partitionHosts(all_hosts, HostsPerLocalityImpl::empty()), +- {}, {std::move(host)}, {}, std::nullopt, std::nullopt); ++ {}, {std::move(new_hosts)}, {}, std::nullopt, std::nullopt); + } } void OriginalDstCluster::cleanup() { @@ -283,7 +293,7 @@ index 25362925..c8063ed8 100644 // // Using the used_ bit is preserved for backwards compatibility and to // add a delay between load balancers choosing a host and grabbing a -@@ -271,49 +350,41 @@ void OriginalDstCluster::cleanup() { +@@ -286,65 +365,57 @@ void OriginalDstCluster::cleanup() { // 3) will not delete h since it takes at least one cleanup_interval for // the host to set used_ bit for h to false. bool keep = false; @@ -331,6 +341,27 @@ index 25362925..c8063ed8 100644 - HostMultiMapSharedPtr new_host_map = std::make_shared(*host_map); - for (const auto& addr : removed_addresses) { - new_host_map->erase(addr); +- } +- setHostMap(new_host_map); +- if (Runtime::runtimeFeatureEnabled( +- "envoy.reloadable_features.skip_partition_original_dst_hosts")) { +- // OriginalDstCluster::LoadBalancer selects the exact destination address from host_map_ and +- // does not consult HostSet health partitions. Preserve all hosts in healthy_hosts so that +- // host set updates expose the complete routable destination set. +- auto healthy_hosts = std::make_shared(*keeping_hosts); +- auto degraded_hosts = std::make_shared(); +- auto excluded_hosts = std::make_shared(); +- priority_set_.updateHosts( +- 0, +- HostSetImpl::updateHostsParams(std::move(keeping_hosts), HostsPerLocalityImpl::empty(), +- std::move(healthy_hosts), HostsPerLocalityImpl::empty(), +- std::move(degraded_hosts), HostsPerLocalityImpl::empty(), +- std::move(excluded_hosts), HostsPerLocalityImpl::empty()), +- {}, {}, to_be_removed, false, std::nullopt); +- } else { +- priority_set_.updateHosts( +- 0, HostSetImpl::partitionHosts(keeping_hosts, HostsPerLocalityImpl::empty()), {}, {}, +- to_be_removed, false, std::nullopt); + + if (!to_be_removed.empty()) { + auto new_host_map = std::make_shared(); @@ -343,22 +374,34 @@ index 25362925..c8063ed8 100644 + + setHostMap(new_host_map); + -+ priority_set_.updateHosts( -+ 0, HostSetImpl::partitionHosts(keeping_hosts, HostsPerLocalityImpl::empty()), {}, {}, -+ to_be_removed, false, absl::nullopt); ++ if (Runtime::runtimeFeatureEnabled( ++ "envoy.reloadable_features.skip_partition_original_dst_hosts")) { ++ // OriginalDstCluster::LoadBalancer selects the exact destination address from host_map_ and ++ // does not consult HostSet health partitions. Preserve all hosts in healthy_hosts so that ++ // host set updates expose the complete routable destination set. ++ auto healthy_hosts = std::make_shared(*keeping_hosts); ++ auto degraded_hosts = std::make_shared(); ++ auto excluded_hosts = std::make_shared(); ++ priority_set_.updateHosts( ++ 0, ++ HostSetImpl::updateHostsParams(std::move(keeping_hosts), HostsPerLocalityImpl::empty(), ++ std::move(healthy_hosts), HostsPerLocalityImpl::empty(), ++ std::move(degraded_hosts), HostsPerLocalityImpl::empty(), ++ std::move(excluded_hosts), HostsPerLocalityImpl::empty()), ++ {}, {}, to_be_removed, false, std::nullopt); ++ } else { ++ priority_set_.updateHosts( ++ 0, HostSetImpl::partitionHosts(keeping_hosts, HostsPerLocalityImpl::empty()), {}, {}, ++ to_be_removed, false, std::nullopt); ++ } } -- setHostMap(new_host_map); -- priority_set_.updateHosts( -- 0, HostSetImpl::partitionHosts(keeping_hosts, HostsPerLocalityImpl::empty()), {}, {}, -- to_be_removed, false, absl::nullopt); } - cleanup_timer_->enableTimer(cleanup_interval_ms_); diff --git a/source/extensions/clusters/original_dst/original_dst_cluster.h b/source/extensions/clusters/original_dst/original_dst_cluster.h -index 55905560..3152af86 100644 +index ff665dc300..818b8c31ff 100644 --- a/source/extensions/clusters/original_dst/original_dst_cluster.h +++ b/source/extensions/clusters/original_dst/original_dst_cluster.h -@@ -22,25 +22,21 @@ namespace Upstream { +@@ -24,25 +24,21 @@ namespace Upstream { class OriginalDstClusterFactory; class OriginalDstClusterTest; @@ -393,7 +436,7 @@ index 55905560..3152af86 100644 class OriginalDstCluster; -@@ -65,7 +61,8 @@ using OriginalDstClusterHandleSharedPtr = std::shared_ptr& http_header_name_; - const absl::optional& metadata_key_; - const absl::optional port_override_; +@@ -127,7 +124,7 @@ public: + const std::optional& http_header_name_; + const std::optional& metadata_key_; + const std::optional port_override_; - HostMultiMapConstSharedPtr host_map_; + HostUseMapConstSharedPtr host_map_; + Common::CallbackHandlePtr member_update_cb_; }; - const absl::optional& httpHeaderName() { return http_header_name_; } -@@ -158,17 +155,23 @@ private: +@@ -169,17 +166,23 @@ private: const OriginalDstClusterHandleSharedPtr cluster_; }; @@ -441,7 +484,7 @@ index 55905560..3152af86 100644 void cleanup(); // ClusterImplBase -@@ -179,7 +182,9 @@ private: +@@ -190,7 +193,9 @@ private: Event::TimerPtr cleanup_timer_; absl::Mutex host_map_lock_; @@ -449,9 +492,9 @@ index 55905560..3152af86 100644 + HostUseMapConstSharedPtr host_map_ ABSL_GUARDED_BY(host_map_lock_); + absl::Mutex updates_map_lock_ ABSL_ACQUIRED_AFTER(host_map_lock_); + HostUseMapUniquePtr updates_map_ ABSL_GUARDED_BY(updates_map_lock_); - absl::optional http_header_name_; - absl::optional metadata_key_; - absl::optional port_override_; + std::optional http_header_name_; + std::optional metadata_key_; + std::optional port_override_; -- -2.54.0 +2.55.0 diff --git a/patches/0004-thread_local-reset-slot-in-worker-threads-first.patch b/patches/0004-thread_local-reset-slot-in-worker-threads-first.patch index 8465b6a6c..7a98cd2a9 100644 --- a/patches/0004-thread_local-reset-slot-in-worker-threads-first.patch +++ b/patches/0004-thread_local-reset-slot-in-worker-threads-first.patch @@ -1,7 +1,7 @@ -From 2c201ef341cf0090b5bf2507351c923fd7d37173 Mon Sep 17 00:00:00 2001 +From f8c8cff10b0e498cf0e4f5edce427bf93774da38 Mon Sep 17 00:00:00 2001 From: Jarno Rajahalme Date: Mon, 23 Dec 2024 22:43:15 +0100 -Subject: [PATCH 4/7] thread_local: reset slot in worker threads first +Subject: [PATCH 4/6] thread_local: reset slot in worker threads first Thread local slots refer to their data via shared pointers. Reset the shared pointer first in the worker threads, and last in the main thread @@ -18,7 +18,7 @@ Signed-off-by: Jarno Rajahalme 4 files changed, 36 insertions(+), 2 deletions(-) diff --git a/envoy/thread_local/thread_local.h b/envoy/thread_local/thread_local.h -index 13ff7496..da982cce 100644 +index 13ff7496ff..da982ccea5 100644 --- a/envoy/thread_local/thread_local.h +++ b/envoy/thread_local/thread_local.h @@ -248,6 +248,13 @@ public: @@ -36,7 +36,7 @@ index 13ff7496..da982cce 100644 } // namespace ThreadLocal diff --git a/source/common/thread_local/thread_local_impl.cc b/source/common/thread_local/thread_local_impl.cc -index 2a49789a..e57b2fd7 100644 +index 1231c044f7..f0c3696bd1 100644 --- a/source/common/thread_local/thread_local_impl.cc +++ b/source/common/thread_local/thread_local_impl.cc @@ -165,7 +165,8 @@ void InstanceImpl::removeSlot(uint32_t slot) { @@ -87,7 +87,7 @@ index 2a49789a..e57b2fd7 100644 if (thread_local_data_.data_.size() <= index) { thread_local_data_.data_.resize(index + 1); diff --git a/source/common/thread_local/thread_local_impl.h b/source/common/thread_local/thread_local_impl.h -index 71941899..685457af 100644 +index a2aa9351f0..01af0cc83a 100644 --- a/source/common/thread_local/thread_local_impl.h +++ b/source/common/thread_local/thread_local_impl.h @@ -29,6 +29,7 @@ public: @@ -99,7 +99,7 @@ index 71941899..685457af 100644 private: // On destruction returns the slot index to the deferred delete queue (detaches it). This allows diff --git a/test/mocks/thread_local/mocks.h b/test/mocks/thread_local/mocks.h -index 09dff237..88d7cea1 100644 +index 7ca4fa8147..171bc4a1bb 100644 --- a/test/mocks/thread_local/mocks.h +++ b/test/mocks/thread_local/mocks.h @@ -27,6 +27,10 @@ public: @@ -114,5 +114,5 @@ index 09dff237..88d7cea1 100644 SlotPtr allocateSlotMock() { return SlotPtr{new SlotImpl(*this, current_slot_++)}; } void runOnAllThreads1(std::function cb) { cb(); } -- -2.54.0 +2.55.0 diff --git a/patches/0005-http-header-expose-attribute.patch b/patches/0005-http-header-expose-attribute.patch index 0e316db87..2b156eaff 100644 --- a/patches/0005-http-header-expose-attribute.patch +++ b/patches/0005-http-header-expose-attribute.patch @@ -1,7 +1,7 @@ -From 3266c2e33a7f93ad72570c65ad592dee2e8470b0 Mon Sep 17 00:00:00 2001 +From c14ff1ecf9ca8108848e4b9e663dbac7e6537963 Mon Sep 17 00:00:00 2001 From: Tam Mach Date: Wed, 19 Mar 2025 21:07:05 +1100 -Subject: [PATCH 5/7] Expose HTTP Header matcher attribute +Subject: [PATCH 5/6] Expose HTTP Header matcher attribute Signed-off-by: Tam Mach --- @@ -9,7 +9,7 @@ Signed-off-by: Tam Mach 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/source/common/http/header_utility.h b/source/common/http/header_utility.h -index 095cb4a1..0577910a 100644 +index 31d7cfb356..7a114bfac1 100644 --- a/source/common/http/header_utility.h +++ b/source/common/http/header_utility.h @@ -96,7 +96,6 @@ public: @@ -140,5 +140,5 @@ index 095cb4a1..0577910a 100644 using HeaderDataPtr = std::unique_ptr; -- -2.54.0 +2.55.0 diff --git a/patches/0007-config-add-grpc-mux-stream-event-callback.patch b/patches/0006-config-add-grpc-mux-stream-event-callback.patch similarity index 88% rename from