build: take two on upstream visibility rules

[alyssawilk]

Setting things up so downstream folks can just override with visibility:public but upstream avoids core code depending on extensions.

Risk Level: medium (of breaking builds, instructions of how to unbreak included)
Testing: manually swapped to public, all works.
Docs Changes: included
Release Notes: overkill
Fixes #12444

[lizan]

I just merged envoyproxy/envoy-filter-example#128, can we bump filter-example SHA in CI to see if it works?

[alyssawilk]

pass-through filter is manually tagged public (not using the default rules) so I think it's orthogonal from this change.

More interesting would be if it were private, and envoy filter example had an override to explicitly depend on it, but I agree that one should be public (and possibly moved to core but organization tbd)

[lizan]

@alyssawilk it is manually tagged public after the previous take. There were a couple PRs.

[alyssawilk]

Right, but this PR doesn't revert that being public, so I guess I'm not sure what bumping proves?
I can do it either way, I would just expect this change and that change to not interact.

[htuch]

This seems reasonable. I can imagine a finer grained system, but this is fine as a starting point to limit the visibility in Envoy.

[lizan]

Thanks this looks good. just one nit

[lizan]

Just name this EXTENSION_PACKAGE_VISIBILITY?

[lizan]

@rgs1 can you test this PR with your BUILD?

[lizan]

/wait-any

[rgs1]

@rgs1 can you test this PR with your BUILD?

Hey sorry for the late response I was OOO; yes I can give this a try. Mind merging master first tho?

[rgs1]

So with:

diff --git a/bazel/build_config/extensions_build_config.bzl b/bazel/build_config/extensions_build_config.bzl
index ab61ec7..5e1f725 100644
--- a/bazel/build_config/extensions_build_config.bzl
+++ b/bazel/build_config/extensions_build_config.bzl
@@ -101,3 +101,6 @@ WINDOWS_EXTENSIONS = {
 }

 ADDITIONAL_VISIBILITY = []
+
+EXTENSION_CONFIG_VISIBILITY = ["//visibility:public"]
+EXTENSION_PACKAGE_VISIBILITY = ["//visibility:public"]

this works for us. Thanks!

[ we do reference a lot of Envoy extensions... the gzip stuff, the crypto stuff, etc. ]

[rgs1]

Works for us -- thanks!

[alyssawilk]

@lizan any other thoughts?

[alyssawilk]

@lizan ping?

[alyssawilk]

cc @yanavlasov @auni53