schema_validator_tool errors on valid envoy.extensions.common.matching.v3.ExtensionWithMatcher configuration

[phamann]

Title: schema_validator_tool errors on valid envoy.extensions.common.matching.v3.ExtensionWithMatcher configuration

Description:
The schema_validator_tool errors on a valid, reduced test case, configuration of the envoy.extensions.common.matching.v3.ExtensionWithMatcher, with an INVALID_ARGUMENT: could not find @type 'type.googleapis.com/envoy.extensions.common.matching.v3.ExtensionWithMatcher') error message.

Repro steps:
Use the example configuration, taken directly from the public docs for Matching API: Match Tree Validation, and pass to the schema_validator_tool, such as schema_validator_tool --schema-type bootstrap --config-path test.yaml and the validator will return an error.

https://www.envoyproxy.io/docs/envoy/v1.32.0/intro/arch_overview/advanced/matching/matching_api#match-tree-validation

This configuration is valid and works when ran via envoy --mode serve or envoy --mode validate.

Config:

static_resources:
  listeners:
  - address:
      socket_address:
        address: 0.0.0.0
        port_value: 443
    listener_filters:
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          http_filters:
          - name: with-matcher
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.common.matching.v3.ExtensionWithMatcher
              extension_config:
                name: envoy.filters.http.fault
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
                  abort:
                    http_status: 503
                    percentage:
                      numerator: 0
                      denominator: HUNDRED
                  delay:
                    fixed_delay: 3s
                    percentage:
                      numerator: 0
                      denominator: HUNDRED
              xds_matcher:
                matcher_list:
                  matchers:
                  - predicate:
                      or_matcher:
                        predicate:
                        - single_predicate:
                            input:
                              name: request-headers
                              typed_config:
                                "@type": type.googleapis.com/envoy.type.matcher.v3.HttpRequestHeaderMatchInput
                                header_name: request-header
                            value_match:
                              exact: foo
                        - single_predicate:
                            input:
                              name: request-headers
                              typed_config:
                                "@type": type.googleapis.com/envoy.type.matcher.v3.HttpResponseHeaderMatchInput
                                header_name: response-header
                            value_match:
                              exact: bar
                    on_match:
                      action:
                        name: skip
                        typed_config:
                          "@type": type.googleapis.com/envoy.extensions.filters.common.matcher.action.v3.SkipFilter
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
          route_config:
            virtual_hosts:
            - name: default
              domains: ["*"]
              routes:
              - match: {prefix: "/"}
                route:
                  cluster: service_foo
  clusters:
  - name: service_foo
    load_assignment:
      cluster_name: some_service
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: 127.0.0.1
                port_value: 8080

Logs:

Unable to parse JSON as proto (INVALID_ARGUMENT: could not find @type 'type.googleapis.com/envoy.extensions.common.matching.v3.ExtensionWithMatcher'): {"static_resources":{"clusters":[{"load_assignment":{"cluster_name":"some_service","endpoints":[{"lb_endpoints":[{"en
dpoint":{"address":{"socket_address":{"port_value":8080,"address":"127.0.0.1"}}}}]}]},"name":"service_foo"}],"listeners":[{"address":{"socket_address":{"port_value":443,"address":"0.0.0.0"}},"listener_filters":null,"filter_chains":[{"filters":[{"name":"envoy.filters.n
etwork.http_connection_manager","typed_config":{"stat_prefix":"ingress_http","route_config":{"virtual_hosts":[{"routes":[{"route":{"cluster":"service_foo"},"match":{"prefix":"/"}}],"domains":["*"],"name":"default"}]},"http_filters":[{"name":"with-matcher","typed_confi
g":{"xds_matcher":{"matcher_list":{"matchers":[{"predicate":{"or_matcher":{"predicate":[{"single_predicate":{"input":{"typed_config":{"@type":"type.googleapis.com/envoy.type.matcher.v3.HttpRequestHeaderMatchInput","header_name":"request-header"},"name":"request-header
s"},"value_match":{"exact":"foo"}}},{"single_predicate":{"input":{"name":"request-headers","typed_config":{"header_name":"response-header","@type":"type.googleapis.com/envoy.type.matcher.v3.HttpResponseHeaderMatchInput"}},"value_match":{"exact":"bar"}}}]}},"on_match":
{"action":{"name":"skip","typed_config":{"@type":"type.googleapis.com/envoy.extensions.filters.common.matcher.action.v3.SkipFilter"}}}}]}},"@type":"type.googleapis.com/envoy.extensions.common.matching.v3.ExtensionWithMatcher","extension_config":{"name":"envoy.filters.
http.fault","typed_config":{"abort":{"percentage":{"numerator":0,"denominator":"HUNDRED"},"http_status":503},"delay":{"fixed_delay":"3s","percentage":{"numerator":0,"denominator":"HUNDRED"}},"@type":"type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
"}}}},{"typed_config":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"},"name":"envoy.filters.http.router"}],"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"}}]}]}]}}

[nezdolik]

cc @phlax @mattklein123

[phamann]

@phlax @mattklein123 Hey. I'm happy to try and PR a fix for this if you could give me some pointers into what area the issue may be in the codebase. I'm assuming somewhere in or a dependancy of test/tools/schema_validator/validator.cc?.

