Merge remote-tracking branch 'upstream/main' into set_filter_state

.github/actions/pr_notifier/pr_notifier.py

@@ -17,7 +17,9 @@
 import os
 import sys
 
+import requests
 import github
+import icalendar
 from slack_sdk import WebClient
 from slack_sdk.errors import SlackApiError
 
@@ -43,6 +45,9 @@
     'soulxu': 'U01GNQ3B8AY',
 }
 
+# Oncall calendar
+CALENDAR = "https://calendar.google.com/calendar/ical/d6glc0l5rc3v235q9l2j29dgovh3dn48%40import.calendar.google.com/public/basic.ics"
+
 # First pass reviewers who are not maintainers should get
 # notifications but not result in a PR not getting assigned a
 # maintainer owner.
@@ -226,10 +231,30 @@ def post_to_oncall(client, unassigned_prs, out_slo_prs):
             text=(
                 "*Untriaged Issues* (please tag and cc area experts)\n<%s|%s>" %
                 (issue_link, issue_link)))
+        # On Monday, post the new oncall.
+        if datetime.date.today().weekday() == 0:
+            oncall = parse_calendar()
+            client.chat_postMessage(channel='#envoy-maintainer-oncall', text=(oncall))
+            client.chat_postMessage(channel='#general', text=(oncall))
     except SlackApiError as e:
         print("Unexpected error %s", e.response["error"])
 
 
+def parse_calendar():
+    ical = requests.get(CALENDAR)
+    parsed_calendar = icalendar.Calendar.from_ical(ical.text)
+    ical.close()
+
+    now = datetime.datetime.now()
+    sunday = now - datetime.timedelta(days=now.weekday() + 1)
+
+    for component in parsed_calendar.walk():
+        if component.name == "VEVENT":
+            if (sunday.date() == component.decoded("dtstart").date()):
+                return component.get("summary")
+    return "unable to find this week's oncall"
+
+
 if __name__ == '__main__':
     parser = argparse.ArgumentParser()
     parser.add_argument(

