This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/dubbo-kubernetes.git
The following commit(s) were added to refs/heads/master by this push:
new 2487ac6d refactor: remove legacy traffic APIs (#1009)
2487ac6d is described below
commit 2487ac6d3a32c39f99cd8ae414f58129c0cc05b8
Author: mfordjody <[email protected]>
AuthorDate: Sun Aug 9 16:19:57 2026 +0800
refactor: remove legacy traffic APIs (#1009)
---
dubbod/discovery/pkg/bootstrap/mesh.go | 2 -
.../pkg/bootstrap/proxyless_grpc_controller.go | 126 +---------
dubbod/discovery/pkg/features/experimental.go | 3 -
dubbod/discovery/pkg/model/destinationrule.go | 32 ---
dubbod/discovery/pkg/model/push_context.go | 216 +---------------
dubbod/discovery/pkg/networking/grpcgen/cds.go | 271 +--------------------
.../discovery/pkg/networking/grpcgen/cds_test.go | 2 +-
dubbod/discovery/pkg/networking/grpcgen/lds.go | 4 +-
.../pkg/xds/endpoints/endpoint_builder.go | 58 +----
go.mod | 6 +-
go.sum | 12 +-
pkg/config/mesh/mesh.go | 10 +-
pkg/xds/server.go | 5 +-
13 files changed, 43 insertions(+), 704 deletions(-)
diff --git a/dubbod/discovery/pkg/bootstrap/mesh.go
b/dubbod/discovery/pkg/bootstrap/mesh.go
index 94d9d059..f99c6521 100644
--- a/dubbod/discovery/pkg/bootstrap/mesh.go
+++ b/dubbod/discovery/pkg/bootstrap/mesh.go
@@ -104,8 +104,6 @@ func compactMeshConfig(cfg *meshv1alpha1.MeshConfig) string
{
formatStringField("root_namespace", cfg.GetRootNamespace()),
formatDurationField("dns_refresh_rate",
cfg.GetDnsRefreshRate()),
formatStringSliceField("service_export_to",
cfg.GetDefaultServiceExportTo()),
- formatStringSliceField("virtual_service_export_to",
cfg.GetDefaultVirtualServiceExportTo()),
- formatStringSliceField("destination_rule_export_to",
cfg.GetDefaultDestinationRuleExportTo()),
}
if defaultCfg := cfg.GetDefaultConfig(); defaultCfg != nil {
diff --git a/dubbod/discovery/pkg/bootstrap/proxyless_grpc_controller.go
b/dubbod/discovery/pkg/bootstrap/proxyless_grpc_controller.go
index 1f310477..7d9964e5 100644
--- a/dubbod/discovery/pkg/bootstrap/proxyless_grpc_controller.go
+++ b/dubbod/discovery/pkg/bootstrap/proxyless_grpc_controller.go
@@ -29,7 +29,6 @@ import (
discoverymodel
"github.com/apache/dubbo-kubernetes/dubbod/discovery/pkg/model"
pkgbootstrap "github.com/apache/dubbo-kubernetes/pkg/bootstrap"
"github.com/apache/dubbo-kubernetes/pkg/config/constants"
- "github.com/apache/dubbo-kubernetes/pkg/config/host"
configlabels "github.com/apache/dubbo-kubernetes/pkg/config/labels"
meshconfig "github.com/apache/dubbo-kubernetes/pkg/config/mesh"
"github.com/apache/dubbo-kubernetes/pkg/config/schema/kind"
@@ -49,7 +48,6 @@ import (
pkiutil
"github.com/apache/dubbo-kubernetes/dubbod/security/pkg/pki/util"
caserver
"github.com/apache/dubbo-kubernetes/dubbod/security/pkg/server/ca"
meshv1alpha1 "github.com/kdubbo/api/mesh/v1alpha1"
- networking "github.com/kdubbo/api/networking/v1alpha3"
"google.golang.org/protobuf/proto"
corev1 "k8s.io/api/core/v1"
apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -788,130 +786,16 @@ func runtimeFaultInjection(push
*discoverymodel.PushContext, namespace, name, po
return fault
}
-func buildRuntimeRouteConfig(push *discoverymodel.PushContext, endpointIndex
*discoverymodel.EndpointIndex, svc *discoverymodel.Service, port int)
proxylessGRPCRouteRuntimeConfig {
- cfg := proxylessGRPCRouteRuntimeConfig{
+func buildRuntimeRouteConfig(_ *discoverymodel.PushContext, endpointIndex
*discoverymodel.EndpointIndex, svc *discoverymodel.Service, port int)
proxylessGRPCRouteRuntimeConfig {
+ return proxylessGRPCRouteRuntimeConfig{
Host: string(svc.Hostname),
Port: port,
- }
- vs := push.VirtualServiceForHost(svc.Hostname)
- if vs == nil || len(vs.Http) == 0 {
- tlsMode := runtimeDestinationTLSMode(push,
svc.Attributes.Namespace, svc.Hostname, "")
- cfg.Destinations = []proxylessGRPCDestinationRuntimeConfig{{
- Host: string(svc.Hostname),
- Weight: 100,
- TLSMode: tlsMode,
- Endpoints:
runtimeRouteEndpointsForService(endpointIndex, svc, port, nil, tlsMode),
- }}
- return cfg
- }
-
- for _, httpRoute := range vs.Http {
- if httpRoute == nil {
- continue
- }
- for _, weighted := range httpRoute.Route {
- if weighted == nil {
- continue
- }
- targetHost := string(svc.Hostname)
- subset := ""
- if weighted.Destination != nil {
- if weighted.Destination.Host != "" {
- targetHost = weighted.Destination.Host
- }
- subset = weighted.Destination.Subset
- }
- targetSvc := push.ServiceForHostname(nil,
host.Name(targetHost))
- if targetSvc == nil {
- targetSvc = svc
- targetHost = string(svc.Hostname)
- }
- selector, subsetFound := runtimeSubsetSelector(push,
targetSvc.Attributes.Namespace, targetSvc.Hostname, subset)
- var endpoints []proxylessGRPCEndpointRuntimeConfig
- if subsetFound {
- endpoints =
runtimeEndpointsForService(endpointIndex, targetSvc, port, selector)
- }
- tlsMode := runtimeDestinationTLSMode(push,
targetSvc.Attributes.Namespace, targetSvc.Hostname, subset)
- cfg.Destinations = append(cfg.Destinations,
proxylessGRPCDestinationRuntimeConfig{
- Host: targetHost,
- Subset: subset,
- Weight: int(weighted.Weight),
- TLSMode: tlsMode,
- Endpoints:
rewriteRuntimeEndpointPortsForTLS(endpoints, tlsMode),
- })
- }
- }
- if len(cfg.Destinations) == 0 {
- tlsMode := runtimeDestinationTLSMode(push,
svc.Attributes.Namespace, svc.Hostname, "")
- cfg.Destinations = []proxylessGRPCDestinationRuntimeConfig{{
+ Destinations: []proxylessGRPCDestinationRuntimeConfig{{
Host: string(svc.Hostname),
Weight: 100,
- TLSMode: tlsMode,
- Endpoints:
runtimeRouteEndpointsForService(endpointIndex, svc, port, nil, tlsMode),
- }}
- }
- normalizeRuntimeRouteWeights(cfg.Destinations)
- return cfg
-}
-
-func runtimeRouteEndpointsForService(endpointIndex
*discoverymodel.EndpointIndex, svc *discoverymodel.Service, port int, selector
configlabels.Instance, tlsMode string) []proxylessGRPCEndpointRuntimeConfig {
- return
rewriteRuntimeEndpointPortsForTLS(runtimeEndpointsForService(endpointIndex,
svc, port, selector), tlsMode)
-}
-
-func rewriteRuntimeEndpointPortsForTLS(endpoints
[]proxylessGRPCEndpointRuntimeConfig, tlsMode string)
[]proxylessGRPCEndpointRuntimeConfig {
- if tlsMode != "DUBBO_MUTUAL" {
- return endpoints
- }
- out := make([]proxylessGRPCEndpointRuntimeConfig, len(endpoints))
- copy(out, endpoints)
- for i := range out {
- out[i].Port = inject.ProxylessGRPCInboundPort
- }
- return out
-}
-
-func runtimeSubsetSelector(push *discoverymodel.PushContext, namespace string,
hostname host.Name, subset string) (configlabels.Instance, bool) {
- if subset == "" {
- return nil, true
- }
- rule := push.DestinationRuleForService(namespace, hostname)
- if rule == nil {
- return nil, false
- }
- for _, ss := range rule.Subsets {
- if ss.Name == subset {
- return configlabels.Instance(ss.Labels), true
- }
- }
- return nil, false
-}
-
-func runtimeDestinationTLSMode(push *discoverymodel.PushContext, namespace
string, hostname host.Name, subset string) string {
- if push == nil {
- return ""
- }
- rule := push.DestinationRuleForService(namespace, hostname)
- if rule == nil {
- return ""
- }
- if subset != "" {
- for _, ss := range rule.Subsets {
- if ss.Name == subset {
- if ss.TrafficPolicy != nil {
- return
runtimeTrafficPolicyTLSMode(ss.TrafficPolicy)
- }
- break
- }
- }
- }
- return runtimeTrafficPolicyTLSMode(rule.TrafficPolicy)
-}
-
-func runtimeTrafficPolicyTLSMode(policy *networking.TrafficPolicy) string {
- if policy == nil || policy.Tls == nil {
- return ""
+ Endpoints: runtimeEndpointsForService(endpointIndex,
svc, port, nil),
+ }},
}
- return policy.Tls.Mode.String()
}
func runtimeInboundMTLSMode(push *discoverymodel.PushContext, namespace
string, port int) string {
diff --git a/dubbod/discovery/pkg/features/experimental.go
b/dubbod/discovery/pkg/features/experimental.go
index 3c2f7e0e..f2db8f09 100644
--- a/dubbod/discovery/pkg/features/experimental.go
+++ b/dubbod/discovery/pkg/features/experimental.go
@@ -24,9 +24,6 @@ var (
EnableLeaderElection = env.Register("ENABLE_LEADER_ELECTION", true,
"If enabled (default), starts a leader election client and
gains leadership before executing controllers. "+
"If false, it assumes that only one instance of dubbod
is running and skips leader election.").Get()
- EnableEnhancedDestinationRuleMerge =
env.Register("ENABLE_ENHANCED_DESTINATIONRULE_MERGE", true,
- "If enabled, Dubbo merges Gateway API-derived destination rules
considering their exportTo fields,"+
- " they will be kept as independent rules if the
exportTos are not equal.").Get()
EnableGatewayAPI = env.Register("DUBBO_ENABLE_GATEWAY_API", true,
"If this is set to true, support for Kubernetes gateway-api
(github.com/kubernetes-sigs/gateway-api) will "+
" be enabled. In addition to this being enabled, the
gateway-api CRDs need to be installed.").Get()
diff --git a/dubbod/discovery/pkg/model/destinationrule.go
b/dubbod/discovery/pkg/model/destinationrule.go
deleted file mode 100644
index 81dec258..00000000
--- a/dubbod/discovery/pkg/model/destinationrule.go
+++ /dev/null
@@ -1,32 +0,0 @@
-//
-// Licensed to the Apache Software Foundation (ASF) under one or more
-// contributor license agreements. See the NOTICE file distributed with
-// this work for additional information regarding copyright ownership.
-// The ASF licenses this file to You under the Apache License, Version 2.0
-// (the "License"); you may not use this file except in compliance with
-// the License. You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package model
-
-import (
- "github.com/apache/dubbo-kubernetes/pkg/config"
- "github.com/apache/dubbo-kubernetes/pkg/config/visibility"
- "github.com/apache/dubbo-kubernetes/pkg/util/sets"
- "k8s.io/apimachinery/pkg/types"
-)
-
-func ConvertConsolidatedDestRule(cfg *config.Config, exportToSet
sets.Set[visibility.Instance]) *ConsolidatedSubRule {
- return &ConsolidatedSubRule{
- exportTo: exportToSet,
- rule: cfg,
- from: []types.NamespacedName{cfg.NamespacedName()},
- }
-}
diff --git a/dubbod/discovery/pkg/model/push_context.go
b/dubbod/discovery/pkg/model/push_context.go
index 72742d38..3ad42cc3 100644
--- a/dubbod/discovery/pkg/model/push_context.go
+++ b/dubbod/discovery/pkg/model/push_context.go
@@ -23,7 +23,6 @@ import (
"sync"
"time"
- "github.com/apache/dubbo-kubernetes/pkg/config/labels"
"github.com/apache/dubbo-kubernetes/pkg/config/schema/gvk"
networking "github.com/kdubbo/api/networking/v1alpha3"
sigsk8siogatewayapiapisv1 "sigs.k8s.io/gateway-api/apis/v1"
@@ -41,7 +40,6 @@ import (
meshv1alpha1 "github.com/kdubbo/api/mesh/v1alpha1"
"go.uber.org/atomic"
"google.golang.org/protobuf/types/known/wrapperspb"
- "k8s.io/apimachinery/pkg/types"
)
type TriggerReason string
@@ -73,13 +71,11 @@ type PushContext struct {
clusterLocalHosts ClusterLocalHosts
exportToDefaults exportToDefaults
ServiceIndex serviceIndex
- virtualServiceIndex virtualServiceIndex
httpRouteIndex httpRouteIndex
dxgateServiceIndex dxgateServiceIndex
backendTLSPolicyIndex backendTLSPolicyIndex
faultInjectionIndex faultInjectionPolicyIndex
serviceActivationIndex serviceActivationPolicyIndex
- destinationRuleIndex destinationRuleIndex
serviceAccounts map[serviceAccountKey][]string
AuthenticationPolicies *AuthenticationPolicies
PushVersion string
@@ -141,24 +137,8 @@ type ConfigKey struct {
Namespace string
}
-type ConsolidatedSubRule struct {
- exportTo sets.Set[visibility.Instance]
- rule *config.Config
- from []types.NamespacedName
-}
-
type exportToDefaults struct {
- service sets.Set[visibility.Instance]
- virtualService sets.Set[visibility.Instance]
- destinationRule sets.Set[visibility.Instance]
-}
-
-type virtualServiceIndex struct {
- // Map of VS hostname -> referenced hostnames
- referencedDestinations map[string]sets.String
-
- // hostToRoutes keeps the resolved VirtualServices keyed by host
- hostToRoutes map[host.Name][]config.Config
+ service sets.Set[visibility.Instance]
}
type httpRouteIndex struct {
@@ -184,28 +164,16 @@ type serviceActivationPolicyIndex struct {
services map[string][]string
}
-type destinationRuleIndex struct {
- namespaceLocal map[string]*consolidatedSubRules
- exportedByNamespace map[string]*consolidatedSubRules
- rootNamespaceLocal *consolidatedSubRules
