envoy

package
v1.20.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 29, 2026 License: Apache-2.0 Imports: 98 Imported by: 11

Documentation

Overview

SPDX-License-Identifier: Apache-2.0 Copyright Authors of Cilium

Index

Constants

View Source 
const (
	CiliumXDSClusterName = "xds-grpc-cilium"

	// LocalNodeID is the Envoy node ID used by the host proxy.
	LocalNodeID = "host~127.0.0.1~no-id~localdomain"
)
View Source 
const (
	// ListenerTypeURL is the type URL of Listener resources.
	ListenerTypeURL = "type.googleapis.com/envoy.config.listener.v3.Listener"

	// RouteTypeURL is the type URL of HTTP Route resources.
	RouteTypeURL = "type.googleapis.com/envoy.config.route.v3.RouteConfiguration"

	// ClusterTypeURL is the type URL of Cluster resources.
	ClusterTypeURL = "type.googleapis.com/envoy.config.cluster.v3.Cluster"

	// HttpConnectionManagerTypeURL is the type URL of HttpConnectionManager filter.
	HttpConnectionManagerTypeURL = "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"

	// TCPProxyTypeURL is the type URL of TCPProxy filter.
	TCPProxyTypeURL = "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy"

	// EndpointTypeURL is the type URL of Endpoint resources.
	EndpointTypeURL = "type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment"

	// SecretTypeURL is the type URL of Endpoint resources.
	SecretTypeURL = "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"

	// NetworkPolicyTypeURL is the type URL of NetworkPolicy resources.
	NetworkPolicyTypeURL = "type.googleapis.com/cilium.NetworkPolicy"

	// NetworkPolicyHostsTypeURL is the type URL of NetworkPolicyHosts resources.
	NetworkPolicyHostsTypeURL = "type.googleapis.com/cilium.NetworkPolicyHosts"

	// HealthCheckSinkPipeTypeURL is the type URL of NetworkPolicyHosts resources.
	HealthCheckSinkPipeTypeURL = "type.googleapis.com/cilium.health_check.event_sink.pipe"

	// DownstreamTlsContextURL is the type URL of DownstreamTlsContext
	DownstreamTlsContextURL = "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext"
)

todo (nezdolik) migrate to go control plane constants when available

View Source 
const LocalityClusterName = "/cilium-locality-cluster"

Keep the constant public to make it accessible in downstream repos.

Variables

View Source 
var Cell = cell.Module(
	"envoy-proxy",
	"Envoy proxy and control-plane",

	metrics.Metric(xds.NewXDSMetric),

	cell.Config(config.ProxyConfig{}),
	cell.Config(config.SecretSyncConfig{}),
	cell.Provide(newEnvoyXDSServer),
	cell.Provide(newEnvoyAdminClient),
	cell.Provide(envoypolicy.NewEnvoyL7RulesTranslator),
	cell.ProvidePrivate(newEnvoyAccessLogServer),
	cell.ProvidePrivate(newLocalEndpointStore),
	cell.ProvidePrivate(newArtifactCopier),
	cell.Invoke(registerEnvoyVersionCheck),
	cell.Invoke(registerSecretSyncer),
)

Cell initializes and manages the Envoy proxy and its control-plane components like xDS- and accesslog server. It is used to provide support for Ingress, GatewayAPI and L7 network policies (e.g. HTTP).

View Source 
var CiliumAdsConfigSource = &envoy_config_core.ApiConfigSource{
	RequestTimeout:            &durationpb.Duration{Seconds: 30},
	ApiType:                   envoy_config_core.ApiConfigSource_GRPC,
	TransportApiVersion:       envoy_config_core.ApiVersion_V3,
	SetNodeOnFirstMessageOnly: true,
	GrpcServices: []*envoy_config_core.GrpcService{
		{
			TargetSpecifier: &envoy_config_core.GrpcService_EnvoyGrpc_{
				EnvoyGrpc: &envoy_config_core.GrpcService_EnvoyGrpc{
					ClusterName: CiliumXDSClusterName,
				},
			},
		},
	},
}
View Source 
var CiliumXDSConfigSource = &envoy_config_core.ConfigSource{
	InitialFetchTimeout: &durationpb.Duration{Seconds: 30},
	ResourceApiVersion:  envoy_config_core.ApiVersion_V3,
	ConfigSourceSpecifier: &envoy_config_core.ConfigSource_ApiConfigSource{
		ApiConfigSource: &envoy_config_core.ApiConfigSource{
			ApiType:                   envoy_config_core.ApiConfigSource_GRPC,
			TransportApiVersion:       envoy_config_core.ApiVersion_V3,
			SetNodeOnFirstMessageOnly: true,
			GrpcServices: []*envoy_config_core.GrpcService{
				{
					TargetSpecifier: &envoy_config_core.GrpcService_EnvoyGrpc_{
						EnvoyGrpc: &envoy_config_core.GrpcService_EnvoyGrpc{
							ClusterName: CiliumXDSClusterName,
						},
					},
				},
			},
		},
	},
}
View Source 
var CiliumXdsWithAdsConfigSource = NewCiliumXdsWithAdsConfigSource()
View Source 
var (
	DenyVerdict = &cilium.PortNetworkPolicyRule_Deny{Deny: true}
)
View Source 
var ErrNilPolicy = errors.New("nil EndpointPolicy")

