context: move the secret manager and ssl context manager to server context (envoyproxy#39027)

Both secret manager and ssl context manager are server wide resource and
should be accessed by server factory context.

This provides a unified way to access all server wide resources. See
envoyproxy#26476 for more detail for why
we do this.

And after this PR is merged, we can use GenericFactoryContext to replace
TransportSocketFactoryContext.

Signed-off-by: wangbaiping(wbpcode) <wbphub@gmail.com>

Author: wbpcode

contrib/cryptomb/private_key_providers/test/config_test.cc

@@ -5,7 +5,7 @@
 
 #include "test/common/stats/stat_test_utility.h"
 #include "test/mocks/common.h"
-#include "test/mocks/server/transport_socket_factory_context.h"
+#include "test/mocks/server/factory_context.h"
 #include "test/mocks/ssl/mocks.h"
 #include "test/mocks/thread_local/mocks.h"
 #include "test/test_common/environment.h"
@@ -37,7 +37,8 @@ class CryptoMbConfigTest : public Event::TestUsingSimulatedTime, public testing:
   CryptoMbConfigTest() : api_(Api::createApiForTest(store_, time_system_)) {
     ON_CALL(factory_context_.server_context_, api()).WillByDefault(ReturnRef(*api_));
     ON_CALL(factory_context_.server_context_, threadLocal()).WillByDefault(ReturnRef(tls_));
-    ON_CALL(factory_context_, sslContextManager()).WillByDefault(ReturnRef(context_manager_));
+    ON_CALL(factory_context_.server_context_, sslContextManager())
+        .WillByDefault(ReturnRef(context_manager_));
     ON_CALL(context_manager_, privateKeyMethodManager())
         .WillByDefault(ReturnRef(private_key_method_manager_));
   }
@@ -48,7 +49,8 @@ class CryptoMbConfigTest : public Event::TestUsingSimulatedTime, public testing:
     Registry::InjectFactory<Ssl::PrivateKeyMethodProviderInstanceFactory>
         cryptomb_private_key_method_factory(cryptomb_factory);
 
-    return factory_context_.sslContextManager()
+    return factory_context_.serverFactoryContext()
+        .sslContextManager()
         .privateKeyMethodManager()
         .createPrivateKeyMethodProvider(parsePrivateKeyProviderFromV3Yaml(yaml), factory_context_);
   }

contrib/qat/private_key_providers/test/config_test.cc

@@ -5,7 +5,7 @@
 
 #include "test/common/stats/stat_test_utility.h"
 #include "test/mocks/common.h"
-#include "test/mocks/server/transport_socket_factory_context.h"
+#include "test/mocks/server/server_factory_context.h"
 #include "test/mocks/ssl/mocks.h"
 #include "test/mocks/thread_local/mocks.h"
 #include "test/test_common/environment.h"
@@ -50,7 +50,8 @@ class QatConfigTest : public Event::TestUsingSimulatedTime, public testing::Test
       : api_(Api::createApiForTest(store_, time_system_)),
         libqat_(std::make_shared<FakeLibQatCryptoImpl>()), fsm_(libqat_) {
     ON_CALL(factory_context_.server_context_, api()).WillByDefault(ReturnRef(*api_));
-    ON_CALL(factory_context_, sslContextManager()).WillByDefault(ReturnRef(context_manager_));
+    ON_CALL(factory_context_.server_context_, sslContextManager())
+        .WillByDefault(ReturnRef(context_manager_));
     ON_CALL(context_manager_, privateKeyMethodManager())
         .WillByDefault(ReturnRef(private_key_method_manager_));
     ON_CALL(factory_context_.server_context_, singletonManager()).WillByDefault(ReturnRef(fsm_));
@@ -61,7 +62,8 @@ class QatConfigTest : public Event::TestUsingSimulatedTime, public testing::Test
     Registry::InjectFactory<Ssl::PrivateKeyMethodProviderInstanceFactory>
         qat_private_key_method_factory(qat_factory);
 
-    return factory_context_.sslContextManager()
+    return factory_context_.serverFactoryContext()
+        .sslContextManager()
         .privateKeyMethodManager()
         .createPrivateKeyMethodProvider(parsePrivateKeyProviderFromV3Yaml(yaml), factory_context_);
   }

contrib/qat/private_key_providers/test/ops_test.cc

@@ -6,7 +6,7 @@
 #include "source/common/tls/private_key/private_key_manager_impl.h"
 
 #include "test/common/stats/stat_test_utility.h"
-#include "test/mocks/server/transport_socket_factory_context.h"
+#include "test/mocks/server/server_factory_context.h"
 #include "test/test_common/environment.h"
 #include "test/test_common/simulated_time_system.h"
 #include "test/test_common/utility.h"
@@ -110,7 +110,7 @@ class QatProviderRsaTest : public QatProviderTest {
     rsa_ = EVP_PKEY_get0_RSA(pkey_.get());
     libqat_->setRsaKey(rsa_);
   }
-  bssl::UniquePtr<EVP_PKEY> pkey_{};
+  bssl::UniquePtr<EVP_PKEY> pkey_;
   RSA* rsa_{};
 };
 

contrib/sxg/filters/http/test/filter_test.cc

@@ -375,10 +375,12 @@ TEST_F(FilterTest, SdsDynamicGenericSecret) {
 
   auto certificate_secret_provider = secret_manager.findOrCreateGenericSecretProvider(
       config_source, "certificate", secret_context, init_manager);
-  auto certificate_callback = secret_context.cluster_manager_.subscription_factory_.callbacks_;
+  auto certificate_callback =
+      secret_context.server_context_.cluster_manager_.subscription_factory_.callbacks_;
   auto private_key_secret_provider = secret_manager.findOrCreateGenericSecretProvider(
       config_source, "private_key", secret_context, init_manager);
-  auto private_key_callback = secret_context.cluster_manager_.subscription_factory_.callbacks_;
+  auto private_key_callback =
+      secret_context.server_context_.cluster_manager_.subscription_factory_.callbacks_;
 
