Commit Graph

5262 Commits

Author SHA1 Message Date
sanjaypujare e4ab8287d0
xds: get rid of legacy SDS and file watching code (#8276) 2021-06-23 11:13:19 -07:00
yifeizhuang c540229d79
core: allow per-service/method executor (#8266)
Add ServerCallExecutorSupplier interface in serverBuilder to allow defining which executor to to handle the server call.
Split StreamCreated() contextRunnable into two to support this new feature: one for method lookup, the other for server call handling. methodLookup() runs on default executor, handleServerCall() may run on the executorSupplier executor.
callbacks are queued after methodLookup() and handleServerCall() on serializing executor to ensure stream listener is set when callbacks starts running.
Make executor settable in serializing executor to allow switching executor for the server call handling runnable as a result of the outcome of the method lookup runnable.
2021-06-21 11:17:36 -07:00
Chengyuan Zhang 9a8bc10f51
xds: unify client and server handling HttpConnectionManager (#8228)
Enables parsing HttpConnectionManager filter for the server side TCP listener, with the same codepath for handling it on the client side. Major changes include:

- Remodeled LdsUpdate with HttpConnectionManager. Now LdsUpdate is an oneof of HttpConnectionManager (for client side) or Listener (for server side). Each of Listener's FiliterChain contains an HttpConnectionManager (required).
Refactored code for validating and parsing the TCP Listener (for server side), put it into ClientXdsClient. The common part of validating/parsing HttpConnectionManager is reused/shared for client side.
- Included the name of FilterChain in the parsed form. As specified by the API, each FilterChain has a unique name. If the name is not provided by the control plane, a UUID is used. FilterChain names can be used for bookkeeping a set of FilterChain easily (e.g., used as map key).
- Added methods isSupportedOnClients() and isSupportedOnServers() to the Filter interface. Parsing the top-level HttpFilter requires knowing if the HttpFilter implementation is supported for the target usage (client-side or server-side). Note, parsing override HttpFilter configs does not need to know whether the config is used for an HttpFilter that is only supported for the client-side or server side.
- Added a new kind of Route: Route with non-forwarding action. Updated the XdsNameResolver being able to handle Route with non-forwarding action: if such a Route is matched to an RPC, that RPC is failed. Note, it is possible that XdsNameResolver receives xDS updates with all Routes with non-forwarding action. That is, the service config will not reference any cluster. Such case can be handled by cluster_manager LB policy's LB config parser: the parser returns the error to Channel and the Channel will handle it as error service config.
2021-06-18 11:57:36 -07:00
Eric Anderson 2258d2e3e9 netty-shaded: Use compile instead of runtime dep in pom for core
This is essentially re-adding #5901 after its behavior was "reverted"
in #8242. At the time grpc-core was the only dependency, so this change
only applies to grpc-core to make it a tiny bit easier to swap to
runtime scope in the future.
2021-06-18 07:48:04 -07:00
Eric Anderson 79e75bace4
Port from Travis-CI to GitHub Actions
Travis-CI no longer has a free tier (only a free trial). That was a
major reason we used Travis-CI, so that external contributors would be
able to run the CI on their forks. Iterating on a Travis config in a
personal repo was also quite convenient. The other reason was that
Travis-CI was safe to run even with untrusted code.

Since the introduction of the permissions field in workflows, GitHub
Actions appears safe to run untrusted code and has a free tier for
external contributors. GitHub Actions and Google Cloud Build are the
main contenders for a Kokoro replacement, but Cloud Build isn't safe for
untrusted code. Instead of migrating to Travis-CI.com from
Travis-CI.org, let's migrate to GitHub Actions and gain some familiarity.

I've really appreciated Travis-CI.org and have wanted to pay for it for
years but wasn't about to give it write permission to the repo. I'm
disappointed to migrate off it, now that the permissions issues have
been sorted out.
2021-06-17 13:32:56 -07:00
Eric Anderson 6201db2d96 Fix aarch64 emulation-triggered flakes
Because we are emulating aarch64 during testing the tests run slower
than normal. Bumping the timeout seems easy and obvious for
StressTestClientTest. The warmup for BinlogHelperTest mirrors what we've
done with timing-based tests in the past. Hopefully that is enough to
lower variance so that it passes consistently; seems likely. I'd rather
not increase the timing fuzziness if I can avoid it, as that reduces the
test's ability to detect issues.

