Skip to content

Make Envoy ALPN configurable #55

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 17, 2021
Merged

Make Envoy ALPN configurable #55

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions depot/containerstore/proxy_config_handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,8 @@ type ProxyConfigHandler struct {
reloadClock clock.Clock

adsServers []string

http2Enabled bool
}

type NoopProxyConfigHandler struct{}
Expand Down Expand Up @@ -126,6 +128,7 @@ func NewProxyConfigHandler(
reloadDuration time.Duration,
reloadClock clock.Clock,
adsServers []string,
http2Enabled bool,
) *ProxyConfigHandler {
return &ProxyConfigHandler{
logger: logger.Session("proxy-manager"),
Expand All @@ -137,6 +140,7 @@ func NewProxyConfigHandler(
reloadDuration: reloadDuration,
reloadClock: reloadClock,
adsServers: adsServers,
http2Enabled: http2Enabled,
}
}

Expand Down Expand Up @@ -254,6 +258,7 @@ func (p *ProxyConfigHandler) writeConfig(credentials Credential, container execu
adminPort,
p.containerProxyRequireClientCerts,
p.adsServers,
p.http2Enabled,
)
if err != nil {
return err
Expand Down Expand Up @@ -305,6 +310,7 @@ func generateProxyConfig(
adminPort uint16,
requireClientCerts bool,
adsServers []string,
http2Enabled bool,
) (*envoy_bootstrap.Bootstrap, error) {
clusters := []*envoy_cluster.Cluster{}
for index, portMap := range container.Ports {
Expand Down Expand Up @@ -332,7 +338,7 @@ func generateProxyConfig(
})
}

listeners, err := generateListeners(container, requireClientCerts)
listeners, err := generateListeners(container, requireClientCerts, http2Enabled)
if err != nil {
return nil, fmt.Errorf("generating listeners: %s", err)
}
Expand Down Expand Up @@ -443,7 +449,7 @@ func writeProxyConfig(proxyConfig *envoy_bootstrap.Bootstrap, path string) error
return ioutil.WriteFile(path, yamlStr, 0666)
}

func generateListeners(container executor.Container, requireClientCerts bool) ([]*envoy_listener.Listener, error) {
func generateListeners(container executor.Container, requireClientCerts, http2Enabled bool) ([]*envoy_listener.Listener, error) {
listeners := []*envoy_listener.Listener{}

for index, portMap := range container.Ports {
Expand All @@ -463,7 +469,6 @@ func generateListeners(container executor.Container, requireClientCerts bool) ([
tlsContext := &envoy_tls.DownstreamTlsContext{
RequireClientCertificate: &wrappers.BoolValue{Value: requireClientCerts},
CommonTlsContext: &envoy_tls.CommonTlsContext{
AlpnProtocols: AlpnProtocols,
TlsCertificateSdsSecretConfigs: []*envoy_tls.SdsSecretConfig{
{
Name: "server-cert-and-key",
Expand All @@ -480,6 +485,10 @@ func generateListeners(container executor.Container, requireClientCerts bool) ([
},
}

if http2Enabled {
tlsContext.CommonTlsContext.AlpnProtocols = AlpnProtocols
}

if requireClientCerts {
tlsContext.CommonTlsContext.ValidationContextType = &envoy_tls.CommonTlsContext_ValidationContextSdsSecretConfig{
ValidationContextSdsSecretConfig: &envoy_tls.SdsSecretConfig{
Expand Down
35 changes: 34 additions & 1 deletion depot/containerstore/proxy_config_handler_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ var _ = Describe("ProxyConfigHandler", func() {
containerProxyVerifySubjectAltName []string
containerProxyRequireClientCerts bool
adsServers []string
http2Enabled bool
)

BeforeEach(func() {
Expand Down Expand Up @@ -101,6 +102,7 @@ var _ = Describe("ProxyConfigHandler", func() {
"10.255.217.2:15010",
"10.255.217.3:15010",
}
http2Enabled = true
})

