Merge branch 'main' of https://github.com/envoyproxy/envoy into main

envoyproxy · Feb 19, 2025 · e1f335d · e1f335d
2 parents b0b0c8e + cedb633
commit e1f335d
Show file tree

Hide file tree

Showing 170 changed files with 2,579 additions and 684 deletions.
diff --git a/.bazelrc b/.bazelrc
@@ -382,7 +382,7 @@ build:compile-time-options --@envoy//source/extensions/filters/http/kill_request
 
 # Docker sandbox
 # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/main/toolchains/rbe_toolchains_config.bzl#L8
-build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:d2be0c198feda0c607fa33209da01bf737ef373f@sha256:026fb6710a3e55716cc1aba129f613f9834212d2deb4ea875ac9d2c37ca19aa3
+build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:506aa20d3a216fa2f5677c1f13d2b1656b000b86@sha256:63598080c3cccb6d7c9f3eeaa16fffd72f13f4c799d08ef891cd3f02978b6284
 build:docker-sandbox --spawn_strategy=docker
 build:docker-sandbox --strategy=Javac=docker
 build:docker-sandbox --strategy=Closure=docker
@@ -551,7 +551,7 @@ common:bes-envoy-engflow --bes_timeout=3600s
 common:bes-envoy-engflow --bes_upload_mode=fully_async
 common:bes-envoy-engflow --nolegacy_important_outputs
 common:rbe-envoy-engflow --remote_executor=grpcs://mordenite.cluster.engflow.com
-common:rbe-envoy-engflow --remote_default_exec_properties=container-image=docker://gcr.io/envoy-ci/envoy-build@sha256:6e494ff9bcfa96868cb43f1200f2126cdab39d62db52a5dda80c8ec1694a93ee
+common:rbe-envoy-engflow --remote_default_exec_properties=container-image=docker://gcr.io/envoy-ci/envoy-build@sha256:b4bc62cde8bc10ebc7e91e93fcf92e6e0737b705363478bfd14d86c92d80db2c
 common:rbe-envoy-engflow --jobs=200
 common:rbe-envoy-engflow --define=engflow_rbe=true
 

diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM gcr.io/envoy-ci/envoy-build:d2be0c198feda0c607fa33209da01bf737ef373f@sha256:6e494ff9bcfa96868cb43f1200f2126cdab39d62db52a5dda80c8ec1694a93ee
+FROM gcr.io/envoy-ci/envoy-build:506aa20d3a216fa2f5677c1f13d2b1656b000b86@sha256:b4bc62cde8bc10ebc7e91e93fcf92e6e0737b705363478bfd14d86c92d80db2c
 
 ARG USERNAME=vscode
 ARG USER_UID=501

diff --git a/.github/config.yml b/.github/config.yml
@@ -2,11 +2,11 @@ agent-ubuntu: ubuntu-24.04
 build-image:
   # Authoritative configuration for build image/s
   repo: envoyproxy/envoy-build-ubuntu
-  sha: 026fb6710a3e55716cc1aba129f613f9834212d2deb4ea875ac9d2c37ca19aa3
-  mobile-sha: d51387127bc3160b2c22b7b2d78f8182ad681a6d4feeeb5b55fda599dd7c4cbe
+  sha: 63598080c3cccb6d7c9f3eeaa16fffd72f13f4c799d08ef891cd3f02978b6284
+  mobile-sha: 67fa99e90cbc9a238ff7ad558993d68732a4ab59d3ef8d95b8e4373e24ea390b
   # this is authoritative, but is not currently used in github ci
-  gcr-sha: 6e494ff9bcfa96868cb43f1200f2126cdab39d62db52a5dda80c8ec1694a93ee
-  tag: d2be0c198feda0c607fa33209da01bf737ef373f
+  gcr-sha: b4bc62cde8bc10ebc7e91e93fcf92e6e0737b705363478bfd14d86c92d80db2c
+  tag: 506aa20d3a216fa2f5677c1f13d2b1656b000b86
 
