Bootstrap

简要概述

这里是 envoy 配置的定义。

proto 定义

Envoy 配置结构在源代码中使用 proto 定义,主要结构如下:

Bootstrap

message Bootstrap {
  ...

  // Statically specified resources.
  StaticResources static_resources = 2;

  ...

  // Configuration for the local administration HTTP server.
  Admin admin = 12;

  ...
}
message StaticResources {
  option (udpa.annotations.versioning).previous_message_type =
      "envoy.config.bootstrap.v2.Bootstrap.StaticResources";

  // Static :ref:`Listeners <envoy_v3_api_msg_config.listener.v3.Listener>`. These listeners are
  // available regardless of LDS configuration.
  repeated listener.v3.Listener listeners = 1;

  // If a network based configuration source is specified for :ref:`cds_config
  // <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.DynamicResources.cds_config>`, it's necessary
  // to have some initial cluster definitions available to allow Envoy to know
  // how to speak to the management server. These cluster definitions may not
  // use :ref:`EDS <arch_overview_dynamic_config_eds>` (i.e. they should be static
  // IP or DNS-based).
  repeated cluster.v3.Cluster clusters = 2;

  // These static secrets can be used by :ref:`SdsSecretConfig
  // <envoy_v3_api_msg_extensions.transport_sockets.tls.v3.SdsSecretConfig>`
  repeated envoy.extensions.transport_sockets.tls.v3.Secret secrets = 3;
}
message Admin {
  option (udpa.annotations.versioning).previous_message_type = "envoy.config.bootstrap.v2.Admin";

  // Configuration for :ref:`access logs <arch_overview_access_logs>`
  // emitted by the administration server.
  repeated accesslog.v3.AccessLog access_log = 5;

  // The path to write the access log for the administration server. If no
  // access log is desired specify ‘/dev/null’. This is only required if
  // :ref:`address <envoy_v3_api_field_config.bootstrap.v3.Admin.address>` is set.
  // Deprecated in favor of ``access_log`` which offers more options.
  string access_log_path = 1
      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];

  // The cpu profiler output path for the administration server. If no profile
  // path is specified, the default is ‘/var/log/envoy/envoy.prof’.
  string profile_path = 2;

  // The TCP address that the administration server will listen on.
  // If not specified, Envoy will not start an administration server.
  core.v3.Address address = 3;

  // Additional socket options that may not be present in Envoy source code or
  // precompiled binaries.
  repeated core.v3.SocketOption socket_options = 4;

  // Indicates whether :ref:`global_downstream_max_connections <config_overload_manager_limiting_connections>`
  // should apply to the admin interface or not.
  bool ignore_global_conn_limit = 6;
}

完整信息查看 bootstrap.proto 定义。

StaticResources

listener.v3.Listener

TODO;

cluster.v3.Cluster

github.com/envoyproxy/envoy/api/envoy/config/cluster/v3/cluster.proto

message Cluster {
  ......
  // Supplies the name of the cluster which must be unique across all clusters.
  // The cluster name is used when emitting  
  // 集群名称,必须是唯一的
  string name = 1 [(validate.rules).string = {min_len: 1}];

  oneof cluster_discovery_type {
    // The :ref:`service discovery type <arch_overview_service_discovery_types>`
    // to use for resolving the cluster.
    DiscoveryType type = 2 [(validate.rules).enum = {defined_only: true}];

    // The custom cluster type.
    CustomClusterType cluster_type = 38;
  }  

  // Configuration to use for EDS updates for the Cluster.
  EdsClusterConfig eds_cluster_config = 3;

  // The timeout for new network connections to hosts in the cluster.
  // If not set, a default value of 5s will be used.
  google.protobuf.Duration connect_timeout = 4 [(validate.rules).duration = {gt {}}];

  // Soft limit on size of the cluster’s connections read and write buffers. If
  // unspecified, an implementation defined default is applied (1MiB).
  google.protobuf.UInt32Value per_connection_buffer_limit_bytes = 5
      [(udpa.annotations.security).configure_for_untrusted_upstream = true];

  // The :ref:`load balancer type <arch_overview_load_balancing_types>` to use
  // when picking a host in the cluster.
  LbPolicy lb_policy = 6 [(validate.rules).enum = {defined_only: true}];

  // Setting this is required for specifying members of
  // :ref:`STATIC<envoy_v3_api_enum_value_config.cluster.v3.Cluster.DiscoveryType.STATIC>`,
  // :ref:`STRICT_DNS<envoy_v3_api_enum_value_config.cluster.v3.Cluster.DiscoveryType.STRICT_DNS>`
  // or :ref:`LOGICAL_DNS<envoy_v3_api_enum_value_config.cluster.v3.Cluster.DiscoveryType.LOGICAL_DNS>` clusters.
  // This field supersedes the ``hosts`` field in the v2 API.
  //
  // .. attention::
  //
  //   Setting this allows non-EDS cluster types to contain embedded EDS equivalent
  //   :ref:`endpoint assignments<envoy_v3_api_msg_config.endpoint.v3.ClusterLoadAssignment>`.
  //
  endpoint.v3.ClusterLoadAssignment load_assignment = 33;

  // Optional :ref:`active health checking <arch_overview_health_checking>`
  // configuration for the cluster. If no
  // configuration is specified no health checking will be done and all cluster
  // members will be considered healthy at all times.
  repeated core.v3.HealthCheck health_checks = 8;

  ......

  // The DNS IP address resolution policy. If this setting is not specified, the
  // value defaults to
  // :ref:`AUTO<envoy_v3_api_enum_value_config.cluster.v3.Cluster.DnsLookupFamily.AUTO>`.
  // 支持的网络协议栈,如 V4_ONLY、V6_ONLY、ALL,分别仅支持 IPv4、IPv6、IPv4 与 IPv6
  DnsLookupFamily dns_lookup_family = 17 [(validate.rules).enum = {defined_only: true}];

  ......

  // Optional custom transport socket implementation to use for upstream connections.
  // To setup TLS, set a transport socket with name ``envoy.transport_sockets.tls`` and
  // :ref:`UpstreamTlsContexts <envoy_v3_api_msg_extensions.transport_sockets.tls.v3.UpstreamTlsContext>` in the ``typed_config``.
  // If no transport socket configuration is specified, new connections
  // will be set up with plaintext.
  core.v3.TransportSocket transport_socket = 24;

  ......
}

endpoint.v3.ClusterLoadAssignment

github.com/envoyproxy/envoy/api/envoy/config/endpoint/v3/endpoint.proto

message ClusterLoadAssignment {
  ......

  // Name of the cluster. This will be the :ref:`service_name
  // <envoy_v3_api_field_config.cluster.v3.Cluster.EdsClusterConfig.service_name>` value if specified
  // in the cluster :ref:`EdsClusterConfig
  // <envoy_v3_api_msg_config.cluster.v3.Cluster.EdsClusterConfig>`.
  string cluster_name = 1 [(validate.rules).string = {min_len: 1}];

  // List of endpoints to load balance to.
  repeated LocalityLbEndpoints endpoints = 2;

  // Map of named endpoints that can be referenced in LocalityLbEndpoints.
  // [#not-implemented-hide:]
  map<string, Endpoint> named_endpoints = 5;

  // Load balancing policy settings.
  Policy policy = 4;
}

core.v3.HealthCheck

api/envoy/config/core/v3/health_check.proto

https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/health_check.proto

Admin

TODO;




最后修改 2024.02.07: docs: add security.md (8158e6f)