xds: Add a KeyValueStore-backed xDS delegate extension to contrib

api/contrib/envoy/extensions/xds/BUILD

@@ -0,0 +1,11 @@
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/config/common/key_value/v3:pkg",
+        "@com_github_cncf_udpa//udpa/annotations:pkg",
+        "@envoy_api//envoy/service/discovery/v3:pkg",
+    ],
+)

api/contrib/envoy/extensions/xds/kv_store_xds_delegate_config.proto

@@ -0,0 +1,23 @@
+syntax = "proto3";
+
+package envoy.extensions.xds;
+
+import "envoy/config/common/key_value/v3/config.proto";
+import "udpa/annotations/status.proto";
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.xds";
+option java_outer_classname = "KeyValueStoreXdsDelegateConfigProto";
+option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/xds";
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#extension: envoy.xds_delegates.kv_store]
+//
+// Configuration for a KeyValueStore-based XdsResourcesDelegate implementation.
+//
+// [#not-implemented-hide:]
+message KeyValueStoreXdsDelegateConfig {
+  // Configuration for the KeyValueStore that holds the xDS resources.
+  config.common.key_value.v3.KeyValueStoreConfig key_value_store_config = 1;
+};

api/contrib/envoy/extensions/xds/persisted_resources.proto

@@ -0,0 +1,16 @@
+syntax = "proto3";
+
+package envoy.extensions.xds;
+
+import "google/protobuf/timestamp.proto";
+import "envoy/service/discovery/v3/discovery.proto";
+
+// [#not-implemented-hide:]
+// Represents a list of xDS resources for an xDS authority and resource type URL tuple. Used to
+// serialize xDS resources in the KeyValueStoreXdsDelegate.
+message ResourceList {
+  repeated envoy.service.discovery.v3.Resource resources = 1;
+
+  // The timestamp at which the xDS resources list was last updated in the KV store.
+  google.protobuf.Timestamp last_updated = 2;
+};

api/versioning/BUILD

@@ -28,6 +28,7 @@ proto_library(
         "//contrib/envoy/extensions/private_key_providers/qat/v3alpha:pkg",
         "//contrib/envoy/extensions/regex_engines/hyperscan/v3alpha:pkg",
         "//contrib/envoy/extensions/vcl/v3alpha:pkg",
+        "//contrib/envoy/extensions/xds:pkg",
         "//envoy/admin/v3:pkg",
         "//envoy/config/accesslog/v3:pkg",
         "//envoy/config/bootstrap/v3:pkg",

contrib/contrib_build_config.bzl

@@ -57,4 +57,10 @@ CONTRIB_EXTENSIONS = {
     #
 
     "envoy.regex_engines.hyperscan":                            "//contrib/hyperscan/regex_engines/source:config",
+
+    #
+    # xDS delegates
+    #
+
+    "envoy.xds_delegates.kv_store":                            "//contrib/xds/source:kv_store_xds_delegate",
 }

contrib/extensions_metadata.yaml

@@ -88,3 +88,8 @@ envoy.regex_engines.hyperscan:
   - envoy.regex_engines
   security_posture: requires_trusted_downstream_and_upstream
   status: alpha
+envoy.xds_delegates.kv_store:
+  categories:
+  - envoy.xds_delegates
+  security_posture: requires_trusted_downstream_and_upstream
+  status: alpha

contrib/xds/source/BUILD

@@ -0,0 +1,23 @@
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_contrib_extension",
+    "envoy_contrib_package",
+)
+
+licenses(["notice"])  # Apache 2
+
+envoy_contrib_package()
+
+envoy_cc_contrib_extension(
+    name = "kv_store_xds_delegate",
+    srcs = ["kv_store_xds_delegate.cc"],
+    hdrs = ["kv_store_xds_delegate.h"],
+    deps = [
+	    "//envoy/common:key_value_store_interface",
+        "//envoy/common:time_interface",
+        "//envoy/config:xds_resources_delegate_interface",
+        "//source/common/config:utility_lib",
+        "//source/common/protobuf:utility_lib",
+        "@envoy_api//contrib/envoy/extensions/xds:pkg_cc_proto",
+    ],
+)