 config:
   envoy:

diff --git a/.github/workflows/codeql-daily.yml b/.github/workflows/codeql-daily.yml
@@ -34,7 +34,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@df409f7d9260372bd5f19e5b04e83cb3c43714ae  # codeql-bundle-v3.27.9
+      uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0  # codeql-bundle-v3.28.9
       # Override language selection by uncommenting this and choosing your languages
       with:
         languages: cpp
@@ -75,6 +75,6 @@ jobs:
         git clean -xdf
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@df409f7d9260372bd5f19e5b04e83cb3c43714ae  # codeql-bundle-v3.27.9
+      uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0  # codeql-bundle-v3.28.9
       with:
         trap-caching: false
diff --git a/.github/workflows/codeql-push.yml b/.github/workflows/codeql-push.yml
@@ -67,7 +67,7 @@ jobs:
 
     - name: Initialize CodeQL
       if: ${{ env.BUILD_TARGETS != '' }}
-      uses: github/codeql-action/init@df409f7d9260372bd5f19e5b04e83cb3c43714ae  # codeql-bundle-v3.27.9
+      uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0  # codeql-bundle-v3.28.9
       with:
         languages: cpp
         trap-caching: false
@@ -112,6 +112,6 @@ jobs:
 
     - name: Perform CodeQL Analysis
       if: ${{ env.BUILD_TARGETS != '' }}
-      uses: github/codeql-action/analyze@df409f7d9260372bd5f19e5b04e83cb3c43714ae  # codeql-bundle-v3.27.9
+      uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0  # codeql-bundle-v3.28.9
       with:
         trap-caching: false
diff --git a/.github/workflows/mobile-traffic_director.yml b/.github/workflows/mobile-traffic_director.yml
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -33,13 +33,13 @@ jobs:
         publish_results: true
 
     - name: "Upload artifact"
-      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b  # v4.5.0
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08  # v4.6.0
       with:
         name: SARIF file
         path: results.sarif
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae  # v3.27.9
+      uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0  # v3.28.9
       with:
         sarif_file: results.sarif
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
     - name: Prune Stale
-      uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e  # v9.0.0
+      uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639  # v9.1.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         # Different amounts of days for issues/PRs are not currently supported but there is a PR

diff --git a/OWNERS.md b/OWNERS.md
@@ -49,6 +49,8 @@ routing PRs, questions, etc. to the right place.
   * ext_proc, data plane, flow control, CEL.
 * Boteng Yao ([botengyao](https://github.com/botengyao)) (boteng@google.com)
   * Overload manager, security, logging, wasm, data plane.
+* Tony Allen ([tonya11en](https://github.com/tonya11en)) (tony@allen.gg)
+  * Load balancing, data plane.
 
 # Envoy mobile maintainers
 

diff --git a/SECURITY-INSIGHTS.yml b/SECURITY-INSIGHTS.yml
@@ -28,6 +28,7 @@ project-lifecycle:
   - github:kyessenov
   - github:ravenblackx
   - github:nezdolik
+  - github:tonya11en
   - github:tyxia
 contribution-policy:
   accepts-pull-requests: true

diff --git a/api/bazel/repository_locations.bzl b/api/bazel/repository_locations.bzl
@@ -38,11 +38,11 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "Java Rules for Bazel",
         project_desc = "Bazel rules for Java",
         project_url = "https://github.com/bazelbuild/rules_jvm_external",
-        version = "6.6",
+        version = "6.7",
         strip_prefix = "rules_jvm_external-{version}",
-        sha256 = "3afe5195069bd379373528899c03a3072f568d33bd96fe037bd43b1f590535e7",
+        sha256 = "a1e351607f04fed296ba33c4977d3fe2a615ed50df7896676b67aac993c53c18",
         urls = ["https://github.com/bazelbuild/rules_jvm_external/releases/download/{version}/rules_jvm_external-{version}.tar.gz"],
-        release_date = "2024-11-25",
+        release_date = "2025-02-11",
         use_category = ["build"],
         license = "Apache-2.0",
         license_url = "https://github.com/bazelbuild/rules_jvm_external/blob/{version}/LICENSE",

