grpc 1.81.1 → 1.83.1

data/src/core/xds/grpc/xds_http_fault_filter.cc

@@ -32,7 +32,6 @@
 #include "google/protobuf/wrappers.upb.h"
 #include "src/core/call/status_util.h"
 #include "src/core/ext/filters/fault_injection/fault_injection_filter.h"
-#include "src/core/ext/filters/fault_injection/fault_injection_service_config_parser.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/transport/status_conversion.h"
 #include "src/core/util/json/json.h"
@@ -83,133 +82,6 @@ void XdsHttpFaultFilter::PopulateSymtab(upb_DefPool* symtab) const {
   envoy_extensions_filters_http_fault_v3_HTTPFault_getmsgdef(symtab);
 }
 
-std::optional<Json> XdsHttpFaultFilter::GenerateFilterConfig(
-    absl::string_view /*instance_name*/,
-    const XdsResourceType::DecodeContext& context,
-    const XdsExtension& extension, ValidationErrors* errors) const {
-  const absl::string_view* serialized_filter_config =
-      std::get_if<absl::string_view>(&extension.value);
-  if (serialized_filter_config == nullptr) {
-    errors->AddError("could not parse fault injection filter config");
-    return std::nullopt;
-  }
-  auto* http_fault = envoy_extensions_filters_http_fault_v3_HTTPFault_parse(
-      serialized_filter_config->data(), serialized_filter_config->size(),
-      context.arena);
-  if (http_fault == nullptr) {
-    errors->AddError("could not parse fault injection filter config");
-    return std::nullopt;
-  }
-  // NOTE(lidiz): Here, we are manually translating the upb messages into the
-  // JSON form of the filter config as part of method config, which will be
-  // directly used later by service config. In this way, we can validate the
-  // filter configs, and NACK if needed. It also allows the service config to
-  // function independently without xDS, but not the other way around.
-  // NOTE(lidiz): please refer to FaultInjectionPolicy for ground truth
-  // definitions, located at:
-  // src/core/ext/filters/fault_injection/service_config_parser.h
-  Json::Object fault_injection_policy_json;
-  // Section 1: Parse the abort injection config
-  const auto* fault_abort =
-      envoy_extensions_filters_http_fault_v3_HTTPFault_abort(http_fault);
-  if (fault_abort != nullptr) {
-    ValidationErrors::ScopedField field(errors, ".abort");
-    grpc_status_code abort_grpc_status_code = GRPC_STATUS_OK;
-    // Try if gRPC status code is set first.  Otherwise, use HTTP status.
-    if (int abort_grpc_status_code_raw =
-            envoy_extensions_filters_http_fault_v3_FaultAbort_grpc_status(
-                fault_abort);
-        abort_grpc_status_code_raw != 0) {
-      if (!grpc_status_code_from_int(abort_grpc_status_code_raw,
-                                     &abort_grpc_status_code)) {
-        ValidationErrors::ScopedField field(errors, ".grpc_status");
-        errors->AddError(absl::StrCat("invalid gRPC status code: ",
-                                      abort_grpc_status_code_raw));
-      }
-    } else if (
-        int abort_http_status_code =
-            envoy_extensions_filters_http_fault_v3_FaultAbort_http_status(
-                fault_abort);
-        abort_http_status_code != 0 && abort_http_status_code != 200) {
-      abort_grpc_status_code =
-          grpc_http2_status_to_grpc_status(abort_http_status_code);
-    }
-    // Set the abort_code, even if it's OK
-    fault_injection_policy_json["abortCode"] =
-        Json::FromString(grpc_status_code_to_string(abort_grpc_status_code));
-    // Set the headers if we enabled header abort injection control
