connect: Remove support for Envoy 1.16

.changelog/11277.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: update supported envoy versions to 1.20.0, 1.19.1, 1.18.4, 1.17.4
+```

.circleci/config.yml

@@ -792,14 +792,14 @@ jobs:
           command: make test-coverage-ci
       - run: *notify-slack-failure
 
-  envoy-integration-test-1_16_5: &ENVOY_TESTS
+  envoy-integration-test-1_17_4: &ENVOY_TESTS
     docker:
       # We only really need bash and docker-compose which is installed on all
       # Circle images but pick Go since we have to pick one of them.
       - image: *GOLANG_IMAGE
     parallelism: 2
     environment:
-      ENVOY_VERSION: "1.16.5"
+      ENVOY_VERSION: "1.17.4"
     steps: &ENVOY_INTEGRATION_TEST_STEPS
       - checkout
       # Get go binary from workspace
@@ -832,17 +832,6 @@ jobs:
           path: *TEST_RESULTS_DIR
       - run: *notify-slack-failure
 
-  envoy-integration-test-1_16_5-v2compat:
-    <<: *ENVOY_TESTS
-    environment:
-      ENVOY_VERSION: "1.16.5"
-      TEST_V2_XDS: "1"
-
-  envoy-integration-test-1_17_4:
-    <<: *ENVOY_TESTS
-    environment:
-      ENVOY_VERSION: "1.17.4"
-
   envoy-integration-test-1_18_4:
     <<: *ENVOY_TESTS
     environment:
@@ -853,6 +842,11 @@ jobs:
     environment:
       ENVOY_VERSION: "1.19.1"
 
+  envoy-integration-test-1_20_0:
+    <<: *ENVOY_TESTS
+    environment:
+      ENVOY_VERSION: "1.20.0"
+
   # run integration tests for the connect ca providers
   test-connect-ca-providers:
     docker:
@@ -1093,12 +1087,6 @@ workflows:
       - nomad-integration-0_8:
           requires:
             - dev-build
-      - envoy-integration-test-1_16_5:
-          requires:
-            - dev-build
-      - envoy-integration-test-1_16_5-v2compat:
-          requires:
-            - dev-build
       - envoy-integration-test-1_17_4:
           requires:
             - dev-build
@@ -1108,6 +1096,9 @@ workflows:
       - envoy-integration-test-1_19_1:
           requires:
             - dev-build
+      - envoy-integration-test-1_20_0:
+          requires:
+            - dev-build
 
   website:
     unless: << pipeline.parameters.trigger-load-test >>

agent/xds/clusters_test.go

@@ -19,7 +19,6 @@ import (
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/agent/xds/proxysupport"
-	"github.com/hashicorp/consul/lib/stringslice"
 	"github.com/hashicorp/consul/sdk/testutil"
 )
 
@@ -720,7 +719,6 @@ func TestClustersFromSnapshot(t *testing.T) {
 	}
 
 	latestEnvoyVersion := proxysupport.EnvoyVersions[0]
-	latestEnvoyVersion_v2 := proxysupport.EnvoyVersionsV2[0]
 	for _, envoyVersion := range proxysupport.EnvoyVersions {
 		sf, err := determineSupportedProxyFeaturesFromString(envoyVersion)
 		require.NoError(t, err)
@@ -763,25 +761,6 @@ func TestClustersFromSnapshot(t *testing.T) {
 
 						require.JSONEq(t, goldenEnvoy(t, filepath.Join("clusters", gName), envoyVersion, latestEnvoyVersion, gotJSON), gotJSON)
 					})
-
-					t.Run("v2-compat", func(t *testing.T) {
-						if !stringslice.Contains(proxysupport.EnvoyVersionsV2, envoyVersion) {
-							t.Skip()
-						}
-						respV2, err := convertDiscoveryResponseToV2(r)
-						require.NoError(t, err)
-
-						gotJSON := protoToJSON(t, respV2)
-
-						gName := tt.name
-						if tt.overrideGoldenName != "" {
-							gName = tt.overrideGoldenName
-						}
-
-						gName += ".v2compat"
-
-						require.JSONEq(t, goldenEnvoy(t, filepath.Join("clusters", gName), envoyVersion, latestEnvoyVersion_v2, gotJSON), gotJSON)
-					})
 				})
 			}
 		})

agent/xds/endpoints_test.go

@@ -15,7 +15,6 @@ import (
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/agent/xds/proxysupport"
-	"github.com/hashicorp/consul/lib/stringslice"
 	"github.com/hashicorp/consul/sdk/testutil"
 )
 