diff --git a/api/envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto b/api/envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto
@@ -326,6 +326,7 @@ message ExternalProcessor {
   // can only be overridden by the response message from the external processing server iff the
   // :ref:`mode_override <envoy_v3_api_field_service.ext_proc.v3.ProcessingResponse.mode_override>` is allowed by
   // the ``allowed_override_modes`` allow-list below.
+  // Since request_header_mode is not applicable in any way, it's ignored in comparison.
   repeated ProcessingMode allowed_override_modes = 22;
 }
 

diff --git a/api/envoy/extensions/filters/http/ext_proc/v3/processing_mode.proto b/api/envoy/extensions/filters/http/ext_proc/v3/processing_mode.proto
@@ -111,8 +111,8 @@ message ProcessingMode {
     FULL_DUPLEX_STREAMED = 4;
   }
 
-  // How to handle the request header. Default is "SEND". A value of "DEFAULT" (unset) should be used
-  // with :ref:`mode_override
+  // How to handle the request header. Default is "SEND".
+  // Note this field is ignored in :ref:`mode_override
   // <envoy_v3_api_field_service.ext_proc.v3.ProcessingResponse.mode_override>`, since mode
   // overrides can only affect messages exchanged after the request header is processed.
   HeaderSendMode request_header_mode = 1 [(validate.rules).enum = {defined_only: true}];

diff --git a/api/envoy/extensions/filters/http/router/v3/router.proto b/api/envoy/extensions/filters/http/router/v3/router.proto
@@ -119,11 +119,11 @@ message Router {
   // for more details.
   bool suppress_grpc_request_failure_code_stats = 7;
 
+  // Optional HTTP filters for the upstream HTTP filter chain.
+  //
   // .. note::
   //   Upstream HTTP filters are currently in alpha.
   //
-  // Optional HTTP filters for the upstream HTTP filter chain.
-  //
   // These filters will be applied for all requests that pass through the router.
   // They will also be applied to shadowed requests.
   // Upstream HTTP filters cannot change route or cluster.

diff --git a/api/envoy/extensions/upstreams/http/v3/http_protocol_options.proto b/api/envoy/extensions/upstreams/http/v3/http_protocol_options.proto
@@ -150,10 +150,11 @@ message HttpProtocolOptions {
     AutoHttpConfig auto_config = 5;
   }
 
+  // Optional HTTP filters for the upstream HTTP filter chain.
+  //
   // .. note::
   //   Upstream HTTP filters are currently in alpha.
   //
-  // Optional HTTP filters for the upstream HTTP filter chain.
   //
   // These filters will be applied for all HTTP streams which flow through this
   // cluster. Unlike downstream HTTP filters, they will *not* be applied to terminated CONNECT requests.

diff --git a/bazel/BUILD b/bazel/BUILD
@@ -18,6 +18,7 @@ exports_files([
     "test_for_benchmark_wrapper.sh",
     "repository_locations.bzl",
     "exported_symbols.txt",
+    "exported_symbols_apple.txt",
 ])
 
 sh_library(

diff --git a/bazel/envoy_internal.bzl b/bazel/envoy_internal.bzl
@@ -211,15 +211,20 @@ def _envoy_select_perfetto(xs):
     })
 
 def envoy_exported_symbols_input():
-    return ["@envoy//bazel:exported_symbols.txt"]
+    return [
+        "@envoy//bazel:exported_symbols.txt",
+        "@envoy//bazel:exported_symbols_apple.txt",
+    ]
 
