extensions: Consolidate configuration

bazel/envoy_library.bzl

@@ -46,11 +46,6 @@ def envoy_basic_cc_library(name, deps = [], external_deps = [], **kargs):
 
 def envoy_cc_extension(
         name,
-        security_posture,
-        category = None,
-        # Only set this for internal, undocumented extensions.
-        undocumented = False,
-        status = "stable",
         tags = [],
         extra_visibility = [],
         visibility = EXTENSION_CONFIG_VISIBILITY,

ci/format_pre.sh

@@ -46,6 +46,9 @@ bazel run "${BAZEL_BUILD_OPTIONS[@]}" //configs:example_configs_validation
 CURRENT=python
 bazel run "${BAZEL_BUILD_OPTIONS[@]}" //tools/code_format:python_check -- --diff-file="$DIFF_OUTPUT" --fix "$(pwd)"
 
+CURRENT=extensions
+bazel run "${BAZEL_BUILD_OPTIONS[@]}" //tools/extensions:validate_extensions
+
 if [[ "${#FAILED[@]}" -ne "0" ]]; then
     echo "TESTS FAILED:" >&2
     for failed in "${FAILED[@]}"; do

docs/build.sh

@@ -63,22 +63,15 @@ pip3 install --require-hashes -r "${SCRIPT_DIR}"/requirements.txt
 # files still.
 rm -rf bazel-bin/external/envoy_api_canonical
 
-EXTENSION_DB_PATH="$(realpath "${BUILD_DIR}/extension_db.json")"
-rm -rf "${EXTENSION_DB_PATH}"
 GENERATED_RST_DIR="$(realpath "${GENERATED_RST_DIR}")"
-export EXTENSION_DB_PATH
 export GENERATED_RST_DIR
 
 # This is for local RBE setup, should be no-op for builds without RBE setting in bazelrc files.
 IFS=" " read -ra BAZEL_BUILD_OPTIONS <<< "${BAZEL_BUILD_OPTIONS:-}"
 BAZEL_BUILD_OPTIONS+=(
     "--remote_download_outputs=all"
     "--strategy=protodoc=sandboxed,local"
-    "--action_env=ENVOY_BLOB_SHA"
-    "--action_env=EXTENSION_DB_PATH")
-
-# TODO(phlax): move this to format_pre checks
-bazel run "${BAZEL_BUILD_OPTIONS[@]}" //tools/extensions:validate_extensions
+    "--action_env=ENVOY_BLOB_SHA")
 
 # Generate RST for the lists of trusted/untrusted extensions in
 # intro/arch_overview/security docs.

source/extensions/BUILD

@@ -2,4 +2,5 @@ licenses(["notice"])  # Apache 2
 
 exports_files([
     "extensions_metadata.yaml",
+    "extensions_build_config.bzl",
 ])

source/extensions/access_loggers/file/BUILD

@@ -15,12 +15,10 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.access_loggers",
     # TODO(#9953) determine if this is core or should be cleaned up.
     extra_visibility = [
         "//test:__subpackages__",
     ],
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         "//include/envoy/registry",
         "//source/common/config:config_provider_lib",

source/extensions/access_loggers/grpc/BUILD

@@ -97,13 +97,11 @@ envoy_cc_extension(
     name = "http_config",
     srcs = ["http_config.cc"],
     hdrs = ["http_config.h"],
-    category = "envoy.access_loggers",
     # TODO(#9953) clean up.
     extra_visibility = [
         "//test/common/access_log:__subpackages__",
         "//test/integration:__subpackages__",
     ],
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         ":config_utils",
         "//include/envoy/server:access_log_config_interface",
@@ -121,13 +119,11 @@ envoy_cc_extension(
     name = "tcp_config",
     srcs = ["tcp_config.cc"],
     hdrs = ["tcp_config.h"],
-    category = "envoy.access_loggers",
     # TODO(#9953) clean up.
     extra_visibility = [
         "//test/common/access_log:__subpackages__",
         "//test/integration:__subpackages__",
     ],
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         ":config_utils",
         "//include/envoy/server:access_log_config_interface",