This is reducing our confidence in our Envoy configuration deployments as we can no longer run the schema validator in CI due to this error.

[phlax]

are you sure you are using a schema_validator_tool built for the correct version?

this works for me:

$ docker run -u1000 -v $PWD/docs/root/intro/arch_overview/advanced/matching/_include/complicated.yaml:/workspace/envoy.yaml -it --rm envoyproxy/envoy:tools-dev schema_validator_tool -t bootstrap -c /workspace/envoy.yaml
Validating: /workspace/envoy.yaml

[phamann]

@phlax your above command fails for me on main.

$ git clone [email protected]:envoyproxy/envoy
$ cd envoy
$ docker run -u1000 -v $PWD/docs/root/intro/arch_overview/advanced/matching/_include/complicated.yaml:/workspace/envoy.yaml -it --rm envoyproxy/envoy:tools-dev schema_validator_tool -t bootstrap -c /w
orkspace/envoy.yaml
Unable to find image 'envoyproxy/envoy:tools-dev' locally
tools-dev: Pulling from envoyproxy/envoy
a186900671ab: Pull complete
4c91c271afe1: Pull complete
fc0025bdf5c0: Pull complete
59049ab27e5c: Pull complete
dea117be6612: Pull complete
75be11fbe7be: Pull complete
9d8dff7393be: Pull complete
3a1ac85964ea: Pull complete
4f4fb700ef54: Pull complete
8e93de2edae8: Pull complete
Digest: sha256:c102de1b98647d60c52f70a115616064073ea2534b1c176879d68d6c4b7bd8a7
Status: Downloaded newer image for envoyproxy/envoy:tools-dev
Validating: /workspace/envoy.yaml
Unable to parse JSON as proto (INVALID_ARGUMENT: could not find @type 'type.googleapis.com/envoy.extensions.common.matching.v3.ExtensionWithMatcher'): {"static_resources":{"listeners":[{"filter_chains
":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typed_config":{"stat_prefix":"ingress_http","http_filters":[{"name":"with-matcher","typed_config":{"extension_config":{"name":"e
nvoy.filters.http.fault","typed_config":{"@type":"type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault","delay":{"percentage":{"denominator":"HUNDRED","numerator":0},"fixed_delay":"3s"
},"abort":{"percentage":{"denominator":"HUNDRED","numerator":0},"http_status":503}}},"@type":"type.googleapis.com/envoy.extensions.common.matching.v3.ExtensionWithMatcher","xds_matcher":{"matcher_tree
":{"exact_match_map":{"map":{"some_value_to_match_on":{"matcher":{"matcher_list":{"matchers":[{"on_match":{"action":{"name":"skip","typed_config":{"@type":"type.googleapis.com/envoy.extensions.filters
.common.matcher.action.v3.SkipFilter"}}},"predicate":{"or_matcher":{"predicate":[{"single_predicate":{"value_match":{"exact":"foo"},"input":{"name":"request-headers","typed_config":{"@type":"type.goog
leapis.com/envoy.type.matcher.v3.HttpRequestHeaderMatchInput","header_name":"second-header"}}}},{"single_predicate":{"value_match":{"exact":"bar"},"input":{"name":"request-headers","typed_config":{"@t
ype":"type.googleapis.com/envoy.type.matcher.v3.HttpRequestHeaderMatchInput","header_name":"second-header"}}}}]}}}]}}}}},"input":{"typed_config":{"@type":"type.googleapis.com/envoy.type.matcher.v3.Htt
pRequestHeaderMatchInput","header_name":"some-header"},"name":"request-headers"}}}}},{"name":"envoy.filters.http.router","typed_config":{"@type":"type.googleapis.com/envoy.extensions.filters.http.rout
er.v3.Router"}}],"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","route_config":{"virtual_hosts":[{"domains":["*"],"routes":[{"match":{"
prefix":"/"},"route":{"cluster":"service_foo"}}],"name":"default"}]}}}]}],"address":{"socket_address":{"address":"0.0.0.0","port_value":443}},"listener_filters":null}],"clusters":[{"name":"service_foo
","load_assignment":{"cluster_name":"some_service","endpoints":[{"lb_endpoints":[{"endpoint":{"address":{"socket_address":{"port_value":8080,"address":"127.0.0.1"}}}}]}]}}]}}

[phlax]

i see - my version of the container was out of date - with latest it also fails - lmc where this started failing

fwiw i tried this way as the referenced config is tested with this tool (at least its lib i think) in ci so confusing that it would fail with the published tool

[phlax]

passes with v1.29 version but fails on all other versions since

[phlax]

ive bisected the failing change to ef0a5b2 (updated)

cc @alyssawilk

[phamann]

Thank you @alyssawilk and @phlax 🙇🏻