diff --git a/modules/sync/envoyproxy/envoy/cas/06777c0a6d9c75d1495b8fc59a5a4b0be7a8de43bcecde66c564eaf5f3746d866e4fe4f4ad9e3182ddea2ef478b2932723f7dde312dc0a6a634f655b87b3da09 b/modules/sync/envoyproxy/envoy/cas/06777c0a6d9c75d1495b8fc59a5a4b0be7a8de43bcecde66c564eaf5f3746d866e4fe4f4ad9e3182ddea2ef478b2932723f7dde312dc0a6a634f655b87b3da09 new file mode 100644 index 00000000..0084255e --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/06777c0a6d9c75d1495b8fc59a5a4b0be7a8de43bcecde66c564eaf5f3746d866e4fe4f4ad9e3182ddea2ef478b2932723f7dde312dc0a6a634f655b87b3da09 @@ -0,0 +1,89 @@ +syntax = "proto3"; + +package envoy.extensions.bootstrap.reverse_tunnel.downstream_socket_interface.v3; + +import "envoy/config/accesslog/v3/accesslog.proto"; +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/extension.proto"; + +import "google/protobuf/duration.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.bootstrap.reverse_tunnel.downstream_socket_interface.v3"; +option java_outer_classname = "DownstreamReverseConnectionSocketInterfaceProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/v3;downstream_socket_interfacev3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Bootstrap settings for downstream reverse connection socket interface] +// [#extension: envoy.bootstrap.reverse_tunnel.downstream_socket_interface] + +// Configuration for the downstream reverse connection socket interface. +// This interface initiates reverse connections to upstream Envoys and provides +// them as socket connections for downstream requests. +// [#next-free-field: 7] +message DownstreamReverseConnectionSocketInterface { + // HTTP handshake settings for initiator envoy initiated reverse tunnels. + // [#next-free-field: 6] + message HttpHandshakeConfig { + // Request path used when issuing the HTTP reverse-connection handshake. Defaults to + // "/reverse_connections/request". + string request_path = 1; + + // Additional headers to include in the HTTP handshake request. + repeated config.core.v3.HeaderValueOption additional_headers = 2; + + // Perform the handshake as an HTTP/1.1 ``Upgrade`` exchange (``Upgrade: reverse-tunnel``, + // success on ``101``) so HTTP proxies can route the handshake and splice the tunnel + // afterward. The responder must set this flag to the same value. + // Defaults to ``false``. + bool use_http_upgrade = 3; + + // Formatter extensions usable in ``additional_headers`` substitution. See the formatter + // extensions documentation for details. When set, ``additional_headers`` values are evaluated + // as substitution format strings; when empty, the values are sent literally. + // [#extension-category: envoy.formatter] + repeated config.core.v3.TypedExtensionConfig formatters = 4; + + // Maximum time to receive the handshake response after the connection opens. If not specified, + // defaults to ``15s``. On expiry the attempt is closed, recorded with failure reason + // ``timeout``, and normal backoff applies. + google.protobuf.Duration handshake_timeout = 5 [(validate.rules).duration = { + lte {seconds: 300} + gt {} + }]; + } + + // Stat prefix to be used for downstream reverse connection socket interface stats. + string stat_prefix = 1; + + // Enable detailed per-host and per-cluster statistics. + // When enabled, emits hidden statistics for individual hosts and clusters. + // Defaults to ``false``. + bool enable_detailed_stats = 2; + + // Optional HTTP handshake configuration. When unset, the initiator envoy uses the defaults + // provided by ``HttpHandshakeConfig``. + HttpHandshakeConfig http_handshake = 3; + + // Access log configuration for reverse tunnel initiator lifecycle events. + // Logs are emitted on handshake success, handshake failure, connection draining, and + // connection close. Reverse tunnel metadata (``node_id``, ``cluster_id``, ``tenant_id``, + // upstream cluster, ``connection_key``, ``connection_id``, etc.) is available via + // ``%DYNAMIC_METADATA(envoy.reverse_tunnel.initiator:*)%`` substitutions. + repeated config.accesslog.v3.AccessLog access_log = 4; + + // Upper bound on the per-host reconnect backoff. The initiator retries a failed handshake on a + // deterministic exponential schedule (1s, 2s, 4s, ...) with small upward jitter; this value caps + // that schedule. + google.protobuf.Duration max_reconnect_backoff = 5 + [(validate.rules).duration = {gte {seconds: 1}}]; + + // How often the initiator re-checks each host and dials any missing reverse tunnels. + // Defaults to 10s. The re-check is jittered upward so agents that start together do not + // redial in lockstep. The minimum value is 100ms. + google.protobuf.Duration maintain_interval = 6 + [(validate.rules).duration = {gte {nanos: 100000000}}]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/0714db48ed84ae812c9f70b086a460cbd06cc56e8a9aec3d6c10eaa7ee5c9f0e4bbf316e51070cff08aeed02624a34e96956ddee5ff25aec0613a0e3deff93cc b/modules/sync/envoyproxy/envoy/cas/0714db48ed84ae812c9f70b086a460cbd06cc56e8a9aec3d6c10eaa7ee5c9f0e4bbf316e51070cff08aeed02624a34e96956ddee5ff25aec0613a0e3deff93cc new file mode 100644 index 00000000..475f4580 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/0714db48ed84ae812c9f70b086a460cbd06cc56e8a9aec3d6c10eaa7ee5c9f0e4bbf316e51070cff08aeed02624a34e96956ddee5ff25aec0613a0e3deff93cc @@ -0,0 +1,235 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.mcp.v3; + +import "google/protobuf/wrappers.proto"; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.mcp.v3"; +option java_outer_classname = "McpProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/mcp/v3;mcpv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: MCP] +// MCP filter :ref:`configuration overview `. +// [#extension: envoy.filters.http.mcp] + +// This filter will inspect and get attributes from MCP traffic. +// [#next-free-field: 12] +message Mcp { + // Traffic handling mode for non-MCP traffic. + enum TrafficMode { + // Proxies the HTTP request and response without MCP spec check. + // This is the default mode. + PASS_THROUGH = 0; + + // Reject requests that are not following MCP spec. + // Valid MCP requests are: + // - POST requests with JSON-RPC 2.0 messages + // - GET requests for SSE streams (with Accept: text/event-stream) + // - DELETE requests for session termination (with MCP-Session-Id header) + REJECT_NO_MCP = 1; + + // Disables MCP processing entirely. The filter performs no inspection, + // attribute extraction, trace context propagation, or rejection; all + // traffic is proxied as-is. + NOOP = 2; + } + + // Where to store parsed MCP request attributes. + enum RequestStorageMode { + // Unspecified. Uses default behavior (same as DYNAMIC_METADATA). + MODE_UNSPECIFIED = 0; + + // Store request attributes in dynamic metadata only. + // This is the default behavior. + DYNAMIC_METADATA = 1; + + // Store request attributes in filter state only. + FILTER_STATE = 2; + + // Store request attributes in both dynamic metadata and filter state. + DYNAMIC_METADATA_AND_FILTER_STATE = 3; + } + + // Source used to obtain MCP request attributes. + enum AttributeSource { + // Parse attributes from the request body and ignore MCP attribute headers. + BODY = 0; + + // Use MCP attribute headers and verify that values parsed from the body agree. + VERIFY = 1; + + // Trust MCP attribute headers for ``method`` and the method-specific + // identifier carried by ``Mcp-Name`` (``params.name``, ``params.uri``, or + // ``params.taskId``), and avoid parsing the body when nothing else requires it. + HEADERS = 2; + } + + message TraceContextPropagationConfig { + option (xds.annotations.v3.message_status).work_in_progress = true; + } + + message BaggagePropagationConfig { + option (xds.annotations.v3.message_status).work_in_progress = true; + } + + // Configures how the filter handles non-MCP traffic. + TrafficMode traffic_mode = 1 [(validate.rules).enum = {defined_only: true}]; + + // When set to true, the filter will clear the route cache after setting dynamic metadata. + // This allows the route to be re-selected based on the MCP metadata (e.g., method, params). + // Defaults to false. + bool clear_route_cache = 2; + + // Maximum size of the request body to buffer for JSON-RPC parsing. + // Only the first ``max_request_body_size`` bytes are parsed for MCP attribute extraction. + // + // When the body exceeds this limit: + // - In ``PASS_THROUGH`` mode: the request is allowed through with an ``is_exceeding_limit`` marker in the dynamic metadata, indicating that the MCP payload was only partially parsed. + // - In ``REJECT_NO_MCP`` mode: the request is rejected with ``400 Bad Request`` because the complete root JSON object must fit within the size limit. + // + // It defaults to 8KB (8192 bytes) and the maximum allowed value is 10MB (10485760 bytes). + // + // Setting it to 0 would disable the limit. It is not recommended to do so in production. + google.protobuf.UInt32Value max_request_body_size = 3 [(validate.rules).uint32 = {lte: 10485760}]; + + // Parser configuration, this provide the attribute extraction override. + ParserConfig parser_config = 4; + + // Where to store parsed MCP request attributes. + // Controls whether attributes are written to dynamic metadata, filter state, or both. + // Default is DYNAMIC_METADATA when unspecified. + RequestStorageMode request_storage_mode = 5 [(validate.rules).enum = {defined_only: true}]; + + // If set, extract and validate W3C trace context from the MCP request body + // (params._meta.traceparent & params._meta.tracestate) and propagate it in HTTP headers + // ``traceparent`` and ``tracestate`` (respectively). + // + // The traceparent and tracestate fields are validated and propagated according to the spec at + // ``https://www.w3.org/TR/trace-context/``. + // + // If unset (default), do not extract or inject trace context. + TraceContextPropagationConfig propagate_trace_context = 6; + + // If set, extract and validate W3C baggage from the MCP request body (params._meta.baggage) and + // copy it to the HTTP header ``baggage``. + // + // The baggage field is validated according to the spec at ``https://www.w3.org/TR/baggage/``. + + // Note that this is independent of ``propagate_trace_context``. + // Also note that if this is set, the downstream request's baggage header will be overwritten if + // the MCP request body contains a valid baggage field. + // + // If unset (default), do not extract or inject baggage. + BaggagePropagationConfig propagate_baggage = 7; + + // When true, disallow requests that contain duplicate JSON keys at any + // nesting level. RFC 8259 Section 4 states that names within an object SHOULD + // be unique. Defaults to false (last-key-wins / last-win). If traffic mode is + // REJECT_NO_MCP, reject these requests; if PASS_THROUGH, log an error status + // but don't reject the request. + google.protobuf.BoolValue reject_duplicate_keys = 8; + + // Controls whether MCP request attributes are obtained from the request body + // or from MCP request headers. Header-based extraction is limited to ``method`` + // and the method-specific identifier carried by ``Mcp-Name``; other configured + // extraction rules still require body parsing. + AttributeSource attribute_source = 9 [(validate.rules).enum = {defined_only: true}]; + + // When true, stop parsing (and buffering) the request body as soon as all the + // required routing attributes for the request's method have been collected + // (for example ``method`` and ``params.name`` for ``tools/call``), even if + // optional attributes such as ``params._meta`` or the remainder of the body + // have not been parsed yet. This decouples routing from body size, so a large + // trailing payload (for example ``params.arguments``) does not need to be + // buffered at the proxy just to route the request. + // + // Early termination is intentionally skipped when it could change observable + // behavior, so it has no effect when any of the following holds: + // + // - ``reject_duplicate_keys`` is set (duplicate detection needs a full-body scan); + // - ``propagate_trace_context`` or ``propagate_baggage`` is set (both read + // ``params._meta``, which may appear after the routing attributes); + // - ``attribute_source`` is not ``BODY``. + // + // Requests whose body arrives complete in a single chunk are unaffected, since + // the whole root object is observed before iteration continues. + // + // Defaults to false. + bool early_terminate_when_routable = 10; + + // The latest MCP protocol revision supported by the filter. + // + // Requests using a known protocol revision newer than this value are rejected. + // When unset, no protocol-version restriction is applied. + google.protobuf.StringValue max_supported_protocol_version = 11; +} + +// Parser configuration with method-specific rules. +// This configuration allows overriding the default attribute extraction behavior for specific MCP methods. +message ParserConfig { + // A single attribute extraction rule. + message AttributeExtractionRule { + // JSON path to extract (e.g., "params.name", "params.uri"). + // The path is a dot-separated string representing the location of the field in the JSON payload. + // For example, "params.name" extracts the "name" field from the "params" object. + string path = 1 [(validate.rules).string = {min_len: 1}]; + } + + // Configuration for a specific MCP method. + message MethodConfig { + // Method name (e.g., "tools/call", "resources/read", "initialize"). + // This matches the "method" field in the JSON-RPC request. + string method = 1 [(validate.rules).string = {min_len: 1}]; + + // The group/category name to assign to this method (e.g., "tool", "lifecycle"). + // This will be emitted to dynamic metadata under the key specified by group_metadata_key. + // If empty, the built-in group classification is used. + string group = 2; + + // Attributes to extract for this method. + // If empty, only default attributes (jsonrpc, method) are extracted. + repeated AttributeExtractionRule extraction_rules = 3; + } + + // List of rules for classification and extraction. + // Rules are evaluated in order; the first match wins. + // If no rule matches, extraction defaults are used and group falls back to built-in classification. + // Built-in groups: lifecycle, tool, resource, prompt, notification, logging, sampling, completion, unknown. + repeated MethodConfig methods = 1; + + // The dynamic metadata key where the group name will be stored. + // If empty, group classification is disabled. + string group_metadata_key = 2; +} + +// Per-route override configuration for MCP filter +// [#next-free-field: 7] +message McpOverride { + // Overrides the global traffic mode for this route. + Mcp.TrafficMode traffic_mode = 1 [(validate.rules).enum = {defined_only: true}]; + + // Optional per-route max request body size override. + // When set, this overrides the global max_request_body_size for this route. + // It defaults to 8KB (8192 bytes) and the maximum allowed value is 10MB (10485760 bytes). + google.protobuf.UInt32Value max_request_body_size = 2 [(validate.rules).uint32 = {lte: 10485760}]; + + // Overrides the global clear_route_cache setting for this route. + bool clear_route_cache = 3; + + // Overrides the global parser config for this route. + ParserConfig parser_config = 4; + + // Overrides the global request storage mode for this route. + Mcp.RequestStorageMode request_storage_mode = 5 [(validate.rules).enum = {defined_only: true}]; + + // Overrides the global reject_duplicate_keys setting for this route. + bool reject_duplicate_keys = 6; +} diff --git a/modules/sync/envoyproxy/envoy/cas/08a48e484d19ccab2d4169ce5191e666f0eb3cf37656ea19c22e94a1c4764d7928df1ff4f530f2ef7aacfbe26d40234c1f4ba8ff38d9166f683a9af6c5656af1 b/modules/sync/envoyproxy/envoy/cas/08a48e484d19ccab2d4169ce5191e666f0eb3cf37656ea19c22e94a1c4764d7928df1ff4f530f2ef7aacfbe26d40234c1f4ba8ff38d9166f683a9af6c5656af1 new file mode 100644 index 00000000..6fc84d9f --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/08a48e484d19ccab2d4169ce5191e666f0eb3cf37656ea19c22e94a1c4764d7928df1ff4f530f2ef7aacfbe26d40234c1f4ba8ff38d9166f683a9af6c5656af1 @@ -0,0 +1,303 @@ +syntax = "proto3"; + +package envoy.config.core.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/extension.proto"; +import "envoy/config/core/v3/grpc_service.proto"; + +import "google/protobuf/any.proto"; +import "google/protobuf/duration.proto"; +import "google/protobuf/wrappers.proto"; + +import "xds/core/v3/authority.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.config.core.v3"; +option java_outer_classname = "ConfigSourceProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/config/core/v3;corev3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Configuration sources] + +// xDS API and non-xDS services version. This is used to describe both resource and transport +// protocol versions (in distinct configuration fields). +enum ApiVersion { + // When not specified, we assume v3; it is the only supported version. + AUTO = 0; + + // Use xDS v2 API. This is no longer supported. + V2 = 1 [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.0"]; + + // Use xDS v3 API. + V3 = 2; +} + +// API configuration source. This identifies the API type and cluster that Envoy +// will use to fetch an xDS API. +// [#next-free-field: 10] +message ApiConfigSource { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.ApiConfigSource"; + + // APIs may be fetched via either REST or gRPC. + enum ApiType { + // Ideally this would be 'reserved 0' but one can't reserve the default + // value. Instead we throw an exception if this is ever used. + DEPRECATED_AND_UNAVAILABLE_DO_NOT_USE = 0 + [deprecated = true, (envoy.annotations.disallowed_by_default_enum) = true]; + + // REST-JSON v2 API. The `canonical JSON encoding + // `_ for + // the v2 protos is used. + REST = 1; + + // SotW gRPC service. + GRPC = 2; + + // Using the delta xDS gRPC service, i.e. DeltaDiscovery{Request,Response} + // rather than Discovery{Request,Response}. Rather than sending Envoy the entire state + // with every update, the xDS server only sends what has changed since the last update. + DELTA_GRPC = 3; + + // SotW xDS gRPC with ADS. All resources which resolve to this configuration source will be + // multiplexed on a single connection to an ADS endpoint. + // [#not-implemented-hide:] + AGGREGATED_GRPC = 5; + + // Delta xDS gRPC with ADS. All resources which resolve to this configuration source will be + // multiplexed on a single connection to an ADS endpoint. + // [#not-implemented-hide:] + AGGREGATED_DELTA_GRPC = 6; + } + + // API type (gRPC, REST, delta gRPC) + ApiType api_type = 1 [(validate.rules).enum = {defined_only: true}]; + + // API version for xDS transport protocol. This describes the xDS gRPC/REST + // endpoint and version of [Delta]DiscoveryRequest/Response used on the wire. + ApiVersion transport_api_version = 8 [(validate.rules).enum = {defined_only: true}]; + + // Cluster names should be used only with REST. If > 1 + // cluster is defined, clusters will be cycled through if any kind of failure + // occurs. + // + // .. note:: + // + // The cluster with name ``cluster_name`` must be statically defined and its + // type must not be ``EDS``. + repeated string cluster_names = 2; + + // Multiple gRPC services be provided for GRPC. If > 1 cluster is defined, + // services will be cycled through if any kind of failure occurs. + repeated GrpcService grpc_services = 4; + + // For REST APIs, the delay between successive polls. + google.protobuf.Duration refresh_delay = 3; + + // For REST APIs, the request timeout. If not set, a default value of 1s will be used. + google.protobuf.Duration request_timeout = 5 [(validate.rules).duration = {gt {}}]; + + // For GRPC APIs, the rate limit settings. If present, discovery requests made by Envoy will be + // rate limited. + RateLimitSettings rate_limit_settings = 6; + + // Skip the node identifier in subsequent discovery requests for streaming gRPC config types. + bool set_node_on_first_message_only = 7; + + // A list of config validators that will be executed when a new update is + // received from the ApiConfigSource. Note that each validator handles a + // specific xDS service type, and only the validators corresponding to the + // type url (in ``:ref: DiscoveryResponse`` or ``:ref: DeltaDiscoveryResponse``) + // will be invoked. + // If the validator returns false or throws an exception, the config will be rejected by + // the client, and a NACK will be sent. + // [#extension-category: envoy.config.validators] + repeated TypedExtensionConfig config_validators = 9; +} + +// Aggregated Discovery Service (ADS) options. This is currently empty, but when +// set in :ref:`ConfigSource ` can be used to +// specify that ADS is to be used. +message AggregatedConfigSource { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.core.AggregatedConfigSource"; +} + +// [#not-implemented-hide:] +// Self-referencing config source options. This is currently empty, but when +// set in :ref:`ConfigSource ` can be used to +// specify that other data can be obtained from the same server. +message SelfConfigSource { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.SelfConfigSource"; + + // API version for xDS transport protocol. This describes the xDS gRPC/REST + // endpoint and version of [Delta]DiscoveryRequest/Response used on the wire. + ApiVersion transport_api_version = 1 [(validate.rules).enum = {defined_only: true}]; +} + +// Rate Limit settings to be applied for discovery requests made by Envoy. +message RateLimitSettings { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.core.RateLimitSettings"; + + // Maximum number of tokens to be used for rate limiting discovery request calls. If not set, a + // default value of 100 will be used. + google.protobuf.UInt32Value max_tokens = 1; + + // Rate at which tokens will be filled per second. If not set, a default fill rate of 10 tokens + // per second will be used. The minimal fill rate is once per year. Lower + // fill rates will be set to once per year. + google.protobuf.DoubleValue fill_rate = 2 [(validate.rules).double = {gt: 0.0}]; +} + +// Local filesystem path configuration source. +message PathConfigSource { + // Path on the filesystem from which to source configuration updates. + // When sourcing configuration for a + // :ref:`secret `, file-based secret + // data supported for SDS rotation is also monitored for updates. + // + // .. note:: + // + // The path to the source must exist at config load time. + // + // .. note:: + // + // If neither ``poll_interval`` nor ``watched_directory`` is configured, Envoy will watch the + // file path for *moves*. This is because in general only moves are atomic. The same method of + // swapping files as is demonstrated in the + // :ref:`runtime documentation ` can be used here also. + // One of ``poll_interval`` and ``watched_directory`` can also be configured; the configuration + // is rejected if both are set. With ``poll_interval``, the same path is reloaded periodically. + // With ``watched_directory``, no watch is placed directly on this path; events in the + // configured directory trigger this path to be reloaded. + string path = 1 [(validate.rules).string = {min_len: 1}]; + + // If configured, this directory will be watched for *moves*. When an entry in this directory is + // moved to, the ``path`` will be reloaded. This is required in certain deployment scenarios. + // + // Specifically, if trying to load an xDS resource using a + // `Kubernetes ConfigMap `_, the + // following configuration might be used: + // 1. Store xds.yaml inside a ConfigMap. + // 2. Mount the ConfigMap to ``/config_map/xds`` + // 3. Configure path ``/config_map/xds/xds.yaml`` + // 4. Configure watched directory ``/config_map/xds`` + // + // The above configuration will ensure that Envoy watches the owning directory for moves which is + // required due to how Kubernetes manages ConfigMap symbolic links during atomic updates. + // + // This field cannot be used together with ``poll_interval``. + WatchedDirectory watched_directory = 2; + + // If configured, the ``path`` will be polled at this interval instead of watched for filesystem + // events on either the file or ``watched_directory``. This is useful when the underlying + // filesystem does not reliably provide change notifications, or when a custom deployment model + // does not generate the move or modification events handled by watching the path or directory. + // The file is read on every poll, but an update is delivered only when its parsed contents + // change. + // + // When this configuration source provides a + // :ref:`Secret `, the same secret + // files that are watched in event-based mode are polled at this interval. The last successfully + // loaded configuration or secret remains active when a poll fails. + // + // This field cannot be used together with ``watched_directory`` and must be at least 1ms. + google.protobuf.Duration poll_interval = 3 [(validate.rules).duration = {gte {nanos: 1000000}}]; +} + +// Configuration for :ref:`listeners `, :ref:`clusters +// `, :ref:`routes +// `, :ref:`endpoints +// ` etc. may either be sourced from the +// filesystem or from an xDS API source. Filesystem configs are watched with +// inotify for updates. +// [#next-free-field: 9] +message ConfigSource { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.ConfigSource"; + + // Authorities that this config source may be used for. An authority specified in a xdstp:// URL + // is resolved to a ``ConfigSource`` prior to configuration fetch. This field provides the + // association between authority name and configuration source. + // [#not-implemented-hide:] + repeated xds.core.v3.Authority authorities = 7; + + oneof config_source_specifier { + option (validate.required) = true; + + // Deprecated in favor of ``path_config_source``. Use that field instead. + string path = 1 [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Local filesystem path configuration source. + PathConfigSource path_config_source = 8; + + // API configuration source. + ApiConfigSource api_config_source = 2; + + // When set, ADS will be used to fetch resources. The ADS API configuration + // source in the bootstrap configuration is used. + AggregatedConfigSource ads = 3; + + // [#not-implemented-hide:] + // When set, the client will access the resources from the same server it got the + // ConfigSource from, although not necessarily from the same stream. This is similar to the + // :ref:`ads` field, except that the client may use a + // different stream to the same server. As a result, this field can be used for things + // like LRS that cannot be sent on an ADS stream. It can also be used to link from (e.g.) + // LDS to RDS on the same server without requiring the management server to know its name + // or required credentials. + // [#next-major-version: In xDS v3, consider replacing the ads field with this one, since + // this field can implicitly mean to use the same stream in the case where the ConfigSource + // is provided via ADS and the specified data can also be obtained via ADS.] + SelfConfigSource self = 5; + } + + // When this timeout is specified, Envoy will wait no longer than the specified time for first + // config response on this xDS subscription during the :ref:`initialization process + // `. After reaching the timeout, Envoy will move to the next + // initialization phase, even if the first config is not delivered yet. The timer is activated + // when the xDS API subscription starts, and is disarmed on first config update or on error. 0 + // means no timeout - Envoy will wait indefinitely for the first xDS config (unless another + // timeout applies). The default is 15s. + google.protobuf.Duration initial_fetch_timeout = 4; + + // API version for xDS resources. This implies the type URLs that the client + // will request for resources and the resource type that the client will in + // turn expect to be delivered. + ApiVersion resource_api_version = 6 [(validate.rules).enum = {defined_only: true}]; +} + +// Configuration source specifier for a late-bound extension configuration. The +// parent resource is warmed until all the initial extension configurations are +// received, unless the flag to apply the default configuration is set. +// Subsequent extension updates are atomic on a per-worker basis. Once an +// extension configuration is applied to a request or a connection, it remains +// constant for the duration of processing. If the initial delivery of the +// extension configuration fails, due to a timeout for example, the optional +// default configuration is applied. Without a default configuration, the +// extension is disabled, until an extension configuration is received. The +// behavior of a disabled extension depends on the context. For example, a +// filter chain with a disabled extension filter rejects all incoming streams. +message ExtensionConfigSource { + ConfigSource config_source = 1 [(validate.rules).any = {required: true}]; + + // Optional default configuration to use as the initial configuration if + // there is a failure to receive the initial extension configuration or if + // ``apply_default_config_without_warming`` flag is set. + google.protobuf.Any default_config = 2; + + // Use the default config as the initial configuration without warming and + // waiting for the first discovery response. Requires the default configuration + // to be supplied. + bool apply_default_config_without_warming = 3; + + // A set of permitted extension type URLs for the type encoded inside of the + // :ref:`TypedExtensionConfig `. Extension + // configuration updates are rejected if they do not match any type URL in the set. + repeated string type_urls = 4 [(validate.rules).repeated = {min_items: 1}]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/0a7f86f42952f99273f528aed03accb6581d2034c07e9e6729bb66c4f493df1610e8ea25c8f2162cc9d9c765b8e2b0f6866a453c5b53ac0191f434acbc8b91ff b/modules/sync/envoyproxy/envoy/cas/0a7f86f42952f99273f528aed03accb6581d2034c07e9e6729bb66c4f493df1610e8ea25c8f2162cc9d9c765b8e2b0f6866a453c5b53ac0191f434acbc8b91ff new file mode 100644 index 00000000..fea7dcc1 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/0a7f86f42952f99273f528aed03accb6581d2034c07e9e6729bb66c4f493df1610e8ea25c8f2162cc9d9c765b8e2b0f6866a453c5b53ac0191f434acbc8b91ff @@ -0,0 +1,115 @@ +syntax = "proto3"; + +package envoy.config.core.v3; + +import "envoy/config/core/v3/substitution_format_string.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.config.core.v3"; +option java_outer_classname = "ProxyProtocolProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/config/core/v3;corev3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Proxy protocol] + +message ProxyProtocolPassThroughTLVs { + enum PassTLVsMatchType { + // Pass all TLVs. + INCLUDE_ALL = 0; + + // Pass specific TLVs defined in tlv_type. + INCLUDE = 1; + } + + // The strategy to pass through TLVs. Default is INCLUDE_ALL. + // If INCLUDE_ALL is set, all TLVs will be passed through no matter the tlv_type field. + PassTLVsMatchType match_type = 1; + + // The TLV types that are applied based on match_type. + // TLV type is defined as uint8_t in proxy protocol. See `the spec + // `_ for details. + repeated uint32 tlv_type = 2 [(validate.rules).repeated = {items {uint32 {lt: 256}}}]; +} + +// Represents a single Type-Length-Value (TLV) entry. +message TlvEntry { + // The type of the TLV. Must be a uint8 (0-255) as per the Proxy Protocol v2 specification. + uint32 type = 1 [(validate.rules).uint32 = {lt: 256}]; + + // The static value of the TLV. + // Only one of ``value`` or ``format_string`` may be set. + bytes value = 2; + + // Uses the :ref:`format string ` to dynamically + // populate the TLV value from stream information. This allows dynamic values + // such as metadata, filter state, or other stream properties to be included in + // the TLV. + // + // For example: + // + // .. code-block:: yaml + // + // type: 0xF0 + // format_string: + // text_format_source: + // inline_string: "%DYNAMIC_METADATA(envoy.filters.network:key)%" + // + // The formatted string will be used directly as the TLV value. + // Only one of ``value`` or ``format_string`` may be set. + SubstitutionFormatString format_string = 3; +} + +message ProxyProtocolConfig { + enum Version { + // PROXY protocol version 1. Human readable format. + V1 = 0; + + // PROXY protocol version 2. Binary format. + V2 = 1; + } + + // The PROXY protocol version to use. See https://www.haproxy.org/download/2.1/doc/proxy-protocol.txt for details + Version version = 1; + + // This config controls which TLVs can be passed to upstream if it is Proxy Protocol + // V2 header. If there is no setting for this field, no TLVs will be passed through. + ProxyProtocolPassThroughTLVs pass_through_tlvs = 2; + + // This config allows additional TLVs to be included in the upstream PROXY protocol + // V2 header. Unlike ``pass_through_tlvs``, which passes TLVs from the downstream request, + // ``added_tlvs`` provides an extension mechanism for defining new TLVs that are included + // with the upstream request. These TLVs may not be present in the downstream request and + // can be defined at either the transport socket level or the host level to provide more + // granular control over the TLVs that are included in the upstream request. + // + // Host-level TLVs are specified in the ``metadata.typed_filter_metadata`` field under the + // ``envoy.transport_sockets.proxy_protocol`` namespace. + // + // .. literalinclude:: /_configs/repo/proxy_protocol.yaml + // :language: yaml + // :lines: 49-57 + // :linenos: + // :lineno-start: 49 + // :caption: :download:`proxy_protocol.yaml ` + // + // **Precedence behavior**: + // + // - When a TLV is defined at both the host level and the transport socket level, the value + // from the host level configuration takes precedence. This allows users to define default TLVs + // at the transport socket level and override them at the host level. + // - Any TLV defined in the ``pass_through_tlvs`` field will be overridden by either the host-level + // or transport socket-level TLV. + // + // If there are multiple TLVs with the same type, only the TLVs from the highest precedence level + // will be used. + repeated TlvEntry added_tlvs = 3; +} + +message PerHostConfig { + // Enables per-host configuration for Proxy Protocol. Only the static ``value`` of each + // ``TlvEntry`` is applied to host-level TLVs. The ``format_string`` field is not evaluated here. + repeated TlvEntry added_tlvs = 1; +} diff --git a/modules/sync/envoyproxy/envoy/cas/0b4d2556efa7056770dbe60b694e853e411f160b2725e48cbe4c30b254185359096f0fb43375845c9bfa21c1db9f5234f20a0c1ec85deea8fcdbde493693942e b/modules/sync/envoyproxy/envoy/cas/0b4d2556efa7056770dbe60b694e853e411f160b2725e48cbe4c30b254185359096f0fb43375845c9bfa21c1db9f5234f20a0c1ec85deea8fcdbde493693942e new file mode 100644 index 00000000..38900bd1 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/0b4d2556efa7056770dbe60b694e853e411f160b2725e48cbe4c30b254185359096f0fb43375845c9bfa21c1db9f5234f20a0c1ec85deea8fcdbde493693942e @@ -0,0 +1,782 @@ +syntax = "proto3"; + +package envoy.service.ext_proc.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/extensions/filters/http/ext_proc/v3/processing_mode.proto"; +import "envoy/type/v3/http_status.proto"; + +import "google/protobuf/any.proto"; +import "google/protobuf/duration.proto"; +import "google/protobuf/struct.proto"; + +import "xds/annotations/v3/status.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.service.ext_proc.v3"; +option java_outer_classname = "ExternalProcessorProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/service/ext_proc/v3;ext_procv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: External processing service] + +// A service that can access and modify HTTP requests and responses as part of a filter chain. +// The overall external processing protocol works like this: +// +// 1. The data plane sends to the service information about the HTTP request. +// 2. The service sends back a ``ProcessingResponse`` message that directs the data plane to either +// stop processing, continue without it, or send it the next chunk of the message body. +// 3. If so requested, the data plane sends the server the message body in chunks, or the entire +// body at once. In either case, the server may send back a ``ProcessingResponse`` for each +// message it receives, or wait for a certain amount of body chunks to be received before +// streaming back the ``ProcessingResponse`` messages. +// 4. If so requested, the data plane sends the server the HTTP trailers, and the server sends back +// a ``ProcessingResponse``. +// 5. At this point, request processing is done, and we pick up again at step 1 when the data plane +// receives a response from the upstream server. +// 6. At any point above, if the server closes the gRPC stream cleanly, then the data plane +// proceeds without consulting the server. +// 7. At any point above, if the server closes the gRPC stream with an error, then the data plane +// returns a ``500`` error to the client, unless the filter was configured to ignore errors. +// +// In other words, the process is a request/response conversation, but using a gRPC stream to make +// it easier for the server to maintain state. +service ExternalProcessor { + // This begins the bidirectional stream that the data plane will use to + // give the server control over what the filter does. The actual + // protocol is described by the ``ProcessingRequest`` and ``ProcessingResponse`` + // messages below. + rpc Process(stream ProcessingRequest) returns (stream ProcessingResponse) { + } +} + +// This message specifies the filter protocol configurations which will be sent to the ext_proc +// server in a :ref:`ProcessingRequest `. +// If the server does not support these protocol configurations, it may choose to close the gRPC +// stream. If the server supports these protocol configurations, it should respond based on the +// API specifications. +message ProtocolConfiguration { + // Specifies the filter configuration + // :ref:`request_body_mode `. + envoy.extensions.filters.http.ext_proc.v3.ProcessingMode.BodySendMode request_body_mode = 1 + [(validate.rules).enum = {defined_only: true}]; + + // Specifies the filter configuration + // :ref:`response_body_mode `. + envoy.extensions.filters.http.ext_proc.v3.ProcessingMode.BodySendMode response_body_mode = 2 + [(validate.rules).enum = {defined_only: true}]; + + // Specifies the filter configuration + // :ref:`send_body_without_waiting_for_header_response `. + // If the client is waiting for a header response from the server, setting to ``true`` means the + // client will send the body to the server as it arrives. Setting to ``false`` means the client + // will buffer the arrived data and not send it to the server immediately. + bool send_body_without_waiting_for_header_response = 3; +} + +// This represents the different types of messages that the data plane can send +// to an external processing server. +// [#next-free-field: 14] +message ProcessingRequest { + // Initial flow control window sizes for ``FULL_DUPLEX_STREAMED`` and + // ``GRPC`` body send modes. + // + // A sender starts with this amount of flow control window. Whenever + // it sends body data, it must decrement its flow control window by + // the number of bytes that it has sent. When its flow control + // window is less than or equal to the amount of body data it wishes + // to send, it may not send until it receives a window update causing + // its flow control window to be large enough. + // + // However, note that in ``GRPC`` body send mode, whenever the flow + // control window is greater than zero, a sender may send a single + // message, even if the size of that message exceeds the available flow + // control window. At that point, the flow control window will be negative + // and the sender must not send the next message until it becomes positive. + // + // Note that the initial size for the to-sidestream windows are set by + // the sender, not the receiver. This is because each sidestream may be + // routed to a different ext_proc server instance, but there is no + // connection-level handshake to set a default for that server + // instance, so the only alternative here would be to have the + // ext_proc server instance set this on a per-stream basis, which + // would require an additional round-trip and therefore hurt latency. + // This unfortunately means that the ext_proc server instance has a + // bit less control: as soon as it receives these initial values, it can + // immediately send a window update that reduces the window, but it + // must be prepared to handle any data that the sender has already sent. + // The initial sizes for the to-sidestream windows are generally + // expected to be in the range of 32K to 64K. + // + // [#not-implemented-hide:] + message FlowControlInit { + // Downstream-to-sidestream initial window size. + int64 initial_window_downstream_to_sidestream = 1; + + // Sidestream-to-upstream initial window size. + int64 initial_window_sidestream_to_upstream = 2; + + // Upstream-to-sidestream initial window size. + int64 initial_window_upstream_to_sidestream = 3; + + // Sidestream-to-downstream initial window size. + int64 initial_window_sidestream_to_downstream = 4; + } + + // Flow control window update. Values may be positive or negative. The + // sender must immediately add these values to its flow control window, + // which governs how much data can be sent. + // + // [#not-implemented-hide:] + message ClientWindowUpdate { + // Window update for sidestream-to-upstream. + int64 window_increment_sidestream_to_upstream = 1; + + // Window update for sidestream-to-downstream. + int64 window_increment_sidestream_to_downstream = 2; + } + + reserved 1; + + reserved "async_mode"; + + // Each request message will include one of the following sub-messages. Which + // ones are set for a particular HTTP request/response depend on the + // processing mode. + oneof request { + // Information about the HTTP request headers, as well as peer info and additional + // properties. Unless ``observability_mode`` is ``true``, the server must send back a + // ``HeaderResponse`` message, an ``ImmediateResponse`` message, or close the stream. + HttpHeaders request_headers = 2; + + // Information about the HTTP response headers, as well as peer info and additional + // properties. Unless ``observability_mode`` is ``true``, the server must send back a + // ``HeaderResponse`` message or close the stream. + HttpHeaders response_headers = 3; + + // A chunk of the HTTP request body. Unless ``observability_mode`` is ``true``, the server must + // send back a ``BodyResponse`` message, an ``ImmediateResponse`` message, or close the stream. + HttpBody request_body = 4; + + // A chunk of the HTTP response body. Unless ``observability_mode`` is ``true``, the server must + // send back a ``BodyResponse`` message or close the stream. + HttpBody response_body = 5; + + // The HTTP trailers for the request path. Unless ``observability_mode`` is ``true``, the server + // must send back a ``TrailerResponse`` message or close the stream. + // + // This message is only sent if the trailers processing mode is set to ``SEND`` and + // the original downstream request has trailers. + HttpTrailers request_trailers = 6; + + // The HTTP trailers for the response path. Unless ``observability_mode`` is ``true``, the server + // must send back a ``TrailerResponse`` message or close the stream. + // + // This message is only sent if the trailers processing mode is set to ``SEND`` and + // the original upstream response has trailers. + HttpTrailers response_trailers = 7; + } + + // Dynamic metadata associated with the request. + config.core.v3.Metadata metadata_context = 8; + + // The values of properties selected by the ``request_attributes`` + // or ``response_attributes`` list in the configuration. Each entry + // in the list is populated from the standard + // :ref:`attributes ` supported in the data plane. + map attributes = 9; + + // Specifies whether the filter that sent this request is running in + // :ref:`observability_mode `. + // + // * A value of ``false`` indicates that the server must respond to this message by either + // sending back a matching ``ProcessingResponse`` message, or by closing the stream. + // * A value of ``true`` indicates that the server should not respond to this message, as any + // responses will be ignored. However, it may still close the stream to indicate that no more + // messages are needed. + // + // Defaults to ``false``. + bool observability_mode = 10; + + // Specify the filter protocol configurations to be sent to the server. + // ``protocol_config`` is only encoded in the first ``ProcessingRequest`` message from the client to the server. + ProtocolConfiguration protocol_config = 11; + + // Flow control initialization for ``FULL_DUPLEX_STREAMED`` and + // ``GRPC`` body send modes. + // + // Must be set in the initial message on the stream. Not used in + // subsequent messages. + // + // [#not-implemented-hide:] + FlowControlInit flow_control_init = 12; + + // Flow control updates for ``FULL_DUPLEX_STREAMED`` and ``GRPC`` body + // send modes. + // + // This message may be included in a request message that also + // populates one of the fields in the ``request`` oneof above, or it + // may be sent in a request message that does not set the + // ``request`` oneof. + // + // In ``FULL_DUPLEX_STREAMED`` body send mode, for backward + // compatibility with data planes that do not yet support flow control, + // the data plane must not send a message containing only this field + // (i.e., not setting the ``request`` oneof) unless the ext_proc server + // has sent a window update, thus indicating that it supports flow control. + // + // [#not-implemented-hide:] + ClientWindowUpdate client_window_update = 13; +} + +// This represents the different types of messages the server may send back to the data plane +// when the ``observability_mode`` field in the received ``ProcessingRequest`` is set to ``false``. +// +// * If the corresponding ``BodySendMode`` in the +// :ref:`processing_mode ` +// is not set to ``FULL_DUPLEX_STREAMED``, then for every received ``ProcessingRequest``, +// the server must send back exactly one ``ProcessingResponse`` message. +// * If it is set to ``FULL_DUPLEX_STREAMED``, the server must follow the API defined +// for this mode to send the ``ProcessingResponse`` messages. +// [#next-free-field: 17] +message ProcessingResponse { + // Flow control window update. Values may be positive or negative. The + // sender must immediately add these values to its flow control window, + // which governs how much data can be sent. + // + // [#not-implemented-hide:] + message ServerWindowUpdate { + // Window update for downstream-to-sidestream. + int64 window_increment_downstream_to_sidestream = 1; + + // Window update for upstream-to-sidestream. + int64 window_increment_upstream_to_sidestream = 2; + } + + // The response type that is sent by the server. + oneof response { + // The server must send back this message in response to a message with the + // ``request_headers`` field set. + HeadersResponse request_headers = 1; + + // The server must send back this message in response to a message with the + // ``response_headers`` field set. + HeadersResponse response_headers = 2; + + // The server must send back this message in response to a message with + // the ``request_body`` field set. + BodyResponse request_body = 3; + + // The server must send back this message in response to a message with + // the ``response_body`` field set. + BodyResponse response_body = 4; + + // The server must send back this message in response to a message with + // the ``request_trailers`` field set. + TrailersResponse request_trailers = 5; + + // The server must send back this message in response to a message with + // the ``response_trailers`` field set. + TrailersResponse response_trailers = 6; + + // If specified, attempt to create a locally generated response, send it + // downstream, and stop processing additional filters and ignore any + // additional messages received from the remote server for this request or + // response. If a response has already started -- for example, if this + // message is sent response to a ``response_body`` message -- then + // this will either ship the reply directly to the downstream codec, + // or reset the stream. + ImmediateResponse immediate_response = 7; + + // The server sends back this message to initiate or continue local response streaming. + // The server must initiate local response streaming with the ``headers_response`` in response + // to a ``ProcessingRequest`` with the ``request_headers`` only. + // The server may follow up with multiple messages containing ``body_response``. The server must + // indicate end of stream by setting ``end_of_stream`` to ``true`` in the ``headers_response`` + // or ``body_response`` message or by sending a ``trailers_response`` message. + // The client may send a ``request_body`` or ``request_trailers`` to the server depending on + // configuration. + // The streaming local response can only be sent when the ``request_header_mode`` in the filter + // :ref:`processing_mode ` + // is set to ``SEND``. The ext_proc server should not send ``StreamedImmediateResponse`` if it + // did not observe request headers, as it will result in a race with the upstream server + // response and reset of the client request. + // Presently only the ``FULL_DUPLEX_STREAMED`` or ``NONE`` body modes are supported. + StreamedImmediateResponse streamed_immediate_response = 11; + } + + // Optional metadata that will be emitted as dynamic metadata to be consumed by + // following filters. This metadata will be placed in the namespace(s) specified by the top-level + // field name(s) of the struct. + google.protobuf.Struct dynamic_metadata = 8; + + // Optional typed metadata that will be emitted as dynamic metadata to be consumed by + // following filters. This metadata will be placed in the namespace(s) specified by the + // keys of the map. + // + // Typed dynamic metadata should be preferred over untyped dynamic metadata (``dynamic_metadata``) + // because it is more efficient and more type-safe. + map typed_dynamic_metadata = 13; + + // Override how parts of the HTTP request and response are processed for the duration of this + // particular request/response only. Servers may use this to intelligently control how requests + // are processed based on the headers and other metadata that they see. + // + // If set in a response to body or trailer requests, it will be ignored by the data plane. + // It is also ignored by the data plane when the ext_proc filter config + // :ref:`allow_mode_override ` + // is set to ``false``, or + // :ref:`send_body_without_waiting_for_header_response ` + // is set to ``true``. + // + // ``mode_override`` can be sent in the following scenarios: + // + // 1. Included in a header response: + // The server can set this field when responding to request or response headers, i.e., + // alongside a ``request_headers`` or ``response_headers`` response. + // + // 2. Standalone ``mode_override`` response: + // After receiving a ``ProcessingRequest`` for request headers, the server can send a + // standalone ``mode_override`` response (i.e., a ``ProcessingResponse`` with only + // ``mode_override`` populated and no ``response`` case set) before sending the + // ``request_headers`` response. Subsequent messages will adhere to this new mode. + // + // .. note:: + // Processing mode changes in a standalone ``mode_override`` have the following constraints: + // + // * For request path: Only supports transitioning the request body processing mode from + // ``NONE`` or ``STREAMED`` to ``FULL_DUPLEX_STREAMED``. Additionally, the request + // trailer mode must be set to ``SEND``, which is required by ``FULL_DUPLEX_STREAMED`` + // mode. Responses that do not meet these constraints are treated as spurious and rejected. + // * For Response path: There are no restrictions on processing mode changes. + // + envoy.extensions.filters.http.ext_proc.v3.ProcessingMode mode_override = 9; + + // [#not-implemented-hide:] + // Deprecated and not implemented. This field has been replaced with + // the request_drain_requests and request_drain_responses fields. + bool request_drain = 12 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // [#not-implemented-hide:] + // Initiates a drain of request body data. Used only in + // ``FULL_DUPLEX_STREAMED`` and ``GRPC`` body send modes. + // + // The expected sequence for a drain is as follows: + // + // 1. The ext_proc server sends a message to the data plane with this + // field set to true. + // 2. The data plane pauses reading from the downstream client, applying + // any necessary flow control push-back. + // 3. The data plane sends a + // :ref:`request_body ` + // with the + // :ref:`drain_complete ` + // field set to true. + // 4. The ext_proc server continues processing all subsequent request body + // chunks until it sees the body chunk with the + // :ref:`drain_complete ` + // field set to true. When sending back its response to that last body + // chunk, the ext_proc server will set the + // :ref:`drain_complete ` + // field to true to let the data plane know that it has finished draining. + // 5. When the data plane sees the response with the + // :ref:`drain_complete ` + // field set to true, it will resume reading from the downstream + // client, passing all data directly to the upstream server, + // without going through the ext_proc sidestream. + // + // This procedure provides a safe way for the ext_proc server to indicate + // that it does not need to see the rest of the request body. + // + // Note that if the data plane is sending request body data and the + // ext_proc server wants to terminate the stream with an OK status, it + // must perform this drain before doing so. + // + // Note that the data plane may have either sent a body chunk with + // :ref:`end_of_stream ` + // set to true or may have sent trailers before it received the drain + // request from the ext_proc server. In these cases, the data plane will + // ignore the drain request, and the ext_proc will consider the drain + // complete when it sees the end-of-stream or trailers. + bool request_drain_requests = 15; + + // [#not-implemented-hide:] + // Initiates a drain of response body data. Used only in + // ``FULL_DUPLEX_STREAMED`` and ``GRPC`` body send modes. + // + // The expected sequence for a drain is as follows: + // + // 1. The ext_proc server sends a message to the data plane with this + // field set to true. + // 2. The data plane pauses reading from the upstream server, applying + // any necessary flow control push-back. + // 3. The data plane sends a + // :ref:`response_body ` + // with the + // :ref:`drain_complete ` + // field set to true. + // 4. The ext_proc server continues processing all subsequent response body + // chunks until it sees the body chunk with the + // :ref:`drain_complete ` + // field set to true. When sending back its response to that last body + // chunk, the ext_proc server will set the + // :ref:`drain_complete ` + // field to true to let the data plane know that it has finished draining. + // 5. When the data plane sees the response with the + // :ref:`drain_complete ` + // field set to true, it will resume reading from the upstream + // server, passing all data directly to the downstream client, + // without going through the ext_proc sidestream. + // + // This procedure provides a safe way for the ext_proc server to indicate + // that it does not need to see the rest of the response body. + // + // Note that if the data plane is sending response body data and the + // ext_proc server wants to terminate the stream with an OK status, it + // must perform this drain before doing so. + // + // Note that the data plane may have either sent a body chunk with + // :ref:`end_of_stream ` + // set to true or may have sent trailers before it received the drain + // request from the ext_proc server. In these cases, the data plane will + // ignore the drain request, and the ext_proc will consider the drain + // complete when it sees the end-of-stream or trailers. + bool request_drain_responses = 16; + + // When the ext_proc server receives a request message and needs more time to process it, it + // sends back a ``ProcessingResponse`` message with a new timeout value. When the data plane + // receives this response message, it ignores other fields in the response, stops the original + // timer (which has the timeout value specified in + // :ref:`message_timeout `), + // and starts a new timer with this ``override_message_timeout`` value while keeping the data + // plane ext_proc filter state machine intact. + // + // The value must be >= 1ms and <= + // :ref:`max_message_timeout `. + // Such a message can be sent at most once in a particular data plane ext_proc filter processing + // state. To enable this API, ``max_message_timeout`` must be set to a value >= 1ms. + google.protobuf.Duration override_message_timeout = 10; + + // Flow control updates for ``FULL_DUPLEX_STREAMED`` and ``GRPC`` body + // send modes. + // + // This message may be included in a response message that also + // populates one of the fields in the ``response`` oneof above, or it + // may be sent in a response message that does not set the + // ``response`` oneof. + // + // In ``FULL_DUPLEX_STREAMED`` body send mode, for backward + // compatibility with data planes that do not yet support flow control, + // the ext_proc server must not set this field unless the data plane + // sent initial window sizes in its initial message on the stream. + // Conversely, if the data plane did send initial window sizes in its + // initial message on the stream, the ext_proc server must send a + // window update immediately to let the data plane know that it also + // supports flow control. If the ext_proc server is sending a message + // immediately anyway (e.g., for a header or body chunk), it can include + // this field in that same message; otherwise, the ext_proc server must + // send a message containing only this field. + // + // [#not-implemented-hide:] + ServerWindowUpdate server_window_update = 14; +} + +// The following are messages that are sent to the server. + +// This message is sent to the external server when the HTTP request and response headers +// are first received. +message HttpHeaders { + // The HTTP request headers. All header keys will be lower-cased, because HTTP header keys are + // case-insensitive. The header value is encoded in the + // :ref:`raw_value ` field. + config.core.v3.HeaderMap headers = 1; + + // [#not-implemented-hide:] + // This field is deprecated and not implemented. Attributes will be sent in the top-level + // :ref:`attributes ` field. + map attributes = 2 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // If ``true``, then there is no message body associated with this request or response. + bool end_of_stream = 3; +} + +// This message is sent to the external server when the HTTP request and response bodies are +// received. +// [#next-free-field: 6] +message HttpBody { + // The contents of the body in the HTTP request/response. Note that in streaming mode multiple + // ``HttpBody`` messages may be sent. + // + // In ``GRPC`` body send mode, a separate ``HttpBody`` message will be sent for each message in + // the gRPC stream. + bytes body = 1; + + // If ``true``, this will be the last ``HttpBody`` message that will be sent and no trailers + // will be sent for the current request/response. + bool end_of_stream = 2; + + // This field is used only in ``GRPC`` body send mode. It is not used in any other body send + // mode. + // + // This field is used only when ``end_of_stream`` is true and ``body`` is empty. + // Normally, in ``GRPC`` body send mode, an empty ``body`` field indicates an empty message on + // the gRPC stream. However, it is possible that the gRPC client sends a half-close without + // actually sending a message on the stream, so we need a way to differentiate between + // an empty message being sent and no message being sent. If this field is true, then it + // indicates that no message has been sent; if it is false, then it indicates that an empty + // message has been sent. + // [#not-implemented-hide:] + bool end_of_stream_without_message = 3; + + // This field is used in ``GRPC`` body send mode to indicate whether the message is compressed. + // This will never be set to ``true`` by gRPC but may be set to ``true`` by a proxy like Envoy. + bool grpc_message_compressed = 4; + + // [#not-implemented-hide:] + // In ``FULL_DUPLEX_STREAMED`` or ``GRPC`` body send modes, if the + // data plane has seen the + // :ref:`request_drain_requests ` + // or :ref:`request_drain_responses ` + // field, it will populate this field to indicate that it has finished + // sending data to the ext_proc server. + bool drain_complete = 5; +} + +// This message is sent to the external server when the HTTP request and +// response trailers are received. +message HttpTrailers { + // The header value is encoded in the + // :ref:`raw_value ` field. + config.core.v3.HeaderMap trailers = 1; +} + +// The following are messages that may be sent back by the server. + +// This message is sent by the external server to the data plane after ``HttpHeaders`` was +// sent to it. +message HeadersResponse { + // Details the modifications (if any) to be made by the data plane to the current + // request/response. + CommonResponse response = 1; +} + +// This message is sent by the external server to the data plane after ``HttpBody`` was +// sent to it. +message BodyResponse { + // Details the modifications (if any) to be made by the data plane to the current + // request/response. + CommonResponse response = 1; +} + +// This message is sent by the external server to the data plane after ``HttpTrailers`` was +// sent to it. +message TrailersResponse { + // Details the modifications (if any) to be made by the data plane to the current + // request/response trailers. + HeaderMutation header_mutation = 1; +} + +// This message is sent by the external server to the data plane after ``HttpHeaders`` to initiate +// local response streaming. The server may follow up with multiple messages containing +// ``body_response``. The server must indicate end of stream by setting ``end_of_stream`` to +// ``true`` in the ``headers_response`` or ``body_response`` message or by sending a +// ``trailers_response`` message. +message StreamedImmediateResponse { + oneof response { + // Response headers to be sent downstream. The ``:status`` header must be set. + HttpHeaders headers_response = 1; + + // Response body to be sent downstream. + StreamedBodyResponse body_response = 2; + + // Response trailers to be sent downstream. + config.core.v3.HeaderMap trailers_response = 3; + } +} + +// This message contains common fields between header and body responses. +// [#next-free-field: 6] +message CommonResponse { + // The status of the response. + enum ResponseStatus { + // Apply the mutation instructions in this message to the + // request or response, and then continue processing the filter + // stream as normal. This is the default. + CONTINUE = 0; + + // Apply the specified header mutation, replace the body with the body + // specified in the body mutation (if present), and do not send any + // further messages for this request or response even if the processing + // mode is configured to do so. + // + // When used in response to a ``request_headers`` or ``response_headers`` message, + // this status makes it possible to either completely replace the body + // while discarding the original body, or to add a body to a message that + // formerly did not have one. + // + // In other words, this response makes it possible to turn an HTTP GET + // into a POST, PUT, or PATCH. + // + // Not supported if the body send mode is ``GRPC``. + CONTINUE_AND_REPLACE = 1; + } + + // If set, provide additional direction on how the data plane should + // handle the rest of the HTTP filter chain. + ResponseStatus status = 1 [(validate.rules).enum = {defined_only: true}]; + + // Instructions on how to manipulate the headers. When responding to an + // ``HttpBody`` request, header mutations will only take effect if the current processing mode + // for the body is ``BUFFERED``. + HeaderMutation header_mutation = 2; + + // Replace the body of the last message sent to the remote server on this stream. If responding + // to an ``HttpBody`` request, simply replace or clear the body chunk that was sent with that + // request. Body mutations may take effect in response either to ``header`` or ``body`` messages. + // When it is in response to ``header`` messages, it only takes effect if the + // :ref:`status ` + // is set to ``CONTINUE_AND_REPLACE``. + BodyMutation body_mutation = 3; + + // [#not-implemented-hide:] + // Add new trailers to the message. This may be used when responding to either an + // ``HttpHeaders`` or ``HttpBody`` message, but only if this message is returned + // along with the ``CONTINUE_AND_REPLACE`` status. + // The header value is encoded in the + // :ref:`raw_value ` field. + config.core.v3.HeaderMap trailers = 4; + + // Clear the route cache for the current client request. This is necessary + // if the remote server modified headers that are used to calculate the route. + // This field is ignored in the response direction. This field is also ignored + // if the data plane ext_proc filter is in the upstream filter chain. + bool clear_route_cache = 5; +} + +// This message causes the filter to attempt to create a locally generated response, send it +// downstream, stop processing additional filters, and ignore any additional messages received +// from the remote server for this request or response. If a response has already started, then +// this will either ship the reply directly to the downstream codec, or reset the stream. +// [#next-free-field: 6] +message ImmediateResponse { + // The response code to return. + type.v3.HttpStatus status = 1 [(validate.rules).message = {required: true}]; + + // Apply changes to the default headers, which will include ``content-type``. + HeaderMutation headers = 2; + + // The message body to return with the response which is sent using the + // ``text/plain`` content type, or encoded in the ``grpc-message`` header. + bytes body = 3; + + // If set, then include a gRPC status trailer. + GrpcStatus grpc_status = 4; + + // A string detailing why this local reply was sent, which may be included + // in log and debug output (e.g., this populates the ``%RESPONSE_CODE_DETAILS%`` + // command operator field for use in access logging). + string details = 5; +} + +// This message specifies a gRPC status for an ``ImmediateResponse`` message. +message GrpcStatus { + // The actual gRPC status. + uint32 status = 1; +} + +// Change HTTP headers or trailers by appending, replacing, or removing +// headers. +message HeaderMutation { + // Add or replace HTTP headers. Attempts to set the value of + // any ``x-envoy`` header, and attempts to set the ``:method``, + // ``:authority``, ``:scheme``, or ``host`` headers will be ignored. + // The header value is encoded in the + // :ref:`raw_value ` field. + // Note that the :ref:`append field in HeaderValueOption ` + // defaults to false when used in this message. + // The :ref:`keep_empty_value field in HeaderValueOption ` + // is not supported. + repeated config.core.v3.HeaderValueOption set_headers = 1; + + // Remove these HTTP headers. Attempts to remove system headers -- + // any header starting with ``:``, plus ``host`` -- will be ignored. + repeated string remove_headers = 2; +} + +// The body response message corresponding to ``FULL_DUPLEX_STREAMED`` or ``GRPC`` body modes. +// [#next-free-field: 6] +message StreamedBodyResponse { + // In ``FULL_DUPLEX_STREAMED`` body send mode, contains the body response chunk that will be + // passed to the upstream/downstream by the data plane. In ``GRPC`` body send mode, contains + // a serialized gRPC message to be passed to the upstream/downstream by the data plane. + bytes body = 1; + + // The server sets this flag to ``true`` if it has received a body request with + // :ref:`end_of_stream ` set to + // ``true``, and this is the last chunk of body responses. + // + // Note that in ``GRPC`` body send mode, this allows the ext_proc server to tell the data plane + // to send a half close after a client message, which will result in discarding any other + // messages sent by the client application. + bool end_of_stream = 2; + + // This field is used only in ``GRPC`` body send mode. It is not used in any other body send + // mode. + // + // This field is used only when ``end_of_stream`` is true and ``body`` is empty. + // Normally, in ``GRPC`` body send mode, an empty ``body`` field indicates an empty message on + // the gRPC stream. However, it is possible that the gRPC client sends a half-close without + // actually sending a message on the stream, so we need a way to differentiate between + // an empty message being sent and no message being sent. If this field is true, then it + // indicates that no message has been sent; if it is false, then it indicates that an empty + // message has been sent. + // [#not-implemented-hide:] + bool end_of_stream_without_message = 3; + + // This field is used in ``GRPC`` body send mode to indicate whether the message is compressed. + // This will never be set to ``true`` by gRPC but may be set to ``true`` by a proxy like Envoy. + bool grpc_message_compressed = 4; + + // [#not-implemented-hide:] + // In ``FULL_DUPLEX_STREAMED`` or ``GRPC`` body send modes, if the + // ext_proc server has seen the + // :ref:`drain_complete ` + // field, it will populate this field to indicate that it has finished + // sending data back to the data plane. + // + // If the data plane receives a message with this field set to true + // before it has sent a drain-complete message to the ext_proc server, + // the data plane will treat that as if the ext_proc stream has failed + // with a non-OK status. + bool drain_complete = 5; +} + +// This message specifies the body mutation the server sends to the data plane. +message BodyMutation { + // The type of mutation for the body. + oneof mutation { + // The entire body to replace. + // Should only be used when the corresponding ``BodySendMode`` in the + // :ref:`processing_mode ` + // is not set to ``FULL_DUPLEX_STREAMED`` or ``GRPC``. + bytes body = 1; + + // Clear the corresponding body chunk. Should only be used when the corresponding + // ``BodySendMode`` in the + // :ref:`processing_mode ` + // is not set to ``FULL_DUPLEX_STREAMED`` or ``GRPC``. + bool clear_body = 2; + + // Must be used when the corresponding ``BodySendMode`` in the + // :ref:`processing_mode ` + // is set to ``FULL_DUPLEX_STREAMED`` or ``GRPC``. + StreamedBodyResponse streamed_response = 3 + [(xds.annotations.v3.field_status).work_in_progress = true]; + } +} diff --git a/modules/sync/envoyproxy/envoy/cas/141946962e83db22b0607a516569e39151a7c8fcf202a0f5a535380b4bb16a4e6f8d4052c4fc81b98bb659b97a3ea188f5a8742d0489948e915b8cc8e6c643d6 b/modules/sync/envoyproxy/envoy/cas/141946962e83db22b0607a516569e39151a7c8fcf202a0f5a535380b4bb16a4e6f8d4052c4fc81b98bb659b97a3ea188f5a8742d0489948e915b8cc8e6c643d6 new file mode 100644 index 00000000..62cb2908 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/141946962e83db22b0607a516569e39151a7c8fcf202a0f5a535380b4bb16a4e6f8d4052c4fc81b98bb659b97a3ea188f5a8742d0489948e915b8cc8e6c643d6 @@ -0,0 +1,105 @@ +syntax = "proto3"; + +package envoy.config.listener.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/extension.proto"; +import "envoy/config/core/v3/protocol.proto"; +import "envoy/config/core/v3/socket_cmsg_headers.proto"; + +import "google/protobuf/duration.proto"; +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.config.listener.v3"; +option java_outer_classname = "QuicConfigProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3;listenerv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: QUIC listener config] + +// Configuration specific to the UDP QUIC listener. +// [#next-free-field: 15] +message QuicProtocolOptions { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.listener.QuicProtocolOptions"; + + core.v3.QuicProtocolOptions quic_protocol_options = 1; + + // Maximum number of milliseconds that connection will be alive when there is + // no network activity. + // + // If it is less than 1ms, Envoy will use 1ms. 300000ms if not specified. + google.protobuf.Duration idle_timeout = 2; + + // Connection timeout in milliseconds before the crypto handshake is finished. + // + // If it is less than 5000ms, Envoy will use 5000ms. 20000ms if not specified. + google.protobuf.Duration crypto_handshake_timeout = 3; + + // Runtime flag that controls whether the listener is enabled or not. If not specified, defaults + // to enabled. + core.v3.RuntimeFeatureFlag enabled = 4; + + // A multiplier to number of connections which is used to determine how many packets to read per + // event loop. A reasonable number should allow the listener to process enough payload but not + // starve TCP and other UDP sockets and also prevent long event loop duration. + // The default value is 32. This means if there are N QUIC connections, the total number of + // packets to read in each read event will be 32 * N. + // The actual number of packets to read in total by the UDP listener is also + // bound by 6000, regardless of this field or how many connections there are. + google.protobuf.UInt32Value packets_to_read_to_connection_count_ratio = 5 + [(validate.rules).uint32 = {gte: 1}]; + + // Configure which implementation of ``quic::QuicCryptoClientStreamBase`` to be used for this listener. + // If not specified the :ref:`QUICHE default one configured by ` will be used. + // [#extension-category: envoy.quic.server.crypto_stream] + core.v3.TypedExtensionConfig crypto_stream_config = 6; + + // Configure which implementation of ``quic::ProofSource`` to be used for this listener. + // If not specified the :ref:`default one configured by ` will be used. + // [#extension-category: envoy.quic.proof_source] + core.v3.TypedExtensionConfig proof_source_config = 7; + + // Config which implementation of ``quic::ConnectionIdGeneratorInterface`` to be used for this listener. + // If not specified the :ref:`default one configured by ` will be used. + // [#extension-category: envoy.quic.connection_id_generator] + core.v3.TypedExtensionConfig connection_id_generator_config = 8; + + // Configure the server's preferred address to advertise so that client can migrate to it. See :ref:`example ` which configures a pair of v4 and v6 preferred addresses. + // The current QUICHE implementation will advertise only one of the preferred IPv4 and IPv6 addresses based on the address family the client initially connects with. + // If not specified, Envoy will not advertise any server's preferred address. + // [#extension-category: envoy.quic.server_preferred_address] + core.v3.TypedExtensionConfig server_preferred_address_config = 9; + + // Configure the server to send transport parameter `disable_active_migration `_. + // Defaults to false (do not send this transport parameter). + google.protobuf.BoolValue send_disable_active_migration = 10; + + // Configure which implementation of ``quic::QuicConnectionDebugVisitor`` to be used for this listener. + // If not specified, no debug visitor will be attached to connections. + // [#extension-category: envoy.quic.connection_debug_visitor] + core.v3.TypedExtensionConfig connection_debug_visitor_config = 11; + + // Configure a type of UDP cmsg to pass to listener filters via QuicReceivedPacket. + // Both level and type must be specified for cmsg to be saved. + // Cmsg may be truncated or omitted if expected size is not set. + // If not specified, no cmsg will be saved to QuicReceivedPacket. + repeated core.v3.SocketCmsgHeaders save_cmsg_config = 12 + [(validate.rules).repeated = {max_items: 1}]; + + // If true, the listener will reject connection-establishing packets at the + // QUIC layer by replying with an empty version negotiation packet to the + // client. + bool reject_new_connections = 13; + + // Maximum number of QUIC sessions to create per event loop. + // If not specified, the default value is 16. + // This is an equivalent of the TCP listener option + // max_connections_to_accept_per_socket_event. + google.protobuf.UInt32Value max_sessions_per_event_loop = 14 [(validate.rules).uint32 = {gt: 0}]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/15603a2e7434422fedf63e85f2c2476e8990b38abaa85ca316216a0177dcaf3ab60481c0d312615bb7e24f0d333e508e42f2e387df060bc247aa0afc00f01857 b/modules/sync/envoyproxy/envoy/cas/15603a2e7434422fedf63e85f2c2476e8990b38abaa85ca316216a0177dcaf3ab60481c0d312615bb7e24f0d333e508e42f2e387df060bc247aa0afc00f01857 new file mode 100644 index 00000000..091eccce --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/15603a2e7434422fedf63e85f2c2476e8990b38abaa85ca316216a0177dcaf3ab60481c0d312615bb7e24f0d333e508e42f2e387df060bc247aa0afc00f01857 @@ -0,0 +1,77 @@ +syntax = "proto3"; + +package envoy.extensions.http.header_formatters.dynamic_modules.v3; + +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.http.header_formatters.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/http/header_formatters/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Dynamic Modules Header Formatter] +// [#extension: envoy.http.stateful_header_formatters.dynamic_modules] + +// Configuration for the Dynamic Modules HTTP/1 header formatter. This extension allows loading +// shared object files via ``dlopen`` to decide the casing of header keys written on the wire, +// which is what the :ref:`preserve case formatter +// ` +// does with a fixed policy. See the :ref:`header casing +// ` configuration guide for how to select a stateful +// formatter. +// +// This extension only affects HTTP/1 traffic: HTTP/2 and HTTP/3 require lower-cased header keys. +message DynamicModuleHeaderFormatter { + // Specifies the shared-object level configuration. This field is required. + // + // Only sources that are available synchronously are supported, i.e. ``name``, ``module.local``, + // and a ``module.remote`` that is already present in the on-disk cache. A remote source that + // would need to be fetched is rejected, since the codec must be able to format headers for the + // first message the connection serves. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1 + [(validate.rules).message = {required: true}]; + + // The name for this header formatter configuration. If not specified, defaults to an empty + // string. + // + // This can be used to distinguish between different header formatter implementations inside a + // dynamic module. When Envoy receives this configuration, it passes the + // ``header_formatter_name`` to the dynamic module's header formatter config init function + // together with the ``header_formatter_config``. That way a module can decide which in-module + // implementation to use based on the name at load time. + string header_formatter_name = 2; + + // The configuration for the header formatter chosen by ``header_formatter_name``. If not + // specified, an empty configuration is passed to the module. + // + // This is passed to the module's header formatter initialization function. Together with the + // ``header_formatter_name``, the module can decide which in-module implementation to use and + // fine-tune its behavior. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly + // without the wrapper. + // + // .. code-block:: yaml + // + // # Passing a JSON struct configuration + // header_formatter_config: + // "@type": "type.googleapis.com/google.protobuf.Struct" + // value: + // known_headers: + // - X-Request-ID + // + // # Passing a simple string configuration + // header_formatter_config: + // "@type": "type.googleapis.com/google.protobuf.StringValue" + // value: "proper_case" + // + google.protobuf.Any header_formatter_config = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/15c949253033d1f64fae17d8ffc0d53511fa6b0eabe3a45986b017594f32590c1c2b8945d0c74af543d3aec676a11ffd8788d469b18380c1d93e1d84c997f21f b/modules/sync/envoyproxy/envoy/cas/15c949253033d1f64fae17d8ffc0d53511fa6b0eabe3a45986b017594f32590c1c2b8945d0c74af543d3aec676a11ffd8788d469b18380c1d93e1d84c997f21f new file mode 100644 index 00000000..5b1ffdcb --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/15c949253033d1f64fae17d8ffc0d53511fa6b0eabe3a45986b017594f32590c1c2b8945d0c74af543d3aec676a11ffd8788d469b18380c1d93e1d84c997f21f @@ -0,0 +1,181 @@ +syntax = "proto3"; + +package envoy.extensions.load_balancing_policies.per_worker_subset.v3alpha; + +import "envoy/extensions/load_balancing_policies/common/v3/common.proto"; + +import "google/protobuf/wrappers.proto"; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.load_balancing_policies.per_worker_subset.v3alpha"; +option java_outer_classname = "PerWorkerSubsetProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/contrib/envoy/extensions/load_balancing_policies/per_worker_subset/v3alpha"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: Per-Worker Subset Load Balancing Policy] +// [#extension: envoy.load_balancing_policies.per_worker_subset] + +// Per-worker subset load balancer. +// +// Each Envoy worker thread maintains its own subset of upstream hosts and +// load-balances requests across only that subset. The motivating use case is +// upstream clusters with hundreds to thousands of hosts behind a short +// server-side HTTP keepalive timeout: stock per-cluster load balancers will +// eventually open a connection from every worker to every host, producing +// tens of thousands of mostly-idle keepalive connections that the upstream +// reaps. This policy caps per-worker fanout to K hosts so each connection +// stays in active use inside the upstream's keepalive window. +// +// Fleet-wide upstream coverage is preserved: across W workers per Envoy and +// E Envoys, each upstream host receives roughly ``(W*E)/N`` workers' worth +// of traffic. +// +// The policy is two-axis: +// +// 1. :ref:`partitioning_strategy +// ` +// selects how each worker's subset is derived from the cluster's host +// set. +// +// 2. :ref:`host_selection_strategy +// ` +// selects how an individual host is picked on each ``chooseHost`` call +// within the worker's subset. +// +// Both axes are independent and can be combined freely. +// +// [#next-free-field: 6] +message PerWorkerSubset { + option (xds.annotations.v3.message_status).work_in_progress = true; + + enum PartitioningStrategy { + // Deterministic, non-overlapping slice of ``ceil(N/W)`` hosts from a + // stable address-sorted ordering, where ``N`` is the cluster's host + // count and ``W`` is the worker count. A process-local random starting + // offset rotates the assignment so the partition is not byte-identical + // across the fleet. Stability across Envoy restarts is not required. + // The slices cover all hosts, with up to ``W*K - N`` wrap-around + // assignments when ``N`` is not divisible by ``W``. + // + // Health-only updates do not change slice boundaries: partitioning is + // performed over the all-hosts list, then each worker filters its fixed + // slice by health. A host becoming unhealthy therefore affects only + // workers whose slice contains that host. Membership updates may change + // ``N`` or ``K`` and can repartition workers. ``subset_size`` is treated + // as a subsetting-disable threshold (see ``subset_size`` below). This is + // the default. + EQUAL_PARTITIONS = 0; + + // Each worker independently samples ``subset_size`` hosts uniformly at + // random without replacement. The sampled membership is retained across + // health-only updates so a health transition does not rotate unrelated + // connections. Membership updates retain sampled hosts that still exist + // and fill only vacancies created by removed hosts. ``subset_size`` must + // be ``> 0`` in this mode. + RANDOM_PARTITIONS = 1; + } + + // Within-subset host selection. Applies on top of either partitioning + // strategy. + // + // This contributed implementation intentionally exposes a small set of + // validated strategies rather than accepting an arbitrary nested load + // balancing policy. The inner policy operates on a synthetic + // single-priority, single-locality ``PrioritySet``, and not every Envoy + // load balancer is compatible with that constrained model. + // ``SIMPLE_ROUND_ROBIN`` also provides a low-overhead option that avoids + // constructing an inner stock load balancer per worker. A nested policy + // can be reconsidered if this extension moves into the core + // load-balancer set. + enum HostSelectionStrategy { + // proto3-default sentinel. Rejected by the factory at config-load + // time; operators must pick an explicit strategy. Exists so callers + // can distinguish "explicitly chose ROUND_ROBIN" from "field not + // set" at the proto layer. + UNSPECIFIED = 0; + + // Minimal ``next_index_ % K`` round-robin over the worker's subset + // implemented inline. No weight handling, no slow-start, no locality. + // Pick this when the partition itself is the only thing required. + SIMPLE_ROUND_ROBIN = 1; + + // Envoy's stock RoundRobin load balancer constructed against the + // worker's subset via a synthetic PrioritySet. Honors per-host weights + // (EDF scheduling) and ``slow_start_config``. The synthetic PrioritySet + // presents the subset as one locality, so locality-weighted balancing is + // intentionally not supported within the worker subset. Recommended + // default for tiers opting in. + ENVOY_ROUND_ROBIN = 2; + + // Power-of-two-choices over active request counts (the algorithm + // implemented by Envoy's stock LeastRequest load balancer with + // ``choice_count=2``). Each ``chooseHost`` samples two random subset + // hosts and returns the one with fewer pending requests. Honors + // ``slow_start_config`` and weighted hosts. + ENVOY_P2C = 3; + } + + // Interpretation depends on + // :ref:`partitioning_strategy + // `: + // + // ``EQUAL_PARTITIONS``: subset_size is a subsetting kill-switch. The + // actual K (hosts per worker) is auto-computed as ``ceil(N/W)`` on every + // membership update, where W is the resolved total worker count and N + // is the cluster's host count. When ``subset_size >= N`` the policy + // disables subsetting and each worker takes the entire cluster (the + // within-subset selection runs over the full cluster). The default of + // 0 means "always subset". + // + // ``RANDOM_PARTITIONS``: subset_size is K, the number of hosts each worker + // samples. Must be ``> 0`` in this mode. Setting it ``>= N`` degenerates + // to within-subset selection over the full set. + uint32 subset_size = 1; + + // Partition strategy. Defaults to ``EQUAL_PARTITIONS``. + PartitioningStrategy partitioning_strategy = 2 [(validate.rules).enum = {defined_only: true}]; + + // Within-subset host selection. Required when the extension is + // instantiated; leaving this at the proto default (``UNSPECIFIED``) is + // rejected by the factory's ``loadConfig`` with ``InvalidArgumentError``. + HostSelectionStrategy host_selection_strategy = 3 [(validate.rules).enum = {defined_only: true}]; + + // Per-worker fallback threshold (percent points, ``[0, 100]``). + // When the healthy hosts in a worker's slice drop below this fraction of + // K, degraded hosts are added before considering unhealthy hosts. The + // worker uses the full slice (including unhealthy hosts) only when + // healthy plus degraded capacity still does not meet the threshold. + // Per-worker: workers fall back independently based on their own slice's + // health. + // + // * Unset: defaults to 50. + // * Set to 0: disables the percent check; healthy hosts are used when + // present, otherwise degraded hosts, then the full slice. + // * Set to 100: degraded hosts are added as soon as healthy hosts alone + // cannot fill the slice; the full slice is used if healthy plus degraded + // still cannot fill it. + // * Values ``> 100``: rejected by the factory. + // + // Independent of the cluster's + // :ref:`common_lb_config.healthy_panic_threshold + // ` + // -- this knob is scoped to the per-worker subset, not the whole + // cluster. It is evaluated by this policy before publishing the worker's + // synthetic host set; the inner stock load balancer does not apply a + // second panic threshold. + google.protobuf.UInt32Value fallback_threshold = 4 [(validate.rules).uint32 = {lte: 100}]; + + // Slow-start config forwarded to the inner stock LB when + // ``host_selection_strategy`` is ``ENVOY_ROUND_ROBIN`` or ``ENVOY_P2C``. + // ``SIMPLE_ROUND_ROBIN`` ignores it. Lives here, not at the cluster + // level, because Envoy ignores the legacy + // ``round_robin_lb_config.slow_start_config`` field when + // ``load_balancing_policy`` is set to a typed extension. + common.v3.SlowStartConfig slow_start_config = 5; +} diff --git a/modules/sync/envoyproxy/envoy/cas/16ea57deb3c9206e9f72502ffca313607e245493ab1ef2a6cfc6977b4177f3ba84d30185d1513f4b7c06601af58d411e889ed95daabb2e9ebde62d82491d1594 b/modules/sync/envoyproxy/envoy/cas/16ea57deb3c9206e9f72502ffca313607e245493ab1ef2a6cfc6977b4177f3ba84d30185d1513f4b7c06601af58d411e889ed95daabb2e9ebde62d82491d1594 new file mode 100644 index 00000000..2d15452b --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/16ea57deb3c9206e9f72502ffca313607e245493ab1ef2a6cfc6977b4177f3ba84d30185d1513f4b7c06601af58d411e889ed95daabb2e9ebde62d82491d1594 @@ -0,0 +1,171 @@ +syntax = "proto3"; + +package envoy.extensions.common.ratelimit.v3; + +import "envoy/type/v3/ratelimit_unit.proto"; +import "envoy/type/v3/token_bucket.proto"; + +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.common.ratelimit.v3"; +option java_outer_classname = "RatelimitProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/common/ratelimit/v3;ratelimitv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Common rate limit components] + +// Defines the version of the standard to use for X-RateLimit headers. +enum XRateLimitHeadersRFCVersion { + // X-RateLimit headers disabled. + OFF = 0; + + // Use `draft RFC Version 03 `_ where 3 headers will be added: + // + // * ``X-RateLimit-Limit`` - indicates the request-quota associated to the + // client in the current time-window followed by the description of the + // quota policy. The value is returned by the maximum tokens of the token bucket. + // * ``X-RateLimit-Remaining`` - indicates the remaining requests in the + // current time-window. The value is returned by the remaining tokens in the token bucket. + // * ``X-RateLimit-Reset`` - indicates the number of seconds until reset of + // the current time-window. The value is returned by the remaining fill interval of the token bucket. + DRAFT_VERSION_03 = 1; +} + +enum VhRateLimitsOptions { + // Use the virtual host rate limits unless the route has a rate limit policy. + OVERRIDE = 0; + + // Use the virtual host rate limits even if the route has a rate limit policy. + INCLUDE = 1; + + // Ignore the virtual host rate limits even if the route does not have a rate limit policy. + IGNORE = 2; +} + +// A RateLimitDescriptor is a list of hierarchical entries that are used by the service to +// determine the final rate limit key and overall allowed limit. Here are some examples of how +// they might be used for the domain "envoy". +// +// .. code-block:: cpp +// +// ["authenticated": "false"], ["remote_address": "10.0.0.1"] +// +// What it does: Limits all unauthenticated traffic for the IP address 10.0.0.1. The +// configuration supplies a default limit for the *remote_address* key. If there is a desire to +// raise the limit for 10.0.0.1 or block it entirely it can be specified directly in the +// configuration. +// +// .. code-block:: cpp +// +// ["authenticated": "false"], ["path": "/foo/bar"] +// +// What it does: Limits all unauthenticated traffic globally for a specific path (or prefix if +// configured that way in the service). +// +// .. code-block:: cpp +// +// ["authenticated": "false"], ["path": "/foo/bar"], ["remote_address": "10.0.0.1"] +// +// What it does: Limits unauthenticated traffic to a specific path for a specific IP address. +// Like (1) we can raise/block specific IP addresses if we want with an override configuration. +// +// .. code-block:: cpp +// +// ["authenticated": "true"], ["client_id": "foo"] +// +// What it does: Limits all traffic for an authenticated client "foo" +// +// .. code-block:: cpp +// +// ["authenticated": "true"], ["client_id": "foo"], ["path": "/foo/bar"] +// +// What it does: Limits traffic to a specific path for an authenticated client "foo" +// +// The idea behind the API is that (1)/(2)/(3) and (4)/(5) can be sent in 1 request if desired. +// This enables building complex application scenarios with a generic backend. +// +// Optionally the descriptor can contain a limit override under a "limit" key, that specifies +// the number of requests per unit to use instead of the number configured in the +// rate limiting service. +message RateLimitDescriptor { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.ratelimit.RateLimitDescriptor"; + + message Entry { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.ratelimit.RateLimitDescriptor.Entry"; + + // Descriptor key. + string key = 1 [(validate.rules).string = {min_len: 1}]; + + // Descriptor value. Blank value is treated as wildcard to create dynamic token buckets for each unique value. + // Blank Values as wild card is currently supported only with envoy server instance level HTTP local rate limiting + // and will not work if HTTP local rate limiting is enabled per connection level. + string value = 2 [(validate.rules).string = {min_len: 0}]; + } + + // Override rate limit to apply to this descriptor instead of the limit + // configured in the rate limit service. See :ref:`rate limit override + // ` for more information. + message RateLimitOverride { + // The number of requests per unit of time. + uint32 requests_per_unit = 1; + + // The unit of time. + type.v3.RateLimitUnit unit = 2 [(validate.rules).enum = {defined_only: true}]; + + // The number of units in the rate limit period. For example, a value of ``30`` with a unit + // of ``SECOND`` specifies a 30-second rate limit period. If not specified, defaults to ``1``. + google.protobuf.UInt32Value unit_multiplier = 3 [(validate.rules).uint32 = {gt: 0}]; + } + + // Descriptor entries. + repeated Entry entries = 1 [(validate.rules).repeated = {min_items: 1}]; + + // Optional rate limit override to supply to the ratelimit service. + RateLimitOverride limit = 2; + + // Optional hits_addend for the rate limit descriptor. If set the value will override the + // request level hits_addend. + google.protobuf.UInt64Value hits_addend = 3; + + // If true, the hits_addend value will be treated as negative, effectively adding to + // the rate limit budget instead of consuming from it. This can be used to refill previously consumed + // rate limit tokens. + bool is_negative_hits = 4; +} + +// Configuration used to enable local rate limiting. +// +// .. note:: +// The ``LocalRateLimitDescriptor`` is used to configure a local rate limit rule with a token +// bucket algorithm. The ``RateLimitDescriptor`` is used to represent a list of symbols that +// are used to match against the rate limit rule. +// +message LocalRateLimitDescriptor { + // Descriptor entries. + repeated v3.RateLimitDescriptor.Entry entries = 1 [(validate.rules).repeated = {min_items: 1}]; + + // Token Bucket algorithm for local ratelimiting. + type.v3.TokenBucket token_bucket = 2 [(validate.rules).message = {required: true}]; + + // Mark the descriptor as shadow. When the values is true, envoy allow requests to the backend. + bool shadow_mode = 3; +} + +// Configuration used to enable local cluster level rate limiting where the token buckets +// will be shared across all the Envoy instances in the local cluster. +// A share will be calculated based on the membership of the local cluster dynamically +// and the configuration. When the limiter refilling the token bucket, the share will be +// applied. By default, the token bucket will be shared evenly. +// +// See :ref:`local cluster name +// ` for more context +// about local cluster. +message LocalClusterRateLimit { +} diff --git a/modules/sync/envoyproxy/envoy/cas/1732513f22bc9d5956267a7d4a149f2c9b3471c8b8da67733e786b32684e80344e44bbbc1a9873bb5ee979cbbdaed2a8d2d4082c7161e552d710eed81e2e7b5b b/modules/sync/envoyproxy/envoy/cas/1732513f22bc9d5956267a7d4a149f2c9b3471c8b8da67733e786b32684e80344e44bbbc1a9873bb5ee979cbbdaed2a8d2d4082c7161e552d710eed81e2e7b5b new file mode 100644 index 00000000..a71b04d2 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/1732513f22bc9d5956267a7d4a149f2c9b3471c8b8da67733e786b32684e80344e44bbbc1a9873bb5ee979cbbdaed2a8d2d4082c7161e552d710eed81e2e7b5b @@ -0,0 +1,138 @@ +syntax = "proto3"; + +package envoy.data.core.v3; + +import "envoy/config/core/v3/address.proto"; +import "envoy/config/core/v3/base.proto"; + +import "google/protobuf/timestamp.proto"; + +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.data.core.v3"; +option java_outer_classname = "HealthCheckEventProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/data/core/v3;corev3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Health check logging events] +// :ref:`Health check logging `. + +enum HealthCheckFailureType { + ACTIVE = 0; + PASSIVE = 1; + NETWORK = 2; + NETWORK_TIMEOUT = 3; +} + +enum HealthCheckerType { + HTTP = 0; + TCP = 1; + GRPC = 2; + REDIS = 3; + THRIFT = 4; + DYNAMIC_MODULE = 5; + UDP = 6; +} + +// [#next-free-field: 13] +message HealthCheckEvent { + option (udpa.annotations.versioning).previous_message_type = + "envoy.data.core.v2alpha.HealthCheckEvent"; + + HealthCheckerType health_checker_type = 1 [(validate.rules).enum = {defined_only: true}]; + + config.core.v3.Address host = 2; + + string cluster_name = 3 [(validate.rules).string = {min_len: 1}]; + + oneof event { + option (validate.required) = true; + + // Host ejection. + HealthCheckEjectUnhealthy eject_unhealthy_event = 4; + + // Host addition. + HealthCheckAddHealthy add_healthy_event = 5; + + // A health check was successful. Note: a host will be considered healthy either if it is + // the first ever health check, or if the healthy threshold is reached. This kind of event + // indicate that a health check was successful, but does not indicates that the host is + // considered healthy. A host is considered healthy if HealthCheckAddHealthy kind of event is sent. + HealthCheckSuccessful successful_health_check_event = 12; + + // Host failure. + HealthCheckFailure health_check_failure_event = 7; + + // Healthy host became degraded. + DegradedHealthyHost degraded_healthy_host = 8; + + // A degraded host returned to being healthy. + NoLongerDegradedHost no_longer_degraded_host = 9; + } + + // Timestamp for event. + google.protobuf.Timestamp timestamp = 6; + + // Host metadata + config.core.v3.Metadata metadata = 10; + + // Host locality + config.core.v3.Locality locality = 11; +} + +message HealthCheckEjectUnhealthy { + option (udpa.annotations.versioning).previous_message_type = + "envoy.data.core.v2alpha.HealthCheckEjectUnhealthy"; + + // The type of failure that caused this ejection. + HealthCheckFailureType failure_type = 1 [(validate.rules).enum = {defined_only: true}]; + + // HTTP status code observed on the response associated with the failure. + // Only set when the health checker type is HTTP and the failure type is ``ACTIVE``. + // A value of ``0`` indicates that no HTTP status code was recorded (e.g., network-level failures + // or non-HTTP health checkers). + uint32 http_status_code = 2; +} + +message HealthCheckAddHealthy { + option (udpa.annotations.versioning).previous_message_type = + "envoy.data.core.v2alpha.HealthCheckAddHealthy"; + + // Whether this addition is the result of the first ever health check on a host, in which case + // the configured :ref:`healthy threshold ` + // is bypassed and the host is immediately added. + bool first_check = 1; +} + +message HealthCheckSuccessful { +} + +message HealthCheckFailure { + option (udpa.annotations.versioning).previous_message_type = + "envoy.data.core.v2alpha.HealthCheckFailure"; + + // The type of failure that caused this event. + HealthCheckFailureType failure_type = 1 [(validate.rules).enum = {defined_only: true}]; + + // Whether this event is the result of the first ever health check on a host. + bool first_check = 2; + + // HTTP status code observed on the response associated with the failure. + // Only set when the health checker type is HTTP and the failure type is ``ACTIVE``. + // A value of ``0`` indicates that no HTTP status code was recorded (e.g., network-level failures + // or non-HTTP health checkers). + uint32 http_status_code = 3; +} + +message DegradedHealthyHost { + option (udpa.annotations.versioning).previous_message_type = + "envoy.data.core.v2alpha.DegradedHealthyHost"; +} + +message NoLongerDegradedHost { + option (udpa.annotations.versioning).previous_message_type = + "envoy.data.core.v2alpha.NoLongerDegradedHost"; +} diff --git a/modules/sync/envoyproxy/envoy/cas/17cc86cb088fc468511d70720b7210abb576ff0ffbe5a4ac3cd60c8cd27344464cc70c7ab2d1c95035a5c13dc56391bb802407f9605387fc04e7d808d6423c22 b/modules/sync/envoyproxy/envoy/cas/17cc86cb088fc468511d70720b7210abb576ff0ffbe5a4ac3cd60c8cd27344464cc70c7ab2d1c95035a5c13dc56391bb802407f9605387fc04e7d808d6423c22 new file mode 100644 index 00000000..9bc3549c --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/17cc86cb088fc468511d70720b7210abb576ff0ffbe5a4ac3cd60c8cd27344464cc70c7ab2d1c95035a5c13dc56391bb802407f9605387fc04e7d808d6423c22 @@ -0,0 +1,91 @@ +syntax = "proto3"; + +package envoy.config.trace.v3; + +import "envoy/config/core/v3/extension.proto"; +import "envoy/config/core/v3/grpc_service.proto"; +import "envoy/config/core/v3/http_service.proto"; + +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/migrate.proto"; +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.config.trace.v3"; +option java_outer_classname = "OpentelemetryProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/config/trace/v3;tracev3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: OpenTelemetry tracer] + +// Configuration for the OpenTelemetry tracer. +// [#extension: envoy.tracers.opentelemetry] +// [#next-free-field: 11] +message OpenTelemetryConfig { + // The upstream gRPC cluster that will receive OTLP traces. + // Note that the tracer drops traces if the server does not read data fast enough. + // This field can be left empty to disable reporting traces to the gRPC service. + // Only one of ``grpc_service``, ``http_service``, ``exporter`` may be used. + core.v3.GrpcService grpc_service = 1 + [(udpa.annotations.field_migrate).oneof_promotion = "otlp_exporter"]; + + // The upstream HTTP cluster that will receive OTLP traces. + // This field can be left empty to disable reporting traces to the HTTP service. + // Only one of ``grpc_service``, ``http_service``, ``exporter`` may be used. + // + // .. note:: + // + // The ``request_headers_to_add`` property in the OTLP HTTP exporter service supports + // substitution formatters. The formatters cannot access any HTTP or connection properties, but + // can load content such as environment variables or files or secrets. + core.v3.HttpService http_service = 3 + [(udpa.annotations.field_migrate).oneof_promotion = "otlp_exporter"]; + + // Specifies the custom exporter to be used by the OpenTelemetry tracer. + // Only one of ``grpc_service``, ``http_service``, ``exporter`` may be used. + // + // [#extension-category: envoy.tracers.opentelemetry.exporters] + // [#not-implemented-hide:] + core.v3.TypedExtensionConfig exporter = 10 + [(udpa.annotations.field_migrate).oneof_promotion = "otlp_exporter"]; + + // The name for the service. This will be populated in the ResourceSpan Resource attributes. + // If it is not provided, it will default to "unknown_service:envoy". + string service_name = 2; + + // An ordered list of resource detectors + // [#extension-category: envoy.tracers.opentelemetry.resource_detectors] + repeated core.v3.TypedExtensionConfig resource_detectors = 4; + + // Specifies the sampler to be used by the OpenTelemetry tracer. + // The configured sampler implements the Sampler interface defined by the OpenTelemetry specification. + // This field can be left empty. In this case, the default Envoy sampling decision is used. + // + // See: `OpenTelemetry sampler specification `_ + // [#extension-category: envoy.tracers.opentelemetry.samplers] + core.v3.TypedExtensionConfig sampler = 5; + + // Envoy caches the span in memory when the OpenTelemetry backend service is temporarily unavailable. + // This field specifies the maximum number of spans that can be cached. If not specified, the + // default is 1024. + google.protobuf.UInt32Value max_cache_size = 6; + + // Specifies whether to set the telemetry SDK resource attributes. + // The following attributes will be set: + // + // - telemetry.sdk.language + // - telemetry.sdk.name + // - telemetry.sdk.version + // + // If not specified, the default is to set these attributes. + google.protobuf.BoolValue set_telemetry_sdk_resource_attributes = 7; + + // Specifies whether to set the ``service.name`` resource attribute. + // If not specified, the default is to set this attribute. + google.protobuf.BoolValue set_service_name_resource_attribute = 8; + + // Specifies whether to set the instrumentation scope name ("envoy") and version on emitted traces. + // If not specified, the default is to set the instrumentation scope name and version. + google.protobuf.BoolValue set_instrumentation_scope = 9; +} diff --git a/modules/sync/envoyproxy/envoy/cas/1cb3ae86b15ae10d4d2c3c77435928b9045e591d89911b9e9ba6036a0d4168903ceff104d31f4227306495990f38fbb599b8eab0fcd14ac9f9ddbca40e4cb452 b/modules/sync/envoyproxy/envoy/cas/1cb3ae86b15ae10d4d2c3c77435928b9045e591d89911b9e9ba6036a0d4168903ceff104d31f4227306495990f38fbb599b8eab0fcd14ac9f9ddbca40e4cb452 new file mode 100644 index 00000000..752f9175 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/1cb3ae86b15ae10d4d2c3c77435928b9045e591d89911b9e9ba6036a0d4168903ceff104d31f4227306495990f38fbb599b8eab0fcd14ac9f9ddbca40e4cb452 @@ -0,0 +1,40 @@ +syntax = "proto3"; + +package envoy.extensions.http.ai_filters.request_info.v3; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.http.ai_filters.request_info.v3"; +option java_outer_classname = "RequestInfoProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/http/ai_filters/request_info/v3;request_infov3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: Request info AI filter] +// Request info AI filter :ref:`configuration overview +// `. +// [#extension: envoy.http.ai_filters.request_info] + +// Publishes :ref:`RequestInfo ` as typed +// dynamic metadata. On a declared endpoint with a body, it is written before the +// request headers continue, so later HTTP filters see it from their first callback. +message RequestInfo { + // Estimates the input tokens from the size of the request payload, for consumers that must + // budget before the provider reports what it actually charged. + message TokenEstimation { + // Estimated input tokens, as ``ceil(tokens_per_byte * request payload bytes)``. No token + // spans fewer than one byte, so the ratio cannot exceed 1.0; ``0.5`` is a rough fit for + // JSON chat payloads. + double tokens_per_byte = 1 [(validate.rules).double = {lte: 1.0 gt: 0.0}]; + } + + // Metadata namespace. Defaults to ``envoy.ai.request_info``. + string metadata_namespace = 1; + + // When unset, no estimate is published. + TokenEstimation token_estimation = 2; +} diff --git a/modules/sync/envoyproxy/envoy/cas/215924db62d3fceb150319e0f9426b9ccf5056399ed051eae3252cde40bfc9476a15ce3c50047e6132875e8ab586c86bdb31e03297186593e6da09ece69f47c8 b/modules/sync/envoyproxy/envoy/cas/215924db62d3fceb150319e0f9426b9ccf5056399ed051eae3252cde40bfc9476a15ce3c50047e6132875e8ab586c86bdb31e03297186593e6da09ece69f47c8 new file mode 100644 index 00000000..a3d9abc6 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/215924db62d3fceb150319e0f9426b9ccf5056399ed051eae3252cde40bfc9476a15ce3c50047e6132875e8ab586c86bdb31e03297186593e6da09ece69f47c8 @@ -0,0 +1,179 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.mcp_router.v3; + +import "envoy/type/matcher/v3/string.proto"; +import "envoy/type/metadata/v3/metadata.proto"; + +import "google/protobuf/duration.proto"; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.mcp_router.v3"; +option java_outer_classname = "McpRouterProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/mcp_router/v3;mcp_routerv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: MCP Multiplexer/Demultiplexer] +// [#extension: envoy.filters.http.mcp_router] + +// Configuration for the MCP Multiplexer/Demultiplexer. +// +// This extension aggregates capabilities, tools and resources of remote MCP servers and presents Envoy +// as a singe MCP server to the client. This allows a unified policy to be applied to multiple remote +// servers and abstracts multiple MCP servers as a single one. +// +// This filter must be a terminal filter in the filter chain and replaces the HTTP router filter. +// +// Not all route level policies are applicable to this filter. +// Specifically the following policies are ignored: +// * :ref:`route ` +// * :ref:`redirect ` +// * :ref:`direct_response ` +// + +// Extract identity from a request header. +message HeaderSource { + // Header name to extract (e.g., "x-user-identity"). + string name = 1 [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME}]; +} + +// Extract identity from dynamic metadata (e.g., populated by JWT or ext_authz filter). +message DynamicMetadataSource { + // The metadata key to retrieve the value from. + type.metadata.v3.MetadataKey key = 1 [(validate.rules).message = {required: true}]; +} + +// Defines how the identity (user/principal) is extracted from the request. +// Exactly one of ``header`` or ``dynamic_metadata`` must be set. +message IdentityExtractor { + // Extract identity from a request header. + HeaderSource header = 1; + + // Extract identity from dynamic metadata. + DynamicMetadataSource dynamic_metadata = 2; +} + +// Specifies how to handle requests where the identity is missing or mismatched. +message ValidationPolicy { + enum Mode { + // Not specified. Defaults to DISABLED behavior. + MODE_UNSPECIFIED = 0; + + // Bind identity on Initialize if present, but do not validate subsequent requests. + // If extraction fails, the session proceeds anonymously. + DISABLED = 1; + + // Reject the request (403) if the identity cannot be extracted + // or if the session identity does not match the request identity. + ENFORCE = 2; + } + + Mode mode = 1 [(validate.rules).enum = {defined_only: true}]; +} + +// Session identity configuration. +message SessionIdentity { + // Defines how the identity (user/principal) is extracted from the request. + IdentityExtractor identity = 1 [(validate.rules).message = {required: true}]; + + // Specifies how to handle requests where the subject is missing or invalid. + // Defaults to DISABLED. + ValidationPolicy validation = 2; +} + +message McpRouter { + // Specification of the MCP server. + message McpBackend { + // Unique name for this backend. Used for: + // - Tool name prefixing (e.g., "time__get_current_time") + // - Session ID composition + // - Logging and error messages. + // Default will be the cluster name if not specified. + string name = 1; + + // Backend target specification. + McpCluster mcp_cluster = 2; + + // Controls which downstream request headers are forwarded to this backend. + // If not set, no downstream-controlled headers are forwarded beyond those the + // router itself must synthesize (e.g. ``content-type``, ``accept``, the session + // header) — in particular, a client's ``authorization`` header is NOT forwarded + // by default. Router-owned, framing, session, and hop-by-hop headers are never + // affected by this policy; they are handled separately and can never be forwarded + // via this mechanism. + HeaderForwarding header_forwarding = 3; + } + + // Cluster-based backend configuration. + message McpCluster { + // Cluster name to route requests to. + string cluster = 1 [(validate.rules).string = {min_len: 1}]; + + // Path to use for MCP requests. Defaults to "/mcp". + string path = 2; + + // Request timeout. + // If not set, uses cluster's timeout configuration. + google.protobuf.Duration timeout = 3; + + // Indicates that during forwarding, the host header will be swapped with + // this value. + string host_rewrite_literal = 4; + } + + // Specifies which downstream request headers are allowed to be forwarded to an MCP + // backend. Modeled after + // :ref:`ext_proc's HeaderForwardingRules `, + // but MCP-local and secure-by-default: unlike ext_proc, an unset/empty policy + // forwards nothing rather than everything, because MCP requires audience-bound + // tokens and prohibits implicit token passthrough between a client and a backend it + // did not authenticate to. + // + // Evaluation order per header: + // + // 1. If the header matches ``disallowed_headers``, it is never forwarded — this + // takes precedence over everything below, including ``forward_all``. + // 2. Otherwise, if ``forward_all`` is true, the header is forwarded. + // 3. Otherwise, if the header matches ``allowed_headers``, it is forwarded. + // 4. Otherwise, the header is not forwarded. + // + // This does not cover header *mutation* or credential injection, which remain a + // separate concern from this filter's forwarding policy. + message HeaderForwarding { + // If true, forward all downstream request headers to this backend (subject to + // ``disallowed_headers`` above), matching the legacy forward-everything behavior. + // Defaults to false. Users relying on the legacy behavior must set this explicitly. + bool forward_all = 1; + + // If set, specifically allow any header in this list to be forwarded. Ignored for a + // header that also matches ``disallowed_headers``, and redundant (but harmless) for + // any header covered by ``forward_all``. + type.matcher.v3.ListStringMatcher allowed_headers = 2; + + // If set, specifically disallow any header in this list from being forwarded. This + // takes precedence over both ``forward_all`` and ``allowed_headers``. + type.matcher.v3.ListStringMatcher disallowed_headers = 3; + } + + // A list of remote MCP servers. MCP router aggregates capabilities, tools and resources from remote MCP servers + // and presents itself as single MCP server to the client. All remote MCP servers are sent the same capabilities + // that the client presented to Envoy. + repeated McpBackend servers = 1; + + // If set, extracts a request "subject" and binds it into the MCP session. + // If not set, sessions are created without identity binding. + SessionIdentity session_identity = 2; + + // If true, backend initialization is deferred until the first request that targets each backend. + // The ``initialize`` response is returned immediately with gateway capabilities and an empty + // backend session map. Each backend is initialized on-demand when a request first routes to it. + // This avoids blocking the client ``initialize`` on slow or misbehaving backends. + // Default is false (eager initialization of all backends during ``initialize``). + bool lazy_initialization = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/24dc50c4d6a191e16a5900c34cddb4d7d0409709c5b8a717da9b9eff7451365435e0b56da197dd084f4411d0460f7365bc255d0e622da1c6274e80a7e1de8126 b/modules/sync/envoyproxy/envoy/cas/24dc50c4d6a191e16a5900c34cddb4d7d0409709c5b8a717da9b9eff7451365435e0b56da197dd084f4411d0460f7365bc255d0e622da1c6274e80a7e1de8126 new file mode 100644 index 00000000..6e705cd6 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/24dc50c4d6a191e16a5900c34cddb4d7d0409709c5b8a717da9b9eff7451365435e0b56da197dd084f4411d0460f7365bc255d0e622da1c6274e80a7e1de8126 @@ -0,0 +1,856 @@ +syntax = "proto3"; + +package envoy.config.bootstrap.v3; + +import "envoy/config/accesslog/v3/accesslog.proto"; +import "envoy/config/cluster/v3/cluster.proto"; +import "envoy/config/core/v3/address.proto"; +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/config_source.proto"; +import "envoy/config/core/v3/event_service_config.proto"; +import "envoy/config/core/v3/extension.proto"; +import "envoy/config/core/v3/resolver.proto"; +import "envoy/config/core/v3/socket_option.proto"; +import "envoy/config/listener/v3/listener.proto"; +import "envoy/config/metrics/v3/stats.proto"; +import "envoy/config/overload/v3/overload.proto"; +import "envoy/config/trace/v3/http_tracer.proto"; +import "envoy/extensions/transport_sockets/tls/v3/secret.proto"; +import "envoy/type/matcher/v3/string.proto"; +import "envoy/type/v3/percent.proto"; + +import "google/protobuf/duration.proto"; +import "google/protobuf/struct.proto"; +import "google/protobuf/wrappers.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/migrate.proto"; +import "udpa/annotations/security.proto"; +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.config.bootstrap.v3"; +option java_outer_classname = "BootstrapProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/config/bootstrap/v3;bootstrapv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Bootstrap] +// This proto is supplied via the :option:`-c` CLI flag and acts as the root +// of the Envoy v3 configuration. See the :ref:`v3 configuration overview +// ` for more detail. + +// Bootstrap :ref:`configuration overview `. +// [#next-free-field: 44] +message Bootstrap { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.bootstrap.v2.Bootstrap"; + + message StaticResources { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.bootstrap.v2.Bootstrap.StaticResources"; + + // Static :ref:`Listeners `. These listeners are + // available regardless of LDS configuration. + repeated listener.v3.Listener listeners = 1; + + // If a network based configuration source is specified for :ref:`cds_config + // `, it's necessary + // to have some initial cluster definitions available to allow Envoy to know + // how to speak to the management server. + repeated cluster.v3.Cluster clusters = 2; + + // These static secrets can be used by :ref:`SdsSecretConfig + // ` + repeated envoy.extensions.transport_sockets.tls.v3.Secret secrets = 3; + } + + // [#next-free-field: 7] + message DynamicResources { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.bootstrap.v2.Bootstrap.DynamicResources"; + + reserved 4; + + // All :ref:`Listeners ` are provided by a single + // :ref:`LDS ` configuration source. + core.v3.ConfigSource lds_config = 1; + + // ``xdstp://`` resource locator for listener collection. + // [#not-implemented-hide:] + string lds_resources_locator = 5; + + // All post-bootstrap :ref:`Cluster ` definitions are + // provided by a single :ref:`CDS ` + // configuration source. + core.v3.ConfigSource cds_config = 2; + + // ``xdstp://`` resource locator for cluster collection. + // [#not-implemented-hide:] + string cds_resources_locator = 6; + + // A single :ref:`ADS ` source may be optionally + // specified. This must have :ref:`api_type + // ` :ref:`GRPC + // `. Only + // :ref:`ConfigSources ` that have + // the :ref:`ads ` field set will be + // streamed on the ADS channel. + core.v3.ApiConfigSource ads_config = 3; + } + + message ApplicationLogConfig { + message LogFormat { + oneof log_format { + option (validate.required) = true; + + // Flush application logs in JSON format. The configured JSON struct can + // support all the format flags specified in the :option:`--log-format` + // command line options section, except for the ``%v`` and ``%_`` flags. + google.protobuf.Struct json_format = 1; + + // Flush application log in a format defined by a string. The text format + // can support all the format flags specified in the :option:`--log-format` + // command line option section. + string text_format = 2; + } + } + + // Optional field to set the application logs format. If this field is set, it will override + // the default log format. Setting both this field and :option:`--log-format` command line + // option is not allowed, and will cause a bootstrap error. + LogFormat log_format = 1; + } + + message DeferredStatOptions { + // When the flag is enabled, Envoy will lazily initialize a subset of the stats (see below). + // This will save memory and CPU cycles when creating the objects that own these stats, if those + // stats are never referenced throughout the lifetime of the process. However, it will incur additional + // memory overhead for these objects, and a small increase of CPU usage when at least one of the stats + // is updated for the first time. + // + // Groups of stats that will be lazily initialized: + // + // - Cluster traffic stats: a subgroup of the :ref:`cluster statistics ` + // that are used when requests are routed to the cluster. + bool enable_deferred_creation_stats = 1; + } + + message GrpcAsyncClientManagerConfig { + // Optional field to set the expiration time for the cached gRPC client object. + // The minimal value is ``5s`` and the default is ``50s``. + google.protobuf.Duration max_cached_entry_idle_duration = 1 + [(validate.rules).duration = {gte {seconds: 5}}]; + } + + reserved 10, 11; + + reserved "runtime"; + + // Node identity to present to the management server and for instance + // identification purposes (e.g. in generated headers). + core.v3.Node node = 1; + + // A list of :ref:`Node ` field names + // that will be included in the context parameters of the effective + // ``xdstp://`` URL that is sent in a discovery request when resource + // locators are used for LDS/CDS. Any non-string field will have its JSON + // encoding set as the context parameter value, with the exception of + // metadata, which will be flattened (see example below). The supported field + // names are: + // - ``cluster`` + // - ``id`` + // - ``locality.region`` + // - ``locality.sub_zone`` + // - ``locality.zone`` + // - ``metadata`` + // - ``user_agent_build_version.metadata`` + // - ``user_agent_build_version.version`` + // - ``user_agent_name`` + // - ``user_agent_version`` + // + // The node context parameters act as a base layer dictionary for the context + // parameters (i.e. more specific resource specific context parameters will + // override). Field names will be prefixed with ````"udpa.node."```` when included in + // context parameters. + // + // For example, if node_context_params is ``["user_agent_name", "metadata"]``, + // the implied context parameters might be:: + // + // node.user_agent_name: "envoy" + // node.metadata.foo: "{\"bar\": \"baz\"}" + // node.metadata.some: "42" + // node.metadata.thing: "\"thing\"" + // + // [#not-implemented-hide:] + repeated string node_context_params = 26; + + // Statically specified resources. + StaticResources static_resources = 2; + + // xDS configuration sources. + DynamicResources dynamic_resources = 3; + + // Configuration for the cluster manager which owns all upstream clusters + // within the server. + ClusterManager cluster_manager = 4; + + // Health discovery service config option. + // (:ref:`core.ApiConfigSource `) + core.v3.ApiConfigSource hds_config = 14; + + // Optional file system path to search for startup flag files. + string flags_path = 5; + + // Optional set of stats sinks. + repeated metrics.v3.StatsSink stats_sinks = 6; + + // Options to control behaviors of deferred creation compatible stats. + DeferredStatOptions deferred_stat_options = 39; + + // Configuration for internal processing of stats. + metrics.v3.StatsConfig stats_config = 13; + + // Optional duration between flushes to configured stats sinks. For + // performance reasons Envoy latches counters and only flushes counters and + // gauges at a periodic interval. If not specified the default is ``5000ms`` (``5`` seconds). + // Only one of ``stats_flush_interval`` or ``stats_flush_on_admin`` + // can be set. + // Duration must be at least ``1ms`` and at most ``5 min``. + google.protobuf.Duration stats_flush_interval = 7 [ + (validate.rules).duration = { + lt {seconds: 300} + gte {nanos: 1000000} + }, + (udpa.annotations.field_migrate).oneof_promotion = "stats_flush" + ]; + + oneof stats_flush { + // Flush stats to sinks only when queried for on the admin interface. If set, + // a flush timer is not created. Only one of ``stats_flush_on_admin`` or + // ``stats_flush_interval`` can be set. + bool stats_flush_on_admin = 29 [(validate.rules).bool = {const: true}]; + } + + oneof stats_eviction { + // Optional duration to perform metric eviction. At every interval, during the stats flush + // the unused metrics are removed from the worker caches and the used metrics + // are marked as unused. Must be a multiple of the ``stats_flush_interval``. + google.protobuf.Duration stats_eviction_interval = 42 + [(validate.rules).duration = {gte {nanos: 1000000}}]; + } + + // Optional watchdog configuration. + // This is for a single watchdog configuration for the entire system. + // Deprecated in favor of ``watchdogs`` which has finer granularity. + Watchdog watchdog = 8 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Optional watchdogs configuration. + // This is used for specifying different watchdogs for the different subsystems. + // [#extension-category: envoy.guarddog_actions] + Watchdogs watchdogs = 27; + + // Configuration for an external tracing provider. + // + // .. attention:: + // This field has been deprecated in favor of :ref:`HttpConnectionManager.Tracing.provider + // `. + trace.v3.Tracing tracing = 9 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Configuration for the runtime configuration provider. If not + // specified, a “null” provider will be used which will result in all defaults + // being used. + LayeredRuntime layered_runtime = 17; + + // Configuration for the local administration HTTP server. + Admin admin = 12; + + // Optional overload manager configuration. + overload.v3.OverloadManager overload_manager = 15 [ + (udpa.annotations.security).configure_for_untrusted_downstream = true, + (udpa.annotations.security).configure_for_untrusted_upstream = true + ]; + + // Enable :ref:`stats for event dispatcher `. Defaults to ``false``. + // + // .. note:: + // + // This records a value for each iteration of the event loop on every thread. This + // should normally be minimal overhead, but when using + // :ref:`statsd `, it will send each observed value + // over the wire individually because the statsd protocol doesn't have any way to represent a + // histogram summary. Be aware that this can be a very large volume of data. + bool enable_dispatcher_stats = 16; + + // Optional string which will be used in lieu of ``x-envoy`` in prefixing headers. + // + // For example, if this string is present and set to ``X-Foo``, then ``x-envoy-retry-on`` will be + // transformed into ``x-foo-retry-on`` etc. + // + // .. note:: + // + // This applies to the headers Envoy will generate, the headers Envoy will sanitize, and the + // headers Envoy will trust for core code and core extensions only. Be VERY careful making + // changes to this string, especially in multi-layer Envoy deployments or deployments using + // extensions which are not upstream. + string header_prefix = 18; + + // Optional proxy version which will be used to set the value of :ref:`server.version statistic + // ` if specified. Envoy will not process this value, it will be sent as is to + // :ref:`stats sinks `. + google.protobuf.UInt64Value stats_server_version_override = 19; + + // Always use ``TCP`` queries instead of ``UDP`` queries for DNS lookups. + // This may be overridden on a per-cluster basis in ``cds_config``, + // when :ref:`dns_resolvers ` and + // :ref:`use_tcp_for_dns_lookups ` are + // specified. + // This field is deprecated in favor of ``dns_resolution_config`` + // which aggregates all of the DNS resolver configuration in a single message. + bool use_tcp_for_dns_lookups = 20 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // DNS resolution configuration which includes the underlying DNS resolver addresses and options. + // This may be overridden on a per-cluster basis in ``cds_config``, when + // :ref:`dns_resolution_config ` + // is specified. + // This field is deprecated in favor of + // :ref:`typed_dns_resolver_config `. + core.v3.DnsResolutionConfig dns_resolution_config = 30 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // DNS resolver type configuration extension. This extension can be used to configure ``c-ares``, ``apple``, + // or any other DNS resolver types and the related parameters. + // For example, an object of + // :ref:`CaresDnsResolverConfig ` + // can be packed into this ``typed_dns_resolver_config``. This configuration replaces the + // :ref:`dns_resolution_config ` + // configuration. + // + // During the transition period when both ``dns_resolution_config`` and ``typed_dns_resolver_config`` exist, + // when ``typed_dns_resolver_config`` is in place, Envoy will use it and ignore ``dns_resolution_config``. + // When ``typed_dns_resolver_config`` is missing, the default behavior is in place. + // [#extension-category: envoy.network.dns_resolver] + core.v3.TypedExtensionConfig typed_dns_resolver_config = 31; + + // Specifies optional bootstrap extensions to be instantiated at startup time. + // Each item contains extension specific configuration. + // [#extension-category: envoy.bootstrap] + repeated core.v3.TypedExtensionConfig bootstrap_extensions = 21; + + // Specifies optional extensions instantiated at startup time and + // invoked during crash time on the request that caused the crash. + repeated FatalAction fatal_actions = 28; + + // Configuration sources that will participate in + // ``xdstp://`` URL authority resolution. The algorithm is as + // follows: + // + // 1. The authority field is taken from the ``xdstp://`` URL, call + // this ``resource_authority``. + // 2. ``resource_authority`` is compared against the authorities in any peer + // ``ConfigSource``. The peer ``ConfigSource`` is the configuration source + // message which would have been used unconditionally for resolution + // with opaque resource names. If there is a match with an authority, the + // peer ``ConfigSource`` message is used. + // 3. ``resource_authority`` is compared sequentially with the authorities in + // each configuration source in ``config_sources``. The first ``ConfigSource`` + // to match wins. + // 4. As a fallback, if no configuration source matches, then + // ``default_config_source`` is used. + // 5. If ``default_config_source`` is not specified, resolution fails. + // [#not-implemented-hide:] + repeated core.v3.ConfigSource config_sources = 22; + + // Default configuration source for ``xdstp://`` URLs if all + // other resolution fails. + // [#not-implemented-hide:] + core.v3.ConfigSource default_config_source = 23; + + // Optional overriding of default socket interface. The value must be the name of one of the + // socket interface factories initialized through a bootstrap extension + string default_socket_interface = 24; + + // Global map of CertificateProvider instances. These instances are referred to by name in the + // :ref:`CommonTlsContext.CertificateProviderInstance.instance_name + // ` + // field. + // [#not-implemented-hide:] + map certificate_provider_instances = 25; + + // Specifies a set of headers that need to be registered as inline header. This configuration + // allows users to customize the inline headers on-demand at Envoy startup without modifying + // Envoy's source code. + // + // .. note:: + // + // The ``set-cookie`` header cannot be registered as inline header. + repeated CustomInlineHeader inline_headers = 32; + + // Optional path to a file with performance tracing data created by ``Perfetto`` SDK in binary + // ProtoBuf format. The default value is ``envoy.pftrace``. + string perf_tracing_file_path = 33; + + // Optional overriding of default regex engine. + // If the value is not specified, ``Google RE2`` will be used by default. + // [#extension-category: envoy.regex_engines] + core.v3.TypedExtensionConfig default_regex_engine = 34; + + // Optional XdsResourcesDelegate configuration, which allows plugging custom logic into both + // fetch and load events during xDS processing. + // If a value is not specified, no ``XdsResourcesDelegate`` will be used. + // TODO(abeyad): Add public-facing documentation. + // [#not-implemented-hide:] + core.v3.TypedExtensionConfig xds_delegate_extension = 35; + + // Optional XdsConfigTracker configuration, which allows tracking xDS responses in external components, + // e.g., external tracer or monitor. It provides the process point when receive, ingest, or fail to + // process xDS resources and messages. If a value is not specified, no ``XdsConfigTracker`` will be used. + // + // .. note:: + // + // There are no in-repo extensions currently, and the :repo:`XdsConfigTracker ` + // interface should be implemented before using. + // See :repo:`xds_config_tracker_integration_test ` + // for an example usage of the interface. + core.v3.TypedExtensionConfig xds_config_tracker_extension = 36; + + // [#not-implemented-hide:] + // This controls the type of listener manager configured for Envoy. Currently + // Envoy only supports ``ListenerManager`` for this field and Envoy Mobile + // supports ``ApiListenerManager``. + core.v3.TypedExtensionConfig listener_manager = 37; + + // Optional application log configuration. + ApplicationLogConfig application_log_config = 38; + + // Optional gRPC async client manager config. + GrpcAsyncClientManagerConfig grpc_async_client_manager_config = 40; + + // Optional configuration for memory allocation manager. + // Memory releasing is supported with `tcmalloc `_ and + // `gperftools `_. + MemoryAllocatorManager memory_allocator_manager = 41; + + // When enabled, Envoy pins each worker thread to a distinct CPU from the process affinity mask, + // worker ``i`` to the ``i-th`` CPU in ascending order. This improves CPU cache and ``NUMA`` + // locality for high concurrency deployments on bare metal. It is available on Linux only and is + // ignored on other platforms. Pinning requires a worker count no greater than the number of CPUs + // in the process affinity mask. When the worker count exceeds the available CPUs no worker is + // pinned. Pinning is applied once when the workers start, so a later change to the process + // affinity mask does not re-pin. + // + // Defaults to ``false``. + bool enable_worker_cpu_affinity = 43; +} + +// Administration interface :ref:`operations documentation +// `. +// [#next-free-field: 8] +message Admin { + option (udpa.annotations.versioning).previous_message_type = "envoy.config.bootstrap.v2.Admin"; + + // Configuration for :ref:`access logs ` + // emitted by the administration server. + repeated accesslog.v3.AccessLog access_log = 5; + + // The path to write the access log for the administration server. If no + // access log is desired specify ``/dev/null``. This is only required if + // :ref:`address ` is set. + // Deprecated in favor of ``access_log`` which offers more options. + string access_log_path = 1 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // The CPU profiler output path for the administration server. If no profile + // path is specified, the default is ``/var/log/envoy/envoy.prof``. + string profile_path = 2; + + // The TCP address that the administration server will listen on. + // If not specified, Envoy will not start an administration server. + core.v3.Address address = 3; + + // Additional socket options that may not be present in Envoy source code or + // precompiled binaries. + repeated core.v3.SocketOption socket_options = 4; + + // Indicates whether :ref:`global_downstream_max_connections ` + // should apply to the admin interface or not. + bool ignore_global_conn_limit = 6; + + // List of admin paths that are accessible. If not specified, all admin endpoints are accessible. + // Matchers are evaluated against the request path. For endpoints commonly queried with + // parameters (for example ``/stats?format=...``), prefer ``prefix`` matchers. + // + // When specified, only paths in this list will be accessible, all others will return ``HTTP 403 Forbidden``. + // + // Example: + // + // .. code-block:: yaml + // + // allow_paths: + // - prefix: /stats + // - prefix: /config_dump + // - exact: /ready + // - prefix: /healthcheck + // + repeated type.matcher.v3.StringMatcher allow_paths = 7; +} + +// Cluster manager :ref:`architecture overview `. +// [#next-free-field: 6] +message ClusterManager { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.bootstrap.v2.ClusterManager"; + + message OutlierDetection { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.bootstrap.v2.ClusterManager.OutlierDetection"; + + // Specifies the path to the outlier event log. + string event_log_path = 1; + + // [#not-implemented-hide:] + // The gRPC service for the outlier detection event service. + // If empty, outlier detection events won't be sent to a remote endpoint. + core.v3.EventServiceConfig event_service = 2; + } + + // Name of the local cluster (i.e., the cluster that owns the Envoy running + // this configuration). In order to enable :ref:`zone aware routing + // ` this option must be set. + // If ``local_cluster_name`` is defined then :ref:`clusters + // ` must be defined in the :ref:`Bootstrap + // static cluster resources + // `. This is unrelated to + // the :option:`--service-cluster` option which does not `affect zone aware + // routing `_. + string local_cluster_name = 1; + + // Optional global configuration for outlier detection. + OutlierDetection outlier_detection = 2; + + // Optional configuration used to bind newly established upstream connections. + // This may be overridden on a per-cluster basis by ``upstream_bind_config`` in the ``cds_config``. + core.v3.BindConfig upstream_bind_config = 3; + + // A management server endpoint to stream load stats to via + // ``StreamLoadStats``. This must have :ref:`api_type + // ` :ref:`GRPC + // `. + core.v3.ApiConfigSource load_stats_config = 4; + + // Whether the ClusterManager will create clusters on the worker threads + // inline during requests. This will save memory and CPU cycles in cases where + // there are lots of inactive clusters and ``> 1`` worker thread. + bool enable_deferred_cluster_creation = 5; +} + +// Allows you to specify different watchdog configs for different subsystems. +// This allows finer tuned policies for the watchdog. If a subsystem is omitted +// the default values for that system will be used. +message Watchdogs { + // Watchdog for the main thread. + Watchdog main_thread_watchdog = 1; + + // Watchdog for the worker threads. + Watchdog worker_watchdog = 2; +} + +// Envoy process watchdog configuration. When configured, this monitors for +// nonresponsive threads and kills the process after the configured thresholds. +// See the :ref:`watchdog documentation ` for more information. +// [#next-free-field: 8] +message Watchdog { + option (udpa.annotations.versioning).previous_message_type = "envoy.config.bootstrap.v2.Watchdog"; + + message WatchdogAction { + // The events are fired in this order: ``KILL``, ``MULTIKILL``, ``MEGAMISS``, ``MISS``. + // Within an event type, actions execute in the order they are configured. + // For ``KILL``/``MULTIKILL`` there is a default ``PANIC`` that will run after the + // registered actions and kills the process if it wasn't already killed. + // It might be useful to specify several debug actions, and possibly an + // alternate ``FATAL`` action. + enum WatchdogEvent { + UNKNOWN = 0; + KILL = 1; + MULTIKILL = 2; + MEGAMISS = 3; + MISS = 4; + } + + // Extension specific configuration for the action. + core.v3.TypedExtensionConfig config = 1; + + WatchdogEvent event = 2 [(validate.rules).enum = {defined_only: true}]; + } + + // Register actions that will fire on given Watchdog events. + // See ``WatchdogAction`` for priority of events. + repeated WatchdogAction actions = 7; + + // The duration after which Envoy counts a nonresponsive thread in the + // ``watchdog_miss`` statistic. If not specified the default is ``200ms``. + google.protobuf.Duration miss_timeout = 1; + + // The duration after which Envoy counts a nonresponsive thread in the + // ``watchdog_mega_miss`` statistic. If not specified the default is ``1000ms``. + google.protobuf.Duration megamiss_timeout = 2; + + // If a watched thread has been nonresponsive for this duration, assume a + // programming error and kill the entire Envoy process. Set to ``0`` to disable + // kill behavior. If not specified the default is ``0`` (disabled). + google.protobuf.Duration kill_timeout = 3; + + // Defines the maximum jitter used to adjust the ``kill_timeout`` if ``kill_timeout`` is + // enabled. Enabling this feature would help to reduce risk of synchronized + // watchdog kill events across proxies due to external triggers. Set to ``0`` to + // disable. If not specified the default is ``0`` (disabled). + google.protobuf.Duration max_kill_timeout_jitter = 6 [(validate.rules).duration = {gte {}}]; + + // If ``max(2, ceil(registered_threads * Fraction(multikill_threshold)))`` + // threads have been nonresponsive for at least this duration kill the entire + // Envoy process. Set to ``0`` to disable this behavior. If not specified the + // default is ``0`` (disabled). + google.protobuf.Duration multikill_timeout = 4; + + // Sets the threshold for ``multikill_timeout`` in terms of the percentage of + // nonresponsive threads required for the ``multikill_timeout``. + // If not specified the default is ``0``. + type.v3.Percent multikill_threshold = 5; +} + +// Fatal actions to run while crashing. Actions can be safe (meaning they are +// async-signal safe) or unsafe. We run all safe actions before we run unsafe actions. +// +// .. note:: +// +// If using an unsafe action that could get stuck or deadlock, it is important to +// have an out of band system to terminate the process. +// +// The interface for the extension is ``Envoy::Server::Configuration::FatalAction``. +// ``FatalAction`` extensions live in the ``envoy.extensions.fatal_actions`` API +// namespace. +message FatalAction { + // Extension specific configuration for the action. It's expected to conform + // to the ``Envoy::Server::Configuration::FatalAction`` interface. + core.v3.TypedExtensionConfig config = 1; +} + +// Runtime :ref:`configuration overview ` (deprecated). +message Runtime { + option (udpa.annotations.versioning).previous_message_type = "envoy.config.bootstrap.v2.Runtime"; + + // The implementation assumes that the file system tree is accessed via a + // symbolic link. An atomic link swap is used when a new tree should be + // switched to. This parameter specifies the path to the symbolic link. Envoy + // will watch the location for changes and reload the file system tree when + // they happen. If this parameter is not set, there will be no disk based + // runtime. + string symlink_root = 1; + + // Specifies the subdirectory to load within the root directory. This is + // useful if multiple systems share the same delivery mechanism. Envoy + // configuration elements can be contained in a dedicated subdirectory. + string subdirectory = 2; + + // Specifies an optional subdirectory to load within the root directory. If + // specified and the directory exists, configuration values within this + // directory will override those found in the primary subdirectory. This is + // useful when Envoy is deployed across many different types of servers. + // Sometimes it is useful to have a per service cluster directory for runtime + // configuration. See below for exactly how the override directory is used. + string override_subdirectory = 3; + + // Static base runtime. This will be :ref:`overridden + // ` by other runtime layers, e.g. + // disk or admin. This follows the :ref:`runtime protobuf JSON representation + // encoding `. + google.protobuf.Struct base = 4; +} + +// [#next-free-field: 6] +message RuntimeLayer { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.bootstrap.v2.RuntimeLayer"; + + // :ref:`Disk runtime ` layer. + message DiskLayer { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.bootstrap.v2.RuntimeLayer.DiskLayer"; + + // The implementation assumes that the file system tree is accessed via a + // symbolic link. An atomic link swap is used when a new tree should be + // switched to. This parameter specifies the path to the symbolic link. + // Envoy will watch the location for changes and reload the file system tree + // when they happen. See documentation on runtime :ref:`atomicity + // ` for further details on how reloads are + // treated. + string symlink_root = 1; + + // Specifies the subdirectory to load within the root directory. This is + // useful if multiple systems share the same delivery mechanism. Envoy + // configuration elements can be contained in a dedicated subdirectory. + string subdirectory = 3; + + // :ref:`Append ` the + // service cluster to the path under symlink root. + bool append_service_cluster = 2; + } + + // :ref:`Admin console runtime ` layer. + message AdminLayer { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.bootstrap.v2.RuntimeLayer.AdminLayer"; + } + + // :ref:`Runtime Discovery Service (RTDS) ` layer. + message RtdsLayer { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.bootstrap.v2.RuntimeLayer.RtdsLayer"; + + // Resource to subscribe to at the ``rtds_config`` for the RTDS layer. + string name = 1; + + // RTDS configuration source. + core.v3.ConfigSource rtds_config = 2; + } + + // Descriptive name for the runtime layer. This is only used for the runtime + // :http:get:`/runtime` output. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + oneof layer_specifier { + option (validate.required) = true; + + // :ref:`Static runtime ` layer. + // This follows the :ref:`runtime protobuf JSON representation encoding + // `. Unlike static xDS resources, this static + // layer is overridable by later layers in the runtime virtual filesystem. + google.protobuf.Struct static_layer = 2; + + DiskLayer disk_layer = 3; + + AdminLayer admin_layer = 4; + + RtdsLayer rtds_layer = 5; + } +} + +// Runtime :ref:`configuration overview `. +message LayeredRuntime { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.bootstrap.v2.LayeredRuntime"; + + // The :ref:`layers ` of the runtime. This is ordered + // such that later layers in the list overlay earlier entries. + repeated RuntimeLayer layers = 1; +} + +// Used to specify the header that needs to be registered as an inline header. +// +// If request or response contain multiple headers with the same name and the header +// name is registered as an inline header, then multiple headers will be folded +// into one, and multiple header values will be concatenated by a suitable delimiter. +// The delimiter is generally a comma. +// +// For example, if ``foo`` is registered as an inline header, and the headers contain +// the following two headers: +// +// .. code-block:: text +// +// foo: bar +// foo: eep +// +// Then they will eventually be folded into: +// +// .. code-block:: text +// +// foo: bar, eep +// +// Inline headers provide O(1) search performance, but each inline header imposes +// an additional memory overhead on all instances of the corresponding type of +// HeaderMap or TrailerMap. +message CustomInlineHeader { + enum InlineHeaderType { + REQUEST_HEADER = 0; + REQUEST_TRAILER = 1; + RESPONSE_HEADER = 2; + RESPONSE_TRAILER = 3; + } + + // The name of the header that is expected to be set as the inline header. + string inline_header_name = 1 + [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // The type of the header that is expected to be set as the inline header. + InlineHeaderType inline_header_type = 2 [(validate.rules).enum = {defined_only: true}]; +} + +// [#next-free-field: 6] +message MemoryAllocatorManager { + // Configures tcmalloc to perform background release of free memory in amount of bytes per + // ``memory_release_interval`` interval. If equals to ``0``, no memory release will occur. + // Defaults to ``0``. + uint64 bytes_to_release = 1; + + // Interval in milliseconds for memory releasing. If specified, during every interval Envoy will + // try to release ``bytes_to_release`` of free memory back to operating system for reuse. If set + // to ``0``, no memory release will occur. Defaults to ``1000`` milliseconds. + google.protobuf.Duration memory_release_interval = 2; + + // Sets the soft memory limit for tcmalloc. When the total memory used by tcmalloc exceeds this + // limit, background release will be performed more aggressively to bring memory usage below the + // limit. If not set, no soft memory limit is applied. + // + // .. note:: + // This is currently only supported with tcmalloc and not with ``gperftools``. + // + google.protobuf.UInt64Value soft_memory_limit_bytes = 3; + + // Sets the maximum per-CPU cache size in bytes for tcmalloc. Smaller values reduce per-CPU + // memory overhead at the cost of increased contention on the central free list. If not set, + // tcmalloc's default is used. + // + // .. note:: + // This is currently only supported with tcmalloc and not with ``gperftools``. + // + google.protobuf.UInt32Value max_per_cpu_cache_size_bytes = 4; + + // The threshold of unfreed memory in bytes that triggers the heap shrinker to release memory + // back to the OS. When the difference between physical memory used and application-allocated + // memory exceeds this threshold, free memory is released. + // + // Defaults to ``104857600`` (100 MB). + uint64 max_unfreed_memory_bytes = 5; +} + +// A placeholder proto so that users can explicitly configure the standard +// Listener Manager via the bootstrap's :ref:`listener_manager `. +// [#not-implemented-hide:] +message ListenerManager { +} + +// A placeholder proto so that users can explicitly configure the standard +// Validation Listener Manager via the bootstrap's :ref:`listener_manager `. +// [#not-implemented-hide:] +message ValidationListenerManager { +} + +// A placeholder proto so that users can explicitly configure the API +// Listener Manager via the bootstrap's :ref:`listener_manager `. +// [#not-implemented-hide:] +message ApiListenerManager { + enum ThreadingModel { + // Handle HTTP requests on the main Envoy thread which also processes platform-raised events and runs xDS clients. + MAIN_THREAD_ONLY = 0; + + // Handle HTTP requests on a standalone worker thread. + STANDALONE_WORKER_THREAD = 1; + } + + // Default to MainThreadOnly. + ThreadingModel threading_model = 1; +} diff --git a/modules/sync/envoyproxy/envoy/cas/27d6937632ebcee64c3c8cfc15890eb8d3193e5fb1c7b419fcb1aa9bf8c0317b947cecc50ca3a205201df37f27856023c6f4be2fb49e4975f953d3c22bf03dc5 b/modules/sync/envoyproxy/envoy/cas/27d6937632ebcee64c3c8cfc15890eb8d3193e5fb1c7b419fcb1aa9bf8c0317b947cecc50ca3a205201df37f27856023c6f4be2fb49e4975f953d3c22bf03dc5 new file mode 100644 index 00000000..d612d0cb --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/27d6937632ebcee64c3c8cfc15890eb8d3193e5fb1c7b419fcb1aa9bf8c0317b947cecc50ca3a205201df37f27856023c6f4be2fb49e4975f953d3c22bf03dc5 @@ -0,0 +1,163 @@ +syntax = "proto3"; + +package envoy.service.auth.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/service/auth/v3/attribute_context.proto"; +import "envoy/type/v3/http_status.proto"; + +import "google/protobuf/struct.proto"; +import "google/rpc/status.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; + +option java_package = "io.envoyproxy.envoy.service.auth.v3"; +option java_outer_classname = "ExternalAuthProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/service/auth/v3;authv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Authorization service] + +// The authorization service request messages used by external authorization :ref:`network filter +// ` and :ref:`HTTP filter `. + +// A generic interface for performing authorization check on incoming +// requests to a networked service. +service Authorization { + // Performs authorization check based on the attributes associated with the + // incoming request, and returns status `OK` or not `OK`. + rpc Check(CheckRequest) returns (CheckResponse) { + } +} + +message CheckRequest { + option (udpa.annotations.versioning).previous_message_type = "envoy.service.auth.v2.CheckRequest"; + + // The request attributes. + AttributeContext attributes = 1; +} + +// HTTP attributes for a denied response. +message DeniedHttpResponse { + option (udpa.annotations.versioning).previous_message_type = + "envoy.service.auth.v2.DeniedHttpResponse"; + + // This field allows the authorization service to send an HTTP response status code to the + // downstream client. If not set, Envoy sends ``403 Forbidden`` HTTP status code by default. + type.v3.HttpStatus status = 1; + + // This field allows the authorization service to send HTTP response headers + // to the downstream client. Note that the :ref:`append field in HeaderValueOption ` defaults to + // false when used in this message. + // The :ref:`keep_empty_value field in HeaderValueOption ` + // is not supported. + repeated config.core.v3.HeaderValueOption headers = 2; + + // This field allows the authorization service to send a response body data + // to the downstream client. + string body = 3; +} + +// HTTP attributes for an OK response. +// [#next-free-field: 9] +message OkHttpResponse { + option (udpa.annotations.versioning).previous_message_type = + "envoy.service.auth.v2.OkHttpResponse"; + + // HTTP entity headers in addition to the original request headers. This allows the authorization + // service to append, to add or to override headers from the original request before + // dispatching it to the upstream. Note that the :ref:`append field in HeaderValueOption ` defaults to + // false when used in this message. By setting the ``append`` field to ``true``, + // the filter will append the correspondent header value to the matched request header. + // By leaving ``append`` as false, the filter will either add a new header, or override an existing + // one if there is a match. + // The :ref:`keep_empty_value field in HeaderValueOption ` + // is not supported. + repeated config.core.v3.HeaderValueOption headers = 2; + + // HTTP entity headers to remove from the original request before dispatching + // it to the upstream. This allows the authorization service to act on auth + // related headers (like ``Authorization``), process them, and consume them. + // Under this model, the upstream will either receive the request (if it's + // authorized) or not receive it (if it's not), but will not see headers + // containing authorization credentials. + // + // Pseudo headers (such as ``:authority``, ``:method``, ``:path`` etc), as well as + // the header ``Host``, may not be removed as that would make the request + // malformed. If mentioned in ``headers_to_remove`` these special headers will + // be ignored. + // + // When using the HTTP service this must instead be set by the HTTP + // authorization service as a comma separated list like so: + // ``x-envoy-auth-headers-to-remove: one-auth-header, another-auth-header``. + repeated string headers_to_remove = 5; + + // This field has been deprecated in favor of :ref:`CheckResponse.dynamic_metadata + // `. Until it is removed, + // setting this field overrides :ref:`CheckResponse.dynamic_metadata + // `. + google.protobuf.Struct dynamic_metadata = 3 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // This field allows the authorization service to send HTTP response headers + // to the downstream client on success. Note that the :ref:`append field in HeaderValueOption ` + // defaults to false when used in this message. + // The :ref:`keep_empty_value field in HeaderValueOption ` + // is not supported. + repeated config.core.v3.HeaderValueOption response_headers_to_add = 6; + + // This field allows the authorization service to set (and overwrite) query + // string parameters on the original request before it is sent upstream. + repeated config.core.v3.QueryParameter query_parameters_to_set = 7; + + // This field allows the authorization service to specify which query parameters + // should be removed from the original request before it is sent upstream. Each + // element in this list is a case-sensitive query parameter name to be removed. + repeated string query_parameters_to_remove = 8; +} + +// Intended for gRPC and Network Authorization servers ``only``. +// [#next-free-field: 6] +message CheckResponse { + option (udpa.annotations.versioning).previous_message_type = + "envoy.service.auth.v2.CheckResponse"; + + // Status ``OK`` allows the request. Any other status indicates the request should be denied, and + // for HTTP filter, if not overridden by :ref:`denied HTTP response status ` + // Envoy sends ``403 Forbidden`` HTTP status code by default. + google.rpc.Status status = 1; + + // An message that contains HTTP response attributes. This message is + // used when the authorization service needs to send custom responses to the + // downstream client or, to modify/add request headers being dispatched to the upstream. + oneof http_response { + // Supplies http attributes for a denied response. + DeniedHttpResponse denied_response = 2; + + // Supplies http attributes for an ok response. + OkHttpResponse ok_response = 3; + + // Supplies http attributes for an error response. This is used when the authorization + // service encounters an internal error and wants to return custom headers and body to the + // downstream client. When ``error_response`` is set, the ext_authz filter increments the + // ``ext_authz_error`` stat and respects the :ref:`failure_mode_allow + // ` + // configuration. The HTTP status code, headers, and body are taken from the + // :ref:`DeniedHttpResponse ` message. + // If the status field is not set, Envoy sends the status code configured via + // :ref:`status_on_error `, + // which defaults to ``403 Forbidden``. + DeniedHttpResponse error_response = 5; + } + + // Optional response metadata that will be emitted as dynamic metadata to be consumed by the next + // filter. This metadata lives in a namespace specified by the canonical name of extension filter + // that requires it: + // + // - :ref:`envoy.filters.http.ext_authz ` for HTTP filter. + // - :ref:`envoy.filters.network.ext_authz ` for network filter. + google.protobuf.Struct dynamic_metadata = 4; +} diff --git a/modules/sync/envoyproxy/envoy/cas/27ff670b92e98a70aad2c1a5141da88e37caa55a8152a66c3c32c0a483ce10ce24afc2b8a89149cf34fb3cde1e85460c0da591f6da8035e02de051d429298a41 b/modules/sync/envoyproxy/envoy/cas/27ff670b92e98a70aad2c1a5141da88e37caa55a8152a66c3c32c0a483ce10ce24afc2b8a89149cf34fb3cde1e85460c0da591f6da8035e02de051d429298a41 new file mode 100644 index 00000000..126209c6 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/27ff670b92e98a70aad2c1a5141da88e37caa55a8152a66c3c32c0a483ce10ce24afc2b8a89149cf34fb3cde1e85460c0da591f6da8035e02de051d429298a41 @@ -0,0 +1,75 @@ +syntax = "proto3"; + +package envoy.extensions.matching.input_matchers.dynamic_modules.v3; + +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.matching.input_matchers.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/matching/input_matchers/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Dynamic Modules Input Matcher] +// [#extension: envoy.matching.matchers.dynamic_modules] + +// Configuration for the Dynamic Modules Input Matcher. This matcher allows loading shared object +// files via ``dlopen`` to implement custom matching logic in dynamic modules (e.g. Rust, Go). +// +// A module can implement arbitrary matching logic by examining request headers and other HTTP +// attributes during the match evaluation. This is useful for scenarios that require complex +// matching beyond what built-in matchers provide, such as JWT/OAuth token analysis, custom +// routing decisions, or integration with external data sources. +message DynamicModuleMatcher { + // The policy applied when the module cannot evaluate a match, for example after a panic in the + // module's match hook. + enum OnError { + // Treat an evaluation that could not complete as no match. This is the default. + NO_MATCH = 0; + + // Treat an evaluation that could not complete as a match. + MATCH = 1; + } + + // Specifies the shared-object level configuration. This field is required. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1 + [(validate.rules).message = {required: true}]; + + // The name for this matcher configuration. If not specified, defaults to an empty string. + // + // This can be used to distinguish between different matcher implementations inside a dynamic + // module. For example, a module can have completely different matcher implementations (e.g., + // OAuth token matcher, geo-IP matcher). When Envoy receives this configuration, it passes + // the ``matcher_name`` to the dynamic module's matcher config init function together with the + // ``matcher_config``. That way a module can decide which in-module matcher implementation to + // use based on the name at load time. + string matcher_name = 2; + + // The configuration for the matcher chosen by ``matcher_name``. If not specified, an empty + // configuration is passed to the module. + // + // This is passed to the module's matcher initialization function. Together with the + // ``matcher_name``, the module can decide which in-module matcher implementation to use and + // fine-tune the behavior of the matcher. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly + // without the wrapper. + google.protobuf.Any matcher_config = 3; + + // The result applied for an evaluation that the module could not complete, for example when the + // module's match hook panics. A panic is caught at the ABI boundary and cannot report a match + // result, so the matcher applies this policy for that single evaluation. If not specified, + // defaults to ``NO_MATCH``. + // + // ``NO_MATCH`` is safe for allow-on-match trees where a missed match denies the request. + // ``MATCH`` is safe for deny-on-match trees where a missed match would let a request bypass the + // rule. + OnError on_error = 4; +} diff --git a/modules/sync/envoyproxy/envoy/cas/292e42dde6932c1148c0c59b3fd91973c690820e8908070d383c1e4dc7eec495a3f07018c61c578b282c22dafeaf83f102500784cfeb90ef9ed269abb7c5e038 b/modules/sync/envoyproxy/envoy/cas/292e42dde6932c1148c0c59b3fd91973c690820e8908070d383c1e4dc7eec495a3f07018c61c578b282c22dafeaf83f102500784cfeb90ef9ed269abb7c5e038 new file mode 100644 index 00000000..f5b9b8d4 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/292e42dde6932c1148c0c59b3fd91973c690820e8908070d383c1e4dc7eec495a3f07018c61c578b282c22dafeaf83f102500784cfeb90ef9ed269abb7c5e038 @@ -0,0 +1,264 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.ratelimit.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/config/ratelimit/v3/rls.proto"; +import "envoy/config/route/v3/route_components.proto"; +import "envoy/type/v3/http_status.proto"; + +import "google/protobuf/duration.proto"; + +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.ratelimit.v3"; +option java_outer_classname = "RateLimitProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ratelimit/v3;ratelimitv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Rate limit] +// Rate limit :ref:`configuration overview `. +// [#extension: envoy.filters.http.ratelimit] + +// [#next-free-field: 20] +message RateLimit { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.rate_limit.v2.RateLimit"; + + // Defines the version of the standard to use for X-RateLimit headers. + // + // [#next-major-version: unify with local ratelimit, should use common.ratelimit.v3.XRateLimitHeadersRFCVersion instead.] + enum XRateLimitHeadersRFCVersion { + // X-RateLimit headers disabled. + OFF = 0; + + // Use `draft RFC Version 03 `_. + DRAFT_VERSION_03 = 1; + } + + // The rate limit domain to use when calling the rate limit service. + string domain = 1 [(validate.rules).string = {min_len: 1}]; + + // Specifies the rate limit configurations to be applied with the same + // stage number. If not set, the default stage number is 0. + // + // .. note:: + // + // The filter supports a range of 0 - 10 inclusively for stage numbers. + uint32 stage = 2 [(validate.rules).uint32 = {lte: 10}]; + + // The type of requests the filter should apply to. The supported + // types are ``internal``, ``external`` or ``both``. A request is considered internal if + // :ref:`x-envoy-internal` is set to true. If + // :ref:`x-envoy-internal` is not set or false, a + // request is considered external. The filter defaults to ``both``, and it will apply to all request + // types. + string request_type = 3 + [(validate.rules).string = {in: "internal" in: "external" in: "both" in: ""}]; + + // The timeout in milliseconds for the rate limit service RPC. If not + // set, this defaults to 20ms. A value of 0 disables the timeout (infinite). + google.protobuf.Duration timeout = 4; + + // The filter's behaviour in case the rate limiting service does + // not respond back. When it is set to true, Envoy will not allow traffic in case of + // communication failure between rate limiting service and the proxy. + bool failure_mode_deny = 5; + + // Specifies whether a ``RESOURCE_EXHAUSTED`` gRPC code must be returned instead + // of the default ``UNAVAILABLE`` gRPC code for a rate limited gRPC call. The + // HTTP code will be 200 for a gRPC response. + bool rate_limited_as_resource_exhausted = 6; + + // Configuration for an external rate limit service provider. If not + // specified, any calls to the rate limit service will immediately return + // success. + config.ratelimit.v3.RateLimitServiceConfig rate_limit_service = 7 + [(validate.rules).message = {required: true}]; + + // Defines the standard version to use for X-RateLimit headers emitted by the filter: + // + // * ``X-RateLimit-Limit`` - indicates the request-quota associated to the + // client in the current time-window followed by the description of the + // quota policy. The values are returned by the rate limiting service in + // :ref:`current_limit` + // field. Example: ``10, 10;w=1;name="per-ip", 1000;w=3600``. + // * ``X-RateLimit-Remaining`` - indicates the remaining requests in the + // current time-window. The values are returned by the rate limiting service + // in :ref:`limit_remaining` + // field. + // * ``X-RateLimit-Reset`` - indicates the number of seconds until reset of + // the current time-window. The values are returned by the rate limiting service + // in :ref:`duration_until_reset` + // field. + // + // In case rate limiting policy specifies more than one time window, the values + // above represent the window that is closest to reaching its limit. + // + // For more information about the headers specification see selected version of + // the `draft RFC `_. + // + // Disabled by default. + // + // [#next-major-version: unify with local ratelimit, should use common.ratelimit.v3.XRateLimitHeadersRFCVersion instead.] + XRateLimitHeadersRFCVersion enable_x_ratelimit_headers = 8 + [(validate.rules).enum = {defined_only: true}]; + + // Disables emitting the :ref:`x-envoy-ratelimited` header + // in case of rate limiting (i.e. 429 responses). + // Having this header not present potentially makes the request retriable. + bool disable_x_envoy_ratelimited_header = 9; + + // This field allows for a custom HTTP response status code to the downstream client when + // the request has been rate limited. + // Defaults to 429 (TooManyRequests). + // + // .. note:: + // If this is set to < 400, 429 will be used instead. + type.v3.HttpStatus rate_limited_status = 10; + + // Specifies a list of HTTP headers that should be added to each response for requests that + // have been rate limited. + repeated config.core.v3.HeaderValueOption response_headers_to_add = 11 + [(validate.rules).repeated = {max_items: 10}]; + + // Sets the HTTP status that is returned to the client when the ratelimit server returns an error + // or cannot be reached. The default status is 500. + type.v3.HttpStatus status_on_error = 12; + + // Optional additional prefix to use when emitting statistics. This allows to distinguish + // emitted statistics between configured ``ratelimit`` filters in an HTTP filter chain. + string stat_prefix = 13; + + // If set, this will enable -- but not necessarily enforce -- the rate limit for the given + // fraction of requests. + // + // If not set then ``ratelimit.http_filter_enabled`` runtime key will be used to determine + // the fraction of requests to enforce rate limits on. And the default percentage of the + // runtime key is 100% for backwards compatibility. + config.core.v3.RuntimeFractionalPercent filter_enabled = 14; + + // If set, this will enforce the rate limit decisions for the given fraction of requests. + // + // Note: this only applies to the fraction of enabled requests. + // + // If not set then ``ratelimit.http_filter_enforcing`` runtime key will be used to determine + // the fraction of requests to enforce rate limits on. And the default percentage of the + // runtime key is 100% for backwards compatibility. + config.core.v3.RuntimeFractionalPercent filter_enforced = 15; + + // If set, this will override the failure_mode_deny parameter with a runtime fraction. + // If the runtime key is not specified, the value of failure_mode_deny will be used. + // + // Example: + // + // .. code-block:: yaml + // + // failure_mode_deny: true + // failure_mode_deny_percent: + // default_value: + // numerator: 50 + // denominator: HUNDRED + // runtime_key: ratelimit.failure_mode_deny_percent + // + // This means that when the rate limit service is unavailable, 50% of requests will be denied + // (fail closed) and 50% will be allowed (fail open). + config.core.v3.RuntimeFractionalPercent failure_mode_deny_percent = 16; + + // Rate limit configuration that is used to generate a list of descriptor entries based on + // the request context. The generated entries will be sent to the rate limit service. + // If this is set, then + // :ref:`VirtualHost.rate_limits` or + // :ref:`RouteAction.rate_limits` fields + // will be ignored. However, :ref:`RateLimitPerRoute.rate_limits` + // will take precedence over this field. + // + // .. note:: + // Not all configuration fields of + // :ref:`rate limit config ` is supported at here. + // Following fields are not supported: + // + // 1. :ref:`rate limit stage `. + // 2. :ref:`dynamic metadata `. + // 3. :ref:`disable_key `. + // 4. :ref:`override limit `. + repeated config.route.v3.RateLimit rate_limits = 17; + + // The namespace where dynamic metadata from rate limit response is saved. + // If not set, the default is "envoy.filters.http.ratelimit". + string metadata_namespace = 18; + + // Specifies whether the filter emits a ``Retry-After`` header when it enforces an HTTP 429 + // response. This option has no effect on responses with any other status code. The value is the + // largest ``duration_until_reset`` among the over-limit descriptor statuses returned by the rate + // limit service, expressed in seconds and clamped to at least 1. The header is not emitted when no + // over-limit descriptor status is present. + // If the rate limit service returns a ``Retry-After`` header, the filter does not overwrite it. + // + // Disabled by default. + bool enable_retry_after_header = 19; +} + +message RateLimitPerRoute { + // [#next-major-version: unify with local ratelimit, should use common.ratelimit.v3.VhRateLimitsOptions instead.] + enum VhRateLimitsOptions { + // Use the virtual host rate limits unless the route has a rate limit policy. + OVERRIDE = 0; + + // Use the virtual host rate limits even if the route has a rate limit policy. + INCLUDE = 1; + + // Ignore the virtual host rate limits even if the route does not have a rate limit policy. + IGNORE = 2; + } + + // The override option determines how the filter handles the cases where there is an override config at a more specific level than this one (from least to most specific: virtual host, route, cluster weight). + // [#not-implemented-hide:] + enum OverrideOptions { + // Client-defined default, typically OVERRIDE_POLICY. If VhRateLimitsOptions is set, that will be used instead. + DEFAULT = 0; + + // If there is an override config at a more specific level, use that instead of this one. + OVERRIDE_POLICY = 1; + + // If there is an override config at a more specific level, use data from both. + INCLUDE_POLICY = 2; + + // If there is an override config at a more specific level, ignore it and use only this one. + IGNORE_POLICY = 3; + } + + // Specifies if the rate limit filter should include the virtual host rate limits. + // [#next-major-version: unify with local ratelimit, should use common.ratelimit.v3.VhRateLimitsOptions instead.] + VhRateLimitsOptions vh_rate_limits = 1 [(validate.rules).enum = {defined_only: true}]; + + // Specifies if the rate limit filter should include the lower levels (route level, virtual host level or cluster weight level) rate limits override options. + // [#not-implemented-hide:] + OverrideOptions override_option = 2 [(validate.rules).enum = {defined_only: true}]; + + // Rate limit configuration that is used to generate a list of descriptor entries based on + // the request context. The generated entries will be used to find one or multiple matched rate + // limit rule from the ``descriptors``. + // If this is set, then + // :ref:`VirtualHost.rate_limits`, + // :ref:`RouteAction.rate_limits` and + // :ref:`RateLimit.rate_limits` fields + // will be ignored. + // + // .. note:: + // Not all configuration fields of + // :ref:`rate limit config ` is supported at here. + // Following fields are not supported: + // + // 1. :ref:`rate limit stage `. + // 2. :ref:`dynamic metadata `. + // 3. :ref:`disable_key `. + // 4. :ref:`override limit `. + repeated config.route.v3.RateLimit rate_limits = 3; + + // Overrides the domain. If not set, uses the filter-level domain instead. + string domain = 4; +} diff --git a/modules/sync/envoyproxy/envoy/cas/2a751a2d745240b338992e26dd84d5ec71e6f0a9f017eeec3b215c667fd485f3d2a2fb57e86ac8e898e9a14c4eebc9a5830e88f48fb8f324abbe8e332d0dc291 b/modules/sync/envoyproxy/envoy/cas/2a751a2d745240b338992e26dd84d5ec71e6f0a9f017eeec3b215c667fd485f3d2a2fb57e86ac8e898e9a14c4eebc9a5830e88f48fb8f324abbe8e332d0dc291 new file mode 100644 index 00000000..67aa1fab --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/2a751a2d745240b338992e26dd84d5ec71e6f0a9f017eeec3b215c667fd485f3d2a2fb57e86ac8e898e9a14c4eebc9a5830e88f48fb8f324abbe8e332d0dc291 @@ -0,0 +1,99 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.basic_auth.v3; + +import "envoy/config/core/v3/base.proto"; + +import "udpa/annotations/sensitive.proto"; +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.basic_auth.v3"; +option java_outer_classname = "BasicAuthProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/basic_auth/v3;basic_authv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Basic Auth] +// Basic Auth :ref:`configuration overview `. +// [#extension: envoy.filters.http.basic_auth] + +// Basic HTTP authentication. +// +// Example: +// +// .. code-block:: yaml +// +// users: +// inline_string: |- +// user1:{SHA}hashed_user1_password +// user2:{SHA}hashed_user2_password +// +// [#next-free-field: 7] +message BasicAuth { + // Username-password pairs used to verify user credentials in the "Authorization" header. + // The value needs to be the htpasswd format. + // Reference to https://httpd.apache.org/docs/2.4/programs/htpasswd.html + config.core.v3.DataSource users = 1 [(udpa.annotations.sensitive) = true]; + + // This field specifies the header name to forward a successfully authenticated user to + // the backend. The header will be added to the request with the username as the value. + // + // If it is not specified, the username will not be forwarded. + string forward_username_header = 2 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // This field specifies the request header to load the basic credential from. + // + // If it is not specified, the filter loads the credential from the "Authorization" header. + string authentication_header = 3 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // If set to true, requests without Basic credentials (missing ``Authorization`` header, or + // ``Authorization`` header with a non-``Basic`` scheme such as ``Bearer``) are allowed to pass through + // without authentication. Requests that present ``Basic`` credentials are still fully validated. + // + // This is useful when combining BasicAuth with other authentication methods (e.g. JWT) to + // achieve OR semantics: a request is accepted if any one configured auth method succeeds. + // When ``allow_missing`` is ``true`` on all auth filters, pair it with an RBAC filter that checks + // the dynamic metadata emitted by this filter (see ``emit_dynamic_metadata``) to ensure at + // least one method authenticated the request. Requires ``emit_dynamic_metadata`` to be set to + // ``true``. + bool allow_missing = 4; + + // If set to ``true``, the filter emits dynamic metadata on successful authentication with key + // ``username`` set to the authenticated username. The metadata is emitted under the namespace + // corresponding to the name of this basic_auth filter as configured in the ``http_filters`` + // chain (e.g. if the filter is configured with name ``envoy.filters.http.basic_auth``, that is + // the namespace that will be used). + // + // This is typically enabled together with ``allow_missing`` when combining BasicAuth with + // other authentication methods (e.g. JWT) and using a downstream RBAC filter to enforce + // OR semantics. + bool emit_dynamic_metadata = 5; + + // The realm to use in the ``WWW-Authenticate`` response header when authentication fails. + // The value is placed verbatim into ``WWW-Authenticate: Basic realm=""``. + // + // If not specified, Envoy falls back to using the full request URI + // (scheme + authority + path, truncated to 256 characters), which differs per path and + // prevents browsers from reusing cached credentials across paths on the same origin. + // Set a fixed realm to enable correct credential caching. The realm pattern dose not + // allow DEL, 32 C0 control chars including CRLF injection chars. + string realm = 6 [(validate.rules).string = {pattern: "^[^\\x00-\\x1f\\x7f]*$"}]; +} + +// Extra settings that may be added to per-route configuration for +// a virtual host or a cluster. +message BasicAuthPerRoute { + // Username-password pairs for this route. + config.core.v3.DataSource users = 1 + [(validate.rules).message = {required: true}, (udpa.annotations.sensitive) = true]; + + // Per-route realm override for the ``WWW-Authenticate`` response header. If set, takes + // precedence over the filter-level ``BasicAuth.realm``. Same escaping semantics apply. + // If neither this nor the filter-level realm is set, the full request URI is used. + // Set a fixed realm to enable correct credential caching. The realm pattern dose not + // allow DEL, 32 C0 control chars including CRLF injection chars. + string realm = 2 [(validate.rules).string = {pattern: "^[^\\x00-\\x1f\\x7f]*$"}]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/2c94a38b712b0bc8464609832cff79b02595cb280c341eeffc6042d89a9c623376cdfd615ecb833fd3ce82f83857f1a4073016dc8b55d6b56a5090683ddfd91c b/modules/sync/envoyproxy/envoy/cas/2c94a38b712b0bc8464609832cff79b02595cb280c341eeffc6042d89a9c623376cdfd615ecb833fd3ce82f83857f1a4073016dc8b55d6b56a5090683ddfd91c new file mode 100644 index 00000000..e6f4ae23 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/2c94a38b712b0bc8464609832cff79b02595cb280c341eeffc6042d89a9c623376cdfd615ecb833fd3ce82f83857f1a4073016dc8b55d6b56a5090683ddfd91c @@ -0,0 +1,3097 @@ +syntax = "proto3"; + +package envoy.config.route.v3; + +import "envoy/config/common/mutation_rules/v3/mutation_rules.proto"; +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/extension.proto"; +import "envoy/config/core/v3/proxy_protocol.proto"; +import "envoy/config/core/v3/substitution_format_string.proto"; +import "envoy/type/matcher/v3/address.proto"; +import "envoy/type/matcher/v3/filter_state.proto"; +import "envoy/type/matcher/v3/metadata.proto"; +import "envoy/type/matcher/v3/regex.proto"; +import "envoy/type/matcher/v3/string.proto"; +import "envoy/type/metadata/v3/metadata.proto"; +import "envoy/type/tracing/v3/custom_tag.proto"; +import "envoy/type/v3/percent.proto"; +import "envoy/type/v3/range.proto"; +import "envoy/type/v3/ratelimit_unit.proto"; + +import "google/protobuf/any.proto"; +import "google/protobuf/duration.proto"; +import "google/protobuf/wrappers.proto"; + +import "xds/type/matcher/v3/matcher.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/migrate.proto"; +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.config.route.v3"; +option java_outer_classname = "RouteComponentsProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/config/route/v3;routev3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: HTTP route components] +// * Routing :ref:`architecture overview ` +// * HTTP :ref:`router filter ` + +// The top level element in the routing configuration is a virtual host. Each virtual host has +// a logical name as well as a set of domains that get routed to it based on the incoming request's +// host header. This allows a single listener to service multiple top level domain path trees. Once +// a virtual host is selected based on the domain, the routes are processed in order to see which +// upstream cluster to route to or whether to perform a redirect. +// [#next-free-field: 27] +message VirtualHost { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.VirtualHost"; + + enum TlsRequirementType { + // No TLS requirement for the virtual host. + NONE = 0; + + // External requests must use TLS. If a request is external and it is not + // using TLS, a 301 redirect will be sent telling the client to use HTTPS. + EXTERNAL_ONLY = 1; + + // All requests must use TLS. If a request is not using TLS, a 301 redirect + // will be sent telling the client to use HTTPS. + ALL = 2; + } + + reserved 9, 12; + + reserved "per_filter_config"; + + // The logical name of the virtual host. This is used when emitting certain + // statistics but is not relevant for routing. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // A list of domains (host/authority header) that will be matched to this + // virtual host. Wildcard hosts are supported in the suffix or prefix form. + // + // Domain search order: + // 1. Exact domain names: ``www.foo.com``. + // 2. Suffix domain wildcards: ``*.foo.com`` or ``*-bar.foo.com``. + // 3. Prefix domain wildcards: ``foo.*`` or ``foo-*``. + // 4. Special wildcard ``*`` matching any domain. + // + // .. note:: + // + // The wildcard will not match the empty string. + // For example, ``*-bar.foo.com`` will match ``baz-bar.foo.com`` but not ``-bar.foo.com``. + // The longest wildcards match first. + // Only a single virtual host in the entire route configuration can match on ``*``. A domain + // must be unique across all virtual hosts or the config will fail to load. + // + // Domains cannot contain control characters. This is validated by the well_known_regex HTTP_HEADER_VALUE. + repeated string domains = 2 [(validate.rules).repeated = { + min_items: 1 + items {string {well_known_regex: HTTP_HEADER_VALUE strict: false}} + }]; + + // The list of routes that will be matched, in order, for incoming requests. + // The first route that matches will be used. + // Only one of this and ``matcher`` can be specified. + repeated Route routes = 3 [(udpa.annotations.field_migrate).oneof_promotion = "route_selection"]; + + // The match tree to use when resolving route actions for incoming requests. Only one of this and ``routes`` + // can be specified. + xds.type.matcher.v3.Matcher matcher = 21 + [(udpa.annotations.field_migrate).oneof_promotion = "route_selection"]; + + // Specifies the type of TLS enforcement the virtual host expects. If this option is not + // specified, there is no TLS requirement for the virtual host. + TlsRequirementType require_tls = 4 [(validate.rules).enum = {defined_only: true}]; + + // A list of virtual clusters defined for this virtual host. Virtual clusters + // are used for additional statistics gathering. + repeated VirtualCluster virtual_clusters = 5; + + // Specifies a set of rate limit configurations that will be applied to the + // virtual host. + repeated RateLimit rate_limits = 6; + + // Specifies a list of HTTP headers that should be added to each request + // handled by this virtual host. Headers specified at this level are applied + // after headers from enclosed :ref:`envoy_v3_api_msg_config.route.v3.Route` and before headers from the + // enclosing :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration`. For more information, including + // details on header value syntax, see the documentation on :ref:`custom request headers + // `. + repeated core.v3.HeaderValueOption request_headers_to_add = 7 + [(validate.rules).repeated = {max_items: 1000}]; + + // Specifies a list of HTTP headers that should be removed from each request + // handled by this virtual host. + repeated string request_headers_to_remove = 13 [(validate.rules).repeated = { + items {string {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}} + }]; + + // Specifies a list of HTTP headers that should be added to each response + // handled by this virtual host. Headers specified at this level are applied + // after headers from enclosed :ref:`envoy_v3_api_msg_config.route.v3.Route` and before headers from the + // enclosing :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration`. For more information, including + // details on header value syntax, see the documentation on :ref:`custom request headers + // `. + repeated core.v3.HeaderValueOption response_headers_to_add = 10 + [(validate.rules).repeated = {max_items: 1000}]; + + // Specifies a list of HTTP headers that should be removed from each response + // handled by this virtual host. + repeated string response_headers_to_remove = 11 [(validate.rules).repeated = { + items {string {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}} + }]; + + // Indicates that the virtual host has a CORS policy. This field is ignored if related cors policy is + // found in the + // :ref:`VirtualHost.typed_per_filter_config`. + // + // .. attention:: + // + // This option has been deprecated. Please use + // :ref:`VirtualHost.typed_per_filter_config` + // to configure the CORS HTTP filter. + CorsPolicy cors = 8 [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // This field can be used to provide virtual host level per filter config. The key should match the + // :ref:`filter config name + // `. + // See :ref:`HTTP filter route-specific config ` + // for details. + // [#comment: An entry's value may be wrapped in a + // :ref:`FilterConfig` + // message to specify additional options.] + map typed_per_filter_config = 15; + + // Decides whether the :ref:`x-envoy-attempt-count + // ` header should be included + // in the upstream request. Setting this option will cause it to override any existing header + // value, so in the case of two Envoys on the request path with this option enabled, the upstream + // will see the attempt count as perceived by the second Envoy. + // + // Defaults to ``false``. + // + // This header is unaffected by the + // :ref:`suppress_envoy_headers + // ` flag. + // + // [#next-major-version: rename to include_attempt_count_in_request.] + bool include_request_attempt_count = 14; + + // Decides whether the :ref:`x-envoy-attempt-count + // ` header should be included + // in the downstream response. Setting this option will cause the router to override any existing header + // value, so in the case of two Envoys on the request path with this option enabled, the downstream + // will see the attempt count as perceived by the Envoy closest upstream from itself. + // + // Defaults to ``false``. + // + // This header is unaffected by the + // :ref:`suppress_envoy_headers + // ` flag. + bool include_attempt_count_in_response = 19; + + // Indicates the retry policy for all routes in this virtual host. Note that setting a + // route level entry will take precedence over this config and it'll be treated + // independently (e.g., values are not inherited). + RetryPolicy retry_policy = 16; + + // [#not-implemented-hide:] + // Specifies the configuration for retry policy extension. Note that setting a route level entry + // will take precedence over this config and it'll be treated independently (e.g., values are not + // inherited). :ref:`Retry policy ` should not be + // set if this field is used. + google.protobuf.Any retry_policy_typed_config = 20; + + // Indicates the hedge policy for all routes in this virtual host. Note that setting a + // route level entry will take precedence over this config and it'll be treated + // independently (e.g., values are not inherited). + HedgePolicy hedge_policy = 17; + + // Decides whether to include the :ref:`x-envoy-is-timeout-retry ` + // request header in retries initiated by per-try timeouts. + bool include_is_timeout_retry_header = 23; + + // The maximum bytes which will be buffered for retries and shadowing. If set, the bytes actually buffered will be + // the minimum value of this and the listener ``per_connection_buffer_limit_bytes``. + // + // .. attention:: + // + // This field has been deprecated. Please use :ref:`request_body_buffer_limit + // ` instead. + // Only one of ``per_request_buffer_limit_bytes`` and ``request_body_buffer_limit`` could be set. + google.protobuf.UInt32Value per_request_buffer_limit_bytes = 18 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // The maximum bytes which will be buffered for request bodies to support large request body + // buffering beyond the ``per_connection_buffer_limit_bytes``. + // + // This limit is specifically for the request body buffering and allows buffering larger payloads while maintaining + // flow control. + // + // Buffer limit precedence (from highest to lowest priority): + // + // 1. If ``request_body_buffer_limit`` is set, then ``request_body_buffer_limit`` will be used. + // 2. If :ref:`per_request_buffer_limit_bytes ` + // is set but ``request_body_buffer_limit`` is not, then ``min(per_request_buffer_limit_bytes, per_connection_buffer_limit_bytes)`` + // will be used. + // 3. If neither is set, then ``per_connection_buffer_limit_bytes`` will be used. + // + // For flow control chunk sizes, ``min(per_connection_buffer_limit_bytes, 16KB)`` will be used. + // + // Only one of :ref:`per_request_buffer_limit_bytes ` + // and ``request_body_buffer_limit`` could be set. + google.protobuf.UInt64Value request_body_buffer_limit = 25 + [(validate.rules).message = {required: false}]; + + // Specify a set of default request mirroring policies for every route under this virtual host. + // It takes precedence over the route config mirror policy entirely. + // That is, policies are not merged, the most specific non-empty one becomes the mirror policies. + repeated RouteAction.RequestMirrorPolicy request_mirror_policies = 22; + + // The metadata field can be used to provide additional information + // about the virtual host. It can be used for configuration, stats, and logging. + // The metadata should go under the filter namespace that will need it. + // For instance, if the metadata is intended for the Router filter, + // the filter name should be specified as ``envoy.filters.http.router``. + core.v3.Metadata metadata = 24; + + // After the route matching has resolved a route for incoming request, the route specifiers + // are applied to the route to customize or monitor it and the output of the specifiers will be + // used as the final route by Envoy for the request. The specifiers here will not modify/affect + // the request attributes (e.g., headers, path) directly. + // + // Specifiers are executed in order, and the output of each is the input of the next. The + // specifiers here will run after the ``route_specifiers`` of the resolved + // :ref:`route ` + // and before the ``route_specifiers`` of + // :ref:`route configuration `. + // + // .. note:: + // If the route matching resolves no route, the route specifiers at the route configuration + // and the virtual host levels will still be applied to null. This allows route specifiers to + // optionally generate a valid route even when no route is resolved for the request. + // Similarly, if the route matching resolves a valid route, the route specifiers may drop it + // and return no route. Then Envoy will treat it as route not found and result in 404 response. + // + // See :ref:`route specifiers ` for more details. + repeated core.v3.TypedExtensionConfig route_specifiers = 26; +} + +// A filter-defined action type. +message FilterAction { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.FilterAction"; + + google.protobuf.Any action = 1; +} + +// This can be used in route matcher :ref:`VirtualHost.matcher `. +// When the matcher matches, routes will be matched and run. +message RouteList { + // The list of routes that will be matched and run, in order. The first route that matches will be used. + repeated Route routes = 1; +} + +// A route is both a specification of how to match a request as well as an indication of what to do +// next (e.g., redirect, forward, rewrite, etc.). +// +// .. attention:: +// +// Envoy supports routing on HTTP method via :ref:`header matching +// `. +// [#next-free-field: 22] +message Route { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.Route"; + + reserved 6, 8; + + reserved "per_filter_config"; + + // Name for the route. + string name = 14; + + // Route matching parameters. + RouteMatch match = 1 [(validate.rules).message = {required: true}]; + + oneof action { + option (validate.required) = true; + + // Route request to some upstream cluster. + RouteAction route = 2; + + // Return a redirect. + RedirectAction redirect = 3; + + // Return an arbitrary HTTP response directly, without proxying. + DirectResponseAction direct_response = 7; + + // [#not-implemented-hide:] + // A filter-defined action (e.g., it could dynamically generate the RouteAction). + // [#comment: TODO(samflattery): Remove cleanup in route_fuzz_test.cc when + // implemented] + FilterAction filter_action = 17; + + // [#not-implemented-hide:] + // An action used when the route will generate a response directly, + // without forwarding to an upstream host. This will be used in non-proxy + // xDS clients like the gRPC server. It could also be used in the future + // in Envoy for a filter that directly generates responses for requests. + NonForwardingAction non_forwarding_action = 18; + } + + // The Metadata field can be used to provide additional information + // about the route. It can be used for configuration, stats, and logging. + // The metadata should go under the filter namespace that will need it. + // For instance, if the metadata is intended for the Router filter, + // the filter name should be specified as ``envoy.filters.http.router``. + core.v3.Metadata metadata = 4; + + // Decorator for the matched route. + Decorator decorator = 5; + + // This field can be used to provide route specific per filter config. The key should match the + // :ref:`filter config name + // `. + // See :ref:`HTTP filter route-specific config ` + // for details. + // [#comment: An entry's value may be wrapped in a + // :ref:`FilterConfig` + // message to specify additional options.] + map typed_per_filter_config = 13; + + // Specifies a set of headers that will be added to requests matching this + // route. Headers specified at this level are applied before headers from the + // enclosing :ref:`envoy_v3_api_msg_config.route.v3.VirtualHost` and + // :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration`. For more information, including details on + // header value syntax, see the documentation on :ref:`custom request headers + // `. + repeated core.v3.HeaderValueOption request_headers_to_add = 9 + [(validate.rules).repeated = {max_items: 1000}]; + + // Specifies a list of HTTP headers that should be removed from each request + // matching this route. + repeated string request_headers_to_remove = 12 [(validate.rules).repeated = { + items {string {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}} + }]; + + // Specifies a set of headers that will be added to responses to requests + // matching this route. Headers specified at this level are applied before + // headers from the enclosing :ref:`envoy_v3_api_msg_config.route.v3.VirtualHost` and + // :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration`. For more information, including + // details on header value syntax, see the documentation on + // :ref:`custom request headers `. + repeated core.v3.HeaderValueOption response_headers_to_add = 10 + [(validate.rules).repeated = {max_items: 1000}]; + + // Specifies a list of HTTP headers that should be removed from each response + // to requests matching this route. + repeated string response_headers_to_remove = 11 [(validate.rules).repeated = { + items {string {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}} + }]; + + // Presence of the object defines whether the connection manager's tracing configuration + // is overridden by this route specific instance. + Tracing tracing = 15; + + // The maximum bytes which will be buffered for retries and shadowing. + // If set, the bytes actually buffered will be the minimum value of this and the + // listener per_connection_buffer_limit_bytes. + // + // .. attention:: + // + // This field has been deprecated. Please use :ref:`request_body_buffer_limit + // ` instead. + // Only one of ``per_request_buffer_limit_bytes`` and ``request_body_buffer_limit`` may be set. + google.protobuf.UInt32Value per_request_buffer_limit_bytes = 16 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // The human readable prefix to use when emitting statistics for this endpoint. + // The statistics are rooted at vhost..route.. + // This should be set for highly critical + // endpoints that one wishes to get “per-route” statistics on. + // If not set, endpoint statistics are not generated. + // + // The emitted statistics are the same as those documented for :ref:`virtual clusters `. + // + // .. warning:: + // + // We do not recommend setting up a stat prefix for + // every application endpoint. This is both not easily maintainable and + // statistics use a non-trivial amount of memory (approximately 1KiB per route). + string stat_prefix = 19; + + // The maximum bytes which will be buffered for request bodies to support large request body + // buffering beyond the ``per_connection_buffer_limit_bytes``. + // + // This limit is specifically for the request body buffering and allows buffering larger payloads while maintaining + // flow control. + // + // Buffer limit precedence (from highest to lowest priority): + // + // 1. If ``request_body_buffer_limit`` is set: use ``request_body_buffer_limit`` + // 2. If :ref:`per_request_buffer_limit_bytes ` + // is set but ``request_body_buffer_limit`` is not: use ``min(per_request_buffer_limit_bytes, per_connection_buffer_limit_bytes)`` + // 3. If neither is set: use ``per_connection_buffer_limit_bytes`` + // + // For flow control chunk sizes, use ``min(per_connection_buffer_limit_bytes, 16KB)``. + // + // Only one of :ref:`per_request_buffer_limit_bytes ` + // and ``request_body_buffer_limit`` may be set. + google.protobuf.UInt64Value request_body_buffer_limit = 20; + + // After the route matching has resolved this route for incoming request, the route specifiers + // are applied to the route to customize or monitor it and the output of the specifiers will be + // used as the final route by Envoy for the request. The specifiers here will not modify/affect + // the request attributes (e.g., headers, path) directly. + // + // Specifiers are executed in order, and the output of each is the input of the next. The + // specifiers here will run first, before the ``route_specifiers`` of + // :ref:`virtual host ` and + // :ref:`route configuration `, + // so the route that comes out of the last specifier here is the input of the specifiers of + // these two levels. + // + // .. note:: + // If the route matching resolves no route, the route specifiers at the route configuration + // and the virtual host levels will still be applied to null. This allows route specifiers to + // optionally generate a valid route even when no route is resolved for the request. + // Similarly, if the route matching resolves a valid route, the route specifiers may drop it + // and return no route. Then Envoy will treat it as route not found and result in 404 response. + // + // See :ref:`route specifiers ` for more details. + repeated core.v3.TypedExtensionConfig route_specifiers = 21; +} + +// Compared to the :ref:`cluster ` field that specifies a +// single upstream cluster as the target of a request, the :ref:`weighted_clusters +// ` option allows for specification of +// multiple upstream clusters along with weights that indicate the percentage of +// traffic to be forwarded to each cluster. The router selects an upstream cluster based on the +// weights. +// [#next-free-field: 6] +message WeightedCluster { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.WeightedCluster"; + + // [#next-free-field: 13] + message ClusterWeight { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.WeightedCluster.ClusterWeight"; + + reserved 7, 8; + + reserved "per_filter_config"; + + // Only one of ``name`` and ``cluster_header`` may be specified. + // [#next-major-version: Need to add back the validation rule: (validate.rules).string = {min_len: 1}] + // Name of the upstream cluster. The cluster must exist in the + // :ref:`cluster manager configuration `. + string name = 1 [(udpa.annotations.field_migrate).oneof_promotion = "cluster_specifier"]; + + // Only one of ``name`` and ``cluster_header`` may be specified. + // [#next-major-version: Need to add back the validation rule: (validate.rules).string = {min_len: 1 }] + // Envoy will determine the cluster to route to by reading the value of the + // HTTP header named by cluster_header from the request headers. If the + // header is not found or the referenced cluster does not exist, Envoy will + // return a 404 response. + // + // .. attention:: + // + // Internally, Envoy always uses the HTTP/2 ``:authority`` header to represent the HTTP/1 + // ``Host`` header. Thus, if attempting to match on ``Host``, match on ``:authority`` instead. + // + // .. note:: + // + // If the header appears multiple times only the first value is used. + string cluster_header = 12 [ + (validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false}, + (udpa.annotations.field_migrate).oneof_promotion = "cluster_specifier" + ]; + + // The weight of the cluster. This value is relative to the other clusters' + // weights. When a request matches the route, the choice of an upstream cluster + // is determined by its weight. The sum of weights across all + // entries in the clusters array must be greater than 0, and must not exceed + // uint32_t maximal value (4294967295). + google.protobuf.UInt32Value weight = 2; + + // Optional endpoint metadata match criteria used by the subset load balancer. Only endpoints in + // the upstream cluster with metadata matching what is set in this field will be considered for + // load balancing. Note that this will be merged with what's provided in + // :ref:`RouteAction.metadata_match `, with + // values here taking precedence. The filter name should be specified as ``envoy.lb``. + core.v3.Metadata metadata_match = 3; + + // Specifies a list of headers to be added to requests when this cluster is selected + // through the enclosing :ref:`envoy_v3_api_msg_config.route.v3.RouteAction`. + // Headers specified at this level are applied before headers from the enclosing + // :ref:`envoy_v3_api_msg_config.route.v3.Route`, :ref:`envoy_v3_api_msg_config.route.v3.VirtualHost`, and + // :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration`. For more information, including details on + // header value syntax, see the documentation on :ref:`custom request headers + // `. + repeated core.v3.HeaderValueOption request_headers_to_add = 4 + [(validate.rules).repeated = {max_items: 1000}]; + + // Specifies a list of HTTP headers that should be removed from each request when + // this cluster is selected through the enclosing :ref:`envoy_v3_api_msg_config.route.v3.RouteAction`. + repeated string request_headers_to_remove = 9 [(validate.rules).repeated = { + items {string {well_known_regex: HTTP_HEADER_NAME strict: false}} + }]; + + // Specifies a list of headers to be added to responses when this cluster is selected + // through the enclosing :ref:`envoy_v3_api_msg_config.route.v3.RouteAction`. + // Headers specified at this level are applied before headers from the enclosing + // :ref:`envoy_v3_api_msg_config.route.v3.Route`, :ref:`envoy_v3_api_msg_config.route.v3.VirtualHost`, and + // :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration`. For more information, including details on + // header value syntax, see the documentation on :ref:`custom request headers + // `. + repeated core.v3.HeaderValueOption response_headers_to_add = 5 + [(validate.rules).repeated = {max_items: 1000}]; + + // Specifies a list of headers to be removed from responses when this cluster is selected + // through the enclosing :ref:`envoy_v3_api_msg_config.route.v3.RouteAction`. + repeated string response_headers_to_remove = 6 [(validate.rules).repeated = { + items {string {well_known_regex: HTTP_HEADER_NAME strict: false}} + }]; + + // This field can be used to provide weighted cluster specific per filter config. The key should match the + // :ref:`filter config name + // `. + // See :ref:`HTTP filter route-specific config ` + // for details. + // [#comment: An entry's value may be wrapped in a + // :ref:`FilterConfig` + // message to specify additional options.] + map typed_per_filter_config = 10; + + oneof host_rewrite_specifier { + // Indicates that during forwarding, the host header will be swapped with + // this value. + string host_rewrite_literal = 11 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE strict: false}]; + } + } + + // Specifies one or more upstream clusters associated with the route. + repeated ClusterWeight clusters = 1 [(validate.rules).repeated = {min_items: 1}]; + + // Specifies the total weight across all clusters. The sum of all cluster weights must equal this + // value, if this is greater than 0. + // This field is now deprecated, and the client will use the sum of all + // cluster weights. It is up to the management server to supply the correct weights. + google.protobuf.UInt32Value total_weight = 3 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Specifies the runtime key prefix that should be used to construct the + // runtime keys associated with each cluster. When the ``runtime_key_prefix`` is + // specified, the router will look for weights associated with each upstream + // cluster under the key ``runtime_key_prefix`` + ``.`` + ``cluster[i].name`` where + // ``cluster[i]`` denotes an entry in the clusters array field. If the runtime + // key for the cluster does not exist, the value specified in the + // configuration file will be used as the default weight. See the :ref:`runtime documentation + // ` for how key names map to the underlying implementation. + string runtime_key_prefix = 2; + + oneof random_value_specifier { + // Specifies the header name that is used to look up the random value passed in the request header. + // This is used to ensure consistent cluster picking across multiple proxy levels for weighted traffic. + // If header is not present or invalid, Envoy will fall back to use the internally generated random value. + // This header is expected to be single-valued header as we only want to have one selected value throughout + // the process for the consistency. And the value is a unsigned number between 0 and UINT64_MAX. + string header_name = 4 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // When set to true, the hash policies will be used to generate the random value for weighted cluster selection. + // This could ensure consistent cluster picking across multiple proxy levels for weighted traffic. + google.protobuf.BoolValue use_hash_policy = 5; + } +} + +// Configuration for a cluster specifier plugin. +message ClusterSpecifierPlugin { + // The name of the plugin and its opaque configuration. + // + // [#extension-category: envoy.router.cluster_specifier_plugin] + core.v3.TypedExtensionConfig extension = 1 [(validate.rules).message = {required: true}]; + + // If is_optional is not set or is set to false and the plugin defined by this message is not a + // supported type, the containing resource is NACKed. If is_optional is set to true, the resource + // would not be NACKed for this reason. In this case, routes referencing this plugin's name would + // not be treated as an illegal configuration, but would result in a failure if the route is + // selected. + bool is_optional = 2; +} + +// [#next-free-field: 18] +message RouteMatch { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.RouteMatch"; + + message GrpcRouteMatchOptions { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RouteMatch.GrpcRouteMatchOptions"; + } + + message TlsContextMatchOptions { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RouteMatch.TlsContextMatchOptions"; + + // If specified, the route will match against whether or not a certificate is presented. + // If not specified, certificate presentation status (true or false) will not be considered when route matching. + google.protobuf.BoolValue presented = 1; + + // If specified, the route will match against whether or not a certificate is validated. + // If not specified, certificate validation status (true or false) will not be considered when route matching. + // + // .. warning:: + // + // Client certificate validation is not currently performed upon TLS session resumption. For + // a resumed TLS session the route will match only when ``validated`` is false, regardless of + // whether the client TLS certificate is valid. + // + // The only known workaround for this issue is to disable TLS session resumption entirely, by + // setting both :ref:`disable_stateless_session_resumption ` + // and :ref:`disable_stateful_session_resumption ` on the DownstreamTlsContext. + google.protobuf.BoolValue validated = 2; + } + + // An extensible message for matching CONNECT or CONNECT-UDP requests. + message ConnectMatcher { + } + + reserved 5, 3; + + reserved "regex"; + + oneof path_specifier { + option (validate.required) = true; + + // If specified, the route is a prefix rule meaning that the prefix must + // match the beginning of the ``:path`` header. + string prefix = 1; + + // If specified, the route is an exact path rule meaning that the path must + // exactly match the ``:path`` header once the query string is removed. + string path = 2; + + // If specified, the route is a regular expression rule meaning that the + // regex must match the ``:path`` header once the query string is removed. The entire path + // (without the query string) must match the regex. The rule will not match if only a + // subsequence of the ``:path`` header matches the regex. + // + // [#next-major-version: In the v3 API we should redo how path specification works such + // that we utilize StringMatcher, and additionally have consistent options around whether we + // strip query strings, do a case-sensitive match, etc. In the interim it will be too disruptive + // to deprecate the existing options. We should even consider whether we want to do away with + // path_specifier entirely and just rely on a set of header matchers which can already match + // on :path, etc. The issue with that is it is unclear how to generically deal with query string + // stripping. This needs more thought.] + type.matcher.v3.RegexMatcher safe_regex = 10 [(validate.rules).message = {required: true}]; + + // If this is used as the matcher, the matcher will only match CONNECT or CONNECT-UDP requests. + // Note that this will not match other Extended CONNECT requests (WebSocket and the like) as + // they are normalized in Envoy as HTTP/1.1 style upgrades. + // This is the only way to match CONNECT requests for HTTP/1.1. For HTTP/2 and HTTP/3, + // where Extended CONNECT requests may have a path, the path matchers will work if + // there is a path present. + // Note that CONNECT support is currently considered alpha in Envoy. + // [#comment: TODO(htuch): Replace the above comment with an alpha tag.] + ConnectMatcher connect_matcher = 12; + + // If specified, the route is a path-separated prefix rule meaning that the + // ``:path`` header (without the query string) must either exactly match the + // ``path_separated_prefix`` or have it as a prefix, followed by ``/`` + // + // For example, ``/api/dev`` would match + // ``/api/dev``, ``/api/dev/``, ``/api/dev/v1``, and ``/api/dev?param=true`` + // but would not match ``/api/developer`` + // + // Expect the value to not contain ``?`` or ``#`` and not to end in ``/`` + string path_separated_prefix = 14 [(validate.rules).string = {pattern: "^[^?#]+[^?#/]$"}]; + + // [#extension-category: envoy.path.match] + core.v3.TypedExtensionConfig path_match_policy = 15; + } + + // Indicates that prefix/path matching should be case-sensitive. The default + // is true. Ignored for safe_regex matching. + google.protobuf.BoolValue case_sensitive = 4; + + // Indicates that the route should additionally match on a runtime key. Every time the route + // is considered for a match, it must also fall under the percentage of matches indicated by + // this field. For some fraction N/D, a random number in the range [0,D) is selected. If the + // number is <= the value of the numerator N, or if the key is not present, the default + // value, the router continues to evaluate the remaining match criteria. A runtime_fraction + // route configuration can be used to roll out route changes in a gradual manner without full + // code/config deploys. Refer to the :ref:`traffic shifting + // ` docs for additional documentation. + // + // .. note:: + // + // Parsing this field is implemented such that the runtime key's data may be represented + // as a FractionalPercent proto represented as JSON/YAML and may also be represented as an + // integer with the assumption that the value is an integral percentage out of 100. For + // instance, a runtime key lookup returning the value "42" would parse as a FractionalPercent + // whose numerator is 42 and denominator is HUNDRED. This preserves legacy semantics. + core.v3.RuntimeFractionalPercent runtime_fraction = 9; + + // Specifies a set of headers that the route should match on. The router will + // check the request’s headers against all the specified headers in the route + // config. A match will happen if all the headers in the route are present in + // the request with the same values (or based on presence if the value field + // is not in the config). + repeated HeaderMatcher headers = 6; + + // Specifies a set of URL query parameters on which the route should + // match. The router will check the query string from the ``path`` header + // against all the specified query parameters. If the number of specified + // query parameters is nonzero, they all must match the ``path`` header's + // query string for a match to occur. In the event query parameters are + // repeated, only the first value for each key will be considered. + // + // .. note:: + // + // If query parameters are used to pass request message fields when + // `grpc_json_transcoder `_ + // is used, the transcoded message fields may be different. The query parameters are + // URL-encoded, but the message fields are not. For example, if a query + // parameter is "foo%20bar", the message field will be "foo bar". + repeated QueryParameterMatcher query_parameters = 7; + + // Specifies a set of cookies on which the route should match. The router parses the ``Cookie`` + // header and evaluates the named cookie against each matcher. If the number of specified cookie + // matchers is nonzero, they all must match for the route to be selected. + repeated CookieMatcher cookies = 17; + + // If specified, only gRPC requests will be matched. The router will check + // that the ``Content-Type`` header has ``application/grpc`` or one of the various + // ``application/grpc+`` values. + GrpcRouteMatchOptions grpc = 8; + + // If specified, the client tls context will be matched against the defined + // match options. + // + // [#next-major-version: unify with RBAC] + TlsContextMatchOptions tls_context = 11; + + // Specifies a set of dynamic metadata matchers on which the route should match. + // The router will check the dynamic metadata against all the specified dynamic metadata matchers. + // If the number of specified dynamic metadata matchers is nonzero, they all must match the + // dynamic metadata for a match to occur. + repeated type.matcher.v3.MetadataMatcher dynamic_metadata = 13; + + // Specifies a set of filter state matchers on which the route should match. + // The router will check the filter state against all the specified filter state matchers. + // If the number of specified filter state matchers is nonzero, they all must match the + // filter state for a match to occur. + repeated type.matcher.v3.FilterStateMatcher filter_state = 16; +} + +// Cors policy configuration. +// +// .. attention:: +// +// This message has been deprecated. Please use +// :ref:`CorsPolicy in filter extension ` +// as as alternative. +// +// [#next-free-field: 14] +message CorsPolicy { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.CorsPolicy"; + + reserved 1, 8, 7; + + reserved "allow_origin", "allow_origin_regex", "enabled"; + + // Specifies string patterns that match allowed origins. An origin is allowed if any of the + // string matchers match. + repeated type.matcher.v3.StringMatcher allow_origin_string_match = 11; + + // Specifies the content for the ``access-control-allow-methods`` header. + string allow_methods = 2; + + // Specifies the content for the ``access-control-allow-headers`` header. + string allow_headers = 3; + + // Specifies the content for the ``access-control-expose-headers`` header. + string expose_headers = 4; + + // Specifies the content for the ``access-control-max-age`` header. + string max_age = 5; + + // Specifies whether the resource allows credentials. + google.protobuf.BoolValue allow_credentials = 6; + + oneof enabled_specifier { + // Specifies the % of requests for which the CORS filter is enabled. + // + // If neither ``enabled``, ``filter_enabled``, nor ``shadow_enabled`` are specified, the CORS + // filter will be enabled for 100% of the requests. + // + // If :ref:`runtime_key ` is + // specified, Envoy will lookup the runtime key to get the percentage of requests to filter. + core.v3.RuntimeFractionalPercent filter_enabled = 9; + } + + // Specifies the % of requests for which the CORS policies will be evaluated and tracked, but not + // enforced. + // + // This field is intended to be used when ``filter_enabled`` and ``enabled`` are off. One of those + // fields have to explicitly disable the filter in order for this setting to take effect. + // + // If :ref:`runtime_key ` is specified, + // Envoy will lookup the runtime key to get the percentage of requests for which it will evaluate + // and track the request's ``Origin`` to determine if it's valid but will not enforce any policies. + core.v3.RuntimeFractionalPercent shadow_enabled = 10; + + // Specify whether allow requests whose target server's IP address is more private than that from + // which the request initiator was fetched. + // + // More details refer to https://developer.chrome.com/blog/private-network-access-preflight. + google.protobuf.BoolValue allow_private_network_access = 12; + + // Specifies if preflight requests not matching the configured allowed origin should be forwarded + // to the upstream. Default is ``true``. + google.protobuf.BoolValue forward_not_matching_preflights = 13; +} + +// [#next-free-field: 46] +message RouteAction { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.RouteAction"; + + enum ClusterNotFoundResponseCode { + // HTTP status code - 503 Service Unavailable. + SERVICE_UNAVAILABLE = 0; + + // HTTP status code - 404 Not Found. + NOT_FOUND = 1; + + // HTTP status code - 500 Internal Server Error. + INTERNAL_SERVER_ERROR = 2; + } + + // Configures :ref:`internal redirect ` behavior. + // [#next-major-version: remove this definition - it's defined in the InternalRedirectPolicy message.] + enum InternalRedirectAction { + PASS_THROUGH_INTERNAL_REDIRECT = 0; + HANDLE_INTERNAL_REDIRECT = 1; + } + + // The router is capable of shadowing traffic from one cluster to another. The current + // implementation is "fire and forget," meaning Envoy will not wait for the shadow cluster to + // respond before returning the response from the primary cluster. All normal statistics are + // collected for the shadow cluster making this feature useful for testing. + // + // During shadowing, the host/authority header is altered such that ``-shadow`` is appended. This is + // useful for logging. For example, ``cluster1`` becomes ``cluster1-shadow``. This behavior can be + // disabled by setting ``disable_shadow_host_suffix_append`` to ``true``. + // + // .. note:: + // + // Shadowing will not be triggered if the primary cluster does not exist. + // + // .. note:: + // + // Shadowing doesn't support HTTP CONNECT and upgrades. + // [#next-free-field: 9] + message RequestMirrorPolicy { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RouteAction.RequestMirrorPolicy"; + + reserved 2; + + reserved "runtime_key"; + + // Only one of ``cluster`` and ``cluster_header`` can be specified. + // [#next-major-version: Need to add back the validation rule: (validate.rules).string = {min_len: 1}] + // Specifies the cluster that requests will be mirrored to. The cluster must + // exist in the cluster manager configuration. + string cluster = 1 [(udpa.annotations.field_migrate).oneof_promotion = "cluster_specifier"]; + + // Only one of ``cluster`` and ``cluster_header`` can be specified. + // Envoy will determine the cluster to route to by reading the value of the + // HTTP header named by cluster_header from the request headers. Only the first value in header is used, + // and no shadow request will happen if the value is not found in headers. Envoy will not wait for + // the shadow cluster to respond before returning the response from the primary cluster. + // + // .. attention:: + // + // Internally, Envoy always uses the HTTP/2 ``:authority`` header to represent the HTTP/1 + // ``Host`` header. Thus, if attempting to match on ``Host``, match on ``:authority`` instead. + // + // .. note:: + // + // If the header appears multiple times only the first value is used. + string cluster_header = 5 [ + (validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false}, + (udpa.annotations.field_migrate).oneof_promotion = "cluster_specifier" + ]; + + // If not specified, all requests to the target cluster will be mirrored. + // + // If specified, this field takes precedence over the ``runtime_key`` field and requests must also + // fall under the percentage of matches indicated by this field. + // + // For some fraction N/D, a random number in the range [0,D) is selected. If the + // number is <= the value of the numerator N, or if the key is not present, the default + // value, the request will be mirrored. + core.v3.RuntimeFractionalPercent runtime_fraction = 3; + + // Specifies whether the trace span for the shadow request should be sampled. If this field is not explicitly set, + // the shadow request will inherit the sampling decision of its parent span. This ensures consistency with the trace + // sampling policy of the original request and prevents oversampling, especially in scenarios where runtime sampling + // is disabled. + google.protobuf.BoolValue trace_sampled = 4; + + // Disables appending the ``-shadow`` suffix to the shadowed ``Host`` header. + // + // Defaults to ``false``. + bool disable_shadow_host_suffix_append = 6; + + // Specifies a list of header mutations that should be applied to each mirrored request. + // Header mutations are applied in the order they are specified. For more information, including + // details on header value syntax, see the documentation on :ref:`custom request headers + // `. + repeated common.mutation_rules.v3.HeaderMutation request_headers_mutations = 7 + [(validate.rules).repeated = {max_items: 1000}]; + + // Indicates that during mirroring, the host header will be swapped with this value. + // :ref:`disable_shadow_host_suffix_append + // ` + // is implicitly enabled if this field is set. + string host_rewrite_literal = 8 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE strict: false}]; + } + + // Specifies the route's hashing policy if the upstream cluster uses a hashing :ref:`load balancer + // `. + // [#next-free-field: 7] + message HashPolicy { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RouteAction.HashPolicy"; + + message Header { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RouteAction.HashPolicy.Header"; + + // The name of the request header that will be used to obtain the hash + // key. If the request header is not present, no hash will be produced. + string header_name = 1 + [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // If specified, the request header value will be rewritten and used + // to produce the hash key. + type.matcher.v3.RegexMatchAndSubstitute regex_rewrite = 2; + } + + // CookieAttribute defines an API for adding additional attributes for a HTTP cookie. + message CookieAttribute { + // The name of the cookie attribute. + string name = 1 + [(validate.rules).string = + {min_len: 1 max_bytes: 16384 well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // The optional value of the cookie attribute. + string value = 2 [(validate.rules).string = + {max_bytes: 16384 well_known_regex: HTTP_HEADER_VALUE strict: false}]; + } + + // Envoy supports two types of cookie affinity: + // + // 1. Passive. Envoy takes a cookie that's present in the cookies header and + // hashes on its value. + // + // 2. Generated. Envoy generates and sets a cookie with an expiration (TTL) + // on the first request from the client in its response to the client, + // based on the endpoint the request gets sent to. The client then + // presents this on the next and all subsequent requests. The hash of + // this is sufficient to ensure these requests get sent to the same + // endpoint. The cookie is generated by hashing the source and + // destination ports and addresses so that multiple independent HTTP2 + // streams on the same connection will independently receive the same + // cookie, even if they arrive at the Envoy simultaneously. + message Cookie { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RouteAction.HashPolicy.Cookie"; + + // The name of the cookie that will be used to obtain the hash key. If the + // cookie is not present and ttl below is not set, no hash will be + // produced. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // If specified, a cookie with the TTL will be generated if the cookie is + // not present. If the TTL is present and zero, the generated cookie will + // be a session cookie. + google.protobuf.Duration ttl = 2; + + // The name of the path for the cookie. If no path is specified here, no path + // will be set for the cookie. + string path = 3; + + // Additional attributes for the cookie. They will be used when generating a new cookie. + repeated CookieAttribute attributes = 4; + } + + message ConnectionProperties { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RouteAction.HashPolicy.ConnectionProperties"; + + // Hash on source IP address. + bool source_ip = 1; + } + + message QueryParameter { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RouteAction.HashPolicy.QueryParameter"; + + // The name of the URL query parameter that will be used to obtain the hash + // key. If the parameter is not present, no hash will be produced. Query + // parameter names are case-sensitive. If query parameters are repeated, only + // the first value will be considered. + string name = 1 [(validate.rules).string = {min_len: 1}]; + } + + message FilterState { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RouteAction.HashPolicy.FilterState"; + + // The name of the Object in the per-request filterState, which is an + // Envoy::Hashable object. If there is no data associated with the key, + // or the stored object is not Envoy::Hashable, no hash will be produced. + string key = 1 [(validate.rules).string = {min_len: 1}]; + } + + oneof policy_specifier { + option (validate.required) = true; + + // Header hash policy. + Header header = 1; + + // Cookie hash policy. + Cookie cookie = 2; + + // Connection properties hash policy. + ConnectionProperties connection_properties = 3; + + // Query parameter hash policy. + QueryParameter query_parameter = 5; + + // Filter state hash policy. + FilterState filter_state = 6; + } + + // The flag that short-circuits the hash computing. This field provides a + // 'fallback' style of configuration: "if a terminal policy doesn't work, + // fallback to rest of the policy list", it saves time when the terminal + // policy works. + // + // If true, and there is already a hash computed, ignore rest of the + // list of hash polices. + // For example, if the following hash methods are configured: + // + // ========= ======== + // specifier terminal + // ========= ======== + // Header A true + // Header B false + // Header C false + // ========= ======== + // + // The generateHash process ends if policy "header A" generates a hash, as + // it's a terminal policy. + bool terminal = 4; + } + + // Allows enabling and disabling upgrades on a per-route basis. + // This overrides any enabled/disabled upgrade filter chain specified in the + // HttpConnectionManager + // :ref:`upgrade_configs + // ` + // but does not affect any custom filter chain specified there. + message UpgradeConfig { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RouteAction.UpgradeConfig"; + + // Configuration for sending data upstream as a raw data payload. This is used for + // CONNECT or POST requests, when forwarding request payload as raw TCP. + message ConnectConfig { + // If present, the proxy protocol header will be prepended to the CONNECT payload sent upstream. + core.v3.ProxyProtocolConfig proxy_protocol_config = 1; + + // If set, the route will also allow forwarding POST payload as raw TCP. + bool allow_post = 2; + } + + // The case-insensitive name of this upgrade, for example, "websocket". + // For each upgrade type present in upgrade_configs, requests with + // Upgrade: [upgrade_type] will be proxied upstream. + string upgrade_type = 1 + [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_VALUE strict: false}]; + + // Determines if upgrades are available on this route. + // + // Defaults to ``true``. + google.protobuf.BoolValue enabled = 2; + + // Configuration for sending data upstream as a raw data payload. This is used for + // CONNECT requests, when forwarding CONNECT payload as raw TCP. + // Note that CONNECT support is currently considered alpha in Envoy. + // [#comment: TODO(htuch): Replace the above comment with an alpha tag.] + ConnectConfig connect_config = 3; + } + + message MaxStreamDuration { + // Specifies the maximum duration allowed for streams on the route. If not specified, the value + // from the :ref:`max_stream_duration + // ` field in + // :ref:`HttpConnectionManager.common_http_protocol_options + // ` + // is used. If this field is set explicitly to zero, any + // HttpConnectionManager max_stream_duration timeout will be disabled for + // this route. + google.protobuf.Duration max_stream_duration = 1; + + // If present, and the request contains a `grpc-timeout header + // `_, use that value as the + // ``max_stream_duration``, but limit the applied timeout to the maximum value specified here. + // If set to 0, the ``grpc-timeout`` header is used without modification. + google.protobuf.Duration grpc_timeout_header_max = 2; + + // If present, Envoy will adjust the timeout provided by the ``grpc-timeout`` header by + // subtracting the provided duration from the header. This is useful for allowing Envoy to set + // its global timeout to be less than that of the deadline imposed by the calling client, which + // makes it more likely that Envoy will handle the timeout instead of having the call canceled + // by the client. If, after applying the offset, the resulting timeout is zero or negative, + // the stream will timeout immediately. + google.protobuf.Duration grpc_timeout_header_offset = 3; + } + + reserved 12, 18, 19, 16, 22, 21, 10; + + reserved "request_mirror_policy"; + + oneof cluster_specifier { + option (validate.required) = true; + + // Indicates the upstream cluster to which the request should be routed + // to. + string cluster = 1 [(validate.rules).string = {min_len: 1}]; + + // Envoy will determine the cluster to route to by reading the value of the + // HTTP header named by cluster_header from the request headers. If the + // header is not found or the referenced cluster does not exist, Envoy will + // return a 404 response. + // + // .. attention:: + // + // Internally, Envoy always uses the HTTP/2 ``:authority`` header to represent the HTTP/1 + // ``Host`` header. Thus, if attempting to match on ``Host``, match on ``:authority`` instead. + // + // .. note:: + // + // If the header appears multiple times only the first value is used. + string cluster_header = 2 + [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // Multiple upstream clusters can be specified for a given route. The + // request is routed to one of the upstream clusters based on weights + // assigned to each cluster. See + // :ref:`traffic splitting ` + // for additional documentation. + WeightedCluster weighted_clusters = 3; + + // Name of the cluster specifier plugin to use to determine the cluster for requests on this route. + // The cluster specifier plugin name must be defined in the associated + // :ref:`cluster specifier plugins ` + // in the :ref:`name ` field. + string cluster_specifier_plugin = 37; + + // Custom cluster specifier plugin configuration to use to determine the cluster for requests + // on this route. + ClusterSpecifierPlugin inline_cluster_specifier_plugin = 39; + } + + // The HTTP status code to use when configured cluster is not found. + // The default response code is 503 Service Unavailable. + ClusterNotFoundResponseCode cluster_not_found_response_code = 20 + [(validate.rules).enum = {defined_only: true}]; + + // Optional endpoint metadata match criteria used by the subset load balancer. Only endpoints + // in the upstream cluster with metadata matching what's set in this field will be considered + // for load balancing. If using :ref:`weighted_clusters + // `, metadata will be merged, with values + // provided there taking precedence. The filter name should be specified as ``envoy.lb``. + core.v3.Metadata metadata_match = 4; + + // Indicates that during forwarding, the matched prefix (or path) should be + // swapped with this value. This option allows application URLs to be rooted + // at a different path from those exposed at the reverse proxy layer. The router filter will + // place the original path before rewrite into the :ref:`x-envoy-original-path + // ` header. + // + // Only one of :ref:`regex_rewrite `, + // :ref:`path_rewrite_policy `, + // :ref:`path_rewrite `, + // or :ref:`prefix_rewrite ` + // may be specified. + // + // .. attention:: + // + // Pay careful attention to the use of trailing slashes in the + // :ref:`route's match ` prefix value. + // Stripping a prefix from a path requires multiple Routes to handle all cases. For example, + // rewriting ``/prefix`` to ``/`` and ``/prefix/etc`` to ``/etc`` cannot be done in a single + // :ref:`Route `, as shown by the below config entries: + // + // .. code-block:: yaml + // + // - match: + // prefix: "/prefix/" + // route: + // prefix_rewrite: "/" + // - match: + // prefix: "/prefix" + // route: + // prefix_rewrite: "/" + // + // Having above entries in the config, requests to ``/prefix`` will be stripped to ``/``, while + // requests to ``/prefix/etc`` will be stripped to ``/etc``. + string prefix_rewrite = 5 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE strict: false}]; + + // Indicates that during forwarding, portions of the path that match the + // pattern should be rewritten, even allowing the substitution of capture + // groups from the pattern into the new path as specified by the rewrite + // substitution string. This is useful to allow application paths to be + // rewritten in a way that is aware of segments with variable content like + // identifiers. The router filter will place the original path as it was + // before the rewrite into the :ref:`x-envoy-original-path + // ` header. + // + // Only one of :ref:`regex_rewrite `, + // :ref:`path_rewrite_policy `, + // :ref:`path_rewrite `, + // or :ref:`prefix_rewrite ` + // may be specified. + // + // Examples using Google's `RE2 `_ engine: + // + // * The path pattern ``^/service/([^/]+)(/.*)$`` paired with a substitution + // string of ``\2/instance/\1`` would transform ``/service/foo/v1/api`` + // into ``/v1/api/instance/foo``. + // + // * The pattern ``one`` paired with a substitution string of ``two`` would + // transform ``/xxx/one/yyy/one/zzz`` into ``/xxx/two/yyy/two/zzz``. + // + // * The pattern ``^(.*?)one(.*)$`` paired with a substitution string of + // ``\1two\2`` would replace only the first occurrence of ``one``, + // transforming path ``/xxx/one/yyy/one/zzz`` into ``/xxx/two/yyy/one/zzz``. + // + // * The pattern ``(?i)/xxx/`` paired with a substitution string of ``/yyy/`` + // would do a case-insensitive match and transform path ``/aaa/XxX/bbb`` to + // ``/aaa/yyy/bbb``. + type.matcher.v3.RegexMatchAndSubstitute regex_rewrite = 32; + + // [#extension-category: envoy.path.rewrite] + core.v3.TypedExtensionConfig path_rewrite_policy = 41; + + // Rewrites the whole path (without query parameters) with the given path value. + // The router filter will + // place the original path before rewrite into the :ref:`x-envoy-original-path + // ` header. + // + // Only one of :ref:`regex_rewrite `, + // :ref:`path_rewrite_policy `, + // :ref:`path_rewrite `, + // or :ref:`prefix_rewrite ` + // may be specified. + // + // The :ref:`substitution format specifier ` could be applied here. + // For example, with the following config: + // + // .. code-block:: yaml + // + // path_rewrite: "/new_path_prefix%REQ(custom-path-header-name)%" + // + // Would rewrite the path to ``/new_path_prefix/some_value`` given the header + // ``custom-path-header-name: some_value``. If the header is not present, the path will be + // rewritten to ``/new_path_prefix``. + // + // + // If the final output of the path rewrite is empty, then the update will be ignored and the + // original path will be preserved. + string path_rewrite = 45; + + // If one of the host rewrite specifiers is set and the + // :ref:`suppress_envoy_headers + // ` flag is not + // set to true, the router filter will place the original host header value before + // rewriting into the :ref:`x-envoy-original-host + // ` header. + // + // And if the + // :ref:`append_x_forwarded_host ` + // is set to true, the original host value will also be appended to the + // :ref:`config_http_conn_man_headers_x-forwarded-host` header. + // + oneof host_rewrite_specifier { + // Indicates that during forwarding, the host header will be swapped with + // this value. + string host_rewrite_literal = 6 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE strict: false}]; + + // Indicates that during forwarding, the host header will be swapped with + // the hostname of the upstream host chosen by the cluster manager. This + // option is applicable only when the destination cluster for a route is of + // type ``strict_dns`` or ``logical_dns``, + // or when :ref:`hostname ` + // field is not empty. Setting this to true with other cluster types + // has no effect. + google.protobuf.BoolValue auto_host_rewrite = 7; + + // Indicates that during forwarding, the host header will be swapped with the content of given + // downstream or :ref:`custom ` header. + // If header value is empty, host header is left intact. + // + // .. attention:: + // + // Pay attention to the potential security implications of using this option. Provided header + // must come from trusted source. + // + // .. note:: + // + // If the header appears multiple times only the first value is used. + string host_rewrite_header = 29 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // Indicates that during forwarding, the host header will be swapped with + // the result of the regex substitution executed on path value with query and fragment removed. + // This is useful for transitioning variable content between path segment and subdomain. + // + // For example with the following config: + // + // .. code-block:: yaml + // + // host_rewrite_path_regex: + // pattern: + // google_re2: {} + // regex: "^/(.+)/.+$" + // substitution: \1 + // + // Would rewrite the host header to ``envoyproxy.io`` given the path ``/envoyproxy.io/some/path``. + type.matcher.v3.RegexMatchAndSubstitute host_rewrite_path_regex = 35; + + // Rewrites the host header with the value of this field. The router filter will + // place the original host header value before rewriting into the :ref:`x-envoy-original-host + // ` header. + // + // The :ref:`substitution format specifier ` could be applied here. + // For example, with the following config: + // + // .. code-block:: yaml + // + // host_rewrite: "prefix-%REQ(custom-host-header-name)%" + // + // Would rewrite the host header to ``prefix-some_value`` given the header + // ``custom-host-header-name: some_value``. If the header is not present, the host header will + // be rewritten to an value of ``prefix-``. + // + // If the final output of the host rewrite is empty, then the update will be ignored and the + // original host header will be preserved. + string host_rewrite = 44; + } + + // If set, then a host rewrite action (one of + // :ref:`host_rewrite_literal `, + // :ref:`auto_host_rewrite `, + // :ref:`host_rewrite_header `, or + // :ref:`host_rewrite_path_regex `) + // causes the original value of the host header, if any, to be appended to the + // :ref:`config_http_conn_man_headers_x-forwarded-host` HTTP header if it is different to the last value appended. + bool append_x_forwarded_host = 38; + + // Specifies the upstream timeout for the route. If not specified, the default is 15s. This + // spans between the point at which the entire downstream request (i.e. end-of-stream) has been + // processed and when the upstream response has been completely processed. A value of 0 will + // disable the route's timeout. + // + // .. note:: + // + // This timeout includes all retries. See also + // :ref:`config_http_filters_router_x-envoy-upstream-rq-timeout-ms`, + // :ref:`config_http_filters_router_x-envoy-upstream-rq-per-try-timeout-ms`, and the + // :ref:`retry overview `. + google.protobuf.Duration timeout = 8; + + // Specifies the idle timeout for the route. If not specified, there is no per-route idle timeout, + // although the connection manager wide :ref:`stream_idle_timeout + // ` + // will still apply. A value of 0 will completely disable the route's idle timeout, even if a + // connection manager stream idle timeout is configured. + // + // The idle timeout is distinct to :ref:`timeout + // `, which provides an upper bound + // on the upstream response time; :ref:`idle_timeout + // ` instead bounds the amount + // of time the request's stream may be idle. + // + // After header decoding, the idle timeout will apply on downstream and + // upstream request events. Each time an encode/decode event for headers or + // data is processed for the stream, the timer will be reset. If the timeout + // fires, the stream is terminated with a 408 Request Timeout error code if no + // upstream response header has been received, otherwise a stream reset + // occurs. + // + // If the :ref:`overload action ` "envoy.overload_actions.reduce_timeouts" + // is configured, this timeout is scaled according to the value for + // :ref:`HTTP_DOWNSTREAM_STREAM_IDLE `. + // + // This timeout may also be used in place of ``flush_timeout`` in very specific cases. See the + // documentation for ``flush_timeout`` for more details. + google.protobuf.Duration idle_timeout = 24; + + // Specifies the codec stream flush timeout for the route. + // + // If not specified, the first preference is the global :ref:`stream_flush_timeout + // `, + // but only if explicitly configured. + // + // If neither the explicit HCM-wide flush timeout nor this route-specific flush timeout is configured, + // the route's stream idle timeout is reused for this timeout. This is for + // backwards compatibility since both behaviors were historically controlled by the one timeout. + // + // If the route also does not have an idle timeout configured, the global :ref:`stream_idle_timeout + // `. used, again + // for backwards compatibility. That timeout defaults to 5 minutes. + // + // A value of 0 via any of the above paths will completely disable the timeout for a given route. + google.protobuf.Duration flush_timeout = 42; + + // Specifies how to send request over TLS early data. + // If absent, allows `safe HTTP requests `_ to be sent on early data. + // [#extension-category: envoy.route.early_data_policy] + core.v3.TypedExtensionConfig early_data_policy = 40; + + // Indicates that the route has a retry policy. Note that if this is set, + // it'll take precedence over the virtual host level retry policy entirely + // (e.g., policies are not merged, the most internal one becomes the enforced policy). + RetryPolicy retry_policy = 9; + + // [#not-implemented-hide:] + // Specifies the configuration for retry policy extension. Note that if this is set, it'll take + // precedence over the virtual host level retry policy entirely (e.g., policies are not merged, + // the most internal one becomes the enforced policy). :ref:`Retry policy ` + // should not be set if this field is used. + google.protobuf.Any retry_policy_typed_config = 33; + + // Specify a set of route request mirroring policies. + // It takes precedence over the virtual host and route config mirror policy entirely. + // That is, policies are not merged, the most specific non-empty one becomes the mirror policies. + repeated RequestMirrorPolicy request_mirror_policies = 30; + + // Optionally specifies the :ref:`routing priority `. + core.v3.RoutingPriority priority = 11 [(validate.rules).enum = {defined_only: true}]; + + // Specifies a set of rate limit configurations that could be applied to the + // route. + repeated RateLimit rate_limits = 13; + + // Specifies if the rate limit filter should include the virtual host rate + // limits. By default, if the route configured rate limits, the virtual host + // :ref:`rate_limits ` are not applied to the + // request. + // + // .. attention:: + // + // This field is deprecated. Please use :ref:`vh_rate_limits ` + google.protobuf.BoolValue include_vh_rate_limits = 14 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Specifies a list of hash policies to use for ring hash load balancing. Each + // hash policy is evaluated individually and the combined result is used to + // route the request. The method of combination is deterministic such that + // identical lists of hash policies will produce the same hash. Since a hash + // policy examines specific parts of a request, it can fail to produce a hash + // (i.e. if the hashed header is not present). If (and only if) all configured + // hash policies fail to generate a hash, no hash will be produced for + // the route. In this case, the behavior is the same as if no hash policies + // were specified (i.e. the ring hash load balancer will choose a random + // backend). If a hash policy has the "terminal" attribute set to true, and + // there is already a hash generated, the hash is returned immediately, + // ignoring the rest of the hash policy list. + repeated HashPolicy hash_policy = 15; + + // Indicates that the route has a CORS policy. This field is ignored if related cors policy is + // found in the :ref:`Route.typed_per_filter_config` or + // :ref:`WeightedCluster.ClusterWeight.typed_per_filter_config`. + // + // .. attention:: + // + // This option has been deprecated. Please use + // :ref:`Route.typed_per_filter_config` or + // :ref:`WeightedCluster.ClusterWeight.typed_per_filter_config` + // to configure the CORS HTTP filter. + CorsPolicy cors = 17 [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Deprecated by :ref:`grpc_timeout_header_max ` + // If present, and the request is a gRPC request, use the + // `grpc-timeout header `_, + // or its default value (infinity) instead of + // :ref:`timeout `, but limit the applied timeout + // to the maximum value specified here. If configured as 0, the maximum allowed timeout for + // gRPC requests is infinity. If not configured at all, the ``grpc-timeout`` header is not used + // and gRPC requests time out like any other requests using + // :ref:`timeout ` or its default. + // This can be used to prevent unexpected upstream request timeouts due to potentially long + // time gaps between gRPC request and response in gRPC streaming mode. + // + // .. note:: + // + // If a timeout is specified using :ref:`config_http_filters_router_x-envoy-upstream-rq-timeout-ms`, it takes + // precedence over `grpc-timeout header `_, when + // both are present. See also + // :ref:`config_http_filters_router_x-envoy-upstream-rq-timeout-ms`, + // :ref:`config_http_filters_router_x-envoy-upstream-rq-per-try-timeout-ms`, and the + // :ref:`retry overview `. + google.protobuf.Duration max_grpc_timeout = 23 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Deprecated by :ref:`grpc_timeout_header_offset `. + // If present, Envoy will adjust the timeout provided by the ``grpc-timeout`` header by subtracting + // the provided duration from the header. This is useful in allowing Envoy to set its global + // timeout to be less than that of the deadline imposed by the calling client, which makes it more + // likely that Envoy will handle the timeout instead of having the call canceled by the client. + // The offset will only be applied if the provided grpc_timeout is greater than the offset. This + // ensures that the offset will only ever decrease the timeout and never set it to 0 (meaning + // infinity). + google.protobuf.Duration grpc_timeout_offset = 28 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + repeated UpgradeConfig upgrade_configs = 25; + + // If present, Envoy will try to follow an upstream redirect response instead of proxying the + // response back to the downstream. An upstream redirect response is defined + // by :ref:`redirect_response_codes + // `. + InternalRedirectPolicy internal_redirect_policy = 34; + + InternalRedirectAction internal_redirect_action = 26 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // An internal redirect is handled, iff the number of previous internal redirects that a + // downstream request has encountered is lower than this value, and + // :ref:`internal_redirect_action ` + // is set to :ref:`HANDLE_INTERNAL_REDIRECT + // ` + // In the case where a downstream request is bounced among multiple routes by internal redirect, + // the first route that hits this threshold, or has + // :ref:`internal_redirect_action ` + // set to + // :ref:`PASS_THROUGH_INTERNAL_REDIRECT + // ` + // will pass the redirect back to downstream. + // + // If not specified, at most one redirect will be followed. + google.protobuf.UInt32Value max_internal_redirects = 31 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Indicates that the route has a hedge policy. Note that if this is set, + // it'll take precedence over the virtual host level hedge policy entirely + // (e.g., policies are not merged, the most internal one becomes the enforced policy). + HedgePolicy hedge_policy = 27; + + // Specifies the maximum stream duration for this route. + MaxStreamDuration max_stream_duration = 36; +} + +// HTTP retry :ref:`architecture overview `. +// [#next-free-field: 15] +message RetryPolicy { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.RetryPolicy"; + + enum ResetHeaderFormat { + SECONDS = 0; + UNIX_TIMESTAMP = 1; + } + + message RetryPriority { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RetryPolicy.RetryPriority"; + + reserved 2; + + reserved "config"; + + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // [#extension-category: envoy.retry_priorities] + oneof config_type { + google.protobuf.Any typed_config = 3; + } + } + + message RetryHostPredicate { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RetryPolicy.RetryHostPredicate"; + + reserved 2; + + reserved "config"; + + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // [#extension-category: envoy.retry_host_predicates] + oneof config_type { + google.protobuf.Any typed_config = 3; + } + } + + message RetryBackOff { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RetryPolicy.RetryBackOff"; + + // Specifies the base interval between retries. This parameter is required and must be greater + // than zero. Values less than 1 ms are rounded up to 1 ms. + // See :ref:`config_http_filters_router_x-envoy-max-retries` for a discussion of Envoy's + // back-off algorithm. + google.protobuf.Duration base_interval = 1 [(validate.rules).duration = { + required: true + gt {} + }]; + + // Specifies the maximum interval between retries. This parameter is optional, but must be + // greater than or equal to the ``base_interval`` if set. The default is 10 times the + // ``base_interval``. See :ref:`config_http_filters_router_x-envoy-max-retries` for a discussion + // of Envoy's back-off algorithm. + google.protobuf.Duration max_interval = 2 [(validate.rules).duration = {gt {}}]; + } + + message ResetHeader { + // The name of the reset header. + // + // .. note:: + // + // If the header appears multiple times only the first value is used. + string name = 1 + [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // The format of the reset header. + ResetHeaderFormat format = 2 [(validate.rules).enum = {defined_only: true}]; + } + + // A retry back-off strategy that applies when the upstream server rate limits + // the request. + // + // Given this configuration: + // + // .. code-block:: yaml + // + // rate_limited_retry_back_off: + // reset_headers: + // - name: Retry-After + // format: SECONDS + // - name: X-RateLimit-Reset + // format: UNIX_TIMESTAMP + // max_interval: "300s" + // + // The following algorithm will apply: + // + // 1. If the response contains the header ``Retry-After`` its value must be on + // the form ``120`` (an integer that represents the number of seconds to + // wait before retrying). If so, this value is used as the back-off interval. + // 2. Otherwise, if the response contains the header ``X-RateLimit-Reset`` its + // value must be on the form ``1595320702`` (an integer that represents the + // point in time at which to retry, as a Unix timestamp in seconds). If so, + // the current time is subtracted from this value and the result is used as + // the back-off interval. + // 3. Otherwise, Envoy will use the default + // :ref:`exponential back-off ` + // strategy. + // + // No matter which format is used, if the resulting back-off interval exceeds + // ``max_interval`` it is discarded and the next header in ``reset_headers`` + // is tried. If a request timeout is configured for the route it will further + // limit how long the request will be allowed to run. + // + // To prevent many clients retrying at the same point in time jitter is added + // to the back-off interval, so the resulting interval is decided by taking: + // ``random(interval, interval * 1.5)``. + // + // .. attention:: + // + // Configuring ``rate_limited_retry_back_off`` will not by itself cause a request + // to be retried. You will still need to configure the right retry policy to match + // the responses from the upstream server. + message RateLimitedRetryBackOff { + // Specifies the reset headers (like ``Retry-After`` or ``X-RateLimit-Reset``) + // to match against the response. Headers are tried in order, and matched case + // insensitive. The first header to be parsed successfully is used. If no headers + // match the default exponential back-off is used instead. + repeated ResetHeader reset_headers = 1 [(validate.rules).repeated = {min_items: 1}]; + + // Specifies the maximum back off interval that Envoy will allow. If a reset + // header contains an interval longer than this then it will be discarded and + // the next header will be tried. + // + // Defaults to 300 seconds. + google.protobuf.Duration max_interval = 2 [(validate.rules).duration = {gt {}}]; + } + + // Specifies the conditions under which retry takes place. These are the same + // conditions documented for :ref:`config_http_filters_router_x-envoy-retry-on` and + // :ref:`config_http_filters_router_x-envoy-retry-grpc-on`. + string retry_on = 1; + + // Specifies the allowed number of retries. This parameter is optional and + // defaults to 1. These are the same conditions documented for + // :ref:`config_http_filters_router_x-envoy-max-retries`. + google.protobuf.UInt32Value num_retries = 2 + [(udpa.annotations.field_migrate).rename = "max_retries"]; + + // Specifies a non-zero upstream timeout per retry attempt (including the initial attempt). This + // parameter is optional. The same conditions documented for + // :ref:`config_http_filters_router_x-envoy-upstream-rq-per-try-timeout-ms` apply. + // + // .. note:: + // + // If left unspecified, Envoy will use the global + // :ref:`route timeout ` for the request. + // Consequently, when using a :ref:`5xx ` based + // retry policy, a request that times out will not be retried as the total timeout budget + // would have been exhausted. + google.protobuf.Duration per_try_timeout = 3; + + // Specifies an upstream idle timeout per retry attempt (including the initial attempt). This + // parameter is optional and if absent there is no per-try idle timeout. The semantics of the per- + // try idle timeout are similar to the + // :ref:`route idle timeout ` and + // :ref:`stream idle timeout + // ` + // both enforced by the HTTP connection manager. The difference is that this idle timeout + // is enforced by the router for each individual attempt and thus after all previous filters have + // run, as opposed to *before* all previous filters run for the other idle timeouts. This timeout + // is useful in cases in which total request timeout is bounded by a number of retries and a + // :ref:`per_try_timeout `, but + // there is a desire to ensure each try is making incremental progress. Note also that similar + // to :ref:`per_try_timeout `, + // this idle timeout does not start until after both the entire request has been received by the + // router *and* a connection pool connection has been obtained. Unlike + // :ref:`per_try_timeout `, + // the idle timer continues once the response starts streaming back to the downstream client. + // This ensures that response data continues to make progress without using one of the HTTP + // connection manager idle timeouts. + google.protobuf.Duration per_try_idle_timeout = 13; + + // Specifies an implementation of a RetryPriority which is used to determine the + // distribution of load across priorities used for retries. Refer to + // :ref:`retry plugin configuration ` for more details. + RetryPriority retry_priority = 4; + + // Specifies a collection of RetryHostPredicates that will be consulted when selecting a host + // for retries. If any of the predicates reject the host, host selection will be reattempted. + // Refer to :ref:`retry plugin configuration ` for more + // details. + repeated RetryHostPredicate retry_host_predicate = 5; + + // Retry options predicates that will be applied prior to retrying a request. These predicates + // allow customizing request behavior between retries. + // [#comment: add [#extension-category: envoy.retry_options_predicates] when there are built-in extensions] + repeated core.v3.TypedExtensionConfig retry_options_predicates = 12; + + // The maximum number of times host selection will be reattempted before giving up, at which + // point the host that was last selected will be routed to. If unspecified, this will default to + // retrying once. + int64 host_selection_retry_max_attempts = 6; + + // HTTP status codes that should trigger a retry in addition to those specified by retry_on. + repeated uint32 retriable_status_codes = 7; + + // Specifies parameters that control exponential retry back off. This parameter is optional, in which case the + // default base interval is 25 milliseconds or, if set, the current value of the + // ``upstream.base_retry_backoff_ms`` runtime parameter. The default maximum interval is 10 times + // the base interval. The documentation for :ref:`config_http_filters_router_x-envoy-max-retries` + // describes Envoy's back-off algorithm. + RetryBackOff retry_back_off = 8; + + // Specifies parameters that control a retry back-off strategy that is used + // when the request is rate limited by the upstream server. The server may + // return a response header like ``Retry-After`` or ``X-RateLimit-Reset`` to + // provide feedback to the client on how long to wait before retrying. If + // configured, this back-off strategy will be used instead of the + // default exponential back off strategy (configured using ``retry_back_off``) + // whenever a response includes the matching headers. + RateLimitedRetryBackOff rate_limited_retry_back_off = 11; + + // HTTP response headers that trigger a retry if present in the response. A retry will be + // triggered if any of the header matches match the upstream response headers. + // The field is only consulted if 'retriable-headers' retry policy is active. + repeated HeaderMatcher retriable_headers = 9; + + // HTTP headers which must be present in the request for retries to be attempted. + repeated HeaderMatcher retriable_request_headers = 10; + + // By default, the target upstream cluster of a retry request is the same as the original request, + // and Envoy will not try to refresh it when retrying. + // If this field is set to true, Envoy will try to refresh the target upstream cluster when + // retrying a request. This is useful when users want to try different upstream cluster for + // each retry attempt. + // + // .. note:: + // This currently works when the route cluster specifier support the dynamic refresh, + // e.g. :ref:`matcher cluster specifier + // `, + // :ref:`priority group cluster specifier + // ` + // and :ref:`dynamic modules cluster specifier + // `. + bool refresh_cluster_on_retry = 14; +} + +// HTTP request hedging :ref:`architecture overview `. +message HedgePolicy { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.HedgePolicy"; + + // Specifies the number of initial requests that should be sent upstream. + // Must be at least 1. + // + // Defaults to 1. + // [#not-implemented-hide:] + google.protobuf.UInt32Value initial_requests = 1 [(validate.rules).uint32 = {gte: 1}]; + + // Specifies a probability that an additional upstream request should be sent + // on top of what is specified by initial_requests. + // + // Defaults to 0. + // [#not-implemented-hide:] + type.v3.FractionalPercent additional_request_chance = 2; + + // Indicates that a hedged request should be sent when the per-try timeout is hit. + // This means that a retry will be issued without resetting the original request, leaving multiple upstream requests in flight. + // The first request to complete successfully will be the one returned to the caller. + // + // * At any time, a successful response (i.e. not triggering any of the retry-on conditions) would be returned to the client. + // * Before per-try timeout, an error response (per retry-on conditions) would be retried immediately or returned to the client + // if there are no more retries left. + // * After per-try timeout, an error response would be discarded, as a retry in the form of a hedged request is already in progress. + // + // .. note:: + // + // For this to have effect, you must have a :ref:`RetryPolicy ` that retries at least + // one error code and specifies a maximum number of retries. + // + // Defaults to ``false``. + bool hedge_on_per_try_timeout = 3; +} + +// [#next-free-field: 11] +message RedirectAction { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.RedirectAction"; + + enum RedirectResponseCode { + // Moved Permanently HTTP Status Code - 301. + MOVED_PERMANENTLY = 0; + + // Found HTTP Status Code - 302. + FOUND = 1; + + // See Other HTTP Status Code - 303. + SEE_OTHER = 2; + + // Temporary Redirect HTTP Status Code - 307. + TEMPORARY_REDIRECT = 3; + + // Permanent Redirect HTTP Status Code - 308. + PERMANENT_REDIRECT = 4; + } + + // When the scheme redirection take place, the following rules apply: + // 1. If the source URI scheme is ``http`` and the port is explicitly + // set to ``:80``, the port will be removed after the redirection + // 2. If the source URI scheme is ``https`` and the port is explicitly + // set to ``:443``, the port will be removed after the redirection + oneof scheme_rewrite_specifier { + // The scheme portion of the URL will be swapped with "https". + bool https_redirect = 4; + + // The scheme portion of the URL will be swapped with this value. + string scheme_redirect = 7; + } + + // The host portion of the URL will be swapped with this value. + string host_redirect = 1 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE strict: false}]; + + // The port value of the URL will be swapped with this value. + uint32 port_redirect = 8; + + oneof path_rewrite_specifier { + // The path portion of the URL will be swapped with this value. + // Please note that query string in path_redirect will override the + // request's query string and will not be stripped. + // + // For example, let's say we have the following routes: + // + // - match: { path: "/old-path-1" } + // redirect: { path_redirect: "/new-path-1" } + // - match: { path: "/old-path-2" } + // redirect: { path_redirect: "/new-path-2", strip-query: "true" } + // - match: { path: "/old-path-3" } + // redirect: { path_redirect: "/new-path-3?foo=1", strip_query: "true" } + // + // 1. if request uri is "/old-path-1?bar=1", users will be redirected to "/new-path-1?bar=1" + // 2. if request uri is "/old-path-2?bar=1", users will be redirected to "/new-path-2" + // 3. if request uri is "/old-path-3?bar=1", users will be redirected to "/new-path-3?foo=1" + string path_redirect = 2 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE strict: false}]; + + // Indicates that during redirection, the matched prefix (or path) + // should be swapped with this value. This option allows redirect URLs be dynamically created + // based on the request. + // + // .. attention:: + // + // Pay attention to the use of trailing slashes as mentioned in + // :ref:`RouteAction's prefix_rewrite `. + string prefix_rewrite = 5 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE strict: false}]; + + // Indicates that during redirect, portions of the path that match the + // pattern should be rewritten, even allowing the substitution of capture + // groups from the pattern into the new path as specified by the rewrite + // substitution string. This is useful to allow application paths to be + // rewritten in a way that is aware of segments with variable content like + // identifiers. + // + // Examples using Google's `RE2 `_ engine: + // + // * The path pattern ``^/service/([^/]+)(/.*)$`` paired with a substitution + // string of ``\2/instance/\1`` would transform ``/service/foo/v1/api`` + // into ``/v1/api/instance/foo``. + // + // * The pattern ``one`` paired with a substitution string of ``two`` would + // transform ``/xxx/one/yyy/one/zzz`` into ``/xxx/two/yyy/two/zzz``. + // + // * The pattern ``^(.*?)one(.*)$`` paired with a substitution string of + // ``\1two\2`` would replace only the first occurrence of ``one``, + // transforming path ``/xxx/one/yyy/one/zzz`` into ``/xxx/two/yyy/one/zzz``. + // + // * The pattern ``(?i)/xxx/`` paired with a substitution string of ``/yyy/`` + // would do a case-insensitive match and transform path ``/aaa/XxX/bbb`` to + // ``/aaa/yyy/bbb``. + type.matcher.v3.RegexMatchAndSubstitute regex_rewrite = 9; + + // The path portion of the URL will be set to this value and supports + // :ref:`substitution format specifiers ` and CEL + // expressions. + // + // For example, with the following config: + // + // .. code-block:: yaml + // + // path_rewrite: "/new/%REQ(x-version)%" + // + // Would redirect to ``/new/v2`` given a request header ``x-version: v2``. + // If the substitution produces an empty string the path redirect is ignored + // and the original path is preserved. + string path_rewrite = 10; + } + + // The HTTP status code to use in the redirect response. The default response + // code is MOVED_PERMANENTLY (301). + RedirectResponseCode response_code = 3 [(validate.rules).enum = {defined_only: true}]; + + // Indicates that during redirection, the query portion of the URL will + // be removed. Default value is false. + bool strip_query = 6; +} + +message DirectResponseAction { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.DirectResponseAction"; + + // Specifies the HTTP response status to be returned. + uint32 status = 1 [(validate.rules).uint32 = {lt: 600 gte: 200}]; + + // Specifies the content of the response body. If this setting is omitted, + // no body is included in the generated response. + // + // .. note:: + // + // Headers can be specified using ``response_headers_to_add`` in the enclosing + // :ref:`envoy_v3_api_msg_config.route.v3.Route`, :ref:`envoy_v3_api_msg_config.route.v3.RouteConfiguration` or + // :ref:`envoy_v3_api_msg_config.route.v3.VirtualHost`. + core.v3.DataSource body = 2; + + // Specifies a format string for the response body. If present, the contents of + // ``body_format`` will be formatted and used as the response body, where the + // contents of ``body`` (may be empty) will be passed as the variable ``%LOCAL_REPLY_BODY%``. + // If neither are provided, no body is included in the generated response. + core.v3.SubstitutionFormatString body_format = 3; +} + +// [#not-implemented-hide:] +message NonForwardingAction { +} + +message Decorator { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.Decorator"; + + // The operation name associated with the request matched to this route. If tracing is + // enabled, this information will be used as the span name reported for this request. + // + // .. note:: + // + // For ingress (inbound) requests, or egress (outbound) responses, this value may be overridden + // by the :ref:`x-envoy-decorator-operation + // ` header. + string operation = 1 [(validate.rules).string = {min_len: 1}]; + + // Whether the decorated details should be propagated to the other party. The default is ``true``. + google.protobuf.BoolValue propagate = 2; +} + +// [#next-free-field: 7] +message Tracing { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.Tracing"; + + // Target percentage of requests managed by this HTTP connection manager that will be force + // traced if the :ref:`x-client-trace-id ` + // header is set. This field is a direct analog for the runtime variable + // 'tracing.client_enabled' in the :ref:`HTTP Connection Manager + // `. + // Default: 100% + type.v3.FractionalPercent client_sampling = 1; + + // Target percentage of requests managed by this HTTP connection manager that will be randomly + // selected for trace generation, if not requested by the client or not forced. This field is + // a direct analog for the runtime variable 'tracing.random_sampling' in the + // :ref:`HTTP Connection Manager `. + // Default: 100% + type.v3.FractionalPercent random_sampling = 2; + + // Target percentage of requests managed by this HTTP connection manager that will be traced + // after all other sampling checks have been applied (client-directed, force tracing, random + // sampling). This field functions as an upper limit on the total configured sampling rate. For + // instance, setting client_sampling to 100% but overall_sampling to 1% will result in only 1% + // of client requests with the appropriate headers to be force traced. This field is a direct + // analog for the runtime variable 'tracing.global_enabled' in the + // :ref:`HTTP Connection Manager `. + // Default: 100% + type.v3.FractionalPercent overall_sampling = 3; + + // A list of custom tags with unique tag name to create tags for the active span. + // It will take effect after merging with the :ref:`corresponding configuration + // ` + // configured in the HTTP connection manager. If two tags with the same name are configured + // each in the HTTP connection manager and the route level, the one configured here takes + // priority. + repeated type.tracing.v3.CustomTag custom_tags = 4; + + // The operation name of the span which will be used for tracing. + // + // The same :ref:`format specifier ` as used for + // :ref:`HTTP access logging ` applies here, however + // unknown specifier values are replaced with the empty string instead of ``-``. + // + // This field will take precedence over and make following settings ineffective: + // + // * :ref:`route decorator `. + // * :ref:`x-envoy-decorator-operation `. + // * :ref:`HCM tracing operation + // `. + string operation = 5; + + // The operation name of the upstream span which will be used for tracing. + // This only takes effect when ``spawn_upstream_span`` is set to true and the upstream + // span is created. + // + // The same :ref:`format specifier ` as used for + // :ref:`HTTP access logging ` applies here, however + // unknown specifier values are replaced with the empty string instead of ``-``. + // + // This field will take precedence over and make following settings ineffective: + // + // * :ref:`HCM tracing upstream operation + // ` + string upstream_operation = 6; +} + +// A virtual cluster is a way of specifying a regex matching rule against +// certain important endpoints such that statistics are generated explicitly for +// the matched requests. The reason this is useful is that when doing +// prefix/path matching Envoy does not always know what the application +// considers to be an endpoint. Thus, it’s impossible for Envoy to generically +// emit per endpoint statistics. However, often systems have highly critical +// endpoints that they wish to get “perfect” statistics on. Virtual cluster +// statistics are perfect in the sense that they are emitted on the downstream +// side such that they include network level failures. +// +// Documentation for :ref:`virtual cluster statistics `. +// +// .. note:: +// +// Virtual clusters are a useful tool, but we do not recommend setting up a virtual cluster for +// every application endpoint. This is both not easily maintainable and as well the matching and +// statistics output are not free. +message VirtualCluster { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.VirtualCluster"; + + reserved 1, 3; + + reserved "pattern", "method"; + + // Specifies a list of header matchers to use for matching requests. Each specified header must + // match. The pseudo-headers ``:path`` and ``:method`` can be used to match the request path and + // method, respectively. + repeated HeaderMatcher headers = 4; + + // Specifies the name of the virtual cluster. The virtual cluster name as well + // as the virtual host name are used when emitting statistics. The statistics are emitted by the + // router filter and are documented :ref:`here `. + string name = 2 [(validate.rules).string = {min_len: 1}]; +} + +// Global rate limiting :ref:`architecture overview `. +// Also applies to Local rate limiting :ref:`using descriptors `. +// [#next-free-field: 8] +message RateLimit { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.RateLimit"; + + enum XRateLimitOption { + // X-RateLimit headers is not specified. When this enum is used at descriptor level, + // the behavior is to inherit the setting from the filter. + UNSPECIFIED = 0; + + // X-RateLimit headers disabled. + OFF = 1; + + // Use `draft RFC Version 03 `_ + // where 3 headers will be added: + // + // * ``X-RateLimit-Limit`` - indicates the request-quota associated to the + // client in the current time-window followed by the description of the + // quota policy. The value is returned by the maximum tokens of the token bucket. + // * ``X-RateLimit-Remaining`` - indicates the remaining requests in the + // current time-window. The value is returned by the remaining tokens in the token bucket. + // * ``X-RateLimit-Reset`` - indicates the number of seconds until reset of + // the current time-window. The value is returned by the remaining fill interval of the token bucket. + DRAFT_VERSION_03 = 2; + } + + // [#next-free-field: 14] + message Action { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RateLimit.Action"; + + // The following descriptor entry is appended to the descriptor: + // + // .. code-block:: cpp + // + // ("source_cluster", "") + // + // is derived from the :option:`--service-cluster` option. + message SourceCluster { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RateLimit.Action.SourceCluster"; + } + + // The following descriptor entry is appended to the descriptor: + // + // .. code-block:: cpp + // + // ("destination_cluster", "") + // + // Once a request matches against a route table rule, a routed cluster is determined by one of + // the following :ref:`route table configuration ` + // settings: + // + // * :ref:`cluster ` indicates the upstream cluster + // to route to. + // * :ref:`weighted_clusters ` + // chooses a cluster randomly from a set of clusters with attributed weight. + // * :ref:`cluster_header ` indicates which + // header in the request contains the target cluster. + message DestinationCluster { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RateLimit.Action.DestinationCluster"; + } + + // The following descriptor entry is appended when a header contains a key that matches the + // ``header_name``: + // + // .. code-block:: cpp + // + // ("", "") + message RequestHeaders { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RateLimit.Action.RequestHeaders"; + + // The header name to be queried from the request headers. The header’s + // value is used to populate the value of the descriptor entry for the + // descriptor_key. + string header_name = 1 + [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // The key to use in the descriptor entry. + string descriptor_key = 2 [(validate.rules).string = {min_len: 1}]; + + // Controls the behavior when the specified header is not present in the request. + // + // If set to ``false`` (default): + // + // * Envoy does **NOT** call the rate limiting service for this descriptor. + // * Useful if the header is optional and you prefer to skip rate limiting when it's absent. + // + // If set to ``true``: + // + // * Envoy calls the rate limiting service but omits this descriptor if the header is missing. + // * Useful if you want Envoy to enforce rate limiting even when the header is not present. + // + bool skip_if_absent = 3; + } + + // The following descriptor entry is appended when a query parameter contains a key that matches the + // ``query_parameter_name``: + // + // .. code-block:: cpp + // + // ("", "") + message QueryParameters { + // The name of the query parameter to use for rate limiting. Value of this query parameter is used to populate + // the value of the descriptor entry for the descriptor_key. + string query_parameter_name = 1 [(validate.rules).string = {min_len: 1}]; + + // The key to use when creating the rate limit descriptor entry. This descriptor key will be used to identify the + // rate limit rule in the rate limiting service. + string descriptor_key = 2 [(validate.rules).string = {min_len: 1}]; + + // Controls the behavior when the specified query parameter is not present in the request. + // + // If set to ``false`` (default): + // + // * Envoy does **NOT** call the rate limiting service for this descriptor. + // * Useful if the query parameter is optional and you prefer to skip rate limiting when it's absent. + // + // If set to ``true``: + // + // * Envoy calls the rate limiting service but omits this descriptor if the query parameter is missing. + // * Useful if you want Envoy to enforce rate limiting even when the query parameter is not present. + // + bool skip_if_absent = 3; + } + + // The following descriptor entry is appended to the descriptor and is populated using the + // trusted address from :ref:`x-forwarded-for `: + // + // .. code-block:: cpp + // + // ("remote_address", "") + message RemoteAddress { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RateLimit.Action.RemoteAddress"; + } + + // The following descriptor entry is appended to the descriptor and is populated using the + // masked address from :ref:`x-forwarded-for `: + // + // .. code-block:: cpp + // + // ("masked_remote_address", "") + message MaskedRemoteAddress { + // Length of prefix mask len for IPv4 (e.g. 0, 32). + // + // Defaults to 32 when unset. + // + // For example, trusted address from x-forwarded-for is ``192.168.1.1``, + // the descriptor entry is ("masked_remote_address", "192.168.1.1/32"); + // if mask len is 24, the descriptor entry is ("masked_remote_address", "192.168.1.0/24"). + google.protobuf.UInt32Value v4_prefix_mask_len = 1 [(validate.rules).uint32 = {lte: 32}]; + + // Length of prefix mask len for IPv6 (e.g. 0, 128). + // + // Defaults to 128 when unset. + // + // For example, trusted address from x-forwarded-for is ``2001:abcd:ef01:2345:6789:abcd:ef01:234``, + // the descriptor entry is ("masked_remote_address", "2001:abcd:ef01:2345:6789:abcd:ef01:234/128"); + // if mask len is 64, the descriptor entry is ("masked_remote_address", "2001:abcd:ef01:2345::/64"). + google.protobuf.UInt32Value v6_prefix_mask_len = 2 [(validate.rules).uint32 = {lte: 128}]; + } + + // The following descriptor entry is appended to the descriptor: + // + // .. code-block:: cpp + // + // ("generic_key", "") + message GenericKey { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RateLimit.Action.GenericKey"; + + // Descriptor value of entry. + // + // The same :ref:`format specifier ` as used for + // :ref:`HTTP access logging ` applies here, however + // unknown specifier values are replaced with the empty string instead of ``-``. + // + // .. note:: + // + // Formatter parsing is controlled by the runtime feature flag + // ``envoy.reloadable_features.enable_formatter_for_ratelimit_action_descriptor_value`` + // (disabled by default). + // + // When enabled: The format string can contain multiple valid substitution + // fields. If multiple substitution fields are present, their results will be concatenated + // to form the final descriptor value. If it contains no substitution fields, the value + // will be used as is. If the final concatenated result is empty and ``default_value`` is set, + // the ``default_value`` will be used. If ``default_value`` is not set and the result is + // empty, this descriptor will be skipped and not included in the rate limit call. + // + // When disabled (default): The descriptor_value is used as a literal string without any formatter + // parsing or substitution. + // + // For example, ``static_value`` will be used as is since there are no substitution fields. + // ``%REQ(:method)%`` will be replaced with the HTTP method, and + // ``%REQ(:method)%%REQ(:path)%`` will be replaced with the concatenation of the HTTP method and path. + // ``%CEL(request.headers['user-id'])%`` will use CEL to extract the user ID from request headers. + // + string descriptor_value = 1 [(validate.rules).string = {min_len: 1}]; + + // An optional value to use if the final concatenated ``descriptor_value`` result is empty. + // Only applicable when formatter parsing is enabled by the runtime feature flag + // ``envoy.reloadable_features.enable_formatter_for_ratelimit_action_descriptor_value`` (disabled by default). + string default_value = 3; + + // An optional key to use in the descriptor entry. If not set it defaults + // to 'generic_key' as the descriptor key. + string descriptor_key = 2; + } + + // The following descriptor entry is appended to the descriptor: + // + // .. code-block:: cpp + // + // ("header_match", "") + // [#next-free-field: 6] + message HeaderValueMatch { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.RateLimit.Action.HeaderValueMatch"; + + // Descriptor value of entry. + // + // The same :ref:`format specifier ` as used for + // :ref:`HTTP access logging ` applies here, however + // unknown specifier values are replaced with the empty string instead of ``-``. + // + // .. note:: + // + // Formatter parsing is controlled by the runtime feature flag + // ``envoy.reloadable_features.enable_formatter_for_ratelimit_action_descriptor_value`` + // (disabled by default). + // + // When enabled: The format string can contain multiple valid substitution + // fields. If multiple substitution fields are present, their results will be concatenated + // to form the final descriptor value. If it contains no substitution fields, the value + // will be used as is. All substitution fields will be evaluated and their results + // concatenated. If the final concatenated result is empty and ``default_value`` is set, + // the ``default_value`` will be used. If ``default_value`` is not set and the result is + // empty, this descriptor will be skipped and not included in the rate limit call. + // + // When disabled (default): The descriptor_value is used as a literal string without any formatter + // parsing or substitution. + // + // For example, ``static_value`` will be used as is since there are no substitution fields. + // ``%REQ(:method)%`` will be replaced with the HTTP method, and + // ``%REQ(:method)%%REQ(:path)%`` will be replaced with the concatenation of the HTTP method and path. + // ``%CEL(request.headers['user-id'])%`` will use CEL to extract the user ID from request headers. + // + string descriptor_value = 1 [(validate.rules).string = {min_len: 1}]; + + // An optional value to use if the final concatenated ``descriptor_value`` result is empty. + // Only applicable when formatter parsing is enabled by the runtime feature flag + // ``envoy.reloadable_features.enable_formatter_for_ratelimit_action_descriptor_value`` (disabled by default). + string default_value = 5; + + // The key to use in the descriptor entry. + // + // Defaults to ``header_match``. + string descriptor_key = 4; + + // If set to true, the action will append a descriptor entry when the + // request matches the headers. If set to false, the action will append a + // descriptor entry when the request does not match the headers. The + // default value is true. + google.protobuf.BoolValue expect_match = 2; + + // Specifies a set of headers that the rate limit action should match + // on. The action will check the request's headers against all the + // specified headers in the config. A match will happen if all the + // headers in the config are present in the request with the same values + // (or based on presence if the value field is not in the config). + repeated HeaderMatcher headers = 3 [(validate.rules).repeated = {min_items: 1}]; + } + + // The following descriptor entry is appended when the + // :ref:`dynamic metadata ` contains a key value: + // + // .. code-block:: cpp + // + // ("", "") + // + // .. attention:: + // This action has been deprecated in favor of the :ref:`metadata ` action + message DynamicMetaData { + // The key to use in the descriptor entry. + string descriptor_key = 1 [(validate.rules).string = {min_len: 1}]; + + // Metadata struct that defines the key and path to retrieve the string value. A match will + // only happen if the value in the dynamic metadata is of type string. + type.metadata.v3.MetadataKey metadata_key = 2 [(validate.rules).message = {required: true}]; + + // An optional value to use if ``metadata_key`` is empty. If not set and + // no value is present under the metadata_key then no descriptor is generated. + string default_value = 3; + } + + // The following descriptor entry is appended when the metadata contains a key value: + // + // .. code-block:: cpp + // + // ("", "") + // [#next-free-field: 6] + message MetaData { + enum Source { + // Query :ref:`dynamic metadata ` + DYNAMIC = 0; + + // Query :ref:`route entry metadata ` + ROUTE_ENTRY = 1; + + // Query :ref:`cluster metadata ` + CLUSTER_ENTRY = 2; + + // Query :ref:`cluster locality metadata ` + // Cluster locality metadata is available after upstream host selection only. To populate descriptors + // with cluster locality metadata it needs to be have the + // :ref:`apply_on_stream_done field ` + // set to ``true`` or host selection completed before the rate limit filter is executed. + CLUSTER_LOCALITY_ENTRY = 3; + } + + // The key to use in the descriptor entry. + string descriptor_key = 1 [(validate.rules).string = {min_len: 1}]; + + // Metadata struct that defines the key and path to retrieve the string value. A match will + // only happen if the value in the metadata is of type string. + type.metadata.v3.MetadataKey metadata_key = 2 [(validate.rules).message = {required: true}]; + + // An optional value to use if ``metadata_key`` is empty. If not set and + // no value is present under the metadata_key then ``skip_if_absent`` is followed to + // skip calling the rate limiting service or skip the descriptor. + string default_value = 3; + + // Source of metadata + Source source = 4 [(validate.rules).enum = {defined_only: true}]; + + // Controls the behavior when the specified ``metadata_key`` is empty and ``default_value`` is not set. + // + // If set to ``false`` (default): + // + // * Envoy does **NOT** call the rate limiting service for this descriptor. + // * Useful if the metadata is optional and you prefer to skip rate limiting when it's absent. + // + // If set to ``true``: + // + // * Envoy calls the rate limiting service but omits this descriptor if the ``metadata_key`` is empty and + // ``default_value`` is missing. + // * Useful if you want Envoy to enforce rate limiting even when the metadata is not present. + // + bool skip_if_absent = 5; + } + + // The following descriptor entry is appended to the descriptor: + // + // .. code-block:: cpp + // + // ("query_match", "") + // [#next-free-field: 6] + message QueryParameterValueMatch { + // Descriptor value of entry. + // + // The same :ref:`format specifier ` as used for + // :ref:`HTTP access logging ` applies here, however + // unknown specifier values are replaced with the empty string instead of ``-``. + // + // .. note:: + // + // Formatter parsing is controlled by the runtime feature flag + // ``envoy.reloadable_features.enable_formatter_for_ratelimit_action_descriptor_value`` + // (disabled by default). + // + // When enabled: The format string can contain multiple valid substitution + // fields. If multiple substitution fields are present, their results will be concatenated + // to form the final descriptor value. If it contains no substitution fields, the value + // will be used as is. All substitution fields will be evaluated and their results + // concatenated. If the final concatenated result is empty and ``default_value`` is set, + // the ``default_value`` will be used. If ``default_value`` is not set and the result is + // empty, this descriptor will be skipped and not included in the rate limit call. + // + // When disabled (default): The descriptor_value is used as a literal string without any formatter + // parsing or substitution. + // + // For example, ``static_value`` will be used as is since there are no substitution fields. + // ``%REQ(:method)%`` will be replaced with the HTTP method, and + // ``%REQ(:method)%%REQ(:path)%`` will be replaced with the concatenation of the HTTP method and path. + // ``%CEL(request.headers['user-id'])%`` will use CEL to extract the user ID from request headers. + // + string descriptor_value = 1 [(validate.rules).string = {min_len: 1}]; + + // An optional value to use if the final concatenated ``descriptor_value`` result is empty. + // Only applicable when formatter parsing is enabled by the runtime feature flag + // ``envoy.reloadable_features.enable_formatter_for_ratelimit_action_descriptor_value`` (disabled by default). + string default_value = 5; + + // The key to use in the descriptor entry. + // + // Defaults to ``query_match``. + string descriptor_key = 4; + + // If set to true, the action will append a descriptor entry when the + // request matches the headers. If set to false, the action will append a + // descriptor entry when the request does not match the headers. The + // default value is true. + google.protobuf.BoolValue expect_match = 2; + + // Specifies a set of query parameters that the rate limit action should match + // on. The action will check the request's query parameters against all the + // specified query parameters in the config. A match will happen if all the + // query parameters in the config are present in the request with the same values + // (or based on presence if the value field is not in the config). + repeated QueryParameterMatcher query_parameters = 3 + [(validate.rules).repeated = {min_items: 1}]; + } + + // The following descriptor entry is appended to the descriptor: + // + // .. code-block:: cpp + // + // ("remote_address_match", "") + message RemoteAddressMatch { + // Descriptor value of entry. + // + // The same :ref:`format specifier ` as used for + // :ref:`HTTP access logging ` applies here, however + // unknown specifier values are replaced with the empty string instead of ``-``. + // + // .. note:: + // + // The format string can contain multiple valid substitution fields. If multiple + // substitution fields are present, their results will be concatenated to form the + // final descriptor value. If it contains no substitution fields, the value will be + // used as is. All substitution fields will be evaluated and their results concatenated. + // If the final concatenated result is empty and ``default_value`` is set, the + // ``default_value`` will be used. If ``default_value`` is not set and the result is + // empty, this descriptor will be skipped and not included in the rate limit call. + // + // For example, ``static_value`` will be used as is since there are no substitution fields. + // ``%REQ(:method)%`` will be replaced with the HTTP method, and + // ``%REQ(:method)%%REQ(:path)%`` will be replaced with the concatenation of the HTTP method and path. + // ``%CEL(request.headers['user-id'])%`` will use CEL to extract the user ID from request headers. + // + string descriptor_value = 1 [(validate.rules).string = {min_len: 1}]; + + // The key to use in the descriptor entry. + // + // Defaults to ``remote_address_match``. + string descriptor_key = 2; + + // An optional value to use if the final concatenated ``descriptor_value`` result is empty. + string default_value = 3; + + // Specifies an address matcher that controls whether the rate limit action is applied. + // The matcher checks the remote address (trusted address from + // :ref:`x-forwarded-for `) + // against the specified CIDR ranges. The rate limit action will be applied if + // the remote address matches any of the CIDR ranges (or does not match any if + // ``invert_match`` is set to true in the address matcher). + type.matcher.v3.AddressMatcher address_matcher = 4 + [(validate.rules).message = {required: true}]; + } + + oneof action_specifier { + option (validate.required) = true; + + // Rate limit on source cluster. + SourceCluster source_cluster = 1; + + // Rate limit on destination cluster. + DestinationCluster destination_cluster = 2; + + // Rate limit on request headers. + RequestHeaders request_headers = 3; + + // Rate limit on query parameters. + QueryParameters query_parameters = 12; + + // Rate limit on remote address. + RemoteAddress remote_address = 4; + + // Rate limit on a generic key. + GenericKey generic_key = 5; + + // Rate limit on the existence of request headers. + HeaderValueMatch header_value_match = 6; + + // Rate limit on dynamic metadata. + // + // .. attention:: + // This field has been deprecated in favor of the :ref:`metadata ` field + DynamicMetaData dynamic_metadata = 7 [ + deprecated = true, + (envoy.annotations.deprecated_at_minor_version) = "3.0", + (envoy.annotations.disallowed_by_default) = true + ]; + + // Rate limit on metadata. + MetaData metadata = 8; + + // Rate limit descriptor extension. See the rate limit descriptor extensions documentation. + // + // :ref:`HTTP matching input functions ` are + // permitted as descriptor extensions. The input functions are only + // looked up if there is no rate limit descriptor extension matching + // the type URL. + // + // [#extension-category: envoy.rate_limit_descriptors] + core.v3.TypedExtensionConfig extension = 9; + + // Rate limit on masked remote address. + MaskedRemoteAddress masked_remote_address = 10; + + // Rate limit on the existence of query parameters. + QueryParameterValueMatch query_parameter_value_match = 11; + + // Rate limit on remote address match. + RemoteAddressMatch remote_address_match = 13; + } + } + + message Override { + // Fetches the override from the dynamic metadata. + message DynamicMetadata { + // Metadata struct that defines the key and path to retrieve the struct value. + // The value must be a struct containing an integer "requests_per_unit" property + // and a "unit" property with a value parseable to :ref:`RateLimitUnit + // enum ` + type.metadata.v3.MetadataKey metadata_key = 1 [(validate.rules).message = {required: true}]; + } + + // Rate limit to apply to this descriptor. + message RateLimitOverride { + // The number of requests per unit of time. + uint32 requests_per_unit = 1; + + // The unit of time. + type.v3.RateLimitUnit unit = 2; + } + + oneof override_specifier { + option (validate.required) = true; + + // Limit override from dynamic metadata. + DynamicMetadata dynamic_metadata = 1; + + // Static limit override. + RateLimitOverride rate_limit = 2; + } + } + + message HitsAddend { + // Fixed number of hits to add to the rate limit descriptor. + // + // One of the ``number`` or ``format`` fields should be set but not both. + google.protobuf.UInt64Value number = 1 [(validate.rules).uint64 = {lte: 1000000000}]; + + // Substitution format string to extract the number of hits to add to the rate limit descriptor. + // The same :ref:`format specifier ` as used for + // :ref:`HTTP access logging ` applies here. + // + // .. note:: + // + // The format string must contains only single valid substitution field. If the format string + // not meets the requirement, the configuration will be rejected. + // + // The substitution field should generates a non-negative number or string representation of + // a non-negative number. The value of the non-negative number should be less than or equal + // to 1000000000 like the ``number`` field. If the output of the substitution field not meet + // the requirement, this will be treated as an error and the current descriptor will be ignored. + // + // For example, the ``%BYTES_RECEIVED%`` format string will be replaced with the number of bytes + // received in the request. + // + // One of the ``number`` or ``format`` fields should be set but not both. + string format = 2 [(validate.rules).string = {prefix: "%" suffix: "%" ignore_empty: true}]; + + // If true, the hits addend value will be treated as negative, effectively adding to + // the rate limit budget instead of consuming from it. This can be used to refill previously consumed + // rate limit tokens. + bool is_negative_hits = 3; + } + + // Refers to the stage set in the filter. The rate limit configuration only + // applies to filters with the same stage number. The default stage number is + // 0. + // + // .. note:: + // + // The filter supports a range of 0 - 10 inclusively for stage numbers. + // + // .. note:: + // This is not supported if the rate limit action is configured in the ``typed_per_filter_config`` like + // :ref:`VirtualHost.typed_per_filter_config` or + // :ref:`Route.typed_per_filter_config`, etc. + google.protobuf.UInt32Value stage = 1 [(validate.rules).uint32 = {lte: 10}]; + + // The key to be set in runtime to disable this rate limit configuration. + // + // .. note:: + // This is not supported if the rate limit action is configured in the ``typed_per_filter_config`` like + // :ref:`VirtualHost.typed_per_filter_config` or + // :ref:`Route.typed_per_filter_config`, etc. + string disable_key = 2; + + // A list of actions that are to be applied for this rate limit configuration. + // Order matters as the actions are processed sequentially and the descriptor + // is composed by appending descriptor entries in that sequence. If an action + // cannot append a descriptor entry, no descriptor is generated for the + // configuration. See :ref:`composing actions + // ` for additional documentation. + repeated Action actions = 3 [(validate.rules).repeated = {min_items: 1}]; + + // An optional limit override to be appended to the descriptor produced by this + // rate limit configuration. If the override value is invalid or cannot be resolved + // from metadata, no override is provided. See :ref:`rate limit override + // ` for more information. + // + // .. note:: + // For the global HTTP :ref:`rate limit filter + // `, this is supported both at the route/virtual host + // level and when the rate limit configuration is supplied via the filter's + // ``rate_limits`` field or the ``typed_per_filter_config`` + // (:ref:`RateLimitPerRoute `). + // This is not supported by the :ref:`local rate limit filter + // `. + Override limit = 4; + + // An optional hits addend to be appended to the descriptor produced by this rate limit + // configuration. + // + // .. note:: + // This is only supported if the rate limit action is configured in the ``typed_per_filter_config`` like + // :ref:`VirtualHost.typed_per_filter_config` or + // :ref:`Route.typed_per_filter_config`, etc. + HitsAddend hits_addend = 5; + + // If true, the rate limit request will be applied when the stream completes. The default value is false. + // This is useful when the rate limit budget needs to reflect the response context that is not available + // on the request path. + // + // For example, let's say the upstream service calculates the usage statistics and returns them in the response body + // and we want to utilize these numbers to apply the rate limit action for the subsequent requests. + // Combined with another filter that can set the desired addend based on the response (e.g. Lua filter), + // this can be used to subtract the usage statistics from the rate limit budget. + // + // A rate limit applied on the stream completion is "fire-and-forget" by nature, and rate limit is not enforced by this config. + // In other words, the current request won't be blocked when this is true, but the budget will be updated for the subsequent + // requests based on the action with this field set to true. Users should ensure that the rate limit is enforced by the actions + // applied on the request path, i.e. the ones with this field set to false. + // + // Currently, this is only supported by the HTTP global rate filter. + bool apply_on_stream_done = 6; + + // Descriptor level X-RateLimit headers options which may override the filter level setting. + XRateLimitOption x_ratelimit_option = 7; +} + +// .. attention:: +// +// Internally, Envoy always uses the HTTP/2 ``:authority`` header to represent the HTTP/1 ``Host`` +// header. Thus, if attempting to match on ``Host``, match on ``:authority`` instead. +// +// .. attention:: +// +// To route on HTTP method, use the special HTTP/2 ``:method`` header. This works for both +// HTTP/1 and HTTP/2 as Envoy normalizes headers. E.g., +// +// .. code-block:: json +// +// { +// "name": ":method", +// "string_match": { +// "exact": "POST" +// } +// } +// +// .. attention:: +// In the absence of any header match specifier, match will default to :ref:`present_match +// `. i.e, a request that has the :ref:`name +// ` header will match, regardless of the header's +// value. +// +// [#next-major-version: HeaderMatcher should be refactored to use StringMatcher.] +// [#next-free-field: 15] +message HeaderMatcher { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.HeaderMatcher"; + + reserved 2, 3, 5; + + reserved "regex_match"; + + // Specifies the name of the header in the request. + string name = 1 + [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // Specifies how the header match will be performed to route the request. + oneof header_match_specifier { + // If specified, header match will be performed based on the value of the header. + // + // .. attention:: + // + // This field is deprecated. Please use :ref:`string_match `. + string exact_match = 4 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // If specified, this regex string is a regular expression rule which implies the entire request + // header value must match the regex. The rule will not match if only a subsequence of the + // request header value matches the regex. + // + // .. attention:: + // + // This field is deprecated. Please use :ref:`string_match `. + type.matcher.v3.RegexMatcher safe_regex_match = 11 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // If specified, header match will be performed based on range. + // The rule will match if the request header value is within this range. + // The entire request header value must represent an integer in base 10 notation: consisting of + // an optional plus or minus sign followed by a sequence of digits. The rule will not match if + // the header value does not represent an integer. Match will fail for empty values, floating + // point numbers or if only a subsequence of the header value is an integer. + // + // Examples: + // + // * For range [-10,0), route will match for header value -1, but not for 0, ``somestring``, 10.9, + // ``-1somestring`` + type.v3.Int64Range range_match = 6; + + // If specified as true, header match will be performed based on whether the header is in the + // request. If specified as false, header match will be performed based on whether the header is absent. + bool present_match = 7; + + // If specified, header match will be performed based on the prefix of the header value. + // + // .. note:: + // + // Empty prefix is not allowed. Please use ``present_match`` instead. + // + // .. attention:: + // + // This field is deprecated. Please use :ref:`string_match `. + // + // Examples: + // + // * The prefix ``abcd`` matches the value ``abcdxyz``, but not for ``abcxyz``. + string prefix_match = 9 [ + deprecated = true, + (validate.rules).string = {min_len: 1}, + (envoy.annotations.deprecated_at_minor_version) = "3.0" + ]; + + // If specified, header match will be performed based on the suffix of the header value. + // + // .. note:: + // + // Empty suffix is not allowed. Please use ``present_match`` instead. + // + // .. attention:: + // + // This field is deprecated. Please use :ref:`string_match `. + // + // Examples: + // + // * The suffix ``abcd`` matches the value ``xyzabcd``, but not for ``xyzbcd``. + string suffix_match = 10 [ + deprecated = true, + (validate.rules).string = {min_len: 1}, + (envoy.annotations.deprecated_at_minor_version) = "3.0" + ]; + + // If specified, header match will be performed based on whether the header value contains + // the given value or not. + // + // .. note:: + // + // Empty contains match is not allowed. Please use ``present_match`` instead. + // + // .. attention:: + // + // This field is deprecated. Please use :ref:`string_match `. + // + // Examples: + // + // * The value ``abcd`` matches the value ``xyzabcdpqr``, but not for ``xyzbcdpqr``. + string contains_match = 12 [ + deprecated = true, + (validate.rules).string = {min_len: 1}, + (envoy.annotations.deprecated_at_minor_version) = "3.0" + ]; + + // If specified, header match will be performed based on the string match of the header value. + type.matcher.v3.StringMatcher string_match = 13; + } + + // If specified, the match result will be inverted before checking. + // + // Defaults to ``false``. + // + // Examples: + // + // * The regex ``\d{3}`` does not match the value ``1234``, so it will match when inverted. + // * The range [-10,0) will match the value -1, so it will not match when inverted. + bool invert_match = 8; + + // If specified, for any header match rule, if the header match rule specified header + // does not exist, this header value will be treated as empty. + // + // Defaults to ``false``. + // + // Examples: + // + // * The header match rule specified header "header1" to range match of [0, 10], + // :ref:`invert_match ` + // is set to true and :ref:`treat_missing_header_as_empty ` + // is set to true; The "header1" header is not present. The match rule will + // treat the "header1" as an empty header. The empty header does not match the range, + // so it will match when inverted. + // * The header match rule specified header "header2" to range match of [0, 10], + // :ref:`invert_match ` + // is set to true and :ref:`treat_missing_header_as_empty ` + // is set to false; The "header2" header is not present and the header + // matcher rule for "header2" will be ignored so it will not match. + // * The header match rule specified header "header3" to a string regex match + // ``^$`` which means an empty string, and + // :ref:`treat_missing_header_as_empty ` + // is set to true; The "header3" header is not present. + // The match rule will treat the "header3" header as an empty header so it will match. + // * The header match rule specified header "header4" to a string regex match + // ``^$`` which means an empty string, and + // :ref:`treat_missing_header_as_empty ` + // is set to false; The "header4" header is not present. + // The match rule for "header4" will be ignored so it will not match. + bool treat_missing_header_as_empty = 14; +} + +// Query parameter matching treats the query string of a request's :path header +// as an ampersand-separated list of keys and/or key=value elements. +// [#next-free-field: 7] +message QueryParameterMatcher { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.route.QueryParameterMatcher"; + + reserved 3, 4; + + reserved "value", "regex"; + + // Specifies the name of a key that must be present in the requested + // ``path``'s query string. + string name = 1 [(validate.rules).string = {min_len: 1 max_bytes: 1024}]; + + oneof query_parameter_match_specifier { + // Specifies whether a query parameter value should match against a string. + type.matcher.v3.StringMatcher string_match = 5 [(validate.rules).message = {required: true}]; + + // Specifies whether a query parameter should be present. + bool present_match = 6; + } +} + +// Cookie matching inspects individual name/value pairs parsed from the ``Cookie`` header. +message CookieMatcher { + // Specifies the cookie name to evaluate. + string name = 1 [(validate.rules).string = {min_len: 1 max_bytes: 1024}]; + + // Match the cookie value using :ref:`StringMatcher + // ` semantics. + type.matcher.v3.StringMatcher string_match = 2 [(validate.rules).message = {required: true}]; + + // Invert the match result. If the cookie is not present, the match result is false, so + // ``invert_match`` will cause the matcher to succeed when the cookie is absent. + bool invert_match = 3; +} + +// HTTP Internal Redirect :ref:`architecture overview `. +// [#next-free-field: 6] +message InternalRedirectPolicy { + // An internal redirect is not handled, unless the number of previous internal redirects that a + // downstream request has encountered is lower than this value. + // In the case where a downstream request is bounced among multiple routes by internal redirect, + // the first route that hits this threshold, or does not set :ref:`internal_redirect_policy + // ` + // will pass the redirect back to downstream. + // + // If not specified, at most one redirect will be followed. + google.protobuf.UInt32Value max_internal_redirects = 1; + + // Defines what upstream response codes are allowed to trigger internal redirect. If unspecified, + // only 302 will be treated as internal redirect. + // Only 301, 302, 303, 307 and 308 are valid values. Any other codes will be ignored. + repeated uint32 redirect_response_codes = 2 [(validate.rules).repeated = {max_items: 5}]; + + // Specifies a list of predicates that are queried when an upstream response is deemed + // to trigger an internal redirect by all other criteria. Any predicate in the list can reject + // the redirect, causing the response to be proxied to downstream. + // [#extension-category: envoy.internal_redirect_predicates] + repeated core.v3.TypedExtensionConfig predicates = 3; + + // Allow internal redirect to follow a target URI with a different scheme than the value of + // x-forwarded-proto. The default is ``false``. + bool allow_cross_scheme_redirect = 4; + + // Specifies a list of headers, by name, to copy from the internal redirect into the subsequent + // request. If a header is specified here but not present in the redirect, it will be cleared in + // the subsequent request. + repeated string response_headers_to_copy = 5 [(validate.rules).repeated = { + unique: true + items {string {well_known_regex: HTTP_HEADER_NAME strict: false}} + }]; +} + +// A simple wrapper for an HTTP filter config. This is intended to be used as a wrapper for the +// map value in +// :ref:`VirtualHost.typed_per_filter_config`, +// :ref:`Route.typed_per_filter_config`, +// or :ref:`WeightedCluster.ClusterWeight.typed_per_filter_config` +// to add additional flags to the filter. +message FilterConfig { + // The filter config. + google.protobuf.Any config = 1; + + // If true, the filter is optional, meaning that if the client does + // not support the specified filter, it may ignore the map entry rather + // than rejecting the config. + bool is_optional = 2; + + // If true, the filter is disabled in the route or virtual host and the ``config`` field is ignored. + // See :ref:`route based filter chain ` + // for more details. + // + // .. note:: + // + // This field will take effect when the request arrive and filter chain is created for the request. + // If initial route is selected for the request and a filter is disabled in the initial route, then + // the filter will not be added to the filter chain. + // And if the request is mutated later and re-match to another route, the disabled filter by the + // initial route will not be added back to the filter chain because the filter chain is already + // created and it is too late to change the chain. + // + bool disabled = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/2dfca9444a089923c1a755c1fbdf192b8730abd6138ddd0ce38e192688c5a33a56680706f776874432cd966a343b5c129d0af379860d2c721a95d8ff1cac8c24 b/modules/sync/envoyproxy/envoy/cas/2dfca9444a089923c1a755c1fbdf192b8730abd6138ddd0ce38e192688c5a33a56680706f776874432cd966a343b5c129d0af379860d2c721a95d8ff1cac8c24 new file mode 100644 index 00000000..b376b844 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/2dfca9444a089923c1a755c1fbdf192b8730abd6138ddd0ce38e192688c5a33a56680706f776874432cd966a343b5c129d0af379860d2c721a95d8ff1cac8c24 @@ -0,0 +1,142 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.dynamic_modules.v3; + +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Dynamic Modules HTTP Filter] +// [#extension: envoy.filters.http.dynamic_modules] + +// Configuration for the Dynamic Modules HTTP filter. This filter allows loading shared object files +// that can be loaded via ``dlopen`` to extend the HTTP filter chain. +// +// A module can be loaded by multiple HTTP filters; the module is loaded only once and shared across +// multiple filters. +// +// A dynamic module HTTP filter can opt into being a terminal filter with no upstream by setting +// :ref:`terminal_filter +// ` +// to ``true``. A terminal dynamic module can use ``send_`` ABI methods to send response headers, +// body, and trailers to the downstream. +message DynamicModuleFilter { + // Specifies the shared-object level configuration. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1; + + // The name for this filter configuration. + // + // This can be used to distinguish between different filter implementations inside a dynamic + // module. For example, a module can have completely different filter implementations. When Envoy + // receives this configuration, it passes the ``filter_name`` to the dynamic module's HTTP filter + // config init function together with the ``filter_config``. That way a module can decide which + // in-module filter implementation to use based on the name at load time. + string filter_name = 2; + + // The configuration for the filter chosen by ``filter_name``. + // + // This is passed to the module's HTTP filter initialization function. Together with the + // ``filter_name``, the module can decide which in-module filter implementation to use and + // fine-tune the behavior of the filter. + // + // For example, if a module has two filter implementations, one for logging and one for header + // manipulation, ``filter_name`` is used to choose either logging or header manipulation. The + // ``filter_config`` can be used to configure the logging level or the header manipulation + // behavior. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the plugin. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly without + // the wrapper. + // + // .. code-block:: yaml + // + // # Passing in a string + // filter_config: + // "@type": "type.googleapis.com/google.protobuf.StringValue" + // value: hello + // + // # Passing in raw bytes + // filter_config: + // "@type": "type.googleapis.com/google.protobuf.BytesValue" + // value: aGVsbG8= # echo -n "hello" | base64 + // + google.protobuf.Any filter_config = 3; + + // If ``true``, the dynamic module is a terminal filter to use without an upstream. + // + // The dynamic module is responsible for creating and sending the response to downstream. + // + // Defaults to ``false``. + bool terminal_filter = 4; +} + +// Configuration of the HTTP per-route filter for dynamic modules. +message DynamicModuleFilterPerRoute { + // Specifies the shared-object level configuration. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1; + + // The name for this filter configuration. + // + // This can be used to distinguish between different filter implementations inside a dynamic + // module. For example, a module can have completely different filter implementations. When Envoy + // receives this configuration, it passes the ``per_route_config_name`` to the dynamic module's + // HTTP per-route filter config init function together with the ``filter_config``. That way a + // module can decide which in-module filter implementation to use based on the name at load time. + // + // .. note:: + // This is deprecated in favor of ``filter_name``. Please use ``filter_name`` instead of + // ``per_route_config_name`` to specify the name for the filter implementation. + // If both ``per_route_config_name`` and ``filter_name`` are specified, Envoy uses + // ``filter_name`` and ignores ``per_route_config_name``. + // + string per_route_config_name = 2 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // The name for this filter configuration. + // + // This can be used to distinguish between different filter implementations inside a dynamic + // module. For example, a module can have completely different filter implementations. When Envoy + // receives this configuration, it passes the ``filter_name`` to the dynamic module's + // HTTP per-route filter config init function together with the ``filter_config``. That way a + // module can decide which in-module filter implementation to use based on the name at load time. + string filter_name = 4; + + // The configuration for the filter chosen by ``filter_name``. + // + // This is passed to the module's HTTP per-route filter initialization function. Together with + // the ``filter_name``, the module can decide which in-module filter implementation to use and fine-tune the behavior of the filter on a specific route. + // + // For example, if a module has two filter implementations, one for logging and one for header + // manipulation, ``filter_name`` is used to choose either logging or header + // manipulation. The ``filter_config`` can be used to configure the logging level or the header + // manipulation behavior. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the plugin. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly without + // the wrapper. + // + // .. code-block:: yaml + // + // # Passing in a string + // filter_config: + // "@type": "type.googleapis.com/google.protobuf.StringValue" + // value: hello + // + // # Passing in raw bytes + // filter_config: + // "@type": "type.googleapis.com/google.protobuf.BytesValue" + // value: aGVsbG8= # echo -n "hello" | base64 + // + google.protobuf.Any filter_config = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/311a3681f3f3d77ddfc1eb3c82e620bfaf0023946cbebbb6ca684fd9fa164ff24f838a06c58949b09af0fd404700a81e69f0852dc4353c6ac27b3500d5894fc7 b/modules/sync/envoyproxy/envoy/cas/311a3681f3f3d77ddfc1eb3c82e620bfaf0023946cbebbb6ca684fd9fa164ff24f838a06c58949b09af0fd404700a81e69f0852dc4353c6ac27b3500d5894fc7 new file mode 100644 index 00000000..8f2d080a --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/311a3681f3f3d77ddfc1eb3c82e620bfaf0023946cbebbb6ca684fd9fa164ff24f838a06c58949b09af0fd404700a81e69f0852dc4353c6ac27b3500d5894fc7 @@ -0,0 +1,236 @@ +syntax = "proto3"; + +package envoy.service.ratelimit.