Skip to content

Commit 493c9d5

Browse files
zirainarkodgzhaohuabing
authored
[release/v1.4] cherry-pick for v1.4.3 (#6767)
* fix: don't block deployment creating when missing secret in EnvoyProxy (#6692) * fix: don't block deployment creating when missing secret in EnvoyProxy Signed-off-by: zirain <[email protected]> * sort httpFilters on name if priority order is same (#6600) * sort httpFilters on name if priority order is same ensures stability across translations, mitigating listener drains https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/listeners/listener_filters#filter-chain-only-update Signed-off-by: Arko Dasgupta <[email protected]> Signed-off-by: zirain <[email protected]> * fix: add missing HTTP filters for HTTP3 listener (#6584) * fix: add missing HTTP filters for HTTP3 listener Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: zirain <[email protected]> * fix: use per-route configuration for session persistence to avoid listener drain (#6580) use per-route configuration for session persistence to avoid listener darin Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: zirain <[email protected]> * Fix EEP CEL Validations around FullDuplexStreamed and FailOpen (#6560) * Fix EEP CEL Validations around FullDuplexStreamed and FailOpen Fixes: #6559 Signed-off-by: Arko Dasgupta <[email protected]> Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> Signed-off-by: Arko Dasgupta <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: Arko Dasgupta <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]>
1 parent da09b3a commit 493c9d5

29 files changed

+954
-268
lines changed

‎api/v1alpha1/ext_proc_types.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ type ExtProcProcessingMode struct {
6868
// +kubebuilder:validation:XValidation:message="BackendRefs must be used, backendRef is not supported.",rule="!has(self.backendRef)"
6969
// +kubebuilder:validation:XValidation:message="BackendRefs only supports Service and Backend kind.",rule="has(self.backendRefs) ? self.backendRefs.all(f, f.kind == 'Service' || f.kind == 'Backend') : true"
7070
// +kubebuilder:validation:XValidation:message="BackendRefs only supports Core and gateway.envoyproxy.io group.",rule="has(self.backendRefs) ? (self.backendRefs.all(f, f.group == \"\" || f.group == 'gateway.envoyproxy.io')) : true"
71-
// +kubebuilder:validation:XValidation:message="If FullDuplexStreamed body processing mode is used, FailOpen must be false.",rule="!(has(self.failOpen) && self.failOpen == true && ((has(self.processingMode.request.body) && self.processingMode.request.body == 'FullDuplexStreamed') || (has(self.processingMode.response.body) && self.processingMode.response.body == 'FullDuplexStreamed')))"
71+
// +kubebuilder:validation:XValidation:message="If FullDuplexStreamed body processing mode is used, FailOpen must be false.",rule="!(has(self.failOpen) && self.failOpen == true && has(self.processingMode) && ((has(self.processingMode.request) && has(self.processingMode.request.body) && self.processingMode.request.body == 'FullDuplexStreamed') || (has(self.processingMode.response) && has(self.processingMode.response.body) && self.processingMode.response.body == 'FullDuplexStreamed')))"
7272
type ExtProc struct {
7373
BackendCluster `json:",inline"`
7474

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1044,10 +1044,11 @@ spec:
10441044
== "" || f.group == ''gateway.envoyproxy.io'')) : true'
10451045
- message: If FullDuplexStreamed body processing mode is used, FailOpen
10461046
must be false.
1047-
rule: '!(has(self.failOpen) && self.failOpen == true && ((has(self.processingMode.request.body)
1047+
rule: '!(has(self.failOpen) && self.failOpen == true && has(self.processingMode)
1048+
&& ((has(self.processingMode.request) && has(self.processingMode.request.body)
10481049
&& self.processingMode.request.body == ''FullDuplexStreamed'')
1049-
|| (has(self.processingMode.response.body) && self.processingMode.response.body
1050-
== ''FullDuplexStreamed'')))'
1050+
|| (has(self.processingMode.response) && has(self.processingMode.response.body)
1051+
&& self.processingMode.response.body == ''FullDuplexStreamed'')))'
10511052
maxItems: 16
10521053
type: array
10531054
lua:

‎charts/gateway-helm/crds/generated/gateway.envoyproxy.io_envoyextensionpolicies.yaml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1043,10 +1043,11 @@ spec:
10431043
== "" || f.group == ''gateway.envoyproxy.io'')) : true'
10441044
- message: If FullDuplexStreamed body processing mode is used, FailOpen
10451045
must be false.
1046-
rule: '!(has(self.failOpen) && self.failOpen == true && ((has(self.processingMode.request.body)
1046+
rule: '!(has(self.failOpen) && self.failOpen == true && has(self.processingMode)
1047+
&& ((has(self.processingMode.request) && has(self.processingMode.request.body)
10471048
&& self.processingMode.request.body == ''FullDuplexStreamed'')
1048-
|| (has(self.processingMode.response.body) && self.processingMode.response.body
1049-
== ''FullDuplexStreamed'')))'
1049+
|| (has(self.processingMode.response) && has(self.processingMode.response.body)
1050+
&& self.processingMode.response.body == ''FullDuplexStreamed'')))'
10501051
maxItems: 16
10511052
type: array
10521053
lua:

‎internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1176,14 +1176,14 @@ xds:
11761176
initialStreamWindowSize: 65536
11771177
maxConcurrentStreams: 100
11781178
httpFilters:
1179-
- name: envoy.filters.http.grpc_web
1180-
typedConfig:
1181-
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
11821179
- name: envoy.filters.http.grpc_stats
11831180
typedConfig:
11841181
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_stats.v3.FilterConfig
11851182
emitFilterState: true
11861183
statsForAllMethods: true
1184+
- name: envoy.filters.http.grpc_web
1185+
typedConfig:
1186+
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
11871187
- name: envoy.filters.http.router
11881188
typedConfig:
11891189
'@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

‎internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -953,12 +953,6 @@
953953
"maxConcurrentStreams": 100
954954
},
955955
"httpFilters": [
956-
{
957-
"name": "envoy.filters.http.grpc_web",
958-
"typedConfig": {
959-
"@type": "type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb"
960-
}
961-
},
962956
{
963957
"name": "envoy.filters.http.grpc_stats",
964958
"typedConfig": {
@@ -967,6 +961,12 @@
967961
"statsForAllMethods": true
968962
}
969963
},
964+
{
965+
"name": "envoy.filters.http.grpc_web",
966+
"typedConfig": {
967+
"@type": "type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb"
968+
}
969+
},
970970
{
971971
"name": "envoy.filters.http.router",
972972
"typedConfig": {

‎internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -593,14 +593,14 @@ xds:
593593
initialStreamWindowSize: 65536
594594
maxConcurrentStreams: 100
595595
httpFilters:
596-
- name: envoy.filters.http.grpc_web
597-
typedConfig:
598-
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
599596
- name: envoy.filters.http.grpc_stats
600597
typedConfig:
601598
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_stats.v3.FilterConfig
602599
emitFilterState: true
603600
statsForAllMethods: true
601+
- name: envoy.filters.http.grpc_web
602+
typedConfig:
603+
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
604604
- name: envoy.filters.http.router
605605
typedConfig:
606606
'@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

‎internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.listener.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -229,14 +229,14 @@ xds:
229229
initialStreamWindowSize: 65536
230230
maxConcurrentStreams: 100
231231
httpFilters:
232-
- name: envoy.filters.http.grpc_web
233-
typedConfig:
234-
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
235232
- name: envoy.filters.http.grpc_stats
236233
typedConfig:
237234
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_stats.v3.FilterConfig
238235
emitFilterState: true
239236
statsForAllMethods: true
237+
- name: envoy.filters.http.grpc_web
238+
typedConfig:
239+
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
240240
- name: envoy.filters.http.router
241241
typedConfig:
242242
'@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