patches/0007-config-add-grpc-mux-stream-event-callback.patch rename to patches/0006-config-add-grpc-mux-stream-event-callback.patch index b9b218886..e8ca40d18 100644 --- a/patches/0007-config-add-grpc-mux-stream-event-callback.patch +++ b/patches/0006-config-add-grpc-mux-stream-event-callback.patch @@ -1,7 +1,32 @@ +From 9d7d0dbed5d3219608e06fb2e05556dfd3acc2bb Mon Sep 17 00:00:00 2001 +From: Jarno Rajahalme +Date: Mon, 17 Aug 2026 18:52:54 +1000 +Subject: [PATCH 6/6] config: add grpc mux stream event callback + +--- + envoy/config/BUILD | 1 + + envoy/config/grpc_mux.h | 19 ++++++++++ + source/common/config/BUILD | 9 +++++ + .../config/grpc_mux_stream_event_tracker.h | 36 +++++++++++++++++++ + source/common/config/null_grpc_mux_impl.h | 10 ++++++ + .../extensions/config_subscription/grpc/BUILD | 2 ++ + .../config_subscription/grpc/grpc_mux_impl.cc | 2 ++ + .../config_subscription/grpc/grpc_mux_impl.h | 10 ++++++ + .../grpc/new_grpc_mux_impl.cc | 2 ++ + .../grpc/new_grpc_mux_impl.h | 10 ++++++ + .../config_subscription/grpc/xds_mux/BUILD | 1 + + .../grpc/xds_mux/grpc_mux_impl.cc | 2 ++ + .../grpc/xds_mux/grpc_mux_impl.h | 20 +++++++++++ + .../config/grpc_subscription_impl_test.cc | 36 +++++++++++++++++++ + test/mocks/config/mocks.h | 4 +++ + 15 files changed, 164 insertions(+) + create mode 100644 source/common/config/grpc_mux_stream_event_tracker.h + diff --git a/envoy/config/BUILD b/envoy/config/BUILD +index ad9f959847..616c47916c 100644 --- a/envoy/config/BUILD +++ b/envoy/config/BUILD -@@ -66,6 +66,7 @@ envoy_cc_library( +@@ -65,6 +65,7 @@ envoy_cc_library( name = "grpc_mux_interface", hdrs = ["grpc_mux.h"], deps = [ @@ -10,6 +35,7 @@ diff --git a/envoy/config/BUILD b/envoy/config/BUILD ":subscription_interface", "//envoy/stats:stats_macros", diff --git a/envoy/config/grpc_mux.h b/envoy/config/grpc_mux.h +index f8aa1b3e4b..ca8c6f1c62 100644 --- a/envoy/config/grpc_mux.h +++ b/envoy/config/grpc_mux.h @@ -1,8 +1,10 @@ @@ -55,6 +81,7 @@ diff --git a/envoy/config/grpc_mux.h b/envoy/config/grpc_mux.h * Pause discovery requests for a given API type. This is useful when we're processing an update * for LDS or CDS and don't want a flood of updates for RDS or EDS respectively. Discovery diff --git a/source/common/config/BUILD b/source/common/config/BUILD +index ba2ee65f1f..d772e8a95e 100644 --- a/source/common/config/BUILD +++ b/source/common/config/BUILD @@ -87,11 +87,20 @@ envoy_cc_library( @@ -80,6 +107,7 @@ diff --git a/source/common/config/BUILD b/source/common/config/BUILD ) diff --git a/source/common/config/grpc_mux_stream_event_tracker.h b/source/common/config/grpc_mux_stream_event_tracker.h new file mode 100644 +index 0000000000..686348502d --- /dev/null +++ b/source/common/config/grpc_mux_stream_event_tracker.h @@ -0,0 +1,36 @@ @@ -120,6 +148,7 @@ new file mode 100644 +} // namespace Config +} // namespace Envoy diff --git a/source/common/config/null_grpc_mux_impl.h b/source/common/config/null_grpc_mux_impl.h +index 590d32f30b..34ebb0e6da 100644 --- a/source/common/config/null_grpc_mux_impl.h +++ b/source/common/config/null_grpc_mux_impl.h @@ -1,6 +1,7 @@ @@ -143,7 +172,7 @@ diff --git a/source/common/config/null_grpc_mux_impl.h b/source/common/config/nu ScopedResume pause(const std::string&) override { return std::make_unique([] {}); } -@@ -43,6 +50,9 @@ public: +@@ -44,6 +51,9 @@ public: void onEstablishmentFailure(bool) override {} void onDiscoveryResponse(std::unique_ptr&&, ControlPlaneStats&) override {} @@ -154,6 +183,7 @@ diff --git a/source/common/config/null_grpc_mux_impl.h b/source/common/config/nu } // namespace Config diff --git a/source/extensions/config_subscription/grpc/BUILD b/source/extensions/config_subscription/grpc/BUILD +index 3d5ef9dee2..7bc6f98a62 100644 --- a/source/extensions/config_subscription/grpc/BUILD +++ b/source/extensions/config_subscription/grpc/BUILD @@ -30,6 +30,7 @@ envoy_cc_extension( @@ -173,9 +203,10 @@ diff --git a/source/extensions/config_subscription/grpc/BUILD b/source/extension ":watch_map_lib", "//envoy/config:custom_config_validators_interface", diff --git a/source/extensions/config_subscription/grpc/grpc_mux_impl.cc b/source/extensions/config_subscription/grpc/grpc_mux_impl.cc +index e8be9a58ce..29b04801c7 100644 --- a/source/extensions/config_subscription/grpc/grpc_mux_impl.cc +++ b/source/extensions/config_subscription/grpc/grpc_mux_impl.cc -@@ -571,6 +571,7 @@ void GrpcMuxImpl::onStreamEstablished() { +@@ -575,6 +575,7 @@ void GrpcMuxImpl::onStreamEstablished() { for (const auto& type_url : subscriptions_) { queueDiscoveryRequest(type_url); } @@ -183,7 +214,7 @@ diff --git a/source/extensions/config_subscription/grpc/grpc_mux_impl.cc b/sourc } void GrpcMuxImpl::onEstablishmentFailure(bool) { -@@ -590,6 +591,7 @@ void GrpcMuxImpl::onEstablishmentFailure(bool) { +@@ -594,6 +595,7 @@ void GrpcMuxImpl::onEstablishmentFailure(bool) { api_state.second->previously_fetched_data_ = true; } } @@ -192,6 +223,7 @@ diff --git a/source/extensions/config_subscription/grpc/grpc_mux_impl.cc b/sourc void GrpcMuxImpl::queueDiscoveryRequest(absl::string_view queue_item) { diff --git a/source/extensions/config_subscription/grpc/grpc_mux_impl.h b/source/extensions/config_subscription/grpc/grpc_mux_impl.h +index eb47c049ff..f02dfc2a01 100644 --- a/source/extensions/config_subscription/grpc/grpc_mux_impl.h +++ b/source/extensions/config_subscription/grpc/grpc_mux_impl.h @@ -3,6 +3,7 @@ @@ -224,7 +256,7 @@ diff --git a/source/extensions/config_subscription/grpc/grpc_mux_impl.h b/source // GrpcMux ScopedResume pause(const std::string& type_url) override; ScopedResume pause(const std::vector type_urls) override; -@@ -294,6 +303,7 @@ private: +@@ -327,6 +336,7 @@ private: const bool skip_subsequent_node_; CustomConfigValidatorsPtr config_validators_; XdsConfigTrackerOptRef xds_config_tracker_; @@ -233,6 +265,7 @@ diff --git a/source/extensions/config_subscription/grpc/grpc_mux_impl.h b/source EdsResourcesCachePtr eds_resources_cache_; const std::string target_xds_authority_; diff --git a/source/extensions/config_subscription/grpc/new_grpc_mux_impl.cc b/source/extensions/config_subscription/grpc/new_grpc_mux_impl.cc +index 0a59a4abcf..46659f5d43 100644 --- a/source/extensions/config_subscription/grpc/new_grpc_mux_impl.cc +++ b/source/extensions/config_subscription/grpc/new_grpc_mux_impl.cc @@ -198,6 +198,7 @@ void NewGrpcMuxImpl::onStreamEstablished() { @@ -252,6 +285,7 @@ diff --git a/source/extensions/config_subscription/grpc/new_grpc_mux_impl.cc b/s void NewGrpcMuxImpl::onWriteable() { trySendDiscoveryRequests(); } diff --git a/source/extensions/config_subscription/grpc/new_grpc_mux_impl.h b/source/extensions/config_subscription/grpc/new_grpc_mux_impl.h +index 45b8a3fc59..1320833b90 100644 --- a/source/extensions/config_subscription/grpc/new_grpc_mux_impl.h +++ b/source/extensions/config_subscription/grpc/new_grpc_mux_impl.h @@ -1,6 +1,7 @@ @@ -284,7 +318,7 @@ diff --git a/source/extensions/config_subscription/grpc/new_grpc_mux_impl.h b/so GrpcMuxWatchPtr addWatch(const std::string& type_url, const absl::flat_hash_set& resources, -@@ -220,6 +229,7 @@ private: +@@ -221,6 +230,7 @@ private: const LocalInfo::LocalInfo& local_info_; CustomConfigValidatorsPtr config_validators_; @@ -293,6 +327,7 @@ diff --git a/source/extensions/config_subscription/grpc/new_grpc_mux_impl.h b/so XdsConfigTrackerOptRef xds_config_tracker_; const bool skip_subsequent_node_; diff --git a/source/extensions/config_subscription/grpc/xds_mux/BUILD b/source/extensions/config_subscription/grpc/xds_mux/BUILD +index a0fa33be75..912f49b39c 100644 --- a/source/extensions/config_subscription/grpc/xds_mux/BUILD +++ b/source/extensions/config_subscription/grpc/xds_mux/BUILD @@ -71,6 +71,7 @@ envoy_cc_extension( @@ -304,9 +339,10 @@ diff --git a/source/extensions/config_subscription/grpc/xds_mux/BUILD b/source/e "//source/extensions/config_subscription/grpc:pausable_ack_queue_lib", "//source/extensions/config_subscription/grpc:watch_map_lib", diff --git a/source/extensions/config_subscription/grpc/xds_mux/grpc_mux_impl.cc b/source/extensions/config_subscription/grpc/xds_mux/grpc_mux_impl.cc +index cb221ac889..010d6bc2bc 100644 --- a/source/extensions/config_subscription/grpc/xds_mux/grpc_mux_impl.cc +++ b/source/extensions/config_subscription/grpc/xds_mux/grpc_mux_impl.cc -@@ -323,6 +323,7 @@ void GrpcMuxImpl::handleEstablishedStream() { +@@ -339,6 +339,7 @@ void GrpcMuxImpl::handleEstablishedStream() { maybeUpdateQueueSizeStat(0); pausable_ack_queue_.clear(); trySendDiscoveryRequests(); @@ -314,7 +350,7 @@ diff --git a/source/extensions/config_subscription/grpc/xds_mux/grpc_mux_impl.cc } template -@@ -347,6 +348,7 @@ void GrpcMuxImpl::handleStreamEstablishmentFailure( +@@ -363,6 +364,7 @@ void GrpcMuxImpl::handleStreamEstablishmentFailure( } } while (all_subscribed.size() != subscriptions_.size()); should_send_initial_resource_versions_ = next_attempt_may_send_initial_resource_version; @@ -323,6 +359,7 @@ diff --git a/source/extensions/config_subscription/grpc/xds_mux/grpc_mux_impl.cc template diff --git a/source/extensions/config_subscription/grpc/xds_mux/grpc_mux_impl.h b/source/extensions/config_subscription/grpc/xds_mux/grpc_mux_impl.h +index a268014701..3cea9bc79f 100644 --- a/source/extensions/config_subscription/grpc/xds_mux/grpc_mux_impl.h +++ b/source/extensions/config_subscription/grpc/xds_mux/grpc_mux_impl.h @@ -3,6 +3,7 @@ @@ -355,7 +392,7 @@ diff --git