Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

vrp: allow supervisord to open its log file #14066

Merged
merged 2 commits into from
Nov 18, 2020
Merged

vrp: allow supervisord to open its log file #14066

merged 2 commits into from
Nov 18, 2020

Conversation

akonradi
Copy link
Contributor

Commit Message: Allow supervisord to open its log file
Additional Description:
Change the default location of the log file and give supervisord
permissions to write to it.

Risk Level: low
Testing: built image locally
Docs Changes: n/a
Release Notes: n/a
Platform Specific Features: n/a

@akonradi
Allow supervisord to open its log file
0f09550 
Change the default location of the log file and give supervisord
permissions to write to it.

Signed-off-by: Alex Konradi <akonradi@google.com>
@mattklein123
Copy link
Member

cc @phlax who has been working on similar things.

htuch
htuch reviewed Nov 17, 2020
View reviewed changes
Copy link
Member

@htuch htuch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @akonradi for the quick fix! Did you notice this makes a difference at HEAD? The reason I ask is that I replayed https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/google_vrp#working-with-the-docker-images instructions and it seemed to work on -latest but I saw the supervisord errors at fixed release versions.

configs/google-vrp/supervisor.conf Show resolved Hide resolved
@akonradi
Copy link
Contributor Author

Yeah I only tried this for the current master. How would I apply it to a release version? Just use that as the base docker image?

@akonradi akonradi marked this pull request as ready for review November 17, 2020 22:57
htuch
htuch reviewed Nov 18, 2020
View reviewed changes
Copy link
Member

@htuch htuch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. I've confirmed this fixes things locally. I think if you can deal with the permission issues as well, we can ship this and it should fix latest. I'll do some followups to deal with released version images and putting the VRP image runtime validation into CI to avoid snafus like this in future.

ci/Dockerfile-envoy-google-vrp Show resolved Hide resolved
@htuch htuch added the backport/approved Approved backports to stable releases label Nov 18, 2020
@akonradi
Set permissions on config files and launch script
5864e22 
Signed-off-by: Alex Konradi <akonradi@google.com>
@akonradi
Copy link
Contributor Author

/retest

@repokitteh-read-only
Copy link

Retrying Azure Pipelines:
Retried failed jobs in: envoy-presubmit

🐱

Caused by: a #14066 (comment) was created by @akonradi.

see: more, trace.

htuch
htuch approved these changes Nov 18, 2020
View reviewed changes
Copy link
Member

@htuch htuch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!

@akonradi akonradi changed the title [vrp] allow supervisord to open its log file vrp: allow supervisord to open its log file Nov 18, 2020
@htuch
Copy link
Member

htuch commented Nov 18, 2020

Coverage failure is unrelated, force merging.

@htuch htuch merged commit 9a65e98 into envoyproxy:master Nov 18, 2020
@akonradi akonradi deleted the vrp-supervisor-log branch November 18, 2020 15:23
mpuncel added a commit to mpuncel/envoy that referenced this pull request Nov 18, 2020
@mpuncel
Merge branch 'master' into HEAD
ed7a0f1 
* master: (117 commits)
  vrp: allow supervisord to open its log file (envoyproxy#14066)
  [http1] fix H/1 response pipelining (envoyproxy#13983)
  wasm: make dependency clearer (envoyproxy#14062)
  docs: updating 100-continue docs (envoyproxy#14040)
  quiche: fix stream trailer decoding issue (envoyproxy#13871)
  tidy: use last_github_commit script instead of target branch (envoyproxy#14052)
  stats: use RE2 and a better pattern to accelerate a single stats tag-extraction RE (envoyproxy#8831)
  wasm: use static registration for runtimes (envoyproxy#14014)
  grpc-json-transcoder: Add support for configuring unescaping behavior (envoyproxy#14009)
  ci: fix CodeQL-build by removing deprecated set-env command (envoyproxy#14046)
  config: fix crash when type URL doesn't match proto. (envoyproxy#14031)
  Build: Propagate user-supplied tags to external headers library. (envoyproxy#14016)
  [test host utils] use make_shared to avoid memory leaks (envoyproxy#14042)
  jwt_authn: update to jwt_verify_lib with 1 minute clock skew (envoyproxy#13872)
  quiche: update QUICHE tar (envoyproxy#13949)
  sds: improve watched directory documentation. (envoyproxy#14029)
  log the internal error message from *SSL when the cert and private key doesn't match (envoyproxy#14023)
  wasm: fix CPE for Wasmtime. (envoyproxy#14024)
  docs: Bump sphinxext-rediraffe version (envoyproxy#13996)
  CDS: remove warming cluster if CDS response desired (envoyproxy#13997)
  ...
htuch added a commit to htuch/envoy that referenced this pull request Nov 19, 2020
@htuch
examples: add VRP runtime validation to verify_examples.
5e02c2d 
This is a regression test to cover the issue underlying
envoyproxy#14066.

