From f0fe3cf4a645d5e62706f7c151f773229f3ee75b Mon Sep 17 00:00:00 2001 From: Freddy Date: Tue, 8 Jun 2021 13:18:41 -0600 Subject: [PATCH] Revert "Avoid adding original_dst filter when not needed" (#10365) --- .changelog/10302.txt | 4 ---- .changelog/10365.txt | 3 +++ agent/xds/listeners.go | 18 +++++++++++------- ...talog-destinations-only.envoy-1-18-x.golden | 5 +++++ ...tinations-only.v2compat.envoy-1-16-x.golden | 5 +++++ 5 files changed, 24 insertions(+), 11 deletions(-) delete mode 100644 .changelog/10302.txt create mode 100644 .changelog/10365.txt diff --git a/.changelog/10302.txt b/.changelog/10302.txt deleted file mode 100644 index e87d168986..0000000000 --- a/.changelog/10302.txt +++ /dev/null @@ -1,4 +0,0 @@ -```release-note:improvement -connect: Avoid adding original_dst listener filter when it won't be used. -``` - diff --git a/.changelog/10365.txt b/.changelog/10365.txt new file mode 100644 index 0000000000..665d5401e7 --- /dev/null +++ b/.changelog/10365.txt @@ -0,0 +1,3 @@ +```release-note:bug +connect: Fix bug that prevented transparent proxies from working when mesh config restricted routing to catalog destinations. +``` \ No newline at end of file diff --git a/agent/xds/listeners.go b/agent/xds/listeners.go index c31f0fd6c5..cc08ed0d55 100644 --- a/agent/xds/listeners.go +++ b/agent/xds/listeners.go @@ -78,6 +78,17 @@ func (s *ResourceGenerator) listenersFromSnapshotConnectProxy(cfgSnap *proxycfg. outboundListener = makePortListener(OutboundListenerName, "127.0.0.1", port, envoy_core_v3.TrafficDirection_OUTBOUND) outboundListener.FilterChains = make([]*envoy_listener_v3.FilterChain, 0) + outboundListener.ListenerFilters = []*envoy_listener_v3.ListenerFilter{ + { + // The original_dst filter is a listener filter that recovers the original destination + // address before the iptables redirection. This filter is needed for transparent + // proxies because they route to upstreams using filter chains that match on the + // destination IP address. If the filter is not present, no chain will match. + // + // TODO(tproxy): Hard-coded until we upgrade the go-control-plane library + Name: "envoy.filters.listener.original_dst", + }, + } } var hasFilterChains bool @@ -201,13 +212,6 @@ func (s *ResourceGenerator) listenersFromSnapshotConnectProxy(cfgSnap *proxycfg. if cfgSnap.ConnectProxy.MeshConfig == nil || !cfgSnap.ConnectProxy.MeshConfig.TransparentProxy.CatalogDestinationsOnly { - outboundListener.ListenerFilters = []*envoy_listener_v3.ListenerFilter{ - { - // TODO (freddy): Hard-coded until we upgrade the go-control-plane library - Name: "envoy.filters.listener.original_dst", - }, - } - filterChain, err := s.makeUpstreamFilterChainForDiscoveryChain( "passthrough", OriginalDestinationClusterName, diff --git a/agent/xds/testdata/listeners/transparent-proxy-catalog-destinations-only.envoy-1-18-x.golden b/agent/xds/testdata/listeners/transparent-proxy-catalog-destinations-only.envoy-1-18-x.golden index 4c444e0444..a3c52dc4f3 100644 --- a/agent/xds/testdata/listeners/transparent-proxy-catalog-destinations-only.envoy-1-18-x.golden +++ b/agent/xds/testdata/listeners/transparent-proxy-catalog-destinations-only.envoy-1-18-x.golden @@ -57,6 +57,11 @@ ] } ], + "listenerFilters": [ + { + "name": "envoy.filters.listener.original_dst" + } + ], "trafficDirection": "OUTBOUND" }, { diff --git a/agent/xds/testdata/listeners/transparent-proxy-catalog-destinations-only.v2compat.envoy-1-16-x.golden b/agent/xds/testdata/listeners/transparent-proxy-catalog-destinations-only.v2compat.envoy-1-16-x.golden index 1d3f29225d..db881a384a 100644 --- a/agent/xds/testdata/listeners/transparent-proxy-catalog-destinations-only.v2compat.envoy-1-16-x.golden +++ b/agent/xds/testdata/listeners/transparent-proxy-catalog-destinations-only.v2compat.envoy-1-16-x.golden @@ -57,6 +57,11 @@ ] } ], + "listenerFilters": [ + { + "name": "envoy.filters.listener.original_dst" + } + ], "trafficDirection": "OUTBOUND" }, {