ErrNotImplemented is the error returned by gRPC methods that are not implemented by Cilium.

View Source 
var ErrNotImplemented = errors.New("not implemented")

ErrNotImplemented is the error returned by gRPC methods that are not implemented by Cilium.

Functions

func ADSModeEnabled added in v1.20.0 

func ADSModeEnabled() bool

func EnableTracing 

func EnableTracing()

EnableTracing changes Envoy log level to "trace", producing the most logs.

func GetCiliumHttpFilter added in v1.16.0 

func GetCiliumHttpFilter(accessLogPath string) *envoy_config_http.HttpFilter

func GetDirectionNetworkPolicy added in v1.20.0 

func GetDirectionNetworkPolicy(ep endpoint.EndpointUpdater, getEgressNamedPorts GetEgressNamedPorts, selectors policy.SelectorSnapshot, l4DirectionPolicy *policy.L4DirectionPolicy, policyEnforced bool, useFullTLSContext, useSDS bool, dir string, policySecretsNamespace string, logger *slog.Logger, l7RulesTranslator envoypolicy.EnvoyL7RulesTranslator) []*cilium.PortNetworkPolicy

func GetFlowType 

func GetFlowType(m *cilium.LogEntry) accesslog.FlowType

GetFlowType returns the type of flow (request|response)

func GetHttpFilterChainProto added in v1.20.0 

func GetHttpFilterChainProto(clusterName string, tls bool, isIngress bool, accessLogPath string, config xdsServerConfig) *envoy_config_listener.FilterChain

func GetInternalListenerCIDRs added in v1.14.19 

func GetInternalListenerCIDRs(ipv4, ipv6 bool) []*envoy_config_core.CidrRange

func GetLegacyFormatNodeIDs added in v1.20.0 

func GetLegacyFormatNodeIDs(ep endpoint.EndpointUpdater, policy *policy.L4Policy) []string

GetLegacyFormatNodeIDs returns the Envoy proxy IDs that need to ACK policy updates on the legacy per-type xDS server. The legacy server records ACKs by parsed node IP, not by full Envoy node ID.

func GetListenerFilter added in v1.20.0 

func GetListenerFilter(isIngress bool, useOriginalSourceAddr bool, proxyPort uint16, lingerConfig int) *envoy_config_listener.ListenerFilter

func GetLocalListenerAddresses added in v1.16.0 

func GetLocalListenerAddresses(port uint16, ipv4, ipv6 bool) (*envoy_config_core.Address, []*envoy_config_listener.AdditionalAddress)

func GetNetHttpHeaders 

func GetNetHttpHeaders(httpHeaders []*cilium.KeyValue) http.Header

getNetHttpHeaders returns the Headers as net.http.Header

func GetNetworkPolicy added in v1.20.0 

func GetNetworkPolicy(ep endpoint.EndpointUpdater, getEgressNamedPorts GetEgressNamedPorts, selectors policy.SelectorSnapshot, names []string, l4Policy *policy.L4Policy,
	ingressPolicyEnforced, egressPolicyEnforced, useFullTLSContext, useSDS bool, policySecretsNamespace string, logger *slog.Logger, l7RulesTranslator envoypolicy.EnvoyL7RulesTranslator,
) *cilium.NetworkPolicy

func GetNodeIDs added in v1.20.0 

func GetNodeIDs(ep endpoint.EndpointUpdater, policy *policy.L4Policy) []string

return the Envoy proxy node IDs that need to ACK the policy.