@@ -567,7 +566,6 @@ func TestEndpointsFromSnapshot(t *testing.T) {
 	}
 
 	latestEnvoyVersion := proxysupport.EnvoyVersions[0]
-	latestEnvoyVersion_v2 := proxysupport.EnvoyVersionsV2[0]
 	for _, envoyVersion := range proxysupport.EnvoyVersions {
 		sf, err := determineSupportedProxyFeaturesFromString(envoyVersion)
 		require.NoError(t, err)
@@ -609,25 +607,6 @@ func TestEndpointsFromSnapshot(t *testing.T) {
 
 						require.JSONEq(t, goldenEnvoy(t, filepath.Join("endpoints", gName), envoyVersion, latestEnvoyVersion, gotJSON), gotJSON)
 					})
-
-					t.Run("v2-compat", func(t *testing.T) {
-						if !stringslice.Contains(proxysupport.EnvoyVersionsV2, envoyVersion) {
-							t.Skip()
-						}
-						respV2, err := convertDiscoveryResponseToV2(r)
-						require.NoError(t, err)
-
-						gotJSON := protoToJSON(t, respV2)
-
-						gName := tt.name
-						if tt.overrideGoldenName != "" {
-							gName = tt.overrideGoldenName
-						}
-
-						gName += ".v2compat"
-
-						require.JSONEq(t, goldenEnvoy(t, filepath.Join("endpoints", gName), envoyVersion, latestEnvoyVersion_v2, gotJSON), gotJSON)
-					})
 				})
 			}
 		})

agent/xds/envoy_versioning.go

@@ -11,7 +11,7 @@ import (
 var (
 	// minSupportedVersion is the oldest mainline version we support. This should always be
 	// the zero'th point release of the last element of proxysupport.EnvoyVersions.
-	minSupportedVersion = version.Must(version.NewVersion("1.16.0"))
+	minSupportedVersion = version.Must(version.NewVersion("1.17.0"))
 
 	// add min version constraints for associated feature flags when necessary, for example:
 	// minVersionAllowingEmptyGatewayClustersWithIncrementalXDS = version.Must(version.NewVersion("1.16.0"))

agent/xds/envoy_versioning_test.go

@@ -112,15 +112,21 @@ func TestDetermineSupportedProxyFeaturesFromString(t *testing.T) {
 		"1.15.3": {expectErr: "Envoy 1.15.3 " + errTooOld},
 		"1.15.4": {expectErr: "Envoy 1.15.4 " + errTooOld},
 		"1.15.5": {expectErr: "Envoy 1.15.5 " + errTooOld},
+		"1.16.1": {expectErr: "Envoy 1.16.1 " + errTooOld},
+		"1.16.2": {expectErr: "Envoy 1.16.2 " + errTooOld},
+		"1.16.3": {expectErr: "Envoy 1.16.3 " + errTooOld},
+		"1.16.4": {expectErr: "Envoy 1.16.4 " + errTooOld},
+		"1.16.5": {expectErr: "Envoy 1.16.5 " + errTooOld},
+		"1.16.6": {expectErr: "Envoy 1.16.6 " + errTooOld},
 	}
 
 	// Insert a bunch of valid versions.
 	// Populate feature flags here when appropriate. See consul 1.10.x for reference.
 	for _, v := range []string{
-		"1.16.0", "1.16.1", "1.16.2", "1.16.3", "1.16.4", "1.16.5",
 		"1.17.0", "1.17.1", "1.17.2", "1.17.3", "1.17.4",
 		"1.18.0", "1.18.1", "1.18.2", "1.18.3", "1.18.4",
 		"1.19.0", "1.19.1",
+		"1.20.0",
 	} {
 		cases[v] = testcase{expect: supportedProxyFeatures{}}
 	}

agent/xds/listeners_test.go

@@ -18,7 +18,6 @@ import (
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/agent/xds/proxysupport"
-	"github.com/hashicorp/consul/lib/stringslice"
 	"github.com/hashicorp/consul/sdk/testutil"
 	"github.com/hashicorp/consul/types"
 )
@@ -942,7 +941,6 @@ func TestListenersFromSnapshot(t *testing.T) {
 	}
 
 	latestEnvoyVersion := proxysupport.EnvoyVersions[0]
-	latestEnvoyVersion_v2 := proxysupport.EnvoyVersionsV2[0]
 	for _, envoyVersion := range proxysupport.EnvoyVersions {
 		sf, err := determineSupportedProxyFeaturesFromString(envoyVersion)
 		require.NoError(t, err)
@@ -991,36 +989,6 @@ func TestListenersFromSnapshot(t *testing.T) {
 						expectedJSON := goldenEnvoy(t, filepath.Join("listeners", gName), envoyVersion, latestEnvoyVersion, gotJSON)
 						require.JSONEq(t, expectedJSON, gotJSON)
 					})
-
-					t.Run("v2-compat", func(t *testing.T) {
-						if !stringslice.Contains(proxysupport.EnvoyVersionsV2, envoyVersion) {
-							t.Skip()
-						}
-						respV2, err := convertDiscoveryResponseToV2(r)
-						require.NoError(t, err)
-
-						gotJSON := protoToJSON(t, respV2)
-
-						gName := tt.name
-						if tt.overrideGoldenName != "" {
-							gName = tt.overrideGoldenName
-						}
-
-						gName += ".v2compat"
-
-						// It's easy to miss a new type that encodes a version from just
-						// looking at the golden files so lets make it an error here. If
-						// there are ever false positives we can maybe include an allow list
-						// here as it seems safer to assume something was missed than to
-						// assume we'll notice the golden file being wrong. Note the first
-						// one matches both resourceApiVersion and transportApiVersion. I
-						// left it as a suffix in case there are other field names that
-						// follow that convention now or in the future.
-						require.NotContains(t, gotJSON, `ApiVersion": "V3"`)
-						require.NotContains(t, gotJSON, `type.googleapis.com/envoy.api.v3`)
-
-						require.JSONEq(t, goldenEnvoy(t, filepath.Join("listeners", gName), envoyVersion, latestEnvoyVersion_v2, gotJSON), gotJSON)
-					})
 				})
 			}
 		})

