Skip to content

Commit

Permalink
NET-4774 - replace usage of deprecated Envoy field match_subject_alt_…
Browse files Browse the repository at this point in the history 
…names (#19954)
  • Loading branch information
@jmurret
jmurret committed Jan 2, 2024
1 parent 84eda5f commit e87f903
Show file tree
Hide file tree
Showing 215 changed files with 16,781 additions and 832 deletions.
3 changes: 3 additions & 0 deletions .changelog/19954.txt
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:improvement
connect: Remove usage of deprecated Envoy field `match_subject_alt_names` in favor of `match_typed_subject_alt_names`.
```
14 changes: 8 additions & 6 deletions agent/xds/clusters.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1620,17 +1620,19 @@ func injectSANMatcher(tlsContext *envoy_tls_v3.CommonTlsContext, matchStrings ..
tlsContext.ValidationContextType)
}

var matchers []*envoy_matcher_v3.StringMatcher
var matchers []*envoy_tls_v3.SubjectAltNameMatcher
for _, m := range matchStrings {
matchers = append(matchers, &envoy_matcher_v3.StringMatcher{
MatchPattern: &envoy_matcher_v3.StringMatcher_Exact{
Exact: m,
matchers = append(matchers, &envoy_tls_v3.SubjectAltNameMatcher{
SanType: envoy_tls_v3.SubjectAltNameMatcher_URI,
Matcher: &envoy_matcher_v3.StringMatcher{
MatchPattern: &envoy_matcher_v3.StringMatcher_Exact{
Exact: m,
},
},
})
}

//nolint:staticcheck
validationCtx.ValidationContext.MatchSubjectAltNames = matchers
validationCtx.ValidationContext.MatchTypedSubjectAltNames = matchers

return nil
}
Expand Down
19 changes: 14 additions & 5 deletions ...t/xds/testdata/builtin_extension/clusters/ext-authz-http-local-grpc-service.latest.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,12 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
}
}
],
"trustedCa": {
Expand Down Expand Up @@ -78,12 +81,18 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
}
},
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
}
}
],
"trustedCa": {
Expand Down
19 changes: 14 additions & 5 deletions ...t/xds/testdata/builtin_extension/clusters/ext-authz-http-local-http-service.latest.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,12 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
}
}
],
"trustedCa": {
Expand Down Expand Up @@ -78,12 +81,18 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
}
},
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
}
}
],
"trustedCa": {
Expand Down
19 changes: 14 additions & 5 deletions ...ds/testdata/builtin_extension/clusters/ext-authz-http-upstream-grpc-service.latest.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,12 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
}
}
],
"trustedCa": {
Expand Down Expand Up @@ -78,12 +81,18 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
}
},
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
}
}
],
"trustedCa": {
Expand Down
19 changes: 14 additions & 5 deletions ...ds/testdata/builtin_extension/clusters/ext-authz-http-upstream-http-service.latest.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,12 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
}
}
],
"trustedCa": {
Expand Down Expand Up @@ -78,12 +81,18 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
}
},
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
}
}
],
"trustedCa": {
Expand Down
19 changes: 14 additions & 5 deletions agent/xds/testdata/builtin_extension/clusters/ext-authz-tcp-local-grpc-service.latest.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,12 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
}
}
],
"trustedCa": {
Expand Down Expand Up @@ -78,12 +81,18 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
}
},
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
}
}
],
"trustedCa": {
Expand Down
19 changes: 14 additions & 5 deletions ...xds/testdata/builtin_extension/clusters/ext-authz-tcp-upstream-grpc-service.latest.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,12 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
}
}
],
"trustedCa": {
Expand Down Expand Up @@ -78,12 +81,18 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
}
},
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
}
}
],
"trustedCa": {
Expand Down
12 changes: 9 additions & 3 deletions agent/xds/testdata/builtin_extension/clusters/lambda-and-lua-connect-proxy.latest.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -70,12 +70,18 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
}
},
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
}
}
],
"trustedCa": {
Expand Down
12 changes: 9 additions & 3 deletions .../xds/testdata/builtin_extension/clusters/lambda-connect-proxy-opposite-meta.latest.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -70,12 +70,18 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
}
},
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
}
}
],
"trustedCa": {
Expand Down
26 changes: 19 additions & 7 deletions agent/xds/testdata/builtin_extension/clusters/lambda-connect-proxy-tproxy.latest.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,12 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
}
}
],
"trustedCa": {
Expand Down Expand Up @@ -78,12 +81,18 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
}
},
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
}
}
],
"trustedCa": {
Expand Down Expand Up @@ -194,9 +203,12 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/no-endpoints"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/no-endpoints"
}
}
],
"trustedCa": {
Expand Down
19 changes: 14 additions & 5 deletions ...n_extension/clusters/lambda-connect-proxy-with-terminating-gateway-upstream.latest.golden
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,12 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/db"
}
}
],
"trustedCa": {
Expand Down Expand Up @@ -78,12 +81,18 @@
],
"tlsParams": {},
"validationContext": {
"matchSubjectAltNames": [
"matchTypedSubjectAltNames": [
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc1/svc/geo-cache-target"
}
},
{
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
"sanType": "URI",
"matcher": {
"exact": "spiffe://11111111-2222-3333-4444-555555555555.consul/ns/default/dc/dc2/svc/geo-cache-target"
}
}
],
"trustedCa": {
Expand Down
Loading

0 comments on commit e87f903

Please sign in to comment.