NET-6946 / NET-6941 - Replace usage of deprecated Envoy fields envoy.…

…config.route.v3.HeaderMatcher.safe_regex_match and envoy.type.matcher.v3.RegexMatcher.google_re2 (#20013) * NET-6946 - Replace usage of deprecated Envoy field envoy.config.route.v3.HeaderMatcher.safe_regex_match * removing unrelated changes * update golden files * do not set engine type
hashicorp · Jan 3, 2024 · d925e4b · d925e4b
1 parent 3b94efa
commit d925e4b
Showing 286 changed files with 1,527 additions and 1,781 deletions.
diff --git a/.changelog/20013.txt b/.changelog/20013.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+xds: replace usage of deprecated Envoy field `envoy.config.route.v3.HeaderMatcher.safe_regex_match`
+```
diff --git a/agent/envoyextensions/builtin/ext-authz/structs.go b/agent/envoyextensions/builtin/ext-authz/structs.go
@@ -547,8 +547,7 @@ func (s *StringMatcher) toEnvoy() *envoy_type_matcher_v3.StringMatcher {
 		return &envoy_type_matcher_v3.StringMatcher{
 			MatchPattern: &envoy_type_matcher_v3.StringMatcher_SafeRegex{
 				SafeRegex: &envoy_type_matcher_v3.RegexMatcher{
-					EngineType: &envoy_type_matcher_v3.RegexMatcher_GoogleRe2{},
-					Regex:      s.SafeRegex,
+					Regex: s.SafeRegex,
 				},
 			},
 		}

diff --git a/agent/xds/rbac.go b/agent/xds/rbac.go
@@ -1107,9 +1107,6 @@ func parseXFCCToDynamicMetaHTTPFilter() (*envoy_http_v3.HttpFilter, error) {
 				RegexValueRewrite: &envoy_matcher_v3.RegexMatchAndSubstitute{
 					Pattern: &envoy_matcher_v3.RegexMatcher{
 						Regex: downstreamServiceIdentityMatcher,
-						EngineType: &envoy_matcher_v3.RegexMatcher_GoogleRe2{
-							GoogleRe2: &envoy_matcher_v3.RegexMatcher_GoogleRE2{},
-						},
 					},
 					Substitution: f.sub,
 				},
@@ -1310,8 +1307,12 @@ func convertPermission(perm *structs.IntentionPermission) *envoy_rbac_v3.Permiss
 
 		eh := &envoy_route_v3.HeaderMatcher{
 			Name: ":method",
-			HeaderMatchSpecifier: &envoy_route_v3.HeaderMatcher_SafeRegexMatch{
-				SafeRegexMatch: response.MakeEnvoyRegexMatch(methodHeaderRegex),
+			HeaderMatchSpecifier: &envoy_route_v3.HeaderMatcher_StringMatch{
+				StringMatch: &envoy_matcher_v3.StringMatcher{
+					MatchPattern: &envoy_matcher_v3.StringMatcher_SafeRegex{
+						SafeRegex: response.MakeEnvoyRegexMatch(methodHeaderRegex),
+					},
+				},
 			},
 		}
 

diff --git a/agent/xds/response/response.go b/agent/xds/response/response.go
@@ -75,9 +75,6 @@ func MakeBoolValue(n bool) *wrapperspb.BoolValue {
 
 func MakeEnvoyRegexMatch(patt string) *envoy_matcher_v3.RegexMatcher {
 	return &envoy_matcher_v3.RegexMatcher{
-		EngineType: &envoy_matcher_v3.RegexMatcher_GoogleRe2{
-			GoogleRe2: &envoy_matcher_v3.RegexMatcher_GoogleRE2{},
-		},
 		Regex: patt,
 	}
 }
diff --git a/agent/xds/routes.go b/agent/xds/routes.go
@@ -924,8 +924,12 @@ func makeRouteMatchForDiscoveryRoute(discoveryRoute *structs.DiscoveryRoute) *en
 
 		eh := &envoy_route_v3.HeaderMatcher{
 			Name: ":method",
-			HeaderMatchSpecifier: &envoy_route_v3.HeaderMatcher_SafeRegexMatch{
-				SafeRegexMatch: response.MakeEnvoyRegexMatch(methodHeaderRegex),
+			HeaderMatchSpecifier: &envoy_route_v3.HeaderMatcher_StringMatch{
+				StringMatch: &envoy_matcher_v3.StringMatcher{
+					MatchPattern: &envoy_matcher_v3.StringMatcher_SafeRegex{
+						SafeRegex: response.MakeEnvoyRegexMatch(methodHeaderRegex),
+					},
+				},
 			},
 		}
 

diff --git a/...t/xds/testdata/builtin_extension/clusters/ext-authz-http-local-grpc-service.latest.golden b/...t/xds/testdata/builtin_extension/clusters/ext-authz-http-local-grpc-service.latest.golden
@@ -36,10 +36,10 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {
@@ -83,16 +83,16 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 },
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {

diff --git a/...t/xds/testdata/builtin_extension/clusters/ext-authz-http-local-http-service.latest.golden b/...t/xds/testdata/builtin_extension/clusters/ext-authz-http-local-http-service.latest.golden
@@ -36,10 +36,10 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {
@@ -83,16 +83,16 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 },
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {

diff --git a/...ds/testdata/builtin_extension/clusters/ext-authz-http-upstream-grpc-service.latest.golden b/...ds/testdata/builtin_extension/clusters/ext-authz-http-upstream-grpc-service.latest.golden
@@ -36,10 +36,10 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {
@@ -83,16 +83,16 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 },
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {

diff --git a/...ds/testdata/builtin_extension/clusters/ext-authz-http-upstream-http-service.latest.golden b/...ds/testdata/builtin_extension/clusters/ext-authz-http-upstream-http-service.latest.golden
@@ -36,10 +36,10 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {
@@ -83,16 +83,16 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 },
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {

diff --git a/agent/xds/testdata/builtin_extension/clusters/ext-authz-tcp-local-grpc-service.latest.golden b/agent/xds/testdata/builtin_extension/clusters/ext-authz-tcp-local-grpc-service.latest.golden
@@ -36,10 +36,10 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {
@@ -83,16 +83,16 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 },
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {

diff --git a/...xds/testdata/builtin_extension/clusters/ext-authz-tcp-upstream-grpc-service.latest.golden b/...xds/testdata/builtin_extension/clusters/ext-authz-tcp-upstream-grpc-service.latest.golden
@@ -36,10 +36,10 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {
@@ -83,16 +83,16 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 },
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {

diff --git a/agent/xds/testdata/builtin_extension/clusters/lambda-and-lua-connect-proxy.latest.golden b/agent/xds/testdata/builtin_extension/clusters/lambda-and-lua-connect-proxy.latest.golden
@@ -72,16 +72,16 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 },
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {

diff --git a/.../xds/testdata/builtin_extension/clusters/lambda-connect-proxy-opposite-meta.latest.golden b/.../xds/testdata/builtin_extension/clusters/lambda-connect-proxy-opposite-meta.latest.golden
@@ -72,16 +72,16 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 },
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {

diff --git a/agent/xds/testdata/builtin_extension/clusters/lambda-connect-proxy-tproxy.latest.golden b/agent/xds/testdata/builtin_extension/clusters/lambda-connect-proxy-tproxy.latest.golden
@@ -36,10 +36,10 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {
@@ -83,16 +83,16 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 },
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {
@@ -205,10 +205,10 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/no-endpoints"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {

diff --git a/...n_extension/clusters/lambda-connect-proxy-with-terminating-gateway-upstream.latest.golden b/...n_extension/clusters/lambda-connect-proxy-with-terminating-gateway-upstream.latest.golden
@@ -36,10 +36,10 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {
@@ -83,16 +83,16 @@
             "validationContext": {
               "matchTypedSubjectAltNames": [
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 },
                 {
-                  "sanType": "URI",
                   "matcher": {
                     "exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
-                  }
+                  },
+                  "sanType": "URI"
                 }
               ],
               "trustedCa": {