-}
-
-type consolidatedSubRules struct {
- specificSubRules map[host.Name][]*ConsolidatedSubRule
-}
-
func NewPushContext() *PushContext {
return &PushContext{
ServiceIndex: newServiceIndex(),
- virtualServiceIndex: newVirtualServiceIndex(),
dxgateServiceIndex: dxgateServiceIndex{byNamespace:
map[string]map[string]config.Config{}},
backendTLSPolicyIndex: backendTLSPolicyIndex{serviceTLS:
map[string]BackendTLSSettings{}},
serviceActivationIndex: serviceActivationPolicyIndex{
services: map[string][]string{},
},
- destinationRuleIndex: newDestinationRuleIndex(),
- serviceAccounts: map[serviceAccountKey][]string{},
- ProxyStatus: map[string]map[string]ProxyPushStatus{},
+ serviceAccounts: map[serviceAccountKey][]string{},
+ ProxyStatus: map[string]map[string]ProxyPushStatus{},
}
}
@@ -219,21 +187,6 @@ func newServiceIndex() serviceIndex {
}
}
-func newVirtualServiceIndex() virtualServiceIndex {
- out := virtualServiceIndex{
- referencedDestinations: map[string]sets.String{},
- hostToRoutes: map[host.Name][]config.Config{},
- }
- return out
-}
-
-func newDestinationRuleIndex() destinationRuleIndex {
- return destinationRuleIndex{
- namespaceLocal: map[string]*consolidatedSubRules{},
- exportedByNamespace: map[string]*consolidatedSubRules{},
- }
-}
-
func NewReasonStats(reasons ...TriggerReason) ReasonStats {
ret := make(ReasonStats)
for _, reason := range reasons {
@@ -421,16 +374,6 @@ func (pr *PushRequest) PushReason() string {
}
func (ps *PushContext) initDefaultExportMaps() {
- ps.exportToDefaults.destinationRule = sets.New[visibility.Instance]()
- if ps.Mesh.DefaultDestinationRuleExportTo != nil {
- for _, e := range ps.Mesh.DefaultDestinationRuleExportTo {
-
ps.exportToDefaults.destinationRule.Insert(visibility.Instance(e))
- }
- } else {
- // default to *
- ps.exportToDefaults.destinationRule.Insert(visibility.Public)
- }
-
ps.exportToDefaults.service = sets.New[visibility.Instance]()
if ps.Mesh.DefaultServiceExportTo != nil {
for _, e := range ps.Mesh.DefaultServiceExportTo {
@@ -440,14 +383,6 @@ func (ps *PushContext) initDefaultExportMaps() {
ps.exportToDefaults.service.Insert(visibility.Public)
}
- ps.exportToDefaults.virtualService = sets.New[visibility.Instance]()
- if ps.Mesh.DefaultVirtualServiceExportTo != nil {
- for _, e := range ps.Mesh.DefaultVirtualServiceExportTo {
-
ps.exportToDefaults.virtualService.Insert(visibility.Instance(e))
- }
- } else {
- ps.exportToDefaults.virtualService.Insert(visibility.Public)
- }
}
func (ps *PushContext) InitContext(env *Environment, oldPushContext
*PushContext, pushReq *PushRequest) {
@@ -1265,151 +1200,6 @@ func (ps *PushContext) initServiceAccounts(env
*Environment, services []*Service
}
}
-// VirtualServiceForHost returns the first VirtualService that matches the
given host.
-func (ps *PushContext) VirtualServiceForHost(hostname host.Name)
*networking.VirtualService {
- routes := ps.virtualServiceIndex.hostToRoutes[hostname]
- if len(routes) == 0 {
- log.Debugf("no VirtualService found for hostname %s", hostname)
- return nil
- }
- if vs, ok := routes[0].Spec.(*networking.VirtualService); ok {
- log.Infof("found VirtualService %s/%s for hostname %s with %d
HTTP routes",
- routes[0].Namespace, routes[0].Name, hostname,
len(vs.Http))
- return vs
- }
- log.Warnf("VirtualService %s/%s for hostname %s is not a
VirtualService",
- routes[0].Namespace, routes[0].Name, hostname)
- return nil
-}
-
-// DestinationRuleForService returns the first DestinationRule applicable to
the service hostname/namespace.
-func (ps *PushContext) DestinationRuleForService(namespace string, hostname
host.Name) *networking.DestinationRule {
- log.Debugf("looking for DestinationRule for %s/%s", namespace, hostname)
-
- // Check namespace-local rules first
- if nsRules := ps.destinationRuleIndex.namespaceLocal[namespace];
nsRules != nil {
- log.Debugf("checking namespace-local rules for %s (found %d
specific rules)", namespace, len(nsRules.specificSubRules))
- if dr := firstDestinationRule(nsRules, hostname); dr != nil {
- hasTLS := dr.TrafficPolicy != nil &&
dr.TrafficPolicy.Tls != nil
- tlsMode := "none"
- if hasTLS {
- tlsMode = dr.TrafficPolicy.Tls.Mode.String()
- }
- log.Debugf("found DestinationRule in namespace-local
index for %s/%s with %d subsets (has TrafficPolicy: %v, has TLS: %v, TLS mode:
%s)",
- namespace, hostname, len(dr.Subsets),
dr.TrafficPolicy != nil, hasTLS, tlsMode)
- return dr
- }
- } else {
- log.Debugf("no namespace-local rules for namespace %s",
namespace)
- }
-
- // Check exported rules
- log.Debugf("checking exported rules (found %d exported namespaces)",
len(ps.destinationRuleIndex.exportedByNamespace))
- for ns, exported := range ps.destinationRuleIndex.exportedByNamespace {
- if dr := firstDestinationRule(exported, hostname); dr != nil {
- hasTLS := dr.TrafficPolicy != nil &&
dr.TrafficPolicy.Tls != nil
- tlsMode := "none"
- if hasTLS {
- tlsMode = dr.TrafficPolicy.Tls.Mode.String()
- }
- log.Debugf("found DestinationRule in exported rules
from namespace %s for %s/%s with %d subsets (has TrafficPolicy: %v, has TLS:
%v, TLS mode: %s)",
- ns, namespace, hostname, len(dr.Subsets),
dr.TrafficPolicy != nil, hasTLS, tlsMode)
- return dr
- }
- }
-
- // Finally, check root namespace scoped rules
- if rootRules := ps.destinationRuleIndex.rootNamespaceLocal; rootRules
!= nil {
- log.Debugf("checking root namespace rules (found %d specific
rules)", len(rootRules.specificSubRules))
- if dr := firstDestinationRule(rootRules, hostname); dr != nil {
- hasTLS := dr.TrafficPolicy != nil &&
dr.TrafficPolicy.Tls != nil
- tlsMode := "none"
- if hasTLS {
- tlsMode = dr.TrafficPolicy.Tls.Mode.String()
- }
- log.Debugf("found DestinationRule in root namespace for
%s/%s with %d subsets (has TrafficPolicy: %v, has TLS: %v, TLS mode: %s)",
- namespace, hostname, len(dr.Subsets),
dr.TrafficPolicy != nil, hasTLS, tlsMode)
- return dr
- }
- }
-
- log.Debugf("no DestinationRule found for %s/%s", namespace, hostname)
- return nil
-}
-
-// SubsetLabelsForHost returns the label selector for a subset defined in
DestinationRule.
