xds: decouple A76 and A86 EDS metadata parsing #8875
+98
−14
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The EDS metadata parsing was inadvertently coupling the A76 (ring hash endpoint hash key) and A86 (HTTP CONNECT) features. When either GRPC_XDS_ENDPOINT_HASH_KEY_BACKWARD_COMPAT was false (A76 enabled) or GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT was true (A86 enabled), the code would parse all metadata including TypedFilterMetadata with converters. This caused issues because: - A76 only needs FilterMetadata["envoy.lb"] for hash_key extraction - A86 needs TypedFilterMetadata with converters (e.g., for envoy.config.core.v3.Address) which can fail validation When A76 was enabled but A86 was disabled, invalid proxy addresses in TypedFilterMetadata would still cause NACKs, even though the user didn't care about HTTP CONNECT. This change makes TypedFilterMetadata processing conditional on GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT, so that A76 can be enabled independently without triggering A86-specific validation failures. Also adds test coverage for the previously untested combination of GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true with GRPC_XDS_ENDPOINT_HASH_KEY_BACKWARD_COMPAT=true. Release-note: Fix a bug where enabling A76 ring hash endpoint hash key feature would cause EDS resources to be NACKed if they contained invalid proxy address metadata, even when HTTP CONNECT (A86) was not enabled.
atollena
added
Area: xDS
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #8875 +/- ##
==========================================
- Coverage 83.28% 83.15% -0.13%
==========================================
Files 414 414
Lines 32751 32752 +1
==========================================
- Hits 27276 27236 -40
- Misses 4071 4094 +23
- Partials 1404 1422 +18
🚀 New features to boost your workflow:
|
arjan-bal
approved these changes
Feb 3, 2026
Contributor
arjan-bal
left a comment
arjan-bal
left a comment
There was a problem hiding this comment.
LGTM! Adding a second reviewer.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The EDS metadata parsing was inadvertently coupling the A76 (ring hash
endpoint hash key) and A86 (HTTP CONNECT) features. When either
GRPC_XDS_ENDPOINT_HASH_KEY_BACKWARD_COMPAT was false (A76 enabled) or
GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT was true (A86 enabled), the code would
parse all metadata including TypedFilterMetadata with converters.
This caused issues because:
envoy.config.core.v3.Address) which can fail validation
When A76 was enabled but A86 was disabled, invalid proxy addresses in
TypedFilterMetadata would still cause NACKs, even though the user didn't care
about HTTP CONNECT.
This change makes TypedFilterMetadata processing conditional on
GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT, so that A76 can be enabled independently
without triggering A86-specific validation failures.
RELEASE NOTES:
would cause EDS resources to be NACKed if they contained invalid proxy address
metadata, even when HTTP CONNECT (A86) was not enabled.