grpc
/
grpc-java
mirror of https://github.com/grpc/grpc-java.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

xds: Envoy proto sync to 2024-11-11 (#11816)

This commit is contained in:
MV Shiva 2025-01-17 14:58:52 +05:30 committed by GitHub
parent 4d8aff72dc
commit b44ebce45d
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
12 changed files with 174 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
repositories.bzl
View File

@ -141,10 +141,10 @@ def grpc_java_repositories(bzlmod = False):
if not native.existing_rule("envoy_api"):
http_archive(
name = "envoy_api",
sha256 = "f439add0cc01f718d53d6feb4d0972ac0d48b3e145c18b53439a3b5148a0cb6e",
strip_prefix = "data-plane-api-55f8b2351962d84c84a6534da67da1dd9f671c50",
sha256 = "ecf71817233eba19cc8b4ee14e126ffd5838065d5b5a92b2506258a42ac55199",
strip_prefix = "data-plane-api-0bc95493c5e88b7b07e62758d23b39341813a827",
urls = [
"https://github.com/envoyproxy/data-plane-api/archive/55f8b2351962d84c84a6534da67da1dd9f671c50.tar.gz",
"https://github.com/envoyproxy/data-plane-api/archive/0bc95493c5e88b7b07e62758d23b39341813a827.tar.gz",
],
)

11
xds/src/test/java/io/grpc/xds/RbacFilterTest.java
View File

@ -219,14 +219,15 @@ public class RbacFilterTest {
@SuppressWarnings("unchecked")
public void compositeRules() {
MetadataMatcher metadataMatcher = MetadataMatcher.newBuilder().build();
@SuppressWarnings("deprecation")
Permission permissionMetadata = Permission.newBuilder().setMetadata(metadataMatcher).build();
List<Permission> permissionList = Arrays.asList(
Permission.newBuilder().setOrRules(Permission.Set.newBuilder().addRules(
Permission.newBuilder().setMetadata(metadataMatcher).build()
).build()).build());
permissionMetadata).build()).build());
@SuppressWarnings("deprecation")
Principal principalMetadata = Principal.newBuilder().setMetadata(metadataMatcher).build();
List<Principal> principalList = Arrays.asList(
Principal.newBuilder().setNotId(
Principal.newBuilder().setMetadata(metadataMatcher).build()
).build());
Principal.newBuilder().setNotId(principalMetadata).build());
ConfigOrError<? extends FilterConfig> result = parse(permissionList, principalList);
assertThat(result.errorDetail).isNull();
assertThat(result.config).isInstanceOf(RbacConfig.class);

2
xds/third_party/envoy/import.sh vendored
View File

@ -17,7 +17,7 @@
set -e
# import VERSION from the google internal copybara_version.txt for Envoy
VERSION=742a3b02e3b2a9dfb877a7e378607c6ed0c2aa53
VERSION=0b90f64539c88dc3d2a6792dc714e8207bce0c08
DOWNLOAD_URL="https://github.com/envoyproxy/envoy/archive/${VERSION}.tar.gz"
DOWNLOAD_BASE_DIR="envoy-${VERSION}"
SOURCE_PROTO_BASE_DIR="${DOWNLOAD_BASE_DIR}/api"

1
xds/third_party/envoy/src/main/proto/envoy/config/core/v3/base.proto vendored
View File

@ -453,6 +453,7 @@ message HeaderValueOption {
message HeaderMap {
option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.HeaderMap";
// A list of header names and their values.
repeated HeaderValue headers = 1;
}

6
xds/third_party/envoy/src/main/proto/envoy/config/core/v3/protocol.proto vendored
View File

@ -123,6 +123,9 @@ message UpstreamHttpProtocolOptions {
// header when :ref:`override_auto_sni_header <envoy_v3_api_field_config.core.v3.UpstreamHttpProtocolOptions.override_auto_sni_header>`
// is set, as seen by the :ref:`router filter <config_http_filters_router>`.
// Does nothing if a filter before the http router filter sets the corresponding metadata.
//
// See :ref:`SNI configuration <start_quick_start_securing_sni_client>` for details on how this
// interacts with other validation options.
bool auto_sni = 1;
// Automatic validate upstream presented certificate for new upstream connections based on the
@ -130,6 +133,9 @@ message UpstreamHttpProtocolOptions {
// is set, as seen by the :ref:`router filter <config_http_filters_router>`.
// This field is intended to be set with ``auto_sni`` field.
// Does nothing if a filter before the http router filter sets the corresponding metadata.
//
// See :ref:`validation configuration <start_quick_start_securing_validation>` for how this interacts with
// other validation options.
bool auto_san_validation = 2;
// An optional alternative to the host/authority header to be used for setting the SNI value.

