Implement xDS in Quilkin (#552)

Cargo.toml

@@ -42,16 +42,21 @@ quilkin-macros = { version = "0.4.0-dev", path = "./macros" }
 
 # Crates.io
 arc-swap = { version = "1.5.0", features = ["serde"] }
+async-stream = "0.3.3"
 base64 = "0.13.0"
 base64-serde = "0.6.1"
 bytes = { version = "1.1.0", features = ["serde"] }
+cached = "0.34.0"
+chrono = "0.4.19"
 clap = { version = "3.1.2", features = ["cargo", "derive", "env"] }
 dashmap = "4.0.2"
 either = "1.6.1"
 eyre = "0.6.7"
 futures = "0.3.21"
 hyper = "0.14.17"
 ipnetwork = "0.18.0"
+k8s-openapi = { version = "0.15.0", features = ["v1_22", "schemars"] }
+kube = { version = "0.73.0", features = ["derive", "runtime", "rustls-tls", "client"], default-features = false }
 num_cpus = "1.13.0"
 once_cell = "1.9.0"
 parking_lot = "0.12"
@@ -60,22 +65,26 @@ prost = "=0.9.0"
 prost-types = "=0.9.0"
 rand = "0.8.5"
 regex = "1.5.4"
-schemars = { version = "0.8.8", features = ["bytes"] }
+schemars = { version = "0.8.8", features = ["chrono", "bytes"] }
 serde = { version = "1.0.130", features = ["derive", "rc"] }
 serde_json = "1.0.79"
 serde_regex = "1.1.0"
 serde_yaml = "0.8.21"
 socket2 = "0.4.4"
 snap = "1.0.5"
 stable-eyre = "0.2.2"
+tempdir = "0.3"
 thiserror = "1.0.30"
-tokio = { version = "1.19.2", features = ["rt-multi-thread", "signal", "test-util", "parking_lot"] }
+tokio = { version = "1.19.2", features = ["rt-multi-thread", "fs", "signal", "test-util", "parking_lot", "tracing"] }
 tokio-stream = "0.1.8"
 tonic = "0.6.1"
-tracing = {version = "0.1.31" }
-tracing-subscriber = { version = "0.3.9", features = ["json"] }
+tracing = "0.1.31"
+tracing-subscriber = { version = "0.3.9", features = ["json", "env-filter"] }
 tryhard = "0.4.0"
-uuid = { version = "0.8.2", default-features = false, features = ["v4"] }
+uuid = { version = "1", default-features = false, features = ["v4"] }
+enum-map = "=2.1.0"
+notify = "5.0.0-pre.15"
+serde_stacker = "0.1.5"
 
 [target.'cfg(target_os = "linux")'.dependencies]
 sys-info = "0.9.0"
@@ -85,11 +94,13 @@ regex = "1.5.4"
 criterion = { version = "0.3.5", features = ["html_reports"] }
 once_cell = "1.8.0"
 tracing-test = "0.2"
+pretty_assertions = "1.2.1"
 
 [build-dependencies]
 tonic-build = { version = "0.6.0", default_features = false, features = ["transport", "prost"] }
 # Locked to 0.8 to match `tonic-build`'s `prost-build`.
 prost-build = "=0.9.0"
+built = { version = "0.5.1", features = ["git2"] }
 
 [features]
 instrument = []

about.toml

@@ -18,6 +18,13 @@ accepted = [
     "Apache-2.0",
     "BSD-2-Clause",
     "BSD-3-Clause",
+    "CC0-1.0",
+    "ISC",
     "MIT",
+    "NOASSERTION",
     "Unicode-DFS-2016"
 ]
+workarounds = ["ring"]
+
+[ring]
+accepted = ["ISC", "OpenSSL"]

build.rs

@@ -22,6 +22,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         "proto/data-plane-api/envoy/config/accesslog/v3/accesslog.proto",
         "proto/data-plane-api/envoy/config/cluster/v3/cluster.proto",
         "proto/data-plane-api/envoy/config/listener/v3/listener.proto",
+        "proto/data-plane-api/envoy/config/listener/v3/listener_components.proto",
         "proto/data-plane-api/envoy/config/route/v3/route.proto",
         "proto/data-plane-api/envoy/service/cluster/v3/cds.proto",
         "proto/data-plane-api/envoy/service/discovery/v3/ads.proto",
@@ -81,5 +82,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         println!("cargo:rerun-if-changed={}", path.to_str().unwrap());
     }
 
+    built::write_built_file().expect("Failed to acquire build-time information");
+
     Ok(())
 }

build/Makefile

@@ -102,7 +102,7 @@ test-docs: ensure-build-image
 build: binary-archive build-image
 
 # Build all debug and release binaries
-build-all-binaries: ensure-build-image build-linux-binary build-windows-binary build-macos-binary
+build-all-binaries: ensure-build-image build-linux-binary build-macos-binary
 