.github/actions/pr_notifier/requirements.in

@@ -1,2 +1,4 @@
 pygithub
 slack_sdk
+requests
+icalendar

.github/actions/pr_notifier/requirements.txt

@@ -1,8 +1,8 @@
 #
-# This file is autogenerated by pip-compile
-# To update, run:
+# This file is autogenerated by pip-compile with Python 3.11
+# by the following command:
 #
-#    pip-compile --generate-hashes .github/actions/pr_notifier/requirements.txt
+#    pip-compile --allow-unsafe --generate-hashes requirements.in
 #
 certifi==2023.7.22 \
     --hash=sha256:539cc1d13202e33ca466e88b2807e29f4c13049d6d87031a3c110744495cb082 \
@@ -167,6 +167,10 @@ deprecated==1.2.13 \
     --hash=sha256:43ac5335da90c31c24ba028af536a91d41d53f9e6901ddb021bcc572ce44e38d \
     --hash=sha256:64756e3e14c8c5eea9795d93c524551432a0be75629f8f29e67ab8caf076c76d
     # via pygithub
+icalendar==5.0.10 \
+    --hash=sha256:34f0ca020b804758ddf316eb70d1d46f769bce64638d5a080cb65dd46cfee642 \
+    --hash=sha256:6e392c2f301b6b5f49433e14c905db3de444b12876f3345f1856a75e9cd8be6f
+    # via -r requirements.in
 idna==2.10 \
     --hash=sha256:b307872f855b18632ce0c21c5e45be78c0ea7ae4c15c828c20788b26921eb3f6 \
     --hash=sha256:b97d804b1e9b523befed77c48dacec60e6dcb0b5391d57af6a65a312a90648c0
@@ -175,9 +179,9 @@ pycparser==2.20 \
     --hash=sha256:2d475327684562c3a96cc71adf7dc8c4f0565175cf86b6d7a404ff4c771f15f0 \
     --hash=sha256:7582ad22678f0fcd81102833f60ef8d0e57288b6b5fb00323d101be910e35705
     # via cffi
-pygithub==1.59.1 \
-    --hash=sha256:3d87a822e6c868142f0c2c4bf16cce4696b5a7a4d142a7bd160e1bdf75bc54a9 \
-    --hash=sha256:c44e3a121c15bf9d3a5cc98d94c9a047a5132a9b01d22264627f58ade9ddc217
+pygithub==2.1.1 \
+    --hash=sha256:4b528d5d6f35e991ea5fd3f942f58748f24938805cb7fcf24486546637917337 \
+    --hash=sha256:ecf12c2809c44147bce63b047b3d2e9dac8a41b63e90fcb263c703f64936b97c
     # via -r requirements.in
 pyjwt[crypto]==2.4.0 \
     --hash=sha256:72d1d253f32dbd4f5c88eaf1fdc62f3a19f676ccbadb9dbc5d07e951b2b26daf \
@@ -203,22 +207,40 @@ pynacl==1.4.0 \
     --hash=sha256:ea6841bc3a76fa4942ce00f3bda7d436fda21e2d91602b9e21b7ca9ecab8f3ff \
     --hash=sha256:f8851ab9041756003119368c1e6cd0b9c631f46d686b3904b18c0139f4419f80
     # via pygithub
+python-dateutil==2.8.2 \
+    --hash=sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86 \
+    --hash=sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9
+    # via pygithub
+pytz==2023.3.post1 \
+    --hash=sha256:7b4fddbeb94a1eba4b557da24f19fdf9db575192544270a9101d8509f9f43d7b \
+    --hash=sha256:ce42d816b81b68506614c11e8937d3aa9e41007ceb50bfdcb0749b921bf646c7
+    # via icalendar
 requests==2.31.0 \
     --hash=sha256:58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f \
     --hash=sha256:942c5a758f98d790eaed1a29cb6eefc7ffb0d1cf7af05c3d2791656dbd6ad1e1
-    # via pygithub
+    # via
+    #   -r requirements.in
+    #   pygithub
 six==1.16.0 \
     --hash=sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926 \
     --hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254
-    # via pynacl
+    # via
+    #   pynacl
+    #   python-dateutil
 slack-sdk==3.22.0 \
     --hash=sha256:6eacce0fa4f8cfb4d84eac0d7d7e1b1926040a2df654ae86b94179bdf2bc4d8c \
     --hash=sha256:f102a4902115dff3b97c3e8883ad4e22d54732221886fc5ef29bfc290f063b4a
     # via -r requirements.in
+typing-extensions==4.8.0 \
+    --hash=sha256:8f92fc8806f9a6b641eaa5318da32b44d401efaac0f6678c9bc448ba3605faa0 \
+    --hash=sha256:df8e4339e9cb77357558cbdbceca33c303714cf861d1eef15e1070055ae8b7ef
+    # via pygithub
 urllib3==1.26.6 \
     --hash=sha256:39fb8672126159acb139a7718dd10806104dec1e2f0f6c88aab05d17df10c8d4 \
     --hash=sha256:f57b4c16c62fa2760b7e3d97c35b255512fb6b59a259730f36ba32ce9f8e342f
-    # via requests
+    # via
+    #   pygithub
+    #   requests
 wrapt==1.12.1 \
     --hash=sha256:b62ffa81fb85f4332a4f609cab4ac40709470da05643a082ec1eb88e6d9b97d7
     # via deprecated

.github/workflows/_stage_publish.yml

@@ -105,5 +105,5 @@ jobs:
         app_id: ${{ secrets.ENVOY_CI_SYNC_APP_ID }}
         key: "${{ secrets.ENVOY_CI_SYNC_APP_KEY }}"
         ref: main
-        repository: ${ inputs.version_dev != '' && 'envoyproxy/envoy-website' || 'envoyproxy/archive' }
+        repository: ${{ inputs.version_dev != '' && 'envoyproxy/envoy-website' || 'envoyproxy/archive' }}
         workflow: envoy-sync.yaml

BUILD

@@ -1,5 +1,12 @@
+load("//bazel:envoy_build_system.bzl", "envoy_package")
+load("//tools/base:envoy_python.bzl", "envoy_py_namespace")
+
 licenses(["notice"])  # Apache 2
 
+envoy_package()
+
+envoy_py_namespace()
+
 exports_files([
     "VERSION.txt",
     "API_VERSION.txt",

api/CONTRIBUTING.md

@@ -23,19 +23,19 @@ documentation.
 The documentation can be built locally in the root of https://github.com/envoyproxy/envoy via:
 
 ```
-docs/build.sh
+ci/do_ci.sh docs
 ```
 
 To skip configuration examples validation:
 
 ```
-SPHINX_SKIP_CONFIG_VALIDATION=true docs/build.sh
+SPHINX_SKIP_CONFIG_VALIDATION=true ci/do_ci.sh docs
 ```
 