24
xds/third_party/envoy/src/main/proto/envoy/config/listener/v3/listener_components.proto vendored
View File

@ -201,24 +201,9 @@ message FilterChainMatch {
message FilterChain {
option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.listener.FilterChain";
// The configuration for on-demand filter chain. If this field is not empty in FilterChain message,
// a filter chain will be built on-demand.
// On-demand filter chains help speedup the warming up of listeners since the building and initialization of
// an on-demand filter chain will be postponed to the arrival of new connection requests that require this filter chain.
// Filter chains that are not often used can be set as on-demand.
message OnDemandConfiguration {
// The timeout to wait for filter chain placeholders to complete rebuilding.
// 1. If this field is set to 0, timeout is disabled.
// 2. If not specified, a default timeout of 15s is used.
// Rebuilding will wait until dependencies are ready, have failed, or this timeout is reached.
// Upon failure or timeout, all connections related to this filter chain will be closed.
// Rebuilding will start again on the next new connection.
google.protobuf.Duration rebuild_timeout = 1;
}
reserved 2, 8;
reserved 2;
reserved "tls_context";
reserved "tls_context", "on_demand_configuration";
// The criteria to use when matching a connection to this filter chain.
FilterChainMatch filter_chain_match = 1;
@ -269,11 +254,6 @@ message FilterChain {
// <envoy_v3_api_field_config.listener.v3.Listener.filter_chain_matcher>`
// requires that filter chains are uniquely named within a listener.
string name = 7;
// [#not-implemented-hide:] The configuration to specify whether the filter chain will be built on-demand.
// If this field is not empty, the filter chain will be built on-demand.
// Otherwise, the filter chain will be built normally and block listener warming.
OnDemandConfiguration on_demand_configuration = 8;
}
// Listener filter chain match configuration. This is a recursive structure which allows complex

6
xds/third_party/envoy/src/main/proto/envoy/config/overload/v3/overload.proto vendored
View File

@ -103,6 +103,12 @@ message ScaleTimersOverloadActionConfig {
// This affects the value of
// :ref:`FilterChain.transport_socket_connect_timeout <envoy_v3_api_field_config.listener.v3.FilterChain.transport_socket_connect_timeout>`.
TRANSPORT_SOCKET_CONNECT = 3;
// Adjusts the max connection duration timer for downstream HTTP connections.
// This affects the value of
// :ref:`HttpConnectionManager.common_http_protocol_options.max_connection_duration
// <envoy_v3_api_field_config.core.v3.HttpProtocolOptions.max_connection_duration>`.
HTTP_DOWNSTREAM_CONNECTION_MAX = 4;
}
message ScaleTimer {

51
xds/third_party/envoy/src/main/proto/envoy/config/rbac/v3/rbac.proto vendored
View File

