Update use of deprecated fields

This is driven by "which of these cause test failures".  It is NOT an
audit of the codebase cross-referenced with
<https://www.envoyproxy.io/docs/envoy/latest/intro/deprecated>.  It would
be a good idea to do that audit at some point.

cmd/ambex/main.go

@@ -64,10 +64,15 @@ import (
 	"github.com/datawire/ambassador/pkg/envoy-control-plane/cache"
 	"github.com/datawire/ambassador/pkg/envoy-control-plane/server"
 
-	// envoy protobuf
+	// envoy protobuf -- Be sure to import the package of any types that the Python
+	// emits a "@type" of in the generated config, even if that package is otherwise
+	// not used by ambex.
 	v2 "github.com/datawire/ambassador/pkg/api/envoy/api/v2"
+	_ "github.com/datawire/ambassador/pkg/api/envoy/api/v2/auth"
 	core "github.com/datawire/ambassador/pkg/api/envoy/api/v2/core"
+	_ "github.com/datawire/ambassador/pkg/api/envoy/config/accesslog/v2"
 	bootstrap "github.com/datawire/ambassador/pkg/api/envoy/config/bootstrap/v2"
+	_ "github.com/datawire/ambassador/pkg/api/envoy/config/filter/network/http_connection_manager/v2"
 	discovery "github.com/datawire/ambassador/pkg/api/envoy/service/discovery/v2"
 )
 

python/ambassador/envoy/v2/v2bootstrap.py

@@ -32,7 +32,27 @@ def __init__(self, config: 'V2Config') -> None:
                 "cds_config": { "ads": {} },
                 "lds_config": { "ads": {} }
             },
-            "admin": dict(config.admin)
+            "admin": dict(config.admin),
+            'layered_runtime': {
+                'layers': [
+                    {
+                        'name': 'static_layer',
+                        'static_layer': {
+                            # For now, we enable the deprecated & disallowed_by_default "HTTP_JSON_V1" Zipkin
+                            # collector_endpoint_version because it repesents the Zipkin v1 API, while the
+                            # non-deprecated options HTTP_JSON and HTTP_PROTO are the Zipkin v2 API; switching
+                            # top one of them would change how Envoy talks to the outside world.
+                            'envoy.deprecated_features:envoy.config.trace.v2.ZipkinConfig.HTTP_JSON_V1': True,
+                            # Give our users more time to migrate to v2; we've said that we'll continue
+                            # supporting both for a while even after we change the default.
+                            'envoy.deprecated_features:envoy.config.filter.http.ext_authz.v2.ExtAuthz.use_alpha': True,
+                            # We haven't yet told users that we'll be deprecating `regex_type: unsafe`.
+                            'envoy.deprecated_features:envoy.api.v2.route.RouteMatch.regex': True,         # HTTP path
+                            'envoy.deprecated_features:envoy.api.v2.route.HeaderMatcher.regex_match': True # HTTP header
+                        }
+                    }
+                ]
+            }
         })
 
         clusters = [{

python/ambassador/envoy/v2/v2cluster.py

@@ -74,13 +74,20 @@ def __init__(self, config: 'V2Config', cluster: IRCluster) -> None:
             # minimal `tls_context` to enable HTTPS origination.
 
             if ctx.get('_ambassador_enabled', False):
-                fields['tls_context'] = {
+                envoy_ctx = {
                     'common_tls_context': {}
                 }
             else:
                 envoy_ctx = V2TLSContext(ctx=ctx, host_rewrite=cluster.get('host_rewrite', None))
-                if envoy_ctx:
-                    fields['tls_context'] = envoy_ctx
+
+            if envoy_ctx:
+                fields['transport_socket'] = {
+                    'name': 'envoy.transport_sockets.tls',
+                    'typed_config': {
+                        '@type': 'type.googleapis.com/envoy.api.v2.auth.UpstreamTlsContext',
+                        **envoy_ctx
+                    }
+                }
 
 
         keepalive = cluster.get('keepalive', None)

python/ambassador/envoy/v2/v2config.py

@@ -56,17 +56,39 @@ def __init__(self, ir: IR) -> None:
         V2Bootstrap.generate(self)
 
     def as_dict(self) -> Dict[str, Any]:
+        bootstrap_config, ads_config = self.split_config()
+
         d = {
-            'bootstrap': self.bootstrap,
-            'static_resources': self.static_resources
+            'bootstrap': bootstrap_config,
+            **ads_config
         }
 