 # Build an archive all debug and release binaries
 binary-archive: ensure-build-image build-all-binaries
@@ -127,8 +127,9 @@ build-windows-binary: ensure-build-image
 build-macos-binary:
 	docker run --rm -v $(project_path):/workspace -w /workspace \
 		-v $(CARGO_HOME)/registry:/root/.cargo/registry \
-		joseluisq/rust-linux-darwin-builder:$(rust_toolchain) \
-			sh -c "rustup target add x86_64-apple-darwin && cargo build --target x86_64-apple-darwin && cargo build --release --target x86_64-apple-darwin"
+		-e "CC=o64-clang" -e "CXX=o64-clang++" \
+        joseluisq/rust-linux-darwin-builder:$(rust_toolchain) \
+        	sh -c "rustup target add x86_64-apple-darwin && cargo build --target x86_64-apple-darwin && cargo build --release --target x86_64-apple-darwin"
 
 # Build release and debug container images.
 # Use either `REPOSITORY` to specify a container repository (defaults to blank/none), or use `IMAGE_TAG` argument to specify

deny.toml

@@ -15,7 +15,10 @@
 #
 
 [advisories]
-ignore = []
+ignore = [
+    # time 0.1 vulnerability, we don't use any affected APIs
+    "RUSTSEC-2020-0071"
+]
 
 # This section is considered when running `cargo deny check licenses`
 # More documentation for the licenses section can be found here:
@@ -28,3 +31,10 @@ exceptions = [
     # Each entry is the crate and version constraint, and its specific allow
     # list
 ]
+
+[[licenses.clarify]]
+name = "ring"
+expression = "MIT AND ISC AND OpenSSL"
+license-files = [
+    { path = "LICENSE", hash = 0xbd0eed23 }
+]

docs/src/filters.md

@@ -61,8 +61,11 @@ filters:
     config:
       max_packets: 10
       period: 1
-endpoints:
-  - address: 127.0.0.1:7001
+clusters: 
+  default:
+    localities:
+      - endpoints:
+        - address: 127.0.0.1:7001
 # ";
 # let config = quilkin::config::Config::from_reader(yaml.as_bytes()).unwrap();
 # assert_eq!(config.filters.load().len(), 2);

docs/src/filters/capture.md

@@ -38,10 +38,13 @@ filters:
     config:
       metadataKey: myapp.com/myownkey
       prefix:
-      size: 3
-      remove: false
-endpoints:
-  - address: 127.0.0.1:7001
+        size: 3
+        remove: false
+clusters:
+  default:
+    localities:
+        - endpoints:
+            - address: 127.0.0.1:7001
 # ";
 # let config = quilkin::config::Config::from_reader(yaml.as_bytes()).unwrap();
 # assert_eq!(config.filters.load().len(), 1);

docs/src/filters/compress.md

@@ -18,8 +18,11 @@ filters:
         on_read: COMPRESS
         on_write: DECOMPRESS
         mode: SNAPPY
-endpoints:
-  - address: 127.0.0.1:7001
+clusters: 
+  default:
+    localities:
+      - endpoints:
+        - address: 127.0.0.1:7001
 # ";
 # let config = quilkin::config::Config::from_reader(yaml.as_bytes()).unwrap();
 # assert_eq!(config.filters.load().len(), 1);

docs/src/filters/concatenate_bytes.md

@@ -18,8 +18,11 @@ filters:
         on_read: APPEND
         on_write: DO_NOTHING
         bytes: MXg3aWp5Ng==
-endpoints:
-  - address: 127.0.0.1:7001
+clusters:
+  default:
+    localities:
+        - endpoints:
+            - address: 127.0.0.1:7001
 # ";
 # let config = quilkin::config::Config::from_reader(yaml.as_bytes()).unwrap();
 # assert_eq!(config.filters.load().len(), 1);

docs/src/filters/debug.md

@@ -17,8 +17,11 @@ filters:
   - name: quilkin.filters.debug.v1alpha1.Debug
     config:
       id: debug-1
-endpoints:
-  - address: 127.0.0.1:7001
+clusters:
+  default:
+    localities:
+        - endpoints:
+            - address: 127.0.0.1:7001
 # ";
 # let config = quilkin::config::Config::from_reader(yaml.as_bytes()).unwrap();
 # assert_eq!(config.filters.load().len(), 1);

docs/src/filters/firewall.md

@@ -26,8 +26,11 @@ filters:
           source: 192.168.51.0/24
           ports:
              - 7000
-endpoints:
-  - address: 127.0.0.1:7001
+clusters:
+  default:
+    localities:
+        - endpoints:
+            - address: 127.0.0.1:7001
 # ";
 # let config = quilkin::config::Config::from_reader(yaml.as_bytes()).unwrap();
 # assert_eq!(config.filters.load().len(), 1);

docs/src/filters/load_balancer.md

@@ -17,8 +17,11 @@ filters:
   - name: quilkin.filters.load_balancer.v1alpha1.LoadBalancer
     config:
       policy: ROUND_ROBIN
-endpoints:
-  - address: 127.0.0.1:7001
+clusters:
+  default:
+    localities:
+        - endpoints:
+            - address: 127.0.0.1:7001
 # ";
 #   let config = quilkin::config::Config::from_reader(yaml.as_bytes()).unwrap();
 # assert_eq!(config.filters.load().len(), 1);

