Revert "xds: add support for envoy 1.15.0 and drop support for 1.11.x (…

…#8424)"

This reverts commit c599a2f.

.circleci/config.yml

@@ -691,13 +691,13 @@ jobs:
           command: bash <(curl -s https://codecov.io/bash) -v -c -C $CIRCLE_SHA1 -F ui
       - run: *notify-slack-failure
 
-  envoy-integration-test-1.12.6:
+  envoy-integration-test-1.11.2:
     docker:
       # We only really need bash and docker-compose which is installed on all
       # Circle images but pick Go since we have to pick one of them.
       - image: *GOLANG_IMAGE
     environment:
-      ENVOY_VERSION: "1.12.6"
+      ENVOY_VERSION: "1.11.2"
     steps: &ENVOY_INTEGRATION_TEST_STEPS
       - checkout
       # Get go binary from workspace
@@ -726,25 +726,25 @@ jobs:
           path: *TEST_RESULTS_DIR
       - run: *notify-slack-failure
 
-  envoy-integration-test-1.13.4:
+  envoy-integration-test-1.12.6:
     docker:
       - image: *GOLANG_IMAGE
     environment:
-      ENVOY_VERSION: "1.13.4"
+      ENVOY_VERSION: "1.12.6"
     steps: *ENVOY_INTEGRATION_TEST_STEPS
 
-  envoy-integration-test-1.14.4:
+  envoy-integration-test-1.13.4:
     docker:
       - image: *GOLANG_IMAGE
     environment:
-      ENVOY_VERSION: "1.14.4"
+      ENVOY_VERSION: "1.13.4"
     steps: *ENVOY_INTEGRATION_TEST_STEPS
 
-  envoy-integration-test-1.15.0:
+  envoy-integration-test-1.14.4:
     docker:
       - image: *GOLANG_IMAGE
     environment:
-      ENVOY_VERSION: "1.15.0"
+      ENVOY_VERSION: "1.14.4"
     steps: *ENVOY_INTEGRATION_TEST_STEPS
 
   # run integration tests for the connect ca providers
@@ -859,6 +859,9 @@ workflows:
       - nomad-integration-0_8:
           requires:
             - dev-build
+      - envoy-integration-test-1.11.2:
+          requires:
+            - dev-build
       - envoy-integration-test-1.12.6:
           requires:
             - dev-build
@@ -868,9 +871,6 @@ workflows:
       - envoy-integration-test-1.14.4:
           requires:
             - dev-build
-      - envoy-integration-test-1.15.0:
-          requires:
-            - dev-build
 
   website:
     jobs:

agent/xds/clusters_test.go

@@ -11,7 +11,6 @@ import (
 	envoy "github.com/envoyproxy/go-control-plane/envoy/api/v2"
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
-	"github.com/hashicorp/consul/agent/xds/proxysupport"
 	"github.com/hashicorp/consul/sdk/testutil"
 	testinf "github.com/mitchellh/go-testing-interface"
 	"github.com/stretchr/testify/require"
@@ -528,9 +527,8 @@ func TestClustersFromSnapshot(t *testing.T) {
 		},
 	}
 
-	for _, envoyVersion := range proxysupport.EnvoyVersions {
-		sf, err := determineSupportedProxyFeaturesFromString(envoyVersion)
-		require.NoError(t, err)
+	for _, envoyVersion := range supportedEnvoyVersions {
+		sf := determineSupportedProxyFeaturesFromString(envoyVersion)
 		t.Run("envoy-"+envoyVersion, func(t *testing.T) {
 			for _, tt := range tests {
 				t.Run(tt.name, func(t *testing.T) {
@@ -739,3 +737,13 @@ func setupTLSRootsAndLeaf(t *testing.T, snap *proxycfg.ConfigSnapshot) {
 		snap.Roots.Roots[0].RootCert = golden(t, "test-root-cert", "", "")
 	}
 }
+
+// supportedEnvoyVersions lists the versions that we generated golden tests for
+//
+// see: https://www.consul.io/docs/connect/proxies/envoy#supported-versions
+var supportedEnvoyVersions = []string{
+	"1.14.4",
+	"1.13.4",
+	"1.12.6",
+	"1.11.2",
+}

agent/xds/endpoints_test.go

@@ -14,7 +14,6 @@ import (
 	envoyendpoint "github.com/envoyproxy/go-control-plane/envoy/api/v2/endpoint"
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
-	"github.com/hashicorp/consul/agent/xds/proxysupport"
 	"github.com/hashicorp/consul/sdk/testutil"
 	testinf "github.com/mitchellh/go-testing-interface"
 )
@@ -555,9 +554,8 @@ func Test_endpointsFromSnapshot(t *testing.T) {
 		},
 	}
 
