Sort filter chains on the first match address

We don't name filter chains, so the existing sort was a no-op. Sorting on the match addresses is reasonable because each address is guaranteed to be unique. If not unique, Envoy will reject the config.
hashicorp · Jun 9, 2021 · ef2f6f7 · ef2f6f7
1 parent 7459917
commit ef2f6f7
Show file tree

Hide file tree

Showing 3 changed files with 26 additions and 25 deletions.
diff --git a/agent/xds/listeners.go b/agent/xds/listeners.go
@@ -197,7 +197,8 @@ func (s *ResourceGenerator) listenersFromSnapshotConnectProxy(cfgSnap *proxycfg.
 
 		// Filter chains are stable sorted to avoid draining if the list is provided out of order
 		sort.SliceStable(outboundListener.FilterChains, func(i, j int) bool {
-			return outboundListener.FilterChains[i].Name < outboundListener.FilterChains[j].Name
+			return outboundListener.FilterChains[i].FilterChainMatch.PrefixRanges[0].AddressPrefix <
+				outboundListener.FilterChains[j].FilterChainMatch.PrefixRanges[0].AddressPrefix
 		})
 
 		// Add a catch-all filter chain that acts as a TCP proxy to non-catalog destinations

diff --git a/agent/xds/testdata/listeners/transparent-proxy-dial-instances-directly.envoy-1-18-x.golden b/agent/xds/testdata/listeners/transparent-proxy-dial-instances-directly.envoy-1-18-x.golden
@@ -40,7 +40,11 @@
           "filterChainMatch": {
             "prefixRanges": [
               {
-                "addressPrefix": "6.6.6.6",
+                "addressPrefix": "10.10.10.10",
+                "prefixLen": 32
+              },
+              {
+                "addressPrefix": "10.10.10.12",
                 "prefixLen": 32
               }
             ]
@@ -51,7 +55,7 @@
               "typedConfig": {
                 "@type": "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy",
                 "statPrefix": "upstream.mongo.default.dc1",
-                "cluster": "mongo.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
+                "cluster": "passthrough~mongo.default.dc1.internal.e5b08d03-bfc3-c870-1833-baddb116e648.consul"
               }
             }
           ]
@@ -60,7 +64,7 @@
           "filterChainMatch": {
             "prefixRanges": [
               {
-                "addressPrefix": "9.9.9.9",
+                "addressPrefix": "6.6.6.6",
                 "prefixLen": 32
               }
             ]
@@ -70,8 +74,8 @@
               "name": "envoy.filters.network.tcp_proxy",
               "typedConfig": {
                 "@type": "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy",
-                "statPrefix": "upstream.kafka.default.dc1",
-                "cluster": "passthrough~kafka.default.dc1.internal.e5b08d03-bfc3-c870-1833-baddb116e648.consul"
+                "statPrefix": "upstream.mongo.default.dc1",
+                "cluster": "mongo.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
               }
             }
           ]
@@ -80,11 +84,7 @@
           "filterChainMatch": {
             "prefixRanges": [
               {
-                "addressPrefix": "10.10.10.10",
-                "prefixLen": 32
-              },
-              {
-                "addressPrefix": "10.10.10.12",
+                "addressPrefix": "9.9.9.9",
                 "prefixLen": 32
               }
             ]
@@ -94,8 +94,8 @@
               "name": "envoy.filters.network.tcp_proxy",
               "typedConfig": {
                 "@type": "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy",
-                "statPrefix": "upstream.mongo.default.dc1",
-                "cluster": "passthrough~mongo.default.dc1.internal.e5b08d03-bfc3-c870-1833-baddb116e648.consul"
+                "statPrefix": "upstream.kafka.default.dc1",
+                "cluster": "passthrough~kafka.default.dc1.internal.e5b08d03-bfc3-c870-1833-baddb116e648.consul"
               }
             }
           ]

diff --git a/...testdata/listeners/transparent-proxy-dial-instances-directly.v2compat.envoy-1-16-x.golden b/...testdata/listeners/transparent-proxy-dial-instances-directly.v2compat.envoy-1-16-x.golden
@@ -40,7 +40,11 @@
           "filterChainMatch": {
             "prefixRanges": [
               {
-                "addressPrefix": "6.6.6.6",
+                "addressPrefix": "10.10.10.10",
+                "prefixLen": 32
+              },
+              {
+                "addressPrefix": "10.10.10.12",
                 "prefixLen": 32
               }
             ]
@@ -51,7 +55,7 @@
               "typedConfig": {
                 "@type": "type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy",
                 "statPrefix": "upstream.mongo.default.dc1",
-                "cluster": "mongo.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
+                "cluster": "passthrough~mongo.default.dc1.internal.e5b08d03-bfc3-c870-1833-baddb116e648.consul"
               }
             }
           ]
@@ -60,7 +64,7 @@
           "filterChainMatch": {
             "prefixRanges": [
               {
-                "addressPrefix": "9.9.9.9",
+                "addressPrefix": "6.6.6.6",
                 "prefixLen": 32
               }
             ]
@@ -70,8 +74,8 @@
               "name": "envoy.filters.network.tcp_proxy",
               "typedConfig": {
                 "@type": "type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy",
-                "statPrefix": "upstream.kafka.default.dc1",
-                "cluster": "passthrough~kafka.default.dc1.internal.e5b08d03-bfc3-c870-1833-baddb116e648.consul"
+                "statPrefix": "upstream.mongo.default.dc1",
+                "cluster": "mongo.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul"
               }
             }
           ]
@@ -80,11 +84,7 @@
           "filterChainMatch": {
             "prefixRanges": [
               {
-                "addressPrefix": "10.10.10.10",
-                "prefixLen": 32
-              },
-              {
-                "addressPrefix": "10.10.10.12",
+                "addressPrefix": "9.9.9.9",
                 "prefixLen": 32
               }
             ]
@@ -94,8 +94,8 @@
               "name": "envoy.filters.network.tcp_proxy",
               "typedConfig": {
                 "@type": "type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy",
-                "statPrefix": "upstream.mongo.default.dc1",
-                "cluster": "passthrough~mongo.default.dc1.internal.e5b08d03-bfc3-c870-1833-baddb116e648.consul"
+                "statPrefix": "upstream.kafka.default.dc1",
+                "cluster": "passthrough~kafka.default.dc1.internal.e5b08d03-bfc3-c870-1833-baddb116e648.consul"
               }
             }
           ]