docs/src/filters/local_rate_limit.md

@@ -21,8 +21,11 @@ filters:
     config:
       max_packets: 1000
       period: 1
-endpoints:
-  - address: 127.0.0.1:7001
+clusters: 
+  default:
+    localities:
+      - endpoints:
+        - address: 127.0.0.1:7001
 # ";
 #   let config = quilkin::config::Config::from_reader(yaml.as_bytes()).unwrap();
 # assert_eq!(config.filters.load().len(), 1);

docs/src/filters/match.md

@@ -14,24 +14,28 @@ quilkin.filters.match.v1alpha1.Match
 ```rust
 # let yaml = "
 version: v1alpha1
-endpoints:
-  - address: 127.0.0.1:26000
-  - address: 127.0.0.1:26001
+clusters: 
+  default:
+    localities:
+      - endpoints:
+        - address: 127.0.0.1:26000
+        - address: 127.0.0.1:26001
 filters:
-  - name: quilkin.filters.capture_bytes.v1alpha1.CaptureBytes
+  - name: quilkin.filters.capture.v1alpha1.Capture
     config:
-        strategy: PREFIX
-        metadataKey: myapp.com/token
+      metadataKey: myapp.com/token
+      prefix:
         size: 3
         remove: false
   - name: quilkin.filters.match.v1alpha1.Match
     config:
-        on_read:
-          metadataKey: myapp.com/token
-          branches:
-              - value: abc
-                filter: quilkin.filters.pass.v1alpha1.Pass
-          fallthrough: quilkin.filters.drop.v1alpha1.Drop
+      on_read:
+        metadataKey: myapp.com/token
+        branches:
+          - value: abc
+            name: quilkin.filters.pass.v1alpha1.Pass
+        fallthrough:
+          name: quilkin.filters.drop.v1alpha1.Drop
 # ";
 # let config = quilkin::config::Config::from_reader(yaml.as_bytes()).unwrap();
 # assert_eq!(config.filters.load().len(), 2);

docs/src/filters/token_router.md

@@ -19,18 +19,21 @@ filters:
   - name: quilkin.filters.token_router.v1alpha1.TokenRouter
     config:
         metadataKey: myapp.com/myownkey
-endpoints:
-  - address: 127.0.0.1:26000
-    metadata:
-      quilkin.dev:
-        tokens:
-          - MXg3aWp5Ng== # Authentication is provided by these ids, and matched against
-          - OGdqM3YyaQ== # the value stored in Filter dynamic metadata
-  - address: 127.0.0.1:26001
-    metadata:
-      quilkin.dev:
-        tokens:
-          - bmt1eTcweA==
+clusters: 
+  default:
+    localities:
+      - endpoints:
+        - address: 127.0.0.1:26000
+          metadata:
+            quilkin.dev:
+              tokens:
+                - MXg3aWp5Ng== # Authentication is provided by these ids, and matched against
+                - OGdqM3YyaQ== # the value stored in Filter dynamic metadata
+        - address: 127.0.0.1:26001
+          metadata:
+            quilkin.dev:
+              tokens:
+                - bmt1eTcweA==
 # ";
 # let config = quilkin::config::Config::from_reader(yaml.as_bytes()).unwrap();
 # assert_eq!(config.filters.load().len(), 1);
@@ -81,18 +84,21 @@ filters:
           size: 3
           remove: true
   - name: quilkin.filters.token_router.v1alpha1.TokenRouter
-endpoints:
-  - address: 127.0.0.1:26000
-    metadata:
-      quilkin.dev:
-        tokens:
-          - MXg3aWp5Ng== # Authentication is provided by these ids, and matched against
-          - OGdqM3YyaQ== # the value stored in Filter dynamic metadata
-  - address: 127.0.0.1:26001
-    metadata:
-      quilkin.dev:
-        tokens:
-          - bmt1eTcweA==
+clusters: 
+  default:
+    localities:
+      - endpoints:
+        - address: 127.0.0.1:26000
+          metadata:
+            quilkin.dev:
+              tokens:
+                - MXg3aWp5Ng== # Authentication is provided by these ids, and matched against
+                - OGdqM3YyaQ== # the value stored in Filter dynamic metadata
+        - address: 127.0.0.1:26001
+          metadata:
+            quilkin.dev:
+              tokens:
+                - bmt1eTcweA==
 # ";
 # let config = quilkin::config::Config::from_reader(yaml.as_bytes()).unwrap();
 # assert_eq!(config.filters.load().len(), 2);

docs/src/filters/writing_custom_filters.md

@@ -104,8 +104,11 @@ proxy:
   port: 7001
 filters:
   - name: greet.v1
-endpoints:
-  - address: 127.0.0.1:4321
+clusters:
+  default:
+    localities:
+        - endpoints:
+            - address: 127.0.0.1:7001
 ```
 
 Next we to setup our network of services, for this example we're going to use