-func (ps *PushContext) SubsetLabelsForHost(namespace string, hostname
host.Name, subset string) labels.Instance {
- if subset == "" {
- return nil
- }
- rule := ps.DestinationRuleForService(namespace, hostname)
- if rule == nil {
- return nil
- }
- for _, ss := range rule.Subsets {
- if ss.Name == subset {
- return labels.Instance(ss.Labels)
- }
- }
- return nil
-}
-
-func firstDestinationRule(csr *consolidatedSubRules, hostname host.Name)
*networking.DestinationRule {
- if csr == nil {
- log.Debugf("consolidatedSubRules is nil for hostname %s",
hostname)
- return nil
- }
- if rules := csr.specificSubRules[hostname]; len(rules) > 0 {
- log.Debugf("found %d rules for hostname %s", len(rules),
hostname)
- // The first rule should contain the merged result if merge was
successful.
- // However, if merge failed (e.g.,
EnableEnhancedDestinationRuleMerge is disabled),
- // we need to check all rules and prefer the one with TLS
configuration.
- // we return the one that has TLS if available, or the first
one otherwise.
- var bestRule *networking.DestinationRule
- var bestRuleHasTLS bool
- for i, rule := range rules {
- if dr, ok :=
rule.rule.Spec.(*networking.DestinationRule); ok {
- hasTLS := dr.TrafficPolicy != nil &&
dr.TrafficPolicy.Tls != nil
- if hasTLS {
- tlsModeStr :=
dr.TrafficPolicy.Tls.Mode.String()
- hasTLS = (tlsModeStr == "DUBBO_MUTUAL")
- }
- if i == 0 {
- // Always use first rule as fallback
- bestRule = dr
- bestRuleHasTLS = hasTLS
- } else if hasTLS && !bestRuleHasTLS {
- // Prefer rule with TLS over rule
without TLS
- log.Debugf("found rule %d with TLS for
hostname %s, preferring it over rule 0", i, hostname)
- bestRule = dr
- bestRuleHasTLS = hasTLS
- }
- }
- }
- if bestRule != nil {
- tlsMode := "none"
- if bestRuleHasTLS {
- tlsMode =
bestRule.TrafficPolicy.Tls.Mode.String()
- }
- log.Debugf("returning DestinationRule for hostname %s
(has TrafficPolicy: %v, has TLS: %v, TLS mode: %s, has %d subsets)",
- hostname, bestRule.TrafficPolicy != nil,
bestRuleHasTLS, tlsMode, len(bestRule.Subsets))
- return bestRule
- } else {
- log.Warnf("failed to cast any rule to DestinationRule
for hostname %s", hostname)
- }
- } else {
- log.Debugf("no specific rules found for hostname %s (available
hostnames: %v)", hostname, func() []string {
- hosts := make([]string, 0, len(csr.specificSubRules))
- for h := range csr.specificSubRules {
- hosts = append(hosts, string(h))
- }
- return hosts
- }())
- }
- // TODO: support wildcard hosts
- return nil
-}
-
func (ps *PushContext) StatusJSON() ([]byte, error) {
if ps == nil {
return []byte{'{', '}'}, nil
diff --git a/dubbod/discovery/pkg/networking/grpcgen/cds.go
b/dubbod/discovery/pkg/networking/grpcgen/cds.go
index c147fd74..0702250d 100644
--- a/dubbod/discovery/pkg/networking/grpcgen/cds.go
+++ b/dubbod/discovery/pkg/networking/grpcgen/cds.go
@@ -28,7 +28,6 @@ import (
"github.com/apache/dubbo-kubernetes/dubbod/discovery/pkg/networking/util"
"github.com/apache/dubbo-kubernetes/pkg/config/host"
"github.com/apache/dubbo-kubernetes/pkg/util/sets"
- networking "github.com/kdubbo/api/networking/v1alpha3"
cluster "github.com/kdubbo/xds-api/cluster/v1"
core "github.com/kdubbo/xds-api/core/v1"
tlsv1 "github.com/kdubbo/xds-api/extensions/transport_sockets/tls/v1"
@@ -42,9 +41,7 @@ type clusterBuilder struct {
hostname host.Name
portNum int
- // may not be set
svc *model.Service
- port *model.Port
filter sets.String
}
@@ -90,13 +87,12 @@ func newClusterBuilder(node *model.Proxy, push
*model.PushContext, defaultCluste
}
// try to resolve the service and port
- var port *model.Port
svc := push.ServiceForHostname(node, hostname)
if svc == nil {
return nil, fmt.Errorf("cds gen for %s: did not find service
for cluster %s", node.ID, defaultClusterName)
}
- port, ok := svc.Ports.GetByPort(portNum)
+ _, ok := svc.Ports.GetByPort(portNum)
if !ok {
return nil, fmt.Errorf("cds gen for %s: did not find port %d in
service for cluster %s", node.ID, portNum, defaultClusterName)
}
@@ -110,42 +106,19 @@ func newClusterBuilder(node *model.Proxy, push
*model.PushContext, defaultCluste
portNum: portNum,
filter: filter,
- svc: svc,
- port: port,
+ svc: svc,
}, nil
}
func (b *clusterBuilder) build() []*cluster.Cluster {
- var defaultCluster *cluster.Cluster
defaultRequested := b.filter == nil ||
b.filter.Contains(b.defaultClusterName)
-
- var dr *networking.DestinationRule
- if b.svc != nil {
- dr =
b.push.DestinationRuleForService(b.svc.Attributes.Namespace, b.hostname)
- if dr == nil && b.svc.Hostname != b.hostname {
- dr =
b.push.DestinationRuleForService(b.svc.Attributes.Namespace, b.svc.Hostname)
- }
- }
- hasTLSInDR := dr != nil && dr.TrafficPolicy != nil &&
dr.TrafficPolicy.Tls != nil
- if hasTLSInDR {
- tlsMode := dr.TrafficPolicy.Tls.Mode
- tlsModeStr := dr.TrafficPolicy.Tls.Mode.String()
- hasTLSInDR = (tlsMode ==
networking.ClientTLSSettings_DUBBO_MUTUAL || tlsModeStr == "DUBBO_MUTUAL")
+ if !defaultRequested {
+ return nil
}
- // Generate default cluster if requested OR if DestinationRule has
DUBBO_MUTUAL TLS
- if defaultRequested || hasTLSInDR {
- defaultCluster = b.edsCluster(b.defaultClusterName)
- // For gRPC proxyless, we need to set CommonLbConfig to handle
endpoint health status
- // in OverrideHostStatus so that clients can use them when
healthy endpoints are not available.
