Migrate peer_metadata HTTP filter from istio/proxy to contrib

[Copilot]

Migrates the peer_metadata HTTP filter extension from istio/proxy to Envoy's contrib extensions, enabling peer telemetry attribute discovery and propagation for service mesh observability.

Components Added

Proto API (api/contrib/envoy/extensions/filters/http/peer_metadata/v3alpha/)

• Configuration for discovery methods: XDS workload discovery, Istio header exchange
• Propagation methods for upstream/downstream metadata injection
• Namespace: envoy.extensions.filters.http.peer_metadata.v3alpha

Common Libraries (contrib/common/)

• metadata_object - Workload metadata serialization/deserialization, protocol buffer conversion
• workload_discovery - Stub API for XDS-based metadata provider (extensible)

Filter Implementation (contrib/peer_metadata/filters/http/source/)

• Discovery: Derives peer metadata from XDS or Istio headers (x-envoy-peer-metadata)
• Propagation: Injects metadata into request/response headers with external cluster filtering
• Caching: LRU cache (500 entries) for decoded metadata
• Filter state integration: Stores metadata for downstream consumer filters

Tests (contrib/peer_metadata/filters/http/test/)

• Discovery methods (XDS, Istio headers, fallback chains)
• Propagation with skip rules for external clusters
• Cache behavior and metadata parsing

Key Adaptations

• Updated proto namespace from io.istio.http.peer_metadata to Envoy's v3alpha convention
• Stubbed XDS workload discovery (returns null provider, can be enhanced with full implementation)
• Preserved Istio metadata exchange protocol compatibility
• Registered in contrib build system with proper metadata annotations

Example Configuration

downstream_discovery:
  - workload_discovery: {}  # XDS-based discovery
  - istio_headers: {}       # Fallback to header exchange
upstream_propagation:
  - istio_headers:
      skip_external_clusters: true  # Don't leak metadata outside mesh

The filter discovers peer metadata during request processing and stores it in filter state as downstream_peer/upstream_peer for telemetry filters to consume.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• dl.google.com
  • Triggering command: /build/bazel_root/install/fb2a7f6d344d2f4e335882534df59296/embedded_tools/jdk/bin/java bazel(envoy) --add-opens=java.base/java.lang=ALL-UNNAMED -Xverify:none -Djava.util.logging.config.file=/build/bazel_root/base/javalog.properties -Dcom.google.devtools.build.lib.util.LogHandlerQuerier.class=com.google.devtools.build.lib.util.SimpleLogHandler$HandlerQuerier -XX:-MaxFDLimit -Djava.library.path=/build/bazel_root/install/fb2a7f6d344d2f4e335882534df59296/embedded_tools/jdk/lib:/build/bazel_root/install/fb2a7f6d344d2f4e335882534df59296/embedded_tools/jdk/lib/server:/build/bazel_root/install/fb2a7f6d344d2f4e335882534df59296/ -Dfile.encoding=ISO-8859-1 -Duser.country= -Duser.language= -Duser.variant= -Xmx3g -DBAZEL_TRACK_SOURCE_DIRECTORIES=1 -Djavax.net.ssl.trustStore=/tmp/custom-cacerts -Djavax.net.ssl.trustStorePassword=changeit -jar /build/bazel_root/install/fb2a7f6d344d2f4e335882534df59296/A-server.jar --max_idle_secs=10800 --noshutdown_on_low_sys_mem --connect_timeout_secs=30 (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

migrate the peer_metadata extension from the istio/proxy to the wbpcode/envoy's contrib extensions. You can find the peer_metadata from https://github.com/istio/proxy and the main code in the https://github.com/istio/proxy/tree/master/source/extensions/filters/http/peer_metadata.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.