Skip to content

Commit ee9f74f

Browse files
arkodgzirain
arkodg
authored and
zirain
committed
sort httpFilters on name if priority order is same (envoyproxy#6600)
* sort httpFilters on name if priority order is same ensures stability across translations, mitigating listener drains https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/listeners/listener_filters#filter-chain-only-update Signed-off-by: Arko Dasgupta <arko@tetrate.io>
1 parent 3771951 commit ee9f74f

14 files changed

+135
-126
lines changed

‎internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1176,14 +1176,14 @@ xds:
11761176
initialStreamWindowSize: 65536
11771177
maxConcurrentStreams: 100
11781178
httpFilters:
1179-
- name: envoy.filters.http.grpc_web
1180-
typedConfig:
1181-
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
11821179
- name: envoy.filters.http.grpc_stats
11831180
typedConfig:
11841181
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_stats.v3.FilterConfig
11851182
emitFilterState: true
11861183
statsForAllMethods: true
1184+
- name: envoy.filters.http.grpc_web
1185+
typedConfig:
1186+
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
11871187
- name: envoy.filters.http.router
11881188
typedConfig:
11891189
'@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

‎internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -953,12 +953,6 @@
953953
"maxConcurrentStreams": 100
954954
},
955955
"httpFilters": [
956-
{
957-
"name": "envoy.filters.http.grpc_web",
958-
"typedConfig": {
959-
"@type": "type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb"
960-
}
961-
},
962956
{
963957
"name": "envoy.filters.http.grpc_stats",
964958
"typedConfig": {
@@ -967,6 +961,12 @@
967961
"statsForAllMethods": true
968962
}
969963
},
964+
{
965+
"name": "envoy.filters.http.grpc_web",
966+
"typedConfig": {
967+
"@type": "type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb"
968+
}
969+
},
970970
{
971971
"name": "envoy.filters.http.router",
972972
"typedConfig": {

‎internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -593,14 +593,14 @@ xds:
593593
initialStreamWindowSize: 65536
594594
maxConcurrentStreams: 100
595595
httpFilters:
596-
- name: envoy.filters.http.grpc_web
597-
typedConfig:
598-
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
599596
- name: envoy.filters.http.grpc_stats
600597
typedConfig:
601598
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_stats.v3.FilterConfig
602599
emitFilterState: true
603600
statsForAllMethods: true
601+
- name: envoy.filters.http.grpc_web
602+
typedConfig:
603+
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
604604
- name: envoy.filters.http.router
605605
typedConfig:
606606
'@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

‎internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.listener.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -229,14 +229,14 @@ xds:
229229
initialStreamWindowSize: 65536
230230
maxConcurrentStreams: 100
231231
httpFilters:
232-
- name: envoy.filters.http.grpc_web
233-
typedConfig:
234-
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
235232
- name: envoy.filters.http.grpc_stats
236233
typedConfig:
237234
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_stats.v3.FilterConfig
238235
emitFilterState: true
239236
statsForAllMethods: true
237+
- name: envoy.filters.http.grpc_web
238+
typedConfig:
239+
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
240240
- name: envoy.filters.http.router
241241
typedConfig:
242242
'@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

‎internal/xds/translator/httpfilters.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,14 @@ func (o OrderedHTTPFilters) Len() int {
153153
}
154154

155155
func (o OrderedHTTPFilters) Less(i, j int) bool {
156+
// Sort on name if the order is equal
157+
// to keep the order stable and avoiding
158+
// listener drains
159+
if o[i].order == o[j].order {
160+
return o[i].filter.Name < o[j].filter.Name
161+
}
162+
163+
// Sort on order
156164
return o[i].order < o[j].order
157165
}
158166

@@ -171,6 +179,7 @@ func sortHTTPFilters(filters []*hcmv3.HttpFilter, filterOrder []egv1a1.FilterPos
171179
for i := 0; i < len(filters); i++ {
172180
orderedFilters[i] = newOrderedHTTPFilter(filters[i])
173181
}
182+
174183
sort.Sort(orderedFilters)
175184

176185
// Use a linked list to sort the filters in the custom order.