a/source/extensions/config_subscription/grpc/xds_mux/grpc_mux_impl.h void updateWatch(const std::string& type_url, Watch* watch, const absl::flat_hash_set& resources, const SubscriptionOptions& options); -@@ -241,6 +250,7 @@ private: +@@ -242,6 +251,7 @@ private: // this one is up to GrpcMux. const LocalInfo::LocalInfo& local_info_; Common::CallbackHandlePtr dynamic_update_callback_handle_; @@ -363,7 +400,7 @@ diff --git a/source/extensions/config_subscription/grpc/xds_mux/grpc_mux_impl.h CustomConfigValidatorsPtr config_validators_; XdsConfigTrackerOptRef xds_config_tracker_; XdsResourcesDelegateOptRef xds_resources_delegate_; -@@ -293,6 +303,13 @@ private: +@@ -294,6 +304,13 @@ private: class NullGrpcMuxImpl : public GrpcMux { public: void start() override {} @@ -377,7 +414,7 @@ diff --git a/source/extensions/config_subscription/grpc/xds_mux/grpc_mux_impl.h ScopedResume pause(const std::string&) override { return std::make_unique([]() {}); -@@ -319,6 +336,9 @@ public: +@@ -321,6 +338,9 @@ public: Upstream::LoadStatsReporter* loadStatsReporter() const override { return nullptr; } Upstream::LoadStatsReporter* maybeCreateLoadStatsReporter() override { return nullptr; } @@ -388,6 +425,7 @@ diff --git a/source/extensions/config_subscription/grpc/xds_mux/grpc_mux_impl.h } // namespace XdsMux diff --git a/test/common/config/grpc_subscription_impl_test.cc b/test/common/config/grpc_subscription_impl_test.cc +index e70750ed4f..b0f84d66f1 100644 --- a/test/common/config/grpc_subscription_impl_test.cc +++ b/test/common/config/grpc_subscription_impl_test.cc @@ -65,6 +65,42 @@ TEST_P(GrpcSubscriptionImplTest, RemoteStreamClose) { @@ -434,9 +472,10 @@ diff --git a/test/common/config/grpc_subscription_impl_test.cc b/test/common/con // ignore later ones. This allows the nonce to be used. TEST_P(GrpcSubscriptionImplTest, RepeatedNonce) { diff --git a/test/mocks/config/mocks.h b/test/mocks/config/mocks.h +index 72b2fd2133..787e52c321 100644 --- a/test/mocks/config/mocks.h +++ b/test/mocks/config/mocks.h -@@ -116,6 +116,10 @@ public: +@@ -161,6 +161,10 @@ public: MOCK_METHOD(ScopedResume, pause, (const std::string& type_url), (override)); MOCK_METHOD(ScopedResume, pause, (const std::vector type_urls), (override)); @@ -447,3 +486,6 @@ diff --git a/test/mocks/config/mocks.h b/test/mocks/config/mocks.h MOCK_METHOD(void, addSubscription, (const absl::flat_hash_set& resources, const std::string& type_url, SubscriptionCallbacks& callbacks, SubscriptionStats& stats, +-- +2.55.0 + diff --git a/patches/0006-test-integration-Defer-fake-upstream-read-enable-un.patch b/patches/0006-test-integration-Defer-fake-upstream-read-enable-un.patch deleted file mode 100644 index 4a771123f..000000000 --- a/patches/0006-test-integration-Defer-fake-upstream-read-enable-un.patch +++ /dev/null @@ -1,133 +0,0 @@ -From 50f4d0e3a617d9a3db477c3532da7f5a36c5862b Mon Sep 17 00:00:00 2001 -From: Kateryna Nezdolii -Date: Wed, 20 May 2026 18:23:27 +0000 -Subject: [PATCH 6/7] [test/integration] Defer fake upstream read enable until - initialize (#45029) - ---- - test/integration/fake_upstream.cc | 36 +++++++++++++++++++++++-------- - test/integration/fake_upstream.h | 9 ++++++-- - 2 files changed, 34 insertions(+), 11 deletions(-) - -diff --git a/test/integration/fake_upstream.cc b/test/integration/fake_upstream.cc -index 72ec3fec..f6ea46d6 100644 ---- a/test/integration/fake_upstream.cc -+++ b/test/integration/fake_upstream.cc -@@ -401,8 +401,10 @@ FakeHttpConnection::FakeHttpConnection( - Event::TestTimeSystem& time_system, uint32_t max_request_headers_kb, - uint32_t max_request_headers_count, - envoy::config::core::v3::HttpProtocolOptions::HeadersWithUnderscoresAction -- headers_with_underscores_action) -+ headers_with_underscores_action, -+ bool deferred_read_enable) - : FakeConnectionBase(shared_connection, time_system), type_(type), -+ deferred_read_enable_(deferred_read_enable), - header_validator_factory_( - IntegrationUtil::makeHeaderValidationFactory(fakeUpstreamHeaderValidatorConfig())) { - ASSERT(max_request_headers_count != 0); -@@ -437,6 +439,17 @@ FakeHttpConnection::FakeHttpConnection( - Network::ReadFilterSharedPtr{new ReadFilter(*this)}); - } - -+void FakeHttpConnection::initialize() { -+ FakeConnectionBase::initialize(); -+ if (deferred_read_enable_ && shared_connection_.connected() && -+ !shared_connection_.connection().readEnabled()) { -+ // Re-enable reads that were explicitly deferred by consumeConnection(defer_read_enable=true) -+ // to ensure the HTTP codec and read filter are fully initialized before processing request -+ // bytes. This must not re-enable reads when disable_and_do_not_enable_ is active. -+ shared_connection_.connection().readDisable(false); -+ } -+} -+ - AssertionResult FakeConnectionBase::close(std::chrono::milliseconds timeout) { - ENVOY_LOG(trace, "FakeConnectionBase close"); - if (!shared_connection_.connected()) { -@@ -821,8 +834,10 @@ AssertionResult FakeUpstream::waitForHttpConnection(Event::Dispatcher& client_di - return runOnDispatcherThreadAndWait([&]() { - absl::MutexLock lock(lock_); - connection = std::make_unique( -- *this, consumeConnection(), http_type_, time_system_, config_.max_request_headers_kb_, -- config_.max_request_headers_count_, config_.headers_with_underscores_action_); -+ *this, consumeConnection(/*defer_read_enable=*/true), http_type_, time_system_, -+ config_.max_request_headers_kb_, config_.max_request_headers_count_, -+ config_.headers_with_underscores_action_, -+ /*deferred_read_enable=*/read_disable_on_new_connection_ && !disable_and_do_not_enable_); - connection->initialize(); - return AssertionSuccess(); - }); -@@ -858,9 +873,11 @@ FakeUpstream::waitForHttpConnection(Event::Dispatcher& client_dispatcher, - EXPECT_TRUE(upstream.runOnDispatcherThreadAndWait([&]() { - absl::MutexLock lock(upstream.lock_); - connection = std::make_unique( -- upstream, upstream.consumeConnection(), upstream.http_type_, upstream.timeSystem(), -- Http::DEFAULT_MAX_REQUEST_HEADERS_KB, Http::DEFAULT_MAX_HEADERS_COUNT, -- envoy::config::core::v3::HttpProtocolOptions::ALLOW); -+ upstream, upstream.consumeConnection(/*defer_read_enable=*/true), upstream.http_type_, -+ upstream.timeSystem(), Http::DEFAULT_MAX_REQUEST_HEADERS_KB, -+ Http::DEFAULT_MAX_HEADERS_COUNT, envoy::config::core::v3::HttpProtocolOptions::ALLOW, -+ /*deferred_read_enable=*/upstream.read_disable_on_new_connection_ && -+ !upstream.disable_and_do_not_enable_); - connection->initialize(); - return AssertionSuccess(); - })); -@@ -929,7 +946,7 @@ void FakeUpstream::convertFromRawToHttp(FakeRawConnectionPtr& raw_connection, - raw_connection.release(); - } - --SharedConnectionWrapper& FakeUpstream::consumeConnection() { -+SharedConnectionWrapper& FakeUpstream::consumeConnection(bool defer_read_enable) { - ASSERT(!new_connections_.empty()); - auto* const connection_wrapper = new_connections_.front().get(); - // Skip the thread safety check if the network connection has already been freed since there's no -@@ -939,10 +956,11 @@ SharedConnectionWrapper& FakeUpstream::consumeConnection() { - connection_wrapper->moveBetweenLists(new_connections_, consumed_connections_); - if (read_disable_on_new_connection_ && connection_wrapper->connected() && - http_type_ != Http::CodecType::HTTP3 && !disable_and_do_not_enable_) { -- // Re-enable read and early close detection. - auto& connection = connection_wrapper->connection(); - connection.detectEarlyCloseWhenReadDisabled(true); -- connection.readDisable(false); -+ if (!defer_read_enable) { -+ connection.readDisable(false); -+ } - } - return *connection_wrapper; - } -diff --git a/test/integration/fake_upstream.h b/test/integration/fake_upstream.h -index 277189bd..43cd5f05 100644 ---- a/test/integration/fake_upstream.h -+++ b/test/integration/fake_upstream.h -@@ -545,7 +545,10 @@ public: - Http::CodecType type, Event::TestTimeSystem& time_system, - uint32_t max_request_headers_kb, uint32_t max_request_headers_count, - envoy::config::core::v3::HttpProtocolOptions::HeadersWithUnderscoresAction -- headers_with_underscores_action); -+ headers_with_underscores_action, -+ bool deferred_read_enable = false); -+ -+ void initialize() override; - - ABSL_MUST_USE_RESULT - testing::AssertionResult -@@ -607,6 +610,7 @@ private: - }; - - const Http::CodecType type_; -+ bool deferred_read_enable_; - Http::ServerConnectionPtr codec_; - std::list new_streams_ ABSL_GUARDED_BY(lock_); - testing::NiceMock overload_manager_; -@@ -1002,7 +1006,8 @@ private: - }; - - void threadRoutine(); -- SharedConnectionWrapper& consumeConnection() ABSL_EXCLUSIVE_LOCKS_REQUIRED(lock_); -+ SharedConnectionWrapper& consumeConnection(bool defer_read_enable = false) -+ ABSL_EXCLUSIVE_LOCKS_REQUIRED(lock_); - Network::FilterStatus onRecvDatagram(Network::UdpRecvData& data); - AssertionResult - runOnDispatcherThreadAndWait(std::function cb, --- -2.55.0 - diff --git a/patches/0008-repo-Make-yq-dependency-optional-for-CI-config-parsi.patch b/patches/0008-repo-Make-yq-dependency-optional-for-CI-config-parsi.patch deleted file mode 100644 index de006961d..000000000 --- a/patches/0008-repo-Make-yq-dependency-optional-for-CI-config-parsi.patch +++ /dev/null @@ -1,72 +0,0 @@ -From af2053dc1e3892a9f28d6eebf7f907c3d83ce536 Mon Sep 17 00:00:00 2001 -From: Tam Mach -Date: Sat, 14 Mar 2026 21:00:53 +1100 -Subject: [PATCH] repo: Make yq dependency optional for CI config parsing - -When yq is unavailable (e.g. in