Merge pull request #28353 from vespa-engine/mortent/override-port-filters

Override filter port bindings

6 files changed, 55 insertions, 16 deletions

diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/http/xml/HttpBuilder.java b/config-model/src/main/java/com/yahoo/vespa/model/container/http/xml/HttpBuilder.java
index ae13bed4bb4..d276bf3b850 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/http/xml/HttpBuilder.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/http/xml/HttpBuilder.java
@@ -22,6 +22,7 @@ import org.w3c.dom.Element;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Optional;
+import java.util.Set;
 import java.util.logging.Level;
 
 /**
@@ -33,6 +34,12 @@ public class HttpBuilder extends VespaDomBuilder.DomConfigProducerBuilderBase<Ht
     static final String REQUEST_CHAIN_TAG_NAME = "request-chain";
     static final String RESPONSE_CHAIN_TAG_NAME = "response-chain";
     static final List<String> VALID_FILTER_CHAIN_TAG_NAMES = List.of(REQUEST_CHAIN_TAG_NAME, RESPONSE_CHAIN_TAG_NAME);
+    private final Set<Integer> portBindingOverrides;
+
+    public HttpBuilder(Set<Integer> portBindingOverrides) {
+        super();
+        this.portBindingOverrides = portBindingOverrides;
+    }
 
     @Override
     protected Http doBuild(DeployState deployState, TreeConfigProducer<AnyConfigProducer> ancestor, Element spec) {
@@ -44,7 +51,7 @@ public class HttpBuilder extends VespaDomBuilder.DomConfigProducerBuilderBase<Ht
         Element filteringElem = XML.getChild(spec, "filtering");
         if (filteringElem != null) {
             filterChains = new FilterChainsBuilder().build(deployState, ancestor, filteringElem);
-            bindings = readFilterBindings(filteringElem);
+            bindings = readFilterBindings(filteringElem, this.portBindingOverrides);
             strictFiltering = XmlHelper.getOptionalAttribute(filteringElem, "strict-mode")
                     .map(Boolean::valueOf);
 
@@ -140,7 +147,7 @@ public class HttpBuilder extends VespaDomBuilder.DomConfigProducerBuilderBase<Ht
         return Optional.of((ApplicationContainerCluster) currentProducer);
     }
 
-    private List<FilterBinding> readFilterBindings(Element filteringSpec) {
+    private List<FilterBinding> readFilterBindings(Element filteringSpec, Set<Integer> portBindingOverride) {
         List<FilterBinding> result = new ArrayList<>();
 
         for (Element child: XML.getChildren(filteringSpec)) {
@@ -150,7 +157,14 @@ public class HttpBuilder extends VespaDomBuilder.DomConfigProducerBuilderBase<Ht
 
                 for (Element bindingSpec: XML.getChildren(child, "binding")) {
                     String binding = XML.getValue(bindingSpec);
-                    result.add(FilterBinding.create(toFilterBindingType(tagName), chainId, UserBindingPattern.fromPattern(binding)));
+                    if (portBindingOverride.isEmpty()) {
+                        result.add(FilterBinding.create(toFilterBindingType(tagName), chainId, UserBindingPattern.fromPattern(binding)));
+                    } else {
+                        UserBindingPattern userBindingPattern = UserBindingPattern.fromPattern(binding);
+                        portBindingOverride.stream()
+                                .map(userBindingPattern::withOverriddenPort)
+                                .forEach(pattern -> result.add(FilterBinding.create(toFilterBindingType(tagName), chainId, pattern)));
+                    }
                 }
             }
         }
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerModelBuilder.java b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerModelBuilder.java
index b603f9f0ba1..459c54a2805 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerModelBuilder.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerModelBuilder.java
@@ -444,7 +444,7 @@ public class ContainerModelBuilder extends ConfigModelBuilder<ContainerModel> {
     protected void addHttp(DeployState deployState, Element spec, ApplicationContainerCluster cluster, ConfigModelContext context) {
         Element httpElement = XML.getChild(spec, "http");
         if (httpElement != null) {
-            cluster.setHttp(buildHttp(deployState, cluster, httpElement));
+            cluster.setHttp(buildHttp(deployState, cluster, httpElement, context));
         }
         if (isHostedTenantApplication(context)) {
             addHostedImplicitHttpIfNotPresent(deployState, cluster);
@@ -707,8 +707,8 @@ public class ContainerModelBuilder extends ConfigModelBuilder<ContainerModel> {
                 .configureHttpFilterChains(http);
     }
 
