Merge commit '6eaaa255541844b11b34c23be557a58c5e95c1ef' into text_action

.azure-pipelines/pipelines.yml

@@ -542,6 +542,13 @@ stages:
         itemPattern: "bazel.release.arm64/envoy-contrib_binary.tar.gz"
         downloadType: single
         targetPath: $(Build.StagingDirectory)
+
+    - task: DownloadSecureFile@1
+      name: MaintainerGPGKey
+      displayName: 'Download maintainer GPG key'
+      inputs:
+        secureFile: 'maintainer.gpg.key'
+
     - bash: |
         set -e
 
@@ -561,13 +568,13 @@ stages:
         cp -a linux/arm64/build_envoy_release_stripped/envoy "publish/envoy-${VERSION}-linux-aarch_64"
         cp -a linux/arm64/build_envoy-contrib_release_stripped/envoy "publish/envoy-contrib-${VERSION}-linux-aarch_64"
 
-        echo "$MAINTAINER_GPG_KEY" | base64 -d | gpg --import -
+        echo "$MAINTAINER_GPG_KEY_PASSPHRASE" | gpg --batch --yes --passphrase-fd 0 --import "$(MaintainerGPGKey.secureFilePath)"
 
         ci/publish_github_assets.sh "v${VERSION}" "${PWD}/publish"
       workingDirectory: $(Build.SourcesDirectory)
       env:
         GITHUB_TOKEN: $(GitHubPublicRepoOnlyAccessToken)
-        MAINTAINER_GPG_KEY: $(MaintainerGPGKey)
+        MAINTAINER_GPG_KEY_PASSPHRASE: $(MaintainerGPGKeyPassphrase)
 
 - stage: verify
   dependsOn: ["docker"]

.bazelrc

@@ -45,6 +45,10 @@ build:linux --features=per_object_debug_info
 build:linux --action_env=BAZEL_LINKLIBS=-l%:libstdc++.a
 build:linux --action_env=BAZEL_LINKOPTS=-lm
 
+# TODO(keith): remove once https://github.com/DataDog/dd-opentracing-cpp/pull/252 is integrated
+# this avoids warnings/errors on arm64 Linux builds
+build:linux --per_file_copt=external/com_github_datadog_dd_opentracing_cpp/.*.cpp@-Wno-type-limits
+
 # We already have absl in the build, define absl=1 to tell googletest to use absl for backtrace.
 build --define absl=1
 
@@ -373,6 +377,7 @@ build:windows --define tcmalloc=disabled
 build:windows --define wasm=disabled
 build:windows --define manual_stamp=manual_stamp
 build:windows --cxxopt="/std:c++17"
+build:windows --output_groups=+pdb_file
 
 # TODO(wrowe,sunjayBhatia): Resolve bugs upstream in curl and rules_foreign_cc
 # See issue https://github.com/bazelbuild/rules_foreign_cc/issues/301

.bazelversion

@@ -1 +1 @@
-6.0.0-pre.20220706.4
+6.0.0rc1

.github/actions/pr_notifier/requirements.txt

@@ -111,9 +111,9 @@ six==1.16.0 \
     --hash=sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926 \
     --hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254
     # via pynacl
-slack-sdk==3.19.1 \
-    --hash=sha256:5db78a3ed3c58b3b0a2bdbe40bac43c7b00edcbc12ff6a7778ac5cbe3a3a2899 \
-    --hash=sha256:a0bafb9e53ffbc408a8b5a42443525aac2c0c7347223d9373dd9d41cf90c9343
+slack-sdk==3.19.2 \
+    --hash=sha256:336365512ee8620a7227c6780af28d3a69db3387653fbeee156bc391cbbdbf47 \
+    --hash=sha256:8b36a0c1cd99426df1e7dea9ad55838cafe9de46db88a4c9e4ee787da718a00a
     # via -r requirements.in
 urllib3==1.26.6 \
     --hash=sha256:39fb8672126159acb139a7718dd10806104dec1e2f0f6c88aab05d17df10c8d4 \