WORKSPACE mode due to aspect_bazel_lib -hub repo symlink issues), fall back to placeholder container image -values. This only affects RBE container references which are not needed -for local or Docker-based builds. - -Signed-off-by: Tam Mach ---- - bazel/repo.bzl | 38 +++++++++++++++++++++++++------------- - 1 file changed, 25 insertions(+), 13 deletions(-) - -diff --git a/bazel/repo.bzl b/bazel/repo.bzl -index 561c99b71c..a96fcd3757 100644 ---- a/bazel/repo.bzl -+++ b/bazel/repo.bzl -@@ -66,24 +66,36 @@ def _envoy_repo_impl(repository_ctx): - """ - - # parse container information for use in RBE -+ # Try to use yq, fall back to placeholder values if unavailable -+ # (yq may not resolve in WORKSPACE mode due to aspect_bazel_lib hub repo symlink issues) - json_result = repository_ctx.execute([ - repository_ctx.path(repository_ctx.attr.yq), - repository_ctx.path(repository_ctx.attr.envoy_ci_config), - "-ojson", - ]) -- if json_result.return_code != 0: -- fail("yq failed: {}".format(json_result.stderr)) -- repository_ctx.file("ci-config.json", json_result.stdout) -- config_data = json.decode(repository_ctx.read("ci-config.json")) -- repository_ctx.file("containers.bzl", CONTAINERS.format( -- repo = config_data["build-image"]["repo"], -- repo_gcr = config_data["build-image"]["repo-gcr"], -- sha = config_data["build-image"]["sha"], -- sha_gcc = config_data["build-image"]["sha-gcc"], -- sha_mobile = config_data["build-image"]["sha-mobile"], -- sha_worker = config_data["build-image"]["sha-worker"], -- tag = config_data["build-image"]["tag"], -- )) -+ if json_result.return_code == 0: -+ repository_ctx.file("ci-config.json", json_result.stdout) -+ config_data = json.decode(repository_ctx.read("ci-config.json")) -+ repository_ctx.file("containers.bzl", CONTAINERS.format( -+ repo = config_data["build-image"]["repo"], -+ repo_gcr = config_data["build-image"]["repo-gcr"], -+ sha = config_data["build-image"]["sha"], -+ sha_gcc = config_data["build-image"]["sha-gcc"], -+ sha_mobile = config_data["build-image"]["sha-mobile"], -+ sha_worker = config_data["build-image"]["sha-worker"], -+ tag = config_data["build-image"]["tag"], -+ )) -+ else: -+ # yq unavailable - use placeholder values (RBE container refs won't work) -+ repository_ctx.file("containers.bzl", CONTAINERS.format( -+ repo = "envoyproxy/envoy-build-ubuntu", -+ repo_gcr = "envoyproxy/envoy-build-ubuntu", -+ sha = "0" * 64, -+ sha_gcc = "0" * 64, -+ sha_mobile = "0" * 64, -+ sha_worker = "0" * 64, -+ tag = "unknown", -+ )) - repo_version_path = repository_ctx.path(repository_ctx.attr.envoy_version) - api_version_path = repository_ctx.path(repository_ctx.attr.envoy_api_version) - version = repository_ctx.read(repo_version_path).strip() --- -2.43.0 - diff --git a/tests/BUILD b/tests/BUILD index be476c796..f14ed7b2c 100644 --- a/tests/BUILD +++ b/tests/BUILD @@ -130,6 +130,7 @@ envoy_cc_test( ":bpf_metadata_lib", ":cilium_test_peer_lib", "//cilium:network_policy_lib", + "@envoy//test/mocks/secret:secret_mocks", "@envoy//test/mocks/server:factory_context_mocks", ], ) diff --git a/tests/accesslog_server.cc b/tests/accesslog_server.cc index 9cffe6165..850d84fe7 100644 --- a/tests/accesslog_server.cc +++ b/tests/accesslog_server.cc @@ -2,6 +2,7 @@ #include #include +#include #include #include "source/common/common/logger.h" @@ -9,7 +10,6 @@ #include "absl/base/thread_annotations.h" #include "absl/synchronization/mutex.h" #include "absl/time/time.h" -#include "absl/types/optional.h" #include "cilium/api/accesslog.pb.h" #include "tests/uds_server.h" @@ -27,10 +27,10 @@ void AccessLogServer::clear() { messages_.clear(); } -absl::optional<::cilium::LogEntry> +std::optional<::cilium::LogEntry> AccessLogServer::waitForMessage(::cilium::EntryType entry_type, std::chrono::milliseconds timeout) { absl::MutexLock lock(&mutex_); - absl::optional<::cilium::LogEntry> entry; + std::optional<::cilium::LogEntry> entry; auto predicate = [this, &entry, entry_type]() ABSL_SHARED_LOCKS_REQUIRED(mutex_) { mutex_.AssertHeld(); for (auto& msg : messages_) { diff --git a/tests/accesslog_server.h b/tests/accesslog_server.h index 60f06c6fe..1f43f27de 100644 --- a/tests/accesslog_server.h +++ b/tests/accesslog_server.h @@ -1,6 +1,7 @@ #pragma once #include +#include #include #include @@ -8,7 +9,6 @@ #include "absl/base/thread_annotations.h" #include "absl/synchronization/mutex.h" -#include "absl/types/optional.h" #include "cilium/api/accesslog.pb.h" #include "tests/uds_server.h" @@ -20,7 +20,7 @@ class AccessLogServer : public UDSServer { ~AccessLogServer() override; void clear(); - absl::optional<::cilium::LogEntry> + std::optional<::cilium::LogEntry> waitForMessage(::cilium::EntryType entry_type, std::chrono::milliseconds timeout = TestUtility::DefaultTimeout); diff --git a/tests/bpf_metadata.cc b/tests/bpf_metadata.cc index 2604586bc..d224e8eb1 100644 --- a/tests/bpf_metadata.cc +++ b/tests/bpf_metadata.cc @@ -2,6 +2,7 @@ #include #include +#include #include #include #include @@ -26,7 +27,6 @@ #include "test/test_common/environment.h" #include "absl/strings/string_view.h" -#include "absl/types/optional.h" #include "cilium/api/bpf_metadata.pb.h" #include "cilium/bpf_metadata.h" #include "cilium/host_map.h" @@ -164,7 +164,7 @@ TestConfig::~TestConfig() { npmap.reset(); } -absl::optional +std::optional TestConfig::extractSocketMetadata(Network::ConnectionSocket& socket) { // TLS filter chain matches this, make namespace part of this (e.g., // "default")? diff --git a/tests/bpf_metadata.h b/tests/bpf_metadata.h index 995a805ee..e7b794860 100644 --- a/tests/bpf_metadata.h +++ b/tests/bpf_metadata.h @@ -1,6 +1,7 @@ #pragma once #include +#include #include #include #include @@ -9,7 +10,6 @@ #include "envoy/network/listen_socket.h" #include "envoy/server/factory_context.h" -#include "absl/types/optional.h" #include "cilium/bpf_metadata.h" #include "cilium/host_map.h" #include "cilium/network_policy.h" @@ -47,7 +47,7 @@ class TestConfig : public Config { Server::Configuration::ListenerFactoryContext& context); ~TestConfig() override; - absl::optional + std::optional extractSocketMetadata(Network::ConnectionSocket& socket) override; // Prevent socket options that require NET_ADMIN privileges from being applied during test diff --git a/tests/bpf_metadata_integration_test.cc b/tests/bpf_metadata_integration_test.cc index fd1d7189c..33884ab96 100644 --- a/tests/bpf_metadata_integration_test.cc +++ b/tests/bpf_metadata_integration_test.cc @@ -4,6 +4,7 @@ #include #include #include +#include #include #include @@ -213,7 +214,7 @@ class BpfMetadataIntegrationTest : public BaseIntegrationTest, setBpfMetadataNpdsConfig(bpf_config, use_ads, api_type); - listener_filter->mutable_typed_config()->PackFrom(bpf_config); + std::ignore = listener_filter->mutable_typed_config()->PackFrom(bpf_config); } void updateBpfMetadataListenerFilter(envoy::config::listener::v3::Listener& listener, @@ -227,7 +228,7 @@ class BpfMetadataIntegrationTest : public BaseIntegrationTest, RELEASE_ASSERT(listener_filter.typed_config().UnpackTo(&bpf_config), "failed to unpack cilium.bpf_metadata listener filter"); setBpfMetadataNpdsConfig(bpf_config, /*use_ads=*/false, api_type); - listener_filter.mutable_typed_config()->PackFrom(bpf_config); + std::ignore = listener_filter.mutable_typed_config()->PackFrom(bpf_config); return; } RELEASE_ASSERT(false, "cilium.bpf_metadata listener filter not found"); @@ -383,7 +384,7 @@ class BpfMetadataIntegrationTest : public BaseIntegrationTest, response.set_nonce(version); response.set_type_url(Envoy::Config::TestTypeUrl::get().Listener); for (const auto& listener_config : listener_configs) { - response.add_resources()->PackFrom(listener_config); + std::ignore = response.add_resources()->PackFrom(listener_config); } stream.sendGrpcMessage(response); } @@ -411,7 +412,7 @@ class BpfMetadataIntegrationTest : public BaseIntegrationTest, proto_configs.emplace_back(TestUtility::parseYaml(policy_config)); } for (const auto& policy_config : proto_configs) { - response.add_resources()->PackFrom(policy_config); + std::ignore = response.add_resources()->PackFrom(policy_config); } stream.sendGrpcMessage(response); } @@ -430,7 +431,7 @@ class BpfMetadataIntegrationTest : public BaseIntegrationTest, TestUtility::parseYaml(policy_host_config)); } for (const auto& policy_host_config : proto_configs) { - response.add_resources()->PackFrom(policy_host_config); + std::ignore = response.add_resources()->PackFrom(policy_host_config); } stream.sendGrpcMessage(response); } @@ -446,7 +447,7 @@ class BpfMetadataIntegrationTest : public BaseIntegrationTest, envoy::service::discovery::v3::Resource* resource = response.add_resources(); resource->set_name(resource_config.name); resource->set_version(resource_config.version); - resource->mutable_resource()->PackFrom( + std::ignore = resource->mutable_resource()->PackFrom( TestUtility::parseYaml(resource_config.yaml)); } for (const auto& removed_resource : removed_resources) { @@ -466,7 +467,7 @@ class BpfMetadataIntegrationTest : public BaseIntegrationTest, envoy::service::discovery::v3::Resource* resource = response.add_resources(); resource->set_name(resource_config.name); resource->set_version(resource_config.version); - resource->mutable_resource()->PackFrom( + std::ignore = resource->mutable_resource()->PackFrom( TestUtility::parseYaml(resource_config.yaml)); } for (const auto& removed_resource : removed_resources) { @@ -524,7 +525,8 @@ class BpfMetadataIntegrationTest : public BaseIntegrationTest, } uint64_t waitForPolicyStreamGenerationAfter(uint64_t previous_generation) { - test_server_->waitForGaugeGe("cilium.policy.policy_stream_generation", previous_generation + 1); + test_server_->waitForGauge("cilium.policy.policy_stream_generation", + testing::Ge(previous_generation + 1)); const uint64_t generation = policyStreamGeneration(); EXPECT_GT(generation, previous_generation); return generation; @@ -594,12 +596,12 @@ TEST_P(BpfMetadataIntegrationTest, BpfMetadataWithNpdsAndNpdhsViaAds) { }; initializeAds(); - test_server_->waitForCounterGe("listener_manager.lds.update_success", 1); + test_server_->waitForCounter("listener_manager.lds.update_success", testing::Ge(1)); EXPECT_EQ(test_server_->server().listenerManager().listeners().size(), 1); sendNpdsResponse(*ads_stream_, "1"); - test_server_->waitForCounterGe("cilium.policy.update_success", 1); + test_server_->waitForCounter("cilium.policy.update_success", testing::Ge(1)); sendNphdsResponse(*ads_stream_, "1"); - test_server_->waitForCounterGe("cilium.hostmap.update_success", 1); + test_server_->waitForCounter("cilium.hostmap.update_success", testing::Ge(1)); } TEST_P(BpfMetadataIntegrationTest, AdsPolicyMapsSurviveLastListenerRemoval) { @@ -617,11 +619,11 @@ TEST_P(BpfMetadataIntegrationTest, AdsPolicyMapsSurviveLastListenerRemoval) { }; initializeAds(); - test_server_->waitForCounterGe("listener_manager.lds.update_success", 1); + test_server_->waitForCounter("listener_manager.lds.update_success", testing::Ge(1)); sendNpdsResponse(*ads_stream_, "1"); - test_server_->waitForCounterGe("cilium.policy.update_success", 1); + test_server_->waitForCounter("cilium.policy.update_success", testing::Ge(1)); sendNphdsResponse(*ads_stream_, "1"); - test_server_->waitForCounterGe("cilium.hostmap.update_success", 1); + test_server_->waitForCounter("cilium.hostmap.update_success", testing::Ge(1)); { const auto policy_map = networkPolicyMap(); @@ -632,15 +634,15 @@ TEST_P(BpfMetadataIntegrationTest, AdsPolicyMapsSurviveLastListenerRemoval) { EXPECT_EQ(resolveHostPolicyId("10.2.2.2"), 222); sendLdsResponse(*ads_stream_, std::vector{}, "2"); - test_server_->waitForCounterGe("listener_manager.lds.update_success", 2); - test_server_->waitForCounterEq("listener_manager.listener_removed", 1); - test_server_->waitForGaugeEq("listener_manager.total_listeners_draining", 0); + test_server_->waitForCounter("listener_manager.lds.update_success", testing::Ge(2)); + test_server_->waitForCounter("listener_manager.listener_removed", testing::Eq(1)); + test_server_->waitForGauge("listener_manager.total_listeners_draining", testing::Eq(0)); EXPECT_TRUE(test_server_->server().listenerManager().listeners().empty()); sendNpdsResponse(*ads_stream_, "2", {policy2}); - test_server_->waitForCounterGe("cilium.policy.update_success", 2); + test_server_->waitForCounter("cilium.policy.update_success", testing::Ge(2)); sendNphdsResponse(*ads_stream_, "2", {policy_host2}); - test_server_->waitForCounterGe("cilium.hostmap.update_success", 2); + test_server_->waitForCounter("cilium.hostmap.update_success", testing::Ge(2)); const auto policy_map = networkPolicyMap(); EXPECT_FALSE(policy_map->exists("10.1.1.1")); @@ -664,15 +666,15 @@ TEST_P(BpfMetadataIntegrationTest, PolicyStreamGenerationTracksAcceptedAdsGrpcSt }; initializeAds(); - test_server_->waitForCounterGe("listener_manager.lds.update_success", 1); + test_server_->waitForCounter("listener_manager.lds.update_success", testing::Ge(1)); EXPECT_EQ(policyStreamGeneration(), 0); sendNpdsResponse(*ads_stream_, "1"); - test_server_->waitForCounterGe("cilium.policy.update_success", 1); + test_server_->waitForCounter("cilium.policy.update_success", testing::Ge(1)); const uint64_t first_generation = waitForPolicyStreamGenerationAfter(0); sendNpdsResponse(*ads_stream_, "2"); - test_server_->waitForCounterGe("cilium.policy.update_success", 2); + test_server_->waitForCounter("cilium.policy.update_success", testing::Ge(2)); EXPECT_EQ(policyStreamGeneration(), first_generation); resetConnections(); @@ -685,15 +687,15 @@ TEST_P(BpfMetadataIntegrationTest, PolicyStreamGenerationTracksAcceptedSotwGrpcS createSotWStreams("1"); }; initializeSotw(); - test_server_->waitForCounterGe("listener_manager.lds.update_success", 1); + test_server_->waitForCounter("listener_manager.lds.update_success", testing::Ge(1)); EXPECT_EQ(policyStreamGeneration(), 0); sendNpdsResponse(*npds_stream_, "1"); - test_server_->waitForCounterGe("cilium.policy.update_success", 1); + test_server_->waitForCounter("cilium.policy.update_success", testing::Ge(1)); const uint64_t first_generation = waitForPolicyStreamGenerationAfter(0); sendNpdsResponse(*npds_stream_, "2"); - test_server_->waitForCounterGe("cilium.policy.update_success", 2); + test_server_->waitForCounter("cilium.policy.update_success", testing::Ge(2)); EXPECT_EQ(policyStreamGeneration(), first_generation); resetConnections(); @@ -704,11 +706,11 @@ TEST_P(BpfMetadataIntegrationTest, PolicyStreamGenerationTracksAcceptedSotwGrpcS // The invalid policy is rejected by the real gRPC subscription decoder/validator before // NetworkPolicyMapImpl::onConfigUpdate() runs, so this increments NPDS subscription stats // rather than cilium.policy.updates_rejected. - test_server_->waitForCounterGe("cilium.npds.update_rejected", 1); + test_server_->waitForCounter("cilium.npds.update_rejected", testing::Ge(1)); EXPECT_EQ(policyStreamGeneration(), first_generation); sendNpdsResponse(*npds_stream_, "4"); - test_server_->waitForCounterGe("cilium.policy.update_success", 3); + test_server_->waitForCounter("cilium.policy.update_success", testing::Ge(3)); waitForPolicyStreamGenerationAfter(first_generation); } @@ -719,14 +721,14 @@ TEST_P(BpfMetadataIntegrationTest, PolicyStreamGenerationTracksAcceptedDeltaNpds createSotWStreams("1"); }; initializeSotw(); - test_server_->waitForCounterGe("listener_manager.lds.update_success", 1); + test_server_->waitForCounter("listener_manager.lds.update_success", testing::Ge(1)); auto policy_map = networkPolicyMap(); EXPECT_EQ(policyStreamGeneration(), 0); // Step 2: accept a real SotW NPDS response so the starting mode has installed policy. sendNpdsResponse(*npds_stream_, "1"); - test_server_->waitForCounterGe("cilium.policy.update_success", 1); + test_server_->waitForCounter("cilium.policy.update_success", testing::Ge(1)); const uint64_t sotw_generation = waitForPolicyStreamGenerationAfter(0); EXPECT_TRUE(policy_map->exists("10.1.1.1")); EXPECT_TRUE(policy_map->exists("10.2.2.2")); @@ -735,7 +737,7 @@ TEST_P(BpfMetadataIntegrationTest, PolicyStreamGenerationTracksAcceptedDeltaNpds updateBpfMetadataListenerFilter(listener_config_, envoy::config::core::v3::ApiConfigSource::DELTA_GRPC); sendLdsResponse(*lds_stream_, {listener_config_}, "2"); - test_server_->waitForCounterGe("listener_manager.lds.update_success", 2); + test_server_->waitForCounter("listener_manager.lds.update_success", testing::Ge(2)); // Step 4: observe the immediate switch to Delta NPDS without advancing accepted policy state. createStreamsUntil("2", NetworkPolicyTypeUrl, /*expect_delta=*/true); @@ -779,8 +781,8 @@ TEST_P(BpfMetadataIntegrationTest, PolicyStreamGenerationTracksAcceptedDeltaNphd createSotWStreams("1"); }; initializeSotw(); - test_server_->waitForCounterGe("listener_manager.lds.update_success", 1); - test_server_->waitForCounterGe("cilium.hostmap.update_success", 1); + test_server_->waitForCounter("listener_manager.lds.update_success", testing::Ge(1)); + test_server_->waitForCounter("cilium.hostmap.update_success", testing::Ge(1)); auto policy_map = networkPolicyMap(); EXPECT_EQ(policyStreamGeneration(), 0); @@ -789,7 +791,7 @@ TEST_P(BpfMetadataIntegrationTest, PolicyStreamGenerationTracksAcceptedDeltaNphd // Step 2: accept a real SotW NPDS response so the starting mode has installed policy. sendNpdsResponse(*npds_stream_, "1"); - test_server_->waitForCounterGe("cilium.policy.update_success", 1); + test_server_->waitForCounter("cilium.policy.update_success", testing::Ge(1)); const uint64_t sotw_generation = waitForPolicyStreamGenerationAfter(0); EXPECT_TRUE(policy_map->exists("10.1.1.1")); EXPECT_TRUE(policy_map->exists("10.2.2.2")); @@ -798,7 +800,7 @@ TEST_P(BpfMetadataIntegrationTest, PolicyStreamGenerationTracksAcceptedDeltaNphd updateBpfMetadataListenerFilter(listener_config_, envoy::config::core::v3::ApiConfigSource::DELTA_GRPC); sendLdsResponse(*lds_stream_, {listener_config_}, "2"); - test_server_->waitForCounterGe("listener_manager.lds.update_success", 2); + test_server_->waitForCounter("listener_manager.lds.update_success", testing::Ge(2)); // Step 4: observe the immediate switch to Delta NPHDS without advancing accepted policy state. createStreamsUntil("2", NetworkPolicyHostsTypeUrl, /*expect_delta=*/true); @@ -809,7 +811,7 @@ TEST_P(BpfMetadataIntegrationTest, PolicyStreamGenerationTracksAcceptedDeltaNphd // Step 5: accept the first Delta NPHDS update. This should not change policy stream generation. sendNphdsDeltaResponse(*nphds_stream_, "1", {policy_host1_resource, policy_host2_resource}); EXPECT_TRUE(compareNphdsAck()); - test_server_->waitForCounterGe("cilium.hostmap.update_success", 2); + test_server_->waitForCounter("cilium.hostmap.update_success", testing::Ge(2)); EXPECT_EQ(policyStreamGeneration(), sotw_generation); EXPECT_EQ(resolveHostPolicyId("10.1.1.1"), 