- // The client will prioritize HEALTHY endpoints but can fall
back to UNHEALTHY/DRAINING if needed.
- if defaultCluster.CommonLbConfig == nil {
- defaultCluster.CommonLbConfig =
&cluster.Cluster_CommonLbConfig{}
- }
- // in OverrideHostStatus. This allows clients to use unhealthy
endpoints when healthy ones
- // are not available, preventing "weighted-target: no targets
to pick from" errors.
- // The client will still prioritize HEALTHY endpoints, but can
fall back to others.
- defaultCluster.CommonLbConfig.OverrideHostStatus =
&core.HealthStatusSet{
+ defaultCluster := b.edsCluster(b.defaultClusterName)
+ defaultCluster.CommonLbConfig = &cluster.Cluster_CommonLbConfig{
+ OverrideHostStatus: &core.HealthStatusSet{
Statuses: []core.HealthStatus{
core.HealthStatus_HEALTHY,
core.HealthStatus_UNHEALTHY,
@@ -153,41 +126,16 @@ func (b *clusterBuilder) build() []*cluster.Cluster {
core.HealthStatus_UNKNOWN,
core.HealthStatus_DEGRADED,
},
- }
- // TLS will be applied in applyDestinationRule after
DestinationRule is found
- if hasTLSInDR {
- log.Debugf("generated default cluster %s (required for
DUBBO_MUTUAL TLS)", b.defaultClusterName)
- } else {
- log.Debugf("generated default cluster %s",
b.defaultClusterName)
- }
- }
-
- subsetClusters, newDefaultCluster :=
b.applyDestinationRule(defaultCluster)
- // If applyDestinationRule generated a new default cluster (because TLS
was found but cluster wasn't generated in build()),
- // use it instead of the original defaultCluster
- if newDefaultCluster != nil {
- defaultCluster = newDefaultCluster
+ },
}
if b.requiresPeerAuthenticationMTLS() {
b.applyPeerAuthenticationMTLS(defaultCluster)
- for _, subsetCluster := range subsetClusters {
- b.applyPeerAuthenticationMTLS(subsetCluster)
- }
}
if b.node != nil && b.node.IsRouter() {
b.applyBackendTLSPolicy(defaultCluster)
- for _, subsetCluster := range subsetClusters {
- b.applyBackendTLSPolicy(subsetCluster)
- }
}
- out := make([]*cluster.Cluster, 0, 1+len(subsetClusters))
- if defaultCluster != nil {
- out = append(out, defaultCluster)
- }
- result := append(out, subsetClusters...)
- log.Debugf("generated %d clusters total (1 default + %d subsets) for
%s",
- len(result), len(subsetClusters), b.defaultClusterName)
- return result
+ log.Debugf("generated cluster %s", b.defaultClusterName)
+ return []*cluster.Cluster{defaultCluster}
}
func (b *clusterBuilder) requiresPeerAuthenticationMTLS() bool {
@@ -203,7 +151,7 @@ func (b *clusterBuilder) applyPeerAuthenticationMTLS(c
*cluster.Cluster) {
if c == nil || c.TransportSocket != nil {
return
}
- tlsContext := b.buildUpstreamTLSContext(c, nil)
+ tlsContext := b.buildUpstreamTLSContext(c)
if tlsContext == nil {
log.Warnf("failed to build automatic mTLS context for STRICT
PeerAuthentication on cluster %s", c.Name)
return
@@ -251,201 +199,6 @@ func defaultLbPolicy() cluster.Cluster_LbPolicy {
}
}
-func (b *clusterBuilder) applyDestinationRule(defaultCluster *cluster.Cluster)
(subsetClusters []*cluster.Cluster, newDefaultCluster *cluster.Cluster) {
- if b.svc == nil || b.port == nil {
- log.Warnf("service or port is nil for %s", b.defaultClusterName)
- return nil, nil
- }
- log.Debugf("looking for DestinationRule for service %s/%s (hostname=%s,
port=%d)",
- b.svc.Attributes.Namespace, b.svc.Attributes.Name, b.hostname,
b.portNum)
- dr := b.push.DestinationRuleForService(b.svc.Attributes.Namespace,
b.hostname)
- if dr == nil {
- // If not found with b.hostname, try with the service's FQDN
hostname
- if b.svc.Hostname != b.hostname {
- dr =
b.push.DestinationRuleForService(b.svc.Attributes.Namespace, b.svc.Hostname)
- }
- if dr == nil {
- log.Debugf("no DestinationRule found for %s/%s or %s",
b.svc.Attributes.Namespace, b.hostname, b.svc.Hostname)
- return nil, nil
- }
- }
-
- // Check if DestinationRule has TLS configuration
- hasTLS := dr.TrafficPolicy != nil && dr.TrafficPolicy.Tls != nil
- if hasTLS {
- tlsMode := dr.TrafficPolicy.Tls.Mode
- tlsModeStr := dr.TrafficPolicy.Tls.Mode.String()
- hasTLS = (tlsMode == networking.ClientTLSSettings_DUBBO_MUTUAL
|| tlsModeStr == "DUBBO_MUTUAL")
- }
-
- // If no subsets and no TLS, there's nothing to do
- if len(dr.Subsets) == 0 && !hasTLS {
- log.Debugf("DestinationRule found for %s/%s but has no subsets
and no TLS policy", b.svc.Attributes.Namespace, b.hostname)
- return nil, nil
- }
-
- log.Debugf("found DestinationRule for %s/%s with %d subsets,
defaultCluster requested=%v, hasTLS=%v",
- b.svc.Attributes.Namespace, b.hostname, len(dr.Subsets),
defaultCluster != nil, hasTLS)
-
- // Apply TLS to default cluster if it exists and doesn't have
TransportSocket yet
- // This ensures that default cluster gets TLS from the top-level
TrafficPolicy in DestinationRule
- // When DestinationRule sets DUBBO_MUTUAL, inbound listener enforces
STRICT mTLS, so outbound must also use TLS
- // NOTE: We re-check hasTLS here because firstDestinationRule might
have returned a different rule
- // than the one checked in build(), especially when multiple
DestinationRules exist and merge failed
- if defaultCluster != nil && defaultCluster.TransportSocket == nil {
- // Re-check TLS in case DestinationRule was found here but not
in build()
- recheckTLS := dr != nil && dr.TrafficPolicy != nil &&
dr.TrafficPolicy.Tls != nil
- if recheckTLS {
- tlsMode := dr.TrafficPolicy.Tls.Mode
- tlsModeStr := dr.TrafficPolicy.Tls.Mode.String()
- recheckTLS = (tlsMode ==
networking.ClientTLSSettings_DUBBO_MUTUAL || tlsModeStr == "DUBBO_MUTUAL")
- }
- if hasTLS || recheckTLS {
- log.Debugf("applying TLS to default cluster %s
(DestinationRule has DUBBO_MUTUAL)", b.defaultClusterName)
- b.applyTLSForCluster(defaultCluster, nil)
- } else {
- log.Debugf("skipping TLS for default cluster %s
(DestinationRule has no TrafficPolicy or TLS)", b.defaultClusterName)
- }
- } else if defaultCluster == nil && hasTLS {
- // If default cluster was not generated in build() but
DestinationRule has TLS,
- // we need to generate it here to ensure TLS is applied
- // This can happen if build() checked the first rule (without
TLS) but applyDestinationRule
- // found a different rule (with TLS) via firstDestinationRule's
improved logic
- log.Debugf("default cluster was not generated in build() but
DestinationRule has TLS, generating it now")
- defaultCluster = b.edsCluster(b.defaultClusterName)
- if defaultCluster.CommonLbConfig == nil {
- defaultCluster.CommonLbConfig =
&cluster.Cluster_CommonLbConfig{}
- }
- defaultCluster.CommonLbConfig.OverrideHostStatus =
&core.HealthStatusSet{
- Statuses: []core.HealthStatus{
- core.HealthStatus_HEALTHY,
- core.HealthStatus_UNHEALTHY,
- core.HealthStatus_DRAINING,
- core.HealthStatus_UNKNOWN,
- core.HealthStatus_DEGRADED,
- },
- }
- log.Debugf("applying TLS to newly generated default cluster %s
(DestinationRule has DUBBO_MUTUAL)", b.defaultClusterName)
- b.applyTLSForCluster(defaultCluster, nil)
- return nil, defaultCluster // Return the newly generated
default cluster
- }
-
- var commonLbConfig *cluster.Cluster_CommonLbConfig
- if defaultCluster != nil {
- commonLbConfig = defaultCluster.CommonLbConfig
- } else {
- commonLbConfig = &cluster.Cluster_CommonLbConfig{
- OverrideHostStatus: &core.HealthStatusSet{
- Statuses: []core.HealthStatus{
- core.HealthStatus_HEALTHY,
- core.HealthStatus_UNHEALTHY,
- core.HealthStatus_DRAINING,
- core.HealthStatus_UNKNOWN,
- core.HealthStatus_DEGRADED,
- },
- },
- }
- }
-
- defaultClusterRequested := defaultCluster != nil
- if b.filter != nil {
- defaultClusterRequested =
b.filter.Contains(b.defaultClusterName)
- }
-
- for _, subset := range dr.Subsets {
- if subset == nil || subset.Name == "" {
- continue
- }
- clusterName :=
model.BuildSubsetKey(model.TrafficDirectionOutbound, subset.Name, b.hostname,
b.portNum)
-
- // Always generate subset clusters if default cluster is
requested
- shouldGenerate := true
- if b.filter != nil && !b.filter.Contains(clusterName) {
- // Subset cluster not explicitly requested, but
generate it if default cluster was requested
- shouldGenerate = defaultClusterRequested
- }
-
- if !shouldGenerate {
- log.Debugf("skipping subset cluster %s (not requested
and default not requested)", clusterName)
- continue
- }
-
- log.Debugf("generating subset cluster %s for subset %s",
clusterName, subset.Name)
- subsetCluster := b.edsCluster(clusterName)
- subsetCluster.CommonLbConfig = commonLbConfig
- b.applyTLSForCluster(subsetCluster, subset)
- subsetClusters = append(subsetClusters, subsetCluster)
- }
-
- log.Debugf("generated %d subset clusters for %s/%s",
len(subsetClusters), b.svc.Attributes.Namespace, b.hostname)
- return subsetClusters, nil
-}
-
-// applyTLSForCluster attaches a gRPC-compatible TLS transport socket whenever
the
-// DestinationRule (or subset override) specifies DUBBO_MUTUAL/DUBBO_MUTUAL
mode.
-func (b *clusterBuilder) applyTLSForCluster(c *cluster.Cluster, subset
*networking.Subset) {
- if c == nil || b.svc == nil {
- return
- }
-
- dr := b.push.DestinationRuleForService(b.svc.Attributes.Namespace,
b.hostname)
- if dr == nil && b.svc.Hostname != b.hostname {
- // If not found with b.hostname, try with the service's FQDN
hostname
- dr =
b.push.DestinationRuleForService(b.svc.Attributes.Namespace, b.svc.Hostname)
- }
- if dr == nil {
- log.Debugf("no DestinationRule found for cluster %s
(namespace=%s, hostname=%s, service hostname=%s)",
- c.Name, b.svc.Attributes.Namespace, b.hostname,
b.svc.Hostname)
- return
- }
-
- var policy *networking.TrafficPolicy
- if subset != nil && subset.TrafficPolicy != nil {
- policy = subset.TrafficPolicy
- log.Debugf("using TrafficPolicy from subset %s for cluster %s",
subset.Name, c.Name)
- } else {
- policy = dr.TrafficPolicy
- if policy != nil {
- log.Debugf("using top-level TrafficPolicy for cluster
%s", c.Name)
- }
- }
-
- if policy == nil || policy.Tls == nil {
- if policy == nil {
- log.Debugf("no TrafficPolicy found in DestinationRule
for cluster %s", c.Name)
- } else {
- log.Debugf("no TLS settings in TrafficPolicy for
cluster %s", c.Name)
- }
- return
- }
-
- mode := policy.Tls.Mode
- modeStr := policy.Tls.Mode.String()
- if mode != networking.ClientTLSSettings_DUBBO_MUTUAL && modeStr !=
"DUBBO_MUTUAL" {
- log.Debugf("TLS mode %v (%s) not supported for gRPC proxyless,
skipping", mode, modeStr)
- return
- }
-
- tlsContext := b.buildUpstreamTLSContext(c, policy.Tls)
- if tlsContext == nil {
- log.Warnf("failed to build TLS context for cluster %s", c.Name)
- return
- }
-
- sni := tlsContext.Sni
- if sni == "" {
- log.Warnf("SNI is empty for cluster %s, this may cause TLS
handshake failures", c.Name)
- } else {
- log.Debugf("using SNI=%s for cluster %s", sni, c.Name)
- }
-
- c.TransportSocket = &core.TransportSocket{
- Name: "transport_sockets.tls",
- ConfigType: &core.TransportSocket_TypedConfig{TypedConfig:
protoconv.MessageToAny(tlsContext)},
- }
- log.Debugf("applied %v TLS transport socket to cluster %s (SNI=%s)",
mode, c.Name, sni)
-}
-
func (b *clusterBuilder) applyBackendTLSPolicy(c *cluster.Cluster) {
if c == nil || c.TransportSocket != nil || b.svc == nil || b.push ==
nil {
return
@@ -470,7 +223,7 @@ func (b *clusterBuilder) applyBackendTLSPolicy(c
*cluster.Cluster) {
// buildUpstreamTLSContext builds an UpstreamTlsContext that conforms to gRPC
xDS expectations,
// reusing the common certificate-provider setup from buildCommonTLSContext.
