diff --git a/go.mod b/go.mod index 697c2a1452b..c8e904b3faf 100644 --- a/go.mod +++ b/go.mod @@ -6,9 +6,9 @@ require ( fortio.org/fortio v1.63.7 fortio.org/log v1.12.2 github.com/Masterminds/semver/v3 v3.2.1 - github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa + github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b github.com/davecgh/go-spew v1.1.1 - github.com/envoyproxy/go-control-plane v0.12.1-0.20240410145647-bdba4bba15fc + github.com/envoyproxy/go-control-plane v0.12.1-0.20240425230418-212e93054f1a github.com/envoyproxy/ratelimit v1.4.1-0.20230427142404-e2a87f41d3a7 github.com/evanphx/json-patch/v5 v5.9.0 github.com/fatih/color v1.16.0 @@ -56,6 +56,7 @@ require ( ) require ( + cel.dev/expr v0.15.0 // indirect fortio.org/dflag v1.7.1 // indirect fortio.org/sets v1.0.4 // indirect fortio.org/struct2env v0.4.0 // indirect diff --git a/go.sum b/go.sum index ee2b0823437..b51b6ec29e7 100644 --- a/go.sum +++ b/go.sum @@ -1,3 +1,5 @@ +cel.dev/expr v0.15.0 h1:O1jzfJCQBfL5BFoYktaxwIhuttaQPsVWerH9/EEKx0w= +cel.dev/expr v0.15.0/go.mod h1:TRSuuV7DlVCE/uwv5QbAiW/v8l5O8C4eEPHeu7gf7Sg= cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU= @@ -96,8 +98,8 @@ github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWR github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw= -github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa h1:jQCWAUqqlij9Pgj2i/PB79y4KOPYVyFYdROxgaCwdTQ= -github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa/go.mod h1:x/1Gn8zydmfq8dk6e9PdstVsDgu9RuyIIJqAaF//0IM= +github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b h1:ga8SEFjZ60pxLcmhnThWgvH2wg8376yUJmPhEH4H3kw= +github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8= github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8= github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM= github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw= @@ -167,8 +169,8 @@ github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g= github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= -github.com/envoyproxy/go-control-plane v0.12.1-0.20240410145647-bdba4bba15fc h1:FJoupBhZkbUXmzGxgAic3rEHeZf8jgvREB7uMfBI23w= -github.com/envoyproxy/go-control-plane v0.12.1-0.20240410145647-bdba4bba15fc/go.mod h1:Dj0RQ153G7gNYzcQCihXUreYTQbuJNuL7IT7v9+jTr4= +github.com/envoyproxy/go-control-plane v0.12.1-0.20240425230418-212e93054f1a h1:OmSlDWdXUzNgoMWOtrcEAmiO9BxTt6cGotwz7cZwIyw= +github.com/envoyproxy/go-control-plane v0.12.1-0.20240425230418-212e93054f1a/go.mod h1:5Wkq+JduFtdAXihLmeTJf+tRYIT4KBc2vPXDhwVo1pA= github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c= github.com/envoyproxy/protoc-gen-validate v1.0.4 h1:gVPz/FMfvh57HdSJQyvBtF00j8JU4zdyUgIUNhlgg0A= github.com/envoyproxy/protoc-gen-validate v1.0.4/go.mod h1:qys6tmnRsYrQqIhm2bvKZH4Blx/1gTIZ2UKVY1M+Yew= diff --git a/internal/xds/translator/cors.go b/internal/xds/translator/cors.go index cd46b6f41a6..2b31a25f221 100644 --- a/internal/xds/translator/cors.go +++ b/internal/xds/translator/cors.go @@ -16,8 +16,8 @@ import ( hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3" matcherv3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3" "github.com/envoyproxy/go-control-plane/pkg/wellknown" - "github.com/golang/protobuf/ptypes/wrappers" "google.golang.org/protobuf/types/known/anypb" + "google.golang.org/protobuf/types/known/wrapperspb" "github.com/envoyproxy/gateway/internal/ir" "github.com/envoyproxy/gateway/internal/xds/types" @@ -125,7 +125,7 @@ func (*cors) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error { allowHeaders string exposeHeaders string maxAge string - allowCredentials *wrappers.BoolValue + allowCredentials *wrapperspb.BoolValue c = irRoute.Security.CORS ) @@ -141,7 +141,7 @@ func (*cors) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error { if c.MaxAge != nil { maxAge = strconv.Itoa(int(c.MaxAge.Seconds())) } - allowCredentials = &wrappers.BoolValue{Value: c.AllowCredentials} + allowCredentials = &wrapperspb.BoolValue{Value: c.AllowCredentials} routeCfgProto := &corsv3.CorsPolicy{ AllowOriginStringMatch: allowOrigins, @@ -150,7 +150,7 @@ func (*cors) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error { ExposeHeaders: exposeHeaders, MaxAge: maxAge, AllowCredentials: allowCredentials, - ForwardNotMatchingPreflights: &wrappers.BoolValue{Value: false}, + ForwardNotMatchingPreflights: &wrapperspb.BoolValue{Value: false}, } routeCfgAny, err := anypb.New(routeCfgProto) diff --git a/internal/xds/translator/extauth.go b/internal/xds/translator/extauth.go index 43712564e16..28aaad6bfa4 100644 --- a/internal/xds/translator/extauth.go +++ b/internal/xds/translator/extauth.go @@ -14,8 +14,8 @@ import ( extauthv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_authz/v3" hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3" matcherv3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3" - "github.com/golang/protobuf/ptypes/duration" "google.golang.org/protobuf/types/known/anypb" + "google.golang.org/protobuf/types/known/durationpb" "github.com/envoyproxy/gateway/internal/ir" "github.com/envoyproxy/gateway/internal/xds/types" @@ -133,7 +133,7 @@ func extAuthConfig(extAuth *ir.ExtAuth) *extauthv3.ExtAuthz { TargetSpecifier: &corev3.GrpcService_EnvoyGrpc_{ EnvoyGrpc: grpcService(extAuth.GRPC), }, - Timeout: &duration.Duration{ + Timeout: &durationpb.Duration{ Seconds: defaultExtServiceRequestTimeout, }, }, @@ -169,7 +169,7 @@ func httpService(http *ir.HTTPExtAuthService) *extauthv3.HttpService { HttpUpstreamType: &corev3.HttpUri_Cluster{ Cluster: http.Destination.Name, }, - Timeout: &duration.Duration{ + Timeout: &durationpb.Duration{ Seconds: defaultExtServiceRequestTimeout, }, } diff --git a/internal/xds/translator/extproc.go b/internal/xds/translator/extproc.go index ac03a49d08e..d1836fc7b5b 100644 --- a/internal/xds/translator/extproc.go +++ b/internal/xds/translator/extproc.go @@ -12,8 +12,8 @@ import ( routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3" extprocv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_proc/v3" hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3" - "github.com/golang/protobuf/ptypes/duration" "google.golang.org/protobuf/types/known/anypb" + "google.golang.org/protobuf/types/known/durationpb" "github.com/envoyproxy/gateway/internal/ir" "github.com/envoyproxy/gateway/internal/xds/types" @@ -103,7 +103,7 @@ func extProcConfig(extProc ir.ExtProc) *extprocv3.ExternalProcessor { TargetSpecifier: &corev3.GrpcService_EnvoyGrpc_{ EnvoyGrpc: grpcExtProcService(extProc), }, - Timeout: &duration.Duration{ + Timeout: &durationpb.Duration{ Seconds: defaultExtServiceRequestTimeout, }, }, diff --git a/internal/xds/translator/listener.go b/internal/xds/translator/listener.go index 55b29d168eb..a261dc1365f 100644 --- a/internal/xds/translator/listener.go +++ b/internal/xds/translator/listener.go @@ -24,7 +24,6 @@ import ( typev3 "github.com/envoyproxy/go-control-plane/envoy/type/v3" "github.com/envoyproxy/go-control-plane/pkg/resource/v3" "github.com/envoyproxy/go-control-plane/pkg/wellknown" - "github.com/golang/protobuf/ptypes/wrappers" "google.golang.org/protobuf/proto" "google.golang.org/protobuf/types/known/anypb" "google.golang.org/protobuf/types/known/durationpb" @@ -85,13 +84,13 @@ func http2ProtocolOptions(opts *ir.HTTP2Settings) *corev3.Http2ProtocolOptions { } return &corev3.Http2ProtocolOptions{ - MaxConcurrentStreams: &wrappers.UInt32Value{ + MaxConcurrentStreams: &wrapperspb.UInt32Value{ Value: ptr.Deref(opts.MaxConcurrentStreams, http2MaxConcurrentStreamsLimit), }, - InitialStreamWindowSize: &wrappers.UInt32Value{ + InitialStreamWindowSize: &wrapperspb.UInt32Value{ Value: ptr.Deref(opts.InitialStreamWindowSize, http2InitialStreamWindowSize), }, - InitialConnectionWindowSize: &wrappers.UInt32Value{ + InitialConnectionWindowSize: &wrapperspb.UInt32Value{ Value: ptr.Deref(opts.InitialConnectionWindowSize, http2InitialConnectionWindowSize), }, } @@ -250,7 +249,7 @@ func (t *Translator) addHCMToXDSListener(xdsListener *listenerv3.Listener, irLis // Set it by default to also support HTTP1.1 to HTTP2 Upgrades Http2ProtocolOptions: http2ProtocolOptions(irListener.HTTP2), // https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_conn_man/headers#x-forwarded-for - UseRemoteAddress: &wrappers.BoolValue{Value: useRemoteAddress}, + UseRemoteAddress: &wrapperspb.BoolValue{Value: useRemoteAddress}, XffNumTrustedHops: xffNumTrustedHops(irListener.ClientIPDetection), OriginalIpDetectionExtensions: originalIPDetectionExtensions, // normalize paths according to RFC 3986 @@ -507,7 +506,7 @@ func buildDownstreamQUICTransportSocket(tlsConfig *ir.TLSConfig) (*corev3.Transp } if tlsConfig.CACertificate != nil { - tlsCtx.DownstreamTlsContext.RequireClientCertificate = &wrappers.BoolValue{Value: true} + tlsCtx.DownstreamTlsContext.RequireClientCertificate = &wrapperspb.BoolValue{Value: true} tlsCtx.DownstreamTlsContext.CommonTlsContext.ValidationContextType = &tlsv3.CommonTlsContext_ValidationContextSdsSecretConfig{ ValidationContextSdsSecretConfig: &tlsv3.SdsSecretConfig{ Name: tlsConfig.CACertificate.Name, @@ -547,7 +546,7 @@ func buildXdsDownstreamTLSSocket(tlsConfig *ir.TLSConfig) (*corev3.TransportSock } if tlsConfig.CACertificate != nil { - tlsCtx.RequireClientCertificate = &wrappers.BoolValue{Value: tlsConfig.RequireClientCertificate} + tlsCtx.RequireClientCertificate = &wrapperspb.BoolValue{Value: tlsConfig.RequireClientCertificate} tlsCtx.CommonTlsContext.ValidationContextType = &tlsv3.CommonTlsContext_ValidationContextSdsSecretConfig{ ValidationContextSdsSecretConfig: &tlsv3.SdsSecretConfig{ Name: tlsConfig.CACertificate.Name, diff --git a/internal/xds/translator/local_ratelimit.go b/internal/xds/translator/local_ratelimit.go index a3110cbf98e..3fe8c740d0c 100644 --- a/internal/xds/translator/local_ratelimit.go +++ b/internal/xds/translator/local_ratelimit.go @@ -15,9 +15,8 @@ import ( localrlv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/local_ratelimit/v3" hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3" typev3 "github.com/envoyproxy/go-control-plane/envoy/type/v3" - "github.com/golang/protobuf/ptypes/duration" - "github.com/golang/protobuf/ptypes/wrappers" "google.golang.org/protobuf/types/known/anypb" + "google.golang.org/protobuf/types/known/durationpb" "google.golang.org/protobuf/types/known/wrapperspb" egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1" @@ -169,7 +168,7 @@ func (*localRateLimit) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) e // won't consume the default token bucket. This means that a request only // counts towards the default token bucket if it does not match any of the // descriptors. - AlwaysConsumeDefaultTokenBucket: &wrappers.BoolValue{ + AlwaysConsumeDefaultTokenBucket: &wrapperspb.BoolValue{ Value: false, }, } @@ -284,7 +283,7 @@ func buildRouteLocalRateLimits(local *ir.LocalRateLimit) ( return rateLimits, descriptors, nil } -func ratelimitUnitToDuration(unit ir.RateLimitUnit) *duration.Duration { +func ratelimitUnitToDuration(unit ir.RateLimitUnit) *durationpb.Duration { var seconds int64 switch egv1a1.RateLimitUnit(unit) { @@ -297,7 +296,7 @@ func ratelimitUnitToDuration(unit ir.RateLimitUnit) *duration.Duration { case egv1a1.RateLimitUnitDay: seconds = 60 * 60 * 24 } - return &duration.Duration{ + return &durationpb.Duration{ Seconds: seconds, } } diff --git a/internal/xds/translator/oidc.go b/internal/xds/translator/oidc.go index f7202a7f407..e7f8aa5219d 100644 --- a/internal/xds/translator/oidc.go +++ b/internal/xds/translator/oidc.go @@ -15,8 +15,8 @@ import ( hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3" tlsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3" matcherv3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3" - "github.com/golang/protobuf/ptypes/duration" "google.golang.org/protobuf/types/known/anypb" + "google.golang.org/protobuf/types/known/durationpb" "k8s.io/utils/ptr" "github.com/envoyproxy/gateway/internal/ir" @@ -122,7 +122,7 @@ func oauth2Config(oidc *ir.OIDC) (*oauth2v3.OAuth2, error) { HttpUpstreamType: &corev3.HttpUri_Cluster{ Cluster: cluster.name, }, - Timeout: &duration.Duration{ + Timeout: &durationpb.Duration{ Seconds: defaultExtServiceRequestTimeout, }, }, diff --git a/internal/xds/translator/wasm.go b/internal/xds/translator/wasm.go index 1c8c03951ca..e4b9e0d321a 100644 --- a/internal/xds/translator/wasm.go +++ b/internal/xds/translator/wasm.go @@ -13,8 +13,8 @@ import ( wasmfilterv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/wasm/v3" hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3" wasmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/wasm/v3" - "github.com/golang/protobuf/ptypes/duration" "google.golang.org/protobuf/types/known/anypb" + "google.golang.org/protobuf/types/known/durationpb" "google.golang.org/protobuf/types/known/wrapperspb" "github.com/envoyproxy/gateway/internal/ir" @@ -139,7 +139,7 @@ func wasmConfig(wasm ir.Wasm) (*wasmfilterv3.Wasm, error) { HttpUpstreamType: &corev3.HttpUri_Cluster{ Cluster: uc.name, }, - Timeout: &duration.Duration{ + Timeout: &durationpb.Duration{ Seconds: defaultExtServiceRequestTimeout, }, },