Risk level: Low
Testing: Validating manually verify.sh passes, CI.

Signed-off-by: Harvey Tuch <htuch@google.com>
@htuch htuch mentioned this pull request Nov 19, 2020
Merged
htuch added a commit that referenced this pull request Nov 20, 2020
@htuch
examples: add VRP runtime validation to verify_examples. (#14099)
ca6e246 
This is a regression test to cover the issue underlying
#14066.

Risk level: Low
Testing: Validating manually verify.sh passes, CI.

Signed-off-by: Harvey Tuch <htuch@google.com>
andreyprezotto pushed a commit to andreyprezotto/envoy that referenced this pull request Nov 24, 2020
@akonradi @andreyprezotto
vrp: allow supervisord to open its log file (envoyproxy#14066)
36fabd0 
Change the default location of the log file and give supervisord
permissions to write to it.

Signed-off-by: Alex Konradi <akonradi@google.com>
andreyprezotto pushed a commit to andreyprezotto/envoy that referenced this pull request Nov 24, 2020
@htuch @andreyprezotto
examples: add VRP runtime validation to verify_examples. (envoyproxy#…
723475a 
…14099)

This is a regression test to cover the issue underlying
envoyproxy#14066.

Risk level: Low
Testing: Validating manually verify.sh passes, CI.

Signed-off-by: Harvey Tuch <htuch@google.com>
qqustc pushed a commit to qqustc/envoy that referenced this pull request Nov 24, 2020
@akonradi @qqustc
vrp: allow supervisord to open its log file (envoyproxy#14066)
452df9e 
Change the default location of the log file and give supervisord
permissions to write to it.

Signed-off-by: Alex Konradi <akonradi@google.com>
Signed-off-by: Qin Qin <qqin@google.com>
qqustc pushed a commit to qqustc/envoy that referenced this pull request Nov 24, 2020
@htuch @qqustc
examples: add VRP runtime validation to verify_examples. (envoyproxy#…
6ae75e6 
…14099)

This is a regression test to cover the issue underlying
envoyproxy#14066.

Risk level: Low
Testing: Validating manually verify.sh passes, CI.

Signed-off-by: Harvey Tuch <htuch@google.com>
Signed-off-by: Qin Qin <qqin@google.com>
cpakulski pushed a commit to cpakulski/envoy that referenced this pull request Dec 4, 2020
@akonradi @cpakulski
vrp: allow supervisord to open its log file (envoyproxy#14066)
6f0e443 
Change the default location of the log file and give supervisord
permissions to write to it.

Signed-off-by: Alex Konradi <akonradi@google.com>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>
cpakulski pushed a commit to cpakulski/envoy that referenced this pull request Dec 4, 2020
@akonradi @cpakulski
vrp: allow supervisord to open its log file (envoyproxy#14066)
c9d237d 
Change the default location of the log file and give supervisord
permissions to write to it.

Signed-off-by: Alex Konradi <akonradi@google.com>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>
jmarantz pushed a commit that referenced this pull request Dec 5, 2020
@cpakulski
backport to 1.16: vrp: allow supervisord to open its log file (#14066) (
e8b0091 
#14279)

Commit Message: Allow supervisord to open its log file
Additional Description:
Change the default location of the log file and give supervisord
permissions to write to it.

Risk Level: low
Testing: built image locally
Docs Changes: n/a
Release Notes: n/a
Platform Specific Features: n/a

Signed-off-by: Alex Konradi <akonradi@google.com>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>
jmarantz pushed a commit that referenced this pull request Dec 5, 2020
@cpakulski
backport to 1.15: vrp: allow supervisord to open its log file (#14066) (
4e14b86 
#14280)

Commit Message: Allow supervisord to open its log file
Additional Description:
Change the default location of the log file and give supervisord
permissions to write to it.

Risk Level: low
Testing: built image locally
Docs Changes: n/a
Release Notes: n/a
Platform Specific Features: n/a

Signed-off-by: Alex Konradi <akonradi@google.com>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>
@cpakulski
Copy link
Contributor

Backported to releases 1.16 and 1.15. Removing backport/approved label.

@cpakulski cpakulski removed the backport/approved Approved backports to stable releases label Dec 16, 2020
istio-testing pushed a commit to istio/envoy that referenced this pull request Jan 8, 2021
@bianpengyuan @PiotrSikora
@antoniovicente @mattklein123 @lizan @cpakulski @asraa @jmarantz @Shikugawa @alyssawilk
[release-1.7] Backport Envoy 1.15 fixes (#290)
a0eff54 
* docs: kick-off 1.15.1 release. (envoyproxy#12166)

Signed-off-by: Piotr Sikora <piotrsikora@google.com>

* tls: update BoringSSL-FIPS to 20190808. (envoyproxy#12170)

Signed-off-by: Piotr Sikora <piotrsikora@google.com>

* test: Exclude wasm_vm_test from CI by making it a "manual" test. (#207)

The wee v8 build times out in CI under --config=asan because the machine the job is scheduled on is too small.

Signed-off-by: Antonio Vicente <avd@google.com>

* [v1.15] http: header map security fixes for duplicate headers (#197) (#200)

Previously header matching did not match on all headers for
non-inline headers. This patch changes the default behavior to
always logically match on all headers. Multiple individual
headers will be logically concatenated with ',' similar to what
is done with inline headers. This makes the behavior effectively
consistent. This behavior can be temporary reverted by setting
the runtime value "envoy.reloadable_features.header_match_on_all_headers"
to "false".

Targeted fixes have been additionally performed on the following
extensions which make them consider all duplicate headers by default as
a comma concatenated list:
1) Any extension using CEL matching on headers.
2) The header to metadata filter.
3) The JWT filter.
4) The Lua filter.
Like primary header matching used in routing, RBAC, etc. this behavior
can be disabled by setting the runtime value
"envoy.reloadable_features.header_match_on_all_headers" to false.

Finally, the setCopy() header map API previously only set the first
header in the case of duplicate non-inline headers. setCopy() now
behaves similiarly to the other set*() APIs and replaces all found
headers with a single value. This may have had security implications
in the extauth filter which uses this API. This behavior can be disabled
by setting the runtime value
"envoy.reloadable_features.http_set_copy_replace_all_headers" to false.

Fixes https://github.com/envoyproxy/envoy-setec/issues/188

Signed-off-by: Matt Klein <mklein@lyft.com>

* backport to v1.15: Fix Kafka Repository Location (#223)

Update mirror used to fetch kafka dependency to a valid, working mirror.

Based on envoyproxy#13025
Resolves envoyproxy#13011

Signed-off-by: Antonio Vicente <avd@google.com>

* release: cutting 1.15.1 (#217)

Signed-off-by: Antonio Vicente <avd@google.com>

* docs: Fix release notes for v1.15.1 release. (envoyproxy#13318)

Signed-off-by: Antonio Vicente <avd@google.com>

* Backport flaky test and tsan fixes to releases/v1.15 branch (envoyproxy#13337)

* hds: fix integration test flakes (envoyproxy#12214)

Part of envoyproxy#12184

Signed-off-by: Matt Klein <mklein@lyft.com>
Signed-off-by: Antonio Vicente <avd@google.com>

* Switch to a tsan-instrumented libc++ for tsan tests (envoyproxy#12134)

This fixes envoyproxy#9784 and re-enables vhds_integration_test

Risk Level: Low, but will most likely increase memory usage

Signed-off-by: Dmitri Dolguikh <ddolguik@redhat.com>

Signed-off-by: Antonio Vicente <avd@google.com>

* test: shard hds_integration_test (envoyproxy#12482)

This should avoid TSAN timeout flakes.

Signed-off-by: Matt Klein <mklein@lyft.com>
Signed-off-by: Antonio Vicente <avd@google.com>

* test: shard http2_integration_test (envoyproxy#11939)

This should mitigate TSAN timeout.

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
Signed-off-by: Antonio Vicente <avd@google.com>

* test: fix http2_integration_test flake (envoyproxy#12450)

Fixes envoyproxy#12442

Signed-off-by: Matt Klein <mklein@lyft.com>
Signed-off-by: Antonio Vicente <avd@google.com>

* Kick CI

Signed-off-by: Antonio Vicente <avd@google.com>

Co-authored-by: Matt Klein <mklein@lyft.com>
Co-authored-by: Dmitri Dolguikh <ddolguik@redhat.com>
Co-authored-by: Lizan Zhou <lizan@tetrate.io>

* docs: kick off v1.15.3-dev (envoyproxy#13695)

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

* 1.15: CI fixes backport (envoyproxy#13697)

