envoyproxy/envoy

Assert failure when accessing config_dump from admin interface

Open

#15,017 opened on 2021年2月10日

GitHub で見る
 (10 comments) (0 reactions) (0 assignees)C++ (5,373 forks)batch import
area/xdsbughelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (平均マージ 8d) (30d で 378 merged PRs)

説明

Title: Assert failure when accessing config_dump from admin interface

Description: I have a binary of envoy built with a custom http filter. The custom filter works without any issue. However when I access admin interface on localhost:9000 after deploying an API, I get the following assert failure.

[2021-02-10 14:13:12.485][7][critical][assert] [external/envoy/source/common/protobuf/utility.cc:730] assert failure: type_url_field_descriptor != nullptr && value_field_descriptor != nullptr && reflection->HasField(*message, type_url_field_descriptor).

It happens only when I use the ADS to config envoy. When I statically configure envoy there's no assert failure. The config of the custom http filter is defined from the following proto.

syntax = "proto3";

package envoy.extensions.filters.http.mgw_websocket.v3;

import "udpa/annotations/status.proto";
import "envoy/config/ratelimit/v3/rls.proto";
import "validate/validate.proto";

import "google/protobuf/duration.proto";

message RateLimit{
    string domain = 1 [(validate.rules).string = {min_len: 1}];

    string ratelimit_type = 2 [(validate.rules).string = {in:["downstream", "upstream", "", "default"]}];

    google.protobuf.Duration timeout = 3;

    bool failure_mode_deny = 4;

    envoy.config.ratelimit.v3.RateLimitServiceConfig rate_limit_service = 5 [(validate.rules).message = {required: true}];
}

envoy.yaml is as follows.

admin:
  access_log_path: /dev/null
  address:
    socket_address:
      address: '${ROUTER_ADMIN_HOST}'
      port_value: '${ROUTER_ADMIN_PORT}'
dynamic_resources:
  ads_config:
    api_type: GRPC
    transport_api_version: V3
    grpc_services:
      - envoy_grpc:
          cluster_name: xds_cluster
  cds_config:
    ads: {}
    resource_api_version: V3
  lds_config:
    ads: {}
    resource_api_version: V3
node:
  cluster: '${ROUTER_CLUSTER}'
  id: '${ROUTER_LABEL}'
static_resources:
  clusters:
    - name: xds_cluster
      type: STRICT_DNS
      connect_timeout: 1s
      hosts:
        - socket_address:
            address: '${ADAPTER_HOST}'
            port_value: '${ADAPTER_PORT}'
      http2_protocol_options: {}
      transport_socket:
        name: envoy.transport_sockets.tls
        typed_config:
          '@type': >-
            type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
          common_tls_context:
            tls_params:
              tls_minimum_protocol_version: TLSv1_2
              tls_maximum_protocol_version: TLSv1_2
            tls_certificates:
              private_key:
                filename: '${ROUTER_PRIVATE_KEY_PATH}'
              certificate_chain:
                filename: '${ROUTER_PUBLIC_CERT_PATH}'
            validation_context:
              trusted_ca:
                filename: '${ADAPTER_CA_CERT_PATH}'
    - name: ext-authz
      type: STRICT_DNS
      connect_timeout: 20s
      http2_protocol_options: {}
      transport_socket:
        name: envoy.transport_sockets.tls
        typed_config:
          '@type': >-
            type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
          common_tls_context:
            tls_params:
              tls_minimum_protocol_version: TLSv1_2
              tls_maximum_protocol_version: TLSv1_2
            tls_certificates:
              private_key:
                filename: '${ROUTER_PRIVATE_KEY_PATH}'
              certificate_chain:
                filename: '${ROUTER_PUBLIC_CERT_PATH}'
            validation_context:
              trusted_ca:
                filename: '${ENFORCER_CA_CERT_PATH}'
      load_assignment:
        cluster_name: ext-authz
        endpoints:
          - lb_endpoints:
              - endpoint:
                  address:
                    socket_address:
                      address: '${ENFORCER_HOST}'
                      port_value: '${ENFORCER_PORT}'

Note I have the following observations about the issue.

  1. Assert failure does not happen in static configuration. Only in ADS.
  2. Assert failure occurs only after deploying an API to envoy. Before deploying I can access config_dump without any issue.
  3. Even when I'm not configuring my custom filter from go-control-plane, I'm getting the assert failure. So my guess is the issue got something to do with my filter config. My BUILD file is as follows.
api_proto_package(
    name = "proto_mgw",
    srcs = ["mgw_websocket_rls.proto", "mgw_websocket.proto"],
    deps = [
        "@envoy_api//envoy/config/ratelimit/v3:pkg",
        "@com_github_cncf_udpa//udpa/annotations:pkg",
        "@envoy_api//envoy/config/core/v3:pkg",
    ],
)

Any help or tip to solve the issue is highly appreciated since I'm stucked with this for couple of days. I can provide more info too. Thanks

コントリビューターガイド