Add ability to filter ConfigDump.

include/envoy/matcher/BUILD

@@ -22,3 +22,16 @@ envoy_cc_library(
         "@envoy_api//envoy/config/core/v3:pkg_cc_proto",
     ],
 )
+
+envoy_cc_library(
+    name = "dump_matcher_interface",
+    hdrs = ["dump_matcher.h"],
+    external_deps = [
+        "abseil_base",
+        "abseil_hash",
+    ],
+    deps = [
+        "//include/envoy/config:typed_config_interface",
+        "//source/common/protobuf",
+    ],
+)

include/envoy/matcher/dump_matcher.h

@@ -0,0 +1,48 @@
+#pragma once
+
+#include <memory>
+#include <string>
+
+#include "envoy/common/pure.h"
+#include "envoy/config/typed_config.h"
+
+#include "common/protobuf/protobuf.h"
+
+#include "absl/container/flat_hash_map.h"
+
+namespace Envoy {
+namespace Matcher {
+namespace ConfigDump {
+using MatchingParameters = absl::flat_hash_map<std::string, std::string>;
+
+/**
+ * Implement this class and its `match` method for all the types that should
+ * have config dump filtering enabled. For example:
+ * class RouteConfigDumpMatcher : DumpMatcher {
+ *   bool match(const proto2::Message& dump_message) {
+ *     // cast dump_message to the correct proto, and perform the match
+ *   }
+ * };
+ */
+class DumpMatcher {
+public:
+  virtual ~DumpMatcher() = default;
+
+  virtual bool match(const Protobuf::Message& dump_message,
+                     const MatchingParameters& matchers) const PURE;
+};
+
+// Must have `name` method which returns the fully qualified proto name that the
+// matcher is supposed to match.
+class DumpMatcherFactory : public Config::UntypedFactory {
+public:
+  virtual ~DumpMatcherFactory() = default;
+
+  virtual const DumpMatcher& getDumpMatcher() PURE;
+
+  std::string category() const override { return "envoy.matching.config_dump"; }
+};
+
+} // namespace ConfigDump
+} // namespace Matcher
+} // namespace Envoy

include/envoy/server/BUILD

@@ -53,6 +53,7 @@ envoy_cc_library(
     name = "config_tracker_interface",
     hdrs = ["config_tracker.h"],
     deps = [
+        "//include/envoy/matcher:dump_matcher_interface",
         "//source/common/common:non_copyable",
         "//source/common/protobuf",
     ],

include/envoy/server/config_tracker.h

@@ -5,6 +5,7 @@
 #include <memory>
 
 #include "envoy/common/pure.h"
+#include "envoy/matcher/dump_matcher.h"
 
 #include "common/common/non_copyable.h"
 #include "common/protobuf/protobuf.h"
@@ -13,22 +14,25 @@ namespace Envoy {
 namespace Server {
 
 /**
- * ConfigTracker is used by the `/config_dump` admin endpoint to manage storage of config-providing
- * callbacks with weak ownership semantics. Callbacks added to ConfigTracker only live as long as
- * the returned EntryOwner object (or ConfigTracker itself, if shorter). Keys should be descriptors
- * of the configs provided by the corresponding callback. They must be unique.
- * ConfigTracker is *not* threadsafe.
+ * ConfigTracker is used by the `/config_dump` admin endpoint to manage storage
+ * of config-providing callbacks with weak ownership semantics. Callbacks added
+ * to ConfigTracker only live as long as the returned EntryOwner object (or
+ * ConfigTracker itself, if shorter). Keys should be descriptors of the configs
+ * provided by the corresponding callback. They must be unique. ConfigTracker is
+ * *not* threadsafe.
  */
 class ConfigTracker {
 public:
-  using Cb = std::function<ProtobufTypes::MessagePtr()>;
+  using Cb =
+      std::function<ProtobufTypes::MessagePtr(const Matcher::ConfigDump::MatchingParameters&)>;
   using CbsMap = std::map<std::string, Cb>;
 
   /**
    * EntryOwner supplies RAII semantics for entries in the map.
-   * The entry is not removed until the EntryOwner or the ConfigTracker itself is destroyed,
-   * whichever happens first. When you add() an entry, you must hold onto the returned
-   * owner object for as long as you want the entry to stay in the map.
+   * The entry is not removed until the EntryOwner or the ConfigTracker itself
+   * is destroyed, whichever happens first. When you add() an entry, you must
+   * hold onto the returned owner object for as long as you want the entry to
+   * stay in the map.
    */
   class EntryOwner {
   public:
@@ -50,7 +54,8 @@ class ConfigTracker {
    * Add a new callback to the map under the given key
    * @param key the map key for the new callback.
    * @param cb the callback to add. *must not* return nullptr.
-   * @return EntryOwnerPtr the new entry's owner object. nullptr if the key is already present.
+   * @return EntryOwnerPtr the new entry's owner object. nullptr if the key is
+   * already present.
    */
   virtual EntryOwnerPtr add(const std::string& key, Cb cb) PURE;
 };

source/common/config/BUILD

@@ -32,13 +32,15 @@ envoy_cc_library(
         "//include/envoy/config:config_provider_interface",
         "//include/envoy/config:config_provider_manager_interface",
         "//include/envoy/init:manager_interface",
+        "//include/envoy/matcher:dump_matcher_interface",
         "//include/envoy/server:admin_interface",
         "//include/envoy/server:config_tracker_interface",
         "//include/envoy/singleton:instance_interface",
         "//include/envoy/thread_local:thread_local_interface",
         "//source/common/init:manager_lib",
         "//source/common/init:target_lib",
         "//source/common/init:watcher_lib",
+        "//source/common/matcher:config_dump_matcher",
         "//source/common/protobuf",
     ],
 )

source/common/config/config_provider_impl.cc

@@ -1,5 +1,7 @@
 #include "common/config/config_provider_impl.h"
 
+#include "envoy/matcher/dump_matcher.h"
+
 namespace Envoy {
 namespace Config {
 
@@ -52,10 +54,13 @@ bool ConfigSubscriptionInstance::checkAndApplyConfigUpdate(const Protobuf::Messa
 
 ConfigProviderManagerImplBase::ConfigProviderManagerImplBase(Server::Admin& admin,
                                                              const std::string& config_name) {
-  config_tracker_entry_ =
-      admin.getConfigTracker().add(config_name, [this] { return dumpConfigs(); });
-  // ConfigTracker keys must be unique. We are asserting that no one has stolen the key
-  // from us, since the returned entry will be nullptr if the key already exists.
+  config_tracker_entry_ = admin.getConfigTracker().add(
+      config_name, [this](const Matcher::ConfigDump::MatchingParameters& matching_params) {
+        return dumpConfigs(matching_params);
+      });
+  // ConfigTracker keys must be unique. We are asserting that no one has stolen
+  // the key from us, since the returned entry will be nullptr if the key
+  // already exists.
   RELEASE_ASSERT(config_tracker_entry_, "");
 }
 

source/common/config/config_provider_impl.h

@@ -3,6 +3,7 @@
 #include "envoy/config/config_provider.h"
 #include "envoy/config/config_provider_manager.h"
 #include "envoy/init/manager.h"
+#include "envoy/matcher/dump_matcher.h"
 #include "envoy/server/admin.h"
 #include "envoy/server/config_tracker.h"
 #include "envoy/singleton/instance.h"
@@ -383,7 +384,8 @@ class ConfigProviderManagerImplBase : public ConfigProviderManager, public Singl
    * @return ProtobufTypes::MessagePtr the config dump proto corresponding to the associated
    *                                   config providers.
    */
-  virtual ProtobufTypes::MessagePtr dumpConfigs() const PURE;
+  virtual ProtobufTypes::MessagePtr
+  dumpConfigs(const Matcher::ConfigDump::MatchingParameters& matching_params) const PURE;
 
 protected:
   // Ordered set for deterministic config dump output.

source/common/matcher/BUILD

@@ -16,6 +16,17 @@ envoy_cc_library(
     ],
 )
 
+envoy_cc_library(
+    name = "config_dump_matcher",
+    srcs = ["config_dump_matcher.cc"],
+    hdrs = ["config_dump_matcher.h"],
+    deps = [
+        "//include/envoy/matcher:dump_matcher_interface",
+        "//source/common/config:utility_lib",
+        "//source/common/protobuf",
+    ],
+)
+
 envoy_cc_library(
     name = "value_input_matcher_lib",
     hdrs = ["value_input_matcher.h"],

source/common/matcher/config_dump_matcher.cc

@@ -0,0 +1,22 @@
+#include "common/matcher/config_dump_matcher.h"
+
+#include "envoy/matcher/dump_matcher.h"
+
+#include "common/config/utility.h"
+#include "common/protobuf/protobuf.h"
+
+namespace Envoy {
+namespace Matcher {
+namespace ConfigDump {
+bool isMatch(const Envoy::Protobuf::Message& dump_message, const MatchingParameters& match_params) {
+  auto* factory = Envoy::Config::Utility::getFactoryByName<DumpMatcherFactory>(
+      dump_message.GetDescriptor()->full_name());
+  if (factory == nullptr) {
+    return true;
+  }
+  return factory->getDumpMatcher().match(dump_message, match_params);
+}
+
+} // namespace ConfigDump
+} // namespace Matcher
+} // namespace Envoy

source/common/matcher/config_dump_matcher.h

@@ -0,0 +1,13 @@
+#pragma once
+
+#include "envoy/matcher/dump_matcher.h"
+
+#include "common/protobuf/protobuf.h"
+
+namespace Envoy {
+namespace Matcher {
+namespace ConfigDump {
+bool isMatch(const Envoy::Protobuf::Message& dump_message, const MatchingParameters& match_params);
+} // namespace ConfigDump
+} // namespace Matcher
+} // namespace Envoy

source/common/router/BUILD

@@ -168,6 +168,7 @@ envoy_cc_library(
         "//include/envoy/config:subscription_interface",
         "//include/envoy/http:codes_interface",
         "//include/envoy/local_info:local_info_interface",
+        "//include/envoy/matcher:dump_matcher_interface",
         "//include/envoy/router:rds_interface",
         "//include/envoy/router:route_config_provider_manager_interface",
         "//include/envoy/router:route_config_update_info_interface",
@@ -186,6 +187,7 @@ envoy_cc_library(
         "//source/common/init:manager_lib",
         "//source/common/init:target_lib",
         "//source/common/init:watcher_lib",
+        "//source/common/matcher:config_dump_matcher",
         "//source/common/protobuf:utility_lib",
         "//source/common/router:route_config_update_impl_lib",
         "//source/common/router:vhds_lib",
@@ -224,6 +226,7 @@ envoy_cc_library(
         ":scoped_config_lib",
         "//include/envoy/config:config_provider_interface",
         "//include/envoy/config:subscription_interface",
+        "//include/envoy/matcher:dump_matcher_interface",
         "//include/envoy/router:route_config_provider_manager_interface",
         "//include/envoy/stats:stats_interface",
         "//source/common/common:assert_lib",
@@ -237,6 +240,7 @@ envoy_cc_library(
         "//source/common/config:xds_resource_lib",
         "//source/common/init:manager_lib",
         "//source/common/init:watcher_lib",
+        "//source/common/matcher:config_dump_matcher",
         "@envoy_api//envoy/admin/v3:pkg_cc_proto",
         "@envoy_api//envoy/api/v2:pkg_cc_proto",
         "@envoy_api//envoy/config/core/v3:pkg_cc_proto",

source/common/router/rds_impl.cc

@@ -9,6 +9,7 @@
 #include "envoy/api/v2/route.pb.h"
 #include "envoy/config/core/v3/config_source.pb.h"
 #include "envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.h"
+#include "envoy/matcher/dump_matcher.h"
 #include "envoy/service/discovery/v3/discovery.pb.h"
 
 #include "common/common/assert.h"
@@ -17,6 +18,7 @@
 #include "common/config/utility.h"
 #include "common/config/version_converter.h"
 #include "common/http/header_map_impl.h"
+#include "common/matcher/config_dump_matcher.h"
 #include "common/protobuf/utility.h"
 #include "common/router/config_impl.h"
 
@@ -303,8 +305,9 @@ void RdsRouteConfigProviderImpl::validateConfig(
   ConfigImpl validation_config(config, optional_http_filters_, factory_context_, validator_, false);
 }
 