-    private Http buildHttp(DeployState deployState, ApplicationContainerCluster cluster, Element httpElement) {
-        Http http = new HttpBuilder().build(deployState, cluster, httpElement);
+    private Http buildHttp(DeployState deployState, ApplicationContainerCluster cluster, Element httpElement, ConfigModelContext context) {
+        Http http = new HttpBuilder(portBindingOverride(deployState, context)).build(deployState, cluster, httpElement);
 
         if (networking == Networking.disable)
             http.removeAllServers();
@@ -836,10 +836,9 @@ public class ContainerModelBuilder extends ConfigModelBuilder<ContainerModel> {
     }
 
     private void addUserHandlers(DeployState deployState, ApplicationContainerCluster cluster, Element spec, ConfigModelContext context) {
-        var portBindingOverride = isHostedTenantApplication(context) ? getDataplanePorts(deployState) : Set.<Integer>of();
         for (Element component: XML.getChildren(spec, "handler")) {
             cluster.addComponent(
-                    new DomHandlerBuilder(cluster, portBindingOverride).build(deployState, cluster, component));
+                    new DomHandlerBuilder(cluster, portBindingOverride(deployState, context)).build(deployState, cluster, component));
         }
     }
 
@@ -1172,11 +1171,14 @@ public class ContainerModelBuilder extends ConfigModelBuilder<ContainerModel> {
 
         ContainerDocumentApi.HandlerOptions documentApiOptions = DocumentApiOptionsBuilder.build(documentApiElement);
         Element ignoreUndefinedFields = XML.getChild(documentApiElement, "ignore-undefined-fields");
-        var portBindingOverride = isHostedTenantApplication(context)
+        return new ContainerDocumentApi(cluster, documentApiOptions,
+                                        "true".equals(XML.getValue(ignoreUndefinedFields)), portBindingOverride(deployState, context));
+    }
+
+    private Set<Integer> portBindingOverride(DeployState deployState, ConfigModelContext context) {
+        return isHostedTenantApplication(context)
                 ? getDataplanePorts(deployState)
                 : Set.<Integer>of();
-        return new ContainerDocumentApi(cluster, documentApiOptions,
-                                        "true".equals(XML.getValue(ignoreUndefinedFields)), portBindingOverride);
     }
 
     private ContainerDocproc buildDocproc(DeployState deployState, ApplicationContainerCluster cluster, Element spec) {
diff --git a/config-model/src/test/java/com/yahoo/vespa/model/container/http/FilterBindingsTest.java b/config-model/src/test/java/com/yahoo/vespa/model/container/http/FilterBindingsTest.java
index 787a8255628..70a859af010 100644
--- a/config-model/src/test/java/com/yahoo/vespa/model/container/http/FilterBindingsTest.java
+++ b/config-model/src/test/java/com/yahoo/vespa/model/container/http/FilterBindingsTest.java
@@ -14,6 +14,8 @@ import com.yahoo.vespa.model.container.xml.ContainerModelBuilder.Networking;
 import org.junit.jupiter.api.Test;
 import org.w3c.dom.Element;
 
+import java.util.Set;
+
 import static com.yahoo.collections.CollectionUtil.first;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
@@ -26,7 +28,7 @@ public class FilterBindingsTest extends DomBuilderTest {
     private static final BindingPattern MY_CHAIN_BINDING = UserBindingPattern.fromHttpPath("/my-chain-binding");
 
     private Http buildHttp(Element xml) {
-        Http http = new HttpBuilder().build(root.getDeployState(), root, xml);
+        Http http = new HttpBuilder(Set.of()).build(root.getDeployState(), root, xml);
         root.freezeModelTopology();
         http.validate();
         return http;
@@ -108,4 +110,21 @@ public class FilterBindingsTest extends DomBuilderTest {
         }
     }
 