111); EXPECT_EQ(resolveHostPolicyId("10.2.2.2"), 222); @@ -817,7 +819,7 @@ TEST_P(BpfMetadataIntegrationTest, PolicyStreamGenerationTracksAcceptedDeltaNphd // Step 6: accept a same-stream Delta update; omitted resources stay present on the same stream. sendNphdsDeltaResponse(*nphds_stream_, "2", {policy_host1_new_stream_resource}); EXPECT_TRUE(compareNphdsAck()); - test_server_->waitForCounterGe("cilium.hostmap.update_success", 3); + test_server_->waitForCounter("cilium.hostmap.update_success", testing::Ge(3)); EXPECT_EQ(policyStreamGeneration(), sotw_generation); EXPECT_EQ(resolveHostPolicyId("10.1.1.1"), 111); EXPECT_EQ(resolveHostPolicyId("10.2.2.2"), 222); @@ -833,7 +835,7 @@ TEST_P(BpfMetadataIntegrationTest, PolicyStreamGenerationTracksAcceptedDeltaNphd // Step 9: accept the first update on the new stream and retire resources from the old stream. sendNphdsDeltaResponse(*nphds_stream_, "3", {policy_host1_new_stream_resource}); EXPECT_TRUE(compareNphdsAck()); - test_server_->waitForCounterGe("cilium.hostmap.update_success", 4); + test_server_->waitForCounter("cilium.hostmap.update_success", testing::Ge(4)); EXPECT_EQ(policyStreamGeneration(), sotw_generation); EXPECT_EQ(resolveHostPolicyId("10.1.1.1"), 111); EXPECT_EQ(resolveHostPolicyId("10.2.2.2"), Cilium::ID::UNKNOWN); diff --git a/tests/cilium_http_integration.h b/tests/cilium_http_integration.h index 3ce1f1db7..aab9b4f15 100644 --- a/tests/cilium_http_integration.h +++ b/tests/cilium_http_integration.h @@ -3,6 +3,7 @@ #include #include +#include #include #include #include @@ -16,7 +17,6 @@ #include "test/integration/http_integration.h" #include "test/test_common/utility.h" -#include "absl/types/optional.h" #include "cilium/api/accesslog.pb.h" #include "tests/accesslog_server.h" @@ -41,7 +41,7 @@ class CiliumHttpIntegrationTest : public HttpIntegrationTest, return std::vector>{}; } - absl::optional<::cilium::LogEntry> + std::optional<::cilium::LogEntry> waitForAccessLogMessage(::cilium::EntryType entry_type, std::chrono::milliseconds timeout = TestUtility::DefaultTimeout) { return accessLogServer_.waitForMessage(entry_type, timeout); @@ -59,7 +59,7 @@ class CiliumHttpIntegrationTest : public HttpIntegrationTest, return accessLogServer_.expectDeniedTo(pred); } - static absl::optional + static std::optional getHeader(const Protobuf::RepeatedPtrField<::cilium::KeyValue>& headers, const std::string& name) { for (const auto& entry : headers) { @@ -67,7 +67,7 @@ class CiliumHttpIntegrationTest : public HttpIntegrationTest, return entry.value(); } } - return absl::nullopt; + return std::nullopt; } static bool hasHeader(const Protobuf::RepeatedPtrField<::cilium::KeyValue>& headers, diff --git a/tests/cilium_http_integration_test.cc b/tests/cilium_http_integration_test.cc index 7c13833ba..e4c9b28cc 100644 --- a/tests/cilium_http_integration_test.cc +++ b/tests/cilium_http_integration_test.cc @@ -6,6 +6,7 @@ #include #include +#include #include #include #include @@ -28,7 +29,6 @@ #include "absl/time/clock.h" #include "absl/time/time.h" -#include "absl/types/optional.h" #include "cilium/api/accesslog.pb.h" #include "cilium/host_map.h" #include "cilium/secret_watcher.h" @@ -275,6 +275,8 @@ const std::string cilium_proxy_config_fmt = R"EOF( "@type": type.googleapis.com/cilium.L7Policy access_log_path: "{{ test_udsdir }}/access_log.sock" - name: envoy.filters.http.router + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router route_config: name: policy_enabled virtual_hosts: @@ -323,7 +325,7 @@ class CiliumIntegrationTest : public CiliumHttpIntegrationTest { ASSERT_TRUE(response->waitForEndStream()); // Validate that request access log message with x-request-id is logged - absl::optional maybe_x_request_id; + std::optional maybe_x_request_id; EXPECT_TRUE(expectAccessLogDeniedTo([&maybe_x_request_id](const ::cilium::LogEntry& entry) { maybe_x_request_id = getHeader(entry.http().headers(), "x-request-id"); return entry.http().status() == 0; @@ -331,7 +333,7 @@ class CiliumIntegrationTest : public CiliumHttpIntegrationTest { ASSERT_TRUE(maybe_x_request_id.has_value()); // Validate that response x-request-id is the same as in request - absl::optional maybe_x_request_id_resp; + std::optional maybe_x_request_id_resp; EXPECT_TRUE( expectAccessLogResponseTo([&maybe_x_request_id_resp](const ::cilium::LogEntry& entry) { maybe_x_request_id_resp = getHeader(entry.http().headers(), "x-request-id"); @@ -358,8 +360,8 @@ class CiliumIntegrationTest : public CiliumHttpIntegrationTest { IntegrationCodecClientPtr makeL3DeniedHttpConnection() { // L3/L4 policy denial happens in the network filter during connection setup, so the reset may // reach the client before Envoy's HTTP test helper observes the connection as established. - return makeRawHttpConnection(makeClientConnection(lookupPort("http")), absl::nullopt, - absl::nullopt, /*wait_till_connected=*/false); + return makeRawHttpConnection(makeClientConnection(lookupPort("http")), std::nullopt, + std::nullopt, /*wait_till_connected=*/false); } void accepted(Http::TestRequestHeaderMapImpl&& headers) { @@ -368,7 +370,7 @@ class CiliumIntegrationTest : public CiliumHttpIntegrationTest { auto response = sendRequestAndWaitForResponse(headers, 0, default_response_headers_, 0); // Validate that request access log message with x-request-id is logged - absl::optional maybe_x_request_id; + std::optional maybe_x_request_id; EXPECT_TRUE(expectAccessLogRequestTo([&maybe_x_request_id](const ::cilium::LogEntry& entry) { maybe_x_request_id = getHeader(entry.http().headers(), "x-request-id"); return entry.http().status() == 0; @@ -376,7 +378,7 @@ class CiliumIntegrationTest : public CiliumHttpIntegrationTest { ASSERT_TRUE(maybe_x_request_id.has_value()); // Validate that response x-request-id is the same as in request - absl::optional maybe_x_request_id_resp; + std::optional maybe_x_request_id_resp; EXPECT_TRUE( expectAccessLogResponseTo([&maybe_x_request_id_resp](const ::cilium::LogEntry& entry) { maybe_x_request_id_resp = getHeader(entry.http().headers(), "x-request-id"); diff --git a/tests/cilium_http_upstream_integration_test.cc b/tests/cilium_http_upstream_integration_test.cc index c93931c28..b7895ef42 100644 --- a/tests/cilium_http_upstream_integration_test.cc +++ b/tests/cilium_http_upstream_integration_test.cc @@ -3,6 +3,7 @@ #include #include +#include #include #include #include @@ -18,7 +19,6 @@ #include "absl/time/clock.h" #include "absl/time/time.h" -#include "absl/types/optional.h" #include "cilium/api/accesslog.pb.h" #include "cilium/secret_watcher.h" #include "tests/bpf_metadata.h" // host_map_config @@ -360,7 +360,7 @@ class CiliumIntegrationTest : public CiliumHttpIntegrationTest { ASSERT_TRUE(response->waitForEndStream()); // Validate that request access log message with x-request-id is logged - absl::optional maybe_x_request_id; + std::optional maybe_x_request_id; EXPECT_TRUE(expectAccessLogDeniedTo([&maybe_x_request_id](const ::cilium::LogEntry& entry) { maybe_x_request_id = getHeader(entry.http().headers(), "x-request-id"); return entry.http().status() == 0; @@ -368,7 +368,7 @@ class CiliumIntegrationTest : public CiliumHttpIntegrationTest { ASSERT_TRUE(maybe_x_request_id.has_value()); // Validate that response x-request-id is the same as in request - absl::optional maybe_x_request_id_resp; + std::optional maybe_x_request_id_resp; EXPECT_TRUE( expectAccessLogResponseTo([&maybe_x_request_id_resp](const ::cilium::LogEntry& entry) { maybe_x_request_id_resp = getHeader(entry.http().headers(), "x-request-id"); @@ -388,7 +388,7 @@ class CiliumIntegrationTest : public CiliumHttpIntegrationTest { auto response = sendRequestAndWaitForResponse(headers, 0, default_response_headers_, 0); // Validate that request access log message with x-request-id is logged - absl::optional maybe_x_request_id; + std::optional maybe_x_request_id; EXPECT_TRUE(expectAccessLogRequestTo([&maybe_x_request_id](const ::cilium::LogEntry& entry) { maybe_x_request_id = getHeader(entry.http().headers(), "x-request-id"); return entry.http().status() == 0; @@ -396,7 +396,7 @@ class CiliumIntegrationTest : public CiliumHttpIntegrationTest { ASSERT_TRUE(maybe_x_request_id.has_value()); // Validate that response x-request-id is the same as in request - absl::optional maybe_x_request_id_resp; + std::optional maybe_x_request_id_resp; EXPECT_TRUE( expectAccessLogResponseTo([&maybe_x_request_id_resp](const ::cilium::LogEntry& entry) { maybe_x_request_id_resp = getHeader(entry.http().headers(), "x-request-id"); diff --git a/tests/cilium_tcp_integration_test.cc b/tests/cilium_tcp_integration_test.cc index 35f9a0145..c484247bc 100644 --- a/tests/cilium_tcp_integration_test.cc +++ b/tests/cilium_tcp_integration_test.cc @@ -199,7 +199,8 @@ TEST_P(CiliumTcpProxyIntegrationTest, CiliumTcpProxyDownstreamFlush) { ASSERT_TRUE(fake_upstream_connection->write(data, true)); - test_server_->waitForCounterGe("cluster.cluster1.upstream_flow_control_paused_reading_total", 1); + test_server_->waitForCounter("cluster.cluster1.upstream_flow_control_paused_reading_total", + testing::Ge(1)); EXPECT_EQ(test_server_->counter("cluster.cluster1.upstream_flow_control_resumed_reading_total") ->value(), 0); @@ -239,7 +240,7 @@ TEST_P(CiliumTcpProxyIntegrationTest, CiliumTcpProxyUpstreamFlush) { ASSERT_TRUE(tcp_client->write(data, true, true, std::chrono::milliseconds(30000))); - test_server_->waitForGaugeEq("tcp.tcp_stats.upstream_flush_active", 