 Or to use a hermetic Docker container:
 
 ```
-./ci/run_envoy_docker.sh './ci/do_ci.sh docs'
+./ci/run_envoy_docker.sh 'ci/do_ci.sh docs'
 ```
 
 This process builds RST documentation directly from the proto files, merges it with the static RST

api/bazel/repository_locations.bzl

@@ -155,12 +155,12 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "envoy_toolshed",
         project_desc = "Tooling, libraries, runners and checkers for Envoy proxy's CI",
         project_url = "https://github.com/envoyproxy/toolshed",
-        version = "0.0.9",
-        sha256 = "f1a2169d271efbf4de2b24207136c5009c5453fba62ba8dc3497cba204d092aa",
+        version = "0.0.10",
+        sha256 = "bdfcf0a23c18a99887ac25761aa56d85bedb6eda77c89f9f19e6142b812749b9",
         strip_prefix = "toolshed-bazel-v{version}/bazel",
         urls = ["https://github.com/envoyproxy/toolshed/archive/bazel-v{version}.tar.gz"],
         use_category = ["build"],
-        release_date = "2023-09-28",
+        release_date = "2023-10-02",
         cpe = "N/A",
         license = "Apache-2.0",
         license_url = "https://github.com/envoyproxy/envoy/blob/bazel-v{version}/LICENSE",

api/contrib/envoy/extensions/filters/network/generic_proxy/v3/route.proto

@@ -43,7 +43,7 @@ message VirtualHost {
   xds.type.matcher.v3.Matcher routes = 3 [(validate.rules).message = {required: true}];
 }
 
-// The generic proxy makes use of the `xds matching API` for routing configurations.
+// The generic proxy makes use of the xDS matching API for routing configurations.
 //
 // In the below example, we combine a top level tree matcher with a linear matcher to match
 // the incoming requests, and send the matching requests to v1 of the upstream service.

api/envoy/config/core/v3/address.proto

@@ -151,7 +151,7 @@ message BindConfig {
   // precompiled binaries.
   repeated SocketOption socket_options = 3;
 
-  // Extra source addresses appended to the address specified in the `source_address`
+  // Extra source addresses appended to the address specified in the ``source_address``
   // field. This enables to specify multiple source addresses.
   // The source address selection is determined by :ref:`local_address_selector
   // <envoy_v3_api_field_config.core.v3.BindConfig.local_address_selector>`.

api/envoy/config/core/v3/protocol.proto

@@ -96,11 +96,11 @@ message QuicProtocolOptions {
   QuicKeepAliveSettings connection_keepalive = 5;
 
   // A comma-separated list of strings representing QUIC connection options defined in
-  // `QUICHE <https://github.com/google/quiche/blob/main/quiche/quic/core/crypto/crypto_protocol.h>` and to be sent by upstream connections.
+  // `QUICHE <https://github.com/google/quiche/blob/main/quiche/quic/core/crypto/crypto_protocol.h>`_ and to be sent by upstream connections.
   string connection_options = 6;
 
   // A comma-separated list of strings representing QUIC client connection options defined in
-  // `QUICHE <https://github.com/google/quiche/blob/main/quiche/quic/core/crypto/crypto_protocol.h>` and to be sent by upstream connections.
+  // `QUICHE <https://github.com/google/quiche/blob/main/quiche/quic/core/crypto/crypto_protocol.h>`_ and to be sent by upstream connections.
   string client_connection_options = 7;
 }
 

api/envoy/config/endpoint/v3/endpoint_components.proto

@@ -88,8 +88,8 @@ message Endpoint {
   // :ref:`auto_host_rewrite <envoy_v3_api_field_config.route.v3.RouteAction.auto_host_rewrite>`.
   string hostname = 3;
 
-  // An ordered list of addresses that together with `address` comprise the
-  // list of addresses for an endpoint. The address given in the `address` is
+  // An ordered list of addresses that together with ``address`` comprise the
+  // list of addresses for an endpoint. The address given in the ``address`` is
   // prepended to this list. It is assumed that the list must already be
   // sorted by preference order of the addresses. This will only be supported
   // for STATIC and EDS clusters.

