Don't Merge: temp commit to bring up reverse tunnels on docker containers with latest changes

.dockerignore

@@ -1,10 +1,12 @@
 /*
 !/VERSION.txt
 !/build_envoy
+!/build_envoy_debug
 !/ci
 !/distribution/docker
 !/configs/google-vrp
 !/configs/*yaml
+!/linux/amd64/build_envoy_debug
 !/linux/amd64/release.tar.zst
 !/linux/amd64/schema_validator_tool
 !/linux/amd64/router_check_tool

CODEOWNERS

@@ -433,3 +433,4 @@ extensions/upstreams/tcp @ggreenway @mattklein123
 /contrib/qat/ @giantcroc @soulxu
 /contrib/generic_proxy/ @wbpcode @UNOWNED
 /contrib/tap_sinks/ @coolg92003 @yiyibaoguo
+/contrib/reverse_connection/ @arun-vasudev @basundhara-c @agrawoh

api/BUILD

@@ -145,6 +145,7 @@ proto_library(
         "//envoy/extensions/clusters/dns/v3:pkg",
         "//envoy/extensions/clusters/dynamic_forward_proxy/v3:pkg",
         "//envoy/extensions/clusters/redis/v3:pkg",
+        "//envoy/extensions/clusters/reverse_connection/v3:pkg",
         "//envoy/extensions/common/async_files/v3:pkg",
         "//envoy/extensions/common/aws/v3:pkg",
         "//envoy/extensions/common/dynamic_forward_proxy/v3:pkg",
@@ -216,6 +217,7 @@ proto_library(
         "//envoy/extensions/filters/http/rate_limit_quota/v3:pkg",
         "//envoy/extensions/filters/http/ratelimit/v3:pkg",
         "//envoy/extensions/filters/http/rbac/v3:pkg",
+        "//envoy/extensions/filters/http/reverse_conn/v3:pkg",
         "//envoy/extensions/filters/http/router/v3:pkg",
         "//envoy/extensions/filters/http/set_filter_state/v3:pkg",
         "//envoy/extensions/filters/http/set_metadata/v3:pkg",
@@ -229,6 +231,7 @@ proto_library(
         "//envoy/extensions/filters/listener/original_dst/v3:pkg",
         "//envoy/extensions/filters/listener/original_src/v3:pkg",
         "//envoy/extensions/filters/listener/proxy_protocol/v3:pkg",
+        "//envoy/extensions/filters/listener/reverse_connection/v3:pkg",
         "//envoy/extensions/filters/listener/tls_inspector/v3:pkg",
         "//envoy/extensions/filters/network/connection_limit/v3:pkg",
         "//envoy/extensions/filters/network/direct_response/v3:pkg",

api/envoy/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/v3/upstream_reverse_connection_socket_interface.proto

@@ -2,19 +2,26 @@ syntax = "proto3";
 
 package envoy.extensions.bootstrap.reverse_tunnel.upstream_socket_interface.v3;
 
+import "google/protobuf/wrappers.proto";
+
 import "udpa/annotations/status.proto";
+import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.extensions.bootstrap.reverse_tunnel.upstream_socket_interface.v3";
 option java_outer_classname = "UpstreamReverseConnectionSocketInterfaceProto";
 option java_multiple_files = true;
 option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/v3;upstream_socket_interfacev3";
 option (udpa.annotations.file_status).package_version_status = ACTIVE;
 
-// [#protodoc-title: Bootstrap settings for upstream reverse connection socket interface]
+// [#protodoc-title: Upstream reverse connection socket interface]
 // [#extension: envoy.bootstrap.reverse_tunnel.upstream_socket_interface]
 