-	for _, envoyVersion := range proxysupport.EnvoyVersions {
-		sf, err := determineSupportedProxyFeaturesFromString(envoyVersion)
-		require.NoError(t, err)
+	for _, envoyVersion := range supportedEnvoyVersions {
+		sf := determineSupportedProxyFeaturesFromString(envoyVersion)
 		t.Run("envoy-"+envoyVersion, func(t *testing.T) {
 			for _, tt := range tests {
 				t.Run(tt.name, func(t *testing.T) {

agent/xds/envoy_versioning.go

@@ -9,37 +9,25 @@ import (
 )
 
 var (
-	// minSupportedVersion is the oldest mainline version we support. This should always be
-	// the zero'th point release of the last element of proxysupport.EnvoyVersions.
-	minSupportedVersion = version.Must(version.NewVersion("1.12.0"))
+	// minSafeRegexVersion reflects the minimum version where we could use safe_regex instead of regex
+	//
+	// NOTE: the first version that no longer supported the old style was 1.13.0
+	minSafeRegexVersion = version.Must(version.NewVersion("1.11.2"))
 )
 
 type supportedProxyFeatures struct {
-	// add version dependent feature flags here
+	RouterMatchSafeRegex bool // use safe_regex instead of regex in http.router rules
 }
 
-func determineSupportedProxyFeatures(node *envoycore.Node) (supportedProxyFeatures, error) {
+func determineSupportedProxyFeatures(node *envoycore.Node) supportedProxyFeatures {
 	version := determineEnvoyVersionFromNode(node)
-	return determineSupportedProxyFeaturesFromVersion(version)
-}
-
-func determineSupportedProxyFeaturesFromString(vs string) (supportedProxyFeatures, error) {
-	version := version.Must(version.NewVersion(vs))
-	return determineSupportedProxyFeaturesFromVersion(version)
-}
-
-func determineSupportedProxyFeaturesFromVersion(version *version.Version) (supportedProxyFeatures, error) {
 	if version == nil {
-		// This would happen on either extremely old builds OR perhaps on
-		// custom builds. Should we error?
-		return supportedProxyFeatures{}, nil
+		return supportedProxyFeatures{}
 	}
 
-	if version.LessThan(minSupportedVersion) {
-		return supportedProxyFeatures{}, fmt.Errorf("Envoy %s is too old and is not supported by Consul", version)
+	return supportedProxyFeatures{
+		RouterMatchSafeRegex: !version.LessThan(minSafeRegexVersion),
 	}
-
-	return supportedProxyFeatures{}, nil
 }
 
 // example: 1580db37e9a97c37e410bad0e1507ae1a0fd9e77/1.12.4/Clean/RELEASE/BoringSSL
@@ -86,3 +74,10 @@ func determineEnvoyVersionFromNode(node *envoycore.Node) *version.Version {
 		),
 	))
 }
+
+func determineSupportedProxyFeaturesFromString(vs string) supportedProxyFeatures {
+	version := version.Must(version.NewVersion(vs))
+	return supportedProxyFeatures{
+		RouterMatchSafeRegex: !version.LessThan(minSafeRegexVersion),
+	}
+}

agent/xds/listeners_test.go

@@ -11,7 +11,6 @@ import (
 	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
-	"github.com/hashicorp/consul/agent/xds/proxysupport"
 	"github.com/hashicorp/consul/sdk/testutil"
 	testinf "github.com/mitchellh/go-testing-interface"
 	"github.com/stretchr/testify/require"
@@ -494,9 +493,8 @@ func TestListenersFromSnapshot(t *testing.T) {
 		},
 	}
 
