refactor xds resource subscription

chickenlj · Sep 2, 2024 · d9ff0da · d9ff0da
1 parent f11579b
commit d9ff0da
Show file tree

Hide file tree

Showing 31 changed files with 1,056 additions and 797 deletions.
diff --git a/dubbo-demo/dubbo-demo-xds/dubbo-demo-xds-consumer/pom.xml b/dubbo-demo/dubbo-demo-xds/dubbo-demo-xds-consumer/pom.xml
@@ -37,6 +37,12 @@
       <version>${project.parent.version}</version>
     </dependency>
 
+    <dependency>
+      <groupId>org.apache.dubbo</groupId>
+      <artifactId>dubbo-remoting-http3</artifactId>
+      <version>${project.parent.version}</version>
+    </dependency>
+
     <dependency>
       <groupId>org.apache.dubbo</groupId>
       <artifactId>dubbo-triple-servlet</artifactId>

diff --git a/...xds-consumer/src/main/java/org/apache/dubbo/xds/demo/consumer/XdsConsumerApplication.java b/...xds-consumer/src/main/java/org/apache/dubbo/xds/demo/consumer/XdsConsumerApplication.java
@@ -29,7 +29,7 @@
 @Service
 @EnableDubbo
 public class XdsConsumerApplication {
-    @DubboReference(providedBy = "dubbo-demo-xds-provider")
+    @DubboReference(providedBy = "echo:7070")
     private DemoService demoService;
 
     public static void main(String[] args) throws InterruptedException {

diff --git a/dubbo-demo/dubbo-demo-xds/dubbo-demo-xds-consumer/src/main/resources/application.yml b/dubbo-demo/dubbo-demo-xds/dubbo-demo-xds-consumer/src/main/resources/application.yml
@@ -26,6 +26,6 @@ dubbo:
     name: tri
     port: 50050
   registry:
-    address: xds://istiod.istio-system.svc:15010?security=plaintext # istio://istiod.istio-system.svc:15012
+    address: xds://47.251.12.148:15010?security=plaintext # istio://istiod.istio-system.svc:15012
 
 
diff --git a/dubbo-demo/dubbo-demo-xds/dubbo-demo-xds-consumer/src/main/resources/bootstrap.json b/dubbo-demo/dubbo-demo-xds/dubbo-demo-xds-consumer/src/main/resources/bootstrap.json
@@ -0,0 +1,92 @@
+{
+  "xds_servers": [
+    {
+      "server_uri": "47.251.12.148:15010",
+      "channel_creds": [
+        {
+          "type": "insecure"
+        }
+      ],
+      "server_features": [
+        "xds_v3"
+      ]
+    }
+  ],
+  "node": {
+    "id": "sidecar~192.168.19.141~echo-v1-5764868574-whqs9.echo-grpc~echo-grpc.svc.cluster.local",
+    "metadata": {
+      "ANNOTATIONS": {
+        "inject.istio.io/templates": "grpc-agent",
+        "istio.io/rev": "default",
+        "kubectl.kubernetes.io/default-container": "app",
+        "kubectl.kubernetes.io/default-logs-container": "app",
+        "kubernetes.io/config.seen": "2024-07-02T17:22:26.354582057+08:00",
+        "kubernetes.io/config.source": "api",
+        "prometheus.io/path": "/stats/prometheus",
+        "prometheus.io/port": "15020",
+        "prometheus.io/scrape": "true",
+        "proxy.istio.io/config": "{\"holdApplicationUntilProxyStarts\": true}",
+        "proxy.istio.io/overrides": "{\"containers\":[{\"name\":\"app\",\"image\":\"gcr.io/istio-testing/app:latest\",\"args\":[\"--metrics=15014\",\"--port\",\"18080\",\"--tcp\",\"19090\",\"--xds-grpc-server=17070\",\"--grpc\",\"17070\",\"--grpc\",\"17171\",\"--port\",\"3333\",\"--port\",\"8080\",\"--version\",\"v1\",\"--crt=/cert.crt\",\"--key=/cert.key\"],\"ports\":[{\"containerPort\":17070,\"protocol\":\"TCP\"},{\"containerPort\":17171,\"protocol\":\"TCP\"},{\"containerPort\":8080,\"protocol\":\"TCP\"},{\"name\":\"tcp-health-port\",\"containerPort\":3333,\"protocol\":\"TCP\"}],\"env\":[{\"name\":\"INSTANCE_IP\",\"valueFrom\":{\"fieldRef\":{\"apiVersion\":\"v1\",\"fieldPath\":\"status.podIP\"}}}],\"resources\":{},\"volumeMounts\":[{\"name\":\"kube-api-access-4qkzb\",\"readOnly\":true,\"mountPath\":\"/var/run/secrets/kubernetes.io/serviceaccount\"}],\"livenessProbe\":{\"tcpSocket\":{\"port\":\"tcp-health-port\"},\"initialDelaySeconds\":10,\"timeoutSeconds\":1,\"periodSeconds\":10,\"successThreshold\":1,\"failureThreshold\":10},\"readinessProbe\":{\"httpGet\":{\"path\":\"/\",\"port\":8080,\"scheme\":\"HTTP\"},\"initialDelaySeconds\":1,\"timeoutSeconds\":1,\"periodSeconds\":2,\"successThreshold\":1,\"failureThreshold\":10},\"startupProbe\":{\"tcpSocket\":{\"port\":\"tcp-health-port\"},\"timeoutSeconds\":1,\"periodSeconds\":10,\"successThreshold\":1,\"failureThreshold\":10},\"terminationMessagePath\":\"/dev/termination-log\",\"terminationMessagePolicy\":\"File\",\"imagePullPolicy\":\"Always\"}]}",
+        "sidecar.istio.io/rewriteAppHTTPProbers": "false",
+        "sidecar.istio.io/status": "{\"initContainers\":null,\"containers\":[\"istio-proxy\",\"app\"],\"volumes\":[\"workload-socket\",\"workload-certs\",\"istio-xds\",\"istio-data\",\"istio-podinfo\",\"istiod-ca-cert\"],\"imagePullSecrets\":null,\"revision\":\"default\"}"
+      },
+      "APP_CONTAINERS": "app",
+      "CLUSTER_ID": "Kubernetes",
+      "ENVOY_PROMETHEUS_PORT": 15090,
+      "ENVOY_STATUS_PORT": 15021,
+      "GENERATOR": "grpc",
+      "INSTANCE_IPS": "192.168.19.141",
+      "ISTIO_PROXY_SHA": "7b292c7175692c822148b64005a731eb00365508",
+      "ISTIO_VERSION": "1.20.2",
+      "LABELS": {
+        "app": "echo",
+        "service.istio.io/canonical-name": "echo",
+        "service.istio.io/canonical-revision": "v1",
+        "version": "v1"
+      },
+      "MESH_ID": "cluster.local",
+      "NAME": "echo-v1-5859d7bc7d-wlb2d",
+      "NAMESPACE": "echo-grpc",
+      "NODE_NAME": "us-west-1.192.168.19.107",
+      "OWNER": "kubernetes://apis/apps/v1/namespaces/echo-grpc/deployments/echo-v1",
+      "PILOT_SAN": [
+        "istiod.istio-system.svc"
+      ],
+      "POD_PORTS": "[{\"containerPort\":17070,\"protocol\":\"TCP\"},{\"containerPort\":17171,\"protocol\":\"TCP\"},{\"containerPort\":8080,\"protocol\":\"TCP\"},{\"name\":\"tcp-health-port\",\"containerPort\":3333,\"protocol\":\"TCP\"}]",