 // Configuration for the upstream reverse connection socket interface.
 message UpstreamReverseConnectionSocketInterface {
-  // Stat prefix to be used for upstream reverse connection socket interface stats.
+  // Stat prefix for upstream reverse connection socket interface stats.
   string stat_prefix = 1;
+
+  // Number of consecutive ping failures before an idle reverse connection socket is marked dead.
+  // Defaults to 3 if unset. Must be at least 1.
+  google.protobuf.UInt32Value ping_failure_threshold = 2 [(validate.rules).uint32 = {gte: 1}];
 }

api/envoy/extensions/clusters/reverse_connection/v3/BUILD

@@ -0,0 +1,12 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "@com_github_cncf_xds//udpa/annotations:pkg",
+        "@com_github_cncf_xds//xds/type/matcher/v3:pkg",
+    ],
+)

api/envoy/extensions/clusters/reverse_connection/v3/reverse_connection.proto

@@ -0,0 +1,86 @@
+syntax = "proto3";
+
+package envoy.extensions.clusters.reverse_connection.v3;
+
+import "google/protobuf/duration.proto";
+
+import "xds/type/matcher/v3/matcher.proto";
+
+import "udpa/annotations/status.proto";
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.clusters.reverse_connection.v3";
+option java_outer_classname = "ReverseConnectionProto";
+option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/clusters/reverse_connection/v3;reverse_connectionv3";
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Reverse connection cluster]
+// [#extension: envoy.clusters.reverse_connection]
+
+// Configuration for a cluster of type REVERSE_CONNECTION.
+message RevConClusterConfig {
+  // Time interval after which Envoy removes unused dynamic hosts created for reverse connections.
+  // Hosts that are not referenced by any connection pool are deleted during cleanup.
+  //
+  // If unset, Envoy uses a default of 60s.
+  google.protobuf.Duration cleanup_interval = 1 [(validate.rules).duration = {gt {}}];
+
+  // Host identifier matcher.
+  //
+  // This matcher is evaluated on the downstream request and yields a ``HostIdAction``.
+  // The action's payload is used as the host identifier to select the reverse connection
+  // endpoint.
+  //
+  // Typical rules use built-in inputs such as:
+  //
+  // * ``HttpRequestHeaderMatchInput`` to map a request header value.
+  // * ``HttpAttributesCelMatchInput`` to compute a value with CEL from headers/SNI.
+  //
+  // The match tree can be a list or a map matcher. The first matching rule should
+  // return a ``HostIdAction`` with the desired identifier.
+  //
+  // Example:
+  //
+  // .. validated-code-block:: yaml
+  //   :type-name: xds.type.matcher.v3.Matcher
+  //
+  //   matcher_list:
+  //     matchers:
+  //     - predicate:
+  //         single_predicate:
+  //           input:
+  //             typed_config:
+  //               '@type': type.googleapis.com/envoy.type.matcher.v3.HttpRequestHeaderMatchInput
+  //               header_name: x-remote-node-id
+  //           value_match:
+  //             exact: node-a
+  //       on_match:
+  //         action:
+  //           typed_config:
+  //             '@type': type.googleapis.com/envoy.extensions.clusters.reverse_connection.v3.HostIdAction
+  //             host_id: "node-a"
+  //
+  //     - predicate:
+  //         single_predicate:
+  //           input:
+  //             typed_config:
+  //               '@type': type.googleapis.com/envoy.type.matcher.v3.HttpRequestHeaderMatchInput
+  //               header_name: x-remote-node-id
+  //           value_match:
+  //             exact: node-b
+  //       on_match:
+  //         action:
+  //           typed_config:
+  //             '@type': type.googleapis.com/envoy.extensions.clusters.reverse_connection.v3.HostIdAction
+  //             host_id: "node-b"
+  //
+  // If the matcher does not return a ``HostIdAction``, the request will not be routed.
+  xds.type.matcher.v3.Matcher host_id_matcher = 2 [(validate.rules).message = {required: true}];
+}
+
+// Action that returns the resolved host identifier.
+message HostIdAction {
+  // Resolved host identifier for the reverse connection endpoint.
+  string host_id = 1 [(validate.rules).string = {min_len: 1}];
+}

api/envoy/extensions/filters/http/reverse_conn/v3/BUILD

@@ -0,0 +1,9 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = ["@com_github_cncf_xds//udpa/annotations:pkg"],
+)

api/envoy/extensions/filters/http/reverse_conn/v3/reverse_conn.proto

@@ -0,0 +1,25 @@
+syntax = "proto3";
+
+package envoy.extensions.filters.http.reverse_conn.v3;
+
+import "google/protobuf/wrappers.proto";
+
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.filters.http.reverse_conn.v3";
+option java_outer_classname = "ReverseConnProto";
+option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/reverse_conn/v3;reverse_connv3";
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: ReverseConn]
+// ReverseConn :ref:`configuration overview <config_http_filters_reverse_conn>`.
+// [#extension: envoy.filters.http.reverse_conn]
+
+message ReverseConn {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.extensions.filters.http.reverse_conn.v3alpha.ReverseConn";
+
+  google.protobuf.UInt32Value ping_interval = 1;
+}

api/envoy/extensions/filters/listener/reverse_connection/v3/BUILD

@@ -0,0 +1,9 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = ["@com_github_cncf_xds//udpa/annotations:pkg"],
+)

api/envoy/extensions/filters/listener/reverse_connection/v3/reverse_connection.proto

