Cherry pick all newer commits into v1.26.4.0 except the fips commit (#39

) * Bump github.com/prometheus/client_golang from 1.15.1 to 1.16.0 in /agent (#36) Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.15.1 to 1.16.0. - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/main/CHANGELOG.md) - [Commits](prometheus/client_golang@v1.15.1...v1.16.0) --- updated-dependencies: - dependency-name: github.com/prometheus/client_golang dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Add ability to set envoy.reloadable_features_successful_active_health_check_uneject_host using env variable ENVOY_ACTIVE_HEALTH_CHECK_UNEJECT_HOST. (#38) Co-authored-by: thomashoffman <[email protected]> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: thomashoffman <[email protected]>
aws · Aug 1, 2023 · 5a70df1 · 5a70df1
1 parent 9a840a5
commit 5a70df1
Show file tree

Hide file tree

Showing 23 changed files with 461 additions and 119 deletions.
diff --git a/README.md b/README.md
@@ -114,6 +114,7 @@ These environment variables offer controls for the bootstrap config generation f
 |`ENVOY_NO_EXTENSION_LOOKUP_BY_NAME`	|<true &#124; false>	|Controls whether Envoy needs type URL to lookup extensions regardless of the name field. If the type URL is missing it will reject (NACK) the configuration	|true	|
 |`ENVOY_ENABLE_TCP_POOL_IDLE_TIMEOUT`	|<true &#124; false>	|Controls whether the `idle_timeout` protocol options feature is enabled for TCP upstreams. If not configured the default `idle_timeout` is 10 minutes. Set this environment variable to `false` to disable `idle_timeout` option.	|true	|
 |`ENVOY_SANITIZE_ORIGINAL_PATH`	|<true &#124; false>	|Controls whether to sanitize `x-envoy-original-path` coming from an untrusted users. Set this environment variable to `false` to not sanitize `x-envoy-original-path` header coming from untrusted users.	|true	|
+|`ENVOY_ACTIVE_HEALTH_CHECK_UNEJECT_HOST`	|<true &#124; false>	|Controls whether, if active HC is enabled and a host is ejected by outlier detection, a successful active health check unejects the host and consider it healthy. This also clears all the outlier detection counters.	|false	|
 |`APPMESH_SDS_SOCKET_PATH`	|/path/to/socket	|Unix Domain Socket for SDS Based TLS.	|	|
 |`APPMESH_PREVIEW`	|<0 &#124; 1>	|Enables the App Mesh Preview Endpoint	|	|
 |`APPMESH_DUALSTACK_ENDPOINT`	|<0 &#124; 1>	|Enables the App Mesh Dual-Stack Endpoint	|	|

diff --git a/agent/envoy_bootstrap/envoy_bootstrap.go b/agent/envoy_bootstrap/envoy_bootstrap.go
@@ -120,6 +120,11 @@ func getRuntimeConfigLayer0() (map[string]interface{}, error) {
 		return nil, err
 	}
 
+	setActiveHealthCheckUnejectHost, err := env.TruthyOrElse("ENVOY_ACTIVE_HEALTH_CHECK_UNEJECT_HOST", false)
+	if err != nil {
+		return nil, err
+	}
+
 	return map[string]interface{}{
 		// Allow all deprecated features to be enabled by Envoy. This prevents warnings or hard errors when
 		// it is sent config that is being deprecated.
@@ -155,6 +160,13 @@ func getRuntimeConfigLayer0() (map[string]interface{}, error) {
 		// in request path logged in traces and access logs. So in case user wants to keep the original behavior because
 		// CVE is not applicable in their case then they can set Envoy env variable ENVOY_SANITIZE_ORIGINAL_PATH to `false`.
 		"envoy.reloadable_features.sanitize_original_path": setSanitizeOriginalPath,
+
+		// Default is set to false.
+		// Envoy made a change to outlier detection with active healthchecks enabled. If active HC is enabled and a host
+		// is ejected by outlier detection, a successful active health check unejects the host and consider it healthy.
+		// This also clears all the outlier detection counters. To enable the new behavior, set Envoy env variable
+		// ENVOY_ACTIVE_HEALTH_CHECK_UNEJECT_HOST to `true`.
+		"envoy.reloadable_features.successful_active_health_check_uneject_host": setActiveHealthCheckUnejectHost,
 	}, nil
 }
 

diff --git a/agent/envoy_bootstrap/envoy_bootstrap_test.go b/agent/envoy_bootstrap/envoy_bootstrap_test.go
@@ -608,6 +608,7 @@ layers:
       envoy.reloadable_features.no_extension_lookup_by_name: true
       envoy.reloadable_features.tcp_pool_idle_timeout: true
       envoy.reloadable_features.sanitize_original_path: true
+      envoy.reloadable_features.successful_active_health_check_uneject_host: false
       re2.max_program_size.error_level: 1000
   - name: "admin_layer"
     adminLayer: {}
@@ -631,6 +632,7 @@ layers:
       envoy.reloadable_features.no_extension_lookup_by_name: true
       envoy.reloadable_features.tcp_pool_idle_timeout: true
       envoy.reloadable_features.sanitize_original_path: true
+      envoy.reloadable_features.successful_active_health_check_uneject_host: false
       re2.max_program_size.error_level: 1000
   - name: "admin_layer"
     adminLayer: {}
@@ -654,6 +656,7 @@ layers:
       envoy.reloadable_features.no_extension_lookup_by_name: false
       envoy.reloadable_features.tcp_pool_idle_timeout: true
       envoy.reloadable_features.sanitize_original_path: true
+      envoy.reloadable_features.successful_active_health_check_uneject_host: false
       re2.max_program_size.error_level: 1000
   - name: "admin_layer"
     adminLayer: {}
@@ -677,6 +680,7 @@ layers:
       envoy.reloadable_features.no_extension_lookup_by_name: true
       envoy.reloadable_features.tcp_pool_idle_timeout: false
       envoy.reloadable_features.sanitize_original_path: true
+      envoy.reloadable_features.successful_active_health_check_uneject_host: false
       re2.max_program_size.error_level: 1000
   - name: "admin_layer"
     adminLayer: {}
@@ -700,6 +704,31 @@ layers:
       envoy.reloadable_features.no_extension_lookup_by_name: true
       envoy.reloadable_features.tcp_pool_idle_timeout: true
       envoy.reloadable_features.sanitize_original_path: false
+      envoy.reloadable_features.successful_active_health_check_uneject_host: false
+      re2.max_program_size.error_level: 1000
+  - name: "admin_layer"
+    adminLayer: {}
+`)
+}
+
+func TestBuildLayeredRuntime_ActiveHealthcheckUnejectHost(t *testing.T) {
+	setup()
+	os.Setenv("ENVOY_ACTIVE_HEALTH_CHECK_UNEJECT_HOST", "true")
+	defer os.Unsetenv("ENVOY_ACTIVE_HEALTH_CHECK_UNEJECT_HOST")
+	rt, err := buildLayeredRuntime()
+	if err != nil {
+		t.Error(err)
+	}
+	checkMessage(t, rt, `
+layers:
+  - name: "static_layer_0"
+    staticLayer:
+      envoy.features.enable_all_deprecated_features: true
+      envoy.reloadable_features.http_set_tracing_decision_in_request_id: true
+      envoy.reloadable_features.no_extension_lookup_by_name: true
+      envoy.reloadable_features.tcp_pool_idle_timeout: true
+      envoy.reloadable_features.sanitize_original_path: true
+      envoy.reloadable_features.successful_active_health_check_uneject_host: true
       re2.max_program_size.error_level: 1000
   - name: "admin_layer"
     adminLayer: {}

diff --git a/agent/go.mod b/agent/go.mod
@@ -12,7 +12,7 @@ require (
 	github.com/gorilla/mux v1.8.0
 	github.com/hashicorp/go-retryablehttp v0.7.4
 	github.com/nsf/jsondiff v0.0.0-20200515183724-f29ed568f4ce
-	github.com/prometheus/client_golang v1.15.1
+	github.com/prometheus/client_golang v1.16.0
 	github.com/prometheus/client_model v0.4.0
 	github.com/prometheus/common v0.44.0
 	github.com/sirupsen/logrus v1.9.3
@@ -49,7 +49,7 @@ require (
 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/procfs v0.9.0 // indirect
+	github.com/prometheus/procfs v0.10.1 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	golang.org/x/sys v0.8.0 // indirect

diff --git a/agent/go.sum b/agent/go.sum
@@ -86,15 +86,15 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.15.1 h1:8tXpTmJbyH5lydzFPoxSIJ0J46jdh3tylbvM1xCv0LI=
-github.com/prometheus/client_golang v1.15.1/go.mod h1:e9yaBhRPU2pPNsZwE+JdQl0KEt1N9XgF6zxWmaC0xOk=
+github.com/prometheus/client_golang v1.16.0 h1:yk/hx9hDbrGHovbci4BY+pRMfSuuat626eFsHb7tmT8=
+github.com/prometheus/client_golang v1.16.0/go.mod h1:Zsulrv/L9oM40tJ7T815tM89lFEugiJ9HzIqaAx4LKc=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.4.0 h1:5lQXD3cAg1OXBf4Wq03gTrXHeaV0TQvGfUooCfx1yqY=
 github.com/prometheus/client_model v0.4.0/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU=
 github.com/prometheus/common v0.44.0 h1:+5BrQJwiBB9xsMygAB3TNvpQKOwlkc25LbISbrdOOfY=
 github.com/prometheus/common v0.44.0/go.mod h1:ofAIvZbQ1e/nugmZGz4/qCb9Ap1VoSTIO7x0VV9VvuY=
-github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI=
-github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY=
+github.com/prometheus/procfs v0.10.1 h1:kYK1Va/YMlutzCGazswoHKo//tZVlFpKYh+PymziUAg=
+github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPHWJq+XBB/FM=
 github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=

diff --git a/agent/vendor/github.com/prometheus/client_golang/prometheus/desc.go b/agent/vendor/github.com/prometheus/client_golang/prometheus/desc.go
diff --git a/agent/vendor/github.com/prometheus/client_golang/prometheus/histogram.go b/agent/vendor/github.com/prometheus/client_golang/prometheus/histogram.go
diff --git a/agent/vendor/github.com/prometheus/client_golang/prometheus/vec.go b/agent/vendor/github.com/prometheus/client_golang/prometheus/vec.go
diff --git a/agent/vendor/github.com/prometheus/procfs/Makefile.common b/agent/vendor/github.com/prometheus/procfs/Makefile.common
diff --git a/agent/vendor/github.com/prometheus/procfs/fs.go b/agent/vendor/github.com/prometheus/procfs/fs.go
diff --git a/agent/vendor/github.com/prometheus/procfs/fs_statfs_notype.go b/agent/vendor/github.com/prometheus/procfs/fs_statfs_notype.go
diff --git a/agent/vendor/github.com/prometheus/procfs/fs_statfs_type.go b/agent/vendor/github.com/prometheus/procfs/fs_statfs_type.go