func GetPortNetworkPolicyRule added in v1.20.0 

func GetPortNetworkPolicyRule(ep endpoint.EndpointUpdater, selectors policy.SelectorSnapshot, sel policy.CachedSelector, psp *policy.PerSelectorPolicy, tierBasePriority, tierLastPriority policyTypes.Priority, useFullTLSContext, useSDS bool, policySecretsNamespace string, l7RulesTranslator envoypolicy.EnvoyL7RulesTranslator, logger *slog.Logger) (*cilium.PortNetworkPolicyRule, bool)

func GetProtocol 

func GetProtocol(httpProtocol cilium.HttpProtocol) string

getProtocol returns the HTTP protocol in the format that Cilium understands

func GetPublicListenerAddress added in v1.20.0 

func GetPublicListenerAddress(port uint16, ipv4, ipv6 bool) *envoy_config_core.Address

func GetTcpFilterChainProto added in v1.20.0 

func GetTcpFilterChainProto(clusterName string, tls bool, accessLogPath string) *envoy_config_listener.FilterChain

GetTcpFilterChainProto creates a TCP filter chain with the Cilium network filter.

func GetUpstreamCodecFilter added in v1.14.15 

func GetUpstreamCodecFilter() *envoy_config_http.HttpFilter

func GetVerdict 

func GetVerdict(m *cilium.LogEntry) accesslog.FlowVerdict

GetVerdict returns the verdict performed on the flow (forwarded|denied)

func GetWildcardPortNetworkPolicyRules added in v1.20.0 

func GetWildcardPortNetworkPolicyRules(ep endpoint.EndpointUpdater,
	snapshot policy.SelectorSnapshot, tierBasePriority, tierLastPriority policyTypes.Priority,
	selectors policy.L7DataMap, useFullTLSContext, useSDS bool, policySecretsNamespace string, logger *slog.Logger, l7RulesTranslator envoypolicy.EnvoyL7RulesTranslator,
) (rules []*cilium.PortNetworkPolicyRule, havePassRules bool, wildcardPrecedence policyTypes.Precedence)

getWildcardPortNetworkPolicyRules returns the rules for port 0, which will be considered after port-specific rules. Returns the set of rules, and if any of them was a deny/allow all rule, and the highest priority of any deny/allow all rule, if any.

func GetXDSConfigSource added in v1.20.0 

func GetXDSConfigSource() *envoy_config_core.ConfigSource

GetXDSConfigSource returns the appropriate xDS config source for inline resource references (RDS, EDS, SDS). When ADS mode is enabled, resources are fetched via the aggregated stream; otherwise they use per-resource-type gRPC streams.

func InitPortNetworkPolicyRule added in v1.20.0 

func InitPortNetworkPolicyRule(psp *policy.PerSelectorPolicy, tierBasePriority, tierLastPriority policyTypes.Priority, logger *slog.Logger) *cilium.PortNetworkPolicyRule

InitPortNetworkPolicyRule returns a new PortNetworkPolicyRule with Precedence and Verdict fields initialized. RemotePolicies field is left empty, which is only good for a wildcard identity rule.

func NewCiliumXdsWithAdsConfigSource added in v1.20.0 

func NewCiliumXdsWithAdsConfigSource() *envoy_config_core.ConfigSource

func ParseURL 

func ParseURL(scheme, host, path string) *url.URL

ParseURL returns the URL as *net.url.URL

func SetXDSConfigSourceInitialFetchTimeout added in v1.20.0 

func SetXDSConfigSourceInitialFetchTimeout(proxyInitialFetchTimeout uint)

func SetXDSMode added in v1.20.0 

func SetXDSMode(mode string)

func StrictADSModeEnabled added in v1.20.0 

func StrictADSModeEnabled() bool

func ToAny added in v1.20.0 

func ToAny(pb proto.Message) *anypb.Any

Types

type AccessLogServer 

type AccessLogServer struct {
	// contains filtered or unexported fields
}

type ArtifactCopier added in v1.15.0 

type ArtifactCopier struct {
	// contains filtered or unexported fields
}

ArtifactCopier provides support for copying artifacts from a given source directory to a target directory. This is mainly used to copy additional artifacts referenced by the Envoy proxy configuration from the Cilium agent container to the config directory that is shared with the Envoy container if Envoy is running in a dedicated DaemonSet.

func (*ArtifactCopier) Copy added in v1.15.0 

func (r *ArtifactCopier) Copy() (err error)

Copy copies all files within the given sourcePath directory into the targetPath directory.