source/extensions/access_loggers/open_telemetry/BUILD

@@ -61,13 +61,11 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.access_loggers",
     # TODO(#9953) clean up.
     extra_visibility = [
         "//test/common/access_log:__subpackages__",
         "//test/integration:__subpackages__",
     ],
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         "//include/envoy/server:access_log_config_interface",
         "//source/common/common:assert_lib",

source/extensions/access_loggers/stream/BUILD

@@ -12,11 +12,9 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.access_loggers",
     extra_visibility = [
         "//test:__subpackages__",
     ],
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         "//include/envoy/registry",
         "//source/common/config:config_provider_lib",

source/extensions/access_loggers/wasm/BUILD

@@ -26,9 +26,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.access_loggers",
-    security_posture = "unknown",
-    status = "alpha",
     deps = [
         ":wasm_access_log_lib",
         "//include/envoy/registry",

source/extensions/bootstrap/wasm/BUILD

@@ -16,9 +16,6 @@ envoy_cc_extension(
     hdrs = [
         "config.h",
     ],
-    category = "envoy.bootstrap",
-    security_posture = "unknown",
-    status = "alpha",
     deps = [
         "//include/envoy/registry",
         "//include/envoy/server:bootstrap_extension_config_interface",

source/extensions/clusters/aggregate/BUILD

@@ -15,8 +15,6 @@ envoy_cc_extension(
         "cluster.h",
         "lb_context.h",
     ],
-    category = "envoy.clusters",
-    security_posture = "requires_trusted_downstream_and_upstream",
     deps = [
         "//source/common/upstream:cluster_factory_lib",
         "//source/common/upstream:upstream_includes",

source/extensions/clusters/dynamic_forward_proxy/BUILD

@@ -12,8 +12,6 @@ envoy_cc_extension(
     name = "cluster",
     srcs = ["cluster.cc"],
     hdrs = ["cluster.h"],
-    category = "envoy.clusters",
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         "//source/common/network:transport_socket_options_lib",
         "//source/common/upstream:cluster_factory_lib",

source/extensions/clusters/redis/BUILD

@@ -42,8 +42,6 @@ envoy_cc_extension(
         "redis_cluster.cc",
         "redis_cluster.h",
     ],
-    category = "envoy.clusters",
-    security_posture = "requires_trusted_downstream_and_upstream",
     deps = [
         "redis_cluster_lb",
         "//include/envoy/api:api_interface",

source/extensions/common/crypto/BUILD

@@ -18,7 +18,6 @@ envoy_cc_extension(
         "crypto_impl.h",
         "utility_impl.h",
     ],
-    category = "DELIBERATELY_OMITTED",
     external_deps = [
         "ssl",
     ],
@@ -27,8 +26,6 @@ envoy_cc_extension(
         "//test/common/config:__subpackages__",
         "//test/common/crypto:__subpackages__",
     ],
-    security_posture = "unknown",
-    undocumented = True,
     deps = [
         "//include/envoy/buffer:buffer_interface",
         "//source/common/common:assert_lib",

source/extensions/compression/brotli/compressor/BUILD

@@ -25,8 +25,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.compression.compressor",
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         ":compressor_lib",
         "//source/common/http:headers_lib",

source/extensions/compression/brotli/decompressor/BUILD

@@ -27,8 +27,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.compression.decompressor",
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         ":decompressor_lib",
         "//source/common/http:headers_lib",

source/extensions/compression/gzip/compressor/BUILD

@@ -26,8 +26,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.compression.compressor",
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         ":compressor_lib",
         "//source/common/http:headers_lib",

source/extensions/compression/gzip/decompressor/BUILD

@@ -29,8 +29,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.compression.decompressor",
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         ":zlib_decompressor_impl_lib",
         "//source/common/http:headers_lib",

source/extensions/filters/http/adaptive_concurrency/BUILD

@@ -30,9 +30,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "unknown",
-    status = "alpha",
     deps = [
         "//include/envoy/registry",
         "//source/extensions/filters/http:well_known_names",

source/extensions/filters/http/admission_control/BUILD

@@ -1,6 +1,7 @@
 load(
     "//bazel:envoy_build_system.bzl",
     "envoy_cc_extension",
+    "envoy_cc_library",
     "envoy_extension_package",
 )
 