@@ -0,0 +1,25 @@
+syntax = "proto3";
+
+package envoy.extensions.filters.listener.reverse_connection.v3;
+
+import "google/protobuf/wrappers.proto";
+
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.filters.listener.reverse_connection.v3";
+option java_outer_classname = "ReverseConnectionProto";
+option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/listener/reverse_connection/v3;reverse_connectionv3";
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Reverse Connection Filter]
+// Reverse Connection listener filter.
+// [#extension: envoy.filters.listener.reverse_connection]
+
+message ReverseConnection {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.extensions.filters.listener.reverse_connection.v3alpha.ReverseConnection";
+
+  google.protobuf.UInt32Value ping_wait_timeout = 1;
+}

api/versioning/BUILD

@@ -82,6 +82,7 @@ proto_library(
         "//envoy/extensions/clusters/dns/v3:pkg",
         "//envoy/extensions/clusters/dynamic_forward_proxy/v3:pkg",
         "//envoy/extensions/clusters/redis/v3:pkg",
+        "//envoy/extensions/clusters/reverse_connection/v3:pkg",
         "//envoy/extensions/common/async_files/v3:pkg",
         "//envoy/extensions/common/aws/v3:pkg",
         "//envoy/extensions/common/dynamic_forward_proxy/v3:pkg",
@@ -153,6 +154,7 @@ proto_library(
         "//envoy/extensions/filters/http/rate_limit_quota/v3:pkg",
         "//envoy/extensions/filters/http/ratelimit/v3:pkg",
         "//envoy/extensions/filters/http/rbac/v3:pkg",
+        "//envoy/extensions/filters/http/reverse_conn/v3:pkg",
         "//envoy/extensions/filters/http/router/v3:pkg",
         "//envoy/extensions/filters/http/set_filter_state/v3:pkg",
         "//envoy/extensions/filters/http/set_metadata/v3:pkg",
@@ -166,6 +168,7 @@ proto_library(
         "//envoy/extensions/filters/listener/original_dst/v3:pkg",
         "//envoy/extensions/filters/listener/original_src/v3:pkg",
         "//envoy/extensions/filters/listener/proxy_protocol/v3:pkg",
+        "//envoy/extensions/filters/listener/reverse_connection/v3:pkg",
         "//envoy/extensions/filters/listener/tls_inspector/v3:pkg",
         "//envoy/extensions/filters/network/connection_limit/v3:pkg",
         "//envoy/extensions/filters/network/direct_response/v3:pkg",