+      "PROXY_CONFIG": {
+        "binaryPath": "/usr/local/bin/envoy",
+        "configPath": "./etc/istio/proxy",
+        "controlPlaneAuthPolicy": "MUTUAL_TLS",
+        "discoveryAddress": "istiod.istio-system.svc:15012",
+        "drainDuration": "45s",
+        "holdApplicationUntilProxyStarts": true,
+        "proxyAdminPort": 15000,
+        "serviceCluster": "istio-proxy",
+        "statNameLength": 189,
+        "statusPort": 15020,
+        "terminationDrainDuration": "5s",
+        "tracing": {
+          "zipkin": {
+            "address": "zipkin.istio-system:9411"
+          }
+        }
+      },
+      "SERVICE_ACCOUNT": "default",
+      "WORKLOAD_NAME": "echo-v1"
+    },
+    "locality": {},
+    "UserAgentVersionType": null
+  },
+  "certificate_providers": {
+    "default": {
+      "plugin_name": "file_watcher",
+      "config": {
+        "certificate_file": "/var/lib/istio/data/cert-chain.pem",
+        "private_key_file": "/var/lib/istio/data/key.pem",
+        "ca_certificate_file": "/var/lib/istio/data/root-cert.pem",
+        "refresh_interval": "900s"
+      }
+    }
+  },
+  "server_listener_resource_name_template": "xds.istio.io/grpc/lds/inbound/%s"
+}
diff --git a/dubbo-demo/dubbo-demo-xds/dubbo-demo-xds-provider/src/main/resources/application.yml b/dubbo-demo/dubbo-demo-xds/dubbo-demo-xds-provider/src/main/resources/application.yml
@@ -26,4 +26,4 @@ dubbo:
     name: tri
     port: 50051
   registry:
-    address: xds://istiod.istio-system.svc:15010?security=plaintext # istio://istiod.istio-system.svc:15012
+    address: xds://47.251.12.148:15010?security=plaintext # istio://istiod.istio-system.svc:15012
diff --git a/dubbo-demo/dubbo-demo-xds/dubbo-demo-xds-provider/src/main/resources/bootstrap.json b/dubbo-demo/dubbo-demo-xds/dubbo-demo-xds-provider/src/main/resources/bootstrap.json
@@ -0,0 +1,92 @@
+{
+  "xds_servers": [
+    {
+      "server_uri": "47.251.12.148:15010",
+      "channel_creds": [
+        {
+          "type": "insecure"
+        }
+      ],
+      "server_features": [
+        "xds_v3"
+      ]
+    }
+  ],
+  "node": {
+    "id": "sidecar~192.168.19.141~echo-v1-5764868574-whqs9.echo-grpc~echo-grpc.svc.cluster.local",
+    "metadata": {
+      "ANNOTATIONS": {
+        "inject.istio.io/templates": "grpc-agent",
+        "istio.io/rev": "default",
+        "kubectl.kubernetes.io/default-container": "app",
+        "kubectl.kubernetes.io/default-logs-container": "app",
+        "kubernetes.io/config.seen": "2024-07-02T17:22:26.354582057+08:00",
+        "kubernetes.io/config.source": "api",
+        "prometheus.io/path": "/stats/prometheus",
+        "prometheus.io/port": "15020",
+        "prometheus.io/scrape": "true",
+        "proxy.istio.io/config": "{\"holdApplicationUntilProxyStarts\": true}",
+        "proxy.istio.io/overrides": "{\"containers\":[{\"name\":\"app\",\"image\":\"gcr.io/istio-testing/app:latest\",\"args\":[\"--metrics=15014\",\"--port\",\"18080\",\"--tcp\",\"19090\",\"--xds-grpc-server=17070\",\"--grpc\",\"17070\",\"--grpc\",\"17171\",\"--port\",\"3333\",\"--port\",\"8080\",\"--version\",\"v1\",\"--crt=/cert.crt\",\"--key=/cert.key\"],\"ports\":[{\"containerPort\":17070,\"protocol\":\"TCP\"},{\"containerPort\":17171,\"protocol\":\"TCP\"},{\"containerPort\":8080,\"protocol\":\"TCP\"},{\"name\":\"tcp-health-port\",\"containerPort\":3333,\"protocol\":\"TCP\"}],\"env\":[{\"name\":\"INSTANCE_IP\",\"valueFrom\":{\"fieldRef\":{\"apiVersion\":\"v1\",\"fieldPath\":\"status.podIP\"}}}],\"resources\":{},\"volumeMounts\":[{\"name\":\"kube-api-access-4qkzb\",\"readOnly\":true,\"mountPath\":\"/var/run/secrets/kubernetes.io/serviceaccount\"}],\"livenessProbe\":{\"tcpSocket\":{\"port\":\"tcp-health-port\"},\"initialDelaySeconds\":10,\"timeoutSeconds\":1,\"periodSeconds\":10,\"successThreshold\":1,\"failureThreshold\":10},\"readinessProbe\":{\"httpGet\":{\"path\":\"/\",\"port\":8080,\"scheme\":\"HTTP\"},\"initialDelaySeconds\":1,\"timeoutSeconds\":1,\"periodSeconds\":2,\"successThreshold\":1,\"failureThreshold\":10},\"startupProbe\":{\"tcpSocket\":{\"port\":\"tcp-health-port\"},\"timeoutSeconds\":1,\"periodSeconds\":10,\"successThreshold\":1,\"failureThreshold\":10},\"terminationMessagePath\":\"/dev/termination-log\",\"terminationMessagePolicy\":\"File\",\"imagePullPolicy\":\"Always\"}]}",