@@ -11,7 +12,7 @@ licenses(["notice"])  # Apache 2
 
 envoy_extension_package()
 
-envoy_cc_extension(
+envoy_cc_library(
     name = "admission_control_filter_lib",
     srcs = [
         "admission_control.cc",
@@ -21,8 +22,6 @@ envoy_cc_extension(
         "admission_control.h",
         "thread_local_controller.h",
     ],
-    category = "envoy.filters.http",
-    security_posture = "unknown",
     deps = [
         "//include/envoy/http:filter_interface",
         "//include/envoy/runtime:runtime_interface",
@@ -41,9 +40,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "unknown",
-    status = "alpha",
     deps = [
         "//include/envoy/registry",
         "//source/common/common:enum_to_int",

source/extensions/filters/http/aws_lambda/BUILD

@@ -37,9 +37,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "requires_trusted_downstream_and_upstream",
-    status = "alpha",
     deps = [
         ":aws_lambda_filter_lib",
         "//include/envoy/registry",

source/extensions/filters/http/aws_request_signing/BUILD

@@ -29,9 +29,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "requires_trusted_downstream_and_upstream",
-    status = "alpha",
     deps = [
         ":aws_request_signing_filter_lib",
         "//include/envoy/registry",

source/extensions/filters/http/bandwidth_limit/BUILD

@@ -36,8 +36,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "unknown",
     deps = [
         ":bandwidth_limit_lib",
         "//include/envoy/http:filter_interface",

source/extensions/filters/http/buffer/BUILD

@@ -37,8 +37,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "robust_to_untrusted_downstream",
     # Legacy test use. TODO(#9953) clean up.
     visibility = ["//visibility:public"],
     deps = [

source/extensions/filters/http/cache/BUILD

@@ -101,9 +101,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "robust_to_untrusted_downstream_and_upstream",
-    status = "wip",
     deps = [
         ":cache_filter_lib",
         "//source/extensions/filters/http:well_known_names",

source/extensions/filters/http/cache/simple_http_cache/BUILD

@@ -14,9 +14,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["simple_http_cache.cc"],
     hdrs = ["simple_http_cache.h"],
-    category = "envoy.filters.http.cache",
-    security_posture = "robust_to_untrusted_downstream_and_upstream",
-    status = "wip",
     deps = [
         "//include/envoy/registry",
         "//include/envoy/runtime:runtime_interface",

source/extensions/filters/http/cdn_loop/BUILD

@@ -45,9 +45,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "unknown",
-    status = "alpha",
     deps = [
         ":filter_lib",
         ":parser_lib",

source/extensions/filters/http/composite/BUILD

@@ -45,8 +45,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "unknown",
     deps = [
         "//include/envoy/registry",
         "//include/envoy/server:filter_config_interface",

source/extensions/filters/http/compressor/BUILD

@@ -27,8 +27,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         ":compressor_filter_lib",
         "//include/envoy/compression/compressor:compressor_config_interface",

source/extensions/filters/http/cors/BUILD

@@ -31,12 +31,10 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
     # TODO(#9953) clean up.
     extra_visibility = [
         "//test/integration:__subpackages__",
     ],
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         "//include/envoy/registry",
         "//include/envoy/server:filter_config_interface",

source/extensions/filters/http/csrf/BUILD

@@ -33,8 +33,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         "//include/envoy/registry",
         "//source/extensions/filters/http:well_known_names",

source/extensions/filters/http/decompressor/BUILD

@@ -33,8 +33,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "robust_to_untrusted_downstream_and_upstream",
     deps = [
         ":decompressor_filter_lib",
         "//include/envoy/compression/decompressor:decompressor_config_interface",

source/extensions/filters/http/dynamic_forward_proxy/BUILD

@@ -29,8 +29,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         "//include/envoy/registry",
         "//include/envoy/server:filter_config_interface",

source/extensions/filters/http/dynamo/BUILD

@@ -42,8 +42,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "requires_trusted_downstream_and_upstream",
     deps = [
         ":dynamo_filter_lib",
         "//include/envoy/registry",