connect: add support for envoy 1.16.0, drop support for 1.12.x, and bump point releases as well (hashicorp#8944)

Supported versions will be: "1.16.0", "1.15.2", "1.14.5", "1.13.6"

Author: rboyer

.circleci/config.yml

@@ -739,13 +739,13 @@ jobs:
           command: bash <(curl -s https://codecov.io/bash) -v -c -C $CIRCLE_SHA1 -F ui
       - run: *notify-slack-failure
 
-  envoy-integration-test-1.12.6:
+  envoy-integration-test-1.13.6:
     docker:
       # We only really need bash and docker-compose which is installed on all
       # Circle images but pick Go since we have to pick one of them.
       - image: *GOLANG_IMAGE
     environment:
-      ENVOY_VERSION: "1.12.6"
+      ENVOY_VERSION: "1.13.6"
     steps: &ENVOY_INTEGRATION_TEST_STEPS
       - checkout
       # Get go binary from workspace
@@ -774,25 +774,25 @@ jobs:
           path: *TEST_RESULTS_DIR
       - run: *notify-slack-failure
 
-  envoy-integration-test-1.13.4:
+  envoy-integration-test-1.14.5:
     docker:
       - image: *GOLANG_IMAGE
     environment:
-      ENVOY_VERSION: "1.13.4"
+      ENVOY_VERSION: "1.14.5"
     steps: *ENVOY_INTEGRATION_TEST_STEPS
 
-  envoy-integration-test-1.14.4:
+  envoy-integration-test-1.15.2:
     docker:
       - image: *GOLANG_IMAGE
     environment:
-      ENVOY_VERSION: "1.14.4"
+      ENVOY_VERSION: "1.15.2"
     steps: *ENVOY_INTEGRATION_TEST_STEPS
 
-  envoy-integration-test-1.15.0:
+  envoy-integration-test-1.16.0:
     docker:
       - image: *GOLANG_IMAGE
     environment:
-      ENVOY_VERSION: "1.15.0"
+      ENVOY_VERSION: "1.16.0"
     steps: *ENVOY_INTEGRATION_TEST_STEPS
 
   # run integration tests for the connect ca providers
@@ -929,16 +929,16 @@ workflows:
       - nomad-integration-0_8:
           requires:
             - dev-build
-      - envoy-integration-test-1.12.6:
+      - envoy-integration-test-1.13.6:
           requires:
             - dev-build
-      - envoy-integration-test-1.13.4:
+      - envoy-integration-test-1.14.5:
           requires:
             - dev-build
-      - envoy-integration-test-1.14.4:
+      - envoy-integration-test-1.15.2:
           requires:
             - dev-build
-      - envoy-integration-test-1.15.0:
+      - envoy-integration-test-1.16.0:
           requires:
             - dev-build
   website:

agent/xds/envoy_versioning.go

@@ -11,24 +11,9 @@ import (
 var (
 	// minSupportedVersion is the oldest mainline version we support. This should always be
 	// the zero'th point release of the last element of proxysupport.EnvoyVersions.
-	minSupportedVersion = version.Must(version.NewVersion("1.12.0"))
+	minSupportedVersion = version.Must(version.NewVersion("1.13.0"))
 
 	specificUnsupportedVersions = []unsupportedVersion{
-		{
-			Version:   version.Must(version.NewVersion("1.12.0")),
-			UpgradeTo: "1.12.3+",
-			Why:       "does not support RBAC rules using url_path",
-		},
-		{
-			Version:   version.Must(version.NewVersion("1.12.1")),
-			UpgradeTo: "1.12.3+",
-			Why:       "does not support RBAC rules using url_path",
-		},
-		{
-			Version:   version.Must(version.NewVersion("1.12.2")),
-			UpgradeTo: "1.12.3+",
-			Why:       "does not support RBAC rules using url_path",
-		},
 		{
 			Version:   version.Must(version.NewVersion("1.13.0")),
 			UpgradeTo: "1.13.1+",

agent/xds/envoy_versioning_test.go

@@ -72,7 +72,6 @@ func TestDetermineEnvoyVersionFromNode(t *testing.T) {
 
 func TestDetermineSupportedProxyFeaturesFromString(t *testing.T) {
 	const (
-		err1_12   = "is too old of a point release and is not supported by Consul because it does not support RBAC rules using url_path. Please upgrade to version 1.12.3+."
 		err1_13   = "is too old of a point release and is not supported by Consul because it does not support RBAC rules using url_path. Please upgrade to version 1.13.1+."
 		errTooOld = "is too old and is not supported by Consul"
 	)
@@ -87,18 +86,22 @@ func TestDetermineSupportedProxyFeaturesFromString(t *testing.T) {
 		"1.9.0":  {expectErr: "Envoy 1.9.0 " + errTooOld},
 		"1.10.0": {expectErr: "Envoy 1.10.0 " + errTooOld},
 		"1.11.0": {expectErr: "Envoy 1.11.0 " + errTooOld},
-		"1.12.0": {expectErr: "Envoy 1.12.0 " + err1_12},
-		"1.12.1": {expectErr: "Envoy 1.12.1 " + err1_12},
-		"1.12.2": {expectErr: "Envoy 1.12.2 " + err1_12},
+		"1.12.0": {expectErr: "Envoy 1.12.0 " + errTooOld},
+		"1.12.1": {expectErr: "Envoy 1.12.1 " + errTooOld},
+		"1.12.2": {expectErr: "Envoy 1.12.2 " + errTooOld},
+		"1.12.3": {expectErr: "Envoy 1.12.3 " + errTooOld},
+		"1.12.4": {expectErr: "Envoy 1.12.4 " + errTooOld},
+		"1.12.5": {expectErr: "Envoy 1.12.5 " + errTooOld},
+		"1.12.6": {expectErr: "Envoy 1.12.6 " + errTooOld},
+		"1.12.7": {expectErr: "Envoy 1.12.7 " + errTooOld},
 		"1.13.0": {expectErr: "Envoy 1.13.0 " + err1_13},
 	}
 
 	// Insert a bunch of valid versions.
 	for _, v := range []string{
-		"1.12.3", "1.12.4", "1.12.5", "1.12.6", "1.12.7",
 		"1.13.1", "1.13.2", "1.13.3", "1.13.4", "1.13.6", "1.14.1",
 		"1.14.2", "1.14.3", "1.14.4", "1.14.5",
-		"1.15.0", "1.15.1", "1.15.2",
+		"1.15.0", "1.15.1", "1.15.2", "1.16.0",
 	} {
 		cases[v] = testcase{expect: supportedProxyFeatures{}}
 	}

agent/xds/proxysupport/proxysupport.go

@@ -7,8 +7,8 @@ package proxysupport
 //
 // see: https://www.consul.io/docs/connect/proxies/envoy#supported-versions
 var EnvoyVersions = []string{
-	"1.15.0",
-	"1.14.4",
-	"1.13.4",
-	"1.12.6",
+	"1.16.0",
+	"1.15.2",
+	"1.14.5",
+	"1.13.6",
 }

agent/xds/testdata/clusters/connect-proxy-lb-in-resolver.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/connect-proxy-lb-in-resolver.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/connect-proxy-with-chain-and-failover.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/connect-proxy-with-chain-and-failover.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/connect-proxy-with-chain-and-overrides.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/connect-proxy-with-chain-and-overrides.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/connect-proxy-with-chain-external-sni.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/connect-proxy-with-chain-external-sni.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/connect-proxy-with-chain.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/connect-proxy-with-chain.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway-triggered.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway-triggered.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-local-gateway.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway-triggered.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway-triggered.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-double-failover-through-remote-gateway.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway-triggered.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway-triggered.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-local-gateway.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway-triggered.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway-triggered.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "ingress-gateway",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/connect-proxy-with-tcp-chain-failover-through-remote-gateway.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "ingress-gateway",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/custom-limits-max-connections-only.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/custom-limits-max-connections-only.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "my-gateway-123",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/custom-limits-set-to-zero.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/custom-limits-set-to-zero.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "my-gateway",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/custom-limits.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/custom-limits.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "ingress-gateway-1",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/custom-local-app.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/custom-local-app.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/custom-timeouts.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/custom-timeouts.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/custom-upstream-default-chain.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/custom-upstream-default-chain.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/custom-upstream.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/custom-upstream.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/defaults.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/defaults.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/expose-paths-grpc-new-cluster-http1.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/expose-paths-grpc-new-cluster-http1.envoy-1-16-x.golden

@@ -13,7 +13,7 @@
     "id": "test-proxy",
     "metadata": {
       "namespace": "default",
-      "envoy_version": "1.15.0"
+      "envoy_version": "1.16.0"
     }
   },
   "static_resources": {

agent/xds/testdata/clusters/expose-paths-local-app-paths.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/expose-paths-local-app-paths.envoy-1-16-x.golden

@@ -8,7 +8,7 @@ readonly self_name="$0"
 DEBUG=${DEBUG:-}
 
 # ENVOY_VERSION to run each test against
-ENVOY_VERSION=${ENVOY_VERSION:-"1.15.0"}
+ENVOY_VERSION=${ENVOY_VERSION:-"1.16.0"}
 export ENVOY_VERSION
 
 if [ ! -z "$DEBUG" ] ; then

agent/xds/testdata/clusters/expose-paths-new-cluster-http2.envoy-1-12-x.golden renamed to agent/xds/testdata/clusters/expose-paths-new-cluster-http2.envoy-1-16-x.golden

@@ -7,20 +7,12 @@ unset CDPATH
 cd "$(dirname "$0")"
 
 ## no rbac url_path support
-    # 1.12.0
-    # 1.12.1
-    # 1.12.2
     # 1.13.0
 
 ## does not exist in docker
     # 1.13.5
     # 1.14.0
 versions=(
-    1.12.3
-    1.12.4
-    1.12.5
-    1.12.6
-    1.12.7
     1.13.1
     1.13.2
     1.13.3
@@ -34,6 +26,7 @@ versions=(
     1.15.0
     1.15.1
     1.15.2
+    1.16.0
 )
 
 for v in "${versions[@]}"; do