@ -28,6 +28,14 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
// [#protodoc-title: Role Based Access Control (RBAC)]
enum MetadataSource {
// Query :ref:`dynamic metadata <well_known_dynamic_metadata>`
DYNAMIC = 0;
// Query :ref:`route metadata <envoy_v3_api_field_config.route.v3.Route.metadata>`
ROUTE = 1;
}
// Role Based Access Control (RBAC) provides service-level and method-level access control for a
// service. Requests are allowed or denied based on the ``action`` and whether a matching policy is
// found. For instance, if the action is ALLOW and a matching policy is found the request should be
@ -193,8 +201,27 @@ message Policy {
[(udpa.annotations.field_migrate).oneof_promotion = "expression_specifier"];
}
// SourcedMetadata enables matching against metadata from different sources in the request processing
// pipeline. It extends the base MetadataMatcher functionality by allowing specification of where the
// metadata should be sourced from, rather than only matching against dynamic metadata.
//
// The matcher can be configured to look up metadata from:
// * Dynamic metadata: Runtime metadata added by filters during request processing
// * Route metadata: Static metadata configured on the route entry
message SourcedMetadata {
// Metadata matcher configuration that defines what metadata to match against. This includes the filter name,
// metadata key path, and expected value.
type.matcher.v3.MetadataMatcher metadata_matcher = 1
[(validate.rules).message = {required: true}];
// Specifies which metadata source should be used for matching. If not set,
// defaults to DYNAMIC (dynamic metadata). Set to ROUTE to match against
// static metadata configured on the route entry.
MetadataSource metadata_source = 2 [(validate.rules).enum = {defined_only: true}];
}
// Permission defines an action (or actions) that a principal can take.
// [#next-free-field: 14]
// [#next-free-field: 15]
message Permission {
option (udpa.annotations.versioning).previous_message_type = "envoy.config.rbac.v2.Permission";
@ -237,8 +264,10 @@ message Permission {
// A port number range that describes a range of destination ports connecting to.
type.v3.Int32Range destination_port_range = 11;
// Metadata that describes additional information about the action.
type.matcher.v3.MetadataMatcher metadata = 7;
// Metadata that describes additional information about the action. This field is deprecated; please use
// :ref:`sourced_metadata<envoy_v3_api_field_config.rbac.v3.Permission.sourced_metadata>` instead.
type.matcher.v3.MetadataMatcher metadata = 7
[deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
// Negates matching the provided permission. For instance, if the value of
// ``not_rule`` would match, this permission would not match. Conversely, if
@ -274,12 +303,16 @@ message Permission {
// URI template path matching.
// [#extension-category: envoy.path.match]
core.v3.TypedExtensionConfig uri_template = 13;
// Matches against metadata from either dynamic state or route configuration. Preferred over the
// ``metadata`` field as it provides more flexibility in metadata source selection.
SourcedMetadata sourced_metadata = 14;
}
}
// Principal defines an identity or a group of identities for a downstream
// subject.
// [#next-free-field: 13]
// [#next-free-field: 14]
message Principal {
option (udpa.annotations.versioning).previous_message_type = "envoy.config.rbac.v2.Principal";
@ -356,8 +389,10 @@ message Principal {
// A URL path on the incoming HTTP request. Only available for HTTP.
type.matcher.v3.PathMatcher url_path = 9;
// Metadata that describes additional information about the principal.
type.matcher.v3.MetadataMatcher metadata = 7;
// Metadata that describes additional information about the principal. This field is deprecated; please use
// :ref:`sourced_metadata<envoy_v3_api_field_config.rbac.v3.Principal.sourced_metadata>` instead.
type.matcher.v3.MetadataMatcher metadata = 7
[deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
// Identifies the principal using a filter state object.
type.matcher.v3.FilterStateMatcher filter_state = 12;
@ -366,6 +401,10 @@ message Principal {
// ``not_id`` would match, this principal would not match. Conversely, if the
// value of ``not_id`` would not match, this principal would match.
Principal not_id = 8;
// Matches against metadata from either dynamic state or route configuration. Preferred over the
// ``metadata`` field as it provides more flexibility in metadata source selection.
SourcedMetadata sourced_metadata = 13;
}
}

28
xds/third_party/envoy/src/main/proto/envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.proto vendored
View File

