don't validate clusters

hashicorp · Aug 15, 2024 · 12f4daf · 12f4daf
1 parent e2bb1b7
commit 12f4daf
Show file tree

Hide file tree

Showing 82 changed files with 27 additions and 180 deletions.
diff --git a/.changelog/21587.txt b/.changelog/21587.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+Use Envoy's default for a route's validate_clusters option, which is false. This fixes a case where non-existent clusters could cause a route to no longer route to any of its backends, including existing ones.
+```
diff --git a/agent/xds/routes.go b/agent/xds/routes.go
@@ -76,10 +76,6 @@ func (s *ResourceGenerator) routesForConnectProxy(cfgSnap *proxycfg.ConfigSnapsh
 		route := &envoy_route_v3.RouteConfiguration{
 			Name:         uid.EnvoyID(),
 			VirtualHosts: []*envoy_route_v3.VirtualHost{virtualHost},
-			// ValidateClusters defaults to true when defined statically and false
-			// when done via RDS. Re-set the reasonable value of true to prevent
-			// null-routing traffic.
-			ValidateClusters: response.MakeBoolValue(true),
 		}
 		resources = append(resources, route)
 	}
@@ -276,10 +272,6 @@ func (s *ResourceGenerator) routesForMeshGateway(cfgSnap *proxycfg.ConfigSnapsho
 		route := &envoy_route_v3.RouteConfiguration{
 			Name:         uid.EnvoyID(),
 			VirtualHosts: []*envoy_route_v3.VirtualHost{virtualHost},
-			// ValidateClusters defaults to true when defined statically and false
-			// when done via RDS. Re-set the reasonable value of true to prevent
-			// null-routing traffic.
-			ValidateClusters: response.MakeBoolValue(true),
 		}
 		resources = append(resources, route)
 	}
@@ -319,20 +311,12 @@ func makeNamedDefaultRouteWithLB(clusterName string, lb *structs.LoadBalancer, t
 				},
 			},
 		},
-		// ValidateClusters defaults to true when defined statically and false
-		// when done via RDS. Re-set the reasonable value of true to prevent
-		// null-routing traffic.
-		ValidateClusters: response.MakeBoolValue(true),
 	}, nil
 }
 
 func makeNamedAddressesRoute(routeName string, addresses map[string]string) (*envoy_route_v3.RouteConfiguration, error) {
 	route := &envoy_route_v3.RouteConfiguration{
 		Name: routeName,
-		// ValidateClusters defaults to true when defined statically and false
-		// when done via RDS. Re-set the reasonable value of true to prevent
-		// null-routing traffic.
-		ValidateClusters: response.MakeBoolValue(true),
 	}
 	for clusterName, address := range addresses {
 		action := makeRouteActionFromName(clusterName)
@@ -371,10 +355,6 @@ func (s *ResourceGenerator) routesForIngressGateway(cfgSnap *proxycfg.ConfigSnap
 		// don't have custom filter chains and routes to this.
 		defaultRoute := &envoy_route_v3.RouteConfiguration{
 			Name: listenerKey.RouteName(),
-			// ValidateClusters defaults to true when defined statically and false
-			// when done via RDS. Re-set the reasonable value of true to prevent
-			// null-routing traffic.
-			ValidateClusters: response.MakeBoolValue(true),
 		}
 
 		for _, u := range upstreams {
@@ -422,9 +402,8 @@ func (s *ResourceGenerator) routesForIngressGateway(cfgSnap *proxycfg.ConfigSnap
 				defaultRoute.VirtualHosts = append(defaultRoute.VirtualHosts, virtualHost)
 			} else {
 				svcRoute := &envoy_route_v3.RouteConfiguration{
-					Name:             svcRouteName,
-					ValidateClusters: response.MakeBoolValue(true),
-					VirtualHosts:     []*envoy_route_v3.VirtualHost{virtualHost},
+					Name:         svcRouteName,
+					VirtualHosts: []*envoy_route_v3.VirtualHost{virtualHost},
 				}
 				result = append(result, svcRoute)
 			}
@@ -460,10 +439,6 @@ func (s *ResourceGenerator) routesForAPIGateway(cfgSnap *proxycfg.ConfigSnapshot
 
 		listenerRoute := &envoy_route_v3.RouteConfiguration{
 			Name: readyListener.listenerKey.RouteName(),
-			// ValidateClusters defaults to true when defined statically and false
-			// when done via RDS. Re-set the reasonable value of true to prevent
-			// null-routing traffic.
-			ValidateClusters: response.MakeBoolValue(true),
 		}
 
 		// Consolidate all routes for this listener into the minimum possible set based on hostname matching.

