bulwark icon indicating copy to clipboard operation
bulwark copied to clipboard

Improve compatibility across Envoy versions

Open sporkmonger opened this issue 1 year ago • 1 comments

Previously we've been testing against envoy 1.22.2, however compatibility has been broken somewhere between then and the latest version. Bulwark should tolerate the differences in the messages sent by different versions of Envoy. Probably worth thinking about a test matrix for this too.

sporkmonger avatar Mar 05 '24 21:03 sporkmonger

Due to the root cause discovery in #236 and this being dependent on #233 for a resolution, this has been delayed to the 0.6.0 release instead.

sporkmonger avatar Apr 03 '24 23:04 sporkmonger

The initial problem was with the HeaderValue protobuf. Previously it carried things in the value field, but switched to the raw_header field, leaving the value field empty. This applied to pseudo headers as well (named with a : prefix, e.g. :authority and :method). This has been worked around by checking if raw_header is empty and using it preferentially if it's present and falling back to value if it's missing. This is backwards-compatible to at least Envoy 1.22 (as far back as I'm testing) but perhaps earlier too.

However there appears to be a secondary issue with prematurely dropped connections that I'm still trying to figure out.

sporkmonger avatar May 17 '24 20:05 sporkmonger

The secondary issue turned out to be that processing mode overrides are now ignored by default and a new configuration option, allow_mode_override was added to return to pre-1.27 behavior. Trying to use allow_mode_override prior to 1.27 will cause Envoy to error out. I don't think it's a good idea to ship different example configs depending on Envoy version number, and ideally the test matrix setup should be simple, so I opted to change configuration to specify processing mode explicitly, since this works in all current versions.

sporkmonger avatar May 20 '24 22:05 sporkmonger