1); + test_server_->waitForGauge("tcp.tcp_stats.upstream_flush_active", testing::Eq(1)); ASSERT_TRUE(fake_upstream_connection->readDisable(false)); ASSERT_TRUE(fake_upstream_connection->waitForData(data.size())); ASSERT_TRUE(fake_upstream_connection->waitForHalfClose()); @@ -247,7 +248,7 @@ TEST_P(CiliumTcpProxyIntegrationTest, CiliumTcpProxyUpstreamFlush) { tcp_client->waitForHalfClose(); EXPECT_EQ(test_server_->counter("tcp.tcp_stats.upstream_flush_total")->value(), 1); - test_server_->waitForGaugeEq("tcp.tcp_stats.upstream_flush_active", 0); + test_server_->waitForGauge("tcp.tcp_stats.upstream_flush_active", testing::Eq(0)); } // Test that Envoy doesn't crash or assert when shutting down with an upstream @@ -273,7 +274,7 @@ TEST_P(CiliumTcpProxyIntegrationTest, CiliumTcpProxyUpstreamFlushEnvoyExit) { ASSERT_TRUE(tcp_client->write(data, true)); - test_server_->waitForGaugeEq("tcp.tcp_stats.upstream_flush_active", 1); + test_server_->waitForGauge("tcp.tcp_stats.upstream_flush_active", testing::Eq(1)); test_server_.reset(); ASSERT_TRUE(fake_upstream_connection->close()); ASSERT_TRUE(fake_upstream_connection->waitForDisconnect()); diff --git a/tests/cilium_tls_http_integration_test.cc b/tests/cilium_tls_http_integration_test.cc index 9d277c945..58ee44564 100644 --- a/tests/cilium_tls_http_integration_test.cc +++ b/tests/cilium_tls_http_integration_test.cc @@ -105,6 +105,8 @@ const std::string cilium_tls_http_proxy_config_fmt = R"EOF( "@type": type.googleapis.com/cilium.L7Policy access_log_path: "{{ test_udsdir }}/access_log.sock" - name: envoy.filters.http.router + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router route_config: name: policy_enabled virtual_hosts: @@ -136,6 +138,8 @@ const std::string cilium_tls_http_proxy_config_fmt = R"EOF( "@type": type.googleapis.com/cilium.L7Policy access_log_path: "{{ test_udsdir }}/access_log.sock" - name: envoy.filters.http.router + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router route_config: name: policy_enabled virtual_hosts: @@ -338,11 +342,11 @@ class CiliumHttpTLSIntegrationTest : public CiliumHttpIntegrationTest { EXPECT_TRUE(upstream_request_->complete()); EXPECT_EQ(0, upstream_request_->bodyLength()); - test_server_->waitForGaugeEq("http.config_test.downstream_cx_ssl_active", 1); + test_server_->waitForGauge("http.config_test.downstream_cx_ssl_active", testing::Eq(1)); cleanupUpstreamAndDownstream(); - test_server_->waitForGaugeEq("http.config_test.downstream_cx_ssl_active", 0); + test_server_->waitForGauge("http.config_test.downstream_cx_ssl_active", testing::Eq(0)); } // Upstream diff --git a/tests/cilium_tls_tcp_integration_test.cc b/tests/cilium_tls_tcp_integration_test.cc index 81e41b533..b3fd2c5ef 100644 --- a/tests/cilium_tls_tcp_integration_test.cc +++ b/tests/cilium_tls_tcp_integration_test.cc @@ -7,9 +7,9 @@ #include #include -#include #include #include +#include #include #include "envoy/buffer/buffer.h" @@ -33,6 +33,7 @@ #include "test/test_common/test_time_system.h" #include "test/test_common/utility.h" +#include "absl/functional/any_invocable.h" #include "tests/cilium_tcp_integration.h" #include "tests/cilium_tls_integration.h" @@ -197,20 +198,23 @@ class CiliumTLSIntegrationTest : public CiliumTcpIntegrationTest { EXPECT_CALL(*mock_buffer_factory_, createBuffer_(_, _, _)) .Times(AtLeast(1)) - .WillOnce(Invoke([&](std::function below_low, std::function above_high, - std::function above_overflow) -> Buffer::Instance* { - client_write_buffer_ = - new NiceMock(below_low, above_high, above_overflow); - ON_CALL(*client_write_buffer_, move(_)) - .WillByDefault(Invoke(client_write_buffer_, &MockWatermarkBuffer::baseMove)); - ON_CALL(*client_write_buffer_, drain(_)) - .WillByDefault(Invoke(client_write_buffer_, &MockWatermarkBuffer::trackDrains)); - return client_write_buffer_; - })) - .WillRepeatedly(Invoke([](std::function below_low, std::function above_high, - std::function above_overflow) -> Buffer::Instance* { - return new Buffer::WatermarkBuffer(below_low, above_high, above_overflow); - })); + .WillOnce( + Invoke([&](absl::AnyInvocable below_low, absl::AnyInvocable above_high, + absl::AnyInvocable above_overflow) -> Buffer::Instance* { + client_write_buffer_ = new NiceMock( + std::move(below_low), std::move(above_high), std::move(above_overflow)); + ON_CALL(*client_write_buffer_, move(_)) + .WillByDefault(Invoke(client_write_buffer_, &MockWatermarkBuffer::baseMove)); + ON_CALL(*client_write_buffer_, drain(_)) + .WillByDefault(Invoke(client_write_buffer_, &MockWatermarkBuffer::trackDrains)); + return client_write_buffer_; + })) + .WillRepeatedly( + Invoke([](absl::AnyInvocable below_low, absl::AnyInvocable above_high, + absl::AnyInvocable above_overflow) -> Buffer::Instance* { + return new Buffer::WatermarkBuffer(std::move(below_low), std::move(above_high), + std::move(above_overflow)); + })); // Set up the SSL client. Network::Address::InstanceConstSharedPtr address = Ssl::getSslAddress(version_, lookupPort("tcp_proxy")); @@ -466,8 +470,8 @@ TEST_P(CiliumTLSProxyIntegrationTest, CiliumTLSProxyDownstreamFlush) { ASSERT_TRUE(fake_upstream_connection->write(data, true)); - test_server_->waitForCounterGe("cluster.tls-cluster.upstream_flow_control_paused_reading_total", - 1); + test_server_->waitForCounter("cluster.tls-cluster.upstream_flow_control_paused_reading_total", + testing::Ge(1)); EXPECT_EQ(test_server_->counter("cluster.tls-cluster.upstream_flow_control_resumed_reading_total") ->value(), 0); @@ -512,7 +516,7 @@ TEST_P(CiliumTLSProxyIntegrationTest, CiliumTLSProxyUpstreamFlush) { ASSERT_TRUE(tcp_client->write(data, true, true, std::chrono::milliseconds(30000))); - test_server_->waitForGaugeEq("tcp.tcp_stats.upstream_flush_active", 1); + test_server_->waitForGauge("tcp.tcp_stats.upstream_flush_active", testing::Eq(1)); ASSERT_TRUE(fake_upstream_connection->readDisable(false)); ASSERT_TRUE( fake_upstream_connection->waitForData(data.size(), nullptr, 3 * TestUtility::DefaultTimeout)); @@ -522,7 +526,7 @@ TEST_P(CiliumTLSProxyIntegrationTest, CiliumTLSProxyUpstreamFlush) { tcp_client->waitForHalfClose(); EXPECT_EQ(test_server_->counter("tcp.tcp_stats.upstream_flush_total")->value(), 1); - test_server_->waitForGaugeEq("tcp.tcp_stats.upstream_flush_active", 0); + test_server_->waitForGauge("tcp.tcp_stats.upstream_flush_active", testing::Eq(0)); } // Test that Envoy doesn't crash or assert when shutting down with an upstream @@ -552,7 +556,7 @@ TEST_P(CiliumTLSProxyIntegrationTest, CiliumTLSProxyUpstreamFlushEnvoyExit) { ASSERT_TRUE(tcp_client->write(data, true)); - test_server_->waitForGaugeEq("tcp.tcp_stats.upstream_flush_active", 1); + test_server_->waitForGauge("tcp.tcp_stats.upstream_flush_active", testing::Eq(1)); test_server_.reset(); ASSERT_TRUE(fake_upstream_connection->close()); ASSERT_TRUE(fake_upstream_connection->waitForDisconnect()); diff --git a/tests/cilium_websocket_codec_integration_test.cc b/tests/cilium_websocket_codec_integration_test.cc index c4d1f70bf..03b2fed2e 100644 --- a/tests/cilium_websocket_codec_integration_test.cc +++ b/tests/cilium_websocket_codec_integration_test.cc @@ -124,7 +124,7 @@ TEST_P(CiliumWebSocketIntegrationTest, CiliumWebSocketUpstreamWritesFirst) { FakeRawConnectionPtr fake_upstream_connection; ASSERT_TRUE(fake_upstreams_[0]->waitForRawConnection(fake_upstream_connection)); - test_server_->waitForCounterGe("websocket.ping_sent_count", 1); + test_server_->waitForCounter("websocket.ping_sent_count", testing::Ge(1)); ASSERT_TRUE(fake_upstream_connection->write("hello")); tcp_client->waitForData("hello"); @@ -154,7 +154,7 @@ TEST_P(CiliumWebSocketIntegrationTest, CiliumWebSocketUpstreamDisconnect) { ASSERT_TRUE(fake_upstream_connection->waitForData(5, &received)); ASSERT_EQ(received, "hello"); - test_server_->waitForCounterGe("websocket.ping_sent_count", 1); + test_server_->waitForCounter("websocket.ping_sent_count", testing::Ge(1)); ASSERT_TRUE(fake_upstream_connection->write("world")); ASSERT_TRUE(fake_upstream_connection->close()); @@ -180,7 +180,7 @@ TEST_P(CiliumWebSocketIntegrationTest, CiliumWebSocketDownstreamDisconnect) { ASSERT_TRUE(fake_upstream_connection->write("world")); tcp_client->waitForData("world"); - test_server_->waitForCounterGe("websocket.ping_sent_count", 1); + test_server_->waitForCounter("websocket.ping_sent_count", testing::Ge(1)); ASSERT_TRUE(tcp_client->write("hello", true)); ASSERT_TRUE(fake_upstream_connection->waitForData(10, &received)); @@ -207,7 +207,7 @@ TEST_P(CiliumWebSocketIntegrationTest, CiliumWebSocketLargeWrite) { ASSERT_TRUE(fake_upstream_connection->write(data)); tcp_client->waitForData(data); - test_server_->waitForCounterGe("websocket.ping_sent_count", 1); + test_server_->waitForCounter("websocket.ping_sent_count", testing::Ge(1)); tcp_client->close(); ASSERT_TRUE(fake_upstream_connection->waitForHalfClose()); @@ -247,7 +247,7 @@ TEST_P(CiliumWebSocketIntegrationTest, CiliumWebSocketDownstreamFlush) { FakeRawConnectionPtr fake_upstream_connection; ASSERT_TRUE(fake_upstreams_[0]->waitForRawConnection(fake_upstream_connection)); - test_server_->waitForCounterGe("websocket.ping_sent_count", 1); + test_server_->waitForCounter("websocket.ping_sent_count", testing::Ge(1)); tcp_client->readDisable(true); ASSERT_TRUE(tcp_client->write("", true)); @@ -258,7 +258,8 @@ TEST_P(CiliumWebSocketIntegrationTest, CiliumWebSocketDownstreamFlush) { ASSERT_TRUE(fake_upstream_connection->write(data, true)); - test_server_->waitForCounterGe("cluster.cluster1.upstream_flow_control_paused_reading_total", 1); + test_server_->waitForCounter("cluster.cluster1.upstream_flow_control_paused_reading_total", + testing::Ge(1)); EXPECT_EQ(test_server_->counter("cluster.cluster1.upstream_flow_control_resumed_reading_total") ->value(), 0); @@ -290,7 +291,7 @@ TEST_P(CiliumWebSocketIntegrationTest, CiliumWebSocketUpstreamFlush) { FakeRawConnectionPtr fake_upstream_connection; ASSERT_TRUE(fake_upstreams_[0]->waitForRawConnection(fake_upstream_connection)); - test_server_->waitForCounterGe("websocket.ping_sent_count", 1); + test_server_->waitForCounter("websocket.ping_sent_count", testing::Ge(1)); ASSERT_TRUE(fake_upstream_connection->readDisable(true)); ASSERT_TRUE(fake_upstream_connection->write("", true)); @@ -301,7 +302,7 @@ TEST_P(CiliumWebSocketIntegrationTest, CiliumWebSocketUpstreamFlush) { ASSERT_TRUE(tcp_client->write(data, true, true, std::chrono::milliseconds(30000))); - test_server_->waitForGaugeEq("tcp.tcp_stats.upstream_flush_active", 1); + test_server_->waitForGauge("tcp.tcp_stats.upstream_flush_active", testing::Eq(1)); ASSERT_TRUE(fake_upstream_connection->readDisable(false)); std::string received; @@ -312,7 +313,7 @@ TEST_P(CiliumWebSocketIntegrationTest, CiliumWebSocketUpstreamFlush) { tcp_client->waitForHalfClose(); EXPECT_EQ(test_server_->counter("tcp.tcp_stats.upstream_flush_total")->value(), 1); - test_server_->waitForGaugeEq("tcp.tcp_stats.upstream_flush_active", 0); + test_server_->waitForGauge("tcp.tcp_stats.upstream_flush_active", testing::Eq(0)); } // Test that Envoy doesn't crash or assert when shutting down with an upstream @@ -336,11 +337,11 @@ TEST_P(CiliumWebSocketIntegrationTest, CiliumWebSocketUpstreamFlushEnvoyExit) { // it's thread before tcp_client starts writing. tcp_client->waitForHalfClose(); - test_server_->waitForCounterGe("websocket.ping_sent_count", 1); + test_server_->waitForCounter("websocket.ping_sent_count", testing::Ge(1)); ASSERT_TRUE(tcp_client->write(data, true)); - test_server_->waitForGaugeEq("tcp.tcp_stats.upstream_flush_active", 1); + test_server_->waitForGauge("tcp.tcp_stats.upstream_flush_active", testing::Eq(1)); test_server_.reset(); ASSERT_TRUE(fake_upstream_connection->close()); ASSERT_TRUE(fake_upstream_connection->waitForDisconnect()); diff --git a/tests/cilium_websocket_encap_integration_test.cc b/tests/cilium_websocket_encap_integration_test.cc index eb2fc758d..5f12671c4 100644 --- a/tests/cilium_websocket_encap_integration_test.cc +++ b/tests/cilium_websocket_encap_integration_test.cc @@ -195,7 +195,7 @@ TEST_P(CiliumWebSocketIntegrationTest, CiliumWebSocketHandshakeNonHTTPResponse) "world")); ASSERT_TRUE(fake_upstream_connection->close()); ASSERT_TRUE(fake_upstream_connection->waitForDisconnect()); - test_server_->waitForCounterGe("websocket.handshake_not_http", 1); + test_server_->waitForCounter("websocket.handshake_not_http", testing::Ge(1)); // Handshake errors close the downstream with NoFlush, which may be observed as either a // graceful FIN or an RST. The counter above is the behavior under test. @@ -226,7 +226,7 @@ TEST_P(CiliumWebSocketIntegrationTest, CiliumWebSocketHandshakeInvalidResponse) fmt::format(fmt::runtime(HANDSHAKE_RESPONSE_FMT), "invalid-hash"); ASSERT_TRUE(fake_upstream_connection->write(handshake_response)); - test_server_->waitForCounterGe("websocket.handshake_invalid_websocket_response", 1); + test_server_->waitForCounter("websocket.handshake_invalid_websocket_response", testing::Ge(1)); // Handshake errors close the downstream with NoFlush, which may be observed as either a // graceful FIN or an RST. The counter above is the behavior under test. @@ -452,7 +452,8 @@ TEST_P(CiliumWebSocketIntegrationTest, CiliumWebSocketDownstreamFlush) { ASSERT_TRUE(fake_upstream_connection->write("\x82\x7f\x03\x20\0\0"s)); ASSERT_TRUE(fake_upstream_connection->write(data, true)); - test_server_->waitForCounterGe("cluster.cluster1.upstream_flow_control_paused_reading_total", 1); + test_server_->waitForCounter("cluster.cluster1.upstream_flow_control_paused_reading_total", + testing::Ge(1)); EXPECT_EQ(test_server_->counter("cluster.cluster1.upstream_flow_control_resumed_reading_total") ->value(), 0); @@ -512,7 +513,7 @@ TEST_P(CiliumWebSocketIntegrationTest, CiliumWebSocketUpstreamFlush) { ASSERT_TRUE(fake_upstream_connection->waitForDisconnect()); tcp_client->waitForHalfClose(); - test_server_->waitForGaugeEq("tcp.tcp_stats.upstream_flush_active", 0); + test_server_->waitForGauge("tcp.tcp_stats.upstream_flush_active", testing::Eq(0)); EXPECT_EQ(test_server_->counter("tcp.tcp_stats.upstream_flush_total")->value(), 1); } @@ -551,7 +552,7 @@ TEST_P(CiliumWebSocketIntegrationTest, CiliumWebSocketUpstreamFlushEnvoyExit) { ASSERT_TRUE(tcp_client->write(data, true)); - // test_server_->waitForCounterGe("tcp.tcp_stats.upstream_flush_total", 1); + // test_server_->waitForCounter("tcp.tcp_stats.upstream_flush_total", testing::Ge(1)); test_server_.reset(); ASSERT_TRUE(fake_upstream_connection->close()); diff --git a/tests/cilium_websocket_policy_integration_test.cc b/tests/cilium_websocket_policy_integration_test.cc index 17b682c5a..aa98de3d7 100644 --- a/tests/cilium_websocket_policy_integration_test.cc +++ b/tests/cilium_websocket_policy_integration_test.cc @@ -268,7 +268,7 @@ TEST_P(CiliumWebSocketIntegrationTest, CiliumWebSocketUpstreamWritesFirst) { ASSERT_TRUE(fake_upstreams_[0]->waitForRawConnection(fake_upstream_connection)); // wait for at least one more ping to arrive as proof that the handshake is ready - test_server_->waitForCounterGe("websocket.ping_sent_count", previous_ping_count + 1); + test_server_->waitForCounter("websocket.ping_sent_count", testing::Ge(previous_ping_count + 1)); ASSERT_TRUE(fake_upstream_connection->write("hello")); tcp_client->waitForData("hello"); diff --git a/tests/health_check_sink_server.cc b/tests/health_check_sink_server.cc index 7a2915b05..bc81c98fb 100644 --- a/tests/health_check_sink_server.cc +++ b/tests/health_check_sink_server.cc @@ -2,6 +2,7 @@ #include #include +#include #include #include "envoy/data/core/v3/health_check_event.pb.h" @@ -11,7 +12,6 @@ #include "absl/base/thread_annotations.h" #include "absl/synchronization/mutex.h" #include "absl/time/time.h" -#include "absl/types/optional.h" #include "tests/uds_server.h" namespace Envoy { @@ -28,7 +28,7 @@ void HealthCheckSinkServer::clear() { events_.clear(); } -absl::optional +std::optional HealthCheckSinkServer::waitForEvent(std::chrono::milliseconds timeout) { absl::MutexLock lock(&mutex_); auto predicate = [this]() ABSL_SHARED_LOCKS_REQUIRED(mutex_) { diff --git a/tests/health_check_sink_server.h b/tests/health_check_sink_server.h index 4230e0153..ac88a4520 100644 --- a/tests/health_check_sink_server.h +++ b/tests/health_check_sink_server.h @@ -2,6 +2,7 @@ #include #include +#include #include #include "envoy/data/core/v3/health_check_event.pb.h" @@ -11,7 +12,6 @@ #include "absl/base/thread_annotations.h" #include "absl/synchronization/mutex.h" -#include "absl/types/optional.h" #include "tests/uds_server.h" namespace Envoy { @@ -22,7 +22,7 @@ class HealthCheckSinkServer : public UDSServer { ~HealthCheckSinkServer() override; void clear(); - absl::optional + std::optional waitForEvent(std::chrono::milliseconds timeout = TestUtility::DefaultTimeout); template diff --git a/tests/health_check_sink_test.cc b/tests/health_check_sink_test.cc index 6eb412f24..04be20fc3 100644 --- a/tests/health_check_sink_test.cc +++ b/tests/health_check_sink_test.cc @@ -1,6 +1,7 @@ #include #include +#include #include "envoy/data/core/v3/health_check_event.pb.h" #include "envoy/registry/registry.h" @@ -41,7 +42,7 @@ TEST(HealthCheckEventPipeSinkFactory, createHealthCheckEventSink) { cilium::HealthCheckEventPipeSink config; config.set_path("test_path"); Envoy::Protobuf::Any typed_config; - typed_config.PackFrom(config); + std::ignore = typed_config.PackFrom(config); NiceMock context; EXPECT_NE(factory->createHealthCheckEventSink(typed_config, context), nullptr); @@ -68,7 +69,7 @@ TEST(HealthCheckEventPipeSink, logTest) { EXPECT_TRUE(config.path().empty()); config.set_path(normal_path); Envoy::Protobuf::Any typed_config; - typed_config.PackFrom(config); + std::ignore = typed_config.PackFrom(config); NiceMock context; auto pipe_sink = factory->createHealthCheckEventSink(typed_config, context); EXPECT_NE(pipe_sink, nullptr); @@ -132,7 +133,7 @@ TEST(HealthCheckEventPipeSink, logTest) { // Set up 3rd client on a different socket cilium::HealthCheckEventPipeSink config3; config3.set_path(abstract_name); - typed_config.PackFrom(config3); + std::ignore = typed_config.PackFrom(config3); auto pipe_sink3 = factory->createHealthCheckEventSink(typed_config, context); EXPECT_NE(pipe_sink3, nullptr); diff --git a/tests/network_filter_test.cc b/tests/network_filter_test.cc index 12055972f..b90b54814 100644 --- a/tests/network_filter_test.cc +++ b/tests/network_filter_test.cc @@ -82,7 +82,7 @@ TEST(CiliumNetworkFilterTest, MissingMetadataNamespaceDoesNotCrash) { std::make_shared( 0, 456, false, false, 80, std::string("pod"), std::string(""), std::make_shared(), 7, ""), - StreamInfo::FilterState::StateType::ReadOnly, StreamInfo::FilterState::LifeSpan::Connection); + StreamInfo::FilterState::LifeSpan::Connection); instance.initializeReadFilterCallbacks(callbacks); Filter::CiliumL3::NetworkFilterTestPeer::setL7Proto(instance, "test.l7");