   NiceMock<ThreadLocal::MockInstance> tls;
   SDSSecretReader secret_reader(std::move(certificate_secret_provider),

envoy/server/factory_context.h

@@ -229,6 +229,16 @@ class ServerFactoryContext : public virtual CommonFactoryContext {
    * @return whether external healthchecks are currently failed or not.
    */
   virtual bool healthCheckFailed() const PURE;
+
+  /**
+   * @return Ssl::ContextManager& the SSL context manager.
+   */
+  virtual Ssl::ContextManager& sslContextManager() PURE;
+
+  /**
+   * Return the instance of secret manager.
+   */
+  virtual Secret::SecretManager& secretManager() PURE;
 };
 
 // ServerFactoryContextInstance is a thread local singleton that provides access to the

envoy/server/transport_socket_config.h

@@ -34,35 +34,17 @@ class TransportSocketFactoryContext {
    */
   virtual ServerFactoryContext& serverFactoryContext() PURE;
 
-  /**
-   * @return Upstream::ClusterManager& singleton for use by the entire server.
-   * TODO(wbpcode): clusterManager() of ServerFactoryContext still be invalid when loading
-   * static cluster. So we need to provide an cluster manager reference here.
-   * This could be removed after https://github.com/envoyproxy/envoy/issues/26653 is resolved.
-   */
-  virtual Upstream::ClusterManager& clusterManager() PURE;
-
   /**
    * @return ProtobufMessage::ValidationVisitor& validation visitor for cluster configuration
    * messages.
    */
   virtual ProtobufMessage::ValidationVisitor& messageValidationVisitor() PURE;
 
-  /**
-   * @return Ssl::ContextManager& the SSL context manager.
-   */
-  virtual Ssl::ContextManager& sslContextManager() PURE;
-
   /**
    * @return Stats::Scope& the transport socket's stats scope.
    */
   virtual Stats::Scope& statsScope() PURE;
 
-  /**
-   * Return the instance of secret manager.
-   */
-  virtual Secret::SecretManager& secretManager() PURE;
-
   /**
    * @return the init manager of the particular context.
    */

mobile/test/common/integration/BUILD

@@ -77,8 +77,8 @@ envoy_cc_test_library(
         "@envoy//source/exe:process_wide_lib",
         "@envoy//test/integration:autonomous_upstream_lib",
         "@envoy//test/integration:utility_lib",
+        "@envoy//test/mocks/server:factory_context_mocks",
         "@envoy//test/mocks/server:server_factory_context_mocks",
-        "@envoy//test/mocks/server:transport_socket_factory_context_mocks",
         "@envoy//test/test_common:environment_lib",
         "@envoy_build_config//:extension_registry",
     ] + envoy_select_signal_trace(

mobile/test/common/integration/test_server.cc

@@ -136,7 +136,7 @@ TestServer::TestServer()
   ON_CALL(factory_context_.server_context_, api()).WillByDefault(testing::ReturnRef(*api_));
   ON_CALL(factory_context_, statsScope())
       .WillByDefault(testing::ReturnRef(*stats_store_.rootScope()));
-  ON_CALL(factory_context_, sslContextManager())
+  ON_CALL(factory_context_.server_context_, sslContextManager())
       .WillByDefault(testing::ReturnRef(context_manager_));
 
   Envoy::ExtensionRegistry::registerFactories();

mobile/test/common/integration/test_server.h

@@ -9,7 +9,7 @@
 #include "envoy/extensions/transport_sockets/quic/v3/quic_transport.pb.h"
 #include "test/integration/autonomous_upstream.h"
 #include "test/mocks/server/server_factory_context.h"
-#include "test/mocks/server/transport_socket_factory_context.h"
+#include "test/mocks/server/server_factory_context.h"
 #include "test/integration/server.h"
 
 #include "tools/cpp/runfiles/runfiles.h"

source/common/listener_manager/listener_impl.cc

@@ -335,8 +335,7 @@ ListenerImpl::ListenerImpl(const envoy::config::listener::v3::Listener& config,
                           }),
       transport_factory_context_(
           std::make_shared<Server::Configuration::TransportSocketFactoryContextImpl>(
-              parent_.server_.serverFactoryContext(), parent_.server_.sslContextManager(),
-              listenerScope(), parent_.server_.clusterManager(), validation_visitor_)),
+              parent_.server_.serverFactoryContext(), listenerScope(), validation_visitor_)),
       quic_stat_names_(parent_.quicStatNames()),
       missing_listener_config_stats_({ALL_MISSING_LISTENER_CONFIG_STATS(
           POOL_COUNTER(listener_factory_context_->listenerScope()))}) {