Backport following commits to 1.15:
748b2ab (mac ci: try ignoring update failure (envoyproxy#13658), 2020-10-20)
f95f539 (ci: various improvements (envoyproxy#13660), 2020-10-20)
73d78f8 (ci: use multiple stage (envoyproxy#13557), 2020-10-15)
b7a4756 (ci: use azp for api and go-control-plane sync (envoyproxy#13550), 2020-10-14)
876a6bb (ci use azp to sync filter example (envoyproxy#13501), 2020-10-12)
a0f31ee (ci: use azp to generate docs (envoyproxy#13481), 2020-10-12)

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
Co-authored-by: asraa <asraa@google.com>

* 1.15: fix CI script (envoyproxy#13724)

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

* Prevent SEGFAULT when disabling listener (envoyproxy#13515) (envoyproxy#13903)

This prevents the stop_listening overload action from causing
segmentation faults that can occur if the action is enabled after the
listener has already shut down.

Signed-off-by: Alex Konradi <akonradi@google.com>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

* proxy protocol: set downstreamRemoteAddress on StreamInfo (envoyproxy#14131) (envoyproxy#14169)

This fixes a regression which resulted in the downstreamRemoteAddress
on the StreamInfo for a connection not having the address supplied by
the proxy protocol filter, but instead having the address of the
directly connected peer.

This issue does not affect HTTP filters.

Fixes envoyproxy#14087

Signed-off-by: Greg Greenway <ggreenway@apple.com>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

* ci: temproray disable vhds_integration_test in TSAN (envoyproxy#12067) (envoyproxy#14217)

Signed-off-by: Lizan Zhou <lizan@tetrate.io>

* tcmalloc changed and the data coming out of tcmalloc::MallocExtension::GetNumericProperty("generic.current_allocated_bytes") (envoyproxy#14165)

Commit Message: tcmalloc changed and the data coming out of tcmalloc::MallocExtension::GetNumericProperty("generic.current_allocated_bytes") no longer appears to be deterministic, even in unthreaded tests. So disable exact mem checks till we sort that out
Additional Description:
Risk Level: low
Testing: just thread_local_store_test
Docs Changes: n/a
Release Notes: n/a

no longer appears to be deterministic, even in unthreaded tests. So disable exact mem checks till we sort that out

Signed-off-by: Joshua Marantz <jmarantz@google.com>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Co-authored-by: Joshua Marantz <jmarantz@google.com>

* backport to v1.15: connection: Remember transport socket read resumption requests and replay them when re-enabling read. (envoyproxy#13772) (envoyproxy#14173)

* connection: Remember transport socket read resumption requests and replay them when re-enabling read. (envoyproxy#13772)

Fixes SslSocket read resumption after readDisable when processing the SSL record that contains the last bytes of the HTTP message

Signed-off-by: Antonio Vicente <avd@google.com>

* backport to 1.15: udp: properly handle truncated/dropped datagrams (envoyproxy#14122) (envoyproxy#14166)

Signed-off-by: Matt Klein <mklein@lyft.com>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>
Co-authored-by: Matt Klein <mklein@lyft.com>
Co-authored-by: Christoph Pakulski <christoph@tetrate.io>

* backport to 1.15: vrp: allow supervisord to open its log file (envoyproxy#14066) (envoyproxy#14280)

Commit Message: Allow supervisord to open its log file
Additional Description:
Change the default location of the log file and give supervisord
permissions to write to it.

Risk Level: low
Testing: built image locally
Docs Changes: n/a
Release Notes: n/a
Platform Specific Features: n/a

Signed-off-by: Alex Konradi <akonradi@google.com>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

* rel 1.15: close release 1.15.3 (envoyproxy#14303)

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

* Kick off rel 1.15.4. (envoyproxy#14323)

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

* backport to 1.15: http: fix datadog and squash handling of responses without body (envoyproxy#13328) (envoyproxy#14458)

Commit Message: Fixing bugs in datadog and sqaush where unexpected bodyless responses would crash Envoy
Risk Level: low
Testing: new unit tests, updated certs
Docs Changes: n/a
Release Notes: inline
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>
Co-authored-by: alyssawilk <alyssar@chromium.org>

* backport 1.15: http: fixing a bug with IPv6 hosts (envoyproxy#14273)

Fixing a bug where HTTP parser offsets for IPv6 hosts did not include [] and Envoy assumed it did.
This results in mis-parsing addresses for IPv6 CONNECT requests and IPv6 hosts in fully URLs over HTTP/1.1

Risk Level: low
Testing: new unit, integration tests
Docs Changes: n/a
Release Notes: inline

Signed-off-by: Shikugawa <rei@tetrate.io>
Co-authored-by: alyssawilk <alyssar@chromium.org>

* backport to 1.15: tls: fix detection of the upstream connection close event. (envoyproxy#13858) (envoyproxy#14568)

Fixes envoyproxy#13856.