-    if (envoy_extensions_filters_http_fault_v3_FaultAbort_has_header_abort(
-            fault_abort)) {
-      fault_injection_policy_json["abortCodeHeader"] =
-          Json::FromString("x-envoy-fault-abort-grpc-request");
-      fault_injection_policy_json["abortPercentageHeader"] =
-          Json::FromString("x-envoy-fault-abort-percentage");
-    }
-    // Set the fraction percent
-    auto* percent =
-        envoy_extensions_filters_http_fault_v3_FaultAbort_percentage(
-            fault_abort);
-    if (percent != nullptr) {
-      fault_injection_policy_json["abortPercentageNumerator"] =
-          Json::FromNumber(envoy_type_v3_FractionalPercent_numerator(percent));
-      fault_injection_policy_json["abortPercentageDenominator"] =
-          Json::FromNumber(GetDenominator(percent));
-    }
-  }
-  // Section 2: Parse the delay injection config
-  const auto* fault_delay =
-      envoy_extensions_filters_http_fault_v3_HTTPFault_delay(http_fault);
-  if (fault_delay != nullptr) {
-    ValidationErrors::ScopedField field(errors, ".delay");
-    // Parse the delay duration
-    const auto* delay_duration =
-        envoy_extensions_filters_common_fault_v3_FaultDelay_fixed_delay(
-            fault_delay);
-    if (delay_duration != nullptr) {
-      ValidationErrors::ScopedField field(errors, ".fixed_delay");
-      Duration duration = ParseDuration(delay_duration, errors);
-      fault_injection_policy_json["delay"] =
-          Json::FromString(duration.ToJsonString());
-    }
-    // Set the headers if we enabled header delay injection control
-    if (envoy_extensions_filters_common_fault_v3_FaultDelay_has_header_delay(
-            fault_delay)) {
-      fault_injection_policy_json["delayHeader"] =
-          Json::FromString("x-envoy-fault-delay-request");
-      fault_injection_policy_json["delayPercentageHeader"] =
-          Json::FromString("x-envoy-fault-delay-request-percentage");
-    }
-    // Set the fraction percent
-    auto* percent =
-        envoy_extensions_filters_common_fault_v3_FaultDelay_percentage(
-            fault_delay);
-    if (percent != nullptr) {
-      fault_injection_policy_json["delayPercentageNumerator"] =
-          Json::FromNumber(envoy_type_v3_FractionalPercent_numerator(percent));
-      fault_injection_policy_json["delayPercentageDenominator"] =
-          Json::FromNumber(GetDenominator(percent));
-    }
-  }
-  // Section 3: Parse the maximum active faults
-  auto max_fault_wrapper = ParseUInt32Value(
-      envoy_extensions_filters_http_fault_v3_HTTPFault_max_active_faults(
-          http_fault));
-  if (max_fault_wrapper.has_value()) {
-    fault_injection_policy_json["maxFaults"] =
-        Json::FromNumber(*max_fault_wrapper);
-  }
-  return Json::FromObject(std::move(fault_injection_policy_json));
-}
-
-std::optional<Json> XdsHttpFaultFilter::GenerateFilterConfigOverride(
-    absl::string_view instance_name,
-    const XdsResourceType::DecodeContext& context,
-    const XdsExtension& extension, ValidationErrors* errors) const {
-  // HTTPFault filter has the same message type in HTTP connection manager's
-  // filter config and in overriding filter config field.
-  return GenerateFilterConfig(instance_name, context, extension, errors);
-}
-
 const grpc_channel_filter* XdsHttpFaultFilter::channel_filter() const {
   return &FaultInjectionFilter::kFilterVtable;
 }
@@ -220,27 +92,6 @@ void XdsHttpFaultFilter::AddFilter(
   builder.AddFilter<FaultInjectionFilter>(std::move(config));
 }
 
-ChannelArgs XdsHttpFaultFilter::ModifyChannelArgs(
-    const ChannelArgs& args) const {
-  return args.Set(GRPC_ARG_PARSE_FAULT_INJECTION_METHOD_CONFIG, 1);
-}
-
-absl::StatusOr<XdsHttpFilterImpl::ServiceConfigJsonEntry>
-XdsHttpFaultFilter::GenerateMethodConfig(
-    const Json& hcm_filter_config, const Json* filter_config_override) const {
-  const Json& policy_json = filter_config_override != nullptr
-                                ? *filter_config_override
-                                : hcm_filter_config;
-  // The policy JSON may be empty, that's allowed.
-  return ServiceConfigJsonEntry{"faultInjectionPolicy", JsonDump(policy_json)};
-}
-
-absl::StatusOr<XdsHttpFilterImpl::ServiceConfigJsonEntry>
-XdsHttpFaultFilter::GenerateServiceConfig(
-    const Json& /*hcm_filter_config*/) const {
-  return ServiceConfigJsonEntry{"", ""};
-}
-
 RefCountedPtr<const FilterConfig> XdsHttpFaultFilter::ParseTopLevelConfig(
     absl::string_view /*instance_name*/,
     const XdsResourceType::DecodeContext& context,

data/src/core/xds/grpc/xds_http_fault_filter.h

@@ -40,19 +40,30 @@ class XdsHttpFaultFilter final : public XdsHttpFilterImpl {
   void PopulateSymtab(upb_DefPool* symtab) const override;
   std::optional<Json> GenerateFilterConfig(
       absl::string_view /*instance_name*/,
-      const XdsResourceType::DecodeContext& context,
-      const XdsExtension& extension, ValidationErrors* errors) const override;
+      const XdsResourceType::DecodeContext& /*context*/,
+      const XdsExtension& /*extension*/,
+      ValidationErrors* /*errors*/) const override {
+    return std::nullopt;
+  }
   std::optional<Json> GenerateFilterConfigOverride(
       absl::string_view /*instance_name*/,
-      const XdsResourceType::DecodeContext& context,
-      const XdsExtension& extension, ValidationErrors* errors) const override;
+      const XdsResourceType::DecodeContext& /*context*/,
+      const XdsExtension& /*extension*/,
+      ValidationErrors* /*errors*/) const override {
+    return std::nullopt;
+  }
   const grpc_channel_filter* channel_filter() const override;
-  ChannelArgs ModifyChannelArgs(const ChannelArgs& args) const override;
   absl::StatusOr<ServiceConfigJsonEntry> GenerateMethodConfig(
-      const Json& hcm_filter_config,
-      const Json* filter_config_override) const override;
+      const Json& /*hcm_filter_config*/,
+      const Json* /*filter_config_override*/) const override {
+    return absl::UnimplementedError(
+        "old-style filter config APIs not supported");
+  }
   absl::StatusOr<ServiceConfigJsonEntry> GenerateServiceConfig(
-      const Json& hcm_filter_config) const override;
+      const Json& /*hcm_filter_config*/) const override {
+    return absl::UnimplementedError(
+        "old-style filter config APIs not supported");
+  }
   void AddFilter(FilterChainBuilder& builder,
                  RefCountedPtr<const FilterConfig> config) const override;
   RefCountedPtr<const FilterConfig> ParseTopLevelConfig(

data/src/core/xds/grpc/xds_http_filter.cc

@@ -22,7 +22,8 @@ RefCountedPtr<const FilterConfig> XdsHttpFilterImpl::MergeConfigs(
     RefCountedPtr<const FilterConfig> top_level_config,
     RefCountedPtr<const FilterConfig> virtual_host_override_config,
     RefCountedPtr<const FilterConfig> route_override_config,
-    RefCountedPtr<const FilterConfig> cluster_weight_override_config) const {
+    RefCountedPtr<const FilterConfig> cluster_weight_override_config,
+    Blackboard& /*blackboard*/) const {
   if (cluster_weight_override_config != nullptr) {
     return cluster_weight_override_config;
   }

data/src/core/xds/grpc/xds_http_filter.h

@@ -20,13 +20,13 @@
 #include <optional>
 #include <string>
 
-#include "src/core/filter/blackboard.h"
 #include "src/core/filter/filter_chain.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
 #include "src/core/util/json/json.h"
 #include "src/core/util/json/json_writer.h"
 #include "src/core/util/validation_errors.h"
+#include "src/core/xds/grpc/blackboard.h"
 #include "src/core/xds/grpc/xds_common_types.h"
 #include "src/core/xds/xds_client/xds_resource_type.h"
 #include "upb/reflection/def.h"
@@ -67,19 +67,15 @@ class XdsHttpFilterImpl {
       const XdsExtension& extension, ValidationErrors* errors) const = 0;
 