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/extensions/common/ratelimit/v3/ratelimit.proto"; + +import "google/protobuf/duration.proto"; +import "google/protobuf/struct.proto"; +import "google/protobuf/timestamp.proto"; +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.service.ratelimit.v3"; +option java_outer_classname = "RlsProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/service/ratelimit/v3;ratelimitv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Rate limit service (RLS)] + +service RateLimitService { + // Determine whether rate limiting should take place. + rpc ShouldRateLimit(RateLimitRequest) returns (RateLimitResponse) { + } +} + +// Main message for a rate limit request. The rate limit service is designed to be fully generic +// in the sense that it can operate on arbitrary hierarchical key/value pairs. The loaded +// configuration will parse the request and find the most specific limit to apply. In addition, +// a RateLimitRequest can contain multiple "descriptors" to limit on. When multiple descriptors +// are provided, the server will limit on *ALL* of them and return an OVER_LIMIT response if any +// of them are over limit. This enables more complex application level rate limiting scenarios +// if desired. +message RateLimitRequest { + option (udpa.annotations.versioning).previous_message_type = + "envoy.service.ratelimit.v2.RateLimitRequest"; + + // All rate limit requests must specify a domain. This enables the configuration to be per + // application without fear of overlap. E.g., "envoy". + string domain = 1; + + // All rate limit requests must specify at least one RateLimitDescriptor. Each descriptor is + // processed by the service (see below). If any of the descriptors are over limit, the entire + // request is considered to be over limit. + repeated envoy.extensions.common.ratelimit.v3.RateLimitDescriptor descriptors = 2; + + // Rate limit requests can optionally specify the number of hits a request adds to the matched + // limit. If the value is not set in the message, a request increases the matched limit by 1. + // This value can be overridden by setting filter state value ``envoy.ratelimit.hits_addend`` + // to the desired number. Invalid number (< 0) or number will be ignored. + uint32 hits_addend = 3; +} + +// A response from a ShouldRateLimit call. +// [#next-free-field: 8] +message RateLimitResponse { + option (udpa.annotations.versioning).previous_message_type = + "envoy.service.ratelimit.v2.RateLimitResponse"; + + enum Code { + // The response code is not known. + UNKNOWN = 0; + + // The response code to notify that the number of requests are under limit. + OK = 1; + + // The response code to notify that the number of requests are over limit. + OVER_LIMIT = 2; + } + + // Defines an actual rate limit in terms of requests per unit of time and the unit itself. + message RateLimit { + option (udpa.annotations.versioning).previous_message_type = + "envoy.service.ratelimit.v2.RateLimitResponse.RateLimit"; + + // Identifies the unit of of time for rate limit. + // [#comment: replace by envoy/type/v3/ratelimit_unit.proto in v4] + enum Unit { + // The time unit is not known. + UNKNOWN = 0; + + // The time unit representing a second. + SECOND = 1; + + // The time unit representing a minute. + MINUTE = 2; + + // The time unit representing an hour. + HOUR = 3; + + // The time unit representing a day. + DAY = 4; + + // The time unit representing a week. + WEEK = 7; + + // The time unit representing a month. + MONTH = 5; + + // The time unit representing a year. + YEAR = 6; + } + + // A name or description of this limit. + string name = 3; + + // The number of requests per unit of time. + uint32 requests_per_unit = 1; + + // The unit of time. + Unit unit = 2; + + // The number of units in the rate limit period. For example, a value of ``10`` with a unit + // of ``MINUTE`` specifies a 10-minute rate limit period. If not specified, defaults to ``1``. + google.protobuf.UInt32Value unit_multiplier = 4 [(validate.rules).uint32 = {gt: 0}]; + } + + // Cacheable quota for responses. + // Quota can be granted at different levels: either for each individual descriptor or for the whole descriptor set. + // This is a certain number of requests over a period of time. + // The client may cache this result and apply the effective RateLimitResponse to future matching + // requests without querying rate limit service. + // + // When quota expires due to timeout, a new RLS request will also be made. + // The implementation may choose to preemptively query the rate limit server for more quota on or + // before expiration or before the available quota runs out. + // [#not-implemented-hide:] + message Quota { + // Number of matching requests granted in quota. Must be 1 or more. + uint32 requests = 1 [(validate.rules).uint32 = {gt: 0}]; + + oneof expiration_specifier { + // Point in time at which the quota expires. + google.protobuf.Timestamp valid_until = 2; + } + + // The unique id that is associated with each Quota either at individual descriptor level or whole descriptor set level. + // + // For a matching policy with boolean logic, for example, match: "request.headers['environment'] == 'staging' || request.headers['environment'] == 'dev'"), + // the request_headers action produces a distinct list of descriptors for each possible value of the ‘environment’ header even though the granted quota is same. + // Thus, the client will use this id information (returned from RLS server) to correctly correlate the multiple descriptors/descriptor sets that have been granted with same quota (i.e., share the same quota among multiple descriptors or descriptor sets.) + // + // If id is empty, this id field will be ignored. If quota for the same id changes (e.g. due to configuration update), the old quota will be overridden by the new one. Shared quotas referenced by ID will still adhere to expiration after `valid_until`. + string id = 3; + } + + // [#next-free-field: 6] + message DescriptorStatus { + option (udpa.annotations.versioning).previous_message_type = + "envoy.service.ratelimit.v2.RateLimitResponse.DescriptorStatus"; + + // The response code for an individual descriptor. + Code code = 1; + + // The current limit as configured by the server. Useful for debugging, etc. + RateLimit current_limit = 2; + + // The limit remaining in the current time unit. + uint32 limit_remaining = 3; + + // Duration until reset of the current limit window. + google.protobuf.Duration duration_until_reset = 4; + + // Quota is available for a request if its descriptor set has cached quota available for all + // descriptors. + // This is for each individual descriptor in the descriptor set. The client will perform matches for each individual descriptor against available per-descriptor quota. + // + // If quota is available, a RLS request will not be made and the quota will be reduced by 1 for + // all matching descriptors. + // + // If there is not sufficient quota, there are three cases: + // 1. A cached entry exists for a RLS descriptor that is out-of-quota, but not expired. + // In this case, the request will be treated as OVER_LIMIT. + // 2. Some RLS descriptors have a cached entry that has valid quota but some RLS descriptors + // have no cached entry. This will trigger a new RLS request. + // When the result is returned, a single unit will be consumed from the quota for all + // matching descriptors. + // If the server did not provide a quota, such as the quota message is empty for some of + // the descriptors, then the request admission is determined by the + // :ref:`overall_code `. + // 3. All RLS descriptors lack a cached entry, this will trigger a new RLS request, + // When the result is returned, a single unit will be consumed from the quota for all + // matching descriptors. + // If the server did not provide a quota, such as the quota message is empty for some of + // the descriptors, then the request admission is determined by the + // :ref:`overall_code `. + // [#not-implemented-hide:] + Quota quota = 5; + } + + // The overall response code which takes into account all of the descriptors that were passed + // in the RateLimitRequest message. + Code overall_code = 1; + + // A list of DescriptorStatus messages which matches the length of the descriptor list passed + // in the RateLimitRequest. This can be used by the caller to determine which individual + // descriptors failed and/or what the currently configured limits are for all of them. + repeated DescriptorStatus statuses = 2; + + // A list of headers to add to the response + repeated config.core.v3.HeaderValue response_headers_to_add = 3; + + // A list of headers to add to the request when forwarded + repeated config.core.v3.HeaderValue request_headers_to_add = 4; + + // A response body to send to the downstream client when the response code is not OK. + bytes raw_body = 5; + + // Optional response metadata that will be emitted as dynamic metadata to be consumed by the next + // filter. This metadata lives in a namespace specified by the canonical name of extension filter + // that requires it: + // + // - :ref:`envoy.filters.http.ratelimit ` for HTTP filter. The default namespace can + // be modified by setting the :ref:`metadata_namespace ` + // in the filter configuration. + // - :ref:`envoy.filters.network.ratelimit ` for network filter. + // - :ref:`envoy.filters.thrift.rate_limit ` for Thrift filter. + google.protobuf.Struct dynamic_metadata = 6; + + // Quota is available for a request if its entire descriptor set has cached quota available. + // This is a union of all descriptors in the descriptor set. Clients can use the quota for future matches if and only if the descriptor set matches what was sent in the request that originated this response. + // + // If quota is available, a RLS request will not be made and the quota will be reduced by 1. + // If quota is not available (i.e., a cached entry doesn't exist for a RLS descriptor set), a RLS request will be triggered. + // If the server did not provide a quota, such as the quota message is empty then the request admission is determined by the + // :ref:`overall_code `. + // + // If there is not sufficient quota and the cached entry exists for a RLS descriptor set is out-of-quota but not expired, + // the request will be treated as OVER_LIMIT. + // [#not-implemented-hide:] + Quota quota = 7; +} diff --git a/modules/sync/envoyproxy/envoy/cas/327d9c50181bfabbf3a0c88ffb11199d08a3478dcd2d65daef92d5c6d03e5abcb61632b8dd7cc0dda670a88d444b8785c80c2114f293d43e0f95d17337ef8cb9 b/modules/sync/envoyproxy/envoy/cas/327d9c50181bfabbf3a0c88ffb11199d08a3478dcd2d65daef92d5c6d03e5abcb61632b8dd7cc0dda670a88d444b8785c80c2114f293d43e0f95d17337ef8cb9 new file mode 100644 index 00000000..0bc96cec --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/327d9c50181bfabbf3a0c88ffb11199d08a3478dcd2d65daef92d5c6d03e5abcb61632b8dd7cc0dda670a88d444b8785c80c2114f293d43e0f95d17337ef8cb9 @@ -0,0 +1,224 @@ +syntax = "proto3"; + +package envoy.extensions.wasm.v3; + +import "envoy/config/core/v3/backoff.proto"; +import "envoy/config/core/v3/base.proto"; + +import "google/protobuf/any.proto"; +import "google/protobuf/wrappers.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.wasm.v3"; +option java_outer_classname = "WasmProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/wasm/v3;wasmv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Wasm] +// [#extension: envoy.bootstrap.wasm] + +// If there is a fatal error on the VM (e.g. exception, ``abort()``), then the policy will be applied. +enum FailurePolicy { + // No policy is specified. The default policy will be used. The default policy is ``FAIL_CLOSED``. + UNSPECIFIED = 0; + + // New plugin instance will be created for the new request if the VM is failed. Note this will only + // be applied to the following failures: + // + // * ``proxy_wasm::FailState::RuntimeError`` + // + // This will fallback to the ``FAIL_CLOSED`` for all other failures. + FAIL_RELOAD = 1; + + // All plugins associated with the VM will return an HTTP 503 error. + FAIL_CLOSED = 2; + + // All plugins associated with the VM will be ignored and the filter chain will continue. This + // makes sense when the plugin is optional. + FAIL_OPEN = 3; +} + +message ReloadConfig { + // Backoff strategy for the VM failure reload. If not specified, the default 1s base interval + // will be applied. + config.core.v3.BackoffStrategy backoff = 1; +} + +// Configuration for restricting Proxy-Wasm capabilities available to modules. +message CapabilityRestrictionConfig { + // The Proxy-Wasm capabilities which will be allowed. Capabilities are mapped by + // name. The ``SanitizationConfig`` which each capability maps to is currently unimplemented and ignored, + // and so should be left empty. + // + // The capability names are given in the + // `Proxy-Wasm ABI `_. + // Additionally, the following WASI capabilities from + // `this list `_ + // are implemented and can be allowed: + // ``fd_write``, ``fd_read``, ``fd_seek``, ``fd_close``, ``fd_fdstat_get``, ``environ_get``, ``environ_sizes_get``, + // ``args_get``, ``args_sizes_get``, ``proc_exit``, ``clock_time_get``, ``random_get``. + map allowed_capabilities = 1; +} + +// Configuration for sanitization of inputs to an allowed capability. +// +// .. note:: +// This is currently unimplemented. +message SanitizationConfig { +} + +// Configuration for a Wasm VM. +// [#next-free-field: 9] +message VmConfig { + // An ID which will be used along with a hash of the wasm code (or the name of the registered Null + // VM plugin) to determine which VM will be used for the plugin. All plugins which use the same + // ``vm_id`` and code will use the same VM. May be left blank. Sharing a VM between plugins can + // reduce memory utilization and make sharing of data easier which may have security implications. + // [#comment: TODO: add ref for details.] + string vm_id = 1; + + // The Wasm runtime type, defaults to the first available Wasm engine used at Envoy build-time. + // The priority to search for the available engine is: v8 -> wasmtime -> wamr. + // Available Wasm runtime types are registered as extensions. The following runtimes are included + // in Envoy code base: + // + // .. _extension_envoy.wasm.runtime.null: + // + // **envoy.wasm.runtime.null**: Null sandbox, the Wasm module must be compiled and linked into the + // Envoy binary. The registered name is given in the ``code`` field as ``inline_string``. + // + // .. _extension_envoy.wasm.runtime.v8: + // + // **envoy.wasm.runtime.v8**: `V8 `_-based WebAssembly runtime. + // + // .. _extension_envoy.wasm.runtime.wamr: + // + // **envoy.wasm.runtime.wamr**: `WAMR `_-based WebAssembly runtime. + // This runtime is not enabled in the official build. + // + // .. _extension_envoy.wasm.runtime.wasmtime: + // + // **envoy.wasm.runtime.wasmtime**: `Wasmtime `_-based WebAssembly runtime. + // This runtime is not enabled in the official build. + // + // [#extension-category: envoy.wasm.runtime] + string runtime = 2; + + // The Wasm code that Envoy will execute. + config.core.v3.AsyncDataSource code = 3; + + // The Wasm configuration used in initialization of a new VM + // (``proxy_on_start``). ``google.protobuf.Struct`` is serialized as JSON before + // passing it to the plugin. ``google.protobuf.BytesValue`` and + // ``google.protobuf.StringValue`` are passed directly without the wrapper. + google.protobuf.Any configuration = 4; + + // Allow the wasm file to include pre-compiled code on VMs which support it. + // + // .. warning:: + // This should only be enabled for trusted sources as the precompiled code is not + // verified. + bool allow_precompiled = 5; + + // If true and the code needs to be remotely fetched and it is not in the cache then NACK the configuration + // update and do a background fetch to fill the cache, otherwise fetch the code asynchronously and enter + // warming state. + bool nack_on_code_cache_miss = 6; + + // Specifies environment variables to be injected to this VM which will be available through + // WASI's ``environ_get`` and ``environ_get_sizes`` system calls. Note that these functions + // are generally called implicitly by your language's standard library. Therefore, you do not + // need to call them directly. You can access environment variables in the same way you would + // on native platforms. + // + // .. warning:: + // Envoy rejects the configuration if there's conflict of key space. + EnvironmentVariables environment_variables = 7; + + // Configuration for restricting Proxy-Wasm capabilities available to modules. + // + // The restrictions are applied when the VM is created and are shared by every plugin running in + // that VM, so they are a property of the VM rather than of an individual plugin. + CapabilityRestrictionConfig capability_restriction_config = 8; +} + +message EnvironmentVariables { + // The keys of *Envoy's* environment variables exposed to this VM. In other words, if a key exists in Envoy's environment + // variables, then that key-value pair will be injected. Note that if a key does not exist, it will be ignored. + repeated string host_env_keys = 1; + + // Explicitly given key-value pairs to be injected to this VM in the form of "KEY=VALUE". + map key_values = 2; +} + +// Base Configuration for Wasm Plugins e.g. filters and services. +// [#next-free-field: 10] +message PluginConfig { + // A unique name for a filters/services in a VM for use in identifying the filter/service if + // multiple filters/services are handled by the same ``vm_id`` and ``root_id`` and for + // logging/debugging. + string name = 1; + + // A unique ID for a set of filters/services in a VM which will share a RootContext and Contexts + // if applicable (e.g. an Wasm HttpFilter and an Wasm AccessLog). If left blank, all + // filters/services with a blank root_id with the same ``vm_id`` will share Context(s). + string root_id = 2; + + // Configuration for finding or starting VM. + oneof vm { + VmConfig vm_config = 3; + // TODO: add referential VM configurations. + } + + // Filter/service configuration used to configure or reconfigure a plugin + // (``proxy_on_configure``). + // ``google.protobuf.Struct`` is serialized as JSON before + // passing it to the plugin. ``google.protobuf.BytesValue`` and + // ``google.protobuf.StringValue`` are passed directly without the wrapper. + google.protobuf.Any configuration = 4; + + // If there is a fatal error on the VM (e.g. exception, ``abort()``, ``on_start`` or ``on_configure`` return false), + // then all plugins associated with the VM will either fail closed (by default), e.g. by returning an HTTP 503 error, + // or fail open (if 'fail_open' is set to true) by bypassing the filter. + // + // .. note:: + // When ``on_start`` or ``on_configure`` return ``false`` during xDS updates the xDS configuration will be rejected and when ``on_start`` or ``on_configure`` return ``false`` on + // initial startup the proxy will not start. + // + // This field is deprecated in favor of the ``failure_policy`` field. + bool fail_open = 5 [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // The failure policy for the plugin. + FailurePolicy failure_policy = 7; + + // Reload configuration. This is only applied when ``failure_policy`` is set to ``FAIL_RELOAD``. + ReloadConfig reload_config = 8; + + // Configuration for restricting Proxy-Wasm capabilities available to modules. + // + // This field is deprecated in favor of the :ref:`vm_config.capability_restriction_config + // ` field, because + // the restrictions are applied to the Wasm VM and are therefore shared by every plugin running in + // it. If this field is set and ``vm_config.capability_restriction_config`` is not, this field is + // used to populate it. + CapabilityRestrictionConfig capability_restriction_config = 6 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Whether or not to allow plugin onRequestHeaders and onResponseHeaders callbacks to return + // FilterHeadersStatus::StopIteration. + google.protobuf.BoolValue allow_on_headers_stop_iteration = 9; +} + +// WasmService is configured as a built-in ``envoy.wasm_service`` :ref:`WasmService +// ` This opaque configuration will be used to create a Wasm Service. +message WasmService { + // General plugin configuration. + PluginConfig config = 1; + + // If true, create a single VM rather than creating one VM per worker. Such a singleton can + // not be used with filters. + bool singleton = 2; +} diff --git a/modules/sync/envoyproxy/envoy/cas/34cdb621792ca31ddf9dbd9d82b80ebd8fcf1702b92790ed8f3ec8117b754eeac2fcfc326cea1adb4e55c1691749dbfd552b014e4f6b02312cce062f06286441 b/modules/sync/envoyproxy/envoy/cas/34cdb621792ca31ddf9dbd9d82b80ebd8fcf1702b92790ed8f3ec8117b754eeac2fcfc326cea1adb4e55c1691749dbfd552b014e4f6b02312cce062f06286441 new file mode 100644 index 00000000..c6be053b --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/34cdb621792ca31ddf9dbd9d82b80ebd8fcf1702b92790ed8f3ec8117b754eeac2fcfc326cea1adb4e55c1691749dbfd552b014e4f6b02312cce062f06286441 @@ -0,0 +1,41 @@ +syntax = "proto3"; + +package envoy.extensions.http.injected_credentials.generic.v3; + +import "envoy/extensions/transport_sockets/tls/v3/secret.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.http.injected_credentials.generic.v3"; +option java_outer_classname = "GenericProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/http/injected_credentials/generic/v3;genericv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Generic Credential] +// [#extension: envoy.http.injected_credentials.generic] + +// Generic extension can be used to inject HTTP Basic Auth, Bearer Token, or any arbitrary credential +// into the proxied requests. +// The credential will be injected into the specified HTTP request header. +// Refer to `RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage `_ for details. +// +message Generic { + // The SDS configuration for the credential that will be injected to the specified HTTP request header. + // It must be a generic secret. + transport_sockets.tls.v3.SdsSecretConfig credential = 1 + [(validate.rules).message = {required: true}]; + + // The header that will be injected to the HTTP request with the provided credential. + // If not set, filter will default to: ``Authorization`` + string header = 2 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME ignore_empty: true}]; + + // The prefix to prepend to the credential value before injecting it into the header. + // This is useful for adding a scheme such as ``Bearer `` or ``Basic `` to the credential. + // For example, if the credential is ``xyz123`` and the prefix is ``Bearer ``, the + // final header value will be ``Bearer xyz123``. + // If not set, the raw credential value will be injected without any prefix. + string header_value_prefix = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/374b75100366b366afa9c14d5a1ef45ed82771f5e1b4d532b9345288365e1dcd5457f78e446ae5dd9aae91ce9e3c434c4e10ed242595aae859891f0941318035 b/modules/sync/envoyproxy/envoy/cas/374b75100366b366afa9c14d5a1ef45ed82771f5e1b4d532b9345288365e1dcd5457f78e446ae5dd9aae91ce9e3c434c4e10ed242595aae859891f0941318035 new file mode 100644 index 00000000..2a619292 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/374b75100366b366afa9c14d5a1ef45ed82771f5e1b4d532b9345288365e1dcd5457f78e446ae5dd9aae91ce9e3c434c4e10ed242595aae859891f0941318035 @@ -0,0 +1,121 @@ +syntax = "proto3"; + +package envoy.type.metadata.v3; + +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.type.metadata.v3"; +option java_outer_classname = "MetadataProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/type/metadata/v3;metadatav3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Metadata] + +// MetadataKey provides a way to retrieve values from +// :ref:`Metadata ` using a ``key`` and a ``path``. +// +// For example, consider the following Metadata: +// +// .. code-block:: yaml +// +// filter_metadata: +// envoy.xxx: +// prop: +// foo: bar +// xyz: +// hello: envoy +// +// The following MetadataKey would retrieve the string value "bar" from the Metadata: +// +// .. code-block:: yaml +// +// key: envoy.xxx +// path: +// - key: prop +// - key: foo +// +message MetadataKey { + option (udpa.annotations.versioning).previous_message_type = "envoy.type.metadata.v2.MetadataKey"; + + // Specifies a segment in a path for retrieving values from Metadata. + // Supports both key-based segments (field names in a Struct) and index-based + // segments (element access in a ListValue). + message PathSegment { + option (udpa.annotations.versioning).previous_message_type = + "envoy.type.metadata.v2.MetadataKey.PathSegment"; + + oneof segment { + option (validate.required) = true; + + // If specified, use this key to retrieve the value in a Struct. + string key = 1 [(validate.rules).string = {min_len: 1}]; + + // If specified, use this index to retrieve a value from a ListValue. + uint32 index = 2; + } + } + + // The key name of the Metadata from which to retrieve the Struct. + // This typically represents a builtin subsystem or custom extension. + string key = 1 [(validate.rules).string = {min_len: 1}]; + + // The path used to retrieve a specific Value from the Struct. + // This can be either a prefix or a full path, depending on the use case. + // For example, ``[{key: prop}, {key: xyz}]`` would retrieve a struct or ``[{key: prop}, {key: foo}]`` + // would retrieve a string in the example above. + // + // Path segments support both struct field access (via ``key``) and list element access (via ``index``). + // For example, to access the first element of a list at ``envoy.filters.http.grpc_field_extraction.tenant_id``, + // use ``path: [{key: tenant_id}, {index: 0}]``. + repeated PathSegment path = 2 [(validate.rules).repeated = {min_items: 1}]; +} + +// Describes different types of metadata sources. +message MetadataKind { + option (udpa.annotations.versioning).previous_message_type = + "envoy.type.metadata.v2.MetadataKind"; + + // Represents dynamic metadata associated with the request. + message Request { + option (udpa.annotations.versioning).previous_message_type = + "envoy.type.metadata.v2.MetadataKind.Request"; + } + + // Represents metadata from :ref:`the route`. + message Route { + option (udpa.annotations.versioning).previous_message_type = + "envoy.type.metadata.v2.MetadataKind.Route"; + } + + // Represents metadata from :ref:`the upstream cluster`. + message Cluster { + option (udpa.annotations.versioning).previous_message_type = + "envoy.type.metadata.v2.MetadataKind.Cluster"; + } + + // Represents metadata from :ref:`the upstream + // host`. + message Host { + option (udpa.annotations.versioning).previous_message_type = + "envoy.type.metadata.v2.MetadataKind.Host"; + } + + oneof kind { + option (validate.required) = true; + + // Request kind of metadata. + Request request = 1; + + // Route kind of metadata. + Route route = 2; + + // Cluster kind of metadata. + Cluster cluster = 3; + + // Host kind of metadata. + Host host = 4; + } +} diff --git a/modules/sync/envoyproxy/envoy/cas/37da7ed59f40a587cafd0726db8a894ff61a65bf604e2473b134eb33acec205c57602232ef3fd8e566ca031ee4decf0cc056d96d895ee992f7d77c154c747892 b/modules/sync/envoyproxy/envoy/cas/37da7ed59f40a587cafd0726db8a894ff61a65bf604e2473b134eb33acec205c57602232ef3fd8e566ca031ee4decf0cc056d96d895ee992f7d77c154c747892 new file mode 100644 index 00000000..32cd8419 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/37da7ed59f40a587cafd0726db8a894ff61a65bf604e2473b134eb33acec205c57602232ef3fd8e566ca031ee4decf0cc056d96d895ee992f7d77c154c747892 @@ -0,0 +1,1440 @@ +syntax = "proto3"; + +package envoy.config.cluster.v3; + +import "envoy/config/cluster/v3/circuit_breaker.proto"; +import "envoy/config/cluster/v3/filter.proto"; +import "envoy/config/cluster/v3/outlier_detection.proto"; +import "envoy/config/core/v3/address.proto"; +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/config_source.proto"; +import "envoy/config/core/v3/extension.proto"; +import "envoy/config/core/v3/health_check.proto"; +import "envoy/config/core/v3/protocol.proto"; +import "envoy/config/core/v3/resolver.proto"; +import "envoy/config/endpoint/v3/endpoint.proto"; +import "envoy/config/metrics/v3/stats.proto"; +import "envoy/type/matcher/v3/metadata.proto"; +import "envoy/type/metadata/v3/metadata.proto"; +import "envoy/type/v3/percent.proto"; + +import "google/protobuf/any.proto"; +import "google/protobuf/duration.proto"; +import "google/protobuf/struct.proto"; +import "google/protobuf/wrappers.proto"; + +import "xds/core/v3/collection_entry.proto"; +import "xds/type/matcher/v3/matcher.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/migrate.proto"; +import "udpa/annotations/security.proto"; +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.config.cluster.v3"; +option java_outer_classname = "ClusterProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3;clusterv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Cluster configuration] + +// Cluster list collections. Entries are ``Cluster`` resources or references. +// [#not-implemented-hide:] +message ClusterCollection { + xds.core.v3.CollectionEntry entries = 1; +} + +// Configuration for a single upstream cluster. +// [#next-free-field: 63] +message Cluster { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.Cluster"; + + // Refer to :ref:`service discovery type ` + // for an explanation on each type. + enum DiscoveryType { + // Refer to the :ref:`static discovery type` + // for an explanation. + STATIC = 0; + + // Refer to the :ref:`strict DNS discovery + // type` + // for an explanation. + STRICT_DNS = 1; + + // Refer to the :ref:`logical DNS discovery + // type` + // for an explanation. + LOGICAL_DNS = 2; + + // Refer to the :ref:`service discovery type` + // for an explanation. + EDS = 3; + + // Refer to the :ref:`original destination discovery + // type` + // for an explanation. + ORIGINAL_DST = 4; + } + + // Refer to :ref:`load balancer type ` architecture + // overview section for information on each type. + enum LbPolicy { + reserved 4; + + reserved "ORIGINAL_DST_LB"; + + // Refer to the :ref:`round robin load balancing + // policy` + // for an explanation. + ROUND_ROBIN = 0; + + // Refer to the :ref:`least request load balancing + // policy` + // for an explanation. + LEAST_REQUEST = 1; + + // Refer to the :ref:`ring hash load balancing + // policy` + // for an explanation. + RING_HASH = 2; + + // Refer to the :ref:`random load balancing + // policy` + // for an explanation. + RANDOM = 3; + + // Refer to the :ref:`Maglev load balancing policy` + // for an explanation. + MAGLEV = 5; + + // This load balancer type must be specified if the configured cluster provides a cluster + // specific load balancer. Consult the configured cluster's documentation for whether to set + // this option or not. + CLUSTER_PROVIDED = 6; + + // Use the new :ref:`load_balancing_policy + // ` field to determine the LB policy. + // This has been deprecated in favor of using the :ref:`load_balancing_policy + // ` field without + // setting any value in :ref:`lb_policy`. + LOAD_BALANCING_POLICY_CONFIG = 7; + } + + // When V4_ONLY is selected, the DNS resolver will only perform a lookup for + // addresses in the IPv4 family. If V6_ONLY is selected, the DNS resolver will + // only perform a lookup for addresses in the IPv6 family. If AUTO is + // specified, the DNS resolver will first perform a lookup for addresses in + // the IPv6 family and fallback to a lookup for addresses in the IPv4 family. + // This is semantically equivalent to a non-existent V6_PREFERRED option. + // AUTO is a legacy name that is more opaque than + // necessary and will be deprecated in favor of V6_PREFERRED in a future major version of the API. + // If V4_PREFERRED is specified, the DNS resolver will first perform a lookup for addresses in the + // IPv4 family and fallback to a lookup for addresses in the IPv6 family. i.e., the callback + // target will only get v6 addresses if there were NO v4 addresses to return. + // If ALL is specified, the DNS resolver will perform a lookup for both IPv4 and IPv6 families, + // and return all resolved addresses. When this is used, Happy Eyeballs will be enabled for + // upstream connections. Refer to :ref:`Happy Eyeballs Support ` + // for more information. + // For cluster types other than + // :ref:`STRICT_DNS` and + // :ref:`LOGICAL_DNS`, + // this setting is + // ignored. + // [#next-major-version: deprecate AUTO in favor of a V6_PREFERRED option.] + enum DnsLookupFamily { + AUTO = 0; + V4_ONLY = 1; + V6_ONLY = 2; + V4_PREFERRED = 3; + ALL = 4; + } + + enum ClusterProtocolSelection { + // Cluster can only operate on one of the possible upstream protocols (HTTP1.1, HTTP2). + // If :ref:`http2_protocol_options ` are + // present, HTTP2 will be used, otherwise HTTP1.1 will be used. + USE_CONFIGURED_PROTOCOL = 0; + + // Use HTTP1.1 or HTTP2, depending on which one is used on the downstream connection. + USE_DOWNSTREAM_PROTOCOL = 1; + } + + // TransportSocketMatch specifies what transport socket config will be used + // when the match conditions are satisfied. + message TransportSocketMatch { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.Cluster.TransportSocketMatch"; + + // The name of the match, used in stats generation. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // Optional metadata match criteria. + // The connection to the endpoint with metadata matching what is set in this field + // will use the transport socket configuration specified here. + // The endpoint's metadata entry in ``envoy.transport_socket_match`` is used to match + // against the values specified in this field. + google.protobuf.Struct match = 2; + + // The configuration of the transport socket. + // [#extension-category: envoy.transport_sockets.upstream] + core.v3.TransportSocket transport_socket = 3; + } + + // Extended cluster type. + message CustomClusterType { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.Cluster.CustomClusterType"; + + // The type of the cluster to instantiate. The name must match a supported cluster type. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // Cluster specific configuration which depends on the cluster being instantiated. + // See the supported cluster for further documentation. + // [#extension-category: envoy.clusters] + google.protobuf.Any typed_config = 2; + } + + // Only valid when discovery type is EDS. + message EdsClusterConfig { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.Cluster.EdsClusterConfig"; + + // Configuration for the source of EDS updates for this Cluster. + core.v3.ConfigSource eds_config = 1; + + // Optional alternative to cluster name to present to EDS. This does not + // have the same restrictions as cluster name, i.e. it may be arbitrary + // length. This may be a xdstp:// URL. + string service_name = 2; + } + + // Optionally divide the endpoints in this cluster into subsets defined by + // endpoint metadata and selected by route and weighted cluster metadata. + // [#next-free-field: 9] + message LbSubsetConfig { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.Cluster.LbSubsetConfig"; + + // If NO_FALLBACK is selected, a result + // equivalent to no healthy hosts is reported. If ANY_ENDPOINT is selected, + // any cluster endpoint may be returned (subject to policy, health checks, + // etc). If DEFAULT_SUBSET is selected, load balancing is performed over the + // endpoints matching the values from the default_subset field. + enum LbSubsetFallbackPolicy { + NO_FALLBACK = 0; + ANY_ENDPOINT = 1; + DEFAULT_SUBSET = 2; + } + + enum LbSubsetMetadataFallbackPolicy { + // No fallback. Route metadata will be used as-is. + METADATA_NO_FALLBACK = 0; + + // A special metadata key ``fallback_list`` will be used to provide variants of metadata to try. + // Value of ``fallback_list`` key has to be a list. Every list element has to be a struct - it will + // be merged with route metadata, overriding keys that appear in both places. + // ``fallback_list`` entries will be used in order until a host is found. + // + // ``fallback_list`` key itself is removed from metadata before subset load balancing is performed. + // + // Example: + // + // for metadata: + // + // .. code-block:: yaml + // + // version: 1.0 + // fallback_list: + // - version: 2.0 + // hardware: c64 + // - hardware: c32 + // - version: 3.0 + // + // at first, metadata: + // + // .. code-block:: json + // + // {"version": "2.0", "hardware": "c64"} + // + // will be used for load balancing. If no host is found, metadata: + // + // .. code-block:: json + // + // {"version": "1.0", "hardware": "c32"} + // + // is next to try. If it still results in no host, finally metadata: + // + // .. code-block:: json + // + // {"version": "3.0"} + // + // is used. + FALLBACK_LIST = 1; + } + + // Specifications for subsets. + message LbSubsetSelector { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.Cluster.LbSubsetConfig.LbSubsetSelector"; + + // Allows to override top level fallback policy per selector. + enum LbSubsetSelectorFallbackPolicy { + // If NOT_DEFINED top level config fallback policy is used instead. + NOT_DEFINED = 0; + + // If NO_FALLBACK is selected, a result equivalent to no healthy hosts is reported. + NO_FALLBACK = 1; + + // If ANY_ENDPOINT is selected, any cluster endpoint may be returned + // (subject to policy, health checks, etc). + ANY_ENDPOINT = 2; + + // If DEFAULT_SUBSET is selected, load balancing is performed over the + // endpoints matching the values from the default_subset field. + DEFAULT_SUBSET = 3; + + // If KEYS_SUBSET is selected, subset selector matching is performed again with metadata + // keys reduced to + // :ref:`fallback_keys_subset`. + // It allows for a fallback to a different, less specific selector if some of the keys of + // the selector are considered optional. + KEYS_SUBSET = 4; + } + + // List of keys to match with the weighted cluster metadata. + repeated string keys = 1; + + // Selects a mode of operation in which each subset has only one host. This mode uses the same rules for + // choosing a host, but updating hosts is faster, especially for large numbers of hosts. + // + // If a match is found to a host, that host will be used regardless of priority levels. + // + // When this mode is enabled, configurations that contain more than one host with the same metadata value for the single key in ``keys`` + // will use only one of the hosts with the given key; no requests will be routed to the others. The cluster gauge + // :ref:`lb_subsets_single_host_per_subset_duplicate` indicates how many duplicates are + // present in the current configuration. + bool single_host_per_subset = 4; + + // The behavior used when no endpoint subset matches the selected route's + // metadata. + LbSubsetSelectorFallbackPolicy fallback_policy = 2 + [(validate.rules).enum = {defined_only: true}]; + + // Subset of + // :ref:`keys` used by + // :ref:`KEYS_SUBSET` + // fallback policy. + // It has to be a non empty list if KEYS_SUBSET fallback policy is selected. + // For any other fallback policy the parameter is not used and should not be set. + // Only values also present in + // :ref:`keys` are allowed, but + // ``fallback_keys_subset`` cannot be equal to ``keys``. + repeated string fallback_keys_subset = 3; + } + + // The behavior used when no endpoint subset matches the selected route's + // metadata. The value defaults to + // :ref:`NO_FALLBACK`. + LbSubsetFallbackPolicy fallback_policy = 1 [(validate.rules).enum = {defined_only: true}]; + + // Specifies the default subset of endpoints used during fallback if + // fallback_policy is + // :ref:`DEFAULT_SUBSET`. + // Each field in default_subset is + // compared to the matching LbEndpoint.Metadata under the ``envoy.lb`` + // namespace. It is valid for no hosts to match, in which case the behavior + // is the same as a fallback_policy of + // :ref:`NO_FALLBACK`. + google.protobuf.Struct default_subset = 2; + + // For each entry, LbEndpoint.Metadata's + // ``envoy.lb`` namespace is traversed and a subset is created for each unique + // combination of key and value. For example: + // + // .. code-block:: json + // + // { "subset_selectors": [ + // { "keys": [ "version" ] }, + // { "keys": [ "stage", "hardware_type" ] } + // ]} + // + // A subset is matched when the metadata from the selected route and + // weighted cluster contains the same keys and values as the subset's + // metadata. The same host may appear in multiple subsets. + repeated LbSubsetSelector subset_selectors = 3; + + // If true, routing to subsets will take into account the localities and locality weights of the + // endpoints when making the routing decision. + // + // There are some potential pitfalls associated with enabling this feature, as the resulting + // traffic split after applying both a subset match and locality weights might be undesirable. + // + // Consider for example a situation in which you have 50/50 split across two localities X/Y + // which have 100 hosts each without subsetting. If the subset LB results in X having only 1 + // host selected but Y having 100, then a lot more load is being dumped on the single host in X + // than originally anticipated in the load balancing assignment delivered via EDS. + bool locality_weight_aware = 4; + + // When used with locality_weight_aware, scales the weight of each locality by the ratio + // of hosts in the subset vs hosts in the original subset. This aims to even out the load + // going to an individual locality if said locality is disproportionately affected by the + // subset predicate. + bool scale_locality_weight = 5; + + // If true, when a fallback policy is configured and its corresponding subset fails to find + // a host this will cause any host to be selected instead. + // + // This is useful when using the default subset as the fallback policy, given the default + // subset might become empty. With this option enabled, if that happens the LB will attempt + // to select a host from the entire cluster. + bool panic_mode_any = 6; + + // If true, metadata specified for a metadata key will be matched against the corresponding + // endpoint metadata if the endpoint metadata matches the value exactly OR it is a list value + // and any of the elements in the list matches the criteria. + bool list_as_any = 7; + + // Fallback mechanism that allows to try different route metadata until a host is found. + // If load balancing process, including all its mechanisms (like + // :ref:`fallback_policy`) + // fails to select a host, this policy decides if and how the process is repeated using another metadata. + // + // The value defaults to + // :ref:`METADATA_NO_FALLBACK`. + LbSubsetMetadataFallbackPolicy metadata_fallback_policy = 8 + [(validate.rules).enum = {defined_only: true}]; + } + + // Configuration for :ref:`slow start mode `. + message SlowStartConfig { + // Represents the size of slow start window. + // If set, the newly created host remains in slow start mode starting from its creation time + // for the duration of slow start window. + google.protobuf.Duration slow_start_window = 1; + + // This parameter controls the speed of traffic increase over the slow start window. Defaults to 1.0, + // so that endpoint would get linearly increasing amount of traffic. + // When increasing the value for this parameter, the speed of traffic ramp-up increases non-linearly. + // The value of aggression parameter should be greater than 0.0. + // By tuning the parameter, is possible to achieve polynomial or exponential shape of ramp-up curve. + // + // During slow start window, effective weight of an endpoint would be scaled with time factor and aggression: + // ``new_weight = weight * max(min_weight_percent, time_factor ^ (1 / aggression))``, + // where ``time_factor=(time_since_start_seconds / slow_start_time_seconds)``. + // + // As time progresses, more and more traffic would be sent to endpoint, which is in slow start window. + // Once host exits slow start, time_factor and aggression no longer affect its weight. + core.v3.RuntimeDouble aggression = 2; + + // Configures the minimum percentage of origin weight that avoids too small new weight, + // which may cause endpoints in slow start mode receive no traffic in slow start window. + // If not specified, the default is 10%. + type.v3.Percent min_weight_percent = 3; + } + + // Specific configuration for the RoundRobin load balancing policy. + message RoundRobinLbConfig { + // Configuration for slow start mode. + // If this configuration is not set, slow start will not be not enabled. + SlowStartConfig slow_start_config = 1; + } + + // Specific configuration for the LeastRequest load balancing policy. + message LeastRequestLbConfig { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.Cluster.LeastRequestLbConfig"; + + // The number of random healthy hosts from which the host with the fewest active requests will + // be chosen. Defaults to 2 so that we perform two-choice selection if the field is not set. + google.protobuf.UInt32Value choice_count = 1 [(validate.rules).uint32 = {gte: 2}]; + + // The following formula is used to calculate the dynamic weights when hosts have different load + // balancing weights: + // + // ``weight = load_balancing_weight / (active_requests + 1)^active_request_bias`` + // + // The larger the active request bias is, the more aggressively active requests will lower the + // effective weight when all host weights are not equal. + // + // ``active_request_bias`` must be greater than or equal to 0.0. + // + // When ``active_request_bias == 0.0`` the Least Request Load Balancer doesn't consider the number + // of active requests at the time it picks a host and behaves like the Round Robin Load + // Balancer. + // + // When ``active_request_bias > 0.0`` the Least Request Load Balancer scales the load balancing + // weight by the number of active requests at the time it does a pick. + // + // The value is cached for performance reasons and refreshed whenever one of the Load Balancer's + // host sets changes, e.g., whenever there is a host membership update or a host load balancing + // weight change. + // + // .. note:: + // This setting only takes effect if all host weights are not equal. + core.v3.RuntimeDouble active_request_bias = 2; + + // Configuration for slow start mode. + // If this configuration is not set, slow start will not be not enabled. + SlowStartConfig slow_start_config = 3; + } + + // Specific configuration for the :ref:`RingHash` + // load balancing policy. + message RingHashLbConfig { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.Cluster.RingHashLbConfig"; + + // The hash function used to hash hosts onto the ketama ring. + enum HashFunction { + // Use `xxHash `_, this is the default hash function. + XX_HASH = 0; + + // Use `MurmurHash2 `_, this is compatible with + // std:hash in GNU libstdc++ 3.4.20 or above. This is typically the case when compiled + // on Linux and not macOS. + MURMUR_HASH_2 = 1; + } + + reserved 2; + + // Minimum hash ring size. The larger the ring is (that is, the more hashes there are for each + // provided host) the better the request distribution will reflect the desired weights. Defaults + // to 1024 entries, and limited to 8M entries. See also + // :ref:`maximum_ring_size`. + google.protobuf.UInt64Value minimum_ring_size = 1 [(validate.rules).uint64 = {lte: 8388608}]; + + // The hash function used to hash hosts onto the ketama ring. The value defaults to + // :ref:`XX_HASH`. + HashFunction hash_function = 3 [(validate.rules).enum = {defined_only: true}]; + + // Maximum hash ring size. Defaults to 8M entries, and limited to 8M entries, but can be lowered + // to further constrain resource use. See also + // :ref:`minimum_ring_size`. + google.protobuf.UInt64Value maximum_ring_size = 4 [(validate.rules).uint64 = {lte: 8388608}]; + } + + // Specific configuration for the :ref:`Maglev` + // load balancing policy. + message MaglevLbConfig { + // The table size for Maglev hashing. Maglev aims for "minimal disruption" rather than an absolute guarantee. + // Minimal disruption means that when the set of upstream hosts change, a connection will likely be sent to the same + // upstream as it was before. Increasing the table size reduces the amount of disruption. + // The table size must be prime number limited to 5000011. If it is not specified, the default is 65537. + google.protobuf.UInt64Value table_size = 1 [(validate.rules).uint64 = {lte: 5000011}]; + } + + // Specific configuration for the + // :ref:`Original Destination ` + // load balancing policy. + // [#extension: envoy.clusters.original_dst] + message OriginalDstLbConfig { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.Cluster.OriginalDstLbConfig"; + + // When true, a HTTP header can be used to override the original dst address. The default header is + // :ref:`x-envoy-original-dst-host `. + // + // .. attention:: + // + // This header isn't sanitized by default, so enabling this feature allows HTTP clients to + // route traffic to arbitrary hosts and/or ports, which may have serious security + // consequences. + // + // .. note:: + // + // If the header appears multiple times only the first value is used. + bool use_http_header = 1; + + // The http header to override destination address if :ref:`use_http_header `. + // is set to true. If the value is empty, :ref:`x-envoy-original-dst-host ` will be used. + string http_header_name = 2; + + // The port to override for the original dst address. This port + // will take precedence over filter state and header override ports + google.protobuf.UInt32Value upstream_port_override = 3 [(validate.rules).uint32 = {lte: 65535}]; + + // The dynamic metadata key to override destination address. + // First the request metadata is considered, then the connection one. + type.metadata.v3.MetadataKey metadata_key = 4; + } + + // Common configuration for all load balancer implementations. + // [#next-free-field: 9] + message CommonLbConfig { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.Cluster.CommonLbConfig"; + + // Configuration for :ref:`zone aware routing + // `. + message ZoneAwareLbConfig { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.Cluster.CommonLbConfig.ZoneAwareLbConfig"; + + // Configures percentage of requests that will be considered for zone aware routing + // if zone aware routing is configured. If not specified, the default is 100%. + // * :ref:`runtime values `. + // * :ref:`Zone aware routing support `. + type.v3.Percent routing_enabled = 1; + + // Configures minimum upstream cluster size required for zone aware routing + // If upstream cluster size is less than specified, zone aware routing is not performed + // even if zone aware routing is configured. If not specified, the default is 6. + // * :ref:`runtime values `. + // * :ref:`Zone aware routing support `. + google.protobuf.UInt64Value min_cluster_size = 2; + + // If set to true, Envoy will not consider any hosts when the cluster is in :ref:`panic + // mode`. Instead, the cluster will fail all + // requests as if all hosts are unhealthy. This can help avoid potentially overwhelming a + // failing service. + bool fail_traffic_on_panic = 3; + } + + // Configuration for :ref:`locality weighted load balancing + // ` + message LocalityWeightedLbConfig { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.Cluster.CommonLbConfig.LocalityWeightedLbConfig"; + } + + // Common Configuration for all consistent hashing load balancers (MaglevLb, RingHashLb, etc.) + message ConsistentHashingLbConfig { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.Cluster.CommonLbConfig.ConsistentHashingLbConfig"; + + // If set to ``true``, the cluster will use hostname instead of the resolved + // address as the key to consistently hash to an upstream host. Only valid for StrictDNS clusters with hostnames which resolve to a single IP address. + bool use_hostname_for_hashing = 1; + + // Configures percentage of average cluster load to bound per upstream host. For example, with a value of 150 + // no upstream host will get a load more than 1.5 times the average load of all the hosts in the cluster. + // If not specified, the load is not bounded for any upstream host. Typical value for this parameter is between 120 and 200. + // Minimum is 100. + // + // Applies to both Ring Hash and Maglev load balancers. + // + // This is implemented based on the method described in the paper https://arxiv.org/abs/1608.01350. For the specified + // ``hash_balance_factor``, requests to any upstream host are capped at ``hash_balance_factor/100`` times the average number of requests + // across the cluster. When a request arrives for an upstream host that is currently serving at its max capacity, linear probing + // is used to identify an eligible host. Further, the linear probe is implemented using a random jump in hosts ring/table to identify + // the eligible host (this technique is as described in the paper https://arxiv.org/abs/1908.08762 - the random jump avoids the + // cascading overflow effect when choosing the next host in the ring/table). + // + // If weights are specified on the hosts, they are respected. + // + // This is an O(N) algorithm, unlike other load balancers. Using a lower ``hash_balance_factor`` results in more hosts + // being probed, so use a higher value if you require better performance. + google.protobuf.UInt32Value hash_balance_factor = 2 [(validate.rules).uint32 = {gte: 100}]; + } + + // Configures the :ref:`healthy panic threshold `. + // If not specified, the default is 50%. + // To disable panic mode, set to 0%. + // + // .. note:: + // The specified percent will be truncated to the nearest 1%. + type.v3.Percent healthy_panic_threshold = 1; + + oneof locality_config_specifier { + ZoneAwareLbConfig zone_aware_lb_config = 2; + + LocalityWeightedLbConfig locality_weighted_lb_config = 3; + } + + // If set, all health check/weight/metadata updates that happen within this duration will be + // merged and delivered in one shot when the duration expires. The start of the duration is when + // the first update happens. This is useful for big clusters, with potentially noisy deploys + // that might trigger excessive CPU usage due to a constant stream of healthcheck state changes + // or metadata updates. The first set of updates to be seen apply immediately (e.g.: a new + // cluster). Please always keep in mind that the use of sandbox technologies may change this + // behavior. + // + // If this is not set, we default to a merge window of 1000ms. To disable it, set the merge + // window to 0. + // + // .. note:: + // Merging does not apply to cluster membership changes (e.g.: adds/removes); this is + // because merging those updates isn't currently safe. See + // https://github.com/envoyproxy/envoy/pull/3941. + google.protobuf.Duration update_merge_window = 4; + + // If set to true, Envoy will :ref:`exclude ` new hosts + // when computing load balancing weights until they have been health checked for the first time. + // This will have no effect unless active health checking is also configured. + bool ignore_new_hosts_until_first_hc = 5; + + // If set to ``true``, the cluster manager will drain all existing + // connections to upstream hosts whenever hosts are added or removed from the cluster. + bool close_connections_on_host_set_change = 6; + + // Common Configuration for all consistent hashing load balancers (MaglevLb, RingHashLb, etc.) + ConsistentHashingLbConfig consistent_hashing_lb_config = 7; + + // This controls what hosts are considered valid when using + // :ref:`host overrides `, which is used by some + // filters to modify the load balancing decision. + // + // If this is unset then [UNKNOWN, HEALTHY, DEGRADED] will be applied by default. If this is + // set with an empty set of statuses then host overrides will be ignored by the load balancing. + core.v3.HealthStatusSet override_host_status = 8; + } + + message RefreshRate { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.Cluster.RefreshRate"; + + // Specifies the base interval between refreshes. This parameter is required and must be greater + // than zero and less than + // :ref:`max_interval `. + google.protobuf.Duration base_interval = 1 [(validate.rules).duration = { + required: true + gt {nanos: 1000000} + }]; + + // Specifies the maximum interval between refreshes. This parameter is optional, but must be + // greater than or equal to the + // :ref:`base_interval ` if set. The default + // is 10 times the :ref:`base_interval `. + google.protobuf.Duration max_interval = 2 [(validate.rules).duration = {gt {nanos: 1000000}}]; + } + + message PreconnectPolicy { + // Indicates how many streams (rounded up) can be anticipated per-upstream for each + // incoming stream. This is useful for high-QPS or latency-sensitive services. Preconnecting + // will only be done if the upstream is healthy and the cluster has traffic. + // + // For example if this is 2, for an incoming HTTP/1.1 stream, 2 connections will be + // established, one for the new incoming stream, and one for a presumed follow-up stream. For + // HTTP/2, only one connection would be established by default as one connection can + // serve both the original and presumed follow-up stream. + // + // In steady state for non-multiplexed connections a value of 1.5 would mean if there were 100 + // active streams, there would be 100 connections in use, and 50 connections preconnected. + // This might be a useful value for something like short lived single-use connections, + // for example proxying HTTP/1.1 if keep-alive were false and each stream resulted in connection + // termination. It would likely be overkill for long lived connections, such as TCP proxying SMTP + // or regular HTTP/1.1 with keep-alive. For long lived traffic, a value of 1.05 would be more + // reasonable, where for every 100 connections, 5 preconnected connections would be in the queue + // in case of unexpected disconnects where the connection could not be reused. + // + // If this value is not set, or set explicitly to one, Envoy will fetch as many connections + // as needed to serve streams in flight. This means in steady state if a connection is torn down, + // a subsequent streams will pay an upstream-rtt latency penalty waiting for a new connection. + // + // This is limited somewhat arbitrarily to 3 because preconnecting too aggressively can + // harm latency more than the preconnecting helps. + google.protobuf.DoubleValue per_upstream_preconnect_ratio = 1 + [(validate.rules).double = {lte: 3.0 gte: 1.0}]; + + // Indicates how many streams (rounded up) can be anticipated across a cluster for each + // stream, useful for low QPS services. This is currently supported for a subset of + // deterministic non-hash-based load-balancing algorithms (weighted round robin, random). + // Unlike ``per_upstream_preconnect_ratio`` this preconnects across the upstream instances in a + // cluster, doing best effort predictions of what upstream would be picked next and + // pre-establishing a connection. + // + // Preconnecting will be limited to one preconnect per configured upstream in the cluster and will + // only be done if there are healthy upstreams and the cluster has traffic. + // + // For example if preconnecting is set to 2 for a round robin HTTP/2 cluster, on the first + // incoming stream, 2 connections will be preconnected - one to the first upstream for this + // cluster, one to the second on the assumption there will be a follow-up stream. + // + // If this value is not set, or set explicitly to one, Envoy will fetch as many connections + // as needed to serve streams in flight, so during warm up and in steady state if a connection + // is closed (and per_upstream_preconnect_ratio is not set), there will be a latency hit for + // connection establishment. + // + // If both this and preconnect_ratio are set, Envoy will make sure both predicted needs are met, + // basically preconnecting max(predictive-preconnect, per-upstream-preconnect), for each + // upstream. + // + // This is limited somewhat arbitrarily to 3 because preconnecting too aggressively can + // harm latency more than the preconnecting helps. + google.protobuf.DoubleValue predictive_preconnect_ratio = 2 + [(validate.rules).double = {lte: 3.0 gte: 1.0}]; + + // Restricts anticipatory connections to hosts whose endpoint metadata matches this matcher. + // Non-matching hosts are never preconnected, and instead get connections only on demand, as they + // serve real requests. If unset, all healthy hosts are eligible. + type.matcher.v3.MetadataMatcher preconnect_enabled_metadata = 3; + } + + // Queueing policies for the cluster. + message QueuingPolicies { + // Queue policy for cluster pending requests. If unset, Envoy uses the FIFO queue policy. + // [#extension-category: envoy.queue_policy] + core.v3.TypedExtensionConfig pending_rq_policy = 1; + } + + reserved 12, 15, 7, 11, 35; + + reserved "hosts", "tls_context", "extension_protocol_options"; + + // Configuration to use different transport sockets for different endpoints. The entry of + // ``envoy.transport_socket_match`` in the :ref:`LbEndpoint.Metadata + // ` is used to match against the + // transport sockets as they appear in the list. If a match is not found, the search continues in + // :ref:`LocalityLbEndpoints.Metadata + // `. The first :ref:`match + // ` is used. For example, with + // the following match + // + // .. code-block:: yaml + // + // transport_socket_matches: + // - name: "enableMTLS" + // match: + // acceptMTLS: true + // transport_socket: + // name: envoy.transport_sockets.tls + // config: { ... } # tls socket configuration + // - name: "defaultToPlaintext" + // match: {} + // transport_socket: + // name: envoy.transport_sockets.raw_buffer + // + // Connections to the endpoints whose metadata value under ``envoy.transport_socket_match`` + // having "acceptMTLS"/"true" key/value pair use the "enableMTLS" socket configuration. + // + // If a :ref:`socket match ` with empty match + // criteria is provided, that always match any endpoint. For example, the "defaultToPlaintext" + // socket match in case above. + // + // If an endpoint metadata's value under ``envoy.transport_socket_match`` does not match any + // ``TransportSocketMatch``, the locality metadata is then checked for a match. Barring any + // matches in the endpoint or locality metadata, the socket configuration fallbacks to use the + // ``tls_context`` or ``transport_socket`` specified in this cluster. + // + // This field allows gradual and flexible transport socket configuration changes. + // + // The metadata of endpoints in EDS can indicate transport socket capabilities. For example, + // an endpoint's metadata can have two key value pairs as "acceptMTLS": "true", + // "acceptPlaintext": "true". While some other endpoints, only accepting plaintext traffic + // has "acceptPlaintext": "true" metadata information. + // + // Then the xDS server can configure the CDS to a client, Envoy A, to send mutual TLS + // traffic for endpoints with "acceptMTLS": "true", by adding a corresponding + // ``TransportSocketMatch`` in this field. Other client Envoys receive CDS without + // ``transport_socket_match`` set, and still send plain text traffic to the same cluster. + // + // This field can be used to specify custom transport socket configurations for health + // checks by adding matching key/value pairs in a health check's + // :ref:`transport socket match criteria ` field. + // + // [#comment:TODO(incfly): add a detailed architecture doc on intended usage.] + repeated TransportSocketMatch transport_socket_matches = 43; + + // Optional matcher that selects a transport socket from + // :ref:`transport_socket_matches `. + // + // This matcher uses the generic xDS matcher framework to select a named transport socket + // based on various inputs available at transport socket selection time. + // + // Supported matching inputs: + // + // * ``endpoint_metadata``: Extract values from the selected endpoint's metadata. + // * ``locality_metadata``: Extract values from the endpoint's locality metadata. + // * ``transport_socket_filter_state``: Extract values from filter state that was explicitly shared from + // downstream to upstream via ``TransportSocketOptions``. This enables flexible + // downstream-connection-based matching, such as: + // + // - Network namespace matching. + // - Custom connection attributes. + // - Any data explicitly passed via filter state. + // + // .. note:: + // Filter state sharing follows the same pattern as tunneling in Envoy. Filters must explicitly + // share data by setting filter state with the appropriate sharing mode. The filter state is + // then accessible via the ``transport_socket_filter_state`` input during transport socket selection. + // + // If this field is set, it takes precedence over legacy metadata-based selection + // performed by :ref:`transport_socket_matches + // ` alone. + // If the matcher does not yield a match, Envoy uses the default transport socket + // configured for the cluster. + // + // When using this field, each entry in + // :ref:`transport_socket_matches ` + // must have a unique ``name``. The matcher outcome is expected to reference one of + // these names. + xds.type.matcher.v3.Matcher transport_socket_matcher = 59; + + // Supplies the name of the cluster which must be unique across all clusters. + // The cluster name is used when emitting + // :ref:`statistics ` if :ref:`alt_stat_name + // ` is not provided. + // Any ``:`` in the cluster name will be converted to ``_`` when emitting statistics. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // An optional alternative to the cluster name to be used for observability. This name is used + // for emitting stats for the cluster and access logging the cluster name. This will appear as + // additional information in configuration dumps of a cluster's current status as + // :ref:`observability_name ` + // and as an additional tag "upstream_cluster.name" while tracing. + // + // .. note:: + // Any ``:`` in the name will be converted to ``_`` when emitting statistics. This should not be confused with + // :ref:`Router Filter Header `. + string alt_stat_name = 28 [(udpa.annotations.field_migrate).rename = "observability_name"]; + + // Optional stats matcher that can be used to configure which stats are instantiated for this + // cluster. If configured, this overrides the bootstrap :ref:`stats_config + // ` stats matcher configuration + // for this cluster. + metrics.v3.StatsMatcher stats_matcher = 61; + + oneof cluster_discovery_type { + // The :ref:`service discovery type ` + // to use for resolving the cluster. + DiscoveryType type = 2 [(validate.rules).enum = {defined_only: true}]; + + // The custom cluster type. + CustomClusterType cluster_type = 38; + } + + // Configuration to use for EDS updates for the Cluster. + EdsClusterConfig eds_cluster_config = 3; + + // The timeout for new network connections to hosts in the cluster. + // If not set, a default value of 5s will be used. + google.protobuf.Duration connect_timeout = 4 [(validate.rules).duration = {gt {}}]; + + // Soft limit on size of the cluster’s connections read and write buffers. If + // unspecified, an implementation defined default is applied (1MiB). + google.protobuf.UInt32Value per_connection_buffer_limit_bytes = 5 + [(udpa.annotations.security).configure_for_untrusted_upstream = true]; + + // Optional timeout that controls how long an upstream connection is allowed to stay above the + // configured buffer high watermark before it is closed. If this timeout is not specified, or + // explicitly set to 0, connections will not be closed due to buffer high watermark usage. + google.protobuf.Duration per_connection_buffer_high_watermark_timeout = 60 + [(validate.rules).duration = {gte {}}]; + + // The :ref:`load balancer type ` to use + // when picking a host in the cluster. + LbPolicy lb_policy = 6 [(validate.rules).enum = {defined_only: true}]; + + // Setting this is required for specifying members of + // :ref:`STATIC`, + // :ref:`STRICT_DNS` + // or :ref:`LOGICAL_DNS` clusters. + // This field supersedes the ``hosts`` field in the v2 API. + // + // .. attention:: + // + // Setting this allows non-EDS cluster types to contain embedded EDS equivalent + // :ref:`endpoint assignments`. + // + endpoint.v3.ClusterLoadAssignment load_assignment = 33; + + // Optional :ref:`active health checking ` + // configuration for the cluster. If no + // configuration is specified no health checking will be done and all cluster + // members will be considered healthy at all times. + repeated core.v3.HealthCheck health_checks = 8 [(validate.rules).repeated = {max_items: 8}]; + + // Optional maximum requests for a single upstream connection. This parameter + // is respected by both the HTTP/1.1 and HTTP/2 connection pool + // implementations. If not specified, there is no limit. Setting this + // parameter to 1 will effectively disable keep alive. + // + // .. attention:: + // This field has been deprecated in favor of the :ref:`max_requests_per_connection ` field. + google.protobuf.UInt32Value max_requests_per_connection = 9 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Optional :ref:`circuit breaking ` for the cluster. + CircuitBreakers circuit_breakers = 10; + + // HTTP protocol options that are applied only to upstream HTTP connections. + // These options apply to all HTTP versions. + // This has been deprecated in favor of + // :ref:`upstream_http_protocol_options ` + // in the :ref:`http_protocol_options ` message. + // upstream_http_protocol_options can be set via the cluster's + // :ref:`extension_protocol_options`. + // See :ref:`upstream_http_protocol_options + // ` + // for example usage. + core.v3.UpstreamHttpProtocolOptions upstream_http_protocol_options = 46 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Additional options when handling HTTP requests upstream. These options will be applicable to + // both HTTP1 and HTTP2 requests. + // This has been deprecated in favor of + // :ref:`common_http_protocol_options ` + // in the :ref:`http_protocol_options ` message. + // common_http_protocol_options can be set via the cluster's + // :ref:`extension_protocol_options`. + // See :ref:`upstream_http_protocol_options + // ` + // for example usage. + core.v3.HttpProtocolOptions common_http_protocol_options = 29 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Additional options when handling HTTP1 requests. + // This has been deprecated in favor of http_protocol_options fields in the + // :ref:`http_protocol_options ` message. + // http_protocol_options can be set via the cluster's + // :ref:`extension_protocol_options`. + // See :ref:`upstream_http_protocol_options + // ` + // for example usage. + core.v3.Http1ProtocolOptions http_protocol_options = 13 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Even if default HTTP2 protocol options are desired, this field must be + // set so that Envoy will assume that the upstream supports HTTP/2 when + // making new HTTP connection pool connections. Currently, Envoy only + // supports prior knowledge for upstream connections. Even if TLS is used + // with ALPN, ``http2_protocol_options`` must be specified. As an aside this allows HTTP/2 + // connections to happen over plain text. + // This has been deprecated in favor of http2_protocol_options fields in the + // :ref:`http_protocol_options ` + // message. http2_protocol_options can be set via the cluster's + // :ref:`extension_protocol_options`. + // See :ref:`upstream_http_protocol_options + // ` + // for example usage. + core.v3.Http2ProtocolOptions http2_protocol_options = 14 [ + deprecated = true, + (udpa.annotations.security).configure_for_untrusted_upstream = true, + (envoy.annotations.deprecated_at_minor_version) = "3.0" + ]; + + // The extension_protocol_options field is used to provide extension-specific protocol options + // for upstream connections. The key should match the extension filter name, such as + // "envoy.filters.network.thrift_proxy". See the extension's documentation for details on + // specific options. + // [#next-major-version: make this a list of typed extensions.] + // [#extension-category: envoy.upstream_options] + map typed_extension_protocol_options = 36; + + // If the DNS refresh rate is specified and the cluster type is either + // :ref:`STRICT_DNS`, + // or :ref:`LOGICAL_DNS`, + // this value is used as the cluster’s DNS refresh + // rate. The value configured must be at least 1ms. If this setting is not specified, the + // value defaults to 5000ms. For cluster types other than + // :ref:`STRICT_DNS` + // and :ref:`LOGICAL_DNS` + // this setting is ignored. + // This field is deprecated in favor of using the :ref:`cluster_type` + // extension point and configuring it with :ref:`DnsCluster`. + // If :ref:`cluster_type` is configured with + // :ref:`DnsCluster`, this field will be ignored. + google.protobuf.Duration dns_refresh_rate = 16 [ + deprecated = true, + (validate.rules).duration = {gt {nanos: 1000000}}, + (envoy.annotations.deprecated_at_minor_version) = "3.0" + ]; + + // DNS jitter can be optionally specified if the cluster type is either + // :ref:`STRICT_DNS`, + // or :ref:`LOGICAL_DNS`. + // DNS jitter causes the cluster to refresh DNS entries later by a random amount of time to avoid a + // stampede of DNS requests. This value sets the upper bound (exclusive) for the random amount. + // There will be no jitter if this value is omitted. For cluster types other than + // :ref:`STRICT_DNS` + // and :ref:`LOGICAL_DNS` + // this setting is ignored. + // This field is deprecated in favor of using the :ref:`cluster_type` + // extension point and configuring it with :ref:`DnsCluster`. + // If :ref:`cluster_type` is configured with + // :ref:`DnsCluster`, this field will be ignored. + google.protobuf.Duration dns_jitter = 58 [ + deprecated = true, + (validate.rules).duration = {gte {}}, + (envoy.annotations.deprecated_at_minor_version) = "3.0" + ]; + + // If the DNS failure refresh rate is specified and the cluster type is either + // :ref:`STRICT_DNS`, + // or :ref:`LOGICAL_DNS`, + // this is used as the cluster’s DNS refresh rate when requests are failing. If this setting is + // not specified, the failure refresh rate defaults to the DNS refresh rate. For cluster types + // other than :ref:`STRICT_DNS` and + // :ref:`LOGICAL_DNS` this setting is + // ignored. + // This field is deprecated in favor of using the :ref:`cluster_type` + // extension point and configuring it with :ref:`DnsCluster`. + // If :ref:`cluster_type` is configured with + // :ref:`DnsCluster`, this field will be ignored. + RefreshRate dns_failure_refresh_rate = 44 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Optional configuration for setting cluster's DNS refresh rate. If the value is set to true, + // cluster's DNS refresh rate will be set to resource record's TTL which comes from DNS + // resolution. + // This field is deprecated in favor of using the :ref:`cluster_type` + // extension point and configuring it with :ref:`DnsCluster`. + // If :ref:`cluster_type` is configured with + // :ref:`DnsCluster`, this field will be ignored. + bool respect_dns_ttl = 39 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // The DNS IP address resolution policy. If this setting is not specified, the + // value defaults to + // :ref:`AUTO`. + // For logical and strict dns cluster, this field is deprecated in favor of using the + // :ref:`cluster_type` + // extension point and configuring it with :ref:`DnsCluster`. + // If :ref:`cluster_type` is configured with + // :ref:`DnsCluster`, this field will be ignored. + DnsLookupFamily dns_lookup_family = 17 [(validate.rules).enum = {defined_only: true}]; + + // If DNS resolvers are specified and the cluster type is either + // :ref:`STRICT_DNS`, + // or :ref:`LOGICAL_DNS`, + // this value is used to specify the cluster’s dns resolvers. + // If this setting is not specified, the value defaults to the default + // resolver, which uses /etc/resolv.conf for configuration. For cluster types + // other than + // :ref:`STRICT_DNS` + // and :ref:`LOGICAL_DNS` + // this setting is ignored. + // This field is deprecated in favor of ``dns_resolution_config`` + // which aggregates all of the DNS resolver configuration in a single message. + repeated core.v3.Address dns_resolvers = 18 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Always use TCP queries instead of UDP queries for DNS lookups. + // This field is deprecated in favor of ``dns_resolution_config`` + // which aggregates all of the DNS resolver configuration in a single message. + bool use_tcp_for_dns_lookups = 45 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // DNS resolution configuration which includes the underlying dns resolver addresses and options. + // This field is deprecated in favor of + // :ref:`typed_dns_resolver_config `. + core.v3.DnsResolutionConfig dns_resolution_config = 53 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // DNS resolver type configuration extension. This extension can be used to configure c-ares, apple, + // or any other DNS resolver types and the related parameters. + // For example, an object of + // :ref:`CaresDnsResolverConfig ` + // can be packed into this ``typed_dns_resolver_config``. This configuration replaces the + // :ref:`dns_resolution_config ` + // configuration. + // During the transition period when both ``dns_resolution_config`` and ``typed_dns_resolver_config`` exists, + // when ``typed_dns_resolver_config`` is in place, Envoy will use it and ignore ``dns_resolution_config``. + // When ``typed_dns_resolver_config`` is missing, the default behavior is in place. + // Also note that this field is deprecated for logical dns and strict dns clusters and will be ignored when + // :ref:`cluster_type` is configured with + // :ref:`DnsCluster`. + // [#extension-category: envoy.network.dns_resolver] + core.v3.TypedExtensionConfig typed_dns_resolver_config = 55; + + // Optional configuration for having cluster readiness block on warm-up. Currently, only applicable for + // :ref:`STRICT_DNS`, + // or :ref:`LOGICAL_DNS`, + // or :ref:`Redis Cluster`. + // If true, cluster readiness blocks on warm-up. If false, the cluster will complete + // initialization whether or not warm-up has completed. Defaults to true. + google.protobuf.BoolValue wait_for_warm_on_init = 54; + + // If specified, outlier detection will be enabled for this upstream cluster. + // Each of the configuration values can be overridden via + // :ref:`runtime values `. + OutlierDetection outlier_detection = 19; + + // The interval for removing stale hosts from a cluster type + // :ref:`ORIGINAL_DST`. + // Hosts are considered stale if they have not been used + // as upstream destinations during this interval. New hosts are added + // to original destination clusters on demand as new connections are + // redirected to Envoy, causing the number of hosts in the cluster to + // grow over time. Hosts that are not stale (they are actively used as + // destinations) are kept in the cluster, which allows connections to + // them remain open, saving the latency that would otherwise be spent + // on opening new connections. If this setting is not specified, the + // value defaults to 5000ms. For cluster types other than + // :ref:`ORIGINAL_DST` + // this setting is ignored. + google.protobuf.Duration cleanup_interval = 20 [(validate.rules).duration = {gt {}}]; + + // Optional configuration used to bind newly established upstream connections. + // This overrides any bind_config specified in the bootstrap proto. + // If the address and port are empty, no bind will be performed. + core.v3.BindConfig upstream_bind_config = 21; + + // Configuration for load balancing subsetting. + LbSubsetConfig lb_subset_config = 22; + + // Optional configuration for the load balancing algorithm selected by + // LbPolicy. Currently only + // :ref:`RING_HASH`, + // :ref:`MAGLEV` and + // :ref:`LEAST_REQUEST` + // has additional configuration options. + // Specifying ring_hash_lb_config or maglev_lb_config or least_request_lb_config without setting the corresponding + // LbPolicy will generate an error at runtime. + oneof lb_config { + // Optional configuration for the Ring Hash load balancing policy. + RingHashLbConfig ring_hash_lb_config = 23; + + // Optional configuration for the Maglev load balancing policy. + MaglevLbConfig maglev_lb_config = 52; + + // Optional configuration for the Original Destination load balancing policy. + OriginalDstLbConfig original_dst_lb_config = 34; + + // Optional configuration for the LeastRequest load balancing policy. + LeastRequestLbConfig least_request_lb_config = 37; + + // Optional configuration for the RoundRobin load balancing policy. + RoundRobinLbConfig round_robin_lb_config = 56; + } + + // Common configuration for all load balancer implementations. + CommonLbConfig common_lb_config = 27; + + // Optional custom transport socket implementation to use for upstream connections. + // To setup TLS, set a transport socket with name ``envoy.transport_sockets.tls`` and + // :ref:`UpstreamTlsContexts ` in the ``typed_config``. + // If no transport socket configuration is specified, new connections + // will be set up with plaintext. + core.v3.TransportSocket transport_socket = 24; + + // The Metadata field can be used to provide additional information about the + // cluster. It can be used for stats, logging, and varying filter behavior. + // Fields should use reverse DNS notation to denote which entity within Envoy + // will need the information. For instance, if the metadata is intended for + // the Router filter, the filter name should be specified as ``envoy.filters.http.router``. + core.v3.Metadata metadata = 25; + + // Determines how Envoy selects the protocol used to speak to upstream hosts. + // This has been deprecated in favor of setting explicit protocol selection + // in the :ref:`http_protocol_options + // ` message. + // http_protocol_options can be set via the cluster's + // :ref:`extension_protocol_options`. + ClusterProtocolSelection protocol_selection = 26 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Optional options for upstream connections. + UpstreamConnectionOptions upstream_connection_options = 30; + + // If an upstream host becomes unhealthy (as determined by the configured health checks + // or outlier detection), immediately close all connections to the failed host. + // + // .. note:: + // + // This is currently only supported for connections created by tcp_proxy. + // + // .. note:: + // + // The current implementation of this feature closes all connections immediately when + // the unhealthy status is detected. If there are a large number of connections open + // to an upstream host that becomes unhealthy, Envoy may spend a substantial amount of + // time exclusively closing these connections, and not processing any other traffic. + bool close_connections_on_host_health_failure = 31; + + // If set to true, Envoy will ignore the health value of a host when processing its removal + // from service discovery. This means that if active health checking is used, Envoy will *not* + // wait for the endpoint to go unhealthy before removing it. + bool ignore_health_on_host_removal = 32; + + // An (optional) network filter chain, listed in the order the filters should be applied. + // The chain will be applied to all outgoing connections that Envoy makes to the upstream + // servers of this cluster. + repeated Filter filters = 40; + + // If this field is set and is supported by the client, it will supersede the value of + // :ref:`lb_policy`. + LoadBalancingPolicy load_balancing_policy = 41; + + // [#not-implemented-hide:] + // If present, tells the client where to send load reports via LRS. If not present, the + // client will fall back to a client-side default, which may be either (a) don't send any + // load reports or (b) send load reports for all clusters to a single default server + // (which may be configured in the bootstrap file). + // + // Note that if multiple clusters point to the same LRS server, the client may choose to + // create a separate stream for each cluster or it may choose to coalesce the data for + // multiple clusters onto a single stream. Either way, the client must make sure to send + // the data for any given cluster on no more than one stream. + // + // [#next-major-version: In the v3 API, we should consider restructuring this somehow, + // maybe by allowing LRS to go on the ADS stream, or maybe by moving some of the negotiation + // from the LRS stream here.] + core.v3.ConfigSource lrs_server = 42; + + // A list of metric names from :ref:`ORCA load reports ` to propagate to LRS. + // + // If not specified, then ORCA load reports will not be propagated to LRS. + // + // For map fields in the ORCA proto, the string will be of the form ``.``. + // For example, the string ``named_metrics.foo`` will mean to look for the key ``foo`` in the ORCA + // :ref:`named_metrics ` field. + // + // The special map key ``*`` means to report all entries in the map (e.g., ``named_metrics.*`` means to + // report all entries in the ORCA named_metrics field). Note that this should be used only with trusted + // backends. + // + // The metric names in LRS will follow the same semantics as this field. In other words, if this field + // contains ``named_metrics.foo``, then the LRS load report will include the data with that same string + // as the key. + repeated string lrs_report_endpoint_metrics = 57; + + // If track_timeout_budgets is true, the :ref:`timeout budget histograms + // ` will be published for each + // request. These show what percentage of a request's per try and global timeout was used. A value + // of 0 would indicate that none of the timeout was used or that the timeout was infinite. A value + // of 100 would indicate that the request took the entirety of the timeout given to it. + // + // .. attention:: + // + // This field has been deprecated in favor of ``timeout_budgets``, part of + // :ref:`track_cluster_stats `. + bool track_timeout_budgets = 47 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Optional customization and configuration of upstream connection pool, and upstream type. + // + // Currently this field only applies for HTTP traffic but is designed for eventual use for custom + // TCP upstreams. + // + // For HTTP traffic, Envoy will generally take downstream HTTP and send it upstream as upstream + // HTTP, using the http connection pool and the codec from ``http2_protocol_options`` + // + // For routes where CONNECT termination is configured, Envoy will take downstream CONNECT + // requests and forward the CONNECT payload upstream over raw TCP using the tcp connection pool. + // + // The default pool used is the generic connection pool which creates the HTTP upstream for most + // HTTP requests, and the TCP upstream if CONNECT termination is configured. + // + // If users desire custom connection pool or upstream behavior, for example terminating + // CONNECT only if a custom filter indicates it is appropriate, the custom factories + // can be registered and configured here. + // [#extension-category: envoy.upstreams] + core.v3.TypedExtensionConfig upstream_config = 48; + + // Configuration to track optional cluster stats. + TrackClusterStats track_cluster_stats = 49; + + // Preconnect configuration for this cluster. + PreconnectPolicy preconnect_policy = 50; + + // If ``connection_pool_per_downstream_connection`` is true, the cluster will use a separate + // connection pool for every downstream connection + bool connection_pool_per_downstream_connection = 51; + + // Queueing policies for the cluster (e.g. the queue policy for cluster pending requests). + QueuingPolicies queuing_policies = 62; +} + +// Extensible load balancing policy configuration. +// +// Every LB policy defined via this mechanism will be identified via a unique name using reverse +// DNS notation. If the policy needs configuration parameters, it must define a message for its +// own configuration, which will be stored in the config field. The name of the policy will tell +// clients which type of message they should expect to see in the config field. +// +// Note that there are cases where it is useful to be able to independently select LB policies +// for choosing a locality and for choosing an endpoint within that locality. For example, a +// given deployment may always use the same policy to choose the locality, but for choosing the +// endpoint within the locality, some clusters may use weighted-round-robin, while others may +// use some sort of session-based balancing. +// +// This can be accomplished via hierarchical LB policies, where the parent LB policy creates a +// child LB policy for each locality. For each request, the parent chooses the locality and then +// delegates to the child policy for that locality to choose the endpoint within the locality. +// +// To facilitate this, the config message for the top-level LB policy may include a field of +// type LoadBalancingPolicy that specifies the child policy. +message LoadBalancingPolicy { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.LoadBalancingPolicy"; + + message Policy { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.LoadBalancingPolicy.Policy"; + + reserved 2, 1, 3; + + reserved "config", "name", "typed_config"; + + // [#extension-category: envoy.load_balancing_policies] + core.v3.TypedExtensionConfig typed_extension_config = 4; + } + + // Each client will iterate over the list in order and stop at the first policy that it + // supports. This provides a mechanism for starting to use new LB policies that are not yet + // supported by all clients. + repeated Policy policies = 1; +} + +message UpstreamConnectionOptions { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.UpstreamConnectionOptions"; + + // [#comment: Keep this list of address types in sync with api/config/core/v3/address.proto.] + enum FirstAddressFamilyVersion { + // Use the first address family encountered in the address list. + DEFAULT = 0; + + V4 = 1; + + V6 = 2; + + PIPE = 3; + + INTERNAL = 4; + } + + message HappyEyeballsConfig { + // Specify the IP address family to attempt connection first in happy + // eyeballs algorithm according to RFC8305#section-4. + FirstAddressFamilyVersion first_address_family_version = 1; + + // Specify the number of addresses of the first_address_family_version being + // attempted for connection before the other address family. + google.protobuf.UInt32Value first_address_family_count = 2 [(validate.rules).uint32 = {gte: 1}]; + } + + // If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + core.v3.TcpKeepalive tcp_keepalive = 1; + + // If enabled, associates the interface name of the local address with the upstream connection. + // This can be used by extensions during processing of requests. The association mechanism is + // implementation specific. Defaults to false due to performance concerns. + bool set_local_interface_name_on_upstream_connections = 2; + + // Configurations for happy eyeballs algorithm. + // Add configs for first_address_family_version and first_address_family_count + // when sorting destination ip addresses. + HappyEyeballsConfig happy_eyeballs_config = 3; +} + +message TrackClusterStats { + // If timeout_budgets is true, the :ref:`timeout budget histograms + // ` will be published for each + // request. These show what percentage of a request's per try and global timeout was used. A value + // of 0 would indicate that none of the timeout was used or that the timeout was infinite. A value + // of 100 would indicate that the request took the entirety of the timeout given to it. + bool timeout_budgets = 1; + + // If request_response_sizes is true, then the :ref:`histograms + // ` tracking header and body sizes + // of requests and responses will be published. Additionally, number of headers in the requests and responses will be tracked. + bool request_response_sizes = 2; + + // If true, some stats will be emitted per-endpoint, similar to the stats in admin ``/clusters`` + // output. + // + // This does not currently output correct stats during a hot-restart. + // + // This is not currently implemented by all stat sinks. + // + // These stats do not honor filtering or tag extraction rules in :ref:`StatsConfig + // ` (but fixed-value tags are supported). Admin + // endpoint filtering is supported. + // + // This may not be used at the same time as + // :ref:`load_stats_config `. + bool per_endpoint_stats = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/3b5d20207b95fb25ba7b567fd93e7799aaed33eab2da87ba1bb54febb0a8d657f3b5dcd09032adf1e7ff846fde53cef6deac8eb166a424dd9bead7069d4f53ba b/modules/sync/envoyproxy/envoy/cas/3b5d20207b95fb25ba7b567fd93e7799aaed33eab2da87ba1bb54febb0a8d657f3b5dcd09032adf1e7ff846fde53cef6deac8eb166a424dd9bead7069d4f53ba new file mode 100644 index 00000000..acd17263 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/3b5d20207b95fb25ba7b567fd93e7799aaed33eab2da87ba1bb54febb0a8d657f3b5dcd09032adf1e7ff846fde53cef6deac8eb166a424dd9bead7069d4f53ba @@ -0,0 +1,48 @@ +syntax = "proto3"; + +package envoy.admin.v3; + +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; + +option java_package = "io.envoyproxy.envoy.admin.v3"; +option java_outer_classname = "MemoryProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/admin/v3;adminv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Memory] + +// Proto representation of the internal memory consumption of an Envoy instance. These represent +// values extracted from an internal TCMalloc instance. For more information, see the section of the +// docs entitled `"Generic Tcmalloc Status" `_. +// [#next-free-field: 7] +message Memory { + option (udpa.annotations.versioning).previous_message_type = "envoy.admin.v2alpha.Memory"; + + // The number of bytes allocated by the heap for Envoy. This is an alias for + // ``generic.current_allocated_bytes``. + uint64 allocated = 1; + + // The number of bytes reserved by the heap but not necessarily allocated. This is an alias for + // ``generic.heap_size``. + uint64 heap_size = 2; + + // The number of bytes in free, unmapped pages in the page heap. These bytes always count towards + // virtual memory usage, and depending on the OS, typically do not count towards physical memory + // usage. This is an alias for ``tcmalloc.pageheap_unmapped_bytes``. + uint64 pageheap_unmapped = 3; + + // The number of bytes in free, mapped pages in the page heap. These bytes always count towards + // virtual memory usage, and unless the underlying memory is swapped out by the OS, they also + // count towards physical memory usage. This is an alias for ``tcmalloc.pageheap_free_bytes``. + uint64 pageheap_free = 4; + + // The amount of memory used by the TCMalloc thread caches (for small objects). This is an alias + // for ``tcmalloc.current_total_thread_cache_bytes``. + uint64 total_thread_cache = 5; + + // The number of bytes of the physical memory usage by the allocator. This is an alias for + // ``generic.total_physical_bytes``. + uint64 total_physical_bytes = 6; +} diff --git a/modules/sync/envoyproxy/envoy/cas/3cf58f3f20d249c51043cd45dc319779001d676c9496a820b242ca3271fdd6df5d2672b8680db80d48c77d43da36d2137ddb8353952e83745219860a0ab131b7 b/modules/sync/envoyproxy/envoy/cas/3cf58f3f20d249c51043cd45dc319779001d676c9496a820b242ca3271fdd6df5d2672b8680db80d48c77d43da36d2137ddb8353952e83745219860a0ab131b7 new file mode 100644 index 00000000..721bdc78 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/3cf58f3f20d249c51043cd45dc319779001d676c9496a820b242ca3271fdd6df5d2672b8680db80d48c77d43da36d2137ddb8353952e83745219860a0ab131b7 @@ -0,0 +1,113 @@ +syntax = "proto3"; + +package envoy.extensions.filters.network.ext_authz.v3; + +import "envoy/config/core/v3/config_source.proto"; +import "envoy/config/core/v3/grpc_service.proto"; +import "envoy/type/matcher/v3/metadata.proto"; + +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.network.ext_authz.v3"; +option java_outer_classname = "ExtAuthzProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/ext_authz/v3;ext_authzv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Network External Authorization ] +// The network layer external authorization service configuration +// :ref:`configuration overview `. +// [#extension: envoy.filters.network.ext_authz] + +// External Authorization filter calls out to an external service over the +// gRPC Authorization API defined by +// :ref:`CheckRequest `. +// A failed check will cause this filter to close the TCP connection, unless ``shadow_mode`` is +// enabled. +// [#next-free-field: 13] +message ExtAuthz { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.ext_authz.v2.ExtAuthz"; + + // The prefix to use when emitting statistics. + string stat_prefix = 1 [(validate.rules).string = {min_len: 1}]; + + // The external authorization gRPC service configuration. + // The default timeout is set to 200ms by this filter. + config.core.v3.GrpcService grpc_service = 2; + + // The filter's behaviour in case the external authorization service does + // not respond back. When it is set to true, Envoy will also allow traffic in case of + // communication failure between authorization service and the proxy. + // Defaults to false. + bool failure_mode_allow = 3; + + // Specifies if the peer certificate is sent to the external service. + // + // When this field is true, Envoy will include the peer X.509 certificate, if available, in the + // :ref:`certificate`. + bool include_peer_certificate = 4; + + // API version for ext_authz transport protocol. This describes the ext_authz gRPC endpoint and + // version of Check{Request,Response} used on the wire. + config.core.v3.ApiVersion transport_api_version = 5 + [(validate.rules).enum = {defined_only: true}]; + + // Specifies if the filter is enabled with metadata matcher. + // If this field is not specified, the filter will be enabled for all requests. + type.matcher.v3.MetadataMatcher filter_enabled_metadata = 6; + + // Optional labels that will be passed to :ref:`labels` in + // :ref:`destination`. + // The labels will be read from :ref:`metadata` with the specified key. + string bootstrap_metadata_labels_key = 7; + + // Specifies if the TLS session level details like SNI are sent to the external service. + // + // When this field is true, Envoy will include the SNI name used for TLSClientHello, if available, in the + // :ref:`tls_session`. + bool include_tls_session = 8; + + // When set to ``true``, the filter will send a TLS ``access_denied(49)`` alert before closing + // the connection when authorization is denied. This provides better visibility to TLS clients + // about the reason for connection closure. This alert is only sent for TLS connections. The + // non-TLS connections will be closed without sending an alert. + // + // Defaults to ``false``. + bool send_tls_alert_on_denial = 9; + + // Specifies a list of metadata namespaces whose values, if present, will be passed to the + // ext_authz service. The :ref:`filter_metadata ` + // is passed as an opaque ``protobuf::Struct``. + // + // For example, if the ``proxy_protocol`` listener filter is used and populates TLV metadata, + // then the following will pass that metadata to the authorization server for making decisions + // based on proxy protocol information. + // + // .. code-block:: yaml + // + // metadata_context_namespaces: + // - envoy.filters.listener.proxy_protocol + // + repeated string metadata_context_namespaces = 10; + + // Specifies a list of metadata namespaces whose values, if present, will be passed to the + // ext_authz service. :ref:`typed_filter_metadata ` + // is passed as a ``protobuf::Any``. + // + // This works similarly to ``metadata_context_namespaces`` but allows Envoy and the ext_authz server to share + // the protobuf message definition in order to perform safe parsing. + // + repeated string typed_metadata_context_namespaces = 11; + + // When set to ``true``, the filter operates in shadow mode. The filter still calls the external + // authorization service but never closes the connection. The authorization decision is instead + // recorded in the connection's :ref:`FilterState ` + // under the key ``envoy.filters.network.ext_authz`` so that a subsequent filter can read and + // optionally enforce it. + // + // Defaults to ``false``. + bool shadow_mode = 12; +} diff --git a/modules/sync/envoyproxy/envoy/cas/3fce8ee954a7306c1e9a2c1677cd9d2f41d394195e46eb905de6a15cef7af99f8ba98a17183c1a9292e67a06e4333031c7f8259f77584dd2a34fd371a88a565e b/modules/sync/envoyproxy/envoy/cas/3fce8ee954a7306c1e9a2c1677cd9d2f41d394195e46eb905de6a15cef7af99f8ba98a17183c1a9292e67a06e4333031c7f8259f77584dd2a34fd371a88a565e new file mode 100644 index 00000000..876a2d9e --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/3fce8ee954a7306c1e9a2c1677cd9d2f41d394195e46eb905de6a15cef7af99f8ba98a17183c1a9292e67a06e4333031c7f8259f77584dd2a34fd371a88a565e @@ -0,0 +1,90 @@ +syntax = "proto3"; + +package envoy.extensions.http.early_header_mutation.dynamic_modules.v3; + +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.http.early_header_mutation.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/http/early_header_mutation/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Dynamic Modules Early Header Mutation] +// [#extension: envoy.http.early_header_mutation.dynamic_modules] + +// Configuration for the Dynamic Modules Early Header Mutation. This extension allows loading shared +// object files via ``dlopen`` to rewrite request headers before routing, tracing, request ID +// generation and any HTTP filter runs. +// +// Exactly one instance is created per configured entry, on the main thread, and it is shared by +// every worker thread for the lifetime of the connection manager configuration. The module is +// therefore invoked concurrently and must treat its configuration as read-only. +// +// The module can read and rewrite the request headers, and read the stream info attributes, dynamic +// metadata and filter state. Because the extension runs before routing and before the upstream +// request, the route, the response and every upstream attribute are not yet populated. The stream +// info is read-only at this point, so a module that needs to publish state for later extensions +// should do so from an :ref:`HTTP filter +// ` instead. +// +// When multiple early header mutation extensions are configured, they run in order and the module +// controls whether the ones after it run: see +// :ref:`early_header_mutation_extensions +// `. +message DynamicModuleEarlyHeaderMutation { + // Specifies the shared-object level configuration. This field is required. + // + // Only sources that are available synchronously are supported, i.e. ``name``, ``module.local``, + // and a ``module.remote`` that is already present in the on-disk cache. A remote source that + // would need to be fetched is rejected, since the extension must be usable for the first request + // the connection manager serves. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1 + [(validate.rules).message = {required: true}]; + + // The name for this early header mutation configuration. If not specified, defaults to an empty + // string. + // + // This can be used to distinguish between different early header mutation implementations inside + // a dynamic module. When Envoy receives this configuration, it passes the + // ``early_header_mutation_name`` to the dynamic module's early header mutation config init + // function together with the ``early_header_mutation_config``. That way a module can decide which + // in-module implementation to use based on the name at load time. + // + // This is also used as the ``config_name`` tag of the ``dynamic_modules.module_load_error`` and + // ``dynamic_modules.config_init_error`` counters. + string early_header_mutation_name = 2; + + // The configuration for the early header mutation chosen by ``early_header_mutation_name``. If + // not specified, an empty configuration is passed to the module. + // + // This is passed to the module's early header mutation initialization function. Together with the + // ``early_header_mutation_name``, the module can decide which in-module implementation to use and + // fine-tune its behavior. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly + // without the wrapper. + // + // .. code-block:: yaml + // + // # Passing a JSON struct configuration + // early_header_mutation_config: + // "@type": "type.googleapis.com/google.protobuf.Struct" + // value: + // copy_headers: + // - x-original-authority + // + // # Passing a simple string configuration + // early_header_mutation_config: + // "@type": "type.googleapis.com/google.protobuf.StringValue" + // value: "x-tenant-id" + // + google.protobuf.Any early_header_mutation_config = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/40fbed94190d48e57183cbfad8be7c2ad62220cf3832469320a5fd8452899f084db63ef0da48859d0c2a69aabe2cf7e9b41782d855e66f74c814cbd87c5f38a1 b/modules/sync/envoyproxy/envoy/cas/40fbed94190d48e57183cbfad8be7c2ad62220cf3832469320a5fd8452899f084db63ef0da48859d0c2a69aabe2cf7e9b41782d855e66f74c814cbd87c5f38a1 new file mode 100644 index 00000000..103ca0ff --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/40fbed94190d48e57183cbfad8be7c2ad62220cf3832469320a5fd8452899f084db63ef0da48859d0c2a69aabe2cf7e9b41782d855e66f74c814cbd87c5f38a1 @@ -0,0 +1,684 @@ +syntax = "proto3"; + +package envoy.config.core.v3; + +import "envoy/config/core/v3/address.proto"; +import "envoy/config/core/v3/backoff.proto"; +import "envoy/config/core/v3/http_uri.proto"; +import "envoy/type/v3/percent.proto"; +import "envoy/type/v3/semantic_version.proto"; + +import "google/protobuf/any.proto"; +import "google/protobuf/struct.proto"; +import "google/protobuf/wrappers.proto"; + +import "xds/core/v3/context_params.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/migrate.proto"; +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.config.core.v3"; +option java_outer_classname = "BaseProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/config/core/v3;corev3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Common types] + +// Envoy supports :ref:`upstream priority routing +// ` both at the route and the virtual +// cluster level. The current priority implementation uses different connection +// pool and circuit breaking settings for each priority level. This means that +// even for HTTP/2 requests, two physical connections will be used to an +// upstream host. In the future Envoy will likely support true HTTP/2 priority +// over a single upstream connection. +enum RoutingPriority { + DEFAULT = 0; + HIGH = 1; +} + +// HTTP request method. +enum RequestMethod { + METHOD_UNSPECIFIED = 0; + GET = 1; + HEAD = 2; + POST = 3; + PUT = 4; + DELETE = 5; + CONNECT = 6; + OPTIONS = 7; + TRACE = 8; + PATCH = 9; +} + +// Identifies the direction of the traffic relative to the local Envoy. +enum TrafficDirection { + // Default option is unspecified. + UNSPECIFIED = 0; + + // The transport is used for incoming traffic. + INBOUND = 1; + + // The transport is used for outgoing traffic. + OUTBOUND = 2; +} + +// Identifies location of where either Envoy runs or where upstream hosts run. +message Locality { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.Locality"; + + // Region this :ref:`zone ` belongs to. + string region = 1; + + // Defines the local service zone where Envoy is running. Though optional, it + // should be set if discovery service routing is used and the discovery + // service exposes :ref:`zone data `, + // either in this message or via :option:`--service-zone`. The meaning of zone + // is context dependent, e.g. `Availability Zone (AZ) + // `_ + // on AWS, `Zone `_ on + // GCP, etc. + string zone = 2; + + // When used for locality of upstream hosts, this field further splits zone + // into smaller chunks of sub-zones so they can be load balanced + // independently. + string sub_zone = 3; +} + +// BuildVersion combines SemVer version of extension with free-form build information +// (i.e. 'alpha', 'private-build') as a set of strings. +message BuildVersion { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.BuildVersion"; + + // SemVer version of extension. + type.v3.SemanticVersion version = 1; + + // Free-form build information. + // Envoy defines several well known keys in the source/common/version/version.h file + google.protobuf.Struct metadata = 2; +} + +// Version and identification for an Envoy extension. +// [#next-free-field: 7] +message Extension { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.Extension"; + + // This is the name of the Envoy filter as specified in the Envoy + // configuration, e.g. envoy.filters.http.router, com.acme.widget. + string name = 1; + + // Category of the extension. + // Extension category names use reverse DNS notation. For instance "envoy.filters.listener" + // for Envoy's built-in listener filters or "com.acme.filters.http" for HTTP filters from + // acme.com vendor. + // [#comment:TODO(yanavlasov): Link to the doc with existing envoy category names.] + string category = 2; + + // [#not-implemented-hide:] Type descriptor of extension configuration proto. + // [#comment:TODO(yanavlasov): Link to the doc with existing configuration protos.] + // [#comment:TODO(yanavlasov): Add tests when PR #9391 lands.] + string type_descriptor = 3 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // The version is a property of the extension and maintained independently + // of other extensions and the Envoy API. + // This field is not set when extension did not provide version information. + BuildVersion version = 4; + + // Indicates that the extension is present but was disabled via dynamic configuration. + bool disabled = 5; + + // Type URLs of extension configuration protos. + repeated string type_urls = 6; +} + +// Identifies a specific Envoy instance. The node identifier is presented to the +// management server, which may use this identifier to distinguish per Envoy +// configuration for serving. +// [#next-free-field: 13] +message Node { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.Node"; + + reserved 5; + + reserved "build_version"; + + // An opaque node identifier for the Envoy node. This also provides the local + // service node name. It should be set if any of the following features are + // used: :ref:`statsd `, :ref:`CDS + // `, and :ref:`HTTP tracing + // `, either in this message or via + // :option:`--service-node`. + string id = 1; + + // Defines the local service cluster name where Envoy is running. Though + // optional, it should be set if any of the following features are used: + // :ref:`statsd `, :ref:`health check cluster + // verification + // `, + // :ref:`runtime override directory `, + // :ref:`user agent addition + // `, + // :ref:`HTTP global rate limiting `, + // :ref:`CDS `, and :ref:`HTTP tracing + // `, either in this message or via + // :option:`--service-cluster`. + string cluster = 2; + + // Opaque metadata extending the node identifier. Envoy will pass this + // directly to the management server. + google.protobuf.Struct metadata = 3; + + // Map from xDS resource type URL to dynamic context parameters. These may vary at runtime (unlike + // other fields in this message). For example, the xDS client may have a shard identifier that + // changes during the lifetime of the xDS client. In Envoy, this would be achieved by updating the + // dynamic context on the Server::Instance's LocalInfo context provider. The shard ID dynamic + // parameter then appears in this field during future discovery requests. + map dynamic_parameters = 12; + + // Locality specifying where the Envoy instance is running. + Locality locality = 4; + + // Free-form string that identifies the entity requesting config. + // E.g. "envoy" or "grpc" + string user_agent_name = 6; + + oneof user_agent_version_type { + // Free-form string that identifies the version of the entity requesting config. + // E.g. "1.12.2" or "abcd1234", or "SpecialEnvoyBuild" + string user_agent_version = 7; + + // Structured version of the entity requesting config. + BuildVersion user_agent_build_version = 8; + } + + // List of extensions and their versions supported by the node. + repeated Extension extensions = 9; + + // Client feature support list. These are well known features described + // in the Envoy API repository for a given major version of an API. Client features + // use reverse DNS naming scheme, for example ``com.acme.feature``. + // See :ref:`the list of features ` that xDS client may + // support. + repeated string client_features = 10; + + // Known listening ports on the node as a generic hint to the management server + // for filtering :ref:`listeners ` to be returned. For example, + // if there is a listener bound to port 80, the list can optionally contain the + // SocketAddress ``(0.0.0.0,80)``. The field is optional and just a hint. + repeated Address listening_addresses = 11 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; +} + +// Metadata provides additional inputs to filters based on matched listeners, +// filter chains, routes and endpoints. It is structured as a map, usually from +// filter name (in reverse DNS format) to metadata specific to the filter. Metadata +// key-values for a filter are merged as connection and request handling occurs, +// with later values for the same key overriding earlier values. +// +// An example use of metadata is providing additional values to +// http_connection_manager in the envoy.http_connection_manager.access_log +// namespace. +// +// Another example use of metadata is to per service config info in cluster metadata, which may get +// consumed by multiple filters. +// +// For load balancing, Metadata provides a means to subset cluster endpoints. +// Endpoints have a Metadata object associated and routes contain a Metadata +// object to match against. There are some well defined metadata used today for +// this purpose: +// +// * ``{"envoy.lb": {"canary": }}`` This indicates the canary status of an +// endpoint and is also used during header processing +// (x-envoy-upstream-canary) and for stats purposes. +// [#next-major-version: move to type/metadata/v2] +message Metadata { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.Metadata"; + + // Key is the reverse DNS filter name, e.g. com.acme.widget. The ``envoy.*`` + // namespace is reserved for Envoy's built-in filters. + // If both ``filter_metadata`` and + // :ref:`typed_filter_metadata ` + // fields are present in the metadata with same keys, + // only ``typed_filter_metadata`` field will be parsed. + map filter_metadata = 1 + [(validate.rules).map = {keys {string {min_len: 1}}}]; + + // Key is the reverse DNS filter name, e.g. com.acme.widget. The ``envoy.*`` + // namespace is reserved for Envoy's built-in filters. + // The value is encoded as google.protobuf.Any. + // If both :ref:`filter_metadata ` + // and ``typed_filter_metadata`` fields are present in the metadata with same keys, + // only ``typed_filter_metadata`` field will be parsed. + map typed_filter_metadata = 2 + [(validate.rules).map = {keys {string {min_len: 1}}}]; +} + +// Runtime derived uint32 with a default when not specified. +message RuntimeUInt32 { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.RuntimeUInt32"; + + // Default value if runtime value is not available. + uint32 default_value = 2; + + // Runtime key to get value for comparison. This value is used if defined. + string runtime_key = 3; +} + +// Runtime derived uint64 with a default when not specified. +message RuntimeUInt64 { + // Default value if runtime value is not available. + uint64 default_value = 2; + + // Runtime key to get value for comparison. This value is used if defined. + string runtime_key = 3; +} + +// Runtime derived percentage with a default when not specified. +message RuntimePercent { + // Default value if runtime value is not available. + type.v3.Percent default_value = 1; + + // Runtime key to get value for comparison. This value is used if defined. + string runtime_key = 2; +} + +// Runtime derived double with a default when not specified. +message RuntimeDouble { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.RuntimeDouble"; + + // Default value if runtime value is not available. + double default_value = 1; + + // Runtime key to get value for comparison. This value is used if defined. + string runtime_key = 2; +} + +// Runtime derived bool with a default when not specified. +message RuntimeFeatureFlag { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.core.RuntimeFeatureFlag"; + + // Default value if runtime value is not available. + google.protobuf.BoolValue default_value = 1 [(validate.rules).message = {required: true}]; + + // Runtime key to get value for comparison. This value is used if defined. The boolean value must + // be represented via its + // `canonical JSON encoding `_. + string runtime_key = 2; +} + +// Please use :ref:`KeyValuePair ` instead. +// [#not-implemented-hide:] +message KeyValue { + // The key of the key/value pair. + string key = 1 [ + deprecated = true, + (validate.rules).string = {min_len: 1 max_bytes: 16384}, + (envoy.annotations.deprecated_at_minor_version) = "3.0" + ]; + + // The value of the key/value pair. + // + // The ``bytes`` type is used. This means if JSON or YAML is used to to represent the + // configuration, the value must be base64 encoded. This is unfriendly for users in most + // use scenarios of this message. + // + bytes value = 2 [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; +} + +message KeyValuePair { + // The key of the key/value pair. + string key = 1 [(validate.rules).string = {min_len: 1 max_bytes: 16384}]; + + // The value of the key/value pair. + google.protobuf.Value value = 2; +} + +// Key/value pair plus option to control append behavior. This is used to specify +// key/value pairs that should be appended to a set of existing key/value pairs. +message KeyValueAppend { + // Describes the supported actions types for key/value pair append action. + enum KeyValueAppendAction { + // If the key already exists, this action will result in the following behavior: + // + // - Comma-concatenated value if multiple values are not allowed. + // - New value added to the list of values if multiple values are allowed. + // + // If the key doesn't exist then this will add pair with specified key and value. + APPEND_IF_EXISTS_OR_ADD = 0; + + // This action will add the key/value pair if it doesn't already exist. If the + // key already exists then this will be a no-op. + ADD_IF_ABSENT = 1; + + // This action will overwrite the specified value by discarding any existing + // values if the key already exists. If the key doesn't exist then this will add + // the pair with specified key and value. + OVERWRITE_IF_EXISTS_OR_ADD = 2; + + // This action will overwrite the specified value by discarding any existing + // values if the key already exists. If the key doesn't exist then this will + // be no-op. + OVERWRITE_IF_EXISTS = 3; + } + + // The single key/value pair record to be appended or overridden. This field must be set. + KeyValuePair record = 3; + + // Key/value pair entry that this option to append or overwrite. This field is deprecated + // and please use :ref:`record ` + // as replacement. + // [#not-implemented-hide:] + KeyValue entry = 1 [ + deprecated = true, + (validate.rules).message = {skip: true}, + (envoy.annotations.deprecated_at_minor_version) = "3.0" + ]; + + // Describes the action taken to append/overwrite the given value for an existing + // key or to only add this key if it's absent. + KeyValueAppendAction action = 2 [(validate.rules).enum = {defined_only: true}]; +} + +// Key/value pair to append or remove. +message KeyValueMutation { + // Key/value pair to append or overwrite. Only one of ``append`` or ``remove`` can be set or + // the configuration will be rejected. + KeyValueAppend append = 1; + + // Key to remove. Only one of ``append`` or ``remove`` can be set or the configuration will be + // rejected. + string remove = 2 [(validate.rules).string = {max_bytes: 16384}]; +} + +// Query parameter name/value pair. +message QueryParameter { + // The key of the query parameter. Case sensitive. + string key = 1 [(validate.rules).string = {min_len: 1}]; + + // The value of the query parameter. + string value = 2; +} + +// Header name/value pair. +message HeaderValue { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.HeaderValue"; + + // Header name. + string key = 1 + [(validate.rules).string = + {min_len: 1 max_bytes: 16384 well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // Header value. + // + // The same :ref:`format specifier ` as used for + // :ref:`HTTP access logging ` applies here, however + // unknown header values are replaced with the empty string instead of ``-``. + // Header value is encoded as string. This does not work for non-utf8 characters. + // Only one of ``value`` or ``raw_value`` can be set. + string value = 2 [ + (validate.rules).string = {max_bytes: 16384 well_known_regex: HTTP_HEADER_VALUE strict: false}, + (udpa.annotations.field_migrate).oneof_promotion = "value_type" + ]; + + // Header value is encoded as bytes which can support non-utf8 characters. + // Only one of ``value`` or ``raw_value`` can be set. + bytes raw_value = 3 [ + (validate.rules).bytes = {min_len: 0 max_len: 16384}, + (udpa.annotations.field_migrate).oneof_promotion = "value_type" + ]; +} + +// Header name/value pair plus option to control append behavior. +message HeaderValueOption { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.core.HeaderValueOption"; + + // Describes the supported actions types for header append action. + enum HeaderAppendAction { + // If the header already exists, this action will result in: + // + // - Comma-concatenated for predefined inline headers. + // - Duplicate header added in the ``HeaderMap`` for other headers. + // + // If the header doesn't exist then this will add new header with specified key and value. + APPEND_IF_EXISTS_OR_ADD = 0; + + // This action will add the header if it doesn't already exist. If the header + // already exists then this will be a no-op. + ADD_IF_ABSENT = 1; + + // This action will overwrite the specified value by discarding any existing values if + // the header already exists. If the header doesn't exist then this will add the header + // with specified key and value. + OVERWRITE_IF_EXISTS_OR_ADD = 2; + + // This action will overwrite the specified value by discarding any existing values if + // the header already exists. If the header doesn't exist then this will be no-op. + OVERWRITE_IF_EXISTS = 3; + } + + // Header name/value pair that this option applies to. + HeaderValue header = 1 [(validate.rules).message = {required: true}]; + + // Should the value be appended? If true (default), the value is appended to + // existing values. Otherwise it replaces any existing values. + // This field is deprecated and please use + // :ref:`append_action ` as replacement. + // + // .. note:: + // The :ref:`external authorization service ` and + // :ref:`external processor service ` have + // default value (``false``) for this field. + google.protobuf.BoolValue append = 2 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Describes the action taken to append/overwrite the given value for an existing header + // or to only add this header if it's absent. + // Value defaults to :ref:`APPEND_IF_EXISTS_OR_ADD + // `. + HeaderAppendAction append_action = 3 [(validate.rules).enum = {defined_only: true}]; + + // Is the header value allowed to be empty? If false (default), custom headers with empty values are dropped, + // otherwise they are added. + // + // .. note:: + // In any context other than the router filter, we always act as if keep_empty_value is true, + // regardless of the setting of this field. + // + bool keep_empty_value = 4; +} + +// Wrapper for a set of headers. +message HeaderMap { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.HeaderMap"; + + // A list of header names and their values. + repeated HeaderValue headers = 1; +} + +// A directory that is watched for changes, e.g. by inotify on Linux. Move/rename +// events inside this directory trigger the watch. +message WatchedDirectory { + // Directory path to watch. + string path = 1 [(validate.rules).string = {min_len: 1}]; + + // If set to true, the watcher will also subscribe to file modification events + // (``IN_MODIFY`` on Linux) in addition to move events (``IN_MOVED_TO``). This allows + // in-place file writes to trigger reload callbacks. Use this when the writing process + // cannot use atomic rename (e.g. certain secret managers that write certificate files + // directly). By default, only move/rename events are watched, which is the safe choice + // for atomic updates (e.g. Kubernetes ConfigMap symlink swaps). + bool watch_modify = 2; +} + +// Data source consisting of a file, an inline value, or an environment variable. +// [#next-free-field: 6] +message DataSource { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.DataSource"; + + oneof specifier { + option (validate.required) = true; + + // Local filesystem data source. + string filename = 1 [(validate.rules).string = {min_len: 1}]; + + // Bytes inlined in the configuration. + bytes inline_bytes = 2; + + // String inlined in the configuration. + string inline_string = 3; + + // Environment variable data source. + string environment_variable = 4 [(validate.rules).string = {min_len: 1}]; + } + + // Watched directory that is watched for file changes. If this is set explicitly, the file + // specified in the ``filename`` field will be reloaded when relevant file move events occur. + // + // .. note:: + // This field only makes sense when the ``filename`` field is set. + // + // .. note:: + // Envoy only updates when the file is replaced by a file move, and not when the file is + // edited in place. + // + // .. note:: + // Not all use cases of ``DataSource`` support watching directories. It depends on the + // specific usage of the ``DataSource``. See the documentation of the parent message for + // details. + WatchedDirectory watched_directory = 5; +} + +// The message specifies the retry policy of remote data source when fetching fails. +// [#next-free-field: 7] +message RetryPolicy { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.RetryPolicy"; + + // See :ref:`RetryPriority `. + message RetryPriority { + string name = 1 [(validate.rules).string = {min_len: 1}]; + + oneof config_type { + google.protobuf.Any typed_config = 2; + } + } + + // See :ref:`RetryHostPredicate `. + message RetryHostPredicate { + string name = 1 [(validate.rules).string = {min_len: 1}]; + + oneof config_type { + google.protobuf.Any typed_config = 2; + } + } + + // Specifies parameters that control :ref:`retry backoff strategy `. + // This parameter is optional, in which case the default base interval is 1000 milliseconds. The + // default maximum interval is 10 times the base interval. + BackoffStrategy retry_back_off = 1; + + // Specifies the allowed number of retries. This parameter is optional and + // defaults to 1. + google.protobuf.UInt32Value num_retries = 2 + [(udpa.annotations.field_migrate).rename = "max_retries"]; + + // For details, see :ref:`retry_on `. + string retry_on = 3; + + // For details, see :ref:`retry_priority `. + RetryPriority retry_priority = 4; + + // For details, see :ref:`RetryHostPredicate `. + repeated RetryHostPredicate retry_host_predicate = 5; + + // For details, see :ref:`host_selection_retry_max_attempts `. + int64 host_selection_retry_max_attempts = 6; +} + +// The message specifies how to fetch data from remote and how to verify it. +message RemoteDataSource { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.RemoteDataSource"; + + // The HTTP URI to fetch the remote data. + HttpUri http_uri = 1 [(validate.rules).message = {required: true}]; + + // SHA256 string for verifying data. + string sha256 = 2 [(validate.rules).string = {min_len: 1}]; + + // Retry policy for fetching remote data. + RetryPolicy retry_policy = 3; +} + +// Async data source which support async data fetch. +message AsyncDataSource { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.AsyncDataSource"; + + oneof specifier { + option (validate.required) = true; + + // Local async data source. + DataSource local = 1; + + // Remote async data source. + RemoteDataSource remote = 2; + } +} + +// Configuration for transport socket in :ref:`listeners ` and +// :ref:`clusters `. If the configuration is +// empty, a default transport socket implementation and configuration will be +// chosen based on the platform and existence of tls_context. +message TransportSocket { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.TransportSocket"; + + reserved 2; + + reserved "config"; + + // The name of the transport socket to instantiate. The name must match a supported transport + // socket implementation. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // Implementation specific configuration which depends on the implementation being instantiated. + // See the supported transport socket implementations for further documentation. + oneof config_type { + google.protobuf.Any typed_config = 3; + } +} + +// Runtime derived FractionalPercent with defaults for when the numerator or denominator is not +// specified via a runtime key. +// +// .. note:: +// +// Parsing of the runtime key's data is implemented such that it may be represented as a +// :ref:`FractionalPercent ` proto represented as JSON/YAML +// and may also be represented as an integer with the assumption that the value is an integral +// percentage out of 100. For instance, a runtime key lookup returning the value "42" would parse +// as a ``FractionalPercent`` whose numerator is 42 and denominator is HUNDRED. +message RuntimeFractionalPercent { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.core.RuntimeFractionalPercent"; + + // Default value if the runtime value's for the numerator/denominator keys are not available. + type.v3.FractionalPercent default_value = 1 [(validate.rules).message = {required: true}]; + + // Runtime key for a YAML representation of a FractionalPercent. + string runtime_key = 2; +} + +// Identifies a specific ControlPlane instance that Envoy is connected to. +message ControlPlane { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.ControlPlane"; + + // An opaque control plane identifier that uniquely identifies an instance + // of control plane. This can be used to identify which control plane instance, + // the Envoy is connected to. + string identifier = 1; +} diff --git a/modules/sync/envoyproxy/envoy/cas/436b10d2ed00bc25e99d66c3078c9df7f9270226426b2518204f3d8dcf6d9c589829f8dc4a2c16b64da619eb3f33eee945fd8c1b6b4c80428048b96411ccb511 b/modules/sync/envoyproxy/envoy/cas/436b10d2ed00bc25e99d66c3078c9df7f9270226426b2518204f3d8dcf6d9c589829f8dc4a2c16b64da619eb3f33eee945fd8c1b6b4c80428048b96411ccb511 new file mode 100644 index 00000000..701f1c6a --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/436b10d2ed00bc25e99d66c3078c9df7f9270226426b2518204f3d8dcf6d9c589829f8dc4a2c16b64da619eb3f33eee945fd8c1b6b4c80428048b96411ccb511 @@ -0,0 +1,131 @@ +syntax = "proto3"; + +package envoy.extensions.filters.udp.dns_filter.v3; + +import "envoy/config/accesslog/v3/accesslog.proto"; +import "envoy/config/core/v3/address.proto"; +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/extension.proto"; +import "envoy/config/core/v3/resolver.proto"; +import "envoy/data/dns/v3/dns_table.proto"; + +import "google/protobuf/duration.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.udp.dns_filter.v3"; +option java_outer_classname = "DnsFilterProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/udp/dns_filter/v3;dns_filterv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: DNS Filter] +// DNS Filter :ref:`configuration overview `. +// [#extension: envoy.filters.udp.dns_filter] + +// Configuration for the DNS filter. +// [#next-free-field: 6] +message DnsFilterConfig { + // This message contains the configuration for the DNS Filter operating + // in a server context. This message will contain the virtual hosts and + // associated addresses with which Envoy will respond to queries + message ServerContextConfig { + oneof config_source { + option (validate.required) = true; + + // Load the configuration specified from the control plane + data.dns.v3.DnsTable inline_dns_table = 1; + + // Seed the filter configuration from an external path. This source + // is a yaml formatted file that contains the DnsTable driving Envoy's + // responses to DNS queries + config.core.v3.DataSource external_dns_table = 2; + } + } + + // This message contains the configuration for the DNS Filter operating + // in a client context. This message will contain the timeouts, retry, + // and forwarding configuration for Envoy to make DNS requests to other + // resolvers + // + // [#next-free-field: 6] + message ClientContextConfig { + // Sets the maximum time we will wait for the upstream query to complete + // We allow 5s for the upstream resolution to complete, so the minimum + // value here is 1. Note that the total latency for a failed query is the + // number of retries multiplied by the resolver_timeout. + google.protobuf.Duration resolver_timeout = 1 [(validate.rules).duration = {gte {seconds: 1}}]; + + // This field was used for `dns_resolution_config` in Envoy 1.19.0 and + // 1.19.1. + // Control planes that need to set this field for Envoy 1.19.0 and + // 1.19.1 clients should fork the protobufs and change the field type + // to `DnsResolutionConfig`. + // Control planes that need to simultaneously support Envoy 1.18.x and + // Envoy 1.19.x should avoid Envoy 1.19.0 and 1.19.1. + // + // [#not-implemented-hide:] + repeated config.core.v3.Address upstream_resolvers = 2 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // DNS resolution configuration which includes the underlying dns resolver addresses and options. + // This field is deprecated in favor of + // :ref:`typed_dns_resolver_config `. + config.core.v3.DnsResolutionConfig dns_resolution_config = 5 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // DNS resolver type configuration extension. This extension can be used to configure c-ares, apple, + // or any other DNS resolver types and the related parameters. + // For example, an object of + // :ref:`CaresDnsResolverConfig ` + // can be packed into this ``typed_dns_resolver_config``. This configuration replaces the + // :ref:`dns_resolution_config ` + // configuration. + // During the transition period when both ``dns_resolution_config`` and ``typed_dns_resolver_config`` exists, + // when ``typed_dns_resolver_config`` is in place, Envoy will use it and ignore ``dns_resolution_config``. + // When ``typed_dns_resolver_config`` is missing, the default behavior is in place. + // [#extension-category: envoy.network.dns_resolver] + config.core.v3.TypedExtensionConfig typed_dns_resolver_config = 4; + + // Controls how many outstanding external lookup contexts the filter tracks. + // The context structure allows the filter to respond to every query even if the external + // resolution times out or is otherwise unsuccessful + uint64 max_pending_lookups = 3 [(validate.rules).uint64 = {gte: 1}]; + } + + // The stat prefix used when emitting DNS filter statistics + string stat_prefix = 1 [(validate.rules).string = {min_len: 1}]; + + // Server context configuration contains the data that the filter uses to respond + // to DNS requests. + ServerContextConfig server_config = 2; + + // Client context configuration controls Envoy's behavior when it must use external + // resolvers to answer a query. This object is optional and if omitted instructs + // the filter to resolve queries from the data in the server_config. + // Also, if ``client_config`` is omitted, here is the Envoy's behavior to create DNS resolver: + // + // 1. If :ref:`typed_dns_resolver_config ` + // is not empty, uses it. + // + // 2. Otherwise, uses the default c-ares DNS resolver. + // + ClientContextConfig client_config = 3; + + // Configuration for :ref:`access logs ` + // emitted by the DNS filter for each DNS query received. + // Supports custom format commands for DNS-specific attributes: + // - ``QUERY_NAME``: The DNS query name being resolved + // - ``QUERY_TYPE``: The DNS query type (A, AAAA, SRV, etc.) + // - ``QUERY_CLASS``: The DNS query class + // - ``ANSWER_COUNT``: Number of answers in the response + // - ``RESPONSE_CODE``: DNS response code + // - ``PARSE_STATUS``: Whether the query was successfully parsed + repeated config.accesslog.v3.AccessLog access_log = 4; + + // When true, virtual domain names are matched case-insensitively. The response echoes the + // client's original query-name case. Defaults to false. + bool case_insensitive = 5; +} diff --git a/modules/sync/envoyproxy/envoy/cas/43739fbb908ba7e84eff67712f401ddc33bf468287f93d582247803a5c006a315be85476393c5207f05ab70d4d2c9ae6559ab2c37859b74bf6eae0c4bfc735e5 b/modules/sync/envoyproxy/envoy/cas/43739fbb908ba7e84eff67712f401ddc33bf468287f93d582247803a5c006a315be85476393c5207f05ab70d4d2c9ae6559ab2c37859b74bf6eae0c4bfc735e5 new file mode 100644 index 00000000..78581c70 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/43739fbb908ba7e84eff67712f401ddc33bf468287f93d582247803a5c006a315be85476393c5207f05ab70d4d2c9ae6559ab2c37859b74bf6eae0c4bfc735e5 @@ -0,0 +1,77 @@ +syntax = "proto3"; + +package envoy.extensions.filters.common.jwks.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/extensions/filters/common/jwks/v3/jwks.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.common.jwks.v3"; +option java_outer_classname = "JwtHandshakeProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/common/jwks/v3;jwksv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: JWT handshake validation] +// Configuration for verifying a bearer JWT during handshake authentication, shared by extensions +// that authenticate a connection or request by validating a token. + +// Validation of a bearer JWT. A consuming extension verifies the token against the configured JWKS, +// issuer, audiences, and time constraints. On success it publishes the verified claims as dynamic +// metadata under ``claims_metadata_namespace``, so the consumer can bind a claimed identifier to a +// verified claim via ``%DYNAMIC_METADATA(namespace:claim)%``. What a validation failure does, and +// any per-field defaults, are defined by the consuming extension. +// +// .. attention:: +// Verifying the token proves only that the caller *holds* a valid token; it does **not** by itself +// prove the caller is the identity it claims. To authenticate the claimed identity, bind a verified +// claim from the consuming extension's own validation configuration. Without such a binding, a token +// minted for one identity can be presented for another. Tokens without an ``exp`` claim are +// rejected. All top-level claims are published as dynamic metadata (see +// ``claims_metadata_namespace``), so do not put secrets in the token. +// [#next-free-field: 9] +message JwtHandshakeValidator { + // Required. Expected token issuer. The JWT ``iss`` claim must equal this value. + string issuer = 1 [(validate.rules).string = {min_len: 1 max_len: 1024}]; + + // Allowed audiences. If non-empty, the JWT must carry at least one of these in its ``aud`` claim. + // If empty, the audience is not checked. + repeated string audiences = 2; + + // Source of the JSON Web Key Set (JWKS) used to verify the token signature. Exactly one source + // must be configured. + oneof jwks_source_specifier { + option (validate.required) = true; + + // The JWKS provided inline as a data source (``inline_string``, ``inline_bytes``, or + // ``filename``). The keys are read once when the configuration is loaded. + config.core.v3.DataSource local_jwks = 3; + + // The JWKS fetched over HTTP. See :ref:`RemoteJwks + // ` for the fetch, cache, + // ``async_fetch``, and ``retry_policy`` options. + RemoteJwks remote_jwks = 8; + } + + // Name of the header carrying the token. When unset, the consuming extension applies its own + // default (commonly ``authorization``, with a leading ``Bearer`` prefix stripped). + string token_header = 4 [(validate.rules).string = {max_len: 255 ignore_empty: true}]; + + // Namespace under which verified claims are emitted as dynamic metadata. If unset, the consuming + // extension's default namespace is used. Each top-level JWT claim is written as a field in this + // namespace so it can be referenced via ``%DYNAMIC_METADATA(namespace:claim)%`` by the consuming + // extension's validation configuration. + string claims_metadata_namespace = 5 + [(validate.rules).string = {max_len: 255 ignore_empty: true}]; + + // If ``true``, a missing or invalid token does **not** fail validation; the verified claims are + // simply not published. Useful for a staged rollout or audit mode. Defaults to ``false``. How a + // validation failure is handled is defined by the consuming extension. + bool allow_missing_or_failed = 6; + + // Clock skew, in seconds, allowed when checking the ``exp`` and ``nbf`` time constraints. When + // unset (``0``), the consuming extension applies its own default. + uint32 clock_skew_seconds = 7; +} diff --git a/modules/sync/envoyproxy/envoy/cas/46355b26af4e644f11953163f73f60b008af9016214806e263636b9cfe9355a7e4476f3892ff5cbe7ff4f63de4a39c78f0fe36831be74da87fb6470585105b37 b/modules/sync/envoyproxy/envoy/cas/46355b26af4e644f11953163f73f60b008af9016214806e263636b9cfe9355a7e4476f3892ff5cbe7ff4f63de4a39c78f0fe36831be74da87fb6470585105b37 new file mode 100644 index 00000000..a6537e44 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/46355b26af4e644f11953163f73f60b008af9016214806e263636b9cfe9355a7e4476f3892ff5cbe7ff4f63de4a39c78f0fe36831be74da87fb6470585105b37 @@ -0,0 +1,58 @@ +syntax = "proto3"; + +package envoy.extensions.config.validators.dynamic_modules.v3; + +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.config.validators.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/config/validators/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Dynamic Modules Config Validator] +// [#extension: envoy.config.validators.dynamic_modules] + +// Configuration for an xDS config validator implemented by a dynamic module. For each xDS update the +// module receives the xDS type URL and the decoded resources, with each resource carrying its name, +// version, aliases, TTL, and re-serialized protobuf payload. During validation the module can also +// read current server state, such as the dynamic cluster count, through the validation context. A +// rejection from the module follows Envoy's normal xDS rejection path, so the xDS client receives a +// NACK and the last accepted configuration is retained. +message DynamicModuleConfigValidator { + // Specifies the shared-object level configuration. This field is required. + // + // Only the ``name`` and ``module.local.filename`` sources are supported. Remote module sources + // are not supported because config validators are created without a factory context. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1 + [(validate.rules).message = {required: true}]; + + // The name identifying the config validator implementation within the module. This is passed to + // the module's config validator init function so that a module can host multiple + // implementations. This field is required. + string extension_name = 2 [(validate.rules).string = {min_len: 1}]; + + // The configuration for the implementation chosen by ``extension_name``. If not specified, an + // empty configuration is passed to the module. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly without + // the wrapper. Otherwise the serialized bytes of the configured message are passed. + google.protobuf.Any extension_config = 3; + + // The xDS resource type URLs handled by this validator. Only updates whose type URL matches one + // of these values invoke the module. Each value must use the canonical + // ``type.googleapis.com/`` form. Exactly one type URL is supported today and this + // restriction may be relaxed in the future. This field is required. + repeated string type_urls = 4 [(validate.rules).repeated = { + min_items: 1 + max_items: 1 + items {string {min_len: 1}} + }]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/471e9f4568cee8c55789a48dd9d2977b05ddd06e1032aaf87760f50366e6c6eddd404c65d00f36b5ddb28751a8e3ed5b3ae28e79c976bfc515d8cd83cb98ced4 b/modules/sync/envoyproxy/envoy/cas/471e9f4568cee8c55789a48dd9d2977b05ddd06e1032aaf87760f50366e6c6eddd404c65d00f36b5ddb28751a8e3ed5b3ae28e79c976bfc515d8cd83cb98ced4 new file mode 100644 index 00000000..cd126b18 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/471e9f4568cee8c55789a48dd9d2977b05ddd06e1032aaf87760f50366e6c6eddd404c65d00f36b5ddb28751a8e3ed5b3ae28e79c976bfc515d8cd83cb98ced4 @@ -0,0 +1,527 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.ext_proc.v3; + +import "envoy/config/common/mutation_rules/v3/mutation_rules.proto"; +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/extension.proto"; +import "envoy/config/core/v3/grpc_service.proto"; +import "envoy/config/core/v3/http_service.proto"; +import "envoy/extensions/filters/http/ext_proc/v3/processing_mode.proto"; +import "envoy/type/matcher/v3/string.proto"; +import "envoy/type/v3/http_status.proto"; + +import "google/protobuf/duration.proto"; +import "google/protobuf/struct.proto"; +import "google/protobuf/wrappers.proto"; + +import "xds/annotations/v3/status.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/migrate.proto"; +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.ext_proc.v3"; +option java_outer_classname = "ExtProcProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_proc/v3;ext_procv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: External Processing Filter] +// External Processing Filter +// [#extension: envoy.filters.http.ext_proc] + +// The External Processing filter allows an external service to act on HTTP traffic in a flexible way. + +// The filter communicates with an external gRPC service called an "external processor" +// that can do a variety of things with the request and response: +// +// * Access and modify the HTTP headers on the request, response, or both. +// * Access and modify the HTTP request and response bodies. +// * Access and modify the dynamic stream metadata. +// * Immediately send an HTTP response downstream and terminate other processing. +// +// The filter communicates with the server using a gRPC bidirectional stream. After the initial +// request, the external server is in control over what additional data is sent to it +// and how it should be processed. +// +// By implementing the protocol specified by the stream, the external server can choose: +// +// * Whether it receives the response message at all. +// * Whether it receives the message body at all, in separate chunks, or as a single buffer. +// * To modify request or response trailers if they already exist. +// +// The filter supports up to six different processing steps. Each is represented by +// a gRPC stream message that is sent to the external processor. For each message, the +// processor must send a matching response. +// +// * Request headers: Contains the headers from the original HTTP request. +// * Request body: If the body is present, the behavior depends on the +// body send mode. In ``BUFFERED`` or ``BUFFERED_PARTIAL`` mode, the body is sent to the external +// processor in a single message. In ``STREAMED`` or ``FULL_DUPLEX_STREAMED`` mode, the body will +// be split across multiple messages sent to the external processor. In ``GRPC`` mode, as each +// gRPC message arrives, it will be sent to the external processor (there will be exactly one +// gRPC message in each message sent to the external processor). In ``NONE`` mode, the body will +// not be sent to the external processor. +// * Request trailers: Delivered if they are present and if the trailer mode is set +// to ``SEND``. +// * Response headers: Contains the headers from the HTTP response. Keep in mind +// that if the upstream system sends them before processing the request body that +// this message may arrive before the complete body. +// * Response body: Sent according to the processing mode like the request body. +// * Response trailers: Delivered according to the processing mode like the +// request trailers. +// +// By default, the processor sends only the request and response headers messages. +// This may be changed to include any of the six steps by changing the ``processing_mode`` +// setting of the filter configuration, or by setting the ``mode_override`` of any response +// from the external processor. The latter is only enabled if ``allow_mode_override`` is +// set to true. This way, a processor may, for example, use information +// in the request header to determine whether the message body must be examined, or whether +// the data plane should simply stream it straight through. +// +// All of this together allows a server to process the filter traffic in fairly +// sophisticated ways. For example: +// +// * A server may choose to examine all or part of the HTTP message bodies depending +// on the content of the headers. +// * A server may choose to immediately reject some messages based on their HTTP +// headers (or other dynamic metadata) and more carefully examine others. +// +// The protocol itself is based on a bidirectional gRPC stream. The data plane will send the server +// :ref:`ProcessingRequest ` +// messages, and the server must reply with +// :ref:`ProcessingResponse `. +// +// Stats about each gRPC call are recorded in a :ref:`dynamic filter state +// ` object in a namespace matching the filter +// name. +// +// [#next-free-field: 28] +message ExternalProcessor { + // Describes the route cache action to be taken when an external processor response + // is received in response to request headers. + enum RouteCacheAction { + // The default behavior is to clear the route cache only when the + // :ref:`clear_route_cache ` + // field is set in an external processor response. + DEFAULT = 0; + + // Always clear the route cache irrespective of the ``clear_route_cache`` bit in + // the external processor response. + CLEAR = 1; + + // Do not clear the route cache irrespective of the ``clear_route_cache`` bit in + // the external processor response. Setting to ``RETAIN`` is equivalent to setting the + // :ref:`disable_clear_route_cache ` + // to true. + RETAIN = 2; + } + + reserved 4; + + reserved "async_mode"; + + // Configuration for the gRPC service that the filter will communicate with. + // Only one of ``grpc_service`` or ``http_service`` can be set. + // It is required that one of them must be set. + config.core.v3.GrpcService grpc_service = 1 + [(udpa.annotations.field_migrate).oneof_promotion = "ext_proc_service_type"]; + + // Configuration for the HTTP service that the filter will communicate with. + // Only one of ``http_service`` or + // :ref:`grpc_service ` + // can be set. It is required that one of them must be set. + // + // If ``http_service`` is set, the + // :ref:`processing_mode ` + // cannot be configured to send any body or trailers. i.e., ``http_service`` only supports + // sending request or response headers to the side stream server. + // + // With this configuration, the data plane behavior is: + // + // 1. The headers are first put in a proto message + // :ref:`ProcessingRequest `. + // + // 2. This proto message is then transcoded into a JSON text. + // + // 3. The data plane then sends an HTTP POST message with content-type as "application/json", + // and this JSON text as body to the side stream server. + // + // After the side-stream receives this HTTP request message, it is expected to do as follows: + // + // 1. It converts the body, which is a JSON string, into a ``ProcessingRequest`` + // proto message to examine and mutate the headers. + // + // 2. It then sets the mutated headers into a new proto message + // :ref:`ProcessingResponse `. + // + // 3. It converts the ``ProcessingResponse`` proto message into a JSON text. + // + // 4. It then sends an HTTP response back to the data plane with status code as ``"200"``, + // ``content-type`` as ``"application/json"`` and sets the JSON text as the body. + // + ExtProcHttpService http_service = 20 [ + (udpa.annotations.field_migrate).oneof_promotion = "ext_proc_service_type", + (xds.annotations.v3.field_status).work_in_progress = true + ]; + + // By default, if in the following cases: + // + // 1. The gRPC stream cannot be established. + // + // 2. The gRPC stream is closed prematurely with an error. + // + // 3. The external processing timeouts. + // + // 4. The ext_proc server sends back spurious response messages. + // + // The filter will fail and a local reply with error code + // 504(for timeout case) or 500(for all other cases), will be sent to the downstream. + // + // However, with this parameter set to true and if the above cases happen, the processing + // continues without error. + // + bool failure_mode_allow = 2; + + // Specifies default options for how HTTP headers, trailers, and bodies are + // sent. See ``ProcessingMode`` for details. + ProcessingMode processing_mode = 3; + + // The data plane provides a number of :ref:`attributes ` + // for expressive policies. Each attribute name provided in this field will be + // matched against that list and populated in the + // :ref:`ProcessingRequest.attributes ` field. + // See the :ref:`attribute documentation ` + // for the list of supported attributes and their types. + repeated string request_attributes = 5; + + // The data plane provides a number of :ref:`attributes ` + // for expressive policies. Each attribute name provided in this field will be + // matched against that list and populated in the + // :ref:`ProcessingRequest.attributes ` field. + // See the :ref:`attribute documentation ` + // for the list of supported attributes and their types. + repeated string response_attributes = 6; + + // Specifies the timeout for each individual message sent on the stream. + // Whenever the data plane sends a message on the stream that requires a + // response, it will reset this timer, and will stop processing and return + // an error (subject to the processing mode) if the timer expires before a + // matching response is received. There is no timeout when the filter is + // running in observability mode or when the body send mode is + // ``FULL_DUPLEX_STREAMED`` or ``GRPC``. Zero is a valid config which means + // the timer will be triggered immediately. If not configured, default is + // 200 milliseconds. + google.protobuf.Duration message_timeout = 7 [(validate.rules).duration = { + lte {seconds: 3600} + gte {} + }]; + + // Optional additional prefix to use when emitting statistics. This allows to distinguish + // emitted statistics between configured ``ext_proc`` filters in an HTTP filter chain. + string stat_prefix = 8; + + // Rules that determine what modifications an external processing server may + // make to message headers. If not set, all headers may be modified except + // for "host", ":authority", ":scheme", ":method", and headers that start + // with the header prefix set via + // :ref:`header_prefix ` + // (which is usually "x-envoy"). + // Note that changing headers such as "host" or ":authority" may not in itself + // change the data plane's routing decision, as routes can be cached. To also force the + // route to be recomputed, set the + // :ref:`clear_route_cache ` + // field to true in the same response. + config.common.mutation_rules.v3.HeaderMutationRules mutation_rules = 9; + + // Specify the upper bound of + // :ref:`override_message_timeout ` + // If not specified, by default it is 0, which will effectively disable the ``override_message_timeout`` API. + google.protobuf.Duration max_message_timeout = 10 [(validate.rules).duration = { + lte {seconds: 3600} + gte {} + }]; + + // Allow headers matching the ``forward_rules`` to be forwarded to the external processing server. + // If not set, all headers are forwarded to the external processing server. + HeaderForwardingRules forward_rules = 12; + + // Additional metadata to be added to the filter state for logging purposes. The metadata + // will be added to StreamInfo's filter state under the namespace corresponding to the + // ext_proc filter name. + google.protobuf.Struct filter_metadata = 13; + + // If ``allow_mode_override`` is set to true, the filter config :ref:`processing_mode + // ` + // can be overridden by the response message from the external processing server + // :ref:`mode_override `. + // If not set, ``mode_override`` API in the response message will be ignored. + // Mode override is not supported if the body send mode is ``FULL_DUPLEX_STREAMED``. + bool allow_mode_override = 14; + + // If set to true, ignore the + // :ref:`immediate_response ` + // message in an external processor response. In such case, no local reply will be sent. + // Instead, the stream to the external processor will be closed. There will be no + // more external processing for this stream from now on. + bool disable_immediate_response = 15; + + // Options related to the sending and receiving of dynamic metadata. + MetadataOptions metadata_options = 16; + + // If true, send each part of the HTTP request or response specified by ``ProcessingMode`` + // without pausing on filter chain iteration. It is "Send and Go" mode that can be used + // by external processor to observe the request's data and status. In this mode: + // + // 1. Only ``STREAMED``, ``GRPC``, and ``NONE`` body processing modes are supported; for any + // other body processing mode, the body will not be sent. + // + // 2. External processor should not send back processing response, as any responses will be ignored. + // This also means that + // :ref:`message_timeout ` + // restriction doesn't apply to this mode. + // + // 3. External processor may still close the stream to indicate that no more messages are needed. + // + bool observability_mode = 17; + + // Prevents clearing the route-cache when the + // :ref:`clear_route_cache ` + // field is set in an external processor response. + // Only one of ``disable_clear_route_cache`` or ``route_cache_action`` can be set. + // It is recommended to set ``route_cache_action`` which supersedes ``disable_clear_route_cache``. + bool disable_clear_route_cache = 11 + [(udpa.annotations.field_migrate).oneof_promotion = "clear_route_cache_type"]; + + // Specifies the action to be taken when an external processor response is + // received in response to request headers. It is recommended to set this field rather than set + // :ref:`disable_clear_route_cache `. + // Only one of ``disable_clear_route_cache`` or ``route_cache_action`` can be set. + // + // .. attention:: + // + // Clearing the route cache can cause Envoy to recompute route matching after earlier HTTP + // filters have already processed the request. This can be security-sensitive when filters + // that make route-dependent authorization decisions, such as the RBAC filter, run before + // ext_proc and ext_proc mutates route-matching inputs. + // + // Operators should only enable route cache clearing for trusted external processors, should + // carefully order route-dependent authorization filters, and should use mutation_rules to + // restrict sensitive mutations when appropriate. + RouteCacheAction route_cache_action = 18 + [(udpa.annotations.field_migrate).oneof_promotion = "clear_route_cache_type"]; + + // Specifies the deferred closure timeout for gRPC stream that connects to external processor. Currently, the deferred stream closure + // is only used in :ref:`observability_mode `. + // In observability mode, gRPC streams may be held open to the external processor longer than the lifetime of the regular client to + // backend stream lifetime. In this case, the data plane will eventually timeout the external processor stream according to this time limit. + // The default value is 5000 milliseconds (5 seconds) if not specified. + google.protobuf.Duration deferred_close_timeout = 19; + + // Send body to the side stream server once it arrives without waiting for the header response from that server. + // It only works for ``STREAMED`` body processing mode. For any other body + // processing modes, it is ignored. + // The server has two options upon receiving a header request: + // + // 1. Instant Response: send the header response as soon as the header request is received. + // + // 2. Delayed Response: wait for the body before sending any response. + // + // In all scenarios, the header-body ordering must always be maintained. + // + // If enabled the data plane will ignore the + // :ref:`mode_override ` + // value that the server sends in the header response. This is because the data plane may have already + // sent the body to the server, prior to processing the header response. + bool send_body_without_waiting_for_header_response = 21; + + // When :ref:`allow_mode_override + // ` is enabled and + // ``allowed_override_modes`` is configured, the filter config :ref:`processing_mode + // ` + // can only be overridden by the response message from the external processing server iff the + // :ref:`mode_override ` is allowed by + // the ``allowed_override_modes`` allow-list below. + // Since ``request_header_mode`` is not applicable in any way, it's ignored in comparison. + repeated ProcessingMode allowed_override_modes = 22; + + // Decorator to introduce custom logic that runs after the ``ProcessingRequest`` is constructed, but + // before it is sent to the External Processor. The ``ProcessingRequest`` may be modified. + // + // .. note:: + // Processing request modifiers are currently in alpha. + // + // [#extension-category: envoy.http.ext_proc.processing_request_modifiers] + config.core.v3.TypedExtensionConfig processing_request_modifier = 25 + [(xds.annotations.v3.field_status).work_in_progress = true]; + + // Decorator to introduce custom logic that runs after a message received from + // the External Processor is processed, but before continuing filter chain iteration. + // + // .. note:: + // Response processors are currently in alpha. + // + // [#extension-category: envoy.http.ext_proc.response_processors] + config.core.v3.TypedExtensionConfig on_processing_response = 23 + [(xds.annotations.v3.field_status).work_in_progress = true]; + + // Sets the HTTP status code that is returned to the client when the external processing server returns + // an error, fails to respond, or cannot be reached. + // + // The default status is ``HTTP 500 Internal Server Error``. + type.v3.HttpStatus status_on_error = 24; + + // If true, the filter will not remove the ``content-length`` header from the request/response after external processing. + // It is typically used in + // :ref:`FULL_DUPLEX_STREAMED ` + // mode. If the original body has been modified, the external processing server needs to set the correct content-length header in HeaderMutation + // that matches the modified body length. + // + // .. warning:: + // + // This configuration should only be used if you are sure that the content length matches + // the body length after external processing. Otherwise, it may cause vulnerability issues such as + // request smuggling. Thus, please use your own discretion when enabling this feature. + // + bool allow_content_length_header = 26; + + // Whether to emit client-side spans for external processing requests. + // When set to false, client-side egress spans will not be emitted/exported to trace collectors, + // but trace context (e.g. ``traceparent``) will still be propagated to the external processor. + // + // If unset, defaults to ``true``. + google.protobuf.BoolValue emit_client_span = 27; +} + +// ExtProcHttpService is used for HTTP communication between the filter and the external processing service. +message ExtProcHttpService { + // Sets the HTTP service which the external processing requests must be sent to. + config.core.v3.HttpService http_service = 1; +} + +// The MetadataOptions structure defines options for the sending and receiving of +// dynamic metadata. Specifically, which namespaces to send to the server, whether +// metadata returned by the server may be written, and how that metadata may be written. +message MetadataOptions { + message MetadataNamespaces { + // Specifies a list of metadata namespaces whose values, if present, + // will be passed to the ``ext_proc`` service as an opaque ``protobuf::Struct``. + repeated string untyped = 1; + + // Specifies a list of metadata namespaces whose values, if present, + // will be passed to the ``ext_proc`` service as a ``protobuf::Any``. This allows + // envoy and the external processing server to share the protobuf message + // definition for safe parsing. + repeated string typed = 2; + } + + // Describes which typed or untyped filter dynamic metadata namespaces to forward to + // the external processing server. + MetadataNamespaces forwarding_namespaces = 1; + + // Describes which typed or untyped filter dynamic metadata namespaces to accept from + // the external processing server. Set to empty or leave unset to disallow writing + // any received dynamic metadata. + MetadataNamespaces receiving_namespaces = 2; + + // Describes which cluster metadata namespaces to forward to + // the external processing server. + // .. note:: + // This is the least specific metadata. Should there be any namespace collision, + // cluster level metadata can be overridden by filter metadata. + MetadataNamespaces cluster_metadata_forwarding_namespaces = 3; +} + +// The HeaderForwardingRules structure specifies what headers are +// allowed to be forwarded to the external processing server. +// +// This works as below: +// +// 1. If neither ``allowed_headers`` nor ``disallowed_headers`` is set, all headers are forwarded. +// 2. If both ``allowed_headers`` and ``disallowed_headers`` are set, only headers in the +// ``allowed_headers`` but not in the ``disallowed_headers`` are forwarded. +// 3. If ``allowed_headers`` is set, and ``disallowed_headers`` is not set, only headers in +// the ``allowed_headers`` are forwarded. +// 4. If ``disallowed_headers`` is set, and ``allowed_headers`` is not set, all headers except +// headers in the ``disallowed_headers`` are forwarded. +message HeaderForwardingRules { + // If set, specifically allow any header in this list to be forwarded to the external + // processing server. This can be overridden by the below ``disallowed_headers``. + type.matcher.v3.ListStringMatcher allowed_headers = 1; + + // If set, specifically disallow any header in this list to be forwarded to the external + // processing server. This overrides the above ``allowed_headers`` if a header matches both. + type.matcher.v3.ListStringMatcher disallowed_headers = 2; +} + +// Extra settings that may be added to per-route configuration for a +// virtual host or cluster. +message ExtProcPerRoute { + oneof override { + option (validate.required) = true; + + // Disable the filter for this particular vhost or route. + // If disabled is specified in multiple per-filter-configs, the most specific one will be used. + bool disabled = 1 [(validate.rules).bool = {const: true}]; + + // Override aspects of the configuration for this route. A set of + // overrides in a more specific configuration will override a "disabled" + // flag set in a less-specific one. + ExtProcOverrides overrides = 2; + } +} + +// Overrides that may be set on a per-route basis +// [#next-free-field: 11] +message ExtProcOverrides { + // Set a different processing mode for this route than the default. + ProcessingMode processing_mode = 1; + + // [#not-implemented-hide:] + // Set a different asynchronous processing option than the default. + // Deprecated and not implemented. + bool async_mode = 2 [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // [#not-implemented-hide:] + // Set different optional attributes than the default setting of the + // ``request_attributes`` field. + repeated string request_attributes = 3; + + // [#not-implemented-hide:] + // Set different optional properties than the default setting of the + // ``response_attributes`` field. + repeated string response_attributes = 4; + + // Set a different gRPC service for this route than the default. + config.core.v3.GrpcService grpc_service = 5; + + // Options related to the sending and receiving of dynamic metadata. + // Lists of forwarding and receiving namespaces will be overridden in their entirety, + // meaning the most-specific config that specifies this override will be the final + // config used. It is the prerogative of the control plane to ensure this + // most-specific config contains the correct final overrides. + MetadataOptions metadata_options = 6; + + // Additional metadata to include into streams initiated to the ``ext_proc`` gRPC + // service. This can be used for scenarios in which additional ad hoc + // authorization headers (e.g. ``x-foo-bar: baz-key``) are to be injected or + // when a route needs to partially override inherited metadata. + repeated config.core.v3.HeaderValue grpc_initial_metadata = 7; + + // If true, the filter will not fail closed if the gRPC stream is prematurely closed + // or could not be opened. This field is the per-route override of + // :ref:`failure_mode_allow `. + google.protobuf.BoolValue failure_mode_allow = 8; + + // Decorator to introduce custom logic that runs after the ``ProcessingRequest`` is constructed, but + // before it is sent to the External Processor. The ``ProcessingRequest`` may be modified. + // This is a per-route override of + // :ref:`processing_request_modifier `. + config.core.v3.TypedExtensionConfig processing_request_modifier = 9 + [(xds.annotations.v3.field_status).work_in_progress = true]; + + // Overrides the filter-level ``emit_client_span`` setting for this route. + google.protobuf.BoolValue emit_client_span = 10; +} diff --git a/modules/sync/envoyproxy/envoy/cas/47d9b45b6609bf2cdbc4b7ecce176c32b686cf33d8f787a557afe7c8e4f8e174d61e9732d6ea408f6d479d66078d2cdc96274677822dfd3009061569569e8f8e b/modules/sync/envoyproxy/envoy/cas/47d9b45b6609bf2cdbc4b7ecce176c32b686cf33d8f787a557afe7c8e4f8e174d61e9732d6ea408f6d479d66078d2cdc96274677822dfd3009061569569e8f8e new file mode 100644 index 00000000..38bd581b --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/47d9b45b6609bf2cdbc4b7ecce176c32b686cf33d8f787a557afe7c8e4f8e174d61e9732d6ea408f6d479d66078d2cdc96274677822dfd3009061569569e8f8e @@ -0,0 +1,704 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.ext_authz.v3; + +import "envoy/config/common/mutation_rules/v3/mutation_rules.proto"; +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/config_source.proto"; +import "envoy/config/core/v3/grpc_service.proto"; +import "envoy/config/core/v3/http_uri.proto"; +import "envoy/type/matcher/v3/metadata.proto"; +import "envoy/type/matcher/v3/string.proto"; +import "envoy/type/v3/http_status.proto"; + +import "google/protobuf/struct.proto"; +import "google/protobuf/wrappers.