+    @Test
+    void filter_binding_ports_are_overriden() {
+        Element xml = parse(
+                "<http>",
+                "  <filtering>",
+                "    <request-chain id='my-request-chain'>",
+                "      <binding>http://*/my-binding</binding>",
+                "    </request-chain>",
+                "  </filtering>",
+                "</http>");
+        Http http = new HttpBuilder(Set.of(4443)).build(root.getDeployState(), root, xml);
+        root.freezeModelTopology();
+        http.validate();
+        FilterBinding binding = first(http.getBindings());
+        assertEquals("my-request-chain", binding.chainId().getName());
+        assertEquals("http://*:4443/my-binding", binding.binding().patternString());
+    }
 }
diff --git a/config-model/src/test/java/com/yahoo/vespa/model/container/http/FilterChainsTest.java b/config-model/src/test/java/com/yahoo/vespa/model/container/http/FilterChainsTest.java
index 990896acb01..1c60205039f 100644
--- a/config-model/src/test/java/com/yahoo/vespa/model/container/http/FilterChainsTest.java
+++ b/config-model/src/test/java/com/yahoo/vespa/model/container/http/FilterChainsTest.java
@@ -9,6 +9,8 @@ import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.w3c.dom.Element;
 
+import java.util.Set;
+
 import static com.yahoo.collections.CollectionUtil.first;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
@@ -23,7 +25,7 @@ public class FilterChainsTest extends DomBuilderTest {
 
     @BeforeEach
     public void setupFilterChains() {
-        http = new HttpBuilder().build(root.getDeployState(), root, servicesXml());
+        http = new HttpBuilder(Set.of()).build(root.getDeployState(), root, servicesXml());
         root.freezeModelTopology();
     }
 
diff --git a/config-model/src/test/java/com/yahoo/vespa/model/container/http/FilterConfigTest.java b/config-model/src/test/java/com/yahoo/vespa/model/container/http/FilterConfigTest.java
index 76a3dcb2788..a1f9661de14 100644
--- a/config-model/src/test/java/com/yahoo/vespa/model/container/http/FilterConfigTest.java
+++ b/config-model/src/test/java/com/yahoo/vespa/model/container/http/FilterConfigTest.java
@@ -8,6 +8,8 @@ import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.w3c.dom.Element;
 
+import java.util.Set;
+
 import static com.yahoo.collections.CollectionUtil.first;
 import static com.yahoo.vespa.model.container.http.FilterConfigProvider.configProviderId;
 import static org.junit.jupiter.api.Assertions.*;
@@ -22,7 +24,7 @@ public class FilterConfigTest extends DomBuilderTest {
 
     @BeforeEach
     public void setupFilterChains() {
-        http = new HttpBuilder().build(root.getDeployState(), root, servicesXml());
+        http = new HttpBuilder(Set.of()).build(root.getDeployState(), root, servicesXml());
         root.freezeModelTopology();
     }
 
diff --git a/config-model/src/test/java/com/yahoo/vespa/model/container/xml/AccessControlTest.java b/config-model/src/test/java/com/yahoo/vespa/model/container/xml/AccessControlTest.java
index 697d2d422e8..740986bb000 100644
--- a/config-model/src/test/java/com/yahoo/vespa/model/container/xml/AccessControlTest.java
+++ b/config-model/src/test/java/com/yahoo/vespa/model/container/xml/AccessControlTest.java
@@ -225,7 +225,7 @@ public class AccessControlTest extends ContainerModelBuilderTestBase {
                 "http://*:4443/metrics/v2/*")));
 
         Set<String> actualCustomChainBindings = getFilterBindings(http, ComponentId.fromString("my-custom-request-chain"));
-        assertTrue(actualCustomChainBindings.containsAll(List.of("http://*/custom-handler/*", "http://*/")));
+        assertTrue(actualCustomChainBindings.containsAll(List.of("http://*:4443/custom-handler/*", "http://*:4443/")));
     }
 
     @Test
@@ -262,7 +262,7 @@ public class AccessControlTest extends ContainerModelBuilderTestBase {
                 "http://*:4443/custom-handler/*")));
 
         Set<String> actualCustomChainBindings = getFilterBindings(http, ComponentId.fromString("my-custom-response-chain"));
-        assertTrue(actualCustomChainBindings.contains("http://*/custom-handler/*"));
+        assertTrue(actualCustomChainBindings.contains("http://*:4443/custom-handler/*"));
     }
 
     @Test