.github/workflows/codeql-daily.yml

@@ -28,7 +28,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@cc7986c02bac29104a72998e67239bb5ee2ee110
+      uses: github/codeql-action/init@18fe527fa8b29f134bb91f32f1a5dc5abb15ed7f
       # Override language selection by uncommenting this and choosing your languages
       with:
         languages: cpp
@@ -55,4 +55,4 @@ jobs:
         git clean -xdf
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@cc7986c02bac29104a72998e67239bb5ee2ee110
+      uses: github/codeql-action/analyze@18fe527fa8b29f134bb91f32f1a5dc5abb15ed7f

.github/workflows/codeql-push.yml

@@ -41,7 +41,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@cc7986c02bac29104a72998e67239bb5ee2ee110
+      uses: github/codeql-action/init@18fe527fa8b29f134bb91f32f1a5dc5abb15ed7f
       # Override language selection by uncommenting this and choosing your languages
       with:
         languages: cpp
@@ -71,4 +71,4 @@ jobs:
 
     - name: Perform CodeQL Analysis
       if: env.BUILD_TARGETS != ''
-      uses: github/codeql-action/analyze@cc7986c02bac29104a72998e67239bb5ee2ee110
+      uses: github/codeql-action/analyze@18fe527fa8b29f134bb91f32f1a5dc5abb15ed7f

.github/workflows/depsreview.yml

@@ -9,4 +9,4 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@fd675ced9c17f1393071e1a2e685ab527e585a0c
+        uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c

.yamllint

@@ -1,9 +1,16 @@
 extends: default
 
 rules:
-  line-length:
-    max: 200
-    level: warning
+  document-start: false
   indentation:
     spaces: consistent
     indent-sequences: false
+  line-length:
+    max: 200
+    level: warning
+  truthy:
+    allowed-values:
+    - "yes"
+    - "no"
+    - "true"
+    - "false"

.zuul.yaml

@@ -2,7 +2,7 @@
     name: envoyproxy/envoy
     check:
       jobs:
-        - envoy-build-arm64
+      - envoy-build-arm64
 
 - job:
     name: envoy-build-arm64

BUILD

@@ -58,3 +58,10 @@ package_group(
         "//examples/...",
     ],
 )
+
+package_group(
+    name = "mobile_library",
+    packages = [
+        "//mobile/...",
+    ],
+)

CODEOWNERS

@@ -128,6 +128,7 @@ extensions/filters/common/original_src @snowp @klarose
 /*/extensions/resource_monitors/injected_resource @eziskind @htuch
 /*/extensions/resource_monitors/common @eziskind @htuch
 /*/extensions/resource_monitors/fixed_heap @eziskind @htuch
+/*/extensions/resource_monitors/downstream_connections @antoniovicente @nezdolik @mattklein123
 /*/extensions/retry/priority @snowp @alyssawilk
 /*/extensions/retry/priority/previous_priorities @snowp @alyssawilk
 /*/extensions/retry/host @snowp @alyssawilk
@@ -278,11 +279,16 @@ extensions/filters/http/oauth2 @derekargueta @snowp
 /*/extensions/filters/common @UNOWNED @UNOWNED
 /*/extensions/filters/http/common @UNOWNED @UNOWNED
 /*/extensions/filters/network/common @UNOWNED @UNOWNED
+/*/extensions/clusters/original_dst @UNOWNED @UNOWNED
+
 
 # URL Pattern Match and Rewrite Library
 /*/extensions/path/uri_template_lib @alyssawilk @yanjunxiang-google
 /*/extensions/path/uri_template_lib/proto @alyssawilk @yanjunxiang-google
 
+# mobile
+/mobile/ @jpsim @Augustyniak @RyanTheOptimist @alyssawilk @abeyad
+
 # Contrib
 /contrib/exe/ @mattklein123 @lizan
 /contrib/client_ssl_auth/ @UNOWNED @UNOWNED

DEPENDENCY_POLICY.md

@@ -156,4 +156,4 @@ The following dependencies are exempt from the policy:
 * Any developer-only facing tooling or the documentation build.
 