@ -5,8 +5,10 @@ package envoy.extensions.filters.http.gcp_authn.v3;
import "envoy/config/core/v3/base.proto";
import "envoy/config/core/v3/http_uri.proto";
import "google/protobuf/duration.proto";
import "google/protobuf/wrappers.proto";
import "envoy/annotations/deprecation.proto";
import "udpa/annotations/status.proto";
import "validate/validate.proto";
@ -21,12 +23,21 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
// [#extension: envoy.filters.http.gcp_authn]
// Filter configuration.
// [#next-free-field: 7]
message GcpAuthnFilterConfig {
// The HTTP URI to fetch tokens from GCE Metadata Server(https://cloud.google.com/compute/docs/metadata/overview).
// The URL format is "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=[AUDIENCE]"
config.core.v3.HttpUri http_uri = 1 [(validate.rules).message = {required: true}];
//
// This field is deprecated because it does not match the API surface provided by the google auth libraries.
// Control planes should not attempt to override the metadata server URI.
// The cluster and timeout can be configured using the ``cluster`` and ``timeout`` fields instead.
// For backward compatibility, the cluster and timeout configured in this field will be used
// if the new ``cluster`` and ``timeout`` fields are not set.
config.core.v3.HttpUri http_uri = 1
[deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
// Retry policy for fetching tokens. This field is optional.
// Retry policy for fetching tokens.
// Not supported by all data planes.
config.core.v3.RetryPolicy retry_policy = 2;
// Token cache configuration. This field is optional.
@ -34,7 +45,20 @@ message GcpAuthnFilterConfig {
// Request header location to extract the token. By default (i.e. if this field is not specified), the token
// is extracted to the Authorization HTTP header, in the format "Authorization: Bearer <token>".
// Not supported by all data planes.
TokenHeader token_header = 4;
// Cluster to send traffic to the GCE metadata server. Not supported
// by all data planes; a data plane may instead have its own mechanism
// for contacting the metadata server.
string cluster = 5;
// Timeout for fetching the tokens from the GCE metadata server.
// Not supported by all data planes.
google.protobuf.Duration timeout = 6 [(validate.rules).duration = {
lt {seconds: 4294967296}
gte {}
}];
}
// Audience is the URL of the receiving service that performs token authentication.

2
xds/third_party/envoy/src/main/proto/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto vendored
View File

@ -691,7 +691,7 @@ message HttpConnectionManager {
// information about internal/external addresses.
//
// .. warning::
// In the next release, no IP addresses will be considered trusted. If you have tooling such as probes
// As of Envoy 1.33.0 no IP addresses will be considered trusted. If you have tooling such as probes
// on your private network which need to be treated as trusted (e.g. changing arbitrary x-envoy headers)
// you will have to manually include those addresses or CIDR ranges like:
//

22
xds/third_party/envoy/src/main/proto/envoy/extensions/transport_sockets/tls/v3/tls.proto vendored
View File

@ -25,7 +25,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
// [#extension: envoy.transport_sockets.tls]
// The TLS contexts below provide the transport socket configuration for upstream/downstream TLS.
// [#next-free-field: 6]
// [#next-free-field: 8]
message UpstreamTlsContext {
option (udpa.annotations.versioning).previous_message_type =
"envoy.api.v2.auth.UpstreamTlsContext";
@ -42,6 +42,26 @@ message UpstreamTlsContext {
// SNI string to use when creating TLS backend connections.
string sni = 2 [(validate.rules).string = {max_bytes: 255}];
// If true, replaces the SNI for the connection with the hostname of the upstream host, if
// the hostname is known due to either a DNS cluster type or the
// :ref:`hostname <envoy_v3_api_field_config.endpoint.v3.Endpoint.hostname>` is set on
// the host.
//
// See :ref:`SNI configuration <start_quick_start_securing_sni_client>` for details on how this
// interacts with other validation options.
bool auto_host_sni = 6;
// If true, replace any Subject Alternative Name validations with a validation for a DNS SAN matching
// the SNI value sent. Note that the validation will be against the actual requested SNI, regardless of how it
// is configured.
//
// For the common case where an SNI value is sent and it is expected that the server certificate contains a SAN
// matching that SNI value, this option will do the correct SAN validation.
//
// See :ref:`validation configuration <start_quick_start_securing_validation>` for how this interacts with
// other validation options.
bool auto_sni_san_validation = 7;
// If true, server-initiated TLS renegotiation will be allowed.
//
// .. attention::

56
xds/third_party/envoy/src/main/proto/envoy/type/v3/http_status.proto vendored
View File