agent/xds/proxysupport/proxysupport.go

@@ -7,12 +7,8 @@ package proxysupport
 //
 // see: https://www.consul.io/docs/connect/proxies/envoy#supported-versions
 var EnvoyVersions = []string{
+	"1.20.0",
 	"1.19.1",
 	"1.18.4",
 	"1.17.4",
-	"1.16.5",
-}
-
-var EnvoyVersionsV2 = []string{
-	"1.16.5",
 }

agent/xds/rbac_test.go

@@ -718,15 +718,6 @@ func TestMakeRBACNetworkAndHTTPFilters(t *testing.T) {
 
 					require.JSONEq(t, goldenSimple(t, filepath.Join("rbac", name), gotJSON), gotJSON)
 				})
-
-				t.Run("v2-compat", func(t *testing.T) {
-					filterV2, err := convertNetFilterToV2(filter)
-					require.NoError(t, err)
-
-					gotJSON := protoToJSON(t, filterV2)
-
-					require.JSONEq(t, goldenSimple(t, filepath.Join("rbac", name+".v2compat"), gotJSON), gotJSON)
-				})
 			})
 			t.Run("http filter", func(t *testing.T) {
 				filter, err := makeRBACHTTPFilter(tt.intentions, tt.intentionDefaultAllow)
@@ -737,15 +728,6 @@ func TestMakeRBACNetworkAndHTTPFilters(t *testing.T) {
 
 					require.JSONEq(t, goldenSimple(t, filepath.Join("rbac", name+"--httpfilter"), gotJSON), gotJSON)
 				})
-
-				t.Run("v2-compat", func(t *testing.T) {
-					filterV2, err := convertHttpFilterToV2(filter)
-					require.NoError(t, err)
-
-					gotJSON := protoToJSON(t, filterV2)
-
-					require.JSONEq(t, goldenSimple(t, filepath.Join("rbac", name+"--httpfilter.v2compat"), gotJSON), gotJSON)
-				})
 			})
 		})
 	}

agent/xds/routes_test.go

@@ -17,7 +17,6 @@ import (
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/agent/xds/proxysupport"
-	"github.com/hashicorp/consul/lib/stringslice"
 	"github.com/hashicorp/consul/sdk/testutil"
 )
 
@@ -329,7 +328,6 @@ func TestRoutesFromSnapshot(t *testing.T) {
 	}
 
 	latestEnvoyVersion := proxysupport.EnvoyVersions[0]
-	latestEnvoyVersion_v2 := proxysupport.EnvoyVersionsV2[0]
 	for _, envoyVersion := range proxysupport.EnvoyVersions {
 		sf, err := determineSupportedProxyFeaturesFromString(envoyVersion)
 		require.NoError(t, err)
@@ -370,36 +368,6 @@ func TestRoutesFromSnapshot(t *testing.T) {
 
 						require.JSONEq(t, goldenEnvoy(t, filepath.Join("routes", gName), envoyVersion, latestEnvoyVersion, gotJSON), gotJSON)
 					})
-
-					t.Run("v2-compat", func(t *testing.T) {
-						if !stringslice.Contains(proxysupport.EnvoyVersionsV2, envoyVersion) {
-							t.Skip()
-						}
-						respV2, err := convertDiscoveryResponseToV2(r)
-						require.NoError(t, err)
-
-						gotJSON := protoToJSON(t, respV2)
-
-						gName := tt.name
-						if tt.overrideGoldenName != "" {
-							gName = tt.overrideGoldenName
-						}
-
-						gName += ".v2compat"
-
-						// It's easy to miss a new type that encodes a version from just
-						// looking at the golden files so lets make it an error here. If
-						// there are ever false positives we can maybe include an allow list
-						// here as it seems safer to assume something was missed than to
-						// assume we'll notice the golden file being wrong. Note the first
-						// one matches both resourceApiVersion and transportApiVersion. I
-						// left it as a suffix in case there are other field names that
-						// follow that convention now or in the future.
-						require.NotContains(t, gotJSON, `ApiVersion": "V3"`)
-						require.NotContains(t, gotJSON, `type.googleapis.com/envoy.api.v3`)
-
-						require.JSONEq(t, goldenEnvoy(t, filepath.Join("routes", gName), envoyVersion, latestEnvoyVersion_v2, gotJSON), gotJSON)
-					})
 				})
 			}
 		})