 * Transitive build time dependencies, e.g. Go projects vendored into
-  [protoc-gen-validate](https://github.com/envoyproxy/protoc-gen-validate).
+  [protoc-gen-validate](https://github.com/bufbuild/protoc-gen-validate).

OWNERS.md

@@ -13,7 +13,7 @@ routing PRs, questions, etc. to the right place.
   * xDS APIs, configuration and control plane.
 * Alyssa Wilk ([alyssawilk](https://github.com/alyssawilk)) ([email protected])
   * HTTP, flow control, cluster manager, load balancing, and core networking (listeners,
-    connections, etc.).
+    connections, etc.), Envoy Mobile.
 * Stephan Zuercher ([zuercher](https://github.com/zuercher)) ([email protected])
   * Load balancing, upstream clusters and cluster manager, logging, complex HTTP routing
     (metadata, etc.), and macOS build.
@@ -29,7 +29,7 @@ routing PRs, questions, etc. to the right place.
 * Ryan Northey ([phlax](https://github.com/phlax)) ([email protected])
   * Docs, tooling, CI, containers and sandbox examples
 * Ryan Hamilton ([RyanTheOptimist](https://github.com/ryantheoptimist)) ([email protected])
-  * HTTP/3, upstream connection management.
+  * HTTP/3, upstream connection management, Envoy Mobile.
 
 # Maintainers
 
@@ -50,6 +50,17 @@ routing PRs, questions, etc. to the right place.
 * Kuat Yessenov ([kyessenov](https://github.com/kyessenov)) ([email protected])
   * Listeners, RBAC, CEL, matching, Istio.
 
+# Envoy mobile maintainers
+
+The following Envoy maintainers have final say over any changes only affecting /mobile
+
+* JP Simard ([jpsim](https://github.com/jpsim)) ([email protected])
+  * iOS (swift/objective-c) platform bindings.
+* Rafal Augustyniak ([Augustyniak](https://github.com/Augustyniak)) ([email protected])
+  * iOS (swift/objective-c) platform bindings.
+* Ali Beyad ([abeyad](https://github.com/abeyad)) ([email protected])
+  * xDS, C++ integration tests.
+
 # Senior extension maintainers
 
 The following extension maintainers have final say over the extensions mentioned below. Once they
@@ -60,10 +71,6 @@ without further review.
   * Wasm
 * Raúl Gutiérrez Segalés ([rgs1](https://github.com/rgs1)) ([email protected])
   * Thrift
-* Ryan Hamilton ([RyanTheOptimist](https://github.com/ryantheoptimist)) ([email protected])
-  * HTTP/3
-* Baiping Wang ([wbpcode](https://github.com/wbpcode)) ([email protected])
-  * Dubbo
 
 # Envoy security team
 

api/API_VERSIONING.md

@@ -63,7 +63,7 @@ experience a backward compatible break on a change. Specifically:
     churn.
 
   * Increasing the strictness of
-    [protoc-gen-validate](https://github.com/envoyproxy/protoc-gen-validate) annotations. Exceptions
+    [protoc-gen-validate](https://github.com/bufbuild/protoc-gen-validate) annotations. Exceptions
     may be granted for scenarios in which these stricter conditions model behavior already implied
     structurally or by documentation.
 

api/BUILD

@@ -217,6 +217,7 @@ proto_library(
         "//envoy/extensions/filters/network/sni_dynamic_forward_proxy/v3:pkg",
         "//envoy/extensions/filters/network/tcp_proxy/v3:pkg",
         "//envoy/extensions/filters/network/thrift_proxy/filters/header_to_metadata/v3:pkg",
+        "//envoy/extensions/filters/network/thrift_proxy/filters/payload_to_metadata/v3:pkg",
         "//envoy/extensions/filters/network/thrift_proxy/filters/ratelimit/v3:pkg",
         "//envoy/extensions/filters/network/thrift_proxy/router/v3:pkg",
         "//envoy/extensions/filters/network/thrift_proxy/v3:pkg",
@@ -256,6 +257,7 @@ proto_library(
         "//envoy/extensions/rbac/matchers/upstream_ip_port/v3:pkg",
         "//envoy/extensions/regex_engines/v3:pkg",
         "//envoy/extensions/request_id/uuid/v3:pkg",
+        "//envoy/extensions/resource_monitors/downstream_connections/v3:pkg",
         "//envoy/extensions/resource_monitors/fixed_heap/v3:pkg",
         "//envoy/extensions/resource_monitors/injected_resource/v3:pkg",
         "//envoy/extensions/retry/host/omit_canary_hosts/v3:pkg",

api/STYLE.md

@@ -184,7 +184,7 @@ metadata. We describe these annotations below by category.
   the field will be promoted to a given `oneof` in the next API major version.
 * `[(udpa.annotations.sensitive) = true]` to denote sensitive fields that
   should be redacted in output such as logging or configuration dumps.
-* [PGV annotations](https://github.com/envoyproxy/protoc-gen-validate) to denote field
+* [PGV annotations](https://github.com/bufbuild/protoc-gen-validate) to denote field
   value constraints.
 
 ### Enum value level

api/buf.yaml

@@ -1,22 +1,22 @@
 version: v1
 deps:
-    - buf.build/googleapis/googleapis:62f35d8aed1149c291d606d958a7ce32
-    - buf.build/opencensus/opencensus
-    - buf.build/beta/prometheus
-    - buf.build/opentelemetry/opentelemetry
-    - buf.build/gogo/protobuf
-    - buf.build/cncf/xds
+- buf.build/googleapis/googleapis:62f35d8aed1149c291d606d958a7ce32
+- buf.build/opencensus/opencensus
+- buf.build/beta/prometheus
+- buf.build/opentelemetry/opentelemetry
+- buf.build/gogo/protobuf
+- buf.build/cncf/xds
 breaking:
   ignore_unstable_packages: true
   use:
-    - FIELD_SAME_ONEOF
-    - FIELD_SAME_JSON_NAME
-    - FIELD_SAME_NAME
-    - FIELD_SAME_TYPE
-    - FIELD_SAME_LABEL
-    - FILE_SAME_PACKAGE
-    - FIELD_NO_DELETE_UNLESS_NUMBER_RESERVED
-    - FIELD_NO_DELETE_UNLESS_NAME_RESERVED
+  - FIELD_SAME_ONEOF
+  - FIELD_SAME_JSON_NAME
+  - FIELD_SAME_NAME
+  - FIELD_SAME_TYPE
+  - FIELD_SAME_LABEL
+  - FILE_SAME_PACKAGE
+  - FIELD_NO_DELETE_UNLESS_NUMBER_RESERVED
+  - FIELD_NO_DELETE_UNLESS_NAME_RESERVED
 lint:
   use:
   - IMPORT_USED

api/contrib/envoy/extensions/filters/network/generic_proxy/v3/generic_proxy.proto

@@ -35,7 +35,6 @@ message GenericProxy {
   oneof route_specifier {
     option (validate.required) = true;
 
-    // [#not-implemented-hide:]
     // The generic proxies route table will be dynamically loaded via the meta RDS API.
     GenericRds generic_rds = 3;
 
@@ -50,7 +49,6 @@ message GenericProxy {
   repeated config.core.v3.TypedExtensionConfig filters = 5;
 }
 
-// [#not-implemented-hide:]
 message GenericRds {
   // Configuration source specifier for RDS.
   config.core.v3.ConfigSource config_source = 1 [(validate.rules).message = {required: true}];

api/envoy/api/v2/core/grpc_service.proto

@@ -100,7 +100,7 @@ message GrpcService {
       message StsService {
         // URI of the token exchange service that handles token exchange requests.
         // [#comment:TODO(asraa): Add URI validation when implemented. Tracked by
-        // https://github.com/envoyproxy/protoc-gen-validate/issues/303]
+        // https://github.com/bufbuild/protoc-gen-validate/issues/303]
         string token_exchange_service_uri = 1;
 
