Skip to content

Matcher + MatcherTree support for a keep_matching field in OnMatch #38726

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 29 commits into
base: main
Choose a base branch
from

Conversation

bsurber
Copy link
Contributor

@bsurber bsurber commented Mar 12, 2025

Commit Message:

  • Add a keep_matching field to OnMatch to mark Matchers that should be recorded when matched but should not be the final matched + enforced action.
  • Implement support for keep_matching using MatcherTree re-entry.
    • Re-entry is implemented in PR Support for MatcherTree Re-Entry #38564 as well for a separate review if this PR gets closed.
    • ListMatcher was chosen as the simplest example usecase / proof-of-concept for re-entry, but implementation in other MatcherTree children will follow in separate PRs (namely prefix_map_matcher).
  • Centralize recursion handling & re-entry logic into evaluateMatch(...), leaving each MatchTree child class to implement the simplest possible match(...) logic (find a match and return it + optionally a reentrant).
    • Previously recursion handling was inconsistent across the MatchTree children, and this saves each child from having to re-implement recursion, keep_handling processing, etc.
    • TrieMatcher also required a reentrant implementation as part of moving recursion logic out of its match(...) logic.

Additional Description:

  • The final goal is to implement preview / darklaunch Matchers whose actions are logged or added to metadata, but not enforced.
    • An initial implementation of preview matched actions just using re-entry was drafted for the rate_limit_quota filter in PR rate_limit_quota: preview mode for matchers #38576, prompting the request to instead add this keep_matching feature to the Matcher API for re-usability.
  • This change will also depend on a duplicate, matcher proto change in github.com/cnf/xds.

Risk Level: moderate - includes changes to widely-used libraries
Testing: Unit + Integration testing, loadtesting WIP
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
API Considerations: The new keep_matching field is not marked as WIP as its implementation should be tested for any breaking changes.

bsurber added 2 commits March 12, 2025 20:07
…on should be recorded but whose enforcement should be skipped.

Signed-off-by: Brian Surber <[email protected]>
… support for reentry & using it to skip keep_matching matches.

Signed-off-by: Brian Surber <[email protected]>
Copy link

As a reminder, PRs marked as draft will not be automatically assigned reviewers,
or be handled by maintainer-oncall triage.

Please mark your PR as ready when you want it to be reviewed!

🐱

Caused by: #38726 was opened by bsurber.

see: more, trace.

Copy link

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @mattklein123
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

🐱

Caused by: #38726 was opened by bsurber.

see: more, trace.

@bsurber
Copy link
Contributor Author

bsurber commented Mar 12, 2025

CC'ing @markroth as the original shepherd to request the 1st class feature support in OnMatch

@repokitteh-read-only repokitteh-read-only bot added the deps Approval required for changes to Envoy's external dependencies label Mar 13, 2025
Copy link

CC @envoyproxy/dependency-shepherds: Your approval is needed for changes made to (bazel/.*repos.*\.bzl)|(bazel/dependency_imports\.bzl)|(api/bazel/.*\.bzl)|(.*/requirements\.txt)|(.*\.patch).
envoyproxy/dependency-shepherds assignee is @mattklein123

🐱

Caused by: #38726 was synchronize by bsurber.

see: more, trace.

bsurber added 3 commits March 14, 2025 20:32
… a few more incomplete initializations in tests

Signed-off-by: Brian Surber <[email protected]>
Signed-off-by: Brian Surber <[email protected]>
…k. Remove this commit before merging or once the cncf/xds matcher PR is merged.

Signed-off-by: Brian Surber <[email protected]>
@bsurber bsurber force-pushed the keep-matching-matchers branch from d1a3596 to 296ce9b Compare March 14, 2025 20:35
@bsurber bsurber marked this pull request as ready for review March 17, 2025 18:34
@tyxia
Copy link
Member

tyxia commented Mar 19, 2025

@bsurber Please fix the CI failures

@bsurber
Copy link
Contributor Author

bsurber commented Mar 19, 2025

@bsurber Please fix the CI failures

The deps failures are likely to be expected while I have 296ce9b in the branch, but it's needed for testing to pass while waiting for cncf/xds#117 to be merged.

Please review regardless of the dep failures. They'll intentionally block a merge here until that xds PR is reviewed+merged & I can remove the do-not-submit commit.

@bsurber
Copy link
Contributor Author

bsurber commented Mar 24, 2025

at tyxia's request, reassigning to wpcode

@bsurber
Copy link
Contributor Author

bsurber commented Mar 24, 2025

/assign wbpcode

Copy link

bsurber is not allowed to assign users.

🐱

Caused by: a #38726 (comment) was created by @bsurber.

see: more, trace.

@tyxia
Copy link
Member

tyxia commented Mar 24, 2025

/assign @wbpcode

@tyxia tyxia removed their assignment Mar 24, 2025
@wbpcode
Copy link
Member

wbpcode commented Mar 26, 2025

I actually didn't get the usage of the new field. If you don't want to enforce the action and only want to log the match result, I think you can use a log action? matcher tree is pretty hard to maintain/follow, let us be cautious to add new feature/field.

/wait-any

@bsurber
Copy link
Contributor Author

bsurber commented May 2, 2025

Oop, seeing an error in RouteMatcherTest.TestMatchInvalidInput from ci. Looking into it, but it's probably unrelated to this PR: https://github.com/envoyproxy/envoy/commits/main/test/common/router/config_impl_test.cc has recent updates as well that got pulled in here.

ravenblackx
ravenblackx previously approved these changes May 5, 2025
@tyxia tyxia self-assigned this May 5, 2025
tyxia
tyxia previously approved these changes May 5, 2025
Copy link
Member

@tyxia tyxia left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, Thanks for your contribution !
@bsurber Are you going to follow-up with a PR of using this new field in the client e.g., RLQS

Also, I guess @wbpcode probably wanted to take a senior maintainer pass as it touches core files.

}
// No match.
if (!maybe_match.result())
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: Do you really need a continue here?

It seems that the logic can be simplified as

if (maybe_match.result()) {
// Provide a reentrant ListMatcher to continue traversal from the next index.
      return {MatchState::MatchComplete, matcher.second,
              std::make_unique<ListMatcherReentrant<DataType>>(*this, i + 1)};
}

Copy link
Contributor Author

@bsurber bsurber May 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, it's functionally identical, updated.

@bsurber bsurber dismissed stale reviews from tyxia and ravenblackx via 9055263 May 5, 2025 21:39
@bsurber
Copy link
Contributor Author

bsurber commented May 5, 2025

LGTM, Thanks for your contribution ! @bsurber Are you going to follow-up with a PR of using this new field in the client e.g., RLQS

Also, I guess @wbpcode probably wanted to take a senior maintainer pass as it touches core files.

Yes, the actual preview feature in the RLQS filter will come after this PR.

tyxia
tyxia previously approved these changes May 6, 2025
@ravenblackx
Copy link
Contributor

Looks like it probably needs to re-merge main to fix
//test/common/router:config_impl_test and
RouteMatcherTest.TestMatchInvalidInput and
//test/common/router:route_fuzz_test FAILED TO BUILD

(May also be that something is genuinely broken by updating the xds API version?)

@bsurber
Copy link
Contributor Author

bsurber commented May 6, 2025

I did some comparisons against upstream/main. My change to config validation may be what's causing this. The expected error message in RouteMatcherTest.TestMatchInvalidInput matches the envoy exception, but the test case isn't expecting an exception at all (it expects to be able to query for the error post-processing).
I'm looking further into whether the change should be in the test, or if it's an actual issue.

@bsurber
Copy link
Contributor Author

bsurber commented May 6, 2025

Yeah, it looks to be a breaking change from having the envoy exceptions surface during parsing instead of checking against the validator later with validator.errors(). I'll make the adjustment to conform.

…ollowing existing convention of checking the validator.errors() result.

Signed-off-by: Brian Surber <[email protected]>
ravenblackx
ravenblackx previously approved these changes May 8, 2025
@ravenblackx
Copy link
Contributor

ravenblackx commented May 8, 2025

/retest

(Looks like all the fails are different now, so probably flakes.)
(argh robot ignoring me if there's any explanation.)

@ravenblackx
Copy link
Contributor

/retest

@ravenblackx
Copy link
Contributor

Error: ERROR: Code coverage for source/common/matcher is lower than limit of 94.7 (93.6) is what remains.

@ravenblackx
Copy link
Contributor

/coverage

Copy link

Coverage for this Pull Request will be rendered here:

https://storage.googleapis.com/envoy-pr/38726/coverage/index.html

The coverage results are (re-)rendered each time the CI envoy-presubmit (check linux_x64 coverage) job completes.

🐱

Caused by: a #38726 (comment) was created by @ravenblackx.

see: more, trace.

@bsurber
Copy link
Contributor Author

bsurber commented May 8, 2025

Thanks, I see a couple of tests / test edits I can add around sub-matching.

…d now that skipped matchers are handled via callback instead of recorded to a vector

Signed-off-by: Brian Surber <[email protected]>
ravenblackx
ravenblackx previously approved these changes May 8, 2025
…o includes defining behavior of continued re-entry attempts against the failed matcher.

Signed-off-by: Brian Surber <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
deps Approval required for changes to Envoy's external dependencies
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants