diff --git a/internal/xds/translator/proxy_protocol.go b/internal/xds/translator/proxy_protocol.go index 453cb0ed29..ada9bd3017 100644 --- a/internal/xds/translator/proxy_protocol.go +++ b/internal/xds/translator/proxy_protocol.go @@ -6,6 +6,8 @@ package translator import ( + "slices" + listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3" proxyprotocolv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/listener/proxy_protocol/v3" "github.com/envoyproxy/go-control-plane/pkg/wellknown" @@ -37,7 +39,7 @@ func patchProxyProtocolFilter(xdsListener *listenerv3.Listener, proxyProtocolSet // Build and patch the Proxy Protocol Filter. filter := buildProxyProtocolFilter(proxyProtocolSettings) if filter != nil { - xdsListener.ListenerFilters = append(xdsListener.ListenerFilters, filter) + xdsListener.ListenerFilters = slices.Insert(xdsListener.ListenerFilters, 0, filter) } } diff --git a/internal/xds/translator/testdata/in/xds-ir/listener-proxy-protocol-multi.yaml b/internal/xds/translator/testdata/in/xds-ir/listener-proxy-protocol-multi.yaml new file mode 100644 index 0000000000..bd6e7acb73 --- /dev/null +++ b/internal/xds/translator/testdata/in/xds-ir/listener-proxy-protocol-multi.yaml @@ -0,0 +1,44 @@ +http: +- name: "listener" + address: "::" + port: 10080 + hostnames: + - "foo.com" + - "bar.com" + path: + mergeSlashes: true + escapedSlashesAction: UnescapeAndRedirect + tls: + alpnProtocols: + - h2 + - http/1.1 + certificates: + - name: secret-1 + # byte slice representation of "key-data" + certificate: [99, 101, 114, 116, 45, 100, 97, 116, 97] + # byte slice representation of "key-data" + privateKey: [107, 101, 121, 45, 100, 97, 116, 97] + - name: secret-2 + certificate: [99, 101, 114, 116, 45, 100, 97, 116, 97] + privateKey: [107, 101, 121, 45, 100, 97, 116, 97] + proxyProtocol: + optional: false + routes: + - name: "first-route" + hostname: "foo.com" + destination: + name: "first-route-dest" + settings: + - endpoints: + - host: "1.2.3.4" + port: 50000 + name: "first-route-dest/backend/0" + - name: "second-route" + hostname: "bar.com" + destination: + name: "second-route-dest" + settings: + - endpoints: + - host: "5.6.7.8" + port: 50000 + name: "second-route-dest/backend/0" diff --git a/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol-multi.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol-multi.clusters.yaml new file mode 100644 index 0000000000..7e9eb80719 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol-multi.clusters.yaml @@ -0,0 +1,48 @@ +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: first-route-dest + ignoreHealthOnHostRemoval: true + lbPolicy: LEAST_REQUEST + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + name: first-route-dest + perConnectionBufferLimitBytes: 32768 + type: EDS +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: second-route-dest + ignoreHealthOnHostRemoval: true + lbPolicy: LEAST_REQUEST + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + name: second-route-dest + perConnectionBufferLimitBytes: 32768 + type: EDS diff --git a/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol-multi.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol-multi.endpoints.yaml new file mode 100644 index 0000000000..39102da400 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol-multi.endpoints.yaml @@ -0,0 +1,24 @@ +- clusterName: first-route-dest + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 1.2.3.4 + portValue: 50000 + loadBalancingWeight: 1 + loadBalancingWeight: 1 + locality: + region: first-route-dest/backend/0 +- clusterName: second-route-dest + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 5.6.7.8 + portValue: 50000 + loadBalancingWeight: 1 + loadBalancingWeight: 1 + locality: + region: second-route-dest/backend/0 diff --git a/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol-multi.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol-multi.listeners.yaml new file mode 100644 index 0000000000..4a01e1c2f6 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol-multi.listeners.yaml @@ -0,0 +1,65 @@ +- address: + socketAddress: + address: '::' + portValue: 10080 + filterChains: + - filterChainMatch: + serverNames: + - foo.com + - bar.com + filters: + - name: envoy.filters.network.http_connection_manager + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + commonHttpProtocolOptions: + headersWithUnderscoresAction: REJECT_REQUEST + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + maxConcurrentStreams: 100 + httpFilters: + - name: envoy.filters.http.router + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + suppressEnvoyHeaders: true + mergeSlashes: true + normalizePath: true + pathWithEscapedSlashesAction: UNESCAPE_AND_REDIRECT + rds: + configSource: + ads: {} + resourceApiVersion: V3 + routeConfigName: listener + serverHeaderTransformation: PASS_THROUGH + statPrefix: https-10080 + useRemoteAddress: true + name: listener + transportSocket: + name: envoy.transport_sockets.tls + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext + commonTlsContext: + alpnProtocols: + - h2 + - http/1.1 + tlsCertificateSdsSecretConfigs: + - name: secret-1 + sdsConfig: + ads: {} + resourceApiVersion: V3 + - name: secret-2 + sdsConfig: + ads: {} + resourceApiVersion: V3 + disableStatefulSessionResumption: true + disableStatelessSessionResumption: true + listenerFilters: + - name: envoy.filters.listener.proxy_protocol + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol + - name: envoy.filters.listener.tls_inspector + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector + maxConnectionsToAcceptPerSocketEvent: 1 + name: listener + perConnectionBufferLimitBytes: 32768 diff --git a/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol-multi.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol-multi.routes.yaml new file mode 100644 index 0000000000..21193de51f --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol-multi.routes.yaml @@ -0,0 +1,25 @@ +- ignorePortInHostMatching: true + name: listener + virtualHosts: + - domains: + - foo.com + name: listener/foo_com + routes: + - match: + prefix: / + name: first-route + route: + cluster: first-route-dest + upgradeConfigs: + - upgradeType: websocket + - domains: + - bar.com + name: listener/bar_com + routes: + - match: + prefix: / + name: second-route + route: + cluster: second-route-dest + upgradeConfigs: + - upgradeType: websocket diff --git a/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol-multi.secrets.yaml b/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol-multi.secrets.yaml new file mode 100644 index 0000000000..ad88ffe43c --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol-multi.secrets.yaml @@ -0,0 +1,12 @@ +- name: secret-1 + tlsCertificate: + certificateChain: + inlineBytes: Y2VydC1kYXRh + privateKey: + inlineBytes: a2V5LWRhdGE= +- name: secret-2 + tlsCertificate: + certificateChain: + inlineBytes: Y2VydC1kYXRh + privateKey: + inlineBytes: a2V5LWRhdGE=