@ -21,116 +21,172 @@ enum StatusCode {
// `enum` type.
Empty = 0;
// Continue - ``100`` status code.
Continue = 100;
// OK - ``200`` status code.
OK = 200;
// Created - ``201`` status code.
Created = 201;
// Accepted - ``202`` status code.
Accepted = 202;
// NonAuthoritativeInformation - ``203`` status code.
NonAuthoritativeInformation = 203;
// NoContent - ``204`` status code.
NoContent = 204;
// ResetContent - ``205`` status code.
ResetContent = 205;
// PartialContent - ``206`` status code.
PartialContent = 206;
// MultiStatus - ``207`` status code.
MultiStatus = 207;
// AlreadyReported - ``208`` status code.
AlreadyReported = 208;
// IMUsed - ``226`` status code.
IMUsed = 226;
// MultipleChoices - ``300`` status code.
MultipleChoices = 300;
// MovedPermanently - ``301`` status code.
MovedPermanently = 301;
// Found - ``302`` status code.
Found = 302;
// SeeOther - ``303`` status code.
SeeOther = 303;
// NotModified - ``304`` status code.
NotModified = 304;
// UseProxy - ``305`` status code.
UseProxy = 305;
// TemporaryRedirect - ``307`` status code.
TemporaryRedirect = 307;
// PermanentRedirect - ``308`` status code.
PermanentRedirect = 308;
// BadRequest - ``400`` status code.
BadRequest = 400;
// Unauthorized - ``401`` status code.
Unauthorized = 401;
// PaymentRequired - ``402`` status code.
PaymentRequired = 402;
// Forbidden - ``403`` status code.
Forbidden = 403;
// NotFound - ``404`` status code.
NotFound = 404;
// MethodNotAllowed - ``405`` status code.
MethodNotAllowed = 405;
// NotAcceptable - ``406`` status code.
NotAcceptable = 406;
// ProxyAuthenticationRequired - ``407`` status code.
ProxyAuthenticationRequired = 407;
// RequestTimeout - ``408`` status code.
RequestTimeout = 408;
// Conflict - ``409`` status code.
Conflict = 409;
// Gone - ``410`` status code.
Gone = 410;
// LengthRequired - ``411`` status code.
LengthRequired = 411;
// PreconditionFailed - ``412`` status code.
PreconditionFailed = 412;
// PayloadTooLarge - ``413`` status code.
PayloadTooLarge = 413;
// URITooLong - ``414`` status code.
URITooLong = 414;
// UnsupportedMediaType - ``415`` status code.
UnsupportedMediaType = 415;
// RangeNotSatisfiable - ``416`` status code.
RangeNotSatisfiable = 416;
// ExpectationFailed - ``417`` status code.
ExpectationFailed = 417;
// MisdirectedRequest - ``421`` status code.
MisdirectedRequest = 421;
// UnprocessableEntity - ``422`` status code.
UnprocessableEntity = 422;
// Locked - ``423`` status code.
Locked = 423;
// FailedDependency - ``424`` status code.
FailedDependency = 424;
// UpgradeRequired - ``426`` status code.
UpgradeRequired = 426;
// PreconditionRequired - ``428`` status code.
PreconditionRequired = 428;
// TooManyRequests - ``429`` status code.
TooManyRequests = 429;
// RequestHeaderFieldsTooLarge - ``431`` status code.
RequestHeaderFieldsTooLarge = 431;
// InternalServerError - ``500`` status code.
InternalServerError = 500;
// NotImplemented - ``501`` status code.
NotImplemented = 501;
// BadGateway - ``502`` status code.
BadGateway = 502;
// ServiceUnavailable - ``503`` status code.
ServiceUnavailable = 503;
// GatewayTimeout - ``504`` status code.
GatewayTimeout = 504;
// HTTPVersionNotSupported - ``505`` status code.
HTTPVersionNotSupported = 505;
// VariantAlsoNegotiates - ``506`` status code.
VariantAlsoNegotiates = 506;
// InsufficientStorage - ``507`` status code.
InsufficientStorage = 507;
// LoopDetected - ``508`` status code.
LoopDetected = 508;
// NotExtended - ``510`` status code.
NotExtended = 510;
// NetworkAuthenticationRequired - ``511`` status code.
NetworkAuthenticationRequired = 511;
}