contrib/xds/source/kv_store_xds_delegate.cc

@@ -0,0 +1,111 @@
+#include "contrib/envoy/extensions/xds/kv_store_xds_delegate_config.pb.h"
+#include "contrib/envoy/extensions/xds/kv_store_xds_delegate_config.pb.validate.h"
+#include "contrib/envoy/extensions/xds/persisted_resources.pb.h"
+#include "contrib/xds/source/kv_store_xds_delegate.h"
+
+#include "envoy/registry/registry.h"
+#include "envoy/service/discovery/v3/discovery.pb.h"
+
+#include "source/common/config/utility.h"
+#include "source/common/protobuf/utility.h"
+
+#include "absl/strings/str_cat.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace Config {
+namespace {
+
+using envoy::extensions::xds::KeyValueStoreXdsDelegateConfig;
+using envoy::extensions::xds::ResourceList;
+
+// The supplied KeyValueStore may be shared with other parts of the application
+// (e.g. SharedPreferences on Android). Therefore, we introduce a prefix to the key to create a
+// distinct key namespace.
+constexpr char KEY_PREFIX[] = "XDS_CONFIG";
+// The delimiter between parts of the key.
+constexpr char DELIMITER[] = "*+";
+
+// Constructs the key for the KeyValueStore from the xDS authority and resource type URL.
+std::string constructKey(const std::string& authority_id, const std::string& resource_type_url) {
+  return absl::StrCat(KEY_PREFIX, DELIMITER, authority_id, DELIMITER, resource_type_url);
+}
+
+} // namespace
+
+KeyValueStoreXdsDelegate::KeyValueStoreXdsDelegate(KeyValueStorePtr&& xds_config_store,
+                                                   Api::Api& api)
+    : xds_config_store_(std::move(xds_config_store)), api_(api) {}
+
+std::vector<envoy::service::discovery::v3::Resource>
+KeyValueStoreXdsDelegate::getResources(const std::string& authority_id,
+                                       const std::string& resource_type_url) const {
+  const std::string key = constructKey(authority_id, resource_type_url);
+  if (auto existing_resources = xds_config_store_->get(key)) {
+    ResourceList resource_list;
+    resource_list.ParseFromString(std::string(*existing_resources));
+    return std::vector<envoy::service::discovery::v3::Resource>{resource_list.resources().begin(),
+                                                                resource_list.resources().end()};
+  }
+  return {};
+}
+
+// TODO(abeyad): Handle key eviction.
+void KeyValueStoreXdsDelegate::onConfigUpdated(
+    const std::string& authority_id, const std::string& resource_type_url,
+    const std::vector<Envoy::Config::DecodedResourceRef>& resources) {
+  ResourceList resource_list;
+  for (const auto& resource_ref : resources) {
+    const auto& decoded_resource = resource_ref.get();
+    if (decoded_resource.hasResource()) {
+      envoy::service::discovery::v3::Resource r;
+      // TODO(abeyad): Support dynamic parameter constraints.
+      r.set_name(decoded_resource.name());
+      r.set_version(decoded_resource.version());
+      r.mutable_resource()->PackFrom(decoded_resource.resource());
+      if (decoded_resource.ttl()) {
+        r.mutable_ttl()->CopyFrom(Protobuf::util::TimeUtil::MillisecondsToDuration(
+            decoded_resource.ttl().value().count()));
+      }
+      *resource_list.add_resources() = std::move(r);
+    }
+  }
+
+  const std::string key = constructKey(authority_id, resource_type_url);
+
+  if (resource_list.resources_size() == 0) {
+    xds_config_store_->remove(key);
+    return;
+  }
+
+  TimestampUtil::systemClockToTimestamp(api_.timeSource().systemTime(),
+                                        *resource_list.mutable_last_updated());
+  xds_config_store_->addOrUpdate(key, resource_list.SerializeAsString());
+}
+
+Envoy::ProtobufTypes::MessagePtr KeyValueStoreXdsDelegateFactory::createEmptyConfigProto() {
+  return std::make_unique<KeyValueStoreXdsDelegateConfig>();
+}
+
+std::string KeyValueStoreXdsDelegateFactory::name() const {
+  return "envoy.xds_delegates.KeyValueStoreXdsDelegate";
+};
+
+Envoy::Config::XdsResourcesDelegatePtr KeyValueStoreXdsDelegateFactory::createXdsResourcesDelegate(
+    const ProtobufWkt::Any& config, ProtobufMessage::ValidationVisitor& validation_visitor,
+    Api::Api& api, Event::Dispatcher& dispatcher) {
+  const auto& validator_config =
+      Envoy::MessageUtil::anyConvertAndValidate<KeyValueStoreXdsDelegateConfig>(config,
+                                                                                validation_visitor);
+  auto& kv_store_factory = Envoy::Config::Utility::getAndCheckFactory<Envoy::KeyValueStoreFactory>(
+      validator_config.key_value_store_config().config());
+  KeyValueStorePtr xds_config_store = kv_store_factory.createStore(
+      validator_config.key_value_store_config(), validation_visitor, dispatcher, api.fileSystem());
+  return std::make_unique<KeyValueStoreXdsDelegate>(std::move(xds_config_store), api);
+}
+
+REGISTER_FACTORY(KeyValueStoreXdsDelegateFactory, Envoy::Config::XdsResourcesDelegateFactory);
+
+} // namespace Config
+} // namespace Extensions
+} // namespace Envoy

contrib/xds/source/kv_store_xds_delegate.h

@@ -0,0 +1,44 @@
+#pragma once
+
+#include "envoy/common/key_value_store.h"
+#include "envoy/config/xds_resources_delegate.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace Config {
+
+// TODO(abeyad): add comments
+class KeyValueStoreXdsDelegate : public Envoy::Config::XdsResourcesDelegate {
+public:
+  KeyValueStoreXdsDelegate(KeyValueStorePtr&& xds_config_store, Api::Api& api);
+
+  std::vector<envoy::service::discovery::v3::Resource>
+  getResources(const std::string& authority_id,
+               const std::string& resource_type_url) const override;
+
+  void onConfigUpdated(const std::string& authority_id, const std::string& resource_type_url,
+                       const std::vector<Envoy::Config::DecodedResourceRef>& resources) override;
+
+private:
+  KeyValueStorePtr xds_config_store_;
+  Api::Api& api_;
+};
+
+// TODO(abeyad): add comments
+class KeyValueStoreXdsDelegateFactory : public Envoy::Config::XdsResourcesDelegateFactory {
+public:
+  KeyValueStoreXdsDelegateFactory() = default;
+
+  Envoy::ProtobufTypes::MessagePtr createEmptyConfigProto() override;
+
+  std::string name() const override;
+
+  Envoy::Config::XdsResourcesDelegatePtr
+  createXdsResourcesDelegate(const ProtobufWkt::Any& config,
+                             ProtobufMessage::ValidationVisitor& validation_visitor, Api::Api& api,
+                             Event::Dispatcher& dispatcher) override;
+};
+
+} // namespace Config
+} // namespace Extensions
+} // namespace Envoy

contrib/xds/test/BUILD

@@ -0,0 +1,34 @@
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_test",
+    "envoy_contrib_package",
+)
+
+licenses(["notice"])  # Apache 2
+
+envoy_contrib_package()
+
+envoy_cc_test(
+    name = "kv_store_xds_delegate_integration_test",
+    srcs = [
+        "kv_store_xds_delegate_integration_test.cc",
+    ],
+    data = [
+        "//test/config/integration/certs",
+    ],
+    deps = [
+	"//contrib/xds/source:kv_store_xds_delegate",
+	"//source/extensions/key_value/file_based:config_lib",
+        "//test/common/grpc:grpc_client_integration_lib",
+        "//test/integration:http_integration_lib",
+        "//test/test_common:utility_lib",
+        "@envoy_api//contrib/envoy/extensions/xds:pkg_cc_proto",
+        "@envoy_api//envoy/admin/v3:pkg_cc_proto",
+        "@envoy_api//envoy/config/bootstrap/v3:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/transport_sockets/tls/v3:pkg_cc_proto",
+        "@envoy_api//envoy/service/discovery/v3:pkg_cc_proto",
+        "@envoy_api//envoy/service/runtime/v3:pkg_cc_proto",
+        "@envoy_api//envoy/service/secret/v3:pkg_cc_proto",
+    ],
+)