Fixes #8135 (mostly+hopefully)
2021-06-17 13:32:11 -07:00
Sergii Tkachenko 814655cdde buildscripts: add option to use xds-k8s test driver from a fork 2021-06-16 19:09:04 -04:00
ZHANG Dapeng e980ebd118
Start 1.40.0 development cycle (#8263) 2021-06-16 08:04:43 -07:00
Daniel Zou dc74a31be1
Modify netty-shaded resources to reference shaded class names (#8258) 2021-06-16 07:56:48 -07:00
yifeizhuang 84eb285742
xds: add override rbacfilter type url RbacPerProto (#8262) 2021-06-15 16:50:50 -07:00
Chengyuan Zhang 25122f9e83
api: clean up duplicated method in InternalServerInterceptors (#8261) 2021-06-15 15:11:56 -07:00
yifeizhuang c8ba601529
xds: add rbac http filter (#8251) 2021-06-14 12:54:07 -07:00
Chengyuan Zhang 2cbc7fc3a5
grpclb: skip fallback if the LB is already in fallback mode (#8253)
Manually checks if the gRPCLB policy is already in fallback mode when trying to fallback due to receiving address update without LB addresses. 

Commit b956f8852d added an invariant check in the FallbackModeTask runnable to ensure the task is fired only when the LB is not already in fallback mode. However, that commit missed the case that receiving address updates without LB addresses can trigger the run of FallbackModeTask runnable, because the existing implementation chose to reuse the code in FallbackModeTask. In such case, running FallbackModeTask could break the invariant check as the LB policy may already in fallback mode.

This change eliminates the reuse of FallbackModeTask for handling address update without LB address. That is, every time receiving address update, we manually check if it is already in fallback instead of reusing to FallbackModeTask perform the check.

Note there was a discussion brought up whether we should force entering fallback (shutdown existing subchannels) or we should still keep the balancer connection. Different languages have already diverged on this. Go shuts down the balancer connection and all subchannel connections to force using fallback addresses. C-core keep the balancer connection working and does not shutdown subchannels, only let fallback happens after the existing balancer connection and subchannel connections become broken. Java shuts down the balancer connection but not subchannels. This change does not try to change the existing behavior, but only fixes the invariant check breakage.

-------------------
See bug reported in  b/190700476
2021-06-11 14:53:18 -07:00
Eric Anderson 5642e01243
Replace failOnVersionConflict() with custom requireUpperBoundDeps
failOnVersionConflict has never been good for us. It is equivalent to
Maven dependencyConvergence which we discourage our users to use because
it is too tempermental and _creates_ version skew issues over time.
However, we had no real alternative for determining if our deps would be
misinterpeted by Maven.

failOnVersionConflict has been a constant drain and makes it really hard
to do seemingly-trivial upgrades. As evidenced by protobuf/build.gradle
in this change, it also caused _us_ to introduce a version downgrade.