-	for _, envoyVersion := range proxysupport.EnvoyVersions {
-		sf, err := determineSupportedProxyFeaturesFromString(envoyVersion)
-		require.NoError(t, err)
+	for _, envoyVersion := range supportedEnvoyVersions {
+		sf := determineSupportedProxyFeaturesFromString(envoyVersion)
 		t.Run("envoy-"+envoyVersion, func(t *testing.T) {
 			for _, tt := range tests {
 				t.Run(tt.name, func(t *testing.T) {

agent/xds/routes.go

@@ -277,7 +277,7 @@ func makeUpstreamRouteForDiscoveryChain(
 	return host, nil
 }
 
-func makeRouteMatchForDiscoveryRoute(_ connectionInfo, discoveryRoute *structs.DiscoveryRoute) *envoyroute.RouteMatch {
+func makeRouteMatchForDiscoveryRoute(cInfo connectionInfo, discoveryRoute *structs.DiscoveryRoute) *envoyroute.RouteMatch {
 	match := discoveryRoute.Definition.Match
 	if match == nil || match.IsEmpty() {
 		return makeDefaultRouteMatch()
@@ -295,8 +295,14 @@ func makeRouteMatchForDiscoveryRoute(_ connectionInfo, discoveryRoute *structs.D
 			Prefix: match.HTTP.PathPrefix,
 		}
 	case match.HTTP.PathRegex != "":
-		em.PathSpecifier = &envoyroute.RouteMatch_SafeRegex{
-			SafeRegex: makeEnvoyRegexMatch(match.HTTP.PathRegex),
+		if cInfo.ProxyFeatures.RouterMatchSafeRegex {
+			em.PathSpecifier = &envoyroute.RouteMatch_SafeRegex{
+				SafeRegex: makeEnvoyRegexMatch(match.HTTP.PathRegex),
+			}
+		} else {
+			em.PathSpecifier = &envoyroute.RouteMatch_Regex{
+				Regex: match.HTTP.PathRegex,
+			}
 		}
 	default:
 		em.PathSpecifier = &envoyroute.RouteMatch_Prefix{
@@ -317,8 +323,14 @@ func makeRouteMatchForDiscoveryRoute(_ connectionInfo, discoveryRoute *structs.D
 					ExactMatch: hdr.Exact,
 				}
 			case hdr.Regex != "":
-				eh.HeaderMatchSpecifier = &envoyroute.HeaderMatcher_SafeRegexMatch{
-					SafeRegexMatch: makeEnvoyRegexMatch(hdr.Regex),
+				if cInfo.ProxyFeatures.RouterMatchSafeRegex {
+					eh.HeaderMatchSpecifier = &envoyroute.HeaderMatcher_SafeRegexMatch{
+						SafeRegexMatch: makeEnvoyRegexMatch(hdr.Regex),
+					}
+				} else {
+					eh.HeaderMatchSpecifier = &envoyroute.HeaderMatcher_RegexMatch{
+						RegexMatch: hdr.Regex,
+					}
 				}
 			case hdr.Prefix != "":
 				eh.HeaderMatchSpecifier = &envoyroute.HeaderMatcher_PrefixMatch{
@@ -349,9 +361,15 @@ func makeRouteMatchForDiscoveryRoute(_ connectionInfo, discoveryRoute *structs.D
 
 		eh := &envoyroute.HeaderMatcher{
 			Name: ":method",
-			HeaderMatchSpecifier: &envoyroute.HeaderMatcher_SafeRegexMatch{
+		}
+		if cInfo.ProxyFeatures.RouterMatchSafeRegex {
+			eh.HeaderMatchSpecifier = &envoyroute.HeaderMatcher_SafeRegexMatch{
 				SafeRegexMatch: makeEnvoyRegexMatch(methodHeaderRegex),
-			},
+			}
+		} else {
+			eh.HeaderMatchSpecifier = &envoyroute.HeaderMatcher_RegexMatch{
+				RegexMatch: methodHeaderRegex,
+			}
 		}
 
 		em.Headers = append(em.Headers, eh)
@@ -366,24 +384,37 @@ func makeRouteMatchForDiscoveryRoute(_ connectionInfo, discoveryRoute *structs.D
 