api/envoy/config/listener/v3/listener.proto

@@ -249,7 +249,7 @@ message Listener {
   // Additional socket options that may not be present in Envoy source code or
   // precompiled binaries. The socket options can be updated for a listener when
   // :ref:`enable_reuse_port <envoy_v3_api_field_config.listener.v3.Listener.enable_reuse_port>`
-  // is `true`. Otherwise, if socket options change during a listener update the update will be rejected
+  // is ``true``. Otherwise, if socket options change during a listener update the update will be rejected
   // to make it clear that the options were not updated.
   repeated core.v3.SocketOption socket_options = 13;
 

api/envoy/config/metrics/v3/stats.proto

@@ -121,8 +121,8 @@ message StatsMatcher {
   // limited by either an exclusion or an inclusion list of :ref:`StringMatcher
   // <envoy_v3_api_msg_type.matcher.v3.StringMatcher>` protos:
   //
-  // * If ``reject_all`` is set to `true`, no stats will be instantiated. If ``reject_all`` is set to
-  //   `false`, all stats will be instantiated.
+  // * If ``reject_all`` is set to ``true``, no stats will be instantiated. If ``reject_all`` is set to
+  //   ``false``, all stats will be instantiated.
   //
   // * If an exclusion list is supplied, any stat name matching *any* of the StringMatchers in the
   //   list will not instantiate.

api/envoy/config/route/v3/route_components.proto

@@ -1193,7 +1193,7 @@ message RouteAction {
   // :ref:`host_rewrite_path_regex <envoy_v3_api_field_config.route.v3.RouteAction.host_rewrite_path_regex>`)
   // causes the original value of the host header, if any, to be appended to the
   // :ref:`config_http_conn_man_headers_x-forwarded-host` HTTP header if it is different to the last value appended.
-  // This can be disabled by setting the runtime guard `envoy_reloadable_features_append_xfh_idempotent` to false.
+  // This can be disabled by setting the runtime guard ``envoy_reloadable_features_append_xfh_idempotent`` to false.
   bool append_x_forwarded_host = 38;
 
   // Specifies the upstream timeout for the route. If not specified, the default is 15s. This

api/envoy/config/trace/v3/zipkin.proto

@@ -75,7 +75,7 @@ message ZipkinConfig {
   //
   // * The Envoy Proxy is used as gateway or ingress.
   // * The Envoy Proxy is used as sidecar but inbound traffic capturing or outbound traffic capturing is disabled.
-  // * Any case that the `start_child_span of router <envoy_v3_api_field_extensions.filters.http.router.v3.Router.start_child_span>` is set to true.
+  // * Any case that the :ref:`start_child_span of router <envoy_v3_api_field_extensions.filters.http.router.v3.Router.start_child_span>` is set to true.
   //
   // .. attention::
   //

api/envoy/config/upstream/local_address_selector/v3/default_local_address_selector.proto

@@ -23,9 +23,9 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // is appended to the address specified in the
 // :ref:`source_address <envoy_v3_api_field_config.core.v3.BindConfig.source_address>`
 // field. The extra address should have a different IP version than the address in the
-// `source_address` field. The address which has the same IP
+// ``source_address`` field. The address which has the same IP
 // version with the target host's address IP version will be used as bind address.
-// If there is no same IP version address found, the address in the `source_address` field will
+// If there is no same IP version address found, the address in the ``source_address`` field will
 // be returned.
 message DefaultLocalAddressSelector {
 }

api/envoy/extensions/clusters/dynamic_forward_proxy/v3/cluster.proto

@@ -60,7 +60,7 @@ message ClusterConfig {
   // resolved address for the new connection matches the peer address of the connection and
   // the TLS certificate is also valid for the new hostname. For example, if a connection
   // has previously been established to foo.example.com at IP 1.2.3.4 with a certificate
-  // that is valid for `*.example.com`, then this connection could be used for requests to
+  // that is valid for ``*.example.com``, then this connection could be used for requests to
   // bar.example.com if that also resolved to 1.2.3.4.
   //
   // .. note::

api/envoy/extensions/filters/http/compressor/v3/compressor.proto

@@ -126,18 +126,18 @@ message Compressor {
   //    ``<stat_prefix>.compressor.<compressor_library.name>.<compressor_library_stat_prefix>.*``.
   ResponseDirectionConfig response_direction_config = 8;
 
-  // If true, chooses this compressor first to do compression when the q-values in `Accept-Encoding` are same.
+  // If true, chooses this compressor first to do compression when the q-values in ``Accept-Encoding`` are same.
   // The last compressor which enables choose_first will be chosen if multiple compressor filters in the chain have choose_first as true.
   bool choose_first = 9;
 }
 
-// Per-route overrides of `ResponseDirectionConfig`. Anything added here should be optional,
+// Per-route overrides of ``ResponseDirectionConfig``. Anything added here should be optional,
 // to allow overriding arbitrary subsets of configuration. Omitted fields must have no affect.
 message ResponseDirectionOverrides {
 }
 