-func (b *clusterBuilder) buildUpstreamTLSContext(c *cluster.Cluster,
tlsSettings *networking.ClientTLSSettings) *tlsv1.UpstreamTlsContext {
+func (b *clusterBuilder) buildUpstreamTLSContext(c *cluster.Cluster)
*tlsv1.UpstreamTlsContext {
// Pin the upstream identity: only certificates whose SAN matches one
of the
// target service's SPIFFE identities are accepted.
var sans []string
diff --git a/dubbod/discovery/pkg/networking/grpcgen/cds_test.go
b/dubbod/discovery/pkg/networking/grpcgen/cds_test.go
index 85b3e851..45d14019 100644
--- a/dubbod/discovery/pkg/networking/grpcgen/cds_test.go
+++ b/dubbod/discovery/pkg/networking/grpcgen/cds_test.go
@@ -42,7 +42,7 @@ func
TestActivationPinsBackendAndActivatorSANsInOneCDSContext(t *testing.T) {
push: push,
hostname: hostName,
svc: service,
- }).buildUpstreamTLSContext(&cluster.Cluster{Name: "outbound|8080||" +
string(hostName)}, nil)
+ }).buildUpstreamTLSContext(&cluster.Cluster{Name: "outbound|8080||" +
string(hostName)})
got := context.GetCommonTlsContext().
GetCombinedValidationContext().
GetDefaultValidationContext().
diff --git a/dubbod/discovery/pkg/networking/grpcgen/lds.go
b/dubbod/discovery/pkg/networking/grpcgen/lds.go
index 0eb4a6cc..59ad9bf4 100644
--- a/dubbod/discovery/pkg/networking/grpcgen/lds.go
+++ b/dubbod/discovery/pkg/networking/grpcgen/lds.go
@@ -204,9 +204,7 @@ func buildInboundListeners(node *model.Proxy, push
*model.PushContext, names []s
log.Debugf(" listener %s, service=%s, isGatewayPod=%v,
node.Type=%v, node.IsRouter()=%v",
name, si.Service.Attributes.Name, isGatewayPod,
node.Type, node.IsRouter())
- // - DestinationRule with DUBBO_MUTUAL only configures
CLIENT-SIDE (outbound) mTLS
- // - PeerAuthentication with STRICT configures SERVER-SIDE
(inbound) mTLS
- // Both are REQUIRED for mTLS to work. Server-side mTLS should
ONLY be controlled by PeerAuthentication.
+ // PeerAuthentication is the single source of truth for inbound
mTLS.
mode := push.InboundMTLSModeForProxy(node, uint32(listenPort))
// For proxyless gRPC inbound listeners, we need a FilterChain
with HttpConnectionManager filter
diff --git a/dubbod/discovery/pkg/xds/endpoints/endpoint_builder.go
b/dubbod/discovery/pkg/xds/endpoints/endpoint_builder.go
index d01180d2..1511a0d6 100644
--- a/dubbod/discovery/pkg/xds/endpoints/endpoint_builder.go
+++ b/dubbod/discovery/pkg/xds/endpoints/endpoint_builder.go
@@ -26,12 +26,10 @@ import (
"github.com/apache/dubbo-kubernetes/dubbod/discovery/pkg/networking/util"
"github.com/apache/dubbo-kubernetes/pkg/cluster"
"github.com/apache/dubbo-kubernetes/pkg/config/host"
- "github.com/apache/dubbo-kubernetes/pkg/config/labels"
"github.com/apache/dubbo-kubernetes/pkg/kube/inject"
"github.com/apache/dubbo-kubernetes/pkg/kube/multicluster"
dubbolog "github.com/apache/dubbo-kubernetes/pkg/log"
"github.com/cespare/xxhash/v2"
- networking "github.com/kdubbo/api/networking/v1alpha3"
// core "github.com/kdubbo/xds-api/core/v1"
core "github.com/kdubbo/xds-api/core/v1"
// endpoint "github.com/kdubbo/xds-api/endpoint/v1"
@@ -49,7 +47,6 @@ type EndpointBuilder struct {
push *model.PushContext
hostname host.Name
port int
- subsetName string
service *model.Service
}
@@ -57,7 +54,7 @@ var _ model.XdsCacheEntry = &EndpointBuilder{}
// NewEndpointBuilder creates a new EndpointBuilder
func NewEndpointBuilder(clusterName string, proxy *model.Proxy, push
*model.PushContext) *EndpointBuilder {
- _, subsetName, hostname, port := model.ParseSubsetKey(clusterName)
+ _, _, hostname, port := model.ParseSubsetKey(clusterName)
if hostname == "" || port == 0 {
return nil
}
@@ -70,7 +67,6 @@ func NewEndpointBuilder(clusterName string, proxy
*model.Proxy, push *model.Push
push: push,
hostname: hostname,
port: port,
- subsetName: subsetName,
service: svc,
}
}
@@ -247,11 +243,6 @@ func (b *EndpointBuilder)
BuildClusterLoadAssignmentWithGateways(endpointIndex *
}
}
- // Filter by subset labels if subset is specified
- if b.subsetName != "" && !b.matchesSubset(ep.Labels) {
- continue
- }
-
lbEp := b.buildLbEndpointForCluster(ep, shard.Cluster,
gateways)
if lbEp == nil {
buildFailedCount++
@@ -345,21 +336,6 @@ func (b *EndpointBuilder) servicePort(port int)
*model.Port {
return svcPort
}
-func (b *EndpointBuilder) matchesSubset(epLabels labels.Instance) bool {
- if b.subsetName == "" {
- return true
- }
- if b.service == nil || b.push == nil {
- return true
- }
- selector := b.push.SubsetLabelsForHost(b.service.Attributes.Namespace,
b.hostname, b.subsetName)
- if len(selector) == 0 {
- // No subset labels defined, treat as match-all
- return true
- }
- return selector.SubsetOf(epLabels)
-}
-
func (b *EndpointBuilder) buildLbEndpointForCluster(ep *model.DubboEndpoint,
endpointCluster cluster.ID, gateways
map[cluster.ID]multicluster.EastWestGateway) *endpoint.LbEndpoint {
if len(ep.Addresses) == 0 {
return nil
@@ -439,35 +415,13 @@ func (b *EndpointBuilder) endpointPort(ep
*model.DubboEndpoint) uint32 {
}
func (b *EndpointBuilder) useGRPCInboundEndpointPort() bool {
- if b == nil || b.proxy == nil || !b.proxy.IsProxylessGrpc() || b.push
== nil || b.service == nil {
- return false
- }
- return b.destinationUsesDUBBOMutual()
-}
-
-func (b *EndpointBuilder) destinationUsesDUBBOMutual() bool {
- rule :=
b.push.DestinationRuleForService(b.service.Attributes.Namespace, b.hostname)
- if rule == nil && b.service.Hostname != "" && b.service.Hostname !=
b.hostname {
- rule =
b.push.DestinationRuleForService(b.service.Attributes.Namespace,
b.service.Hostname)
- }
- if rule == nil {