+        "sidecar.istio.io/rewriteAppHTTPProbers": "false",
+        "sidecar.istio.io/status": "{\"initContainers\":null,\"containers\":[\"istio-proxy\",\"app\"],\"volumes\":[\"workload-socket\",\"workload-certs\",\"istio-xds\",\"istio-data\",\"istio-podinfo\",\"istiod-ca-cert\"],\"imagePullSecrets\":null,\"revision\":\"default\"}"
+      },
+      "APP_CONTAINERS": "app",
+      "CLUSTER_ID": "Kubernetes",
+      "ENVOY_PROMETHEUS_PORT": 15090,
+      "ENVOY_STATUS_PORT": 15021,
+      "GENERATOR": "grpc",
+      "INSTANCE_IPS": "192.168.19.141",
+      "ISTIO_PROXY_SHA": "7b292c7175692c822148b64005a731eb00365508",
+      "ISTIO_VERSION": "1.20.2",
+      "LABELS": {
+        "app": "echo",
+        "service.istio.io/canonical-name": "echo",
+        "service.istio.io/canonical-revision": "v1",
+        "version": "v1"
+      },
+      "MESH_ID": "cluster.local",
+      "NAME": "echo-v1-5859d7bc7d-wlb2d",
+      "NAMESPACE": "echo-grpc",
+      "NODE_NAME": "us-west-1.192.168.19.107",
+      "OWNER": "kubernetes://apis/apps/v1/namespaces/echo-grpc/deployments/echo-v1",
+      "PILOT_SAN": [
+        "istiod.istio-system.svc"
+      ],
+      "POD_PORTS": "[{\"containerPort\":17070,\"protocol\":\"TCP\"},{\"containerPort\":17171,\"protocol\":\"TCP\"},{\"containerPort\":8080,\"protocol\":\"TCP\"},{\"name\":\"tcp-health-port\",\"containerPort\":3333,\"protocol\":\"TCP\"}]",
+      "PROXY_CONFIG": {
+        "binaryPath": "/usr/local/bin/envoy",
+        "configPath": "./etc/istio/proxy",
+        "controlPlaneAuthPolicy": "MUTUAL_TLS",
+        "discoveryAddress": "istiod.istio-system.svc:15012",
+        "drainDuration": "45s",
+        "holdApplicationUntilProxyStarts": true,
+        "proxyAdminPort": 15000,
+        "serviceCluster": "istio-proxy",
+        "statNameLength": 189,
+        "statusPort": 15020,
+        "terminationDrainDuration": "5s",
+        "tracing": {
+          "zipkin": {
+            "address": "zipkin.istio-system:9411"
+          }
+        }
+      },
+      "SERVICE_ACCOUNT": "default",
+      "WORKLOAD_NAME": "echo-v1"
+    },
+    "locality": {},
+    "UserAgentVersionType": null
+  },
+  "certificate_providers": {
+    "default": {
+      "plugin_name": "file_watcher",
+      "config": {
+        "certificate_file": "/var/lib/istio/data/cert-chain.pem",
+        "private_key_file": "/var/lib/istio/data/key.pem",
+        "ca_certificate_file": "/var/lib/istio/data/root-cert.pem",
+        "refresh_interval": "900s"
+      }
+    }
+  },
+  "server_listener_resource_name_template": "xds.istio.io/grpc/lds/inbound/%s"
+}
diff --git a/.../dubbo-remoting-http3/src/main/java/org/apache/dubbo/remoting/http3/Http3SslContexts.java b/.../dubbo-remoting-http3/src/main/java/org/apache/dubbo/remoting/http3/Http3SslContexts.java
@@ -65,7 +65,7 @@ public static QuicSslContext buildServerSslContext(URL url) {
                         toX509Certificates(keyCertChainIn));
                 try (InputStream trustCertIn = cert.getTrustCertInputStream()) {
                     if (trustCertIn != null) {
-                        ClientAuth clientAuth = cert.getAuthPolicy() == AuthPolicy.CLIENT_AUTH
+                        ClientAuth clientAuth = cert.getAuthPolicy() == AuthPolicy.CLIENT_AUTH_STRICT
                                 ? ClientAuth.REQUIRE
                                 : ClientAuth.OPTIONAL;
                         builder.trustManager(toX509Certificates(trustCertIn)).clientAuth(clientAuth);