JustBeforeEach(func() {
Expand All @@ -114,6 +116,7 @@ var _ = Describe("ProxyConfigHandler", func() {
reloadDuration,
reloadClock,
adsServers,
http2Enabled,
)
Eventually(rotatingCredChan).Should(BeSent(containerstore.Credential{
Cert: "some-cert",
Expand Down Expand Up @@ -394,6 +397,7 @@ var _ = Describe("ProxyConfigHandler", func() {
statPrefix: "0-stats",
clusterName: "0-service-cluster",
requireClientCertificate: false,
alpnProtocols: []string{"h2,http/1.1"},
}.check(proxyConfig.StaticResources.Listeners[0])
})
})
Expand Down Expand Up @@ -548,6 +552,7 @@ var _ = Describe("ProxyConfigHandler", func() {
statPrefix: "0-stats",
clusterName: "0-service-cluster",
requireClientCertificate: true,
alpnProtocols: []string{"h2,http/1.1"},
}.check(proxyConfig.StaticResources.Listeners[0])

adsConfigSource := &envoy_core.ConfigSource{
Expand Down Expand Up @@ -621,6 +626,31 @@ var _ = Describe("ProxyConfigHandler", func() {
})
})

Context("when HTTP/2 is disabled", func() {
BeforeEach(func() {
http2Enabled = false
})

It("creates a proxy config without ALPN for listeners", func() {
err := proxyConfigHandler.Update(containerstore.Credential{Cert: "cert", Key: "key"}, container)
Expect(err).NotTo(HaveOccurred())
Eventually(proxyConfigFile).Should(BeAnExistingFile())

var proxyConfig envoy_bootstrap.Bootstrap
Expect(yamlFileToProto(proxyConfigFile, &proxyConfig)).To(Succeed())

Expect(proxyConfig.StaticResources.Listeners).To(HaveLen(1))
expectedListener{
name: "listener-8080",
listenPort: 61001,
statPrefix: "0-stats",
clusterName: "0-service-cluster",
requireClientCertificate: true,
alpnProtocols: nil,
}.check(proxyConfig.StaticResources.Listeners[0])
})
})

Context("with multiple port mappings", func() {
BeforeEach(func() {
container.Ports = []executor.PortMapping{
Expand Down Expand Up @@ -683,6 +713,7 @@ var _ = Describe("ProxyConfigHandler", func() {
statPrefix: "0-stats",
clusterName: "0-service-cluster",
requireClientCertificate: true,
alpnProtocols: []string{"h2,http/1.1"},
}.check(proxyConfig.StaticResources.Listeners[0])

expectedListener{
Expand All @@ -691,6 +722,7 @@ var _ = Describe("ProxyConfigHandler", func() {
statPrefix: "1-stats",
clusterName: "1-service-cluster",
requireClientCertificate: true,
alpnProtocols: []string{"h2,http/1.1"},
}.check(proxyConfig.StaticResources.Listeners[1])
})

Expand Down Expand Up @@ -846,6 +878,7 @@ type expectedListener struct {
statPrefix string
clusterName string
requireClientCertificate bool
alpnProtocols []string
}

func (l expectedListener) check(listener *envoy_listener.Listener) {
Expand All @@ -869,7 +902,7 @@ func (l expectedListener) check(listener *envoy_listener.Listener) {
Expect(filterChain.TransportSocket.Name).To(Equal(l.name))

Expect(downstreamTlsContext.RequireClientCertificate.Value).To(Equal(l.requireClientCertificate))
Expect(downstreamTlsContext.CommonTlsContext.AlpnProtocols).To(Equal([]string{"h2,http/1.1"}))
Expect(downstreamTlsContext.CommonTlsContext.AlpnProtocols).To(Equal(l.alpnProtocols))
Expect(downstreamTlsContext.CommonTlsContext.TlsCertificateSdsSecretConfigs).To(ConsistOf(
&envoy_tls.SdsSecretConfig{
Name: "server-cert-and-key",
Expand Down
2 changes: 2 additions & 0 deletions initializer/initializer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,6 +139,7 @@ type ExecutorConfig struct {
PathToTLSKey string `json:"path_to_tls_key"`
PostSetupHook string `json:"post_setup_hook"`
PostSetupUser string `json:"post_setup_user"`
ProxyEnableHttp2 bool `json:"proxy_enable_http2"`
ProxyMemoryAllocationMB int `json:"proxy_memory_allocation_mb,omitempty"`
ReadWorkPoolSize int `json:"read_work_pool_size,omitempty"`
ReservedExpirationTime durationjson.Duration `json:"reserved_expiration_time,omitempty"`
Expand Down Expand Up @@ -290,6 +291,7 @@ func Initialize(logger lager.Logger, config ExecutorConfig, cellID, zone string,
time.Duration(config.EnvoyConfigReloadDuration),
clock,
config.ContainerProxyADSServers,
config.ProxyEnableHttp2,
)
} else {
proxyConfigHandler = containerstore.NewNoopProxyConfigHandler()
Expand Down