 # Default symbols to be exported.
-# TODO(wbpcode): make this work correctly for apple/darwin.
 def _envoy_default_exported_symbols():
     return select({
         "@envoy//bazel:linux": [
             "-Wl,--dynamic-list=$(location @envoy//bazel:exported_symbols.txt)",
         ],
+        "@envoy//bazel:apple": [
+            "-Wl,-exported_symbols_list,$(location @envoy//bazel:exported_symbols_apple.txt)",
+        ],
         "//conditions:default": [],
     })
 

diff --git a/bazel/exported_symbols.txt b/bazel/exported_symbols.txt
@@ -1,4 +1,5 @@
 {
 	lua*;
 	envoyGo*;
+	envoy_dynamic_module_callback_*;
 };
diff --git a/bazel/exported_symbols_apple.txt b/bazel/exported_symbols_apple.txt
@@ -0,0 +1,3 @@
+_lua*
+_envoyGo*
+_envoy_dynamic_module_callback_*
diff --git a/bazel/external/quiche.BUILD b/bazel/external/quiche.BUILD
@@ -5176,6 +5176,7 @@ envoy_cc_library(
     tags = ["nofips"],
     visibility = ["//visibility:public"],
     deps = [
+        ":quiche_common_platform",
         ":quiche_common_platform_export",
         ":quiche_common_platform_logging",
         "@com_google_absl//absl/algorithm:container",

diff --git a/bazel/rbe/toolchains/configs/linux/clang/config/BUILD b/bazel/rbe/toolchains/configs/linux/clang/config/BUILD
@@ -42,7 +42,7 @@ platform(
         "@bazel_tools//tools/cpp:clang",
     ],
     exec_properties = {
-        "container-image": "docker://gcr.io/envoy-ci/envoy-build@sha256:6e494ff9bcfa96868cb43f1200f2126cdab39d62db52a5dda80c8ec1694a93ee",
+        "container-image": "docker://gcr.io/envoy-ci/envoy-build@sha256:b4bc62cde8bc10ebc7e91e93fcf92e6e0737b705363478bfd14d86c92d80db2c",
         "OSFamily": "Linux",
     },
     parents = ["@local_config_platform//:host"],

diff --git a/bazel/rbe/toolchains/configs/linux/clang_libcxx/config/BUILD b/bazel/rbe/toolchains/configs/linux/clang_libcxx/config/BUILD
@@ -42,7 +42,7 @@ platform(
         "@bazel_tools//tools/cpp:clang",
     ],
     exec_properties = {
-        "container-image": "docker://gcr.io/envoy-ci/envoy-build@sha256:6e494ff9bcfa96868cb43f1200f2126cdab39d62db52a5dda80c8ec1694a93ee",
+        "container-image": "docker://gcr.io/envoy-ci/envoy-build@sha256:b4bc62cde8bc10ebc7e91e93fcf92e6e0737b705363478bfd14d86c92d80db2c",
         "OSFamily": "Linux",
     },
     parents = ["@local_config_platform//:host"],

diff --git a/bazel/rbe/toolchains/configs/linux/gcc/config/BUILD b/bazel/rbe/toolchains/configs/linux/gcc/config/BUILD
@@ -42,7 +42,7 @@ platform(
         "@bazel_tools//tools/cpp:clang",
     ],
     exec_properties = {
-        "container-image": "docker://gcr.io/envoy-ci/envoy-build@sha256:6e494ff9bcfa96868cb43f1200f2126cdab39d62db52a5dda80c8ec1694a93ee",
+        "container-image": "docker://gcr.io/envoy-ci/envoy-build@sha256:b4bc62cde8bc10ebc7e91e93fcf92e6e0737b705363478bfd14d86c92d80db2c",
         "OSFamily": "Linux",
     },
     parents = ["@local_config_platform//:host"],

diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
@@ -226,12 +226,12 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "liburing",
         project_desc = "C helpers to set up and tear down io_uring instances",
         project_url = "https://github.com/axboe/liburing",
-        version = "2.8",
-        sha256 = "3ed7891d1b2bbe743ef3fb6d0a4970e630aa02d7c7bd3b0212791fb7be815984",
+        version = "2.9",
+        sha256 = "897b1153b55543e8b92a5a3eb9b906537a5fedcf8afaf241f8b8787940c79f8d",
         strip_prefix = "liburing-liburing-{version}",
         urls = ["https://github.com/axboe/liburing/archive/liburing-{version}.tar.gz"],
         use_category = ["dataplane_core", "controlplane"],
-        release_date = "2024-10-25",
+        release_date = "2025-02-03",
         cpe = "N/A",
     ),
     # This dependency is built only when performance tracing is enabled with the
@@ -1024,11 +1024,11 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "Go rules for Bazel",
         project_desc = "Bazel rules for the Go language",
         project_url = "https://github.com/bazelbuild/rules_go",
-        version = "0.52.0",
-        sha256 = "90fe8fb402dee957a375f3eb8511455bd738c7ed562695f4dd117ac7d2d833b1",
+        version = "0.53.0",
+        sha256 = "b78f77458e77162f45b4564d6b20b6f92f56431ed59eaaab09e7819d1d850313",
         urls = ["https://github.com/bazelbuild/rules_go/releases/download/v{version}/rules_go-v{version}.zip"],
         use_category = ["build", "api"],
-        release_date = "2025-01-13",
+        release_date = "2025-02-11",
         implied_untracked_deps = [
             "com_github_golang_protobuf",
             "io_bazel_rules_nogo",
@@ -1124,12 +1124,12 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "Shell script rules for Bazel",
         project_desc = "Bazel rules for shell scripts",
         project_url = "https://github.com/bazelbuild/rules_shell",
-        version = "0.3.0",
-        sha256 = "d8cd4a3a91fc1dc68d4c7d6b655f09def109f7186437e3f50a9b60ab436a0c53",
-        strip_prefix = "rules_shell-0.3.0",
-        urls = ["https://github.com/bazelbuild/rules_shell/releases/download/v0.3.0/rules_shell-v0.3.0.tar.gz"],
+        version = "0.4.0",
+        sha256 = "3e114424a5c7e4fd43e0133cc6ecdfe54e45ae8affa14fadd839f29901424043",
+        strip_prefix = "rules_shell-{version}",
+        urls = ["https://github.com/bazelbuild/rules_shell/releases/download/v{version}/rules_shell-v{version}.tar.gz"],
         use_category = ["build"],
-        release_date = "2024-11-06",
+        release_date = "2025-01-30",
         license = "Apache-2.0",
         license_url = "https://github.com/protocolbuffers/rules_shell/blob/{version}/LICENSE",
     ),
@@ -1218,12 +1218,12 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "QUICHE",
         project_desc = "QUICHE (QUIC, HTTP/2, Etc) is Google‘s implementation of QUIC and related protocols",
         project_url = "https://github.com/google/quiche",
-        version = "5a433bd7de22c23700d046346bd3d3afe5c9cd07",
-        sha256 = "39951f6fff2171a36c759d64c98a9d0bd5921172a36437d719ea5cba639c3802",
+        version = "66856e353d1bde66f1dfaf5762f03cb2a5e9a96e",
+        sha256 = "00c0bfeb77ca1d01b1462fe68b6d952199f109a419a1b03e88ada4730deabc9b",
         urls = ["https://github.com/google/quiche/archive/{version}.tar.gz"],
         strip_prefix = "quiche-{version}",
         use_category = ["controlplane", "dataplane_core"],
-        release_date = "2025-02-06",
+        release_date = "2025-02-12",
         cpe = "N/A",
         license = "BSD-3-Clause",
         license_url = "https://github.com/google/quiche/blob/{version}/LICENSE",