 			switch {
 			case qm.Exact != "":
-				eq.QueryParameterMatchSpecifier = &envoyroute.QueryParameterMatcher_StringMatch{
-					StringMatch: &envoymatcher.StringMatcher{
-						MatchPattern: &envoymatcher.StringMatcher_Exact{
-							Exact: qm.Exact,
+				if cInfo.ProxyFeatures.RouterMatchSafeRegex {
+					eq.QueryParameterMatchSpecifier = &envoyroute.QueryParameterMatcher_StringMatch{
+						StringMatch: &envoymatcher.StringMatcher{
+							MatchPattern: &envoymatcher.StringMatcher_Exact{
+								Exact: qm.Exact,
+							},
 						},
-					},
+					}
+				} else {
+					eq.Value = qm.Exact
 				}
 			case qm.Regex != "":
-				eq.QueryParameterMatchSpecifier = &envoyroute.QueryParameterMatcher_StringMatch{
-					StringMatch: &envoymatcher.StringMatcher{
-						MatchPattern: &envoymatcher.StringMatcher_SafeRegex{
-							SafeRegex: makeEnvoyRegexMatch(qm.Regex),
+				if cInfo.ProxyFeatures.RouterMatchSafeRegex {
+					eq.QueryParameterMatchSpecifier = &envoyroute.QueryParameterMatcher_StringMatch{
+						StringMatch: &envoymatcher.StringMatcher{
+							MatchPattern: &envoymatcher.StringMatcher_SafeRegex{
+								SafeRegex: makeEnvoyRegexMatch(qm.Regex),
+							},
 						},
-					},
+					}
+				} else {
+					eq.Value = qm.Regex
+					eq.Regex = makeBoolValue(true)
 				}
 			case qm.Present:
-				eq.QueryParameterMatchSpecifier = &envoyroute.QueryParameterMatcher_PresentMatch{
-					PresentMatch: true,
+				if cInfo.ProxyFeatures.RouterMatchSafeRegex {
+					eq.QueryParameterMatchSpecifier = &envoyroute.QueryParameterMatcher_PresentMatch{
+						PresentMatch: true,
+					}
+				} else {
+					eq.Value = ""
 				}
 			default:
 				continue // skip this impossible situation

agent/xds/routes_test.go

@@ -11,7 +11,6 @@ import (
 	"github.com/hashicorp/consul/agent/consul/discoverychain"
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
-	"github.com/hashicorp/consul/agent/xds/proxysupport"
 	testinf "github.com/mitchellh/go-testing-interface"
 	"github.com/stretchr/testify/require"
 )
@@ -176,9 +175,8 @@ func TestRoutesFromSnapshot(t *testing.T) {
 		},
 	}
 
-	for _, envoyVersion := range proxysupport.EnvoyVersions {
-		sf, err := determineSupportedProxyFeaturesFromString(envoyVersion)
-		require.NoError(t, err)
+	for _, envoyVersion := range supportedEnvoyVersions {
+		sf := determineSupportedProxyFeaturesFromString(envoyVersion)
 		t.Run("envoy-"+envoyVersion, func(t *testing.T) {
 			for _, tt := range tests {
 				t.Run(tt.name, func(t *testing.T) {

agent/xds/server.go

@@ -297,11 +297,7 @@ func (s *Server) process(stream ADSStream, reqCh <-chan *envoy.DiscoveryRequest)
 
 			if node == nil && req.Node != nil {
 				node = req.Node
-				var err error
-				proxyFeatures, err = determineSupportedProxyFeatures(req.Node)
-				if err != nil {
-					return status.Errorf(codes.InvalidArgument, err.Error())
-				}
+				proxyFeatures = determineSupportedProxyFeatures(req.Node)
 			}
 
 			if handler, ok := handlers[req.TypeUrl]; ok {

command/connect/envoy/envoy.go

@@ -14,7 +14,6 @@ import (
 
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/agent/xds"
-	"github.com/hashicorp/consul/agent/xds/proxysupport"
 	"github.com/hashicorp/consul/api"
 	proxyCmd "github.com/hashicorp/consul/command/connect/proxy"
 	"github.com/hashicorp/consul/command/flags"
@@ -69,9 +68,10 @@ type cmd struct {
 	gatewayKind    api.ServiceKind
 }
 
-const meshGatewayVal = "mesh"
-
-var defaultEnvoyVersion = proxysupport.EnvoyVersions[0]
+const (
+	defaultEnvoyVersion = "1.14.4"
+	meshGatewayVal      = "mesh"
+)
 
 var supportedGateways = map[string]api.ServiceKind{
 	"mesh":        api.ServiceKindMeshGateway,