   // Returns a new filter config that takes into account any necessary
-  // overrides.  Base class returns the most specific filter config;
-  // subclasses can override if needed.
+  // overrides.  May also add objects to config from the blackboard.
+  // Base class returns the most specific filter config; subclasses can
+  // override if needed.
   virtual RefCountedPtr<const FilterConfig> MergeConfigs(
       RefCountedPtr<const FilterConfig> top_level_config,
       RefCountedPtr<const FilterConfig> virtual_host_override_config,
       RefCountedPtr<const FilterConfig> route_override_config,
-      RefCountedPtr<const FilterConfig> cluster_weight_override_config) const;
-
-  // Adds state to new_blackboard if needed for the specified filter
-  // config.  Copies existing state from old_blackboard as appropriate.
-  virtual void UpdateBlackboard(const FilterConfig& /*config*/,
-                                const Blackboard* /*old_blackboard*/,
-                                Blackboard* /*new_blackboard*/) const {}
+      RefCountedPtr<const FilterConfig> cluster_weight_override_config,
+      Blackboard& blackboard) const;
 
   // Returns true if the filter is supported on clients; false otherwise
   virtual bool IsSupportedOnClients() const = 0;
@@ -151,12 +147,6 @@ class XdsHttpFilterImpl {
   // Currently used only on the client side.
   virtual absl::StatusOr<ServiceConfigJsonEntry> GenerateServiceConfig(
       const Json& hcm_filter_config) const = 0;
-
-  // Adds state to new_blackboard if needed for the specified filter
-  // config.  Copies existing state from old_blackboard as appropriate.
-  virtual void UpdateBlackboard(const Json& /*hcm_filter_config*/,
-                                const Blackboard* /*old_blackboard*/,
-                                Blackboard* /*new_blackboard*/) const {}
 };
 
 }  // namespace grpc_core

data/src/core/xds/grpc/xds_http_filter_registry.cc

@@ -23,7 +23,7 @@
 
 #include "envoy/extensions/filters/http/router/v3/router.upb.h"
 #include "envoy/extensions/filters/http/router/v3/router.upbdefs.h"
-#include "src/core/util/env.h"
+#include "src/core/config/experiment_env_var.h"
 #include "src/core/util/grpc_check.h"
 #include "src/core/util/json/json.h"
 #include "src/core/util/sync.h"
@@ -112,16 +112,6 @@ RefCountedPtr<const FilterConfig> XdsHttpRouterFilter::ParseOverrideConfig(
 
 namespace {
 
-bool XdsCompositeFilterEnabled() {
-  // This experiment is a prereq.
-  if (!IsXdsChannelFilterChainPerRouteEnabled()) return false;
-  auto value = GetEnv("GRPC_EXPERIMENTAL_XDS_COMPOSITE_FILTER");
-  if (!value.has_value()) return false;
-  bool parsed_value;
-  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
-  return parse_succeeded && parsed_value;
-}
-
 Mutex* g_mu = new Mutex;
 NoDestruct<absl::AnyInvocable<std::unique_ptr<XdsHttpFilterImpl>()>>
     g_http_filter_factory_factory ABSL_GUARDED_BY(*g_mu);
@@ -141,7 +131,7 @@ XdsHttpFilterRegistry::XdsHttpFilterRegistry(bool register_builtins) {
     RegisterFilter(std::make_unique<XdsHttpRbacFilter>());
     RegisterFilter(std::make_unique<XdsHttpStatefulSessionFilter>());
     RegisterFilter(std::make_unique<XdsHttpGcpAuthnFilter>());
-    if (XdsCompositeFilterEnabled()) {
+    if (IsExperimentEnvVarEnabled("GRPC_EXPERIMENTAL_XDS_COMPOSITE_FILTER")) {
       RegisterFilter(std::make_unique<XdsHttpCompositeFilter>());
     }
     MutexLock lock(g_mu);

data/src/core/xds/grpc/xds_http_gcp_authn_filter.cc

@@ -25,7 +25,6 @@
 #include "envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.upb.h"
 #include "envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.upbdefs.h"
 #include "src/core/ext/filters/gcp_authentication/gcp_authentication_filter.h"
-#include "src/core/ext/filters/gcp_authentication/gcp_authentication_service_config_parser.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/util/json/json.h"
 #include "src/core/util/json/json_writer.h"
@@ -51,64 +50,6 @@ void XdsHttpGcpAuthnFilter::PopulateSymtab(upb_DefPool* symtab) const {
       symtab);
 }
 
-namespace {
-
-Json::Object ValidateFilterConfig(
-    absl::string_view instance_name,
-    const envoy_extensions_filters_http_gcp_authn_v3_GcpAuthnFilterConfig*
-        gcp_auth,
-    ValidationErrors* errors) {
-  Json::Object config = {
-      {"filter_instance_name", Json::FromString(std::string(instance_name))}};
-  const auto* cache_config =
-      envoy_extensions_filters_http_gcp_authn_v3_GcpAuthnFilterConfig_cache_config(
-          gcp_auth);
-  if (cache_config == nullptr) return config;
-  uint64_t cache_size =
-      ParseUInt64Value(
-          envoy_extensions_filters_http_gcp_authn_v3_TokenCacheConfig_cache_size(
-              cache_config))
-          .value_or(10);
-  if (cache_size == 0) {
-    ValidationErrors::ScopedField field(errors, ".cache_config.cache_size");
-    errors->AddError("must be greater than 0");
-  }
-  config["cache_size"] = Json::FromNumber(cache_size);
-  return config;
-}
-
-}  // namespace
-
-std::optional<Json> XdsHttpGcpAuthnFilter::GenerateFilterConfig(
-    absl::string_view instance_name,
-    const XdsResourceType::DecodeContext& context,
-    const XdsExtension& extension, ValidationErrors* errors) const {
-  const absl::string_view* serialized_filter_config =
-      std::get_if<absl::string_view>(&extension.value);
-  if (serialized_filter_config == nullptr) {
-    errors->AddError("could not parse GCP auth filter config");
-    return std::nullopt;
-  }
-  auto* gcp_auth =
-      envoy_extensions_filters_http_gcp_authn_v3_GcpAuthnFilterConfig_parse(
-          serialized_filter_config->data(), serialized_filter_config->size(),
-          context.arena);
-  if (gcp_auth == nullptr) {
-    errors->AddError("could not parse GCP auth filter config");
-    return std::nullopt;
-  }
-  return Json::FromObject(
-      ValidateFilterConfig(instance_name, gcp_auth, errors));
-}
-
-std::optional<Json> XdsHttpGcpAuthnFilter::GenerateFilterConfigOverride(
-    absl::string_view /*instance_name*/,
-    const XdsResourceType::DecodeContext& /*context*/,
-    const XdsExtension& /*extension*/, ValidationErrors* errors) const {
-  errors->AddError("GCP auth filter does not support config override");
-  return std::nullopt;
-}
-
 const grpc_channel_filter* XdsHttpGcpAuthnFilter::channel_filter() const {
   return &GcpAuthenticationFilter::kFilterVtable;
 }
@@ -119,66 +60,31 @@ void XdsHttpGcpAuthnFilter::AddFilter(
   builder.AddFilter<GcpAuthenticationFilter>(std::move(config));
 }
 
-ChannelArgs XdsHttpGcpAuthnFilter::ModifyChannelArgs(
-    const ChannelArgs& args) const {
-  return args.Set(GRPC_ARG_PARSE_GCP_AUTHENTICATION_METHOD_CONFIG, 1);
-}
-
-absl::StatusOr<XdsHttpFilterImpl::ServiceConfigJsonEntry>
-XdsHttpGcpAuthnFilter::GenerateMethodConfig(
-    const Json& /*hcm_filter_config*/,
-    const Json* /*filter_config_override*/) const {
-  return ServiceConfigJsonEntry{"", ""};
-}
-
-absl::StatusOr<XdsHttpFilterImpl::ServiceConfigJsonEntry>
-XdsHttpGcpAuthnFilter::GenerateServiceConfig(
-    const Json& hcm_filter_config) const {
-  return ServiceConfigJsonEntry{"gcp_authentication",
-                                JsonDump(hcm_filter_config)};
-}
-
-void XdsHttpGcpAuthnFilter::UpdateBlackboard(const Json& hcm_filter_config,
-                                             const Blackboard* old_blackboard,
-                                             Blackboard* new_blackboard) const {
-  ValidationErrors errors;
-  auto config = LoadFromJson<GcpAuthenticationParsedConfig::Config>(
-      hcm_filter_config, JsonArgs(), &errors);
-  CHECK(errors.ok()) << errors.message("filter config validation failed");
-  RefCountedPtr<GcpAuthenticationFilter::CallCredentialsCache> cache;
-  if (old_blackboard != nullptr) {
-    cache = old_blackboard->Get<GcpAuthenticationFilter::CallCredentialsCache>(
-        config.filter_instance_name);
-  }
-  if (cache != nullptr) {
-    cache->SetMaxSize(config.cache_size);
-  } else {
-    cache = MakeRefCounted<GcpAuthenticationFilter::CallCredentialsCache>(
-        config.cache_size);
-  }
-  CHECK_NE(new_blackboard, nullptr);
-  new_blackboard->Set(config.filter_instance_name, std::move(cache));
-}
-
-void XdsHttpGcpAuthnFilter::UpdateBlackboard(const FilterConfig& config,
-                                             const Blackboard* old_blackboard,
-                                             Blackboard* new_blackboard) const {
-  const auto& filter_config =
-      DownCast<const GcpAuthenticationFilter::Config&>(config);
-  ValidationErrors errors;
-  RefCountedPtr<GcpAuthenticationFilter::CallCredentialsCache> cache;
-  if (old_blackboard != nullptr) {
-    cache = old_blackboard->Get<GcpAuthenticationFilter::CallCredentialsCache>(
-        filter_config.instance_name);
-  }
-  if (cache != nullptr) {
-    cache->SetMaxSize(filter_config.cache_size);
-  } else {
-    cache = MakeRefCounted<GcpAuthenticationFilter::CallCredentialsCache>(
-        filter_config.cache_size);
-  }
-  CHECK_NE(new_blackboard, nullptr);
-  new_blackboard->Set(filter_config.instance_name, std::move(cache));
+RefCountedPtr<const FilterConfig> XdsHttpGcpAuthnFilter::MergeConfigs(
+    RefCountedPtr<const FilterConfig> top_level_config,
+    RefCountedPtr<const FilterConfig> /*virtual_host_override_config*/,
+    RefCountedPtr<const FilterConfig> /*route_override_config*/,
+    RefCountedPtr<const FilterConfig> /*cluster_weight_override_config*/,
+    Blackboard& blackboard) const {
+  // Make a copy of the parsed config.
+  const auto& parsed_config =
+      DownCast<const GcpAuthenticationFilter::Config&>(*top_level_config);
+  auto new_config = MakeRefCounted<GcpAuthenticationFilter::Config>();
+  new_config->instance_name = parsed_config.instance_name;
+  new_config->cache_size = parsed_config.cache_size;
+  // Get the cache from the blackboard, adding it if necessary.
+  bool constructed = false;
+  new_config->cache = blackboard.GetOrSet<
+      GcpAuthenticationFilter::CallCredentialsCache>(
+      new_config->instance_name, [&]() {
+        constructed = true;
+        return MakeRefCounted<GcpAuthenticationFilter::CallCredentialsCache>(
+            new_config->cache_size);
+      });
+  // If we didn't just construct the cache object, make sure it has the
+  // right size.
+  if (!constructed) new_config->cache->SetMaxSize(new_config->cache_size);
+  return new_config;
 }
 
 RefCountedPtr<const FilterConfig> XdsHttpGcpAuthnFilter::ParseTopLevelConfig(

data/src/core/xds/grpc/xds_http_gcp_authn_filter.h

@@ -37,20 +37,31 @@ class XdsHttpGcpAuthnFilter final : public XdsHttpFilterImpl {
   absl::string_view OverrideConfigProtoName() const override;
   void PopulateSymtab(upb_DefPool* symtab) const override;
   std::optional<Json> GenerateFilterConfig(
-      absl::string_view instance_name,
-      const XdsResourceType::DecodeContext& context,
-      const XdsExtension& extension, ValidationErrors* errors) const override;
+      absl::string_view /*instance_name*/,
+      const XdsResourceType::DecodeContext& /*context*/,
+      const XdsExtension& /*extension*/,
+      ValidationErrors* /*errors*/) const override {
+    return std::nullopt;
+  }
   std::optional<Json> GenerateFilterConfigOverride(
-      absl::string_view instance_name,
-      const XdsResourceType::DecodeContext& context,
-      const XdsExtension& extension, ValidationErrors* errors) const override;
+      absl::string_view /*instance_name*/,
+      const XdsResourceType::DecodeContext& /*context*/,
+      const XdsExtension& /*extension*/,
+      ValidationErrors* /*errors*/) const override {
+    return std::nullopt;
+  }
   const grpc_channel_filter* channel_filter() const override;
-  ChannelArgs ModifyChannelArgs(const ChannelArgs& args) const override;
   absl::StatusOr<ServiceConfigJsonEntry> GenerateMethodConfig(
-      const Json& hcm_filter_config,
-      const Json* filter_config_override) const override;
+      const Json& /*hcm_filter_config*/,
+      const Json* /*filter_config_override*/) const override {
+    return absl::UnimplementedError(
+        "old-style filter config APIs not supported");
+  }
   absl::StatusOr<ServiceConfigJsonEntry> GenerateServiceConfig(
-      const Json& hcm_filter_config) const override;
+      const Json& /*hcm_filter_config*/) const override {
+    return absl::UnimplementedError(
+        "old-style filter config APIs not supported");
+  }
   void AddFilter(FilterChainBuilder& builder,
                  RefCountedPtr<const FilterConfig> config) const override;
   RefCountedPtr<const FilterConfig> ParseTopLevelConfig(
@@ -61,11 +72,12 @@ class XdsHttpGcpAuthnFilter final : public XdsHttpFilterImpl {
       absl::string_view instance_name,
       const XdsResourceType::DecodeContext& context,
       const XdsExtension& extension, ValidationErrors* errors) const override;
-  void UpdateBlackboard(const Json& config, const Blackboard* old_blackboard,
-                        Blackboard* new_blackboard) const override;
-  void UpdateBlackboard(const FilterConfig& config,
-                        const Blackboard* old_blackboard,
-                        Blackboard* new_blackboard) const override;
+  RefCountedPtr<const FilterConfig> MergeConfigs(
+      RefCountedPtr<const FilterConfig> top_level_config,
+      RefCountedPtr<const FilterConfig> /*virtual_host_override_config*/,
+      RefCountedPtr<const FilterConfig> /*route_override_config*/,
+      RefCountedPtr<const FilterConfig> /*cluster_weight_override_config*/,
+      Blackboard& blackboard) const override;
   bool IsSupportedOnClients() const override { return true; }
   bool IsSupportedOnServers() const override { return false; }
 };

data/src/core/xds/grpc/xds_http_rbac_filter.cc

@@ -36,14 +36,13 @@
 #include "envoy/type/matcher/v3/string.upb.h"
 #include "envoy/type/v3/range.upb.h"
 #include "google/protobuf/wrappers.upb.h"
+#include "src/core/config/experiment_env_var.h"
 #include "src/core/ext/filters/rbac/rbac_filter.h"
 #include "src/core/ext/filters/rbac/rbac_service_config_parser.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/util/down_cast.h"
-#include "src/core/util/env.h"
 #include "src/core/util/json/json.h"
 #include "src/core/util/json/json_writer.h"
-#include "src/core/util/string.h"
 #include "src/core/util/upb_utils.h"
 #include "src/core/xds/grpc/xds_audit_logger_registry.h"
 #include "src/core/xds/grpc/xds_bootstrap_grpc.h"
@@ -60,15 +59,6 @@ namespace grpc_core {
 
 namespace {
 
-// TODO(lwge): Remove once the feature is stable.
-bool XdsRbacAuditLoggingEnabled() {
-  auto value = GetEnv("GRPC_EXPERIMENTAL_XDS_RBAC_AUDIT_LOGGING");
-  if (!value.has_value()) return false;
-  bool parsed_value;
-  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
-  return parse_succeeded && parsed_value;
-}
-
 Json ParseRegexMatcherToJson(
     const envoy_type_matcher_v3_RegexMatcher* regex_matcher) {
   return Json::FromObject(
@@ -479,7 +469,8 @@ Json ParseHttpRbacToJson(const XdsResourceType::DecodeContext& context,
                               Json::FromObject(std::move(policies_object)));
     }
     // Flatten the nested messages defined in rbac.proto
-    if (XdsRbacAuditLoggingEnabled() &&
+    // TODO(lwge): Remove env var guard once the feature is stable.
+    if (IsExperimentEnvVarEnabled("GRPC_EXPERIMENTAL_XDS_RBAC_AUDIT_LOGGING") &&
         envoy_config_rbac_v3_RBAC_has_audit_logging_options(rules)) {
       ValidationErrors::ScopedField field(errors, ".audit_logging_options");
       const auto* audit_logging_options =