-// Schedules a VHDS request on the main thread and queues up the callback to use when the VHDS
-// response has been propagated to the worker thread that was the request origin.
+// Schedules a VHDS request on the main thread and queues up the callback to use
+// when the VHDS response has been propagated to the worker thread that was the
+// request origin.
 void RdsRouteConfigProviderImpl::requestVirtualHostsUpdate(
     const std::string& for_domain, Event::Dispatcher& thread_local_dispatcher,
     std::weak_ptr<Http::RouteConfigUpdatedCallback> route_config_updated_cb) {
@@ -325,10 +328,13 @@ void RdsRouteConfigProviderImpl::requestVirtualHostsUpdate(
 }
 
 RouteConfigProviderManagerImpl::RouteConfigProviderManagerImpl(Server::Admin& admin) {
-  config_tracker_entry_ =
-      admin.getConfigTracker().add("routes", [this] { return dumpRouteConfigs(); });
-  // ConfigTracker keys must be unique. We are asserting that no one has stolen the "routes" key
-  // from us, since the returned entry will be nullptr if the key already exists.
+  config_tracker_entry_ = admin.getConfigTracker().add(
+      "routes", [this](const Matcher::ConfigDump::MatchingParameters& matching_params) {
+        return dumpRouteConfigs(matching_params);
+      });
+  // ConfigTracker keys must be unique. We are asserting that no one has stolen
+  // the "routes" key from us, since the returned entry will be nullptr if the
+  // key already exists.
   RELEASE_ASSERT(config_tracker_entry_, "");
 }
 
@@ -377,9 +383,9 @@ RouteConfigProviderPtr RouteConfigProviderManagerImpl::createStaticRouteConfigPr
 }
 
 std::unique_ptr<envoy::admin::v3::RoutesConfigDump>
-RouteConfigProviderManagerImpl::dumpRouteConfigs() const {
+RouteConfigProviderManagerImpl::dumpRouteConfigs(
+    const Matcher::ConfigDump::MatchingParameters& matching_params) const {
   auto config_dump = std::make_unique<envoy::admin::v3::RoutesConfigDump>();
-
   for (const auto& element : dynamic_route_config_providers_) {
     const auto& subscription = element.second.lock()->subscription_;
     // Because the RouteConfigProviderManager's weak_ptrs only get cleaned up
@@ -389,6 +395,10 @@ RouteConfigProviderManagerImpl::dumpRouteConfigs() const {
     ASSERT(subscription->route_config_provider_opt_.has_value());
 
     if (subscription->routeConfigUpdate()->configInfo()) {
+      if (!Matcher::ConfigDump::isMatch(subscription->routeConfigUpdate()->protobufConfiguration(),
+                                        matching_params)) {
+        continue;
+      }
       auto* dynamic_config = config_dump->mutable_dynamic_route_configs()->Add();
       dynamic_config->set_version_info(subscription->routeConfigUpdate()->configVersion());
       dynamic_config->mutable_route_config()->PackFrom(
@@ -400,6 +410,9 @@ RouteConfigProviderManagerImpl::dumpRouteConfigs() const {
 
   for (const auto& provider : static_route_config_providers_) {
     ASSERT(provider->configInfo());
+    if (!Matcher::ConfigDump::isMatch(provider->configInfo().value().config_, matching_params)) {
+      continue;
+    }
     auto* static_config = config_dump->mutable_static_route_configs()->Add();
     static_config->mutable_route_config()->PackFrom(
         API_RECOVER_ORIGINAL(provider->configInfo().value().config_));

source/common/router/rds_impl.h

@@ -14,6 +14,7 @@
 #include "envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.h"
 #include "envoy/http/codes.h"
 #include "envoy/local_info/local_info.h"
+#include "envoy/matcher/dump_matcher.h"
 #include "envoy/router/rds.h"
 #include "envoy/router/route_config_provider_manager.h"
 #include "envoy/router/route_config_update_receiver.h"
@@ -241,7 +242,8 @@ class RouteConfigProviderManagerImpl : public RouteConfigProviderManager,
 public:
   RouteConfigProviderManagerImpl(Server::Admin& admin);
 
-  std::unique_ptr<envoy::admin::v3::RoutesConfigDump> dumpRouteConfigs() const;
+  std::unique_ptr<envoy::admin::v3::RoutesConfigDump>
+  dumpRouteConfigs(const Matcher::ConfigDump::MatchingParameters& matching_params) const;
 
   // RouteConfigProviderManager
   RouteConfigProviderSharedPtr createRdsRouteConfigProvider(