This introduces our own custom requireUpperBoundDeps implementation so
that we can get back to simple dependency upgrades _and_ increase our
confidence in a consistent dependency tree.
2021-06-11 14:01:18 -07:00
Penn (Dapeng) Zhang aa18b2c228 grpclb: update load_balancer.proto 2021-06-11 13:28:48 -07:00
Penn (Dapeng) Zhang 11c0d1d81e rls: update rls proto 2021-06-11 13:28:48 -07:00
markb74 b846ae79bb
Allow SecurityPolicy definitions. (#8254)
Internally this was package visible to retain strict control
over the available policies. However, that kind of strict control
doesn't work with the open-source version, since users will want
to create their own policies. There's at least google-specific
policy internally.
2021-06-11 18:02:36 +02:00
Eric Anderson 8360e60330 netty/shaded: Leverage shadow plugin's publishing support
https://github.com/johnrengelman/shadow/pull/543 fixed project support,
which means the workaround is no longer necessary.
2021-06-11 08:32:11 -07:00
Chengyuan Zhang 91948b2606
xds: fix lint (#8248) 2021-06-09 14:57:26 -07:00
Chengyuan Zhang d41094944c
xds: equally weight endpoints within locality if endpoint-level weight unspecified (#8245)
Use a multiplier of 1 for endpoints with endpoint-level load balancing weight unspecified when computing weights for mixing-locality load balancing. Therefore, if a locality has endpoints without endpoint-level load balancing weight, they are weighted equally within the locality.
2021-06-09 12:04:17 -07:00
yifeizhuang b7f3fddc76
xds, rbac: implement rbac engine (#8168) 2021-06-08 14:45:11 -07:00
Eric Anderson d4c31ffad4 netty/shaded: Include deps automatically
Previously it required manually listing the direct deps of grpc-netty
which is error-prone as evidinced by the fact that we were missing
multiple deps (guava, perfmark-api). This didn't cause a problem because
grpc-core happens to bring in these same deps.
2021-06-08 12:27:12 -07:00
Chengyuan Zhang fa4b980e07
xds: use defaults for unspecified ring_hash_lb_config values (#8237)
Sets ring_hash LB config to its default values (min_ring_size = 1024 and max_ring_size = 8M) if not given by the control plane. This applies to both parsing RingHashLbConfig from xDS proto and parsing RingHashConfig from the JSON config (currently not used). If the values are given by the control plane, they are validated such that min_ring_size is not less than max_ring_size and do not exceed the 8M limit.
2021-06-07 14:26:50 -07:00
Eric Anderson 29618a6bb6 Bump Protobuf to 3.17.2
Removed some references to the protobuf version from COMPILING.md and
compiler/README.md to make updates a tiny bit easier.
2021-06-07 11:20:48 -07:00
Chengyuan Zhang e51a17574f
xds: append a random number to C2P generated node id (#8239)
Adding a random number to the xDS stream node id helps debugging for distinguishing between different clients.
2021-06-07 11:01:04 -07:00
sanjaypujare 4209c8d8cc
xds: close SslContexrProviderSupplier when the CDS LoadBalancer is shut down to prevent leakage (#8240) 2021-06-07 10:53:57 -07:00
markb74 0c723f7ca9
binder: Server and Channel Builders for BinderChannel. (#8218)
binder: Server and Channel Builders for BinderChannel.

Also adds 3 additional tests.
2021-06-07 19:39:20 +02:00
Amit Shirodkar a6d78c5e3e
fix build on ppc64le (#8141) 2021-06-07 00:10:29 -07:00
Eric Anderson 50012832de Bump Protobuf Gradle Plugin to 0.8.16
This version works around a warning about DuplicateStrategy in Gradle 6
that will be an error in Gradle 7 caused by [a bug in the plugin][1].
Bumping the version makes a clean build with `--warning-mode all` (at
least if skipping Android and codegen).

[1]: https://github.com/google/protobuf-gradle-plugin/issues/470
2021-06-04 07:55:58 -07:00
sanjaypujare d8d378454f
xds: remove XdsChannelBuilder and related code that uses old/unsupported interfaces (#8231) 2021-06-03 10:07:05 -07:00
Eric Anderson 005452f6cf Replace accidental U+FFFC with space in GH Action lock.yml 2021-06-03 07:43:50 -07:00
Eric Anderson 01a6364b05 Swap from the Lock GH App to lock-threads GH Action
The Lock App [is unhealthy][1]. GitHub Actions now has [a better
security model][2] such that we think we can safely use it.

The time of day to run the action was randomly generated.