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/sensitive.proto"; +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.ext_authz.v3"; +option java_outer_classname = "ExtAuthzProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_authz/v3;ext_authzv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: External Authorization] +// External Authorization :ref:`configuration overview `. +// [#extension: envoy.filters.http.ext_authz] + +// [#next-free-field: 35] +message ExtAuthz { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.ext_authz.v3.ExtAuthz"; + + reserved 4; + + reserved "use_alpha"; + + // External authorization service configuration. + oneof services { + // gRPC service configuration (default timeout: 200ms). + config.core.v3.GrpcService grpc_service = 1; + + // HTTP service configuration (default timeout: 200ms). + HttpService http_service = 3; + } + + // API version for ext_authz transport protocol. This describes the ext_authz gRPC endpoint and + // version of messages used on the wire. + config.core.v3.ApiVersion transport_api_version = 12 + [(validate.rules).enum = {defined_only: true}]; + + // Changes the filter's behavior on errors: + // + // * When set to ``true``, the filter will ``accept`` the client request even if communication with + // the authorization service has failed, or if the authorization service has returned an HTTP 5xx + // error. + // + // * When set to ``false``, the filter will ``reject`` client requests and return ``Forbidden`` + // if communication with the authorization service has failed, or if the authorization service + // has returned an HTTP 5xx error. + // + // Errors can always be tracked in the :ref:`stats `. + // + // Defaults to ``false``. + bool failure_mode_allow = 2; + + // When ``failure_mode_allow`` and ``failure_mode_allow_header_add`` are both set to ``true``, + // ``x-envoy-auth-failure-mode-allowed: true`` will be added to request headers if the communication + // with the authorization service has failed, or if the authorization service has returned a + // HTTP 5xx error. + bool failure_mode_allow_header_add = 19; + + // Enables the filter to buffer the client request body and send it within the authorization request. + // The ``x-envoy-auth-partial-body: false|true`` metadata header will be added to the authorization + // request indicating whether the body data is partial. + BufferSettings with_request_body = 5; + + // Clears the route cache in order to allow the external authorization service to correctly affect + // routing decisions. The filter clears all cached routes when all of the following holds: + // + // * This field is set to ``true``. + // * The status returned from the authorization service is an HTTP 200 or gRPC 0. + // * At least one ``authorization response header`` is added to the client request, or is used to + // alter another client request header. + // + // Defaults to ``false``. + // + // .. attention:: + // + // Enabling this option can cause Envoy to recompute route matching after earlier HTTP filters + // have already processed the request. This can be security-sensitive when route-dependent + // authorization filters, such as the RBAC filter, run before ext_authz. + // + // Operators should avoid enabling this option for authorization services that are not fully + // trusted to influence routing. When possible, filters that mutate route-matching inputs and + // clear the route cache should run before route-dependent authorization filters. Operators can + // also use decoder_header_mutation_rules to restrict sensitive request header mutations. + bool clear_route_cache = 6; + + // A list of the request header names the routes match on. When this list is not empty and + // ``clear_route_cache`` is ``true``, an ``OK`` response clears the route cache only when it sets, + // appends, or removes one of these headers, or mutates a query parameter, rather than on any request + // mutation. This avoids re-resolving the route when the response only touches headers that no route + // matches on. + // + // If not specified, the route cache is cleared whenever an ``OK`` response sets, appends, or removes + // any request header, or mutates a query parameter. + // + // .. attention:: + // + // List every request header the routes match on. A route that matches on a header omitted here is + // not re-resolved when the authorization service mutates that header, which can route the request + // as if the mutation had not happened. + repeated string clear_route_cache_headers = 34 [(validate.rules).repeated = { + items {string {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}} + }]; + + // Sets the HTTP status that is returned to the client when the authorization server returns an error + // or cannot be reached. + // + // The default status is ``HTTP 403 Forbidden``. + type.v3.HttpStatus status_on_error = 7; + + // When set to ``true``, the filter will check the :ref:`ext_authz response + // ` for invalid header and + // query parameter mutations. If the response is invalid, the filter will send a local reply + // to the downstream request with status ``HTTP 500 Internal Server Error``. + // + // .. note:: + // Both ``headers_to_remove`` and ``query_parameters_to_remove`` are validated, but invalid elements in + // those fields should not affect any headers and thus will not cause the filter to send a local reply. + // + // When set to ``false``, any invalid mutations will be visible to the rest of Envoy and may cause + // unexpected behavior. + // + // If you are using ext_authz with an untrusted ext_authz server, you should set this to ``true``. + // + // Defaults to ``false``. + bool validate_mutations = 24; + + // Specifies a list of metadata namespaces whose values, if present, will be passed to the + // ext_authz service. The :ref:`filter_metadata ` + // is passed as an opaque ``protobuf::Struct``. + // + // .. note:: + // This field applies exclusively to the gRPC ext_authz service and has no effect on the HTTP service. + // + // For example, if the ``jwt_authn`` filter is used and :ref:`payload_in_metadata + // ` is set, + // then the following will pass the jwt payload to the authorization server. + // + // .. code-block:: yaml + // + // metadata_context_namespaces: + // - envoy.filters.http.jwt_authn + // + repeated string metadata_context_namespaces = 8; + + // Specifies a list of metadata namespaces whose values, if present, will be passed to the + // ext_authz service. :ref:`typed_filter_metadata ` + // is passed as a ``protobuf::Any``. + // + // .. note:: + // This field applies exclusively to the gRPC ext_authz service and has no effect on the HTTP service. + // + // This works similarly to ``metadata_context_namespaces`` but allows Envoy and the ext_authz server to share + // the protobuf message definition in order to perform safe parsing. + // + repeated string typed_metadata_context_namespaces = 16; + + // Specifies a list of route metadata namespaces whose values, if present, will be passed to the + // ext_authz service at :ref:`route_metadata_context ` in + // :ref:`CheckRequest `. + // :ref:`filter_metadata ` is passed as an opaque ``protobuf::Struct``. + repeated string route_metadata_context_namespaces = 21; + + // Specifies a list of route metadata namespaces whose values, if present, will be passed to the + // ext_authz service at :ref:`route_metadata_context ` in + // :ref:`CheckRequest `. + // :ref:`typed_filter_metadata ` is passed as a ``protobuf::Any``. + repeated string route_typed_metadata_context_namespaces = 22; + + // Specifies if the filter is enabled. + // + // If :ref:`runtime_key ` is specified, + // Envoy will lookup the runtime key to get the percentage of requests to filter. + // + // If this field is not specified, the filter will be enabled for all requests. + config.core.v3.RuntimeFractionalPercent filter_enabled = 9; + + // Specifies if the filter is enabled with metadata matcher. + // If this field is not specified, the filter will be enabled for all requests. + // + // .. note:: + // + // This field is only evaluated if the filter is instantiated. If the filter is marked with + // ``disabled: true`` in the :ref:`HttpFilter + // ` + // configuration or in per-route configuration via :ref:`ExtAuthzPerRoute + // `, + // the filter will not be instantiated and this field will have no effect. + // + // .. tip:: + // + // For dynamic filter activation based on metadata (such as metadata set by a preceding + // filter), consider using :ref:`ExtensionWithMatcher + // ` instead. This + // provides a more flexible matching framework that can evaluate conditions before filter + // instantiation. See the :ref:`ext_authz filter documentation + // ` for examples. + type.matcher.v3.MetadataMatcher filter_enabled_metadata = 14; + + // Specifies whether to deny the requests when the filter is disabled. + // If :ref:`runtime_key ` is specified, + // Envoy will lookup the runtime key to determine whether to deny requests for filter-protected paths + // when the filter is disabled. If the filter is disabled in ``typed_per_filter_config`` for the path, + // requests will not be denied. + // + // If this field is not specified, all requests will be allowed when disabled. + // + // If a request is denied due to this setting, the response code in :ref:`status_on_error + // ` will + // be returned. + config.core.v3.RuntimeFeatureFlag deny_at_disable = 11; + + // Specifies if the peer certificate is sent to the external service. + // + // When this field is ``true``, Envoy will include the peer X.509 certificate, if available, in the + // :ref:`certificate`. + bool include_peer_certificate = 10; + + // Optional additional prefix to use when emitting statistics. This allows distinguishing + // emitted statistics between configured ``ext_authz`` filters in an HTTP filter chain. For example: + // + // .. code-block:: yaml + // + // http_filters: + // - name: envoy.filters.http.ext_authz + // typed_config: + // "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz + // stat_prefix: waf # This emits ext_authz.waf.ok, ext_authz.waf.denied, etc. + // - name: envoy.filters.http.ext_authz + // typed_config: + // "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz + // stat_prefix: blocker # This emits ext_authz.blocker.ok, ext_authz.blocker.denied, etc. + // + string stat_prefix = 13; + + // Optional labels that will be passed to :ref:`labels` in + // :ref:`destination`. + // The labels will be read from :ref:`metadata` with the specified key. + string bootstrap_metadata_labels_key = 15; + + // Check request to authorization server will include the client request headers that have a correspondent match + // in the list. If this option isn't specified, then + // all client request headers are included in the check request to a gRPC authorization server, whereas no client request headers + // (besides the ones allowed by default - see note below) are included in the check request to an HTTP authorization server. + // This inconsistency between gRPC and HTTP servers is to maintain backwards compatibility with legacy behavior. + // + // .. note:: + // + // For requests to an HTTP authorization server: in addition to the user's supplied matchers, ``Host``, ``Method``, ``Path``, + // ``Content-Length``, and ``Authorization`` are **additionally included** in the list. + // + // .. note:: + // + // For requests to an HTTP authorization server: the value of ``Content-Length`` will be set to ``0`` and the request to the + // authorization server will not have a message body. However, the check request can include the buffered + // client request body (controlled by :ref:`with_request_body + // ` setting); + // consequently, the value of ``Content-Length`` in the authorization request reflects the size of its payload. + // + // .. note:: + // + // This can be overridden by the field ``disallowed_headers`` below. That is, if a header + // matches for both ``allowed_headers`` and ``disallowed_headers``, the header will NOT be sent. + type.matcher.v3.ListStringMatcher allowed_headers = 17; + + // If set, specifically disallow any header in this list to be forwarded to the external + // authentication server. This overrides the above ``allowed_headers`` if a header matches both. + type.matcher.v3.ListStringMatcher disallowed_headers = 25; + + // Specifies if the TLS session level details like SNI are sent to the external service. + // + // When this field is ``true``, Envoy will include the SNI name used for TLSClientHello, if available, in the + // :ref:`tls_session`. + bool include_tls_session = 18; + + // Whether to increment cluster statistics (e.g. cluster..upstream_rq_*) on authorization failure. + // Defaults to ``true``. + google.protobuf.BoolValue charge_cluster_response_stats = 20; + + // Whether to encode the raw headers (i.e., unsanitized values and unconcatenated multi-line headers) + // in the authorization request. Works with both HTTP and gRPC clients. + // + // When this is set to ``true``, header values are not sanitized. Headers with the same key will also + // not be combined into a single, comma-separated header. + // Requests to gRPC services will populate the field + // :ref:`header_map`. + // Requests to HTTP services will be constructed with the unsanitized header values and preserved + // multi-line headers with the same key. + // + // If this field is set to ``false``, header values will be sanitized, with any non-UTF-8-compliant + // bytes replaced with ``'!'``. Headers with the same key will have their values concatenated into a + // single comma-separated header value. + // Requests to gRPC services will populate the field + // :ref:`headers`. + // Requests to HTTP services will have their header values sanitized and will not preserve + // multi-line headers with the same key. + // + // It is recommended to set this to ``true`` unless you rely on the previous behavior. + // + // It is set to ``false`` by default for backwards compatibility. + bool encode_raw_headers = 23; + + // Rules for what modifications an ext_authz server may make to the request headers before + // continuing decoding or forwarding upstream. + // + // If set, enables header mutation checking against the configured rules. Note that + // :ref:`HeaderMutationRules ` + // has defaults that change ext_authz behavior. Also note that if this field is set, + // ext_authz can no longer append to ``:``-prefixed headers. + // + // If unset, header mutation rule checking is completely disabled. + // + // Regardless of what is configured here, ext_authz cannot remove ``:``-prefixed headers. + // + // This field and ``validate_mutations`` have different use cases. ``validate_mutations`` enables + // correctness checks for all header and query parameter mutations (for example, invalid characters). + // This field allows the filter to reject mutations to specific headers. + config.common.mutation_rules.v3.HeaderMutationRules decoder_header_mutation_rules = 26; + + // Enable or disable ingestion of dynamic metadata from the ext_authz service. + // + // If ``false``, the filter will ignore dynamic metadata injected by the ext_authz service. If the + // ext_authz service tries injecting dynamic metadata, the filter will log, increment the + // ``ignored_dynamic_metadata`` stat, then continue handling the response. + // + // If ``true``, the filter will ingest dynamic metadata entries as normal. + // + // If unset, defaults to ``true``. + google.protobuf.BoolValue enable_dynamic_metadata_ingestion = 27; + + // Additional metadata to be added to the filter state for logging purposes. The metadata will be + // added to StreamInfo's filter state under the namespace corresponding to the ext_authz filter + // name. + google.protobuf.Struct filter_metadata = 28; + + // When set to ``true``, the filter will emit per-stream stats for access logging. The filter state + // key will be the same as the filter name. + // + // If using Envoy gRPC, emits latency, bytes sent / received, upstream info, and upstream cluster + // info. If not using Envoy gRPC, emits only latency. + // + // .. note:: + // Stats are ONLY added to filter state if a check request is actually made to an ext_authz service. + // + // If this is ``false`` the filter will not emit stats, but filter_metadata will still be respected if + // it has a value. + // + // Field ``latency_us`` is exposed for CEL and logging when using gRPC or HTTP service. + // Fields ``bytesSent`` and ``bytesReceived`` are exposed for CEL and logging only when using gRPC service. + bool emit_filter_state_stats = 29; + + // Sets the maximum size (in bytes) of the response body that the filter will send downstream + // when a request is denied by the external authorization service. + // + // If the authorization server returns a response body larger than this configured limit, + // the body will be truncated to ``max_denied_response_body_bytes`` before being sent to the + // downstream client. + // + // If this field is not set or is set to 0, no truncation will occur, and the entire + // denied response body will be forwarded. + uint32 max_denied_response_body_bytes = 30; + + // When set to ``true``, the filter will enforce the response header map's count and size limits + // by sending a local reply when those limits are violated. + // + // When set to ``false``, the filter will ignore the response header map's limits and add / set + // all response headers as specified by the external authorization service. + // + // Recommendation: enable if the external authorization service is not trusted. Otherwise, leave + // it ``false``. + // + // Defaults to ``false``. + bool enforce_response_header_limits = 31; + + // When set to ``true``, the filter operates in shadow mode. In shadow mode the + // filter still calls the external authorization service and processes the response, + // but never terminates the request. Instead of sending a local reply on a denied or + // error response, the filter writes the authorization decision (engine result, status + // code, response headers) into the request's + // :ref:`FilterState ` as a + // :ref:`ShadowDecision + // ` object so + // that subsequent filters can read and optionally enforce it. + // + // The FilterState key is the filter's configured ``name`` in the filter chain with a + // ``.shadow`` suffix (``envoy.filters.http.ext_authz.shadow`` by default). Multiple ext_authz + // filters in the same chain must already have distinct names and therefore write to distinct + // keys automatically. + // + // The auth server's denied-response body is intentionally **not** carried on the + // ShadowDecision: bodies can be arbitrarily large and no downstream consumer in the + // shadow-comparison flow needs them. A consumer that wants to reproduce the auth + // server's full denied response must read it from its own source of truth rather + // than replaying it from FilterState. + // + // Header and query-parameter mutations from an OK response are still applied to the + // request as usual. + // + // Defaults to ``false``. + bool shadow_mode = 32; + + // Whether to emit client-side spans for external authorization requests (e.g. gRPC or HTTP calls). + // When set to false, client-side egress spans will not be emitted/exported to trace collectors, + // but trace context (e.g. ``traceparent``) will still be propagated to the authorization server. + // + // If unset, defaults to ``true``. + google.protobuf.BoolValue emit_client_span = 33; +} + +// Serialized form of the shadow-mode authorization decision written to FilterState +// when :ref:`shadow_mode +// ` is +// enabled. Consumed by a downstream filter that decides whether to enforce the +// decision. +message ShadowDecision { + // The decision the auth server returned. + enum CheckResult { + UNSPECIFIED = 0; + OK = 1; + DENIED = 2; + ERROR = 3; + } + + // The decision the auth server returned. + CheckResult check_result = 1; + + // Response status code associated with the decision. For ``DENIED`` and ``ERROR`` this is + // the code the filter would have set on termination (the auth server's code for ``DENIED``, + // or :ref:`status_on_error + // ` fallback + // for ``ERROR``). For ``OK`` this defaults to ``200`` so consumers always see a populated + // value — the upstream response code is not known at shadow-decision time. + uint32 status_code = 2 [(validate.rules).uint32 = {lte: 599 gte: 100 ignore_empty: true}]; + + // Response headers the auth server asked to set on a denied response + // (e.g. ``WWW-Authenticate``, ``Set-Cookie``). Populated for ``DENIED`` only. + // Preserves ordering and duplicate header names. + repeated config.core.v3.HeaderValue response_headers = 3; +} + +// Configuration for buffering the request data. +message BufferSettings { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.ext_authz.v2.BufferSettings"; + + // Sets the maximum size of a message body that the filter will hold in memory. Envoy will return + // ``HTTP 413`` and will *not* initiate the authorization process when the buffer reaches the size + // set in this field. + // + // .. note:: + // This setting will have precedence over :ref:`failure_mode_allow + // `. + uint32 max_request_bytes = 1 [(validate.rules).uint32 = {gt: 0}]; + + // When this field is ``true``, Envoy will buffer the message until ``max_request_bytes`` is reached. + // The authorization request will be dispatched and no 413 HTTP error will be returned by the + // filter. + // + // Defaults to ``false``. + bool allow_partial_message = 2; + + // If ``true``, the body sent to the external authorization service is set as raw bytes and populates + // :ref:`raw_body` + // in the HTTP request attribute context. Otherwise, :ref:`body + // ` will be populated + // with a UTF-8 string request body. + // + // This field only affects configurations using a :ref:`grpc_service + // `. In configurations that use + // an :ref:`http_service `, this + // has no effect. + // + // Defaults to ``false``. + bool pack_as_bytes = 3; +} + +// HttpService is used for raw HTTP communication between the filter and the authorization service. +// When configured, the filter will parse the client request and use these attributes to call the +// authorization server. Depending on the response, the filter may reject or accept the client +// request. +// +// .. note:: +// In any of these events, metadata can be added, removed or overridden by the filter: +// +// On authorization request, a list of allowed request headers may be supplied. See +// :ref:`allowed_headers +// ` +// for details. Additional headers metadata may be added to the authorization request. See +// :ref:`headers_to_add +// ` for +// details. +// +// On authorization response status ``HTTP 200 OK``, the filter will allow traffic to the upstream and +// additional headers metadata may be added to the original client request. See +// :ref:`allowed_upstream_headers +// ` +// for details. Additionally, the filter may add additional headers to the client's response. See +// :ref:`allowed_client_headers_on_success +// ` +// for details. +// +// On other authorization response statuses, the filter will not allow traffic. Additional headers +// metadata as well as body may be added to the client's response. See :ref:`allowed_client_headers +// ` +// for details. +// [#next-free-field: 11] +message HttpService { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.ext_authz.v2.HttpService"; + + reserved 3, 4, 5, 6; + + // Sets the HTTP server URI which the authorization requests must be sent to. + config.core.v3.HttpUri server_uri = 1; + + // Sets a prefix to the value of authorization request header ``Path``. + // Only one of ``path_prefix`` or ``path_override`` may be set. + string path_prefix = 2; + + // Replaces the value of authorization request header ``Path`` with this value. + // Only one of ``path_prefix`` or ``path_override`` may be set. + string path_override = 10; + + // Settings used for controlling authorization request metadata. + AuthorizationRequest authorization_request = 7; + + // Settings used for controlling authorization response metadata. + AuthorizationResponse authorization_response = 8; + + // Optional retry policy for requests to the authorization server. + // If not set, no retries will be performed. + // + // .. note:: + // When this field is set, the ``ext_authz`` filter will buffer the request body for retry purposes. + config.core.v3.RetryPolicy retry_policy = 9; +} + +message AuthorizationRequest { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.ext_authz.v2.AuthorizationRequest"; + + // Authorization request includes the client request headers that have a corresponding match + // in the list. + // This field has been deprecated in favor of :ref:`allowed_headers + // `. + // + // .. note:: + // + // In addition to the user's supplied matchers, ``Host``, ``Method``, ``Path``, + // ``Content-Length``, and ``Authorization`` are **automatically included** in the list. + // + // .. note:: + // + // By default, the ``Content-Length`` header is set to ``0`` and the request to the authorization + // service has no message body. However, the authorization request *may* include the buffered + // client request body (controlled by :ref:`with_request_body + // ` + // setting); hence the value of its ``Content-Length`` reflects the size of its payload. + // + type.matcher.v3.ListStringMatcher allowed_headers = 1 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Sets a list of headers that will be included in the request to the authorization service. + // + // .. note:: + // Client request headers with the same key will be overridden. + repeated config.core.v3.HeaderValue headers_to_add = 2; +} + +// [#next-free-field: 6] +message AuthorizationResponse { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.ext_authz.v2.AuthorizationResponse"; + + // When this list is set, authorization + // response headers that have a correspondent match will be added to the original client request. + // + // .. note:: + // Existing headers will be overridden. + type.matcher.v3.ListStringMatcher allowed_upstream_headers = 1; + + // When this list is set, authorization + // response headers that have a correspondent match will be added to the original client request. + // + // .. note:: + // Existing headers will be appended. + type.matcher.v3.ListStringMatcher allowed_upstream_headers_to_append = 3; + + // When this list is set, authorization + // response headers that have a correspondent match will be added to the client's response. + // When a header is included in this list, ``Path``, ``Status``, ``Content-Length``, ``WWW-Authenticate`` and + // ``Location`` are automatically added. + // + // .. note:: + // When this list is *not* set, all the authorization response headers, except + // ``Authority (Host)``, will be in the response to the client. + type.matcher.v3.ListStringMatcher allowed_client_headers = 2; + + // When this list is set, authorization + // response headers that have a correspondent match will be added to the client's response when + // the authorization response itself is successful, i.e. not failed or denied. When this list is + // *not* set, no additional headers will be added to the client's response on success. + type.matcher.v3.ListStringMatcher allowed_client_headers_on_success = 4; + + // When this list is set, authorization + // response headers that have a correspondent match will be emitted as dynamic metadata to be consumed + // by the next filter. This metadata lives in a namespace specified by the canonical name of extension filter + // that requires it: + // + // - :ref:`envoy.filters.http.ext_authz ` for HTTP filter. + // - :ref:`envoy.filters.network.ext_authz ` for network filter. + type.matcher.v3.ListStringMatcher dynamic_metadata_from_headers = 5; +} + +// Extra settings on a per virtualhost/route/weighted-cluster level. +message ExtAuthzPerRoute { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.ext_authz.v2.ExtAuthzPerRoute"; + + oneof override { + option (validate.required) = true; + + // Disable the ext auth filter for this particular vhost or route. + // If disabled is specified in multiple per-filter-configs, the most specific one will be used. + // If the filter is disabled by default and this is set to ``false``, the filter will be enabled + // for this vhost or route. + bool disabled = 1; + + // Check request settings for this route. + CheckSettings check_settings = 2 [(validate.rules).message = {required: true}]; + } +} + +// Extra settings for the check request. +// [#next-free-field: 7] +message CheckSettings { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.ext_authz.v2.CheckSettings"; + + // Context extensions to set on the CheckRequest's + // :ref:`AttributeContext.context_extensions` + // + // You can use this to provide extra context for the external authorization server on specific + // virtual hosts/routes. For example, adding a context extension on the virtual host level can + // give the ext-authz server information on what virtual host is used without needing to parse the + // host header. If CheckSettings is specified in multiple per-filter-configs, they will be merged + // in order, and the result will be used. + // + // Merge semantics for this field are such that keys from more specific configs override. + // + // .. note:: + // These settings are only applied to a filter configured with a + // :ref:`grpc_service`. + map context_extensions = 1 [(udpa.annotations.sensitive) = true]; + + // When set to ``true``, disable the configured :ref:`with_request_body + // ` for a specific route. + // + // Only one of ``disable_request_body_buffering`` and + // :ref:`with_request_body ` + // may be specified. + bool disable_request_body_buffering = 2; + + // Enable or override request body buffering, which is configured using the + // :ref:`with_request_body ` + // option for a specific route. + // + // Only one of ``with_request_body`` and + // :ref:`disable_request_body_buffering ` + // may be specified. + BufferSettings with_request_body = 3; + + // Override the external authorization service for this route. + // This allows different routes to use different external authorization service backends + // and service types (gRPC or HTTP). If specified, this overrides the filter-level service + // configuration regardless of the original service type. + oneof service_override { + // Override with a gRPC service configuration. + config.core.v3.GrpcService grpc_service = 4; + + // Override with an HTTP service configuration. + HttpService http_service = 5; + } + + // Overrides the filter-level ``emit_client_span`` setting for this route. + google.protobuf.BoolValue emit_client_span = 6; +} diff --git a/modules/sync/envoyproxy/envoy/cas/480fe0447ce1c8c566a733d914442215bbf5edd7e6af6918efac4e807fe990abec31bb5e72d3c5decbdeb2f91056fc31f8d1a24700adb5a70bd750470c381948 b/modules/sync/envoyproxy/envoy/cas/480fe0447ce1c8c566a733d914442215bbf5edd7e6af6918efac4e807fe990abec31bb5e72d3c5decbdeb2f91056fc31f8d1a24700adb5a70bd750470c381948 new file mode 100644 index 00000000..f5023f17 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/480fe0447ce1c8c566a733d914442215bbf5edd7e6af6918efac4e807fe990abec31bb5e72d3c5decbdeb2f91056fc31f8d1a24700adb5a70bd750470c381948 @@ -0,0 +1,962 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.jwt_authn.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/http_uri.proto"; +import "envoy/config/route/v3/route_components.proto"; +import "envoy/type/matcher/v3/string.proto"; + +import "google/protobuf/duration.proto"; +import "google/protobuf/empty.proto"; + +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.jwt_authn.v3"; +option java_outer_classname = "ConfigProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/jwt_authn/v3;jwt_authnv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: JWT Authentication] +// JWT Authentication :ref:`configuration overview `. +// [#extension: envoy.filters.http.jwt_authn] + +// Please see following for JWT authentication flow: +// +// * `JSON Web Token (JWT) `_ +// * `The OAuth 2.0 Authorization Framework `_ +// * `OpenID Connect `_ +// +// A JwtProvider message specifies how a JSON Web Token (JWT) can be verified. It specifies: +// +// * issuer: the principal that issues the JWT. If specified, it has to match the ``iss`` field in JWT. +// * allowed audiences: the ones in the token have to be listed here. +// * how to fetch public key JWKS to verify the token signature. +// * how to extract the JWT in the request. +// * how to pass successfully verified token payload. +// +// Example: +// +// .. code-block:: yaml +// +// issuer: https://example.com +// audiences: +// - bookstore_android.apps.googleusercontent.com +// - bookstore_web.apps.googleusercontent.com +// remote_jwks: +// http_uri: +// uri: https://example.com/.well-known/jwks.json +// cluster: example_jwks_cluster +// timeout: 1s +// cache_duration: +// seconds: 300 +// +// [#next-free-field: 22] +message JwtProvider { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.jwt_authn.v2alpha.JwtProvider"; + + // Alters the payload representation in the request dynamic metadata to facilitate its use in matching. + message NormalizePayload { + // Each claim in this list will be interpreted as a space-delimited string + // and converted to a list of strings based on the delimited values. + // Example: a token with a claim ``scope: "email profile"`` is translated + // to dynamic metadata ``scope: ["email", "profile"]`` if this field is + // set value ``["scope"]``. This special handling of ``scope`` is + // recommended by `RFC8693 + // `_. + repeated string space_delimited_claims = 1; + } + + // Specify the `principal `_ that issued + // the JWT, usually a URL or an email address. + // + // It is optional. If specified, it has to match the ``iss`` field in JWT, + // otherwise the JWT ``iss`` field is not checked. + // + // .. note:: + // + // ``JwtRequirement`` :ref:`allow_missing ` + // and :ref:`allow_missing_or_failed ` + // are implemented differently than other ``JwtRequirements``. Hence the usage of this field + // is different as follows if ``allow_missing`` or ``allow_missing_or_failed`` is used: + // + // * If a JWT has ``iss`` field, it needs to be specified by this field in one of ``JwtProviders``. + // * If a JWT doesn't have ``iss`` field, one of ``JwtProviders`` should fill this field empty. + // * Multiple ``JwtProviders`` should not have same value in this field. + // + // Examples: + // + // * https://securetoken.google.com + // * Example: 1234567-compute@developer.gserviceaccount.com + // + string issuer = 1; + + // The list of JWT `audiences `_ are + // allowed to access. A JWT containing any of these audiences will be accepted. If not specified, + // will not check audiences in the token. + // + // Example: + // + // .. code-block:: yaml + // + // audiences: + // - bookstore_android.apps.googleusercontent.com + // - bookstore_web.apps.googleusercontent.com + // + repeated string audiences = 2; + + // Restrict the `subjects `_ + // that the JwtProvider can assert. For instance, this could implement JWT-SVID + // `subject restrictions `_. + // If not specified, will not check subjects in the token. + // + // Example: + // + // .. code-block:: yaml + // + // subjects: + // prefix: spiffe://spiffe.example.com/ + // + type.matcher.v3.StringMatcher subjects = 19; + + // Requires that the credential contains an `expiration `_. + // For instance, this could implement JWT-SVID + // `expiration restrictions `_. + // Unlike ``max_lifetime``, this only requires that expiration is present, where ``max_lifetime`` also checks the value. + // + // Example: + // + // .. code-block:: yaml + // + // require_expiration: true + // + bool require_expiration = 20; + + // Restrict the maximum remaining lifetime of a credential from the JwtProvider. Credential lifetime + // is the difference between the current time and the expiration of the credential. For instance, + // the following example will reject credentials that have a lifetime longer than 24 hours. If not set, + // expiration checking still occurs, but there is no limit on credential lifetime. If set, takes precedence + // over ``require_expiration``. + // + // Example: + // + // .. code-block:: yaml + // + // max_lifetime: + // seconds: 86400 + // + google.protobuf.Duration max_lifetime = 21; + + // `JSON Web Key Set (JWKS) `_ is needed to + // validate signature of a JWT. This field specifies where to fetch JWKS. + oneof jwks_source_specifier { + option (validate.required) = true; + + // JWKS can be fetched from remote server via HTTP/HTTPS. This field specifies the remote HTTP + // URI and how the fetched JWKS should be cached. + // + // Example: + // + // .. code-block:: yaml + // + // remote_jwks: + // http_uri: + // uri: https://www.googleapis.com/oauth2/v1/certs + // cluster: jwt.www.googleapis.com|443 + // timeout: 1s + // cache_duration: + // seconds: 300 + // + RemoteJwks remote_jwks = 3; + + // JWKS is in local data source. It could be either in a local file or embedded in the + // inline_string. + // + // Example: local file + // + // .. code-block:: yaml + // + // local_jwks: + // filename: /etc/envoy/jwks/jwks1.txt + // + // Example: inline_string + // + // .. code-block:: yaml + // + // local_jwks: + // inline_string: ACADADADADA + // + config.core.v3.DataSource local_jwks = 4; + } + + // If false, the JWT is removed in the request after a success verification. If true, the JWT is + // not removed in the request. Default value is false. + // caveat: only works for from_header/from_params & has no effect for JWTs extracted through from_cookies. + bool forward = 5; + + // Two fields below define where to extract the JWT from an HTTP request. + // + // If no explicit location is specified, the following default locations are tried in order: + // + // 1. The Authorization header using the `Bearer schema + // `_. Example:: + // + // Authorization: Bearer . + // + // 2. `access_token `_ query parameter. + // + // Multiple JWTs can be verified for a request. Each JWT has to be extracted from the locations + // its provider specified or from the default locations. + // + // Specify the HTTP headers to extract the JWT. For examples, following config: + // + // .. code-block:: yaml + // + // from_headers: + // - name: x-goog-iap-jwt-assertion + // + // can be used to extract token from header:: + // + // ``x-goog-iap-jwt-assertion: ``. + // + repeated JwtHeader from_headers = 6; + + // JWT is sent in a query parameter. ``jwt_params`` represents the query parameter names. + // + // For example, if config is: + // + // .. code-block:: yaml + // + // from_params: + // - jwt_token + // + // The JWT format in query parameter is:: + // + // /path?jwt_token= + // + repeated string from_params = 7; + + // JWT is sent in a cookie. ``from_cookies`` represents the cookie names to extract from. + // + // For example, if config is: + // + // .. code-block:: yaml + // + // from_cookies: + // - auth-token + // + // Then JWT will be extracted from ``auth-token`` cookie in the request. + // + repeated string from_cookies = 13; + + // This field specifies the header name to forward a successfully verified JWT payload to the + // backend. The forwarded data is:: + // + // base64url_encoded(jwt_payload_in_JSON) + // + // If it is not specified, the payload will not be forwarded. + string forward_payload_header = 8 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // When :ref:`forward_payload_header ` + // is specified, the base64 encoded payload will be added to the headers. + // Normally JWT based64 encode doesn't add padding. If this field is true, + // the header will be padded. + // + // This field is only relevant if :ref:`forward_payload_header ` + // is specified. + bool pad_forward_payload_header = 11; + + // If non empty, successfully verified JWT payloads will be written to StreamInfo DynamicMetadata + // in the format as: ``namespace`` is the jwt_authn filter name as ````envoy.filters.http.jwt_authn```` + // The value is the ``protobuf::Struct``. The value of this field will be the key for its ``fields`` + // and the value is the ``protobuf::Struct`` converted from JWT JSON payload. + // + // For example, if payload_in_metadata is ``my_payload``: + // + // .. code-block:: yaml + // + // envoy.filters.http.jwt_authn: + // my_payload: + // iss: https://example.com + // sub: test@example.com + // aud: https://example.com + // exp: 1501281058 + // + string payload_in_metadata = 9; + + // Normalizes the payload representation in the request metadata. + NormalizePayload normalize_payload_in_metadata = 18; + + // If not empty, similar to :ref:`payload_in_metadata `, + // a successfully verified JWT header will be written to :ref:`Dynamic State ` + // as an entry (``protobuf::Struct``) in ``envoy.filters.http.jwt_authn`` ``namespace`` with the + // value of this field as the key. + // + // For example, if ``header_in_metadata`` is ``my_header``: + // + // .. code-block:: yaml + // + // envoy.filters.http.jwt_authn: + // my_header: + // alg: JWT + // kid: EF71iSaosbC5C4tC6Syq1Gm647M + // alg: PS256 + // + // When the metadata has ``envoy.filters.http.jwt_authn`` entry already (for example if + // :ref:`payload_in_metadata ` + // is not empty), it will be inserted as a new entry in the same ``namespace`` as shown below: + // + // .. code-block:: yaml + // + // envoy.filters.http.jwt_authn: + // my_payload: + // iss: https://example.com + // sub: test@example.com + // aud: https://example.com + // exp: 1501281058 + // my_header: + // alg: JWT + // kid: EF71iSaosbC5C4tC6Syq1Gm647M + // alg: PS256 + // + // .. warning:: + // + // Using the same key name for :ref:`header_in_metadata ` + // and :ref:`payload_in_metadata ` + // is not suggested due to potential override of existing entry, while it is not enforced during + // config validation. + // + string header_in_metadata = 14; + + // If non empty, the failure status ``::google::jwt_verify::Status`` for a non verified JWT will be written to StreamInfo DynamicMetadata + // in the format as: ``namespace`` is the jwt_authn filter name as ``envoy.filters.http.jwt_authn`` + // The value is the ``protobuf::Struct``. The values of this field will be ``code`` and ``message`` + // and they will contain the JWT authentication failure status code and a message describing the failure. + // + // For example, if failed_status_in_metadata is ``my_auth_failure_status``: + // + // .. code-block:: yaml + // + // envoy.filters.http.jwt_authn: + // my_auth_failure_status: + // code: 3 + // message: Jwt expired + string failed_status_in_metadata = 16; + + // Specify the clock skew in seconds when verifying JWT time constraint, + // such as ``exp``, and ``nbf``. If not specified, default is 60 seconds. + uint32 clock_skew_seconds = 10; + + // Enables JWT cache, its size is specified by ``jwt_cache_size``. + // Only valid JWTs are cached. + JwtCacheConfig jwt_cache_config = 12; + + // Add JWT claim to HTTP Header + // Specify the claim name you want to copy in which HTTP header. For examples, following config: + // Claims of type string, int, double and bool are copied verbatim. Claims of type array or + // object are serialized to JSON and copied base64-encoded. + // + // .. literalinclude:: /_configs/repo/jwt_authn.yaml + // :language: yaml + // :lines: 44-51 + // :linenos: + // :lineno-start: 44 + // :caption: :download:`jwt_authn.yaml ` + // + // This header is only reserved for jwt claim; any other value will be overwritten. + repeated JwtClaimToHeader claim_to_headers = 15; + + // Clears route cache in order to allow the JWT to correctly affect + // routing decisions. Filter clears all cached routes when: + // + // 1. The field is set to ``true``. + // + // 2. At least one ``claim_to_headers`` header is added to the request OR + // if ``payload_in_metadata`` is set. + // + bool clear_route_cache = 17; +} + +// This message specifies JWT Cache configuration. +message JwtCacheConfig { + // The unit is number of JWTs, default to 100. + uint32 jwt_cache_size = 1; + + // The maximum size of a single cached token in bytes. + // If this field is not set or is set to 0, then the default value 4096 bytes is used. + // The maximum value for a token is inclusive. + uint32 jwt_max_token_size = 2; +} + +// This message specifies how to fetch JWKS from remote and how to cache it. +message RemoteJwks { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.jwt_authn.v2alpha.RemoteJwks"; + + // The HTTP URI to fetch the JWKS. For example: + // + // .. code-block:: yaml + // + // http_uri: + // uri: https://www.googleapis.com/oauth2/v1/certs + // cluster: jwt.www.googleapis.com|443 + // timeout: 1s + // + config.core.v3.HttpUri http_uri = 1 [(validate.rules).message = {required: true}]; + + // Duration after which the cached JWKS should be expired. If not specified, default cache + // duration is 10 minutes. + google.protobuf.Duration cache_duration = 2 [(validate.rules).duration = { + lt {seconds: 9000000000} + gte {nanos: 1000000} + }]; + + // Fetch Jwks asynchronously in the main thread before the listener is activated. + // Fetched Jwks can be used by all worker threads. + // + // If this feature is not enabled: + // + // * The Jwks is fetched on-demand when the requests come. During the fetching, first + // few requests are paused until the Jwks is fetched. + // * Each worker thread fetches its own Jwks since Jwks cache is per worker thread. + // + // If this feature is enabled: + // + // * Fetched Jwks is done in the main thread before the listener is activated. Its fetched + // Jwks can be used by all worker threads. Each worker thread doesn't need to fetch its own. + // * Jwks is ready when the requests come, not need to wait for the Jwks fetching. + // + JwksAsyncFetch async_fetch = 3; + + // Retry policy for fetching Jwks. optional. turned off by default. + // + // For example: + // + // .. code-block:: yaml + // + // retry_policy: + // retry_back_off: + // base_interval: 0.01s + // max_interval: 20s + // num_retries: 10 + // + // will yield a randomized truncated exponential backoff policy with an initial delay of 10ms + // 10 maximum attempts spaced at most 20s seconds. + // + // .. code-block:: yaml + // + // retry_policy: + // num_retries:1 + // + // uses the default :ref:`retry backoff strategy `. + // with the default base interval is 1000 milliseconds. and the default maximum interval of 10 times the base interval. + // + // if num_retries is omitted, the default is to allow only one retry. + // + // + // If enabled, the retry policy will apply to all Jwks fetching approaches, e.g. on demand or asynchronously in background. + // + // + config.core.v3.RetryPolicy retry_policy = 4; +} + +// Fetch Jwks asynchronously in the main thread when the filter config is parsed. +// The listener is activated only after the Jwks is fetched. +// When the Jwks is expired in the cache, it is fetched again in the main thread. +// The fetched Jwks from the main thread can be used by all worker threads. +message JwksAsyncFetch { + // If false, the listener is activated after the initial fetch is completed. + // The initial fetch result can be either successful or failed. + // If true, it is activated without waiting for the initial fetch to complete. + // Default is false. + bool fast_listener = 1; + + // The duration to refetch after a failed fetch. If not specified, default is 1 second. + google.protobuf.Duration failed_refetch_duration = 2; +} + +// This message specifies a header location to extract the JWT. +message JwtHeader { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.jwt_authn.v2alpha.JwtHeader"; + + // The HTTP header name. + string name = 1 + [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // The value prefix. The value format is "value_prefix" + // For example, for "Authorization: Bearer ", value_prefix="Bearer " with a space at the + // end. + string value_prefix = 2 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE strict: false}]; +} + +// Specify a required provider with audiences. +message ProviderWithAudiences { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.jwt_authn.v2alpha.ProviderWithAudiences"; + + // Specify a required provider name. + string provider_name = 1; + + // This field overrides the one specified in the JwtProvider. + repeated string audiences = 2; +} + +// This message specifies a Jwt requirement. An empty message means JWT verification is not +// required. Here are some config examples: +// +// .. code-block:: yaml +// +// # Example 1: not required with an empty message +// +// # Example 2: require A +// provider_name: provider-A +// +// # Example 3: require A or B +// requires_any: +// requirements: +// - provider_name: provider-A +// - provider_name: provider-B +// +// # Example 4: require A and B +// requires_all: +// requirements: +// - provider_name: provider-A +// - provider_name: provider-B +// +// # Example 5: require A and (B or C) +// requires_all: +// requirements: +// - provider_name: provider-A +// - requires_any: +// requirements: +// - provider_name: provider-B +// - provider_name: provider-C +// +// # Example 6: require A or (B and C) +// requires_any: +// requirements: +// - provider_name: provider-A +// - requires_all: +// requirements: +// - provider_name: provider-B +// - provider_name: provider-C +// +// # Example 7: A is optional (if token from A is provided, it must be valid, but also allows +// missing token.) +// requires_any: +// requirements: +// - provider_name: provider-A +// - allow_missing: {} +// +// # Example 8: A is optional and B is required. +// requires_all: +// requirements: +// - requires_any: +// requirements: +// - provider_name: provider-A +// - allow_missing: {} +// - provider_name: provider-B +// +// [#next-free-field: 8] +message JwtRequirement { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirement"; + + oneof requires_type { + // Specify a required provider name. + string provider_name = 1; + + // Specify a required provider with audiences. + ProviderWithAudiences provider_and_audiences = 2; + + // Specify list of JwtRequirement. Their results are OR-ed. + // If any one of them passes, the result is passed. + JwtRequirementOrList requires_any = 3; + + // Specify list of JwtRequirement. Their results are AND-ed. + // All of them must pass, if one of them fails or missing, it fails. + JwtRequirementAndList requires_all = 4; + + // The requirement is always satisfied even if JWT is missing or the JWT + // verification fails. A typical usage is: this filter is used to only verify + // JWTs and pass the verified JWT payloads to another filter, the other filter + // will make decision. In this mode, all JWTs will be verified. + google.protobuf.Empty allow_missing_or_failed = 5; + + // The requirement is satisfied if JWT is missing, but failed if JWT is + // presented but invalid. Similar to allow_missing_or_failed, this is used + // to only verify JWTs and pass the verified payload to another filter. The + // different is this mode will reject requests with invalid tokens. + google.protobuf.Empty allow_missing = 6; + + // [#next-major-version: consider removing or gating behind explicit opt-in] + // + // .. warning:: + // + // SECURITY WARNING: This mode does NOT verify JWT signatures. Any party + // can forge a JWT with arbitrary claims, and those claims will be extracted + // and forwarded as HTTP headers. Headers set by this mode are + // INDISTINGUISHABLE from headers set by fully validated JWTs unless the + // ``verification_status_header`` is checked by downstream filters + // (set to ``false`` by default on all extract-only requests). + // + // DO NOT use this mode if: + // - RBAC policies match on JWT-derived headers + // - ext_authz services trust JWT-derived headers + // - Backend services use JWT-derived headers for authorization + // - The JWT source is not cryptographically authenticated by other means + // + // Use only when signature verification is PROVABLY performed elsewhere + // in the request path (e.g., by an upstream mTLS-authenticated service). + // + ExtractOnlyWithoutValidation extract_only_without_validation = 7; + } +} + +// Configuration for extract-only mode without JWT signature validation. +// +// When this mode is active and a JWT is present in the request but fails +// signature verification, a verification status header is set on the request +// to signal to downstream filters (RBAC, ext_authz) that the JWT claims were +// NOT cryptographically verified. The header is not set when the JWT is valid +// or when no JWT is present. +// +message ExtractOnlyWithoutValidation { + // Name of the HTTP header set to "false" when a JWT is present but fails + // signature verification. The header is NOT set when: + // + // - The JWT is valid (verification succeeded), or + // - No JWT is present in the request. + // + // This means the header's presence is a meaningful signal to downstream + // filters: if set, the JWT was present but could not be verified, and any + // extracted claim headers should not be trusted for authorization. + // + // Downstream filters (RBAC, ext_authz) SHOULD check for the absence of this + // header (or its non-"false" value) before trusting JWT-derived claim headers + // for authorization decisions. + // + // Default (unset or empty): ``x-jwt-signature-verified``. + // + // Custom value: uses the specified header name. + // + // The header-setting behavior is guarded by the + // ``envoy.reloadable_features.jwt_authn_add_verification_status_header`` + // runtime flag (default on). If removal is needed downstream, use header + // mutation in a subsequent filter. + // + // Example: when a JWT is present in the request but fails signature + // verification, the request will carry: + // + // .. code-block:: yaml + // + // x-jwt-signature-verified: false + // + string verification_status_header = 1; +} + +// This message specifies a list of RequiredProvider. +// Their results are OR-ed; if any one of them passes, the result is passed +message JwtRequirementOrList { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirementOrList"; + + // Specify a list of JwtRequirement. + repeated JwtRequirement requirements = 1 [(validate.rules).repeated = {min_items: 2}]; +} + +// This message specifies a list of RequiredProvider. +// Their results are AND-ed; all of them must pass, if one of them fails or missing, it fails. +message JwtRequirementAndList { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.jwt_authn.v2alpha.JwtRequirementAndList"; + + // Specify a list of JwtRequirement. + repeated JwtRequirement requirements = 1 [(validate.rules).repeated = {min_items: 2}]; +} + +// This message specifies a Jwt requirement for a specific Route condition. +// Example 1: +// +// .. code-block:: yaml +// +// - match: +// prefix: /healthz +// +// In above example, "requires" field is empty for /healthz prefix match, +// it means that requests matching the path prefix don't require JWT authentication. +// +// Example 2: +// +// .. code-block:: yaml +// +// - match: +// prefix: / +// requires: { provider_name: provider-A } +// +// In above example, all requests matched the path prefix require jwt authentication +// from "provider-A". +message RequirementRule { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.jwt_authn.v2alpha.RequirementRule"; + + // The route matching parameter. Only when the match is satisfied, the "requires" field will + // apply. + // + // For example: following match will match all requests. + // + // .. code-block:: yaml + // + // match: + // prefix: / + // + config.route.v3.RouteMatch match = 1 [(validate.rules).message = {required: true}]; + + // Specify a Jwt requirement. + // If not specified, Jwt verification is disabled. + oneof requirement_type { + // Specify a Jwt requirement. Please see detail comment in message JwtRequirement. + JwtRequirement requires = 2; + + // Use requirement_name to specify a Jwt requirement. + // This requirement_name MUST be specified at the + // :ref:`requirement_map ` + // in ``JwtAuthentication``. + string requirement_name = 3 [(validate.rules).string = {min_len: 1}]; + } +} + +// This message specifies Jwt requirements based on stream_info.filterState. +// This FilterState should use ``Router::StringAccessor`` object to set a string value. +// Other HTTP filters can use it to specify Jwt requirements dynamically. +// +// Example: +// +// .. code-block:: yaml +// +// name: jwt_selector +// requires: +// issuer_1: +// provider_name: issuer1 +// issuer_2: +// provider_name: issuer2 +// +// If a filter set "jwt_selector" with "issuer_1" to FilterState for a request, +// jwt_authn filter will use JwtRequirement{"provider_name": "issuer1"} to verify. +message FilterStateRule { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.jwt_authn.v2alpha.FilterStateRule"; + + // The filter state name to retrieve the ``Router::StringAccessor`` object. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // A map of string keys to requirements. The string key is the string value + // in the FilterState with the name specified in the ``name`` field above. + map requires = 3; +} + +// This is the Envoy HTTP filter config for JWT authentication. +// +// For example: +// +// .. code-block:: yaml +// +// providers: +// provider1: +// issuer: issuer1 +// audiences: +// - audience1 +// - audience2 +// remote_jwks: +// http_uri: +// uri: https://example.com/.well-known/jwks.json +// cluster: example_jwks_cluster +// timeout: 1s +// provider2: +// issuer: issuer2 +// local_jwks: +// inline_string: jwks_string +// +// rules: +// # Not jwt verification is required for /health path +// - match: +// prefix: /health +// +// # Jwt verification for provider1 is required for path prefixed with "prefix" +// - match: +// prefix: /prefix +// requires: +// provider_name: provider1 +// +// # Jwt verification for either provider1 or provider2 is required for all other requests. +// - match: +// prefix: / +// requires: +// requires_any: +// requirements: +// - provider_name: provider1 +// - provider_name: provider2 +// +// [#next-free-field: 8] +message JwtAuthentication { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.jwt_authn.v2alpha.JwtAuthentication"; + + // Map of provider names to JwtProviders. + // + // .. code-block:: yaml + // + // providers: + // provider1: + // issuer: issuer1 + // audiences: + // - audience1 + // - audience2 + // remote_jwks: + // http_uri: + // uri: https://example.com/.well-known/jwks.json + // cluster: example_jwks_cluster + // timeout: 1s + // provider2: + // issuer: provider2 + // local_jwks: + // inline_string: jwks_string + // + map providers = 1; + + // Specifies requirements based on the route matches. The first matched requirement will be + // applied. If there are overlapped match conditions, please put the most specific match first. + // + // Examples + // + // .. code-block:: yaml + // + // rules: + // - match: + // prefix: /healthz + // - match: + // prefix: /baz + // requires: + // provider_name: provider1 + // - match: + // prefix: /foo + // requires: + // requires_any: + // requirements: + // - provider_name: provider1 + // - provider_name: provider2 + // - match: + // prefix: /bar + // requires: + // requires_all: + // requirements: + // - provider_name: provider1 + // - provider_name: provider2 + // + repeated RequirementRule rules = 2; + + // This message specifies Jwt requirements based on stream_info.filterState. + // Other HTTP filters can use it to specify Jwt requirements dynamically. + // The ``rules`` field above is checked first, if it could not find any matches, + // check this one. + FilterStateRule filter_state_rules = 3; + + // When set to true, bypass the `CORS preflight request + // `_ regardless of JWT + // requirements specified in the rules. + bool bypass_cors_preflight = 4; + + // A map of unique requirement_names to JwtRequirements. + // :ref:`requirement_name ` + // in ``PerRouteConfig`` uses this map to specify a JwtRequirement. + map requirement_map = 5; + + // A request failing the verification process will receive a 401 downstream with the failure response details + // in the body along with WWWAuthenticate header value set with "invalid token". If this value is set to true, + // the response details will be stripped and only a 401 response code will be returned. Default value is false + bool strip_failure_response = 6; + + // Optional additional prefix to use when emitting statistics. + string stat_prefix = 7; +} + +// Specify per-route config. +message PerRouteConfig { + oneof requirement_specifier { + option (validate.required) = true; + + // Disable Jwt Authentication for this route. + bool disabled = 1 [(validate.rules).bool = {const: true}]; + + // Use requirement_name to specify a JwtRequirement. + // This requirement_name MUST be specified at the + // :ref:`requirement_map ` + // in ``JwtAuthentication``. If no, the requests using this route will be rejected with 403. + string requirement_name = 2 [(validate.rules).string = {min_len: 1}]; + } +} + +// This message specifies a combination of header name and claim name. +message JwtClaimToHeader { + // Specifies a segment in a path for retrieving a claim from the JWT payload. + message PathSegment { + // The key to retrieve the value with in the enclosing JSON object. The key is matched in + // full, so it may itself contain dots. + string key = 1 [(validate.rules).string = {min_len: 1}]; + } + + // The HTTP header name to copy the claim to. + // The header name is sanitized from the request for every provider configured on the filter + // (including on paths that bypass JWT verification) and then replaced with the claim value when + // verification succeeds. + string header_name = 1 + [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // The name of the claim to copy, split on "." to address nested claims: ``sub`` selects the + // top-level ``sub`` claim, and ``nested.claim.key`` selects ``key`` inside ``claim`` inside + // ``nested``. + // + // Because the name is always split, a claim whose own name contains a dot -- a URL-namespaced + // claim such as ``http://example.org/parent_token`` -- is not addressable this way. Use + // :ref:`claim_path + // ` for + // those. + // + // Exactly one of ``claim_name`` and ``claim_path`` must be set. + string claim_name = 2; + + // The path to the claim to copy, given as an explicit list of segments. Each segment is matched + // in full against a key of the enclosing JSON object, so claim names containing dots are + // addressable. For the payload ``{"a.b": {"c.d": "x.y.z"}}``, the value ``x.y.z`` is selected + // by: + // + // .. code-block:: yaml + // + // claim_to_headers: + // - header_name: x-jwt-claim + // claim_path: + // - key: a.b + // - key: c.d + // + // and a URL-namespaced top-level claim by: + // + // .. code-block:: yaml + // + // claim_to_headers: + // - header_name: x-jwt-claim + // claim_path: + // - key: http://example.org/parent_token + // + // Exactly one of ``claim_name`` and ``claim_path`` must be set. + // + // [#comment: A ``min_items`` PGV rule cannot express this: a repeated field has no presence, so + // ``min_items: 1`` would make ``claim_path`` mandatory and reject every ``claim_name`` config.] + repeated PathSegment claim_path = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/4e9945ad5f8ebf9edf2a98ba2149b631047a678d5c4fe12813db6816a193d3dcde59704d7fa4112cc93cc0ae20a2cc8bb8d2d2bdf06c1b28bb4b625d1aaf075a b/modules/sync/envoyproxy/envoy/cas/4e9945ad5f8ebf9edf2a98ba2149b631047a678d5c4fe12813db6816a193d3dcde59704d7fa4112cc93cc0ae20a2cc8bb8d2d2bdf06c1b28bb4b625d1aaf075a new file mode 100644 index 00000000..490268b1 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/4e9945ad5f8ebf9edf2a98ba2149b631047a678d5c4fe12813db6816a193d3dcde59704d7fa4112cc93cc0ae20a2cc8bb8d2d2bdf06c1b28bb4b625d1aaf075a @@ -0,0 +1,717 @@ +shake256:a9c4ad5b20a2946a25d5efb7f096b32ffaa567e3e9a7d89984870104aab45f08d7f6f10c7c72affdc4aabab0471066958ae97c3bb5925b7cb268f8afde27ebbf LICENSE +shake256:7a9a5a3a62ffe3acb50d67d1b0806566f798ac145649c493bf156a2e5d927e264464f5d3add734c687acde39586cc032795e8ea07f51f5bb2493fd0423db10c3 bazel/cc_proto_descriptor_library/testdata/test-extension.proto +shake256:9e8bd1676e9fcea1d02e7cd0ce63f87e6c76b4b31467ec3df1f4a580da427488a764f9e48617a5be98d85057c648f46ec1925b05cae4346b207210327283dd11 bazel/cc_proto_descriptor_library/testdata/test.proto +shake256:76295fd73d7f33a987c1243e8821818b80bd8b04634fc9ccd10879ab3c1ade926e3ef847f11d8e07ccf8fcf011561d151a5d4926505d6494a23119614e049aa6 bazel/cc_proto_descriptor_library/testdata/test1.proto +shake256:fba6f71f372bd52e0a927375f9b97578d73158c4413f075f377bf7b406091e74e50d6365ca13531e1c80d1ac52cd1274ff6849c21a2ceab4a35ac17859746848 buf.md +shake256:f9abf7473dc3f95cc9ce2dabfabeedbf0f5fd808e1eb09ab07776ca3991ec073784ef8cb2f6df49a8293f1033141e29d687de39f506046b663b258728864f6b4 buf.yaml +shake256:7144b74045a5813f5f81b71eb11ca0ddac4105e3d20b51a146b634f7dc8c529de6fc84d2c4d3fb635eec48616f787eca10287f14ea10ec3d218e9562508be0ba contrib/envoy/extensions/compression/qatzip/compressor/v3alpha/qatzip.proto +shake256:ae38a03abf75ec63838de20438d1fdaf6ca49f6fcc9d701c4f918411027fcabfe08355fb24d7767074d9c440842bc86fd8788ad25e8c47e98782d6b5379f8b42 contrib/envoy/extensions/compression/qatzstd/compressor/v3alpha/qatzstd.proto +shake256:b7a48d5f96609de62c69948d9050b6fe41d81f476f7779a8d46c8d1d8595dbcead84d193fce745eb375f2fb5ba034633c76a4d1c4987627205f9b8b49bcd6104 contrib/envoy/extensions/config/v3alpha/kv_store_xds_delegate_config.proto +shake256:507a8d9386faae791f5ea7cc6b5de36e64384b327e1b9a1738a108783695f21d05108d9aa049668e7b5dca7575e7928229ac2728312523de96648a58949c940f contrib/envoy/extensions/filters/common/workload_discovery/v3/discovery.proto +shake256:a042cae93d024d6bcecdde67e0c856f445cb18ab4555c6f38eb17d049272b6216f1c566b58ee5eb42d649d1bb80e04f9b62fa3a9a6ba3d9c369980eca2214154 contrib/envoy/extensions/filters/common/workload_discovery/v3/extension.proto +shake256:8f8bbcdf0c20b8232d78637ccd2a8aca9ce03f25fb56a75fc83d1bdb8fdaae32d0fa7aad4a1d3b41d8a4f6f9564b4c036e396583710cc37e394cf55f5346fc36 contrib/envoy/extensions/filters/http/alpn/v3/alpn.proto +shake256:fa51c63f2698c8856558be8080bc5340c7d1d9fecfcec48a16e154c6fd7886703897da973a1d4e321bc8748043ec6a7fce2069fe45530f104b73f07b3325296c contrib/envoy/extensions/filters/http/checksum/v3alpha/checksum.proto +shake256:ad6bd157563e3d6423d240f65e9cd854d643ace1006edf4aad7929d9c6aac05b5f0ed5f380842f3086c217380f79276edfa969ac3e5e502d88fdcb42c6dd82fa contrib/envoy/extensions/filters/http/client_cert/v3alpha/client_cert.proto +shake256:ce179ee97700792b3af9c1cb5081b3e62de6f98743f93e6166f73db8e4eb06c9bfd95fc8eec110af02ce1650d12d3dcf8eb74fd0fa21d5653dcaa2c0b84f7fab contrib/envoy/extensions/filters/http/dynamo/v3/dynamo.proto +shake256:47d573dcc69241ec96ca579a48df33d669b3fd9d3de31066e51bfc0da5ff2c150c38269232e6e63fcf37c8716d72fec1e97c143a061791b15de2a9e4ddaea122 contrib/envoy/extensions/filters/http/golang/v3alpha/golang.proto +shake256:54c295690dbab13abb894fdfc00f7169088c828711f94e5c9980521d5e3d3eeabef5e15980148a4c2c2bc3dc77c044643375b2ce74cd0afc2dbd0cf448f01928 contrib/envoy/extensions/filters/http/istio_stats/v3/istio_stats.proto +shake256:c91ad7320770b1bbacf2ac9cfcb3b9ad4814290098d6b54131979be9acb38393595d69a2c89854e6248984cd3c12df7a9e69eeee4ef8cc1fcb814a91e770fa46 contrib/envoy/extensions/filters/http/language/v3alpha/language.proto +shake256:7c09a0ec365d6a776cf29ae4ba19c2c4a62acf19b785f418f22ffdaeb017d896faf7216ec5901a22acddd5d792ba0ddcd7376523ce79059ca756d8327fc854c0 contrib/envoy/extensions/filters/http/peak_ewma/v3alpha/peak_ewma.proto +shake256:9b39880a2a78eb66b8f933d3d50844d34f1da1e16e260b27600603e577af3e3ed8cd1cfc6144022215b2222f0b5fee7de94986e1f792df80205f2e1c70742817 contrib/envoy/extensions/filters/http/peer_metadata/v3/peer_metadata.proto +shake256:e46c4c2c153ea77879a711607b75b949303727fd9c3227897c112a4eab5572a68e0c1c7f3b281d842de83110bcb2c8450f0041d1ba54889992744ec913d42c6a contrib/envoy/extensions/filters/http/sxg/v3alpha/sxg.proto +shake256:6f83dfd604349538d13f6a172792fad7f9c9fc13a4a66134ad7b0b6a99b17be0552d9c770cacd46f2649dbc2c6808b95ae652f648e31d340279d1242ae80b895 contrib/envoy/extensions/filters/listener/postgres_inspector/v3alpha/postgres_inspector.proto +shake256:8cf720d1ee2c70bc75784a9e3d1af11106d1a52418ec13671346d4fde5bd552882b95adae8f35e774d5d34d70f5d6150a36d635e0df072de98eec0208bbf0ee8 contrib/envoy/extensions/filters/network/client_ssl_auth/v3/client_ssl_auth.proto +shake256:cb2005d9e1d460d9fb5b6e1d18c3fb0e6b08db1d9e3f20a2287ac91aabe486826b9d8fa0b674b0a075eeb660da61158d86ce0dce9952ea20c1d73e27b47452e6 contrib/envoy/extensions/filters/network/generic_proxy/codecs/kafka/v3/kafka.proto +shake256:b6678557d0f621ab70455895ce208de8c41b4f51ea1c4cd2a661bc4d72a241a39b39a0bdad5521130f1645c78b37cf68ef3f9b2339a66111b27fc3d89adade00 contrib/envoy/extensions/filters/network/golang/v3alpha/golang.proto +shake256:e1d0772c1e79f87f10446e70e445510cee7549c348789cbaa4b6e17ab6931aea85a6051f3d3c056472e6900e9b711063a01a70abcced4d271558e455f397df98 contrib/envoy/extensions/filters/network/kafka_broker/v3/kafka_broker.proto +shake256:3b5eaa38005e7284020fa83bf98b27dc6022bd88b014a2e03ceb284b5145bd3bbb455204f4b844c2d889a290e0e85c4f58b5c91f728fdff07826ecb4e90d1437 contrib/envoy/extensions/filters/network/kafka_mesh/v3alpha/kafka_mesh.proto +shake256:1b604a7ffa664974b105f56de7c80786e98478d8911ee50e1c24f0d8c75072d4dd09f8ca7a0c8104f7f57d94293065db9c960cd3618af09ff1aa2c37acd745f4 contrib/envoy/extensions/filters/network/metadata_exchange/v3/metadata_exchange.proto +shake256:d74fc2d2b6e5ef353ba218b7860368943977f3f3cc85d6e08773b9e472669d5c2a1fad8c6fc68b972ef0c33b94d72aa3e8c81e5412a57bfc2acfd842c79ea2be contrib/envoy/extensions/filters/network/mysql_proxy/v3/mysql_proxy.proto +shake256:3890183b72504fb727fa185bf393cebc2eda01972fab6adef56ea9231d7871e4f40fb015fda77888c7f1436485a3324d06dd29f8eb8bfd45c2e96d2fd8823bad contrib/envoy/extensions/filters/network/peer_metadata/v3/peer_metadata.proto +shake256:add12f026b68305a95ca38d27b99c60f2fbd064e6207da36607131627006bda245156eeeabfffd798f85829b81f9f97a749e8936af83702ca652415cb02c5d27 contrib/envoy/extensions/filters/network/postgres_proxy/v3alpha/postgres_proxy.proto +shake256:3f3e2331e55ceb14cd6f56a5add4364b134e731f7f925306998d8d8838f717ebb3f6efdf7c8905be7a7251e6c4038b90e1396bfd84db2d1dce2b22630321aae0 contrib/envoy/extensions/filters/network/rocketmq_proxy/v3/rocketmq_proxy.proto +shake256:f788b766d979ecdf38a9a23d447ec167d9c461bd4776e261a15a5062ebba61c31135066937d088999278481ed593bc7d662ac7ce64885b29e0e670211b938fad contrib/envoy/extensions/filters/network/rocketmq_proxy/v3/route.proto +shake256:726bb7baad0914a388e5094f559c289ffe68b86216453e24a0d477535f4b5248925c1706983b3867fac7fd9ae0eee2a8c2913c5252726812e4bd6fbc4b931c14 contrib/envoy/extensions/filters/network/sip_proxy/router/v3alpha/router.proto +shake256:814c9c9f84d6c9518d7b396be3c45c734f94be7f972e591e3b9ba081a63b9abee6569e32e183e5d03453f462551b69af7dc20461dc31e3e2bcc411be5d8fd8a8 contrib/envoy/extensions/filters/network/sip_proxy/tra/v3alpha/tra.proto +shake256:672f7c0aa8932a96a3a45f20e4f58bfa7aa418771393a8b844facae585b8b4d5d184c304fae94762a8acf54d6e724e20064e535b0ac0e8889e2a0c6d4cfe1660 contrib/envoy/extensions/filters/network/sip_proxy/v3alpha/route.proto +shake256:8ffcc12678ded759d7f71dbc576f4a865c9dfdf5cbde41d77e43694ff4158bd76cbdc04258284f289ca61d2a47941ed53ac8ae0bb71956c1d8098813bfb974a4 contrib/envoy/extensions/filters/network/sip_proxy/v3alpha/sip_proxy.proto +shake256:69807b25c10955f9925955a85ee043e724befa30d498745d5610572efbce5884cbead6c5205a5f4d54b4857a25a5853cdb84983a8e40458729251d87b2f3cd34 contrib/envoy/extensions/load_balancing_policies/peak_ewma/v3alpha/peak_ewma.proto +shake256:15c949253033d1f64fae17d8ffc0d53511fa6b0eabe3a45986b017594f32590c1c2b8945d0c74af543d3aec676a11ffd8788d469b18380c1d93e1d84c997f21f contrib/envoy/extensions/load_balancing_policies/per_worker_subset/v3alpha/per_worker_subset.proto +shake256:bdd1669fcd617d3bda7dc5641875d063e878e343a1535c177f17290637ae649d69960feed3b81bbb378ec04797be4bff4bb13265fd69681cac4b58c86bc88b61 contrib/envoy/extensions/matching/input_matchers/hyperscan/v3alpha/hyperscan.proto +shake256:75de73d5c5355f082e4d607078c0891ac2e1899e281718301e1a6d5a89bd2816304e1473d702c4634bb440d388b990d60cc48d21e8ce698e7de59c096463a201 contrib/envoy/extensions/private_key_providers/cryptomb/v3alpha/cryptomb.proto +shake256:ae74dc3f9e4c39da3cece4cd6fef65e2befdd352087667e7b8cac9f069acc4be8d82e8a4b19b3e0f6662a13d981d24b19135b21cc6b08775c4fd14138ca60185 contrib/envoy/extensions/private_key_providers/kae/v3alpha/kae.proto +shake256:444c37b67f885a3f631bb0dcb8140a07cc0f56503a8b4296bdc89638d06591aad6732f2c3bdae8c4891e44bb4c7cabb592821d95fc6c1477eea81e3b237e7ecd contrib/envoy/extensions/private_key_providers/qat/v3alpha/qat.proto +shake256:33e1082c3889f2641394dc2e7074c5ba5ce3126bdc9ba1060ed407ce7e1ae7d41fa5b3a75575286e681ec3851e0c368bde67cea84c0d6bb065b69722cba624b8 contrib/envoy/extensions/regex_engines/hyperscan/v3alpha/hyperscan.proto +shake256:0a3f8fc79164864e519f1840ba8455491910c39b6afad749adb8aae753090f82952d30b6003ad61b0d1c960bb982b3906189e1f98a7efd63975026643b07c6d8 contrib/envoy/extensions/reverse_tunnel_reporters/v3alpha/clients/grpc_client/grpc_client.proto +shake256:de126f26a091d6af4440d921b6a3a17d53608fcf2252aa67fe666fc4bcd9f35d980e29cba4fc1ea00b9d4ce79d8070a38c8f3ee33fced84711826f24ba9d4fc5 contrib/envoy/extensions/reverse_tunnel_reporters/v3alpha/clients/grpc_client/stream_reverse_tunnels.proto +shake256:bd8a77ad07cb81378caff3ffafde08afcb4554f09762d2afaab985b156feda51b3b62f82607c69039422f03a901abddad4361c029e2eda4bcedd85f6f2098cef contrib/envoy/extensions/reverse_tunnel_reporters/v3alpha/reporters/event_reporter.proto +shake256:9825c2f88055cd25c52078a6c508fe77bad594cabb2da12253b4c71057ba330f441300dc8db264a18ab8abd2d324e2fce1089918903ecefacc1bf49c4219c74a contrib/envoy/extensions/router/cluster_specifier/golang/v3alpha/golang.proto +shake256:9426a91c7672867a3f924ff2f4c9a4dba9c12ec763e234c2753c17d568332668eb19ab507f6bf2fca15d07d239e8097907246a216b74cee66ebe9dba66840e51 contrib/envoy/extensions/stat_sinks/kafka/v3/kafka_stats_sink.proto +shake256:61e28a793bfedd8bbcfed42c001fffb76f0aa35fd7fd61c0e0e5e177c29ecd26847670a4d41ff43771eecc4aaca15e4c80a8613ddb7307f1f7bc1391c3348940 contrib/envoy/extensions/stat_sinks/wasm_filter/v3/wasm_filter.proto +shake256:cc70776633491456a381ae3d23406d5099ca7f1f76e2d50dd2febfd8eff9146d38b60fdb44ef8e42a1a2e054264cfdef847875db46cc09afec3c9ed886bfe31b contrib/envoy/extensions/tap_sinks/udp_sink/v3alpha/udp_sink.proto +shake256:fa5971bfc9d3068cbec7922a2442669502e1085efddbdaf11e2e94924f3693687928380f73d0e49ce95bf13596f3affe99e8794631e7975e51755b31fca26b42 contrib/envoy/extensions/upstreams/http/tcp/golang/v3alpha/golang.proto +shake256:80887a746d8294ce4f4dcd0467ee6fe7b157da9555360459146587cf1f3166560d586c1650e274ce9449d5fceeeee3df9a6a096e100b04cd45394841dba6cc26 contrib/envoy/extensions/vcl/v3alpha/vcl_socket_interface.proto +shake256:4d73b76b955d3478a5f466d844271d6c7b4b453b62f013c24eb7881b03f547d063158a3cf522c37d480ab561ce43060115c75ebe5ff70b193c2d4dd1d3bff60f envoy/admin/v2alpha/certs.proto +shake256:392009644dca0f075cd5dc284bacc4d5a6dc0e9254998b32cb58f6773316f608696de51c8c825c8a5f1f4c42b2cececab719f23d8e33fcf20702d652e4db68fc envoy/admin/v2alpha/clusters.proto +shake256:e4db3591f411e0073c4d281b2573e88576c5f9de4b544efb50bb342b54e7e1acc4fa6585401f2629fbf6def9d6d1d92d499994ff1e2f5dd217ecb0a227c292fc envoy/admin/v2alpha/config_dump.proto +shake256:4f2bce6af0bbc8be1cdece55535545e089ead78542386e3c8296cb92280f7609f52854a8271121b19d5b42e39c51c84d2a77f63e27e9bc5f16733e2328cb53d2 envoy/admin/v2alpha/listeners.proto +shake256:babcaf94ee63ef61c6e8a78b5cec1478bef04363192b5279554ca60f4de7850f43864bfd2131e25b133d6f4e39d1223307126baf092edae54524cf64eec4c139 envoy/admin/v2alpha/memory.proto +shake256:a34da07ab2e4a8bd9209a1399e188eac2be481978cc552ced7c6c5bd2de0ca3ca3dd8f324af7b69888381f0522fa4ea23caf5b997dc6afef44e88687472a88a4 envoy/admin/v2alpha/metrics.proto +shake256:572464b7bb7321d388f6e6bbecd73ec0fdee640812cd58a975615ccb561fb63e384945ee6bcfec2c5428bd98e08562f9cfd48f3fafcc362c8c1ffef50e54dfd7 envoy/admin/v2alpha/mutex_stats.proto +shake256:47d3268ce2101d2c203883255d72b5bc2fda272a1fb0e99dbd44ce214d8ea2f771ccb29809e617dd8fcabe3fe0e5f78c1d8780462ffb8f022f7bce3a37a6be7d envoy/admin/v2alpha/server_info.proto +shake256:7b13e01379b3accf542fc1b635e9773f704929127eca82c3d631bd91d71cb4dc6970a66e9777f93f694ef52f46121c78c40f701e25659f56eed0ea13b8a98ef8 envoy/admin/v2alpha/tap.proto +shake256:b0fc6c0c38c61ab85eddc6842483bafaf3442db13de31ab87de2d8287e8737f3cb2c7c7a24d07bc44d5cbfb9094b7140ef69c83a0285ba6dbed3f5c301e6b082 envoy/admin/v3/certs.proto +shake256:0fd5a070d195ea94ff5cbfb328288eefa0b9e791d3e4859629463331addefc941b5876b7bfc746be38419a5fa8c7aaed665d2e26824e9017c48d295f1a1b0350 envoy/admin/v3/clusters.proto +shake256:b74573ab490303f5a6d136e1c0c1b8ac1f9a617bebc73db2d44750f0ca4fd4389c58d1fded5624b38a021fb65c48192326a71209468c1cba243ec4b52d2a176d envoy/admin/v3/config_dump.proto +shake256:e5c3e7849f8aab45cf872016d0b6f6288e7d1694fe103e3b0f64e74a7444dec99b7f296e59cbfe28373c351b0404b7c865e1281b175c19434c5b84f3d4225d03 envoy/admin/v3/config_dump_shared.proto +shake256:e72b3a5de25f5c898cbfe5fc83fef8dd66c03bcb396c52fd2edab6870a3b6cf3b696f66591fd3cbd6f7d28cd23e71d49786756a8ddcb6ae42144fb36077132af envoy/admin/v3/init_dump.proto +shake256:6570272d2d533e5eb9d66f2f9cda21c84aae72a753b497192014ceb2cc77f7a3698e9b52488303c04b0ed6e6c653c49912a55781d873b4113f8a66eadd87655c envoy/admin/v3/listeners.proto +shake256:3b5d20207b95fb25ba7b567fd93e7799aaed33eab2da87ba1bb54febb0a8d657f3b5dcd09032adf1e7ff846fde53cef6deac8eb166a424dd9bead7069d4f53ba envoy/admin/v3/memory.proto +shake256:1fbd58b26fc343916e3a95e7c8bbcd18be83aa4100f0cbb1171556685079dd0c7d6d705bba862d77dbdcf960e9be17cad3e5cb0a5994e9ba9b88b541a9d66411 envoy/admin/v3/metrics.proto +shake256:e492a9f4579ddc0ad028b42e50c646fbca0fbd68d1bfcf621c04ec1cd1ba30bd7b0f0e8f24d6e7e6179d328ceccfd82cfeee61fb4bc91f4f6aec79a605fa4d40 envoy/admin/v3/mutex_stats.proto +shake256:dc6f7ace607947a0df1e52d21918c94d74cc7d8e73d70e0bd252809ed4a30e863758885a12bef4b8da54fda8fe6e830e15a05feae849cd9f3786f44af3f89230 envoy/admin/v3/server_info.proto +shake256:6a478eb836b32fa6eb4912a3cc311d3e54b267e7a628426efc49cb81959b0b5215ed46deacd0233d4aeaab32a303ca5309fcd030012bfedde2de782fc0787310 envoy/admin/v3/tap.proto +shake256:3adb067791805262a0ab31825adf5239b87c95c057cf3b4dffa4a7a8debf5ed4a53e239ed3108da8981c69fe795b1cde14a02c133f410dd0f886e71f6479319a envoy/annotations/deprecation.proto +shake256:f2de7186256f2d6d35bc5e77e5a2060e3be9256970d9415cfa01bd9d0a063f98e2a7bb47bf7b03706d9d466062aa2faca4ea91f45fc93f995340d497bc9d7186 envoy/annotations/resource.proto +shake256:6bcd4872bc82d5ea2fbb17106cdba7772b0b241931a935266ce04e980804700b5b0ea06ac0156f60645830a6ab234bdfc46a37f51bb49a18afdc6bdc984563c5 envoy/api/v2/auth/cert.proto +shake256:4ee13ab3002ccc1c7a6143d26373585edcef9829006e3f6daf46f4e1aacffce7eb83d4c61f5464a62f021eb73126e855650aac16b222b0e0ea8f3d7700ce07b7 envoy/api/v2/auth/common.proto +shake256:fc23072cb4fe3305d96f0d2906e00ef441ca4168ebdb5e03ae90ff55de2c7f8e597049853e149378f283b87d20270e29b91205729bc4400ac8981fd9a00be0d4 envoy/api/v2/auth/secret.proto +shake256:be1ae530ce5457cf99390111b1c49a4eb22ec4c88a926c88aba17f798283648c5b8c0c19b50e82fc38ab4b86b68b2c7880ceddf200218e8e37e27f66a7825742 envoy/api/v2/auth/tls.proto +shake256:15394420cc45218d6f94c6d4d374afbfaee234bb34f5347c9e24f53351ae1d9702b2e6ee54e212c690065f5ba41e7bec67c797f9f67f66bd73a52646761ac7e4 envoy/api/v2/cds.proto +shake256:8ef3d1a78d916b9aa11b7d1ebd91dc3b8ae11e1c8e0394ace665b30f5af424efa0857fc017ffbfab8180aeda10f374129e77c0649d13897bb3550d803b904a3a envoy/api/v2/cluster.proto +shake256:dcf8ada507f8f3d3bc8e2d27b16ccce79ee4cea169bc664b7a16412816429e4833dc7cfc0c1f9cb93da2857135d9ae785ae595ec16eb2656670d3023e1976962 envoy/api/v2/cluster/circuit_breaker.proto +shake256:c42724147597e47e16d67d23c262164c30794cfb11008029b88608165ef6c28f193f3be64b16024ea38e55b684bf67fb7d1d48b57399669b85cb3be0f4c8dcaf envoy/api/v2/cluster/filter.proto +shake256:641cf1b144e9467ff3a518dcff9303974f5ffd7320833992eb1040b670492055bf51d07c3f94ad4108419964b19a320d4d17f498094df3476f0556026e729933 envoy/api/v2/cluster/outlier_detection.proto +shake256:94d83f6ef94961e92bb3c07c3cf513e755e03408f15ee290af3047f7fcd79a7a3eab72cf2cbab525312a4d58efa3d6e6510014f2df2b79762767b45a491c373c envoy/api/v2/core/address.proto +shake256:23237102de7fddb83c181d3b7bfa7d34e693bb9b414f2ac87bdde48a4ad1bd6d8fda9c26cab0e13869d1f0285f725b1d1f978ad63e310f1bd81bb110315b9e24 envoy/api/v2/core/backoff.proto +shake256:13cf2aac8defd6070f70fcd106137a8fb8cb8bf27ac53fc76c876b0dfc098faeaaa90c87fc31aa9c22ca16e576764f7bc4f6e6bb15264310ea266b3fc577d7f3 envoy/api/v2/core/base.proto +shake256:58c4a77b91b41262c7c5db6d9883ba32b83955cc7490c326a7393bc2716646af68282476e0ff4605541d9cf6049a6a9ed4bd124c45e3dc12089c4346d86b3be0 envoy/api/v2/core/config_source.proto +shake256:6a143f29c2c8a492b4d04bc5ab6258c80c2aef067cd0382050a6813c950ddc47c5ec763f6b797398c6a2c03be3bfba65b127be9ffcf5f07d3b6e9631c74fc2b8 envoy/api/v2/core/event_service_config.proto +shake256:488b4d588a48823ff76c9be096afec4ca1573a0fae135436a7b691494d6153759f08ba1abf8b108949b1d1b9225cf6ed4fc934bc3ee03ea0546f0e97d3732b9e envoy/api/v2/core/grpc_method_list.proto +shake256:7b95620b8d3fb3c0b67d8bc400d7d1c61492f2ce4807f75ab5f77086925eeae9b3bc1275c8568b2bef90cfb386466168be40f3f67e613cd307007a372e8fce3f envoy/api/v2/core/grpc_service.proto +shake256:8f651da5a7966d944fb75b1d3a2c245101cb3cdc4883d2d5ba9a54440a6daf5986f92460c5e8f3f439198131246891093ad1aac6f9d70a32d8ffec3834fc030e envoy/api/v2/core/health_check.proto +shake256:662c11e025424aa76f09f82c7f4f374398d62c59b823f2ef865492b54e0560edfc04b989c8e050f0b2e62d7bd764aea4374859a4fbf97f20d6adb50563c4dcf0 envoy/api/v2/core/http_uri.proto +shake256:9c4b1b16e8883e5a4ab925b8da52d27e5ae1891b5391c9416c01e8ea172a34a9786000c15d3728f031f548101d9f2c4cce42fccbfe603c7189a9504de48e0ae0 envoy/api/v2/core/protocol.proto +shake256:4183d9068d64aacc842a36e6ea35f750e7f08118e1b9a8bb9da1aeade8d4a462dc024b226489f5918511261d4e023a5e7676c05a4b91624dab490df30cb6b1c3 envoy/api/v2/core/socket_option.proto +shake256:87a9f435ecb6daab09bdd9d1615fc8883c3b1951b9dc35e5ac2421e68c749893cd1bdd266bcfb21b816e6518c09e623bd08c3a0d519129c85686fb3e7de92928 envoy/api/v2/discovery.proto +shake256:119c145cf6a5e4e18331364889c9ce3ad897293b9b5a79a0480d566f44338a6781ae5801df1f9e9675c78d6ff4ed1eb91e7f61e7dc3e075855a2ec1b6c6bc024 envoy/api/v2/eds.proto +shake256:09e85cf3be7bb8b48dedcc2f0be2729ffa3e4f8bf3a62477adaa8bbfb096b6bc54ceb3a214f0367bd1e629d27db07b389fc2051b3bc106438f1ac37f5ad8b824 envoy/api/v2/endpoint.proto +shake256:d34472c35bbf374d27edc187d7a9748623b9f315d98ceda6c98a3efd883e8d643711dba2e7def8159a04ea8d32a70a84caa1bc4701a19ac7ef412ff6c74ed474 envoy/api/v2/endpoint/endpoint.proto +shake256:41d9f97e89161ba8aa2a398c753b6692bed579d1abec9df50782c120410a8ccb1d382e70729486028036d5fb81aecf784a5f87a03335790b9a6843f2ea8b3fc8 envoy/api/v2/endpoint/endpoint_components.proto +shake256:b47b6d2db7d09e3059247b3620abd6dfa60be9ed18f53336f5cd0f692a8d5dc98393b20f64461bf440bd3d6dbc92794104e6c56c6021599e31b91b60ef6a66c6 envoy/api/v2/endpoint/load_report.proto +shake256:639c987ea02b03f1c4329299df8fcace9c807fcff8e1fe2c651f1f8110bb39d401c9fae511abc9e8b0c08c2c00eaf7ac6116d64fc428cb72fd116064a012b01b envoy/api/v2/lds.proto +shake256:20dcee2d61c25ab8f6ca81f5dcc45c32bfe28821c419f91a1a013a9afd0a5d2a665afadac356922af4f6fc1807ca89f75ec84703ff04ccb30c5a7479f57debd6 envoy/api/v2/listener.proto +shake256:3660a7db469f0a78a086f2c9a3ea6417ee67fad8d8f66f6df255c096780b2f9fac4058f69fafb7b31bb41371be08d49df8e4dd7cbaab57dc81faa072a0b2d961 envoy/api/v2/listener/listener.proto +shake256:01ed343576226520f26c740fd0ff17db2c90a3b40ceb767b5dac115a5ddc45da4fe8bbba5bc07cb5a5b1b1c2c4ad1b9e8bc9f9d789faa245c4b689b4ad31efa1 envoy/api/v2/listener/listener_components.proto +shake256:9eba07e2c57d6721e5c21bd25db39e433e6beb2690f19cc35e491b6ee398a21c602cc66f5c4998bc671c6c60935def6e9fdb78263ebf619a5ad9c5cd0040bf08 envoy/api/v2/listener/quic_config.proto +shake256:bce97795ccfd54cb5517de97a66f625d6358e490738a83016ad6fc352258bd265962bb5cf02c9c53e40130ef02aa0271c766682588b3bbc53c518da9ccac6d88 envoy/api/v2/listener/udp_listener_config.proto +shake256:c4f13154764837590c09419febc8778291e5de10cdca3b4acc72cda616a6e1f542e0ac7183aac0f37348c9761ac3a506fbe657432daba38469e9c6d7d9237b37 envoy/api/v2/ratelimit/ratelimit.proto +shake256:5109fdb17b9347ab1483afac5e638422b3164935fe79f691a8f371adc240c60430a85caf88385588957e3c07d1855bdc0ebb391940b6d5201e1bd3a0c9f28434 envoy/api/v2/rds.proto +shake256:0eefdba40313bb46ee9d204281aa7bebbd8e21329ebb752dbf82d29e0213e8d76d0139a50221d34977d8fcd3bda842cdbb160b55f33969256e5ecb5c59232c09 envoy/api/v2/route.proto +shake256:6b3fe64c7dce23224bed799cdb5162b71f9152b4020e9a002decddc9f8c366c58e21b3c03d681c643c79e78e8945fab211564ffeea0a16e5d8509b7d3d66a8bc envoy/api/v2/route/route.proto +shake256:f236b4f96272bdd8ba4cf24cf02938cb51d915589dea4bcc7a03923361f616bfc4c5ed05d63e5437f8da95a8d423c391d61907e862f445b3f23b7bec07d8ad9b envoy/api/v2/route/route_components.proto +shake256:bc9898fe8b4765b8bfc498d32721a1ed0209a5420d351825522e73c0dcdc915768c5d88eb3b25dfadb6168bbf9d2cf233620950c32f38bddc382527cefa5c259 envoy/api/v2/scoped_route.proto +shake256:6f247444f93f26c93eacb2890b7b831944c5187ebae43414dbe1455abc2b49a7f0f2d965d787b5db9a6ba585d1865add9c35b4ece5fdeeaf08bab78752d17b6e envoy/api/v2/srds.proto +shake256:11e4ff5a2c6dcb48b7d58a3d37bf0ee7cf0c9725684d856f0a0a56c7d6ad07d67478f8f8b3afce1f5634c3f18ba5497f44d902cf931e1a5d01dd78b639336889 envoy/config/accesslog/v2/als.proto +shake256:f00cdaf3138ffede9241f899df44d894016dc547bba274e945eca8d923f158d848ef208fe3271b639ef4858f8e7141ec86461af7a35259fe265fd76d9aad29bb envoy/config/accesslog/v2/file.proto +shake256:f6879fdc241bb8413bd7a7d7a11ebd2605f85f399e70444bd392d8040ed29e6d7599caa614e64bfa6c37c940606f7688b74628cf43a026a0d64b46e937b02976 envoy/config/accesslog/v3/accesslog.proto +shake256:f17fed4317d85246c5b637ab098c1ec900898a4f1a6de66bf20cc4916d91b19fbfe94b3b8008aff5898f561affb1bf7bfb244a1cc8984928c2f246ffd7b91f63 envoy/config/bootstrap/v2/bootstrap.proto +shake256:24dc50c4d6a191e16a5900c34cddb4d7d0409709c5b8a717da9b9eff7451365435e0b56da197dd084f4411d0460f7365bc255d0e622da1c6274e80a7e1de8126 envoy/config/bootstrap/v3/bootstrap.proto +shake256:ef15d2b7031d8edb952315f6f4dd986f1ca0137662cbf58466fc1ae58d9daaa396a6f79be8da1c5de511dc7620c29dec56ec4a1ca9ef29c1dc24de71da2e40e0 envoy/config/cluster/aggregate/v2alpha/cluster.proto +shake256:e96c45cc69cf74ea9fa9ce48596722f01c84f8164b2c8b213a1c901973d70cd9f88a797b22b83423bd548efa3452793495f5f730f2d6c79a3cc4de88f1e23013 envoy/config/cluster/dynamic_forward_proxy/v2alpha/cluster.proto +shake256:f88d1d71037a70c72f39863a5a9ec8d65ded375d725b7e416d36ec233adcd670e010a8b024c755835c16899a8e4c1d00ee24eacc7bc51c778296d6c5fff1fc8a envoy/config/cluster/redis/redis_cluster.proto +shake256:e4794b2ebf537fcfde40dbcaad11e36438e6bd2795f18912a18a2241b8d3ec75817ff19534b462dee128fb132f0b6a28b0cfce6d00c2cdd246c16e36d083acff envoy/config/cluster/v3/circuit_breaker.proto +shake256:37da7ed59f40a587cafd0726db8a894ff61a65bf604e2473b134eb33acec205c57602232ef3fd8e566ca031ee4decf0cc056d96d895ee992f7d77c154c747892 envoy/config/cluster/v3/cluster.proto +shake256:b3be2cbe299480ca14f70ab1684fec6d05045dcea3359785a5c9651036aa8c216b927a23d6107b5c1fd86b6e5bcbb204366562bc7356bb634584ddead1bc2ec0 envoy/config/cluster/v3/filter.proto +shake256:e2ceaae01a83ed14091fbeef727ef4f95253a27971e4aa64b3da4086d854a983655d391ce065997cb6f7acb341fbc3c0ae57b9b1be812ce632b9a626b5534e14 envoy/config/cluster/v3/outlier_detection.proto +shake256:238687121388f8ec3ca6be644812aa45483557f65c5a22f97868ac71fafb3b6770a8256bc28b1f56286d959e8316227035b2606e58aa4b0fae141181f665d4f6 envoy/config/common/dynamic_forward_proxy/v2alpha/dns_cache.proto +shake256:14212536f4874aa3d72398818186611af78b88cd84497439e90174013822a27b0cbd476f0dba6d18be520d6e0969e8a2649530dc89313fdcce7272cb7317a51d envoy/config/common/key_value/v3/config.proto +shake256:36d0af392c209533e79a725e8e1999e141deed82a1769728a96465761fd5346382719b47765b4be6753777f80b1f93b214c6eb8a501d9e7431753ad8b993f136 envoy/config/common/matcher/v3/matcher.proto +shake256:175d2f7896be8a9a86b2eecf8cab4cf5c8e5c5361842335f8c607f3a1ce908a57419a79822d110b334254694bc67e6bd67dfcf0ef08de910b898a8a617eadd4f envoy/config/common/mutation_rules/v3/mutation_rules.proto +shake256:cbad07f379e55edc8e8cbefff8799dee2698ef277b0f8d68d8e4a040cccfc877d2bcd19ca008021ebbc796148d0e7bc01a5f8b6fd1a5dede10e1b1b2672f202c envoy/config/common/tap/v2alpha/common.proto +shake256:dc3026fe73281be8f49653a477fd117922659cc75d2387f07dcebb4e9e79962ed2cfe12a779fcce4f341ed114c04964d6f6512a4168dab457bba08a44d1127b9 envoy/config/core/v3/address.proto +shake256:fdb34f03c4ddb608eaddf33afadc37719a5844bc0f2b0a3d46acdd3a47e03766e7b0021067c67f2f0f1f55e651e0c7000b9e4d2c44aacef35c0f71b016416750 envoy/config/core/v3/backoff.proto +shake256:40fbed94190d48e57183cbfad8be7c2ad62220cf3832469320a5fd8452899f084db63ef0da48859d0c2a69aabe2cf7e9b41782d855e66f74c814cbd87c5f38a1 envoy/config/core/v3/base.proto +shake256:f31af87cde6202d9e68ca042f27da6dba4d65bdeb94065ce789d59f85dda5eaddc12d4060979422f571ed9dcc382ad1d83d018238ca8b810ff91eeace4dc8123 envoy/config/core/v3/cel.proto +shake256:08a48e484d19ccab2d4169ce5191e666f0eb3cf37656ea19c22e94a1c4764d7928df1ff4f530f2ef7aacfbe26d40234c1f4ba8ff38d9166f683a9af6c5656af1 envoy/config/core/v3/config_source.proto +shake256:58094a58339d6781d0d06e48e32ce262aaf8f79448b624a9ac2792248efbd1217c6606c493ec80226069b95efd89e9fa25357a8e76afe0775ddecd40f0ad7d78 envoy/config/core/v3/event_service_config.proto +shake256:fe914c4817a48cf5e7ca7d9cabd28f99eee574396cc29419ca282b75a126126fc4a9c417fe5f702082500b0d9032586a4c7b50f4810ce34c2c1dacef2ab48663 envoy/config/core/v3/extension.proto +shake256:b8c9d6866b3e14f1e41ea50d6977325cf48575bd3a815cc36077ec0f631a69882b3d168c7ae39717b93102a3f3285dadee6d1e0c4aeb461399ea649abf8384b9 envoy/config/core/v3/grpc_method_list.proto +shake256:ce8ca31393368bbd835e656a59ab152cfb4adccc0aae45660c8faa6b27a26ea45bd38647acce9aa7fd5262919c20243a962cfc2e691ebcda0c631a03688fe76d envoy/config/core/v3/grpc_service.proto +shake256:cda524b2a1908462490b81541b602147412724271fcf51e250dd525866ff0365cf20a893d6b4aa94b32843764f574e93cfa05b1e1ff823a6c5270d3446a195ba envoy/config/core/v3/health_check.proto +shake256:e1b7f14cc3da4e6edf1e2f32c17681bbb5c2e410e2efe43cb54292ec2b931edbd15d80971d18feeb20e4a825462bed9df9263575cd6af77a2e257cd1cda0b352 envoy/config/core/v3/http_service.proto +shake256:ee0b0b1aeb239c4327f288f4b00507172a97cfcf5449c12d9abe4ee71a07534c6f80578568b0a445a6818604a3cb44e3cf640f66dee9fb212dff8e31de9f3309 envoy/config/core/v3/http_uri.proto +shake256:d4d225758e4e0bf5fabd550a978db6cf54a2f5c5ad071c377a0ed1e1ac45a79a7defe791ebc852d090e9feca7ffe1913a63b263b8e3b30ae370559627fd51462 envoy/config/core/v3/protocol.proto +shake256:0a7f86f42952f99273f528aed03accb6581d2034c07e9e6729bb66c4f493df1610e8ea25c8f2162cc9d9c765b8e2b0f6866a453c5b53ac0191f434acbc8b91ff envoy/config/core/v3/proxy_protocol.proto +shake256:8dc2e42d6be6f5e608487cc7a5cfd89670edc9a21be4ece3bbff666939f36a2ec7d18283cfa43007557e10e59a603e9844d8e76ce528e51e5d7b79fbfdd041b5 envoy/config/core/v3/resolver.proto +shake256:600c407b3baecc7213d993c5b2c76748c396b7c197de79b94e12427201633d5c5e900dcf1fb3de264dd4ae90c615c8c01194f43d690381f2c79d7604acefc098 envoy/config/core/v3/socket_cmsg_headers.proto +shake256:05ce4c7eb1355fc400087a7acf217c6ef32180d7dc39aac2da5580cc99befb82ddc648a08296153ed4b05a3ab28e8233afd2c3ba61bbd978550640235c61fb3a envoy/config/core/v3/socket_option.proto +shake256:e7b2aa046c34262556a5d6bafe6de68e303abc33b1bedb53514c3aef61660502bc60baf30d1014820e8f735de65efb7fc2af55feedf2062cee2255e1c7f9f325 envoy/config/core/v3/substitution_format_string.proto +shake256:ca4da0953d0209d8c791e9d9eb1910c2d2e577a467348e4986a8c3c341db38e52516a7bf6dc4815ea0e8d1ba7566e314e50c89f3d33ee217b19335939b1142d1 envoy/config/core/v3/udp_socket_config.proto +shake256:f21f75567e86558fb38afe39c448339f1a5363d8add311ce8117e6d4ae8cb8c0eb37c8116636004203da6420eb226ee8b142e9306441cce1be69a0475febaa53 envoy/config/endpoint/v3/endpoint.proto +shake256:3cd151cf7e10fa2af3d6e7eb3f71df6d937702975ddece19c5f28e2786fbb355dce33ec25bf3f6f4f7c373f99a41f784ca682a9d6fa1860cea0febc64e916a89 envoy/config/endpoint/v3/endpoint_components.proto +shake256:37544485154fc1be701779188515c219db0415ee12110f40fd75e51cf5ac61275914ac75f9c349c711215d45c2a1a525cd589738d1f2d119aa56ee3aec2a234a envoy/config/endpoint/v3/load_report.proto +shake256:2d64307e37f83d7f3d7d7702252ae62811016f56644599787a12e0d59c2a414e6454f8518fad20079a195415d543f1c8532615056f5d1aa58f39d38d0713c509 envoy/config/filter/accesslog/v2/accesslog.proto +shake256:2e04814e594b2f7b966528e191ec9c9d7eee8b81ee070f8f1ce057829aca88bb877666a67534989dd0fc653c86109caf2113d38b5276a9a4ec710e30b303c37e envoy/config/filter/dubbo/router/v2alpha1/router.proto +shake256:cb4a510b6cc2d26c941134827154e1d4f9142add0d92470d7de710bbbf26dfe696eba02d256d97e93c874a4eb3f8ea4215cc1f99a4b478085d044dc27f8f6faa envoy/config/filter/fault/v2/fault.proto +shake256:870cdd98267a9028f41edcbaf811fa8ffa62cf8a09f06386769c7dd46b9e43c7496184fc551ee23dd43e3c37bb87405d599634a0096053d90a5eadbab9c0ef15 envoy/config/filter/http/adaptive_concurrency/v2alpha/adaptive_concurrency.proto +shake256:307f7ba037584aa60c116ab81bdebfc57f955fe2aeab90f71ad08afda92d14cc5ec93bc180e5e026ffb1372f42c9ab610d1238dbd0aba4e0a7fa13b588834a61 envoy/config/filter/http/aws_lambda/v2alpha/aws_lambda.proto +shake256:7837e63e24ef6969166ad19d00d825827ab4f33cd2cdc1d314cdf307130aa4f99642be1490b27f395aa030de57e0620e50436fb4b2915238a943134fdf1e0a03 envoy/config/filter/http/aws_request_signing/v2alpha/aws_request_signing.proto +shake256:993900853d6c5b14b2778802dab83b56056d0a8862cc00fb7ae981f249f037aaae42ec53eeb447275152a83a9825a562c2dacc8391b9550e260f651155e0c700 envoy/config/filter/http/buffer/v2/buffer.proto +shake256:e17bffb8959f0ebd69a5f76aa1fecc5c149a52c8883315499788cd3832aad4a9ab4028aab401d10cd12a54c618ee48e1865a8b7dadf9b174545bda38ade11fd8 envoy/config/filter/http/cache/v2alpha/cache.proto +shake256:366ce40fc1609240c011e89743df49698f53243e673279cfe6df1a3fb5011ec1681a7153670b5a03b401718f26686bf96000094f7c0360e3284754440749c517 envoy/config/filter/http/compressor/v2/compressor.proto +shake256:7edf20c50b174033cef65e0b7546ea572a3f5306bd0106fd30eacc18a82efce49ad9d30f6c39577f36b97b373b281c4048cef86d5ea4bba5075fd2b29c8e1cb0 envoy/config/filter/http/cors/v2/cors.proto +shake256:bb31e2ef037ee26af526662fce06b264b2e166f742ec9f32bf113dba81df5e2a76f033db03d23df77f4417593994502508fcd2512f1dd95928b84969a3ce802d envoy/config/filter/http/csrf/v2/csrf.proto +shake256:1d9282eae617b10bf59dcb7633be402cb61cbbac9285c9e5677218f48bba048a73f459d28ec8b2b7384de99a8281f61fb58c4227dc250b97363860cdd168044e envoy/config/filter/http/dynamic_forward_proxy/v2alpha/dynamic_forward_proxy.proto +shake256:76db280e6229da9e4ae842fc296ba18cd72a9e803c045380a7353ee6f765cb69f4c129b559c22ffe920c7f2437f0404a61ec0108681051b0321fba07f894dbe1 envoy/config/filter/http/dynamo/v2/dynamo.proto +shake256:597e702de8f7a40d1fd9744bacce3076dec835378127af4c19e336e480332c0f27da7e4d5b76ae77f160bc3b5088d54e71e5e65016c97735b1c2eecb511d62df envoy/config/filter/http/ext_authz/v2/ext_authz.proto +shake256:d1b6d7c97efce1de7fccb2ba0472bdf62a20f4d0a716450549b03a3dbf405c4a1592385d7195b629ba43336a6649161e832933f3df2fc193aca16cb06d6b60e2 envoy/config/filter/http/fault/v2/fault.proto +shake256:050055233ed4396d983d99b84e8f6a5c3b0d77c80f7607ab28848156b18e268b57419282cb21d44a877ee43ebb3ba95ccdab886fa861a581e51daa3582ac815c envoy/config/filter/http/grpc_http1_bridge/v2/config.proto +shake256:28e5bedd6b62b170f46454d53864405335b83e56699060794d6b2fd6c41215ec056e13dc69726bf576eb2cc4e5e0ab3ea97b29d31b82bd343bc3715ff3093482 envoy/config/filter/http/grpc_http1_reverse_bridge/v2alpha1/config.proto +shake256:3d7cf31ebca862e3f338116034e2e553a3bb02d824e5c60d36dc16329c8c89d4f983388a6701ff5f28f2836c7504ae8dc4a547c750e61fa2b2ec804d7afdd172 envoy/config/filter/http/grpc_stats/v2alpha/config.proto +shake256:4451c917e256788daea0ace8618859b6d92078cb0f4a521c5f37aff6c1f65c643570375af579af06088bdf134b5d478df3300d0ec1c8499f4675ebe3701c22a8 envoy/config/filter/http/grpc_web/v2/grpc_web.proto +shake256:955bd5acf952e1c646307d585ebff1ddb4b9e12a7c211cdbd18683f9c5ec86bef360d6d501c919cf23307575a4e52bb7e1d8269a6bc13a0895d465067ebc542f envoy/config/filter/http/gzip/v2/gzip.proto +shake256:59e8e289a11351075573f2ddd7a37db76634c8948ed3e6ce6700086fb333c2c5fbb699c32a2a8a953fff83e601c78cd07e1c190b1656fc54c96e580f4a07d2f3 envoy/config/filter/http/header_to_metadata/v2/header_to_metadata.proto +shake256:42d4431a3ab45ef6f56608563c40c650ee96b48e840109bc81b72ace5ee088e1730cc8311942f17c3c7f840401ac795527f37011fa0f8baaa71862f1df4ea3f6 envoy/config/filter/http/health_check/v2/health_check.proto +shake256:7d100ed17b8aa3d24e851dd599ee8265010a64ead4583270004dd1e4119a3347a12ebf54b3bb1d46e82a082739adae9563d6d4a95fae0d72082c49aaecd651e1 envoy/config/filter/http/ip_tagging/v2/ip_tagging.proto +shake256:0e52935864306aaffb1aed4a1ceadb85c9d2faa05d1b85f6ca28f4f2f1c5905d8c1bc3d2e82b784d6b4afa6ac8915fa84e35a5d8b5d61bd1d15162c27795ad38 envoy/config/filter/http/jwt_authn/v2alpha/config.proto +shake256:c0905fa961a0b2650e460950ea69a761bbaecb36f3275501e2af3eab849a118859552ffc25fed71acee9467d821644cf8bc0f63b4b03898cbd409bcf542a0438 envoy/config/filter/http/lua/v2/lua.proto +shake256:ade55f48104a52c6a1a07a69eac9362734ca4d1b2b5b388a723770ac870d9f41aa87a698fddeec5fa5b807e6f3af6cb27bc1306d0c037f2ec16a6316ad9c46e0 envoy/config/filter/http/on_demand/v2/on_demand.proto +shake256:c2ad802957739a45a3aa91759fd5d695873aee61068f8a038f052062057a991d5df8c42940a6f18c158e605702188ce8ecbe8c8fabd108597fb4d153a361b516 envoy/config/filter/http/original_src/v2alpha1/original_src.proto +shake256:7a9da6e3d21b951381677149a4ab86cf91c36da9941460b9f0a5779756a8e8420771414f1a7f8ecdd9d11711e96641c5a513783fd73ec32ebcb78e39a20f6bca envoy/config/filter/http/rate_limit/v2/rate_limit.proto +shake256:f3a1c6647ae372e0b96759e4a81c6a0d3b200e3065f30bd68f53afc8196dcc5e5506bc3e1b87b7fa9f55c6300c2f74202ac6c693558d5b9e129ec356dea99418 envoy/config/filter/http/rbac/v2/rbac.proto +shake256:413fe9d15a14a89a22ce071bc25638552237e23446df0a201ecc174cdbc01b002d0f1214f9229a7189b649d26bd1a074b2ec14a59ba5c883654be8028f79bb03 envoy/config/filter/http/router/v2/router.proto +shake256:b6c5109ebaba66d44558c5b42cbdf0b7a2415bcd33350fa1b3bd87bfb79a57a1cbc1c53b745b3f15d2ae8296185973aef15bc6c35651f054f8f14270c6836fc2 envoy/config/filter/http/squash/v2/squash.proto +shake256:396fb5d3083f51ee0c11021b3c8f12795daa40f767de6ca35259c02710fda3e074777e53b4aeb6d1c0f2df8d12d82e54b211a2bb68260914de7e99176a941cda envoy/config/filter/http/tap/v2alpha/tap.proto +shake256:5b8b39f989d4085aec086bad0adde86332f122d5a7039bd417971ebad896c6b0d3f954ef2cf20f2db3e144fad5faa647fcc4f780855c73610a476ec2ff8479a2 envoy/config/filter/http/transcoder/v2/transcoder.proto +shake256:0d6c3b6012f347a164577edd8719c672791fcf42bfaae8801ea78358f1810948ce8e96f160bb7c0cae6d31e599072b15b7765efbea24b4b66171f654132dea3f envoy/config/filter/listener/http_inspector/v2/http_inspector.proto +shake256:ad9a5ebe5ad5dfbcd7cb9ca60512f309b7977f3e799916f203d16a0e5ffcea17ad6f6754e1dc0b1790b4b310c620f7f7b299a666165b6226d8b11e0411b26db8 envoy/config/filter/listener/original_dst/v2/original_dst.proto +shake256:f0f087b21bf93903c09469582f75f567815ea9e61a60fc696a800d3dc9a715a2f1c6bdc46d254add4deae2b7e099458754cb6e00b2875068d967cc884bfe4177 envoy/config/filter/listener/original_src/v2alpha1/original_src.proto +shake256:e87549581f5c86532b2bb5f98f7b36174de46c3f06eccd5450f7de62d009ed796d271943f8dd097ee97470a9a21f56737ba0619f4abf6ec72e314a4a6ae45c8a envoy/config/filter/listener/proxy_protocol/v2/proxy_protocol.proto +shake256:22f6d98be5ea471289b31b871ecef036632bb6db471a2cab6b7e5ccc11567a3722f8c1bbdb79e3aa74b23bc5d96330b097749d9010e73b180e9d491fb3075c6a envoy/config/filter/listener/tls_inspector/v2/tls_inspector.proto +shake256:1456550bea1922225a08a3b31c07d216ace78840dcd333d7c0fe202643b55c8e743b644b97f817c70558dccd760ff621289bc20582d521c090b5107d1f7f9465 envoy/config/filter/network/client_ssl_auth/v2/client_ssl_auth.proto +shake256:0df0940ecb3b653bbafe1ecba3506cce4b15d0da8ffa99591acc62b6ccab803fcb096cb468891b5b60c8f02ebec00737a2585e8bceb1103ca27dcc2f0466d298 envoy/config/filter/network/direct_response/v2/config.proto +shake256:dbdd276342dcc3634ad05a1a440099992ab5f3d122e4a02a51e5103115f672650aeec58af6f49fe03891c63199c1bd778621adbaced888d4199bd89a81536efa envoy/config/filter/network/dubbo_proxy/v2alpha1/dubbo_proxy.proto +shake256:1d6d4703df00e15becb0f3482904cb9d9e2b3275958478c0e947f213e3169da8c5cb19f71177337529ca7090f67e44ba8f7db0fcc81c71d2e23bb608f381ad5c envoy/config/filter/network/dubbo_proxy/v2alpha1/route.proto +shake256:02b5ec1c189f640a9f3544ae58b6f6eaf99c995f91290b44d4ec279f7faae01cc6672478f67603eff54dba99efba1ae5b6850f76428a08d2247c4c777b4f0f67 envoy/config/filter/network/echo/v2/echo.proto +shake256:f620691491093a0c4deeaa76d679ab9e08733bcfd5782d01e22d3f013326b9af64dc0dc85abe8968d7da59730c5f6f597ea9c7c0153724077af9c22762e553b2 envoy/config/filter/network/ext_authz/v2/ext_authz.proto +shake256:a7f813dbdfaadb034a6a7332b0255a0e3b22c62a143f04961312762d3abbf1f55bead00e1df978bdd79ea16c8d90d7c6fd485b60367217391e39ec5aab637b2b envoy/config/filter/network/http_connection_manager/v2/http_connection_manager.proto +shake256:c287f1093bd60b0ed243f40f69dc868a8856f31b36cc3f44790c0ed62e24c23fee9046ff0c55512f5fdbabd3f7fb89ca60d13a90ae0e1595189e5f2ef03febb1 envoy/config/filter/network/kafka_broker/v2alpha1/kafka_broker.proto +shake256:35476c557e6f472b50de17f81ba0acb566e934ae8a1f6b074e5516c797bd9737ae81a44a553af1702b2a29b7a60d41a815abff0fbc960ec4032dcbe7dd0dafa7 envoy/config/filter/network/local_rate_limit/v2alpha/local_rate_limit.proto +shake256:ff5bdb82fe17ffc5e034384ede8f7be5ba4dda6b7aedcf79e3e2a6ceb15253b2e7468944000118b6a8825aeeac97437f5850ac702a6bd2fd4f8e007050588c87 envoy/config/filter/network/mongo_proxy/v2/mongo_proxy.proto +shake256:6358160a2bb957573173e82b28b78768815df7674e3b755e2d73b28926aae148219181fc7a728fab85a0bf9046ff8a3148fe266630fbd6213583b61f093fc1a1 envoy/config/filter/network/mysql_proxy/v1alpha1/mysql_proxy.proto +shake256:f7871c4be8c05a913f14222ad951bcae6adbcbb8c06e1054d04fa726ceaddd4b9662bbabca46863b0662a800f07ac5e0d7cd8259e427f179e43410e12261344d envoy/config/filter/network/rate_limit/v2/rate_limit.proto +shake256:28d44c0675c62529d36fe6cdca9b6195cfbd79c0a28c5214e7b1a8dcea07098639385ffb8707a569ae7c073d72731511c48aac49d157181cddabe721617eba51 envoy/config/filter/network/rbac/v2/rbac.proto +shake256:20013e3fa4f7dcbfac0a112706f65603465c3a2690347a5d73a5c51186306f65fa335620753d5df37e40867dba5262c848e91983488a492d4df6cdc5834665ef envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto +shake256:8b1bc807c6c7bcc0ce1eabeb73492054766baa72cc282d9586fe31dbcfd605a585eb4663bbaac2569d92883ca51fc185951739cd61c41cbec0e419a00b966fc6 envoy/config/filter/network/sni_cluster/v2/sni_cluster.proto +shake256:dc8c92bc94f230e7fea77366937e8f7434fe3e1eceaf1fa39efceafbf3abc462d24bb1b9e666e0871d03737ed493c13e617c3d155ab739b072f3de16dc953559 envoy/config/filter/network/tcp_proxy/v2/tcp_proxy.proto +shake256:82e6c06843d291a8b5709eb695063c78c7ae1d2c1a2b8b2292223305dda4428b1e7eaafb5f306c7eb15dfad1235e60003c253f7a6a5d2e60beec891f23e97338 envoy/config/filter/network/thrift_proxy/v2alpha1/route.proto +shake256:114b21fa77aecb64aca3aab1c3b7d53bc1e7066340c773705815ab4fde30388db17f015ce9522572c3dff389942faa04205440f7969a11cdeea4a23af2f1aee2 envoy/config/filter/network/thrift_proxy/v2alpha1/thrift_proxy.proto +shake256:6cbf64dd0d1c15d6e2c93f4e4afde9f5d7f451654331fae4b02c921606f00f23cfb0caa36f2f06fb9f2ccb0d9f234fa0cbf03ca0a874b0a3bba922b4505e2312 envoy/config/filter/network/zookeeper_proxy/v1alpha1/zookeeper_proxy.proto +shake256:da300993632e7361d6ee03a7662b0e6acc5892e7e07fa8520bc17cf2522385532cc563b364cbc8273fb73bc03531b346ac43f230b753ac137f2dc7fc42168a84 envoy/config/filter/thrift/rate_limit/v2alpha1/rate_limit.proto +shake256:1d3dcf44a5b9aa1d72644ce5fd320c750dd4602cf38fe13a84ded28c71f96b18495917e56a5dc5393891f71bca3694625259f5406be8d534af8b4011b82c7927 envoy/config/filter/thrift/router/v2alpha1/router.proto +shake256:8b64c01228242819c686d8298bcc8cd5a0009f46172bb1160a0b504fcd9887a1d1a16f18f601186ba23509ca27d5fab13dc3ab4dcab7fe5d0ec5afec73a3279a envoy/config/filter/udp/udp_proxy/v2alpha/udp_proxy.proto +shake256:9c1bb39ce93f4f855fe268b2e6d4d54dd73bb2542292e0b86bfaf165d3e675e4d064899b0acc06993e0d58336f3260c16e2c1543dd72e9e0428a0b3c36495e45 envoy/config/grpc_credential/v2alpha/aws_iam.proto +shake256:ccd04514495a977770d0f97b6e366907b20b06daf79b935cea836ac8127e59a5a62116085c4a412751562cddd709808ff87781d7bab9e2f659e563b827dba353 envoy/config/grpc_credential/v2alpha/file_based_metadata.proto +shake256:3f8a8ff682430a9deb7aed8aba00fb69ba6696e62ae7161963ca11e80e4195db0bb9d0efca69da4ba67e9cd62fbce30ae0450144bf3e8d905d90e2eb2418ce59 envoy/config/grpc_credential/v3/file_based_metadata.proto +shake256:8913cce18ff3029b4361fe7cd0af29f512b44f31cff11c45f213873000f5e246f5376640a4df5818b9e9b1b296e5790a53909f4f50434154ea12b001fb180f29 envoy/config/health_checker/redis/v2/redis.proto +shake256:55c7c15b14acd86d816cfec4ac71c775f41c28059fa30449b2b636141bf6acaa769751f331d3fa8c2deed0c1c4a5b493d412761f638768fdab99fd08467afe2a envoy/config/listener/v2/api_listener.proto +shake256:047590d1b4f17739e8b57fd51ef0a1595e76358171b4470db6d058ef045fe31b4dbfcefd8aff4d8fd8fa861fa235a90e00ae867bfd65a78887dff4d08863e0a8 envoy/config/listener/v3/api_listener.proto +shake256:ba2b9f6a0eeead34c75bac35812ae40ec1d1784969ea691c12517bb3be61bd5b9d32dd332aa48c4b3b0507224d5fd9f4ce0dc31810942d0ee424803878155286 envoy/config/listener/v3/listener.proto +shake256:70cc88d4aa127a44d8c9f07ff539b0df74e22f68798bad5d4fe6c2204d9291015b7d8ba081b581e7f84d6762c72c7c9a4c4cbf948fc1a9a0a197e665a683c2bb envoy/config/listener/v3/listener_components.proto +shake256:141946962e83db22b0607a516569e39151a7c8fcf202a0f5a535380b4bb16a4e6f8d4052c4fc81b98bb659b97a3ea188f5a8742d0489948e915b8cc8e6c643d6 envoy/config/listener/v3/quic_config.proto +shake256:1d22bc9a3a0507d33d49885136fbee5c011fd5f74ac1f9ef105c7bca44d0ac9159452d54b8b559e428b8ccf83bfd7870911823678b5a38f44eb2ae1f3c8b1b1a envoy/config/listener/v3/udp_listener_config.proto +shake256:4f66defabea04b57f142cab999dd99555839e1eafd08aeda613bf09565089d4526163edcbd8b645798cc030da7731b4ab9e4c1c69fa9b9f5f4566d11d873cf4f envoy/config/metrics/v2/metrics_service.proto +shake256:381b65015b4dcf88a0b952cc9a87e083818051fa779f8cb7cd45ce92cbd24ca51f4a898bd4d35651962428db7cfcc23bd6203666402466a5aba58caeb3a8ff2c envoy/config/metrics/v2/stats.proto +shake256:da3d8f11bc83acc05f23de19e6eb9192dc8c0a438d35b3fdfd0a96eccc0e50fa5a0854b023ada3335d3ad65ecbbb3d4b9130cf8c7827880a339beb089451b51f envoy/config/metrics/v3/metrics_service.proto +shake256:cad99b38900a55cba98761d6c0e7bb4fdad8d2a3b0bd804c2cfbd7cae55f6f601638cf2aab40d2b5e92ca5bcda90b1f4c8f85192bdd893688f75351a66600dd2 envoy/config/metrics/v3/stats.proto +shake256:00f5305f959618a910e0ffdf75afc0666c5217d86f64db2377b7e5c4c742cdbcbfa572a791db73ac3c4c5c37d3b3b41234c36a4b4b313e6a0bab8a48a4dba3ef envoy/config/overload/v2alpha/overload.proto +shake256:b1483b097f119a5da9c7882192543cee4c57eb7a7f4caee285711bea09f6924a210d40c3dc2cfa4aba940d8b2bf2650e9b557b1fea96771edf54e5374387cfe8 envoy/config/overload/v3/overload.proto +shake256:89a239eff6cea2da4775f5ba8245b06aa675dd8c55d466537de4c17dca74965a54425b365da798ac31cc2165f497274457cfc8d607fa7872686d0d85b221b4e3 envoy/config/ratelimit/v2/rls.proto +shake256:56a59a28387e09e6e782cbfc68daad166335b3c6de22b367d07981a1d85683405ca5598aff8f3512d781af14e855332eff88cf76472616f7120807bb60ce988e envoy/config/ratelimit/v3/rls.proto +shake256:2ffedca49b310f8130941f9e8de30c1b55f5cc5fcf2adde9db1f041a4fa654fe07c76505d15632304475f0004e9483b3dcc6896d6d7438e21f188c5457fa4c62 envoy/config/rbac/v2/rbac.proto +shake256:a5b9356c8ef2aa3c78941be61e47dbf667813c0a9d73f36aa221543f88d82f7e2e3ee366d2bc81f86874832629ed25e92ada0afa531e8273e930bc46ca4ba02a envoy/config/rbac/v3/rbac.proto +shake256:9d482847cac75e699a0121874df7d06db534dcd9267f6d756691929550a8bf1c2ea73d85eae8ad873e0e7fc27872d06f07402ae8ea3b6163df3d4803b23b5666 envoy/config/resource_monitor/fixed_heap/v2alpha/fixed_heap.proto +shake256:d54077cd2998eb60031387346af05ebbccc9fe88e3b0d6f8d4a6b15ffc3f065b0741f42761ce9c3e6cd8d922ae67eb922c155f5490f0a2684923b0c70b1a09e2 envoy/config/resource_monitor/injected_resource/v2alpha/injected_resource.proto +shake256:864a6dbb71a9dc13b1f4724b7cf798208ab247d5eb4c51a3067fd7bad1e7c871c8c0a0c6cbd753462f43cd911f535756d23e24809848f4fdcce86ce58ff8c4f2 envoy/config/retry/omit_canary_hosts/v2/omit_canary_hosts.proto +shake256:42fcafbdb4d49cb14673cc7e2f1d4d12320d5df4f9ad5ef96398ee7aeaa0d731fc5e7fa8ed0c6d8eb7153f89b5eee8512eb94bde1c9ab42b91fb322140e07e21 envoy/config/retry/omit_host_metadata/v2/omit_host_metadata_config.proto +shake256:33f92a4028d3695fd5acb12636463b5d3217fe99aeecad27aa46c9888347f193c9f8b1c71559d8d3e999eb32785de600478db13e2128f559c3dbdecc44c766af envoy/config/retry/previous_hosts/v2/previous_hosts.proto +shake256:9db8237cbf8f7d69fb0ef897855f00e1b6a6517fba00f5972df3495948cc66c9a15270099b5aa7c6334d373514f1a9a30af239da352a3a6f718cf24ba7ddd6d5 envoy/config/retry/previous_priorities/previous_priorities_config.proto +shake256:698dbbd10b0ac4fc88e4935f5677ad37d0abc91eea4bf05e3c35035033cf235d968216abe5b582a7b0c5181ad56a743cfce17ec291b852384f2d3f3ec4c630af envoy/config/route/v3/route.proto +shake256:2c94a38b712b0bc8464609832cff79b02595cb280c341eeffc6042d89a9c623376cdfd615ecb833fd3ce82f83857f1a4073016dc8b55d6b56a5090683ddfd91c envoy/config/route/v3/route_components.proto +shake256:134c73bfd73b81e521e4e18e6627c1c251e27f3df44ff846832d1330a018176583c0d9dd25711b5f2575b7ead00bc1c74fe14a198c49e2ea50a1ac3139c9249f envoy/config/route/v3/scoped_route.proto +shake256:18885472ac3b8f9f067d9bfbdfb1cf351d68cf438a34cd2bcf857f16d475033c8180acc1df0910f16ca78318c7bde6efa4b44059bdb52f24d42b7c1cee5c229f envoy/config/tap/v3/common.proto +shake256:44907bc9d2d03cc048d930b0a78bb6b72b4f353bc9f3a6524f2e93f0a47a2c7234c8299bdc989927d0ca64c593732557bab2d80f47b0c0fca3cdb2d87cc8eace envoy/config/trace/v2/datadog.proto +shake256:bef0bd256ae2d3261475815ec6187b5e852b6a0178d5e9927f526da8ee5d7ef61f4de2639f5ea3511093bde05515b62392becb83ed98f669f3e9a3baeacf203b envoy/config/trace/v2/dynamic_ot.proto +shake256:4637407c3a7a724268ec49ee0bee774f940f60c54d7e13838a12ea9c6115fb34ed56fa20c31ab972a2c9d022616784038e940d2f40c43c0fbb3b85bc9f53bf36 envoy/config/trace/v2/http_tracer.proto +shake256:e86033f3fbb58c172f8fc1a5111f060e09aee3d58d1454955a7d8262422de2a4f1a692456696aa46aae0389f4106738412ed50d067815e30b00106fcc7061006 envoy/config/trace/v2/lightstep.proto +shake256:69abf1db7b6b8ab228edfcca9b0e46831ab9b9374979e609a86bf2204df09d906b33279905bd04d9ff62d4f02c94a3a9dbedb042ba6e3dd96f46db72e5c9f67f envoy/config/trace/v2/service.proto +shake256:db7a4656ca79bb7a54e54e6c6d0c7fe39871f6333f32084aceb29823252bc2bca6090d1f79bebf9c0d2cc9517cb9bbf730003164fe278bdb8777765738320a14 envoy/config/trace/v2/trace.proto +shake256:57cd057a541105aa9f9188ce8135599b752cc1297823951edccf8bf4ad7aa45ce5493f923c7073738d524e9a585090ade1b83f75b6e103ced1dbacb7f8e89a12 envoy/config/trace/v2/zipkin.proto +shake256:14278856f8d450a326b53fd4bf1e136132131664538b2e6d56cdb2c0964c4141c959c1ab0670f6dc53cf84341f3450cd02cdf9fcc0086883648b642648298cda envoy/config/trace/v2alpha/xray.proto +shake256:8d3b5af6ae067de523ffd978d48c5d5426c091552276b300c62c4b2e4903bdc33b1b1b3245cf23056875ccb4d744b676cf7e23f2cfa5aa1d0381458174a21ff2 envoy/config/trace/v3/datadog.proto +shake256:6b579882c08e28fb21fd011c98212afc0edefafa702dd6bfb7545c79d105ae3b5abb8d150246aab75c67f9043c1c7a697b71da38dfa012fe52eab5cb93b477da envoy/config/trace/v3/dynamic_ot.proto +shake256:1125570b23390d44e86ae7a592edeefeafce7821b5281748cf452660d73c20022ce1b3ca8cce1e364209a201b57ff3d5cf75b69be828572475720122be764cdb envoy/config/trace/v3/http_tracer.proto +shake256:a4e359032b0711c7e2ec3dac5bdeb45b4910d590096d1f16ee559bb9210b0c94ab61c3e86dc9f85c6c2320f3769cfb97fdcb5d111af3350ac291c53343587c53 envoy/config/trace/v3/lightstep.proto +shake256:17cc86cb088fc468511d70720b7210abb576ff0ffbe5a4ac3cd60c8cd27344464cc70c7ab2d1c95035a5c13dc56391bb802407f9605387fc04e7d808d6423c22 envoy/config/trace/v3/opentelemetry.proto +shake256:c0071ad84f5e61f0075857b2635f283e4e8e62ca3b9c25e0a7a7fa88ef9ce8ffe243002a5633389ea76f772d1a3d9e44a0a385da9c80aa7880f19f2119764421 envoy/config/trace/v3/service.proto +shake256:a457e40b626a98e1714ca795c0f4c1e56c9efefef26b15b62dc0f1978e957de8e3b99f2a862f7b4fd88fafee15e50189af04cfd3c8b2bd8539a0bf0c9a221a74 envoy/config/trace/v3/skywalking.proto +shake256:d0205fe3c89d1f582db76034f79b0ffc035a8bd2c0d6c1b2fa0a080c9836e3fc69ec5c01d2ff82fdb53d52c27ff9e55f424535eb83b118a5bfc4b96654d41f17 envoy/config/trace/v3/trace.proto +shake256:719e4642cbe678ecafd1338699e9535aa6d448bc97ffed191fd59263dd37ee9fc432d7b7b9f7dd2303b1f4eb87416a237ce1d6b76f8a3321fa253e0167ff6a7b envoy/config/trace/v3/xray.proto +shake256:1ff6ffe28457b2a8cd8b216be08e306264ce95ef295480cae4a752bbca30c7a07c395bd98e5c65f22afacbe75c6ae8e2dfe2803f926a215d4e8b2943b7a215ff envoy/config/trace/v3/zipkin.proto +shake256:72b952cd7788414d2b15680e550320cacb9c2b05f41eebd366a352bf9a8a196bd13dfb37ae05c61d1dce10e3c20db7da9e08647cf1c021dbc040a06b7796f313 envoy/config/transport_socket/alts/v2alpha/alts.proto +shake256:791160950506e2699fca23d4f0a0064aae30c3d30ce6573ede6cdc993b7eec4c118ebfc80850b5dfe907cc8a2af039898741cb25a3b02fc1509e793c9c1c989e envoy/config/transport_socket/raw_buffer/v2/raw_buffer.proto +shake256:d3a0e662e7812372f28a70493a537c01d08628928062da79a6e328e19dd3d40c8376cf811c14decde7bad578a0123f3439be78c6665a1310d6ea3162a55ef556 envoy/config/transport_socket/tap/v2alpha/tap.proto +shake256:a384da635a4197c3cf8ac48f23e764ede9767970455bd7cf1323a18593efc4508198480c9d1cb36278c210d82d519b6e7822a569fd502eff74509802974dbae5 envoy/config/upstream/local_address_selector/v3/default_local_address_selector.proto +shake256:d7f5be3b0700a9aca56b8103381e2b6c492798c086fc2169808c5b6f57798d6f5e9ed0b2eccf7c2137aec6611a5c7e4e20bb7878bb80cc171fbd2ff0dd39f798 envoy/data/accesslog/v2/accesslog.proto +shake256:e428af4c299325c89c6e0fd308d26d8de409354fee4c854ebc6d6b0ec1056ae68694bcf60fa466369b314b938c5239458129fdb5c9e6b6289c19e71c3aeba3a9 envoy/data/accesslog/v3/accesslog.proto +shake256:dbe663dfcfd0c76b1ce3e25e5e3fb44cad6c8c9b3dc91e1e3ef7e16f5f68eb1c107fc7929ff0ba385704a3fe2ef50cb130235493463ca91094813e831de30d89 envoy/data/ai/v3/request_info.proto +shake256:ebd2cbaece394e9f426b8b40c0e8394f607926395b48af0f7c4729e83d401d6b05cb4170a2b27af730704e17dcf018e6148f1404634c444a9f0b45527fb53c02 envoy/data/ai/v3/token_usage.proto +shake256:678006c89c679ff2bbec15ea088af73a37958d828750a0a760ce561b0ceeab7fddaff1db91bc9abd58c64896a613149eec677169bea9bf49e2cca9a357b2e834 envoy/data/cluster/v2alpha/outlier_detection_event.proto +shake256:61967733b051916f65d73c3588c9ebef8c342c7239154dd09a65ad40484df30c015938eef9dcc642cca84a3d2d33d0e94ef96fcaa475ec4d2f1673e5c5d67943 envoy/data/cluster/v3/outlier_detection_event.proto +shake256:4949c45e24893b84cd2159ff9bd7abb5493facd0418def75117e1e512d142a8fef8e73e7b2a314621997df36441ccfd9b41d02ffeb114bc1b688940a56cba2f2 envoy/data/core/v2alpha/health_check_event.proto +shake256:1732513f22bc9d5956267a7d4a149f2c9b3471c8b8da67733e786b32684e80344e44bbbc1a9873bb5ee979cbbdaed2a8d2d4082c7161e552d710eed81e2e7b5b envoy/data/core/v3/health_check_event.proto +shake256:688fce59f3ffa1578320bdf4c261ed966f3cd468c076768aa0c5ec3b470978850bc3a353fed1e88b648366e52555c0c2c6f85d659ba7438a58d552376ba4c89d envoy/data/core/v3/tlv_metadata.proto +shake256:0ddbf0a812e2cdbfa67cffe6f295dddfe3ff1b67fafe2b189dbe56b794f198ea795af6f704b0106867702bf8ae60b1fb641eea702dafeed356514f56ea1ab8f6 envoy/data/dns/v2alpha/dns_table.proto +shake256:25c641eb9d2005b702048207b9e492e3498ce1c42c53954c645389fdc9d276ff97fb1cb63e06d61204c9ebe695fda0d55561d4f608d5b4903ba267d8d7553b2c envoy/data/dns/v3/dns_table.proto +shake256:65f89ef9986261b3a954ceeefd67a70ffd83ecf80fc8e50dab782d1ab212295a7625c96b56f9d277bd1ab96bbeb2c12525b74a32bcdbc2b09d541a86b7dae7c3 envoy/data/tap/v2alpha/common.proto +shake256:61cde86c7ef95ebe901410b910bf31fc2d0be253300932e44cb3b97a83437127df5c47e3c659e0f27220f44a74e10e2c8682386ba61e4e86f7465fa2f2227f46 envoy/data/tap/v2alpha/http.proto +shake256:53a01b2346d8821a23d0d7aa21fd7c134f89c74b7c33c1894aa94f08b59aef3e0093d0e676f08991dbc81ddd9a329a1008cc689f5ea6ac1b00f47a86aabb3476 envoy/data/tap/v2alpha/transport.proto +shake256:891d5bdb9017028abad1e14c68ee3b0e1646f569b97476b8eb8c63d2b781a4b06cb502a46582409292ee431a7e4c0aaf3b28e0272a25e03fbaa56713cb9e6f6b envoy/data/tap/v2alpha/wrapper.proto +shake256:631bfbc49593e820da137679e03ac21405ef7d76e2d68816de0a484bdf0d419f6d72e7d246591904c7712e002e10ebf7b0422c61818d26f1d23337e676f93652 envoy/data/tap/v3/common.proto +shake256:fb758aa0b36e31dccf24f3a64b1621e97ef5d8c80f86e6dfa0844df109d719209dbb6a15d74536f66fcefda9fee5154462dbf640963243a2641b84d17b0a4502 envoy/data/tap/v3/http.proto +shake256:cffb4b03c2cdaf87e95ae70b72ee7afa4952783c02b23cd850bc658223cf7b635a6ae46a4457fe5cc69daa957dbedc9f09477828b46cc0d40c4cc85c42414e80 envoy/data/tap/v3/transport.proto +shake256:8a9f3822651191945c1fd06a15c1eea8952db7ae45c9c0302dc77a47397031bbfe4670eba6d2a10c394025f671310aaaceee562f82927518ef0ed289f48237a4 envoy/data/tap/v3/wrapper.proto +shake256:b801c7532eafc67c8c9fcdb522b395770893de74f2433033bd97d013256be1182c75b86afee07c81abc0c6c35dfc8115ac25e0222c1a07db170dd5f06da6e7a3 envoy/extensions/access_loggers/dynamic_modules/v3/dynamic_modules.proto +shake256:751d80e997924ab9d8826ac8deb4645239f57629571ac7cc458cacb8ada4779999258188a10d9728c0c17961305cb587074c054d6b23391dbfa3852a94a42c1e envoy/extensions/access_loggers/file/v3/file.proto +shake256:b5d9ec9f7834d656e6f73dd7ac2b1ac4765c8888d02fb3e42d51f9447008c8d52f40bebafca0ffeb7326e238dd44a3d0cd59c9aa67748e5dfc36ee8766bb58b8 envoy/extensions/access_loggers/filters/cel/v3/cel.proto +shake256:d24f80ec625ca4a34589ee26dc9092322920a57c5c68562f26c7a6438922039682f2dbc66d9e212c41657197446184f9acfd684ff12de00b492b04fd8a49e2e6 envoy/extensions/access_loggers/filters/process_ratelimit/v3/process_ratelimit.proto +shake256:56b5bfeea1b9589f8782e223818f04fc325bb38825f275cbb89387474f4e7fded90c907292e660bc01f02f2313aeeb19a29c9fefc0c82e031347130bc4fe9ebf envoy/extensions/access_loggers/fluentd/v3/fluentd.proto +shake256:cea5ade650586c7e3d0f5f583c76140ad465de448b21d230b21aebf5b0f6184bc79b12a11374d7672221a612c59a82a23f6061c3bcd978d4cb4d3b7eb321c613 envoy/extensions/access_loggers/grpc/v3/als.proto +shake256:8491c4d20717a14b78e5865417c9f035c5c6371b960584af09789287d65d19d29599727d0a67e6b172df026afee9a7718a0befea90fcb38e24c106a3a3837346 envoy/extensions/access_loggers/open_telemetry/v3/logs_service.proto +shake256:691cf9ccc683d388606ca10cb0d457c4bf41a732f8f95cfe71327dd452afc2606c0b31ef095561fe9520173a9fa3392d631b62d0ffc15c7b4e2d04e467d2d455 envoy/extensions/access_loggers/stats/v3/stats.proto +shake256:667450b661666527e11db45d12b9a0b0376e9c8eded7a80cbe8be51d33569ce931ed8267ac4be3d3cf8f1d1d689b3fe8ce52ddaf61fd2942a52bbf550dcbdb05 envoy/extensions/access_loggers/stream/v3/stream.proto +shake256:dc17cdcb684c9ed3fbd22ebb50989ccaba1edaafe8b2788b64c2aabe277a2540c48136b9db30129543b72ccc3835b563c43589187c10d932d24f55efa43d1ff3 envoy/extensions/access_loggers/wasm/v3/wasm.proto +shake256:bcca4a38dfc74d193604e0758a536a6a3d5ae2b277355ea283da3468f47183524ccb3b0655df290586bc3e325a8584a610ea5fbe554d59cfd6bb2dd5465b20f3 envoy/extensions/bootstrap/dynamic_modules/v3/dynamic_modules.proto +shake256:02c3685ee9a377c8dc2d6dda1e5906e97b78d430219252c734d583bacb37dbe13bc2f7e9b8fe6d3a919d56e66349c076e4ce243aa955d0ebe5bc1dbb8d0d78ba envoy/extensions/bootstrap/internal_listener/v3/internal_listener.proto +shake256:06777c0a6d9c75d1495b8fc59a5a4b0be7a8de43bcecde66c564eaf5f3746d866e4fe4f4ad9e3182ddea2ef478b2932723f7dde312dc0a6a634f655b87b3da09 envoy/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/v3/downstream_reverse_connection_socket_interface.proto +shake256:d390dda96435e41cc43e4e950e0e287a2ba7a29c9377b73ce64e81bd9fe2098725eb8af751addc9845d89067141a36c34af023b4c7390d96c577c3506dd8102c envoy/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/v3/upstream_reverse_connection_socket_interface.proto +shake256:d5eac6c1a79275aef661d3fdf96f471580083b55a808b79b9c01d69204252fcba82f67f47a80a456abf6ec930fe687ce26f08866f116e0fbe4c7be200d68f1d9 envoy/extensions/clusters/aggregate/v3/cluster.proto +shake256:e3fbc3da2acacca933166dc9dabde689f5f20e29f2b7ab43f839c0b29c8bb5bea668ff8536544d06a5a0020b7c537e3789fe9a671b2e217880442891c899d9a3 envoy/extensions/clusters/common/dns/v3/dns.proto +shake256:752daf76478d21aeef455c959b30d42551c1529a3c4b5790334fba28cec557c5595762f42088b438a472742078cedeb8b332f5fd732cac86f5de237ee754e61d envoy/extensions/clusters/composite/v3/cluster.proto +shake256:080f22dafbd2abb52d544b56a18619ca3123bf9f280acc1d838427c65fb844747f5208f09a5dc3ef487454c8306a30be1e31afbf03f0a6c083629f3bd70843aa envoy/extensions/clusters/dns/v3/dns_cluster.proto +shake256:e392dc7007461ec2ae798f202f2b1ffc44d6ea843404340d512ad290632eaaefc5be2f0f1edd10326f87695c980ba499d13b0f4f1e86980ab3cdc4817aa00773 envoy/extensions/clusters/dynamic_forward_proxy/v3/cluster.proto +shake256:e04d47d578900b98d66bf887201464c1bcf114d5dd9b2e29e9618d2f1c12958bef5848aa1491c219715b964dde29da2078cc77cbf973556ebaddff954d737ecf envoy/extensions/clusters/dynamic_modules/v3/cluster.proto +shake256:e4e8ec2ca3180e520c0f89af150fbaebc08714966fa37cba4e42400c25258de81a6f4d9a979b285a010620246df74d8450251968717201c5d0f1b22170f5883e envoy/extensions/clusters/mcp_multicluster/v3/cluster.proto +shake256:f74a0b92a5967659929425007d2f764e28273cc4be3aa3c99b4f540adf80e828c345f5ccd5c589da3b78015eae2fe05b36f20ce3a8a193700420da536fc92843 envoy/extensions/clusters/original_dst/v3/original_dst.proto +shake256:8706a8bcd77de30b9d3efcb798059a31368272605e8bac4afb66a84051a35bd6ba32ea73d4dbd9ba44d94566b7077a8dcf701410cd56b118028a0bfb5fda8070 envoy/extensions/clusters/redis/v3/redis_cluster.proto +shake256:8bd676a0a41122ddf383c0520812f564cc4d8cc6692f5b20c8b3cbce34fe14c1e808e961327b8b1f48b909d477dd15262ace366b6554899243bf18c286cc77b7 envoy/extensions/clusters/reverse_connection/v3/reverse_connection.proto +shake256:9a433eba11a7f4b3fa7ec0c57f89f1d8d9bb514953054bdbb6084f8aec89120f49a316d7b5a38b1cd16d4ab69e09ee5f4beed66abaf2fa285710024cb2be8468 envoy/extensions/common/async_files/v3/async_file_manager.proto +shake256:7ab7551b0c8fc52259981599b1b118ec1aa8abc5692a0d550014d427dc5553c054ccd0c9d0262f7be1cf664e1840f1ea633e4cfc995cab69f3d5b9db44f8888a envoy/extensions/common/aws/v3/credential_provider.proto +shake256:bacc120059e889203d81f339d15019d86124f5e6db3e34fa0f9960282127bf89d900d90cc33a11798277e2d76d60550a55dfd89ec18afa0ec6086087827e12ae envoy/extensions/common/dynamic_forward_proxy/v3/dns_cache.proto +shake256:dee56c7243546db3dcb520fc8c60eeca88376540e5bdbc2a4002dbcf8c61f2c012b17c1e87fc23cc833906440619398fa8a19cf1b4f5cfee4901ccad6c67c8e7 envoy/extensions/common/matching/v3/extension_matcher.proto +shake256:16ea57deb3c9206e9f72502ffca313607e245493ab1ef2a6cfc6977b4177f3ba84d30185d1513f4b7c06601af58d411e889ed95daabb2e9ebde62d82491d1594 envoy/extensions/common/ratelimit/v3/ratelimit.proto +shake256:d0460fa03ea121f02b6240c234f86f50569c78e1e1b0751d21bdcd3f07e90a1f551cfd6b5b1beb96623f89ca1dd5fa409722e112d8fae05afc83611d37add45d envoy/extensions/common/tap/v3/common.proto +shake256:9da9e3129e59f3177a102a530d9c11b974c06bceb112924d1612993e48c266bbdd32f366fb9dd7c86dbb64666edc716ed8266e00f750d8a729b85a0bfb932a97 envoy/extensions/compression/brotli/compressor/v3/brotli.proto +shake256:e75815678d15ffdfee38535448fe91b904f26d1a2d8e25c3a16197c3e9713e94a5c7c9e893cd8eaf3f0d34f00168aaa53f3bc50a03ba3aa12f57ff98e5b9461d envoy/extensions/compression/brotli/decompressor/v3/brotli.proto +shake256:61448ff01a63766c220b1c8b3baaf98cc51b1919293df1db680e62f80203f0809a8dad91ee72f06be9b49ac0dbe071ca8851c29f2608983c13a4e9a684a03897 envoy/extensions/compression/gzip/compressor/v3/gzip.proto +shake256:cefe1d4f68cf744c03b12227f097ed1cb32af4d23fbc72ba227c012da5d06ea82cb1e7cdba3558cca9d942bcb976ef9b71fe65bc80379a9942de1937604aece1 envoy/extensions/compression/gzip/decompressor/v3/gzip.proto +shake256:6970164ab52037dc7cb57972e4949deecda9f9a807cfa875f98cf96392ef3f88c12791bdf03f207885940fb888fc4df0e1f3350c8a86fb6ee0e1492da0d2fea5 envoy/extensions/compression/zstd/compressor/v3/zstd.proto +shake256:e63326da75acfa8ec8373a4f5552d89e171ddea73f8e081375a125a1a0d66f6ec85ade9b0a05fad190f4f5295a7f856fec6c6748e3faaaf356d4b5bab27e6954 envoy/extensions/compression/zstd/decompressor/v3/zstd.proto +shake256:46355b26af4e644f11953163f73f60b008af9016214806e263636b9cfe9355a7e4476f3892ff5cbe7ff4f63de4a39c78f0fe36831be74da87fb6470585105b37 envoy/extensions/config/validators/dynamic_modules/v3/dynamic_modules.proto +shake256:3d8958129036bc56f9b6546fdc0d75d0b3bebbdcbb26b6f267c96f83031abd01bac80e946942cff60f46b3df0586a2f50539074ec4d93f20ea99505e9afbcd7b envoy/extensions/config/validators/minimum_clusters/v3/minimum_clusters.proto +shake256:34728d7ec4daa19f650ce7eb66d0edeea4fe7bc65418d27759524bf61b03574dfd6d0c48ff6b02a0c46278ac6394bd3c97191b872dd1e989a54989f452bfe695 envoy/extensions/content_parsers/json/v3/json_content_parser.proto +shake256:174933bd8f46d956cf29a5dcaff4f8711209faead4e33d83910b72c03bd1eb33b065e2dffbe51a94ccbbfc974cdff44fbd6b01cfab0b9cd0a4736064de122738 envoy/extensions/dynamic_modules/v3/dynamic_modules.proto +shake256:10d9f4d444b46337f205d8690ab38b50a4b8464aefafc1de2f0871f2b5000782bc237fa6f1934543bf87e9cff15a83145f31f972409ec7c2868c00eca946e322 envoy/extensions/early_data/v3/default_early_data_policy.proto +shake256:214ce39eefd934f17dd4a3f5912580313c1c548eace2cda4674c72916827fb79c3752ae8bd95c8e0c50fda9a8dca3eacfca5e155e145786690b05f30d1e44654 envoy/extensions/filters/common/dependency/v3/dependency.proto +shake256:1dc0cd631dc4ab17eb4b5eb919f7daf9b45d61d88a72bdd0888c853b33563966a7c89948948d6454c70c3662282a98d33121d71482babd07ddb13d66cf24e641 envoy/extensions/filters/common/fault/v3/fault.proto +shake256:96159f447b11ba1cb7714a394691f6b296ecb1dd5a152290d8f63d5a95a169debb3bb7a426a8b2c2d5048c64df212c9dd65840cee0c0f0f9e83d162f22fba15d envoy/extensions/filters/common/jwks/v3/jwks.proto +shake256:43739fbb908ba7e84eff67712f401ddc33bf468287f93d582247803a5c006a315be85476393c5207f05ab70d4d2c9ae6559ab2c37859b74bf6eae0c4bfc735e5 envoy/extensions/filters/common/jwks/v3/jwt_handshake.proto +shake256:df574600c0b95f0d3a67e84873051d67fb2204bd1416334e9a6604b12f69c1702988042636741c3979d120a525a098b12c1d976abd0381d4efc97eda88754fcc envoy/extensions/filters/common/matcher/action/v3/skip_action.proto +shake256:0d676447ff49be2c9b90352ac6c6ef5de7153e979c8306b7fb593a988bd21a498009979f47760530429e306a60d8893588da3f050488e8cd982ef018c9d8d9d7 envoy/extensions/filters/common/set_filter_state/v3/value.proto +shake256:6b9d0ad70f60da843ebb34273554082f4164a7e97e67399d45597a5a261002ee47d9deace89a3fac8cddc739ac0f61fd4053d268c0b7580ee373b04bc576568a envoy/extensions/filters/http/a2a/v3/a2a.proto +shake256:b4d3dec94b64da00d30d0c3a2a001941240da6a0ace1e1fbddcf2f70c155b38827a2e41e09055582d268cffc009dae06def4f39929167c31777e5cfe778d5363 envoy/extensions/filters/http/adaptive_concurrency/v3/adaptive_concurrency.proto +shake256:3b505ee35fb0516a12fb2b6a8719392717d0d8edb3b5ca0bc76bff8d7d7f415f52fd1bf7a646aabb476606dae85971fa1e273dae165c400b662d7d3f06e80f9e envoy/extensions/filters/http/admission_control/v3/admission_control.proto +shake256:f535bb9e68b1fc31fd34345beef2ac4f6b1ccd8ee0207a12fb673394c16cd6e9c7ae13a75f14f9f0b1bfd2664c1942318c8189fc4dcf1fea76de4ba64afe7c4e envoy/extensions/filters/http/ai_protocol_manager/v3/ai_protocol_manager.proto +shake256:a78504454f77d6b293890693de4d63ec9ccbb54b5bfd88421221c2ab8cd55ccbf343d8de99591eb5e912cf3dc0cf9193b6b065d4056c32cb2e48c46f983560aa envoy/extensions/filters/http/alternate_protocols_cache/v3/alternate_protocols_cache.proto +shake256:5a0cd327b6fa81883930058fdf67a8544df52a5fab5b2d5846561275ab474f0b7a17f1830065f9edc84c841343becb39986ff68f497d1d6b49a62edc73375b71 envoy/extensions/filters/http/api_key_auth/v3/api_key_auth.proto +shake256:b5477dfb0d32381ab02e26eb2ff4a9a1f99e01599f1cfe39d72f195a8f3570afad60ace573dfd0fb68b0719a4c872ec072e6d849f9fa783435e6927cdb2f95e0 envoy/extensions/filters/http/aws_eventstream_parser/v3/aws_eventstream_parser.proto +shake256:009d0945fabdf8882d4b20b6f5c167d0b886d497d1f8b72274c855dc6ef232f1a0845060936adbcf37f39d5df394b5e69c4b520b96d14d578602a6ec7ae57114 envoy/extensions/filters/http/aws_lambda/v3/aws_lambda.proto +shake256:ec87b6ead92bdf9a5dc242a21f782d7a0f82a292522cbe59b802292b21e03f891b40218ed283b5a5c7c6d5f8196f00e8e3685cf49677ccd616077b68a956180e envoy/extensions/filters/http/aws_request_signing/v3/aws_request_signing.proto +shake256:a012539b93b3211ab8eaa539d7e5792c404eabbcadc186a517229c24f109368600dc9fa7101a18216b333310c6c214f0daf76a1d65aa824c7aae8a6c56834550 envoy/extensions/filters/http/bandwidth_limit/v3/bandwidth_limit.proto +shake256:db9db55c4d2edb5feceba20adc04e8b86855a43a271d7aa969a799b1aa66c67a7cc8254cce74beca89d0107276f283629bea58654f5a6678c106ff5ad13e75fd envoy/extensions/filters/http/bandwidth_share/v3/bandwidth_share.proto +shake256:2a751a2d745240b338992e26dd84d5ec71e6f0a9f017eeec3b215c667fd485f3d2a2fb57e86ac8e898e9a14c4eebc9a5830e88f48fb8f324abbe8e332d0dc291 envoy/extensions/filters/http/basic_auth/v3/basic_auth.proto +shake256:ac67a15e46d5a95c672d5692e0ab1aabfc758982b3c2122bbf2c5c7fcede980963690512051adbf9f8ea10cf31833b322b59f91da46520fa94699b1329312f51 envoy/extensions/filters/http/body_size_limit/v3/body_size_limit.proto +shake256:206a2c768f2b92f64a57eccf17009e8a6dc212dc7093b5fea083be08cae2f3df5ca3757aa37ee3e5bd4f5c7feaff43cae53e6cfe028ea1c3f3f18859321d0e26 envoy/extensions/filters/http/buffer/v3/buffer.proto +shake256:092c99ed8673f473541343b33d81bc4d0e0e5d5cc1d480ca1a2a99e502a72f91444c69ddec54957a7acf7f69e9a163f99d211a50fcad50d1941a2afea84726cd envoy/extensions/filters/http/cache/v3/cache.proto +shake256:32ec3f8854e5a6ceed6ac53d62142d707ea1c335da41359d8d57cfd3cff4edd5afbe1fd1d7a40057a17ae0f20c106756d7d29480007969dcd4b1845fb2e3ad6b envoy/extensions/filters/http/cache_v2/v3/cache.proto +shake256:44aee45498a29aab141211300debf8d21ca32b91974b941358765eddaff8edf6a44b4f1f201b9156b78ecaf90fde2e204bbdc4ace89bef75fa30afdd2d300658 envoy/extensions/filters/http/cdn_loop/v3/cdn_loop.proto +shake256:0273f1108bcefebaabfaee544a90b5ab70c517b9e19e1131b490241df4c37b634ffe406dda73e975d7ff9ce5c6b847018c496110e974facc0bc46e56843dff02 envoy/extensions/filters/http/composite/v3/composite.proto +shake256:755c91ec00e03c5ffcefc462558504d3ec1300866a9a88ba3eb946f1fb6cbc143a56f8178c9fd1c1e050e26d5ed657bc377ec773014421d23ce72da797bf446e envoy/extensions/filters/http/compressor/v3/compressor.proto +shake256:f76396fc10338f03835c8015117c14c6345e9544bff3300eda5aca31281d342902fdbfc69924318db6c8b22beba6e26b63e04b2de12248f98eeb6dface9a89df envoy/extensions/filters/http/connect_grpc_bridge/v3/config.proto +shake256:677757e90aaa84b929d892f82079e879572b926402a7024684ff19fd7d1cefcd874d472427d46492fb412c44339653394979691d2be35700d4e0354302c636cc envoy/extensions/filters/http/cors/v3/cors.proto +shake256:24767a84ee65b6e9e6428051c9743be3072eea6c2a53fcf956ec59b47f2427aceb4dbf795b9ea6f87bd5bd15493338f74bcb878e2417543c78db9611eaaadbce envoy/extensions/filters/http/credential_injector/v3/credential_injector.proto +shake256:86d3b5213890d1c4282fe4b466d3cbc3ab2a8afe6e91c6449b5ed1dde08ce5d7e48fe921551639033d0a744d6f08cc56865386fad1ad61d75e27fac18b550a93 envoy/extensions/filters/http/csrf/v3/csrf.proto +shake256:fefa73c461c513262c6d5502fa1a26b8404c87ceb540447d6c4365961bced055f5514fb92192235388355030b769dd612f3339a0fcc9b5c5c124b4546fe8591a envoy/extensions/filters/http/custom_response/v3/custom_response.proto +shake256:b6ad74944a6e9d41423c56167880b837e29398140519214771a4620522f8eaf703d17ace4ced56f00b4cdbd0858652c73e6da54bf45c283b4e3335e7bd9729fd envoy/extensions/filters/http/decompressor/v3/decompressor.proto +shake256:e17e1ccadd977742a7884357a8920b35a26bcfa9bb6a50caf00bc88b151ca809c5e651f2f04aba6135aa0c969a47a6f2be403d8a7af923ee6e69b25999d93e17 envoy/extensions/filters/http/dynamic_forward_proxy/v3/dynamic_forward_proxy.proto +shake256:2dfca9444a089923c1a755c1fbdf192b8730abd6138ddd0ce38e192688c5a33a56680706f776874432cd966a343b5c129d0af379860d2c721a95d8ff1cac8c24 envoy/extensions/filters/http/dynamic_modules/v3/dynamic_modules.proto +shake256:47d9b45b6609bf2cdbc4b7ecce176c32b686cf33d8f787a557afe7c8e4f8e174d61e9732d6ea408f6d479d66078d2cdc96274677822dfd3009061569569e8f8e envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto +shake256:471e9f4568cee8c55789a48dd9d2977b05ddd06e1032aaf87760f50366e6c6eddd404c65d00f36b5ddb28751a8e3ed5b3ae28e79c976bfc515d8cd83cb98ced4 envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto +shake256:6ddb465da319eecc453afdb11b62ec12451d3ee7eefc0ece502e2ef912395d2e93751af26143901a8edb30aa5ab82fc30ba2e011d7364dad0d5cbe3a9b6b0ee8 envoy/extensions/filters/http/ext_proc/v3/processing_mode.proto +shake256:96b60daf5dde95307b1ceae6ed9607f561179e136ae561122cefaf4ba42624e69f81e59ed7c0c1dfaa68fe4de4795c896f652bac6c73eccce166a0e3ba5d20a8 envoy/extensions/filters/http/fault/v3/fault.proto +shake256:b0a4c8a654df0f58e79b4f41bf72b96bb3a304bf4b5d2ff4b259817152362eb5a059b896e4c2487b317c487e03c9288b913109a79d63e2bfa271fbfcee8139d1 envoy/extensions/filters/http/file_server/v3/file_server.proto +shake256:17a99bcf1de1e3157f141247a5c03ee70c9b537ed3b45e255a01952a6492201b82e077f9d30d88266019b2abb34c4f2576aa1fb97f305e2f744297b8573533ce envoy/extensions/filters/http/file_system_buffer/v3/file_system_buffer.proto +shake256:063f069a102d281650aa59e92baabb00fe306de95ff9bf911e96243e91cfe2863f286f225b22b831cd78f3c81ee5bf980811470613298c18f716bc7d7aacb0cf envoy/extensions/filters/http/filter_chain/v3/filter_chain.proto +shake256:5dca22c6f661b75adf9bca0a6f5e200474aeb1b977cf6e03fb18ac8c1273940f67b3fcb3e3fdee91f7e46f820fa56f51b43c601b05f4c6947aee912b5c0b3d01 envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.proto +shake256:4d560d9e92f505b94c8443df5ca069765297648c1cf28576cae11cdf571689c90dc5fb2b4b9cf9718fb5352dd1057df56bd5f5da8be4bbc194494fa7b3026404 envoy/extensions/filters/http/geoip/v3/geoip.proto +shake256:c6eb550a79d59fd94336007ea8e7939f348ba56ff6946a93a697059168c7987cd7fc11a992edb294d13e1cf4a3bfa171580eacff93010e8776eed75d141d4765 envoy/extensions/filters/http/grpc_field_extraction/v3/config.proto +shake256:54ccc9976e5be2c8496523ee57a6de9c6b9237930e904c43a6531d6d6ff5c88cec12037998ad3a90beffcde8d9ada39d0c09c0b17fadd461dec04f94d8d3f6c4 envoy/extensions/filters/http/grpc_http1_bridge/v3/config.proto +shake256:35678736fadaab25fc9272b2cb7eeef51ad4b9918db5397823fc8acef4a53b16257eca5c8b321a8c76ad75b92179ed78391978d522366baa2d2276d960a3b883 envoy/extensions/filters/http/grpc_http1_reverse_bridge/v3/config.proto +shake256:9785b66a76a0a40de3ba46c4ea9f51964da7959430d165835edba22073a17f7333fc102e3245606aba6b419c0da0053692c07c8ca83ed4925ea172aa9181bbbd envoy/extensions/filters/http/grpc_json_reverse_transcoder/v3/transcoder.proto +shake256:294f73c06abd0145671ef0990937f3db59ec9853b2acf381016e62b43d622340285febb07118c3b5a7b677d996d9bd2ac9d1c83a50782e660e31a26f3c658faa envoy/extensions/filters/http/grpc_json_transcoder/v3/transcoder.proto +shake256:d9a4d41a9792b6012069dca15e2c976f6ddd652efea683a3a55220b846b4bcff6035c1d6e15d87de5c4b86805d37bd289e305047e4577f500cd5a8d944c1ef4b envoy/extensions/filters/http/grpc_stats/v3/config.proto +shake256:3a59bc4b6b35fdc24ec0d2b13aad7e9d87fcc0f2d6bac1173870a993cd643defab7ee86ea754985ef2ec40af21385d002f3ce4a042a8d1cd86fab9348eff427f envoy/extensions/filters/http/grpc_web/v3/grpc_web.proto +shake256:b8efb51f7b329e3d2e96c2aae437cf032560c7fe34fbfaf77a0365d6a5d328a52b69a740867a3ef2ada2181764cf30d101901d7002b95f61550066299ac98924 envoy/extensions/filters/http/gzip/v3/gzip.proto +shake256:defe095f840705fde06764b61993b1b63a99635418cd6eff220e8d8334a5aa736951e6b6e6965e598965b41437f2bbbe49719722399ac062e4d4fb82b9cea4cf envoy/extensions/filters/http/header_mutation/v3/header_mutation.proto +shake256:47a85b1ba384f1512d854424c1f56d8b385ea6444b86df61c1c4710c3e1ad7f3a33fa02802e7c75a49654da1427a0efba7764bc5916bf6de58428cd63693ded1 envoy/extensions/filters/http/header_to_metadata/v3/header_to_metadata.proto +shake256:f865f9d2e827432ef4c8c9e0ac8e846235caca27c3660f45be67ac76263d744ed14229a30cf92c60def1be82776df857bf578d08ffb9cece051b72bd8241e24e envoy/extensions/filters/http/health_check/v3/health_check.proto +shake256:769f5cdb800441cbde268eab925fcef13eedc109348b6caf1b6ba31804fa50182f0a4d0b4f6ad674c51051b80f7cfcebb64ff71a890285b13fdb301220f5954a envoy/extensions/filters/http/ip_tagging/v3/ip_tagging.proto +shake256:45c4c0ac25f4b6ca432de42473f54e11620bf8b355c27c242ab40a0d1a215e889c98a4a36c61680b8f3873a9f886317cc905d715dbceb3cf12da2c5a9c8be57f envoy/extensions/filters/http/json_to_metadata/v3/json_to_metadata.proto +shake256:480fe0447ce1c8c566a733d914442215bbf5edd7e6af6918efac4e807fe990abec31bb5e72d3c5decbdeb2f91056fc31f8d1a24700adb5a70bd750470c381948 envoy/extensions/filters/http/jwt_authn/v3/config.proto +shake256:49399294c8f69e4092b27abaf692a23c812c3f687661268a7fdef357633f6092e9b7949537e203c81ddbe3f2d649636fc5baf98a298a4e47f654b8b5e473902f envoy/extensions/filters/http/kill_request/v3/kill_request.proto +shake256:671c0c38410ba087095fcc257e77261d170bdca8d0ed3c3f9150e302792944f3ce16544a52738be37a92cb3b9dd5d33c40f05fa967695ae0d3b790b8479865ed envoy/extensions/filters/http/local_ratelimit/v3/local_rate_limit.proto +shake256:d97a77149846ad07022885e6267e9a5eb5185a1ab83729a3d0dd4f2edd902d4fb00e923c90173539e72954d993c075ed1db05e5cdaf92a3e324fbd325c3edbe3 envoy/extensions/filters/http/lua/v3/lua.proto +shake256:0714db48ed84ae812c9f70b086a460cbd06cc56e8a9aec3d6c10eaa7ee5c9f0e4bbf316e51070cff08aeed02624a34e96956ddee5ff25aec0613a0e3deff93cc envoy/extensions/filters/http/mcp/v3/mcp.proto +shake256:b8cc3aad08e373430341aa271264b049929ebce00d1e2f69771e1f970604efba7396bd0cc8e5dee629c1c556c817423dfac16bbce88ab7081e40888c3f59a51e envoy/extensions/filters/http/mcp_json_rest_bridge/v3/mcp_json_rest_bridge.proto +shake256:215924db62d3fceb150319e0f9426b9ccf5056399ed051eae3252cde40bfc9476a15ce3c50047e6132875e8ab586c86bdb31e03297186593e6da09ece69f47c8 envoy/extensions/filters/http/mcp_router/v3/mcp_router.proto +shake256:8789f8a8766b74d0084215b44531f7583fab7d7fda35d1e18d3ea5f9315b3ecb4c0e817d3acc110d0891cfe01ce4b2ab27fd18b9fe63a78beefa95a9918fad04 envoy/extensions/filters/http/oauth2/v3/oauth.proto +shake256:fd2c273b62f3393a47ba7268781f55343d960d6d73d11f37fadb455f1dd4c1d4180fa119a5599ba3434e1032314cc1bf08482ade1ec956fdde963c996aacdb10 envoy/extensions/filters/http/on_demand/v3/on_demand.proto +shake256:1d3227dce10e77b73f813d975d24dafd38c5d3ab6a2491a45f3b56a4e8d6412a9b7d687db0e83e300672d7e1bad9998066dbeac43580d6027713e2793cd44e30 envoy/extensions/filters/http/original_src/v3/original_src.proto +shake256:d5176f9cab065fc232e3b5d4d3926abcfeae942b92fea4fe560f60fc5f854c23a36d118cac46cef1abef62ebbccb5d1805d7fa3157dd6cfab8a4706a4f0bec74 envoy/extensions/filters/http/proto_api_scrubber/v3/config.proto +shake256:18a36552f74feffb5e870e31aa73db971de269d00a5b11a0e727722f894450a10a09768b71ad75fa3e532732c65427bfa87772fbab5180477d39765cd27f4e12 envoy/extensions/filters/http/proto_api_scrubber/v3/matcher_actions.proto +shake256:61fa4bc0c15dd4f8db3915ce16d05d830f94e84503ecc3dbe95d45282ffbe1b37f6103c91c139b11893438f0ba0fa806b4a73deabc0e184235739b994264acb0 envoy/extensions/filters/http/proto_message_extraction/v3/config.proto +shake256:bf95c1ca561ecc655f47a4e5221ddef23cb62faf0ff6388cdf2b51bcf34f5ab4702411cd94f5e0a5e7889a8cf90a57e30c400bbe7e5e0b32caad87e202f67172 envoy/extensions/filters/http/rate_limit_quota/v3/rate_limit_quota.proto +shake256:292e42dde6932c1148c0c59b3fd91973c690820e8908070d383c1e4dc7eec495a3f07018c61c578b282c22dafeaf83f102500784cfeb90ef9ed269abb7c5e038 envoy/extensions/filters/http/ratelimit/v3/rate_limit.proto +shake256:0ecfb10ccedca83b3f7d88257cf2f82c341acc72d04085dcc65d469306ae5e2af7b8c851fb0347033f98decb8f571e4c2fb0ad941f11592fc9095eb354d89244 envoy/extensions/filters/http/rbac/v3/rbac.proto +shake256:dc63fcce9d1ed50b4322387791cddf8c021412eb8dc5cb27e63eaa51cb5aa48ccd055477b338e95e007371d79d994f3839140015015bbd8ace57ea993261494f envoy/extensions/filters/http/router/v3/router.proto +shake256:4f6237ab57ff613d95e3b9f9ec380142454c200e4043a624d8647aeda312ee2e16e1eecb33f8b88730ea02a71ce5044c949a42f117830bd4ec8b724256201200 envoy/extensions/filters/http/set_filter_state/v3/set_filter_state.proto +shake256:2d8d34eb836ad52142372664bc0d5e2c0a3432beb2ac2baf5e5190bedd33b625ec3a4c646d45bcf3612ee34b4d27bd598ccb957701ace8adc2d69002d03e1a8d envoy/extensions/filters/http/set_metadata/v3/set_metadata.proto +shake256:afaad9e459e62a9c787edc64889fbc6e2e57e544dac8cdc521a68fdeed078e4bf5fa5de74265ea738f94ff0ef783ce824ec7f4e5b869b9f8946b6133567a0331 envoy/extensions/filters/http/sse_to_metadata/v3/sse_to_metadata.proto +shake256:61fee391431b5282046a8291b84e17f9c225425b25ff7ee3893bb3360c31cd15960fa97d6b468f62d493aba0566267ce8c47107d8e444d11ae81a704462c0389 envoy/extensions/filters/http/stateful_session/v3/stateful_session.proto +shake256:7cf78e9c1627775630db0c853ca3602c21b43a5d2abae605e1e15ae338498104787d3a8ccebeb93e93ed60f546c1ba3734c4201e9093e245b02b6fb65e6efe86 envoy/extensions/filters/http/tap/v3/tap.proto +shake256:43e45fb3e4a545ad85e52c78ab7a51420e9394fd1f861c4dabd90a19c084721263ae2e4aba91ea48fb9d1f0c1a8ba626850d45cfbcac18042ef50581fafaae9a envoy/extensions/filters/http/thrift_to_metadata/v3/thrift_to_metadata.proto +shake256:3d4d166abf61af4d0844593c3eccc0196688d3e6f40ad4092df9b75534d8c9d3110083fa6237da870e34d7f04602da74c67dd184e9108c2c51a2cc15b0e69649 envoy/extensions/filters/http/transform/v3/transform.proto +shake256:62ca580d449d9bfbc44a50576ce74ae2449838aa77333ce29b32dc1157ce4f5ff9bbc5f55e8aa47bee9c0a81bb311656458254570cfac7c5755baf1a54d1199e envoy/extensions/filters/http/upstream_codec/v3/upstream_codec.proto +shake256:7be62eac9f7e39c3ffa0070ae67183e9f795a6da804cfb80fa698e74236fa7f2ecca7eb7643750881ed954e23e47121b4340fa8b834924fe235b3f22001af52e envoy/extensions/filters/http/wasm/v3/wasm.proto +shake256:bb27c6ce8e6b0e1896bf9c84bbdd8ff0bbc9232ff56dd79d741cd58c8359b9aeeab360d902e99ff96ecf5e8123fc57923d0eeb8cd1ccc9b2dfc070ac32278fdc envoy/extensions/filters/listener/dynamic_modules/v3/dynamic_modules.proto +shake256:42754ad153b616a11218efdf3758ef197b6fa86a79b7eb54c2a69dc7a8a7516f277f13d417a2edc1da4335c1bc7ee788ba3d004d94db1ec2fd65d45033a95d8a envoy/extensions/filters/listener/http_inspector/v3/http_inspector.proto +shake256:ff875be86e430acc9cf5417559b1dcbe9908d93fe650a8c2bb8efa1477380310cb4b28e2b99f0123f63ed403e02b86e7d4b54bc6ac4321c1c39d4bb49724c320 envoy/extensions/filters/listener/local_ratelimit/v3/local_ratelimit.proto +shake256:4a6222cdacd18827561373bb4b265bfd8fce19d1d0ba98f8684d4ab00c25df3e828b5ed1b2cbd5613098947f3fe6a6cb4f98a4328a087affc3e5500cae2a8152 envoy/extensions/filters/listener/original_dst/v3/original_dst.proto +shake256:66ba94f4db7b435bf3334fd6f1e9cff5cc57a16f1482473043266888af1de5c3b367cd3597eeeb2f651479fea2131f6dec7bc2060e1a2b2137ac07d5886af19f envoy/extensions/filters/listener/original_src/v3/original_src.proto +shake256:2acc9f14baef8fd67df524cacd3fbac587f8f59708c0a8f3d0a254afb9e554e38a8ad1cbe13a6c23a63b35ac3ad58782c49c658a6451b834588f03c91ec2f1a8 envoy/extensions/filters/listener/proxy_protocol/v3/proxy_protocol.proto +shake256:b5e9b3d848e79b2ed596d66d6aedd93f5a0ebfb98c46a2ff57fe2217c94b0beb5dd7fd3b63a4c6b66aa7445bbeb30deba24eddc29a70069c04a7877e79387de1 envoy/extensions/filters/listener/set_filter_state/v3/set_filter_state.proto +shake256:9ee0b29aed3777812c8d5348bdc7ba125d07c57cec49e831873382c2cdf523b4b5e83788c4ab5ff7d68154d00ba17f627fb92ddfb625c6cecf43b1b3ce9860aa envoy/extensions/filters/listener/tls_inspector/v3/tls_inspector.proto +shake256:7fb4a9e553e835261f8b5ceadaab651f2c62e087b21ea911fa73f93a7a225280400dae1ed41dc8c12e6e48ae03140ffa5b42703fc4108bb4e8d3c1d46b1c01e9 envoy/extensions/filters/network/connection_limit/v3/connection_limit.proto +shake256:e25fa5bec0ccbb67c93a7490ef54159ef21897f7152d693133098346224b8b3fe3f7384397d2f8fb9c1bbc019ff7af93e107fd157194eae16066f7cee812dcda envoy/extensions/filters/network/direct_response/v3/config.proto +shake256:cc08f1da65cfd2a369dd00ebdcbeaec212436b7447914ea40ae9663db6b0c8d6383a20833d8b1f7c162fa0ef55cb159f578c1d596f51f7da021643628051810a envoy/extensions/filters/network/dubbo_proxy/router/v3/router.proto +shake256:4aa8fbb891c4f33443faab88bfcc469e6c43febd790ae7a42b2344f15da519a254362c1033ad0eaff1fdaf2d2dd23d6ae8ea6e1eb4fd2222b512f248b857be7a envoy/extensions/filters/network/dubbo_proxy/v3/dubbo_proxy.proto +shake256:b5aa593876329390075e36b05896ba1a53f7a6cec718f0dc36fb4d0fbd23426803ed3a035b00082a296e5e0bd54d3b8e321407bf87c2342b48c3941255a942a9 envoy/extensions/filters/network/dubbo_proxy/v3/route.proto +shake256:559ebcaa55111ab6468aa3becc83cee62b89554441a4c3f3bbc949a5c06c804af371828dde55be57224733c59abb4eb046427361d8a0edef8ce9f8ee459007b4 envoy/extensions/filters/network/dynamic_modules/v3/dynamic_modules.proto +shake256:6bbcfb264094ea05e42dde37d991b735d59286c5aebcf78d1b263379541f1fe2119ea72580aecb53edff47bddaba873e1badc96d73956ae64923e472ffb537c2 envoy/extensions/filters/network/echo/v3/echo.proto +shake256:3cf58f3f20d249c51043cd45dc319779001d676c9496a820b242ca3271fdd6df5d2672b8680db80d48c77d43da36d2137ddb8353952e83745219860a0ab131b7 envoy/extensions/filters/network/ext_authz/v3/ext_authz.proto +shake256:cc3a720d04c0e522647d43261115f11d2b41a64d6c7a5670d69b0acf4abdfada1d10c21a120270acfc3b9adfd3b7307f8361df4bf40dd0715ebde4f1ae634e34 envoy/extensions/filters/network/ext_proc/v3/ext_proc.proto +shake256:e457b38d22593438c13d6c7c1e8034c1f26880994e3a0b1f0bbfa70fb8fee2af67095abbeb8d9a2a7a51f6d1b43d4c466f63f22f3ebd1e9b4fca5e403f58637a envoy/extensions/filters/network/generic_proxy/action/v3/action.proto +shake256:5d42e421358f8b855a150c085d481c86fc97d63467e349a09ee370b9ece4ca9f324c1ad82216d347ee09dc21ae461e74af87900df20f5ec7bdc4416179cd62b8 envoy/extensions/filters/network/generic_proxy/codecs/dubbo/v3/dubbo.proto +shake256:a2f773aa218c0be748f502dc38227451ffd316db83b6dc4c25c1c38a880505f1fb54fa880e5185e6cb5df419182d76c9142550145a808a8377e9beced176053b envoy/extensions/filters/network/generic_proxy/codecs/http1/v3/http1.proto +shake256:38c38372911fc508b09d7643f104662c8b756deb2f4074cc7786ac71cbe25afb95040b0f1c5fe0ca0fb3e3c048fc13fd47722a73037d99edb18ed24d7171529b envoy/extensions/filters/network/generic_proxy/matcher/v3/matcher.proto +shake256:990910042d14b791cfc23677df7592313d816696cb7c4c9f5d352286a5882ddfd0be3e93e0226daa3d1473f2863ed503b4e076228b93c31a85c56a0ba98a683c envoy/extensions/filters/network/generic_proxy/router/v3/router.proto +shake256:f28e303b2c8ebf38f22f3248e6e949bbd1eb6d08e6700cbc810d283553a27dbe0b04a8c172554efeb4cfe430fe57c0650337be449f6670e8208aecd407cac5b1 envoy/extensions/filters/network/generic_proxy/v3/generic_proxy.proto +shake256:7084f88ef89e808dff1f0246917ce721896f8467b69e801a0e0b4148fa3f71abc7205b0f9e098dc07dfa635cdbf4b514ab410856d3342febf0e308e979bebbb0 envoy/extensions/filters/network/generic_proxy/v3/route.proto +shake256:1a40596b4ce5536642785bc6b04b1c565fba95bc59f0231c0d8691078a51a20b9386c7a23bb31e949c7e06153fe30ef05071970f7378ee176850e2ba1428b1b6 envoy/extensions/filters/network/geoip/v3/geoip.proto +shake256:86affc73c5bb63a417da41b833f706c43013693045ce97dddb2d58dcf8952cd6874d2697b59c83578128cfa2193c9236c5b4e1a419ae969fd1df9315fde2c205 envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto +shake256:668f665598f56fc23cf72fb07af2ea9bd19f1f0f4559d83f664cdbc865d066a9f2414579ce72207fc2efe04ab1cd1175d449f6f572f021cd9c60e467b1b7bbda envoy/extensions/filters/network/local_ratelimit/v3/local_rate_limit.proto +shake256:6ef88675ec00d3aec0ad8a311d84a2296974a7196f7809affe351951d799c4389d95a329bfc2e9b6cdd60bb53f8be6c956c0359da90373c0b226df9caed5bd3c envoy/extensions/filters/network/mongo_proxy/v3/mongo_proxy.proto +shake256:4275b6a6cf29c0bea83f4af29f74d74061d8138bd5dd3fced6b848dd6925e75123ff26b5caec6a391703a0f72e1688eaae92a48fbab238d78669db1b114b4664 envoy/extensions/filters/network/ratelimit/v3/rate_limit.proto +shake256:781b40a8c70122b1a22be027ac05afb870f68a0d6b90894748005adb032e91f1ef800f0d37afa73677b95e2fdf08965b8b9f08388af4a4737e18d84b0c6f3d31 envoy/extensions/filters/network/rbac/v3/rbac.proto +shake256:645d441d2b0d63f29153759dbb3bf26dd41ad19052f28a3309257d4cc452d08b5121b0a42b1f73b16b4f1438d15a4b08161887f607528676dc6b98efb045d639 envoy/extensions/filters/network/redis_proxy/v3/redis_proxy.proto +shake256:f7f5312ba2a7f157bc5e6685f73718984650aedcfaec3ded6e01535805ecc7fe826ab1d6473647e6e9ca7b533306fd533956f31729650c5cec7656ae94adcd3e envoy/extensions/filters/network/reverse_tunnel/v3/drain_aware_hcm.proto +shake256:c0b374171742f42295d7451d3f8d046d3dac45713ce950026ca36f838fb3201c80156d6eb198e19212506adbb16d61a41ac01ffe563e88e331f84f58e7e65050 envoy/extensions/filters/network/reverse_tunnel/v3/reverse_tunnel.proto +shake256:3932cd34cdbfeb0dff85b354d1b42a4dcf7e54c4715c6fb13d2ce16331ef5c0108337c92c9ddbcc5d5915a5dc27602d8a769f5dba97d8f1cf162efe034965dec envoy/extensions/filters/network/set_filter_state/v3/set_filter_state.proto +shake256:25bd66409ff35d0586bc0044e66f1e1dce1d0468827a918b24e47e7d462eed3111f16422598a7178fad89ce05dcf2d2b6a153c88e56993d3448429e83ecd7070 envoy/extensions/filters/network/sni_cluster/v3/sni_cluster.proto +shake256:e3ea7ba1c2fcc332e031713bde4b92e894ad6d650df9355b1d6cfd29439fe33578be62cba39f88f3c8a8845edeb0fae6a15a7874043b40b4f45e566c639bb19b envoy/extensions/filters/network/sni_dynamic_forward_proxy/v3/sni_dynamic_forward_proxy.proto +shake256:1d4dc1e6a0f50919946903618d31b158a7dd5f729328719d0f8be8ba80d98f0e9503375cd1e1ba16682be00de12225a86b31c602e564efee97967bf00fad3cf9 envoy/extensions/filters/network/tcp_bandwidth_limit/v3/tcp_bandwidth_limit.proto +shake256:ca31ea64c3f60b2281935bbb9e7c15b7ba610c02c80f75ee2bbbdd4631b4fc0e44575161eb5252f379f5ea0717b08f23664df6137f519ce900ddabd54a340309 envoy/extensions/filters/network/tcp_proxy/v3/tcp_proxy.proto +shake256:053b0baab6180520c5c2286be33254d0b50ec7c9cc4be9da19f61d59b21025de7de78dad34af65fba8396fcbf45ef35a1db9b7bbc0da489cc723c43b848a9f40 envoy/extensions/filters/network/thrift_proxy/filters/header_to_metadata/v3/header_to_metadata.proto +shake256:e0fbef37510c2cb48041d269bdbf648a265a2ab859daac9c0d7c16c9ada91d4f4d07854e9d3af7f3f4ce92f7838625e603afbb92ad7404f98def19eead357875 envoy/extensions/filters/network/thrift_proxy/filters/payload_to_metadata/v3/payload_to_metadata.proto +shake256:c2810280f8595c193b5c9cef0cf1b664046fd568e240e3169f6c5f9d98b223c83e2e7850b7b4ebdb99fe36e7e493bb9d9c500303465f9295e32559175c943d7d envoy/extensions/filters/network/thrift_proxy/filters/ratelimit/v3/rate_limit.proto +shake256:0c8fceafc6119af0fcea55ccbcd514a77a471f822e4f8cf8ba899eca1392e326aef811bcd03b5989e4cf3832aa0a6ef0928ccda72f5f0becb9308c2b37401d64 envoy/extensions/filters/network/thrift_proxy/router/v3/router.proto +shake256:dd60313c8303ec66220535b1f1089c4c3670f261b5ca1c85eadc9ad1686f7f16e41683ef86c6e1c9d6e33a8b1ef892a03b5652b8ae9ed9631c6e6ff35cdfd211 envoy/extensions/filters/network/thrift_proxy/v3/route.proto +shake256:7ed9f82e986f8b4536bbc8343b7f6a20bb3b1c5f53e55266d00792f55d7a2e08ee9400d9feec448c38ac7abd5a6c4dc80ed20a7f43fa8b242ba6bd1945b56183 envoy/extensions/filters/network/thrift_proxy/v3/thrift_proxy.proto +shake256:1d16001d635cd983fdd0021dbfdb73f87efb41508b6cb5e637ab343f20f9bac8e0419ab3be7a5865c908c4e8d1317f29fcb6682991a2c76cd523091e875d6f66 envoy/extensions/filters/network/wasm/v3/wasm.proto +shake256:9ba04c15ed1a83409dd6102333eca6f31995c479bce9d0af3584d600599a877e31e6b4aa76ac8b0767384128dcefe302ea6f0836a74dd648ef86b6150d00ffbb envoy/extensions/filters/network/zookeeper_proxy/v3/zookeeper_proxy.proto +shake256:436b10d2ed00bc25e99d66c3078c9df7f9270226426b2518204f3d8dcf6d9c589829f8dc4a2c16b64da619eb3f33eee945fd8c1b6b4c80428048b96411ccb511 envoy/extensions/filters/udp/dns_filter/v3/dns_filter.proto +shake256:f1b8280cc604c780329caf36ad0e5fc63be76a77f28d552e14d17024ddeceebe7fde9b9744a8fe5499bf83ff26b10cb754d8e4ea5c5f5e00675ae56634d89ac2 envoy/extensions/filters/udp/dynamic_modules/v3/dynamic_modules.proto +shake256:ce2cc8854cf066d5af22d29382cf8c48fec21386ea035ef7a6e7b6acecfe9e2e32575c577e2e3905de816cee3e02f9d2baa653e15a4283c9e1783aaaa269ce08 