ci/Dockerfile-ntnx

@@ -0,0 +1,90 @@
+ARG BUILD_OS=ubuntu
+ARG BUILD_TAG=20.04
+ARG ENVOY_VRP_BASE_IMAGE=envoy
+
+
+FROM scratch AS binary
+
+ARG TARGETPLATFORM
+ENV TARGETPLATFORM=${TARGETPLATFORM:-linux/amd64}
+ARG ENVOY_BINARY=envoy
+ARG ENVOY_BINARY_SUFFIX=
+ADD ${TARGETPLATFORM}/build_${ENVOY_BINARY}_debug${ENVOY_BINARY_SUFFIX}/envoy* /usr/local/bin/
+ADD configs/envoyproxy_io_proxy.yaml /etc/envoy/envoy.yaml
+COPY ${TARGETPLATFORM}/build_${ENVOY_BINARY}_debug${ENVOY_BINARY_SUFFIX}/schema_validator_tool /usr/local/bin/schema_validator_tool
+COPY ci/docker-entrypoint.sh /
+
+
+# STAGE: envoy
+FROM ${BUILD_OS}:${BUILD_TAG} AS envoy
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && apt-get upgrade -qq -y \
+    && apt-get install -qq --no-install-recommends -y ca-certificates iproute2 iputils-ping curl wget \
+    && apt-get autoremove -y -qq && apt-get clean \
+    && rm -rf /tmp/* /var/tmp/* \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN mkdir -p /etc/envoy
+
+COPY --from=binary /usr/local/bin/envoy* /usr/local/bin/
+COPY --from=binary /etc/envoy/envoy.yaml /etc/envoy/envoy.yaml
+COPY --from=binary /docker-entrypoint.sh /
+
+RUN adduser --group --system envoy
+
+EXPOSE 10000
+
+ENTRYPOINT ["/docker-entrypoint.sh"]
+CMD ["envoy", "-c", "/etc/envoy/envoy.yaml"]
+
+
+# STAGE: envoy-distroless
+# gcr.io/distroless/base-nossl-debian11:nonroot
+FROM gcr.io/distroless/base-nossl-debian11:nonroot@sha256:f10e1fbf558c630a4b74a987e6c754d45bf59f9ddcefce090f6b111925996767 AS envoy-distroless
+
+COPY --from=binary /usr/local/bin/envoy* /usr/local/bin/
+COPY --from=binary /etc/envoy/envoy.yaml /etc/envoy/envoy.yaml
+
+EXPOSE 10000
+
+ENTRYPOINT ["/usr/local/bin/envoy"]
+CMD ["-c", "/etc/envoy/envoy.yaml"]
+
+
+# STAGE: envoy-google-vrp
+FROM ${ENVOY_VRP_BASE_IMAGE} AS envoy-google-vrp
+
+RUN apt-get update \
+    && apt-get upgrade -y -qq \
+    && apt-get install -y -qq libc++1 supervisor gdb strace tshark \
+    && apt-get autoremove -y \
+    && apt-get clean \
+    && rm -rf /tmp/* /var/tmp/* \
+    && rm -rf /var/lib/apt/lists/*
+
+ADD configs/google-vrp/envoy-edge.yaml /etc/envoy/envoy-edge.yaml
+ADD configs/google-vrp/envoy-origin.yaml /etc/envoy/envoy-origin.yaml
+ADD configs/google-vrp/launch_envoy.sh /usr/local/bin/launch_envoy.sh
+ADD configs/google-vrp/supervisor.conf /etc/supervisor.conf
+ADD test/config/integration/certs/serverkey.pem /etc/envoy/certs/serverkey.pem
+ADD test/config/integration/certs/servercert.pem /etc/envoy/certs/servercert.pem
+# ADD %local envoy bin% /usr/local/bin/envoy
+RUN chmod 777 /var/log/supervisor
+RUN chmod a+r /etc/supervisor.conf /etc/envoy/* /etc/envoy/certs/*
+RUN chmod a+rx /usr/local/bin/launch_envoy.sh
+
+EXPOSE 10000
+EXPOSE 10001
+
+CMD ["supervisord", "-c", "/etc/supervisor.conf"]
+
+# STAGE: envoy-tools
+FROM ${BUILD_OS}:${BUILD_TAG} AS envoy-tools
+
+COPY --from=binary /usr/local/bin/schema_validator_tool /usr/local/bin/
+
+
+# Make envoy image as last stage so it is built by default
+FROM envoy

ci/docker-entrypoint-ntnx.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env sh
+set -e
+
+# if the first argument look like a parameter (i.e. start with '-'), run Envoy
+if [ "${1#-}" != "$1" ]; then
+	set -- envoy "$@"
+fi
+
+if [ "$1" = 'envoy' ]; then
+	# set the log level if the $loglevel variable is set
+	if [ -n "$loglevel" ]; then
+		set -- "$@" --log-level "$loglevel"
+	fi
+fi
+
+exec "$@"

ci/run_envoy_docker.sh

@@ -49,7 +49,7 @@ elif [[ -n "$ENVOY_DOCKER_IN_DOCKER" ]]; then
     COMPOSE_SERVICE="envoy-build-dind"
 fi
 
-exec docker compose \
+exec docker-compose \
     -f "${SCRIPT_DIR}/docker-compose.yml" \
     ${ENVOY_DOCKER_PLATFORM:+-p "$ENVOY_DOCKER_PLATFORM"} \
     run \