‎internal/xds/translator/testdata/out/xds-ir/basic-auth-username-header.listeners.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,19 +15,19 @@
1515
maxConcurrentStreams: 100
1616
httpFilters:
1717
- disabled: true
18-
name: envoy.filters.http.basic_auth/securitypolicy/default/policy-for-http-route-1
18+
name: envoy.filters.http.basic_auth/securitypolicy/default/policy-for-gateway-1
1919
typedConfig:
2020
'@type': type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuth
21-
forwardUsernameHeader: x-username
21+
forwardUsernameHeader: x-user-id
2222
users:
23-
inlineBytes: dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo=
23+
inlineBytes: Zm9vOntTSEF9WXMyM0FnLzVJT1dxWkN3OVFHYVZEZEh3SDAwPQpmb28xOntTSEF9ZGpaMTFxSFkwS09pamV5bUs3YUt2WXV2aHZNPQo=
2424
- disabled: true
25-
name: envoy.filters.http.basic_auth/securitypolicy/default/policy-for-gateway-1
25+
name: envoy.filters.http.basic_auth/securitypolicy/default/policy-for-http-route-1
2626
typedConfig:
2727
'@type': type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuth
28-
forwardUsernameHeader: x-user-id
28+
forwardUsernameHeader: x-username
2929
users:
30-
inlineBytes: Zm9vOntTSEF9WXMyM0FnLzVJT1dxWkN3OVFHYVZEZEh3SDAwPQpmb28xOntTSEF9ZGpaMTFxSFkwS09pamV5bUs3YUt2WXV2aHZNPQo=
30+
inlineBytes: dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo=
3131
- name: envoy.filters.http.router
3232
typedConfig:
3333
'@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

‎internal/xds/translator/testdata/out/xds-ir/basic-auth.listeners.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,17 +15,17 @@
1515
maxConcurrentStreams: 100
1616
httpFilters:
1717
- disabled: true
18-
name: envoy.filters.http.basic_auth/securitypolicy/default/policy-for-http-route-1
18+
name: envoy.filters.http.basic_auth/securitypolicy/default/policy-for-gateway-1
1919
typedConfig:
2020
'@type': type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuth
2121
users:
22-
inlineBytes: dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo=
22+
inlineBytes: Zm9vOntTSEF9WXMyM0FnLzVJT1dxWkN3OVFHYVZEZEh3SDAwPQpmb28xOntTSEF9ZGpaMTFxSFkwS09pamV5bUs3YUt2WXV2aHZNPQo=
2323
- disabled: true
24-
name: envoy.filters.http.basic_auth/securitypolicy/default/policy-for-gateway-1
24+
name: envoy.filters.http.basic_auth/securitypolicy/default/policy-for-http-route-1
2525
typedConfig:
2626
'@type': type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuth
2727
users:
28-
inlineBytes: Zm9vOntTSEF9WXMyM0FnLzVJT1dxWkN3OVFHYVZEZEh3SDAwPQpmb28xOntTSEF9ZGpaMTFxSFkwS09pamV5bUs3YUt2WXV2aHZNPQo=
28+
inlineBytes: dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo=
2929
- name: envoy.filters.http.router
3030
typedConfig:
3131
'@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

‎internal/xds/translator/testdata/out/xds-ir/dns-lookup-family.listeners.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -138,14 +138,14 @@
138138
transportApiVersion: V3
139139
withRequestBody:
140140
maxRequestBytes: 8192
141-
- name: envoy.filters.http.grpc_web
142-
typedConfig:
143-
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
144141
- name: envoy.filters.http.grpc_stats
145142
typedConfig:
146143
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_stats.v3.FilterConfig
147144
emitFilterState: true
148145
statsForAllMethods: true
146+
- name: envoy.filters.http.grpc_web
147+
typedConfig:
148+
'@type': type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
149149
- disabled: true
150150
name: envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-httproute/extproc/0
151151
typedConfig:

‎internal/xds/translator/testdata/out/xds-ir/ext-auth-backend.listeners.yaml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -14,22 +14,6 @@
1414
initialStreamWindowSize: 65536
1515
maxConcurrentStreams: 100
1616
httpFilters:
17-
- disabled: true
18-
name: envoy.filters.http.ext_authz/securitypolicy/default/policy-for-http-route-1
19-
typedConfig:
20-
'@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
21-
allowedHeaders:
22-
patterns:
23-
- exact: header1
24-
ignoreCase: true
25-
- exact: header2
26-
ignoreCase: true
27-
grpcService:
28-
envoyGrpc:
29-
authority: primary.foo.com
30-
clusterName: securitypolicy/default/policy-for-http-route-1/default/grpc-backend
31-
timeout: 10s
32-
transportApiVersion: V3
3317
- disabled: true
3418
name: envoy.filters.http.ext_authz/securitypolicy/default/policy-for-gateway-1
3519
typedConfig:
@@ -49,6 +33,22 @@
4933
timeout: 10s
5034
uri: http://primary.foo.com/auth
5135
transportApiVersion: V3
36+
- disabled: true
37+
name: envoy.filters.http.ext_authz/securitypolicy/default/policy-for-http-route-1
38+
typedConfig:
39+
'@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
40+
allowedHeaders:
41+
patterns:
42+
- exact: header1
43+
ignoreCase: true
44+
- exact: header2
45+
ignoreCase: true
46+
grpcService:
47+
envoyGrpc:
48+
authority: primary.foo.com
49+
clusterName: securitypolicy/default/policy-for-http-route-1/default/grpc-backend
50+
timeout: 10s
51+
transportApiVersion: V3
5252
- name: envoy.filters.http.router
5353
typedConfig:
5454
'@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

‎internal/xds/translator/testdata/out/xds-ir/ext-auth-body.listeners.yaml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -14,22 +14,6 @@
1414
initialStreamWindowSize: 65536
1515
maxConcurrentStreams: 100
1616
httpFilters:
17-
- disabled: true
18-
name: envoy.filters.http.ext_authz/securitypolicy/default/policy-for-http-route-1
19-
typedConfig:
20-
'@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
21-
allowedHeaders:
22-
patterns:
23-
- exact: header1
24-
ignoreCase: true
25-
- exact: header2
26-
ignoreCase: true
27-
grpcService:
28-
envoyGrpc:
29-
authority: primary.foo.com
30-
clusterName: securitypolicy/default/policy-for-http-route-1/default/grpc-backend
31-
timeout: 10s
32-
transportApiVersion: V3
3317
- disabled: true
3418
name: envoy.filters.http.ext_authz/securitypolicy/default/policy-for-gateway-1
3519
typedConfig:
@@ -51,6 +35,22 @@
5135
transportApiVersion: V3
5236
withRequestBody:
5337
maxRequestBytes: 32768
38+
- disabled: true
39+
name: envoy.filters.http.ext_authz/securitypolicy/default/policy-for-http-route-1
40+
typedConfig:
41+
'@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
42+
allowedHeaders:
43+
patterns:
44+
- exact: header1
45+
ignoreCase: true
46+
- exact: header2
47+
ignoreCase: true
48+
grpcService:
49+
envoyGrpc:
50+
authority: primary.foo.com
51+
clusterName: securitypolicy/default/policy-for-http-route-1/default/grpc-backend
52+
timeout: 10s
53+
transportApiVersion: V3
5454
- name: envoy.filters.http.router
5555
typedConfig:
5656
'@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

0 commit comments

Comments
 (0)