perf(xds): add x-kuma-tags conditionally

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/listeners.go

@@ -77,11 +77,15 @@ func generateFromService(
 	if svc.Outbound.Resource != nil && svc.Outbound.Resource.ResourceType == core_model.ResourceType(common_api.MeshExternalService) {
 		outboundRouteName = resourceName
 	}
+	var dpTags mesh_proto.MultiValueTagSet
+	if meshCtx.IsXKumaTagsUsed() {
+		dpTags = proxy.Dataplane.Spec.TagSet()
+	}
 	outboundRouteConfigurer := &xds.HttpOutboundRouteConfigurer{
 		Name:    outboundRouteName,
 		Service: svc.ServiceName,
 		Routes:  routes,
-		DpTags:  proxy.Dataplane.Spec.TagSet(),
+		DpTags:  dpTags,
 	}
 
 	filterChainBuilder.

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice-labels.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: outbound:default_backend___msvc_80
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic-real-meshservice.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: outbound:default_backend___msvc_80
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/basic.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: outbound:backend
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshexternalservice.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: default_example___extsvc_9090
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshmultizoneservice.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: outbound:default_multi-backend___mzsvc_80
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-meshservice.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: outbound:default_backend___msvc_80
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-route-outbound-with-tags-with-mtls.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: outbound:backend
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/default-route.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: outbound:backend
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:
@@ -60,10 +56,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: outbound:external-service
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/gateway-default-meshexternalservice.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: default_example___extsvc_9090
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/grpc-service.listeners.golden.yaml

@@ -22,10 +22,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: outbound:backend
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/headers-match.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: outbound:backend
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/httproute-meshexternalservice.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: default_example___extsvc_9090
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/match-priority.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: outbound:backend
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-custom-settings.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: default_example___extsvc_9090
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls-and-skipall.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: default_example___extsvc_9090
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/meshexternalservice-with-tls.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: default_example___extsvc_9090
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/mixed-tcp-and-http-outbounds.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: outbound:backend
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/request-header-modifiers.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: outbound:backend
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/request-mirror.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: outbound:backend
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/request-redirect.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: outbound:backend
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/response-header-modifiers.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: outbound:backend
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/plugins/policies/meshhttproute/plugin/v1alpha1/testdata/url-rewrite.listeners.golden.yaml

@@ -18,10 +18,6 @@ resources:
           normalizePath: true
           routeConfig:
             name: outbound:backend
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/protocol=http&&kuma.io/service=web&'
             validateClusters: false
             virtualHosts:
             - domains:

pkg/xds/context/context.go

@@ -295,6 +295,10 @@ func (mc *MeshContext) GetTLSReadiness() map[string]bool {
 	return tlsReady
 }
 
+func (mc *MeshContext) IsXKumaTagsUsed() bool {
+	return len(mc.Resources.RateLimits().Items) > 0 || len(mc.Resources.FaultInjections().Items) > 0 || len(mc.Resources.MeshFaultInjections().Items) > 0
+}
+
 // AggregatedMeshContexts is an aggregate of all MeshContext across all meshes
 type AggregatedMeshContexts struct {
 	Hash               string

pkg/xds/context/resources.go

@@ -12,6 +12,7 @@ import (
 	core_model "github.com/kumahq/kuma/pkg/core/resources/model"
 	"github.com/kumahq/kuma/pkg/core/resources/registry"
 	"github.com/kumahq/kuma/pkg/core/xds"
+	meshfaultinjection_api "github.com/kumahq/kuma/pkg/plugins/policies/meshfaultinjection/api/v1alpha1"
 	"github.com/kumahq/kuma/pkg/util/maps"
 )
 
@@ -146,6 +147,10 @@ func (r Resources) VirtualOutbounds() *core_mesh.VirtualOutboundResourceList {
 	return r.ListOrEmpty(core_mesh.VirtualOutboundType).(*core_mesh.VirtualOutboundResourceList)
 }
 
+func (r Resources) MeshFaultInjections() *meshfaultinjection_api.MeshFaultInjectionResourceList {
+	return r.ListOrEmpty(meshfaultinjection_api.MeshFaultInjectionType).(*meshfaultinjection_api.MeshFaultInjectionResourceList)
+}
+
 func (r Resources) Meshes() *core_mesh.MeshResourceList {
 	return r.ListOrEmpty(core_mesh.MeshType).(*core_mesh.MeshResourceList)
 }

pkg/xds/generator/outbound_proxy_generator.go

@@ -101,6 +101,10 @@ func (OutboundProxyGenerator) generateLDS(ctx xds_context.Context, proxy *model.
 	if timeoutPolicy := proxy.Policies.Timeouts[oface]; timeoutPolicy != nil {
 		timeoutPolicyConf = timeoutPolicy.Spec.GetConf()
 	}
+	var dpTags mesh_proto.MultiValueTagSet
+	if ctx.Mesh.IsXKumaTagsUsed() {
+		dpTags = proxy.Dataplane.Spec.TagSet()
+	}
 	filterChainBuilder := func() *envoy_listeners.FilterChainBuilder {
 		filterChainBuilder := envoy_listeners.NewFilterChainBuilder(proxy.APIVersion, envoy_common.AnonymousResource)
 		switch protocol {
@@ -116,7 +120,7 @@ func (OutboundProxyGenerator) generateLDS(ctx xds_context.Context, proxy *model.
 				)).
 				Configure(envoy_listeners.HttpAccessLog(meshName, envoy_common.TrafficDirectionOutbound, sourceService, serviceName,
 					ctx.Mesh.GetLoggingBackend(proxy.Policies.TrafficLogs[serviceName]), proxy)).
-				Configure(envoy_listeners.HttpOutboundRoute(serviceName, routes, proxy.Dataplane.Spec.TagSet())).
+				Configure(envoy_listeners.HttpOutboundRoute(serviceName, routes, dpTags)).
 				// backwards compatibility to support RateLimit for ExternalServices without ZoneEgress
 				ConfigureIf(!ctx.Mesh.Resource.ZoneEgressEnabled(), envoy_listeners.RateLimit(rateLimits)).
 				Configure(envoy_listeners.Retry(retryPolicy, protocol)).

pkg/xds/generator/testdata/outbound-proxy/03.envoy.golden.yaml

@@ -459,10 +459,6 @@ resources:
               '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
           routeConfig:
             name: outbound:api-grpc
-            requestHeadersToAdd:
-            - header:
-                key: x-kuma-tags
-                value: '&kuma.io/service=gateway&'
             validateClusters: false
             virtualHosts:
             - domains: