envoyPatchPolicy fails Unable to unmarshal xds resource

[davem-git]

I'm trying to test out envoyPatchPolicy. I've enabled it, but everything I deploy seems to error in this fashion. I used the https://gateway.envoyproxy.io/docs/tasks/extensibility/envoy-patch-policy/#testing and got the following error. I'm not sure where I've gone wrong. This might have to do with some logging changes I made. However, I removed them and tested again and still got the same error.

 Unable to unmarshal xds resource {"name":"envoy-gateway-system/acme-envoy/https","address":{"socket_address":{"address":"0.0.0.0","port_value":10443}},"filter_chains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typed_config":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","stat_prefix":"https","rds":{"config_source":{"ads":{},"resource_api_version":"V3"},"route_config_name":"envoy-gateway-system/acme-envoy/https"},"http_filters":[{"name":"envoy.filters.http.health_check","typed_config":{"@type":"type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck","pass_through_mode":false,"headers":[{"name":":path","string_match":{"exact":"/healthz"}}]}},{"name":"envoy.filters.http.router","typed_config":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router","suppress_envoy_headers":true}}],"common_http_protocol_options":{"headers_with_underscores_action":"REJECT_REQUEST"},"http2_protocol_options":{"max_concurrent_streams":100,"initial_stream_window_size":65536,"initial_connection_window_size":1048576},"server_header_transformation":"PASS_THROUGH","access_log":[{"name":"envoy.access_loggers.file","typed_config":{"@type":"type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog","path":"/dev/stdout","log_format":{"json_format":{"bytes_received":"%!B(MISSING)YTES_RECEIVED%!"(MISSING),"bytes_sent":"%!B(MISSING)YTES_SENT%!"(MISSING),"duration":"%!D(MISSING)URATION%!"(MISSING),"method":"%!R(MISSING)EQ(:method)%!"(MISSING),"response_code":"%!R(MISSING)ESPONSE_CODE%!"(MISSING),"response_flags":"%!R(MISSING)ESPONSE_FLAGS%!"(MISSING),"route_name":"%!R(MISSING)OUTE_NAME%!"(MISSING),"start_time":"%!S(MISSING)TART_TIME%!"(MISSING),"upstream_host":"%!U(MISSING)PSTREAM_HOST%!"(MISSING),"upstream_ssl_cipher":"%!U(MISSING)PSTREAM_TLS_CIPHER%!"(MISSING),"user_agent":"%!R(MISSING)EQ(USER-AGENT)%!"(MISSING),"vhost":"%!R(MISSING)EQ(:authority)%!"(MISSING),"x-envoy-original-path":"%!R(MISSING)EQ(X-ENVOY-ORIGINAL-PATH)%!"(MISSING),"x-forwarded-for":"%!R(MISSING)EQ(x-forwarded-for)%!"(MISSING),"x-request-id":"%!R(MISSING)EQ(x-request-id)%!"(MISSING)}}}}],"use_remote_address":true,"normalize_path":true,"merge_slashes":true,"path_with_escaped_slashes_action":"UNESCAPE_AND_REDIRECT"}}],"transport_socket":{"name":"envoy.transport_sockets.tls","typed_config":{"@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext","common_tls_context":{"tls_params":{"tls_minimum_protocol_version":"TLSv1_2","tls_maximum_protocol_version":"TLSv1_3"},"tls_certificate_sds_secret_configs":[{"name":"envoy-gateway-system/acme-tls-secret","sds_config":{"ads":{},"resource_api_version":"V3"}}],"alpn_protocols":["h2","http/1.1"]}}},"name":"envoy-gateway-system/acme-envoy/https"}],"per_connection_buffer_limit_bytes":32768,"access_log":[{"name":"envoy.access_loggers.file","filter":{"response_flag_filter":{"flags":["NR"]}},"typed_config":{"@type":"type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog","path":"/dev/stdout","log_format":{"json_format":{"bytes_received":"%!B(MISSING)YTES_RECEIVED%!"(MISSING),"bytes_sent":"%!B(MISSING)YTES_SENT%!"(MISSING),"duration":"%!D(MISSING)URATION%!"(MISSING),"method":"%!R(MISSING)EQ(:method)%!"(MISSING),"response_code":"%!R(MISSING)ESPONSE_CODE%!"(MISSING),"response_flags":"%!R(MISSING)ESPONSE_FLAGS%!"(MISSING),"route_name":"%!R(MISSING)OUTE_NAME%!"(MISSING),"start_time":"%!S(MISSING)TART_TIME%!"(MISSING),"upstream_host":"%!U(MISSING)PSTREAM_HOST%!"(MISSING),"upstream_ssl_cipher":"%!U(MISSING)PSTREAM_TLS_CIPHER%!"(MISSING),"user_agent":"%!R(MISSING)EQ(USER-AGENT)%!"(MISSING),"vhost":"%!R(MISSING)EQ(:authority)%!"(MISSING),"x-envoy-original-path":"%!R(MISSING)EQ(X-ENVOY-ORIGINAL-PATH)%!"(MISSING),"x-forwarded-for":"%!R(MISSING)EQ(x-forwarded-for)%!"(MISSING),"x-request-id":"%!R(MISSING)EQ(x-request-id)%!"(MISSING)}}}}],"default_filter_chain":{"filters":[{"typed_config":{"local_reply_config":{"mappers":[{"body":{"inline_string":"could not find what you are looking for"},"filter":{"status_code_filter":{"comparison":{"op":"EQ","value":{"default_value":404,"runtime_key":"key_b"}}}},"status_code":406}]}}}]}}, err:proto: (line 1:3396): missing "@type" field.

      Reason:                Invalid
      Status:                False
      Type:                  Programmed

[zirain]

can you please share the full content of your EnvoyPatchPolicy?

[davem-git]

I started on v1.1.0 but since then updated to v1.1.2

[arkodg]

another thing to note is that /default_filter_chain is only valid for an http listener, the path is different for an https listener, its /filter_chains/0/

[davem-git]

oh, that was it! Is there away to verify what that part of the setting should be. Its not clear on the page where that come from

[arkodg]

https://gateway.envoyproxy.io/docs/tasks/operations/egctl/#egctl-experimental-translate is one way and you can also look at the config dump https://gateway.envoyproxy.io/contributions/develop/#debugging-the-envoy-config, would be good to add these as links to the page

[davem-git]

I'm looking at the config, I can almost follow it as to how the paths are determined. It seems like we have limited options. I'm trying to use it to disable buffering type.googleapis.com/envoy.extensions.filters.http.buffer.v3.BufferPerRoute, but I now don't think that's possible. Does that seem correct to you?