@@ -319,7 +319,7 @@ func (s *Server) makeIngressGatewayListeners(address string, cfgSnap *proxycfg.C
319319 filterName : listenerKey .RouteName (),
320320 routeName : listenerKey .RouteName (),
321321 cluster : "" ,
322- statPrefix : "ingress_upstream_ " ,
322+ statPrefix : "ingress_upstream. " ,
323323 routePath : "" ,
324324 ingress : false ,
325325 httpAuthzFilter : nil ,
@@ -771,7 +771,7 @@ func (s *Server) makeTerminatingGatewayListener(
771771
772772 // This fallback catch-all filter ensures a listener will be present for health checks to pass
773773 // Envoy will reset these connections since known endpoints are caught by filter chain matches above
774- tcpProxy , err := makeTCPProxyFilter (name , "" , "terminating_gateway_ " )
774+ tcpProxy , err := makeTCPProxyFilter (name , "" , "terminating_gateway. " )
775775 if err != nil {
776776 return nil , err
777777 }
@@ -821,7 +821,7 @@ func (s *Server) makeFilterChainTerminatingGateway(
821821 // Lastly we setup the actual proxying component. For L4 this is a straight
822822 // tcp proxy. For L7 this is a very hands-off HTTP proxy just to inject an
823823 // HTTP filter to do intention checks here instead.
824- statPrefix := fmt .Sprintf ("terminating_gateway_%s_%s_ " , service .NamespaceOrDefault (), service .Name )
824+ statPrefix := fmt .Sprintf ("terminating_gateway.%s.%s. " , service .NamespaceOrDefault (), service .Name )
825825 opts := listenerFilterOpts {
826826 protocol : protocol ,
827827 filterName : listener ,
@@ -868,7 +868,7 @@ func (s *Server) makeMeshGatewayListener(name, addr string, port int, cfgSnap *p
868868
869869 // The cluster name here doesn't matter as the sni_cluster
870870 // filter will fill it in for us.
871- tcpProxy , err := makeTCPProxyFilter (name , "" , "mesh_gateway_local_ " )
871+ tcpProxy , err := makeTCPProxyFilter (name , "" , "mesh_gateway_local. " )
872872 if err != nil {
873873 return nil , err
874874 }
@@ -891,8 +891,8 @@ func (s *Server) makeMeshGatewayListener(name, addr string, port int, cfgSnap *p
891891 continue // skip local
892892 }
893893 clusterName := connect .DatacenterSNI (dc , cfgSnap .Roots .TrustDomain )
894- filterName := fmt .Sprintf ("%s_ %s" , name , dc )
895- dcTCPProxy , err := makeTCPProxyFilter (filterName , clusterName , "mesh_gateway_remote_ " )
894+ filterName := fmt .Sprintf ("%s. %s" , name , dc )
895+ dcTCPProxy , err := makeTCPProxyFilter (filterName , clusterName , "mesh_gateway_remote. " )
896896 if err != nil {
897897 return nil , err
898898 }
@@ -913,8 +913,8 @@ func (s *Server) makeMeshGatewayListener(name, addr string, port int, cfgSnap *p
913913 continue // skip local
914914 }
915915 clusterName := cfgSnap .ServerSNIFn (dc , "" )
916- filterName := fmt .Sprintf ("%s_ %s" , name , dc )
917- dcTCPProxy , err := makeTCPProxyFilter (filterName , clusterName , "mesh_gateway_remote_ " )
916+ filterName := fmt .Sprintf ("%s. %s" , name , dc )
917+ dcTCPProxy , err := makeTCPProxyFilter (filterName , clusterName , "mesh_gateway_remote. " )
918918 if err != nil {
919919 return nil , err
920920 }
@@ -933,8 +933,8 @@ func (s *Server) makeMeshGatewayListener(name, addr string, port int, cfgSnap *p
933933 for _ , srv := range cfgSnap .MeshGateway .ConsulServers {
934934 clusterName := cfgSnap .ServerSNIFn (cfgSnap .Datacenter , srv .Node .Node )
935935
936- filterName := fmt .Sprintf ("%s_ %s" , name , cfgSnap .Datacenter )
937- dcTCPProxy , err := makeTCPProxyFilter (filterName , clusterName , "mesh_gateway_local_server_ " )
936+ filterName := fmt .Sprintf ("%s. %s" , name , cfgSnap .Datacenter )
937+ dcTCPProxy , err := makeTCPProxyFilter (filterName , clusterName , "mesh_gateway_local_server. " )
938938 if err != nil {
939939 return nil , err
940940 }
@@ -976,38 +976,61 @@ func (s *Server) makeUpstreamListenerForDiscoveryChain(
976976 }
977977
978978 useRDS := true
979- clusterName := ""
979+ var (
980+ clusterName string
981+ destination , datacenter , namespace string
982+ )
980983 if chain == nil || chain .IsDefault () {
984+ useRDS = false
985+
981986 dc := u .Datacenter
982987 if dc == "" {
983988 dc = cfgSnap .Datacenter
984989 }
985- sni := connect . UpstreamSNI ( u , "" , dc , cfgSnap . Roots . TrustDomain )
990+ destination , datacenter , namespace = u . DestinationName , dc , u . DestinationNamespace
986991
987- useRDS = false
992+ sni := connect . UpstreamSNI ( u , "" , dc , cfgSnap . Roots . TrustDomain )
988993 clusterName = CustomizeClusterName (sni , chain )
989994
990- } else if cfg .Protocol == "tcp" {
991- startNode := chain .Nodes [chain .StartNode ]
992- if startNode == nil {
993- return nil , fmt .Errorf ("missing first node in compiled discovery chain for: %s" , chain .ServiceName )
994- } else if startNode .Type != structs .DiscoveryGraphNodeTypeResolver {
995- return nil , fmt .Errorf ("unexpected first node in discovery chain using protocol=%q: %s" , cfg .Protocol , startNode .Type )
995+ } else {
996+ destination , datacenter , namespace = chain .ServiceName , chain .Datacenter , chain .Namespace
997+
998+ if cfg .Protocol == "tcp" {
999+ useRDS = false
1000+
1001+ startNode := chain .Nodes [chain .StartNode ]
1002+ if startNode == nil {
1003+ return nil , fmt .Errorf ("missing first node in compiled discovery chain for: %s" , chain .ServiceName )
1004+ }
1005+ if startNode .Type != structs .DiscoveryGraphNodeTypeResolver {
1006+ return nil , fmt .Errorf ("unexpected first node in discovery chain using protocol=%q: %s" , cfg .Protocol , startNode .Type )
1007+ }
1008+ targetID := startNode .Resolver .Target
1009+ target := chain .Targets [targetID ]
1010+
1011+ clusterName = CustomizeClusterName (target .Name , chain )
9961012 }
997- targetID := startNode .Resolver .Target
998- target := chain .Targets [targetID ]
1013+ }
9991014
1000- useRDS = false
1001- clusterName = CustomizeClusterName (target .Name , chain )
1015+ // Default the namespace to match how SNIs are generated
1016+ if namespace == "" {
1017+ namespace = structs .IntentionDefaultNamespace
1018+ }
1019+ filterName := fmt .Sprintf ("%s.%s.%s" , destination , namespace , datacenter )
1020+
1021+ if u .DestinationType == structs .UpstreamDestTypePreparedQuery {
1022+ // Avoid encoding dc and namespace for prepared queries.
1023+ // Those are defined in the query itself and are not available here.
1024+ filterName = upstreamID
10021025 }
10031026
10041027 opts := listenerFilterOpts {
10051028 useRDS : useRDS ,
10061029 protocol : cfg .Protocol ,
1007- filterName : upstreamID ,
1030+ filterName : filterName ,
10081031 routeName : upstreamID ,
10091032 cluster : clusterName ,
1010- statPrefix : "upstream_ " ,
1033+ statPrefix : "upstream. " ,
10111034 routePath : "" ,
10121035 ingress : false ,
10131036 httpAuthzFilter : nil ,
@@ -1120,31 +1143,27 @@ func makeSNIClusterFilter() (*envoylistener.Filter, error) {
11201143
11211144func makeTCPProxyFilter (filterName , cluster , statPrefix string ) (* envoylistener.Filter , error ) {
11221145 cfg := & envoytcp.TcpProxy {
1123- StatPrefix : makeStatPrefix ("tcp" , statPrefix , filterName ),
1146+ StatPrefix : makeStatPrefix (statPrefix , filterName ),
11241147 ClusterSpecifier : & envoytcp.TcpProxy_Cluster {Cluster : cluster },
11251148 }
11261149 return makeFilter ("envoy.tcp_proxy" , cfg , false )
11271150}
11281151
1129- func makeStatPrefix (protocol , prefix , filterName string ) string {
1152+ func makeStatPrefix (prefix , filterName string ) string {
11301153 // Replace colons here because Envoy does that in the metrics for the actual
11311154 // clusters but doesn't in the stat prefix here while dashboards assume they
11321155 // will match.
1133- return fmt .Sprintf ("%s%s_% s" , prefix , strings .Replace (filterName , ":" , "_" , - 1 ), protocol )
1156+ return fmt .Sprintf ("%s%s" , prefix , strings .Replace (filterName , ":" , "_" , - 1 ))
11341157}
11351158
11361159func makeHTTPFilter (opts listenerFilterOpts ) (* envoylistener.Filter , error ) {
11371160 op := envoyhttp .HttpConnectionManager_Tracing_INGRESS
11381161 if ! opts .ingress {
11391162 op = envoyhttp .HttpConnectionManager_Tracing_EGRESS
11401163 }
1141- proto := "http"
1142- if opts .protocol == "grpc" {
1143- proto = opts .protocol
1144- }
11451164
11461165 cfg := & envoyhttp.HttpConnectionManager {
1147- StatPrefix : makeStatPrefix (proto , opts .statPrefix , opts .filterName ),
1166+ StatPrefix : makeStatPrefix (opts .statPrefix , opts .filterName ),
11481167 CodecType : envoyhttp .HttpConnectionManager_AUTO ,
11491168 HttpFilters : []* envoyhttp.HttpFilter {
11501169 {
0 commit comments