diff --git a/.../builtin_extension/routes/lambda-terminating-gateway-with-service-resolvers.latest.golden b/.../builtin_extension/routes/lambda-terminating-gateway-with-service-resolvers.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "canary1.web.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [
@@ -27,7 +26,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "canary2.web.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [
@@ -50,7 +48,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "web.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/builtin_extension/routes/lambda-terminating-gateway.latest.golden b/agent/xds/testdata/builtin_extension/routes/lambda-terminating-gateway.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "web.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/...ata/builtin_extension/routes/lua-outbound-applies-to-local-upstreams-tproxy.latest.golden b/...ata/builtin_extension/routes/lua-outbound-applies-to-local-upstreams-tproxy.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "destination.443.~http.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [
@@ -27,7 +26,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "destination.9093.~http.default.dc1.internal.11111111-2222-3333-4444-555555555555.consul",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/..._extension/routes/propertyoverride-patch-specific-upstream-service-splitter.latest.golden b/..._extension/routes/propertyoverride-patch-specific-upstream-service-splitter.latest.golden
@@ -5,7 +5,6 @@
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "mostSpecificHeaderMutationsWins": true,
       "name": "db",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/...a/builtin_extension/routes/propertyoverride-patch-specific-upstream-service.latest.golden b/...a/builtin_extension/routes/propertyoverride-patch-specific-upstream-service.latest.golden
@@ -22,8 +22,7 @@
             }
           ]
         }
-      ],
-      "validateClusters":  true
+      ]
     }
   ],
   "typeUrl":  "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",

diff --git a/agent/xds/testdata/routes/api-gateway-http-listener-with-http-route.latest.golden b/agent/xds/testdata/routes/api-gateway-http-listener-with-http-route.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8080",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/api-gateway-tcp-listener-with-tcp-and-http-route.latest.golden b/agent/xds/testdata/routes/api-gateway-tcp-listener-with-tcp-and-http-route.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8081",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/api-gateway-with-http-route-timeoutfilter-one-set.latest.golden b/agent/xds/testdata/routes/api-gateway-with-http-route-timeoutfilter-one-set.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8080",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/api-gateway-with-http-route.latest.golden b/agent/xds/testdata/routes/api-gateway-with-http-route.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8080",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/api-gateway-with-multiple-hostnames.latest.golden b/agent/xds/testdata/routes/api-gateway-with-multiple-hostnames.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8080",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/connect-proxy-lb-in-resolver.latest.golden b/agent/xds/testdata/routes/connect-proxy-lb-in-resolver.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "db",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/connect-proxy-resolver-with-lb.latest.golden b/agent/xds/testdata/routes/connect-proxy-resolver-with-lb.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "db",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/connect-proxy-route-to-lb-resolver.latest.golden b/agent/xds/testdata/routes/connect-proxy-route-to-lb-resolver.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "db",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/connect-proxy-splitter-overweight.latest.golden b/agent/xds/testdata/routes/connect-proxy-splitter-overweight.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "db",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/connect-proxy-with-chain-and-overrides.latest.golden b/agent/xds/testdata/routes/connect-proxy-with-chain-and-overrides.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "db",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/connect-proxy-with-chain-and-router.latest.golden b/agent/xds/testdata/routes/connect-proxy-with-chain-and-router.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "db",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/connect-proxy-with-chain-and-splitter.latest.golden b/agent/xds/testdata/routes/connect-proxy-with-chain-and-splitter.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "db",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/connect-proxy-with-grpc-chain.latest.golden b/agent/xds/testdata/routes/connect-proxy-with-grpc-chain.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "db",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/connect-proxy-with-grpc-router.latest.golden b/agent/xds/testdata/routes/connect-proxy-with-grpc-router.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "db",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/connect-proxy-with-http-chain.latest.golden b/agent/xds/testdata/routes/connect-proxy-with-http-chain.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "db",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/connect-proxy-with-http2-chain.latest.golden b/agent/xds/testdata/routes/connect-proxy-with-http2-chain.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "db",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/ingress-grpc-multiple-services.latest.golden b/agent/xds/testdata/routes/ingress-grpc-multiple-services.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8080",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/ingress-http-multiple-services.latest.golden b/agent/xds/testdata/routes/ingress-http-multiple-services.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "443",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [
@@ -45,7 +44,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8080",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/ingress-lb-in-resolver.latest.golden b/agent/xds/testdata/routes/ingress-lb-in-resolver.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8080",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/ingress-multiple-listeners-duplicate-service.latest.golden b/agent/xds/testdata/routes/ingress-multiple-listeners-duplicate-service.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "443",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [
@@ -28,7 +27,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8080",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/ingress-splitter-with-resolver-redirect.latest.golden b/agent/xds/testdata/routes/ingress-splitter-with-resolver-redirect.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8080",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/ingress-with-chain-and-router-header-manip.latest.golden b/agent/xds/testdata/routes/ingress-with-chain-and-router-header-manip.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8080",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/ingress-with-chain-and-router.latest.golden b/agent/xds/testdata/routes/ingress-with-chain-and-router.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8080",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/ingress-with-chain-and-splitter.latest.golden b/agent/xds/testdata/routes/ingress-with-chain-and-splitter.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8080",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/ingress-with-grpc-router.latest.golden b/agent/xds/testdata/routes/ingress-with-grpc-router.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8080",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/ingress-with-grpc-single-tls-listener.latest.golden b/agent/xds/testdata/routes/ingress-with-grpc-single-tls-listener.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8080",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [
@@ -28,7 +27,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8081",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [

diff --git a/agent/xds/testdata/routes/ingress-with-http2-and-grpc-multiple-tls-listener.latest.golden b/agent/xds/testdata/routes/ingress-with-http2-and-grpc-multiple-tls-listener.latest.golden
@@ -4,7 +4,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8080",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [
@@ -28,7 +27,6 @@
     {
       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
       "name": "8081",
-      "validateClusters": true,
       "virtualHosts": [
         {
           "domains": [