extensions: Consolidate extension metadata (#16496)

Signed-off-by: Ryan Northey <[email protected]>
envoyproxy · May 28, 2021 · 57976d1 · 57976d1
1 parent a659068
commit 57976d1
Show file tree

Hide file tree

Showing 142 changed files with 32 additions and 450 deletions.
diff --git a/bazel/envoy_library.bzl b/bazel/envoy_library.bzl
@@ -46,11 +46,6 @@ def envoy_basic_cc_library(name, deps = [], external_deps = [], **kargs):
 
 def envoy_cc_extension(
         name,
-        security_posture,
-        category = None,
-        # Only set this for internal, undocumented extensions.
-        undocumented = False,
-        status = "stable",
         tags = [],
         extra_visibility = [],
         visibility = EXTENSION_CONFIG_VISIBILITY,

diff --git a/ci/format_pre.sh b/ci/format_pre.sh
@@ -46,6 +46,9 @@ bazel run "${BAZEL_BUILD_OPTIONS[@]}" //configs:example_configs_validation
 CURRENT=python
 bazel run "${BAZEL_BUILD_OPTIONS[@]}" //tools/code_format:python_check -- --diff-file="$DIFF_OUTPUT" --fix "$(pwd)"
 
+CURRENT=extensions
+bazel run "${BAZEL_BUILD_OPTIONS[@]}" //tools/extensions:validate_extensions
+
 if [[ "${#FAILED[@]}" -ne "0" ]]; then
     echo "TESTS FAILED:" >&2
     for failed in "${FAILED[@]}"; do

diff --git a/docs/build.sh b/docs/build.sh
@@ -63,22 +63,15 @@ pip3 install --require-hashes -r "${SCRIPT_DIR}"/requirements.txt
 # files still.
 rm -rf bazel-bin/external/envoy_api_canonical
 
-EXTENSION_DB_PATH="$(realpath "${BUILD_DIR}/extension_db.json")"
-rm -rf "${EXTENSION_DB_PATH}"
 GENERATED_RST_DIR="$(realpath "${GENERATED_RST_DIR}")"
-export EXTENSION_DB_PATH
 export GENERATED_RST_DIR
 
 # This is for local RBE setup, should be no-op for builds without RBE setting in bazelrc files.
 IFS=" " read -ra BAZEL_BUILD_OPTIONS <<< "${BAZEL_BUILD_OPTIONS:-}"
 BAZEL_BUILD_OPTIONS+=(
     "--remote_download_outputs=all"
     "--strategy=protodoc=sandboxed,local"
-    "--action_env=ENVOY_BLOB_SHA"
-    "--action_env=EXTENSION_DB_PATH")
-
-# TODO(phlax): move this to format_pre checks
-bazel run "${BAZEL_BUILD_OPTIONS[@]}" //tools/extensions:validate_extensions
+    "--action_env=ENVOY_BLOB_SHA")
 
 # Generate RST for the lists of trusted/untrusted extensions in
 # intro/arch_overview/security docs.

diff --git a/source/extensions/BUILD b/source/extensions/BUILD
@@ -2,4 +2,5 @@ licenses(["notice"])  # Apache 2
 
 exports_files([
     "extensions_metadata.yaml",
+    "extensions_build_config.bzl",
 ])
diff --git a/source/extensions/access_loggers/file/BUILD b/source/extensions/access_loggers/file/BUILD
@@ -15,12 +15,10 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.access_loggers",
     # TODO(#9953) determine if this is core or should be cleaned up.
     extra_visibility = [
         "//test:__subpackages__",
     ],
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         "//include/envoy/registry",
         "//source/common/config:config_provider_lib",

diff --git a/source/extensions/access_loggers/grpc/BUILD b/source/extensions/access_loggers/grpc/BUILD
@@ -97,13 +97,11 @@ envoy_cc_extension(
     name = "http_config",
     srcs = ["http_config.cc"],
     hdrs = ["http_config.h"],
-    category = "envoy.access_loggers",
     # TODO(#9953) clean up.
     extra_visibility = [
         "//test/common/access_log:__subpackages__",
         "//test/integration:__subpackages__",
     ],
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         ":config_utils",
         "//include/envoy/server:access_log_config_interface",
@@ -121,13 +119,11 @@ envoy_cc_extension(
     name = "tcp_config",
     srcs = ["tcp_config.cc"],
     hdrs = ["tcp_config.h"],
-    category = "envoy.access_loggers",
     # TODO(#9953) clean up.
     extra_visibility = [
         "//test/common/access_log:__subpackages__",
         "//test/integration:__subpackages__",
     ],
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         ":config_utils",
         "//include/envoy/server:access_log_config_interface",

diff --git a/source/extensions/access_loggers/open_telemetry/BUILD b/source/extensions/access_loggers/open_telemetry/BUILD
@@ -61,13 +61,11 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.access_loggers",
     # TODO(#9953) clean up.
     extra_visibility = [
         "//test/common/access_log:__subpackages__",
         "//test/integration:__subpackages__",
     ],
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         "//include/envoy/server:access_log_config_interface",
         "//source/common/common:assert_lib",

