feat: GeoIP

[zhaohuabing]

Implements: #4412 #8002

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name	Link
🔨 Latest commit	85668e6
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69c21fe3df9fd500085793f6

[codecov]

Codecov Report

❌ Patch coverage is 72.49284% with 96 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.30%. Comparing base (a049df2) to head (85668e6).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/xds/translator/geoip.go	69.28%	25 Missing and 22 partials ⚠️
internal/xds/translator/authorization.go	52.70%	23 Missing and 12 partials ⚠️
internal/gatewayapi/securitypolicy.go	89.58%	6 Missing and 4 partials ⚠️
internal/ir/xds.go	80.95%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8453      +/-   ##
==========================================
- Coverage   74.35%   74.30%   -0.05%     
==========================================
  Files         242      243       +1     
  Lines       37811    38143     +332     
==========================================
+ Hits        28113    28344     +231     
- Misses       7748     7809      +61     
- Partials     1950     1990      +40     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[rudrakhp]

Some questions and minor comments

[sjoukedv]

Hello @zhaohuabing , quick question regarding logging here before I file it as an issue. I was trying this out ahead of the 1.8.0 release, like this:

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: default-gateway-proxy-config
  namespace: envoy-gateway-system
spec:
  ...  
  telemetry:
    accessLog:
      settings:
        - format:
            type: JSON
            json:
              ...
              geo_country_code: "%REQ(X-EG-INTERNAL-GEOIP-COUNTRY)%"

---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: geo-ip-protection
  namespace: envoy-gateway-system
spec:
  targetRefs: [
    ...
  ]

  authorization:
    defaultAction: Allow
    rules:
      - action: Deny
        principal:
          clientIPGeoLocations:
            - country: US

The rejection works fine, but I only see the geo_country_code populated in the access log when it actually is denied, not for requests that are allowed (but still had the country code looked up). Is this intended behaviour? Can we make it to always output the country code so we can story it for auditing purposes?

Side question; is there a reason why we would add -eg-internal- in the name of the header instead of just x-geoip-country?

It would be great if we also add region which is supported from the envoy filter?