envoy/extensions/filters/udp/udp_proxy/session/dynamic_forward_proxy/v3/dynamic_forward_proxy.proto +shake256:c6845d45deee6f291a0e50876d86f32487b77bb8bd6253e86eaa4a05c96d90c1f5998c2f034936a044fc26d1921bbbd1b972256ef1560f74aeaa98febc5e608d envoy/extensions/filters/udp/udp_proxy/session/ext_authz/v3/ext_authz.proto +shake256:12840ff55337412639f5723ad910c1a12a665f9d1a2b949de3df273d49b3998b79d093fa550d75b87d300b7ec948ace5d9f1dd15fc4f086ab987dd5382ad3602 envoy/extensions/filters/udp/udp_proxy/session/http_capsule/v3/http_capsule.proto +shake256:e5efd7c39a13bd85f51e45e06146e65abbde3d1755fa33b1f04cff6201ececb28c9d18cc9a216db49facda118f4a2a777415e418688c98cdd0d9eae78dfd069a envoy/extensions/filters/udp/udp_proxy/v3/route.proto +shake256:d471ed2f786afbbda352903ab63002898eeae4e36fde297b9037752c1f060560a835b6bdaeadbbe62f13fb821a71c4ea64f5057fb4cfadc1747c2c30207bd5af envoy/extensions/filters/udp/udp_proxy/v3/udp_proxy.proto +shake256:ca7f51d5d43c160f9241e19698d8e240e2f3fa8d2ce3453866a3054116903aabed25541fe153fba0a900cc544c2b2be66247ed291cf1633b7fd291650c8790d2 envoy/extensions/formatter/cel/v3/cel.proto +shake256:5acb21e6a80670f6186504c7a0c5bff6d3b54423c829e7390e807b170c1edd8e1de482212b36b5cf9709ce80ca824185b44f11b38bfcd10400d98748e38731a7 envoy/extensions/formatter/dynamic_modules/v3/dynamic_modules.proto +shake256:235ea9784a64a6ac54dd57d627c16d93c642f25a9aa463e2e249abfc6c652f0709ed3d3375428cf7664afb5773a0eb297c5d48ffdfb57f7529b3e28829dcb8ee envoy/extensions/formatter/file_content/v3/file_content.proto +shake256:c833a876b2df74ab0f5fc98642b2d3d526526ce1130718f9d2d0124703d8edcf926764e6ebcf252f0b32d47bf86ce3edd091df433b3df8c35a5dcaa822ded134 envoy/extensions/formatter/generic_secret/v3/generic_secret.proto +shake256:b01b9c08ea0d0da34c23042bd8da58ca40d92f1f7346b2a922c78409fa0e51d0b0acd6787de220b4b32397f96bb0acf7edd8ee83131d7b27524cf538b96c7bf2 envoy/extensions/formatter/metadata/v3/metadata.proto +shake256:fea0013ee58d5bab8985c8ccc364e378f131377f0f7caf0f94c06e4222a973dcef18c139eeba10ce16454423547376d1f32850321f8721621344f2470a29d4e6 envoy/extensions/formatter/req_without_query/v3/req_without_query.proto +shake256:96629664c7c164d5b09c236350eb28c92429295779ef16310c26d29220de1b7e65ac18544cb1670636aa7ec7eed11350aed1428ee425c317eeb92a8ce41cf4c3 envoy/extensions/geoip_providers/common/v3/common.proto +shake256:7612c46eac426d19af9cedcef0dfc3307ddcc0135198548676b789bb15ae69cb0bf62883344bff9c6019492dfce5c03026fff6a317db73f7ce90cb8c4987e722 envoy/extensions/geoip_providers/maxmind/v3/maxmind.proto +shake256:7f89d816c9b3dd99415e179c26bc1a20c9404b6bfeee89f0e0f6449ecfe84964676d13b594b72f0ae8a8506128500e1e16f933ce8df9d394d1c0c4b45813aa17 envoy/extensions/grpc_service/call_credentials/access_token/v3/access_token_credentials.proto +shake256:738f54621e145760f7b19dfd49f2a1b93f3e7e906e90b0d10d8020dfb60671ba007e5a16ad49b43c0f17c26263ad7b75037096c0d099ab9b3766a134b967f4ec envoy/extensions/grpc_service/call_credentials/file_based_metadata/v3/file_based_metadata_credentials.proto +shake256:9b994b424db196e4024393e9773eb91d6c04f40ff51d62ddc3c5be89bf43a44361f944a70c2a1ef8c60e03fd31bf84b4f94a86b60f0ebadc2c8693a8d50bda2b envoy/extensions/grpc_service/call_credentials/google_compute_engine/v3/google_compute_engine_credentials.proto +shake256:3a4bba752e25fbe98c5decf5fb7cef33f26d62cb772a1090a70f52d120f0649f2dd7597c650b360e5b8cb94c73127bc4218ea40d973b391377fe723e65f0297b envoy/extensions/grpc_service/call_credentials/google_iam/v3/google_iam_credentials.proto +shake256:287739521df4ccf47e2466a84022be6911d45006c26e28da2adadf3c8de7173b3d1677c66ca4b77e17a9fb1b672f484df217e1b4611c93488d60245e6e44e1ad envoy/extensions/grpc_service/call_credentials/google_refresh_token/v3/google_refresh_token_credentials.proto +shake256:c4f207e0dd455917f2d2ff262738b2251f0ad9e2089ee7eede8bb1db6616c30ab66a50aefa73b453651d3354aff71bb825481afce3d128202e1e1df32242e949 envoy/extensions/grpc_service/call_credentials/service_account_jwt_access/v3/service_account_jwt_access_credentials.proto +shake256:e15b227bff5203ad4e5f26f97f15b19a8737d04089d7548c23a541220080f846ad5c4417fd874560786f53863bc4c76a04dca54138758749257029360097bac3 envoy/extensions/grpc_service/call_credentials/sts_service/v3/sts_service_credentials.proto +shake256:baaa05a38dbd4935506087fa463cfc3a8835aa79213b713885956c4176beea297948117e5ed8dc6a3d1dbb56730ee3f9af5dd3e452dcbc366fc9ef4bb1387570 envoy/extensions/grpc_service/channel_credentials/google_default/v3/google_default_credentials.proto +shake256:4bcf0fe81cddf339e3add76e432b404823cee937521b87cfa3d3062cccc6737ea842028dab050f99f4aeb2e8950ed82e359707125e6093916f8fdcc6a879f8e5 envoy/extensions/grpc_service/channel_credentials/insecure/v3/insecure_credentials.proto +shake256:bb28c723bc3100a46e0f6df343066f7360925ecf2fc8e6c85b07bf99d452c1777085d39e189ebc8c38142048aa9b0881481de9b10ce0c667c18fc0f12a6dfefc envoy/extensions/grpc_service/channel_credentials/local/v3/local_credentials.proto +shake256:7215f9898193b8af53eb913822e4a62030a22efcd12ab8b10e268e0a04ed5c2c6e5c827f445c7948a594fc9baaeb9dac34dc6cf9bfa1e76d4e1d4273bd9b1b87 envoy/extensions/grpc_service/channel_credentials/tls/v3/tls_credentials.proto +shake256:ac5ba8062d33e4d5aa748d0361c4432c67fc338e29d9e413c1477e57967de535e1f79f135a7ac836cfbc32678b2ee1862b0d14315c6faa0912e542d24be2c20f envoy/extensions/grpc_service/channel_credentials/xds/v3/xds_credentials.proto +shake256:4a151f7408451fe2eae927cdc8ec73a2fda8de863151640fed965d0b7330a60578db177089f2e7811a050de2a800c7b62d15047a55d87420f86bd910ce437587 envoy/extensions/health_check/event_sinks/file/v3/file.proto +shake256:d5574d9597be5b91e315b55e6d7a324d2aeb33a071a60bbe07936e8768b4c4e733e3c49b2367304dec5f3d28c4bbcc67d46d9401362a182dcc6f90f0335c5e21 envoy/extensions/health_checkers/dynamic_modules/v3/dynamic_modules.proto +shake256:227bef7a6683e83eb2544b81cddf8d085d588b5323cb3a70310c6d43083b1799ed370a67042e8fe15c9a4766b7a0b0735f21a7fdb7b642b3cd528f4c66dca8c5 envoy/extensions/health_checkers/redis/v3/redis.proto +shake256:bc7fad5e1d7ce4fef15a7f97c8d6f3e66f6601c90c4c987ee4b14457e84b0af1bc51015a816b5b0077924c2278a3e55df3b3682ed0e75d6988890b70febc8966 envoy/extensions/health_checkers/thrift/v3/thrift.proto +shake256:ed2b6a76c3a187e8fd6cae370d0e0a787eec1d4dd807e2e13c170dc2635fd149848cc080915dbe5ffe528aea043cd97efebff4cc691f99bfb3c1aa81b3da3066 envoy/extensions/health_checkers/udp/v3/udp.proto +shake256:1cb3ae86b15ae10d4d2c3c77435928b9045e591d89911b9e9ba6036a0d4168903ceff104d31f4227306495990f38fbb599b8eab0fcd14ac9f9ddbca40e4cb452 envoy/extensions/http/ai_filters/request_info/v3/request_info.proto +shake256:efb8ed39a57b9e43f6bccdb2ba69ac487f4ca21e429d3ee18923735b02fa24373c7ddfa0c54c36121a32f857009e7224623e4397901f2ba732bec021a5f85f63 envoy/extensions/http/ai_filters/schema_validation/v3/schema_validation.proto +shake256:abb4aa6b05d3254ac7b504949e4a35869e6e7b4f179bf99a3c9c99c02d3abd09271999d73606cd35b752dacef15d7ff9c238e4c34ae29e768e322dddfd2b6c30 envoy/extensions/http/ai_filters/transcoder/v3/transcoder.proto +shake256:ff9835c6f498d4d3c8ff151878270548673fc15db88f48aaed4ae4c8c89baa1080e829fe8276d2b014fd83653fe04c52cdd9b2620fe8c88c456942bf0e96588e envoy/extensions/http/cache/file_system_http_cache/v3/file_system_http_cache.proto +shake256:15c5fe0f88d3faf64dd64ae8c4515a10bd20819565f23b202cfbf8e908cd252bb279458607dc0968e021728e44b716e819d802926956f41e91dd1cdc932e783a envoy/extensions/http/cache/simple_http_cache/v3/config.proto +shake256:df1206e2109fc9b8c5709f4ca2b97bee1b542246208dfade5d301f75f7c2465784191d253bfd96459324e467aed1de28e7af8b1940363ebce406534008fbd60a envoy/extensions/http/cache_v2/file_system_http_cache/v3/file_system_http_cache.proto +shake256:7a766c160b8106c34fe067b54d44f89736dc070bc115d8fe475172b262c98d33b717fe58c1561bfbe44f3fdd5856120c2583c7fc1b38d0099acc3dd6d5ef76c8 envoy/extensions/http/cache_v2/simple_http_cache/v3/config.proto +shake256:b6009c26b7776e0bceab6afc8169b410ab78ebf50b780976d7d335b3240280d8f929bf2c6b7d18546986950a5f85b6bd76c657f087a56a0b47047f133e63d43d envoy/extensions/http/custom_response/local_response_policy/v3/local_response_policy.proto +shake256:4950afe9d63476b20e8bf7e1f474bfdf4e9f3dcfdffeb2e51cbdb84314bf18774b60751e5c756922e4356b5a7751b0177d09b344fec53b1183749dc96ff03196 envoy/extensions/http/custom_response/redirect_policy/v3/redirect_policy.proto +shake256:3fce8ee954a7306c1e9a2c1677cd9d2f41d394195e46eb905de6a15cef7af99f8ba98a17183c1a9292e67a06e4333031c7f8259f77584dd2a34fd371a88a565e envoy/extensions/http/early_header_mutation/dynamic_modules/v3/dynamic_modules.proto +shake256:7f0e981a037ddd48e37e73f0f9dbe999ca911b4ae917b5ce06123a733bbc220bd5ef3308a7c3d3ebc64604a83c3349c06e12cabfcd64fd1a08c1260a81d1ad2e envoy/extensions/http/early_header_mutation/header_mutation/v3/header_mutation.proto +shake256:47e359ec4e204c0d7623942989b9110e37eba23976d1f484b6b699644afc2b2c19ceaa307ae3827f4d34052c819ba44b66fe289ff63c2d25ad8fecf8b7e3c03f envoy/extensions/http/ext_proc/processing_request_modifiers/mapped_attribute_builder/v3/mapped_attribute_builder.proto +shake256:5999af4497b9ad766b8edfe2fd866d2c76644b61ca5351763e96fdf5b043326589afd770694056b3d7ac0f87a6a4914f6a95c48e8e00d57389c3e06d17cce570 envoy/extensions/http/ext_proc/response_processors/save_processing_response/v3/save_processing_response.proto +shake256:15603a2e7434422fedf63e85f2c2476e8990b38abaa85ca316216a0177dcaf3ab60481c0d312615bb7e24f0d333e508e42f2e387df060bc247aa0afc00f01857 envoy/extensions/http/header_formatters/dynamic_modules/v3/dynamic_modules.proto +shake256:a181479f6dc29ac082a54cab8fb709f4bca39c35d1be062d830a211f03df0b549a2d18dc7eb2cdd34e6b4a6388959760a63225f012255b6ca285e6b28dfee5dc envoy/extensions/http/header_formatters/preserve_case/v3/preserve_case.proto +shake256:114aef732cbb5085916309eac9a199ad819ae7fd22780c959e71bb2c4fb739bb0dbb7357e884dd2879f6407df6158c298da830f0dfaa8a4cb7ea442fd1206f93 envoy/extensions/http/header_validators/envoy_default/v3/header_validator.proto +shake256:34cdb621792ca31ddf9dbd9d82b80ebd8fcf1702b92790ed8f3ec8117b754eeac2fcfc326cea1adb4e55c1691749dbfd552b014e4f6b02312cce062f06286441 envoy/extensions/http/injected_credentials/generic/v3/generic.proto +shake256:87e31fc241a567421582a7a3c738c6e6e98b1bc47d59881d2d16274e437565af2aa4831a2248ba3c4fa6380e25a43bde5d2bdb7953140524e4ce00c724827bcf envoy/extensions/http/injected_credentials/oauth2/v3/oauth2.proto +shake256:97a7c1a7dbec726161b4b980259f51744f4839253f20752e51c31213c041d8109c85c29cae138e7d575ddc27f1edda599007802ebeaad57583b5f5c45b93a4ec envoy/extensions/http/original_ip_detection/custom_header/v3/custom_header.proto +shake256:7019fbab61a8adb1bb613ffc714c741a043d90d5c8fe10f77d87d9e76882e2824bbe92b137736cbf32d17d79051056a7f02e6ccf57ee5e002356c4df121ad6a2 envoy/extensions/http/original_ip_detection/xff/v3/xff.proto +shake256:dc55ecb0f8715e8a44b37595950f7660c38048cc7f8c1ead8f859889b189c8a27b060357d6ca46069aa73566698d6180126288480df5780e1703a1acd71b67ad envoy/extensions/http/stateful_session/cookie/v3/cookie.proto +shake256:dec5e094a90a34c797d9a57d4ddc8c503bf62dbba0fdb84df509d681501b529932234730ff2083e4892fafdcc61ffb4a5e0b2ac72f91d45e14107c46be9ed9ca envoy/extensions/http/stateful_session/envelope/v3/envelope.proto +shake256:d65ef8c09d91ea81c580be40025e8d47304949e771c7703878c9401eb2890424cf3195259c57e36ccbafc723e4f2453d38b5cff55bca01d885dc9919753d6917 envoy/extensions/http/stateful_session/header/v3/header.proto +shake256:f4f40da154b91c5e812b9052ebb2f40e2a2197abcb0da08c06f80421907fe23fa51d2cdacce3c386013dee3e5012c333486f41c7482cfc8746e196b999762fa5 envoy/extensions/internal_redirect/allow_listed_routes/v3/allow_listed_routes_config.proto +shake256:a981530941912b70abd63742ea0233867d9f8d8b82cff5c37abebbbdb10b21dd3991551fa21eeea1156d73c6cb8e4fc8db3186a620798942cfe59c043b93f986 envoy/extensions/internal_redirect/filter_state/v3/filter_state_config.proto +shake256:3a0fe2dda37d6ef760596f9ef1217837d0ca6045f0b4e37c2bf79d3c9d3d2462fea787b78107a364b2d5dc20d05c5487b10b53e8b5bdcb95cf01848a07708ed2 envoy/extensions/internal_redirect/previous_routes/v3/previous_routes_config.proto +shake256:9bf7115b738e507c09777b248ae7fcdcffb7908769d316c479b6cc6a526deb0d599e6b9f9c7f64afb2d6b193f54aa1e7e7a846ffa73294386db4c4bf9adb6f12 envoy/extensions/internal_redirect/safe_cross_scheme/v3/safe_cross_scheme_config.proto +shake256:6a007316c0ee2726a32af18a23e61cdf8b129c7ebb01f3cf1e101b0a18c47e78d5f14c2584c84b23e58f6f52468be3b2c4c175bdc7fc2c53e2668afb8b8c5677 envoy/extensions/key_value/file_based/v3/config.proto +shake256:861a39e8e20680fa4eee71ecb7708f708f3edc6b176590d740a0193e9a0cd81c87b7a67d0e73044a02fa8edc2977ec8c1c81d801a3fd9c7eb13a16c3c178197d envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.proto +shake256:0116ad69672ab05cfdf0c0d476e470bb880db0a497883377aaad5d1bc443a590f27681c2abd73df2ca19de21d330a7de69c8be19e15e80fec3f257479a9c4a93 envoy/extensions/load_balancing_policies/cluster_provided/v3/cluster_provided.proto +shake256:7617bafaedc15daaf00b90c6fcdb3078dcba4d99d0d280ebadd1e9b19c871ca9f3374e9cd358afd91c0d232a75687bc861c7ca3ffdc48d75d6fa82c9b6aab406 envoy/extensions/load_balancing_policies/common/v3/common.proto +shake256:6dcbe87f52378e27eb00d8a6512887c67f69cc672b7351f046694cae52e4f0b6ffa5d48f598ade81799dbbe84172d297e79c6beda4db9f12f5621dbf8659bacc envoy/extensions/load_balancing_policies/dynamic_modules/v3/dynamic_modules.proto +shake256:25c22487c24a950f4300c5082e57ef5e5a965b863668b8f3dc9263a861f9505c8849013aca73a6fda9112fd19c6451400e3d225d620c315d673bfaea1bfaf168 envoy/extensions/load_balancing_policies/least_request/v3/least_request.proto +shake256:51c73a45a7d0303da413710d7aede53de6c2a518d534240ed63be5e0d1697645076f435852dfa46052a8def20d02cf325e199712660391c7776b7691f8a34175 envoy/extensions/load_balancing_policies/load_aware_locality/v3/load_aware_locality.proto +shake256:82b636496e8c69961fc462d5cd88bbde2493a146bb59458ae0b28842006ffa025388f9f604a014f145c236c938eecebab3ee64a2d77f83c4497e8009c7e955c2 envoy/extensions/load_balancing_policies/maglev/v3/maglev.proto +shake256:37bae37d222f8f1ff12c8b6b8295cdbc5e965791ac9188d30204dcf606e803624ed3a4e18654f892db5c1f8920313fefd9ae8556f2382f6cb1fadf114d76da00 envoy/extensions/load_balancing_policies/override_host/v3/override_host.proto +shake256:d88e3d6952bc9827ef7e92790c4aa7bcddd81486f4a3162afe6c97e0ed3281b85e94cdecf5c4100d9d07a151ec6c0e0088641dcdf09d2e67d425ffb46907bd2a envoy/extensions/load_balancing_policies/pick_first/v3/pick_first.proto +shake256:14035bc49cef4a7e0d25930d409af20d8f74032a102a88953dc77b620205df625bcadfe69ec9881e73481b3b23bfcfbef1b87247460be38e68d749291af318df envoy/extensions/load_balancing_policies/random/v3/random.proto +shake256:056ea98f23a22a25955841d4606958174b1990f85452169d990a656b9fd06d8131521516969d1b0e21d6d6615e1b99e48d6795eaa1442b06f62d236b13d43c02 envoy/extensions/load_balancing_policies/random_subsetting/v3/random_subsetting.proto +shake256:6ef8080f4b9cc3d9766a69e26d789b16d149e6f0754b7f211038e2b657afe4560bcfe34fb2f2e025343c7017062a83642e6f3452c74838788c0b09cf25a7f56c envoy/extensions/load_balancing_policies/ring_hash/v3/ring_hash.proto +shake256:691efa6e69d36bef31bd84c3002119e91a7ca7efaa60569ab0c18f4e78423f887086eb9db941806511d78bf6061c257c99fcb199b060c9beb7f4b1c5666aa8d3 envoy/extensions/load_balancing_policies/round_robin/v3/round_robin.proto +shake256:fa99fb6373f07bb327f4c8c0f0f8ab64c3a839ba4ad393c7fdb8d05056dda912fee08bf412db38d93348d23371fbc45c6f9d02c454563493a811b3979bdcabe5 envoy/extensions/load_balancing_policies/subset/v3/subset.proto +shake256:c866183a84e3031e4a37288a46498f7e38bb7b544267a8ccdcd7c4ba4e9f498aba720e36f94819ffa6d72fdf785aa4f7d16b3a5a4262a697634624976f92d793 envoy/extensions/load_balancing_policies/wrr_locality/v3/wrr_locality.proto +shake256:c0db1853e908e8135812c85e8a3a1a62c5c85e470976c46d8e9664b930f4c4aac87e4c4a81c4a8c514190efef87e2a92d80b763512663bbddcc13f5af9bd8608 envoy/extensions/local_address_selectors/filter_state_override/v3/config.proto +shake256:acf4ff9c546497c44a9f5e040898e1d8e9cd8caa73add2af8152815a327db594286d7c3200c81165c72da67a06fc630cdede8bb66ac706d1c2e86b42cd743330 envoy/extensions/matching/actions/transform_stat/v3/transform_stat.proto +shake256:1e37d347ef665bbf89aa2437a21c2bdeb64e7a303eb2be072a786af97d4ba1d76063f1f2026e2fd2f3c22e542c4b0c8f319a6899108dfa2d959d5a229c73d656 envoy/extensions/matching/common_inputs/environment_variable/v3/input.proto +shake256:ce21d7db1101a8a8b79497593efbc032e91b4e8da080074a586618d01f82861eb0d73d92e9274eabb8ed0afe2ac1243b3024f8497d35c9ec227ade235f346524 envoy/extensions/matching/common_inputs/network/v3/network_inputs.proto +shake256:d227dc732d21538dabc1aebbda1423e1e7edcf9fc3815d7161a5f2451956ce6b7f0874150246a1128d8cd031d59f6f237df8d27624d44495eabce26326aa5f43 envoy/extensions/matching/common_inputs/ssl/v3/ssl_inputs.proto +shake256:8a545f6c3ca62dfe9a7c26ce58617fe6a752fa76b9fa0cbf747d41fb7f3c4d0fad3370f0597ddb7a6c7a6940433fab76d8cdd27a3174a9944b8c4c3be44afada envoy/extensions/matching/common_inputs/stats/v3/stats.proto +shake256:37161b50fb369c7d99d81420e78eb5528031cb8963387b21f3b16a346425d4a48cac4fa95d2398dd4a8556927c12a6af6b68d36b65c8babdda818d773cd3720f envoy/extensions/matching/common_inputs/transport_socket/v3/transport_socket_inputs.proto +shake256:82884d480870e7153f8bfb1cd95ac73ee60488fef1ddba0730411cc230cf26550f5c2ff2cf3e78284fcc2ea0bbfa911d064477252122d27b2c230b20afd38837 envoy/extensions/matching/http/dynamic_modules/v3/dynamic_modules.proto +shake256:c8ad4158166bc5d9552173149b76287d35e0f142457740a971d8d50a1a31ca154c5bac3aa8265d1abdf9cd0223643afa30db998c0e354f26ff66035b0fc617c9 envoy/extensions/matching/input_matchers/consistent_hashing/v3/consistent_hashing.proto +shake256:27ff670b92e98a70aad2c1a5141da88e37caa55a8152a66c3c32c0a483ce10ce24afc2b8a89149cf34fb3cde1e85460c0da591f6da8035e02de051d429298a41 envoy/extensions/matching/input_matchers/dynamic_modules/v3/dynamic_modules.proto +shake256:8f1301b6a4f15025967881d846e1866c0abd637f645202da0137196db618f307bb3be31429d6c841bf642556fbb0a8bf964ed90bb144ef921d062764444677e6 envoy/extensions/matching/input_matchers/ip/v3/ip.proto +shake256:10c52742299d0dc8b6eea424790a9f44c39f28b204d7ad0af6da35fc33d8a3f89154d42d769eb559aa0acc28a9e6fd896d2a6560fd95c91afe234d4e75636915 envoy/extensions/matching/input_matchers/metadata/v3/metadata.proto +shake256:88434c32dad5c61f6898371ff51de383160f36ee292c7b46983de2a4d54a0af20843221b52d8061759fa9b4767a387f4891c3d9aabc1bb4c56faa6d3e7a3345e envoy/extensions/matching/input_matchers/runtime_fraction/v3/runtime_fraction.proto +shake256:84fa5b00e53d153b1958f4cd8ec6ca9702f27208f44b546a259e3935d899d4d7cf80cda04664f71c289b33e3070ff7b37efb5a00170bef7945b3451bffc60330 envoy/extensions/network/dns_resolver/apple/v3/apple_dns_resolver.proto +shake256:2427c045d79d2731c598c802ecf997935f8195ddc454465c8dcfe7d9f3d20c4304a0ed54bf57b2530d9cd4f789fb1c0c6da605ec3aae83bd1e6f9c5a3408e543 envoy/extensions/network/dns_resolver/cares/v3/cares_dns_resolver.proto +shake256:4c84314b7b487a19899212080e03bc56720f7a7bd9d2ea5bb5096b3afffbec2db6459fca8b4b919aa6ed7d5bd57947588cf58d5720d4a3818abf018c3ae42abb envoy/extensions/network/dns_resolver/getaddrinfo/v3/getaddrinfo_dns_resolver.proto +shake256:86abd3fe28157697761afbf44d695b5e10253790c51245796c511e963f613a2d68b18115c994b88a6e676c269e5bf34d65de23a6fee5d650472c3eb4dd4fccb5 envoy/extensions/network/dns_resolver/hickory/v3/hickory_dns_resolver.proto +shake256:46b90ba66398297fb23b255464df3c9aca2058cc4b25ecec7d843c087a6419cfa83f4278dd00a6ac6ccb2bf946b139f225c591a965532bf366569829f2e824b4 envoy/extensions/network/socket_interface/sockmap/v3/sockmap.proto +shake256:c0b8cacef281eaec500f13691e055259c28c5c56f06be4393eaf634ad3ecc9cff662fd9847c14a0b2b7a2992f0e3ebed1d324ea209a3fd242253184083e533ce envoy/extensions/network/socket_interface/v3/default_socket_interface.proto +shake256:feee06cda1e05a53ff064f726ba892b2bdc07c192adcc50052818cb62ba1880cce1a559c352f35dc45eb275e8fd8fdde3602257ce4742d7485de67a77b6485ec envoy/extensions/outlier_detection_monitors/common/v3/error_types.proto +shake256:ef828f1761de1b5bcf19f71e99c4874d4b1e33475fe7ee3aa1c461d202afc3e4ff0ac4e3de52f4ef8c79f700ff481b6af3fa25084856e80a05b9181a9aecb701 envoy/extensions/outlier_detection_monitors/consecutive_errors/v3/consecutive_errors.proto +shake256:8d63a86e1ba331db3c1eb63403cb19840d08f75120d4e70dda5b508eb588b9d2ae8c7772bbc76bb08139301074b556635b685264ca462c1392d37f808a927ca4 envoy/extensions/path/match/uri_template/v3/uri_template_match.proto +shake256:4c14d13dd9e1e782b7a0dc85854642bfb2df4839adc50747cc71fa12c706d05a544208edeed5c5245f3506dfd83004a899d96d8fdf39dfe653382e92e8b6a3cf envoy/extensions/path/rewrite/uri_template/v3/uri_template_rewrite.proto +shake256:9d8dd4e7df146f83d4a9605fe559bbeff256984607cafc46f468c1b226deaf8c93d0dccc4020b3dc6d10c7eac2c409130d2283da044e87b9fcfef706b58507f6 envoy/extensions/queue_policy/fifo/v3/fifo.proto +shake256:d77cca717af1b36b3af64c7621f965ee6eb7288b95939fe5c280e564f38faf46bbcd539a0eb8f535314f9cd2900e2db4b599e94bafacabc6dc4adf0618f3e548 envoy/extensions/quic/client_writer_factory/v3/default_client_writer.proto +shake256:f7680ea8269c00d0a1c18ee2f3af1e75f8dd2c000c5e8b943910b9d94929ab55ee5d987f52e72a9de04314d7b1067f32b720b754a90f86de61696b264851498e envoy/extensions/quic/connection_debug_visitor/quic_stats/v3/quic_stats.proto +shake256:1f74c6723791858d9dea2478140f942cd69348c0b3914dc9e8e0fdbeb37ceebdec52d13770018d4ef0b13b65bdf421da6211355bdfde5cfed9b71b4b20532c9a envoy/extensions/quic/connection_debug_visitor/v3/connection_debug_visitor_basic.proto +shake256:72e84ba56fb274e08743442b26c1c033122e8c3721eec53b45d4a9f1e84a9bc7137041480a46c801003c458b2314b8b7f908f326362e26a9503d8928b0bdde51 envoy/extensions/quic/connection_id_generator/quic_lb/v3/quic_lb.proto +shake256:b35b11e7deba787adcaa488361dce33d97804b1f276dcaa3c936a50dea030722b9d8707590b3d9e29093061ee67c6eac3ac1d107aa88d58a209d055674198b6a envoy/extensions/quic/connection_id_generator/v3/envoy_deterministic_connection_id_generator.proto +shake256:0d5c109aec1c8a34845c051213323cef13b8acb789a973993caab647c2015addd698e8b7d1df443e81dd966f198cf9029f3ad8e941b1308837d6e317212c2b43 envoy/extensions/quic/crypto_stream/v3/crypto_stream.proto +shake256:b81a6625d0afccd2d290f73787080f319dc2cbac737ff9f655a40d285847b80de77e5b4361d6f5208cb68e439517fccbed20d590e5ce2b47e5276f73a614764e envoy/extensions/quic/proof_source/v3/proof_source.proto +shake256:65be7ddec7f03e73203304f27b2dab6c0adb2f96bcf27859e458d1ee924c4cc13224b7b78b298e07baeedd9bfe26dcdb04c95e93363c32a34ae919edd722c46e envoy/extensions/quic/server_preferred_address/v3/datasource.proto +shake256:bd5330bdb3af2fdd0d6c19e7d2dea7f1f9f3a33b23b8abe7b3ce5e00986ce129e525839820b220d83a2778cce498c427cc8b81685d7e47fce1530bf3ec6e891b envoy/extensions/quic/server_preferred_address/v3/fixed_server_preferred_address_config.proto +shake256:2cb8ebd50ee8f7dbe73b59288a57e8ce66169d0cf29fc0eac26709c6284e36e54582383668fd57d81428187b36b4c2c551b5a4192091ad7d7e8afcae14550e78 envoy/extensions/rate_limit_descriptors/expr/v3/expr.proto +shake256:697ee83d1cbe18b6c803d53ccc7161b52abd0362079be6744fc2fa5d5bc8c6db3d06c76d009d3da91a1d3a8025a9811d30282a8dfaf50fc23b6cfd5e104ae7ec envoy/extensions/rate_limit_descriptors/jwt_claim/v3/jwt_claim.proto +shake256:efefeef95cda09d43c21ea224d984c6164d9eda0b5c74dc3103bb2125bbd19f6296557896636464cb6df3ece2ec78f92554204f6c2e8d269cc3ee78ce8952891 envoy/extensions/rbac/audit_loggers/stream/v3/stream.proto +shake256:12e6aab5a6bb2b487e96b85d1df9a327e4915ee2990d1e5b335a5d02b5b5ab74ef3e5357fb7c01b07cecce676349c9023fdd5fdc3954ff85a32e67232ca01883 envoy/extensions/rbac/matchers/upstream_ip_port/v3/upstream_ip_port_matcher.proto +shake256:516e7d1e52f23285dc29da142505c4c5b1752e48f9fec69021cd8df1e163ed5a2c0be22dce9f050ce81f15e9ed3994403e598ef577fad62f829f6fc56206f1c1 envoy/extensions/rbac/principals/mtls_authenticated/v3/mtls_authenticated.proto +shake256:ed50a0a24b7ede925b68420c09fcd56b455eff0efa60a01082c77f61835ce52d988901474e3c3003545a1c8c16e6d97629f4d23e543d06041237fa650a8d0f5e envoy/extensions/regex_engines/v3/google_re2.proto +shake256:0c367876d65e4a12cb13d075a4b1fe22f867b59210e8003911ebd930e58e1909087da0cfc5f1e6ce3ff60bcafcdabc36bc76314974623961a55e55b18cd80a28 envoy/extensions/request_id/uuid/v3/uuid.proto +shake256:298c4e17fc11e286b92291f710b2eda207d4bfbe91758e2f81ca934f7d1d1ceead2d96629922ca5764920e16f6b57e3ebb91a8ed7ecfe0cc214187d026e83c0a envoy/extensions/resource_monitors/cgroup_memory/v3/cgroup_memory.proto +shake256:f16bf9d750ade1919fe6da89224ba8951dedc35f291bb221ce5a69509caeb2b2b0c25b67e5ac580b9b7119efefe37cf900d978acbdc147470c8fbba3f326de15 envoy/extensions/resource_monitors/cpu_utilization/v3/cpu_utilization.proto +shake256:7f052f002d7e537933393a868929ec03b18b400819f44912c47f99a8fedfcad3dd11b77aeea43550e0ad5615384eb09f31ce8fc3db239543a1b92a6a003aa7d6 envoy/extensions/resource_monitors/downstream_connections/v3/downstream_connections.proto +shake256:408e426cc34122459981ce3a978710b67ce7d2b5d105e81434799f1b916114bea15caf7249eefcb47e4f4bea89667852b7a1c8d790edb5a8eba00adb260309d7 envoy/extensions/resource_monitors/fixed_heap/v3/fixed_heap.proto +shake256:a99a18f73f95166d72f4daad65414723da4f3979be982e87e6a0e2e5f3a49dc5b0e49ff4f35c775aa48f3963d1522dfba66b7fddf1e13019b7503920fe7c0d62 envoy/extensions/resource_monitors/injected_resource/v3/injected_resource.proto +shake256:2d3237daa2aabf8c1379f7f16a5d10b87e41171a0eb5566e64b076fffd5725149040bae21fa5ce5fad3a244ac4118d9d90fa9b99219795648b3b39d2d85dacce envoy/extensions/retry/host/omit_canary_hosts/v3/omit_canary_hosts.proto +shake256:fbbab489437bd68a2d6dc6d762674947e94a5cbe005136ab35ac841b1ebc055df5aaf1c93e371cb4ff75dd84e9d5c13e8f581e87a2fc3ce70f84ba444abd4cde envoy/extensions/retry/host/omit_host_metadata/v3/omit_host_metadata_config.proto +shake256:541e01abca6919462a0d0cf1c85380321afbd0ad796915fa5734c13420603761ab956dfb51a4b1f9e3ed0658eb36f8e29f98e909044efc4998b5f0ac3187f895 envoy/extensions/retry/host/previous_hosts/v3/previous_hosts.proto +shake256:03777221093ecc5820256aa74fddbd488cbd21276dfb6f4155c379078d8070b1757464dfd3d657139733272d5f2308140af8fade16a491757156a9c96502d146 envoy/extensions/retry/priority/previous_priorities/v3/previous_priorities_config.proto +shake256:57a0131334ad804039fabd14a613f7da33d577319612e3d1fe920f1ffe46bbedfdd8ff7b1c57394e1393e8a6b4acc5508a570cafdddf72067303154f09487f45 envoy/extensions/router/cluster_specifiers/dynamic_modules/v3/dynamic_modules.proto +shake256:73aafa2c0d0ef67990969355e95643e8194dc84941666c70b9a1aeba1b4be20bbe8091825f496c26ec52f2f1ffd837abc2255b67f7e2a4a59a913beb20898b44 envoy/extensions/router/cluster_specifiers/lua/v3/lua.proto +shake256:69537d185104e9a65353c4103e9446f326e66207e18b54358d25f14660db77ce2a8a0a94d67d0b6efef5ad70a47174a259a61ba874b711062b1ff49f29bb37dd envoy/extensions/router/cluster_specifiers/matcher/v3/matcher.proto +shake256:c5fd77fd6b35a56306fbd1f9ba9381a940f3d5ed2c6046e2f4ebd4ee5bc2403a39616e299ea51a73a3dfd46d329b89cff851e849b31c41db1161b9a755348b93 envoy/extensions/router/cluster_specifiers/priority_group/v3/priority_group.proto +shake256:7218e21f8ca32a4ffd9ba9412c292991f1e79673548070eceb807f2d5fb7c07ad2d88f23cce6dc9cc2859751d1401fc9df818185b9e1b7d8a1b4c98156d54b6f envoy/extensions/router/route_specifiers/dynamic_modules/v3/dynamic_modules.proto +shake256:aed559c90776a842f40524ddcc51368ae77724cfe51c655c10f86868020d01ad1576d110513a45eb0c53cc30b84fa43b0ae590846bae684a288d9667a882975d envoy/extensions/stat_sinks/dynamic_modules/v3/dynamic_modules.proto +shake256:fb0347fc4ce6ceccc92eb0a4b1d11c85e083d0e53bf589723455727ad13b3051f4be549925782b798fb30a98a7fcbf1e57ab882b3a41fcab6217cc8a2c454e77 envoy/extensions/stat_sinks/graphite_statsd/v3/graphite_statsd.proto +shake256:2493a7eda4bca154b91ea0cefed9b3256f13d1896a9265b4306e8a29cccde89e26baa225880cd46f877fed825bdc337aaf045ef2ed42786eaa2124f221e3a3b6 envoy/extensions/stat_sinks/open_telemetry/v3/open_telemetry.proto +shake256:af239d758d000d60037294ba32773a6c102bd1a2de6c685299e94f127f09445a72a9f88821459c921fae1e9f9fe71259a20334fe4e9a96ac98e8efd59c9a5d87 envoy/extensions/stat_sinks/wasm/v3/wasm.proto +shake256:d7f75c34e0b7f8789150ee0eb5b19e71db666175432858ae35a618e1ed1d11c22833a10b0b7dab072dace62c6128b14ba0c1aed987b36594e77a0d78c4fea8e8 envoy/extensions/string_matcher/lua/v3/lua.proto +shake256:a3abcb3f73ba7ca43e6ea5dc856cf78f13aaf8be73249a42afd62e7d8af953403982600344f0f505cbb732bfe729f93170a3b6073e143c2430503482475682c4 envoy/extensions/tracers/dynamic_modules/v3/dynamic_modules.proto +shake256:6e72f2f15a05142e84506fe9c5e5a52365f4bc84a2832ff2920e05e5a770b8c065bfc548f30a152619c7d1089aa835cb82fb1180cc1ca1f9e4125ec5b9b6ce15 envoy/extensions/tracers/fluentd/v3/fluentd.proto +shake256:2dea78d980bdbcfd314655d85f68cdb80170b1a3a26689033ce3ab8d6b2323ee2f5f9ca431521c888046b1f67fe1b1df7e1b41e72a9525255a892647d03ba47e envoy/extensions/tracers/opentelemetry/resource_detectors/v3/dynatrace_resource_detector.proto +shake256:0b54ea2b09ad005e0f28e296f023999896dd1007d70b19359a8f771f82b222bf2987c8fbf517530c3f45e6a4319efc8aa63af3bad9659194a52854bfa39e7491 envoy/extensions/tracers/opentelemetry/resource_detectors/v3/environment_resource_detector.proto +shake256:5371f5be86060c954b6f8ff11aa8a8c8b2ef94175278fb84547bcfe1bce1496cbff48c324a90b2bc59a57f5d622bcd8be23f907252238be7e3cd391b241ffe18 envoy/extensions/tracers/opentelemetry/resource_detectors/v3/static_config_resource_detector.proto +shake256:d3ab1839e0d23b7027166b6e3c4ed1eb161268611607a79e8a0fe7c3d6ab5f744f66f925ea3390a6031fcd8aeae23c4711e4b5c8bcdc92cd8f4bb8bb8dc89dd2 envoy/extensions/tracers/opentelemetry/samplers/v3/always_on_sampler.proto +shake256:5cf81b0cf871e6a216da80ab14a9e98d6cf071015137f1ebe567f5710d7122832bce5e3eb9e99532ecbf4602248b7c3f995a48c09d48bad6cfed8958fc3b8145 envoy/extensions/tracers/opentelemetry/samplers/v3/cel_sampler.proto +shake256:265484879d7ae5d9a0bb600cce1741b0f6d64ae04be75e7ce927c771066a565c54e1d99758ed3f85a04b3d17dd087018ed6fa0c21f46f90c59fb2d1d4c50cc67 envoy/extensions/tracers/opentelemetry/samplers/v3/dynatrace_sampler.proto +shake256:541e1172fd525e99b287600e7a58bd7b2bc7e0eb07514d8cec74002aadbf0c5385f93bb2efa3ab1f80f98e009996bab83fbb3bca3a19dbd394153172960781f4 envoy/extensions/tracers/opentelemetry/samplers/v3/parent_based_sampler.proto +shake256:e4b240ec009feb9dc7a44a85a04f71753af28a2ca562c606283a22d87d2b8f96dd9898bd34655f72259ac17f177c3254ffcbafa87ede213ea3a9399aa541b716 envoy/extensions/tracers/opentelemetry/samplers/v3/trace_id_ratio_based_sampler.proto +shake256:5b0a26f3fef746f0134abbfb12488a75cb6f71f1fe32cb3010571df1c61a0cbd9c60dcd14f7518e5cab37b005ba0bb90a25f0e4c6d1095bcfc75046023720725 envoy/extensions/transport_sockets/alts/v3/alts.proto +shake256:d50262cdc4cfa7209865e048fd309455614d591bd62fe394513489dc3b7b5d487e68a4bf65707264c5aa832c65d0b5fec50ad379366ec7ac419625317d735e32 envoy/extensions/transport_sockets/dynamic_modules/v3/dynamic_modules.proto +shake256:2527dc14cd40918626811d9bb44b51485e0274df57d6b561d41d8bc01a9abb1ff838d5f6423c6bbf7fb35698d9cf49e3ead38e3f45b0d9bc1098387340bbd444 envoy/extensions/transport_sockets/http_11_proxy/v3/upstream_http_11_connect.proto +shake256:6acc101dff2f6d9dfd42d93835b7eaab9d899ce27194865d6daa1c171d12bbb277784d478d2f2810f1bba0cf84341f59c7271bf3435d6583d9b6ab8b074123fb envoy/extensions/transport_sockets/internal_upstream/v3/internal_upstream.proto +shake256:432449b6de25f852f1c6d8ebb4df1376dfa0042cfa816a7906cafa4739032b3f66f887a2d85fbc00c2e6fd948515acb3732d7be761bf2e9af2d1739dde866b91 envoy/extensions/transport_sockets/proxy_protocol/v3/upstream_proxy_protocol.proto +shake256:56737f595d21329007d97f5069ed35f24a53dc82a7dfbb32dd52117602f757c96d56767883beadd4b70987f95215e7c8a946c12f8a9b901e4c1e27f9a27e3afc envoy/extensions/transport_sockets/quic/v3/quic_transport.proto +shake256:142e115afeaa6a4f0579552383c702b436bd640e359d05ad2617da6bad6044951b3d6ba0e9474fe34c2ac1e8d8468c0eb6417c4dcbef4317d24a694f65585af3 envoy/extensions/transport_sockets/raw_buffer/v3/raw_buffer.proto +shake256:655ebe077789126227c45261078f8d64dd0d989295108efcbc136d2b59a717c6b2a486289156584173a79a7d90cf9429b8d43154cb534cb1aa671eb6a3abda22 envoy/extensions/transport_sockets/s2a/v3/s2a.proto +shake256:b65431721a1a46acfdd0a792ff8b87e2aa557a27cc2e8db151f97d02da20a70f02cdc21ebf72656e165931fcdac08deb6e3075d4431fc4bba160d3a8455776d3 envoy/extensions/transport_sockets/starttls/v3/starttls.proto +shake256:b55ba8ad8802bf22c4a8110670ff402dc1d61dac65692b1d88e05d4ba9b937c0e7f9549c93127bf58a5d01deeb5d09d115fb2c9ddcb71aaf61aee0643e40fdc0 envoy/extensions/transport_sockets/tap/v3/tap.proto +shake256:2db6ce813ff15044dcf88785d43e388e2bb26d59cf4015c0630a6cad9a2439e82f8bd8c2b254c420745604abadf2da52ff4da9bb3c6dff6fd6431eb6417a88f3 envoy/extensions/transport_sockets/tcp_stats/v3/tcp_stats.proto +shake256:fbbc91de81f1f92dae79116f73b0ca0f85b9a2c8b84f3f2628e90da14632bd639f559092fe9f964b4079c5efdef3ee539cbd7f6179136aab4bcdd51fb470134b envoy/extensions/transport_sockets/tls/cert_mappers/filter_state_override/v3/config.proto +shake256:f9b7269bddff63967913951d1a2b7f26a6b4f5801f8cf72f588ab5a2ac4f5327b9221d16ac4110b6688757df796084c485bc602fb7c63412b2d3665cc174d8c6 envoy/extensions/transport_sockets/tls/cert_mappers/sni/v3/config.proto +shake256:10eee635abc4bc9035d7c3fee3bf5459aff50302192c37f03fef2640149c4907e474b43bfbec062fba65b56ec84802dd546fd2e0052d9eb7f96f76857e43d667 envoy/extensions/transport_sockets/tls/cert_mappers/static_name/v3/config.proto +shake256:e5dbd1b9e40b697b3127f79c747979d4ed57c6c17d5bfb7d9c63fe02d449117f4d1ad4dec60916c39d170c8915de1675ce3f76b74b2505c5868a496c52ffe513 envoy/extensions/transport_sockets/tls/cert_selectors/on_demand_secret/v3/config.proto +shake256:4faffcc609f77fb1b39e6b4cb78d8ad3d9df19a3a23a99cddc2fd3a6ae17c5267f8bbf2d82663ca8e5033b41c7952850df5da2ff497520197b7852daa3a14b28 envoy/extensions/transport_sockets/tls/cert_validator/dynamic_modules/v3/dynamic_modules.proto +shake256:7a1088075988f4f4955218bbe749da201b1092c5e2f38d3d595d2196f4b36052bf68adb90da1ece5aadd3a17e75b8c5dd3d6396918248bb65d37e1eb4cbfd604 envoy/extensions/transport_sockets/tls/handshakers/dynamic_modules/v3/dynamic_modules.proto +shake256:70c3f79a8f5ada5334027f2ea99ebeee20e3dd431ef94d82eb096355a8aee3784a309eb588ce1f474844ba17fc17b0220fa2470b69908245d6b2ea3aef26c22a envoy/extensions/transport_sockets/tls/v3/cert.proto +shake256:6538be34cd3980ea8e64d2efe72aeaa2b47a6bfc684f66feed463866af9c4a3bba9264a5b053f3f00b72b8795c6152cd444d283810de4f10e91ea04d64986211 envoy/extensions/transport_sockets/tls/v3/common.proto +shake256:d541b64ff4c04ea5298fcf5208c8571980ce1a691fe5c2b86d8f0a94427160e244adb2381204e45d8d237864211281dbd0ab1bc6f48810625310c15af14fc509 envoy/extensions/transport_sockets/tls/v3/secret.proto +shake256:64496efc016e5617ea8758fef8f3e284150617932c6bf8eb9a9a701a375f32c028d7c16c7aa7bedc704e09ae922f2e34d7b4f017624b85e85e62b8c6a1199d79 envoy/extensions/transport_sockets/tls/v3/tls.proto +shake256:87dbfd87aa0ac4c340aeb8f72428fcc3a1b9f5cba458596be1133b585a6a89c099e2c321d70497714b3a115c849055052d44e8259c70bd790bcc539a166d86e9 envoy/extensions/transport_sockets/tls/v3/tls_spiffe_validator_config.proto +shake256:5ed9430060ee0140165e8bb75940bc40dd565350df5c01e0f3e154b708e4d39ebd525fd439a64da2b8656d438a39da89fa5250b721b90f4a84ea1f682b33ce35 envoy/extensions/udp_packet_writer/v3/udp_default_writer_factory.proto +shake256:628eef9f3842581bfef3c63dcb967478ecbf486c3da4491eefa31814f8fcd4d782b9f5fe81454015dfb2762d447fa6561a05622a59d52d34b75591413fea6321 envoy/extensions/udp_packet_writer/v3/udp_gso_batch_writer_factory.proto +shake256:d9b653269e362272e2197b3b31aeef9177836baccff9973c02954f1595fa393da16e0cbd691a9c86d024528d3c8e008a706a640e1b1ac8015e375d7df9399bd1 envoy/extensions/upstreams/http/dynamic_modules/v3/dynamic_modules.proto +shake256:79f80278f4f4e33eb6864b817786b5305cc6ae0da122f53e426e567cea75b910af45ab9cb858c81a91553386afe0ba5f2b0bbd4d17f855b3cd219a0b08d1b4f4 envoy/extensions/upstreams/http/generic/v3/generic_connection_pool.proto +shake256:1bc3d5c62725d72b2b5959f92e15634cc579ed8e136a92532150f83c2481dd0e9f251fad8f969390d298a39b3d05cd33754c8ce9cd994a321a7da9a0e5e6adf5 envoy/extensions/upstreams/http/http/v3/http_connection_pool.proto +shake256:b000ca7a7fe72709f0a48f1c825618331159235a7a5f13ebaa4f89943a127068d2f4ec7a0f5474be7716ed0f461f6bce47ff29389ce27edfbe936e39a57473c6 envoy/extensions/upstreams/http/reverse_tunnel/v3/reverse_tunnel_codec.proto +shake256:102e997c91c76da612869b2a666ffe2e554593d6c3bdd63a5bbc9ac70d1a0064346c9415fa2f74368db77b4c3be872636c2917899d9dd951d959ae52ae15176b envoy/extensions/upstreams/http/tcp/v3/tcp_connection_pool.proto +shake256:d56f95c23b4fd61618df5dccf70e260f07194b05638161cbfe7b1636aff5114d7e90b49660b32891f570dae71fd2484ac392716197e2dea6318c2f3ccb5ee951 envoy/extensions/upstreams/http/udp/v3/udp_connection_pool.proto +shake256:e5c42b5f36a8128ff99b253ec122dba8700caff3e217f16edb1adf4f5d9b012016e1bc9e5fb486e37734b414b2d7ae1ceb535e5b16f4d085429356f7eed34220 envoy/extensions/upstreams/http/v3/http_protocol_options.proto +shake256:622d6f175b2b12659fad78cd611c5393c3866f584985ff06c29e1ab8a4a4628ead7c2db69a6380c7debf88bae406747b39780d23afc07aa17e7687ad45761a20 envoy/extensions/upstreams/tcp/generic/v3/generic_connection_pool.proto +shake256:96f4fcb2c56df1b0b0ac3414449baf6774e2aa8969255016a23513e170fec1536a30b6b4739f314403d7d61f6d6c3c78a5751e3fe112a4f946d5b8e065bea1de envoy/extensions/upstreams/tcp/v3/tcp_protocol_options.proto +shake256:327d9c50181bfabbf3a0c88ffb11199d08a3478dcd2d65daef92d5c6d03e5abcb61632b8dd7cc0dda670a88d444b8785c80c2114f293d43e0f95d17337ef8cb9 envoy/extensions/wasm/v3/wasm.proto +shake256:f91b5c852f8deb71d90543d4713082f71f5ebb19b3d8101deea71513ccecd4b19012049f8f8ca3f4c643e326a44ac0853e872bbe54e31d9289ab563b8a32ce4c envoy/extensions/watchdog/backtrace_action/v3/backtrace_action.proto +shake256:762e5a35ffa359e351715abcb4d10973dc3eb542f39faf50fb2fd1a69d747413e88c992e218bba253a5a57745a384e923a24bda721056db31c0b2a310f80ba44 envoy/extensions/watchdog/profile_action/v3/profile_action.proto +shake256:4996109c5c6ad7c4df245ff378f41569c9323f6691c2f02bf26e6ded7b6059aed8b5214deb18008cf4fdcc9dd12499f170c570d0381ffc656e6119bfdcbd7205 envoy/service/accesslog/v2/als.proto +shake256:f4a29b2899acf38dc693efa125c0434c56847ea1569b056df833528e5a0603b3f6a62df53b9cf40ec9aa06e30b4cef0688764d468a6eb8da3680e99897106a68 envoy/service/accesslog/v3/als.proto +shake256:a8b6784c472dbaa98f1f3fddd68a50f4dfed29af2c11e7cb0ff350275fdc4cf60b9bf9224c06766af0389b082af73d219cd4f494db207ab45fc88edd7c0ed909 envoy/service/auth/v2/attribute_context.proto +shake256:08a77da191422df68e2e2c432f597478b353b8d04455b618922e642f5938513fea27ec1950aa52acd3333b9d7d82be1035e3c0a253e5b97648cff309bcc8deef envoy/service/auth/v2/external_auth.proto +shake256:4eb4d2e4dd59617cf8ed6ba4d58661099422e8ede70006d905916dd5c60c660380fe977aa61f16361fe6d733c485c853c228dd5483dc4fd40ba7961e7319db8b envoy/service/auth/v2alpha/external_auth.proto +shake256:ef19b99ed5f32b4e64a0001c1fa08917f7ab7374852f3599be77864a113908dd7cfa5287be61aa838423b151fe7af3e8193f2569ca452807875b4a2836171aff envoy/service/auth/v3/attribute_context.proto +shake256:27d6937632ebcee64c3c8cfc15890eb8d3193e5fb1c7b419fcb1aa9bf8c0317b947cecc50ca3a205201df37f27856023c6f4be2fb49e4975f953d3c22bf03dc5 envoy/service/auth/v3/external_auth.proto +shake256:2217dc6bf6933bed2e621b0a8a1f9a3ed3b77239591020eda87b0f592c3c00dbe299988b262029e022705549c0621b17dac6f1d320ff3a5dfc5aa07fcdea0e61 envoy/service/cluster/v3/cds.proto +shake256:c1370a13fe2e5e6b894233bb6432a0b8af8ddf1cf1078de0c750484b3055a78f7974a39fd6f1493d7ed485bcb0261715fa1be067c25f43e4f9469f48df8000da envoy/service/discovery/v2/ads.proto +shake256:ee52e1e4dacec7ff8d1a05136a89bdf7475eb1e6efaeb773f6e608a5f7d00379a3d4211d22a8ea82750a6eb36c8034522da5ab99007cef8c989d58a551717de1 envoy/service/discovery/v2/hds.proto +shake256:0318c755e701e782a34e6faa9e63ff5df3c75f4b8c7b78ed0648e1cd5fc815de826d24b1e9cf3908432c2023d3e6e2d7a3018ab2042be851fbfc1f81a82fc72d envoy/service/discovery/v2/rtds.proto +shake256:9d4cd9fdba3a202916bf6cff81d6eb2529974dc817135aaa900e859e678f9420b78821e80e6891bbde807a71bff8b5b7ceb4b3e31fb01a098d0ef252ec4d0832 envoy/service/discovery/v2/sds.proto +shake256:732ae86f43a83be70c45a2938b8d66e20bfc1abdab938a8705ad971039eaf5931dc9414c4e7299acf00c948e45afa5b1f16b70cffd4ce3e33775a88985a3ca97 envoy/service/discovery/v3/ads.proto +shake256:d0363f981b6164e21562c4686a479114fa780df94fce216e2796b71da32440ee994b4df3365f28dd16f6e029e25eb8aeca72e6437212f48613e617a6f0dddb35 envoy/service/discovery/v3/discovery.proto +shake256:e8a56f89e6931dfa885cfd8de54dc6f92ae0164e007d0e5f366dcc25705008c5e263f636be831687f270d531ae698f7350b91623f9a647a242e49cf6b15931fa envoy/service/endpoint/v3/eds.proto +shake256:416d8c86026458e77fe8ae3845a769f59e3845ef062b5dbe6288745598223e2a450d28cebbc3cd8c6bd07f9838dc836ae7a2193a5c4ba81b14b1ff7c66daa10c envoy/service/endpoint/v3/leds.proto +shake256:b5bf9e082c4ec76d09d874ea26f0f2f70c77bf64caf46de1f9533dc61155ad06da023d650ab6f030c67da25f10488b47caeea7ff20efbc574ab3ff749f7e15c7 envoy/service/event_reporting/v2alpha/event_reporting_service.proto +shake256:357a584bbb25276c4dc0262c69fdd6f44fd6eeb08d50a2c4f8cb1b9f2a16b10385df785ca42ae0ca173bf38aefe80b14572ebf939b97d46ee84688218e1ba920 envoy/service/event_reporting/v3/event_reporting_service.proto +shake256:0b4d2556efa7056770dbe60b694e853e411f160b2725e48cbe4c30b254185359096f0fb43375845c9bfa21c1db9f5234f20a0c1ec85deea8fcdbde493693942e envoy/service/ext_proc/v3/external_processor.proto +shake256:d33d7e3c73ba3134309e4646921cb897c06f9ed845e87b52293263592877f35295c22d222464969f1900ed0f8a5eb84b4bf8a154a0603bfbf2fe4c3345a84001 envoy/service/extension/v3/config_discovery.proto +shake256:c7da7d4042efb8fe51bda5cc47c94c3711a2a4d99905018c7900a94f16a468a5b4910619c719edd97ce7f1fa313242f294817eb643a21b89b15ff0f3b12b779d envoy/service/health/v3/hds.proto +shake256:b30e1a9c40bddf8c84bbeeba1c23d3a391a440e0900b1fc589032b29601f055913c7ccacca2e200c1e4db6cb1131d29bf36161e1dd2e54210a9285adce491076 envoy/service/listener/v3/lds.proto +shake256:e6295415f5e5c97db3d7a76bf1ff2fbadc3d0bbb9dc89560869e243b497c84c21b8b811984d03e2f05fde18c0be89b84f3c4961e1623eda41be9e0cc582eff27 envoy/service/load_stats/v2/lrs.proto +shake256:699477da8f3f972de622c6a2945200c249456c1544c0b5890be78007e6b2549e2e7cdea581b0b1648fa45ad472eae3ab70461eb9f05ea069127b8e0d18d4d531 envoy/service/load_stats/v3/lrs.proto +shake256:b449e325335c4a27aaffffee78cd8efd0dc7f341590c6960ca3fc0820cd6c16cd43f600f602b4e505c0bef8ff96397b80fe3483315cb7ab0e8715c7a09f04e3f envoy/service/metrics/v2/metrics_service.proto +shake256:91f3b9e83028d2470ea9cdd586cc834f7e849b3ce3c1deac251fcbcbb7d1384e671a094596c6782563a3a3d2745da8e4a2aab0be31f980968a9a7a7208a8b9b2 envoy/service/metrics/v3/metrics_service.proto +shake256:fc006a5c791b34aefd34bf03e9240479d6721e4e11f9cc9ad368961393267df1818ecf44ea6e68e54183caf179f764cc33bbf28c4c797a6f63f59069d9b748e6 envoy/service/network_ext_proc/v3/network_external_processor.proto +shake256:d914c01bdc3068df7d0d999fbf63b779c0c184906ef0cd922fbc421276263c34bb565b0dd7a4e1b12eb9ca1875088a525f91f4f81aa61aa907ba72b91ad097bd envoy/service/rate_limit_quota/v3/rlqs.proto +shake256:d2ae1ae11068ba99047618b4f3355c6c63b0cadb7f2b92b62ecaa418d6012a7bd2590ffd8ac4f1d30b9586b3eec6d14a8dacf67d7f4edf7f3946eb606609f962 envoy/service/ratelimit/v2/rls.proto +shake256:311a3681f3f3d77ddfc1eb3c82e620bfaf0023946cbebbb6ca684fd9fa164ff24f838a06c58949b09af0fd404700a81e69f0852dc4353c6ac27b3500d5894fc7 envoy/service/ratelimit/v3/rls.proto +shake256:216d9b8b599926c745c66f9213c7158da4d4578f3a014d92900ba387032b086041bf6ecb1335a93d113fa08c10fc5d7f0601f5d13977d11e718820a5f9e30d15 envoy/service/redis_auth/v3/redis_external_auth.proto +shake256:d8c032e24b649e9bcd34a34c1aa7a3301636cac0d28ba8f2f66bf913f4020518c7147c5258ae7456b2c2a9098238e7d348682e510eec4b22b89ef0a6083b97ee envoy/service/route/v3/rds.proto +shake256:851029f814d9f06c8ddce15d14758f3b6bd3a12fc22f94abddb181a557e345053c6d99cef3f5fe00629e1c9880c606a677b3e146a0bc416e771eb63a32928c30 envoy/service/route/v3/srds.proto +shake256:bc3b113db998b71b675b735aacef60a5a44c4e5b4ae806c3451609adaa29d1abde505591df5e59afa71256aaadd47954750fc8d52b23dfb1a77b14a979e3195c envoy/service/runtime/v3/rtds.proto +shake256:224273be92cff332779fbc3c4cc05e9d896f07f7399755eaef09d4393c823c1417db21551aba27d8d638e9d2c5b2faa0ec7be818a80f669bf0bb3f2c050f3bf5 envoy/service/secret/v3/sds.proto +shake256:2e52093226a25dcfa49f732d9eb94d4e0cf45ea33ffaba69d33e237e1b3b57a1c09125dfe84aea26cf027949c665e65a1e0c3816a0f7632bfc1a27e60164afa1 envoy/service/status/v2/csds.proto +shake256:ac4a57cb2f25fbfce2a8daef2546317e33d09d8162447b82d56491df84b4847880ea6fa7048a0d82380191fced4f1caa1490773c8584aac1251b274429a8335b envoy/service/status/v3/csds.proto +shake256:8c3cdd75a9d29c3cab6409ef44c6560d04b701a5fbb750110a3c690cceed6579eebfa31ba1d3c24220fd30311fc3b1fc71382fd75b87617289584cb89614a8af envoy/service/tap/v2alpha/common.proto +shake256:9238348d1c026eaae1bbcb2eaf891214f11caa40506ac196f09635cef0d600b3fff85c7940f470bdfd0c77ede8b043bd595ef40fb49ef1d570d09b974ae3aee8 envoy/service/tap/v2alpha/tap.proto +shake256:7b68954434433606940c6fa3e32b470dfd6bd645d00e45d70292b0590be710452082946dd19eeaed41fe1a01395c093b0b2c5d5b4b5d25d8ed3d758b854dc629 envoy/service/tap/v3/tap.proto +shake256:c30825cda00b1ad243a8c464c586bc2cf4dcaaa39da6603372e44ace30b5ecc2e4851c3d1254a7411ca4e2cf9bc5842d7cb3dac42477895f561d3e061e9c5ab4 envoy/type/ai/v3/llm_protocol.proto +shake256:690a4716c9c4c5360fc02c82ae8293203c13be4e1134f4d0cc335d6a5da7215b3c0d5448c04926e3e06a790c0a4d012054fff23ac609209e9c1cc3c2a32319ec envoy/type/hash_policy.proto +shake256:d19e024e24adeec5f0b76401119a091029122e4ac3f8a3294b47dca1ec8f8f65ae752c85d68375097421fdd0a5d5cb795603e2d721c5be802b8425f2ffae6755 envoy/type/http.proto +shake256:f6c1ee6c7e0835c3eb5f79a4b6c82fe6cc0875db25649420b9b074f0de7457c89892acc979e2fc37a5ee1b46f441635d19ed243505f0fe47c67ab56472d02474 envoy/type/http/v3/cookie.proto +shake256:0ae546ed47fc0e7f7067fe017de48efd5de4d88d4aa1fa4df6b9eaa51531830675076ff50f13011b4e5d1244aefaa3475e4102f25c9c07fe5fd4f93cdc1e9f92 envoy/type/http/v3/path_transformation.proto +shake256:9809a923db1af1a7ddc5ce050f7cdb9161e42b486765f9dc4c278ca55245897e524ece578d9200cbc16e5dc558b6e62ae0ad9bbbb28f0256444977007d125bf6 envoy/type/http_status.proto +shake256:c72973b0f8238dcde807395ef1b3722004a0fdd34c3e08118914285246babaa837ab4e1614f9a1cbeb93d3d8942f316bc870fc9d40afd1df9f4e08362694a784 envoy/type/matcher/metadata.proto +shake256:4a704a75f9c4816bfa4ab17ae4e9672b1b7e2e5a89177d4413ec3c13296e02918fc511aea1ca3e67bd4927691065b038392f5f6370780b78bb0b3c4fdc77e4b4 envoy/type/matcher/node.proto +shake256:0f00d2d7c167ff88b003036b0cc735fa7d839ab1a914fa03e38f9e67f8fc010fc50b7e743322141d3932169ed51fea1481af7bf5494ba47bb8793d932fba51d0 envoy/type/matcher/number.proto +shake256:4b05ff8e5ecf96d4a5fe628207d9ebf496207b03bdf7a4ca919821744ca76c715799b5f9bfad2caa1dce7d9d1941cc89fa84272603bf7081200f4ba059a7cdba envoy/type/matcher/path.proto +shake256:f64d77676fe9afb578981a25087575bd5473a0339bf128c008b266f89eeafe4615208e0ff2f3b82f9a3a77152c7f8ce49adf14fddd1c52e67362b44a3ab464cd envoy/type/matcher/regex.proto +shake256:cbd2eeb817c033f1083f650aa40e899eccbd5fb928901b2b7d00090a3255adfd14ee71f696ee01cd5db9ea298c9dd1a080ec578d94cdfaa0326b0cc014bcba63 envoy/type/matcher/string.proto +shake256:839ad15eb02acdb2dae9af33fa54e09d1681db3309c2cc28a5a83ab7490f8881d34487caa3e13c1cb2a10749f5f8d7c3c0ae43a69c2c1a9e6c11e0f91ef0834c envoy/type/matcher/struct.proto +shake256:eea057b217ab05e62596fe425a5113b5be7ba039f1eb674ae81328d6a527fb8c2753efc2cf7506f0be75f565bee3aa70ec51cb2e2e95ce6aaf0569843173f2d1 envoy/type/matcher/v3/address.proto +shake256:368384c1f18c40e250a3c223bad867c16c2171e4f3e81dc0e64f95ab0ac8ffa138e3615f975ff473c19ac9cc1de304ce6de23935424d7246b15449a70c8a1f55 envoy/type/matcher/v3/filter_state.proto +shake256:5f019ed81965c01108460610edac0725a6870e0fb85ffd2a1f64af152acb81e1333c24ae15f1c4aef42584271bac8bc6b70e1101ecbcaea42bce4661ed61604f envoy/type/matcher/v3/http_inputs.proto +shake256:125f10e793bed8cf67953b7f5509561afaf62088e12d3e09e386e745a351a7c907684a4978bf06333d9016ca027f19f4dda33385651c8ddefabf97f5809324c6 envoy/type/matcher/v3/metadata.proto +shake256:80fa673ba90f13a4986f6e6119784a9c59c841826227c38ed3ff837bd8213e9cb9a831a890f524b01f180664bbc8318ba8ecc52f7ef10fef2e5c55024681fca0 envoy/type/matcher/v3/node.proto +shake256:5cdefb24c00ba89be1cfd0ff3f0d1e191b0679d13a1dbaef9fcf16075c0d8d5e4f29ee460c29514b12074b53343198695873edacd165261d7ccccd4a4f590acb envoy/type/matcher/v3/number.proto +shake256:6332bfd31883dd3f0adb9cf32312f33ed4405ad8c371f60d6c325b8c7ca490760c0900c78c141b38b46d042b8155f141cefad9a6b3575f8a218ac653b8c4158a envoy/type/matcher/v3/path.proto +shake256:e34e7701305faf83076adebc1d9369573633e627a0e88a9c53fea1ab24a0e2dd400fd6772d75babdcac0174f54562e006792d65bf9c36565453b229ef02e0ad5 envoy/type/matcher/v3/regex.proto +shake256:8bc193ee6750429235cf2707073a86b5799c243d431fd22fae1dcc1034a34b302494989b269a1a11226c1c5c7f110a8f50c403e8d176d03483322c033c7bda63 envoy/type/matcher/v3/status_code_input.proto +shake256:5fddb73ab97242cae4a7799462d4ff64408489e07cbf4443cb5409f4cb666c8aa5165bafde373670a5db0084f80cca5797b63aba31f893174715e3be15c1dab5 envoy/type/matcher/v3/string.proto +shake256:0f38a58bd6eeba1aa88f3a5abdac8668f2540c620fcff2170763d93a5f764ef6694c0630c311d919fd8bc89735a5effcf50ac43fa77b2073392eaa206dcf501a envoy/type/matcher/v3/struct.proto +shake256:ad88cc2e97d5cd12d8392a43fa42460b65a2a3b23825c4e14ef43fa2f559eba6fb9fa12e9d07072fb67fd3c15db9339ce70bcdd1e88476a0864441e122395bab envoy/type/matcher/v3/value.proto +shake256:2894818b159d82e436454b897303459c693593507e5ddfd71291a3aafd6f5e5ff829b72738d56910423f1f06c8712d6c0968db606d275420b4ff2d333d7e8b34 envoy/type/matcher/value.proto +shake256:c61a778022e769b7b86a6f2cf3311fa799234b4b8e8ca8645031605c6c6879b72dfef9928703ec02fdd24618b3afe1adcd0524d60af763d35dfb0c81c7c08c4b envoy/type/metadata/v2/metadata.proto +shake256:374b75100366b366afa9c14d5a1ef45ed82771f5e1b4d532b9345288365e1dcd5457f78e446ae5dd9aae91ce9e3c434c4e10ed242595aae859891f0941318035 envoy/type/metadata/v3/metadata.proto +shake256:ddfe76d43d5adbe5f2cbab06d966d142799b6cda620586672398c31f0ce34c0573112c6c55d9bc01e71782626d3808ad13f7c9ec79b00b430e3c77b788903156 envoy/type/percent.proto +shake256:17b206d1bff0fd1139d6be415b51e54947515ebbaf3ef6cefbe3849d2038eada9ff6bf7b1297066f624711966a9637ff3e78086274a5209f9d053c4ed7e04a6b envoy/type/range.proto +shake256:161720c94d007dfc3bd529c5a702119b85ba308622708caa6f942415e70c5df4615d58692574fcc217f07c11556c64982d94408ca3a1f78659dccbb96f31e8ff envoy/type/semantic_version.proto +shake256:b135fdd513959ff7a4e66d9935e9cb29f5ddeb4fca8e2e342fcf382c6f8e850126491d37a6ef8e234713490e4e95e8ed8d043399fce783d0398652f3c8af0667 envoy/type/token_bucket.proto +shake256:d201238906946214da41f85403023182139eb36c964414993bb659243aded648f4988b0a16875a6ee6e1e0bb1211a2c86a85b416cad62d4d00417a69fcca5d85 envoy/type/tracing/v2/custom_tag.proto +shake256:a3a4044bc25774a45116435a3c732620914ef09f490941d06b6762044aff4c0624177cf96018234ffc8ade813db3ae8a4e83749b72bef469f56903f473fa084d envoy/type/tracing/v3/custom_tag.proto +shake256:884e6803443363459542a1df859f5172ebdf5cae23fba2b2695a471af539c472d410bae54566813d865f05e079978a26c3406e174bc4076aed578ee6b690f5a1 envoy/type/v3/hash_policy.proto +shake256:accdf2d18598af1d1796c3b86c759c3fce8f3a076c354569191f9fb2aff09da01e4ae863006994714383af109df867d87a7a2edfe275996e56a8935da1a77283 envoy/type/v3/http.proto +shake256:d202ec6e99b45a8e9a5671718b070c368e6a5067194ab1c73da32705d28d45802db75994b6e5fb938b9bf4bd2eff59d52dddc8797e085ee99ca6a8d6db475de8 envoy/type/v3/http_status.proto +shake256:93083c00b1962447c795b3c85e8f291fb8fe80688209e48f07f1924b717fed0f76daac681f35b9da6f8719e77156feaf858694e8181df4174e450b46d499a478 envoy/type/v3/percent.proto +shake256:2a803a46ac7d02d32b5208db241509bda30e370014f07f211863e6086ac7ff1ae0cb1966cd60a32ca0cfed5aa2f35415cf676ea8c4120e0fd6fec7ad5dda2bfa envoy/type/v3/range.proto +shake256:e6fddcc8548f308a8bbc564bf1e302e640c95e2c1089a91891eac9711084b3d6b0d69341d9d9bbf7b49f485768df4b6454fb8778d3a76b7a732e0107b2e2b1b6 envoy/type/v3/ratelimit_strategy.proto +shake256:927bc95f9752bc98d44dac7bd56fc63f2e8fd8d8d4416704c396f5b4480c2f5d07ecb0b431050d0f9dc76af34d05731c18a28e62853a4787a9f0e95ca94891a2 envoy/type/v3/ratelimit_unit.proto +shake256:9b2484a11c76b5d389f373a68d702953265802c037fbe2c31b15b31c1ea0f5b34fcecfc4b9885a9e52bc6f8f69659f6ba0df0cd15a23681c87757391b3eec752 envoy/type/v3/scope.proto +shake256:e802325fe5d940c76aab0881202db793985b6b26cbbe58d478363f1145a0c68b400754bd7b96d589d6a441a8f4a8eef8edb2409a202b0ee288818f0db3bcb726 envoy/type/v3/semantic_version.proto +shake256:c32272c0fc9a70c1d5da0b778c77ae575973f21f3cf77f7c7505c24fdbc365051cf6fd75f152198973fc47af62d7f491aa5b847df54d9fc030d6606f1772678a envoy/type/v3/token_bucket.proto +shake256:b85a6a8a18ed14fd96fa1d81be0f8d40a5f1a873f7dee40f037c004f5d77b5930dbbb9058bceee6ea5a1679cbec098795d13a261aa13afaf4d7e6b29fd7d19fb envoy/watchdog/v3/abort_action.proto diff --git a/modules/sync/envoyproxy/envoy/cas/51c73a45a7d0303da413710d7aede53de6c2a518d534240ed63be5e0d1697645076f435852dfa46052a8def20d02cf325e199712660391c7776b7691f8a34175 b/modules/sync/envoyproxy/envoy/cas/51c73a45a7d0303da413710d7aede53de6c2a518d534240ed63be5e0d1697645076f435852dfa46052a8def20d02cf325e199712660391c7776b7691f8a34175 new file mode 100644 index 00000000..f45075d8 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/51c73a45a7d0303da413710d7aede53de6c2a518d534240ed63be5e0d1697645076f435852dfa46052a8def20d02cf325e199712660391c7776b7691f8a34175 @@ -0,0 +1,104 @@ +syntax = "proto3"; + +package envoy.extensions.load_balancing_policies.load_aware_locality.v3; + +import "envoy/config/cluster/v3/cluster.proto"; +import "envoy/extensions/load_balancing_policies/common/v3/common.proto"; + +import "google/protobuf/duration.proto"; +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.load_balancing_policies.load_aware_locality.v3"; +option java_outer_classname = "LoadAwareLocalityProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/load_aware_locality/v3;load_aware_localityv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Load-Aware Locality-Picking Load Balancing Policy] +// [#extension: envoy.load_balancing_policies.load_aware_locality] + +// Configuration for the load_aware_locality LB policy which uses ORCA utilization data +// to route traffic between localities based on available headroom. +// [#next-free-field: 11] +message LoadAwareLocality { + // The child LB policy to create for endpoint-picking within each locality. + config.cluster.v3.LoadBalancingPolicy endpoint_picking_policy = 1 + [(validate.rules).message = {required: true}]; + + // How frequently ORCA weights and locality utilization are recomputed on the + // main thread. Must be at least 100ms. Defaults to 1s. + google.protobuf.Duration weight_update_period = 2 + [(validate.rules).duration = {gte {nanos: 100000000}}]; + + // Specifies the metrics used to compute endpoint utilization. For map + // fields in the ORCA proto, the string will be of the form + // ``.``. For example, the string + // ``named_metrics.foo`` will mean to look for the key ``foo`` in the ORCA + // :ref:`named_metrics ` + // field. Utilization is the max of the values of the metrics specified + // here, when that max is greater than 0. Otherwise + // :ref:`application_utilization ` + // is used if greater than 0, with + // :ref:`cpu_utilization ` + // as the final fallback. Disabling the runtime flag + // ``envoy.reloadable_features.orca_weight_manager_use_named_metrics_first`` + // restores the legacy order, preferring ``application_utilization`` over + // these metrics. + repeated string metric_names_for_computing_utilization = 3; + + // When the local locality's utilization is at most this threshold above the + // remote average, route 100% of traffic to the local locality. This avoids + // unnecessary cross-zone routing when utilization is roughly balanced. + // One-sided: if the local zone is less loaded than remote, all-local routing + // always applies. Must be in [0, 1]. Defaults to 0.1. + google.protobuf.DoubleValue utilization_variance_threshold = 4 + [(validate.rules).double = {lte: 1.0 gte: 0.0}]; + + // EWMA time constant for per-locality utilization smoothing. The per-tick + // smoothing factor alpha is derived as ``1 - exp(-weight_update_period / + // smoothing_time_constant)``, so settling time is consistent regardless of + // the configured tick rate. Larger values produce more stable weights; + // smaller values react faster. Must be greater than 0s. Defaults to 5s + // (~95% settling within ~15s). + google.protobuf.Duration smoothing_time_constant = 5 [(validate.rules).duration = {gt {}}]; + + // Minimum fraction of traffic sent to non-local localities to keep ORCA + // data fresh when the local-preference check would otherwise route 100% of + // traffic to the local locality. The deficit is redistributed across remote + // localities proportionally to their host count. Must be in [0, 1). Set to + // 0 to disable (safe only when ORCA reports arrive out-of-band, or when + // cross-zone traffic must be strictly avoided). Defaults to 0.03 (3%). + // + // Probe fraction is a global value split across all remote localities. + // At very high remote-locality counts combined with low aggregate request + // rates, per-host sample intervals can exceed ``weight_expiration_period``. + // See the architecture overview for the scaling matrix. + google.protobuf.DoubleValue remote_probe_fraction = 6 + [(validate.rules).double = {lt: 1.0 gte: 0.0}]; + + // Per-host ORCA sample validity window. Hosts that have not reported load + // metrics within this duration are excluded from their locality's + // utilization aggregation. The locality's EWMA state continues normally + // over the remaining reporting hosts. If every host in a locality is + // stale, the locality falls back to host-count-proportional weighting + // (the same path used when all localities are overloaded). Set to 0s to + // disable expiration. Defaults to 3 minutes. + google.protobuf.Duration weight_expiration_period = 7 [(validate.rules).duration = {gte {}}]; + + // Whether to enable out-of-band utilization reporting collection from + // the endpoints. By default, per-request utilization reporting is used. + google.protobuf.BoolValue enable_oob_load_report = 8; + + // Load reporting interval to request from the server. Note that the + // server may not provide reports as frequently as the client requests. + // Used only when enable_oob_load_report is true. Default is 10 seconds. + google.protobuf.Duration oob_reporting_period = 9; + + // Optional overrides for the OOB reporting connection (alternative port, + // ``:authority``, transport socket selection). Honored only when + // ``enable_oob_load_report`` is true. + common.v3.OrcaOobReportingConfig oob_reporting_config = 10; +} diff --git a/modules/sync/envoyproxy/envoy/cas/559ebcaa55111ab6468aa3becc83cee62b89554441a4c3f3bbc949a5c06c804af371828dde55be57224733c59abb4eb046427361d8a0edef8ce9f8ee459007b4 b/modules/sync/envoyproxy/envoy/cas/559ebcaa55111ab6468aa3becc83cee62b89554441a4c3f3bbc949a5c06c804af371828dde55be57224733c59abb4eb046427361d8a0edef8ce9f8ee459007b4 new file mode 100644 index 00000000..c56bc716 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/559ebcaa55111ab6468aa3becc83cee62b89554441a4c3f3bbc949a5c06c804af371828dde55be57224733c59abb4eb046427361d8a0edef8ce9f8ee459007b4 @@ -0,0 +1,80 @@ +syntax = "proto3"; + +package envoy.extensions.filters.network.dynamic_modules.v3; + +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.network.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Dynamic Modules Network Filter] +// [#extension: envoy.filters.network.dynamic_modules] + +// Configuration for the Dynamic Modules network filter. This filter allows loading shared object +// files that can be loaded via ``dlopen`` to extend the network filter chain. +// +// A module can be loaded by multiple network filters; the module is loaded only once and shared +// across multiple filters. +// +// Unlike HTTP filters which operate on structured headers, body, and trailers, network filters work +// with raw TCP byte streams. The filter can: +// +// * Inspect, modify, or inject data into the downstream connection. +// * Access connection-level information such as addresses and TLS status. +// * Control connection lifecycle (e.g., close the connection). +message DynamicModuleNetworkFilter { + // Specifies the shared-object level configuration. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1; + + // The name for this filter configuration. + // + // This can be used to distinguish between different filter implementations inside a dynamic + // module. For example, a module can have completely different filter implementations. When Envoy + // receives this configuration, it passes the ``filter_name`` to the dynamic module's network + // filter config init function together with the ``filter_config``. That way a module can decide + // which in-module filter implementation to use based on the name at load time. + string filter_name = 2; + + // The configuration for the filter chosen by ``filter_name``. + // + // This is passed to the module's network filter initialization function. Together with the + // ``filter_name``, the module can decide which in-module filter implementation to use and + // fine-tune the behavior of the filter. + // + // For example, if a module has two filter implementations, one for echo and one for rate + // limiting, ``filter_name`` is used to choose either echo or rate limiting. The + // ``filter_config`` can be used to configure the echo behavior or the rate limiting parameters. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly + // without the wrapper. + // + // .. code-block:: yaml + // + // # Passing a string value + // filter_config: + // "@type": "type.googleapis.com/google.protobuf.StringValue" + // value: hello + // + // # Passing raw bytes + // filter_config: + // "@type": "type.googleapis.com/google.protobuf.BytesValue" + // value: aGVsbG8= # echo -n "hello" | base64 + // + google.protobuf.Any filter_config = 3; + + // If ``true``, the dynamic module is a terminal filter to use without an upstream connection. + // + // The dynamic module is responsible for creating and sending the response to downstream. + // + // Defaults to ``false``. + bool terminal_filter = 4; +} diff --git a/modules/sync/envoyproxy/envoy/cas/56737f595d21329007d97f5069ed35f24a53dc82a7dfbb32dd52117602f757c96d56767883beadd4b70987f95215e7c8a946c12f8a9b901e4c1e27f9a27e3afc b/modules/sync/envoyproxy/envoy/cas/56737f595d21329007d97f5069ed35f24a53dc82a7dfbb32dd52117602f757c96d56767883beadd4b70987f95215e7c8a946c12f8a9b901e4c1e27f9a27e3afc new file mode 100644 index 00000000..ae1e73cf --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/56737f595d21329007d97f5069ed35f24a53dc82a7dfbb32dd52117602f757c96d56767883beadd4b70987f95215e7c8a946c12f8a9b901e4c1e27f9a27e3afc @@ -0,0 +1,52 @@ +syntax = "proto3"; + +package envoy.extensions.transport_sockets.quic.v3; + +import "envoy/extensions/transport_sockets/tls/v3/tls.proto"; + +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.transport_sockets.quic.v3"; +option java_outer_classname = "QuicTransportProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/quic/v3;quicv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: quic transport] +// [#extension: envoy.transport_sockets.quic] +// The QUIC configurations below provide the transport socket configuration for downstream/upstream QUIC. + +// Configuration for Downstream QUIC transport socket. This provides Google's implementation of Google QUIC and IETF QUIC to Envoy. +message QuicDownstreamTransport { + tls.v3.DownstreamTlsContext downstream_tls_context = 1 + [(validate.rules).message = {required: true}]; + + // If false, QUIC will tell TLS to reject any early data and to stop issuing 0-RTT credentials + // with resumption session tickets. This will prevent clients from sending 0-RTT requests. + // Defaults to true, except when a client certificate validation context is configured, in which + // case it defaults to false. Early data requires resumption, so it cannot be enabled unless + // :ref:`enable_resumption + // ` + // is also true. + google.protobuf.BoolValue enable_early_data = 2; + + // If false, TLS session tickets are not issued and accepted by QUIC. + // Defaults to true, except when a client certificate validation context is configured, in which + // case it defaults to false. QUIC does not re-validate the client certificate when a session is + // resumed. A resumed connection reuses the certificate verdict of the original handshake until the + // ticket expires, so certificate revocation or expiry and validation context changes are not + // rechecked. Setting this to true on a filter chain that validates a client certificate opts into + // that trade-off in exchange for cheaper handshakes. Resumption also requires + // :ref:`disable_stateless_session_resumption + // ` + // to be false, because that field controls the underlying TLS session tickets. + google.protobuf.BoolValue enable_resumption = 3; +} + +// Configuration for Upstream QUIC transport socket. This provides Google's implementation of Google QUIC and IETF QUIC to Envoy. +message QuicUpstreamTransport { + tls.v3.UpstreamTlsContext upstream_tls_context = 1 [(validate.rules).message = {required: true}]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/57a0131334ad804039fabd14a613f7da33d577319612e3d1fe920f1ffe46bbedfdd8ff7b1c57394e1393e8a6b4acc5508a570cafdddf72067303154f09487f45 b/modules/sync/envoyproxy/envoy/cas/57a0131334ad804039fabd14a613f7da33d577319612e3d1fe920f1ffe46bbedfdd8ff7b1c57394e1393e8a6b4acc5508a570cafdddf72067303154f09487f45 new file mode 100644 index 00000000..3a71b813 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/57a0131334ad804039fabd14a613f7da33d577319612e3d1fe920f1ffe46bbedfdd8ff7b1c57394e1393e8a6b4acc5508a570cafdddf72067303154f09487f45 @@ -0,0 +1,131 @@ +syntax = "proto3"; + +package envoy.extensions.router.cluster_specifiers.dynamic_modules.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/config/route/v3/route_components.proto"; +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.router.cluster_specifiers.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/router/cluster_specifiers/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Dynamic Modules Cluster Specifier] +// +// Dynamic modules cluster specifier :ref:`configuration reference documentation +// `. +// [#extension: envoy.router.cluster_specifier_plugin.dynamic_modules] + +// Route action properties that a dynamic module may select for a request in place of the properties +// of the matched route. These properties are themselves built from other extensions, such as retry +// host predicates and retry priorities, so they must be declared here in advance rather than chosen +// freely by the module on each request. +// +// Each entry is built and validated when the cluster specifier is configured, so an invalid entry +// is rejected at configuration load rather than on the request path. Every entry must replace at +// least one property, so an entry that builds to no replacement is rejected as well. +message RouteActionOverride { + // Retry policy replacing the retry policy of the matched route. If not specified, the retry + // policy of the matched route is used, so an entry cannot be used to remove a retry policy that + // the matched route configures. + config.route.v3.RetryPolicy retry_policy = 1; + + // Metadata match criteria replacing the criteria of the matched route, used by subset load + // balancing. Only the ``envoy.lb`` entry of :ref:`filter_metadata + // ` is used, matching the behavior of + // :ref:`RouteAction.metadata_match + // `. If not specified, or if there + // is no ``envoy.lb`` entry, the criteria of the matched route are used, so an entry cannot be used + // to remove the criteria that the matched route configures. An entry whose only property is a + // ``metadata_match`` without an ``envoy.lb`` entry therefore replaces nothing and is rejected. + config.core.v3.Metadata metadata_match = 2; + + // Request mirroring policies replacing the request mirroring policies of the matched route. If + // not specified, the request mirroring policies of the matched route are used, so an entry cannot + // be used to turn off mirroring that the matched route configures. Statically named mirror + // clusters are checked against the cluster manager when :ref:`validate_clusters + // ` is enabled. + repeated config.route.v3.RouteAction.RequestMirrorPolicy request_mirror_policies = 3; + + // Hash policy replacing the hash policy of the matched route, used when the upstream cluster + // employs a hashing load balancer. If not specified, the hash policy of the matched route is used, + // so an entry cannot be used to remove a hash policy that the matched route configures. A + // cluster-level hash policy and a load-balancer-level hash policy, when configured, take precedence + // over this route-level policy. + repeated config.route.v3.RouteAction.HashPolicy hash_policy = 4; +} + +// Configuration for the Dynamic Modules Cluster Specifier. This cluster specifier allows loading +// shared object files via ``dlopen`` to select the upstream cluster for a request, and to replace +// the timeout, idle timeout, priority, request body buffer limit, cluster not found response code, +// hash policy, retry policy, metadata match criteria and request mirroring policies of the matched +// route. +// +// A module can be loaded by multiple cluster specifiers. It is loaded only once and shared across +// multiple cluster specifier instances. The module is invoked while the route is being +// resolved, so the selection is visible to the router without clearing the route cache. It is +// invoked again whenever a filter refreshes the route cluster, or a retry re-selects it when +// :ref:`refresh_cluster_on_retry +// ` is set, so the module +// must be able to produce a decision from the request headers and the stream info alone. +message DynamicModuleClusterSpecifier { + // Specifies the shared-object level configuration. This field is required. + // + // .. note:: + // This extension loads the module while the cluster specifier is configured, so it cannot wait + // for an asynchronous fetch. A remote :ref:`module + // ` is therefore + // accepted only when the module is already cached on disk, and is otherwise rejected. Setting + // :ref:`nack_on_cache_miss + // ` to + // ``true`` makes the rejection start a background fetch so that a later update succeeds. Prefer + // ``name`` or a local data source. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1 + [(validate.rules).message = {required: true}]; + + // The name for this cluster specifier configuration. If not specified, defaults to an empty + // string. + // + // This can be used to distinguish between different cluster specifier implementations inside a + // dynamic module. When Envoy receives this configuration, it passes the ``specifier_name`` to the + // dynamic module's cluster specifier config init function together with the ``specifier_config``. + // That way a module can decide which in-module implementation to use based on the name at load + // time. + string specifier_name = 2; + + // The configuration for the cluster specifier chosen by ``specifier_name``. If not specified, an + // empty configuration is passed to the module. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly without + // the wrapper. + // + // .. code-block:: yaml + // + // # Passing a JSON struct configuration + // specifier_config: + // "@type": "type.googleapis.com/google.protobuf.Struct" + // value: + // cluster_name_prefix: shard- + // + // # Passing a simple string configuration + // specifier_config: + // "@type": "type.googleapis.com/google.protobuf.StringValue" + // value: "shard-" + // + google.protobuf.Any specifier_config = 3; + + // Route action overrides that the module may select by name for a request. If not specified, the + // module can only select the cluster, the timeout, the idle timeout, the priority, the request + // body buffer limit and the cluster not found response code. + map route_action_overrides = 4 + [(validate.rules).map = {keys {string {min_len: 1}}}]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/5acb21e6a80670f6186504c7a0c5bff6d3b54423c829e7390e807b170c1edd8e1de482212b36b5cf9709ce80ca824185b44f11b38bfcd10400d98748e38731a7 b/modules/sync/envoyproxy/envoy/cas/5acb21e6a80670f6186504c7a0c5bff6d3b54423c829e7390e807b170c1edd8e1de482212b36b5cf9709ce80ca824185b44f11b38bfcd10400d98748e38731a7 new file mode 100644 index 00000000..121bfcb7 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/5acb21e6a80670f6186504c7a0c5bff6d3b54423c829e7390e807b170c1edd8e1de482212b36b5cf9709ce80ca824185b44f11b38bfcd10400d98748e38731a7 @@ -0,0 +1,71 @@ +syntax = "proto3"; + +package envoy.extensions.formatter.dynamic_modules.v3; + +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.formatter.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/formatter/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Dynamic Modules Formatter] +// [#extension: envoy.formatter.dynamic_modules] + +// Configuration for the Dynamic Modules Formatter. This formatter allows loading shared object +// files via ``dlopen`` to implement custom ``%COMMAND%`` operators for access logs and header +// formatting. +// +// A module can be loaded by multiple formatters; the module is loaded only once and shared across +// multiple command parser instances. Each parsed command produces a provider that is invoked on the +// worker threads to compute the substitution value, with access to request and response headers, +// stream info attributes, dynamic metadata, and the local reply body. +message DynamicModuleFormatter { + // Specifies the shared-object level configuration. This field is required. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1 + [(validate.rules).message = {required: true}]; + + // The name for this formatter configuration. If not specified, defaults to an empty string. + // + // This can be used to distinguish between different formatter implementations inside a dynamic + // module. When Envoy receives this configuration, it passes the ``formatter_name`` to the dynamic + // module's formatter config init function together with the ``formatter_config``. That way a + // module can decide which in-module command parser implementation to use based on the name at + // load time. + string formatter_name = 2; + + // The configuration for the formatter chosen by ``formatter_name``. If not specified, an empty + // configuration is passed to the module. + // + // This is passed to the module's formatter initialization function. Together with the + // ``formatter_name``, the module can decide which in-module command parser implementation to use + // and fine-tune which commands it recognizes. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly + // without the wrapper. + // + // .. code-block:: yaml + // + // # Passing a JSON struct configuration + // formatter_config: + // "@type": "type.googleapis.com/google.protobuf.Struct" + // value: + // redact_headers: + // - authorization + // - cookie + // + // # Passing a simple string configuration + // formatter_config: + // "@type": "type.googleapis.com/google.protobuf.StringValue" + // value: "x-request-id" + // + google.protobuf.Any formatter_config = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/5dca22c6f661b75adf9bca0a6f5e200474aeb1b977cf6e03fb18ac8c1273940f67b3fcb3e3fdee91f7e46f820fa56f51b43c601b05f4c6947aee912b5c0b3d01 b/modules/sync/envoyproxy/envoy/cas/5dca22c6f661b75adf9bca0a6f5e200474aeb1b977cf6e03fb18ac8c1273940f67b3fcb3e3fdee91f7e46f820fa56f51b43c601b05f4c6947aee912b5c0b3d01 new file mode 100644 index 00000000..dcf367f1 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/5dca22c6f661b75adf9bca0a6f5e200474aeb1b977cf6e03fb18ac8c1273940f67b3fcb3e3fdee91f7e46f820fa56f51b43c601b05f4c6947aee912b5c0b3d01 @@ -0,0 +1,176 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.gcp_authn.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/http_uri.proto"; + +import "google/protobuf/duration.proto"; +import "google/protobuf/wrappers.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.gcp_authn.v3"; +option java_outer_classname = "GcpAuthnProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/gcp_authn/v3;gcp_authnv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: GCP authentication] +// GCP authentication :ref:`configuration overview `. +// [#extension: envoy.filters.http.gcp_authn] + +// Filter configuration. +// [#next-free-field: 9] +message GcpAuthnFilterConfig { + // The HTTP URI to fetch tokens from GCE Metadata Server(https://cloud.google.com/compute/docs/metadata/overview). + // The URL format is "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=[AUDIENCE]" + // + // This field is deprecated because it does not match the API surface provided by the google auth libraries. + // Control planes should not attempt to override the metadata server URI. + // The cluster and timeout can be configured using the ``cluster`` and ``timeout`` fields instead. + // For backward compatibility, the cluster and timeout configured in this field will be used + // if the new ``cluster`` and ``timeout`` fields are not set. + config.core.v3.HttpUri http_uri = 1 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Retry policy for fetching tokens. + // Not supported by all data planes. + config.core.v3.RetryPolicy retry_policy = 2; + + // Token cache configuration. This field is optional. + TokenCacheConfig cache_config = 3; + + // Request header location to extract the token. By default (i.e. if this field is not specified), the token + // is extracted to the Authorization HTTP header, in the format "Authorization: Bearer ". + // If ``token_metadata_key`` is set, this field takes no effect. + // Not supported by all data planes. + TokenHeader token_header = 4; + + // Optional dynamic metadata key to save the token. The metadata uses the filter config name as the namespace. + // Takes precedence over ``token_header``. + string token_metadata_key = 7; + + // Cluster to send traffic to the GCE metadata server. Not supported + // by all data planes; a data plane may instead have its own mechanism + // for contacting the metadata server. + string cluster = 5; + + // Timeout for fetching the tokens from the GCE metadata server. + // Not supported by all data planes. + google.protobuf.Duration timeout = 6 [(validate.rules).duration = { + lt {seconds: 4294967296} + gte {} + }]; + + // Defines the authentication service. This field overrides the cluster's typed_filter_metadata definition. + Audience audience = 8; +} + +// Audience is the URL of the receiving service that performs token authentication. +// It will be provided to the filter through cluster's typed_filter_metadata. +// [#next-free-field: 6] +message Audience { + message AccessToken { + // Optional custom OAuth scopes for the access token request. + // If empty, the filter will not request scopes explicitly, so the metadata server's default + // scopes will be used. + // When populated, the filter appends "?scopes=" to the + // metadata server token request. Note that the metadata server replaces default + // scopes with the provided list rather than appending; to preserve general GCP API + // access, callers should explicitly include "https://www.googleapis.com/auth/cloud-platform". + // Validation rules require each scope to be non-empty and disallow whitespace or commas, + // as commas are used as the delimiter for the metadata server and OAuth 2.0 scopes + // cannot contain whitespace (RFC 6749 Section 3.3). + repeated string scopes = 1 + [(validate.rules).repeated = {items {string {min_len: 1 pattern: "^[^\\s,]+$"}}}]; + } + + message BoundJwt { + // The audience URL, used for fetching bound JWT token. + string url = 1 [(validate.rules).string = {min_len: 1}]; + } + + message BoundAccessToken { + // Optional custom OAuth scopes for the bound access token request. + // If empty, the filter will not request scopes explicitly, so the metadata server's default + // scopes will be used. + // When populated, the filter appends "&scopes=" to the + // metadata server token request. Note that the metadata server replaces default + // scopes with the provided list rather than appending; to preserve general GCP API + // access, callers should explicitly include "https://www.googleapis.com/auth/cloud-platform". + // Validation rules require each scope to be non-empty and disallow whitespace or commas, + // as commas are used as the delimiter for the metadata server and OAuth 2.0 scopes + // cannot contain whitespace (RFC 6749 Section 3.3). + repeated string scopes = 1 + [(validate.rules).repeated = {items {string {min_len: 1 pattern: "^[^\\s,]+$"}}}]; + } + + // Default lifetime is 1h. + message IAMAccessToken { + // A template string for the account email or unique ID for which the credentials are requested, + // e.g. ``my-sa-%DYNAMIC_METADATA(my_filter:tenant_project)%@my-project.iam.gserviceaccount.com``. + string account = 1 [(validate.rules).string = {min_len: 1}]; + + // A template string for the authorization header value, + // e.g. ``Bearer %DYNAMIC_METADATA(gcp_authn:token)%``. + string authorization = 2 [(validate.rules).string = {min_len: 1}]; + + // Optional custom scopes for the token request. + // Default scope is https://www.googleapis.com/auth/cloud-platform. + repeated string scopes = 3; + } + + // The audience URL, used for fetching unbound JWT token. + string url = 1; + + // If defined, the filter will fetch unbound Access Token instead of JWT. + // It takes precedence over ``url``. + AccessToken access_token = 2; + + // If defined, the filter will fetch bound JWT token instead of unbound. + // It takes precedence over ``access_token`` and ``url``. + BoundJwt bound_jwt = 3; + + // If defined, the filter will fetch bound Access Token instead of unbound. + // It takes precedence over ``bound_jwt``, ``access_token`` and ``url``. + BoundAccessToken bound_access_token = 4; + + // If defined, the filter will fetch an access token for a service account. + // It takes precedence over ``bound_access_token``, ``bound_jwt``, ``access_token``, and ``url``. + // Requires inlined audience definition in the filter configuration. + IAMAccessToken iam_access_token = 5; +} + +// Token Cache configuration. +message TokenCacheConfig { + // The number of cache entries. The maximum number of entries is INT64_MAX as it is constrained by underlying cache implementation. + // Default value 0 (i.e., proto3 defaults) disables the cache by default. Other default values will enable the cache. + google.protobuf.UInt64Value cache_size = 1 [(validate.rules).uint64 = {lte: 9223372036854775807}]; +} + +message TokenHeader { + // Configuration options for preserving an existing token header. + message PreserveExisting { + } + + // The HTTP header's name. Defaults to ``Authorization`` if not specified. + string name = 1 [ + (validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false ignore_empty: true} + ]; + + // The header's prefix. The format is "value_prefix" + // For example, for "Authorization: Bearer ", value_prefix="Bearer " with a space at the + // end. + string value_prefix = 2 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE strict: false}]; + + // If set, the filter checks if the target header is already present (by header key existence, + // even if the header value is empty). If present, it skips token fetching and preserves the + // existing header intact (``value_prefix`` has no effect on the preserved header). If absent, + // a new token is fetched and written using ``name`` and ``value_prefix``. + // If not set, the default behavior is to unconditionally overwrite the header. + PreserveExisting preserve_existing = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/64496efc016e5617ea8758fef8f3e284150617932c6bf8eb9a9a701a375f32c028d7c16c7aa7bedc704e09ae922f2e34d7b4f017624b85e85e62b8c6a1199d79 b/modules/sync/envoyproxy/envoy/cas/64496efc016e5617ea8758fef8f3e284150617932c6bf8eb9a9a701a375f32c028d7c16c7aa7bedc704e09ae922f2e34d7b4f017624b85e85e62b8c6a1199d79 new file mode 100644 index 00000000..60d0250b --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/64496efc016e5617ea8758fef8f3e284150617932c6bf8eb9a9a701a375f32c028d7c16c7aa7bedc704e09ae922f2e34d7b4f017624b85e85e62b8c6a1199d79 @@ -0,0 +1,371 @@ +syntax = "proto3"; + +package envoy.extensions.transport_sockets.tls.v3; + +import "envoy/config/core/v3/address.proto"; +import "envoy/config/core/v3/extension.proto"; +import "envoy/extensions/transport_sockets/tls/v3/common.proto"; +import "envoy/extensions/transport_sockets/tls/v3/secret.proto"; + +import "google/protobuf/duration.proto"; +import "google/protobuf/wrappers.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.transport_sockets.tls.v3"; +option java_outer_classname = "TlsProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3;tlsv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: TLS transport socket] +// [#extension: envoy.transport_sockets.tls] +// The TLS contexts below provide the transport socket configuration for upstream/downstream TLS. + +// [#next-free-field: 8] +message UpstreamTlsContext { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.auth.UpstreamTlsContext"; + + // Common TLS context settings. + // + // .. attention:: + // + // Server certificate verification is not enabled by default. To enable verification, configure + // :ref:`trusted_ca`. + CommonTlsContext common_tls_context = 1; + + // SNI string to use when creating TLS backend connections. + string sni = 2 [(validate.rules).string = {max_bytes: 255}]; + + // If true, replaces the SNI for the connection with the hostname of the upstream host, if + // the hostname is known due to either a DNS cluster type or the + // :ref:`hostname ` is set on + // the host. + // + // See :ref:`SNI configuration ` for details on how this + // interacts with other validation options. + bool auto_host_sni = 6; + + // If true, replaces any Subject Alternative Name (SAN) validations with a validation for a DNS SAN matching + // the SNI value sent. The validation uses the actual requested SNI, regardless of how the SNI is configured. + // + // For common cases where an SNI value is present and the server certificate should include a corresponding SAN, + // this option ensures the SAN is properly validated. + // + // See the :ref:`validation configuration ` for how this interacts with + // other validation options. + bool auto_sni_san_validation = 7; + + // If true, server-initiated TLS renegotiation will be allowed. + // + // .. attention:: + // + // TLS renegotiation is considered insecure and shouldn't be used unless absolutely necessary. + bool allow_renegotiation = 3; + + // Maximum number of session keys (Pre-Shared Keys for TLSv1.3+, Session IDs and Session Tickets + // for TLSv1.2 and older) to be stored for session resumption. + // + // Defaults to 1, setting this to 0 disables session resumption. + google.protobuf.UInt32Value max_session_keys = 4; + + // Controls enforcement of the ``keyUsage`` extension in peer certificates. If set to ``true``, + // the handshake will fail if the ``keyUsage`` is incompatible with TLS usage. + // + // .. attention:: + // + // This field is deprecated and ignored. Envoy now always enforces the ``keyUsage`` extension + // in peer certificates, making this option unconfigurable. + google.protobuf.BoolValue enforce_rsa_key_usage = 5 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; +} + +// [#next-free-field: 12] +message DownstreamTlsContext { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.auth.DownstreamTlsContext"; + + enum OcspStaplePolicy { + // OCSP responses are optional. If absent or expired, the certificate is used without stapling. + LENIENT_STAPLING = 0; + + // OCSP responses are optional. If absent, the certificate is used without stapling. If present but expired, + // the certificate is not used for subsequent connections. Connections are rejected if no suitable certificate + // is found. + STRICT_STAPLING = 1; + + // OCSP responses are required. Connections fail if a certificate lacks a valid OCSP response. Expired responses + // prevent certificate use in new connections, and connections are rejected if no suitable certificate is available. + MUST_STAPLE = 2; + } + + // Common TLS context settings. + CommonTlsContext common_tls_context = 1; + + // If specified, Envoy will reject connections without a valid client + // certificate. + google.protobuf.BoolValue require_client_certificate = 2; + + // If specified, Envoy will reject connections without a valid and matching SNI. + // [#not-implemented-hide:] + google.protobuf.BoolValue require_sni = 3; + + oneof session_ticket_keys_type { + // TLS session ticket key settings. + TlsSessionTicketKeys session_ticket_keys = 4; + + // Config for fetching TLS session ticket keys via SDS API. + SdsSecretConfig session_ticket_keys_sds_secret_config = 5; + + // Config for controlling stateless TLS session resumption: setting this to true will cause the TLS + // server to not issue TLS session tickets for the purposes of stateless TLS session resumption. + // If set to false, the TLS server will issue TLS session tickets and encrypt/decrypt them using + // the keys specified through either :ref:`session_ticket_keys ` + // or :ref:`session_ticket_keys_sds_secret_config `. + // If this config is set to false and no keys are explicitly configured, the TLS server will issue + // TLS session tickets and encrypt/decrypt them using an internally-generated and managed key, with the + // implication that sessions cannot be resumed across hot restarts or on different hosts. + bool disable_stateless_session_resumption = 7; + } + + // If ``true``, the TLS server will not maintain a session cache of TLS sessions. + // + // .. note:: + // This applies only to TLSv1.2 and earlier. + // + bool disable_stateful_session_resumption = 10; + + // Maximum lifetime of TLS sessions. If specified, ``session_timeout`` will change the maximum lifetime + // of the TLS session. + // + // This serves as a hint for the `TLS session ticket lifetime (for TLSv1.2) `_. + // Only whole seconds are considered; fractional seconds are ignored. + google.protobuf.Duration session_timeout = 6 [(validate.rules).duration = { + lt {seconds: 4294967296} + gte {} + }]; + + // Configuration for handling certificates without an OCSP response or with expired responses. + // + // Defaults to ``LENIENT_STAPLING`` + OcspStaplePolicy ocsp_staple_policy = 8 [(validate.rules).enum = {defined_only: true}]; + + // Multiple certificates are allowed in Downstream transport socket to serve different SNI. + // This option controls the behavior when no matching certificate is found for the received SNI value, + // or no SNI value was sent. If enabled, all certificates will be evaluated for a match for non-SNI criteria + // such as key type and OCSP settings. If disabled, the first provided certificate will be used. + // Defaults to ``false``. See more details in :ref:`Multiple TLS certificates `. + google.protobuf.BoolValue full_scan_certs_on_sni_mismatch = 9; + + // If ``true``, the downstream client's preferred cipher is used during the handshake. If ``false``, Envoy + // uses its preferred cipher. + // + // .. note:: + // This has no effect when using TLSv1_3. + // + bool prefer_client_ciphers = 11; +} + +// TLS key log configuration. +// The key log file format is "format used by NSS for its SSLKEYLOGFILE debugging output" (text taken from openssl man page) +message TlsKeyLog { + // Path to save the TLS key log. + string path = 1 [(validate.rules).string = {min_len: 1}]; + + // Local IP address ranges to filter connections for TLS key logging. If not set, matches any local IP address. + repeated config.core.v3.CidrRange local_address_range = 2; + + // Remote IP address ranges to filter connections for TLS key logging. If not set, matches any remote IP address. + repeated config.core.v3.CidrRange remote_address_range = 3; +} + +// TLS context shared by both client and server TLS contexts. +// [#next-free-field: 17] +message CommonTlsContext { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.auth.CommonTlsContext"; + + // Config for the Certificate Provider to fetch certificates. Certificates are fetched/refreshed asynchronously over + // the network relative to the TLS handshake. + // + // DEPRECATED: This message is not currently used, but if we ever do need it, we will want to + // move it out of CommonTlsContext and into common.proto, similar to the existing + // CertificateProviderPluginInstance message. + // + // [#not-implemented-hide:] + message CertificateProvider { + // opaque name used to specify certificate instances or types. For example, "ROOTCA" to specify + // a root-certificate (validation context) or "TLS" to specify a new tls-certificate. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // Provider specific config. + // Note: an implementation is expected to dedup multiple instances of the same config + // to maintain a single certificate-provider instance. The sharing can happen, for + // example, among multiple clusters or between the tls_certificate and validation_context + // certificate providers of a cluster. + // This config could be supplied inline or (in future) a named xDS resource. + oneof config { + option (validate.required) = true; + + config.core.v3.TypedExtensionConfig typed_config = 2; + } + } + + // Similar to CertificateProvider above, but allows the provider instances to be configured on + // the client side instead of being sent from the control plane. + // + // DEPRECATED: This message was moved outside of CommonTlsContext + // and now lives in common.proto. + // + // [#not-implemented-hide:] + message CertificateProviderInstance { + // Provider instance name. This name must be defined in the client's configuration (e.g., a + // bootstrap file) to correspond to a provider instance (i.e., the same data in the typed_config + // field that would be sent in the CertificateProvider message if the config was sent by the + // control plane). If not present, defaults to "default". + // + // Instance names should generally be defined not in terms of the underlying provider + // implementation (e.g., "file_watcher") but rather in terms of the function of the + // certificates (e.g., "foo_deployment_identity"). + string instance_name = 1; + + // Opaque name used to specify certificate instances or types. For example, "ROOTCA" to specify + // a root-certificate (validation context) or "example.com" to specify a certificate for a + // particular domain. Not all provider instances will actually use this field, so the value + // defaults to the empty string. + string certificate_name = 2; + } + + message CombinedCertificateValidationContext { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.auth.CommonTlsContext.CombinedCertificateValidationContext"; + + // How to validate peer certificates. + CertificateValidationContext default_validation_context = 1 + [(validate.rules).message = {required: true}]; + + // Config for fetching validation context via SDS API. Note SDS API allows certificates to be + // fetched/refreshed over the network asynchronously with respect to the TLS handshake. + SdsSecretConfig validation_context_sds_secret_config = 2 + [(validate.rules).message = {required: true}]; + + // Certificate provider for fetching CA certs. This will populate the + // ``default_validation_context.trusted_ca`` field. + // [#not-implemented-hide:] + CertificateProvider validation_context_certificate_provider = 3 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Certificate provider instance for fetching CA certs. This will populate the + // ``default_validation_context.trusted_ca`` field. + // [#not-implemented-hide:] + CertificateProviderInstance validation_context_certificate_provider_instance = 4 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + } + + reserved 5; + + // TLS protocol versions, cipher suites etc. + TlsParameters tls_params = 1; + + // Only a single TLS certificate is supported in client contexts unless + // ``custom_tls_certificate_selector`` is explicitly defined with ``max_session_keys`` set to 0. In server contexts, + // :ref:`Multiple TLS certificates ` can be associated with the + // same context to allow both RSA and ECDSA certificates and support SNI-based selection. + // + // If ``tls_certificate_provider_instance`` is set, this field is ignored. + // If this field is set, ``tls_certificate_sds_secret_configs`` is ignored. + repeated TlsCertificate tls_certificates = 2; + + // Configs for fetching TLS certificates via SDS API. Note SDS API allows certificates to be + // fetched/refreshed over the network asynchronously with respect to the TLS handshake. + // + // The same number and types of certificates as :ref:`tls_certificates ` + // are valid in the certificates fetched through this setting. + // + // If ``tls_certificates`` or ``tls_certificate_provider_instance`` are set, this field + // is ignored. + repeated SdsSecretConfig tls_certificate_sds_secret_configs = 6; + + // Certificate provider instance for fetching TLS certs. + // + // If this field is set, ``tls_certificates`` and ``tls_certificate_provider_instance`` + // are ignored. + // [#not-implemented-hide:] + CertificateProviderPluginInstance tls_certificate_provider_instance = 14; + + // Custom TLS certificate selector. + // + // For the downstream TLS socket, select a TLS certificate based on TLS client hello. If empty, + // defaults to native TLS certificate selection behavior: DNS SANs or Subject Common Name in TLS + // certificates is extracted as server name pattern to match SNI. + // + // For the upstream TLS socket, select a TLS certificate based on TLS server hello and the + // transport socket options. + // [#extension-category: envoy.tls.certificate_selectors,envoy.tls.upstream_certificate_selectors] + config.core.v3.TypedExtensionConfig custom_tls_certificate_selector = 16; + + // Certificate provider for fetching TLS certificates. + // [#not-implemented-hide:] + CertificateProvider tls_certificate_certificate_provider = 9 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Certificate provider instance for fetching TLS certificates. + // [#not-implemented-hide:] + CertificateProviderInstance tls_certificate_certificate_provider_instance = 11 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + oneof validation_context_type { + // How to validate peer certificates. + CertificateValidationContext validation_context = 3; + + // Config for fetching validation context via SDS API. Note SDS API allows certificates to be + // fetched/refreshed over the network asynchronously with respect to the TLS handshake. + SdsSecretConfig validation_context_sds_secret_config = 7; + + // Combines the default ``CertificateValidationContext`` with the SDS-provided dynamic context for certificate + // validation. + // + // When the SDS server returns a dynamic ``CertificateValidationContext``, it is merged + // with the default context using ``Message::MergeFrom()``. The merging rules are as follows: + // + // * **Singular Fields:** Dynamic fields override the default singular fields. + // * **Repeated Fields:** Dynamic repeated fields are concatenated with the default repeated fields. + // * **Boolean Fields:** Boolean fields are combined using a logical OR operation. + // + // The resulting ``CertificateValidationContext`` is used to perform certificate validation. + CombinedCertificateValidationContext combined_validation_context = 8; + + // Certificate provider for fetching validation context. + // [#not-implemented-hide:] + CertificateProvider validation_context_certificate_provider = 10 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Certificate provider instance for fetching validation context. + // [#not-implemented-hide:] + CertificateProviderInstance validation_context_certificate_provider_instance = 12 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + } + + // Supplies the list of ALPN protocols that the listener should expose. In + // practice this is likely to be set to one of two values (see the + // :ref:`codec_type + // ` + // parameter in the HTTP connection manager for more information): + // + // * "h2,http/1.1" If the listener is going to support both HTTP/2 and HTTP/1.1. + // * "http/1.1" If the listener is only going to support HTTP/1.1. + // + // There is no default for this parameter. If empty, Envoy will not expose ALPN. + repeated string alpn_protocols = 4; + + // Custom TLS handshaker. If empty, defaults to native TLS handshaking + // behavior. + // [#extension-category: envoy.tls_handshakers] + config.core.v3.TypedExtensionConfig custom_handshaker = 13; + + // TLS key log configuration + TlsKeyLog key_log = 15; +} diff --git a/modules/sync/envoyproxy/envoy/cas/645d441d2b0d63f29153759dbb3bf26dd41ad19052f28a3309257d4cc452d08b5121b0a42b1f73b16b4f1438d15a4b08161887f607528676dc6b98efb045d639 b/modules/sync/envoyproxy/envoy/cas/645d441d2b0d63f29153759dbb3bf26dd41ad19052f28a3309257d4cc452d08b5121b0a42b1f73b16b4f1438d15a4b08161887f607528676dc6b98efb045d639 new file mode 100644 index 00000000..515fddf7 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/645d441d2b0d63f29153759dbb3bf26dd41ad19052f28a3309257d4cc452d08b5121b0a42b1f73b16b4f1438d15a4b08161887f607528676dc6b98efb045d639 @@ -0,0 +1,513 @@ +syntax = "proto3"; + +package envoy.extensions.filters.network.redis_proxy.v3; + +import "envoy/config/core/v3/address.proto"; +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/grpc_service.proto"; +import "envoy/extensions/common/aws/v3/credential_provider.proto"; +import "envoy/extensions/common/dynamic_forward_proxy/v3/dns_cache.proto"; + +import "google/protobuf/duration.proto"; +import "google/protobuf/wrappers.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/migrate.proto"; +import "udpa/annotations/sensitive.proto"; +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.network.redis_proxy.v3"; +option java_outer_classname = "RedisProxyProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/redis_proxy/v3;redis_proxyv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Redis Proxy] +// Redis Proxy :ref:`configuration overview `. +// [#extension: envoy.filters.network.redis_proxy] + +// [#next-free-field: 13] +message RedisProxy { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.redis_proxy.v2.RedisProxy"; + + // RESP protocol version supported on this listener. + enum ProtocolVersion { + // Default. The listener speaks RESP2 on both downstream connections and + // every routed upstream conn pool: no ``HELLO 3`` is sent upstream and a + // downstream ``HELLO 3`` is rejected with ``-NOPROTO``. (RESP3-aware + // handling such as the local ``HELLO`` reply, ``CLIENT SETINFO`` / + // ``SETNAME`` acceptance, and the RESP3 decoder is always present; this + // value only controls the negotiated wire version.) + RESP2 = 0; + + // The listener speaks RESP3 on both downstream connections and every + // routed upstream conn pool. Upstream conn pools negotiate ``HELLO 3`` + // (combined with ``AUTH`` when credentials or AWS IAM authentication are + // configured) on each new connection; ``upstream_resp3_hello_failure`` + // tracks negotiation failures. Downstream clients must perform an + // explicit ``HELLO 3`` handshake before any data command — bare ``HELLO`` + // on a fresh connection or any non-HELLO/AUTH/QUIT command before + // ``HELLO 3`` is rejected with ``-NOPROTO``. + RESP3 = 1; + } + + // Redis connection pool settings. + // [#next-free-field: 11] + message ConnPoolSettings { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.redis_proxy.v2.RedisProxy.ConnPoolSettings"; + + // ReadPolicy controls how Envoy routes read commands to Redis nodes. This is currently + // supported for Redis Cluster. All ReadPolicy settings except MASTER may return stale data + // because replication is asynchronous and requires some delay. You need to ensure that your + // application can tolerate stale data. + enum ReadPolicy { + // Default mode. Read from the current primary node. + MASTER = 0 [(udpa.annotations.enum_value_migrate).rename = "PRIMARY"]; + + // Read from the primary, but if it is unavailable, read from replica nodes. + PREFER_MASTER = 1 [(udpa.annotations.enum_value_migrate).rename = "PREFER_PRIMARY"]; + + // Read from replica nodes. If multiple replica nodes are present within a shard, a random + // node is selected. Healthy nodes have precedent over unhealthy nodes. + REPLICA = 2; + + // Read from the replica nodes (similar to REPLICA), but if all replicas are unavailable (not + // present or unhealthy), read from the primary. + PREFER_REPLICA = 3; + + // Read from any node of the cluster. A random node is selected among the primary and + // replicas, healthy nodes have precedent over unhealthy nodes. + ANY = 4; + + // Read from replicas in the same availability zone as the Envoy proxy. If no replicas + // are available in the same zone, fall back to any replica. If no replicas are available + // at all, fall back to the primary. + // + // Note: Zone discovery currently works with Valkey only. Valkey exposes availability_zone + // in its INFO response. Standard Redis does not support this field. + // + // The client zone is determined from Envoy's :ref:`locality zone `. + LOCAL_ZONE_AFFINITY = 5; + + // Similar to LOCAL_ZONE_AFFINITY, but also considers the primary node for same-zone routing. + // Priority order: replicas in same zone -> primary in same zone -> any replica -> primary. + // This is useful when reducing cross-zone traffic is more important than read distribution. + // + // Note: Zone discovery currently works with Valkey only. + LOCAL_ZONE_AFFINITY_REPLICAS_AND_PRIMARY = 6; + } + + // Per-operation timeout in milliseconds. The timer starts when the first + // command of a pipeline is written to the backend connection. Each response received from Redis + // resets the timer since it signifies that the next command is being processed by the backend. + // The only exception to this behavior is when a connection to a backend is not yet established. + // In that case, the connect timeout on the cluster will govern the timeout until the connection + // is ready. + google.protobuf.Duration op_timeout = 1 [(validate.rules).duration = {required: true}]; + + // Use hash tagging on every redis key to guarantee that keys with the same hash tag will be + // forwarded to the same upstream. The hash key used for determining the upstream in a + // consistent hash ring configuration will be computed from the hash tagged key instead of the + // whole key. The algorithm used to compute the hash tag is identical to the `redis-cluster + // implementation `_. + // + // Examples: + // + // * '{user1000}.following' and '{user1000}.followers' **will** be sent to the same upstream + // * '{user1000}.following' and '{user1001}.following' **might** be sent to the same upstream + bool enable_hashtagging = 2; + + // Accept `moved and ask redirection + // `_ errors from upstream + // redis servers, and retry commands to the specified target server. The target server does not + // need to be known to the cluster manager. If the command cannot be redirected, then the + // original error is passed downstream unchanged. By default, this support is not enabled. + bool enable_redirection = 3; + + // If ``enable_redirection`` is set to true this option configures the DNS cache that the + // connection pool will use to resolve hostnames that are returned with MOVED and ASK responses. + // If no configuration is provided, DNS lookups will not be performed (and thus the MOVED/ASK errors + // will be propagated verbatim to the user). + common.dynamic_forward_proxy.v3.DnsCacheConfig dns_cache_config = 9; + + // Maximum size of encoded request buffer before flush is triggered and encoded requests + // are sent upstream. If this is unset, the buffer flushes whenever it receives data + // and performs no batching. + // This feature makes it possible for multiple clients to send requests to Envoy and have + // them batched- for example if one is running several worker processes, each with its own + // Redis connection. There is no benefit to using this with a single downstream process. + // Recommended size (if enabled) is 1024 bytes. + uint32 max_buffer_size_before_flush = 4; + + // The encoded request buffer is flushed N milliseconds after the first request has been + // encoded, unless the buffer size has already exceeded ``max_buffer_size_before_flush``. + // If ``max_buffer_size_before_flush`` is not set, this flush timer is not used. Otherwise, + // the timer should be set according to the number of clients, overall request rate and + // desired maximum latency for a single command. For example, if there are many requests + // being batched together at a high rate, the buffer will likely be filled before the timer + // fires. Alternatively, if the request rate is lower the buffer will not be filled as often + // before the timer fires. + // If ``max_buffer_size_before_flush`` is set, but ``buffer_flush_timeout`` is not, the latter + // defaults to 3ms. + google.protobuf.Duration buffer_flush_timeout = 5; + + // ``max_upstream_unknown_connections`` controls how many upstream connections to unknown hosts + // can be created at any given time by any given worker thread (see ``enable_redirection`` for + // more details). If the host is unknown and a connection cannot be created due to enforcing + // this limit, then redirection will fail and the original redirection error will be passed + // downstream unchanged. This limit defaults to 100. + google.protobuf.UInt32Value max_upstream_unknown_connections = 6; + + // Enable per-command statistics per upstream cluster, in addition to the filter level aggregate + // count. These commands are measured in microseconds. + bool enable_command_stats = 8; + + // Read policy. The default is to read from the primary. + ReadPolicy read_policy = 7 [(validate.rules).enum = {defined_only: true}]; + + // Ops or connection timeout triggers reconnection to redis server which could result in reconnection + // storm to busy redis server. This config is a protection to rate limit reconnection rate. + // If not set, there will be no rate limiting on the reconnection. + ConnectionRateLimit connection_rate_limit = 10; + } + + message PrefixRoutes { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.redis_proxy.v2.RedisProxy.PrefixRoutes"; + + // [#next-free-field: 7] + message Route { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.redis_proxy.v2.RedisProxy.PrefixRoutes.Route"; + + // The router is capable of shadowing traffic from one cluster to another. The current + // implementation is "fire and forget," meaning Envoy will not wait for the shadow cluster to + // respond before returning the response from the primary cluster. All normal statistics are + // collected for the shadow cluster making this feature useful for testing. + message RequestMirrorPolicy { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.redis_proxy.v2.RedisProxy.PrefixRoutes.Route." + "RequestMirrorPolicy"; + + // Specifies the cluster that requests will be mirrored to. The cluster must + // exist in the cluster manager configuration. + string cluster = 1 [(validate.rules).string = {min_len: 1}]; + + // If not specified or the runtime key is not present, all requests to the target cluster + // will be mirrored. + // + // If specified, Envoy will lookup the runtime key to get the percentage of requests to the + // mirror. + config.core.v3.RuntimeFractionalPercent runtime_fraction = 2; + + // Set this to TRUE to only mirror write commands, this is effectively replicating the + // writes in a "fire and forget" manner. + bool exclude_read_commands = 3; + } + + // ReadCommandPolicy specifies that Envoy should route read commands to another cluster. + message ReadCommandPolicy { + string cluster = 1 [(validate.rules).string = {min_len: 1}]; + } + + // String prefix that must match the beginning of the keys. Envoy will always favor the + // longest match. + string prefix = 1 [(validate.rules).string = {max_bytes: 1000}]; + + // Indicates if the prefix needs to be removed from the key when forwarded. + bool remove_prefix = 2; + + // Upstream cluster to forward the command to. + string cluster = 3 [(validate.rules).string = {min_len: 1}]; + + // Indicates that the route has a request mirroring policy. + repeated RequestMirrorPolicy request_mirror_policy = 4; + + // Indicates how redis key should be formatted. To substitute redis key into the formatting + // expression, use %KEY% as a string replacement command. + string key_formatter = 5; + + // Indicates that the route has a read command policy + ReadCommandPolicy read_command_policy = 6; + } + + reserved 3; + + reserved "catch_all_cluster"; + + // List of prefix routes. + repeated Route routes = 1; + + // Indicates that prefix matching should be case insensitive. + bool case_insensitive = 2; + + // Optional catch-all route to forward commands that doesn't match any of the routes. The + // catch-all route becomes required when no routes are specified. + Route catch_all_route = 4; + } + + // RedisFault defines faults used for fault injection. + message RedisFault { + enum RedisFaultType { + // Delays requests. This is the base fault; other faults can have delays added. + DELAY = 0; + + // Returns errors on requests. + ERROR = 1; + } + + // Fault type. + RedisFaultType fault_type = 1 [(validate.rules).enum = {defined_only: true}]; + + // Percentage of requests fault applies to. + config.core.v3.RuntimeFractionalPercent fault_enabled = 2 + [(validate.rules).message = {required: true}]; + + // Delay for all faults. If not set, defaults to zero + google.protobuf.Duration delay = 3; + + // Commands fault is restricted to, if any. If not set, fault applies to all commands + // other than auth and ping (due to special handling of those commands in Envoy). + repeated string commands = 4; + } + + // Configuration to limit reconnection rate to redis server to protect redis server + // from client reconnection storm. + message ConnectionRateLimit { + // Reconnection rate per sec. Rate limiting is implemented with TokenBucket. + uint32 connection_rate_limit_per_sec = 1 [(validate.rules).uint32 = {gt: 0}]; + } + + reserved 2; + + reserved "cluster"; + + // The prefix to use when emitting :ref:`statistics `. + string stat_prefix = 1 [(validate.rules).string = {min_len: 1}]; + + // Network settings for the connection pool to the upstream clusters. + ConnPoolSettings settings = 3 [(validate.rules).message = {required: true}]; + + // Indicates that latency stat should be computed in microseconds. By default it is computed in + // milliseconds. This does not apply to upstream command stats currently. + bool latency_in_micros = 4; + + // List of **unique** prefixes used to separate keys from different workloads to different + // clusters. Envoy will always favor the longest match first in case of overlap. A catch-all + // cluster can be used to forward commands when there is no match. Time complexity of the + // lookups are in O(min(longest key prefix, key length)). + // + // Example: + // + // .. code-block:: yaml + // + // prefix_routes: + // routes: + // - prefix: "ab" + // cluster: "cluster_a" + // - prefix: "abc" + // cluster: "cluster_b" + // + // When using the above routes, the following prefixes would be sent to: + // + // * ``get abc:users`` would retrieve the key 'abc:users' from cluster_b. + // * ``get ab:users`` would retrieve the key 'ab:users' from cluster_a. + // * ``get z:users`` would return a NoUpstreamHost error. A :ref:`catch-all + // route` + // would have retrieved the key from that cluster instead. + // + // See the :ref:`configuration section + // ` of the architecture overview for recommendations on + // configuring the backing clusters. + PrefixRoutes prefix_routes = 5; + + // Authenticate Redis client connections locally by forcing downstream clients to issue a `Redis + // AUTH command `_ with this password before enabling any other + // command. If an AUTH command's password matches this password, an "OK" response will be returned + // to the client. If the AUTH command password does not match this password, then an "ERR invalid + // password" error will be returned. If any other command is received before AUTH when this + // password is set, then a "NOAUTH Authentication required." error response will be sent to the + // client. If an AUTH command is received when the password is not set, then an "ERR Client sent + // AUTH, but no password is set" error will be returned. + // + // .. attention:: + // This field is deprecated. Use :ref:`downstream_auth_passwords + // `. + config.core.v3.DataSource downstream_auth_password = 6 [ + deprecated = true, + (udpa.annotations.sensitive) = true, + (envoy.annotations.deprecated_at_minor_version) = "3.0" + ]; + + // Authenticate Redis client connections locally by forcing downstream clients to issue a `Redis + // AUTH command `_ with one of these passwords before enabling any other + // command. If an AUTH command's password matches one of these passwords, an "OK" response will be returned + // to the client. If the AUTH command password does not match, then an "ERR invalid + // password" error will be returned. If any other command is received before AUTH when the + // password(s) are set, then a "NOAUTH Authentication required." error response will be sent to the + // client. If an AUTH command is received when the password is not set, then an "ERR Client sent + // AUTH, but no password is set" error will be returned. + repeated config.core.v3.DataSource downstream_auth_passwords = 9 + [(udpa.annotations.sensitive) = true]; + + // List of faults to inject. Faults currently come in two flavors: + // - Delay, which delays a request. + // - Error, which responds to a request with an error. Errors can also have delays attached. + // + // Example: + // + // .. code-block:: yaml + // + // faults: + // - fault_type: ERROR + // fault_enabled: + // default_value: + // numerator: 10 + // denominator: HUNDRED + // runtime_key: "bogus_key" + // commands: + // - GET + // - fault_type: DELAY + // fault_enabled: + // default_value: + // numerator: 10 + // denominator: HUNDRED + // runtime_key: "bogus_key" + // delay: 2s + // + // See the :ref:`fault injection section + // ` for more information on how to configure this. + repeated RedisFault faults = 8; + + // If a username is provided an ACL style AUTH command will be required with a username and password. + // Authenticate Redis client connections locally by forcing downstream clients to issue a `Redis + // AUTH command `_ with this username and the ``downstream_auth_password`` + // before enabling any other command. If an AUTH command's username and password matches this username + // and the ``downstream_auth_password`` , an "OK" response will be returned to the client. If the AUTH + // command username or password does not match this username or the ``downstream_auth_password``, then an + // "WRONGPASS invalid username-password pair" error will be returned. If any other command is received before AUTH when this + // password is set, then a "NOAUTH Authentication required." error response will be sent to the + // client. If an AUTH command is received when the password is not set, then an "ERR Client sent + // AUTH, but no ACL is set" error will be returned. + config.core.v3.DataSource downstream_auth_username = 7 [(udpa.annotations.sensitive) = true]; + + // External authentication configuration. If set, instead of validating username and password against ``downstream_auth_username`` and ``downstream_auth_password``, + // the filter will call an external gRPC service to authenticate the client. + // A typical usage of this feature is for situations where the password is a one-time token that needs to be validated against a remote service, like a sidecar. + // Expiration is also supported, which will disable any further commands from the client after the expiration time, unless a new AUTH command is received and the external auth service returns a new expiration time. + // If the external auth service returns an error, authentication is considered failed. + // If this setting is set together with ``downstream_auth_username`` and ``downstream_auth_password``, the external auth service will be source of truth, but those fields will still be used for downstream authentication to the cluster. + // The API is defined by :ref:`RedisProxyExternalAuthRequest `. + RedisExternalAuthProvider external_auth_provider = 10; + + // Optional configure redis custom commands for the proxy, eg -> ["my_custom_cmd1", "my_custom_cmd2"] + // + // .. note:: + // The is to support redis's feature wherein new commands can be added using redis' modules api: + // https://redis.io/docs/latest/develop/reference/modules/ + repeated string custom_commands = 11; + + // RESP protocol version enforced for both downstream connections and every + // routed upstream conn pool for this listener. Mismatched negotiation is + // rejected at HELLO (``HELLO N`` where ``N`` does not match returns + // ``-NOPROTO``) and, when set to ``RESP3``, at every non-HELLO/AUTH/QUIT + // command on a connection that has not yet negotiated RESP3 (so clients + // must perform an explicit ``HELLO 3`` handshake before any data command). + // + // When ``protocol_version`` is ``RESP3``, every routed upstream + // Redis-compatible backend must support ``HELLO 3`` / RESP3 (e.g. + // Redis 6.0+, where RESP3 was introduced). Misconfigured upstreams will + // fail every connection's HELLO 3 negotiation, surfaced as + // ``upstream_resp3_hello_failure`` stat increments. + ProtocolVersion protocol_version = 12 [(validate.rules).enum = {defined_only: true}]; +} + +// RedisProtocolOptions specifies Redis upstream protocol options. This object is used in +// :ref:`typed_extension_protocol_options`, +// keyed by the name ``envoy.filters.network.redis_proxy``. +message RedisProtocolOptions { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.redis_proxy.v2.RedisProtocolOptions"; + + message Credential { + // The address to which this username and password applies. + config.core.v3.Address address = 1; + + // Upstream server password as defined by the ``requirepass`` directive + // ``_ in the server's configuration file. + config.core.v3.DataSource auth_password = 2 [(udpa.annotations.sensitive) = true]; + + // Upstream server username as defined by the ``user`` directive + // ``_ in the server's configuration file. + config.core.v3.DataSource auth_username = 3 [(udpa.annotations.sensitive) = true]; + } + + // Upstream server password as defined by the ``requirepass`` directive + // ``_ in the server's configuration file. + // If ``aws_iam`` is set, this field is ignored. + config.core.v3.DataSource auth_password = 1 [(udpa.annotations.sensitive) = true]; + + // Upstream server username as defined by the ``user`` directive + // ``_ in the server's configuration file. + // If ``aws_iam``` is set, this field will be used as the authenticating user for redis IAM authentication. + // See ``Create a new IAM-enabled user`` under `Setup `_ for more details. + config.core.v3.DataSource auth_username = 2 [(udpa.annotations.sensitive) = true]; + + // The cluster level configuration for AWS IAM authentication + AwsIam aws_iam = 3; + + // If specified, these credentials are used when connecting to upstream endpoints. Which + // credential is used is determined by matching the resolved ``address`` field here with each + // endpoint's resolved ``address`` field. The first entry for a given ``address`` here takes precedence. + // If no entry in ``credentials`` matches, then the ``auth_password`` and ``auth_username`` fields + // are used as defaults. + repeated Credential credentials = 4; +} + +// [#next-free-field: 6] +message AwsIam { + // An AwsCredentialProvider, allowing the use of a specific credential provider chain or specific provider settings + common.aws.v3.AwsCredentialProvider credential_provider = 1; + + // The name of the cache, used when generating the authentication token. + string cache_name = 2 [(validate.rules).string = {min_len: 1}]; + + // The optional service name to be used in AWS IAM authentication. If not provided, the service name will be set to ``elasticache``. For Amazon MemoryDB + // the service name should be set to ``memorydb``. + string service_name = 3; + + // The optional AWS region that your cache is located in. If not provided, the region will be deduced using the region provider chain + // as described in :ref:`config_http_filters_aws_request_signing_region`. + string region = 4; + + // Number of seconds before the IAM authentication token will expire. If not set, defaults to 60s (1 minute). Maximum of 900s (15 minutes) + // Expiration of the current authentication token will automatically trigger generation of a new token. + // As envoy will automatically continue to generate new tokens as required, there is no substantial benefit to using a long expiration value here. + google.protobuf.Duration expiration_time = 5 [(validate.rules).duration = { + lte {seconds: 900} + gte {} + }]; +} + +// RedisExternalAuthProvider specifies a gRPC service that can be used to authenticate Redis clients. +// This service will be called every time an AUTH command is received from a client. +// If the service returns an error, authentication is considered failed. +// If the service returns a success, the client is considered authenticated. +// The service can also return an expiration timestamp, which will be used to disable any further +// commands from the client after it passes, unless a new AUTH command is received and the +// external auth service returns a new expiration timestamp. +message RedisExternalAuthProvider { + // External auth gRPC service configuration. + // It will be called every time an AUTH command is received from a client. + config.core.v3.GrpcService grpc_service = 1; + + // If set to true, the filter will expect an expiration timestamp in the response from the external + // auth service. This timestamp will be used to disable any further commands from the client after + // the expiration time, unless a new AUTH command is received and the external auth service returns + // a new expiration timestamp. + bool enable_auth_expiration = 2; +} diff --git a/modules/sync/envoyproxy/envoy/cas/6538be34cd3980ea8e64d2efe72aeaa2b47a6bfc684f66feed463866af9c4a3bba9264a5b053f3f00b72b8795c6152cd444d283810de4f10e91ea04d64986211 b/modules/sync/envoyproxy/envoy/cas/6538be34cd3980ea8e64d2efe72aeaa2b47a6bfc684f66feed463866af9c4a3bba9264a5b053f3f00b72b8795c6152cd444d283810de4f10e91ea04d64986211 new file mode 100644 index 00000000..f8facd68 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/6538be34cd3980ea8e64d2efe72aeaa2b47a6bfc684f66feed463866af9c4a3bba9264a5b053f3f00b72b8795c6152cd444d283810de4f10e91ea04d64986211 @@ -0,0 +1,676 @@ +syntax = "proto3"; + +package envoy.extensions.transport_sockets.tls.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/extension.proto"; +import "envoy/type/matcher/v3/string.proto"; + +import "google/protobuf/any.proto"; +import "google/protobuf/wrappers.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/migrate.proto"; +import "udpa/annotations/sensitive.proto"; +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.transport_sockets.tls.v3"; +option java_outer_classname = "CommonProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3;tlsv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Common TLS configuration] + +// [#next-free-field: 7] +message TlsParameters { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.auth.TlsParameters"; + + enum TlsProtocol { + // Envoy will choose the optimal TLS version. + TLS_AUTO = 0; + + // TLS 1.0 + TLSv1_0 = 1; + + // TLS 1.1 + TLSv1_1 = 2; + + // TLS 1.2 + TLSv1_2 = 3; + + // TLS 1.3 + TLSv1_3 = 4; + } + + enum CompliancePolicy { + // FIPS_202205 configures a TLS connection to use: + // + // * TLS 1.2 or 1.3 + // * For TLS 1.2, only ECDHE_[RSA|ECDSA]_WITH_AES_*_GCM_SHA*. + // * For TLS 1.3, only AES-GCM + // * P-256 or P-384 for key agreement. + // * For server signatures, only ``PKCS#1/PSS`` with ``SHA256/384/512``, or ECDSA + // with P-256 or P-384. + // + // .. attention:: + // + // Please refer to the `BoringSSL FIPS_202205 compliance policy `_ + // for details. + FIPS_202205 = 0; + + // CNSA2_202603 configures a TLS connection to use: + // + // * Only TLS 1.3, with AES-256-GCM. + // * Only ML-KEM-1024 for key agreement. + // * For handshake signatures, only ECDSA with P-384 and SHA-384, or RSA + // with SHA-384. + // + // Note: this setting aids with compliance with CNSA requirements but does not + // guarantee it. Careful reading of ``draft-becker-cnsa2-tls-profile`` is + // recommended. + // + // .. attention:: + // + // Please refer to the `BoringSSL CNSA2_202603 compliance policy `_ + // for details. + CNSA2_202603 = 1; + + // CNSA1_202603 configures a TLS connection to use: + // * TLS 1.2 or TLS 1.3. + // * For TLS 1.2, only TLS_ECDHE_[ECDSA|RSA]_WITH_AES_256_GCM_SHA384. + // * For TLS 1.3, only AES-256-GCM. + // * ML-KEM-1024 or P-384 for key agreement, preferring ML-KEM-1024 if the + // client supports it. + // * For handshake signatures, only ECDSA with P-384 and SHA-384, or RSA + // with SHA-384. + // + // Note: this setting aids with compliance with CNSA requirements but does not + // guarantee it. Careful reading of RFC 9151 is recommended. + // + // .. attention:: + // + // Please refer to the `BoringSSL CNSA1_202603 compliance policy `_ + // for details. + CNSA1_202603 = 2; + } + + // Minimum TLS protocol version. By default, it's ``TLSv1_2`` for both clients and servers. + // + // TLS protocol versions below TLSv1_2 require setting compatible ciphers with the + // ``cipher_suites`` setting as the default ciphers no longer include compatible ciphers. + // + // .. attention:: + // + // Using TLS protocol versions below TLSv1_2 has serious security considerations and risks. + TlsProtocol tls_minimum_protocol_version = 1 [(validate.rules).enum = {defined_only: true}]; + + // Maximum TLS protocol version. By default, it's ``TLSv1_2`` for clients and ``TLSv1_3`` for + // servers. + TlsProtocol tls_maximum_protocol_version = 2 [(validate.rules).enum = {defined_only: true}]; + + // If specified, the TLS listener will only support the specified `cipher list + // `_ + // when negotiating TLS 1.0-1.2 (this setting has no effect when negotiating TLS 1.3). + // + // If not specified, a default list will be used. Defaults are different for server (downstream) and + // client (upstream) TLS configurations. + // Defaults will change over time in response to security considerations; If you care, configure + // it instead of using the default. + // + // In non-FIPS builds, the default server cipher list is: + // + // .. code-block:: none + // + // [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305] + // [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305] + // ECDHE-ECDSA-AES256-GCM-SHA384 + // ECDHE-RSA-AES256-GCM-SHA384 + // + // In builds using :ref:`BoringSSL FIPS `, the default server cipher list is: + // + // .. code-block:: none + // + // ECDHE-ECDSA-AES128-GCM-SHA256 + // ECDHE-RSA-AES128-GCM-SHA256 + // ECDHE-ECDSA-AES256-GCM-SHA384 + // ECDHE-RSA-AES256-GCM-SHA384 + // + // In non-FIPS builds, the default client cipher list is: + // + // .. code-block:: none + // + // [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305] + // [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305] + // ECDHE-ECDSA-AES256-GCM-SHA384 + // ECDHE-RSA-AES256-GCM-SHA384 + // + // In builds using :ref:`BoringSSL FIPS `, the default client cipher list is: + // + // .. code-block:: none + // + // ECDHE-ECDSA-AES128-GCM-SHA256 + // ECDHE-RSA-AES128-GCM-SHA256 + // ECDHE-ECDSA-AES256-GCM-SHA384 + // ECDHE-RSA-AES256-GCM-SHA384 + repeated string cipher_suites = 3; + + // If specified, the TLS connection will only support the specified ECDH + // curves. If not specified, the default curves will be used. + // + // In non-FIPS builds, the default curves are: + // + // .. code-block:: none + // + // X25519 + // P-256 + // + // In builds using :ref:`BoringSSL FIPS `, the default curve is: + // + // .. code-block:: none + // + // P-256 + repeated string ecdh_curves = 4; + + // If specified, the TLS connection will only support the specified signature algorithms. + // The list is ordered by preference. + // If not specified, the default signature algorithms defined by BoringSSL will be used. + // + // Default signature algorithms selected by BoringSSL (may be out of date): + // + // .. code-block:: none + // + // ecdsa_secp256r1_sha256 + // rsa_pss_rsae_sha256 + // rsa_pkcs1_sha256 + // ecdsa_secp384r1_sha384 + // rsa_pss_rsae_sha384 + // rsa_pkcs1_sha384 + // rsa_pss_rsae_sha512 + // rsa_pkcs1_sha512 + // rsa_pkcs1_sha1 + // + // Signature algorithms supported by BoringSSL (may be out of date): + // + // .. code-block:: none + // + // rsa_pkcs1_sha256 + // rsa_pkcs1_sha384 + // rsa_pkcs1_sha512 + // ecdsa_secp256r1_sha256 + // ecdsa_secp384r1_sha384 + // ecdsa_secp521r1_sha512 + // rsa_pss_rsae_sha256 + // rsa_pss_rsae_sha384 + // rsa_pss_rsae_sha512 + // ed25519 + // rsa_pkcs1_sha1 + // ecdsa_sha1 + repeated string signature_algorithms = 5; + + // Compliance policies configure various aspects of the TLS based on the given policy. + // The policies are applied last during configuration and may override the other TLS + // parameters, or any previous policy. + repeated CompliancePolicy compliance_policies = 6 [(validate.rules).repeated = {max_items: 1}]; +} + +// BoringSSL private key method configuration. The private key methods are used for external +// (potentially asynchronous) signing and decryption operations. Some use cases for private key +// methods would be TPM support and TLS acceleration. +message PrivateKeyProvider { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.auth.PrivateKeyProvider"; + + reserved 2; + + reserved "config"; + + // Private key method provider name. The name must match a + // supported private key method provider type. + string provider_name = 1 [(validate.rules).string = {min_len: 1}]; + + // Private key method provider specific configuration. + oneof config_type { + google.protobuf.Any typed_config = 3 [(udpa.annotations.sensitive) = true]; + } + + // If the private key provider isn't available (eg. the required hardware capability doesn't existed), + // Envoy will fallback to the BoringSSL default implementation when the ``fallback`` is true. + // The default value is ``false``. + bool fallback = 4; +} + +// [#next-free-field: 10] +message TlsCertificate { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.auth.TlsCertificate"; + + // The TLS certificate chain. + // + // If ``certificate_chain`` is a filesystem path, a watch will be added to the + // parent directory for any file moves to support rotation. This currently + // only applies to dynamic secrets, when the ``TlsCertificate`` is delivered via + // SDS. + config.core.v3.DataSource certificate_chain = 1; + + // The TLS private key. + // + // If ``private_key`` is a filesystem path, a watch will be added to the parent + // directory for any file moves to support rotation. This currently only + // applies to dynamic secrets, when the ``TlsCertificate`` is delivered via SDS. + config.core.v3.DataSource private_key = 2 [(udpa.annotations.sensitive) = true]; + + // ``Pkcs12`` data containing TLS certificate, chain, and private key. + // + // If ``pkcs12`` is a filesystem path, the file will be read, but no watch will + // be added to the parent directory, since ``pkcs12`` isn't used by SDS. + // This field is mutually exclusive with ``certificate_chain``, ``private_key`` and ``private_key_provider``. + // This can't be marked as ``oneof`` due to API compatibility reasons. Setting + // both :ref:`private_key `, + // :ref:`certificate_chain `, + // or :ref:`private_key_provider ` + // and :ref:`pkcs12 ` + // fields will result in an error. Use :ref:`password + // ` + // to specify the password to unprotect the ``PKCS12`` data, if necessary. + config.core.v3.DataSource pkcs12 = 8 [(udpa.annotations.sensitive) = true]; + + // If specified, updates of file-based ``certificate_chain`` and ``private_key`` + // sources will be triggered by this watch. The certificate/key pair will be + // read together and validated for atomic read consistency (i.e. no + // intervening modification occurred between cert/key read, verified by file + // hash comparisons). This allows explicit control over the path watched, by + // default the parent directories of the filesystem paths in + // ``certificate_chain`` and ``private_key`` are watched if this field is not + // specified. This only applies when a ``TlsCertificate`` is delivered by SDS + // with references to filesystem paths. See the :ref:`SDS key rotation + // ` documentation for further details. + config.core.v3.WatchedDirectory watched_directory = 7; + + // BoringSSL private key method provider. This is an alternative to :ref:`private_key + // ` field. + // When both :ref:`private_key ` and + // :ref:`private_key_provider ` fields are set, + // ``private_key_provider`` takes precedence. + // If ``private_key_provider`` is unavailable and :ref:`fallback + // ` + // is enabled, ``private_key`` will be used. + PrivateKeyProvider private_key_provider = 6; + + // The password to decrypt the TLS private key. If this field is not set, it is assumed that the + // TLS private key is not password encrypted. + config.core.v3.DataSource password = 3 [(udpa.annotations.sensitive) = true]; + + // The OCSP response to be stapled with this certificate during the handshake. + // The response must be DER-encoded and may only be provided via ``filename`` or + // ``inline_bytes``. The response may pertain to only one certificate. + config.core.v3.DataSource ocsp_staple = 4; + + // [#not-implemented-hide:] + repeated config.core.v3.DataSource signed_certificate_timestamp = 5; + + // Optional per-certificate TLS parameters. When set on a server certificate, any specified + // fields override the corresponding context-level + // :ref:`tls_params ` + // for that certificate during the TLS handshake; unset fields continue to use the context-level + // values. This allows different cipher suites, ECDH curves, protocol versions, signature + // algorithms, or compliance policies per certificate. + // + // These parameters do not affect certificate selection, which continues to be based only on SNI, + // the client's ECDSA capability, and OCSP capability. They are applied after a certificate has + // been selected. For a multi-certificate configuration this means each certificate's parameters + // must be compatible with the clients that select it: if the selected certificate's parameters + // leave nothing in common with the client, the handshake fails and no other certificate is tried. + // + // Note: because these are overrides rather than constraints, a certificate-level + // ``tls_minimum_protocol_version`` can lower the floor set by the context-level + // ``tls_params``, weakening the listener's overall TLS security policy. + // Setting this on a client certificate is not supported and is ignored. + // This field has no effect on QUIC/HTTP3 downstream connections. + TlsParameters tls_params = 9; +} + +message TlsSessionTicketKeys { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.auth.TlsSessionTicketKeys"; + + // Keys for encrypting and decrypting TLS session tickets. The + // first key in the array contains the key to encrypt all new sessions created by this context. + // All keys are candidates for decrypting received tickets. This allows for easy rotation of keys + // by, for example, putting the new key first, and the previous key second. + // + // If :ref:`session_ticket_keys ` + // is not specified, the TLS library will still support resuming sessions via tickets, but it will + // use an internally-generated and managed key, so sessions cannot be resumed across hot restarts + // or on different hosts. + // + // Each key must contain exactly 80 bytes of cryptographically-secure random data. For + // example, the output of ``openssl rand 80``. + // + // .. attention:: + // + // Using this feature has serious security considerations and risks. Improper handling of keys + // may result in loss of secrecy in connections, even if ciphers supporting perfect forward + // secrecy are used. See https://www.imperialviolet.org/2013/06/27/botchingpfs.html for some + // discussion. To minimize the risk, you must: + // + // * Keep the session ticket keys at least as secure as your TLS certificate private keys + // * Rotate session ticket keys at least daily, and preferably hourly + // * Always generate keys using a cryptographically-secure random data source + repeated config.core.v3.DataSource keys = 1 + [(validate.rules).repeated = {min_items: 1}, (udpa.annotations.sensitive) = true]; +} + +// Indicates a certificate to be obtained from a named CertificateProvider plugin instance. +// The plugin instances are defined in the client's bootstrap file. +// The plugin allows certificates to be fetched/refreshed over the network asynchronously with +// respect to the TLS handshake. +// [#not-implemented-hide:] +message CertificateProviderPluginInstance { + // Provider instance name. + // + // Instance names should generally be defined not in terms of the underlying provider + // implementation (e.g., "file_watcher") but rather in terms of the function of the + // certificates (e.g., "foo_deployment_identity"). + string instance_name = 1 [(validate.rules).string = {min_len: 1}]; + + // Opaque name used to specify certificate instances or types. For example, "ROOTCA" to specify + // a root-certificate (validation context) or "example.com" to specify a certificate for a + // particular domain. Not all provider instances will actually use this field, so the value + // defaults to the empty string. + string certificate_name = 2; +} + +// Matcher for subject alternative names, to match both type and value of the SAN. +message SubjectAltNameMatcher { + // Indicates the choice of GeneralName as defined in section 4.2.1.5 of RFC 5280 to match + // against. + enum SanType { + SAN_TYPE_UNSPECIFIED = 0; + EMAIL = 1; + DNS = 2; + URI = 3; + IP_ADDRESS = 4; + OTHER_NAME = 5; + } + + // Specification of type of SAN. Note that the default enum value is an invalid choice. + SanType san_type = 1 [(validate.rules).enum = {defined_only: true not_in: 0}]; + + // Matcher for SAN value. + // + // If the :ref:`san_type ` + // is :ref:`DNS ` + // and the matcher type is :ref:`exact `, DNS wildcards are evaluated + // according to the rules in https://www.rfc-editor.org/rfc/rfc6125#section-6.4.3. + // For example, ``*.example.com`` would match ``test.example.com`` but not ``example.com`` and not + // ``a.b.example.com``. + // + // The string matching for OTHER_NAME SAN values depends on their ASN.1 type: + // + // * OBJECT: Validated against its dotted numeric notation (e.g., "1.2.3.4") + // * BOOLEAN: Validated against strings "true" or "false" + // * INTEGER/ENUMERATED: Validated against a string containing the integer value + // * NULL: Validated against an empty string + // * Other types: Validated directly against the string value + type.matcher.v3.StringMatcher matcher = 2 [(validate.rules).message = {required: true}]; + + // OID Value which is required if OTHER_NAME SAN type is used. + // For example, UPN OID is 1.3.6.1.4.1.311.20.2.3 + // (Reference: http://oid-info.com/get/1.3.6.1.4.1.311.20.2.3). + // + // If set for SAN types other than OTHER_NAME, it will be ignored. + string oid = 3; +} + +// [#next-free-field: 19] +message CertificateValidationContext { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.auth.CertificateValidationContext"; + + // Peer certificate verification mode. + enum TrustChainVerification { + // Perform default certificate verification (e.g., against CA / verification lists) + VERIFY_TRUST_CHAIN = 0; + + // Connections where the certificate fails verification will be permitted. + // For HTTP connections, the result of certificate verification can be used in route matching. ( + // see :ref:`validated ` ). + ACCEPT_UNTRUSTED = 1; + } + + message SystemRootCerts { + } + + reserved 4, 5; + + reserved "verify_subject_alt_name"; + + // TLS certificate data containing certificate authority certificates to use in verifying + // a presented peer certificate (e.g. server certificate for clusters or client certificate + // for listeners). If not specified and a peer certificate is presented it will not be + // verified. By default, a client certificate is optional, unless one of the additional + // options (:ref:`require_client_certificate + // `, + // :ref:`verify_certificate_spki + // `, + // :ref:`verify_certificate_hash + // `, or + // :ref:`match_typed_subject_alt_names + // `) is also + // specified. + // + // It can optionally contain certificate revocation lists, in which case Envoy will verify + // that the presented peer certificate has not been revoked by one of the included CRLs. Note + // that if a CRL is provided for any certificate authority in a trust chain, a CRL must be + // provided for all certificate authorities in that chain. Failure to do so will result in + // verification failure for both revoked and unrevoked certificates from that chain. + // The behavior of requiring all certificates to contain CRLs can be altered by + // setting :ref:`only_verify_leaf_cert_crl ` + // true. If set to true, only the final certificate in the chain undergoes CRL verification. + // + // See :ref:`the TLS overview ` for a list of common + // system CA locations. + // + // If ``trusted_ca`` is a filesystem path, a watch will be added to the parent + // directory for any file moves to support rotation. This currently only + // applies to dynamic secrets, when the ``CertificateValidationContext`` is + // delivered via SDS. + // + // X509_V_FLAG_PARTIAL_CHAIN is set by default, so non-root/intermediate ca certificate in ``trusted_ca`` + // can be treated as trust anchor as well. It allows verification with building valid partial chain instead + // of a full chain. + // + // If ``ca_certificate_provider_instance`` is set, it takes precedence over ``trusted_ca``. + config.core.v3.DataSource trusted_ca = 1 + [(udpa.annotations.field_migrate).oneof_promotion = "ca_cert_source"]; + + // Certificate provider instance for fetching TLS certificates. + // + // If set, takes precedence over ``trusted_ca``. + // [#not-implemented-hide:] + CertificateProviderPluginInstance ca_certificate_provider_instance = 13 + [(udpa.annotations.field_migrate).oneof_promotion = "ca_cert_source"]; + + // Use system root certs for validation. + // If present, system root certs are used only if neither of the ``trusted_ca`` + // or ``ca_certificate_provider_instance`` fields are set. + // [#not-implemented-hide:] + SystemRootCerts system_root_certs = 17; + + // If specified, updates of a file-based ``trusted_ca`` source will be triggered + // by this watch. This allows explicit control over the path watched, by + // default the parent directory of the filesystem path in ``trusted_ca`` is + // watched if this field is not specified. This only applies when a + // ``CertificateValidationContext`` is delivered by SDS with references to + // filesystem paths. See the :ref:`SDS key rotation ` + // documentation for further details. + config.core.v3.WatchedDirectory watched_directory = 11; + + // An optional list of base64-encoded SHA-256 hashes. If specified, Envoy will verify that the + // SHA-256 of the DER-encoded Subject Public Key Information (SPKI) of the presented certificate + // matches one of the specified values. + // + // A base64-encoded SHA-256 of the Subject Public Key Information (SPKI) of the certificate + // can be generated with the following command: + // + // .. code-block:: bash + // + // $ openssl x509 -in path/to/client.crt -noout -pubkey + // | openssl pkey -pubin -outform DER + // | openssl dgst -sha256 -binary + // | openssl enc -base64 + // NvqYIYSbgK2vCJpQhObf77vv+bQWtc5ek5RIOwPiC9A= + // + // This is the format used in HTTP Public Key Pinning. + // + // When both: + // :ref:`verify_certificate_hash + // ` and + // :ref:`verify_certificate_spki + // ` are specified, + // a hash matching value from either of the lists will result in the certificate being accepted. + // + // .. attention:: + // + // This option is preferred over :ref:`verify_certificate_hash + // `, + // because SPKI is tied to a private key, so it doesn't change when the certificate + // is renewed using the same private key. + repeated string verify_certificate_spki = 3 + [(validate.rules).repeated = {items {string {min_len: 44 max_bytes: 44}}}]; + + // An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will verify that + // the SHA-256 of the DER-encoded presented certificate matches one of the specified values. + // + // A hex-encoded SHA-256 of the certificate can be generated with the following command: + // + // .. code-block:: bash + // + // $ openssl x509 -in path/to/client.crt -outform DER | openssl dgst -sha256 | cut -d" " -f2 + // df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a + // + // A long hex-encoded and colon-separated SHA-256 (a.k.a. "fingerprint") of the certificate + // can be generated with the following command: + // + // .. code-block:: bash + // + // $ openssl x509 -in path/to/client.crt -noout -fingerprint -sha256 | cut -d"=" -f2 + // DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A + // + // Both of those formats are acceptable. + // + // When both: + // :ref:`verify_certificate_hash + // ` and + // :ref:`verify_certificate_spki + // ` are specified, + // a hash matching value from either of the lists will result in the certificate being accepted. + repeated string verify_certificate_hash = 2 + [(validate.rules).repeated = {items {string {min_len: 64 max_bytes: 95}}}]; + + // An optional list of Subject Alternative name matchers. If specified, Envoy will verify that the + // Subject Alternative Name of the presented certificate matches one of the specified matchers. + // The matching uses "any" semantics, that is to say, the SAN is verified if at least one matcher is + // matched. + // + // When a certificate has wildcard DNS SAN entries, to match a specific client, it should be + // configured with exact match type in the :ref:`string matcher `. + // For example if the certificate has "\*.example.com" as DNS SAN entry, to allow only "api.example.com", + // it should be configured as shown below. + // + // .. code-block:: yaml + // + // match_typed_subject_alt_names: + // - san_type: DNS + // matcher: + // exact: "api.example.com" + // + // .. attention:: + // + // Subject Alternative Names are easily spoofable and verifying only them is insecure, + // therefore this option must be used together with :ref:`trusted_ca + // `. + repeated SubjectAltNameMatcher match_typed_subject_alt_names = 15; + + // This field is deprecated in favor of + // :ref:`match_typed_subject_alt_names + // `. + // Note that if both this field and :ref:`match_typed_subject_alt_names + // ` + // are specified, the former (deprecated field) is ignored. + repeated type.matcher.v3.StringMatcher match_subject_alt_names = 9 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // [#not-implemented-hide:] Must present signed certificate time-stamp. + google.protobuf.BoolValue require_signed_certificate_timestamp = 6; + + // An optional `certificate revocation list + // `_ + // (in PEM format). If specified, Envoy will verify that the presented peer + // certificate has not been revoked by this CRL. If this DataSource contains + // multiple CRLs, all of them will be used. Note that if a CRL is provided + // for any certificate authority in a trust chain, a CRL must be provided + // for all certificate authorities in that chain. Failure to do so will + // result in verification failure for both revoked and unrevoked certificates + // from that chain. This default behavior can be altered by setting + // :ref:`only_verify_leaf_cert_crl ` to + // true. + // + // If ``crl`` is a filesystem path, a watch will be added to the parent + // directory for any file moves to support rotation. This currently only + // applies to dynamic secrets, when the ``CertificateValidationContext`` is + // delivered via SDS. + config.core.v3.DataSource crl = 7; + + // If specified, Envoy will not reject expired certificates. + bool allow_expired_certificate = 8; + + // Certificate trust chain verification mode. + TrustChainVerification trust_chain_verification = 10 + [(validate.rules).enum = {defined_only: true}]; + + // The configuration of an extension specific certificate validator. + // If specified, all validation is done by the specified validator, + // and the behavior of all other validation settings is defined by the specified validator (and may be entirely ignored, unused, and unvalidated). + // Refer to the documentation for the specified validator. If you do not want a custom validation algorithm, do not set this field. + // [#extension-category: envoy.tls.cert_validator] + config.core.v3.TypedExtensionConfig custom_validator_config = 12; + + // If this option is set to true, only the certificate at the end of the + // certificate chain will be subject to validation by :ref:`CRL `. + bool only_verify_leaf_cert_crl = 14; + + // Defines maximum depth of a certificate chain accepted in verification, the default limit is 100, though this can be system-dependent. + // This number does not include the leaf but includes the trust anchor, so a depth of 1 allows the leaf and one CA certificate. If a trusted issuer + // appears in the chain, but in a depth larger than configured, the certificate validation will fail. + // This matches the semantics of ``SSL_CTX_set_verify_depth`` in OpenSSL 1.0.x and older versions of BoringSSL. It differs from ``SSL_CTX_set_verify_depth`` + // in OpenSSL 1.1.x and newer versions of BoringSSL in that the trust anchor is included. + // Trusted issues are specified by setting :ref:`trusted_ca ` + google.protobuf.UInt32Value max_verify_depth = 16 [(validate.rules).uint32 = {lte: 100}]; + + // If true, the server does not include the trusted-CA distinguished names in the + // TLS ``CertificateRequest`` message. CAs from :ref:`trusted_ca + // ` + // are still used to validate presented client certificates; only the wire + // advertisement changes. + // + // This is useful when the configured CA set is large enough that the + // ``CertificateRequest`` would exceed client-side TLS record limits, or when + // clients mishandle the CA set in some way. + // + // .. attention:: + // + // When enabled, clients that rely on the advertised CA list to select among + // multiple client certificates may now send no certificate or the wrong one; + // validation will then fail with the standard TLS alert. + // + // This option only affects downstream (server) TLS connections where Envoy sends a + // ``CertificateRequest`` to clients. It has no effect on upstream connections. + // + // Honored by the built-in validator and the SPIFFE validator. Validators that do + // not set a client CA list themselves (e.g., the dynamic-modules validator) are + // unaffected. Defaults to false. + bool suppress_client_ca_list = 18; +} diff --git a/modules/sync/envoyproxy/envoy/cas/671c0c38410ba087095fcc257e77261d170bdca8d0ed3c3f9150e302792944f3ce16544a52738be37a92cb3b9dd5d33c40f05fa967695ae0d3b790b8479865ed b/modules/sync/envoyproxy/envoy/cas/671c0c38410ba087095fcc257e77261d170bdca8d0ed3c3f9150e302792944f3ce16544a52738be37a92cb3b9dd5d33c40f05fa967695ae0d3b790b8479865ed new file mode 100644 index 00000000..534e49bc --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/671c0c38410ba087095fcc257e77261d170bdca8d0ed3c3f9150e302792944f3ce16544a52738be37a92cb3b9dd5d33c40f05fa967695ae0d3b790b8479865ed @@ -0,0 +1,202 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.local_ratelimit.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/config/route/v3/route_components.proto"; +import "envoy/extensions/common/ratelimit/v3/ratelimit.proto"; +import "envoy/type/v3/http_status.proto"; +import "envoy/type/v3/token_bucket.proto"; + +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.local_ratelimit.v3"; +option java_outer_classname = "LocalRateLimitProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/local_ratelimit/v3;local_ratelimitv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Local Rate limit] +// Local Rate limit :ref:`configuration overview `. +// [#extension: envoy.filters.http.local_ratelimit] + +// [#next-free-field: 20] +message LocalRateLimit { + // The human readable prefix to use when emitting stats. + string stat_prefix = 1 [(validate.rules).string = {min_len: 1}]; + + // This field allows for a custom HTTP response status code to the downstream client when + // the request has been rate limited. + // Defaults to 429 (TooManyRequests). + // + // .. note:: + // If this is set to < 400, 429 will be used instead. + type.v3.HttpStatus status = 2; + + // The token bucket configuration to use for rate limiting requests that are processed by this + // filter. Each request processed by the filter consumes a single token. If the token is available, + // the request will be allowed. If no tokens are available, the request will receive the configured + // rate limit status. + // + // .. note:: + // It's fine for the token bucket to be unset for the global configuration since the rate limit + // can be applied at a the virtual host or route level. Thus, the token bucket must be set + // for the per route configuration otherwise the config will be rejected. + // + // .. note:: + // When using per route configuration, the bucket becomes unique to that route. + // + // .. note:: + // In the current implementation the token bucket's :ref:`fill_interval + // ` must be >= 50ms to avoid too aggressive + // refills. + type.v3.TokenBucket token_bucket = 3; + + // If set, this will enable -- but not necessarily enforce -- the rate limit for the given + // fraction of requests. + // Defaults to 0% of requests for safety. + config.core.v3.RuntimeFractionalPercent filter_enabled = 4; + + // If set, this will enforce the rate limit decisions for the given fraction of requests. + // + // Note: this only applies to the fraction of enabled requests. + // + // Defaults to 0% of requests for safety. + config.core.v3.RuntimeFractionalPercent filter_enforced = 5; + + // Specifies a list of HTTP headers that should be added to each request that + // has been rate limited and is also forwarded upstream. This can only occur when the + // filter is enabled but not enforced. + repeated config.core.v3.HeaderValueOption request_headers_to_add_when_not_enforced = 10 + [(validate.rules).repeated = {max_items: 10}]; + + // Specifies a list of HTTP headers that should be added to each response for requests that + // have been rate limited. This occurs when the filter is enabled and fully enforced. + repeated config.core.v3.HeaderValueOption response_headers_to_add = 6 + [(validate.rules).repeated = {max_items: 10}]; + + // The rate limit descriptor list to use in the local rate limit to override + // on. The rate limit descriptor is selected by the first full match from the + // request descriptors. + // + // Example on how to use :ref:`this `. + // + // .. note:: + // + // In the current implementation the descriptor's token bucket :ref:`fill_interval + // ` must be a multiple + // global :ref:`token bucket's` fill interval. + // + // The descriptors must match verbatim for rate limiting to apply. There is no partial + // match by a subset of descriptor entries in the current implementation. + repeated common.ratelimit.v3.LocalRateLimitDescriptor descriptors = 8; + + // Specifies the rate limit configurations to be applied with the same + // stage number. If not set, the default stage number is 0. + // + // .. note:: + // + // The filter supports a range of 0 - 10 inclusively for stage numbers. + uint32 stage = 9 [(validate.rules).uint32 = {lte: 10}]; + + // Specifies the scope of the rate limiter's token bucket. + // If set to false, the token bucket is shared across all worker threads, + // thus the rate limits are applied per Envoy process. + // If set to true, a token bucket is allocated for each connection. + // Thus the rate limits are applied per connection thereby allowing + // one to rate limit requests on a per connection basis. + // If unspecified, the default value is false. + bool local_rate_limit_per_downstream_connection = 11; + + // Enables the local cluster level rate limiting, iff this is set explicitly. For example, + // given an Envoy gateway that contains N Envoy instances and a rate limit rule X tokens + // per second. If this is set, the total rate limit of whole gateway will always be X tokens + // per second regardless of how N changes. If this is not set, the total rate limit of whole + // gateway will be N * X tokens per second. + // + // .. note:: + // This should never be set if the ``local_rate_limit_per_downstream_connection`` is set to + // true. Because if per connection rate limiting is enabled, we assume that the token buckets + // should never be shared across Envoy instances. + // + // .. note:: + // This only works when the :ref:`local cluster name + // ` is set and + // the related cluster is defined in the bootstrap configuration. + common.ratelimit.v3.LocalClusterRateLimit local_cluster_rate_limit = 16; + + // Defines the standard version to use for X-RateLimit headers emitted by the filter. + // + // * ``X-RateLimit-Limit`` - indicates the request-quota associated to the + // client in the current time-window followed by the description of the + // quota policy. + // * ``X-RateLimit-Remaining`` - indicates the remaining requests in the + // current time-window. + // * ``X-RateLimit-Reset`` - indicates the number of seconds until reset of + // the current time-window. + // + // In case rate limiting policy specifies more then one time window, the values + // above represent the window that is closest to reaching its limit. + // + // For more information about the headers specification see selected version of + // the `draft RFC `_. + // + // Disabled by default. + common.ratelimit.v3.XRateLimitHeadersRFCVersion enable_x_ratelimit_headers = 12 + [(validate.rules).enum = {defined_only: true}]; + + // Specifies if the local rate limit filter should include the virtual host rate limits. + common.ratelimit.v3.VhRateLimitsOptions vh_rate_limits = 13 + [(validate.rules).enum = {defined_only: true}]; + + // Specifies if default token bucket should be always consumed. + // If set to false, default token bucket will only be consumed when there is + // no matching descriptor. If set to true, default token bucket will always + // be consumed. Default is true. + google.protobuf.BoolValue always_consume_default_token_bucket = 14; + + // Specifies whether a ``RESOURCE_EXHAUSTED`` gRPC code must be returned instead + // of the default ``UNAVAILABLE`` gRPC code for a rate limited gRPC call. The + // HTTP code will be 200 for a gRPC response. + bool rate_limited_as_resource_exhausted = 15; + + // Rate limit configuration that is used to generate a list of descriptor entries based on + // the request context. The generated entries will be used to find one or multiple matched rate + // limit rule from the ``descriptors``. + // If this is set, then + // :ref:`VirtualHost.rate_limits` or + // :ref:`RouteAction.rate_limits` fields + // will be ignored. + // + // .. note:: + // Not all configuration fields of + // :ref:`rate limit config ` is supported at here. + // Following fields are not supported: + // + // 1. :ref:`rate limit stage `. + // 2. :ref:`dynamic metadata `. + // 3. :ref:`disable_key `. + // 4. :ref:`override limit `. + repeated config.route.v3.RateLimit rate_limits = 17; + + // Specifies the max dynamic descriptors kept in the cache for a particular wildcard descriptor + // configured in the global :ref:`descriptors`. + // Wildcard descriptor means descriptor has one or more entries with just key and value omitted. For example if user has configured two descriptors + // with blank value entries, then max dynamic descriptors stored in the LRU cache will be 2 * max_dynamic_descriptors. + // Actual number of dynamic descriptors will depend on the cardinality of unique values received from the http request for the omitted + // values. + // Minimum is 1. Default is 20. + google.protobuf.UInt32Value max_dynamic_descriptors = 18 [(validate.rules).uint32 = {gte: 1}]; + + // Specifies whether the filter emits a ``Retry-After`` header when it enforces an HTTP 429 + // response. This option has no effect on responses with any other status code. The value is the + // number of seconds until the next token is available in the bucket that rejected the request, + // clamped to at least 1. + // If ``response_headers_to_add`` sets a ``Retry-After`` header, the filter does not overwrite it. + // + // Disabled by default. + bool enable_retry_after_header = 19; +} diff --git a/modules/sync/envoyproxy/envoy/cas/697ee83d1cbe18b6c803d53ccc7161b52abd0362079be6744fc2fa5d5bc8c6db3d06c76d009d3da91a1d3a8025a9811d30282a8dfaf50fc23b6cfd5e104ae7ec b/modules/sync/envoyproxy/envoy/cas/697ee83d1cbe18b6c803d53ccc7161b52abd0362079be6744fc2fa5d5bc8c6db3d06c76d009d3da91a1d3a8025a9811d30282a8dfaf50fc23b6cfd5e104ae7ec new file mode 100644 index 00000000..fa4d7d50 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/697ee83d1cbe18b6c803d53ccc7161b52abd0362079be6744fc2fa5d5bc8c6db3d06c76d009d3da91a1d3a8025a9811d30282a8dfaf50fc23b6cfd5e104ae7ec @@ -0,0 +1,101 @@ +syntax = "proto3"; + +package envoy.extensions.rate_limit_descriptors.jwt_claim.v3; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.rate_limit_descriptors.jwt_claim.v3"; +option java_outer_classname = "JwtClaimProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/rate_limit_descriptors/jwt_claim/v3;jwt_claimv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Rate limit descriptor from JWT claim] +// [#extension: envoy.rate_limit_descriptors.jwt_claim] + +// The following descriptor entry is appended with a value extracted from a +// named claim in a JWT found in an HTTP request header or cookie. +// +// .. code-block:: cpp +// +// ("", "") +// +// .. warning:: +// +// SECURITY WARNING: This extension does NOT verify JWT signatures. Any +// party can present a forged or expired JWT with arbitrary claims, and +// those claims will be used as rate limit descriptor values. This means +// an attacker can trivially evade or manipulate per-claim rate limits +// (e.g. impersonate another subject, or rotate a fake claim value on +// every request to bypass limiting entirely) unless the JWT signature +// is verified elsewhere in the request path — for example, by an +// upstream mTLS-authenticated service, or by an +// :ref:`envoy.filters.http.jwt_authn +// ` +// filter earlier in the same filter chain that rejects invalid tokens +// before this descriptor action runs. +// +// DO NOT use this extension to gate access, apply differentiated rate +// limits by trust level, or make any authorization-adjacent decision +// based on the extracted claim, unless signature verification is +// PROVABLY performed elsewhere in the request path. +// +// If you need Envoy itself to verify the JWT before rate limiting, +// use the :ref:`envoy.filters.http.jwt_authn +// ` +// filter (placed before the rate limit filter) together with a +// :ref:`request_headers +// ` +// or :ref:`metadata +// ` +// descriptor action instead of this extension. +// [#next-free-field: 8] +message Descriptor { + // The key to use in the descriptor entry. + string descriptor_key = 1 [(validate.rules).string = {min_len: 1}]; + + // The name of the HTTP header containing the JWT, e.g. "authorization". + // + // Exactly one of ``header_name`` or ``cookie`` must be set. + string header_name = 2 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // The name of the cookie containing the JWT, e.g. "auth_token". The cookie + // is looked up in the request's ``Cookie`` header. + // + // Exactly one of ``header_name`` or ``cookie`` must be set. + string cookie = 7 [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // The value prefix to strip before parsing the remainder as a JWT, e.g. + // "Bearer " (with a trailing space) for an "authorization" header + // formatted as "Authorization: Bearer ". If the header or cookie + // value does not start with this prefix, the descriptor is not populated + // (falls through to ``default_value``/``skip_if_absent`` below). + // + // This is typically only needed for ``header_name``; cookie values do not + // usually carry a prefix. + string value_prefix = 3 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE strict: false}]; + + // The name of the JWT claim to extract. Can be a nested claim, dot- + // separated, e.g. "claim.nested.key". Matches the same convention as + // :ref:`JwtClaimToHeader.claim_name + // `. + // Only string-valued claims are supported; non-string claims (numbers, + // booleans, arrays, objects) are treated as absent. An empty string-valued + // claim populates the descriptor with an empty value. + string claim_name = 4 [(validate.rules).string = {min_len: 1}]; + + // The default value to use if the header or cookie is absent, is not a + // structurally valid JWT, or the named claim is absent/non-string. + string default_value = 5; + + // If true, Envoy skips this descriptor entry (rather than aborting the + // whole descriptor for this action list) when the header or cookie is + // absent, the JWT cannot be parsed, or the named claim is absent/non-string, and + // ``default_value`` is not specified. An empty string-valued claim is + // present and produces an entry with an empty value regardless of this + // setting. + bool skip_if_absent = 6; +} diff --git a/modules/sync/envoyproxy/envoy/cas/698dbbd10b0ac4fc88e4935f5677ad37d0abc91eea4bf05e3c35035033cf235d968216abe5b582a7b0c5181ad56a743cfce17ec291b852384f2d3f3ec4c630af b/modules/sync/envoyproxy/envoy/cas/698dbbd10b0ac4fc88e4935f5677ad37d0abc91eea4bf05e3c35035033cf235d968216abe5b582a7b0c5181ad56a743cfce17ec291b852384f2d3f3ec4c630af new file mode 100644 index 00000000..135ce3ef --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/698dbbd10b0ac4fc88e4935f5677ad37d0abc91eea4bf05e3c35035033cf235d968216abe5b582a7b0c5181ad56a743cfce17ec291b852384f2d3f3ec4c630af @@ -0,0 +1,202 @@ +syntax = "proto3"; + +package envoy.config.route.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/config_source.proto"; +import "envoy/config/core/v3/extension.proto"; +import "envoy/config/route/v3/route_components.proto"; + +import "google/protobuf/any.proto"; +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.config.route.v3"; +option java_outer_classname = "RouteProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/config/route/v3;routev3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: HTTP route configuration] +// * Routing :ref:`architecture overview ` +// * HTTP :ref:`router filter ` + +// [#next-free-field: 20] +message RouteConfiguration { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.RouteConfiguration"; + + // The name of the route configuration. For example, it might match + // :ref:`route_config_name + // ` in + // :ref:`envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.Rds`. + string name = 1; + + // An array of virtual hosts that make up the route table. + repeated VirtualHost virtual_hosts = 2; + + // An array of virtual hosts will be dynamically loaded via the VHDS API. + // Both ``virtual_hosts`` and ``vhds`` fields will be used when present. ``virtual_hosts`` can be used + // for a base routing table or for infrequently changing virtual hosts. ``vhds`` is used for + // on-demand discovery of virtual hosts. The contents of these two fields will be merged to + // generate a routing table for a given RouteConfiguration, with ``vhds`` derived configuration + // taking precedence. + Vhds vhds = 9; + + // Optionally specifies a list of HTTP headers that the connection manager + // will consider to be internal only. If they are found on external requests they will be cleaned + // prior to filter invocation. See :ref:`config_http_conn_man_headers_x-envoy-internal` for more + // information. + repeated string internal_only_headers = 3 [ + (validate.rules).repeated = {items {string {well_known_regex: HTTP_HEADER_NAME strict: false}}} + ]; + + // Specifies a list of HTTP headers that should be added to each response that + // the connection manager encodes. Headers specified at this level are applied + // after headers from any enclosed :ref:`envoy_v3_api_msg_config.route.v3.VirtualHost` or + // :ref:`envoy_v3_api_msg_config.route.v3.RouteAction`. For more information, including details on + // header value syntax, see the documentation on :ref:`custom request headers + // `. + repeated core.v3.HeaderValueOption response_headers_to_add = 4 + [(validate.rules).repeated = {max_items: 1000}]; + + // Specifies a list of HTTP headers that should be removed from each response + // that the connection manager encodes. + repeated string response_headers_to_remove = 5 [ + (validate.rules).repeated = {items {string {well_known_regex: HTTP_HEADER_NAME strict: false}}} + ]; + + // Specifies a list of HTTP headers that should be added to each request + // routed by the HTTP connection manager. Headers specified at this level are + // applied after headers from any enclosed :ref:`envoy_v3_api_msg_config.route.v3.VirtualHost` or + // :ref:`envoy_v3_api_msg_config.route.v3.RouteAction`. For more information, including details on + // header value syntax, see the documentation on :ref:`custom request headers + // `. + repeated core.v3.HeaderValueOption request_headers_to_add = 6 + [(validate.rules).repeated = {max_items: 1000}]; + + // Specifies a list of HTTP headers that should be removed from each request + // routed by the HTTP connection manager. + repeated string request_headers_to_remove = 8 [ + (validate.rules).repeated = {items {string {well_known_regex: HTTP_HEADER_NAME strict: false}}} + ]; + + // Headers mutations at all levels are evaluated, if specified. By default, the order is from most + // specific (i.e. route entry level) to least specific (i.e. route configuration level). Later header + // mutations may override earlier mutations. + // This order can be reversed by setting this field to true. In other words, most specific level mutation + // is evaluated last. + // + bool most_specific_header_mutations_wins = 10; + + // An optional boolean that specifies whether the clusters that the route + // table refers to will be validated by the cluster manager. If set to true + // and a route refers to a non-existent cluster, the route table will not + // load. If set to false and a route refers to a non-existent cluster, the + // route table will load and the router filter will return a 404 if the route + // is selected at runtime. This setting defaults to true if the route table + // is statically defined via the :ref:`route_config + // ` + // option. This setting default to false if the route table is loaded dynamically via the + // :ref:`rds + // ` + // option. Users may wish to override the default behavior in certain cases (for example when + // using CDS with a static route table). + google.protobuf.BoolValue validate_clusters = 7; + + // The maximum bytes of the response :ref:`direct response body + // ` size. If not specified the default + // is 4096. + // + // .. warning:: + // + // Envoy currently holds the content of :ref:`direct response body + // ` in memory. Be careful setting + // this to be larger than the default 4KB, since the allocated memory for direct response body + // is not subject to data plane buffering controls. + // + google.protobuf.UInt32Value max_direct_response_body_size_bytes = 11; + + // A list of plugins and their configurations which may be used by a + // :ref:`cluster specifier plugin name ` + // within the route. All ``extension.name`` fields in this list must be unique. + repeated ClusterSpecifierPlugin cluster_specifier_plugins = 12; + + // Specify a set of default request mirroring policies which apply to all routes under its virtual hosts. + // Note that policies are not merged, the most specific non-empty one becomes the mirror policies. + repeated RouteAction.RequestMirrorPolicy request_mirror_policies = 13; + + // By default, port in :authority header (if any) is used in host matching. + // With this option enabled, Envoy will ignore the port number in the :authority header (if any) when picking VirtualHost. + // + // .. note:: + // This option will not strip the port number (if any) contained in route config + // :ref:`envoy_v3_api_msg_config.route.v3.VirtualHost`.domains field. + bool ignore_port_in_host_matching = 14; + + // Normally, virtual host matching is done using the :authority (or + // Host: in HTTP < 2) HTTP header. Setting this will instead, use a + // different HTTP header for this purpose. + string vhost_header = 18 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // Ignore path-parameters in path-matching. + // Before RFC3986, URI were like(RFC1808): :///;?# + // Envoy by default takes ":path" as ";". + // For users who want to only match path on the "" portion, this option should be true. + bool ignore_path_parameters_in_path_matching = 15; + + // This field can be used to provide RouteConfiguration level per filter config. The key should match the + // :ref:`filter config name + // `. + // See :ref:`Http filter route specific config ` + // for details. + // [#comment: An entry's value may be wrapped in a + // :ref:`FilterConfig` + // message to specify additional options.] + map typed_per_filter_config = 16; + + // The metadata field can be used to provide additional information + // about the route configuration. It can be used for configuration, stats, and logging. + // The metadata should go under the filter namespace that will need it. + // For instance, if the metadata is intended for the Router filter, + // the filter name should be specified as ``envoy.filters.http.router``. + core.v3.Metadata metadata = 17; + + // After the route matching has resolved a route for incoming request, the route specifiers + // are applied to the route to customize or monitor it and the output of the specifiers will be + // used as the final route by Envoy for the request. The specifiers here will not modify/affect + // the request attributes (e.g., headers, path) directly. + // + // Specifiers are executed in order, and the output of each is the input of the next. The route + // that comes out of the last one is the route Envoy uses for the request. + // + // Specifiers are configured at three levels. Specifiers in three levels will run in this order: + // + // 1. The ``route_specifiers`` of resolved + // :ref:`route ` + // 2. The ``route_specifiers`` of resolved + // :ref:`virtual host ` + // 3. The ``route_specifiers`` of + // :ref:`route configuration `. + // + // .. note:: + // If the route matching resolves no route, the route specifiers at the route configuration + // and the virtual host levels will still be applied to null. This allows route specifiers to + // optionally generate a valid route even when no route is resolved for the request. + // Similarly, if the route matching resolves a valid route, the route specifiers may drop it + // and return no route. Then Envoy will treat it as route not found and result in 404 response. + // + // See :ref:`route specifiers ` for more details. + // [#extension-category: envoy.router.route_specifiers] + repeated core.v3.TypedExtensionConfig route_specifiers = 19; +} + +message Vhds { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.Vhds"; + + // Configuration source specifier for VHDS. + core.v3.ConfigSource config_source = 1 [(validate.rules).message = {required: true}]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/7218e21f8ca32a4ffd9ba9412c292991f1e79673548070eceb807f2d5fb7c07ad2d88f23cce6dc9cc2859751d1401fc9df818185b9e1b7d8a1b4c98156d54b6f b/modules/sync/envoyproxy/envoy/cas/7218e21f8ca32a4ffd9ba9412c292991f1e79673548070eceb807f2d5fb7c07ad2d88f23cce6dc9cc2859751d1401fc9df818185b9e1b7d8a1b4c98156d54b6f new file mode 100644 index 00000000..d4897ec9 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/7218e21f8ca32a4ffd9ba9412c292991f1e79673548070eceb807f2d5fb7c07ad2d88f23cce6dc9cc2859751d1401fc9df818185b9e1b7d8a1b4c98156d54b6f @@ -0,0 +1,218 @@ +syntax = "proto3"; + +package envoy.extensions.router.route_specifiers.dynamic_modules.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/config/route/v3/route_components.proto"; +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; +import "envoy/type/matcher/v3/regex.proto"; + +import "google/protobuf/any.proto"; +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.router.route_specifiers.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/router/route_specifiers/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Dynamic modules route specifier] +// +// A :ref:`route specifier ` implemented by a +// :ref:`dynamic module `. For each request the module keeps the +// route that route matching resolved, refines it, replaces it with one of the route templates +// declared here, drops it, or lets route matching carry on with the next route. Envoy builds every +// route from validated configuration, so a module can never produce a malformed route. +// +// See :ref:`the dynamic modules route specifier +// ` for more details. +// [#extension: envoy.router.route_specifiers.dynamic_modules] + +// What Envoy does when the decision of the module cannot be honored. +// +// This covers a module that reports an error, which is what the SDK does when the module panics, +// a decision or a status Envoy does not know, a template selection that names an identifier that +// is not declared, a template whose ``match`` does not hold for the request, an override recorded +// without a template while route matching resolved no route, route entry overrides recorded for a +// direct response, and route metadata a typed metadata factory rejects. +enum FailurePolicy { + // Must be set explicitly. + FAILURE_POLICY_UNSPECIFIED = 0; + + // Use the route the specifier was given, unchanged, and carry on with the chain. This keeps the + // routing of the route table the module replaces in effect while it is being rolled out. If the + // specifier was given no route, the request has no route. + PASS_THROUGH = 1; + + // Use no route, so the request is handled as if nothing had matched, and end the chain. Prefer + // this once the module owns the routing of the virtual host, so that a failure never falls back + // to the routes that are left. + NO_ROUTE = 2; + + // Skip the route the specifier was given and let route matching carry on with the next route, + // keeping the route table the module replaces in effect for the request. Prefer this for the + // catch all route that owns routing during a migration, so a module failure falls back to the + // route table rather than to the catch all route's own action. + CONTINUE_MATCHING = 3; +} + +// A named route the module may select for a request. +// +// A template is built and validated once, when the specifier is configured, so an invalid template +// is rejected at configuration load. It inherits from the virtual host and the route configuration +// the specifier is configured on, exactly like a configured route does. When the module selects a +// template, Envoy evaluates it against the request like a configured route: the +// :ref:`match ` must hold, otherwise the +// ``failure_policy`` applies, and the action is resolved the usual way, including +// :ref:`weighted_clusters ` and +// :ref:`cluster specifier plugins +// `. +message RouteTemplate { + // The identifier the module selects this template with. Must be unique within the specifier. + string template_id = 1 [(validate.rules).string = {min_len: 1}]; + + // The route. ``route_specifiers`` must be empty, since a template is not run through the + // specifier chains. + config.route.v3.Route route = 2 [(validate.rules).message = {required: true}]; +} + +// Route properties the module may select for a request. +// +// These properties are built from other extensions, so they are declared here and built once at +// configuration load rather than constructed on the request path. An entry that replaces no +// property is rejected. A property an entry leaves unset keeps the value of the route the decision +// produced, so an entry can never remove a property that route configures. +// [#next-free-field: 12] +message RouteOverride { + // The identifier the module selects this override with. Must be unique within the specifier. + string override_id = 1 [(validate.rules).string = {min_len: 1}]; + + // Retry policy replacing the retry policy of the produced route. + config.route.v3.RetryPolicy retry_policy = 2; + + // Metadata match criteria replacing those of the produced route, used by subset load balancing. + // Only the ``envoy.lb`` entry of :ref:`filter_metadata + // ` is used, matching the behavior of + // :ref:`RouteAction.metadata_match + // `. An entry whose only property + // is a ``metadata_match`` without an ``envoy.lb`` entry replaces nothing and is rejected. + config.core.v3.Metadata metadata_match = 3; + + // Request mirroring policies replacing those of the produced route. Statically named mirror + // clusters are checked against the cluster manager when ``validate_clusters`` is enabled. + repeated config.route.v3.RouteAction.RequestMirrorPolicy request_mirror_policies = 4; + + // Hash policy replacing the hash policy of the produced route, used when the upstream cluster + // employs a hashing load balancer. A cluster level and a load balancer level hash policy, when + // configured, take precedence over this route level policy. + repeated config.route.v3.RouteAction.HashPolicy hash_policy = 5; + + // Hedge policy replacing the hedge policy of the produced route. + config.route.v3.HedgePolicy hedge_policy = 6; + + // Rate limits replacing the rate limits of the produced route. + repeated config.route.v3.RateLimit rate_limits = 7; + + // CORS policy replacing the CORS policy of the produced route. The CORS filter reads it only when + // CORS is not configured through per filter configuration. + config.route.v3.CorsPolicy cors = 8; + + // Regex rewrite of the request path, replacing the path the produced route sends upstream, + // unless the module records a path of its own, which wins. The + // pattern is compiled once when the specifier is configured. It applies to the path without the + // query string, which is preserved, and the result is capped at + // :ref:`max_rewritten_path_bytes + // `. + type.matcher.v3.RegexMatchAndSubstitute regex_rewrite = 9; + + // Tracing configuration replacing the tracing settings of the produced route, overriding the + // connection manager defaults for the request. This is a route level property, so it applies to + // a direct response or a redirect route as well as a route entry. + config.route.v3.Tracing tracing = 10; + + // Metadata layered onto the metadata of the produced route, per namespace, so consumers such as + // the rate limit ROUTE_ENTRY action, ext_authz and the METADATA(ROUTE) formatter observe it. + // Metadata the module records itself layers on top of it. It is a route level property. An + // empty message layers nothing. + config.core.v3.Metadata metadata = 11; +} + +// Configuration for the dynamic modules route specifier. +// [#next-free-field: 12] +message DynamicModuleRouteSpecifier { + // Specifies the shared object level configuration. This field is required. + // + // .. note:: + // This extension loads the module while the route configuration is built, so it cannot wait + // for an asynchronous fetch. A remote :ref:`module + // ` is therefore + // accepted only when the module is already cached on disk, and is otherwise rejected. Setting + // :ref:`nack_on_cache_miss + // ` to + // ``true`` makes the rejection start a background fetch so that a later update succeeds. Prefer + // ``name`` or a local data source. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1 + [(validate.rules).message = {required: true}]; + + // The name for this route specifier configuration, used to select an implementation within the + // module. If not specified, defaults to an empty string. + string specifier_name = 2; + + // The configuration for the route specifier chosen by ``specifier_name``. If not specified, + // defaults to an empty configuration. + google.protobuf.Any specifier_config = 3; + + // Prefix for the statistics of this specifier, emitted as + // ``.route_specifier..*``, where ``metrics_namespace`` is the + // :ref:`metrics_namespace + // ` + // of the module. Specifiers that share a metrics namespace and prefix share counters, so keep + // the prefix unique within that namespace. + string stat_prefix = 4 [(validate.rules).string = {min_len: 1}]; + + // The route templates the module may select by ``template_id``, each replacing the resolved + // route with a route built from configuration. The ``template_id`` values must be unique. + repeated RouteTemplate route_templates = 5; + + // The route overrides the module may select by ``override_id``, each overlaying its properties + // onto the produced route. The ``override_id`` values must be unique. + repeated RouteOverride route_overrides = 6; + + // Fraction of requests the module is invoked for. A request outside the fraction is passed + // through untouched and counted in ``runtime_skipped``. The stable random value of the request is + // used, so the choice holds when the route of a request is recomputed. If not specified, + // defaults to every request. + // + // .. attention:: + // A request outside the fraction is routed by ``routes`` or ``matcher`` alone, so a fraction + // below 100% is only safe, as a canary or as an emergency switch with the runtime key set to + // ``0``, while the route table the module replaces is still complete. Once that table has been + // shrunk, lowering the fraction turns the affected requests into 404s or routes them wrongly, and + // the way back is a route configuration rollback that restores the table. + config.core.v3.RuntimeFractionalPercent runtime_fraction = 7; + + // What Envoy does when the decision of the module cannot be honored. Must be set explicitly. + FailurePolicy failure_policy = 8 [(validate.rules).enum = {defined_only: true}]; + + // Whether the clusters the route templates and the route overrides name are checked + // against the cluster manager while the specifier is configured. If not specified, defaults to + // ``false``, because the clusters a route names may be delivered after the route configuration + // that references them. An unknown cluster then fails the request with the + // ``cluster_not_found_response_code`` of the route instead. + google.protobuf.BoolValue validate_clusters = 9; + + // The maximum length of a request path a module rewrite may produce, covering the full ``:path`` + // value including the query string. A rewrite whose result would exceed it is rejected. If not + // specified, defaults to 65536. + google.protobuf.UInt32Value max_rewritten_path_bytes = 10 [(validate.rules).uint32 = {gt: 0}]; + + // An opaque identifier the module reads with ``get_config_specifier_instance_id``, so that two + // specifier instances sharing one module can tell the routes they build apart, for example by + // writing it into the route metadata they mark their routes with. It is documentation and + // convenience for the module and Envoy enforces nothing about it. If not specified, defaults to + // an empty string. + string specifier_instance_id = 11 [(validate.rules).string = {max_len: 256}]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/72e84ba56fb274e08743442b26c1c033122e8c3721eec53b45d4a9f1e84a9bc7137041480a46c801003c458b2314b8b7f908f326362e26a9503d8928b0bdde51 b/modules/sync/envoyproxy/envoy/cas/72e84ba56fb274e08743442b26c1c033122e8c3721eec53b45d4a9f1e84a9bc7137041480a46c801003c458b2314b8b7f908f326362e26a9503d8928b0bdde51 new file mode 100644 index 00000000..4aaf121d --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/72e84ba56fb274e08743442b26c1c033122e8c3721eec53b45d4a9f1e84a9bc7137041480a46c801003c458b2314b8b7f908f326362e26a9503d8928b0bdde51 @@ -0,0 +1,72 @@ +syntax = "proto3"; + +package envoy.extensions.quic.connection_id_generator.quic_lb.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/extensions/transport_sockets/tls/v3/secret.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.quic.connection_id_generator.quic_lb.v3"; +option java_outer_classname = "QuicLbProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/quic/connection_id_generator/quic_lb/v3;quic_lbv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: QUIC-LB connection ID generator config] +// [#extension: envoy.quic.connection_id_generator.quic_lb] + +// Configuration for a connection ID generator implementation for the QUIC-LB draft RFC for +// routable connection IDs. +// +// Connection IDs always have the length self encoded, as described in +// https://datatracker.ietf.org/doc/html/draft-ietf-quic-load-balancers#name-length-self-description. +// +// See https://datatracker.ietf.org/doc/html/draft-ietf-quic-load-balancers for details. +// +// [#next-free-field: 7] +message Config { + // Must be at least 1 octet. + // The length of server_id and nonce_length_bytes must be 18 or less. + // See https://datatracker.ietf.org/doc/html/draft-ietf-quic-load-balancers#name-server-id-allocation. + config.core.v3.DataSource server_id = 2 [(validate.rules).message = {required: true}]; + + // If true, indicates that the :ref:`server_id + // ` is base64 encoded. + // + // This can be useful if the ID may contain binary data and must be transmitted as a string, for example in + // an environment variable. + bool server_id_base64_encoded = 6; + + // Optional validation of the expected server ID length. If this is non-zero and the value in ``server_id`` + // does not have a matching length, a configuration error is generated. This can be useful for validating + // that the server ID is valid. + uint32 expected_server_id_length = 3 [(validate.rules).uint32 = {lte: 18}]; + + // The nonce length must be at least 4 bytes. + // The length of server_id and nonce_length_bytes must be 18 bytes or less. + uint32 nonce_length_bytes = 4 [(validate.rules).uint32 = {lte: 16 gte: 4}]; + + // Configuration to fetch the encryption key and configuration version. + // + // The SDS service is for a :ref:`GenericSecret `. + // The data should populate :ref:`secrets `: + // + // "encryption_key" must contain the 16 byte encryption key. + // + // "configuration_version" must contain a 1 byte unsigned integer of value less than 7. + // See https://datatracker.ietf.org/doc/html/draft-ietf-quic-load-balancers#name-config-rotation. + transport_sockets.tls.v3.SdsSecretConfig encryption_parameters = 5 + [(validate.rules).message = {required: true}]; + + // Use the unencrypted mode. This is useful for testing or a simplified implementation of the + // downstream load balancer, but allows for linking different CIDs for the same connection, and + // leaks information about the valid server IDs in use. This mode does not comply with the RFC. + // + // Note that in this mode, :ref:`encryption_parameters + // ` + // is still required because it contains ``configuration_version``, which is still + // needed. ``encryption_key`` can be set to ``inline_string: '0000000000000000'``. + bool unencrypted_mode = 1; +} diff --git a/modules/sync/envoyproxy/envoy/cas/752daf76478d21aeef455c959b30d42551c1529a3c4b5790334fba28cec557c5595762f42088b438a472742078cedeb8b332f5fd732cac86f5de237ee754e61d b/modules/sync/envoyproxy/envoy/cas/752daf76478d21aeef455c959b30d42551c1529a3c4b5790334fba28cec557c5595762f42088b438a472742078cedeb8b332f5fd732cac86f5de237ee754e61d new file mode 100644 index 00000000..5a1323d6 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/752daf76478d21aeef455c959b30d42551c1529a3c4b5790334fba28cec557c5595762f42088b438a472742078cedeb8b332f5fd732cac86f5de237ee754e61d @@ -0,0 +1,59 @@ +syntax = "proto3"; + +package envoy.extensions.clusters.composite.v3; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.clusters.composite.v3"; +option java_outer_classname = "ClusterProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/clusters/composite/v3;compositev3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Composite cluster configuration] + +// Configuration for the composite cluster. See the :ref:`architecture overview +// ` for more information. This cluster type enables retry-aware +// cluster selection, allowing different retry attempts to automatically target +// different upstream clusters. Unlike the standard aggregate cluster which uses +// health-based selection, the composite cluster uses the retry attempt count to +// deterministically select which sub-cluster to route to. If the selected sub-cluster has no +// host available, the following sub-clusters in the list are tried in order within the same +// attempt. +// +// When retry attempts exceed the number of configured clusters, requests will fail with no +// host available. +// +// Example configuration: +// +// .. code-block:: yaml +// +// name: composite_cluster +// connect_timeout: 0.25s +// lb_policy: CLUSTER_PROVIDED +// cluster_type: +// name: envoy.clusters.composite +// typed_config: +// "@type": type.googleapis.com/envoy.extensions.clusters.composite.v3.ClusterConfig +// clusters: +// - name: primary_cluster +// - name: secondary_cluster +// - name: fallback_cluster +// +// [#extension: envoy.clusters.composite] +message ClusterConfig { + // Configuration for an individual cluster entry. + message ClusterEntry { + // Name of the cluster. This cluster must be defined elsewhere in the configuration. + string name = 1 [(validate.rules).string = {min_len: 1}]; + } + + // List of clusters to use for request routing. The first cluster is used for the + // initial request (attempt 1), the second cluster for the first retry (attempt 2), + // and so on. Must contain at least one cluster. When retry attempts exceed the number + // of configured clusters, requests will fail with no host available. When the cluster + // selected for an attempt has no host available, the following clusters in this list are + // tried in order for that attempt. + repeated ClusterEntry clusters = 1 [(validate.rules).repeated = {min_items: 1}]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/755c91ec00e03c5ffcefc462558504d3ec1300866a9a88ba3eb946f1fb6cbc143a56f8178c9fd1c1e050e26d5ed657bc377ec773014421d23ce72da797bf446e b/modules/sync/envoyproxy/envoy/cas/755c91ec00e03c5ffcefc462558504d3ec1300866a9a88ba3eb946f1fb6cbc143a56f8178c9fd1c1e050e26d5ed657bc377ec773014421d23ce72da797bf446e new file mode 100644 index 00000000..30869f60 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/755c91ec00e03c5ffcefc462558504d3ec1300866a9a88ba3eb946f1fb6cbc143a56f8178c9fd1c1e050e26d5ed657bc377ec773014421d23ce72da797bf446e @@ -0,0 +1,227 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.compressor.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/extension.proto"; +import "envoy/type/matcher/v3/string.proto"; + +import "google/protobuf/wrappers.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.compressor.v3"; +option java_outer_classname = "CompressorProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/compressor/v3;compressorv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Compressor] +// Compressor :ref:`configuration overview `. +// [#extension: envoy.filters.http.compressor] + +// [#next-free-field: 10] +message Compressor { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.compressor.v2.Compressor"; + + message CommonDirectionConfig { + // Runtime flag that controls whether compression is enabled for the direction this + // common config is applied to. When this field is ``false``, the filter will operate as a + // pass-through filter in the chosen direction, unless overridden by ``CompressorPerRoute``. + // If this field is not specified, the filter will be enabled. + config.core.v3.RuntimeFeatureFlag enabled = 1; + + // Minimum value of the ``Content-Length`` header in request or response messages (depending on the + // direction this common config is applied to), in bytes, that will trigger compression. Defaults to 30. + google.protobuf.UInt32Value min_content_length = 2; + + // Using ``content_type`` is deprecated. Use ``content_type_matcher`` instead. + // + // Set of strings that allows specifying which mime-types yield compression; e.g., + // ``application/json``, ``text/html``, etc. + // + // When this field is not specified, compression will be applied to these following mime-types + // and their synonyms: + // + // * ``application/javascript`` + // * ``application/json`` + // * ``application/xhtml+xml`` + // * ``image/svg+xml`` + // * ``text/css`` + // * ``text/html`` + // * ``text/plain`` + // * ``text/xml`` + // + repeated string content_type = 3 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Allows specifying which content types yield compression using + // envoy.type.matcher.v3.StringMatcher. + // + // When this field is specified, the default content type list is not used. + // If both ``content_type`` and ``content_type_matcher`` are specified, + // ``content_type_matcher`` takes precedence and the deprecated ``content_type`` + // field is ignored. + repeated type.matcher.v3.StringMatcher content_type_matcher = 4; + } + + // Configuration for filter behavior on the request direction. + message RequestDirectionConfig { + CommonDirectionConfig common_config = 1; + } + + // Configuration for filter behavior on the response direction. + // [#next-free-field: 7] + message ResponseDirectionConfig { + CommonDirectionConfig common_config = 1; + + // When this field is ``true``, disables compression when the response contains an ``ETag`` header. + // When this field is ``false``, the filter will preserve weak ``ETag`` values and remove those that + // require strong validation (unless ``weaken_etag_on_compress`` is set). + // When both ``disable_on_etag_header`` and ``weaken_etag_on_compress`` are ``true``, + // ``weaken_etag_on_compress`` takes precedence (compression is applied and the ETag is weakened). + bool disable_on_etag_header = 2; + + // When this field is ``true`` and the filter compresses a response that contains a strong + // ``ETag``, the filter will weaken the ETag by prepending ``W/`` to its value instead of + // removing it. This allows caching and conditional requests to work while indicating the + // response body was modified by compression. When ``false`` (default), strong ETags are + // removed when compression is applied. When both ``weaken_etag_on_compress`` and + // ``disable_on_etag_header`` are ``true``, this field takes precedence so that compression + // is applied and the ETag is weakened, supporting gradual rollout to clients and servers. + bool weaken_etag_on_compress = 6; + + // When this field is ``true``, removes ``Accept-Encoding`` from the request headers before dispatching + // the request to the upstream so that responses do not get compressed before reaching the filter. + // + // .. attention:: + // + // To avoid interfering with other compression filters in the same chain, use this option in + // the filter closest to the upstream. + bool remove_accept_encoding_header = 3; + + // Set of response codes for which compression is disabled; e.g., 206 Partial Content should not + // be compressed. + repeated uint32 uncompressible_response_codes = 4 [(validate.rules).repeated = { + unique: true + items {uint32 {lt: 600 gte: 200}} + }]; + + // If true, the filter adds the ``x-envoy-compression-status`` response + // header to indicate whether the compression occurred and, if not, provide + // the reason why. The header's value format is + // ``;[;]``, where ```` is + // ``Compressed`` or the reason compression was skipped (e.g., + // ``ContentLengthTooSmall``). When this field is enabled, the compressor + // filter alters the order of the compression eligibility checks to report + // the most valid reason for skipping the compression. + bool status_header_enabled = 5; + } + + // Minimum response length, in bytes, which will trigger compression. The default value is 30. + google.protobuf.UInt32Value content_length = 1 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Set of strings that allows specifying which mime-types yield compression; e.g., + // ``application/json``, ``text/html``, etc. + // + // When this field is not specified, compression will be applied to these following mime-types + // and their synonyms: + // + // * ``application/javascript`` + // * ``application/json`` + // * ``application/xhtml+xml`` + // * ``image/svg+xml`` + // * ``text/css`` + // * ``text/html`` + // * ``text/plain`` + // * ``text/xml`` + // + repeated string content_type = 2 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // When this field is ``true``, disables compression when the response contains an ``ETag`` header. + // When this field is ``false``, the filter will preserve weak ``ETag`` values and remove those that + // require strong validation. + bool disable_on_etag_header = 3 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // When this field is ``true``, removes ``Accept-Encoding`` from the request headers before dispatching + // the request to the upstream so that responses do not get compressed before reaching the filter. + // + // .. attention:: + // + // To avoid interfering with other compression filters in the same chain, use this option in + // the filter closest to the upstream. + bool remove_accept_encoding_header = 4 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Runtime flag that controls whether the filter is enabled. When this field is ``false``, the + // filter will operate as a pass-through filter, unless overridden by ``CompressorPerRoute``. + // If this field is not specified, the filter is enabled by default. + config.core.v3.RuntimeFeatureFlag runtime_enabled = 5 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // A compressor library to use for compression. + // [#extension-category: envoy.compression.compressor] + config.core.v3.TypedExtensionConfig compressor_library = 6 + [(validate.rules).message = {required: true}]; + + // Configuration for request compression. If this field is not specified, request compression is disabled. + RequestDirectionConfig request_direction_config = 7; + + // Configuration for response compression. If this field is not specified, response compression is enabled. + // + // .. attention:: + // + // When this field is set, duplicate deprecated fields of the ``Compressor`` message, + // such as ``content_length``, ``content_type``, ``disable_on_etag_header``, + // ``remove_accept_encoding_header``, and ``runtime_enabled``, are ignored. + // + // Additionally, all statistics related to response compression will be rooted in + // ``.compressor...response.*`` + // instead of + // ``.compressor...*``. + ResponseDirectionConfig response_direction_config = 8; + + // When this field is ``true``, this compressor is preferred when q-values in ``Accept-Encoding`` are equal. + // If multiple compressor filters set ``choose_first`` to ``true``, the last one in the filter chain is chosen. + bool choose_first = 9; +} + +// Per-route overrides of ``ResponseDirectionConfig``. Anything added here should be optional, +// to allow overriding arbitrary subsets of configuration. Omitted fields must have no effect. +message ResponseDirectionOverrides { + // If set, overrides the filter-level + // :ref:`remove_accept_encoding_header`. + google.protobuf.BoolValue remove_accept_encoding_header = 1; +} + +// Per-route overrides. As per-route overrides are needed, they should be +// added here, mirroring the structure of ``Compressor``. All fields should be +// optional, to allow overriding arbitrary subsets of configuration. +message CompressorOverrides { + // If present, response compression is enabled. + ResponseDirectionOverrides response_direction_config = 1; + + // A compressor library to use for compression. If specified, this overrides + // the filter-level ``compressor_library`` configuration for this route. + config.core.v3.TypedExtensionConfig compressor_library = 2; +} + +message CompressorPerRoute { + oneof override { + option (validate.required) = true; + + // If set, the filter will operate as a pass-through filter. + // Overrides ``Compressor.runtime_enabled`` and ``CommonDirectionConfig.enabled``. + bool disabled = 1 [(validate.rules).bool = {const: true}]; + + // Per-route overrides. Fields set here will override corresponding fields in ``Compressor``. + CompressorOverrides overrides = 2; + } +} diff --git a/modules/sync/envoyproxy/envoy/cas/7a1088075988f4f4955218bbe749da201b1092c5e2f38d3d595d2196f4b36052bf68adb90da1ece5aadd3a17e75b8c5dd3d6396918248bb65d37e1eb4cbfd604 b/modules/sync/envoyproxy/envoy/cas/7a1088075988f4f4955218bbe749da201b1092c5e2f38d3d595d2196f4b36052bf68adb90da1ece5aadd3a17e75b8c5dd3d6396918248bb65d37e1eb4cbfd604 new file mode 100644 index 00000000..01530d01 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/7a1088075988f4f4955218bbe749da201b1092c5e2f38d3d595d2196f4b36052bf68adb90da1ece5aadd3a17e75b8c5dd3d6396918248bb65d37e1eb4cbfd604 @@ -0,0 +1,49 @@ +syntax = "proto3"; + +package envoy.extensions.transport_sockets.tls.handshakers.dynamic_modules.v3; + +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.transport_sockets.tls.handshakers.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/handshakers/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Dynamic Module TLS Handshaker] +// [#extension: envoy.tls.handshakers.dynamic_modules] + +// Configuration for the dynamic module TLS handshaker. +// +// Example: +// +// .. validated-code-block:: yaml +// :type-name: envoy.extensions.transport_sockets.tls.v3.CommonTlsContext +// +// custom_handshaker: +// name: envoy.tls.handshakers.dynamic_modules +// typed_config: +// "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.handshakers.dynamic_modules.v3.DynamicModuleTlsHandshaker +// dynamic_module_config: +// name: my_module +// handshaker_name: my_handshaker +// +message DynamicModuleTlsHandshaker { + // Dynamic module configuration. See :ref:`dynamic module configuration + // ` for details. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1 + [(validate.rules).message = {required: true}]; + + // The name of the handshaker implementation in the dynamic module. + // This is passed to the module's ``envoy_dynamic_module_on_tls_handshaker_config_new`` function. + string handshaker_name = 2 [(validate.rules).string = {min_len: 1}]; + + // Optional configuration for the handshaker. This is passed as bytes to the dynamic module. + // If not specified, no configuration bytes are passed to the module. + google.protobuf.Any handshaker_config = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/82884d480870e7153f8bfb1cd95ac73ee60488fef1ddba0730411cc230cf26550f5c2ff2cf3e78284fcc2ea0bbfa911d064477252122d27b2c230b20afd38837 b/modules/sync/envoyproxy/envoy/cas/82884d480870e7153f8bfb1cd95ac73ee60488fef1ddba0730411cc230cf26550f5c2ff2cf3e78284fcc2ea0bbfa911d064477252122d27b2c230b20afd38837 new file mode 100644 index 00000000..e46da812 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/82884d480870e7153f8bfb1cd95ac73ee60488fef1ddba0730411cc230cf26550f5c2ff2cf3e78284fcc2ea0bbfa911d064477252122d27b2c230b20afd38837 @@ -0,0 +1,62 @@ +syntax = "proto3"; + +package envoy.extensions.matching.http.dynamic_modules.v3; + +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.matching.http.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/matching/http/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Dynamic Modules HTTP Match Input] +// [#extension: envoy.matching.inputs.dynamic_module_data_input] + +// Configuration for the dynamic modules HTTP match input. This input extracts HTTP request and +// response data from the matching context and makes it available to the dynamic module matcher +// via ABI callbacks during match evaluation. +// +// This data input should be used together with the +// :ref:`dynamic modules input matcher +// `. +message HttpDynamicModuleMatchInput { +} + +// Configuration for the dynamic modules data input. This input loads a shared object file +// via ``dlopen`` and invokes it during match evaluation to extract a value from the HTTP +// request and response. The extracted value is a string that an exact match map can dispatch on, +// so a module can select one of many matches with a single evaluation. +// +// Unlike :ref:`HttpDynamicModuleMatchInput +// `, the +// module produces the value directly rather than pairing with the dynamic modules input matcher. +// [#extension: envoy.matching.inputs.dynamic_module_string_data_input] +message DynamicModuleDataInput { + // Specifies the shared-object level configuration. This field is required. Remote module sources + // are not supported for data inputs, so the module must be available locally or by name. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1 + [(validate.rules).message = {required: true}]; + + // The name for this data input configuration. If not specified, defaults to an empty string. + // + // This can be used to distinguish between different data input implementations inside a dynamic + // module. When Envoy receives this configuration, it passes the ``input_name`` to the dynamic + // module's data input config init function together with the ``input_config``. That way a module + // can decide which in-module implementation to use based on the name at load time. + string input_name = 2; + + // The configuration for the data input chosen by ``input_name``. If not specified, an empty + // configuration is passed to the module. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly without + // the wrapper. + google.protobuf.Any input_config = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/8491c4d20717a14b78e5865417c9f035c5c6371b960584af09789287d65d19d29599727d0a67e6b172df026afee9a7718a0befea90fcb38e24c106a3a3837346 b/modules/sync/envoyproxy/envoy/cas/8491c4d20717a14b78e5865417c9f035c5c6371b960584af09789287d65d19d29599727d0a67e6b172df026afee9a7718a0befea90fcb38e24c106a3a3837346 new file mode 100644 index 00000000..27822f21 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/8491c4d20717a14b78e5865417c9f035c5c6371b960584af09789287d65d19d29599727d0a67e6b172df026afee9a7718a0befea90fcb38e24c106a3a3837346 @@ -0,0 +1,115 @@ +syntax = "proto3"; + +package envoy.extensions.access_loggers.open_telemetry.v3; + +import "envoy/config/core/v3/extension.proto"; +import "envoy/config/core/v3/grpc_service.proto"; +import "envoy/config/core/v3/http_service.proto"; +import "envoy/extensions/access_loggers/grpc/v3/als.proto"; +import "envoy/type/tracing/v3/custom_tag.proto"; + +import "google/protobuf/duration.proto"; +import "google/protobuf/wrappers.proto"; + +import "opentelemetry/proto/common/v1/common.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.access_loggers.open_telemetry.v3"; +option java_outer_classname = "LogsServiceProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/access_loggers/open_telemetry/v3;open_telemetryv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: OpenTelemetry Access Log] + +// Configuration for the built-in ``envoy.access_loggers.open_telemetry`` +// :ref:`AccessLog `. This configuration will +// populate `opentelemetry.proto.collector.v1.logs.ExportLogsServiceRequest.resource_logs `_. +// In addition, the request start time is set in the dedicated field. +// [#extension: envoy.access_loggers.open_telemetry] +// [#next-free-field: 16] +message OpenTelemetryAccessLogConfig { + // [#comment:TODO(itamarkam): add 'filter_state_objects_to_log' to logs.] + // Deprecated. Use ``grpc_service`` or ``http_service`` instead. + grpc.v3.CommonGrpcAccessLogConfig common_config = 1 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // The upstream HTTP cluster that will receive OTLP logs via + // `OTLP/HTTP `_. + // Note: Only one of ``common_config``, ``grpc_service``, or ``http_service`` may be used. + // + // .. note:: + // + // The ``request_headers_to_add`` property in the OTLP HTTP exporter service supports + // substitution formatters. The formatters cannot access any HTTP or connection properties, but + // can load content such as environment variables or files or secrets. + config.core.v3.HttpService http_service = 8; + + // The upstream gRPC cluster that will receive OTLP logs. + // Note: Only one of ``common_config``, ``grpc_service``, or ``http_service`` may be used. + // This field is preferred over ``common_config.grpc_service``. + config.core.v3.GrpcService grpc_service = 9; + + // If specified, Envoy will not generate built-in resource labels + // like ``log_name``, ``zone_name``, ``cluster_name``, ``node_name``. + // + // Built-in labels have the lowest precedence and can be overridden by matching keys in + // :ref:`resource_detectors ` + // or :ref:`resource_attributes `. + bool disable_builtin_labels = 5; + + // OpenTelemetry `Resource `_ + // attributes are filled with Envoy node info. + // Example: ``resource_attributes { values { key: "region" value { string_value: "cn-north-7" } } }``. + // + // Attributes configured here take highest precedence (``resource_attributes`` > ``resource_detectors`` > built-in labels) + // and will override any matching keys. + opentelemetry.proto.common.v1.KeyValueList resource_attributes = 4; + + // An ordered list of resource detectors to detect OpenTelemetry resource information such as + // attributes and schema URL. + // + // Attributes detected here override built-in labels with matching keys, but are overridden by + // :ref:`resource_attributes ` + // (precedence: ``resource_attributes`` > ``resource_detectors`` > built-in labels). + // [#extension-category: envoy.tracers.opentelemetry.resource_detectors] + repeated config.core.v3.TypedExtensionConfig resource_detectors = 15; + + // OpenTelemetry `LogResource `_ + // fields, following `Envoy access logging formatting `_. + // + // See 'body' in the LogResource proto for more details. + // Example: ``body { string_value: "%PROTOCOL%" }``. + opentelemetry.proto.common.v1.AnyValue body = 2; + + // See 'attributes' in the LogResource proto for more details. + // Example: ``attributes { values { key: "user_agent" value { string_value: "%REQ(USER-AGENT)%" } } }``. + opentelemetry.proto.common.v1.KeyValueList attributes = 3; + + // Optional. Additional prefix to use on OpenTelemetry access logger stats. If empty, the stats will be rooted at + // ``access_logs.open_telemetry_access_log.``. If non-empty, stats will be rooted at + // ``access_logs.open_telemetry_access_log..``. + string stat_prefix = 6; + + // Specifies a collection of Formatter plugins that can be called from the access log configuration. + // See the formatters extensions documentation for details. + // [#extension-category: envoy.formatter] + repeated config.core.v3.TypedExtensionConfig formatters = 7; + + string log_name = 10; + + // The interval for flushing access logs to the transport. Default: 1 second. + google.protobuf.Duration buffer_flush_interval = 11; + + // Soft size limit in bytes for the access log buffer. When the buffer exceeds + // this limit, logs will be flushed. Default: 16KB. + google.protobuf.UInt32Value buffer_size_bytes = 12; + + // Additional filter state objects to log as attributes. + repeated string filter_state_objects_to_log = 13; + + // Custom tags to include as log attributes. + repeated type.tracing.v3.CustomTag custom_tags = 14; +} diff --git a/modules/sync/envoyproxy/envoy/cas/861a39e8e20680fa4eee71ecb7708f708f3edc6b176590d740a0193e9a0cd81c87b7a67d0e73044a02fa8edc2977ec8c1c81d801a3fd9c7eb13a16c3c178197d b/modules/sync/envoyproxy/envoy/cas/861a39e8e20680fa4eee71ecb7708f708f3edc6b176590d740a0193e9a0cd81c87b7a67d0e73044a02fa8edc2977ec8c1c81d801a3fd9c7eb13a16c3c178197d new file mode 100644 index 00000000..dade9fde --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/861a39e8e20680fa4eee71ecb7708f708f3edc6b176590d740a0193e9a0cd81c87b7a67d0e73044a02fa8edc2977ec8c1c81d801a3fd9c7eb13a16c3c178197d @@ -0,0 +1,104 @@ +syntax = "proto3"; + +package envoy.extensions.load_balancing_policies.client_side_weighted_round_robin.v3; + +import "envoy/extensions/load_balancing_policies/common/v3/common.proto"; + +import "google/protobuf/duration.proto"; +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.load_balancing_policies.client_side_weighted_round_robin.v3"; +option java_outer_classname = "ClientSideWeightedRoundRobinProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3;client_side_weighted_round_robinv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Client-Side Weighted Round Robin Load Balancing Policy] +// [#extension: envoy.load_balancing_policies.client_side_weighted_round_robin] + +// Configuration for the client_side_weighted_round_robin LB policy. +// +// This policy differs from the built-in ROUND_ROBIN policy in terms of +// how the endpoint weights are determined. In the ROUND_ROBIN policy, +// the endpoint weights are sent by the control plane via EDS. However, +// in this policy, the endpoint weights are instead determined via qps (queries +// per second), eps (errors per second), and utilization metrics sent by the +// endpoint using the Open Request Cost Aggregation (ORCA) protocol. All queries +// count toward qps, regardless of result. Only failed queries count toward eps. +// A config parameter error_utilization_penalty controls the penalty to adjust +// endpoint weights using eps and qps. The weight of a given endpoint is computed +// as: ``qps / (utilization + eps/qps * error_utilization_penalty)``. +// +// For a load report to update an endpoint's weight, it must set :ref:`rps_fractional +// ` (used as +// qps) greater than 0, and the final utilization (resolved utilization plus any +// error penalty) must be greater than 0. Resolved utilization (see +// :ref:`metric_names_for_computing_utilization +// `) +// is used as the baseline. Reports that fail to do so are ignored, and an endpoint +// with no valid weight is assigned the median weight of the endpoints that have one. +// +// Note that Envoy will forward the ORCA response headers/trailers from the upstream +// cluster to the downstream client. This means that if the downstream client is also +// configured to use ``client_side_weighted_round_robin`` it will load balance against +// Envoy based on upstream weights. This can happen when Envoy is used as a reverse proxy. +// To avoid this issue you can configure the :ref:`header_mutation filter ` to remove +// the ORCA payload from the response headers/trailers. +// +// See the :ref:`load balancing architecture +// overview` for more information. +// +// [#next-free-field: 10] +message ClientSideWeightedRoundRobin { + // Whether to enable out-of-band utilization reporting collection from + // the endpoints. By default, per-request utilization reporting is used. + google.protobuf.BoolValue enable_oob_load_report = 1; + + // Load reporting interval to request from the server. Note that the + // server may not provide reports as frequently as the client requests. + // Used only when enable_oob_load_report is true. Default is 10 seconds. + google.protobuf.Duration oob_reporting_period = 2; + + // A given endpoint must report load metrics continuously for at least + // this long before the endpoint weight will be used. This avoids + // churn when the set of endpoint addresses changes. Takes effect + // both immediately after we establish a connection to an endpoint and + // after weight_expiration_period has caused us to stop using the most + // recent load metrics. Default is 10 seconds. + google.protobuf.Duration blackout_period = 3; + + // If a given endpoint has not reported load metrics in this long, + // then we stop using the reported weight. This ensures that we do + // not continue to use very stale weights. Once we stop using a stale + // value, if we later start seeing fresh reports again, the + // blackout_period applies. Defaults to 3 minutes. + google.protobuf.Duration weight_expiration_period = 4; + + // How often endpoint weights are recalculated. Values less than 100ms are + // capped at 100ms. Default is 1 second. + google.protobuf.Duration weight_update_period = 5; + + // The multiplier used to adjust endpoint weights with the error rate + // calculated as eps/qps. Configuration is rejected if this value is negative. + // Default is 1.0. + google.protobuf.FloatValue error_utilization_penalty = 6 [(validate.rules).float = {gte: 0.0}]; + + // Specifies the metrics used to compute the endpoint utilization from which weight is derived. + // For map fields in the ORCA proto, the string will be of the form ``.``. For example, the string ``named_metrics.foo`` will mean to look for the key ``foo`` in the ORCA :ref:`named_metrics ` field. + // Utilization is the max of the values of the metrics specified here, when that max is greater than 0. + // Otherwise :ref:`application_utilization ` is used if greater than 0, with :ref:`cpu_utilization ` as the final fallback. + // Disabling the runtime flag ``envoy.reloadable_features.orca_weight_manager_use_named_metrics_first`` restores the legacy order, preferring ``application_utilization`` over these metrics. + repeated string metric_names_for_computing_utilization = 7; + + // Configuration for slow start mode. + // If this configuration is not set, slow start will not be not enabled. + common.v3.SlowStartConfig slow_start_config = 8; + + // Optional overrides for the OOB reporting connection (alternative port, + // ``:authority``, transport socket selection). Honored only when + // ``enable_oob_load_report`` is true. + common.v3.OrcaOobReportingConfig oob_reporting_config = 9; +} diff --git a/modules/sync/envoyproxy/envoy/cas/86affc73c5bb63a417da41b833f706c43013693045ce97dddb2d58dcf8952cd6874d2697b59c83578128cfa2193c9236c5b4e1a419ae969fd1df9315fde2c205 b/modules/sync/envoyproxy/envoy/cas/86affc73c5bb63a417da41b833f706c43013693045ce97dddb2d58dcf8952cd6874d2697b59c83578128cfa2193c9236c5b4e1a419ae969fd1df9315fde2c205 new file mode 100644 index 00000000..669afc93 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/86affc73c5bb63a417da41b833f706c43013693045ce97dddb2d58dcf8952cd6874d2697b59c83578128cfa2193c9236c5b4e1a419ae969fd1df9315fde2c205 @@ -0,0 +1,1460 @@ +syntax = "proto3"; + +package envoy.extensions.filters.network.http_connection_manager.v3; + +import "envoy/config/accesslog/v3/accesslog.proto"; +import "envoy/config/core/v3/address.proto"; +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/config_source.proto"; +import "envoy/config/core/v3/extension.proto"; +import "envoy/config/core/v3/protocol.proto"; +import "envoy/config/core/v3/substitution_format_string.proto"; +import "envoy/config/route/v3/route.proto"; +import "envoy/config/route/v3/scoped_route.proto"; +import "envoy/config/trace/v3/http_tracer.proto"; +import "envoy/type/http/v3/path_transformation.proto"; +import "envoy/type/tracing/v3/custom_tag.proto"; +import "envoy/type/v3/percent.proto"; + +import "google/protobuf/any.proto"; +import "google/protobuf/duration.proto"; +import "google/protobuf/wrappers.proto"; + +import "xds/type/matcher/v3/matcher.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/migrate.proto"; +import "udpa/annotations/security.proto"; +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.network.http_connection_manager.v3"; +option java_outer_classname = "HttpConnectionManagerProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3;http_connection_managerv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: HTTP connection manager] +// HTTP connection manager :ref:`configuration overview `. +// [#extension: envoy.filters.network.http_connection_manager] + +// [#next-free-field: 64] +message HttpConnectionManager { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager"; + + enum CodecType { + // For every new connection, the connection manager will determine which + // codec to use. This mode supports both ALPN for TLS listeners as well as + // protocol inference for plaintext listeners. If ALPN data is available, it + // is preferred, otherwise protocol inference is used. In almost all cases, + // this is the right option to choose for this setting. + AUTO = 0; + + // The connection manager will assume that the client is speaking HTTP/1.1. + HTTP1 = 1; + + // The connection manager will assume that the client is speaking HTTP/2 + // (Envoy does not require HTTP/2 to take place over TLS or to use ALPN. + // Prior knowledge is allowed). + HTTP2 = 2; + + // The connection manager will assume that the client is speaking HTTP/3. + // This needs to be consistent with listener and transport socket config. + HTTP3 = 3; + } + + enum ServerHeaderTransformation { + // Overwrite any Server header with the contents of server_name. + OVERWRITE = 0; + + // If no Server header is present, append Server server_name + // If a Server header is present, pass it through. + APPEND_IF_ABSENT = 1; + + // Pass through the value of the server header, and do not append a header + // if none is present. + PASS_THROUGH = 2; + } + + // How to handle the :ref:`config_http_conn_man_headers_x-forwarded-client-cert` (XFCC) HTTP + // header. + enum ForwardClientCertDetails { + // Do not send the XFCC header to the next hop. This is the default value. + SANITIZE = 0; + + // When the client connection is mTLS (Mutual TLS), forward the XFCC header + // in the request. + FORWARD_ONLY = 1; + + // When the client connection is mTLS, append the client certificate + // information to the request’s XFCC header and forward it. + APPEND_FORWARD = 2; + + // When the client connection is mTLS, reset the XFCC header with the client + // certificate information and send it to the next hop. + SANITIZE_SET = 3; + + // Always forward the XFCC header in the request, regardless of whether the + // client connection is mTLS. + ALWAYS_FORWARD_ONLY = 4; + } + + // Determines the action for request that contain ``%2F``, ``%2f``, ``%5C`` or ``%5c`` sequences in the URI path. + // This operation occurs before URL normalization and the merge slashes transformations if they were enabled. + enum PathWithEscapedSlashesAction { + // Default behavior specific to implementation (i.e. Envoy) of this configuration option. + // Envoy, by default, takes the KEEP_UNCHANGED action. + // + // .. note:: + // + // The implementation may change the default behavior at-will. + IMPLEMENTATION_SPECIFIC_DEFAULT = 0; + + // Keep escaped slashes. + KEEP_UNCHANGED = 1; + + // Reject client request with the 400 status. gRPC requests will be rejected with the INTERNAL (13) error code. + // The ``httpN.downstream_rq_failed_path_normalization`` counter is incremented for each rejected request. + REJECT_REQUEST = 2; + + // Unescape ``%2F`` and ``%5C`` sequences and redirect request to the new path if these sequences were present. + // Redirect occurs after path normalization and merge slashes transformations if they were configured. + // + // .. note:: + // + // gRPC requests will be rejected with the INTERNAL (13) error code. This option minimizes possibility of path + // confusion exploits by forcing request with unescaped slashes to traverse all parties: downstream client, + // intermediate proxies, Envoy and upstream server. The ``httpN.downstream_rq_redirected_with_normalized_path`` + // counter is incremented for each redirected request. + // + UNESCAPE_AND_REDIRECT = 3; + + // Unescape ``%2F`` and ``%5C`` sequences. + // + // .. note:: + // + // This option should not be enabled if intermediaries perform path based access control as it may lead to path + // confusion vulnerabilities. + // + UNESCAPE_AND_FORWARD = 4; + } + + // The format to use when writing the + // :ref:`config_http_conn_man_headers_x-forwarded-client-cert` (XFCC) header value. + enum ForwardClientCertFormat { + // Use the :ref:`text format `. + // This is the default. + TEXT = 0; + + // Use the :ref:`JSON format `. + JSON = 1; + } + + // [#next-free-field: 14] + message Tracing { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager.Tracing"; + + // This OperationName makes no sense and is unnecessary in the current tracing API. + // [#not-implemented-hide:] + enum OperationName { + // The HTTP listener is used for ingress/incoming requests. + INGRESS = 0; + + // The HTTP listener is used for egress/outgoing requests. + EGRESS = 1; + } + + reserved 1, 2; + + reserved "operation_name", "request_headers_for_tags"; + + // Target percentage of requests managed by this HTTP connection manager that will be force + // traced if the :ref:`x-client-trace-id ` + // header is set. This field is a direct analog for the runtime variable + // 'tracing.client_enabled' in the :ref:`HTTP Connection Manager + // `. + // Default: 100% + type.v3.Percent client_sampling = 3; + + // Target percentage of requests managed by this HTTP connection manager that will be randomly + // selected for trace generation, if not requested by the client or not forced. This field is + // a direct analog for the runtime variable 'tracing.random_sampling' in the + // :ref:`HTTP Connection Manager `. + // Default: 100% + type.v3.Percent random_sampling = 4; + + // Target percentage of requests managed by this HTTP connection manager that will be traced + // after all other sampling checks have been applied (client-directed, force tracing, random + // sampling). This field functions as an upper limit on the total configured sampling rate. For + // instance, setting client_sampling to 100% but overall_sampling to 1% will result in only 1% + // of client requests with the appropriate headers to be force traced. This field is a direct + // analog for the runtime variable 'tracing.global_enabled' in the + // :ref:`HTTP Connection Manager `. + // Default: 100% + type.v3.Percent overall_sampling = 5; + + // Whether to annotate spans with additional data. If true, spans will include logs for stream + // events. + bool verbose = 6; + + // Maximum length of the request path to extract and include in the HttpUrl tag. Used to + // truncate lengthy request paths to meet the needs of a tracing backend. + // Default: 256 + google.protobuf.UInt32Value max_path_tag_length = 7; + + // A list of custom tags with unique tag name to create tags for the active span. + repeated type.tracing.v3.CustomTag custom_tags = 8; + + // Configuration for an external tracing provider. + // If not specified, no tracing will be performed. + config.trace.v3.Tracing.Http provider = 9; + + // Create separate tracing span for each upstream request if true. And if this flag is set to true, + // the tracing provider will assume that Envoy will be independent hop in the trace chain and may + // set span type to client or server based on this flag. + // This will deprecate the + // :ref:`start_child_span ` + // in the router. + // + // Users should set appropriate value based on their tracing provider and actual scenario: + // + // * If Envoy is used as sidecar and users want to make the sidecar and its application as only one + // hop in the trace chain, this flag should be set to false. And please also make sure the + // :ref:`start_child_span ` + // in the router is not set to true. + // * If Envoy is used as gateway or independent proxy, or users want to make the sidecar and its + // application as different hops in the trace chain, this flag should be set to true. + // * If tracing provider that has explicit requirements on span creation (like SkyWalking), + // this flag should be set to true. + // + // The default value is false for now for backward compatibility. + google.protobuf.BoolValue spawn_upstream_span = 10; + + // The operation name of the span which will be used for tracing. + // + // The same :ref:`format specifier ` as used for + // :ref:`HTTP access logging ` applies here, however + // unknown specifier values are replaced with the empty string instead of ``-``. + // + // This field will take precedence over and make following settings ineffective: + // + // * :ref:`route decorator ` and + // * :ref:`x-envoy-decorator-operation ` + // header will be ignored. + string operation = 11; + + // The operation name of the upstream span which will be used for tracing. + // This only takes effect when ``spawn_upstream_span`` is set to true and the upstream + // span is created. + // + // The same :ref:`format specifier ` as used for + // :ref:`HTTP access logging ` applies here, however + // unknown specifier values are replaced with the empty string instead of ``-``. + string upstream_operation = 12; + + // If set to true, trace context propagation is disabled, meaning that trace context headers + // (e.g. ``traceparent``, ``tracestate`` for OpenTelemetry/W3C, or ``X-B3-*`` headers for Zipkin) + // will not be injected when proxying requests to upstreams. + // + // This is useful for scenarios where you want to report spans from a proxy (e.g., an egress + // gateway) while preventing trace context from being propagated to external services, + // effectively stopping the trace at the mesh boundary. + // + // Note that span reporting is still performed when this is set to true - only context + // propagation is disabled. + // + // Default: false (context propagation is enabled) + bool no_context_propagation = 13; + } + + message InternalAddressConfig { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager." + "InternalAddressConfig"; + + // Whether unix socket addresses should be considered internal. + bool unix_sockets = 1; + + // List of CIDR ranges that are treated as internal. If unset, then RFC1918 / RFC4193 + // IP addresses will be considered internal. + repeated config.core.v3.CidrRange cidr_ranges = 2; + } + + // [#next-free-field: 9] + message SetCurrentClientCertDetails { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager." + "SetCurrentClientCertDetails"; + + reserved 2; + + // Whether to forward the subject of the client cert. Defaults to false. + google.protobuf.BoolValue subject = 1; + + // Whether to forward the entire client cert in URL encoded PEM format. This will appear in the + // XFCC header comma separated from other values with the value Cert="PEM". + // Defaults to false. + bool cert = 3; + + // Whether to forward the entire client cert chain (including the leaf cert) in URL encoded PEM + // format. This will appear in the XFCC header comma separated from other values with the value + // Chain="PEM". + // Defaults to false. + bool chain = 6; + + // Whether to forward the DNS type Subject Alternative Names of the client cert. + // Defaults to false. + bool dns = 4; + + // Whether to forward the URI type Subject Alternative Name of the client cert. Defaults to + // false. + bool uri = 5; + + // Whether to forward the issuer of the client cert. Defaults to false. + bool issuer = 8; + + // The format for the header. When the :ref:`forward_client_cert_details + // ` + // is APPEND_FORWARD and an existing XFCC header is present, the format of the existing header + // is used. The configured format is used when there is no existing header value + // (APPEND_FORWARD with no prior XFCC header, or SANITIZE_SET which always replaces the value). + ForwardClientCertFormat format = 7; + } + + // The configuration for forwarding client cert details, used as the action config in a + // :ref:`forward_client_cert_matcher + // `. + message ForwardClientCertConfig { + // How to handle the XFCC header. + ForwardClientCertDetails forward_client_cert_details = 1; + + // The fields in the client certificate to forward. See + // :ref:`set_current_client_cert_details + // ` + // for details. + SetCurrentClientCertDetails set_current_client_cert_details = 2; + } + + // The configuration for HTTP upgrades. + // For each upgrade type desired, an UpgradeConfig must be added. + // + // .. warning:: + // + // The current implementation of upgrade headers does not handle multi-valued upgrade headers. Support for + // multi-valued headers may be added in the future if needed. + // + // .. warning:: + // The current implementation of upgrade headers does not work with HTTP/2 upstreams. + // + message UpgradeConfig { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager." + "UpgradeConfig"; + + // The case-insensitive name of this upgrade, e.g. "websocket". + // For each upgrade type present in upgrade_configs, requests with + // Upgrade: [upgrade_type] + // will be proxied upstream. + string upgrade_type = 1; + + // If present, this represents the filter chain which will be created for + // this type of upgrade. If no filters are present, the filter chain for + // HTTP connections will be used for this upgrade type. + repeated HttpFilter filters = 2; + + // Determines if upgrades are enabled or disabled by default. Defaults to true. + // This can be overridden on a per-route basis with :ref:`cluster + // ` as documented in the + // :ref:`upgrade documentation `. + google.protobuf.BoolValue enabled = 3; + } + + // [#not-implemented-hide:] Transformations that apply to path headers. Transformations are applied + // before any processing of requests by HTTP filters, routing, and matching. Only the normalized + // path will be visible internally if a transformation is enabled. Any path rewrites that the + // router performs (e.g. :ref:`regex_rewrite + // ` or :ref:`prefix_rewrite + // `) will apply to the ``:path`` header + // destined for the upstream. + // + // .. note:: + // + // Access logging and tracing will show the original ``:path`` header. + // + message PathNormalizationOptions { + // [#not-implemented-hide:] Normalization applies internally before any processing of requests by + // HTTP filters, routing, and matching *and* will affect the forwarded ``:path`` header. Defaults + // to :ref:`NormalizePathRFC3986 + // `. When not + // specified, this value may be overridden by the runtime variable + // :ref:`http_connection_manager.normalize_path`. + // Envoy will respond with 400 to paths that are malformed (e.g. for paths that fail RFC 3986 + // normalization due to disallowed characters.) + type.http.v3.PathTransformation forwarding_transformation = 1; + + // [#not-implemented-hide:] Normalization only applies internally before any processing of + // requests by HTTP filters, routing, and matching. These will be applied after full + // transformation is applied. The ``:path`` header before this transformation will be restored in + // the router filter and sent upstream unless it was mutated by a filter. Defaults to no + // transformations. + // Multiple actions can be applied in the same Transformation, forming a sequential + // pipeline. The transformations will be performed in the order that they appear. Envoy will + // respond with 400 to paths that are malformed (e.g. for paths that fail RFC 3986 + // normalization due to disallowed characters.) + type.http.v3.PathTransformation http_filter_transformation = 2; + } + + // Configures the manner in which the Proxy-Status HTTP response header is + // populated. + // + // See the [Proxy-Status + // RFC](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-proxy-status-08). + // [#comment:TODO: Update this with the non-draft URL when finalized.] + // + // The Proxy-Status header is a string of the form: + // + // "; error=; details=
" + // [#next-free-field: 7] + message ProxyStatusConfig { + // If true, the details field of the Proxy-Status header is not populated with stream_info.response_code_details. + // This value defaults to ``false``, i.e. the ``details`` field is populated by default. + bool remove_details = 1; + + // If true, the details field of the Proxy-Status header will not contain + // connection termination details. This value defaults to ``false``, i.e. the + // ``details`` field will contain connection termination details by default. + bool remove_connection_termination_details = 2; + + // If true, the details field of the Proxy-Status header will not contain an + // enumeration of the Envoy ResponseFlags. This value defaults to ``false``, + // i.e. the ``details`` field will contain a list of ResponseFlags by default. + bool remove_response_flags = 3; + + // If true, overwrites the existing Status header with the response code + // recommended by the Proxy-Status spec. + // This value defaults to ``false``, i.e. the HTTP response code is not + // overwritten. + bool set_recommended_response_code = 4; + + // The name of the proxy as it appears at the start of the Proxy-Status + // header. + // + // If neither of these values are set, this value defaults to ``server_name``, + // which itself defaults to "envoy". + oneof proxy_name { + // If ``use_node_id`` is set, Proxy-Status headers will use the Envoy's node + // ID as the name of the proxy. + bool use_node_id = 5; + + // If ``literal_proxy_name`` is set, Proxy-Status headers will use this + // value as the name of the proxy. + string literal_proxy_name = 6; + } + } + + message HcmAccessLogOptions { + // The interval to flush the above access logs. By default, the HCM will flush exactly one access log + // on stream close, when the HTTP request is complete. If this field is set, the HCM will flush access + // logs periodically at the specified interval. This is especially useful in the case of long-lived + // requests, such as CONNECT and Websockets. Final access logs can be detected via the + // ``requestComplete()`` method of ``StreamInfo`` in access log filters, or through the ``%DURATION%`` substitution + // string. + // The interval must be at least 1 millisecond. + google.protobuf.Duration access_log_flush_interval = 1 + [(validate.rules).duration = {gte {nanos: 1000000}}]; + + // If set to true, HCM will flush an access log when a new HTTP request is received, after request + // headers have been evaluated, before iterating through the HTTP filter chain. + // This log record, if enabled, does not depend on periodic log records or request completion log. + // Details related to upstream cluster, such as upstream host, will not be available for this log. + bool flush_access_log_on_new_request = 2; + + // If true, the HCM will flush an access log when a tunnel is successfully established. For example, + // this could be when an upstream has successfully returned 101 Switching Protocols, or when the proxy + // has returned 200 to a CONNECT request. + bool flush_log_on_tunnel_successfully_established = 3; + } + + reserved 27, 11; + + reserved "idle_timeout"; + + // Supplies the type of codec that the connection manager should use. + CodecType codec_type = 1 [(validate.rules).enum = {defined_only: true}]; + + // The human readable prefix to use when emitting statistics for the + // connection manager. See the :ref:`statistics documentation ` for + // more information. + string stat_prefix = 2 [(validate.rules).string = {min_len: 1}]; + + oneof route_specifier { + option (validate.required) = true; + + // The connection manager’s route table will be dynamically loaded via the RDS API. + Rds rds = 3; + + // The route table for the connection manager is static and is specified in this property. + config.route.v3.RouteConfiguration route_config = 4; + + // A route table will be dynamically assigned to each request based on request attributes + // (e.g., the value of a header). The "routing scopes" (i.e., route tables) and "scope keys" are + // specified in this message. + ScopedRoutes scoped_routes = 31; + } + + // A list of individual HTTP filters that make up the filter chain for + // requests made to the connection manager. :ref:`Order matters ` + // as the filters are processed sequentially as request events happen. + repeated HttpFilter http_filters = 5; + + // Whether the connection manager manipulates the :ref:`config_http_conn_man_headers_user-agent` + // and :ref:`config_http_conn_man_headers_downstream-service-cluster` headers. See the linked + // documentation for more information. Defaults to false. + google.protobuf.BoolValue add_user_agent = 6; + + // Presence of the object defines whether the connection manager + // emits :ref:`tracing ` data to the :ref:`configured tracing provider + // `. + Tracing tracing = 7; + + // Additional settings for HTTP requests handled by the connection manager. These will be + // applicable to both HTTP/1.1 and HTTP/2 requests. + config.core.v3.HttpProtocolOptions common_http_protocol_options = 35 + [(udpa.annotations.security).configure_for_untrusted_downstream = true]; + + // If set to ``true``, Envoy will not initiate an immediate drain timer for downstream HTTP/1 connections + // once :ref:`common_http_protocol_options.max_connection_duration + // ` is exceeded. + // Instead, Envoy will wait until the next downstream request arrives, add a ``connection: close`` header + // to the response, and then gracefully close the connection once the stream has completed. + // + // This behavior adheres to `RFC 9112, Section 9.6 `_. + // + // If set to ``false``, exceeding ``max_connection_duration`` triggers Envoy's default drain behavior for HTTP/1, + // where the connection is eventually closed after all active streams finish. + // + // This option has no effect if ``max_connection_duration`` is not configured. + // Defaults to ``false``. + bool http1_safe_max_connection_duration = 58; + + // Additional HTTP/1 settings that are passed to the HTTP/1 codec. + // [#comment:TODO: The following fields are ignored when the + // :ref:`header validation configuration ` + // is present: + // 1. :ref:`allow_chunked_length `] + config.core.v3.Http1ProtocolOptions http_protocol_options = 8; + + // Additional HTTP/2 settings that are passed directly to the HTTP/2 codec. + config.core.v3.Http2ProtocolOptions http2_protocol_options = 9 + [(udpa.annotations.security).configure_for_untrusted_downstream = true]; + + // Additional HTTP/3 settings that are passed directly to the HTTP/3 codec. + config.core.v3.Http3ProtocolOptions http3_protocol_options = 44; + + // An optional override that the connection manager will write to the server + // header in responses. If not set, the default is ``envoy``. + string server_name = 10 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE strict: false}]; + + // Defines the action to be applied to the Server header on the response path. + // By default, Envoy will overwrite the header with the value specified in + // server_name. + ServerHeaderTransformation server_header_transformation = 34 + [(validate.rules).enum = {defined_only: true}]; + + // Allows for explicit transformation of the :scheme header on the request path. + // If not set, Envoy's default :ref:`scheme ` + // handling applies. + config.core.v3.SchemeHeaderTransformation scheme_header_transformation = 48; + + // The maximum request headers size for incoming connections. + // If unconfigured, the default max request headers allowed is 60 KiB. + // The default value can be overridden by setting runtime key ``envoy.reloadable_features.max_request_headers_size_kb``. + // Requests that exceed this limit will receive a 431 response. + // + // .. note:: + // + // Currently some protocol codecs impose limits on the maximum size of a single header. + // + // * HTTP/2 (when using nghttp2) limits a single header to around 100 KB by default. This can be + // adjusted via :ref:`max_header_field_size_kb + // `. + // * HTTP/3 limits a single header to around 1024 KB. + // + google.protobuf.UInt32Value max_request_headers_kb = 29 + [(validate.rules).uint32 = {lte: 8192 gt: 0}]; + + // The stream idle timeout for connections managed by the connection manager. + // If not specified, this defaults to ``5 minutes``. The default value was selected + // so as not to interfere with any smaller configured timeouts that may have + // existed in configurations prior to the introduction of this feature, while + // introducing robustness to TCP connections that terminate without a FIN. + // + // This idle timeout applies to new streams and is overridable by the + // :ref:`route-level idle_timeout + // `. Even on a stream in + // which the override applies, prior to receipt of the initial request + // headers, the ``stream_idle_timeout`` applies. Each time an encode/decode event + // for headers or data is processed for the stream, the timer will be reset. If the + // timeout fires, the stream is terminated with a ``408 Request Timeout`` error code + // if no upstream response header has been received, otherwise a stream reset occurs. + // + // If the :ref:`overload action ` + // ``envoy.overload_actions.reduce_timeouts`` is configured, this timeout is scaled + // according to the value for + // :ref:`HTTP_DOWNSTREAM_STREAM_IDLE `. + // + // .. note:: + // + // It is possible to idle timeout even if the wire traffic for a stream is non-idle, due + // to the granularity of events presented to the connection manager. For example, while receiving + // very large request headers, it may be the case that there is traffic regularly arriving on the + // wire while the connection manager is only able to observe the end-of-headers event, hence the + // stream may still idle timeout. + // + // A value of ``0`` will completely disable the connection manager stream idle + // timeout, although per-route idle timeout overrides will continue to apply. + // + // This timeout is also used as the default value for + // :ref:`stream_flush_timeout `. + google.protobuf.Duration stream_idle_timeout = 24 + [(udpa.annotations.security).configure_for_untrusted_downstream = true]; + + // The stream flush timeout for connections managed by the connection manager. + // + // If not specified, the value of stream_idle_timeout is used. This is for backwards compatibility + // since this was the original behavior. In essence this timeout is an override for the + // stream_idle_timeout that applies specifically to the end of stream flush case. + // + // This timeout specifies the amount of time that Envoy will wait for the peer to open enough + // window to write any remaining stream data once the entirety of stream data (local end stream is + // true) has been buffered pending available window. In other words, this timeout defends against + // a peer that does not release enough window to completely write the stream, even though all + // data has been proxied within available flow control windows. If the timeout is hit in this + // case, the :ref:`tx_flush_timeout ` counter will be + // incremented. Note that :ref:`max_stream_duration + // ` does not apply to + // this corner case. + google.protobuf.Duration stream_flush_timeout = 59; + + // The amount of time that Envoy will wait for the entire request to be received. + // The timer is activated when the request is initiated, and is disarmed when the last byte of the + // request is sent upstream (i.e. all decoding filters have processed the request), OR when the + // response is initiated. If not specified or set to 0, this timeout is disabled. + google.protobuf.Duration request_timeout = 28 + [(udpa.annotations.security).configure_for_untrusted_downstream = true]; + + // The amount of time that Envoy will wait for the request headers to be received. The timer is + // activated when the first byte of the headers is received, and is disarmed when the last byte of + // the headers has been received. If not specified or set to 0, this timeout is disabled. + google.protobuf.Duration request_headers_timeout = 41 [ + (validate.rules).duration = {gte {}}, + (udpa.annotations.security).configure_for_untrusted_downstream = true + ]; + + // The time that Envoy will wait between sending an HTTP/2 “shutdown + // notification” (GOAWAY frame with max stream ID) and a final GOAWAY frame. + // This is used so that Envoy provides a grace period for new streams that + // race with the final GOAWAY frame. During this grace period, Envoy will + // continue to accept new streams. After the grace period, a final GOAWAY + // frame is sent and Envoy will start refusing new streams. Draining occurs + // either when a connection hits the idle timeout, when :ref:`max_connection_duration + // ` + // is reached, or during general server draining. The default grace period is + // 5000 milliseconds (5 seconds) if this option is not specified. + google.protobuf.Duration drain_timeout = 12; + + // Percentage-based jitter for ``drain_timeout``. If set, the actual drain grace period + // is extended by a random duration up to ``drain_timeout * jitter / 100`` per connection. + // This staggers the final GOAWAY (and connection close) across time so that connections + // entering the drain state simultaneously do not all complete draining at the same instant, + // mitigating thundering-herd reconnects. If not set, no jitter is added. + // + // This is analogous to + // :ref:`max_connection_duration_jitter + // `, + // but applied to the drain grace timer rather than the connection duration timer. + type.v3.Percent drain_timeout_jitter = 62; + + // The delayed close timeout is for downstream connections managed by the HTTP connection manager. + // It is defined as a grace period after connection close processing has been locally initiated + // during which Envoy will wait for the peer to close (i.e., a TCP FIN/RST is received by Envoy + // from the downstream connection) prior to Envoy closing the socket associated with that + // connection. + // + // .. note:: + // + // This timeout is enforced even when the socket associated with the downstream connection is pending a flush of + // the write buffer. However, any progress made writing data to the socket will restart the timer associated with + // this timeout. This means that the total grace period for a socket in this state will be + // +. + // + // Delaying Envoy's connection close and giving the peer the opportunity to initiate the close + // sequence mitigates a race condition that exists when downstream clients do not drain/process + // data in a connection's receive buffer after a remote close has been detected via a socket + // ``write()``. This race leads to such clients failing to process the response code sent by Envoy, + // which could result in erroneous downstream processing. + // + // If the timeout triggers, Envoy will close the connection's socket. + // + // The default timeout is 1000 ms if this option is not specified. + // + // .. note:: + // To be useful in avoiding the race condition described above, this timeout must be set + // to *at least* +<100ms to account for + // a reasonable "worst" case processing time for a full iteration of Envoy's event loop>. + // + // .. warning:: + // A value of ``0`` will completely disable delayed close processing. When disabled, the downstream + // connection's socket will be closed immediately after the write flush is completed or will + // never close if the write flush does not complete. + // + google.protobuf.Duration delayed_close_timeout = 26; + + // Configuration for :ref:`HTTP access logs ` + // emitted by the connection manager. + repeated config.accesslog.v3.AccessLog access_log = 13; + + // The interval to flush the above access logs. + // + // .. attention:: + // + // This field is deprecated in favor of + // :ref:`access_log_flush_interval + // `. + // Note that if both this field and :ref:`access_log_flush_interval + // ` + // are specified, the former (deprecated field) is ignored. + google.protobuf.Duration access_log_flush_interval = 54 [ + deprecated = true, + (validate.rules).duration = {gte {nanos: 1000000}}, + (envoy.annotations.deprecated_at_minor_version) = "3.0" + ]; + + // If set to true, HCM will flush an access log once when a new HTTP request is received, after the request + // headers have been evaluated, and before iterating through the HTTP filter chain. + // + // .. attention:: + // + // This field is deprecated in favor of + // :ref:`flush_access_log_on_new_request + // `. + // Note that if both this field and :ref:`flush_access_log_on_new_request + // ` + // are specified, the former (deprecated field) is ignored. + bool flush_access_log_on_new_request = 55 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Additional access log options for HTTP connection manager. + HcmAccessLogOptions access_log_options = 56; + + // If set to true, the connection manager will use the real remote address + // of the client connection when determining internal versus external origin and manipulating + // various headers. If set to false or absent, the connection manager will use the + // :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header. See the documentation for + // :ref:`config_http_conn_man_headers_x-forwarded-for`, + // :ref:`config_http_conn_man_headers_x-envoy-internal`, and + // :ref:`config_http_conn_man_headers_x-envoy-external-address` for more information. + google.protobuf.BoolValue use_remote_address = 14 + [(udpa.annotations.security).configure_for_untrusted_downstream = true]; + + // The number of additional ingress proxy hops from the right side of the + // :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header to trust when + // determining the origin client's IP address. The default is zero if this option + // is not specified. See the documentation for + // :ref:`config_http_conn_man_headers_x-forwarded-for` for more information. + uint32 xff_num_trusted_hops = 19; + + // Configuration for original IP detection extensions. + // + // When these extensions are configured, Envoy will invoke them with the incoming request headers and + // details about the downstream connection, including the directly connected address. Each extension uses + // this information to determine the effective remote IP address for the request. If an extension cannot + // identify the original IP address and isn't set to reject the request, Envoy will sequentially attempt + // the remaining extensions until one successfully determines the IP or explicitly rejects the request. + // If all extensions fail without rejection, Envoy defaults to using the directly connected remote address. + // + // .. warning:: + // These extensions cannot be configured simultaneously with :ref:`use_remote_address + // ` + // or :ref:`xff_num_trusted_hops + // `. + // + // [#extension-category: envoy.http.original_ip_detection] + repeated config.core.v3.TypedExtensionConfig original_ip_detection_extensions = 46; + + // The configuration for the early header mutation extensions. + // + // When configured the extensions will be called before any routing, tracing, or any filter processing. + // Each extension will be applied in the order they are configured. + // If the same header is mutated by multiple extensions, then the last extension will win. + // + // [#extension-category: envoy.http.early_header_mutation] + repeated config.core.v3.TypedExtensionConfig early_header_mutation_extensions = 52; + + // Configures what network addresses are considered internal for stats and header sanitation + // purposes. If unspecified, only RFC1918 IP addresses will be considered internal. + // See the documentation for :ref:`config_http_conn_man_headers_x-envoy-internal` for more + // information about internal/external addresses. + // + // .. warning:: + // As of Envoy 1.33.0 no IP addresses will be considered trusted. If you have tooling such as probes + // on your private network which need to be treated as trusted (e.g. changing arbitrary x-envoy headers) + // you will have to manually include those addresses or CIDR ranges like: + // + // .. validated-code-block:: yaml + // :type-name: envoy.extensions.filters.network.http_connection_manager.v3.InternalAddressConfig + // + // cidr_ranges: + // address_prefix: 10.0.0.0 + // prefix_len: 8 + // cidr_ranges: + // address_prefix: 192.168.0.0 + // prefix_len: 16 + // cidr_ranges: + // address_prefix: 172.16.0.0 + // prefix_len: 12 + // cidr_ranges: + // address_prefix: 127.0.0.1 + // prefix_len: 32 + // cidr_ranges: + // address_prefix: fd00:: + // prefix_len: 8 + // cidr_ranges: + // address_prefix: ::1 + // prefix_len: 128 + // + InternalAddressConfig internal_address_config = 25; + + // If set, Envoy will not append the remote address to the + // :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header. This may be used in + // conjunction with HTTP filters that explicitly manipulate XFF after the HTTP connection manager + // has mutated the request headers. While :ref:`use_remote_address + // ` + // will also suppress XFF addition, it has consequences for logging and other + // Envoy uses of the remote address, so ``skip_xff_append`` should be used + // when only an elision of XFF addition is intended. + bool skip_xff_append = 21; + + // Via header value to append to request and response headers. If this is + // empty, no via header will be appended. + string via = 22 [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE strict: false}]; + + // Whether the connection manager will generate the :ref:`x-request-id + // ` header if it does not exist. This defaults to + // true. Generating a random UUID4 is expensive so in high throughput scenarios where this feature + // is not desired it can be disabled. + google.protobuf.BoolValue generate_request_id = 15; + + // Whether the connection manager will keep the :ref:`x-request-id + // ` header if passed for a request that is edge + // (Edge request is the request from external clients to front Envoy) and not reset it, which + // is the current Envoy behaviour. This defaults to false. + bool preserve_external_request_id = 32; + + // If set, Envoy will always set :ref:`x-request-id ` header in response. + // If this is false or not set, the request ID is returned in responses only if tracing is forced using + // :ref:`x-envoy-force-trace ` header. + bool always_set_request_id_in_response = 37; + + // How to handle the :ref:`config_http_conn_man_headers_x-forwarded-client-cert` (XFCC) HTTP + // header. + ForwardClientCertDetails forward_client_cert_details = 16 + [(validate.rules).enum = {defined_only: true}]; + + // This field is valid only when :ref:`forward_client_cert_details + // ` + // is APPEND_FORWARD or SANITIZE_SET and the client connection is mTLS. It specifies the fields in + // the client certificate to be forwarded. Note that in the + // :ref:`config_http_conn_man_headers_x-forwarded-client-cert` header, ``Hash`` is always set, and + // ``By`` is always set when the client certificate presents the URI type Subject Alternative Name + // value. + SetCurrentClientCertDetails set_current_client_cert_details = 17; + + // The matcher for forwarding client cert details. This allows per-request configuration + // of forward client cert behavior based on request properties. If a matcher is configured + // and matches a request, the matched action's forward client cert config will be used. + // If the matcher is not configured or doesn't match, the static + // :ref:`forward_client_cert_details + // ` + // and + // :ref:`set_current_client_cert_details + // ` + // config will be used as fallback. + // + // Example: If the x-forwarded-client-cert header contains "trusted-client", use APPEND_FORWARD, + // otherwise use SANITIZE_SET: + // + // .. code-block:: yaml + // + // forward_client_cert_matcher: + // matcher_list: + // matchers: + // - predicate: + // single_predicate: + // input: + // name: envoy.matching.inputs.request_headers + // typed_config: + // "@type": type.googleapis.com/envoy.type.matcher.v3.HttpRequestHeaderMatchInput + // header_name: "x-forwarded-client-cert" + // value_match: + // string_match: + // contains: "trusted-client" + // on_match: + // action: + // name: forward_client_cert + // typed_config: + // "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertConfig + // forward_client_cert_details: APPEND_FORWARD + // set_current_client_cert_details: + // uri: true + // on_no_match: + // action: + // name: forward_client_cert + // typed_config: + // "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertConfig + // forward_client_cert_details: SANITIZE_SET + // set_current_client_cert_details: + // uri: true + xds.type.matcher.v3.Matcher forward_client_cert_matcher = 60; + + // If proxy_100_continue is true, Envoy will proxy incoming "Expect: + // 100-continue" headers upstream, and forward "100 Continue" responses + // downstream. If this is false or not set, Envoy will instead strip the + // "Expect: 100-continue" header, and send a "100 Continue" response itself. + bool proxy_100_continue = 18; + + // If + // :ref:`use_remote_address + // ` + // is true and represent_ipv4_remote_address_as_ipv4_mapped_ipv6 is true and the remote address is + // an IPv4 address, the address will be mapped to IPv6 before it is appended to ``x-forwarded-for``. + // This is useful for testing compatibility of upstream services that parse the header value. For + // example, 50.0.0.1 is represented as ::FFFF:50.0.0.1. See `IPv4-Mapped IPv6 Addresses + // `_ for details. This will also affect the + // :ref:`config_http_conn_man_headers_x-envoy-external-address` header. See + // :ref:`http_connection_manager.represent_ipv4_remote_address_as_ipv4_mapped_ipv6 + // ` for runtime + // control. + // [#not-implemented-hide:] + bool represent_ipv4_remote_address_as_ipv4_mapped_ipv6 = 20; + + repeated UpgradeConfig upgrade_configs = 23; + + // Should paths be normalized according to RFC 3986 before any processing of + // requests by HTTP filters or routing? This affects the upstream ``:path`` header + // as well. For paths that fail this check, Envoy will respond with 400 to + // paths that are malformed. This defaults to false currently but will default + // true in the future. When not specified, this value may be overridden by the + // runtime variable + // :ref:`http_connection_manager.normalize_path`. + // See `Normalization and Comparison `_ + // for details of normalization. + // Note that Envoy does not perform + // `case normalization `_ + // [#comment:TODO: This field is ignored when the + // :ref:`header validation configuration ` + // is present.] + google.protobuf.BoolValue normalize_path = 30; + + // Determines if adjacent slashes in the path are merged into one before any processing of + // requests by HTTP filters or routing. This affects the upstream ``:path`` header as well. Without + // setting this option, incoming requests with path ``//dir///file`` will not match against route + // with ``prefix`` match set to ``/dir``. Defaults to ``false``. Note that slash merging is not part of + // `HTTP spec `_ and is provided for convenience. + // [#comment:TODO: This field is ignored when the + // :ref:`header validation configuration ` + // is present.] + bool merge_slashes = 33; + + // Action to take when request URL path contains escaped slash sequences (%2F, %2f, %5C and %5c). + // The default value can be overridden by the :ref:`http_connection_manager.path_with_escaped_slashes_action` + // runtime variable. + // The :ref:`http_connection_manager.path_with_escaped_slashes_action_sampling` runtime + // variable can be used to apply the action to a portion of all requests. + // [#comment:TODO: This field is ignored when the + // :ref:`header validation configuration ` + // is present.] + PathWithEscapedSlashesAction path_with_escaped_slashes_action = 45; + + // The configuration of the request ID extension. This includes operations such as + // generation, validation, and associated tracing operations. If empty, the + // :ref:`UuidRequestIdConfig ` + // default extension is used with default parameters. See the documentation for that extension + // for details on what it does. Customizing the configuration for the default extension can be + // achieved by configuring it explicitly here. For example, to disable trace reason packing, + // the following configuration can be used: + // + // .. validated-code-block:: yaml + // :type-name: envoy.extensions.filters.network.http_connection_manager.v3.RequestIDExtension + // + // typed_config: + // "@type": type.googleapis.com/envoy.extensions.request_id.uuid.v3.UuidRequestIdConfig + // pack_trace_reason: false + // + // [#extension-category: envoy.request_id] + RequestIDExtension request_id_extension = 36; + + // The configuration to customize local reply returned by Envoy. It can customize status code, + // body text and response content type. If not specified, status code and text body are hard + // coded in Envoy, the response content type is plain text. + LocalReplyConfig local_reply_config = 38; + + // Determines if the port part should be removed from host/authority header before any processing + // of request by HTTP filters or routing. The port would be removed only if it is equal to the :ref:`listener's` + // local port. This affects the upstream host header unless the method is + // CONNECT in which case if no filter adds a port the original port will be restored before headers are + // sent upstream. + // Without setting this option, incoming requests with host ``example:443`` will not match against + // route with :ref:`domains` match set to ``example``. Defaults to ``false``. Note that port removal is not part + // of `HTTP spec `_ and is provided for convenience. + // Only one of ``strip_matching_host_port`` or ``strip_any_host_port`` can be set. + bool strip_matching_host_port = 39 + [(udpa.annotations.field_migrate).oneof_promotion = "strip_port_mode"]; + + oneof strip_port_mode { + // Determines if the port part should be removed from host/authority header before any processing + // of request by HTTP filters or routing. + // This affects the upstream host header unless the method is CONNECT in + // which case if no filter adds a port the original port will be restored before headers are sent upstream. + // Without setting this option, incoming requests with host ``example:443`` will not match against + // route with :ref:`domains` match set to ``example``. Defaults to ``false``. Note that port removal is not part + // of `HTTP spec `_ and is provided for convenience. + // Only one of ``strip_matching_host_port`` or ``strip_any_host_port`` can be set. + bool strip_any_host_port = 42; + } + + // Governs Envoy's behavior when receiving invalid HTTP from downstream. + // If this option is false (default), Envoy will err on the conservative side handling HTTP + // errors, terminating both HTTP/1.1 and HTTP/2 connections when receiving an invalid request. + // If this option is set to true, Envoy will be more permissive, only resetting the invalid + // stream in the case of HTTP/2 and leaving the connection open where possible (if the entire + // request is read for HTTP/1.1) + // In general this should be true for deployments receiving trusted traffic (L2 Envoys, + // company-internal mesh) and false when receiving untrusted traffic (edge deployments). + // + // If different behaviors for invalid_http_message for HTTP/1 and HTTP/2 are + // desired, one should use the new HTTP/1 option :ref:`override_stream_error_on_invalid_http_message + // ` or the new HTTP/2 option + // :ref:`override_stream_error_on_invalid_http_message + // ` + // ``not`` the deprecated but similarly named :ref:`stream_error_on_invalid_http_messaging + // ` + google.protobuf.BoolValue stream_error_on_invalid_http_message = 40; + + // [#not-implemented-hide:] Path normalization configuration. This includes + // configurations for transformations (e.g. RFC 3986 normalization or merge + // adjacent slashes) and the policy to apply them. The policy determines + // whether transformations affect the forwarded ``:path`` header. RFC 3986 path + // normalization is enabled by default and the default policy is that the + // normalized header will be forwarded. See :ref:`PathNormalizationOptions + // ` + // for details. + PathNormalizationOptions path_normalization_options = 43; + + // Determines if trailing dot of the host should be removed from host/authority header before any + // processing of request by HTTP filters or routing. + // This affects the upstream host header. + // Without setting this option, incoming requests with host ``example.com.`` will not match against + // route with :ref:`domains` match set to ``example.com``. Defaults to ``false``. + // When the incoming request contains a host/authority header that includes a port number, + // setting this option will strip a trailing dot, if present, from the host section, + // leaving the port as is (e.g. host value ``example.com.:443`` will be updated to ``example.com:443``). + bool strip_trailing_host_dot = 47; + + // Proxy-Status HTTP response header configuration. + // If this config is set, the Proxy-Status HTTP response header field is + // populated. By default, it is not. + ProxyStatusConfig proxy_status_config = 49; + + // Configuration options for Header Validation (UHV). + // UHV is an extensible mechanism for checking validity of HTTP requests as well as providing + // normalization for request attributes, such as URI path. + // If the typed_header_validation_config is present it overrides the following options: + // ``normalize_path``, ``merge_slashes``, ``path_with_escaped_slashes_action`` + // ``http_protocol_options.allow_chunked_length``, ``common_http_protocol_options.headers_with_underscores_action``. + // + // The default UHV checks the following: + // + // #. HTTP/1 header map validity according to `RFC 7230 section 3.2`_ + // #. Syntax of HTTP/1 request target URI and response status + // #. HTTP/2 header map validity according to `RFC 7540 section 8.1.2`_ + // #. Syntax of HTTP/3 pseudo headers + // #. Syntax of ``Content-Length`` and ``Transfer-Encoding`` + // #. Validation of HTTP/1 requests with both ``Content-Length`` and ``Transfer-Encoding`` headers + // #. Normalization of the URI path according to `Normalization and Comparison `_ + // without `case normalization `_ + // + // [#not-implemented-hide:] + // [#extension-category: envoy.http.header_validators] + config.core.v3.TypedExtensionConfig typed_header_validation_config = 50; + + // Append the ``x-forwarded-port`` header with the port value client used to connect to Envoy. It + // will be ignored if the ``x-forwarded-port`` header has been set by any trusted proxy in front of Envoy. + bool append_x_forwarded_port = 51; + + // Append the :ref:`config_http_conn_man_headers_x-envoy-local-overloaded` HTTP header in the scenario where + // the Overload Manager has been triggered. + bool append_local_overload = 57; + + // Whether the HCM will add ProxyProtocolFilterState to the Connection lifetime filter state. Defaults to ``true``. + // This should be set to ``false`` in cases where Envoy's view of the downstream address may not correspond to the + // actual client address, for example, if there's another proxy in front of the Envoy. + google.protobuf.BoolValue add_proxy_protocol_connection_state = 53; + + // Configuration for controlling how the ``x-forwarded-proto`` header is set. + // This allows customization of protocol inference, including support for inferring the original + // protocol (HTTP or HTTPS) from the PROXY protocol destination port. + // + // This is useful when a Layer 4 load balancer (such as AWS NLB) terminates TLS and uses + // PROXY protocol to communicate with Envoy. + // + // When configured and the local address was restored from PROXY protocol (indicating the + // original destination address is available), the ``x-forwarded-proto`` header will be set + // based on whether the destination port is in ``https_destination_ports`` or + // ``http_destination_ports``. + // + // Example configuration: + // + // .. code-block:: yaml + // + // http_connection_manager: + // forward_proto_config: + // https_destination_ports: [443, 8443] + // http_destination_ports: [80, 8080] + // + // If not configured, defaults to disabled and the standard behavior applies (using connection + // TLS status or trusted downstream headers). + ForwardProtoConfig forward_proto_config = 61; + + // If true, records two per stream histograms, ``downstream_rq_route_resolution_time_us`` for the + // total wall time spent resolving the route and ``downstream_rq_route_resolutions`` for the number + // of resolutions. Defaults to false, so the default stat set is unchanged. + bool record_route_resolution_stats = 63; +} + +// Configuration options for setting the ``x-forwarded-proto`` header. +// This message provides flexibility for future enhancements to protocol inference. +message ForwardProtoConfig { + // List of destination ports that should be treated as HTTPS. + // When the PROXY protocol destination port matches one of these ports, + // ``x-forwarded-proto`` will be set to ``https``. + // + // Common values: 443, 8443 + repeated uint32 https_destination_ports = 1; + + // List of destination ports that should be treated as HTTP. + // When the PROXY protocol destination port matches one of these ports, + // ``x-forwarded-proto`` will be set to ``http``. + // + // Common values: 80, 8080 + repeated uint32 http_destination_ports = 2; +} + +// The configuration to customize local reply returned by Envoy. +message LocalReplyConfig { + // Configuration of list of mappers which allows to filter and change local response. + // The mappers will be checked by the specified order until one is matched. + repeated ResponseMapper mappers = 1; + + // The configuration to form response body from the :ref:`command operators ` + // and to specify response content type as one of: plain/text or application/json. + // + // Example one: "plain/text" ``body_format``. + // + // .. validated-code-block:: yaml + // :type-name: envoy.config.core.v3.SubstitutionFormatString + // + // text_format: "%LOCAL_REPLY_BODY%:%RESPONSE_CODE%:path=%REQ(:path)%\n" + // + // The following response body in "plain/text" format will be generated for a request with + // local reply body of "upstream connection error", response_code=503 and path=/foo. + // + // .. code-block:: text + // + // upstream connect error:503:path=/foo + // + // Example two: "application/json" ``body_format``. + // + // .. validated-code-block:: yaml + // :type-name: envoy.config.core.v3.SubstitutionFormatString + // + // json_format: + // status: "%RESPONSE_CODE%" + // message: "%LOCAL_REPLY_BODY%" + // path: "%REQ(:path)%" + // + // The following response body in "application/json" format would be generated for a request with + // local reply body of "upstream connection error", response_code=503 and path=/foo. + // + // .. code-block:: json + // + // { + // "status": 503, + // "message": "upstream connection error", + // "path": "/foo" + // } + // + config.core.v3.SubstitutionFormatString body_format = 2; +} + +// The configuration to filter and change local response. +// [#next-free-field: 6] +message ResponseMapper { + // Filter to determine if this mapper should apply. + config.accesslog.v3.AccessLogFilter filter = 1 [(validate.rules).message = {required: true}]; + + // The new response status code if specified. + google.protobuf.UInt32Value status_code = 2 [(validate.rules).uint32 = {lt: 600 gte: 200}]; + + // The new local reply body text if specified. It will be used in the ``%LOCAL_REPLY_BODY%`` + // command operator in the ``body_format``. + config.core.v3.DataSource body = 3; + + // A per mapper ``body_format`` to override the :ref:`body_format `. + // It will be used when this mapper is matched. + config.core.v3.SubstitutionFormatString body_format_override = 4; + + // HTTP headers to add to a local reply. This allows the response mapper to append, to add + // or to override headers of any local reply before it is sent to a downstream client. + repeated config.core.v3.HeaderValueOption headers_to_add = 5 + [(validate.rules).repeated = {max_items: 1000}]; +} + +message Rds { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.http_connection_manager.v2.Rds"; + + // Configuration source specifier for RDS. + config.core.v3.ConfigSource config_source = 1; + + // The name of the route configuration. This name will be passed to the RDS + // API. This allows an Envoy configuration with multiple HTTP listeners (and + // associated HTTP connection manager filters) to use different route + // configurations. + string route_config_name = 2; +} + +// This message is used to work around the limitations with 'oneof' and repeated fields. +message ScopedRouteConfigurationsList { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.http_connection_manager.v2.ScopedRouteConfigurationsList"; + + repeated config.route.v3.ScopedRouteConfiguration scoped_route_configurations = 1 + [(validate.rules).repeated = {min_items: 1}]; +} + +// [#next-free-field: 6] +message ScopedRoutes { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.http_connection_manager.v2.ScopedRoutes"; + + // Specifies the mechanism for constructing "scope keys" based on HTTP request attributes. These + // keys are matched against a set of :ref:`Key` + // objects assembled from :ref:`ScopedRouteConfiguration` + // messages distributed via SRDS (the Scoped Route Discovery Service) or assigned statically via + // :ref:`scoped_route_configurations_list`. + // + // Upon receiving a request's headers, the Router will build a key using the algorithm specified + // by this message. This key will be used to look up the routing table (i.e., the + // :ref:`RouteConfiguration`) to use for the request. + message ScopeKeyBuilder { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.http_connection_manager.v2.ScopedRoutes.ScopeKeyBuilder"; + + // Specifies the mechanism for constructing key fragments which are composed into scope keys. + message FragmentBuilder { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.http_connection_manager.v2.ScopedRoutes.ScopeKeyBuilder." + "FragmentBuilder"; + + // Specifies how the value of a header should be extracted. + // The following example maps the structure of a header to the fields in this message. + // + // .. code:: + // + // <0> <1> <-- index + // X-Header: a=b;c=d + // | || | + // | || \----> + // | || + // | |\----> + // | | + // | \----> + // | + // \----> + // + // Each 'a=b' key-value pair constitutes an 'element' of the header field. + message HeaderValueExtractor { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.http_connection_manager.v2.ScopedRoutes.ScopeKeyBuilder." + "FragmentBuilder.HeaderValueExtractor"; + + // Specifies a header field's key value pair to match on. + message KvElement { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.http_connection_manager.v2.ScopedRoutes.ScopeKeyBuilder." + "FragmentBuilder.HeaderValueExtractor.KvElement"; + + // The separator between key and value (e.g., '=' separates 'k=v;...'). + // If an element is an empty string, the element is ignored. + // If an element contains no separator, the whole element is parsed as key and the + // fragment value is an empty string. + // If there are multiple values for a matched key, the first value is returned. + string separator = 1 [(validate.rules).string = {min_len: 1}]; + + // The key to match on. + string key = 2 [(validate.rules).string = {min_len: 1}]; + } + + // The name of the header field to extract the value from. + // + // .. note:: + // + // If the header appears multiple times only the first value is used. + string name = 1 [ + (validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false} + ]; + + // The element separator (e.g., ';' separates 'a;b;c;d'). + // Default: empty string. This causes the entirety of the header field to be extracted. + // If this field is set to an empty string and 'index' is used in the oneof below, 'index' + // must be set to 0. + string element_separator = 2; + + oneof extract_type { + // Specifies the zero based index of the element to extract. + // Note Envoy concatenates multiple values of the same header key into a comma separated + // string, the splitting always happens after the concatenation. + uint32 index = 3; + + // Specifies the key value pair to extract the value from. + KvElement element = 4; + } + } + + oneof type { + option (validate.required) = true; + + // Specifies how a header field's value should be extracted. + HeaderValueExtractor header_value_extractor = 1; + } + } + + // The final(built) scope key consists of the ordered union of these fragments, which are compared in order with the + // fragments of a :ref:`ScopedRouteConfiguration`. + // A missing fragment during comparison will make the key invalid, i.e., the computed key doesn't match any key. + repeated FragmentBuilder fragments = 1 [(validate.rules).repeated = {min_items: 1}]; + } + + // The name assigned to the scoped routing configuration. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // The algorithm to use for constructing a scope key for each request. + ScopeKeyBuilder scope_key_builder = 2 [(validate.rules).message = {required: true}]; + + // Configuration source specifier for RDS. + // This config source is used to subscribe to RouteConfiguration resources specified in + // ScopedRouteConfiguration messages. + config.core.v3.ConfigSource rds_config_source = 3; + + oneof config_specifier { + option (validate.required) = true; + + // The set of routing scopes corresponding to the HCM. A scope is assigned to a request by + // matching a key constructed from the request's attributes according to the algorithm specified + // by the + // :ref:`ScopeKeyBuilder` + // in this message. + ScopedRouteConfigurationsList scoped_route_configurations_list = 4; + + // The set of routing scopes associated with the HCM will be dynamically loaded via the SRDS + // API. A scope is assigned to a request by matching a key constructed from the request's + // attributes according to the algorithm specified by the + // :ref:`ScopeKeyBuilder` + // in this message. + ScopedRds scoped_rds = 5; + } +} + +message ScopedRds { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.http_connection_manager.v2.ScopedRds"; + + // Configuration source specifier for scoped RDS. + config.core.v3.ConfigSource scoped_rds_config_source = 1 + [(validate.rules).message = {required: true}]; + + // xdstp:// resource locator for scoped RDS collection. + // [#not-implemented-hide:] + string srds_resources_locator = 2; +} + +// [#next-free-field: 8] +message HttpFilter { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.http_connection_manager.v2.HttpFilter"; + + reserved 3, 2; + + reserved "config"; + + // The name of the filter configuration. It also serves as a resource name in ExtensionConfigDS. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + oneof config_type { + // Filter specific configuration which depends on the filter being instantiated. See the supported + // filters for further documentation. + // + // To support configuring a :ref:`match tree `, use an + // :ref:`ExtensionWithMatcher ` + // with the desired HTTP filter. + // [#extension-category: envoy.filters.http] + google.protobuf.Any typed_config = 4; + + // Configuration source specifier for an extension configuration discovery service. + // In case of a failure and without the default configuration, the HTTP listener responds with code 500. + // Extension configs delivered through this mechanism are not expected to require warming (see https://github.com/envoyproxy/envoy/issues/12061). + // + // To support configuring a :ref:`match tree `, use an + // :ref:`ExtensionWithMatcher ` + // with the desired HTTP filter. This works for both the default filter configuration as well + // as for filters provided via the API. + config.core.v3.ExtensionConfigSource config_discovery = 5; + } + + // If true, clients that do not support this filter may ignore the + // filter but otherwise accept the config. + // Otherwise, clients that do not support this filter must reject the config. + bool is_optional = 6; + + // If true, the filter is disabled by default and must be explicitly enabled by setting + // per filter configuration in the route configuration. + // See :ref:`route based filter chain ` + // for more details. + // + // Terminal filters (e.g. ``envoy.filters.http.router``) cannot be marked as disabled. + bool disabled = 7; +} + +message RequestIDExtension { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.network.http_connection_manager.v2.RequestIDExtension"; + + // Request ID extension specific configuration. + google.protobuf.Any typed_config = 1; +} + +// [#protodoc-title: Envoy Mobile HTTP connection manager] +// HTTP connection manager for use in Envoy mobile. +// [#extension: envoy.filters.network.envoy_mobile_http_connection_manager] +message EnvoyMobileHttpConnectionManager { + // The configuration for the underlying HttpConnectionManager which will be + // instantiated for Envoy mobile. + HttpConnectionManager config = 1; +} diff --git a/modules/sync/envoyproxy/envoy/cas/8789f8a8766b74d0084215b44531f7583fab7d7fda35d1e18d3ea5f9315b3ecb4c0e817d3acc110d0891cfe01ce4b2ab27fd18b9fe63a78beefa95a9918fad04 b/modules/sync/envoyproxy/envoy/cas/8789f8a8766b74d0084215b44531f7583fab7d7fda35d1e18d3ea5f9315b3ecb4c0e817d3acc110d0891cfe01ce4b2ab27fd18b9fe63a78beefa95a9918fad04 new file mode 100644 index 00000000..4b692cf9 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/8789f8a8766b74d0084215b44531f7583fab7d7fda35d1e18d3ea5f9315b3ecb4c0e817d3acc110d0891cfe01ce4b2ab27fd18b9fe63a78beefa95a9918fad04 @@ -0,0 +1,525 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.oauth2.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/http_uri.proto"; +import "envoy/config/route/v3/route_components.proto"; +import "envoy/extensions/transport_sockets/tls/v3/secret.proto"; +import "envoy/type/matcher/v3/path.proto"; + +import "google/protobuf/duration.proto"; +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.oauth2.v3"; +option java_outer_classname = "OauthProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/oauth2/v3;oauth2v3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: OAuth] +// OAuth :ref:`configuration overview `. +// [#extension: envoy.filters.http.oauth2] +// + +// OAuth cookie configuration attributes. +// +message CookieConfig { + enum SameSite { + DISABLED = 0; + STRICT = 1; + LAX = 2; + NONE = 3; + } + + // The value used for the SameSite cookie attribute. + SameSite same_site = 1 [(validate.rules).enum = {defined_only: true}]; + + // The path attribute for the cookie. + // + // This controls the scope of the cookie and is useful for path-based routing scenarios + // where different logical boundaries or applications may operate with different OAuth2 clients. + // The CSRF cookie (nonce cookie) can be configured with a different path than session cookies + // to support flows where the callback URL is on a different path. + // + // If not specified, defaults to ``/``. + string path = 2 [(validate.rules).string = {pattern: "^$|^/[^\\x00-\\x1f\\x7f \",;<>\\\\]*$"}]; + + // If true, the ``Partitioned`` attribute will be set on the cookie. + // + // Modern browsers (Firefox, Chrome with third-party cookie deprecation) warn or block + // "foreign" cookies unless they carry the ``Partitioned`` attribute alongside ``SameSite=None; Secure``. + // When Envoy is used in a gateway/IdP flow that sets OAuth/OIDC cookies for a parent domain + // (e.g., ``Domain=.example.com``) while running on a different host, those cookies are + // considered third-party and will be rejected without ``Partitioned``. + // + // See `CHIPS `_ for more information. + // + // Default is false. + bool partitioned = 3; +} + +// [#next-free-field: 8] +message CookieConfigs { + // Configuration for the bearer token cookie. + CookieConfig bearer_token_cookie_config = 1; + + // Configuration for the OAuth HMAC cookie. + CookieConfig oauth_hmac_cookie_config = 2; + + // Configuration for the OAuth expires cookie. + CookieConfig oauth_expires_cookie_config = 3; + + // Configuration for the ID token cookie. + CookieConfig id_token_cookie_config = 4; + + // Configuration for the refresh token cookie. + CookieConfig refresh_token_cookie_config = 5; + + // Configuration for the OAuth nonce cookie. + CookieConfig oauth_nonce_cookie_config = 6; + + // Configuration for the code verifier cookie. + CookieConfig code_verifier_cookie_config = 7; +} + +// [#next-free-field: 6] +message OAuth2Credentials { + // [#next-free-field: 8] + message CookieNames { + // Cookie name to hold OAuth bearer token value. When the authentication server validates the + // client and returns an authorization token back to the OAuth filter, no matter what format + // that token is, if :ref:`forward_bearer_token ` + // is set to true the filter will send over the bearer token as a cookie with this name to the + // upstream. Defaults to ``BearerToken``. + string bearer_token = 1 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME ignore_empty: true}]; + + // Cookie name to hold OAuth HMAC value. Defaults to ``OauthHMAC``. + string oauth_hmac = 2 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME ignore_empty: true}]; + + // Cookie name to hold OAuth expiry value. Defaults to ``OauthExpires``. + string oauth_expires = 3 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME ignore_empty: true}]; + + // Cookie name to hold the id token. Defaults to ``IdToken``. + string id_token = 4 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME ignore_empty: true}]; + + // Cookie name to hold the refresh token. Defaults to ``RefreshToken``. + string refresh_token = 5 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME ignore_empty: true}]; + + // Cookie name to hold the nonce value. Defaults to ``OauthNonce``. + string oauth_nonce = 6 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME ignore_empty: true}]; + + // Cookie name to hold the PKCE code verifier. Defaults to ``OauthCodeVerifier``. + string code_verifier = 7 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME ignore_empty: true}]; + } + + // The client_id to be used in the authorize calls. This value will be URL encoded when sent to the OAuth server. + string client_id = 1 [(validate.rules).string = {min_len: 1}]; + + // The secret used to retrieve the access token. This value will be URL encoded when sent to the OAuth server. + // This field is required unless :ref:`auth_type ` + // is set to ``TLS_CLIENT_AUTH``, in which case authentication is done via the client certificate. + // When ``auth_type`` is ``PRIVATE_KEY_JWT``, this field must contain the PEM-encoded private key + // used to sign the JWT client assertion. The key may be supplied in either of two forms: + // + // * As a single-value generic secret holding the PEM-encoded private key. No ``kid`` header + // parameter is included in the client assertion. + // * As a multi-entry generic secret with a ``private_key`` entry holding the PEM-encoded private + // key and an optional ``key_id`` entry. When present, the ``key_id`` value is set as the + // ``kid`` header parameter of the client assertion, per + // `RFC 7515 Section 4.1.4 `_. + // Identity providers use it to select the correct verification key when more than one key is + // registered for the client. Distributing both in one secret means the key ID is always + // rotated together with the key it identifies. + // + // The multi-entry form is only read when ``auth_type`` is ``PRIVATE_KEY_JWT``. The other auth + // types read the single-value form only. + transport_sockets.tls.v3.SdsSecretConfig token_secret = 2; + + // Configures how the secret token should be created. + oneof token_formation { + option (validate.required) = true; + + // If present, the secret token will be a HMAC using the provided secret. + transport_sockets.tls.v3.SdsSecretConfig hmac_secret = 3 + [(validate.rules).message = {required: true}]; + } + + // The cookie names used in OAuth filters flow. + CookieNames cookie_names = 4; + + // The domain to set the cookie on. If not set, the cookie will default to the host of the request, not including the subdomains. + // This is useful when token cookies need to be shared across multiple subdomains. + string cookie_domain = 5 + [(validate.rules).string = {pattern: "^$|^[^\\x00-\\x1f\\x7f \",;<>\\\\]+$"}]; +} + +// Configuration for ``PRIVATE_KEY_JWT`` client authentication (RFC 7523). +message PrivateKeyJwtConfig { + // Supported JWT signing algorithms for the client assertion. + enum SigningAlgorithm { + // ``RSASSA-PKCS1-v1_5`` using SHA-256. + RS256 = 0; + + // ``RSASSA-PKCS1-v1_5`` using SHA-384. + RS384 = 1; + + // ``RSASSA-PKCS1-v1_5`` using SHA-512. + RS512 = 2; + + // ECDSA using P-256 and SHA-256. + ES256 = 3; + + // ECDSA using P-384 and SHA-384. + ES384 = 4; + + // ECDSA using P-521 and SHA-512. + ES512 = 5; + } + + // The signing algorithm to use for the JWT assertion. + // The private key provided in ``token_secret`` must match the algorithm family: an RSA key for + // the ``RS*`` algorithms, or an EC key for the ``ES*`` algorithms. + // Default: ``RS256``. + SigningAlgorithm signing_algorithm = 1 [(validate.rules).enum = {defined_only: true}]; + + // The lifetime of the JWT assertion. After this duration, the assertion expires. + // The value is truncated to whole seconds, so it must be at least ``1s`` when set. + // Default: ``60s``. + google.protobuf.Duration assertion_lifetime = 2 [(validate.rules).duration = {gte {seconds: 1}}]; + + // The value to use as the ``aud`` (audience) claim in the JWT client assertion. + // + // `RFC 7523 Section 3 `_ requires the + // ``aud`` claim to identify the authorization server, and allows the token endpoint URL to be + // used for this purpose. + // `RFC 9126 Section 2.1 `_ recommends + // the authorization server's issuer identifier instead, and + // `FAPI 2.0 `_ requires it, as a + // single canonical value identifies the server regardless of which endpoint receives the + // assertion. + // + // If not set, defaults to the configured ``token_endpoint`` URI. + string assertion_audience = 3; +} + +// Defines how an OAuth token is forwarded upstream. +message OAuth2TokenForwarding { + // The upstream request header that will carry the token. + // Pseudo-headers (names starting with ``:``) and the ``Host`` header are not allowed. + string header = 1 + [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}]; +} + +// Configuration for the ``post_logout_redirect_uri`` parameter used in OpenID Connect +// `RP-Initiated Logout requests `_. +// This configuration is ignored if ``end_session_endpoint`` is not set. +message PostLogoutRedirectUri { + oneof config { + option (validate.required) = true; + + // Do not include the ``post_logout_redirect_uri`` parameter in requests to the + // configured ``end_session_endpoint``. + bool disabled = 1 [(validate.rules).bool = {const: true}]; + + // URI to send as the ``post_logout_redirect_uri`` parameter. Supports header formatting + // tokens, and will be percent-encoded automatically when building the logout URL. + // + // The URI should be registered with the authorization server. + string uri = 2 [(validate.rules).string = {min_len: 1}]; + } +} + +// Splits OAuth token cookies that are too large for a browser to store. +// +// A token that fits in one cookie is written as a single cookie, as without chunking. A larger +// token is written as ``_0`` to ``_N-1``, plus a ``_chunks`` cookie that holds +// the count ``N``. If a token needs more than +// :ref:`max_chunks ` +// cookies, the filter responds with ``503`` instead of setting cookies that the client would drop. +// +// Chunked cookies add to the request header size. A session with more than one large token may +// need a larger :ref:`max_request_headers_kb +// `. +message TokenCookieChunking { + // The largest cookie Envoy writes for a token, counting its name, value and attributes. A token + // whose cookie would be larger is split. Defaults to ``4096``, the limit browsers enforce. + google.protobuf.UInt32Value max_cookie_size = 1 [(validate.rules).uint32 = {lte: 4096 gte: 512}]; + + // The most cookies a single token is split into. Defaults to ``8``. + // + // Envoy rejoins up to 16 chunks on requests regardless of this value, so lowering it does not + // invalidate existing sessions. + google.protobuf.UInt32Value max_chunks = 2 [(validate.rules).uint32 = {lte: 16 gte: 2}]; +} + +// OAuth config +// +// [#next-free-field: 35] +message OAuth2Config { + enum AuthType { + // The ``client_id`` and ``client_secret`` will be sent in the URL encoded request body. + // This type should only be used when Auth server does not support Basic authentication. + URL_ENCODED_BODY = 0; + + // The ``client_id`` and ``client_secret`` will be sent using HTTP Basic authentication scheme. + BASIC_AUTH = 1; + + // The client will be authenticated using mutual TLS (mTLS) with a client certificate. + // The ``client_secret`` is not required and will not be sent in the request to the + // authorization server. + // The client certificate must be configured in the cluster used by ``token_endpoint`` via + // transport socket configuration. + // This implements OAuth 2.0 Mutual-TLS Client Authentication as defined in RFC 8705. + TLS_CLIENT_AUTH = 2; + + // The client authenticates using a signed JWT assertion (RFC 7523). + // The ``token_secret`` in credentials must contain the PEM-encoded private key used to sign the assertion. + // The JWT assertion is sent as ``client_assertion`` in the token request body along with + // ``client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer``. + PRIVATE_KEY_JWT = 3; + } + + // Endpoint on the authorization server to retrieve the access token from. + config.core.v3.HttpUri token_endpoint = 1; + + // Specifies the retry policy for requests to the OAuth server. If not specified, then no retries will be performed. + config.core.v3.RetryPolicy retry_policy = 18; + + // The endpoint redirect to for authorization in response to unauthorized requests. + string authorization_endpoint = 2 [(validate.rules).string = {min_len: 1}]; + + // The endpoint at the authorization server to request the user be logged out of the Authorization server. + // This field is optional and should be set only if openid is in the auth_scopes and the authorization server + // supports the OpenID Connect RP-Initiated Logout specification. + // For more information, see https://openid.net/specs/openid-connect-rpinitiated-1_0.html + // + // If configured, the OAuth2 filter will redirect users to this endpoint when they access the signout_path. + string end_session_endpoint = 23; + + // Optional control for the ``post_logout_redirect_uri`` parameter sent to the ``end_session_endpoint`` when a user + // accesses the ``signout_path``. + // This field should be set only if ``openid`` is in the ``auth_scopes``, the ``end_session_endpoint`` is configured, + // and the authorization server supports the OpenID Connect RP-Initiated Logout specification. + // + // If unset, Envoy preserves the historical behavior and sends ``:///``, constructed from the inbound + // request, as ``post_logout_redirect_uri``. + PostLogoutRedirectUri post_logout_redirect_uri = 33; + + // Credentials used for OAuth. + OAuth2Credentials credentials = 3 [(validate.rules).message = {required: true}]; + + // The redirect URI passed to the authorization endpoint. Supports header formatting + // tokens. For more information, including details on header value syntax, see the + // documentation on :ref:`custom request headers `. + // + // This URI should not contain any query parameters. + string redirect_uri = 4 [(validate.rules).string = {min_len: 1}]; + + // Matching criteria used to determine whether a path appears to be the result of a redirect from the authorization server. + type.matcher.v3.PathMatcher redirect_path_matcher = 5 + [(validate.rules).message = {required: true}]; + + // The path to sign a user out, clearing their credential cookies. + type.matcher.v3.PathMatcher signout_path = 6 [(validate.rules).message = {required: true}]; + + // Forward the OAuth token as a Bearer to upstream web service. + bool forward_bearer_token = 7; + + // Forward the OIDC ID token to the upstream. + // + // If the configured header is ``Authorization``, Envoy forwards the ID token using the + // ``Bearer`` prefix. For any other header, Envoy forwards the raw token value. + // If not specified, the ID token will not be forwarded. + // + // This can not be configured with :ref:`forward_bearer_token + // ` + // or :ref:`preserve_authorization_header + // ` + // when the header is ``Authorization``. + OAuth2TokenForwarding forward_id_token = 31; + + // If set to true, preserve the existing authorization header. + // By default the client strips the existing authorization header before forwarding upstream. + // Can not be set to true if forward_bearer_token is already set to true. + // Default value is false. + bool preserve_authorization_header = 16; + + // Any request that matches any of the provided matchers will be passed through without OAuth validation. + repeated config.route.v3.HeaderMatcher pass_through_matcher = 8; + + // Optional list of OAuth scopes to be claimed in the authorization request. If not specified, + // defaults to "user" scope. + // OAuth RFC https://tools.ietf.org/html/rfc6749#section-3.3 + repeated string auth_scopes = 9; + + // Optional resource parameter for authorization request + // RFC: https://tools.ietf.org/html/rfc8707 + repeated string resources = 10; + + // Defines how ``client_id`` and ``client_secret`` are sent in OAuth client to OAuth server requests. + // RFC https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1 + AuthType auth_type = 11 [(validate.rules).enum = {defined_only: true}]; + + // If set to true, allows automatic access token refresh using the associated refresh token (see + // `RFC 6749 section 6 `_), provided that the OAuth server supports that. + // Default value is true. + google.protobuf.BoolValue use_refresh_token = 12; + + // The default lifetime in seconds of the access token, if omitted by the authorization server. + // + // If this value is not set, it will default to ``0s``. In this case, the expiry must be set by + // the authorization server or the OAuth flow will fail. + google.protobuf.Duration default_expires_in = 13; + + // Any request that matches any of the provided matchers won't be redirected to OAuth server when tokens are not valid. + // Automatic access token refresh will be performed for these requests, if enabled. + // This behavior can be useful for AJAX requests. + repeated config.route.v3.HeaderMatcher deny_redirect_matcher = 14; + + // The default lifetime in seconds of the refresh token, if the exp (expiration time) claim is omitted in the refresh token or the refresh token is not JWT. + // + // If this value is not set, it will default to ``604800s``. In this case, the cookie with the refresh token will be expired + // in a week. + // This setting is only considered if ``use_refresh_token`` is set to true, otherwise the authorization server expiration or ``default_expires_in`` is used. + google.protobuf.Duration default_refresh_token_expires_in = 15; + + // If set to true, the client will not set a cookie for ID Token even if one is received from the Identity Provider. This may be useful in cases where the ID + // Token is too large for HTTP cookies (longer than 4096 characters). Enabling this option will only disable setting the cookie response header, the filter + // will still process incoming ID Tokens as part of the HMAC if they are there. This is to ensure compatibility while switching this setting on. Future + // sessions would not set the IdToken cookie header. + bool disable_id_token_set_cookie = 17; + + // If set to true, the client will not set a cookie for Access Token even if one is received from the Identity Provider. + // Enabling this option will only disable setting the cookie response header, the filter + // will still process incoming Access Tokens as part of the HMAC if they are there. This is to ensure compatibility while switching this setting on. Future + // sessions would not set the Access Token cookie header. + bool disable_access_token_set_cookie = 19; + + // If set to true, the client will not set a cookie for Refresh Token even if one is received from the Identity Provider. + // Enabling this option will only disable setting the cookie response header, the filter + // will still process incoming Refresh Tokens as part of the HMAC if they are there. This is to ensure compatibility while switching this setting on. Future + // sessions would not set the Refresh Token cookie header. + bool disable_refresh_token_set_cookie = 20; + + // Controls for attributes that can be set on the cookies. + CookieConfigs cookie_configs = 21; + + // Optional additional prefix to use when emitting statistics. + string stat_prefix = 22; + + // Optional expiration time for the CSRF protection token cookie. + // The CSRF token prevents cross-site request forgery attacks during the OAuth2 flow. + // If not specified, defaults to ``600s`` (10 minutes), which should provide sufficient time + // for users to complete the OAuth2 authorization flow. + google.protobuf.Duration csrf_token_expires_in = 24; + + // Optional expiration time for the code verifier cookie. + // The code verifier is stored in a secure, HTTP-only cookie during the OAuth2 authorization process. + // If not specified, defaults to ``600s`` (10 minutes), which should provide sufficient time + // for users to complete the OAuth2 authorization flow. + google.protobuf.Duration code_verifier_token_expires_in = 25; + + // Disable token encryption. When set to true, both the access token and the ID token will be stored in plain text. + // This option should only be used in secure environments where token encryption is not required. + // Default is false (tokens are encrypted). + bool disable_token_encryption = 26; + + // Any request that matches any of the provided matchers will be allowed to continue to upstream + // even if OAuth validation fails (missing, invalid, or expired credentials). + // This is useful for services that can handle both authenticated and unauthenticated requests, + // enabling graceful degradation patterns. + // + // When triggered, all OAuth cookies are stripped from the request and the request proceeds as unauthenticated. + // Context headers ``x-envoy-oauth-status: failed`` and ``x-envoy-oauth-failure-reason`` are added to inform upstream. + // + // Note: If a request matches pass_through_matcher, it bypasses OAuth validation and this matcher won't be evaluated. + // This matcher takes precedence over deny_redirect_matcher. + repeated config.route.v3.HeaderMatcher allow_failed_matcher = 27; + + // Optional base URI (scheme + host, e.g. ``https://app.example.com``) used to build the + // original request URI that is encoded into the OAuth2 ``state`` parameter. + // This URI will be used later to redirect users on a successful OAuth. + // + // This is useful when Envoy sits behind a gateway or load balancer that terminates the + // user-facing hostname: In that case, the post-authentication redirect derived from ``state`` would + // send the user to an internal host they didn't request. + // + // Supports request header formatting tokens. + // + // Example: + // + // original_request_uri: "%REQ(x-forwarded-proto?:scheme)%://%REQ(x-forwarded-host?:authority)%" + // + // If not set, defaults to ``<:scheme>://<:authority>`` of the incoming request. + string original_request_uri = 28; + + // Optional list of domains that are allowed as + // 1. redirect_uri: which is what the IdP calls after OAuth + // 2. original_request_uri: the one extracted from the state of an OAuth callback (where should the request go after OAuth) + // + // This mitigates: + // - injecting a malicious x-forwarded-host or any header that is used to template the redirect urls + // - open redirect attacks where an attacker crafts a ``state`` value pointing to an untrusted host. + // + // Each entry is matched against the host (with any port stripped) extracted from the + // formatted ``redirect_uri``, the formatted ``original_request_uri``, and the URL decoded from + // the ``state`` parameter on callback. Matching is case-insensitive and supports two forms: + // + // * Exact match, e.g. ``example.com`` matches only ``example.com``. + // * Wildcard subdomain match using a leading ``*.``, e.g. ``*.example.com`` matches + // ``foo.example.com`` and ``bar.baz.example.com`` but not ``example.com`` itself. + // + // IPv6 literals must be configured without surrounding brackets (e.g. ``::1``, not ``[::1]``). + // + // If this list is empty (the default), all hosts are allowed and no validation is performed. + repeated string allowed_redirect_domains = 29; + + // If set to true, the expiration time for the ID token cookie will always be derived from the + // ``expires_in`` field of the access token response rather than from the ``exp`` claim in the + // ID token JWT. This is useful when the access token response advertises a longer lifetime than + // the ID token and you want the ID token cookie to remain valid for that full duration. + // Default is false (use the ID token's own ``exp`` claim when available). + bool use_access_token_expiry_for_id_token_cookie = 30; + + // Configuration for ``PRIVATE_KEY_JWT`` client authentication. + // Only used when :ref:`auth_type ` + // is set to ``PRIVATE_KEY_JWT``. + PrivateKeyJwtConfig private_key_jwt_config = 32; + + // If set, an access, ID or refresh token cookie that is larger than + // :ref:`max_cookie_size ` + // is split across multiple cookies. If not set, every token is written as a single cookie, + // which a browser drops when it is larger than 4096 bytes. + // + // Envoy always rejoins chunked token cookies on requests, whether or not this is set, so it can + // be removed safely. In a rolling upgrade, set it only after every Envoy that may serve the same + // client understands chunked cookies. + TokenCookieChunking token_cookie_chunking = 34; +} + +// Per-route OAuth2 config. +// +// This message supplies an OAuth2Config for the matched route. +// It overrides the filter-level config for requests matching the route. +// If neither the global config nor a per-route config is specified, OAuth2 is disabled for the route. +message OAuth2PerRoute { + // Full OAuth2 config for this route. + OAuth2Config config = 1 [(validate.rules).message = {required: true}]; +} + +// Filter config. +message OAuth2 { + // The OAuth2 filter config. + OAuth2Config config = 1; +} diff --git a/modules/sync/envoyproxy/envoy/cas/87e31fc241a567421582a7a3c738c6e6e98b1bc47d59881d2d16274e437565af2aa4831a2248ba3c4fa6380e25a43bde5d2bdb7953140524e4ce00c724827bcf b/modules/sync/envoyproxy/envoy/cas/87e31fc241a567421582a7a3c738c6e6e98b1bc47d59881d2d16274e437565af2aa4831a2248ba3c4fa6380e25a43bde5d2bdb7953140524e4ce00c724827bcf new file mode 100644 index 00000000..1538d0ca --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/87e31fc241a567421582a7a3c738c6e6e98b1bc47d59881d2d16274e437565af2aa4831a2248ba3c4fa6380e25a43bde5d2bdb7953140524e4ce00c724827bcf @@ -0,0 +1,102 @@ +syntax = "proto3"; + +package envoy.extensions.http.injected_credentials.oauth2.v3; + +import "envoy/config/core/v3/http_uri.proto"; +import "envoy/extensions/transport_sockets/tls/v3/secret.proto"; + +import "google/protobuf/duration.proto"; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.http.injected_credentials.oauth2.v3"; +option java_outer_classname = "Oauth2Proto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/http/injected_credentials/oauth2/v3;oauth2v3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: OAuth2 Credential] +// [#extension: envoy.http.injected_credentials.oauth2] + +// OAuth2 extension can be used to retrieve an OAuth2 access token from an authorization server and inject it into the +// proxied requests. +// Currently, only the Client Credentials Grant flow is supported. +// The access token will be injected into the request headers using the ``Authorization`` header as a bearer token. +// [#next-free-field: 6] +message OAuth2 { + enum AuthType { + // The ``client_id`` and ``client_secret`` will be sent using HTTP Basic authentication scheme. + BASIC_AUTH = 0; + + // The ``client_id`` and ``client_secret`` will be sent in the URL encoded request body. + // This type should only be used when Auth server does not support Basic authentication. + URL_ENCODED_BODY = 1; + + // The client will be authenticated using mutual TLS (mTLS) with a client certificate. + // The ``client_secret`` is not required and will not be sent in the request to the + // authorization server. + // The client certificate must be configured in the cluster used by ``token_endpoint`` via + // transport socket configuration. + // This implements OAuth 2.0 Mutual-TLS Client Authentication as defined in RFC 8705. + TLS_CLIENT_AUTH = 2; + } + + // Credentials to authenticate client to the authorization server. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework `__ for details. + message ClientCredentials { + // Client ID. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework `__ for details. + string client_id = 1 [(validate.rules).string = {min_len: 1}]; + + // Client secret. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework `__ for details. + // This field is required unless :ref:`auth_type + // ` + // is set to ``TLS_CLIENT_AUTH``, in which case authentication is done via the client certificate. + transport_sockets.tls.v3.SdsSecretConfig client_secret = 2; + + // The method to use when sending credentials to the authorization server. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework `__ for details. + AuthType auth_type = 3; + } + + // Optional additional parameters to include in the token endpoint request body. + // These parameters will be URL-encoded and added to the request body along with the standard OAuth2 parameters. + // Refer to your authorization server's documentation for supported parameters. + message EndpointParameter { + // Parameter name. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // Parameter value. + string value = 2; + } + + // Endpoint on the authorization server to retrieve the access token from. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework `__ for details. + config.core.v3.HttpUri token_endpoint = 1 [(validate.rules).message = {required: true}]; + + // Optional list of OAuth scopes to be claimed in the authorization request. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework `__ for details. + repeated string scopes = 2; + + oneof flow_type { + option (validate.required) = true; + + // Client Credentials Grant. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework `__ for details. + ClientCredentials client_credentials = 3; + } + + // The interval between two successive retries to fetch token from Identity Provider. Default is 2 secs. + // The interval must be at least 1 second. + google.protobuf.Duration token_fetch_retry_interval = 4 + [(validate.rules).duration = {gte {seconds: 1}}]; + + // Optional list of additional parameters to send to the token endpoint. + // These parameters will be URL-encoded and included in the token request body. + repeated EndpointParameter endpoint_params = 5; +} diff --git a/modules/sync/envoyproxy/envoy/cas/96159f447b11ba1cb7714a394691f6b296ecb1dd5a152290d8f63d5a95a169debb3bb7a426a8b2c2d5048c64df212c9dd65840cee0c0f0f9e83d162f22fba15d b/modules/sync/envoyproxy/envoy/cas/96159f447b11ba1cb7714a394691f6b296ecb1dd5a152290d8f63d5a95a169debb3bb7a426a8b2c2d5048c64df212c9dd65840cee0c0f0f9e83d162f22fba15d new file mode 100644 index 00000000..3b11d536 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/96159f447b11ba1cb7714a394691f6b296ecb1dd5a152290d8f63d5a95a169debb3bb7a426a8b2c2d5048c64df212c9dd65840cee0c0f0f9e83d162f22fba15d @@ -0,0 +1,105 @@ +syntax = "proto3"; + +package envoy.extensions.filters.common.jwks.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/http_uri.proto"; + +import "google/protobuf/duration.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.common.jwks.v3"; +option java_outer_classname = "JwksProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/common/jwks/v3;jwksv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Common JWKS fetch] +// Configuration for fetching a JSON Web Key Set (JWKS) from a remote HTTP server and caching it, +// shared by extensions that need remote JWKS. + +// This message specifies how to fetch JWKS from remote and how to cache it. +message RemoteJwks { + // The HTTP URI to fetch the JWKS. For example: + // + // .. code-block:: yaml + // + // http_uri: + // uri: https://www.googleapis.com/oauth2/v1/certs + // cluster: jwt.www.googleapis.com|443 + // timeout: 1s + // + config.core.v3.HttpUri http_uri = 1 [(validate.rules).message = {required: true}]; + + // Duration after which the cached JWKS should be expired. If not specified, default cache + // duration is 10 minutes. + google.protobuf.Duration cache_duration = 2 [(validate.rules).duration = { + lt {seconds: 9000000000} + gte {nanos: 1000000} + }]; + + // Fetch Jwks asynchronously in the main thread before the listener is activated. + // Fetched Jwks can be used by all worker threads. + // + // If this feature is not enabled: + // + // * The Jwks is fetched on-demand when the requests come. During the fetching, first + // few requests are paused until the Jwks is fetched. + // * Each worker thread fetches its own Jwks since Jwks cache is per worker thread. + // + // If this feature is enabled: + // + // * Fetched Jwks is done in the main thread before the listener is activated. Its fetched + // Jwks can be used by all worker threads. Each worker thread doesn't need to fetch its own. + // * Jwks is ready when the requests come, not need to wait for the Jwks fetching. + // + JwksAsyncFetch async_fetch = 3; + + // Retry policy for fetching Jwks. optional. turned off by default. + // + // For example: + // + // .. code-block:: yaml + // + // retry_policy: + // retry_back_off: + // base_interval: 0.01s + // max_interval: 20s + // num_retries: 10 + // + // will yield a randomized truncated exponential backoff policy with an initial delay of 10ms + // 10 maximum attempts spaced at most 20s seconds. + // + // .. code-block:: yaml + // + // retry_policy: + // num_retries:1 + // + // uses the default :ref:`retry backoff strategy `. + // with the default base interval is 1000 milliseconds. and the default maximum interval of 10 times the base interval. + // + // if num_retries is omitted, the default is to allow only one retry. + // + // + // If enabled, the retry policy will apply to all Jwks fetching approaches, e.g. on demand or asynchronously in background. + // + // + config.core.v3.RetryPolicy retry_policy = 4; +} + +// Fetch Jwks asynchronously in the main thread when the filter config is parsed. +// The listener is activated only after the Jwks is fetched. +// When the Jwks is expired in the cache, it is fetched again in the main thread. +// The fetched Jwks from the main thread can be used by all worker threads. +message JwksAsyncFetch { + // If false, the listener is activated after the initial fetch is completed. + // The initial fetch result can be either successful or failed. + // If true, it is activated without waiting for the initial fetch to complete. + // Default is false. + bool fast_listener = 1; + + // The duration to refetch after a failed fetch. If not specified, default is 1 second. + google.protobuf.Duration failed_refetch_duration = 2; +} diff --git a/modules/sync/envoyproxy/envoy/cas/96b60daf5dde95307b1ceae6ed9607f561179e136ae561122cefaf4ba42624e69f81e59ed7c0c1dfaa68fe4de4795c896f652bac6c73eccce166a0e3ba5d20a8 b/modules/sync/envoyproxy/envoy/cas/96b60daf5dde95307b1ceae6ed9607f561179e136ae561122cefaf4ba42624e69f81e59ed7c0c1dfaa68fe4de4795c896f652bac6c73eccce166a0e3ba5d20a8 new file mode 100644 index 00000000..ec52981a --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/96b60daf5dde95307b1ceae6ed9607f561179e136ae561122cefaf4ba42624e69f81e59ed7c0c1dfaa68fe4de4795c896f652bac6c73eccce166a0e3ba5d20a8 @@ -0,0 +1,163 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.fault.v3; + +import "envoy/config/route/v3/route_components.proto"; +import "envoy/extensions/filters/common/fault/v3/fault.proto"; +import "envoy/type/v3/percent.proto"; + +import "google/protobuf/struct.proto"; +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.fault.v3"; +option java_outer_classname = "FaultProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/fault/v3;faultv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Fault Injection] +// Fault Injection :ref:`configuration overview `. +// [#extension: envoy.filters.http.fault] + +// [#next-free-field: 7] +message FaultAbort { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.fault.v2.FaultAbort"; + + // Fault aborts are controlled via an HTTP header (if applicable). See the + // :ref:`HTTP fault filter ` documentation for + // more information. + message HeaderAbort { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.fault.v2.FaultAbort.HeaderAbort"; + } + + reserved 1; + + oneof error_type { + option (validate.required) = true; + + // HTTP status code to use to abort the HTTP request. + uint32 http_status = 2 [(validate.rules).uint32 = {lt: 600 gte: 200}]; + + // gRPC status code to use to abort the gRPC request. + uint32 grpc_status = 5; + + // Fault aborts are controlled via an HTTP header (if applicable). + HeaderAbort header_abort = 4; + } + + // The percentage of requests/operations/connections that will be aborted with the error code + // provided. + type.v3.FractionalPercent percentage = 3; + + // The response body to be returned when aborting the request. + // If not specified, defaults to "fault filter abort". + string response_body = 6; +} + +// [#next-free-field: 17] +message HTTPFault { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.fault.v2.HTTPFault"; + + // If specified, the filter will inject delays based on the values in the + // object. + common.fault.v3.FaultDelay delay = 1; + + // If specified, the filter will abort requests based on the values in + // the object. At least ``abort`` or ``delay`` must be specified. + FaultAbort abort = 2; + + // Specifies the name of the (destination) upstream cluster that the + // filter should match on. Fault injection will be restricted to requests + // bound to the specific upstream cluster. + string upstream_cluster = 3; + + // Specifies a set of headers that the filter should match on. The fault + // injection filter can be applied selectively to requests that match a set of + // headers specified in the fault filter config. The chances of actual fault + // injection further depend on the value of the :ref:`percentage + // ` field. + // The filter will check the request's headers against all the specified + // headers in the filter config. A match will happen if all the headers in the + // config are present in the request with the same values (or based on + // presence if the ``value`` field is not in the config). + repeated config.route.v3.HeaderMatcher headers = 4; + + // Faults are injected for the specified list of downstream hosts. If this + // setting is not set, faults are injected for all downstream nodes. + // Downstream node name is taken from :ref:`the HTTP + // x-envoy-downstream-service-node + // ` header and compared + // against downstream_nodes list. + repeated string downstream_nodes = 5; + + // The maximum number of faults that can be active at a single time via the configured fault + // filter. Note that because this setting can be overridden at the route level, it's possible + // for the number of active faults to be greater than this value (if injected via a different + // route). If not specified, defaults to unlimited. This setting can be overridden via + // ``runtime `` and any faults that are not injected + // due to overflow will be indicated via the ``faults_overflow + // `` stat. + // + // .. attention:: + // Like other :ref:`circuit breakers ` in Envoy, this is a fuzzy + // limit. It's possible for the number of active faults to rise slightly above the configured + // amount due to the implementation details. + google.protobuf.UInt32Value max_active_faults = 6; + + // The response rate limit to be applied to the response body of the stream. When configured, + // the percentage can be overridden by the :ref:`fault.http.rate_limit.response_percent + // ` runtime key. + // + // .. attention:: + // This is a per-stream limit versus a connection level limit. This means that concurrent streams + // will each get an independent limit. + common.fault.v3.FaultRateLimit response_rate_limit = 7; + + // The runtime key to override the :ref:`default ` + // runtime. The default is: fault.http.delay.fixed_delay_percent + string delay_percent_runtime = 8; + + // The runtime key to override the :ref:`default ` + // runtime. The default is: fault.http.abort.abort_percent + string abort_percent_runtime = 9; + + // The runtime key to override the :ref:`default ` + // runtime. The default is: fault.http.delay.fixed_duration_ms + string delay_duration_runtime = 10; + + // The runtime key to override the :ref:`default ` + // runtime. The default is: fault.http.abort.http_status + string abort_http_status_runtime = 11; + + // The runtime key to override the :ref:`default ` + // runtime. The default is: fault.http.max_active_faults + string max_active_faults_runtime = 12; + + // The runtime key to override the :ref:`default ` + // runtime. The default is: fault.http.rate_limit.response_percent + string response_rate_limit_percent_runtime = 13; + + // The runtime key to override the :ref:`default ` + // runtime. The default is: fault.http.abort.grpc_status + string abort_grpc_status_runtime = 14; + + // To control whether stats storage is allocated dynamically for each downstream server. + // If set to true, "x-envoy-downstream-service-cluster" field of header will be ignored by this filter. + // If set to false, dynamic stats storage will be allocated for the downstream cluster name. + // Default value is false. + bool disable_downstream_cluster_stats = 15; + + // When an abort or delay fault is executed, the metadata struct provided here will be added to the + // request's dynamic metadata under the namespace corresponding to the name of the fault filter. + // This data can be logged as part of Access Logs using the :ref:`command operator + // ` %DYNAMIC_METADATA(NAMESPACE)%, where NAMESPACE is the name of + // the fault filter. + google.protobuf.Struct filter_metadata = 16; +} diff --git a/modules/sync/envoyproxy/envoy/cas/9d8dd4e7df146f83d4a9605fe559bbeff256984607cafc46f468c1b226deaf8c93d0dccc4020b3dc6d10c7eac2c409130d2283da044e87b9fcfef706b58507f6 b/modules/sync/envoyproxy/envoy/cas/9d8dd4e7df146f83d4a9605fe559bbeff256984607cafc46f468c1b226deaf8c93d0dccc4020b3dc6d10c7eac2c409130d2283da044e87b9fcfef706b58507f6 new file mode 100644 index 00000000..b00b2e44 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/9d8dd4e7df146f83d4a9605fe559bbeff256984607cafc46f468c1b226deaf8c93d0dccc4020b3dc6d10c7eac2c409130d2283da044e87b9fcfef706b58507f6 @@ -0,0 +1,18 @@ +syntax = "proto3"; + +package envoy.extensions.queue_policy.fifo.v3; + +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.queue_policy.fifo.v3"; +option java_outer_classname = "FifoProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/queue_policy/fifo/v3;fifov3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: FIFO Queue Policy] +// [#extension: envoy.queue_policy.fifo] + +// Configuration for the FIFO pending requests queue policy. +message FifoQueuePolicyConfig { +} diff --git a/modules/sync/envoyproxy/envoy/cas/a3a4044bc25774a45116435a3c732620914ef09f490941d06b6762044aff4c0624177cf96018234ffc8ade813db3ae8a4e83749b72bef469f56903f473fa084d b/modules/sync/envoyproxy/envoy/cas/a3a4044bc25774a45116435a3c732620914ef09f490941d06b6762044aff4c0624177cf96018234ffc8ade813db3ae8a4e83749b72bef469f56903f473fa084d new file mode 100644 index 00000000..f89dca11 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/a3a4044bc25774a45116435a3c732620914ef09f490941d06b6762044aff4c0624177cf96018234ffc8ade813db3ae8a4e83749b72bef469f56903f473fa084d @@ -0,0 +1,150 @@ +syntax = "proto3"; + +package envoy.type.tracing.v3; + +import "envoy/type/metadata/v3/metadata.proto"; + +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.type.tracing.v3"; +option java_outer_classname = "CustomTagProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/type/tracing/v3;tracingv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Custom Tag] + +// Describes custom tags for the active span. +// [#next-free-field: 8] +message CustomTag { + option (udpa.annotations.versioning).previous_message_type = "envoy.type.tracing.v2.CustomTag"; + + // Specifies how the resolved tag value should be typed on tracers that support + // typed span attributes (e.g. OpenTelemetry). The integer and floating-point + // cases are declared explicitly so the emitted attribute type is deterministic + // rather than inferred from the value. + enum ValueType { + // The value type is not set. Behaves like ``STRING``; the distinct default + // value lets consumers tell an unset ``value_type`` apart from an explicit + // ``STRING``. + UNSPECIFIED = 0; + + // Emit the tag value as a string. + STRING = 1; + + // Coerce the resolved tag value to a signed 64-bit integer. Tracers that + // support typed span attributes emit it as a native integer attribute (for + // OpenTelemetry, an OTLP ``int_value``). If the value does not parse as an + // integer, or the tracer has no typed-attribute support, it falls back to a + // string tag. + INT = 2; + + // Coerce the resolved tag value to a double. Tracers that support typed span + // attributes emit it as a native floating-point attribute (for OpenTelemetry, + // an OTLP ``double_value``). If the value does not parse as a double, or the + // tracer has no typed-attribute support, it falls back to a string tag. + DOUBLE = 3; + + // Coerce the resolved tag value to a boolean. Tracers that support typed span + // attributes emit it as a native boolean attribute (for OpenTelemetry, an OTLP + // ``bool_value``). Accepts the usual boolean spellings (``true``/``false``, + // ``1``/``0``, etc.). If the value does not parse as a boolean, or the tracer + // has no typed-attribute support, it falls back to a string tag. + BOOL = 4; + } + + // Literal type custom tag with static value for the tag value. + message Literal { + option (udpa.annotations.versioning).previous_message_type = + "envoy.type.tracing.v2.CustomTag.Literal"; + + // Static literal value to populate the tag value. + string value = 1 [(validate.rules).string = {min_len: 1}]; + } + + // Environment type custom tag with environment name and default value. + message Environment { + option (udpa.annotations.versioning).previous_message_type = + "envoy.type.tracing.v2.CustomTag.Environment"; + + // Environment variable name to obtain the value to populate the tag value. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // When the environment variable is not found, + // the tag value will be populated with this default value if specified, + // otherwise no tag will be populated. + string default_value = 2; + } + + // Header type custom tag with header name and default value. + message Header { + option (udpa.annotations.versioning).previous_message_type = + "envoy.type.tracing.v2.CustomTag.Header"; + + // Header name to obtain the value to populate the tag value. + string name = 1 + [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // When the header does not exist, + // the tag value will be populated with this default value if specified, + // otherwise no tag will be populated. + string default_value = 2; + } + + // Metadata type custom tag using + // :ref:`MetadataKey ` to retrieve the protobuf value + // from :ref:`Metadata `, and populate the tag value with + // `the canonical JSON `_ + // representation of it. + message Metadata { + option (udpa.annotations.versioning).previous_message_type = + "envoy.type.tracing.v2.CustomTag.Metadata"; + + // Specify what kind of metadata to obtain tag value from. + metadata.v3.MetadataKind kind = 1; + + // Metadata key to define the path to retrieve the tag value. + metadata.v3.MetadataKey metadata_key = 2; + + // When no valid metadata is found, + // the tag value would be populated with this default value if specified, + // otherwise no tag would be populated. + string default_value = 3; + } + + // Used to populate the tag name. + string tag = 1 [(validate.rules).string = {min_len: 1}]; + + // Used to specify what kind of custom tag. + oneof type { + option (validate.required) = true; + + // A literal custom tag. + Literal literal = 2; + + // An environment custom tag. + Environment environment = 3; + + // A request header custom tag. + Header request_header = 4; + + // A custom tag to obtain tag value from the metadata. + Metadata metadata = 5; + + // Custom tag value. + // + // The same :ref:`format specifier ` as used for + // :ref:`HTTP access logging ` applies here, however + // unknown specifier values are replaced with the empty string instead of ``-``. + string value = 6; + } + + // The value's type. When unset (``UNSPECIFIED``) or ``STRING`` the tag keeps the + // preexisting string behavior. When set to ``INT``, ``DOUBLE`` or ``BOOL``, tracers + // that support typed span attributes (e.g. OpenTelemetry) emit the tag as an + // integer, floating-point or boolean attribute instead of a string. Applies to + // every custom tag type. + ValueType value_type = 7 [(validate.rules).enum = {defined_only: true}]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/a3abcb3f73ba7ca43e6ea5dc856cf78f13aaf8be73249a42afd62e7d8af953403982600344f0f505cbb732bfe729f93170a3b6073e143c2430503482475682c4 b/modules/sync/envoyproxy/envoy/cas/a3abcb3f73ba7ca43e6ea5dc856cf78f13aaf8be73249a42afd62e7d8af953403982600344f0f505cbb732bfe729f93170a3b6073e143c2430503482475682c4 new file mode 100644 index 00000000..f0a4fece --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/a3abcb3f73ba7ca43e6ea5dc856cf78f13aaf8be73249a42afd62e7d8af953403982600344f0f505cbb732bfe729f93170a3b6073e143c2430503482475682c4 @@ -0,0 +1,72 @@ +syntax = "proto3"; + +package envoy.extensions.tracers.dynamic_modules.v3; + +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.tracers.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/tracers/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Dynamic Modules Tracer] +// [#extension: envoy.tracers.dynamic_modules] + +// Configuration for the Dynamic Modules Tracer. This tracer allows loading shared object +// files via ``dlopen`` to implement custom distributed tracing backends. +// +// A module can be loaded by multiple tracer configurations; the module is loaded only once +// and shared across multiple tracer instances. +// +// The tracer receives trace context from incoming requests and can inject trace context into +// outgoing requests for propagation. It supports the full span lifecycle: creation, tagging, +// logging, child spans, and reporting. +message DynamicModuleTracer { + // Specifies the shared-object level configuration. This field is required. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1 + [(validate.rules).message = {required: true}]; + + // The name for this tracer configuration. If not specified, defaults to an empty string. + // + // This can be used to distinguish between different tracer implementations inside a dynamic + // module. For example, a module can have completely different tracer implementations (e.g., + // Zipkin-compatible, OpenTelemetry-compatible). When Envoy receives this configuration, it + // passes the ``tracer_name`` to the dynamic module's tracer config init function together with + // the ``tracer_config``. That way a module can decide which in-module tracer implementation to + // use based on the name at load time. + string tracer_name = 2; + + // The configuration for the tracer chosen by ``tracer_name``. If not specified, an empty + // configuration is passed to the module. + // + // This is passed to the module's tracer initialization function. Together with the + // ``tracer_name``, the module can decide which in-module tracer implementation to use and + // fine-tune the behavior of the tracer. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly + // without the wrapper. + // + // .. code-block:: yaml + // + // # Passing a JSON struct configuration + // tracer_config: + // "@type": "type.googleapis.com/google.protobuf.Struct" + // value: + // endpoint: "http://tracing-backend:9411/api/v2/spans" + // sample_rate: 0.1 + // + // # Passing a simple string configuration + // tracer_config: + // "@type": "type.googleapis.com/google.protobuf.StringValue" + // value: "http://tracing-backend:9411" + // + google.protobuf.Any tracer_config = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/a981530941912b70abd63742ea0233867d9f8d8b82cff5c37abebbbdb10b21dd3991551fa21eeea1156d73c6cb8e4fc8db3186a620798942cfe59c043b93f986 b/modules/sync/envoyproxy/envoy/cas/a981530941912b70abd63742ea0233867d9f8d8b82cff5c37abebbbdb10b21dd3991551fa21eeea1156d73c6cb8e4fc8db3186a620798942cfe59c043b93f986 new file mode 100644 index 00000000..04b98160 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/a981530941912b70abd63742ea0233867d9f8d8b82cff5c37abebbbdb10b21dd3991551fa21eeea1156d73c6cb8e4fc8db3186a620798942cfe59c043b93f986 @@ -0,0 +1,41 @@ +syntax = "proto3"; + +package envoy.extensions.internal_redirect.filter_state.v3; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.internal_redirect.filter_state.v3"; +option java_outer_classname = "FilterStateConfigProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/internal_redirect/filter_state/v3;filter_statev3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Filter-state internal redirect predicate] + +// An internal redirect predicate that decides whether to follow a redirect by +// reading a boolean filter-state object set earlier in the request by another +// filter (Lua, ext_proc, ``set_filter_state``, a dynamic module, ...). +// +// The predicate reads the filter-state boolean object named ``redirect_enabled_key``: +// +// * If the value is ``true``: follows the redirect +// * If the value is ``false``: does not follow the redirect +// * If the object is absent: ``redirect_if_absent`` decides (default: false) +// +// This lets a request-phase filter decide, per request, whether an +// otherwise-enabled internal redirect is actually taken, without changing route +// matching. Rich, request-time logic (tenant, JWT claim, header, time-of-day, +// rollout %) belongs in the filter that *sets* the boolean value; this predicate +// is a thin reader. +// [#extension: envoy.internal_redirect_predicates.filter_state] +message FilterStateConfig { + // Name of the filter-state boolean object to read. If true, the redirect is + // followed; if false, the redirect is skipped. Must be non-empty. + string redirect_enabled_key = 1 [(validate.rules).string = {min_len: 1}]; + + // Whether to follow the redirect when the filter-state object is absent. + // Defaults to false (do not redirect if the gate wasn't explicitly set), + // giving an opt-in posture. + bool redirect_if_absent = 2; +} diff --git a/modules/sync/envoyproxy/envoy/cas/abb4aa6b05d3254ac7b504949e4a35869e6e7b4f179bf99a3c9c99c02d3abd09271999d73606cd35b752dacef15d7ff9c238e4c34ae29e768e322dddfd2b6c30 b/modules/sync/envoyproxy/envoy/cas/abb4aa6b05d3254ac7b504949e4a35869e6e7b4f179bf99a3c9c99c02d3abd09271999d73606cd35b752dacef15d7ff9c238e4c34ae29e768e322dddfd2b6c30 new file mode 100644 index 00000000..15430453 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/abb4aa6b05d3254ac7b504949e4a35869e6e7b4f179bf99a3c9c99c02d3abd09271999d73606cd35b752dacef15d7ff9c238e4c34ae29e768e322dddfd2b6c30 @@ -0,0 +1,53 @@ +syntax = "proto3"; + +package envoy.extensions.http.ai_filters.transcoder.v3; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.http.ai_filters.transcoder.v3"; +option java_outer_classname = "TranscoderProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/http/ai_filters/transcoder/v3;transcoderv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: Transcoder AI filter] +// Transcoder AI filter :ref:`configuration overview +// `. +// [#extension: envoy.http.ai_filters.transcoder] + +// Rewrites an AI request or response payload from one vendor's API schema into another's, using +// the declarative transcoding engine. +// +// All schemas are translated through a single canonical form -- OpenAI Chat Completions -- so +// that adding a dialect costs one declarative rule set rather than a rule set per pair. Filters +// placed between the two legs therefore only ever need to understand the canonical form. +message Transcoder { + // Which schema translation leg to perform on a given path. + enum Direction { + DIRECTION_UNSPECIFIED = 0; + + // Translates into the canonical IR (OpenAI Chat Completions): + // - In ``request_handling`` (decode): translates client schema -> canonical IR. + // - In ``response_handling`` (encode): translates target backend schema -> canonical IR. + TO_IR = 1; + + // Translates out of the canonical IR (OpenAI Chat Completions): + // - In ``request_handling`` (decode): translates canonical IR -> target backend schema. + // - In ``response_handling`` (encode): translates canonical IR -> client schema. + FROM_IR = 2; + } + + // Request-side transcoding direction. When unset (``DIRECTION_UNSPECIFIED``), the request + // decode path forwards the payload untouched. At least one of ``request_handling`` or + // ``response_handling`` must be set. + Direction request_handling = 1 [(validate.rules).enum = {defined_only: true}]; + + // Response-side transcoding direction. When unset (``DIRECTION_UNSPECIFIED``), response + // transcoding (``encodeUnary`` and ``encodeSSE``) is disabled and responses pass through + // untouched. + Direction response_handling = 2 [(validate.rules).enum = {defined_only: true}]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/ac67a15e46d5a95c672d5692e0ab1aabfc758982b3c2122bbf2c5c7fcede980963690512051adbf9f8ea10cf31833b322b59f91da46520fa94699b1329312f51 b/modules/sync/envoyproxy/envoy/cas/ac67a15e46d5a95c672d5692e0ab1aabfc758982b3c2122bbf2c5c7fcede980963690512051adbf9f8ea10cf31833b322b59f91da46520fa94699b1329312f51 new file mode 100644 index 00000000..b5132bb6 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/ac67a15e46d5a95c672d5692e0ab1aabfc758982b3c2122bbf2c5c7fcede980963690512051adbf9f8ea10cf31833b322b59f91da46520fa94699b1329312f51 @@ -0,0 +1,24 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.body_size_limit.v3; + +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.body_size_limit.v3"; +option java_outer_classname = "BodySizeLimitProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/body_size_limit/v3;body_size_limitv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Body Size Limit] +// Body Size Limit :ref:`configuration overview `. +// [#extension: envoy.filters.http.body_size_limit] + +message BodySizeLimit { + // The maximum request body size allowed. If the request body exceeds this limit, + // the filter will return a 413 response. + google.protobuf.UInt64Value max_request_bytes = 1 [(validate.rules).uint64 = {gt: 0}]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/accdf2d18598af1d1796c3b86c759c3fce8f3a076c354569191f9fb2aff09da01e4ae863006994714383af109df867d87a7a2edfe275996e56a8935da1a77283 b/modules/sync/envoyproxy/envoy/cas/accdf2d18598af1d1796c3b86c759c3fce8f3a076c354569191f9fb2aff09da01e4ae863006994714383af109df867d87a7a2edfe275996e56a8935da1a77283 new file mode 100644 index 00000000..c53c2be3 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/accdf2d18598af1d1796c3b86c759c3fce8f3a076c354569191f9fb2aff09da01e4ae863006994714383af109df867d87a7a2edfe275996e56a8935da1a77283 @@ -0,0 +1,19 @@ +syntax = "proto3"; + +package envoy.type.v3; + +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.type.v3"; +option java_outer_classname = "HttpProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/type/v3;typev3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: HTTP] + +enum CodecClientType { + HTTP1 = 0; + HTTP2 = 1; + HTTP3 = 2; +} diff --git a/modules/sync/envoyproxy/envoy/cas/ad6bd157563e3d6423d240f65e9cd854d643ace1006edf4aad7929d9c6aac05b5f0ed5f380842f3086c217380f79276edfa969ac3e5e502d88fdcb42c6dd82fa b/modules/sync/envoyproxy/envoy/cas/ad6bd157563e3d6423d240f65e9cd854d643ace1006edf4aad7929d9c6aac05b5f0ed5f380842f3086c217380f79276edfa969ac3e5e502d88fdcb42c6dd82fa new file mode 100644 index 00000000..86403e7b --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/ad6bd157563e3d6423d240f65e9cd854d643ace1006edf4aad7929d9c6aac05b5f0ed5f380842f3086c217380f79276edfa969ac3e5e502d88fdcb42c6dd82fa @@ -0,0 +1,31 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.client_cert.v3alpha; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.client_cert.v3alpha"; +option java_outer_classname = "ClientCertProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/contrib/envoy/extensions/filters/http/client_cert/v3alpha"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: Client certificate forwarding (RFC 9440)] +// +// Filter that forwards the downstream mTLS client certificate to the upstream using the +// ``Client-Cert`` and ``Client-Cert-Chain`` HTTP header fields standardized by +// `RFC 9440 `_. Any occurrence of these +// headers in the incoming request is always removed before forwarding, as required by +// RFC 9440 section 2.4. +// [#extension: envoy.filters.http.client_cert] + +message ClientCertConfig { + // If true, the optional ``Client-Cert-Chain`` header is also emitted, containing the + // validated certificate chain of the downstream client certificate (excluding the leaf + // certificate, which is carried by ``Client-Cert``). Disabled by default because the + // header can be large for long certificate chains. + bool set_client_cert_chain = 1; +} diff --git a/modules/sync/envoyproxy/envoy/cas/aed559c90776a842f40524ddcc51368ae77724cfe51c655c10f86868020d01ad1576d110513a45eb0c53cc30b84fa43b0ae590846bae684a288d9667a882975d b/modules/sync/envoyproxy/envoy/cas/aed559c90776a842f40524ddcc51368ae77724cfe51c655c10f86868020d01ad1576d110513a45eb0c53cc30b84fa43b0ae590846bae684a288d9667a882975d new file mode 100644 index 00000000..53f00212 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/aed559c90776a842f40524ddcc51368ae77724cfe51c655c10f86868020d01ad1576d110513a45eb0c53cc30b84fa43b0ae590846bae684a288d9667a882975d @@ -0,0 +1,64 @@ +syntax = "proto3"; + +package envoy.extensions.stat_sinks.dynamic_modules.v3; + +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.stat_sinks.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/stat_sinks/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Dynamic Modules Stats Sink] +// [#extension: envoy.stat_sinks.dynamic_modules] + +// Configuration for the Dynamic Modules Stats Sink. This sink allows loading shared object +// files via ``dlopen`` to implement custom stats sink behavior. +// +// A module can be loaded by multiple stat sinks. It is loaded only once and shared +// across multiple sink instances. +// +// The stats sink receives periodic metric snapshots of counters, gauges, and text readouts, +// and is also called synchronously when histogram observations are recorded. +message DynamicModuleStatsSink { + // Specifies the shared-object level configuration. This field is required. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1 + [(validate.rules).message = {required: true}]; + + // The name for this sink configuration. If not specified, defaults to an empty string. + // + // This can be used to distinguish between different sink implementations inside a dynamic + // module. When Envoy receives this configuration, it passes the ``sink_name`` to the dynamic + // module's sink config init function together with the ``sink_config``. + string sink_name = 2; + + // The configuration for the sink chosen by ``sink_name``. If not specified, an empty + // configuration is passed to the module. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly + // without the wrapper. + // + // .. code-block:: yaml + // + // # Passing a JSON struct configuration + // sink_config: + // "@type": "type.googleapis.com/google.protobuf.Struct" + // value: + // endpoint: "metrics.example.com:9125" + // prefix: "envoy" + // + // # Passing a simple string configuration + // sink_config: + // "@type": "type.googleapis.com/google.protobuf.StringValue" + // value: "metrics.example.com:9125" + // + google.protobuf.Any sink_config = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/b1483b097f119a5da9c7882192543cee4c57eb7a7f4caee285711bea09f6924a210d40c3dc2cfa4aba940d8b2bf2650e9b557b1fea96771edf54e5374387cfe8 b/modules/sync/envoyproxy/envoy/cas/b1483b097f119a5da9c7882192543cee4c57eb7a7f4caee285711bea09f6924a210d40c3dc2cfa4aba940d8b2bf2650e9b557b1fea96771edf54e5374387cfe8 new file mode 100644 index 00000000..b01760ca --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/b1483b097f119a5da9c7882192543cee4c57eb7a7f4caee285711bea09f6924a210d40c3dc2cfa4aba940d8b2bf2650e9b557b1fea96771edf54e5374387cfe8 @@ -0,0 +1,248 @@ +syntax = "proto3"; + +package envoy.config.overload.v3; + +import "envoy/type/v3/percent.proto"; + +import "google/protobuf/any.proto"; +import "google/protobuf/duration.proto"; +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.config.overload.v3"; +option java_outer_classname = "OverloadProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/config/overload/v3;overloadv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Overload Manager] + +// The Overload Manager provides an extensible framework to protect Envoy instances +// from overload of various resources (memory, cpu, file descriptors, etc). +// It monitors a configurable set of resources and notifies registered listeners +// when triggers related to those resources fire. + +message ResourceMonitor { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.overload.v2alpha.ResourceMonitor"; + + reserved 2; + + reserved "config"; + + // The name of the resource monitor to instantiate. Must match a registered + // resource monitor type. + // See the :ref:`extensions listed in typed_config below ` for the default list of available resource monitor. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // Configuration for the resource monitor being instantiated. + // [#extension-category: envoy.resource_monitors] + oneof config_type { + google.protobuf.Any typed_config = 3; + } +} + +message ThresholdTrigger { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.overload.v2alpha.ThresholdTrigger"; + + // If the resource pressure is greater than or equal to this value, the trigger + // will enter saturation. + double value = 1 [(validate.rules).double = {lte: 1.0 gte: 0.0}]; +} + +message ScaledTrigger { + // If the resource pressure is greater than this value, the trigger will be in the + // :ref:`scaling ` state with value + // ``(pressure - scaling_threshold) / (saturation_threshold - scaling_threshold)``. + double scaling_threshold = 1 [(validate.rules).double = {lte: 1.0 gte: 0.0}]; + + // If the resource pressure is greater than this value, the trigger will enter saturation. + double saturation_threshold = 2 [(validate.rules).double = {lte: 1.0 gte: 0.0}]; +} + +message Trigger { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.overload.v2alpha.Trigger"; + + // The name of the resource this is a trigger for. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + oneof trigger_oneof { + option (validate.required) = true; + + ThresholdTrigger threshold = 2; + + ScaledTrigger scaled = 3; + } +} + +// Typed configuration for the "envoy.overload_actions.reduce_timeouts" action. See +// :ref:`the docs ` for an example of how to configure +// the action with different timeouts and minimum values. +message ScaleTimersOverloadActionConfig { + enum TimerType { + // Unsupported value; users must explicitly specify the timer they want scaled. + UNSPECIFIED = 0; + + // Adjusts the idle timer for downstream HTTP connections that takes effect when there are no active streams. + // This affects the value of :ref:`HttpConnectionManager.common_http_protocol_options.idle_timeout + // ` + HTTP_DOWNSTREAM_CONNECTION_IDLE = 1; + + // Adjusts the idle timer for HTTP streams initiated by downstream clients. + // This affects the value of :ref:`RouteAction.idle_timeout ` and + // :ref:`HttpConnectionManager.stream_idle_timeout + // ` + HTTP_DOWNSTREAM_STREAM_IDLE = 2; + + // Adjusts the timer for how long downstream clients have to finish transport-level negotiations + // before the connection is closed. + // This affects the value of + // :ref:`FilterChain.transport_socket_connect_timeout `. + TRANSPORT_SOCKET_CONNECT = 3; + + // Adjusts the max connection duration timer for downstream HTTP connections. + // This affects the value of + // :ref:`HttpConnectionManager.common_http_protocol_options.max_connection_duration + // `. + HTTP_DOWNSTREAM_CONNECTION_MAX = 4; + + // Adjusts the timeout for the downstream codec to flush an ended stream. + // This affects the value of :ref:`RouteAction.flush_timeout + // ` and + // :ref:`HttpConnectionManager.stream_flush_timeout + // ` + HTTP_DOWNSTREAM_STREAM_FLUSH = 5; + } + + message ScaleTimer { + // The type of timer this minimum applies to. + TimerType timer = 1 [(validate.rules).enum = {defined_only: true not_in: 0}]; + + oneof overload_adjust { + option (validate.required) = true; + + // Sets the minimum duration as an absolute value. + google.protobuf.Duration min_timeout = 2; + + // Sets the minimum duration as a percentage of the maximum value. + type.v3.Percent min_scale = 3; + } + } + + // A set of timer scaling rules to be applied. + repeated ScaleTimer timer_scale_factors = 1 [(validate.rules).repeated = {min_items: 1}]; +} + +// Typed configuration for the "envoy.overload_actions.shrink_heap" action. +// See :ref:`the docs ` for an example of how to configure +// this action. +message ShrinkHeapConfig { + // The interval at which shrink heap action checks if memory should be released. + // If not specified, defaults to 10 seconds. + google.protobuf.Duration timer_interval = 1 [(validate.rules).duration = {gte {seconds: 1}}]; + + // Maximum amount of unfreed memory in bytes to keep before releasing memory + // back to the system. This is used as the threshold passed to + // tcmalloc::MallocExtension::ReleaseMemoryToSystem(). + // If not specified, defaults to 104857600 (100MB). + google.protobuf.UInt64Value max_unfreed_memory_bytes = 2; +} + +message OverloadAction { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.overload.v2alpha.OverloadAction"; + + // The action name. Most actions use a well-known string for listener callback registration. + // ``ScaleTimersOverloadActionConfig`` actions may use unique custom names for independently + // triggered ``reduce_timeouts`` instances. Custom names must not use the reserved + // ``envoy.overload_actions.`` prefix. No action name may duplicate a ``LoadShedPoint`` name. + // Valid known overload actions include: + // - envoy.overload_actions.stop_accepting_requests + // - envoy.overload_actions.disable_http_keepalive + // - envoy.overload_actions.stop_accepting_connections + // - envoy.overload_actions.reject_incoming_connections + // - envoy.overload_actions.shrink_heap + // - envoy.overload_actions.reduce_timeouts + // - envoy.overload_actions.reset_high_memory_stream + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // A set of triggers for this action. The state of the action is the maximum + // state of all triggers, which can be scalar values between 0 and 1 or + // saturated. Listeners are notified when the overload action changes state. + // An overload manager action can only have one trigger for a given resource + // e.g. :ref:`Trigger.name + // ` must be unique + // in this list. + repeated Trigger triggers = 2 [(validate.rules).repeated = {min_items: 1}]; + + // Optional implementation configuration. Well-known names identify the action directly; for a + // custom name, this configuration's type identifies it. Currently only + // ``ScaleTimersOverloadActionConfig`` supports custom names, identifying a ``reduce_timeouts`` + // instance. + google.protobuf.Any typed_config = 3; +} + +// A point within the connection or request lifecycle that provides context on +// whether to shed load at that given stage for the current entity at the +// point. +message LoadShedPoint { + // This is just a well-known string for the LoadShedPoint. + // Deployment specific LoadShedPoints e.g. within a custom extension should + // be prefixed by the company / deployment name to avoid colliding with any + // open source LoadShedPoints. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // A set of triggers for this LoadShedPoint. The LoadShedPoint will use the + // the maximum state of all triggers, which can be scalar values between 0 and + // 1 or saturated. A LoadShedPoint can only have one trigger for a given + // resource e.g. :ref:`Trigger.name + // ` must be unique in + // this list. + repeated Trigger triggers = 2 [(validate.rules).repeated = {min_items: 1}]; +} + +// Configuration for which accounts the WatermarkBuffer Factories should +// track. +message BufferFactoryConfig { + // The minimum power of two at which Envoy starts tracking an account. + // + // Envoy has 8 power of two buckets starting with the provided exponent below. + // Concretely the 1st bucket contains accounts for streams that use + // [2^minimum_account_to_track_power_of_two, + // 2^(minimum_account_to_track_power_of_two + 1)) bytes. + // With the 8th bucket tracking accounts + // >= 128 * 2^minimum_account_to_track_power_of_two. + // + // The maximum value is 56, since we're using uint64_t for bytes counting, + // and that's the last value that would use the 8 buckets. In practice, + // we don't expect the proxy to be holding 2^56 bytes. + // + // If omitted, Envoy should not do any tracking. + uint32 minimum_account_to_track_power_of_two = 1 [(validate.rules).uint32 = {lte: 56 gte: 10}]; +} + +// [#next-free-field: 6] +message OverloadManager { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.overload.v2alpha.OverloadManager"; + + // The interval for refreshing resource usage. + google.protobuf.Duration refresh_interval = 1; + + // The set of resources to monitor. + repeated ResourceMonitor resource_monitors = 2 [(validate.rules).repeated = {min_items: 1}]; + + // The set of overload actions. + repeated OverloadAction actions = 3; + + // The set of load shed points. + repeated LoadShedPoint loadshed_points = 5; + + // Configuration for buffer factory. + BufferFactoryConfig buffer_factory_config = 4; +} diff --git a/modules/sync/envoyproxy/envoy/cas/b4d3dec94b64da00d30d0c3a2a001941240da6a0ace1e1fbddcf2f70c155b38827a2e41e09055582d268cffc009dae06def4f39929167c31777e5cfe778d5363 b/modules/sync/envoyproxy/envoy/cas/b4d3dec94b64da00d30d0c3a2a001941240da6a0ace1e1fbddcf2f70c155b38827a2e41e09055582d268cffc009dae06def4f39929167c31777e5cfe778d5363 new file mode 100644 index 00000000..378d74ba --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/b4d3dec94b64da00d30d0c3a2a001941240da6a0ace1e1fbddcf2f70c155b38827a2e41e09055582d268cffc009dae06def4f39929167c31777e5cfe778d5363 @@ -0,0 +1,125 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.adaptive_concurrency.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/type/v3/http_status.proto"; +import "envoy/type/v3/percent.proto"; + +import "google/protobuf/duration.proto"; +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.adaptive_concurrency.v3"; +option java_outer_classname = "AdaptiveConcurrencyProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/adaptive_concurrency/v3;adaptive_concurrencyv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Adaptive Concurrency] +// Adaptive Concurrency Control :ref:`configuration overview +// `. +// [#extension: envoy.filters.http.adaptive_concurrency] + +// Configuration parameters for the gradient controller. +message GradientControllerConfig { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.adaptive_concurrency.v2alpha.GradientControllerConfig"; + + // Parameters controlling the periodic recalculation of the concurrency limit from sampled request + // latencies. + message ConcurrencyLimitCalculationParams { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.adaptive_concurrency.v2alpha.GradientControllerConfig." + "ConcurrencyLimitCalculationParams"; + + // The allowed upper-bound on the calculated concurrency limit. Defaults to 1000. + google.protobuf.UInt32Value max_concurrency_limit = 2 [(validate.rules).uint32 = {gt: 0}]; + + // The period of time samples are taken to recalculate the concurrency limit. + google.protobuf.Duration concurrency_update_interval = 3 [(validate.rules).duration = { + required: true + gt {} + }]; + + // The allowed lower-bound on the calculated concurrency limit. If unset, this defaults to + // :ref:`min_concurrency + // ` + // to preserve the existing behavior where the same value controls both the minimum calculated + // limit and the limit used while measuring minRTT. + google.protobuf.UInt32Value min_concurrency_limit = 4 [(validate.rules).uint32 = {gt: 0}]; + } + + // Parameters controlling the periodic minRTT recalculation. + // [#next-free-field: 7] + message MinimumRTTCalculationParams { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.adaptive_concurrency.v2alpha.GradientControllerConfig." + "MinimumRTTCalculationParams"; + + // The time interval between recalculating the minimum request round-trip time. Has to be + // positive. If set to zero, dynamic sampling of the minRTT is disabled. + google.protobuf.Duration interval = 1 [(validate.rules).duration = {gte {nanos: 1000000}}]; + + // The fixed value for the minRTT. This value is used when minRTT is not sampled dynamically. + // If dynamic sampling of the minRTT is disabled, this field must be set. + google.protobuf.Duration fixed_value = 6 [(validate.rules).duration = {gt {}}]; + + // The number of requests to aggregate/sample during the minRTT recalculation window before + // updating. Defaults to 50. + google.protobuf.UInt32Value request_count = 2 [(validate.rules).uint32 = {gt: 0}]; + + // Randomized time delta that will be introduced to the start of the minRTT calculation window. + // This is represented as a percentage of the interval duration. Defaults to 15%. + // + // Example: If the interval is 10s and the jitter is 15%, the next window will begin + // somewhere in the range (10s - 11.5s). + type.v3.Percent jitter = 3; + + // The concurrency limit set while measuring the minRTT. Defaults to 3. + google.protobuf.UInt32Value min_concurrency = 4 [(validate.rules).uint32 = {gt: 0}]; + + // Amount added to the measured minRTT to add stability to the concurrency limit during natural + // variability in latency. This is expressed as a percentage of the measured value and can be + // adjusted to allow more or less tolerance to the sampled latency values. + // + // Defaults to 25%. + type.v3.Percent buffer = 5; + } + + // The percentile to use when summarizing aggregated samples. Defaults to p50. + type.v3.Percent sample_aggregate_percentile = 1; + + ConcurrencyLimitCalculationParams concurrency_limit_params = 2 + [(validate.rules).message = {required: true}]; + + MinimumRTTCalculationParams min_rtt_calc_params = 3 [(validate.rules).message = {required: true}]; +} + +message AdaptiveConcurrency { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.adaptive_concurrency.v2alpha.AdaptiveConcurrency"; + + oneof concurrency_controller_config { + option (validate.required) = true; + + // Gradient concurrency control will be used. + GradientControllerConfig gradient_controller_config = 1 + [(validate.rules).message = {required: true}]; + } + + // If set to false, the adaptive concurrency filter will operate as a pass-through filter. If the + // message is unspecified, the filter will be enabled. + config.core.v3.RuntimeFeatureFlag enabled = 2; + + // This field allows for a custom HTTP response status code to the downstream client when + // the concurrency limit has been exceeded. + // Defaults to 503 (Service Unavailable). + // + // .. note:: + // If this is set to < 400, 503 will be used instead. + type.v3.HttpStatus concurrency_limit_exceeded_status = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/b5477dfb0d32381ab02e26eb2ff4a9a1f99e01599f1cfe39d72f195a8f3570afad60ace573dfd0fb68b0719a4c872ec072e6d849f9fa783435e6927cdb2f95e0 b/modules/sync/envoyproxy/envoy/cas/b5477dfb0d32381ab02e26eb2ff4a9a1f99e01599f1cfe39d72f195a8f3570afad60ace573dfd0fb68b0719a4c872ec072e6d849f9fa783435e6927cdb2f95e0 new file mode 100644 index 00000000..558cd7a6 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/b5477dfb0d32381ab02e26eb2ff4a9a1f99e01599f1cfe39d72f195a8f3570afad60ace573dfd0fb68b0719a4c872ec072e6d849f9fa783435e6927cdb2f95e0 @@ -0,0 +1,117 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.aws_eventstream_parser.v3; + +import "envoy/config/core/v3/extension.proto"; + +import "google/protobuf/struct.proto"; +import "google/protobuf/wrappers.proto"; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.aws_eventstream_parser.v3"; +option java_outer_classname = "AwsEventstreamParserProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/aws_eventstream_parser/v3;aws_eventstream_parserv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: AWS-EventStream-Parser Filter] +// +// The AWS-EventStream-Parser filter extracts values from AWS EventStream HTTP response bodies +// and writes them to dynamic metadata. This is useful for AWS Bedrock streaming response processing, +// token usage tracking, logging, and other observability use cases. +// +// The filter specifically handles the AWS EventStream binary protocol +// (application/vnd.amazon.eventstream) and uses pluggable content parsers to extract values +// from the message payloads. The content parser is a typed extension that can be configured +// to handle different content types (JSON, plaintext, XML, etc.). +// +// The filter only processes responses with Content-Type "application/vnd.amazon.eventstream". +// Content-Type parameters are ignored. +// +// See AWS-EventStream-Parser :ref:`configuration overview ` for more details. +// [#extension: envoy.filters.http.aws_eventstream_parser] + +message AwsEventstreamParser { + // Metadata action to write when an EventStream header matches or is missing. + message HeaderKeyValuePair { + // The namespace — if this is empty, the filter's namespace will be used. + // Default: "envoy.filters.http.aws_eventstream_parser". + string metadata_namespace = 1; + + // The key to use within the namespace. + string key = 2 [(validate.rules).string = {min_len: 1}]; + + // Optional: a fixed value to use instead of the header's actual value. + // When set for on_present, uses this value instead of the header value. + // Required for on_missing (since there is no header value available). + google.protobuf.Value value = 3; + } + + // A rule for extracting an EventStream message header to dynamic metadata. + message HeaderRule { + // The EventStream header name to match. Case-sensitive. + string header_name = 1 [(validate.rules).string = {min_len: 1}]; + + // If the header is present in a message, apply this metadata action. + HeaderKeyValuePair on_present = 2; + + // If the header was not found in any message by end-of-stream, apply this metadata action. + // The value field in the HeaderKeyValuePair must be set (since there is no header value). + HeaderKeyValuePair on_missing = 3; + + // Controls how many times this rule should successfully match before stopping evaluation + // of this rule for subsequent messages. + // + // - If set to 0 (default): This rule is evaluated against all messages. + // Later matches overwrite earlier values, effectively extracting the LAST occurrence. + // + // - If set to 1: Stop evaluating this rule after the first successful match. + // This is useful for extracting header values that appear early in the stream + // to avoid unnecessary processing of subsequent messages. + // + // - If set to N > 1: Reserved for future use. Values > 1 are currently rejected. + // + // When all header rules AND all content parser rules have stop_processing_after_matches + // limits set and all limits are satisfied, the filter stops processing the stream entirely. + google.protobuf.UInt32Value stop_processing_after_matches = 4 + [(validate.rules).uint32 = {lte: 1}]; + } + + // Rules for processing AWS EventStream streams and extracting metadata. + // + // The filter parses the AWS EventStream binary protocol (messages with headers and payloads), + // then delegates to a content parser to parse the message payload and extract metadata. + // The content parser determines which values to extract and how to write them to metadata. + message ProcessingRules { + // Content parser configuration for parsing message payloads and extracting metadata. + // + // The content parser specifies: + // - How to parse the message payload (e.g., JSON, XML, plaintext) + // - Which values to extract from the parsed content (e.g., JSON paths like usage.total_tokens) + // - How to map extracted values to metadata (namespace, key, type conversions) + // - When to write metadata (on_present, on_missing, on_error actions) + // [#extension-category: envoy.content_parsers] + config.core.v3.TypedExtensionConfig content_parser = 1 + [(validate.rules).message = {required: true}]; + + // Rules for extracting EventStream message headers to dynamic metadata. + // These are evaluated directly by the filter (not by the content parser). + // Headers are simple typed key-value pairs at the EventStream protocol level. + // + // Header values are automatically converted to the appropriate Protobuf value type: + // - BoolTrue/BoolFalse -> bool_value + // - Byte/Short/Int32/Int64/Timestamp -> number_value + // - String -> string_value + // - ByteArray -> string_value (hex-encoded) + // - UUID -> string_value (formatted as xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx) + repeated HeaderRule header_rules = 2; + } + + // Rules for processing AWS EventStream response streams. + ProcessingRules response_rules = 1 [(validate.rules).message = {required: true}]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/b6009c26b7776e0bceab6afc8169b410ab78ebf50b780976d7d335b3240280d8f929bf2c6b7d18546986950a5f85b6bd76c657f087a56a0b47047f133e63d43d b/modules/sync/envoyproxy/envoy/cas/b6009c26b7776e0bceab6afc8169b410ab78ebf50b780976d7d335b3240280d8f929bf2c6b7d18546986950a5f85b6bd76c657f087a56a0b47047f133e63d43d new file mode 100644 index 00000000..c93ad7e8 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/b6009c26b7776e0bceab6afc8169b410ab78ebf50b780976d7d335b3240280d8f929bf2c6b7d18546986950a5f85b6bd76c657f087a56a0b47047f133e63d43d @@ -0,0 +1,64 @@ +syntax = "proto3"; + +package envoy.extensions.http.custom_response.local_response_policy.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/substitution_format_string.proto"; + +import "google/protobuf/wrappers.proto"; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.http.custom_response.local_response_policy.v3"; +option java_outer_classname = "LocalResponsePolicyProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/http/custom_response/local_response_policy/v3;local_response_policyv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: Local Response Policy for Custom Response] +// [#extension: envoy.http.custom_response.local_response_policy] + +// Custom response policy to serve a locally stored response to the +// downstream. +// [#next-free-field: 7] +message LocalResponsePolicy { + // Optional new local reply body text. It will be used + // in the ``%LOCAL_REPLY_BODY%`` command operator in the ``body_format``. If unset when + // ``body_format`` is configured for an existing local reply, the existing body will be used as + // the formatter input instead. + config.core.v3.DataSource body = 1; + + // Optional body format to be used for this response. If ``body_format`` is not + // provided, and ``body`` is, the contents of ``body`` will be used to populate + // the body of the local reply without formatting. + config.core.v3.SubstitutionFormatString body_format = 2; + + // The new response status code if specified. + google.protobuf.UInt32Value status_code = 3 [(validate.rules).uint32 = {lt: 600 gte: 200}]; + + // HTTP headers to add to the response. This allows the + // response policy to append, to add or to override headers of + // the original response for local body, or the custom response from the + // remote body, before it is sent to a downstream client. + repeated config.core.v3.HeaderValueOption response_headers_to_add = 4 + [(validate.rules).repeated = {max_items: 1000}]; + + // Controls what is written to ``stream_info.response_code_details`` when this + // policy sends its local reply. + // + // If unset, details are cleared (empty string), matching legacy behavior. + // Use ``preserve_response_code_details`` to keep the existing value (e.g. + // ``csrf_origin_mismatch``), or ``response_code_details`` to set an explicit + // replacement. + oneof response_code_details_action { + // If set, keep the existing ``response_code_details`` already present on StreamInfo. + bool preserve_response_code_details = 5 [(validate.rules).bool = {const: true}]; + + // Replace ``response_code_details`` with this value. + string response_code_details = 6 [(validate.rules).string = {min_len: 1}]; + } +} diff --git a/modules/sync/envoyproxy/envoy/cas/b801c7532eafc67c8c9fcdb522b395770893de74f2433033bd97d013256be1182c75b86afee07c81abc0c6c35dfc8115ac25e0222c1a07db170dd5f06da6e7a3 b/modules/sync/envoyproxy/envoy/cas/b801c7532eafc67c8c9fcdb522b395770893de74f2433033bd97d013256be1182c75b86afee07c81abc0c6c35dfc8115ac25e0222c1a07db170dd5f06da6e7a3 new file mode 100644 index 00000000..1ac47410 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/b801c7532eafc67c8c9fcdb522b395770893de74f2433033bd97d013256be1182c75b86afee07c81abc0c6c35dfc8115ac25e0222c1a07db170dd5f06da6e7a3 @@ -0,0 +1,77 @@ +syntax = "proto3"; + +package envoy.extensions.access_loggers.dynamic_modules.v3; + +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.access_loggers.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/access_loggers/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Dynamic Modules Access Logger] +// [#extension: envoy.access_loggers.dynamic_modules] + +// Configuration for the Dynamic Modules Access Logger. This logger allows loading shared object +// files via ``dlopen`` to implement custom access logging behavior. +// +// A module can be loaded by multiple access loggers; the module is loaded only once and shared +// across multiple logger instances. +// +// The access logger receives completed request information including request/response headers, +// stream info (timing, upstream info, response codes), and the log context type. +message DynamicModuleAccessLog { + // Specifies the shared-object level configuration. This field is required. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1 + [(validate.rules).message = {required: true}]; + + // The name for this logger configuration. If not specified, defaults to an empty string. + // + // This can be used to distinguish between different logger implementations inside a dynamic + // module. For example, a module can have completely different logger implementations (e.g., + // file logger, gRPC logger, metrics logger). When Envoy receives this configuration, it passes + // the ``logger_name`` to the dynamic module's access logger config init function together with + // the ``logger_config``. That way a module can decide which in-module logger implementation to + // use based on the name at load time. + string logger_name = 2; + + // The configuration for the logger chosen by ``logger_name``. If not specified, an empty + // configuration is passed to the module. + // + // This is passed to the module's access logger initialization function. Together with the + // ``logger_name``, the module can decide which in-module logger implementation to use and + // fine-tune the behavior of the logger. + // + // For example, if a module has two logger implementations, one for file output and one for + // sending to an external service, ``logger_name`` is used to choose either file or external. + // The ``logger_config`` can be used to configure file paths, service endpoints, batching + // parameters, format strings, etc. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly + // without the wrapper. + // + // .. code-block:: yaml + // + // # Passing a JSON struct configuration + // logger_config: + // "@type": "type.googleapis.com/google.protobuf.Struct" + // value: + // output_path: "/var/log/envoy/access.log" + // format: "json" + // buffer_size: 1000 + // + // # Passing a simple string configuration + // logger_config: + // "@type": "type.googleapis.com/google.protobuf.StringValue" + // value: "/var/log/envoy/access.log" + // + google.protobuf.Any logger_config = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/b8cc3aad08e373430341aa271264b049929ebce00d1e2f69771e1f970604efba7396bd0cc8e5dee629c1c556c817423dfac16bbce88ab7081e40888c3f59a51e b/modules/sync/envoyproxy/envoy/cas/b8cc3aad08e373430341aa271264b049929ebce00d1e2f69771e1f970604efba7396bd0cc8e5dee629c1c556c817423dfac16bbce88ab7081e40888c3f59a51e new file mode 100644 index 00000000..e50d31f5 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/b8cc3aad08e373430341aa271264b049929ebce00d1e2f69771e1f970604efba7396bd0cc8e5dee629c1c556c817423dfac16bbce88ab7081e40888c3f59a51e @@ -0,0 +1,405 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.mcp_json_rest_bridge.v3; + +import "google/protobuf/duration.proto"; +import "google/protobuf/wrappers.proto"; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.mcp_json_rest_bridge.v3"; +option java_outer_classname = "McpJsonRestBridgeProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/mcp_json_rest_bridge/v3;mcp_json_rest_bridgev3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: MCP JSON REST Bridge] +// [#extension: envoy.filters.http.mcp_json_rest_bridge] + +// The cache scope of a cacheable MCP result, emitted as the ``cacheScope`` result field. +enum CacheScope { + // Unspecified. Treated as ``CACHE_SCOPE_PUBLIC``. + CACHE_SCOPE_UNSPECIFIED = 0; + + // The result may be stored in a shared cache and reused across clients. + CACHE_SCOPE_PUBLIC = 1; + + // The result may only be stored in a per-client cache. + CACHE_SCOPE_PRIVATE = 2; +} + +// Configuration for the MCP MCP JSON REST Bridge. +// +// This extension translates Model Context Protocol (MCP) JSON-RPC requests into standard JSON-REST +// HTTP requests. This enables existing REST backends to function as MCP servers without native MCP +// support. +// +// Main functionalities: +// +// 1. Transcoding: Converts JSON-RPC request payload to HTTP REST request, and maps JSON response +// back to JSON-RPC. +// 2. Session negotiation: Handles MCP connection prerequisites. +// +// The core logic transforms "tools/call" request into HTTP request following the ``HttpRule`` +// specification. +// +// Example 1: GET request with path and query parameters +// +// .. code-block:: text +// +// tools: { +// name: "getResource" +// http_rule: { +// get: "/v1/projects/{project_id}/resources/{resource_id}" +// // body is omitted for GET +// } +// } +// If tools/call params are: +// { "name": "getResource", "arguments": {"project_id": "foo", "resource_id": "res-789", "view": "FULL"} } +// Translation: +// - Method: GET +// - URL: /v1/projects/foo/resources/res-789?view=FULL +// (Arguments not matching path templates become query parameters.) +// +// Example 2: POST request with wildcard body +// +// .. code-block:: text +// +// tools: { +// name: "createResource" +// http_rule: { +// post: "/v1/projects/{project_id}/resources" +// body: "*" +// } +// } +// If tools/call params are: +// { "name": "createResource", "arguments": {"project_id": "foo", "resource_id": "res-456", "payload": { "data": "some value" }} } +// Translation: +// - Method: POST +// - URL: /v1/projects/foo/resources +// - Body: {"resource_id": "res-456", "payload": { "data": "some value" }} +// (Arguments not used in the path form the body, as per body: "*".) +// +// Example 3: PUT request with a specific field as body +// +// .. code-block:: text +// +// tools: { +// name: "updateResource" +// http_rule: { +// put: "/v1/projects/{project_id}" +// body: "payload" +// } +// } +// If tools/call params are: +// { "name": "updateResource", "arguments": {"project_id": "foo", "resource_id": "res-456", "payload": { "data": "updated value" }} } +// Translation: +// - Method: PUT +// - URL: /v1/projects/foo?resource_id=res-456 +// - Body: {"data": "updated value"} +// (Only the "payload" field from arguments is used as the body. Other arguments not in the +// path, like 'resource_id', become query parameters.) +// [#next-free-field: 9] +message McpJsonRestBridge { + // Where to store parsed MCP request attributes. + enum RequestStorageMode { + // Unspecified. Uses default behavior (nothing is stored). + MODE_UNSPECIFIED = 0; + + // Store request attributes in dynamic metadata. The metadata namespace + // is the filter's config name as specified by the ``name`` field in the + // ``http_filters`` list (e.g. ``envoy.filters.http.mcp_json_rest_bridge`` + // if using the canonical filter name). + DYNAMIC_METADATA = 1; + } + + // General server information. + ServerInfo server_info = 1; + + // Configuration for the MCP tools. + ServerToolConfig tool_config = 2; + + // Maximum size of the request body to buffer for transcoding and validation. + // If the request body exceeds this size, the request is rejected with ``413 Payload Too Large``. + // This limit applies to prevent unbounded buffering. + // + // It defaults to 64KB (65536 bytes) as the MCP calls (tools, resources, or prompts) + // only pass small arguments or identifiers. + // + // Setting it to 0 would disable the limit. It is not recommended to do so in production. + google.protobuf.UInt32Value max_request_body_size = 3; + + // Maximum size of the response body to buffer for transcoding. + // If the response body exceeds this size, the response is rejected with an appropriate error. + // This limit applies to prevent unbounded buffering. + // + // It defaults to 1MB (1048576 bytes) to prevent transcoding failures on large payloads like + // file reads, while aligning with Envoy's standard default connection buffer limit. + // + // Setting it to 0 would disable the limit. It is not recommended to do so in production. + google.protobuf.UInt32Value max_response_body_size = 4; + + // Where to store parsed MCP request attributes. + // Default is not storing anything. + // When set to ``DYNAMIC_METADATA``, attributes are stored in dynamic metadata + // using the filter's config name (i.e. the ``name`` field of this filter's entry + // in the ``http_filters`` list) as the metadata namespace. + RequestStorageMode request_storage_mode = 5 [(validate.rules).enum = {defined_only: true}]; + + // If set, extract OpenTelemetry (OTel) trace context from MCP requests and propagate it to + // request headers. The keys ``traceparent``, ``tracestate``, and ``baggage`` + // will be extracted from ``_meta``. + // Ref: `Request Meta SEP `_ + TraceContextExtractionOptions trace_context_extraction = 6; + + // When set to true, the filter will not clear the route cache after transcoding. + // This allows the route to be re-selected based on the updated request path or method. + bool disable_clear_route_cache = 7; + + // When set to true, the filter will take no action unless per-route config is available. + bool per_route_only = 8; +} + +// Options for trace context extraction. +message TraceContextExtractionOptions { +} + +// Cache configuration for a locally-generated, cacheable MCP result. +message CacheConfig { + // How long the result may be reused, emitted as the MCP ``ttlMs`` result field. + // + // If not provided: Defaults to 0, meaning clients should revalidate before reusing the result. + google.protobuf.Duration ttl = 1 [(validate.rules).duration = {gte {}}]; + + // The cache scope of the result. + // + // If not provided: Defaults to ``CACHE_SCOPE_PUBLIC``. + CacheScope cache_scope = 2 [(validate.rules).enum = {defined_only: true}]; +} + +// Configuration for the server metadata. +message ServerInfo { + // The maximum MCP protocol version supported by this MCP endpoint. + // + // Supported values are ``2025-11-25`` and ``2026-07-28``. Versions prior + // to ``2025-11-25`` are rejected because the filter unconditionally supports features + // up to ``2025-11-25`` and does not support downgrading below that baseline. + // If not provided: Defaults to ``2025-11-25``. + // + // Example value: "2026-07-28" + google.protobuf.StringValue max_supported_protocol_version = 1 + [(validate.rules).string = {in: "2025-11-25" in: "2026-07-28"}]; + + // [#not-implemented-hide:] + // [#comment:TODO(guoyilin42): Implement description] + // Optional description of the server. + string description = 2; + + // The fallback protocol version to use if the client does not provide the ``mcp-protocol-version`` header. + // + // - If provided: The extension uses this version as the fallback protocol version. + // - If not provided: The extension uses the fallback protocol version defined in the latest MCP + // specification. For example, the current latest 2026-07-28 specification designates "2025-03-26" + // as the fallback protocol version. + // See https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http#protocol-version-header + google.protobuf.StringValue fallback_protocol_version = 3; + + // Cache configuration advertised in locally-generated ``server/discover`` responses. + // + // If not provided: the response advertises ``ttlMs: 0`` and ``cacheScope: public``. + CacheConfig server_discovery_cache_config = 4; +} + +// Configuration for sending locally-generated responses to tools/list requests. +message ToolsListLocal { +} + +// Configuration for the MCP tool capability of the server. +// [#next-free-field: 6] +message ServerToolConfig { + // List of MCP tools configurations. + repeated ToolConfig tools = 1; + + // [#not-implemented-hide:] + // [#comment:TODO(guoyilin42): Implement list_changed] + // Whether this server supports notifications for changes to the tool list. + bool list_changed = 2; + + // Optional configuration for tools/list requests. If not set: The ``tools/list`` request is + // passed through. This allows subsequent extension or the backend itself to handle the tools/list + // request if they support it. + oneof tool_list_config { + // Configuration to transcode the tools/list requests to a standard HTTP request. If provided: + // The extension transcodes the request and forwards it down the filter chain. The response + // (whether from an upstream backend, a configured ``direct_response``, or another extension) + // MUST be a JSON body strictly matching the MCP ``ListToolsResult`` schema. Ref: + // https://modelcontextprotocol.io/specification/2025-11-25/schema#listtoolsresult + HttpRule tool_list_http_rule = 3; + + // If provided: The extension sends a local response, according to each tool's + // ToolsListSpecificConfig. + ToolsListLocal tool_list_local = 4; + } + + // Default server info for tools without specific ones. If not provided, a fallback path of '/mcp' will be used. + McpServerInfo default_server_info = 5; +} + +// Configuration for a tool's entry in tools/list responses. +message ToolsListSpecificConfig { + // Optional, human-readable name of the tool for display purposes. + string title = 1; + + // Human-readable description of functionality. + string description = 2; + + // A JSON Schema describing expected parameters, as a serialized JSON string, in the JSON Schema + // 2020-12 dialect. This should be raw JSON, including the "properties" and "required" keys, but + // not "type". Tools with no parameters may omit this to signify a tool with no constraints on the + // parameters object, or set to '"additionalProperties": false' to require empty parameters. + string input_schema = 3; +} + +message McpServerInfo { + // The path to the endpoint hosting this tool. + string path = 1; + + // The host hosting this tool. + string host = 2; +} + +// [#next-free-field: 6] +message ToolConfig { + // Unique identifier of the tool. Used both for tools/list and tools/call transcoding. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // The HTTP configuration rules that apply to the normal backend. + HttpRule http_rule = 2; + + // Config for this tool's entry in a local tools/list response. Used when tool_list_local is set + // in the ServerToolConfig. + ToolsListSpecificConfig tool_list_config = 3; + + // Enables streaming transcoding for unstructured text responses (``content`` field of a result). + // + // When enabled, the response body is streamed directly to the client without buffering. Each + // chunk is JSON escaped as it arrives and wrapped with a pre-built JSON-RPC prefix and suffix. + // + // For Server-Sent Events (SSE) responses (i.e. ``text/event-stream`` content type), Envoy parses + // the stream and wraps each extracted complete event payload into a distinct text content item + // within the JSON-RPC ``content`` array on the fly. + // + // Streaming flow: + // + // .. code-block:: text + // + // input: [chunk1] → [chunk2] → [chunk3] + // output: [prefix+escaped_chunk1] → [escaped_chunk2] → [escaped_chunk3+suffix] + // + // Disabled by default. + bool text_content_streaming_enabled = 4; + + // [#not-implemented-hide:] + // Path and host of the MCP server that hosts this tool. + repeated McpServerInfo server_info = 5; +} + +// Defines the schema of the JSON-RPC to REST mapping. It specifies how the "arguments" +// in a tools/call request are mapped to the URL path, query parameters, and HTTP request body. +// +// Mapping Rules: +// +// 1. Path: Fields defined in the path template (e.g., ``/v1/resources/{id}``) are extracted from +// arguments and placed in the URL. +// 2. Body: Determined by the ``body`` field. +// - If "*": All arguments not used in the path become the HTTP JSON body. +// - If specify a field: Only that specific argument becomes the HTTP JSON body. +// - If empty: No body is sent. +// 3. Query: Any leaf arguments not mapped to Path or Body are added as URL query parameters. +// [#next-free-field: 8] +message HttpRule { + // Represents a mapping from a request message field to an HTTP element. + // If the specified argument is missing from the tools/call request, the binding is silently + // ignored and the corresponding HTTP element (header or cookie) is not added. + message ParameterBinding { + // The target HTTP element type to bind to. + enum Type { + // Unspecified element type. + TYPE_UNSPECIFIED = 0; + + // The argument value is bound to an HTTP request header. + // Conceptually maps to an OpenAPI parameter with ``in: header``. + HEADER = 1; + + // The argument value is bound to an HTTP request cookie. + // Conceptually maps to an OpenAPI parameter with ``in: cookie``. + COOKIE = 2; + } + + // The type of the HTTP element to bind to. + Type type = 1; + + // The name of the HTTP header (e.g., "X-API-Key", "Authorization") or the + // name of the cookie (e.g.,"SESSION_ID"). Note: Envoy normalizes the header names to lowercase. + // The following headers are reserved for Envoy's internal use and cannot be overridden by + // bindings: ``content-length``, ``transfer-encoding``, ``host``, ``:authority``, ``cookie``, + // ``accept-encoding``, and any header starting with ``x-envoy-``. Attempting to bind to these + // will be ignored. + string name = 2 + [(validate.rules).string = + {min_len: 1 max_bytes: 16384 well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // Path to the field within the JSON arguments object from a tools/call + // request. Uses dot-notation for nested fields. + // E.g. if arguments object is ``{"user":{"auth_token":"foo"}}``, then + // ``argument_path`` should be "user.auth_token". + string argument_path = 3 [(validate.rules).string = {min_len: 1}]; + } + + // Determines the HTTP method and the URL path template. + // + // Path templating uses curly braces ``{}`` to mark a section of the URL path as replaceable. + // Each template variable MUST correspond to a field in the JSON-RPC "arguments". + // Use dot-notation to access fields within nested objects (e.g., "user.id" maps the value of the + // "id" field inside "user"). + // + // To support backward compatibility with future methods, these are defined as individual fields + // rather than a "oneof". If multiple fields are present, the one with the highest field number + // highest priority) is the effective method. + // + // Maps to HTTP GET. + string get = 1; + + // Maps to HTTP PUT. + string put = 2; + + // Maps to HTTP POST. + string post = 3; + + // Maps to HTTP DELETE. + string delete = 4; + + // Maps to HTTP PATCH. + string patch = 5; + + // The name of the request field whose value is mapped to the HTTP request body. + // + // - If "*": All fields not bound by the path template are mapped to the request body. + // - If specify a field: This specific field is mapped to the body. Uses dot-notation for nested + // fields (e.g., "user.data" maps the value of the "data" field inside "user"). + // - If omitted: There is no HTTP request body; fields not in the path become query parameters. + string body = 6; + + // Bindings to extract values from the 'arguments' object of a tools/call + // request and inject them as HTTP elements. + repeated ParameterBinding bindings = 7; +} + +// Per-route override configuration for the MCP JSON REST Bridge filter. +message McpJsonRestBridgePerRoute { + repeated ServerToolConfig tool_config = 1; +} diff --git a/modules/sync/envoyproxy/envoy/cas/ba2b9f6a0eeead34c75bac35812ae40ec1d1784969ea691c12517bb3be61bd5b9d32dd332aa48c4b3b0507224d5fd9f4ce0dc31810942d0ee424803878155286 b/modules/sync/envoyproxy/envoy/cas/ba2b9f6a0eeead34c75bac35812ae40ec1d1784969ea691c12517bb3be61bd5b9d32dd332aa48c4b3b0507224d5fd9f4ce0dc31810942d0ee424803878155286 new file mode 100644 index 00000000..1ceee92c --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/ba2b9f6a0eeead34c75bac35812ae40ec1d1784969ea691c12517bb3be61bd5b9d32dd332aa48c4b3b0507224d5fd9f4ce0dc31810942d0ee424803878155286 @@ -0,0 +1,489 @@ +syntax = "proto3"; + +package envoy.config.listener.v3; + +import "envoy/config/accesslog/v3/accesslog.proto"; +import "envoy/config/core/v3/address.proto"; +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/config_source.proto"; +import "envoy/config/core/v3/extension.proto"; +import "envoy/config/core/v3/socket_option.proto"; +import "envoy/config/listener/v3/api_listener.proto"; +import "envoy/config/listener/v3/listener_components.proto"; +import "envoy/config/listener/v3/udp_listener_config.proto"; +import "envoy/config/metrics/v3/stats.proto"; + +import "google/protobuf/duration.proto"; +import "google/protobuf/wrappers.proto"; + +import "xds/core/v3/collection_entry.proto"; +import "xds/type/matcher/v3/matcher.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/security.proto"; +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.config.listener.v3"; +option java_outer_classname = "ListenerProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3;listenerv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Listener configuration] +// Listener :ref:`configuration overview ` + +// The additional address the listener is listening on. +message AdditionalAddress { + core.v3.Address address = 1; + + // Additional socket options that may not be present in Envoy source code or + // precompiled binaries. If specified, this will override the + // :ref:`socket_options ` + // in the listener. If specified with no + // :ref:`socket_options ` + // or an empty list of :ref:`socket_options `, + // it means no socket option will apply. + core.v3.SocketOptionsOverride socket_options = 2; + + // Configures TCP keepalive settings for the additional address. + // If not set, the listener :ref:`tcp_keepalive ` + // configuration is inherited. You can explicitly disable TCP keepalive for the additional address by setting any keepalive field + // (:ref:`keepalive_probes `, + // :ref:`keepalive_time `, or + // :ref:`keepalive_interval `) to ``0``. + core.v3.TcpKeepalive tcp_keepalive = 3; +} + +// Listener list collections. Entries are ``Listener`` resources or references. +// [#not-implemented-hide:] +message ListenerCollection { + repeated xds.core.v3.CollectionEntry entries = 1; +} + +// [#next-free-field: 40] +message Listener { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.Listener"; + + enum DrainType { + // Drain in response to calling /healthcheck/fail admin endpoint (along with the health check + // filter), listener removal/modification, and hot restart. + DEFAULT = 0; + + // Drain in response to listener removal/modification and hot restart. This setting does not + // include /healthcheck/fail. This setting may be desirable if Envoy is hosting both ingress + // and egress listeners. + MODIFY_ONLY = 1; + } + + // [#not-implemented-hide:] + message DeprecatedV1 { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.Listener.DeprecatedV1"; + + // Whether the listener should bind to the port. A listener that doesn't + // bind can only receive connections redirected from other listeners that + // set use_original_dst parameter to true. Default is true. + // + // This is deprecated. Use :ref:`Listener.bind_to_port + // ` + google.protobuf.BoolValue bind_to_port = 1; + } + + // Configuration for listener connection balancing. + message ConnectionBalanceConfig { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.Listener.ConnectionBalanceConfig"; + + // A connection balancer implementation that does exact balancing. This means that a lock is + // held during balancing so that connection counts are nearly exactly balanced between worker + // threads. This is "nearly" exact in the sense that a connection might close in parallel thus + // making the counts incorrect, but this should be rectified on the next accept. This balancer + // sacrifices accept throughput for accuracy and should be used when there are a small number of + // connections that rarely cycle (e.g., service mesh gRPC egress). + message ExactBalance { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.Listener.ConnectionBalanceConfig.ExactBalance"; + } + + // A connection balancer that steers each new TCP connection to the worker thread pinned to the + // CPU that received the connection, using a kernel ``SO_REUSEPORT`` BPF program. This removes + // the lock that the :ref:`exact balancer + // ` takes on + // every accept and keeps each connection on a single worker for cache and ``NUMA`` locality. To + // realize locality the operator should align ``NIC`` receive steering so connections arrive on + // the worker CPUs, for example with receive side scaling or ``IRQ`` affinity. + // + // It is available on Linux only and requires :ref:`enable_worker_cpu_affinity + // ` so worker ``i`` + // is pinned to the CPU the program steers to it, :ref:`enable_reuse_port + // `, a kernel that supports + // reuse port BPF steering, and a worker count no greater than the number of CPUs in the process + // affinity mask. When any of these is not met, or if the kernel rejects the steering program at + // runtime, the listener keeps serving with the kernel default reuse port hashing and without CPU + // locality. + // + // Worker affinity is fixed when the worker threads start, so a listener added dynamically via LDS + // steers with the same mapping. During a hot restart new connections may be steered to the + // draining parent process until it exits. + message CpuLocalityBalance { + } + + oneof balance_type { + option (validate.required) = true; + + // If specified, the listener will use the exact connection balancer. + ExactBalance exact_balance = 1; + + // The listener will use the connection balancer according to ``type_url``. If ``type_url`` is invalid, + // Envoy will not attempt to balance active connections between worker threads. + // The ``envoy.network.connection_balance`` extension category is currently empty. + core.v3.TypedExtensionConfig extend_balance = 2; + + // If specified, the listener will steer new connections to worker threads using a kernel + // ``SO_REUSEPORT`` BPF program. See :ref:`CpuLocalityBalance + // ` + // for the requirements and fallback behavior. + CpuLocalityBalance cpu_locality_balance = 3; + } + } + + // Configuration for envoy internal listener. All the future internal listener features should be added here. + message InternalListenerConfig { + } + + // Configuration for filter chains discovery. + // [#not-implemented-hide:] + message FcdsConfig { + // Optional name to present to the filter chain discovery service. This may be an arbitrary name with arbitrary + // length. If a name is not provided, the listener's name is used. Refer to :ref:`filter_chains `. + // for details on how listener name is determined if unspecified. In addition, this may be a xdstp:// URL. + string name = 1; + + // Configuration for the source of FCDS updates for this listener. + // .. note:: + // This discovery service only supports ``AGGREGATED_GRPC`` API type. + core.v3.ConfigSource config_source = 2; + } + + reserved 14, 23; + + // The unique name by which this listener is known. If no name is provided, + // Envoy will allocate an internal UUID for the listener. If the listener is to be dynamically + // updated or removed via :ref:`LDS ` a unique name must be provided. + string name = 1; + + // The address that the listener should listen on. In general, the address must be unique, though + // that is governed by the bind rules of the OS. E.g., multiple listeners can listen on port 0 on + // Linux as the actual port will be allocated by the OS. + // Required unless ``api_listener`` or ``listener_specifier`` is populated. + // + // When the address contains a network namespace filepath (via + // :ref:`network_namespace_filepath `), + // Envoy automatically populates the filter state with key ``envoy.network.network_namespace`` + // when a connection is accepted. This provides read-only access to the network namespace for + // filters, access logs, and other components. + core.v3.Address address = 2; + + // The additional addresses the listener should listen on. The addresses must be unique across all + // listeners. Multiple addresses with port 0 can be supplied. When using multiple addresses in a single listener, + // all addresses use the same protocol, and multiple internal addresses are not supported. + repeated AdditionalAddress additional_addresses = 33; + + // Optional prefix to use on listener stats. If empty, the stats will be rooted at + // ``listener.
.``. If non-empty, stats will be rooted at + // ``listener..``. + string stat_prefix = 28; + + // Optional stats matcher that can be used to configure which stats are instantiated for this + // listener. If configured, this overrides the bootstrap :ref:`stats_config + // ` stats matcher configuration + // for this listener. + metrics.v3.StatsMatcher stats_matcher = 39; + + // A list of filter chains to consider for this listener. The + // :ref:`FilterChain ` with the most specific + // :ref:`FilterChainMatch ` criteria is used on a + // connection. + // + // Example using SNI for filter chain selection can be found in the + // :ref:`FAQ entry `. + repeated FilterChain filter_chains = 3; + + // Discover filter chains configurations by external service. Dynamic discovery of filter chains is allowed + // while having statically configured filter chains, however, a filter chain name must be unique within a + // listener. If a discovered filter chain matches a name of an existing filter chain, it is discarded. + // [#not-implemented-hide:] + FcdsConfig fcds_config = 36; + + // :ref:`Matcher API ` resolving the filter chain name from the + // network properties. This matcher is used as a replacement for the filter chain match condition + // :ref:`filter_chain_match + // `. If specified, all + // :ref:`filter_chains ` must have a + // non-empty and unique :ref:`name ` field + // and not specify :ref:`filter_chain_match + // ` field. + // + // .. note:: + // + // Once matched, each connection is permanently bound to its filter chain. + // If the matcher changes but the filter chain remains the same, the + // connections bound to the filter chain are not drained. If, however, the + // filter chain is removed or structurally modified, then the drain for its + // connections is initiated. + xds.type.matcher.v3.Matcher filter_chain_matcher = 32; + + // If a connection is redirected using ``iptables``, the port on which the proxy + // receives it might be different from the original destination address. When this flag is set to + // true, the listener hands off redirected connections to the listener associated with the + // original destination address. If there is no listener associated with the original destination + // address, the connection is handled by the listener that receives it. Defaults to false. + google.protobuf.BoolValue use_original_dst = 4; + + // The default filter chain if none of the filter chain matches. If no default filter chain is supplied, + // the connection will be closed. The filter chain match is ignored in this field. + FilterChain default_filter_chain = 25; + + // Soft limit on size of the listener’s new connection read and write buffers. + // If unspecified, an implementation defined default is applied (1MiB). + google.protobuf.UInt32Value per_connection_buffer_limit_bytes = 5 + [(udpa.annotations.security).configure_for_untrusted_downstream = true]; + + // Optional timeout that controls how long a connection is allowed to stay above the configured + // buffer high watermark before it is closed. If this timeout is not specified, or explicitly set + // to 0, connections will not be closed due to buffer high watermark usage. + google.protobuf.Duration per_connection_buffer_high_watermark_timeout = 38 + [(validate.rules).duration = {gte {}}]; + + // Listener metadata. + // + // The following pre-defined metadata could be used by Envoy to manipulate the listener behavior: + // + // * ``envoy.stats_matcher``: this metadata could be used to customize the stats emitted by the + // listener. See :ref:`well-known metadata + // ` for more details. + // If :ref:`stats_matcher + // ` is configured, this metadata + // is ignored. The ``stats_matcher`` field should be preferred. + // + core.v3.Metadata metadata = 6; + + // [#not-implemented-hide:] + DeprecatedV1 deprecated_v1 = 7 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // The type of draining to perform at a listener-wide level. + DrainType drain_type = 8; + + // Listener filters have the opportunity to manipulate and augment the connection metadata that + // is used in connection filter chain matching, for example. These filters are run before any in + // :ref:`filter_chains `. Order matters as the + // filters are processed sequentially right after a socket has been accepted by the listener, and + // before a connection is created. + // UDP Listener filters can be specified when the protocol in the listener socket address in + // :ref:`protocol ` is :ref:`UDP + // ` and no + // :ref:`quic_options ` is specified in :ref:`udp_listener_config `. + // QUIC listener filters can be specified when :ref:`quic_options + // ` is + // specified in :ref:`udp_listener_config `. + // They are processed sequentially right before connection creation. And like TCP Listener filters, they can be used to manipulate the connection metadata and socket. But the difference is that they can't be used to pause connection creation. + repeated ListenerFilter listener_filters = 9; + + // The timeout to wait for all listener filters to complete operation. If the timeout is reached, + // the accepted socket is closed without a connection being created unless + // ``continue_on_listener_filters_timeout`` is set to true. Specify 0 to disable the + // timeout. If not specified, a default timeout of 15s is used. + google.protobuf.Duration listener_filters_timeout = 15; + + // Whether a connection should be created when listener filters timeout. Default is false. + // + // .. attention:: + // + // Some listener filters, such as :ref:`Proxy Protocol filter + // `, should not be used with this option. It will cause + // unexpected behavior when a connection is created. + bool continue_on_listener_filters_timeout = 17; + + // Whether the listener should be set as a transparent socket. + // When this flag is set to true, connections can be redirected to the listener using an + // ``iptables`` ``TPROXY`` target, in which case the original source and destination addresses and + // ports are preserved on accepted connections. This flag should be used in combination with + // :ref:`an original_dst ` :ref:`listener filter + // ` to mark the connections' local addresses as + // "restored." This can be used to hand off each redirected connection to another listener + // associated with the connection's destination address. Direct connections to the socket without + // using ``TPROXY`` cannot be distinguished from connections redirected using ``TPROXY`` and are + // therefore treated as if they were redirected. + // When this flag is set to false, the listener's socket is explicitly reset as non-transparent. + // Setting this flag requires Envoy to run with the ``CAP_NET_ADMIN`` capability. + // When this flag is not set (default), the socket is not modified, i.e. the transparent option + // is neither set nor reset. + google.protobuf.BoolValue transparent = 10; + + // Whether the listener should set the ``IP_FREEBIND`` socket option. When this + // flag is set to true, listeners can be bound to an IP address that is not + // configured on the system running Envoy. When this flag is set to false, the + // option ``IP_FREEBIND`` is disabled on the socket. When this flag is not set + // (default), the socket is not modified, i.e. the option is neither enabled + // nor disabled. + google.protobuf.BoolValue freebind = 11; + + // Additional socket options that may not be present in Envoy source code or + // precompiled binaries. + // It is not allowed to update the socket options for any existing address if + // :ref:`enable_reuse_port ` + // is ``false`` to avoid the conflict when creating new sockets for the listener. + repeated core.v3.SocketOption socket_options = 13; + + // Whether the listener should accept TCP Fast Open (TFO) connections. + // When this flag is set to a value greater than 0, the option TCP_FASTOPEN is enabled on + // the socket, with a queue length of the specified size + // (see `details in RFC7413 `_). + // When this flag is set to 0, the option TCP_FASTOPEN is disabled on the socket. + // When this flag is not set (default), the socket is not modified, + // i.e. the option is neither enabled nor disabled. + // + // On Linux, the net.ipv4.tcp_fastopen kernel parameter must include flag 0x2 to enable + // TCP_FASTOPEN. + // See `ip-sysctl.txt `_. + // + // On macOS, only values of 0, 1, and unset are valid; other values may result in an error. + // To set the queue length on macOS, set the net.inet.tcp.fastopen_backlog kernel parameter. + google.protobuf.UInt32Value tcp_fast_open_queue_length = 12; + + // Specifies the intended direction of the traffic relative to the local Envoy. + // This property is required on Windows for listeners using the original destination filter, + // see :ref:`Original Destination `. + core.v3.TrafficDirection traffic_direction = 16; + + // If the protocol in the listener socket address in :ref:`protocol + // ` is :ref:`UDP + // `, this field specifies UDP + // listener specific configuration. + UdpListenerConfig udp_listener_config = 18; + + // Used to represent an API listener, which is used in non-proxy clients. The type of API + // exposed to the non-proxy application depends on the type of API listener. + // When this field is set, no other field except for :ref:`name` + // should be set. + // + // .. note:: + // + // Currently only one ApiListener can be installed; and it can only be done via bootstrap config, + // not LDS. + // + // [#next-major-version: In the v3 API, instead of this messy approach where the socket + // listener fields are directly in the top-level Listener message and the API listener types + // are in the ApiListener message, the socket listener messages should be in their own message, + // and the top-level Listener should essentially be a oneof that selects between the + // socket listener and the various types of API listener. That way, a given Listener message + // can structurally only contain the fields of the relevant type.] + ApiListener api_listener = 19; + + // The listener's connection balancer configuration, currently only applicable to TCP listeners. + // If no configuration is specified, Envoy will not attempt to balance active connections between + // worker threads. + // + // In the scenario that the listener X redirects all the connections to the listeners Y1 and Y2 + // by setting :ref:`use_original_dst ` in X + // and :ref:`bind_to_port ` to false in Y1 and Y2, + // it is recommended to disable the balance config in listener X to avoid the cost of balancing, and + // enable the balance config in Y1 and Y2 to balance the connections among the workers. + ConnectionBalanceConfig connection_balance_config = 20; + + // Deprecated. Use ``enable_reuse_port`` instead. + bool reuse_port = 21 [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // When this flag is set to true, listeners set the ``SO_REUSEPORT`` socket option and + // create one socket for each worker thread. This makes inbound connections + // distribute among worker threads roughly evenly in cases where there are a high number + // of connections. When this flag is set to false, all worker threads share one socket. This field + // defaults to true. The change of field will be rejected during an listener update when the + // runtime flag ``envoy.reloadable_features.enable_update_listener_socket_options`` is enabled. + // Otherwise, the update of this field will be ignored quietly. + // + // .. attention:: + // + // Although this field defaults to true, it has different behavior on different platforms. See + // the following text for more information. + // + // * On Linux, reuse_port is respected for both TCP and UDP listeners. It also works correctly + // with hot restart. + // * On macOS, reuse_port for TCP does not do what it does on Linux. Instead of load balancing, + // the last socket wins and receives all connections/packets. For TCP, reuse_port is force + // disabled and the user is warned. For UDP, it is enabled, but only one worker will receive + // packets. For QUIC/H3, SW routing will send packets to other workers. For "raw" UDP, only + // a single worker will currently receive packets. + // * On Windows, reuse_port for TCP has undefined behavior. It is force disabled and the user + // is warned similar to macOS. It is left enabled for UDP with undefined behavior currently. + google.protobuf.BoolValue enable_reuse_port = 29; + + // Configuration for :ref:`access logs ` + // emitted by this listener. + repeated accesslog.v3.AccessLog access_log = 22; + + // The maximum length a tcp listener's pending connections queue can grow to. If no value is + // provided net.core.somaxconn will be used on Linux and 128 otherwise. + google.protobuf.UInt32Value tcp_backlog_size = 24; + + // The maximum number of connections to accept from the kernel per socket + // event. Envoy may decide to close these connections after accepting them + // from the kernel e.g. due to load shedding, or other policies. + // If there are more than max_connections_to_accept_per_socket_event + // connections pending accept, connections over this threshold will be + // accepted in later event loop iterations. + // If no value is provided Envoy will accept all connections pending accept + // from the kernel. + // + // .. note:: + // + // It is recommended to lower this value for better overload management and reduced per-event cost. + // Setting it to 1 is a viable option with no noticeable impact on performance. + google.protobuf.UInt32Value max_connections_to_accept_per_socket_event = 34 + [(validate.rules).uint32 = {gt: 0}]; + + // Whether the listener should bind to the port. A listener that doesn't + // bind can only receive connections redirected from other listeners that set + // :ref:`use_original_dst ` + // to true. Default is true. + google.protobuf.BoolValue bind_to_port = 26; + + // The exclusive listener type and the corresponding config. + oneof listener_specifier { + // Used to represent an internal listener which does not listen on OSI L4 address but can be used by the + // :ref:`envoy cluster ` to create a user space connection to. + // The internal listener acts as a TCP listener. It supports listener filters and network filter chains. + // Upstream clusters refer to the internal listeners by their :ref:`name + // `. :ref:`Address + // ` must not be set on the internal listeners. + // + // There are some limitations that are derived from the implementation. The known limitations include: + // + // * :ref:`ConnectionBalanceConfig ` is not + // allowed because both the cluster connection and the listener connection must be owned by the same dispatcher. + // * :ref:`tcp_backlog_size ` + // * :ref:`freebind ` + // * :ref:`transparent ` + InternalListenerConfig internal_listener = 27; + } + + // Enable MPTCP (multi-path TCP) on this listener. Clients will be allowed to establish + // MPTCP connections. Non-MPTCP clients will fall back to regular TCP. + bool enable_mptcp = 30; + + // Whether the listener should limit connections based upon the value of + // :ref:`global_downstream_max_connections `. + bool ignore_global_conn_limit = 31; + + // Whether the listener bypasses configured overload manager actions. + bool bypass_overload_manager = 35; + + // If set, TCP keepalive settings are configured for the listener address and inherited by + // additional addresses. If not set, TCP keepalive settings are not configured for the + // listener address and additional addresses by default. See :ref:`tcp_keepalive ` + // to explicitly configure TCP keepalive settings for individual additional addresses. + core.v3.TcpKeepalive tcp_keepalive = 37; +} diff --git a/modules/sync/envoyproxy/envoy/cas/bb27c6ce8e6b0e1896bf9c84bbdd8ff0bbc9232ff56dd79d741cd58c8359b9aeeab360d902e99ff96ecf5e8123fc57923d0eeb8cd1ccc9b2dfc070ac32278fdc b/modules/sync/envoyproxy/envoy/cas/bb27c6ce8e6b0e1896bf9c84bbdd8ff0bbc9232ff56dd79d741cd58c8359b9aeeab360d902e99ff96ecf5e8123fc57923d0eeb8cd1ccc9b2dfc070ac32278fdc new file mode 100644 index 00000000..9ad43f2a --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/bb27c6ce8e6b0e1896bf9c84bbdd8ff0bbc9232ff56dd79d741cd58c8359b9aeeab360d902e99ff96ecf5e8123fc57923d0eeb8cd1ccc9b2dfc070ac32278fdc @@ -0,0 +1,74 @@ +syntax = "proto3"; + +package envoy.extensions.filters.listener.dynamic_modules.v3; + +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.listener.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/listener/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Listener filter for dynamic modules] +// [#extension: envoy.filters.listener.dynamic_modules] + +// Configuration of the listener filter for dynamic modules. This filter allows loading shared object +// files that can be loaded via dlopen by the listener filter. +// +// A module can be loaded by multiple listener filters, hence the program can be structured in a way +// that the module is loaded only once and shared across multiple filters providing multiple +// functionalities. +// +// Unlike network filters which operate on established TCP connections, listener filters +// work with raw accepted sockets BEFORE a Connection object is created. The filter can: +// +// * Inspect initial bytes to detect protocols (TLS, HTTP, PostgreSQL, etc.). +// * Set socket properties (SNI, ALPN, transport protocol, fingerprints). +// * Modify connection addresses (original destination restoration). +// * Set dynamic metadata and filter state for downstream filters. +// * Rate limit incoming connections. +// +message DynamicModuleListenerFilter { + // Specifies the shared-object level configuration. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1; + + // The name for this filter configuration. This can be used to distinguish between different + // filter implementations inside a dynamic module. For example, a module can have completely + // different filter implementations (TLS inspector, rate limiter, proxy protocol parser). + // When Envoy receives this configuration, it passes the ``filter_name`` to the dynamic module's + // listener filter config init function together with the ``filter_config``. That way a module + // can decide which in-module filter implementation to use based on the name at load time. + string filter_name = 2; + + // The configuration for the filter chosen by ``filter_name``. This is passed to the module's + // listener filter initialization function. Together with the ``filter_name``, the module can + // decide which in-module filter implementation to use and fine-tune the behavior of the filter. + // + // For example, if a module has two filter implementations, one for TLS inspection and one for + // rate limiting, ``filter_name`` is used to choose either TLS or rate limiting. The ``filter_config`` + // can be used to configure the TLS inspection options or the rate limiting parameters. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly + // without the wrapper. + // + // .. code-block:: yaml + // + // # Passing a string value + // filter_config: + // "@type": "type.googleapis.com/google.protobuf.StringValue" + // value: hello + // + // # Passing raw bytes + // filter_config: + // "@type": "type.googleapis.com/google.protobuf.BytesValue" + // value: aGVsbG8= # echo -n "hello" | base64 + // + google.protobuf.Any filter_config = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/bcca4a38dfc74d193604e0758a536a6a3d5ae2b277355ea283da3468f47183524ccb3b0655df290586bc3e325a8584a610ea5fbe554d59cfd6bb2dd5465b20f3 b/modules/sync/envoyproxy/envoy/cas/bcca4a38dfc74d193604e0758a536a6a3d5ae2b277355ea283da3468f47183524ccb3b0655df290586bc3e325a8584a610ea5fbe554d59cfd6bb2dd5465b20f3 new file mode 100644 index 00000000..dec9a477 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/bcca4a38dfc74d193604e0758a536a6a3d5ae2b277355ea283da3468f47183524ccb3b0655df290586bc3e325a8584a610ea5fbe554d59cfd6bb2dd5465b20f3 @@ -0,0 +1,75 @@ +syntax = "proto3"; + +package envoy.extensions.bootstrap.dynamic_modules.v3; + +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.bootstrap.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/bootstrap/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Dynamic Modules Bootstrap Extension] +// [#extension: envoy.bootstrap.dynamic_modules] + +// Configuration for the Dynamic Modules bootstrap extension. This extension allows loading shared +// object files that can be loaded via ``dlopen`` to extend Envoy's bootstrap behavior. +// +// A module can be loaded by multiple bootstrap extensions; the module is loaded only once and shared +// across multiple extensions. +// +// Bootstrap extensions run on the main thread and are initialized when Envoy starts. They can: +// +// * Perform initialization tasks when the server is initialized. +// * Perform per-worker thread initialization when worker threads start. +// * Access server-level resources like the cluster manager and dispatcher. +// +message DynamicModuleBootstrapExtension { + // Specifies the shared-object level configuration. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1; + + // The name for this extension configuration. + // + // This can be used to distinguish between different extension implementations inside a dynamic + // module. For example, a module can have completely different extension implementations. When Envoy + // receives this configuration, it passes the ``extension_name`` to the dynamic module's bootstrap + // extension config init function together with the ``extension_config``. That way a module can + // decide which in-module extension implementation to use based on the name at load time. + // + // If not specified, defaults to an empty string. + string extension_name = 2; + + // The configuration for the extension chosen by ``extension_name``. + // + // This is passed to the module's bootstrap extension initialization function. Together with the + // ``extension_name``, the module can decide which in-module extension implementation to use and + // fine-tune the behavior of the extension. + // + // For example, if a module has two extension implementations, one for configuration loading and + // one for metric initialization, ``extension_name`` is used to choose the implementation. The + // ``extension_config`` can be used to configure the specific behavior of each implementation. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly + // without the wrapper. + // + // .. code-block:: yaml + // + // # Passing a string value + // extension_config: + // "@type": "type.googleapis.com/google.protobuf.StringValue" + // value: hello + // + // # Passing raw bytes + // extension_config: + // "@type": "type.googleapis.com/google.protobuf.BytesValue" + // value: aGVsbG8= # echo -n "hello" | base64 + // + google.protobuf.Any extension_config = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/bf95c1ca561ecc655f47a4e5221ddef23cb62faf0ff6388cdf2b51bcf34f5ab4702411cd94f5e0a5e7889a8cf90a57e30c400bbe7e5e0b32caad87e202f67172 b/modules/sync/envoyproxy/envoy/cas/bf95c1ca561ecc655f47a4e5221ddef23cb62faf0ff6388cdf2b51bcf34f5ab4702411cd94f5e0a5e7889a8cf90a57e30c400bbe7e5e0b32caad87e202f67172 new file mode 100644 index 00000000..db190536 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/bf95c1ca561ecc655f47a4e5221ddef23cb62faf0ff6388cdf2b51bcf34f5ab4702411cd94f5e0a5e7889a8cf90a57e30c400bbe7e5e0b32caad87e202f67172 @@ -0,0 +1,421 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.rate_limit_quota.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/extension.proto"; +import "envoy/config/core/v3/grpc_service.proto"; +import "envoy/type/v3/http_status.proto"; +import "envoy/type/v3/ratelimit_strategy.proto"; + +import "google/protobuf/duration.proto"; +import "google/protobuf/wrappers.proto"; +import "google/rpc/status.proto"; + +import "xds/type/matcher/v3/matcher.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.rate_limit_quota.v3"; +option java_outer_classname = "RateLimitQuotaProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/rate_limit_quota/v3;rate_limit_quotav3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Rate Limit Quota] +// Rate Limit Quota :ref:`configuration overview `. +// [#extension: envoy.filters.http.rate_limit_quota] + +// Configures the Rate Limit Quota filter. +// +// Can be overridden in the per-route and per-host configurations. +// The more specific definition completely overrides the less specific definition. +// [#next-free-field: 7] +message RateLimitQuotaFilterConfig { + // Configures the gRPC Rate Limit Quota Service (RLQS) RateLimitQuotaService. + config.core.v3.GrpcService rlqs_server = 1 [(validate.rules).message = {required: true}]; + + // The application domain to use when calling the service. This enables sharing the quota + // server between different applications without fear of overlap. + // E.g., "envoy". + string domain = 2 [(validate.rules).string = {min_len: 1}]; + + // The match tree to use for grouping incoming requests into buckets. + // + // Example: + // + // .. validated-code-block:: yaml + // :type-name: xds.type.matcher.v3.Matcher + // + // matcher_list: + // matchers: + // # Assign requests with header['env'] set to 'staging' to the bucket { name: 'staging' } + // - predicate: + // single_predicate: + // input: + // typed_config: + // '@type': type.googleapis.com/envoy.type.matcher.v3.HttpRequestHeaderMatchInput + // header_name: env + // value_match: + // exact: staging + // on_match: + // action: + // typed_config: + // '@type': type.googleapis.com/envoy.extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaBucketSettings + // bucket_id_builder: + // bucket_id_builder: + // name: + // string_value: staging + // + // # Assign requests with header['user_group'] set to 'admin' to the bucket { acl: 'admin_users' } + // - predicate: + // single_predicate: + // input: + // typed_config: + // '@type': type.googleapis.com/xds.type.matcher.v3.HttpAttributesCelMatchInput + // custom_match: + // typed_config: + // '@type': type.googleapis.com/xds.type.matcher.v3.CelMatcher + // expr_match: + // # Shortened for illustration purposes. Here should be parsed CEL expression: + // # request.headers['user_group'] == 'admin' + // parsed_expr: {} + // on_match: + // action: + // typed_config: + // '@type': type.googleapis.com/envoy.extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaBucketSettings + // bucket_id_builder: + // bucket_id_builder: + // acl: + // string_value: admin_users + // + // # Catch-all clause for the requests not matched by any of the matchers. + // # In this example, deny all requests. + // on_no_match: + // action: + // typed_config: + // '@type': type.googleapis.com/envoy.extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaBucketSettings + // no_assignment_behavior: + // fallback_rate_limit: + // blanket_rule: DENY_ALL + // + // .. attention:: + // The first matched group wins. Once the request is matched into a bucket, matcher + // evaluation ends. + // + // Use ``on_no_match`` field to assign the catch-all bucket. If a request is not matched + // into any bucket, and there's no ``on_no_match`` field configured, the request will be + // ALLOWED by default. It will NOT be reported to the RLQS server. + // + // Refer to :ref:`Unified Matcher API ` + // documentation for more information on the matcher trees. + xds.type.matcher.v3.Matcher bucket_matchers = 3 [(validate.rules).message = {required: true}]; + + // If set, this will enable -- but not necessarily enforce -- the rate limit for the given + // fraction of requests. + // + // Defaults to 100% of requests. + config.core.v3.RuntimeFractionalPercent filter_enabled = 4; + + // If set, this will enforce the rate limit decisions for the given fraction of requests. + // For requests that are not enforced the filter will still obtain the quota and include it + // in the load computation, however the request will always be allowed regardless of the outcome + // of quota application. This allows validation or testing of the rate limiting service + // infrastructure without disrupting existing traffic. + // + // Note: this only applies to the fraction of enabled requests. + // + // Defaults to 100% of requests. + config.core.v3.RuntimeFractionalPercent filter_enforced = 5; + + // Specifies a list of HTTP headers that should be added to each request that + // has been rate limited and is also forwarded upstream. This can only occur when the + // filter is enabled but not enforced. + repeated config.core.v3.HeaderValueOption request_headers_to_add_when_not_enforced = 6 + [(validate.rules).repeated = {max_items: 10}]; +} + +// Per-route and per-host configuration overrides. The more specific definition completely +// overrides the less specific definition. +message RateLimitQuotaOverride { + // The application domain to use when calling the service. This enables sharing the quota + // server between different applications without fear of overlap. + // E.g., "envoy". + // + // If empty, inherits the value from the less specific definition. + string domain = 1; + + // The match tree to use for grouping incoming requests into buckets. + // + // If set, fully overrides the bucket matchers provided on the less specific definition. + // If not set, inherits the value from the less specific definition. + // + // See usage example: :ref:`RateLimitQuotaFilterConfig.bucket_matchers + // `. + xds.type.matcher.v3.Matcher bucket_matchers = 2; +} + +// Rate Limit Quota Bucket Settings to apply on the successful ``bucket_matchers`` match. +// +// Specify this message in the :ref:`Matcher.OnMatch.action +// ` field of the +// ``bucket_matchers`` matcher tree to assign the matched requests to the Quota Bucket. +// Usage example: :ref:`RateLimitQuotaFilterConfig.bucket_matchers +// `. +// [#next-free-field: 6] +message RateLimitQuotaBucketSettings { + // Configures the behavior after the first request has been matched to the bucket, and before the + // the RLQS server returns the first quota assignment. + message NoAssignmentBehavior { + oneof no_assignment_behavior { + option (validate.required) = true; + + // Apply pre-configured rate limiting strategy until the server sends the first assignment. + type.v3.RateLimitStrategy fallback_rate_limit = 1; + } + } + + // Specifies the behavior when the bucket's assignment has expired, and cannot be refreshed for + // any reason. + message ExpiredAssignmentBehavior { + // Reuse the last known quota assignment, effectively extending it for the duration + // specified in the :ref:`expired_assignment_behavior_timeout + // ` + // field. + message ReuseLastAssignment { + } + + // Limit the time :ref:`ExpiredAssignmentBehavior + // ` + // is applied. If the server doesn't respond within this duration: + // + // 1. Selected ``ExpiredAssignmentBehavior`` is no longer applied. + // 2. The bucket is abandoned. The process of abandoning the bucket is described in the + // :ref:`AbandonAction ` + // message. + // 3. If a new request is matched into the bucket that has become abandoned, + // the data plane restarts the subscription to the bucket. The process of restarting the + // subscription is described in the :ref:`AbandonAction + // ` + // message. + // + // If not set, defaults to zero, and the bucket is abandoned immediately. + google.protobuf.Duration expired_assignment_behavior_timeout = 1 + [(validate.rules).duration = {gt {}}]; + + oneof expired_assignment_behavior { + option (validate.required) = true; + + // Apply the rate limiting strategy to all requests matched into the bucket until the RLQS + // server sends a new assignment, or the :ref:`expired_assignment_behavior_timeout + // ` + // runs out. + type.v3.RateLimitStrategy fallback_rate_limit = 2; + + // Reuse the last ``active`` assignment until the RLQS server sends a new assignment, or the + // :ref:`expired_assignment_behavior_timeout + // ` + // runs out. + ReuseLastAssignment reuse_last_assignment = 3; + } + } + + // Customize the deny response to the requests over the rate limit. + message DenyResponseSettings { + // HTTP response code to deny for HTTP requests (gRPC excluded). + // Defaults to 429 (:ref:`StatusCode.TooManyRequests`). + type.v3.HttpStatus http_status = 1; + + // HTTP response body used to deny for HTTP requests (gRPC excluded). + // If not set, an empty body is returned. + google.protobuf.BytesValue http_body = 2; + + // Configure the deny response for gRPC requests over the rate limit. + // Allows to specify the `RPC status code + // `_, + // and the error message. + // Defaults to the Status with the RPC Code ``UNAVAILABLE`` and empty message. + // + // To identify gRPC requests, Envoy checks that the ``Content-Type`` header is + // ``application/grpc``, or one of the various ``application/grpc+`` values. + // + // .. note:: + // The HTTP code for a gRPC response is always 200. + google.rpc.Status grpc_status = 3; + + // Specifies a list of HTTP headers that should be added to each response for requests that + // have been rate limited. Applies both to plain HTTP, and gRPC requests. + // The headers are added even when the rate limit quota was not enforced. + repeated config.core.v3.HeaderValueOption response_headers_to_add = 4 + [(validate.rules).repeated = {max_items: 10}]; + } + + // ``BucketIdBuilder`` makes it possible to build :ref:`BucketId + // ` with values substituted + // from the dynamic properties associated with each individual request. See usage examples in + // the docs to :ref:`bucket_id_builder + // ` + // field. + message BucketIdBuilder { + // Produces the value of the :ref:`BucketId + // ` map. + message ValueBuilder { + oneof value_specifier { + option (validate.required) = true; + + // Static string value — becomes the value in the :ref:`BucketId + // ` map as is. + string string_value = 1; + + // Dynamic value — evaluated for each request. Must produce a string output, which becomes + // the value in the :ref:`BucketId ` + // map. For example, extensions with the ``envoy.matching.http.input`` category can be used. + config.core.v3.TypedExtensionConfig custom_value = 2; + } + } + + // The map translated into the ``BucketId`` map. + // + // The ``string key`` of this map and becomes the key of ``BucketId`` map as is. + // + // The ``ValueBuilder value`` for the key can be: + // + // * static ``StringValue string_value`` — becomes the value in the ``BucketId`` map as is. + // * dynamic ``TypedExtensionConfig custom_value`` — evaluated for each request. Must produce + // a string output, which becomes the value in the the ``BucketId`` map. + // + // See usage examples in the docs to :ref:`bucket_id_builder + // ` + // field. + map bucket_id_builder = 1 [(validate.rules).map = {min_pairs: 1}]; + } + + // ``BucketId`` builder. + // + // :ref:`BucketId ` is a map from + // the string key to the string value which serves as bucket identifier common for on + // the control plane and the data plane. + // + // While ``BucketId`` is always static, ``BucketIdBuilder`` allows to populate map values + // with the dynamic properties associated with the each individual request. + // + // Example 1: static fields only + // + // ``BucketIdBuilder``: + // + // .. validated-code-block:: yaml + // :type-name: envoy.extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaBucketSettings.BucketIdBuilder + // + // bucket_id_builder: + // name: + // string_value: my_bucket + // hello: + // string_value: world + // + // Produces the following ``BucketId`` for all requests: + // + // .. validated-code-block:: yaml + // :type-name: envoy.service.rate_limit_quota.v3.BucketId + // + // bucket: + // name: my_bucket + // hello: world + // + // Example 2: static and dynamic fields + // + // .. validated-code-block:: yaml + // :type-name: envoy.extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaBucketSettings.BucketIdBuilder + // + // bucket_id_builder: + // name: + // string_value: my_bucket + // env: + // custom_value: + // typed_config: + // '@type': type.googleapis.com/envoy.type.matcher.v3.HttpRequestHeaderMatchInput + // header_name: environment + // + // In this example, the value of ``BucketId`` key ``env`` is substituted from the ``environment`` + // request header. + // + // This is equivalent to the following ``pseudo-code``: + // + // .. code-block:: yaml + // + // name: 'my_bucket' + // env: $header['environment'] + // + // For example, the request with the HTTP header ``env`` set to ``staging`` will produce + // the following ``BucketId``: + // + // .. validated-code-block:: yaml + // :type-name: envoy.service.rate_limit_quota.v3.BucketId + // + // bucket: + // name: my_bucket + // env: staging + // + // For the request with the HTTP header ``environment`` set to ``prod``, will produce: + // + // .. validated-code-block:: yaml + // :type-name: envoy.service.rate_limit_quota.v3.BucketId + // + // bucket: + // name: my_bucket + // env: prod + // + // .. note:: + // The order of ``BucketId`` keys do not matter. Buckets ``{ a: 'A', b: 'B' }`` and + // ``{ b: 'B', a: 'A' }`` are identical. + // + // If not set, requests will NOT be reported to the server, and will always limited + // according to :ref:`no_assignment_behavior + // ` + // configuration. + BucketIdBuilder bucket_id_builder = 1; + + // The interval at which the data plane (RLQS client) is to report quota usage for this bucket. + // + // When the first request is matched to a bucket with no assignment, the data plane is to report + // the request immediately in the :ref:`RateLimitQuotaUsageReports + // ` message. + // For the RLQS server, this signals that the data plane is now subscribed to + // the quota assignments in this bucket, and will start sending the assignment as described in + // the :ref:`RLQS documentation `. + // + // After sending the initial report, the data plane is to continue reporting the bucket usage with + // the internal specified in this field. + // + // If for any reason RLQS client doesn't receive the initial assignment for the reported bucket, + // the data plane will eventually consider the bucket abandoned and stop sending the usage + // reports. This is explained in more details at :ref:`Rate Limit Quota Service (RLQS) + // `. + // + // [#comment: 100000000 nanoseconds = 0.1 seconds] + google.protobuf.Duration reporting_interval = 2 [(validate.rules).duration = { + required: true + gt {nanos: 100000000} + }]; + + // Customize the deny response to the requests over the rate limit. + // If not set, the filter will be configured as if an empty message is set, + // and will behave according to the defaults specified in :ref:`DenyResponseSettings + // `. + DenyResponseSettings deny_response_settings = 3; + + // Configures the behavior in the "no assignment" state: after the first request has been + // matched to the bucket, and before the the RLQS server returns the first quota assignment. + // + // If not set, the default behavior is to allow all requests. + NoAssignmentBehavior no_assignment_behavior = 4; + + // Configures the behavior in the "expired assignment" state: the bucket's assignment has expired, + // and cannot be refreshed. + // + // If not set, the bucket is abandoned when its ``active`` assignment expires. + // The process of abandoning the bucket, and restarting the subscription is described in the + // :ref:`AbandonAction ` + // message. + ExpiredAssignmentBehavior expired_assignment_behavior = 5; +} diff --git a/modules/sync/envoyproxy/envoy/cas/c0b374171742f42295d7451d3f8d046d3dac45713ce950026ca36f838fb3201c80156d6eb198e19212506adbb16d61a41ac01ffe563e88e331f84f58e7e65050 b/modules/sync/envoyproxy/envoy/cas/c0b374171742f42295d7451d3f8d046d3dac45713ce950026ca36f838fb3201c80156d6eb198e19212506adbb16d61a41ac01ffe563e88e331f84f58e7e65050 new file mode 100644 index 00000000..1e6b3987 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/c0b374171742f42295d7451d3f8d046d3dac45713ce950026ca36f838fb3201c80156d6eb198e19212506adbb16d61a41ac01ffe563e88e331f84f58e7e65050 @@ -0,0 +1,187 @@ +syntax = "proto3"; + +package envoy.extensions.filters.network.reverse_tunnel.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/extensions/filters/common/jwks/v3/jwt_handshake.proto"; + +import "google/protobuf/duration.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.network.reverse_tunnel.v3"; +option java_outer_classname = "ReverseTunnelProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/reverse_tunnel/v3;reverse_tunnelv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Reverse Tunnel Network Filter] +// Reverse Tunnel Network Filter :ref:`configuration overview `. +// [#extension: envoy.filters.network.reverse_tunnel] + +// Validation configuration for reverse tunnel identifiers. +// Validates the node ID, cluster ID, and tenant ID extracted from reverse tunnel handshake headers +// against expected values specified using format strings. +// [#next-free-field: 6] +message Validation { + // Format string to extract the expected node identifier for validation. + // The formatted value is compared against the ``x-envoy-reverse-tunnel-node-id`` header + // from the incoming handshake request. If they do not match, the connection is rejected + // with HTTP ``403 Forbidden``. + // + // Supports Envoy's :ref:`command operators `: + // + // * ``%DYNAMIC_METADATA(namespace:key)%``: Extract expected value from dynamic metadata. + // * ``%FILTER_STATE(key)%``: Extract expected value from filter state. + // * ``%DOWNSTREAM_REMOTE_ADDRESS%``: Use downstream connection IP address. + // * Plain strings: Use a static expected value. + // + // If empty, node ID validation is skipped. + // + // Example using dynamic metadata allowlist: + // + // .. code-block:: yaml + // + // node_id_format: "%DYNAMIC_METADATA(envoy.reverse_tunnel.allowlist:expected_node_id)%" + // + string node_id_format = 1 [(validate.rules).string = {max_len: 1024}]; + + // Format string to extract the expected cluster identifier for validation. + // The formatted value is compared against the ``x-envoy-reverse-tunnel-cluster-id`` header + // from the incoming handshake request. If they do not match, the connection is rejected + // with HTTP ``403 Forbidden``. + // + // Supports the same :ref:`command operators ` as + // ``node_id_format``. + // + // If empty, cluster ID validation is skipped. + // + // Example using filter state: + // + // .. code-block:: yaml + // + // cluster_id_format: "%FILTER_STATE(expected_cluster_id)%" + // + string cluster_id_format = 2 [(validate.rules).string = {max_len: 1024}]; + + // Format string to extract the expected tenant identifier for validation. + // The formatted value is compared against the ``x-envoy-reverse-tunnel-tenant-id`` header + // from the incoming handshake request. If they do not match, the connection is rejected + // with HTTP ``403 Forbidden``. + // + // Supports the same :ref:`command operators ` as + // ``node_id_format``. + // + // If empty, tenant ID validation is skipped. + string tenant_id_format = 5 [(validate.rules).string = {max_len: 1024}]; + + // Whether to emit validation results as dynamic metadata. + // When enabled, the filter emits metadata under the namespace specified by + // ``dynamic_metadata_namespace`` containing: + // + // * ``node_id``: The actual node ID from the handshake request. + // * ``cluster_id``: The actual cluster ID from the handshake request. + // * ``tenant_id``: The actual tenant ID from the handshake request. + // * ``validation_result``: Either ``allowed`` or ``denied``. + // + // This metadata can be used by subsequent filters or for access logging. + // Defaults to ``false``. + bool emit_dynamic_metadata = 3; + + // Namespace for emitted dynamic metadata when ``emit_dynamic_metadata`` is ``true``. + // If not specified, defaults to ``envoy.filters.network.reverse_tunnel``. + string dynamic_metadata_namespace = 4 [(validate.rules).string = {max_len: 255}]; +} + +// Configuration for the reverse tunnel network filter. +// This filter handles reverse tunnel connection acceptance and rejection by processing +// HTTP requests where required identification values are provided via HTTP headers. +// [#next-free-field: 12] +message ReverseTunnel { + // Ping interval for health checks on established reverse tunnel connections. + // If not specified, defaults to ``2 seconds``. + google.protobuf.Duration ping_interval = 1 [(validate.rules).duration = { + lte {seconds: 300} + gte {nanos: 1000000} + }]; + + // Deprecated. The handshake connection is always detached once the acceptance response is + // flushed so tunnel bytes have a single reader. Ignored. + bool auto_close_connections = 2 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // HTTP path to match for reverse tunnel requests. + // If not specified, defaults to ``/reverse_connections/request``. + string request_path = 3 [(validate.rules).string = {min_len: 1 max_len: 255 ignore_empty: true}]; + + // HTTP method to match for reverse tunnel requests. + // If not specified (``METHOD_UNSPECIFIED``), this defaults to ``GET``. + config.core.v3.RequestMethod request_method = 4 [(validate.rules).enum = {defined_only: true}]; + + // Optional validation configuration for node, cluster, and tenant identifiers. + // If specified, the filter validates the ``x-envoy-reverse-tunnel-node-id``, + // ``x-envoy-reverse-tunnel-cluster-id``, and ``x-envoy-reverse-tunnel-tenant-id`` headers + // against expected values extracted using format strings. Requests that fail validation + // are rejected with HTTP ``403 Forbidden``. + Validation validation = 5; + + // Required cluster name for validating reverse tunnel connection initiations. + // When set, the filter validates that the upstream cluster of the initiator envoy matches this name + // via ``x-envoy-reverse-tunnel-upstream-cluster-name`` header. Connections with mismatched or missing + // cluster names are rejected with HTTP ``400 Bad Request``. When empty, no cluster name validation is performed. + string required_cluster_name = 6 [(validate.rules).string = {max_len: 255 ignore_empty: true}]; + + // Accept the handshake as an HTTP/1.1 ``Upgrade`` exchange (``Upgrade: reverse-tunnel``, + // reply ``101``) so HTTP proxies can route the handshake and splice the tunnel + // afterward. Non-upgrade requests are rejected with ``426``. The initiator must set this + // flag to the same value. + // Defaults to ``false``. + bool use_http_upgrade = 7; + + // When true, skip worker-thread rebalancing for accepted reverse tunnel connections. + // This avoids the cross-worker lock in pickLeastLoadedSocketManager. + // Default: false (rebalancing enabled). + bool skip_rebalancing = 8; + + // Optional JWT authentication for the handshake. When set, the bearer token carried in the + // handshake request is verified before the connection is accepted or its socket registered, so a + // forged or expired token can never produce a usable reverse tunnel. This runs on the real + // accepted socket, before registration, so it does not interfere with socket reuse. A missing or + // invalid token rejects the handshake with HTTP ``401 Unauthorized`` unless + // ``allow_missing_or_failed`` is set. + // + // On success, the verified claims are published as dynamic metadata (default namespace + // ``envoy.filters.network.reverse_tunnel.jwt``) so the :ref:`Validation + // ` block can bind a + // claimed handshake identifier to a verified claim, e.g.:: + // + // tenant_id_format: "%DYNAMIC_METADATA(envoy.filters.network.reverse_tunnel.jwt:tenant)%" + // + // forces the ``x-envoy-reverse-tunnel-tenant-id`` header to equal the verified ``tenant`` claim. + // Without such a binding, a token minted for one tenant can open a tunnel claiming another. + // + // Token verification is synchronous. With ``remote_jwks`` the keys are fetched and refreshed in the + // background (at startup and every ``cache_duration``) and cached, never on the accept path. Before + // the first successful fetch, or while a refresh is failing with nothing cached, every token is + // rejected. ``token_header`` defaults to ``authorization`` and ``clock_skew_seconds`` to 60. + // + // See :ref:`JwtHandshakeValidator + // `. + common.jwks.v3.JwtHandshakeValidator jwt_validator = 10; + + // Enforces the per-node concurrent connection cap (``max_connections_per_node``, configured on + // the ``UpstreamReverseConnectionSocketInterface`` bootstrap extension) for tunnels accepted by + // this filter. The cap is checked on the accepting worker but the connection is counted on the + // worker it is finally rebalanced to, so it is best-effort unless ``skip_rebalancing`` is ``true``. + // Default: false. + bool enable_connection_limit = 9; + + // Maximum time to receive a complete handshake request. If not specified, defaults to ``10s``. + // On expiry the connection is closed and ``handshake.timeout`` is incremented. + google.protobuf.Duration handshake_timeout = 11 [(validate.rules).duration = { + lte {seconds: 300} + gt {} + }]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/c30825cda00b1ad243a8c464c586bc2cf4dcaaa39da6603372e44ace30b5ecc2e4851c3d1254a7411ca4e2cf9bc5842d7cb3dac42477895f561d3e061e9c5ab4 b/modules/sync/envoyproxy/envoy/cas/c30825cda00b1ad243a8c464c586bc2cf4dcaaa39da6603372e44ace30b5ecc2e4851c3d1254a7411ca4e2cf9bc5842d7cb3dac42477895f561d3e061e9c5ab4 new file mode 100644 index 00000000..46d2949e --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/c30825cda00b1ad243a8c464c586bc2cf4dcaaa39da6603372e44ace30b5ecc2e4851c3d1254a7411ca4e2cf9bc5842d7cb3dac42477895f561d3e061e9c5ab4 @@ -0,0 +1,42 @@ +syntax = "proto3"; + +package envoy.type.ai.v3; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.type.ai.v3"; +option java_outer_classname = "LlmProtocolProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/type/ai/v3;aiv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: LLM protocol] + +// Identifies the AI API contract spoken on the wire. +// +// This names request/response schemas and streaming event semantics, not the +// organization operating the backend: OpenAI, Azure OpenAI, vLLM, and any +// other OpenAI-compatible backend all speak ``OPENAI_CHAT_COMPLETIONS``. +// Provider identity, when needed, must come from configuration or routing +// metadata. +// +// Response framing is separate: JSON, SSE, and streamed JSON-array variants +// of the same API share one ``LLMProtocol`` value. +enum LLMProtocol { + LLM_PROTOCOL_UNSPECIFIED = 0; + + // OpenAI-compatible ``/v1/chat/completions`` API. + OPENAI_CHAT_COMPLETIONS = 1; + + // OpenAI-compatible ``/v1/responses`` API. + OPENAI_RESPONSES = 2; + + // Anthropic-compatible ``/v1/messages`` API. + ANTHROPIC_MESSAGES = 3; + + // Gemini ``generateContent`` / ``streamGenerateContent`` APIs. + GEMINI_GENERATE_CONTENT = 4; +} diff --git a/modules/sync/envoyproxy/envoy/cas/c5fd77fd6b35a56306fbd1f9ba9381a940f3d5ed2c6046e2f4ebd4ee5bc2403a39616e299ea51a73a3dfd46d329b89cff851e849b31c41db1161b9a755348b93 b/modules/sync/envoyproxy/envoy/cas/c5fd77fd6b35a56306fbd1f9ba9381a940f3d5ed2c6046e2f4ebd4ee5bc2403a39616e299ea51a73a3dfd46d329b89cff851e849b31c41db1161b9a755348b93 new file mode 100644 index 00000000..8f0a774c --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/c5fd77fd6b35a56306fbd1f9ba9381a940f3d5ed2c6046e2f4ebd4ee5bc2403a39616e299ea51a73a3dfd46d329b89cff851e849b31c41db1161b9a755348b93 @@ -0,0 +1,193 @@ +syntax = "proto3"; + +package envoy.extensions.router.cluster_specifiers.priority_group.v3; + +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.router.cluster_specifiers.priority_group.v3"; +option java_outer_classname = "PriorityGroupProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/router/cluster_specifiers/priority_group/v3;priority_groupv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Priority Group Based Cluster Specifier] +// [#extension: envoy.router.cluster_specifier_plugin.priority_group] + +// A weighted cluster of a :ref:`priority group +// `. +message ClusterWeight { + // Name of the upstream cluster. + string cluster_name = 1 [(validate.rules).string = {min_len: 1}]; + + // Weight of the cluster relative to the other clusters of the same group. + google.protobuf.UInt32Value weight = 2 + [(validate.rules).uint32 = {gte: 1}, (validate.rules).message = {required: true}]; +} + +// A named group of weighted clusters. All the clusters of a group are considered to have the +// same priority and the target cluster is selected from the group based on the weights. +message PriorityGroup { + // Name of the group. The name is used to reference the group from the :ref:`override metadata + // ` + // and should be unique across all the groups of the same cluster specifier. If multiple groups + // share the same name, then the first one of them is used when the group is referenced by name. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // The candidate clusters of this group. + repeated ClusterWeight clusters = 2 [(validate.rules).repeated = {min_items: 1}]; +} + +// Cluster specifier plugin that selects a :ref:`priority group +// ` based +// on the attempt of the request first, and then selects a cluster from the selected group based +// on the weights of the clusters. +// +// The group is selected by the attempt count of the request: the initial attempt uses the first +// group of the list, the first retry uses the second group, and so on. If the attempt count +// exceeds the number of the available groups, then the last group of the list is used for all +// the remaining attempts. +// +// This plugin must be used together with the :ref:`refresh cluster on retry +// ` option of the retry +// policy to ensure the reselecting of the cluster on every attempt. +// +// See the :ref:`cluster specifier documentation +// ` for more details. +// +// Example: +// +// .. validated-code-block:: yaml +// :type-name: envoy.extensions.router.cluster_specifiers.priority_group.v3.PriorityGroupClusterSpecifier +// +// priority_groups: +// - name: local +// clusters: +// - cluster_name: local_primary +// weight: 80 +// - cluster_name: local_secondary +// weight: 20 +// - name: remote +// clusters: +// - cluster_name: remote_primary +// weight: 100 +// +// With the configuration above, the initial attempt will be routed to ``local_primary`` or +// ``local_secondary`` (80/20), and the first retry and every attempt after it will be routed to +// ``remote_primary``. +// +message PriorityGroupClusterSpecifier { + // The list of the priority groups. The order of the groups is the default selection order that + // is used when the :ref:`override metadata + // ` + // is not configured or not available in the request. + repeated PriorityGroup priority_groups = 1 [(validate.rules).repeated = {min_items: 1}]; + + // Optional dynamic metadata namespace that is used to override the priority groups on a + // per-request basis. If this is configured and the dynamic metadata of the request has a value + // under this namespace, then the priority groups of that value replace the configured + // :ref:`priority_groups + // ` + // for the request. + // + // The value of the namespace is read from the :ref:`typed dynamic metadata + // ` first, where it must be a + // :ref:`PriorityGroupsOverride + // ` + // message. If the namespace is not present there, then it is read from the :ref:`untyped + // dynamic metadata `, where it must + // be a struct with the same shape as the ``PriorityGroupsOverride`` message. + // + // The group of the current attempt is read from the overriding list in the same way as from the + // configured list: the initial attempt uses the first group, the first retry uses the second + // group, and so on, and the last group is used once the attempts go past the end of the list. + // + // An overriding group whose :ref:`clusters + // ` + // are set replaces the clusters and the weights of the group for the request. Note these + // clusters are not validated when the configuration is loaded and the request fails with a + // ``no cluster`` response if the selected cluster does not exist. An overriding group whose + // clusters are omitted or empty instead selects the configured priority group with the same + // :ref:`name + // ` + // and uses the configured clusters and weights of that group. + // + // The dynamic metadata is typically set by a filter that runs before the router filter, for + // example the :ref:`Lua filter ` or the :ref:`external processing + // filter `. + // + // .. note:: + // The route, and with it the cluster of the initial attempt, is resolved before the HTTP + // filter chain runs, so the filter that sets the metadata must also clear the route cache. + // + // Example of a matching untyped dynamic metadata value: + // + // .. code-block:: yaml + // + // envoy.my_filter: + // priority_groups: + // - name: remote + // clusters: + // - cluster_name: remote_primary + // weight: 20 + // - cluster_name: remote_secondary + // weight: 80 + // - name: local + // + // With the metadata value above, the initial attempt uses the group ``remote`` with the clusters + // and the weights of the metadata, and the first retry uses the configured group ``local`` with + // its configured clusters and weights. + // + // If the metadata namespace is missing, cannot be parsed as a ``PriorityGroupsOverride`` + // message, holds no group at all, or the group of the current attempt is not a valid override, + // then the configured ``priority_groups`` are used instead. + string override_metadata_namespace = 2; + + // The source of the random value that is used to select the target cluster of the selected + // priority group based on the cluster weights. If this is not configured, the internally + // generated random value of the request is used. The random value is only computed once for a + // request and the same value is reused for all the attempts of the request. + oneof random_value_specifier { + // Specifies the header name that is used to look up the random value passed in the request header. + // This is used to ensure consistent cluster picking across multiple proxy levels for weighted traffic. + // If header is not present or invalid, Envoy will fall back to use the internally generated random value. + // This header is expected to be single-valued header as we only want to have one selected value throughout + // the process for the consistency. And the value is a unsigned number between 0 and UINT64_MAX. + string header_name = 3 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // When set to true, the :ref:`hash policies + // ` of the route will be used to + // generate the random value for weighted cluster selection. + // This could ensure consistent cluster picking across multiple proxy levels for weighted traffic. + // If the route has no hash policy or the hash policies can not generate a hash for the request, + // Envoy will fall back to use the internally generated random value. + google.protobuf.BoolValue use_hash_policy = 4; + } +} + +// The value of the :ref:`override metadata +// ` +// that replaces the configured :ref:`priority_groups +// ` +// for a single request. +// +// This message is never part of the cluster specifier configuration, so it is not checked by the +// proto validation rules. A value that cannot be used, or a single group of it that cannot be +// used, is ignored and the configured priority groups are used instead. +message PriorityGroupsOverride { + // The ordered list of the overriding priority groups. The initial attempt of the request uses + // the first group, the first retry uses the second group, and so on. Once the attempts go past + // the end of the list, the last group is used for all the remaining attempts. + // + // Unlike a configured :ref:`priority group + // `, an + // overriding group may omit its :ref:`clusters + // ` + // to reuse the clusters and the weights of the configured group with the same :ref:`name + // `. + // An empty list means that there is no override at all. + repeated PriorityGroup priority_groups = 1; +} diff --git a/modules/sync/envoyproxy/envoy/cas/c6eb550a79d59fd94336007ea8e7939f348ba56ff6946a93a697059168c7987cd7fc11a992edb294d13e1cf4a3bfa171580eacff93010e8776eed75d141d4765 b/modules/sync/envoyproxy/envoy/cas/c6eb550a79d59fd94336007ea8e7939f348ba56ff6946a93a697059168c7987cd7fc11a992edb294d13e1cf4a3bfa171580eacff93010e8776eed75d141d4765 new file mode 100644 index 00000000..cf1b908b --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/c6eb550a79d59fd94336007ea8e7939f348ba56ff6946a93a697059168c7987cd7fc11a992edb294d13e1cf4a3bfa171580eacff93010e8776eed75d141d4765 @@ -0,0 +1,248 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.grpc_field_extraction.v3; + +import "envoy/config/core/v3/base.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.grpc_field_extraction.v3"; +option java_outer_classname = "ConfigProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/grpc_field_extraction/v3;grpc_field_extractionv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: gRPC Field Extraction] +// +// [#extension: envoy.filters.http.grpc_field_extraction] +// +// Overview +// -------- +// +// This filter supports extracting the fields from the first gRPC +// request message no matter if it is unary or streaming and writing the result +// to the destination, for which currently only the static Envoy dynamic metadata `envoy.filters.http.grpc_field_extraction` is supported. +// +// Assumptions +// ----------- +// +// This filter assumes +// +// 1. this filter is only applicable for gRPC with Protobuf as payload. +// 2. for bi-directional and client-side gRPC streaming, the initial message from the client should not depend on receiving the server initial metadata. +// +// Process Flow +// ------------ +// +// When a request reaches the filter, it will check +// +// 1. if the request is the gRPC request configured for extraction, the filter tries to: +// +// a. block the incoming data before decoding the first complete gRPC message +// b. look up the target field from the buffered gRPC message +// c. write the extraction result into the dynamic metadata and resume the request propagation. +// +// 2. otherwise, pass through the request. +// +// If the request is a malformed one found during 1.a or 1.b, the filter will reject the request. +// +// Config Requirements +// ------------------- +// +// Here are config requirements +// +// 1. the target field should be among the following primitive types: `string`, +// `uint32`, `uint64`, `int32`, `int64`, `sint32`, `sint64`, `fixed32`, +// `fixed64`, `sfixed32`, `sfixed64`, `float`, `double`, `map`. +// +// 2. the target field could be repeated. +// +// 3. the intermediate type could also be repeated. +// +// Output Format +// ------------- +// +// 1. the extracted field names/values will be wrapped in be ``field`` -> ``values``, which will be added in the dynamic ``metadata``. +// +// 2. if the field value is empty, an empty ``Value`` will be set. +// +// **IMPORTANT**: All extracted values are stored as ``ListValue``, even for singular (non-repeated) fields. +// Filters consuming this metadata (e.g., :ref:`ratelimit `) +// must use :ref:`MetadataKey ` with an ``index`` segment to access the value. +// +// Example: to access a singular ``string tenant_id`` field extracted to ``envoy.filters.http.grpc_field_extraction``: +// +// .. code-block:: yaml +// +// metadata_key: +// key: envoy.filters.http.grpc_field_extraction +// path: +// - key: tenant_id +// - index: 0 # Required: unwrap the ListValue containing the singular value +// +// Omitting the ``index`` segment will cause the consumer to receive the ``ListValue`` itself rather than +// its element, which typically results in empty or incorrect metadata descriptor values. +// +// Performance +// ----------- +// +// This filter should be performant as it +// +// 1. converts between the gRPC message from EnvoyBuffer without data copy. +// 2. parse the gRPC message binary directly without deserialization. +// +// though buffering the first message introduces some latency. +// +// Example +// ------- +// +// We have the following request definition for the gRPC method `pkg.svc.Method`. +// +// .. code-block:: proto +// +// message MethodRequest { +// string foo = 1; +// Nested nested = 2; +// uint32 baz = 3; +// ... +// } +// +// message Nested { +// repeated string bar = 1; +// } +// +// This is the filter config in JSON. +// +// .. code-block:: json +// +// { +// "descriptor_set":{}, +// "extractions_by_method":{ +// "pkg.svc.Method":{ +// "request_field_extractions":{ +// "foo":{ +// }, +// "nested.bar":{ +// } +// "baz":{ +// } +// } +// } +// } +// } +// +// During runtime, the filter receives the following `MethodRequest` message in JSON. +// +// .. code-block:: json +// +// { +// "foo": "val_foo", +// "nested": { "bar": ["val_bar1", "val_bar2"]} +// } +// +// The filter will write the following dynamic metadata(`envoy.filters.http.grpc_field_extraction`) in JSON. +// +// .. code-block:: json +// +// { +// "foo":[ +// "val_foo" +// ], +// "nested.bar":[ +// "val_bar1", "val_bar2" +// ] +// "baz":[ +// ] +// } +// +// Normalizing the metadata key +// ---------------------------- +// +// By default the dynamic metadata key is the field path. ``metadata_key`` overrides it, which +// allows different gRPC methods to write the same logical value under a common key. +// +// .. code-block:: json +// +// { +// "descriptor_set":{}, +// "extractions_by_method":{ +// "pkg.svc.Method":{ +// "request_field_extractions":{ +// "nested.bar":{ +// "metadata_key":"bar" +// } +// } +// } +// } +// } +// +// writes +// +// .. code-block:: json +// +// { +// "bar":[ +// "val_bar1", "val_bar2" +// ] +// } + +message GrpcFieldExtractionConfig { + // The proto descriptor set binary for the gRPC services. + // + // It could be passed by a local file through ``Datasource.filename`` or embedded in the + // ``Datasource.inline_bytes``. + config.core.v3.DataSource descriptor_set = 1 [(validate.rules).message = {required: true}]; + + // Specify the extraction info. + // The key is the fully qualified gRPC method name. + // ``${package}.${Service}.${Method}``, like + // ``endpoints.examples.bookstore.BookStore.GetShelf`` + // + // The value is the field extractions for individual gRPC method. + map extractions_by_method = 2; +} + +// This message can be used to support per route config approach later even +// though the Istio doesn't support that so far. +message FieldExtractions { + // The field extractions for requests. + // The key is the field path within the grpc request. + // For example, we can define ``foo.bar.name`` if we want to extract + // ``Request.foo.bar.name``. + // + // .. code-block:: proto + // + // message Request { + // Foo foo = 1; + // } + // + // message Foo { + // Bar bar = 1; + // } + // + // message Bar { + // string name = 1; + // } + map request_field_extractions = 1; +} + +message RequestFieldValueDisposition { + oneof disposition { + // The dynamic metadata namespace. If empty, "envoy.filters.http.grpc_field_extraction" will be used by default. + // + // Unimplemented. Uses "envoy.filters.http.grpc_field_extraction" for now. + string dynamic_metadata = 1; + } + + // The key that the extracted value is written to within the dynamic metadata. + // If empty, the field path (the key of ``request_field_extractions``) is used. + // + // This is useful for normalizing the metadata written by different gRPC methods whose + // request messages name the same logical field differently. + // + // Within a single gRPC method, two field extractions must not resolve to the same + // metadata key, otherwise the configuration is rejected. + string metadata_key = 2; +} diff --git a/modules/sync/envoyproxy/envoy/cas/ca7f51d5d43c160f9241e19698d8e240e2f3fa8d2ce3453866a3054116903aabed25541fe153fba0a900cc544c2b2be66247ed291cf1633b7fd291650c8790d2 b/modules/sync/envoyproxy/envoy/cas/ca7f51d5d43c160f9241e19698d8e240e2f3fa8d2ce3453866a3054116903aabed25541fe153fba0a900cc544c2b2be66247ed291cf1633b7fd291650c8790d2 new file mode 100644 index 00000000..0cf4b776 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/ca7f51d5d43c160f9241e19698d8e240e2f3fa8d2ce3453866a3054116903aabed25541fe153fba0a900cc544c2b2be66247ed291cf1633b7fd291650c8790d2 @@ -0,0 +1,61 @@ +syntax = "proto3"; + +package envoy.extensions.formatter.cel.v3; + +import "envoy/config/core/v3/cel.proto"; + +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.formatter.cel.v3"; +option java_outer_classname = "CelProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/formatter/cel/v3;celv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Formatter extension for printing CEL expressions] +// [#extension: envoy.formatter.cel] + +// CEL formatter extension implements CEL command operator that evaluates configured +// symbolic Common Expression Language expressions to generate an access log. +// +// See :ref:`here ` for more information on access log configuration. + +// %CEL(EXPRESSION):Z% +// Expressions are based on the set of Envoy :ref:`attributes `. +// Expression errors are considered `-`. Z is an optional parameter denoting string +// truncation up to Z characters long. +// +// Examples: +// +// * ``%CEL(response.code)%`` +// * ``%CEL(connection.mtls)%`` +// * ``%CEL(request.headers['x-envoy-original-path']):10%`` +// * ``%CEL(request.headers['x-log-mtls'] || request.url_path.contains('v1beta3'))%`` + +// Alternatively: %TYPED_CEL(EXPRESSION):Z% +// When using a non-text access log format like JSON, this format command is +// able to emit values of non-string types, like number, boolean, and null, +// based on the output of the CEL expression. It otherwise functions the same as +// %CEL%. CEL types not native to JSON are coerced as follows: +// +// * Bytes are base64 encoded to produce a string. +// * Durations are stringified as a count of seconds, e.g. `duration("1h30m")` +// becomes "5400s". +// * Timestamps are formatted to UTC, e.g. +// `timestamp("2023-08-26T12:39:00-07:00")` becomes +// "2023-08-26T19:39:00+00:00" +// * Maps become objects, provided all keys can be coerced to strings and that +// all values can coerce to types representable in JSON. +// * Lists become lists, provided all values can coerce to types representable +// in JSON. + +// Configuration for the CEL formatter. +// +// .. warning:: +// This extension is treated as a built-in extension and is enabled by default. +// It is unnecessary to configure this extension unless overriding the CEL expression runtime +// via ``cel_config``. +message Cel { + // Configuration for the CEL expression runtime used by this formatter. + config.core.v3.CelExpressionConfig cel_config = 1; +} diff --git a/modules/sync/envoyproxy/envoy/cas/cad99b38900a55cba98761d6c0e7bb4fdad8d2a3b0bd804c2cfbd7cae55f6f601638cf2aab40d2b5e92ca5bcda90b1f4c8f85192bdd893688f75351a66600dd2 b/modules/sync/envoyproxy/envoy/cas/cad99b38900a55cba98761d6c0e7bb4fdad8d2a3b0bd804c2cfbd7cae55f6f601638cf2aab40d2b5e92ca5bcda90b1f4c8f85192bdd893688f75351a66600dd2 new file mode 100644 index 00000000..c22e23fd --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/cad99b38900a55cba98761d6c0e7bb4fdad8d2a3b0bd804c2cfbd7cae55f6f601638cf2aab40d2b5e92ca5bcda90b1f4c8f85192bdd893688f75351a66600dd2 @@ -0,0 +1,440 @@ +syntax = "proto3"; + +package envoy.config.metrics.v3; + +import "envoy/config/core/v3/address.proto"; +import "envoy/type/matcher/v3/string.proto"; + +import "google/protobuf/any.proto"; +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.config.metrics.v3"; +option java_outer_classname = "StatsProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/config/metrics/v3;metricsv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Stats] +// Statistics :ref:`architecture overview `. + +// Configuration for pluggable stats sinks. +message StatsSink { + option (udpa.annotations.versioning).previous_message_type = "envoy.config.metrics.v2.StatsSink"; + + reserved 2; + + reserved "config"; + + // The name of the stats sink to instantiate. The name must match a supported + // stats sink. + // See the :ref:`extensions listed in typed_config below ` for the default list of available stats sink. + // Sinks optionally support tagged/multiple dimensional metrics. + string name = 1; + + // Stats sink specific configuration which depends on the sink being instantiated. See + // :ref:`StatsdSink ` for an example. + // [#extension-category: envoy.stats_sinks] + oneof config_type { + google.protobuf.Any typed_config = 3; + } +} + +// Statistics configuration such as tagging. +// [#next-free-field: 6] +message StatsConfig { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.metrics.v2.StatsConfig"; + + // Each stat name is independently processed through these tag specifiers. When a tag is + // matched, the first capture group is not immediately removed from the name, so later + // :ref:`TagSpecifiers ` can also match that + // same portion of the match. After all tag matching is complete, a tag-extracted version of + // the name is produced and is used in stats sinks that represent tags, such as Prometheus. + repeated TagSpecifier stats_tags = 1; + + // Use all default tag regexes specified in Envoy. These can be combined with + // custom tags specified in :ref:`stats_tags + // `. They will be processed before + // the custom tags. + // + // See :repo:`well_known_names.h ` for a list of the + // default tags in Envoy. + // + // If not provided, the value is assumed to be true. + google.protobuf.BoolValue use_all_default_tags = 2; + + // Inclusion/exclusion matcher for stat name creation. If not provided, all stats are instantiated + // as normal. Preventing the instantiation of certain families of stats can improve memory + // performance for Envoys running especially large configs. + // + // .. warning:: + // Excluding stats may affect Envoy's behavior in undocumented ways. See + // `issue #8771 `_ for more information. + // If any unexpected behavior changes are observed, please open a new issue immediately. + StatsMatcher stats_matcher = 3; + + // Defines rules for setting the histogram buckets. Rules are evaluated in order, and the first + // match is applied. If no match is found (or if no rules are set), the following default buckets + // are used: + // + // .. code-block:: json + // + // [ + // 0.5, + // 1, + // 5, + // 10, + // 25, + // 50, + // 100, + // 250, + // 500, + // 1000, + // 2500, + // 5000, + // 10000, + // 30000, + // 60000, + // 300000, + // 600000, + // 1800000, + // 3600000 + // ] + repeated HistogramBucketSettings histogram_bucket_settings = 4; + + // When set to ``true``, tag extractors specified in :ref:`stats_tags + // ` take precedence over the built-in + // default tag extractors that share the same ``tag_name``, instead of the default taking + // precedence. This allows overriding individual default Envoy tags (for example + // ``envoy.cluster_name``) while keeping :ref:`use_all_default_tags + // ` enabled, so it is not + // necessary to disable all defaults and re-declare every extractor. + // + // Has no effect when ``use_all_default_tags`` is ``false`` (no default extractors are added in + // that case). If not provided, the value is assumed to be false, preserving existing behavior + // where the default extractor takes precedence over custom extractors with the same ``tag_name``. + google.protobuf.BoolValue allow_default_tag_overrides = 5; +} + +// Configuration for disabling stat instantiation. +message StatsMatcher { + // The instantiation of stats is unrestricted by default. If the goal is to configure Envoy to + // instantiate all stats, there is no need to construct a StatsMatcher. + // + // However, StatsMatcher can be used to limit the creation of families of stats in order to + // conserve memory. Stats can either be disabled entirely, or they can be + // limited by either an exclusion or an inclusion list of :ref:`StringMatcher + // ` protos: + // + // * If ``reject_all`` is set to ``true``, no stats will be instantiated. If ``reject_all`` is set to + // ``false``, all stats will be instantiated. + // + // * If an exclusion list is supplied, any stat name matching *any* of the StringMatchers in the + // list will not instantiate. + // + // * If an inclusion list is supplied, no stats will instantiate, except those matching *any* of + // the StringMatchers in the list. + // + // + // A StringMatcher can be used to match against an exact string, a suffix / prefix, or a regex. + // **NB:** For performance reasons, it is highly recommended to use a prefix- or suffix-based + // matcher rather than a regex-based matcher. + // + // Example 1. Excluding all stats. + // + // .. code-block:: json + // + // { + // "statsMatcher": { + // "rejectAll": "true" + // } + // } + // + // Example 2. Excluding all cluster-specific stats, but not cluster-manager stats: + // + // .. code-block:: json + // + // { + // "statsMatcher": { + // "exclusionList": { + // "patterns": [ + // { + // "prefix": "cluster." + // } + // ] + // } + // } + // } + // + // Example 3. Including only manager-related stats: + // + // .. code-block:: json + // + // { + // "statsMatcher": { + // "inclusionList": { + // "patterns": [ + // { + // "prefix": "cluster_manager." + // }, + // { + // "prefix": "listener_manager." + // } + // ] + // } + // } + // } + // + + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.metrics.v2.StatsMatcher"; + + oneof stats_matcher { + option (validate.required) = true; + + // If ``reject_all`` is true, then all stats are disabled. If ``reject_all`` is false, then all + // stats are enabled. + bool reject_all = 1; + + // Exclusive match. All stats are enabled except for those matching one of the supplied + // StringMatcher protos. + type.matcher.v3.ListStringMatcher exclusion_list = 2; + + // Inclusive match. No stats are enabled except for those matching one of the supplied + // StringMatcher protos. + type.matcher.v3.ListStringMatcher inclusion_list = 3; + } +} + +// Designates a tag name and value pair. The value may be either a fixed value +// or a regex providing the value via capture groups. The specified tag will be +// unconditionally set if a fixed value, otherwise it will only be set if one +// or more capture groups in the regex match. +message TagSpecifier { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.metrics.v2.TagSpecifier"; + + // Attaches an identifier to the tag values to identify the tag being in the + // sink. Envoy has a set of default names and regexes to extract dynamic + // portions of existing stats, which can be found in :repo:`well_known_names.h + // ` in the Envoy repository. If a :ref:`tag_name + // ` is provided in the config and + // neither :ref:`regex ` or + // :ref:`fixed_value ` were specified, + // Envoy will attempt to find that name in its set of defaults and use the accompanying regex. + // + // .. note:: + // + // A stat name may be spelled in such a way that it matches two different + // tag extractors for the same tag name. In that case, all but one of the + // tag values will be dropped. It is not specified which tag value will be + // retained. The extraction will only occur for one of the extractors, and + // only the matched extraction will be removed from the tag name. + string tag_name = 1; + + oneof tag_value { + // Designates a tag to strip from the tag extracted name and provide as a named + // tag value for all statistics. This will only occur if any part of the name + // matches the regex provided with one or more capture groups. + // + // The first capture group identifies the portion of the name to remove. The + // second capture group (which will normally be nested inside the first) will + // designate the value of the tag for the statistic. If no second capture + // group is provided, the first will also be used to set the value of the tag. + // All other capture groups will be ignored. + // + // Example 1. a stat name ``cluster.foo_cluster.upstream_rq_timeout`` and + // one tag specifier: + // + // .. code-block:: json + // + // { + // "tag_name": "envoy.cluster_name", + // "regex": "^cluster\\.