Add xDS support for Athenz filters

it/xds-client/build.gradle

@@ -8,4 +8,23 @@ dependencies {
     api(libs.controlplane.cache) {
         exclude group: 'io.envoyproxy.controlplane', module: 'api'
     }
+
+    testImplementation project(':athenz')
+    testImplementation project(':xds-athenz')
+    testImplementation libs.athenz.zms.client
+    testImplementation libs.testcontainers.junit.jupiter
 }
+
+// Copy the Athenz Docker resources from ':athenz'.
+task copyTestResources(type: Copy) {
+    from("${rootProject.projectDir}/athenz/src/test") {
+        include 'resources/**'
+        include '**/AthenzDocker.java'
+        include '**/AthenzExtension.java'
+    }
+    into "${project.ext.genSrcDir}/test"
+}
+
+tasks.compileTestJava.dependsOn(tasks.copyTestResources)
+tasks.processTestResources.dependsOn(tasks.copyTestResources)
+tasks.sourcesJar.dependsOn(tasks.copyTestResources)

it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenFilterTest.java

@@ -0,0 +1,184 @@
+/*
+ * Copyright 2026 LY Corporation
+ *
+ * LY Corporation licenses this file to you under the Apache License,
+ * version 2.0 (the "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at:
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ */
+
+package com.linecorp.armeria.xds.it.athenz;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.io.File;
+import java.net.URI;
+
+import org.junit.jupiter.api.Order;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.RegisterExtension;
+import org.testcontainers.junit.jupiter.EnabledIfDockerAvailable;
+
+import com.linecorp.armeria.client.BlockingWebClient;
+import com.linecorp.armeria.client.WebClient;
+import com.linecorp.armeria.common.AggregatedHttpResponse;
+import com.linecorp.armeria.common.HttpResponse;
+import com.linecorp.armeria.common.HttpStatus;
+import com.linecorp.armeria.server.ServerBuilder;
+import com.linecorp.armeria.server.athenz.AthenzDocker;
+import com.linecorp.armeria.server.athenz.AthenzExtension;
+import com.linecorp.armeria.testing.junit5.common.EventLoopExtension;
+import com.linecorp.armeria.testing.junit5.server.ServerExtension;
+import com.linecorp.armeria.xds.XdsBootstrap;
+import com.linecorp.armeria.xds.client.endpoint.XdsHttpPreprocessor;
+import com.linecorp.armeria.xds.it.XdsResourceReader;
+
+import io.envoyproxy.envoy.config.bootstrap.v3.Bootstrap;
+
+@EnabledIfDockerAvailable
+class AthenzAccessTokenFilterTest {
+
+    private static final String LISTENER_NAME = "listener1";
+    private static final String ATHENZ_RESOURCES = "gen-src/test/resources";
+
+    @RegisterExtension
+    @Order(1)
+    static final AthenzExtension athenz =
+            new AthenzExtension(new File("gen-src/test/resources/docker/docker-compose.yml"));
+
+    @RegisterExtension
+    @Order(2)
+    static final ServerExtension echoServer = new ServerExtension() {
+        @Override
+        protected void configure(ServerBuilder sb) {
+            sb.service("/echo-auth", (ctx, req) -> {
+                final String auth = req.headers().get("authorization");
+                return HttpResponse.of(auth != null ? auth : "no-auth");
+            });
+            sb.http(0);
+        }
+    };
+
+    @RegisterExtension
+    static final EventLoopExtension eventLoop = new EventLoopExtension();
+
+    @Test
+    void tokenInjectedIntoAuthorizationHeader() {
+        final Bootstrap bootstrap = XdsResourceReader.fromYaml(bootstrapYaml(), Bootstrap.class);
+        try (XdsBootstrap xdsBootstrap = XdsBootstrap.of(bootstrap, eventLoop.get());
+             XdsHttpPreprocessor preprocessor =
+                     XdsHttpPreprocessor.ofListener(LISTENER_NAME, xdsBootstrap)) {
+            final BlockingWebClient client = WebClient.of(preprocessor).blocking();
+            final AggregatedHttpResponse response = client.get("/echo-auth");
+            assertThat(response.status()).isEqualTo(HttpStatus.OK);
+            assertThat(response.contentUtf8()).startsWith("Bearer ");
+        }
+    }
+
+    @Test
+    void existingHeaderOverwrittenByFilter() {
+        final Bootstrap bootstrap = XdsResourceReader.fromYaml(bootstrapYaml(), Bootstrap.class);
+        try (XdsBootstrap xdsBootstrap = XdsBootstrap.of(bootstrap, eventLoop.get());
+             XdsHttpPreprocessor preprocessor =
+                     XdsHttpPreprocessor.ofListener(LISTENER_NAME, xdsBootstrap)) {
+            final BlockingWebClient client = WebClient.of(preprocessor).blocking();
+            final AggregatedHttpResponse response = client.prepare()
+                    .get("/echo-auth")
+                    .header("authorization", "Bearer existingToken")
+                    .execute();
+            assertThat(response.status()).isEqualTo(HttpStatus.OK);
+            assertThat(response.contentUtf8()).startsWith("Bearer ");
+        }
+    }
+
+    private static String bootstrapYaml() {
+        final URI ztsUri = athenz.ztsUri();
+        final String serviceCertFile =
+                ATHENZ_RESOURCES + AthenzDocker.ATHENZ_CERTS + AthenzDocker.TEST_SERVICE + "/cert.pem";
+        final String serviceKeyFile =
+                ATHENZ_RESOURCES + AthenzDocker.ATHENZ_CERTS + AthenzDocker.TEST_SERVICE + "/key.pem";
+        final String caCertFile = ATHENZ_RESOURCES + AthenzDocker.CA_CERT_FILE;
+
+        //language=YAML
+        return """
+                static_resources:
+                  listeners:
+                    - name: %s
+                      api_listener:
+                        api_listener:
+                          "@type": type.googleapis.com/envoy.extensions.filters.network\
+                .http_connection_manager.v3.HttpConnectionManager
+                          stat_prefix: http
+                          route_config:
+                            name: local_route
+                            virtual_hosts:
+                              - name: local_service
+                                domains: ["*"]
+                                routes:
+                                  - match:
+                                      prefix: /
+                                    route:
+                                      cluster: echo-cluster
+                          http_filters:
+                            - name: athenz.access_token_target
+                              typed_config:
+                                "@type": type.googleapis.com/jp.co.lycorp.ftd.athenz\
+                .v1.AccessTokenTargetConfig
+                                zts_cluster_name: zts-cluster
+                                access_token_target:
+                                  target_domain: %s
+                                  target_roles: ["%s"]
+                                  syntax_version: 1
+                            - name: envoy.filters.http.router
+                  clusters:
+                    - name: echo-cluster
+                      type: STATIC
+                      load_assignment:
+                        cluster_name: echo-cluster
+                        endpoints:
+                          - lb_endpoints:
+                              - endpoint:
+                                  address:
+                                    socket_address:
+                                      address: %s
+                                      port_value: %d
+                    - name: zts-cluster
+                      type: STATIC
+                      load_assignment:
+                        cluster_name: zts-cluster
+                        endpoints:
+                          - lb_endpoints:
+                              - endpoint:
+                                  address:
+                                    socket_address:
+                                      address: %s
+                                      port_value: %d
+                      transport_socket:
+                        name: envoy.transport_sockets.tls
+                        typed_config:
+                          "@type": type.googleapis.com/envoy.extensions.transport_sockets\
+                .tls.v3.UpstreamTlsContext
+                          common_tls_context:
+                            tls_certificates:
+                              - certificate_chain:
+                                  filename: '%s'
+                                private_key:
+                                  filename: '%s'
+                            validation_context:
+                              trusted_ca:
+                                filename: '%s'
+                """.formatted(
+                LISTENER_NAME,
+                AthenzDocker.TEST_DOMAIN_NAME, AthenzDocker.USER_ROLE,
+                echoServer.httpSocketAddress().getHostString(), echoServer.httpPort(),
+                ztsUri.getHost(), ztsUri.getPort(),
+                serviceCertFile, serviceKeyFile, caCertFile);
+    }
+}