         return d
 
     def split_config(self) -> Tuple[Dict[str, Any], Dict[str, Any]]:
         ads_config = {
             '@type': '/envoy.config.bootstrap.v2.Bootstrap',
-            'static_resources': self.static_resources
+            'static_resources': self.static_resources,
+            'layered_runtime': {
+                'layers': [
+                    {
+                        'name': 'static_layer',
+                        'static_layer': {
+                            # For now, we enable the deprecated & disallowed_by_default "HTTP_JSON_V1" Zipkin
+                            # collector_endpoint_version because it repesents the Zipkin v1 API, while the
+                            # non-deprecated options HTTP_JSON and HTTP_PROTO are the Zipkin v2 API; switching
+                            # top one of them would change how Envoy talks to the outside world.
+                            'envoy.deprecated_features:envoy.config.trace.v2.ZipkinConfig.HTTP_JSON_V1': True,
+                            # Give our users more time to migrate to v2; we've said that we'll continue
+                            # supporting both for a while even after we change the default.
+                            'envoy.deprecated_features:envoy.config.filter.http.ext_authz.v2.ExtAuthz.use_alpha': True,
+                            # We haven't yet told users that we'll be deprecating `regex_type: unsafe`.
+                            'envoy.deprecated_features:envoy.api.v2.route.RouteMatch.regex': True,         # HTTP path
+                            'envoy.deprecated_features:envoy.api.v2.route.HeaderMatcher.regex_match': True # HTTP header
+                        }
+                    }
+                ]
+            }
         }
 
         bootstrap_config = dict(self.bootstrap)

python/ambassador/envoy/v2/v2listener.py

@@ -662,6 +662,7 @@ def __init__(self, config: 'V2Config', service_port: int) -> None:
         self.first_vhost: Optional[V2VirtualHost] = None
         self.http_filters: List[dict] = []
         self.listener_filters: List[dict] = []
+        self.traffic_direction: str = "UNSPECIFIED"
 
         self.config.ir.logger.debug(f"V2Listener {self.name} created")
 
@@ -731,7 +732,8 @@ def __init__(self, config: 'V2Config', service_port: int) -> None:
 
             self.access_log.append({
                 'name': 'envoy.file_access_log',
-                'config': {
+                'typed_config': {
+                    '@type': 'type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog',
                     'path': self.config.ir.ambassador_module.envoy_log_path,
                     'json_format': json_format
                 }
@@ -746,7 +748,8 @@ def __init__(self, config: 'V2Config', service_port: int) -> None:
             self.config.ir.logger.debug("V2Listener: Using log_format '%s'" % log_format)
             self.access_log.append({
                 'name': 'envoy.file_access_log',
-                'config': {
+                'typed_config': {
+                    '@type': 'type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog',
                     'path': self.config.ir.ambassador_module.envoy_log_path,
                     'format': log_format + '\n'
                 }
@@ -788,9 +791,8 @@ def __init__(self, config: 'V2Config', service_port: int) -> None:
         if self.config.ir.tracing:
             self.base_http_config["generate_request_id"] = True
 
-            self.base_http_config["tracing"] = {
-                "operation_name": "egress"
-            }
+            self.base_http_config["tracing"] = {}
+            self.traffic_direction = "OUTBOUND"
 
             req_hdrs = self.config.ir.tracing.get('tag_headers', [])
 
@@ -886,7 +888,10 @@ def finalize(self) -> None:
             filter_chain["filters"] = [
                 {
                     "name": "envoy.http_connection_manager",
-                    "config": http_config
+                    "typed_config": {
+                        "@type": "type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager",
+                        **http_config
+                    }
                 }
             ]
 
@@ -903,7 +908,8 @@ def as_dict(self) -> dict:
             "name": self.name,
             "address": self.address,
             "filter_chains": self.filter_chains,
-            "listener_filters": self.listener_filters
+            "listener_filters": self.listener_filters,
+            "traffic_direction": self.traffic_direction
         }
 
     def pretty(self) -> dict:

python/ambassador/envoy/v2/v2route.py

@@ -120,10 +120,14 @@ def __init__(self, config: 'V2Config', group: IRHTTPMappingGroup, mapping: IRBas
 
         request_headers_to_remove = group.get('remove_request_headers', None)
         if request_headers_to_remove:
+            if type(request_headers_to_remove) != list:
+                request_headers_to_remove = [ request_headers_to_remove ]
             self['request_headers_to_remove'] = request_headers_to_remove
 
