Added Fatal Action extension point.

api/envoy/config/bootstrap/v3/bootstrap.proto

@@ -40,7 +40,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // <config_overview_bootstrap>` for more detail.
 
 // Bootstrap :ref:`configuration overview <config_overview_bootstrap>`.
-// [#next-free-field: 28]
+// [#next-free-field: 29]
 message Bootstrap {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.bootstrap.v2.Bootstrap";
@@ -243,6 +243,10 @@ message Bootstrap {
   // Each item contains extension specific configuration.
   repeated core.v3.TypedExtensionConfig bootstrap_extensions = 21;
 
+  // Specifies optional extensions instantiated at startup time and
+  // invoked during crash time on the request that caused the crash.
+  repeated FatalAction fatal_actions = 28;
+
   // Configuration sources that will participate in
   // *udpa.core.v1.ResourceLocator* authority resolution. The algorithm is as
   // follows:
@@ -420,6 +424,13 @@ message Watchdog {
   type.v3.Percent multikill_threshold = 5;
 }
 
+// Fatal actions to run while crashing.
+// We will run all safe actions before we run unsafe actions.
+message FatalAction {
+  // Extension specific configuration for the action.
+  core.v3.TypedExtensionConfig config = 1;
+}
+
 // Runtime :ref:`configuration overview <config_runtime>` (deprecated).
 message Runtime {
   option (udpa.annotations.versioning).previous_message_type = "envoy.config.bootstrap.v2.Runtime";

docs/root/extending/extending.rst

@@ -24,6 +24,7 @@ types including:
 * :ref:`Watchdog action <envoy_v3_api_msg_config.bootstrap.v3.Watchdog.WatchdogAction>`
 * :ref:`Internal redirect policy <envoy_v3_api_field_config.route.v3.InternalRedirectPolicy.predicates>`
 * :ref:`Compression libraries <arch_overview_compression_libraries>`
+* :ref:`Fatal actions <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.fatal_actions>`
 
 As of this writing there is no high level extension developer documentation. The
 :repo:`existing extensions <source/extensions>` are a good way to learn what is possible.

docs/root/version_history/current.rst

@@ -37,6 +37,7 @@ New Features
 * mongo_proxy: the list of commands to produce metrics for is now :ref:`configurable <envoy_v3_api_field_extensions.filters.network.mongo_proxy.v3.MongoProxy.commands>`.
 * ratelimit: added support for use of various :ref:`metadata <envoy_v3_api_field_config.route.v3.RateLimit.Action.metadata>` as a ratelimit action.
 * ratelimit: added :ref:`disable_x_envoy_ratelimited_header <envoy_v3_api_msg_extensions.filters.http.ratelimit.v3.RateLimit>` option to disable `X-Envoy-RateLimited` header.
+* signal: added an extension point for custom actions to run on the thread that has encountered a fatal error. Actions are configurable via :ref:`fatal_actions <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.fatal_actions>`.
 * tcp: added a new :ref:`envoy.overload_actions.reject_incoming_connections <config_overload_manager_overload_actions>` action to reject incoming TCP connections.
 
 Deprecated

include/envoy/server/BUILD

@@ -339,3 +339,15 @@ envoy_cc_library(
         "//include/envoy/config:typed_config_interface",
     ],
 )
+
+envoy_cc_library(
+    name = "fatal_action_interface",
+    hdrs = ["fatal_action_config.h"],
+    deps = [
+        "//include/envoy/config:typed_config_interface",
+        "//include/envoy/event:dispatcher_interface",
+        "//include/envoy/protobuf:message_validator_interface",
+        "//include/envoy/server:instance_interface",
+        "@envoy_api//envoy/config/bootstrap/v3:pkg_cc_proto",
+    ],
+)