If targetPath already exists, all existing files within the directory are deleted before starting the copy process. If targetPath doesn't exist, it gets created automatically before starting the copy process.

type EnvoyAdminClient 

type EnvoyAdminClient struct {
	// contains filtered or unexported fields
}

func NewEnvoyAdminClientForSocket 

func NewEnvoyAdminClientForSocket(logger *slog.Logger, envoySocketDir string, defaultLogLevel string) *EnvoyAdminClient

func (*EnvoyAdminClient) ChangeLogLevel 

func (a *EnvoyAdminClient) ChangeLogLevel(agentLogLevel slog.Level) error

ChangeLogLevel changes Envoy log level to correspond to the specified 'level'.

func (*EnvoyAdminClient) GetEnvoyVersion 

func (a *EnvoyAdminClient) GetEnvoyVersion() (string, error)

GetEnvoyVersion returns the envoy binary version string

func (*EnvoyAdminClient) Post added in v1.18.0 

func (a *EnvoyAdminClient) Post(query string) (string, error)

Post sends a POST request with the given query to the Envoy Admin API.

type GetEgressNamedPorts added in v1.20.0 

type GetEgressNamedPorts func(name string, proto u8proto.U8proto, idents iter.Seq[identity.NumericIdentity]) ciliumTypes.NidPortSeq

type IPCacheEventSource 

type IPCacheEventSource interface {
	AddListener(ipcache.IPIdentityMappingListener)
}

type LocalEndpointStore 

type LocalEndpointStore struct {
	// contains filtered or unexported fields
}

LocalEndpointStore tracks the mapping between a given endpoint IP and the local endpoint.

type NPHDSCache 

type NPHDSCache struct {
	*xds.Cache
	// contains filtered or unexported fields
}

NPHDSCache is a cache of resources in the Network Policy Hosts Discovery Service.

NetworkPolicyHostsCache is the global cache of resources of type NetworkPolicyHosts. Resources in this cache must have the NetworkPolicyHostsTypeURL type URL.

func (*NPHDSCache) HandleResourceVersionAck 

func (cache *NPHDSCache) HandleResourceVersionAck(ackVersion uint64, nackVersion uint64, nodeIP string, resourceNames []string, typeURL string, detail string)

HandleResourceVersionAck is required to implement ResourceVersionAckObserver. We use this to start the IP Cache listener on the first ACK so that we only start the IP Cache listener if there is an Envoy node that uses NPHDS (e.g. Cilium host proxy running on kernel w/o LPM bpf map support).

func (*NPHDSCache) MarkRestoreCompleted added in v1.16.0 

func (cache *NPHDSCache) MarkRestoreCompleted()

func (*NPHDSCache) MarkRestorePending added in v1.16.0 

func (cache *NPHDSCache) MarkRestorePending()

func (*NPHDSCache) OnIPIdentityCacheChange 

func (cache *NPHDSCache) OnIPIdentityCacheChange(modType ipcache.CacheModification, cidrCluster cmtypes.PrefixCluster,
	oldHostIP, newHostIP net.IP, oldID *ipcache.Identity, newID ipcache.Identity,
	encryptKey uint8, k8sMeta *ipcache.K8sMetadata, endpointFlags uint8,
)

OnIPIdentityCacheChange pushes modifications to the IP<->Identity mapping into the Network Policy Host Discovery Service (NPHDS).

Note that the caller is responsible for passing 'oldID' when 'cidrCluster' has been associated with a different ID before, as this function does not search for conflicting IP/ID mappings.

func (*NPHDSCache) WaitForFirstAck added in v1.16.14 

func (cache *NPHDSCache) WaitForFirstAck(ctx context.Context, node string, typeURL string)

type Resource added in v1.20.0 

type Resource interface {
	proto.Message
}

type StandaloneEnvoy added in v1.20.0 

type StandaloneEnvoy struct {
	// contains filtered or unexported fields
}

Envoy manages a running Envoy proxy instance via the ListenerDiscoveryService and RouteDiscoveryService gRPC APIs.

func (*StandaloneEnvoy) GetAdminClient added in v1.20.0 

func (e *StandaloneEnvoy) GetAdminClient() *EnvoyAdminClient

func (*StandaloneEnvoy) Stop added in v1.20.0 

func (e *StandaloneEnvoy) Stop() error

Stop kills the Envoy process started with startStandaloneEnvoy. The gRPC API streams are terminated first.

type XDSServer 

type XDSServer = xds.XDSServer

XDSServer is an alias for xds.XDSServer, re-exported from the envoy package for backwards compatibility.

Source Files

View all Source files

Directories

Path Synopsis
Package xds is an implementation of Envoy's xDS (Discovery Service) protocol.
 Package xds is an implementation of Envoy's xDS (Discovery Service) protocol.
callbacks

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.