[1]: https://github.com/dessant/lock-threads-app/issues/2
[2]: https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/
2021-06-02 15:51:12 -07:00
sanjaypujare 087d7bc7d5
xds: move the unsupported filterChainMatch matchers to the ranking stage for correct outcomes (#8219) 2021-06-02 10:10:58 -07:00
sanjaypujare 54b4e93927
xds: replace PriorityHeap with simpler logic that keeps track of top matches (#8225) 2021-06-02 10:09:42 -07:00
markb74 1cd925c3dd
Remove InternalMetadataHelper. (#8209)
This class wasn't really necessary.
2021-06-02 11:03:29 +02:00
Chengyuan Zhang a589c2c68f
xds: fix order of processing resolution errors with original cluster ordering (#8224)
When aggregating the endpoint resolution errors of the list of clusters in ClusterResolverLoadBalancer, clusters should be processed in its original order as received in the LB config. The last cluster's error is used as the overall error status.
2021-06-01 11:22:24 -07:00
Menghan Li d4e90a78fd
buildscript: fold header/path matching tests to all (#8054) 2021-05-27 09:47:50 -07:00
Chengyuan Zhang 8129c4e673
xds: import v3 RBAC http filter proto (#8215) 2021-05-27 09:43:56 -07:00
markb74 f88d362bc7
Fix the use of scheduler pools in BinderServer. (#8210)
Switch to using scheduled pools in BinderServer.
2021-05-27 13:37:22 +02:00
sanjaypujare bfcba82dd5
xds: remove MeshCaCertificateProvider and DynamicReloadingCertificate{Provider (#8214) 2021-05-26 19:35:51 -07:00
sanjaypujare 328071bbce
xds: replace DownstreamTlsContext by SslContextProviderSupplier in the Listener (#8205) 2021-05-26 14:42:47 -07:00
ZHANG Dapeng 6aeeba805f
xds: enhance delay injection error message on DEADLINE_EXCEEDED (#8185)
When an RPC is injected with a delay and then fails with DEADLINE_EXCEEDED (partially) due to the delay, it could confuse users if the error message does not mention the existence of the delay injection, because end users normally are not the same people who configured fault injection policy in control plane.
2021-05-26 14:35:45 -07:00
Eric Anderson a7792d3d14 Limit permissions to gradlew validator GH Action
I've already limited the grpc-wide setting to read-only access, but
limiting it explicitly here seems like a good idea; all workflows should
explicitly set their permissions since any action can implicitly access
the GITHUB_TOKEN.
2021-05-26 14:24:29 -07:00
Chengyuan Zhang 505594ac53
xds: change google_default/compute_engine creds to select TLS if the xDS cluster name is prefixed with 'google_cfe_' (#8152)
Following up changes in bbc5f61abb, the cluster_resolver LB policy uses the hostname received in CDS responses for discovering LOGICAL_DNS cluster endpoints.

Based on the new design, TD will generate a CFE cluster called "google_cfe_${service_name}" (e.g., for DirectPath service "cloud-bigtable.googleapis.com", the cluster name will be "google_cfe_cloud-bigtable.googleapis.com") for each DirectPath service. google_default/compute_engine creds will identify CFE clusters by the name having the prefix "google_cfe_".
2021-05-26 12:06:23 -07:00
Chengyuan Zhang bbc5f61abb
xds: use load assignment endpoint address in Cluster as the DNS hostname for LOGICAL_DNS (#8151)
Fixes the source of hostname used for DNS resolution in the cluster_resolver LB policy for LOGICAL_DNS clusters. The change includes:

- parse the single endpoint address from the embedded Cluster resource in CDS responses as the DNS hostname for LOGICAL_DNS cluster and include it in CdsUpdate being notified to the CDS LB policy.
- propagate the DNS hostname to the cluster_resolver LB policy via its LB config (DiscoveryMechanism for LOGICAL_DNS cluster).
- cluster_resolver LB policy takes the DNS hostname from the DiscoveryMechanism for LOGICAL_DNS cluster and use it as the name for DNS resolution.
2021-05-26 12:02:18 -07:00
markb74 8e18c11bbd
binder: BinderTransport implementation. (#8031)
This is the first major code drop for binderchannel, containing the transport class and its internals.
2021-05-26 14:54:32 +02:00
yifeizhuang 2239dd717c
tsan, xds: fix data race (#8206) 2021-05-25 13:35:09 -07:00
sanjaypujare 5b1c3fa12c
xds: shutDown the scheduledExecutorService when the provider is shutdown (#8198) 2021-05-24 12:45:01 -07:00
cfredri4 c8cd4cb260
netty: Support SocketAddress with ChannelCredentials (#8194)
This adds support for creating a Netty Channel with SocketAddress and ChannelCredentials.

This aligns with NettyServerBuilder.forAddress(SocketAddress address, ServerCredentials creds).
2021-05-24 09:49:20 -07:00
sanjaypujare 869b395ec0
xds: ignore unknown SAN name type instead of throwing exception (#8183) 2021-05-19 11:48:11 -07:00