         response_headers_to_remove = group.get('remove_response_headers', None)
         if response_headers_to_remove:
+            if type(response_headers_to_remove) != list:
+                response_headers_to_remove = [ response_headers_to_remove ]
             self['response_headers_to_remove'] = response_headers_to_remove
 
         host_redirect = group.get('host_redirect', None)

python/ambassador/ir/ircors.py

@@ -28,18 +28,15 @@ def __init__(self, ir: 'IR', aconf: Config,
     def setup(self, ir: 'IR', aconf: Config) -> bool:
         # 'origins' cannot be treated like other keys, because if it's a
         # list, then it remains as is, but if it's a string, then it's
-        # converted to a list
+        # converted to a list.  It has already been validated by the
+        # JSON schema to either be a string or a list of strings.
         origins = self.pop('origins', None)
 
         if origins is not None:
-            if type(origins) is list:
-                self.allow_origin = origins
-            elif type(origins) is str:
-                self.allow_origin = origins.split(',')
-            else:
-                self.post_error(RichStatus.fromError("invalid CORS origin - {}".format(origins),
-                                                     module=self))
-                return False
+            if type(origins) is not list:
+                origins = origins.split(',')
+
+            self.allow_origin_string_match = [{'exact': origin} for origin in origins]
 
         for from_key, to_key in [ ( 'max_age', 'max_age' ),
                                   ( 'credentials', 'allow_credentials' ),

python/tests/gold/acceptancegrpcbridgetest/bootstrap-ads.json

@@ -26,6 +26,19 @@
             "ads": {}
         }
     },
+    "layered_runtime": {
+        "layers": [
+            {
+                "name": "static_layer",
+                "static_layer": {
+                    "envoy.deprecated_features:envoy.api.v2.route.HeaderMatcher.regex_match": true,
+                    "envoy.deprecated_features:envoy.api.v2.route.RouteMatch.regex": true,
+                    "envoy.deprecated_features:envoy.config.filter.http.ext_authz.v2.ExtAuthz.use_alpha": true,
+                    "envoy.deprecated_features:envoy.config.trace.v2.ZipkinConfig.HTTP_JSON_V1": true
+                }
+            }
+        ]
+    },
     "node": {
         "cluster": "acceptancegrpcbridgetest-default",
         "id": "test-id"

python/tests/gold/acceptancegrpcbridgetest/snapshots/econf.json

@@ -1,4 +1,17 @@
 {
+    "layered_runtime": {
+        "layers": [
+            {
+                "name": "static_layer",
+                "static_layer": {
+                    "envoy.deprecated_features:envoy.api.v2.route.HeaderMatcher.regex_match": true,
+                    "envoy.deprecated_features:envoy.api.v2.route.RouteMatch.regex": true,
+                    "envoy.deprecated_features:envoy.config.filter.http.ext_authz.v2.ExtAuthz.use_alpha": true,
+                    "envoy.deprecated_features:envoy.config.trace.v2.ZipkinConfig.HTTP_JSON_V1": true
+                }
+            }
+        ]
+    },
     "static_resources": {
         "clusters": [
             {
@@ -71,14 +84,17 @@
                         "filter_chain_match": {},
                         "filters": [
                             {
-                                "config": {
+                                "name": "envoy.http_connection_manager",
+                                "typed_config": {
+                                    "@type": "type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager",
                                     "access_log": [
                                         {
-                                            "config": {
+                                            "name": "envoy.file_access_log",
+                                            "typed_config": {
+                                                "@type": "type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog",
                                                 "format": "ACCESS [%START_TIME%] \"%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%\" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% \"%REQ(X-FORWARDED-FOR)%\" \"%REQ(USER-AGENT)%\" \"%REQ(X-REQUEST-ID)%\" \"%REQ(:AUTHORITY)%\" \"%UPSTREAM_HOST%\"\n",
                                                 "path": "/dev/fd/1"
-                                            },
-                                            "name": "envoy.file_access_log"
+                                            }
                                         }
                                     ],
                                     "http_filters": [
@@ -289,15 +305,15 @@
                                     "stat_prefix": "ingress_http",
                                     "use_remote_address": true,
                                     "xff_num_trusted_hops": 0
-                                },
-                                "name": "envoy.http_connection_manager"
+                                }
                             }
                         ],
                         "use_proxy_proto": false
                     }
                 ],
                 "listener_filters": [],
-                "name": "ambassador-listener-8080"
+                "name": "ambassador-listener-8080",
+                "traffic_direction": "UNSPECIFIED"
             }
         ]
     }