Feature : Listener Filter Chain Discovery Service

[rakeshdatta]

Commit Message: Feature: Listener Filter Chain Discovery Service
Additional Description:
This is an updated version of this PR: envoyproxy#23096

Representing tenants as filter-chains in envoy, its essential to be able to dynamically and independently load the tenant (filter chain) configs. To achieve that, this feature introduces anothe xDS called Filter Chain Discovery Service, which allows the filter chains inside a listener to be discovered dynamically.

This allows a tenant config to be added, deleted and modified on the fly, without impacting other tenant configs.

This is also an Implementation for the ask here: (envoyproxy#4540)
This feature would allow dynamic config update of filter chains.

Main envoy config yaml:

admin:
  access_log_path: /dev/null
  address:
    socket_address:
      address: 127.0.0.1
      port_value: 19000
dynamic_resources:
  ads_config:
    api_type: GRPC
    transport_api_version: V3
    grpc_services:
    - envoy_grpc:
        cluster_name: xds_cluster
node:
  cluster: test-cluster
  id: test-id
static_resources:
  listeners:
  - name: https_listener
    address:
      socket_address:
        address: 0.0.0.0
        port_value: 9443
    listener_filters:
      - name: envoy.filters.listener.original_dst
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.listener.original_dst.v3.OriginalDst
      - name: tls_inspector
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
    fcds_config:
      collection_name: filter_chains_set_01
      config_source:
        ads: {}

    filter_chain_matcher:
      matcher_tree:
        input:
          name: dynamic_metadata
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.common.matcher.metadata_matcher.v3.DynamicMetadataInput
        custom_match:
          name: envoy.matcher.metadata_matcher
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.common.matcher.metadata_matcher.v3.MetadataMatcher
            on_match:
              action:
                name: filter_chain_list
                typed_config:
                  "@type": type.googleapis.com/google.protobuf.BoolValue
                  value: "true"

  clusters:
  - connect_timeout: 1s
    load_assignment:
      cluster_name: xds_cluster
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: 127.0.0.1
                port_value: 18000
    http2_protocol_options: {}
    name: xds_cluster
layered_runtime:
  layers:
    - name: runtime-0
      rtds_layer:
        rtds_config:
          resource_api_version: V3
          api_config_source:
            transport_api_version: V3
            api_type: GRPC
            grpc_services:
              envoy_grpc:
                cluster_name: xds_cluster
        name: runtime-0

fcds (dynamic) resource format:

- "@type": type.googleapis.com/envoy.config.listener.v3.FilterChain
  name: "tenant_id_01"
  filters:
    - name: envoy.filters.network.sni_filter
      <custom filter logic goes here>
    - name: envoy.filters.network.sni_dynamic_forward_proxy
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.filters.network.sni_dynamic_forward_proxy.v3.FilterConfig
        port_value: 443
        dns_cache_config:
          name: dynamic_forward_proxy_cache_config
          dns_lookup_family: V4_ONLY
    - name: envoy.tcp_proxy
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
        stat_prefix: tcp
        cluster: dynamic_forward_proxy_cluster

Risk Level: High

Testing: Locally tested with Inotify-based config updates.

Pending work:

• warm-up sequence
• having one uber fcds subscription instead of per listener subscription

Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]

[rakeshdatta]

@adisuissa After resolving the comments you had, I was getting an issue pushing some more changes (it was asking me to pull). I just ran 'sync fork' from git UI, and looks like the PR is all messed up now :(

I don't see your comments and my replies anymore. Any suggestion on how to fix this?

In case it cant be fixable, I have this draft PR ready, we can close this one and continue that one. I have taken the snaps of your comments and pasted in that PR, so that the previous discussions are not lost.

envoyproxy#25473

Plz, let me know. Thanks