- return false
- }
- if b.subsetName != "" {
- for _, subset := range rule.Subsets {
- if subset.Name == b.subsetName && subset.TrafficPolicy
!= nil {
- return
trafficPolicyUsesDUBBOMutual(subset.TrafficPolicy)
- }
- }
- }
- return trafficPolicyUsesDUBBOMutual(rule.TrafficPolicy)
-}
-
-func trafficPolicyUsesDUBBOMutual(policy *networking.TrafficPolicy) bool {
- if policy == nil || policy.Tls == nil {
+ if b == nil || b.proxy == nil || !b.proxy.IsProxylessGrpc() || b.push
== nil ||
+ b.push.AuthenticationPolicies == nil || b.service == nil {
return false
}
- return policy.Tls.Mode == networking.ClientTLSSettings_DUBBO_MUTUAL ||
policy.Tls.Mode.String() == "DUBBO_MUTUAL"
+ return b.push.AuthenticationPolicies.EffectiveMutualTLSMode(
+ b.service.Attributes.Namespace, nil, uint32(b.port),
+ ) == model.MTLSStrict
}
func buildEmptyClusterLoadAssignment(clusterName string)
*endpoint.ClusterLoadAssignment {
diff --git a/go.mod b/go.mod
index d44a074f..42eef323 100644
--- a/go.mod
+++ b/go.mod
@@ -52,9 +52,9 @@ require (
github.com/hashicorp/go-multierror v1.1.1
github.com/hashicorp/golang-lru/v2 v2.0.7
github.com/heroku/color v0.0.6
- github.com/kdubbo/api v0.0.0-20260808154749-d91601e19406
- github.com/kdubbo/client-go v0.0.0-20260808154904-3acbf91635a1
- github.com/kdubbo/xds-api v0.0.0-20260808155041-b6b8371fcc89
+ github.com/kdubbo/api v0.0.0-20260809040328-26ca8e81828c
+ github.com/kdubbo/client-go v0.0.0-20260809040546-d4a989b2638c
+ github.com/kdubbo/xds-api v0.0.0-20260809040328-0b83f85c2ead
github.com/moby/moby/client v0.4.1
github.com/moby/term v0.5.2
github.com/ory/viper v1.7.5
diff --git a/go.sum b/go.sum
index 5e956c1c..8baf1fa2 100644
--- a/go.sum
+++ b/go.sum
@@ -368,12 +368,12 @@ github.com/jtolds/gls v4.20.0+incompatible/go.mod
h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfV
github.com/julienschmidt/httprouter v1.2.0/go.mod
h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod
h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
-github.com/kdubbo/api v0.0.0-20260808154749-d91601e19406
h1:HlD3yE/A+aHwXNIMydXMtdCTJyLukk8Znv+fo2pX8NA=
-github.com/kdubbo/api v0.0.0-20260808154749-d91601e19406/go.mod
h1:8BtJiIovg7QCPsCxXcw3gDf922VcvYq5ihOSvj49Rq8=
-github.com/kdubbo/client-go v0.0.0-20260808154904-3acbf91635a1
h1:ykfiDq3lqlBJp8r30xJIJC+E2amT0GQVQep62+lhdzo=
-github.com/kdubbo/client-go v0.0.0-20260808154904-3acbf91635a1/go.mod
h1:euRf0fpvc8PfHmIwb3Oj/b42aJDhMVX7PHAYzSZjpU8=
-github.com/kdubbo/xds-api v0.0.0-20260808155041-b6b8371fcc89
h1:HVDXIqVzomm6eHAaitmaB3JGPd7w7BhSg5ns1ObLvzo=
-github.com/kdubbo/xds-api v0.0.0-20260808155041-b6b8371fcc89/go.mod
h1:o2HDUgL1ntaDbWomZ4cD2tt8jBamuG2qRtjXOa1zZ0Q=
+github.com/kdubbo/api v0.0.0-20260809040328-26ca8e81828c
h1:9R/h6Wi5u0tfHufvCoMl8fNvdgO5laxMLxF3XBEueVo=
+github.com/kdubbo/api v0.0.0-20260809040328-26ca8e81828c/go.mod
h1:8BtJiIovg7QCPsCxXcw3gDf922VcvYq5ihOSvj49Rq8=
+github.com/kdubbo/client-go v0.0.0-20260809040546-d4a989b2638c
h1:ndqMI0+82aaUZxV0vYhlQbru0YPfwwB/o+Qb5S7EhMA=
+github.com/kdubbo/client-go v0.0.0-20260809040546-d4a989b2638c/go.mod
h1:E/UAVmHnxrHMqGMMbqO3Lyh5tbjucebe2YL7cQ8HPbc=
+github.com/kdubbo/xds-api v0.0.0-20260809040328-0b83f85c2ead
h1:qQWmzYKhnsf3iRVsqv/gZzRTrkV7RpRw5XujComjubM=
+github.com/kdubbo/xds-api v0.0.0-20260809040328-0b83f85c2ead/go.mod
h1:o2HDUgL1ntaDbWomZ4cD2tt8jBamuG2qRtjXOa1zZ0Q=
github.com/kevinburke/ssh_config v1.2.0
h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
github.com/kevinburke/ssh_config v1.2.0/go.mod
h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
github.com/kisielk/errcheck v1.5.0/go.mod
h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
diff --git a/pkg/config/mesh/mesh.go b/pkg/config/mesh/mesh.go
index ac000d99..8b76814f 100644
--- a/pkg/config/mesh/mesh.go
+++ b/pkg/config/mesh/mesh.go
@@ -134,12 +134,10 @@ func DefaultMeshConfig() *meshv1alpha1.MeshConfig {
Certificates: []*meshv1alpha1.Certificate{},
DefaultConfig: proxyConfig,
- RootNamespace: constants.DubboSystemNamespace,
- ConnectTimeout: durationpb.New(10 *
time.Second),
- DefaultServiceExportTo: []string{"*"},
- DefaultVirtualServiceExportTo: []string{"*"},
- DefaultDestinationRuleExportTo: []string{"*"},
- DnsRefreshRate: durationpb.New(60 *
time.Second),
+ RootNamespace: constants.DubboSystemNamespace,
+ ConnectTimeout: durationpb.New(10 * time.Second),
+ DefaultServiceExportTo: []string{"*"},
+ DnsRefreshRate: durationpb.New(60 * time.Second),
}
}
diff --git a/pkg/xds/server.go b/pkg/xds/server.go
index e4cbe716..b17d2756 100644
--- a/pkg/xds/server.go
+++ b/pkg/xds/server.go
@@ -348,9 +348,8 @@ func ShouldRespond(w Watcher, id string, request
*discovery.DiscoveryRequest) (b
// previousInfo.NonceSent can be empty if we previously had
shouldRespond=true but didn't send any resources.
if request.ResponseNonce != previousInfo.NonceSent {
newResources := sets.New(request.ResourceNames...)
- // Special-case proxyless gRPC: xDS clients may send a "stale"
nonce when they change
- // subscriptions (e.g., after VirtualService introduces subset
clusters). Treat this
- // as a resource change rather than an ACK so the new clusters
get a response.
+ // Proxyless gRPC clients may send a stale nonce while changing
subscriptions.
+ // Treat this as a resource change rather than an ACK.
previousResourcesCopy := previousInfo.ResourceNames.Copy()
if !newResources.Equals(previousResourcesCopy) &&
len(newResources) > 0 {
Log.Debugf("%s: REQ %s nonce mismatch (got %s, sent %s)
but resources changed -> responding",