‎internal/gatewayapi/testdata/backend-tls-settings-invalid.in.yaml‎

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
envoyProxyForGatewayClass:
2+
apiVersion: gateway.envoyproxy.io/v1alpha1
3+
kind: EnvoyProxy
4+
metadata:
5+
namespace: envoy-gateway-system
6+
name: test
7+
spec:
8+
backendTLS:
9+
clientCertificateRef:
10+
group: ""
11+
kind: Secret
12+
namespace: envoy-gateway-system
13+
name: client-auth
14+
ciphers:
15+
- ECDHE-RSA-AES128-GCM-SHA256
16+
- ECDHE-ECDSA-AES256-GCM-SHA384
17+
ecdhCurves:
18+
- ECDHE-RSA-AES128-GCM-SHA256
19+
- ECDHE-ECDSA-AES256-GCM-SHA384
20+
maxVersion: tls1.3
21+
minVersion: tls1.2
22+
SignatureAlgorithms:
23+
- RSA-PSS-RSAE-SHA256
24+
- ECDSA-SECP256R1-SHA256
25+
alpnProtocols:
26+
- HTTP/1.1
27+
- HTTP/2
28+
29+
gateways:
30+
- apiVersion: gateway.networking.k8s.io/v1
31+
kind: Gateway
32+
metadata:
33+
namespace: envoy-gateway
34+
name: gateway-1
35+
spec:
36+
gatewayClassName: envoy-gateway-class
37+
listeners:
38+
- name: http
39+
protocol: HTTP
40+
port: 80
41+
allowedRoutes:
42+
namespaces:
43+
from: All
44+
httpRoutes:
45+
- apiVersion: gateway.networking.k8s.io/v1
46+
kind: HTTPRoute
47+
metadata:
48+
namespace: default
49+
name: httproute-1
50+
spec:
51+
parentRefs:
52+
- namespace: envoy-gateway
53+
name: gateway-1
54+
rules:
55+
- matches:
56+
- path:
57+
value: "/"
58+
backendRefs:
59+
- group: gateway.envoyproxy.io
60+
kind: Backend
61+
name: backend-1
62+
- apiVersion: gateway.networking.k8s.io/v1
63+
kind: HTTPRoute
64+
metadata:
65+
namespace: default
66+
name: httproute-2
67+
spec:
68+
parentRefs:
69+
- namespace: envoy-gateway
70+
name: gateway-1
71+
rules:
72+
- matches:
73+
- path:
74+
value: "/"
75+
backendRefs:
76+
- group: gateway.envoyproxy.io
77+
kind: Backend
78+
name: backend-2
79+
80+
configMaps:
81+
- apiVersion: v1
82+
kind: ConfigMap
83+
metadata:
84+
name: ca-cmap
85+
namespace: default
86+
data:
87+
ca.crt: |
88+
-----BEGIN CERTIFICATE-----
89+
MIIDJzCCAg+gAwIBAgIUAl6UKIuKmzte81cllz5PfdN2IlIwDQYJKoZIhvcNAQEL
90+
BQAwIzEQMA4GA1UEAwwHbXljaWVudDEPMA0GA1UECgwGa3ViZWRiMB4XDTIzMTAw
91+
MjA1NDE1N1oXDTI0MTAwMTA1NDE1N1owIzEQMA4GA1UEAwwHbXljaWVudDEPMA0G
92+
A1UECgwGa3ViZWRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwSTc
93+
1yj8HW62nynkFbXo4VXKv2jC0PM7dPVky87FweZcTKLoWQVPQE2p2kLDK6OEszmM
94+
yyr+xxWtyiveremrWqnKkNTYhLfYPhgQkczib7eUalmFjUbhWdLvHakbEgCodn3b
95+
kz57mInX2VpiDOKg4kyHfiuXWpiBqrCx0KNLpxo3DEQcFcsQTeTHzh4752GV04RU
96+
Ti/GEWyzIsl4Rg7tGtAwmcIPgUNUfY2Q390FGqdH4ahn+mw/6aFbW31W63d9YJVq
97+
ioyOVcaMIpM5B/c7Qc8SuhCI1YGhUyg4cRHLEw5VtikioyE3X04kna3jQAj54YbR
98+
bpEhc35apKLB21HOUQIDAQABo1MwUTAdBgNVHQ4EFgQUyvl0VI5vJVSuYFXu7B48
99+
6PbMEAowHwYDVR0jBBgwFoAUyvl0VI5vJVSuYFXu7B486PbMEAowDwYDVR0TAQH/
100+
BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAMLxrgFVMuNRq2wAwcBt7SnNR5Cfz
101+
2MvXq5EUmuawIUi9kaYjwdViDREGSjk7JW17vl576HjDkdfRwi4E28SydRInZf6J
102+
i8HZcZ7caH6DxR335fgHVzLi5NiTce/OjNBQzQ2MJXVDd8DBmG5fyatJiOJQ4bWE
103+
A7FlP0RdP3CO3GWE0M5iXOB2m1qWkE2eyO4UHvwTqNQLdrdAXgDQlbam9e4BG3Gg
104+
d/6thAkWDbt/QNT+EJHDCvhDRKh1RuGHyg+Y+/nebTWWrFWsktRrbOoHCZiCpXI1
105+
3eXE6nt0YkgtDxG22KqnhpAg9gUSs2hlhoxyvkzyF0mu6NhPlwAgnq7+/Q==
106+
-----END CERTIFICATE-----
107+
backendTLSPolicies:
108+
- apiVersion: gateway.networking.k8s.io/v1alpha3
109+
kind: BackendTLSPolicy
110+
metadata:
111+
name: policy-btls-for-backend-1
112+
namespace: default
113+
spec:
114+
targetRefs:
115+
- group: gateway.envoyproxy.io
116+
kind: Backend
117+
name: backend-1
118+
validation:
119+
caCertificateRefs:
120+
- kind: ConfigMap
121+
group: ""
122+
name: ca-cmap
123+
hostname: example.com
124+
subjectAltNames:
125+
- type: URI
126+
uri: spiffe://cluster.local/ns/istio-demo/sa/echo-v1
127+
- type: Hostname
128+
hostname: subdomain.secondexample.com
129+
130+
backends:
131+
- apiVersion: gateway.envoyproxy.io/v1alpha1
132+
kind: Backend
133+
metadata:
134+
name: backend-1
135+
namespace: default
136+
spec:
137+
# the BackendTLSPolicy should override the one from Backend
138+
# the generated ir tls settings should contain the tls settings from Backend, BackendTLSPolicy and EnvoyProxy
139+
tls:
140+
caCertificateRefs:
141+
- name: ca-cmap
142+
group: ""
143+
kind: ConfigMap
144+
endpoints:
145+
- ip:
146+
address: 1.1.1.1
147+
port: 3001
148+
- apiVersion: gateway.envoyproxy.io/v1alpha1
149+
kind: Backend
150+
metadata:
151+
name: backend-2
152+
namespace: default
153+
spec:
154+
endpoints:
155+
- ip:
156+
address: 2.2.2.2
157+
port: 3001

0 commit comments

Comments
 (0)