settings.gradle

@@ -220,6 +220,7 @@ includeWithFlags ':tomcat8',                             'java', 'publish', 'rel
 includeWithFlags ':tomcat9',                             'java', 'publish', 'relocate', 'no_aggregation'
 includeWithFlags ':tomcat10',                            'java11', 'publish', 'relocate'
 includeWithFlags ':xds',                                 'java', 'publish', 'relocate'
+includeWithFlags ':xds-athenz',                          'java11', 'publish', 'relocate'
 includeWithFlags ':xds-api',                             'java', 'publish', 'relocate', 'javapgv', 'no_aggregation'
 includeWithFlags ':xds-validator',                       'java', 'publish', 'relocate', 'no_aggregation'
 includeWithFlags ':xds-pgv-shaded',                      'java', 'publish', 'relocate', 'no_aggregation'

xds-api/src/main/proto/armeria/xds/athenz/athenz_access_token.proto

@@ -0,0 +1,91 @@
+syntax = "proto3";
+
+package jp.co.lycorp.ftd.athenz.v1;
+
+import "validate/validate.proto";
+import "envoy/type/matcher/v3/string.proto";
+
+// Athenz authorization metadata carried in xDS filter_metadata under the
+// jp.co.lycorp.ftd.athenz.v1 namespace.
+// - AccessTokenTarget     (outbound): which domain/roles to fetch a token for.
+// - AccessTokenConstraint (inbound):  which domain to evaluate, plus an optional
+//                                     per-request action/resource mapping.
+
+// Request attributes usable in inbound mapping conditions and templates.
+// HTTP-level only: these are available to both a proxy and a library client.
+// Connection-level attributes (protocol/port/SNI/ALPN) are excluded because a
+// library data plane cannot supply them.
+enum WellKnownEndpointAttribute {
+  WELL_KNOWN_ENDPOINT_ATTRIBUTE_UNSPECIFIED = 0;
+  WELL_KNOWN_ENDPOINT_ATTRIBUTE_HOST = 1;          // :authority
+  WELL_KNOWN_ENDPOINT_ATTRIBUTE_METHOD = 2;        // :method
+  WELL_KNOWN_ENDPOINT_ATTRIBUTE_PATH = 3;          // :path, no query
+  // 4 was QUERY_STRING; deferred. Query attributes are out of v1 scope.
+}
+
+message EndpointAttribute {
+  oneof attribute {
+    option (validate.required) = true;
+    WellKnownEndpointAttribute well_known = 1
+    [(validate.rules).enum = {defined_only: true not_in: 0}];
+    // Implementation-specific attribute name, documented per syntax_version.
+    string custom = 2 [(validate.rules).string = {min_len: 1}];
+  }
+}
+
+// Placeholders: ${host|method|path}, ${custom.<name>},
+// ${match.<name>.<index>}; $$ is a literal $. Unknown or missing -> rule fails.
+message StringTemplate {
+  string template = 1 [(validate.rules).string = {min_len: 1}];
+}
+
+message MappingString {
+  oneof string_specifier {
+    option (validate.required) = true;
+    string literal = 1 [(validate.rules).string = {min_len: 1}];
+    StringTemplate template = 2 [(validate.rules).message = {required: true}];
+  }
+}
+
+message EndpointAttributeMatch {
+  // Capture namespace referenced from templates as ${match.<name>.<index>}.
+  string name = 1;
+  EndpointAttribute attribute = 2 [(validate.rules).message = {required: true}];
+  envoy.type.matcher.v3.StringMatcher matcher = 3
+  [(validate.rules).message = {required: true}];
+}
+
+// All conditions must match (empty = match all); rules are tried in order,
+// first match wins.
+message AssertionMappingRule {
+  string name = 1;
+  repeated EndpointAttributeMatch conditions = 2;
+  MappingString action = 3 [(validate.rules).message = {required: true}];
+  MappingString resource = 4 [(validate.rules).message = {required: true}];
+}
+
+// No matching rule, or a rule whose action/resource fails to resolve -> deny.
+message AssertionMapping {
+  repeated AssertionMappingRule rules = 1
+  [(validate.rules).repeated = {min_items: 1}];
+}
+
+// Outbound: token to acquire for a destination. Static per cluster; routing
+// selects the cluster, so there is no per-request mapping here.
+message AccessTokenTarget {
+  string target_domain = 1 [(validate.rules).string = {min_len: 1}];
+  // Roles included in the token scope; usually one.
+  repeated string target_roles = 2
+  [(validate.rules).repeated = {min_items: 1, items {string {min_len: 1}}}];
+  // Consumers reject versions they do not implement.
+  uint32 syntax_version = 3 [(validate.rules).uint32 = {gte: 1}];
+}
+
+// Inbound: token evaluation for a listener.
+message AccessTokenConstraint {
+  string constraint_domain = 1 [(validate.rules).string = {min_len: 1}];
+  uint32 syntax_version = 2 [(validate.rules).uint32 = {gte: 1}];
+  // Optional explicit rules for (action, resource). When unset, the default
+  // mapping applies: action = lower(method), resource = request path.
+  AssertionMapping assertion_mapping = 3;
+}

xds-api/src/main/proto/armeria/xds/athenz/athenz_filter_config.proto

@@ -0,0 +1,18 @@
+syntax = "proto3";
+
+package jp.co.lycorp.ftd.athenz.v1;
+
+import "validate/validate.proto";
+import "armeria/xds/athenz/athenz_access_token.proto";
+
+// Outbound filter config: injects an Athenz access token into requests.
+message AccessTokenTargetConfig {
+  string zts_cluster_name = 1 [(validate.rules).string = {min_len: 1}];
+  AccessTokenTarget access_token_target = 2 [(validate.rules).message = {required: true}];
+}
+
+// Inbound filter config: authorizes requests using Athenz access tokens.
+message AccessTokenConstraintConfig {
+  string zts_cluster_name = 1 [(validate.rules).string = {min_len: 1}];
+  AccessTokenConstraint access_token_constraint = 2 [(validate.rules).message = {required: true}];
+}

xds-athenz/build.gradle

@@ -0,0 +1,4 @@
+dependencies {
+    api project(':xds')
+    api project(':athenz')
+}