diff --git a/source/extensions/access_loggers/stream/BUILD b/source/extensions/access_loggers/stream/BUILD
@@ -12,11 +12,9 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.access_loggers",
     extra_visibility = [
         "//test:__subpackages__",
     ],
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         "//include/envoy/registry",
         "//source/common/config:config_provider_lib",

diff --git a/source/extensions/access_loggers/wasm/BUILD b/source/extensions/access_loggers/wasm/BUILD
@@ -26,9 +26,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.access_loggers",
-    security_posture = "unknown",
-    status = "alpha",
     deps = [
         ":wasm_access_log_lib",
         "//include/envoy/registry",

diff --git a/source/extensions/bootstrap/wasm/BUILD b/source/extensions/bootstrap/wasm/BUILD
@@ -16,9 +16,6 @@ envoy_cc_extension(
     hdrs = [
         "config.h",
     ],
-    category = "envoy.bootstrap",
-    security_posture = "unknown",
-    status = "alpha",
     deps = [
         "//include/envoy/registry",
         "//include/envoy/server:bootstrap_extension_config_interface",

diff --git a/source/extensions/clusters/aggregate/BUILD b/source/extensions/clusters/aggregate/BUILD
@@ -15,8 +15,6 @@ envoy_cc_extension(
         "cluster.h",
         "lb_context.h",
     ],
-    category = "envoy.clusters",
-    security_posture = "requires_trusted_downstream_and_upstream",
     deps = [
         "//source/common/upstream:cluster_factory_lib",
         "//source/common/upstream:upstream_includes",

diff --git a/source/extensions/clusters/dynamic_forward_proxy/BUILD b/source/extensions/clusters/dynamic_forward_proxy/BUILD
@@ -12,8 +12,6 @@ envoy_cc_extension(
     name = "cluster",
     srcs = ["cluster.cc"],
     hdrs = ["cluster.h"],
-    category = "envoy.clusters",
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         "//source/common/network:transport_socket_options_lib",
         "//source/common/upstream:cluster_factory_lib",

diff --git a/source/extensions/clusters/redis/BUILD b/source/extensions/clusters/redis/BUILD
@@ -42,8 +42,6 @@ envoy_cc_extension(
         "redis_cluster.cc",
         "redis_cluster.h",
     ],
-    category = "envoy.clusters",
-    security_posture = "requires_trusted_downstream_and_upstream",
     deps = [
         "redis_cluster_lb",
         "//include/envoy/api:api_interface",

diff --git a/source/extensions/common/crypto/BUILD b/source/extensions/common/crypto/BUILD
@@ -18,7 +18,6 @@ envoy_cc_extension(
         "crypto_impl.h",
         "utility_impl.h",
     ],
-    category = "DELIBERATELY_OMITTED",
     external_deps = [
         "ssl",
     ],
@@ -27,8 +26,6 @@ envoy_cc_extension(
         "//test/common/config:__subpackages__",
         "//test/common/crypto:__subpackages__",
     ],
-    security_posture = "unknown",
-    undocumented = True,
     deps = [
         "//include/envoy/buffer:buffer_interface",
         "//source/common/common:assert_lib",

diff --git a/source/extensions/compression/brotli/compressor/BUILD b/source/extensions/compression/brotli/compressor/BUILD
@@ -25,8 +25,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.compression.compressor",
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         ":compressor_lib",
         "//source/common/http:headers_lib",

diff --git a/source/extensions/compression/brotli/decompressor/BUILD b/source/extensions/compression/brotli/decompressor/BUILD
@@ -27,8 +27,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.compression.decompressor",
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         ":decompressor_lib",
         "//source/common/http:headers_lib",

diff --git a/source/extensions/compression/gzip/compressor/BUILD b/source/extensions/compression/gzip/compressor/BUILD
@@ -26,8 +26,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.compression.compressor",
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         ":compressor_lib",
         "//source/common/http:headers_lib",

diff --git a/source/extensions/compression/gzip/decompressor/BUILD b/source/extensions/compression/gzip/decompressor/BUILD
@@ -29,8 +29,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.compression.decompressor",
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         ":zlib_decompressor_impl_lib",
         "//source/common/http:headers_lib",

diff --git a/source/extensions/filters/http/adaptive_concurrency/BUILD b/source/extensions/filters/http/adaptive_concurrency/BUILD
@@ -30,9 +30,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "unknown",
-    status = "alpha",
     deps = [
         "//include/envoy/registry",
         "//source/extensions/filters/http:well_known_names",

diff --git a/source/extensions/filters/http/admission_control/BUILD b/source/extensions/filters/http/admission_control/BUILD
@@ -1,6 +1,7 @@
 load(
     "//bazel:envoy_build_system.bzl",
     "envoy_cc_extension",
+    "envoy_cc_library",
     "envoy_extension_package",
 )
 
@@ -11,7 +12,7 @@ licenses(["notice"])  # Apache 2
 
 envoy_extension_package()
 