((.+?)\\.)" + // } + // + // Note that the regex will remove ``foo_cluster.`` making the tag extracted + // name ``cluster.upstream_rq_timeout`` and the tag value for + // ``envoy.cluster_name`` will be ``foo_cluster`` (note: there will be no + // ``.`` character because of the second capture group). + // + // Example 2. a stat name + // ``http.connection_manager_1.user_agent.ios.downstream_cx_total`` and two + // tag specifiers: + // + // .. code-block:: json + // + // [ + // { + // "tag_name": "envoy.http_user_agent", + // "regex": "^http(?=\\.).*?\\.user_agent\\.((.+?)\\.)\\w+?$" + // }, + // { + // "tag_name": "envoy.http_conn_manager_prefix", + // "regex": "^http\\.((.*?)\\.)" + // } + // ] + // + // The two regexes of the specifiers will be processed from the elaborated + // stat name. + // + // The first regex will save ``ios.`` as the tag value for ``envoy.http_user_agent``. It will + // leave it in the name for potential matching with additional tag specifiers. After all tag + // specifiers are processed the tags will be removed from the name. + // + // The second regex will populate tag ``envoy.http_conn_manager_prefix`` with value + // ``connection_manager_1.``, based on the original stat name. + // + // As a final step, the matched tags are removed, leaving + // ``http.user_agent.downstream_cx_total`` as the tag extracted name. + string regex = 2 [(validate.rules).string = {max_bytes: 1024}]; + + // Specifies a fixed tag value for the ``tag_name``. + string fixed_value = 3; + } +} + +// Specifies a matcher for stats and the buckets that matching stats should use. +message HistogramBucketSettings { + // The stats that this rule applies to. The match is applied to the original stat name + // before tag-extraction, for example ``cluster.exampleclustername.upstream_cx_length_ms``. + type.matcher.v3.StringMatcher match = 1 [(validate.rules).message = {required: true}]; + + // Each value is the upper bound of a bucket. Each bucket must be greater than 0 and unique. + // The order of the buckets does not matter. + repeated double buckets = 2 [(validate.rules).repeated = { + unique: true + items {double {gt: 0.0}} + }]; + + // Initial number of bins for the ``circllhist`` thread local histogram per time series. Default value is 100. + google.protobuf.UInt32Value bins = 3 [(validate.rules).uint32 = {lte: 46082 gt: 0}]; +} + +// Stats configuration proto schema for built-in ``envoy.stat_sinks.statsd`` sink. This sink does not support +// tagged metrics. +// [#extension: envoy.stat_sinks.statsd] +message StatsdSink { + option (udpa.annotations.versioning).previous_message_type = "envoy.config.metrics.v2.StatsdSink"; + + oneof statsd_specifier { + option (validate.required) = true; + + // The UDP address of a running `statsd `_ + // compliant listener. If specified, statistics will be flushed to this + // address. + core.v3.Address address = 1; + + // The name of a cluster that is running a TCP `statsd + // `_ compliant listener. If specified, + // Envoy will connect to this cluster to flush statistics. + string tcp_cluster_name = 2; + } + + // Optional custom prefix for StatsdSink. If + // specified, this will override the default prefix. + // For example: + // + // .. code-block:: json + // + // { + // "prefix" : "envoy-prod" + // } + // + // will change emitted stats to + // + // .. code-block:: cpp + // + // envoy-prod.test_counter:1|c + // envoy-prod.test_timer:5|ms + // + // Note that the default prefix, "envoy", will be used if a prefix is not + // specified. + // + // Stats with default prefix: + // + // .. code-block:: cpp + // + // envoy.test_counter:1|c + // envoy.test_timer:5|ms + string prefix = 3; + + // If true, histogram samples are scaled to milliseconds according to the histogram's unit + // before being reported as timers: samples of histograms recording microseconds are divided by + // 1000 and reported as a fractional millisecond value, while histograms recording milliseconds + // or without a declared unit are reported unchanged. By default every sample is reported + // unchanged with an ``ms`` suffix regardless of the histogram's unit, so histograms recording + // microseconds are reported a factor of 1000 off. + bool scale_histogram_units_to_milliseconds = 4; +} + +// Stats configuration proto schema for built-in ``envoy.stat_sinks.dog_statsd`` sink. +// The sink emits stats with `DogStatsD `_ +// compatible tags. Tags are configurable via :ref:`StatsConfig +// `. +// [#extension: envoy.stat_sinks.dog_statsd] +// [#next-free-field: 6] +message DogStatsdSink { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.metrics.v2.DogStatsdSink"; + + reserved 2; + + oneof dog_statsd_specifier { + option (validate.required) = true; + + // The UDP address of a running DogStatsD compliant listener. If specified, + // statistics will be flushed to this address. + core.v3.Address address = 1; + } + + // Optional custom metric name prefix. See :ref:`StatsdSink's prefix field + // ` for more details. + string prefix = 3; + + // Optional max datagram size to use when sending UDP messages. By default Envoy + // will emit one metric per datagram. By specifying a max-size larger than a single + // metric, Envoy will emit multiple, new-line separated metrics. The max datagram + // size should not exceed your network's MTU. + // + // Note that this value may not be respected if smaller than a single metric. + google.protobuf.UInt64Value max_bytes_per_datagram = 4 [(validate.rules).uint64 = {gt: 0}]; + + // If true, histogram samples are scaled to milliseconds according to the histogram's unit + // before being reported as timers. See :ref:`StatsdSink's scale_histogram_units_to_milliseconds + // field ` + // for more details. + bool scale_histogram_units_to_milliseconds = 5; +} + +// Stats configuration proto schema for built-in ``envoy.stat_sinks.hystrix`` sink. +// The sink emits stats in `text/event-stream +// `_ +// formatted stream for use by `Hystrix dashboard +// `_. +// +// Note that only a single HystrixSink should be configured. +// +// Streaming is started through an admin endpoint :http:get:`/hystrix_event_stream`. +// [#extension: envoy.stat_sinks.hystrix] +message HystrixSink { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.metrics.v2.HystrixSink"; + + // The number of buckets the rolling statistical window is divided into. + // + // Each time the sink is flushed, all relevant Envoy statistics are sampled and + // added to the rolling window (removing the oldest samples in the window + // in the process). The sink then outputs the aggregate statistics across the + // current rolling window to the event stream(s). + // + // ``rolling_window(ms)`` = ``stats_flush_interval(ms)`` * ``num_of_buckets`` + // + // More detailed explanation can be found in `Hystrix wiki + // `_. + int64 num_buckets = 1; +} diff --git a/modules/sync/envoyproxy/envoy/cas/cc3a720d04c0e522647d43261115f11d2b41a64d6c7a5670d69b0acf4abdfada1d10c21a120270acfc3b9adfd3b7307f8361df4bf40dd0715ebde4f1ae634e34 b/modules/sync/envoyproxy/envoy/cas/cc3a720d04c0e522647d43261115f11d2b41a64d6c7a5670d69b0acf4abdfada1d10c21a120270acfc3b9adfd3b7307f8361df4bf40dd0715ebde4f1ae634e34 new file mode 100644 index 00000000..90cf96ac --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/cc3a720d04c0e522647d43261115f11d2b41a64d6c7a5670d69b0acf4abdfada1d10c21a120270acfc3b9adfd3b7307f8361df4bf40dd0715ebde4f1ae634e34 @@ -0,0 +1,125 @@ +syntax = "proto3"; + +package envoy.extensions.filters.network.ext_proc.v3; + +import "envoy/config/core/v3/grpc_service.proto"; + +import "google/protobuf/duration.proto"; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.network.ext_proc.v3"; +option java_outer_classname = "ExtProcProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/ext_proc/v3;ext_procv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: External Processing Filter] +// External Processing Filter: Process network traffic using an external service. +// [#extension: envoy.filters.network.ext_proc] + +// The Network External Processing filter allows an external service to process raw TCP/UDP traffic +// in a flexible way using a bidirectional gRPC stream. Unlike the HTTP External Processing filter, +// this filter operates at the L4 (transport) layer, giving access to raw network traffic. +// +// The filter communicates with an external gRPC service that can: +// +// 1. Inspect traffic in both directions +// 2. Modify the network traffic +// 3. Control connection lifecycle (continue, close, or reset) +// +// By using the filter's processing mode, you can selectively choose which data +// directions to process (read, write or both), allowing for efficient processing. +// [#next-free-field: 8] +message NetworkExternalProcessor { + // The gRPC service that will process network traffic. + // This service must implement the NetworkExternalProcessor service + // defined in the proto file /envoy/service/network_ext_proc/v3/external_processor.proto. + config.core.v3.GrpcService grpc_service = 1; + + // By default, if the gRPC stream cannot be established, or if it is closed + // prematurely with an error, the filter will fail, leading to the close of connection. + // With this parameter set to true, however, then if the gRPC stream is prematurely closed + // or could not be opened, processing continues without error. + bool failure_mode_allow = 2; + + // Options for controlling processing behavior. + ProcessingMode processing_mode = 3; + + // Specifies the timeout for each individual message sent on the stream and + // when the filter is running in synchronous mode. Whenever + // the proxy sends a message on the stream that requires a response, it will + // reset this timer, and will stop processing and return an error (subject + // to the processing mode) if the timer expires. Default is 200 ms. + google.protobuf.Duration message_timeout = 4 [(validate.rules).duration = { + lte {seconds: 3600} + gte {} + }]; + + string stat_prefix = 5 [(validate.rules).string = {min_len: 1}]; + + // Options related to the sending and receiving of dynamic metadata. + MetadataOptions metadata_options = 6; + + // The data plane provides a number of :ref:`attributes ` + // for expressive policies. Each attribute name provided in this field will be + // evaluated against the connection and filter state and populated in the + // :ref:`ProcessingRequest.attributes ` field. + // See the :ref:`attribute documentation ` + // for the list of supported attributes and their types. + repeated string connection_attributes = 7; +} + +// Options for controlling processing behavior. +// Filter will reject the config if both read and write are SKIP mode. +message ProcessingMode { + // Defines how traffic should be handled by the external processor. + enum DataSendMode { + // Send the data to the external processor for processing whenever the data is ready. + STREAMED = 0; + + // Skip sending the data to the external processor. + SKIP = 1; + } + + // Controls whether inbound (read) data from the client is sent to the external processor. + // Default: STREAMED + DataSendMode process_read = 1; + + // Controls whether outbound (write) data to the client is sent to the external processor. + // Default: STREAMED + DataSendMode process_write = 2; +} + +// The MetadataOptions structure defines options for sending dynamic metadata. Specifically, +// which namespaces to send to the server. +message MetadataOptions { + message MetadataNamespaces { + // Specifies a list of metadata namespaces whose values, if present, + // will be passed to the ext_proc service as an opaque *protobuf::Struct*. + repeated string untyped = 1; + + // Specifies a list of metadata namespaces whose values, if present, + // will be passed to the ext_proc service as a *protobuf::Any*. This allows + // envoy and the external processing server to share the protobuf message + // definition for safe parsing. + repeated string typed = 2; + } + + // Describes which typed or untyped dynamic metadata namespaces to forward to + // the external processing server. + MetadataNamespaces forwarding_namespaces = 1; + + // Describes which typed or untyped dynamic metadata namespaces to receive + // from the external processing server. + // Since the server returns untyped dynamic metadata, this configuration acts + // as a allowlist. Only metadata namespaces explicitly listed here will be + // ingested by Envoy from the server's response. + // Receiving of typed metadata is not supported. + // Set to empty or leave unset to disallow writing any received dynamic metadata. + MetadataNamespaces receiving_namespaces = 2; +} diff --git a/modules/sync/envoyproxy/envoy/cas/cda524b2a1908462490b81541b602147412724271fcf51e250dd525866ff0365cf20a893d6b4aa94b32843764f574e93cfa05b1e1ff823a6c5270d3446a195ba b/modules/sync/envoyproxy/envoy/cas/cda524b2a1908462490b81541b602147412724271fcf51e250dd525866ff0365cf20a893d6b4aa94b32843764f574e93cfa05b1e1ff823a6c5270d3446a195ba new file mode 100644 index 00000000..9b2c639b --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/cda524b2a1908462490b81541b602147412724271fcf51e250dd525866ff0365cf20a893d6b4aa94b32843764f574e93cfa05b1e1ff823a6c5270d3446a195ba @@ -0,0 +1,467 @@ +syntax = "proto3"; + +package envoy.config.core.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/event_service_config.proto"; +import "envoy/config/core/v3/extension.proto"; +import "envoy/config/core/v3/proxy_protocol.proto"; +import "envoy/type/matcher/v3/string.proto"; +import "envoy/type/v3/http.proto"; +import "envoy/type/v3/range.proto"; + +import "google/protobuf/any.proto"; +import "google/protobuf/duration.proto"; +import "google/protobuf/struct.proto"; +import "google/protobuf/wrappers.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.config.core.v3"; +option java_outer_classname = "HealthCheckProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/config/core/v3;corev3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Health check] +// * Health checking :ref:`architecture overview `. +// * If health checking is configured for a cluster, additional statistics are emitted. They are +// documented :ref:`here `. + +// Endpoint health status. +enum HealthStatus { + // The health status is not known. This is interpreted by Envoy as ``HEALTHY``. + UNKNOWN = 0; + + // Healthy. + HEALTHY = 1; + + // Unhealthy. + UNHEALTHY = 2; + + // Connection draining in progress. E.g., + // ``_ + // or + // ``_. + // This is interpreted by Envoy as ``UNHEALTHY``. + DRAINING = 3; + + // Health check timed out. This is part of HDS and is interpreted by Envoy as + // ``UNHEALTHY``. + TIMEOUT = 4; + + // Degraded. + DEGRADED = 5; +} + +message HealthStatusSet { + // An order-independent set of health status. + repeated HealthStatus statuses = 1 + [(validate.rules).repeated = {items {enum {defined_only: true}}}]; +} + +// [#next-free-field: 28] +message HealthCheck { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.HealthCheck"; + + // Describes the encoding of the payload bytes in the payload. + message Payload { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.core.HealthCheck.Payload"; + + oneof payload { + option (validate.required) = true; + + // Hex encoded payload. E.g., "000000FF". + string text = 1 [(validate.rules).string = {min_len: 1}]; + + // Binary payload. + bytes binary = 2; + } + } + + // [#next-free-field: 16] + message HttpHealthCheck { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.core.HealthCheck.HttpHealthCheck"; + + reserved 5, 7; + + reserved "service_name", "use_http2"; + + // The value of the host header in the HTTP health check request. If + // left empty (default value), the name of the cluster this health check is associated + // with will be used. The host header can be customized for a specific endpoint by setting the + // :ref:`hostname ` field. + string host = 1 [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE}]; + + // Specifies the HTTP path that will be requested during health checking. For example + // ``/healthcheck``. + string path = 2 [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_VALUE}]; + + // HTTP specific payload to be sent as the request body during health checking. + // If specified, the method should support a request body (POST, PUT, PATCH, etc.). + Payload send = 3; + + // Specifies a list of HTTP expected responses to match in the first ``response_buffer_size`` bytes of the response body. + // If it is set, both the expected response check and status code determine the health check. + // When checking the response, “fuzzy” matching is performed such that each payload block must be found, + // and in the order specified, but not necessarily contiguous. + // + // .. note:: + // + // It is recommended to set ``response_buffer_size`` based on the total Payload size for efficiency. + // The default buffer size is 1024 bytes when it is not set. + repeated Payload receive = 4; + + // Specifies the size of response buffer in bytes that is used to Payload match. + // The default value is 1024. Setting to 0 implies that the Payload will be matched against the entire response. + google.protobuf.UInt64Value response_buffer_size = 14 [(validate.rules).uint64 = {gte: 0}]; + + // Specifies a list of HTTP headers that should be added to each request that is sent to the + // health checked cluster. For more information, including details on header value syntax, see + // the documentation on :ref:`custom request headers + // `. + repeated HeaderValueOption request_headers_to_add = 6 + [(validate.rules).repeated = {max_items: 1000}]; + + // Specifies a list of HTTP headers that should be removed from each request that is sent to the + // health checked cluster. + repeated string request_headers_to_remove = 8 [(validate.rules).repeated = { + items {string {well_known_regex: HTTP_HEADER_NAME strict: false}} + }]; + + // Specifies a list of HTTP response statuses considered healthy. If provided, replaces default + // 200-only policy - 200 must be included explicitly as needed. Ranges follow half-open + // semantics of :ref:`Int64Range `. The start and end of each + // range are required. Only statuses in the range [100, 600) are allowed. + repeated type.v3.Int64Range expected_statuses = 9; + + // Specifies a list of HTTP response statuses considered retriable. If provided, responses in this range + // will count towards the configured :ref:`unhealthy_threshold `, + // but will not result in the host being considered immediately unhealthy. Ranges follow half-open semantics of + // :ref:`Int64Range `. The start and end of each range are required. + // Only statuses in the range [100, 600) are allowed. The :ref:`expected_statuses ` + // field takes precedence for any range overlaps with this field i.e. if status code 200 is both retriable and expected, a 200 response will + // be considered a successful health check. By default all responses not in + // :ref:`expected_statuses ` will result in + // the host being considered immediately unhealthy i.e. if status code 200 is expected and there are no configured retriable statuses, any + // non-200 response will result in the host being marked unhealthy. + repeated type.v3.Int64Range retriable_statuses = 12; + + // Use specified application protocol for health checks. With :ref:`use_alpn_protocol + // ` this is + // the codec used when ALPN settles on neither ``h2`` nor ``http/1.1``. + type.v3.CodecClientType codec_client_type = 10 [(validate.rules).enum = {defined_only: true}]; + + // Select the codec from the protocol negotiated by ALPN on the health check connection: HTTP/2 + // when ``h2`` is negotiated, HTTP/1.1 when ``http/1.1`` is negotiated, and otherwise + // ``codec_client_type``, including when nothing is negotiated. With ``codec_client_type`` at + // its default this is the same mapping as the cluster's :ref:`auto_config + // `. Like + // ``auto_config``, it requires a transport socket that supports ALPN such as TLS and is + // rejected on a cluster whose transport sockets do not, unless the + // ``config.do_not_validate_alpn_support`` runtime key is set, as for ``auto_config``. It + // cannot be combined with ``codec_client_type`` ``HTTP3``. See :ref:`tls_options + // ` for what the connection + // advertises. + bool use_alpn_protocol = 15; + + // An optional service name parameter which is used to validate the identity of + // the health checked cluster using a :ref:`StringMatcher + // `. See the :ref:`architecture overview + // ` for more information. + type.matcher.v3.StringMatcher service_name_matcher = 11; + + // HTTP Method that will be used for health checking, default is "GET". + // GET, HEAD, POST, PUT, DELETE, OPTIONS, TRACE, PATCH methods are supported. + // Request body payloads are supported for POST, PUT, PATCH, and OPTIONS methods only. + // CONNECT method is disallowed because it is not appropriate for health check request. + // If a non-200 response is expected by the method, it needs to be set in :ref:`expected_statuses `. + RequestMethod method = 13 [(validate.rules).enum = {defined_only: true not_in: 6}]; + } + + message TcpHealthCheck { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.core.HealthCheck.TcpHealthCheck"; + + // Empty payloads imply a connect-only health check. + Payload send = 1; + + // When checking the response, “fuzzy” matching is performed such that each + // payload block must be found, and in the order specified, but not + // necessarily contiguous. + repeated Payload receive = 2; + + // When setting this value, it tries to attempt health check request with ProxyProtocol. + // When ``send`` is presented, they are sent after preceding ProxyProtocol header. + // Only ProxyProtocol header is sent when ``send`` is not presented. + // It allows to use both ProxyProtocol V1 and V2. In V1, it presents L3/L4. In V2, it includes + // LOCAL command and doesn't include L3/L4. + ProxyProtocolConfig proxy_protocol_config = 3; + } + + message RedisHealthCheck { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.core.HealthCheck.RedisHealthCheck"; + + // If set, optionally perform ``EXISTS `` instead of ``PING``. A return value + // from Redis of 0 (does not exist) is considered a passing healthcheck. A return value other + // than 0 is considered a failure. This allows the user to mark a Redis instance for maintenance + // by setting the specified key to any value and waiting for traffic to drain. + string key = 1; + } + + // `grpc.health.v1.Health + // `_-based + // healthcheck. See `gRPC doc `_ + // for details. + message GrpcHealthCheck { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.core.HealthCheck.GrpcHealthCheck"; + + // An optional service name parameter which will be sent to gRPC service in + // `grpc.health.v1.HealthCheckRequest + // `_. + // message. See `gRPC health-checking overview + // `_ for more information. + string service_name = 1; + + // The value of the :authority header in the gRPC health check request. If + // left empty (default value), the name of the cluster this health check is associated + // with will be used. The authority header can be customized for a specific endpoint by setting + // the :ref:`hostname ` field. + string authority = 2 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE strict: false}]; + + // Specifies a list of key-value pairs that should be added to the metadata of each GRPC call + // that is sent to the health checked cluster. For more information, including details on header value syntax, + // see the documentation on :ref:`custom request headers + // `. + repeated HeaderValueOption initial_metadata = 3 [(validate.rules).repeated = {max_items: 1000}]; + } + + // Custom health check. + message CustomHealthCheck { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.core.HealthCheck.CustomHealthCheck"; + + reserved 2; + + reserved "config"; + + // The registered name of the custom health checker. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + // A custom health checker specific configuration which depends on the custom health checker + // being instantiated. See :api:`envoy/config/health_checker` for reference. + // [#extension-category: envoy.health_checkers] + oneof config_type { + google.protobuf.Any typed_config = 3; + } + } + + // Health checks occur over the transport socket specified for the cluster. This implies that if a + // cluster is using a TLS-enabled transport socket, the health check will also occur over TLS. + // + // This allows overriding the cluster TLS settings, just for health check connections. + message TlsOptions { + option (udpa.annotations.versioning).previous_message_type = + "envoy.api.v2.core.HealthCheck.TlsOptions"; + + // Specifies the ALPN protocols for health check connections. This is useful if the + // corresponding upstream is using ALPN-based :ref:`FilterChainMatch + // ` along with different protocols for health checks + // versus data connections. If empty, health check connections advertise the ALPN protocols of + // the cluster's TLS context, if any. With :ref:`use_alpn_protocol + // `, + // the negotiated protocol selects the health check codec. + repeated string alpn_protocols = 1; + } + + reserved 10; + + // Optional name for this health checker. When set, per-checker stats are emitted under + // ``health_check.name..`` instead of ``health_check.``. + // + // This is required if multiple health checks are configured on a cluster. + string name = 27; + + // The time to wait for a health check response. If the timeout is reached the + // health check attempt will be considered a failure. + google.protobuf.Duration timeout = 1 [(validate.rules).duration = { + required: true + gt {} + }]; + + // The interval between health checks. + google.protobuf.Duration interval = 2 [(validate.rules).duration = { + required: true + gt {} + }]; + + // An optional jitter amount in milliseconds. If specified, Envoy will start health + // checking after for a random time in ms between 0 and initial_jitter. This only + // applies to the first health check. + google.protobuf.Duration initial_jitter = 20; + + // An optional jitter amount in milliseconds. If specified, during every + // interval Envoy will add interval_jitter to the wait time. + google.protobuf.Duration interval_jitter = 3; + + // An optional jitter amount as a percentage of interval_ms. If specified, + // during every interval Envoy will add ``interval_ms`` * + // ``interval_jitter_percent`` / 100 to the wait time. + // + // If interval_jitter_ms and interval_jitter_percent are both set, both of + // them will be used to increase the wait time. + uint32 interval_jitter_percent = 18; + + // The number of unhealthy health checks required before a host is marked + // unhealthy. Note that for ``http`` health checking if a host responds with a code not in + // :ref:`expected_statuses ` + // or :ref:`retriable_statuses `, + // this threshold is ignored and the host is considered immediately unhealthy. + google.protobuf.UInt32Value unhealthy_threshold = 4 [(validate.rules).message = {required: true}]; + + // The number of healthy health checks required before a host is marked + // healthy. Note that during startup, only a single successful health check is + // required to mark a host healthy. + google.protobuf.UInt32Value healthy_threshold = 5 [(validate.rules).message = {required: true}]; + + // [#not-implemented-hide:] Non-serving port for health checking. + google.protobuf.UInt32Value alt_port = 6; + + // Reuse health check connection between health checks. Default is true. + google.protobuf.BoolValue reuse_connection = 7; + + oneof health_checker { + option (validate.required) = true; + + // HTTP health check. + HttpHealthCheck http_health_check = 8; + + // TCP health check. + TcpHealthCheck tcp_health_check = 9; + + // gRPC health check. + GrpcHealthCheck grpc_health_check = 11; + + // Custom health check. + CustomHealthCheck custom_health_check = 13; + } + + // The "no traffic interval" is a special health check interval that is used when a cluster has + // never had traffic routed to it. This lower interval allows cluster information to be kept up to + // date, without sending a potentially large amount of active health checking traffic for no + // reason. Once a cluster has been used for traffic routing, Envoy will shift back to using the + // standard health check interval that is defined. Note that this interval takes precedence over + // any other. + // + // The default value for "no traffic interval" is 60 seconds. + google.protobuf.Duration no_traffic_interval = 12 [(validate.rules).duration = {gt {}}]; + + // The "no traffic healthy interval" is a special health check interval that + // is used for hosts that are currently passing active health checking + // (including new hosts) when the cluster has received no traffic. + // + // This is useful for when we want to send frequent health checks with + // ``no_traffic_interval`` but then revert to lower frequency ``no_traffic_healthy_interval`` once + // a host in the cluster is marked as healthy. + // + // Once a cluster has been used for traffic routing, Envoy will shift back to using the + // standard health check interval that is defined. + // + // If no_traffic_healthy_interval is not set, it will default to the + // no traffic interval and send that interval regardless of health state. + google.protobuf.Duration no_traffic_healthy_interval = 24 [(validate.rules).duration = {gt {}}]; + + // The "unhealthy interval" is a health check interval that is used for hosts that are marked as + // unhealthy. As soon as the host is marked as healthy, Envoy will shift back to using the + // standard health check interval that is defined. + // + // The default value for "unhealthy interval" is the same as "interval". + google.protobuf.Duration unhealthy_interval = 14 [(validate.rules).duration = {gt {}}]; + + // The "unhealthy edge interval" is a special health check interval that is used for the first + // health check right after a host is marked as unhealthy. For subsequent health checks + // Envoy will shift back to using either "unhealthy interval" if present or the standard health + // check interval that is defined. + // + // The default value for "unhealthy edge interval" is the same as "unhealthy interval". + google.protobuf.Duration unhealthy_edge_interval = 15 [(validate.rules).duration = {gt {}}]; + + // The "healthy edge interval" is a special health check interval that is used for the first + // health check right after a host is marked as healthy. For subsequent health checks + // Envoy will shift back to using the standard health check interval that is defined. + // + // The default value for "healthy edge interval" is the same as the default interval. + google.protobuf.Duration healthy_edge_interval = 16 [(validate.rules).duration = {gt {}}]; + + // Specifies the path to the :ref:`health check event log `. + // + // .. attention:: + // This field is deprecated in favor of the extension + // :ref:`event_logger ` and + // :ref:`event_log_path ` + // in the file sink extension. + string event_log_path = 17 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // A list of event log sinks to process the health check event. + // [#extension-category: envoy.health_check.event_sinks] + repeated TypedExtensionConfig event_logger = 25; + + // [#not-implemented-hide:] + // The gRPC service for the health check event service. + // If empty, health check events won't be sent to a remote endpoint. + EventServiceConfig event_service = 22; + + // If set to true, health check failure events will always be logged. If set to false, only the + // initial health check failure event will be logged. + // The default value is false. + bool always_log_health_check_failures = 19; + + // If set to true, health check success events will always be logged. If set to false, only host addition event will be logged + // if it is the first successful health check, or if the healthy threshold is reached. + // The default value is false. + bool always_log_health_check_success = 26; + + // This allows overriding the cluster TLS settings, just for health check connections. + TlsOptions tls_options = 21; + + // Optional key/value pairs that will be used to match a transport socket from those specified in the cluster's + // :ref:`tranport socket matches `. + // For example, the following match criteria + // + // .. code-block:: yaml + // + // transport_socket_match_criteria: + // useMTLS: true + // + // Will match the following :ref:`cluster socket match ` + // + // .. code-block:: yaml + // + // transport_socket_matches: + // - name: "useMTLS" + // match: + // useMTLS: true + // transport_socket: + // name: envoy.transport_sockets.tls + // config: { ... } # tls socket configuration + // + // If this field is set, then for health checks it will supersede an entry of ``envoy.transport_socket`` in the + // :ref:`LbEndpoint.Metadata `. + // This allows using different transport socket capabilities for health checking versus proxying to the + // endpoint. + // + // If the key/values pairs specified do not match any + // :ref:`transport socket matches `, + // the cluster's :ref:`transport socket ` + // will be used for health check socket configuration. + google.protobuf.Struct transport_socket_match_criteria = 23; +} diff --git a/modules/sync/envoyproxy/envoy/cas/d390dda96435e41cc43e4e950e0e287a2ba7a29c9377b73ce64e81bd9fe2098725eb8af751addc9845d89067141a36c34af023b4c7390d96c577c3506dd8102c b/modules/sync/envoyproxy/envoy/cas/d390dda96435e41cc43e4e950e0e287a2ba7a29c9377b73ce64e81bd9fe2098725eb8af751addc9845d89067141a36c34af023b4c7390d96c577c3506dd8102c new file mode 100644 index 00000000..63c2f406 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/d390dda96435e41cc43e4e950e0e287a2ba7a29c9377b73ce64e81bd9fe2098725eb8af751addc9845d89067141a36c34af023b4c7390d96c577c3506dd8102c @@ -0,0 +1,61 @@ +syntax = "proto3"; + +package envoy.extensions.bootstrap.reverse_tunnel.upstream_socket_interface.v3; + +import "envoy/config/accesslog/v3/accesslog.proto"; +import "envoy/config/core/v3/extension.proto"; + +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.bootstrap.reverse_tunnel.upstream_socket_interface.v3"; +option java_outer_classname = "UpstreamReverseConnectionSocketInterfaceProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/v3;upstream_socket_interfacev3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Upstream reverse connection socket interface] +// [#extension: envoy.bootstrap.reverse_tunnel.upstream_socket_interface] + +// Configuration for the upstream reverse connection socket interface. +// [#next-free-field: 8] +message UpstreamReverseConnectionSocketInterface { + // Stat prefix for upstream reverse connection socket interface stats. + string stat_prefix = 1; + + // Number of consecutive ping failures before an idle reverse connection socket is marked dead. + // Defaults to 3 if unset. Must be at least 1. + google.protobuf.UInt32Value ping_failure_threshold = 2 [(validate.rules).uint32 = {gte: 1}]; + + // Enable detailed per-node and per-cluster statistics. + // When enabled, emits hidden statistics for individual nodes and clusters. + // Defaults to false. + bool enable_detailed_stats = 3; + + // Optional configuration for a tunnel reporting extension. When provided, + // the socket interface instantiates a reporter via the configured factory. + // If unset, no reporting is done. + config.core.v3.TypedExtensionConfig reporter_config = 4; + + // Enables tenant-aware isolation for reverse connections. When set to ``true``, the socket + // interface requires tenant identifiers in addition to node and cluster identifiers and derives + // composite ``tenant:node`` and ``tenant:cluster`` keys for socket tracking. Identifiers + // containing the ``:`` delimiter are rejected to avoid ambiguity. + // Defaults to ``false`` for backwards compatibility. + google.protobuf.BoolValue enable_tenant_isolation = 5; + + // Access logs emitted for reverse tunnel lifecycle events. Entries are generated for tunnel setup, + // socket handoff, tunnel close, and post-handoff HTTP/2 keepalive timeout observations. + repeated config.accesslog.v3.AccessLog access_log = 6; + + // Maximum number of concurrently accepted reverse connections per node (and per tenant + // when tenant isolation is enabled). The cap is only consulted for reverse tunnel network + // filters that opt in via ``enable_connection_limit``; filters that leave it disabled ignore it. + // The cap is enforced per worker thread, so the effective ceiling is roughly this value + // multiplied by the number of workers; it is also only approximate when rebalancing is enabled. + // Defaults to 0; combined with ``enable_connection_limit: true`` a value of 0 rejects all + // connections, so set a non-zero value whenever a filter enables the limit. + uint32 max_connections_per_node = 7; +} diff --git a/modules/sync/envoyproxy/envoy/cas/d471ed2f786afbbda352903ab63002898eeae4e36fde297b9037752c1f060560a835b6bdaeadbbe62f13fb821a71c4ea64f5057fb4cfadc1747c2c30207bd5af b/modules/sync/envoyproxy/envoy/cas/d471ed2f786afbbda352903ab63002898eeae4e36fde297b9037752c1f060560a835b6bdaeadbbe62f13fb821a71c4ea64f5057fb4cfadc1747c2c30207bd5af new file mode 100644 index 00000000..3efec163 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/d471ed2f786afbbda352903ab63002898eeae4e36fde297b9037752c1f060560a835b6bdaeadbbe62f13fb821a71c4ea64f5057fb4cfadc1747c2c30207bd5af @@ -0,0 +1,278 @@ +syntax = "proto3"; + +package envoy.extensions.filters.udp.udp_proxy.v3; + +import "envoy/config/accesslog/v3/accesslog.proto"; +import "envoy/config/core/v3/backoff.proto"; +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/config_source.proto"; +import "envoy/config/core/v3/extension.proto"; +import "envoy/config/core/v3/udp_socket_config.proto"; + +import "google/protobuf/any.proto"; +import "google/protobuf/duration.proto"; +import "google/protobuf/wrappers.proto"; + +import "xds/annotations/v3/status.proto"; +import "xds/type/matcher/v3/matcher.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.udp.udp_proxy.v3"; +option java_outer_classname = "UdpProxyProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/udp/udp_proxy/v3;udp_proxyv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: UDP proxy] +// UDP proxy :ref:`configuration overview `. +// [#extension: envoy.filters.udp_listener.udp_proxy] + +// Configuration for the UDP proxy filter. +// [#next-free-field: 14] +message UdpProxyConfig { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.udp.udp_proxy.v2alpha.UdpProxyConfig"; + + // Specifies the UDP hash policy. + // The packets can be routed by hash policy. + message HashPolicy { + oneof policy_specifier { + option (validate.required) = true; + + // The source IP will be used to compute the hash used by hash-based load balancing algorithms. + bool source_ip = 1 [(validate.rules).bool = {const: true}]; + + // A given key will be used to compute the hash used by hash-based load balancing algorithms. + // In certain cases there is a need to direct different UDP streams jointly towards the selected set of endpoints. + // A possible use-case is VoIP telephony, where media (RTP) and its corresponding control (RTCP) belong to the same logical session, + // although they travel in separate streams. To ensure that these pair of streams are load-balanced on session level + // (instead of individual stream level), dynamically created listeners can use the same hash key for each stream in the session. + string key = 2 [(validate.rules).string = {min_len: 1}]; + } + } + + // Configuration for UDP session filters. + message SessionFilter { + // The name of the filter configuration. + string name = 1 [(validate.rules).string = {min_len: 1}]; + + oneof config_type { + // Filter specific configuration which depends on the filter being + // instantiated. See the supported filters for further documentation. + google.protobuf.Any typed_config = 2; + + // Configuration source specifier for an extension configuration discovery + // service. In case of a failure and without the default configuration, the + // UDP session will be removed. + config.core.v3.ExtensionConfigSource config_discovery = 3; + } + } + + // Configuration for tunneling UDP over other transports or application layers. + // Tunneling is currently supported over HTTP/2. + // [#next-free-field: 13] + message UdpTunnelingConfig { + // Configuration for UDP datagrams buffering. + message BufferOptions { + // If set, the filter will only buffer datagrams up to the requested limit, and will drop + // new UDP datagrams if the buffer contains the max_buffered_datagrams value at the time + // of a new datagram arrival. If not set, the default value is 1024 datagrams. + google.protobuf.UInt32Value max_buffered_datagrams = 1; + + // If set, the filter will only buffer datagrams up to the requested total buffered bytes limit, + // and will drop new UDP datagrams if the buffer contains the max_buffered_datagrams value + // at the time of a new datagram arrival. If not set, the default value is 16,384 (16KB). + google.protobuf.UInt64Value max_buffered_bytes = 2; + } + + message RetryOptions { + // The maximum number of unsuccessful connection attempts that will be made before giving up. + // If the parameter is not specified, 1 connection attempt will be made. + google.protobuf.UInt32Value max_connect_attempts = 1; + + // Sets the backoff strategy. If not set, the retries are performed without backoff. + config.core.v3.BackoffStrategy backoff_options = 2; + } + + // The hostname to send in the synthesized CONNECT headers to the upstream proxy. + // This field evaluates command operators if set, otherwise returns hostname as is. + // + // Example: dynamically set hostname using filter state + // + // .. code-block:: yaml + // + // tunneling_config: + // proxy_host: "%FILTER_STATE(proxy.host.key:PLAIN)%" + // + string proxy_host = 1 [(validate.rules).string = {min_len: 1}]; + + // Optional port value to add to the HTTP request URI. + // This value can be overridden per-session by setting the required port value for + // the filter state key ``udp.connect.proxy_port``. + google.protobuf.UInt32Value proxy_port = 2; + + // The target host to send in the synthesized CONNECT headers to the upstream proxy. + // This field evaluates command operators if set, otherwise returns hostname as is. + // + // Example: dynamically set target host using filter state + // + // .. code-block:: yaml + // + // tunneling_config: + // target_host: "%FILTER_STATE(target.host.key:PLAIN)%" + // + string target_host = 3 [(validate.rules).string = {min_len: 1}]; + + // The default target port to send in the CONNECT headers to the upstream proxy. + // This value can be overridden per-session by setting the required port value for + // the filter state key ``udp.connect.target_port``. + uint32 default_target_port = 4 [(validate.rules).uint32 = {lte: 65535 gt: 0}]; + + // Use POST method instead of CONNECT method to tunnel the UDP stream. + // + // .. note:: + // If use_post is set, the upstream stream does not comply with the connect-udp RFC, and + // instead it will be a POST request. the path used in the headers will be set from the + // post_path field, and the headers will not contain the target host and target port, as + // required by the connect-udp protocol. This flag should be used carefully. + // + bool use_post = 5; + + // The path used with POST method. Default path is ``/``. If post path is specified and + // use_post field isn't true, it will be rejected. + string post_path = 6; + + // Optional retry options, in case connecting to the upstream failed. + RetryOptions retry_options = 7; + + // Additional request headers to upstream proxy. Neither ``:-prefixed`` pseudo-headers + // nor the Host: header can be overridden. Values of the added headers evaluates command + // operators if they are set in the value template. + // + // Example: dynamically set a header with the local port + // + // .. code-block:: yaml + // + // headers_to_add: + // - header: + // key: original_dst_port + // value: "%DOWNSTREAM_LOCAL_PORT%" + // + repeated config.core.v3.HeaderValueOption headers_to_add = 8 + [(validate.rules).repeated = {max_items: 1000}]; + + // If configured, the filter will buffer datagrams in case that it is waiting for the upstream to be + // ready, whether if it is during the connection process or due to upstream buffer watermarks. + // If this field is not configured, there will be no buffering and downstream datagrams that arrive + // while the upstream is not ready will be dropped. In case this field is set but the options + // are not configured, the default values will be applied as described in the ``BufferOptions``. + BufferOptions buffer_options = 9; + + // Save the response headers to the downstream info filter state for consumption + // by the session filters. The filter state key is ``envoy.udp_proxy.propagate_response_headers``. + bool propagate_response_headers = 10; + + // Save the response trailers to the downstream info filter state for consumption + // by the session filters. The filter state key is ``envoy.udp_proxy.propagate_response_trailers``. + bool propagate_response_trailers = 11; + + // Specifies a collection of Formatter plugins that can be used in substitution formatters + // in ``headers_to_add``. + // See the formatters extensions documentation for details. + // [#extension-category: envoy.formatter] + repeated config.core.v3.TypedExtensionConfig formatters = 12; + } + + message UdpAccessLogOptions { + // The interval to flush access log. The UDP proxy will flush only one access log when the session + // is ended by default. If this field is set, the UDP proxy will flush access log periodically with + // the specified interval. + // This field does not require on-tunnel-connected access logging enabled, and the other way around. + // The interval must be at least 1ms. + google.protobuf.Duration access_log_flush_interval = 1 + [(validate.rules).duration = {gte {nanos: 1000000}}]; + + // If set to true and UDP tunneling is configured, access log will be flushed when the UDP proxy has successfully + // established a connection tunnel with the upstream. If the connection failed, the access log will not be flushed. + bool flush_access_log_on_tunnel_connected = 2; + } + + // The stat prefix used when emitting UDP proxy filter stats. + string stat_prefix = 1 [(validate.rules).string = {min_len: 1}]; + + oneof route_specifier { + option (validate.required) = true; + + // The upstream cluster to connect to. + // This field is deprecated in favor of + // :ref:`matcher `. + string cluster = 2 [ + deprecated = true, + (validate.rules).string = {min_len: 1}, + (envoy.annotations.deprecated_at_minor_version) = "3.0" + ]; + + // The match tree to use when resolving route actions for incoming requests. + // See :ref:`Routing ` for more information. + xds.type.matcher.v3.Matcher matcher = 9 + [(xds.annotations.v3.field_status).work_in_progress = true]; + } + + // The idle timeout for sessions. Idle is defined as no datagrams between received or sent by + // the session. The default if not specified is 1 minute. + google.protobuf.Duration idle_timeout = 3; + + // Use the remote downstream IP address as the sender IP address when sending packets to upstream hosts. + // This option requires Envoy to be run with the ``CAP_NET_ADMIN`` capability on Linux. + // And the IPv6 stack must be enabled on Linux kernel. + // This option does not preserve the remote downstream port. + // If this option is enabled, the IP address of sent datagrams will be changed to the remote downstream IP address. + // This means that Envoy will not receive packets that are sent by upstream hosts because the upstream hosts + // will send the packets with the remote downstream IP address as the destination. All packets will be routed + // to the remote downstream directly if there are route rules on the upstream host side. + // There are two options to return the packets back to the remote downstream. + // The first one is to use DSR (Direct Server Return). + // The other one is to configure routing rules on the upstream hosts to forward + // all packets back to Envoy and configure iptables rules on the host running Envoy to + // forward all packets from upstream hosts to the Envoy process so that Envoy can forward the packets to the downstream. + // If the platform does not support this option, Envoy will raise a configuration error. + bool use_original_src_ip = 4; + + // Optional configuration for UDP proxy hash policies. If hash_policies is not set, the hash-based + // load balancing algorithms will select a host randomly. Currently the number of hash policies is + // limited to 1. + repeated HashPolicy hash_policies = 5 [(validate.rules).repeated = {max_items: 1}]; + + // UDP socket configuration for upstream sockets. The default for + // :ref:`prefer_gro ` is true for upstream + // sockets as the assumption is datagrams will be received from a single source. + config.core.v3.UdpSocketConfig upstream_socket_config = 6; + + // Perform per packet load balancing (upstream host selection) on each received data chunk. + // The default if not specified is false, that means each data chunk is forwarded + // to upstream host selected on first chunk receival for that "session" (identified by source IP/port and local IP/port). + // Only one of use_per_packet_load_balancing or session_filters can be used. + bool use_per_packet_load_balancing = 7; + + // Configuration for session access logs emitted by the UDP proxy. Note that certain UDP specific data is emitted as :ref:`Dynamic Metadata `. + repeated config.accesslog.v3.AccessLog access_log = 8; + + // Configuration for proxy access logs emitted by the UDP proxy. Note that certain UDP specific data is emitted as :ref:`Dynamic Metadata `. + repeated config.accesslog.v3.AccessLog proxy_access_log = 10; + + // Optional session filters that will run for each UDP session. + // Only one of use_per_packet_load_balancing or session_filters can be used. + // [#extension-category: envoy.filters.udp.session] + repeated SessionFilter session_filters = 11; + + // If set, this configures UDP tunneling. See `Proxying UDP in HTTP `_. + // More information can be found in the UDP Proxy and HTTP upgrade documentation. + UdpTunnelingConfig tunneling_config = 12; + + // Additional access log options for UDP Proxy. + UdpAccessLogOptions access_log_options = 13; +} diff --git a/modules/sync/envoyproxy/envoy/cas/d5574d9597be5b91e315b55e6d7a324d2aeb33a071a60bbe07936e8768b4c4e733e3c49b2367304dec5f3d28c4bbcc67d46d9401362a182dcc6f90f0335c5e21 b/modules/sync/envoyproxy/envoy/cas/d5574d9597be5b91e315b55e6d7a324d2aeb33a071a60bbe07936e8768b4c4e733e3c49b2367304dec5f3d28c4bbcc67d46d9401362a182dcc6f90f0335c5e21 new file mode 100644 index 00000000..d89ef235 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/d5574d9597be5b91e315b55e6d7a324d2aeb33a071a60bbe07936e8768b4c4e733e3c49b2367304dec5f3d28c4bbcc67d46d9401362a182dcc6f90f0335c5e21 @@ -0,0 +1,73 @@ +syntax = "proto3"; + +package envoy.extensions.health_checkers.dynamic_modules.v3; + +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.health_checkers.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/health_checkers/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Dynamic Modules Health Checker] +// [#extension: envoy.health_checkers.dynamic_modules] + +// Configuration for the Dynamic Modules Health Checker. This health checker allows loading shared +// object files via ``dlopen`` to implement custom active health checking behavior. +// +// A module can be loaded by multiple health checkers; the module is loaded only once and shared +// across multiple health checker instances. +// +// Envoy drives the standard per-host interval and timeout timers and applies the common +// ``interval``, ``timeout``, ``healthy_threshold`` and ``unhealthy_threshold`` settings. On each +// interval the module is asked to check the host; it may perform the work on its own thread and +// reports the host's health status back to Envoy. +message DynamicModuleHealthCheck { + // Specifies the shared-object level configuration. This field is required. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1 + [(validate.rules).message = {required: true}]; + + // The name for this health checker configuration. + // + // This can be used to distinguish between different health checker implementations inside a + // dynamic module. For example, a module can have completely different health checker + // implementations (e.g., a ping checker, an external-service checker). When Envoy receives this + // configuration, it passes the ``health_checker_name`` to the dynamic module's health checker + // config init function together with the ``health_checker_config``. That way a module can decide + // which in-module health checker implementation to use based on the name at load time. + string health_checker_name = 2 [(validate.rules).string = {min_len: 1}]; + + // The configuration for the health checker chosen by ``health_checker_name``. If not specified, + // an empty configuration is passed to the module. + // + // This is passed to the module's health checker initialization function. Together with the + // ``health_checker_name``, the module can decide which in-module health checker implementation to + // use and fine-tune the behavior of the health checker. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly + // without the wrapper. + // + // .. code-block:: yaml + // + // # Passing a JSON struct configuration + // health_checker_config: + // "@type": "type.googleapis.com/google.protobuf.Struct" + // value: + // path: "/healthz" + // degraded_on_slow_response: true + // + // # Passing a simple string configuration + // health_checker_config: + // "@type": "type.googleapis.com/google.protobuf.StringValue" + // value: "/healthz" + // + google.protobuf.Any health_checker_config = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/d914c01bdc3068df7d0d999fbf63b779c0c184906ef0cd922fbc421276263c34bb565b0dd7a4e1b12eb9ca1875088a525f91f4f81aa61aa907ba72b91ad097bd b/modules/sync/envoyproxy/envoy/cas/d914c01bdc3068df7d0d999fbf63b779c0c184906ef0cd922fbc421276263c34bb565b0dd7a4e1b12eb9ca1875088a525f91f4f81aa61aa907ba72b91ad097bd new file mode 100644 index 00000000..cb65948f --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/d914c01bdc3068df7d0d999fbf63b779c0c184906ef0cd922fbc421276263c34bb565b0dd7a4e1b12eb9ca1875088a525f91f4f81aa61aa907ba72b91ad097bd @@ -0,0 +1,255 @@ +syntax = "proto3"; + +package envoy.service.rate_limit_quota.v3; + +import "envoy/type/v3/ratelimit_strategy.proto"; + +import "google/protobuf/duration.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.service.rate_limit_quota.v3"; +option java_outer_classname = "RlqsProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/service/rate_limit_quota/v3;rate_limit_quotav3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Rate Limit Quota Service (RLQS)] + +// The Rate Limit Quota Service (RLQS) is a Envoy global rate limiting service that allows to +// delegate rate limit decisions to a remote service. The service will aggregate the usage reports +// from multiple data plane instances, and distribute Rate Limit Assignments to each instance +// based on its business logic. The logic is outside of the scope of the protocol API. +// +// The protocol is designed as a streaming-first API. It utilizes watch-like subscription model. +// The data plane groups requests into Quota Buckets as directed by the filter config, +// and periodically reports them to the RLQS server along with the Bucket identifier, :ref:`BucketId +// `. Once RLQS server has collected enough +// reports to make a decision, it'll send back the assignment with the rate limiting instructions. +// +// The first report sent by the data plane is interpreted by the RLQS server as a "watch" request, +// indicating that the data plane instance is interested in receiving further updates for the +// ``BucketId``. From then on, RLQS server may push assignments to this instance at will, even if +// the instance is not sending usage reports. It's the responsibility of the RLQS server +// to determine when the data plane instance didn't send ``BucketId`` reports for too long, +// and to respond with the :ref:`AbandonAction +// `, +// indicating that the server has now stopped sending quota assignments for the ``BucketId`` bucket, +// and the data plane instance should :ref:`abandon +// ` +// it. +// +// If for any reason the RLQS client doesn't receive the initial assignment for the reported bucket, +// in order to prevent memory exhaustion, the data plane will limit the time such bucket +// is retained. The exact time to wait for the initial assignment is chosen by the filter, +// and may vary based on the implementation. +// Once the duration ends, the data plane will stop reporting bucket usage, reject any enqueued +// requests, and purge the bucket from the memory. Subsequent requests matched into the bucket +// will re-initialize the bucket in the "no assignment" state, restarting the reports. +// +// Refer to Rate Limit Quota :ref:`configuration overview ` +// for further details. + +// Defines the Rate Limit Quota Service (RLQS). +service RateLimitQuotaService { + // Main communication channel: the data plane sends usage reports to the RLQS server, + // and the server asynchronously responding with the assignments. + rpc StreamRateLimitQuotas(stream RateLimitQuotaUsageReports) + returns (stream RateLimitQuotaResponse) { + } +} + +message RateLimitQuotaUsageReports { + // The usage report for a bucket. + // + // .. note:: + // Note that the first report sent for a ``BucketId`` indicates to the RLQS server that + // the RLQS client is subscribing for the future assignments for this ``BucketId``. + message BucketQuotaUsage { + // ``BucketId`` for which request quota usage is reported. + BucketId bucket_id = 1 [(validate.rules).message = {required: true}]; + + // Time elapsed since the last report. + google.protobuf.Duration time_elapsed = 2 [(validate.rules).duration = { + required: true + gt {} + }]; + + // Requests the data plane has allowed through. + uint64 num_requests_allowed = 3; + + // Requests throttled. + uint64 num_requests_denied = 4; + } + + // All quota requests must specify the domain. This enables sharing the quota + // server between different applications without fear of overlap. + // E.g., "envoy". + // + // Should only be provided in the first report, all subsequent messages on the same + // stream are considered to be in the same domain. In case the domain needs to be + // changes, close the stream, and reopen a new one with the different domain. + string domain = 1 [(validate.rules).string = {min_len: 1}]; + + // A list of quota usage reports. The list is processed by the RLQS server in the same order + // it's provided by the client. + repeated BucketQuotaUsage bucket_quota_usages = 2 [(validate.rules).repeated = {min_items: 1}]; +} + +message RateLimitQuotaResponse { + // Commands the data plane to apply one of the actions to the bucket with the + // :ref:`bucket_id `. + message BucketAction { + // Quota assignment for the bucket. Configures the rate limiting strategy and the duration + // for the given :ref:`bucket_id + // `. + // + // **Applying the first assignment to the bucket** + // + // Once the data plane receives the ``QuotaAssignmentAction``, it must send the current usage + // report for the bucket, and start rate limiting requests matched into the bucket + // using the strategy configured in the :ref:`rate_limit_strategy + // ` + // field. The assignment becomes bucket's ``active`` assignment. + // + // **Expiring the assignment** + // + // The duration of the assignment defined in the :ref:`assignment_time_to_live + // ` + // field. When the duration runs off, the assignment is ``expired``, and no longer ``active``. + // The data plane should stop applying the rate limiting strategy to the bucket, and transition + // the bucket to the "expired assignment" state. This activates the behavior configured in the + // :ref:`expired_assignment_behavior ` + // field. + // + // **Replacing the assignment** + // + // * If the rate limiting strategy is different from bucket's ``active`` assignment, or + // the current bucket assignment is ``expired``, the data plane must immediately + // end the current assignment, report the bucket usage, and apply the new assignment. + // The new assignment becomes bucket's ``active`` assignment. + // * If the rate limiting strategy is the same as the bucket's ``active`` (not ``expired``) + // assignment, the data plane should extend the duration of the ``active`` assignment + // for the duration of the new assignment provided in the :ref:`assignment_time_to_live + // ` + // field. The ``active`` assignment is considered unchanged. + message QuotaAssignmentAction { + // A duration after which the assignment is be considered ``expired``. The process of the + // expiration is described :ref:`above + // `. + // + // * If unset, the assignment has no expiration date. + // * If set to ``0``, the assignment expires immediately, forcing the client into the + // :ref:`"expired assignment" + // ` + // state. This may be used by the RLQS server in cases when it needs clients to proactively + // fall back to the pre-configured :ref:`ExpiredAssignmentBehavior + // `, + // f.e. before the server going into restart. + // + // .. attention:: + // Note that :ref:`expiring + // ` + // the assignment is not the same as :ref:`abandoning + // ` + // the assignment. While expiring the assignment just transitions the bucket to + // the "expired assignment" state; abandoning the assignment completely erases + // the bucket from the data plane memory, and stops the usage reports. + google.protobuf.Duration assignment_time_to_live = 2 [(validate.rules).duration = {gte {}}]; + + // Configures the local rate limiter for the request matched to the bucket. + // If not set, allow all requests. + type.v3.RateLimitStrategy rate_limit_strategy = 3; + } + + // Abandon action for the bucket. Indicates that the RLQS server will no longer be + // sending updates for the given :ref:`bucket_id + // `. + // + // If no requests are reported for a bucket, after some time the server considers the bucket + // inactive. The server stops tracking the bucket, and instructs the the data plane to abandon + // the bucket via this message. + // + // **Abandoning the assignment** + // + // The data plane is to erase the bucket (including its usage data) from the memory. + // It should stop tracking the bucket, and stop reporting its usage. This effectively resets + // the data plane to the state prior to matching the first request into the bucket. + // + // **Restarting the subscription** + // + // If a new request is matched into a bucket previously abandoned, the data plane must behave + // as if it has never tracked the bucket, and it's the first request matched into it: + // + // 1. The process of :ref:`subscription and reporting + // ` + // starts from the beginning. + // + // 2. The bucket transitions to the :ref:`"no assignment" + // ` + // state. + // + // 3. Once the new assignment is received, it's applied per + // "Applying the first assignment to the bucket" section of the :ref:`QuotaAssignmentAction + // `. + message AbandonAction { + } + + // ``BucketId`` for which request the action is applied. + BucketId bucket_id = 1 [(validate.rules).message = {required: true}]; + + oneof bucket_action { + option (validate.required) = true; + + // Apply the quota assignment to the bucket. + // + // Commands the data plane to apply a rate limiting strategy to the bucket. + // The process of applying and expiring the rate limiting strategy is detailed in the + // :ref:`QuotaAssignmentAction + // ` + // message. + QuotaAssignmentAction quota_assignment_action = 2; + + // Abandon the bucket. + // + // Commands the data plane to abandon the bucket. + // The process of abandoning the bucket is described in the :ref:`AbandonAction + // ` + // message. + AbandonAction abandon_action = 3; + } + } + + // An ordered list of actions to be applied to the buckets. The actions are applied in the + // given order, from top to bottom. + repeated BucketAction bucket_action = 1 [(validate.rules).repeated = {min_items: 1}]; +} + +// The identifier for the bucket. Used to match the bucket between the control plane (RLQS server), +// and the data plane (RLQS client), f.e.: +// +// * the data plane sends a usage report for requests matched into the bucket with ``BucketId`` +// to the control plane +// * the control plane sends an assignment for the bucket with ``BucketId`` to the data plane +// Bucket ID. +// +// Example: +// +// .. validated-code-block:: yaml +// :type-name: envoy.service.rate_limit_quota.v3.BucketId +// +// bucket: +// name: my_bucket +// env: staging +// +// .. note:: +// The order of ``BucketId`` keys do not matter. Buckets ``{ a: 'A', b: 'B' }`` and +// ``{ b: 'B', a: 'A' }`` are identical. +message BucketId { + map bucket = 1 [(validate.rules).map = { + min_pairs: 1 + keys {string {min_len: 1}} + values {string {min_len: 1}} + }]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/d97a77149846ad07022885e6267e9a5eb5185a1ab83729a3d0dd4f2edd902d4fb00e923c90173539e72954d993c075ed1db05e5cdaf92a3e324fbd325c3edbe3 b/modules/sync/envoyproxy/envoy/cas/d97a77149846ad07022885e6267e9a5eb5185a1ab83729a3d0dd4f2edd902d4fb00e923c90173539e72954d993c075ed1db05e5cdaf92a3e324fbd325c3edbe3 new file mode 100644 index 00000000..5acf676c --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/d97a77149846ad07022885e6267e9a5eb5185a1ab83729a3d0dd4f2edd902d4fb00e923c90173539e72954d993c075ed1db05e5cdaf92a3e324fbd325c3edbe3 @@ -0,0 +1,223 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.lua.v3; + +import "envoy/config/core/v3/base.proto"; + +import "google/protobuf/struct.proto"; +import "google/protobuf/wrappers.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.lua.v3"; +option java_outer_classname = "LuaProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/lua/v3;luav3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Lua] +// Lua :ref:`configuration overview `. +// [#extension: envoy.filters.http.lua] + +// [#next-free-field: 10] +message Lua { + option (udpa.annotations.versioning).previous_message_type = + "envoy.config.filter.http.lua.v2.Lua"; + + // The Lua code that Envoy will execute. This can be a very small script that + // further loads code from disk if desired. Note that if JSON configuration is used, the code must + // be properly escaped. YAML configuration may be easier to read since YAML supports multi-line + // strings so complex scripts can be easily expressed inline in the configuration. + // + // This field is deprecated. Please use + // :ref:`default_source_code `. + // Only one of :ref:`inline_code ` + // or :ref:`default_source_code ` + // can be set for the Lua filter. + string inline_code = 1 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Map of named Lua source codes that can be referenced in :ref:`LuaPerRoute + // `. The Lua source codes can be + // loaded from inline string or local files. + // + // Example: + // + // .. code-block:: yaml + // + // source_codes: + // hello.lua: + // inline_string: | + // function envoy_on_response(response_handle) + // -- Do something. + // end + // world.lua: + // filename: /etc/lua/world.lua + // + map source_codes = 2; + + // The default Lua code that Envoy will execute. If no per route config is provided + // for the request, this Lua code will be applied. + config.core.v3.DataSource default_source_code = 3; + + // Optional additional prefix to use when emitting statistics. By default + // metrics are emitted in *.lua.* namespace. If multiple lua filters are + // configured in a filter chain, the stats from each filter instance can + // be emitted using custom stat prefix to distinguish emitted + // statistics. For example: + // + // .. code-block:: yaml + // + // http_filters: + // - name: envoy.filters.http.lua + // typed_config: + // "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua + // stat_prefix: foo_script # This emits lua.foo_script.errors etc. + // - name: envoy.filters.http.lua + // typed_config: + // "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua + // stat_prefix: bar_script # This emits lua.bar_script.errors etc. + // + string stat_prefix = 4; + + // If set to true, the Lua filter will clear the route cache automatically if the request + // headers are modified by the Lua script. If set to false, the Lua filter will not clear the + // route cache automatically. + // Default is true for backward compatibility. + google.protobuf.BoolValue clear_route_cache = 5; + + // Optional filter context for the Lua script, accessed the same way as the per-route + // :ref:`filter_context + // `, via + // ``handle:filterContext()``. This is the context a request gets when it has no + // ``LuaPerRoute`` configuration, or when the one it has does not set ``filter_context``. + // + // A ``LuaPerRoute`` which does set ``filter_context`` replaces this value rather than merging + // into it, so a route which sets an empty ``filter_context`` sees an empty context rather than + // this one. Only the most specific ``LuaPerRoute`` is consulted: a ``filter_context`` on a less + // specific one, such as a virtual host when the route has its own ``LuaPerRoute``, is not + // reached, and this value is used instead. + google.protobuf.Struct filter_context = 6; + + // Additional patterns for the Lua ``package.path`` of every VM this filter creates, so that a + // script can ``require`` modules from locations the interpreter does not search on its own. + // Each entry is one Lua path pattern; the entries are joined with ``;`` in the order given and + // placed ahead of the interpreter's built-in default path, which is kept. + // + // .. code-block:: yaml + // + // package_paths: + // - /etc/envoy/lua/?.lua + // - /etc/envoy/lua/?/init.lua + // + // The patterns are in place before any configured code runs, including the run that validates + // the configuration, so a ``require`` at the top level of a script whose module cannot be found + // is rejected as a configuration error rather than failing per request. + // + // Each worker builds its own VM and runs the script again to do so, after the configuration has + // been accepted, so the files a script requires must stay readable for as long as the process + // runs and not only while the configuration is loaded. + repeated string package_paths = 7 [(validate.rules).repeated = {items {string {min_len: 1}}}]; + + // As :ref:`package_paths + // `, but for + // ``package.cpath``, i.e. modules which are loadable C libraries rather than Lua source, for + // example ``/etc/envoy/lua/?.so``. + repeated string package_cpaths = 8 [(validate.rules).repeated = {items {string {min_len: 1}}}]; + + // If set, the Lua VMs this filter builds are shared with every other Lua filter configuration + // that sets the same ``shared_vm_id`` and configures the same script, rather than each + // configuration building its own. This applies to every script this message configures: + // :ref:`default_source_code + // `, + // :ref:`inline_code ` and + // every entry of :ref:`source_codes + // `. + // + // Sharing is decided per script, not per configuration: two configurations that agree on this + // id share a VM only for the scripts whose contents match, and whose :ref:`package_paths + // ` and + // :ref:`package_cpaths + // ` match, since a + // script that resolves its ``require`` calls differently does not produce an equivalent VM. + // A :ref:`LuaPerRoute.shared_vm_id + // ` participates in + // the same sharing, so a route's inline script can reuse a VM built here and the other way + // around. + // + // A VM is not only an amount of memory, it is also a set of Lua globals that outlive a request. + // Scripts sharing a VM therefore see each other's globals, exactly as separate requests through + // one configuration already do. Leave this field unset, which is the default, to keep every + // configuration's scripts in VMs of their own. + // + // A shared VM lives for as long as at least one configuration using it is alive. Once the last + // one is drained the VM is torn down, and the next configuration asking for that id and script + // builds a fresh one. + string shared_vm_id = 9; +} + +// [#next-free-field: 8] +message LuaPerRoute { + oneof override { + // Disable the Lua filter for this particular vhost or route. If disabled is specified in + // multiple per-filter-configs, the most specific one will be used. + bool disabled = 1 [(validate.rules).bool = {const: true}]; + + // A name of a Lua source code stored in + // :ref:`Lua.source_codes `. + string name = 2 [(validate.rules).string = {min_len: 1}]; + + // A configured per-route Lua source code that can be served by RDS or provided inline. + config.core.v3.DataSource source_code = 3; + } + + // Optional filter context for Lua script. This could be used to pass configuration + // to Lua script. The Lua script can access the filter context using ``handle:filterContext()``. + // For example: + // + // .. code-block:: lua + // + // function envoy_on_request(request_handle) + // local filter_context = request_handle:filterContext() + // local filter_context_value = filter_context:get("key") + // -- Do something with filter_context_value. + // end + // + // This replaces the filter-level :ref:`filter_context + // ` rather than merging + // into it. + google.protobuf.Struct filter_context = 4; + + // Additional patterns for the Lua ``package.path`` of the VM built from this route's + // :ref:`source_code + // `, with the same + // meaning as the filter-level :ref:`package_paths + // `. + // + // This route's inline source code gets its own VM, which is why it needs its own patterns: the + // filter-level ones are not visible to it. Setting these has no effect when this route selects a + // script by :ref:`name + // `, or configures no script + // at all, since that VM belongs to the filter and carries the filter-level patterns. + repeated string package_paths = 5 [(validate.rules).repeated = {items {string {min_len: 1}}}]; + + // As :ref:`package_paths + // `, but for + // ``package.cpath``. + repeated string package_cpaths = 6 [(validate.rules).repeated = {items {string {min_len: 1}}}]; + + // As :ref:`Lua.shared_vm_id + // `, but for the VM built + // from this route's :ref:`source_code + // `. Routes and + // filter configurations share one pool of VMs, so a route setting the same id as a filter + // configuration reuses that configuration's VM when the script matches. + // + // Setting this has no effect when this route selects a script by :ref:`name + // `, or configures no + // script at all, since that VM belongs to the filter and follows the filter's setting. + string shared_vm_id = 7; +} diff --git a/modules/sync/envoyproxy/envoy/cas/dbe663dfcfd0c76b1ce3e25e5e3fb44cad6c8c9b3dc91e1e3ef7e16f5f68eb1c107fc7929ff0ba385704a3fe2ef50cb130235493463ca91094813e831de30d89 b/modules/sync/envoyproxy/envoy/cas/dbe663dfcfd0c76b1ce3e25e5e3fb44cad6c8c9b3dc91e1e3ef7e16f5f68eb1c107fc7929ff0ba385704a3fe2ef50cb130235493463ca91094813e831de30d89 new file mode 100644 index 00000000..644b837e --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/dbe663dfcfd0c76b1ce3e25e5e3fb44cad6c8c9b3dc91e1e3ef7e16f5f68eb1c107fc7929ff0ba385704a3fe2ef50cb130235493463ca91094813e831de30d89 @@ -0,0 +1,52 @@ +syntax = "proto3"; + +package envoy.data.ai.v3; + +import "envoy/type/ai/v3/llm_protocol.proto"; + +import "google/protobuf/wrappers.proto"; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.data.ai.v3"; +option java_outer_classname = "RequestInfoProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/data/ai/v3;aiv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: AI request info] + +// Request attributes published as typed dynamic metadata by the :ref:`request info AI +// filter `. Values are +// client-declared and unverified, apart from ``estimated_input_tokens``, which Envoy computes. +// A value the client sent that Envoy cannot use, such as one of the wrong type, out of range, +// or a string over 256 bytes, is ignored. +// [#next-free-field: 8] +message RequestInfo { + // The route's declared wire API. When unspecified, only ``model`` and ``stream`` are read. + type.ai.v3.LLMProtocol input_llm_protocol = 1; + + // The requested model. + string model = 2; + + // Whether a streamed response was requested. + google.protobuf.BoolValue stream = 3; + + // The requested output token cap. + google.protobuf.UInt64Value max_output_tokens = 4; + + // Number of messages in the conversation. + google.protobuf.UInt32Value message_count = 5; + + // Number of tools declared. + google.protobuf.UInt32Value tool_count = 6; + + // Envoy's estimate of the input tokens, published only when :ref:`token_estimation + // ` + // is configured: ``ceil(tokens_per_byte * request payload bytes)``. A size heuristic, not a + // tokenizer result, and independent of the wire API. + google.protobuf.UInt64Value estimated_input_tokens = 7; +} diff --git a/modules/sync/envoyproxy/envoy/cas/dc3026fe73281be8f49653a477fd117922659cc75d2387f07dcebb4e9e79962ed2cfe12a779fcce4f341ed114c04964d6f6512a4168dab457bba08a44d1127b9 b/modules/sync/envoyproxy/envoy/cas/dc3026fe73281be8f49653a477fd117922659cc75d2387f07dcebb4e9e79962ed2cfe12a779fcce4f341ed114c04964d6f6512a4168dab457bba08a44d1127b9 new file mode 100644 index 00000000..b9140f62 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/dc3026fe73281be8f49653a477fd117922659cc75d2387f07dcebb4e9e79962ed2cfe12a779fcce4f341ed114c04964d6f6512a4168dab457bba08a44d1127b9 @@ -0,0 +1,233 @@ +syntax = "proto3"; + +package envoy.config.core.v3; + +import "envoy/config/core/v3/extension.proto"; +import "envoy/config/core/v3/socket_option.proto"; + +import "google/protobuf/wrappers.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.config.core.v3"; +option java_outer_classname = "AddressProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/config/core/v3;corev3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Network addresses] + +message Pipe { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.Pipe"; + + // Unix Domain Socket path. On Linux, paths starting with '@' will use the + // abstract namespace. The starting '@' is replaced by a null byte by Envoy. + // Paths starting with '@' will result in an error in environments other than + // Linux. + string path = 1 [(validate.rules).string = {min_len: 1}]; + + // The mode for the Pipe. Not applicable for abstract sockets. + uint32 mode = 2 [(validate.rules).uint32 = {lte: 511}]; +} + +// The address represents an envoy internal listener. +// [#comment: TODO(asraa): When address available, remove workaround from test/server/server_fuzz_test.cc:30.] +message EnvoyInternalAddress { + oneof address_name_specifier { + option (validate.required) = true; + + // Specifies the :ref:`name ` of the + // internal listener. + string server_listener_name = 1; + } + + // Specifies an endpoint identifier to distinguish between multiple endpoints for the same internal listener in a + // single upstream pool. Only used in the upstream addresses for tracking changes to individual endpoints. This, for + // example, may be set to the final destination IP for the target internal listener. + string endpoint_id = 2; +} + +// [#next-free-field: 8] +message SocketAddress { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.SocketAddress"; + + enum Protocol { + TCP = 0; + UDP = 1; + } + + Protocol protocol = 1 [(validate.rules).enum = {defined_only: true}]; + + // The address for this socket. :ref:`Listeners ` will bind + // to the address. An empty address is not allowed. Specify ``0.0.0.0`` or ``::`` + // to bind to any address. [#comment:TODO(zuercher) reinstate when implemented: + // It is possible to distinguish a Listener address via the prefix/suffix matching + // in :ref:`FilterChainMatch `.] When used + // within an upstream :ref:`BindConfig `, the address + // controls the source address of outbound connections. For :ref:`clusters + // `, the cluster type determines whether the + // address must be an IP (``STATIC`` or ``EDS`` clusters) or a hostname resolved by DNS + // (``STRICT_DNS`` or ``LOGICAL_DNS`` clusters). Address resolution can be customized + // via :ref:`resolver_name `. + string address = 2 [(validate.rules).string = {min_len: 1}]; + + oneof port_specifier { + option (validate.required) = true; + + uint32 port_value = 3 [(validate.rules).uint32 = {lte: 65535}]; + + // This is only valid if :ref:`resolver_name + // ` is specified below and the + // named resolver is capable of named port resolution. + string named_port = 4; + } + + // The name of the custom resolver. This must have been registered with Envoy. If + // this is empty, a context dependent default applies. If the address is a concrete + // IP address, no resolution will occur. If address is a hostname this + // should be set for resolution other than DNS. Specifying a custom resolver with + // ``STRICT_DNS`` or ``LOGICAL_DNS`` will generate an error at runtime. + string resolver_name = 5; + + // When binding to an IPv6 address above, this enables `IPv4 compatibility + // `_. Binding to ``::`` will + // allow both IPv4 and IPv6 connections, with peer IPv4 addresses mapped into + // IPv6 space as ``::FFFF:``. + bool ipv4_compat = 6; + + // Filepath that specifies the Linux network namespace this socket will be created in (see ``man 7 + // network_namespaces``). If this field is set, Envoy will create the socket in the specified + // network namespace. + // + // .. note:: + // Setting this parameter requires Envoy to run with the ``CAP_SYS_ADMIN`` capability. + // + // .. attention:: + // Network namespaces are only configurable on Linux. Otherwise, this field has no effect. + string network_namespace_filepath = 7; +} + +message TcpKeepalive { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.TcpKeepalive"; + + // Maximum number of keepalive probes to send without response before deciding + // the connection is dead. Default is to use the OS level configuration (unless + // overridden, Linux defaults to 9.) Setting this to ``0`` disables TCP keepalive. + google.protobuf.UInt32Value keepalive_probes = 1; + + // The number of seconds a connection needs to be idle before keep-alive probes + // start being sent. Default is to use the OS level configuration (unless + // overridden, Linux defaults to 7200s (i.e., 2 hours.) Setting this to ``0`` disables + // TCP keepalive. + google.protobuf.UInt32Value keepalive_time = 2; + + // The number of seconds between keep-alive probes. Default is to use the OS + // level configuration (unless overridden, Linux defaults to 75s.) Setting this to + // ``0`` disables TCP keepalive. + google.protobuf.UInt32Value keepalive_interval = 3; +} + +message ExtraSourceAddress { + // The additional address to bind. + SocketAddress address = 1 [(validate.rules).message = {required: true}]; + + // Additional socket options that may not be present in Envoy source code or + // precompiled binaries. If specified, this will override the + // :ref:`socket_options ` + // in the BindConfig. If specified with no + // :ref:`socket_options ` + // or an empty list of :ref:`socket_options `, + // it means no socket option will apply. + SocketOptionsOverride socket_options = 2; +} + +// [#next-free-field: 8] +message BindConfig { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.BindConfig"; + + // The address to bind to when creating a socket. + SocketAddress source_address = 1; + + // Whether to set the ``IP_FREEBIND`` option when creating the socket. When this + // flag is set to true, allows the :ref:`source_address + // ` to be an IP address + // that is not configured on the system running Envoy. When this flag is set + // to false, the option ``IP_FREEBIND`` is disabled on the socket. When this + // flag is not set (default), the socket is not modified, i.e. the option is + // neither enabled nor disabled. + google.protobuf.BoolValue freebind = 2; + + // Additional socket options that may not be present in Envoy source code or + // precompiled binaries. + repeated SocketOption socket_options = 3; + + // Extra source addresses appended to the address specified in the ``source_address`` + // field. This enables to specify multiple source addresses. + // The source address selection is determined by :ref:`local_address_selector + // `. + repeated ExtraSourceAddress extra_source_addresses = 5; + + // Deprecated by + // :ref:`extra_source_addresses ` + repeated SocketAddress additional_source_addresses = 4 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Custom local address selector to override the default (i.e. + // :ref:`DefaultLocalAddressSelector + // `). + // [#extension-category: envoy.upstream.local_address_selector] + TypedExtensionConfig local_address_selector = 6; + + // If set to true, the :ref:`network_namespace_filepath + // ` of every source + // address in this bind config is validated when the configuration is loaded, and the + // configuration is rejected if a referenced network namespace cannot be opened. + // + // By default no such validation is performed: a network namespace that does not exist when the + // configuration is loaded may be created later, before connections are actually established, so + // eager validation would wrongly reject such configurations. If a namespace is unavailable when + // a connection is created, the connection attempt fails gracefully. + // + // Listener addresses do not need an equivalent option: a listener creates and binds its socket + // in the configured network namespace when the listener configuration is loaded, so an + // unavailable namespace always rejects the listener configuration. + // + // .. attention:: + // Network namespaces are only configurable on Linux. Otherwise, this field has no effect. + bool validate_network_namespaces = 7; +} + +// Addresses specify either a logical or physical address and port, which are +// used to tell Envoy where to bind/listen, connect to upstream and find +// management servers. +message Address { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.Address"; + + // [#comment: Keep this list of address types in sync with UpstreamConnectionOptions.FirstAddressFamilyVersion in api/envoy/config/cluster/v3/cluster.proto.] + oneof address { + option (validate.required) = true; + + SocketAddress socket_address = 1; + + Pipe pipe = 2; + + // Specifies a user-space address handled by :ref:`internal listeners + // `. + EnvoyInternalAddress envoy_internal_address = 3; + } +} + +// CidrRange specifies an IP Address and a prefix length to construct +// the subnet mask for a `CIDR `_ range. +message CidrRange { + option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.CidrRange"; + + // IPv4 or IPv6 address, e.g. ``192.0.0.0`` or ``2001:db8::``. + string address_prefix = 1 [(validate.rules).string = {min_len: 1}]; + + // Length of prefix, e.g. 0, 32. Defaults to 0 when unset. + google.protobuf.UInt32Value prefix_len = 2 [(validate.rules).uint32 = {lte: 128}]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/defe095f840705fde06764b61993b1b63a99635418cd6eff220e8d8334a5aa736951e6b6e6965e598965b41437f2bbbe49719722399ac062e4d4fb82b9cea4cf b/modules/sync/envoyproxy/envoy/cas/defe095f840705fde06764b61993b1b63a99635418cd6eff220e8d8334a5aa736951e6b6e6965e598965b41437f2bbbe49719722399ac062e4d4fb82b9cea4cf new file mode 100644 index 00000000..8503468c --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/defe095f840705fde06764b61993b1b63a99635418cd6eff220e8d8334a5aa736951e6b6e6965e598965b41437f2bbbe49719722399ac062e4d4fb82b9cea4cf @@ -0,0 +1,66 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.header_mutation.v3; + +import "envoy/config/common/mutation_rules/v3/mutation_rules.proto"; +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/extension.proto"; + +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.header_mutation.v3"; +option java_outer_classname = "HeaderMutationProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/header_mutation/v3;header_mutationv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Header mutation filter configuration] +// Mutate HTTP headers and trailers in requests and responses. +// [#extension: envoy.filters.http.header_mutation] + +// [#next-free-field: 7] +message Mutations { + // The request mutations are applied before the request is forwarded to the upstream cluster. + repeated config.common.mutation_rules.v3.HeaderMutation request_mutations = 1; + + // The ``path`` header query parameter mutations are applied after ``request_mutations`` and before the request + // is forwarded to the next filter in the filter chain. + repeated config.core.v3.KeyValueMutation query_parameter_mutations = 3; + + // The response mutations are applied before the response is sent to the downstream client. + repeated config.common.mutation_rules.v3.HeaderMutation response_mutations = 2; + + // The response trailer mutations are applied before the response is sent to the downstream client. + repeated config.common.mutation_rules.v3.HeaderMutation response_trailers_mutations = 4; + + // The request trailer mutations are applied before the request is sent to the upstream cluster. + repeated config.common.mutation_rules.v3.HeaderMutation request_trailers_mutations = 5; + + // Specifies a collection of Formatter plugins that can be used in substitution formatters + // in this message. + // If not specified, only the built-in command operators are available. + // Configured plugins take precedence over the built-in command operators. + // The plugins apply only to this message and are not inherited from other configuration levels. + // See the formatters extensions documentation for details. + // [#extension-category: envoy.formatter] + repeated config.core.v3.TypedExtensionConfig formatters = 6; +} + +// Per route configuration for the header mutation filter. +message HeaderMutationPerRoute { + Mutations mutations = 1; +} + +// Configuration for the header mutation filter. The mutation rules in the filter configuration will +// always be applied first and then the per-route mutation rules, if both are specified. +message HeaderMutation { + Mutations mutations = 1; + + // If per route HeaderMutationPerRoute config is configured at multiple route levels, header mutations + // at all specified levels are evaluated. By default, the order is from most specific (i.e. route entry level) + // to least specific (i.e. route configuration level). Later header mutations may override earlier mutations. + // + // This order can be reversed by setting this field to true. In other words, most specific level mutation + // is evaluated last. + bool most_specific_header_mutations_wins = 2; +} diff --git a/modules/sync/envoyproxy/envoy/cas/e46c4c2c153ea77879a711607b75b949303727fd9c3227897c112a4eab5572a68e0c1c7f3b281d842de83110bcb2c8450f0041d1ba54889992744ec913d42c6a b/modules/sync/envoyproxy/envoy/cas/e46c4c2c153ea77879a711607b75b949303727fd9c3227897c112a4eab5572a68e0c1c7f3b281d842de83110bcb2c8450f0041d1ba54889992744ec913d42c6a new file mode 100644 index 00000000..3189f699 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/e46c4c2c153ea77879a711607b75b949303727fd9c3227897c112a4eab5572a68e0c1c7f3b281d842de83110bcb2c8450f0041d1ba54889992744ec913d42c6a @@ -0,0 +1,70 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.sxg.v3alpha; + +import "envoy/extensions/transport_sockets/tls/v3/secret.proto"; + +import "google/protobuf/duration.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.sxg.v3alpha"; +option java_outer_classname = "SxgProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/contrib/envoy/extensions/filters/http/sxg/v3alpha"; +option (udpa.annotations.file_status).work_in_progress = true; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Signed HTTP Exchange Filter] +// SXG :ref:`configuration overview `. +// [#extension: envoy.filters.http.sxg] + +// [#next-free-field: 10] +message SXG { + // The SDS configuration for the public key data for the SSL certificate that will be used to sign the + // SXG response. + transport_sockets.tls.v3.SdsSecretConfig certificate = 1; + + // The SDS configuration for the private key data for the SSL certificate that will be used to sign the + // SXG response. + transport_sockets.tls.v3.SdsSecretConfig private_key = 2; + + // The duration for which the generated SXG package will be valid. Default is 604800s (7 days in seconds). + // Note that in order to account for clock skew, the timestamp will be backdated by a day. So, if duration + // is set to 7 days, that will be 7 days from 24 hours ago (6 days from now). Also note that while 6/7 days + // is appropriate for most content, if the downstream service is serving Javascript, or HTML with inline + // Javascript, 1 day (so, with backdated expiry, 2 days, or 172800 seconds) is more appropriate. + google.protobuf.Duration duration = 3; + + // The SXG response payload is `Merkle Integrity Content Encoding (MICE) encoded + // `_. + // This value indicates the record size in the encoded payload. The default value is 4096. + uint64 mi_record_size = 4; + + // The URI of certificate CBOR file published. Since it is required that the certificate CBOR file + // be served from the same domain as the SXG document, this should be a relative URI. + string cbor_url = 5 [(validate.rules).string = {min_len: 1 prefix: "/"}]; + + // URL to retrieve validity data for signature, a CBOR map. See specification + // `here `_ + string validity_url = 6 [(validate.rules).string = {min_len: 1 prefix: "/"}]; + + // Header that will be set if it is determined that the client can accept SXG (typically ``accept: application/signed-exchange;v=b3``) + // If not set, filter will default to: ``x-client-can-accept-sxg`` + string client_can_accept_sxg_header = 7 [ + (validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false ignore_empty: true} + ]; + + // Header set by downstream service to signal that the response should be transformed to SXG If not set, + // filter will default to: ``x-should-encode-sxg`` + string should_encode_sxg_header = 8 [ + (validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false ignore_empty: true} + ]; + + // Headers that will be stripped from the SXG document, by listing a prefix (i.e. ``x-custom-`` will cause + // all headers prefixed by ``x-custom-`` to be omitted from the SXG document) + repeated string header_prefix_filters = 9 [ + (validate.rules).repeated = {items {string {well_known_regex: HTTP_HEADER_NAME strict: false}}} + ]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/e492a9f4579ddc0ad028b42e50c646fbca0fbd68d1bfcf621c04ec1cd1ba30bd7b0f0e8f24d6e7e6179d328ceccfd82cfeee61fb4bc91f4f6aec79a605fa4d40 b/modules/sync/envoyproxy/envoy/cas/e492a9f4579ddc0ad028b42e50c646fbca0fbd68d1bfcf621c04ec1cd1ba30bd7b0f0e8f24d6e7e6179d328ceccfd82cfeee61fb4bc91f4f6aec79a605fa4d40 new file mode 100644 index 00000000..bca2944d --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/e492a9f4579ddc0ad028b42e50c646fbca0fbd68d1bfcf621c04ec1cd1ba30bd7b0f0e8f24d6e7e6179d328ceccfd82cfeee61fb4bc91f4f6aec79a605fa4d40 @@ -0,0 +1,34 @@ +syntax = "proto3"; + +package envoy.admin.v3; + +import "udpa/annotations/status.proto"; +import "udpa/annotations/versioning.proto"; + +option java_package = "io.envoyproxy.envoy.admin.v3"; +option java_outer_classname = "MutexStatsProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/admin/v3;adminv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: MutexStats] + +// Proto representation of the statistics collected upon absl::Mutex contention, if Envoy is run +// under :option:`--enable-mutex-tracing`. For more information, see the ``absl::Mutex`` +// `docs `__. +// +// *NB*: The wait cycles below are measured by ``absl::base_internal::CycleClock``, and may not +// correspond to core clock frequency. For more information, see the ``CycleClock`` +// `docs `__. +message MutexStats { + option (udpa.annotations.versioning).previous_message_type = "envoy.admin.v2alpha.MutexStats"; + + // The number of individual mutex contentions which have occurred since startup. + uint64 num_contentions = 1; + + // The length of the current contention wait cycle. + uint64 current_wait_cycles = 2; + + // The lifetime total of all contention wait cycles. + uint64 lifetime_wait_cycles = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/e4e8ec2ca3180e520c0f89af150fbaebc08714966fa37cba4e42400c25258de81a6f4d9a979b285a010620246df74d8450251968717201c5d0f1b22170f5883e b/modules/sync/envoyproxy/envoy/cas/e4e8ec2ca3180e520c0f89af150fbaebc08714966fa37cba4e42400c25258de81a6f4d9a979b285a010620246df74d8450251968717201c5d0f1b22170f5883e new file mode 100644 index 00000000..111ac34f --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/e4e8ec2ca3180e520c0f89af150fbaebc08714966fa37cba4e42400c25258de81a6f4d9a979b285a010620246df74d8450251968717201c5d0f1b22170f5883e @@ -0,0 +1,134 @@ +syntax = "proto3"; + +package envoy.extensions.clusters.mcp_multicluster.v3; + +import "envoy/type/matcher/v3/string.proto"; + +import "google/protobuf/duration.proto"; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.clusters.mcp_multicluster.v3"; +option java_outer_classname = "ClusterProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/clusters/mcp_multicluster/v3;mcp_multiclusterv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: MCP multi cluster configuration] + +// Configuration for the MCP multi cluster. See the :ref:`architecture overview +// ` for more information. This cluster type allows aggregation of +// multiple clusters into one, providing metadata with the list of aggregated clusters. +// Use the ``attemptCount`` property of the request ``StreamInfo`` object to select host in a specific subcluster. +// If the ``attemptCount`` value is greater than the number of aggregated clusters, the host selection will fail. +// +// The primary purpose of this cluster extension is to provide the list of servers for the MCP router +// configured for tool and resource aggregation. For details of how tools and resource are aggregated see +// :ref:`MCP router documentation`. +// +// Example configuration: +// +// .. code-block:: yaml +// +// name: mcp_multicluster +// connect_timeout: 0.25s +// lb_policy: CLUSTER_PROVIDED +// cluster_type: +// name: envoy.clusters.mcp_multicluster +// typed_config: +// "@type": type.googleapis.com/envoy.extensions.clusters.mcp_multicluster.v3.ClusterConfig +// servers: +// - name: build_tools +// mcp_cluster: +// cluster: build_tools +// - name: review_tools +// mcp_cluster: +// cluster: review_tools +// host_rewrite_literal: "mcp.review_tools.acme.com" +// +// [#extension: envoy.clusters.mcp_multicluster] +message ClusterConfig { + // Cluster-based backend configuration. + message McpCluster { + // Cluster name to route requests to. + string cluster = 1 [(validate.rules).string = {min_len: 1}]; + + // Path to use for MCP requests. Defaults to "/mcp". + string path = 2; + + // Request timeout. + // If not set, uses cluster's timeout configuration. + google.protobuf.Duration timeout = 3; + + // Indicates that during forwarding, the host header will be swapped with + // this value. + string host_rewrite_literal = 4; + } + + // Specifies which downstream request headers are allowed to be forwarded to an MCP + // backend. Modeled after + // :ref:`ext_proc's HeaderForwardingRules `, + // but MCP-local and secure-by-default: unlike ext_proc, an unset/empty policy + // forwards nothing rather than everything, because MCP requires audience-bound + // tokens and prohibits implicit token passthrough between a client and a backend it + // did not authenticate to. + // + // Evaluation order per header: + // + // 1. If the header matches ``disallowed_headers``, it is never forwarded — this + // takes precedence over everything below, including ``forward_all``. + // 2. Otherwise, if ``forward_all`` is true, the header is forwarded. + // 3. Otherwise, if the header matches ``allowed_headers``, it is forwarded. + // 4. Otherwise, the header is not forwarded. + // + // This does not cover header *mutation* or credential injection, which remain a + // separate concern from this policy. + message HeaderForwarding { + // If true, forward all downstream request headers to this backend (subject to + // ``disallowed_headers`` above), matching the legacy forward-everything behavior. + // Defaults to false. Users relying on the legacy behavior must set this explicitly. + bool forward_all = 1; + + // If set, specifically allow any header in this list to be forwarded. Ignored for a + // header that also matches ``disallowed_headers``, and redundant (but harmless) for + // any header covered by ``forward_all``. + type.matcher.v3.ListStringMatcher allowed_headers = 2; + + // If set, specifically disallow any header in this list from being forwarded. This + // takes precedence over both ``forward_all`` and ``allowed_headers``. + type.matcher.v3.ListStringMatcher disallowed_headers = 3; + } + + // Specification of the MCP server. + message McpBackend { + // Unique name for this backend. Used for: + // - Tool name prefixing (e.g., "time__get_current_time") + // - Session ID composition + // - Logging and error messages. + // Default will be the cluster name if not specified. + string name = 1; + + // Backend target specification. + McpCluster mcp_cluster = 2; + + // Controls which downstream request headers are forwarded to this backend. + // If not set, no downstream-controlled headers are forwarded beyond those the + // router itself must synthesize (e.g. ``content-type``, ``accept``, the session + // header) — in particular, a client's ``authorization`` header is NOT forwarded + // by default. Router-owned, framing, session, and hop-by-hop headers are never + // affected by this policy; they are handled separately and can never be forwarded + // via this mechanism. + HeaderForwarding header_forwarding = 3; + } + + // A list of remote MCP servers. + // Based on the MCP multi cluster configuration the MCP router aggregates capabilities, tools and resources from remote MCP servers + // and presents itself as single MCP server to the client. All remote MCP servers are sent the same capabilities + // that the client presented to Envoy. MCP router prefixes tool names and resource path with the server name to resolve + // naming collisions. + repeated McpBackend servers = 1 [(validate.rules).repeated = {min_items: 1}]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/e5c42b5f36a8128ff99b253ec122dba8700caff3e217f16edb1adf4f5d9b012016e1bc9e5fb486e37734b414b2d7ae1ceb535e5b16f4d085429356f7eed34220 b/modules/sync/envoyproxy/envoy/cas/e5c42b5f36a8128ff99b253ec122dba8700caff3e217f16edb1adf4f5d9b012016e1bc9e5fb486e37734b414b2d7ae1ceb535e5b16f4d085429356f7eed34220 new file mode 100644 index 00000000..6b53f9da --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/e5c42b5f36a8128ff99b253ec122dba8700caff3e217f16edb1adf4f5d9b012016e1bc9e5fb486e37734b414b2d7ae1ceb535e5b16f4d085429356f7eed34220 @@ -0,0 +1,213 @@ +syntax = "proto3"; + +package envoy.extensions.upstreams.http.v3; + +import "envoy/config/common/matcher/v3/matcher.proto"; +import "envoy/config/core/v3/extension.proto"; +import "envoy/config/core/v3/protocol.proto"; +import "envoy/config/route/v3/route_components.proto"; +import "envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.upstreams.http.v3"; +option java_outer_classname = "HttpProtocolOptionsProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/upstreams/http/v3;httpv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: HTTP Protocol Options] +// [#extension: envoy.upstreams.http.http_protocol_options] + +// HttpProtocolOptions specifies Http upstream protocol options. This object +// is used in +// :ref:`typed_extension_protocol_options`, +// keyed by the name ``envoy.extensions.upstreams.http.v3.HttpProtocolOptions``. +// +// This controls what protocol(s) should be used for upstream and how said protocol(s) are configured. +// +// This replaces the prior pattern of explicit protocol configuration directly +// in the cluster. So a configuration like this, explicitly configuring the use of HTTP/2 upstream: +// +// .. code:: +// +// clusters: +// - name: some_service +// connect_timeout: 5s +// upstream_http_protocol_options: +// auto_sni: true +// common_http_protocol_options: +// idle_timeout: 1s +// http2_protocol_options: +// max_concurrent_streams: 100 +// .... [further cluster config] +// +// Would now look like this: +// +// .. code:: +// +// clusters: +// - name: some_service +// connect_timeout: 5s +// typed_extension_protocol_options: +// envoy.extensions.upstreams.http.v3.HttpProtocolOptions: +// "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions +// upstream_http_protocol_options: +// auto_sni: true +// common_http_protocol_options: +// idle_timeout: 1s +// explicit_http_config: +// http2_protocol_options: +// max_concurrent_streams: 100 +// .... [further cluster config] +// [#next-free-field: 12] +message HttpProtocolOptions { + // If this is used, the cluster will only operate on one of the possible upstream protocols. + // Note that HTTP/2 or above should generally be used for upstream gRPC clusters. + message ExplicitHttpConfig { + oneof protocol_config { + option (validate.required) = true; + + config.core.v3.Http1ProtocolOptions http_protocol_options = 1; + + config.core.v3.Http2ProtocolOptions http2_protocol_options = 2; + + config.core.v3.Http3ProtocolOptions http3_protocol_options = 3; + } + } + + // If this is used, the cluster can use either of the configured protocols, and + // will use whichever protocol was used by the downstream connection. + // + // If HTTP/3 is configured for downstream and not configured for upstream, + // HTTP/3 requests will fail over to HTTP/2. + message UseDownstreamHttpConfig { + config.core.v3.Http1ProtocolOptions http_protocol_options = 1; + + config.core.v3.Http2ProtocolOptions http2_protocol_options = 2; + + config.core.v3.Http3ProtocolOptions http3_protocol_options = 3; + } + + // If this is used, the cluster can use either HTTP/1 or HTTP/2, and will use whichever + // protocol is negotiated by ALPN with the upstream. + // Clusters configured with ``AutoHttpConfig`` will use the highest available + // protocol; HTTP/2 if supported, otherwise HTTP/1. + // If the upstream does not support ALPN, ``AutoHttpConfig`` will fail over to HTTP/1. + // This can only be used with transport sockets which support ALPN. Using a + // transport socket which does not support ALPN will result in configuration + // failure. The transport layer may be configured with custom ALPN, but the default ALPN + // for the cluster (or if custom ALPN fails) will be "h2,http/1.1". + message AutoHttpConfig { + config.core.v3.Http1ProtocolOptions http_protocol_options = 1; + + config.core.v3.Http2ProtocolOptions http2_protocol_options = 2; + + // Unlike HTTP/1 and HTTP/2, HTTP/3 will not be configured unless it is + // present, and only if there is an indication of server side + // support. + // See :ref:`here ` for more information on + // when HTTP/3 will be used, and when Envoy will fail over to TCP. + config.core.v3.Http3ProtocolOptions http3_protocol_options = 3; + + // The presence of alternate protocols cache options causes the use of the + // alternate protocols cache, which is responsible for parsing and caching + // HTTP Alt-Svc headers. This enables the use of HTTP/3 for origins that + // advertise supporting it. + // + // .. note:: + // This is required when HTTP/3 is enabled. + config.core.v3.AlternateProtocolsCacheOptions alternate_protocols_cache_options = 4; + } + + message OutlierDetection { + // If specified, only responses matching the matcher will be treated by outlier detection as errors. + // If not specified, only 5xx codes are treated by outlier detection as errors. + config.common.matcher.v3.MatchPredicate error_matcher = 1 + [(validate.rules).message = {required: true}]; + } + + // This contains options common across HTTP/1 and HTTP/2 + config.core.v3.HttpProtocolOptions common_http_protocol_options = 1; + + // This contains common protocol options which are only applied upstream. + config.core.v3.UpstreamHttpProtocolOptions upstream_http_protocol_options = 2; + + // This controls the actual protocol to be used upstream. + oneof upstream_protocol_options { + option (validate.required) = true; + + // To explicitly configure either HTTP/1 or HTTP/2 (but not both!) use ``explicit_http_config``. + ExplicitHttpConfig explicit_http_config = 3; + + // This allows switching on protocol based on what protocol the downstream + // connection used. + UseDownstreamHttpConfig use_downstream_protocol_config = 4; + + // This allows switching on protocol based on ALPN + AutoHttpConfig auto_config = 5; + } + + // Optional HTTP filters for the upstream HTTP filter chain. + // + // .. note:: + // Upstream HTTP filters are currently in alpha. + // + // + // These filters will be applied for all HTTP streams which flow through this + // cluster. Unlike downstream HTTP filters, they will *not* be applied to terminated CONNECT requests. + // + // If using upstream HTTP filters, please be aware that local errors sent by + // upstream HTTP filters will not trigger retries, and local errors sent by + // upstream HTTP filters will count as a final response if hedging is configured. + // [#extension-category: envoy.filters.http.upstream] + repeated filters.network.http_connection_manager.v3.HttpFilter http_filters = 6; + + // Configuration options for Unified Header Validation (UHV). + // UHV is an extensible mechanism for checking validity of HTTP responses. + // + // [#comment:TODO(yanavlasov): Make it a link to the default header validator doc when it becomes visible.] + // Leaving this field unspecified, selects the default header validator ``envoy.http.header_validators.envoy_default``. + // + // [#not-implemented-hide:] + // [#extension-category: envoy.http.header_validators] + config.core.v3.TypedExtensionConfig header_validation_config = 7; + + // Defines http specific outlier detection parameters. + OutlierDetection outlier_detection = 8; + + // Specifies a list of HTTP-level mirroring policies for requests routed to this cluster. + // Cluster-level policies override route-level policies when they both are configured. + // + // .. note:: + // + // Mirroring will not be triggered if the :ref:`primary cluster + // ` does not exist. + repeated config.route.v3.RouteAction.RequestMirrorPolicy request_mirror_policies = 9; + + // Specifies a list of hash policies for consistent hashing load balancing (e.g., Ring Hash or + // Maglev) for requests routed to this cluster. When configured, cluster-level policies override + // route-level policies. When not configured, route-level policies (if any) will be used. + // + // This enables consistent routing to the same upstream host for all requests to a cluster, + // which is particularly useful for stateful services like caching, session management, or + // sticky routing requirements. + // + // .. note:: + // + // Hash policies are only effective when the cluster is configured with a hash-based load + // balancing policy (e.g., :ref:`RING_HASH ` + // or :ref:`MAGLEV `). + repeated config.route.v3.RouteAction.HashPolicy hash_policy = 10; + + // Specifies the retry policy for requests routed to this cluster. When configured, + // cluster-level retry policy overrides route-level retry policy. When not configured, + // route-level retry policy (if any) will be used. + // + // .. note:: + // + // Cluster-level retry policy will override route-level retry policy entirely. Policies are + // not merged. + config.route.v3.RetryPolicy retry_policy = 11; +} diff --git a/modules/sync/envoyproxy/envoy/cas/e7b2aa046c34262556a5d6bafe6de68e303abc33b1bedb53514c3aef61660502bc60baf30d1014820e8f735de65efb7fc2af55feedf2062cee2255e1c7f9f325 b/modules/sync/envoyproxy/envoy/cas/e7b2aa046c34262556a5d6bafe6de68e303abc33b1bedb53514c3aef61660502bc60baf30d1014820e8f735de65efb7fc2af55feedf2062cee2255e1c7f9f325 new file mode 100644 index 00000000..48c3cbc7 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/e7b2aa046c34262556a5d6bafe6de68e303abc33b1bedb53514c3aef61660502bc60baf30d1014820e8f735de65efb7fc2af55feedf2062cee2255e1c7f9f325 @@ -0,0 +1,134 @@ +syntax = "proto3"; + +package envoy.config.core.v3; + +import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/extension.proto"; + +import "google/protobuf/struct.proto"; + +import "envoy/annotations/deprecation.proto"; +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.config.core.v3"; +option java_outer_classname = "SubstitutionFormatStringProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/config/core/v3;corev3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Substitution format string] + +// Optional configuration options to be used with json_format. +message JsonFormatOptions { + // The output JSON string properties will be sorted. + // + // .. note:: + // As the properties are always sorted, this option has no effect and is deprecated. + // + bool sort_properties = 1 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; +} + +// Configuration to use multiple :ref:`command operators ` +// to generate a new string in either plain text or JSON format. +// [#next-free-field: 8] +message SubstitutionFormatString { + oneof format { + option (validate.required) = true; + + // Specify a format with command operators to form a text string. + // Its details is described in :ref:`format string`. + // + // For example, setting ``text_format`` like below, + // + // .. validated-code-block:: yaml + // :type-name: envoy.config.core.v3.SubstitutionFormatString + // + // text_format: "%LOCAL_REPLY_BODY%:%RESPONSE_CODE%:path=%REQ(:path)%\n" + // + // generates plain text similar to: + // + // .. code-block:: text + // + // upstream connect error:503:path=/foo + // + // Deprecated in favor of :ref:`text_format_source `. To migrate text format strings, use the :ref:`inline_string ` field. + string text_format = 1 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Specify a format with command operators to form a JSON string. + // Its details is described in :ref:`format dictionary`. + // Values are rendered as strings, numbers, or boolean values as appropriate. + // Nested JSON objects may be produced by some command operators (e.g. FILTER_STATE or DYNAMIC_METADATA). + // See the documentation for a specific command operator for details. + // + // .. validated-code-block:: yaml + // :type-name: envoy.config.core.v3.SubstitutionFormatString + // + // json_format: + // status: "%RESPONSE_CODE%" + // message: "%LOCAL_REPLY_BODY%" + // + // The following JSON object would be created: + // + // .. code-block:: json + // + // { + // "status": 500, + // "message": "My error message" + // } + // + google.protobuf.Struct json_format = 2 [(validate.rules).message = {required: true}]; + + // Specify a format with command operators to form a text string. + // Its details is described in :ref:`format string`. + // + // For example, setting ``text_format`` like below, + // + // .. validated-code-block:: yaml + // :type-name: envoy.config.core.v3.SubstitutionFormatString + // + // text_format_source: + // inline_string: "%LOCAL_REPLY_BODY%:%RESPONSE_CODE%:path=%REQ(:path)%\n" + // + // generates plain text similar to: + // + // .. code-block:: text + // + // upstream connect error:503:path=/foo + // + DataSource text_format_source = 5; + } + + // If set to true, when command operators are evaluated to null, + // + // * for ``text_format``, the output of the empty operator is changed from ``-`` to an + // empty string, so that empty values are omitted entirely. + // * for ``json_format``, the keys with null values are omitted in the output structure. Nested + // objects whose values are all omitted are removed as well, while empty arrays are preserved. + // The root object is always emitted, so a fully empty structure is rendered as ``{}``. + // + // Defaults to false. + bool omit_empty_values = 3; + + // Specify a ``content_type`` field. + // If this field is not set then ``text/plain`` is used for ``text_format`` and + // ``application/json`` is used for ``json_format``. + // + // .. validated-code-block:: yaml + // :type-name: envoy.config.core.v3.SubstitutionFormatString + // + // content_type: "text/html; charset=UTF-8" + // + string content_type = 4 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE strict: false}]; + + // Specifies a collection of Formatter plugins that can be called from the access log configuration. + // See the formatters extensions documentation for details. + // [#extension-category: envoy.formatter] + repeated TypedExtensionConfig formatters = 6; + + // If json_format is used, the options will be applied to the output JSON string. + JsonFormatOptions json_format_options = 7; +} diff --git a/modules/sync/envoyproxy/envoy/cas/ebd2cbaece394e9f426b8b40c0e8394f607926395b48af0f7c4729e83d401d6b05cb4170a2b27af730704e17dcf018e6148f1404634c444a9f0b45527fb53c02 b/modules/sync/envoyproxy/envoy/cas/ebd2cbaece394e9f426b8b40c0e8394f607926395b48af0f7c4729e83d401d6b05cb4170a2b27af730704e17dcf018e6148f1404634c444a9f0b45527fb53c02 new file mode 100644 index 00000000..311a3e90 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/ebd2cbaece394e9f426b8b40c0e8394f607926395b48af0f7c4729e83d401d6b05cb4170a2b27af730704e17dcf018e6148f1404634c444a9f0b45527fb53c02 @@ -0,0 +1,112 @@ +syntax = "proto3"; + +package envoy.data.ai.v3; + +import "envoy/type/ai/v3/llm_protocol.proto"; + +import "google/protobuf/wrappers.proto"; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.data.ai.v3"; +option java_outer_classname = "TokenUsageProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/data/ai/v3;aiv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: AI token usage] + +// Canonical LLM token usage extracted from a provider response by the +// :ref:`AI Protocol Manager filter `, +// published as typed dynamic metadata under one namespace at a clean end of +// stream. +// +// Counts are normalized onto one *inclusive* contract regardless of wire API: +// ``input_tokens`` covers all input consumed (uncached input, cached reads, +// cache writes, and tool-use prompt tokens) and ``output_tokens`` covers all +// generated output including reasoning/thought tokens; the detail messages +// are subsets of those canonical values. Every value remains +// provider-reported and is not independently verified by Envoy. +// +// Every count is optional: wire APIs report different subsets, and a +// status-only record (``llm_protocol``, ``model`` when captured, and +// ``extraction_status: FAILED``) is published when extraction failed +// outright, distinguishing that from a response that supplied no usage +// (which publishes nothing). +// [#next-free-field: 10] +message TokenUsage { + // Quality of the extraction result. + enum ExtractionStatus { + EXTRACTION_STATUS_UNSPECIFIED = 0; + + // All observed usage-bearing data was parsed successfully. + COMPLETE = 1; + + // Usable counts were extracted, but some usage-bearing input was lost: + // malformed, truncated, or skipped by a configured resource limit. The + // counts may be stale (an earlier cumulative snapshot) or incomplete. + PARTIAL = 2; + + // Usage-bearing input was observed but no usable canonical count could + // be extracted; only ``llm_protocol`` and ``model`` may be populated. + FAILED = 3; + } + + // The wire API the usage was extracted from. This names an API contract, + // not a provider identity: any OpenAI-compatible backend reports an OpenAI + // protocol here. + type.ai.v3.LLMProtocol llm_protocol = 1; + + // The model reported by the response, when present. + string model = 2; + + // Canonical inclusive input token count. + google.protobuf.UInt64Value input_tokens = 3; + + // Canonical inclusive output token count. + google.protobuf.UInt64Value output_tokens = 4; + + // Canonical total: ``input_tokens + output_tokens``. Present only when + // both canonical components are known, so the triple is always internally + // consistent. Compare against ``provider_total_tokens`` to detect a + // provider that reports inconsistently or in buckets unknown to the + // extractor. + google.protobuf.UInt64Value total_tokens = 5; + + // Canonical input token breakdown. + InputTokenDetails input_token_details = 6; + + // Canonical output token breakdown. + OutputTokenDetails output_token_details = 7; + + // The total token count reported directly by the provider, when it + // reported one — preserved regardless of whether it agrees with + // ``total_tokens``. + google.protobuf.UInt64Value provider_total_tokens = 8; + + // Quality of the extraction result. + ExtractionStatus extraction_status = 9; +} + +// Subsets of :ref:`input_tokens +// `. +message InputTokenDetails { + // Cache-read input tokens. + google.protobuf.UInt64Value cached_tokens = 1; + + // Cache-creation (cache-write) input tokens. + google.protobuf.UInt64Value cache_creation_tokens = 2; + + // Tool-use prompt tokens. + google.protobuf.UInt64Value tool_use_tokens = 3; +} + +// Subsets of :ref:`output_tokens +// `. +message OutputTokenDetails { + // Reasoning or thought tokens. + google.protobuf.UInt64Value reasoning_tokens = 1; +} diff --git a/modules/sync/envoyproxy/envoy/cas/ed2b6a76c3a187e8fd6cae370d0e0a787eec1d4dd807e2e13c170dc2635fd149848cc080915dbe5ffe528aea043cd97efebff4cc691f99bfb3c1aa81b3da3066 b/modules/sync/envoyproxy/envoy/cas/ed2b6a76c3a187e8fd6cae370d0e0a787eec1d4dd807e2e13c170dc2635fd149848cc080915dbe5ffe528aea043cd97efebff4cc691f99bfb3c1aa81b3da3066 new file mode 100644 index 00000000..5b782980 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/ed2b6a76c3a187e8fd6cae370d0e0a787eec1d4dd807e2e13c170dc2635fd149848cc080915dbe5ffe528aea043cd97efebff4cc691f99bfb3c1aa81b3da3066 @@ -0,0 +1,51 @@ +syntax = "proto3"; + +package envoy.extensions.health_checkers.udp.v3; + +import "envoy/config/core/v3/health_check.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.health_checkers.udp.v3"; +option java_outer_classname = "UdpProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/health_checkers/udp/v3;udpv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: UDP Health Checker] +// [#extension: envoy.health_checkers.udp] + +// Configuration for the UDP health checker. +// +// For every health-check attempt, Envoy creates a fresh connected UDP socket targeting the host's +// :ref:`health check address +// `. UDP ``connect()`` +// only selects the peer; it does not establish connectivity and does not count as a successful +// health check. The :ref:`reuse_connection +// ` setting does not apply. +// +// Attempts for a host are serialized so that only one attempt is active at a time. Envoy sends +// exactly one datagram containing ``send`` and waits for a response until the enclosing +// :ref:`HealthCheck.timeout ` expires. +// +// The connected socket accepts datagrams only from the configured peer. Each complete response +// datagram is compared byte-for-byte with ``receive``. A matching datagram completes the attempt +// successfully. Non-matching datagrams do not satisfy the check; Envoy continues waiting until a +// matching datagram arrives or the attempt times out. A timeout or local socket error completes +// the attempt unsuccessfully. +// +// The enclosing :ref:`HealthCheck +// ` controls thresholds, intervals, jitter, +// statistics, and event logging. +message UdpHealthCheck { + // Payload sent as exactly one UDP datagram at the start of each health-check attempt. The decoded + // payload must not exceed 65,507 bytes. A smaller payload may be required to avoid IP + // fragmentation along the network path. + config.core.v3.HealthCheck.Payload send = 1 [(validate.rules).message = {required: true}]; + + // Expected response payload. A response datagram must match the entire payload exactly to make + // the health-check attempt successful. The decoded payload must not exceed 65,507 bytes. A + // smaller payload may be required to avoid IP fragmentation along the network path. + config.core.v3.HealthCheck.Payload receive = 2 [(validate.rules).message = {required: true}]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/efb8ed39a57b9e43f6bccdb2ba69ac487f4ca21e429d3ee18923735b02fa24373c7ddfa0c54c36121a32f857009e7224623e4397901f2ba732bec021a5f85f63 b/modules/sync/envoyproxy/envoy/cas/efb8ed39a57b9e43f6bccdb2ba69ac487f4ca21e429d3ee18923735b02fa24373c7ddfa0c54c36121a32f857009e7224623e4397901f2ba732bec021a5f85f63 new file mode 100644 index 00000000..8e146b57 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/efb8ed39a57b9e43f6bccdb2ba69ac487f4ca21e429d3ee18923735b02fa24373c7ddfa0c54c36121a32f857009e7224623e4397901f2ba732bec021a5f85f63 @@ -0,0 +1,38 @@ +syntax = "proto3"; + +package envoy.extensions.http.ai_filters.schema_validation.v3; + +import "envoy/type/ai/v3/llm_protocol.proto"; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.http.ai_filters.schema_validation.v3"; +option java_outer_classname = "SchemaValidationProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/http/ai_filters/schema_validation/v3;schema_validationv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: Schema validation AI filter] +// Schema validation AI filter :ref:`configuration overview +// `. +// [#extension: envoy.http.ai_filters.schema_validation] + +// Validates the request payload against the payload schema of its wire API, and rejects a payload +// that violates it with a 400. Configure it first, so the AI filters after it see the API it +// resolved and only a payload that passed. +message SchemaValidation { + // The wire API for a request that declares none, through either the + // ``envoy.ai.llm_protocol.request`` filter state object or the route's :ref:`llm_protocol + // `. + // ``LLM_PROTOCOL_UNSPECIFIED``, the default, detects it from the request path, then the + // ``anthropic-version`` header, then the payload's shape. A request none of them identifies is + // forwarded unvalidated. + type.ai.v3.LLMProtocol default_llm_protocol = 1 [(validate.rules).enum = {defined_only: true}]; + + // Forward a payload that violates its schema instead of rejecting it. It is still counted. + bool fail_open = 2; +} diff --git a/modules/sync/envoyproxy/envoy/cas/f1b8280cc604c780329caf36ad0e5fc63be76a77f28d552e14d17024ddeceebe7fde9b9744a8fe5499bf83ff26b10cb754d8e4ea5c5f5e00675ae56634d89ac2 b/modules/sync/envoyproxy/envoy/cas/f1b8280cc604c780329caf36ad0e5fc63be76a77f28d552e14d17024ddeceebe7fde9b9744a8fe5499bf83ff26b10cb754d8e4ea5c5f5e00675ae56634d89ac2 new file mode 100644 index 00000000..986c099e --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/f1b8280cc604c780329caf36ad0e5fc63be76a77f28d552e14d17024ddeceebe7fde9b9744a8fe5499bf83ff26b10cb754d8e4ea5c5f5e00675ae56634d89ac2 @@ -0,0 +1,66 @@ +syntax = "proto3"; + +package envoy.extensions.filters.udp.dynamic_modules.v3; + +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.udp.dynamic_modules.v3"; +option java_outer_classname = "DynamicModulesProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/udp/dynamic_modules/v3;dynamic_modulesv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Dynamic Modules UDP Listener Filter] +// [#extension: envoy.filters.udp_listener.dynamic_modules] + +// Configuration for the Dynamic Modules UDP listener filter. This filter allows loading shared object +// files that can be loaded via ``dlopen`` to extend the UDP listener filter chain. +// +// A module can be loaded by multiple UDP listener filters; the module is loaded only once and shared +// across multiple filters. +message DynamicModuleUdpListenerFilter { + // Specifies the shared-object level configuration. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1; + + // The name for this filter configuration. + // + // This can be used to distinguish between different filter implementations inside a dynamic + // module. For example, a module can have completely different filter implementations. When Envoy + // receives this configuration, it passes the ``filter_name`` to the dynamic module's UDP listener + // filter config init function together with the ``filter_config``. That way a module can decide + // which in-module filter implementation to use based on the name at load time. + string filter_name = 2; + + // The configuration for the filter chosen by ``filter_name``. + // + // This is passed to the module's UDP listener filter initialization function. Together with the + // ``filter_name``, the module can decide which in-module filter implementation to use and + // fine-tune the behavior of the filter. + // + // For example, if a module has two filter implementations, one for echo and one for rate + // limiting, ``filter_name`` is used to choose either echo or rate limiting. The + // ``filter_config`` can be used to configure the echo behavior or the rate limiting parameters. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly + // without the wrapper. + // + // .. code-block:: yaml + // + // # Passing a string value + // filter_config: + // "@type": "type.googleapis.com/google.protobuf.StringValue" + // value: hello + // + // # Passing raw bytes + // filter_config: + // "@type": "type.googleapis.com/google.protobuf.BytesValue" + // value: aGVsbG8= # echo -n "hello" | base64 + // + google.protobuf.Any filter_config = 3; +} diff --git a/modules/sync/envoyproxy/envoy/cas/f535bb9e68b1fc31fd34345beef2ac4f6b1ccd8ee0207a12fb673394c16cd6e9c7ae13a75f14f9f0b1bfd2664c1942318c8189fc4dcf1fea76de4ba64afe7c4e b/modules/sync/envoyproxy/envoy/cas/f535bb9e68b1fc31fd34345beef2ac4f6b1ccd8ee0207a12fb673394c16cd6e9c7ae13a75f14f9f0b1bfd2664c1942318c8189fc4dcf1fea76de4ba64afe7c4e new file mode 100644 index 00000000..ee379e8d --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/f535bb9e68b1fc31fd34345beef2ac4f6b1ccd8ee0207a12fb673394c16cd6e9c7ae13a75f14f9f0b1bfd2664c1942318c8189fc4dcf1fea76de4ba64afe7c4e @@ -0,0 +1,263 @@ +syntax = "proto3"; + +package envoy.extensions.filters.http.ai_protocol_manager.v3; + +import "envoy/config/core/v3/extension.proto"; +import "envoy/type/ai/v3/llm_protocol.proto"; + +import "google/protobuf/wrappers.proto"; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.ai_protocol_manager.v3"; +option java_outer_classname = "AiProtocolManagerProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ai_protocol_manager/v3;ai_protocol_managerv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: AI Protocol Manager] +// AI Protocol Manager filter +// :ref:`configuration overview `. +// [#extension: envoy.filters.http.ai_protocol_manager] + +// Configuration for the AI Protocol Manager filter. +// +// The filter manages AI endpoint traffic on both directions of a stream. On +// the request path it holds a declared AI endpoint's payload and parses it, +// which is what lets routing, admission and policy act on a payload the proxy +// understands rather than on opaque bytes. On the response path it can +// extract normalized LLM token usage into dynamic metadata. +// +// Request and response processing are independently enabled by the presence +// of ``request_handling`` and ``response_handling``. Which routes are AI +// endpoints — and which :ref:`wire API ` +// each speaks — is declared with the :ref:`per-route configuration +// `. +message AiProtocolManager { + // Request-side AI protocol processing. When unset, the decode path is a + // pure passthrough — including on routes carrying per-route configuration. + RequestHandling request_handling = 1; + + // Response-side AI protocol processing. When unset, the encode path is a + // pure passthrough. + ResponseHandling response_handling = 2; + + // AI filters, in order. They run over a declared AI endpoint's parsed request payload + // before it continues down the HTTP filter chain, and require ``request_handling``. + // [#extension-category: envoy.http.ai_filters] + repeated config.core.v3.TypedExtensionConfig filters = 3; +} + +// Request-side processing configuration. A route that carries a +// :ref:`per-route request declaration +// ` +// has its payload held, offloaded, and parsed strictly: a body that is not +// well-formed JSON is rejected with a 400 rather than forwarded for the +// upstream to interpret differently. +message RequestHandling { + // How the request body is written out once the :ref:`AI filters + // ` + // finish. + enum BodyReserialization { + // Re-serialize the parsed document, so the edits AI filters make to it reach the upstream. + ALWAYS = 0; + + // Forward the received body byte for byte. Edits AI filters make to the parsed document are + // not sent, so use this only with AI filters that read the request, such as request info. + DISABLE = 1; + } + + // Attempt best-effort JSON parsing on routes without a per-route + // configuration. + // + // Defaults to ``false``: unconfigured routes are not buffered or parsed. + // When ``true``, such routes are parsed too, but never failed over it — a + // route that declared no AI wire contract has nothing to hold its payload + // to, so a body that fails to parse is forwarded unchanged. + // + // Only requests that can be held to end of stream are taken: the request must + // carry a JSON content type (``application/json`` or a ``+json`` suffix) and + // must not be gRPC or Connect streaming, an upgrade, or a CONNECT. Holding a + // full-duplex request would stall it, since the client may not finish the + // request until it sees a response the held upstream cannot produce. + bool parse_unconfigured_routes = 1; + + // Request-path parsing limits. Defaults apply when unset. + RequestParsingLimits limits = 2; + + // Whether the parsed request is re-serialized once the AI filters finish. Defaults to ``ALWAYS``. + // Requests that run no AI filters are forwarded as received either way. + BodyReserialization reserialize_body = 3 [(validate.rules).enum = {defined_only: true}]; +} + +// Per-stream limits for request payload parsing. +message RequestParsingLimits { + // Maximum size, in bytes, of a decoded string value kept inline in the + // parsed document; a larger value stays in the external buffer and is + // referenced by offset. Object keys are always inline. + // + // This is the deployment-wide default, applied when a declared API's payload + // schema does not pin its own threshold. Defaults to 1KiB, which keeps + // ordinary metadata (model names, roles, tool names) inline while + // conversation content goes to the buffer. + // + // Keep it above the longest ``model`` name in use. Values over the threshold + // are offloaded, and the :ref:`schema validation AI filter + // ` + // requires ``model`` inline, so it rejects an offloaded one with a 400. + google.protobuf.UInt32Value inline_string_threshold_bytes = 1 + [(validate.rules).uint32 = {lte: 1048576 gte: 64}]; +} + +// Response-side processing configuration. Individual response features are +// enabled by the presence of their corresponding messages. +message ResponseHandling { + // Extract canonical token usage from eligible AI responses. When unset, + // token usage extraction is disabled. + TokenUsageExtraction token_usage = 1; +} + +// Configuration for canonical response token-usage extraction. +// +// Eligible 2xx SSE and JSON responses are observed as they stream through; +// the filter never stops iteration or modifies the response, and no +// extraction failure can affect it. The result is published at a clean end +// of stream under one namespace as typed dynamic metadata: the authoritative +// record is :ref:`envoy.data.ai.v3.TokenUsage +// `, consumable through typed +// metadata readers such as ext_proc typed forwarding. No untyped ``Struct`` +// mirror is emitted. +// [#next-free-field: 6] +message TokenUsageExtraction { + // Stream signals emitted upon publishing token usage metadata. + enum UsageSignal { + USAGE_SIGNAL_UNSPECIFIED = 0; + + // Synthesize empty response trailers at end of stream if none exist. + // This wakes downstream trailer-driven consumers (such as ext_proc with + // ``response_trailer_mode: SEND``) with metadata context without transferring + // response body bytes. + SYNTHESIZE_TRAILERS = 1; + } + + // Also inspect responses on routes without per-route configuration. + // + // Defaults to ``false``: only routes carrying an + // :ref:`AiProtocolManagerPerRoute + // ` + // configuration are inspected, so enabling token usage on a mixed listener + // does not silently parse unrelated JSON/SSE responses. Enable this for + // response-only installations whose routes cannot be declared — for + // example an upstream installation on a dynamic-forward-proxy cluster. + bool include_unconfigured_routes = 1; + + // Fallback wire API used when the route does not identify a response API. + // + // ``LLM_PROTOCOL_UNSPECIFIED`` means auto-detect from the response shape + // (only strongly shaped, value-validated markers lock a stream). This is a + // fallback, not an override of per-route response configuration; see the + // :ref:`per-route configuration + // ` + // for the full precedence. + type.ai.v3.LLMProtocol default_llm_protocol = 2 [(validate.rules).enum = {defined_only: true}]; + + // Namespace for the emitted typed dynamic metadata. + // Defaults to ``envoy.ai.token_usage``. + string metadata_namespace = 3; + + // Extraction resource limits. Defaults apply when unset. + TokenUsageExtractionLimits limits = 4; + + // Optional signal to emit at end of stream after publishing token usage. + UsageSignal usage_signal = 5 [(validate.rules).enum = {defined_only: true}]; +} + +// Per-stream memory and work limits for token-usage extraction. The response +// itself always streams through unaffected; on any limit only extraction +// state is dropped and the published record is flagged. +message TokenUsageExtractionLimits { + // Maximum size of one SSE event inspected for token usage. This is a hard + // bound on retained extraction state, regardless of how large individual + // data frames are: a pending event over the cap is discarded through its + // real terminating blank line, and a complete event over the cap is + // skipped without parsing. + // + // Defaults to 1MiB: OpenAI Responses API streams carry usage on terminal + // lifecycle events that embed the complete response object, so ordinary + // long generations produce usage-bearing events far larger than typical + // SSE deltas. Lower this in constrained deployments at the cost of losing + // usage from long generations. + google.protobuf.UInt32Value max_sse_event_size = 1 + [(validate.rules).uint32 = {lte: 10485760 gte: 1}]; + + // Maximum JSON response body inspected for token usage. A larger body — + // including one whose ``content-length`` already exceeds the cap — is not + // inspected. Defaults to 4MiB. + google.protobuf.UInt32Value max_json_body_size = 2 + [(validate.rules).uint32 = {lte: 10485760 gte: 1}]; + + // Maximum number of SSE payloads parsed as JSON for one response, counting + // malformed payloads; events skipped by name (keepalives, content deltas) + // do not count. ``max_sse_event_size`` bounds one event; this bounds the + // parse work a long-lived stream can extract from the worker. On + // exhaustion the accumulated usage is kept and published as partial, and + // extraction goes inert. + // + // Defaults to 65536 — far above ordinary streams. Raise it for extremely + // long generations whose every chunk must be parsed (OpenAI Chat + // Completions streams, whose chunks are unnamed and cannot be skipped by + // classification). + google.protobuf.UInt32Value max_parsed_sse_events = 3 [(validate.rules).uint32 = {gte: 1}]; +} + +// Per-route configuration. Its presence declares the route an AI endpoint. +// +// Request and response wire protocols are declared separately because +// protocol translation can make the client-facing request API differ from +// the provider's response API. For response token-usage extraction the +// effective wire API is resolved in precedence order: per-route +// ``response.llm_protocol``, then per-route ``request.llm_protocol``, then +// :ref:`default_llm_protocol +// `, +// then auto-detection. +message AiProtocolManagerPerRoute { + // Request-side route configuration. Its presence hands the request payload + // to the filter to hold and validate (when :ref:`request_handling + // ` + // is enabled). + RequestPerRoute request = 1; + + // Optional response-side route configuration. When absent, response + // processing inherits ``request.llm_protocol`` when available, then the + // global fallback. + ResponsePerRoute response = 2; +} + +// Per-route request-side behavior. +message RequestPerRoute { + // The wire API a request payload on this route follows. + // ``LLM_PROTOCOL_UNSPECIFIED`` declares the endpoint without naming its + // API. The ``envoy.ai.llm_protocol.request`` filter state object, when it + // names one, takes precedence. + // + // The :ref:`schema validation AI filter + // ` + // holds a payload to its API's schema. + // + // [#comment: Normalization is not implemented yet; a normalization knob + // will be added here once the transformation and its output contract + // exist.] + type.ai.v3.LLMProtocol llm_protocol = 1 [(validate.rules).enum = {defined_only: true}]; +} + +// Per-route response-side behavior. +message ResponsePerRoute { + // The wire API the response on this route follows. This can differ from + // ``request.llm_protocol`` when the gateway performs protocol translation. + // ``LLM_PROTOCOL_UNSPECIFIED`` falls through the precedence chain above. + type.ai.v3.LLMProtocol llm_protocol = 1 [(validate.rules).enum = {defined_only: true}]; +} diff --git a/modules/sync/envoyproxy/envoy/cas/f91b5c852f8deb71d90543d4713082f71f5ebb19b3d8101deea71513ccecd4b19012049f8f8ca3f4c643e326a44ac0853e872bbe54e31d9289ab563b8a32ce4c b/modules/sync/envoyproxy/envoy/cas/f91b5c852f8deb71d90543d4713082f71f5ebb19b3d8101deea71513ccecd4b19012049f8f8ca3f4c643e326a44ac0853e872bbe54e31d9289ab563b8a32ce4c new file mode 100644 index 00000000..e1c95737 --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/f91b5c852f8deb71d90543d4713082f71f5ebb19b3d8101deea71513ccecd4b19012049f8f8ca3f4c643e326a44ac0853e872bbe54e31d9289ab563b8a32ce4c @@ -0,0 +1,25 @@ +syntax = "proto3"; + +package envoy.extensions.watchdog.backtrace_action.v3; + +import "google/protobuf/duration.proto"; + +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.watchdog.backtrace_action.v3"; +option java_outer_classname = "BacktraceActionProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/watchdog/backtrace_action/v3;backtrace_actionv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Watchdog Action that logs backtraces.] +// [#extension: envoy.watchdog.backtrace_action] + +// Configuration for the backtrace watchdog action. +// +// This action is currently only supported on Linux. +message BacktraceActionConfig { + // Minimum time between backtrace logs per thread. Defaults to 10 seconds if not set. + // Set to 0 to disable the cooldown and log a backtrace on every watchdog event. + google.protobuf.Duration cooldown_duration = 1; +} diff --git a/modules/sync/envoyproxy/envoy/cas/fb0347fc4ce6ceccc92eb0a4b1d11c85e083d0e53bf589723455727ad13b3051f4be549925782b798fb30a98a7fcbf1e57ab882b3a41fcab6217cc8a2c454e77 b/modules/sync/envoyproxy/envoy/cas/fb0347fc4ce6ceccc92eb0a4b1d11c85e083d0e53bf589723455727ad13b3051f4be549925782b798fb30a98a7fcbf1e57ab882b3a41fcab6217cc8a2c454e77 new file mode 100644 index 00000000..a42f847b --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/fb0347fc4ce6ceccc92eb0a4b1d11c85e083d0e53bf589723455727ad13b3051f4be549925782b798fb30a98a7fcbf1e57ab882b3a41fcab6217cc8a2c454e77 @@ -0,0 +1,52 @@ +syntax = "proto3"; + +package envoy.extensions.stat_sinks.graphite_statsd.v3; + +import "envoy/config/core/v3/address.proto"; + +import "google/protobuf/wrappers.proto"; + +import "udpa/annotations/status.proto"; +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.stat_sinks.graphite_statsd.v3"; +option java_outer_classname = "GraphiteStatsdProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/stat_sinks/graphite_statsd/v3;graphite_statsdv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; + +// [#protodoc-title: Graphite+Statsd] +// Stats configuration proto schema for ``envoy.stat_sinks.graphite_statsd`` sink. +// The sink emits stats with `Graphite `_ +// compatible tags. Tags are configurable via :ref:`StatsConfig +// `. +// [#extension: envoy.stat_sinks.graphite_statsd] + +// [#next-free-field: 6] +message GraphiteStatsdSink { + oneof statsd_specifier { + option (validate.required) = true; + + // The UDP address of a running Graphite-compliant listener. If specified, + // statistics will be flushed to this address. + config.core.v3.Address address = 1; + } + + // Optional custom metric name prefix. See :ref:`StatsdSink's prefix field + // ` for more details. + string prefix = 3; + + // Optional max datagram size to use when sending UDP messages. By default Envoy + // will emit one metric per datagram. By specifying a max-size larger than a single + // metric, Envoy will emit multiple, new-line separated metrics. The max datagram + // size should not exceed your network's MTU. + // + // Note that this value may not be respected if smaller than a single metric. + google.protobuf.UInt64Value max_bytes_per_datagram = 4 [(validate.rules).uint64 = {gt: 0}]; + + // If true, histogram samples are scaled to milliseconds according to the histogram's unit + // before being reported as timers. See :ref:`StatsdSink's scale_histogram_units_to_milliseconds + // field ` + // for more details. + bool scale_histogram_units_to_milliseconds = 5; +} diff --git a/modules/sync/envoyproxy/envoy/cas/fc006a5c791b34aefd34bf03e9240479d6721e4e11f9cc9ad368961393267df1818ecf44ea6e68e54183caf179f764cc33bbf28c4c797a6f63f59069d9b748e6 b/modules/sync/envoyproxy/envoy/cas/fc006a5c791b34aefd34bf03e9240479d6721e4e11f9cc9ad368961393267df1818ecf44ea6e68e54183caf179f764cc33bbf28c4c797a6f63f59069d9b748e6 new file mode 100644 index 00000000..76dffcda --- /dev/null +++ b/modules/sync/envoyproxy/envoy/cas/fc006a5c791b34aefd34bf03e9240479d6721e4e11f9cc9ad368961393267df1818ecf44ea6e68e54183caf179f764cc33bbf28c4c797a6f63f59069d9b748e6 @@ -0,0 +1,182 @@ +syntax = "proto3"; + +package envoy.service.network_ext_proc.v3; + +import "envoy/config/core/v3/base.proto"; + +import "google/protobuf/struct.proto"; + +import "xds/annotations/v3/status.proto"; + +import "udpa/annotations/status.proto"; + +option java_package = "io.envoyproxy.envoy.service.network_ext_proc.v3"; +option java_outer_classname = "NetworkExternalProcessorProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/service/network_ext_proc/v3;network_ext_procv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: Network External Processing Service] + +// The Network External Processing filter allows an external service to dynamically +// interact with and modify L4 network traffic passing through Envoy. Unlike the +// HTTP External Processing filter, this service operates at the TCP/UDP level, +// providing access to raw network data. +// +// The filter communicates with an external gRPC service that can: +// +// 1. Inspect network traffic in both directions (client->server and server->client) +// 2. Modify the payload data +// 3. Control connection lifecycle (continue, close gracefully, or reset) +// +// Use cases include: +// +// 1. Custom protocol inspection and modification +// 2. Advanced traffic manipulation +// 3. Security scanning and filtering +// 4. Dynamic connection management +// +// The service uses a bidirectional gRPC stream, maintaining state throughout +// the connection lifetime while allowing asynchronous processing. + +// NetworkExternalProcessor service defines the contract between Envoy and +// external processing servers for L4 network traffic. +service NetworkExternalProcessor { + // Process establishes a bidirectional stream between Envoy and the external + // processing server. Envoy sends ProcessingRequests containing network data + // and the server responds with ProcessingResponses containing processing + // decisions and potentially modified data. + // + // The server should handle processing timeout properly to avoid blocking + // network traffic for extended periods. Any uncaught exceptions will + // be treated as errors and will terminate the stream. + // + // Implementation note: The server should process requests in the order + // they are received to maintain proper sequencing of network traffic. + rpc Process(stream ProcessingRequest) returns (stream ProcessingResponse) { + } +} + +// The payload data from network layer +message Data { + // The raw payload data + bytes data = 1; + + // Indicates whether this is the last data frame in the current direction. + // The external processor should still respond to this message even + // if there is no more data expected in this direction. + bool end_of_stream = 2; +} + +// ProcessingRequest contains data sent from Envoy to the external processing server. +// Each request contains either read data (from client) or write data (to client) +// along with optional metadata and attributes. +message ProcessingRequest { + // ReadData contains the network data intercepted in the request path (client to server). + // This is sent to the external processor when data arrives from the downstream client. + // If this is set, write_data should not be set. + Data read_data = 1; + + // WriteData contains the network data intercepted in the response path (server to client). + // This is sent to the external processor when data arrives from the upstream server. + // If this is set, read_data should not be set. + Data write_data = 2; + + // Optional metadata associated with the request. + // This can include connection properties, filter configuration, and any other + // contextual information that might be useful for processing decisions. + // + // The metadata is not automatically propagated from request to response. + // The external processor must include any needed metadata in its response. + config.core.v3.Metadata metadata = 3; + + // The values of properties selected by the ``connection_attributes`` + // list in the configuration. Each entry in the list is populated + // from the standard :ref:`attributes ` supported in the data plane. + map attributes = 4; +} + +// ProcessingResponse contains the response from the external processing server to Envoy. +// Each response corresponds to a ProcessingRequest and indicates how the network +// traffic should be handled. +// [#next-free-field: 7] +message ProcessingResponse { + // DataProcessedStatus indicates whether the data was modified by the external processor. + enum DataProcessedStatus { + // The data processed status is unknown. + UNKNOWN = 0; + + // The data remains unchanged. Envoy will use the original data. + // This is useful when the processor only wants to inspect but not modify the traffic. + UNMODIFIED = 1; + + // The data has been modified. Envoy will use the modified data provided in the response. + // This allows the processor to transform the network traffic as needed. + MODIFIED = 2; + } + + // ConnectionStatus determines what happens to the connection after processing. + enum ConnectionStatus { + // Continue normal processing of the connection. + // This is the default behavior and allows traffic to flow normally. + CONTINUE = 0; + + // Close the connection with normal TCP FIN. + // This allows for clean connection termination with a normal close sequence. + // Any buffered data will be sent before closing. + CLOSE = 1; + + // Immediately reset the connection with TCP RST. + // This forcibly terminates the connection without a clean shutdown, + // discarding any buffered data. Use this for security-critical situations + // or when immediate termination is required. + CLOSE_RST = 2; + } + + // The processed ReadData containing potentially modified data for the request path. + // This should be sent in response to a ProcessingRequest with read_data, and the + // previous data in ProcessingRequest will be replaced by the new data in Envoy's data plane. + // If this is set, write_data should not be set. + Data read_data = 1; + + // The processed WriteData containing potentially modified data for the response path. + // This should be sent in response to a ProcessingRequest with write_data, and the + // previous data in ProcessingRequest will be replaced by the new data in Envoy's data plane. + // If this is set, read_data should not be set. + Data write_data = 2; + + // Indicates whether the data was modified or not. + // This is mandatory and tells Envoy whether to use the original or modified data. + DataProcessedStatus data_processing_status = 3; + + // Optional: Determines the connection behavior after processing. + // If not specified, CONTINUE is assumed, and the connection proceeds normally. + // Use CLOSE or CLOSE_RST to terminate the connection based on processing results. + ConnectionStatus connection_status = 4; + + // Optional metadata associated with the request. + // This can include connection properties, filter configuration, and any other + // contextual information that might be useful for processing decisions. + // + // The metadata is not automatically propagated from request to response. + // The external processor must include any needed metadata in its response. + google.protobuf.Struct dynamic_metadata = 5; + + // If set to true, Envoy will close the gRPC stream to the external processor + // after applying this response. Subsequent data will bypass the ext_proc filter + // as if it were configured in SKIP mode. + // + // .. note:: + // This should only be used when there is a strong protocol guarantee + // that no additional data chunks are in-flight on the wire. Because Envoy + // immediately drains its local buffer when forwarding bytes to the external + // processor, if Envoy has already dispatched subsequent data chunks before this + // stream is closed, those in-flight bytes will be permanently lost and not + // injected back into the filter chain. + // + // This feature is primarily designed for tightly-coupled synchronous protocols, + // such as reading the ClientHello during a TLS handshake, where the sender + // naturally halts transmission while awaiting the receiver's response. + bool close_stream_to_ext_proc_server = 6; +} diff --git a/modules/sync/envoyproxy/envoy/state.json b/modules/sync/envoyproxy/envoy/state.json index a4326a2b..b8b8254e 100644 --- a/modules/sync/envoyproxy/envoy/state.json +++ b/modules/sync/envoyproxy/envoy/state.json @@ -151,6 +151,10 @@ { "name": "v1.39.4", "digest": "d05607c7c4ea6f1414960b75e6242310718e6c1efb231d9b669adecf96133b33722b3b383d115cdf2f473cd576cdfa3fe52e8f64c1f01b3745312bcca02f9d9e" + }, + { + "name": "v1.40.0", + "digest": "4e9945ad5f8ebf9edf2a98ba2149b631047a678d5c4fe12813db6816a193d3dcde59704d7fa4112cc93cc0ae20a2cc8bb8d2d2bdf06c1b28bb4b625d1aaf075a" } ] } \ No newline at end of file diff --git a/modules/sync/state.json b/modules/sync/state.json index 9de886b4..90e8dc6a 100644 --- a/modules/sync/state.json +++ b/modules/sync/state.json @@ -22,7 +22,7 @@ }, { "module_name": "envoyproxy/envoy", - "latest_reference": "v1.39.4" + "latest_reference": "v1.40.0" }, { "module_name": "envoyproxy/protoc-gen-validate",