Signed-off-by: Piotr Sikora <piotrsikora@google.com>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

Co-authored-by: Piotr Sikora <piotrsikora@google.com>
Co-authored-by: antonio <avd@google.com>
Co-authored-by: Matt Klein <mklein@lyft.com>
Co-authored-by: Dmitri Dolguikh <ddolguik@redhat.com>
Co-authored-by: Lizan Zhou <lizan@tetrate.io>
Co-authored-by: Christoph Pakulski <christoph@tetrate.io>
Co-authored-by: asraa <asraa@google.com>
Co-authored-by: Joshua Marantz <jmarantz@google.com>
Co-authored-by: Rei Shimizu <Shikugawa@gmail.com>
Co-authored-by: alyssawilk <alyssar@chromium.org>
istio-testing pushed a commit to istio/envoy that referenced this pull request Feb 5, 2021
@tbarrella @Shikugawa
@cpakulski @MarcinFalkowski
Merge envoy/release/v1.16 into release-1.8 (#294)
5b0c5f7 
* backport to 1.16: http: fixing a bug with IPv6 hosts (envoyproxy#14238)

Fixing a bug where HTTP parser offsets for IPv6 hosts did not include [] and Envoy assumed it did.
This results in mis-parsing addresses for IPv6 CONNECT requests and IPv6 hosts in fully URLs over HTTP/1.1

Risk Level: low
Testing: new unit, integration tests
Docs Changes: n/a
Release Notes: inline
Signed-off-by: Shikugawa <rei@tetrate.io>
Co-authored-by: alyssawilk <alyssar@chromium.org>

* backport to 1.16: vrp: allow supervisord to open its log file (envoyproxy#14066) (envoyproxy#14279)

Commit Message: Allow supervisord to open its log file
Additional Description:
Change the default location of the log file and give supervisord
permissions to write to it.

Risk Level: low
Testing: built image locally
Docs Changes: n/a
Release Notes: n/a
Platform Specific Features: n/a

Signed-off-by: Alex Konradi <akonradi@google.com>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

* Closing release 1.16.2. (envoyproxy#14308)

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

* Kick-off rel 1.16.3. (envoyproxy#14321)

Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

* lua: reset downstream_ssl_connection in StreamInfoWrapper when object is marked dead by Lua GC (envoyproxy#14092) (envoyproxy#14449)

Co-authored-by: Marcin Falkowski <marcin.falkowski@allegro.pl>

* backport to 1.16: tls: fix detection of the upstream connection close event. (envoyproxy#13858) (envoyproxy#14452)

Fixes envoyproxy#13856.

This change also contains the following backports:
- build: Fix some unused variable warnings (envoyproxy#13987)
- test: Check in all TLS test certs (envoyproxy#13702)

Signed-off-by: Piotr Sikora <piotrsikora@google.com>
Signed-off-by: Christoph Pakulski <christoph@tetrate.io>

* backport to 1.16: aggregate cluster: fix TLS init issue (envoyproxy#14456)

Additional Description: Based on envoyproxy#14388
Risk Level: Low
Testing: Build and run the repro from envoyproxy#14119 without crashing, `bazel test test/extensions/clusters/aggregate:cluster_test`
Docs Changes: N/A
Release Notes:
envoyproxy#14119

Signed-off-by: Taylor Barrella <tabarr@google.com>

Co-authored-by: Rei Shimizu <rei@tetrate.io>
Co-authored-by: Christoph Pakulski <christoph@tetrate.io>
Co-authored-by: Marcin Falkowski <marcin.falkowski@allegro.pl>
rexengineering pushed a commit to rexengineering/istio-envoy that referenced this pull request Oct 15, 2021
@htuch
examples: add VRP runtime validation to verify_examples. (#14099)
ab82336 
This is a regression test to cover the issue underlying
envoyproxy/envoy#14066.

Risk level: Low
Testing: Validating manually verify.sh passes, CI.

Signed-off-by: Harvey Tuch <htuch@google.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@htuch htuch htuch approved these changes

Assignees

@phlax phlax

@htuch htuch

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@akonradi @mattklein123 @htuch @cpakulski @phlax