-envoy_cc_extension(
+envoy_cc_library(
     name = "admission_control_filter_lib",
     srcs = [
         "admission_control.cc",
@@ -21,8 +22,6 @@ envoy_cc_extension(
         "admission_control.h",
         "thread_local_controller.h",
     ],
-    category = "envoy.filters.http",
-    security_posture = "unknown",
     deps = [
         "//include/envoy/http:filter_interface",
         "//include/envoy/runtime:runtime_interface",
@@ -41,9 +40,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "unknown",
-    status = "alpha",
     deps = [
         "//include/envoy/registry",
         "//source/common/common:enum_to_int",

diff --git a/source/extensions/filters/http/aws_lambda/BUILD b/source/extensions/filters/http/aws_lambda/BUILD
@@ -37,9 +37,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "requires_trusted_downstream_and_upstream",
-    status = "alpha",
     deps = [
         ":aws_lambda_filter_lib",
         "//include/envoy/registry",

diff --git a/source/extensions/filters/http/aws_request_signing/BUILD b/source/extensions/filters/http/aws_request_signing/BUILD
@@ -29,9 +29,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "requires_trusted_downstream_and_upstream",
-    status = "alpha",
     deps = [
         ":aws_request_signing_filter_lib",
         "//include/envoy/registry",

diff --git a/source/extensions/filters/http/bandwidth_limit/BUILD b/source/extensions/filters/http/bandwidth_limit/BUILD
@@ -36,8 +36,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "unknown",
     deps = [
         ":bandwidth_limit_lib",
         "//include/envoy/http:filter_interface",

diff --git a/source/extensions/filters/http/buffer/BUILD b/source/extensions/filters/http/buffer/BUILD
@@ -37,8 +37,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "robust_to_untrusted_downstream",
     # Legacy test use. TODO(#9953) clean up.
     visibility = ["//visibility:public"],
     deps = [

diff --git a/source/extensions/filters/http/cache/BUILD b/source/extensions/filters/http/cache/BUILD
@@ -101,9 +101,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "robust_to_untrusted_downstream_and_upstream",
-    status = "wip",
     deps = [
         ":cache_filter_lib",
         "//source/extensions/filters/http:well_known_names",

diff --git a/source/extensions/filters/http/cache/simple_http_cache/BUILD b/source/extensions/filters/http/cache/simple_http_cache/BUILD
@@ -14,9 +14,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["simple_http_cache.cc"],
     hdrs = ["simple_http_cache.h"],
-    category = "envoy.filters.http.cache",
-    security_posture = "robust_to_untrusted_downstream_and_upstream",
-    status = "wip",
     deps = [
         "//include/envoy/registry",
         "//include/envoy/runtime:runtime_interface",

diff --git a/source/extensions/filters/http/cdn_loop/BUILD b/source/extensions/filters/http/cdn_loop/BUILD
@@ -45,9 +45,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "unknown",
-    status = "alpha",
     deps = [
         ":filter_lib",
         ":parser_lib",

diff --git a/source/extensions/filters/http/composite/BUILD b/source/extensions/filters/http/composite/BUILD
@@ -45,8 +45,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "unknown",
     deps = [
         "//include/envoy/registry",
         "//include/envoy/server:filter_config_interface",

diff --git a/source/extensions/filters/http/compressor/BUILD b/source/extensions/filters/http/compressor/BUILD
@@ -27,8 +27,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         ":compressor_filter_lib",
         "//include/envoy/compression/compressor:compressor_config_interface",

diff --git a/source/extensions/filters/http/cors/BUILD b/source/extensions/filters/http/cors/BUILD
@@ -31,12 +31,10 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
     # TODO(#9953) clean up.
     extra_visibility = [
         "//test/integration:__subpackages__",
     ],
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         "//include/envoy/registry",
         "//include/envoy/server:filter_config_interface",

diff --git a/source/extensions/filters/http/csrf/BUILD b/source/extensions/filters/http/csrf/BUILD
@@ -33,8 +33,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         "//include/envoy/registry",
         "//source/extensions/filters/http:well_known_names",

diff --git a/source/extensions/filters/http/decompressor/BUILD b/source/extensions/filters/http/decompressor/BUILD
@@ -33,8 +33,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "robust_to_untrusted_downstream_and_upstream",
     deps = [
         ":decompressor_filter_lib",
         "//include/envoy/compression/decompressor:decompressor_config_interface",

diff --git a/source/extensions/filters/http/dynamic_forward_proxy/BUILD b/source/extensions/filters/http/dynamic_forward_proxy/BUILD
@@ -29,8 +29,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "robust_to_untrusted_downstream",
     deps = [
         "//include/envoy/registry",
         "//include/envoy/server:filter_config_interface",

diff --git a/source/extensions/filters/http/dynamo/BUILD b/source/extensions/filters/http/dynamo/BUILD
@@ -42,8 +42,6 @@ envoy_cc_extension(
     name = "config",
     srcs = ["config.cc"],
     hdrs = ["config.h"],
-    category = "envoy.filters.http",
-    security_posture = "requires_trusted_downstream_and_upstream",
     deps = [
         ":dynamo_filter_lib",
         "//include/envoy/registry",