include/envoy/server/fatal_action_config.h

@@ -0,0 +1,55 @@
+#pragma once
+
+#include <memory>
+
+#include "envoy/common/pure.h"
+#include "envoy/config/bootstrap/v3/bootstrap.pb.h"
+#include "envoy/config/typed_config.h"
+#include "envoy/event/dispatcher.h"
+#include "envoy/protobuf/message_validator.h"
+#include "envoy/server/instance.h"
+
+namespace Envoy {
+namespace Server {
+namespace Configuration {
+
+class FatalAction {
+public:
+  virtual ~FatalAction() = default;
+  /**
+   * Callback function to run when we are crashing.
+   * @param current_object the object we were working on when we started
+   * crashing.
+   */
+  virtual void run(const ScopeTrackedObject* current_object) PURE;
+
+  virtual bool isAsyncSignalSafe() const PURE;
+};
+
+using FatalActionPtr = std::unique_ptr<FatalAction>;
+
+/**
+ * Implemented by each custom FatalAction and registered via Registry::registerFactory()
+ * or the convenience class RegisterFactory.
+ */
+class FatalActionFactory : public Config::TypedFactory {
+public:
+  ~FatalActionFactory() override = default;
+
+  /**
+   * Creates a particular FatalAction implementation.
+   *
+   * @param config supplies the configuration for the action.
+   * @param context supplies the GuardDog Action's context.
+   * @return FatalActionsPtr the FatalActions object.
+   */
+  virtual FatalActionPtr
+  createFatalActionFromProto(const envoy::config::bootstrap::v3::FatalAction& config,
+                             Instance* server) PURE;
+
+  std::string category() const override { return "envoy.fatal_action"; }
+};
+
+} // namespace Configuration
+} // namespace Server
+} // namespace Envoy

source/common/event/dispatcher_impl.h

@@ -91,6 +91,18 @@ class DispatcherImpl : Logger::Loggable<Logger::Id::main>,
     }
   }
 
+  void
+  runFatalActionsOnTrackedObject(const FatalAction::FatalActionPtrList& actions) const override {
+    if (run_tid_.isEmpty() || (run_tid_ != api_.threadFactory().currentThreadId())) {
+      return;
+    }
+
+    // Run the actions
+    for (const auto& action : actions) {
+      action->run(current_object_);
+    }
+  }
+
 private:
   TimerPtr createTimerInternal(TimerCb cb);
   void updateApproximateMonotonicTimeInternal();

source/common/signal/BUILD

@@ -13,6 +13,8 @@ envoy_cc_library(
     srcs = ["fatal_error_handler.cc"],
     hdrs = ["fatal_error_handler.h"],
     deps = [
+        ":fatal_action_lib",
+        "//include/envoy/event:dispatcher_interface",
         "//source/common/common:macros",
     ],
 )
@@ -30,3 +32,12 @@ envoy_cc_library(
         "//source/server:backtrace_lib",
     ],
 )
+
+envoy_cc_library(
+    name = "fatal_action_lib",
+    hdrs = ["fatal_action.h"],
+    deps = [
+        "//include/envoy/server:fatal_action_interface",
+        "//include/envoy/thread:thread_interface",
+    ],
+)

source/common/signal/fatal_action.h

@@ -0,0 +1,34 @@
+#pragma once
+
+#include <ostream>
+
+#include "envoy/common/pure.h"
+#include "envoy/server/fatal_action_config.h"
+#include "envoy/thread/thread.h"
+
+namespace Envoy {
+namespace FatalAction {
+
+using FatalActionPtrList = std::list<Server::Configuration::FatalActionPtr>;
+
+// A simple class which manages the Fatal Actions registered via the
+// extension point.
+class FatalActionManager {
+public:
+  FatalActionManager(FatalActionPtrList safe_actions, FatalActionPtrList unsafe_actions,
+                     Thread::ThreadFactory& thread_factory)
+      : safe_actions_(std::move(safe_actions)), unsafe_actions_(std::move(unsafe_actions)),
+        thread_factory_(thread_factory) {}
+
+  const FatalActionPtrList& getSafeActions() const { return safe_actions_; }
+  const FatalActionPtrList& getUnsafeActions() const { return unsafe_actions_; }
+  Thread::ThreadFactory& getThreadFactory() const { return thread_factory_; }
+
+private:
+  FatalActionPtrList safe_actions_;
+  FatalActionPtrList unsafe_actions_;
+  Thread::ThreadFactory& thread_factory_;
+};
+
+} // namespace FatalAction
+} // namespace Envoy