 // Per-route overrides. As per-route overrides are needed, they should be
-// added here, mirroring the structure of `Compressor`. All fields should be
+// added here, mirroring the structure of ``Compressor``. All fields should be
 // optional, to allow overriding arbitrary subsets of configuration.
 message CompressorOverrides {
   // If present, response compression is enabled.
@@ -152,7 +152,7 @@ message CompressorPerRoute {
     // Overrides Compressor.runtime_enabled and CommonDirectionConfig.enabled.
     bool disabled = 1 [(validate.rules).bool = {const: true}];
 
-    // Per-route overrides. Fields set here will override corresponding fields in `Compressor`.
+    // Per-route overrides. Fields set here will override corresponding fields in ``Compressor``.
     CompressorOverrides overrides = 2;
   }
 }

api/envoy/extensions/filters/http/geoip/v3/geoip.proto

@@ -77,7 +77,7 @@ message Geoip {
   }
 
   // If set, the :ref:`xff_num_trusted_hops <envoy_v3_api_field_extensions.filters.http.geoip.v3.Geoip.XffConfig.xff_num_trusted_hops>` field will be used to determine
-  // trusted client address from `x-forwarded-for` header.
+  // trusted client address from ``x-forwarded-for`` header.
   // Otherwise, the immediate downstream connection source address will be used.
   // [#next-free-field: 2]
   XffConfig xff_config = 1;

api/envoy/extensions/filters/http/grpc_field_extraction/v3/config.proto

@@ -140,14 +140,14 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 message GrpcFieldExtractionConfig {
   // The proto descriptor set binary for the gRPC services.
   //
-  // It could be passed by a local file through `Datasource.filename` or embedded in the
-  // `Datasource.inline_bytes`.
+  // It could be passed by a local file through ``Datasource.filename`` or embedded in the
+  // ``Datasource.inline_bytes``.
   config.core.v3.DataSource descriptor_set = 1 [(validate.rules).message = {required: true}];
 
   // Specify the extraction info.
   // The key is the fully qualified gRPC method name.
-  // `${package}.${Service}.${Method}`, like
-  // `endpoints.examples.bookstore.BookStore.GetShelf`
+  // ``${package}.${Service}.${Method}``, like
+  // ``endpoints.examples.bookstore.BookStore.GetShelf``
   //
   // The value is the field extractions for individual gRPC method.
   map<string, FieldExtractions> extractions_by_method = 2;
@@ -158,8 +158,8 @@ message GrpcFieldExtractionConfig {
 message FieldExtractions {
   // The field extractions for requests.
   // The key is the field path within the grpc request.
-  // For example, we can define `foo.bar.name` if we want to extract
-  // Request.foo.bar.name.
+  // For example, we can define ``foo.bar.name`` if we want to extract
+  // ``Request.foo.bar.name``.
   //
   // .. code-block:: proto
   //

api/envoy/extensions/filters/http/json_to_metadata/v3/json_to_metadata.proto

@@ -99,9 +99,9 @@ message JsonToMetadata {
     repeated Rule rules = 1 [(validate.rules).repeated = {min_items: 1}];
 
     // Allowed content-type for json to metadata transformation.
-    // Default to {"application/json"}.
+    // Default to ``{"application/json"}``.
     //
-    // Set `allow_empty_content_type` if empty/missing content-type header
+    // Set ``allow_empty_content_type`` if empty/missing content-type header
     // is allowed.
     repeated string allow_content_types = 2
         [(validate.rules).repeated = {items {string {min_len: 1}}}];

api/envoy/extensions/filters/http/jwt_authn/v3/config.proto

@@ -270,8 +270,8 @@ message JwtProvider {
   //
   string header_in_metadata = 14;
 
-  // If non empty, the failure status `::google::jwt_verify::Status` for a non verified JWT will be written to StreamInfo DynamicMetadata
-  // in the format as: ``namespace`` is the jwt_authn filter name as ````envoy.filters.http.jwt_authn````
+  // If non empty, the failure status ``::google::jwt_verify::Status`` for a non verified JWT will be written to StreamInfo DynamicMetadata
+  // in the format as: ``namespace`` is the jwt_authn filter name as ``envoy.filters.http.jwt_authn``
   // The value is the ``protobuf::Struct``. The values of this field will be ``code`` and ``message``
   // and they will contain the JWT authentication failure status code and a message describing the failure.
   //