         // Location of the target service or resource where the client

api/envoy/config/cluster/v3/cluster.proto

@@ -525,6 +525,7 @@ message Cluster {
   // Specific configuration for the
   // :ref:`Original Destination <arch_overview_load_balancing_types_original_destination>`
   // load balancing policy.
+  // [#extension: envoy.clusters.original_dst]
   message OriginalDstLbConfig {
     option (udpa.annotations.versioning).previous_message_type =
         "envoy.api.v2.Cluster.OriginalDstLbConfig";

api/envoy/config/core/v3/grpc_service.proto

@@ -142,7 +142,7 @@ message GrpcService {
 
         // URI of the token exchange service that handles token exchange requests.
         // [#comment:TODO(asraa): Add URI validation when implemented. Tracked by
-        // https://github.com/envoyproxy/protoc-gen-validate/issues/303]
+        // https://github.com/bufbuild/protoc-gen-validate/issues/303]
         string token_exchange_service_uri = 1;
 
         // Location of the target service or resource where the client

api/envoy/config/filter/http/ext_authz/v2/ext_authz.proto

@@ -194,7 +194,7 @@ message AuthorizationResponse {
   // Note that coexistent headers will be overridden.
   type.matcher.ListStringMatcher allowed_upstream_headers = 1;
 
-  // When this :ref:`list <envoy_api_msg_type.matcher.ListStringMatcher>`. is set, authorization
+  // When this :ref:`list <envoy_api_msg_type.matcher.ListStringMatcher>` is set, authorization
   // response headers that have a correspondent match will be added to the client's response. Note
   // that when this list is *not* set, all the authorization response headers, except *Authority
   // (Host)* will be in the response to the client. When a header is included in this list, *Path*,

api/envoy/config/listener/v3/listener_components.proto

@@ -155,6 +155,7 @@ message FilterChainMatch {
   // will be first matched against ``www.example.com``, then ``*.example.com``, then ``*.com``.
   //
   // Note that partial wildcards are not supported, and values like ``*w.example.com`` are invalid.
+  // The value ``*`` is also not supported, and ``server_names`` should be omitted instead.
   //
   // .. attention::
   //

api/envoy/extensions/common/async_files/v3/async_file_manager.proto

@@ -22,7 +22,7 @@ message AsyncFileManagerConfig {
     // The number of threads to use. If unset or zero, will default to the number
     // of concurrent threads the hardware supports. This default is subject to
     // change if performance analysis suggests it.
-    uint32 thread_count = 1;
+    uint32 thread_count = 1 [(validate.rules).uint32 = {lte: 1024}];
   }
 
   // An optional identifier for the manager. An empty string is a valid identifier

api/envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto

@@ -268,14 +268,14 @@ message AuthorizationResponse {
   // that coexistent headers will be appended.
   type.matcher.v3.ListStringMatcher allowed_upstream_headers_to_append = 3;
 
-  // When this :ref:`list <envoy_v3_api_msg_type.matcher.v3.ListStringMatcher>`. is set, authorization
+  // When this :ref:`list <envoy_v3_api_msg_type.matcher.v3.ListStringMatcher>` is set, authorization
   // response headers that have a correspondent match will be added to the client's response. Note
   // that when this list is *not* set, all the authorization response headers, except ``Authority
   // (Host)`` will be in the response to the client. When a header is included in this list, ``Path``,
   // ``Status``, ``Content-Length``, ``WWWAuthenticate`` and ``Location`` are automatically added.
   type.matcher.v3.ListStringMatcher allowed_client_headers = 2;
 
-  // When this :ref:`list <envoy_v3_api_msg_type.matcher.v3.ListStringMatcher>`. is set, authorization
+  // When this :ref:`list <envoy_v3_api_msg_type.matcher.v3.ListStringMatcher>` is set, authorization
   // response headers that have a correspondent match will be added to the client's response when
   // the authorization response itself is successful, i.e. not failed or denied. When this list is
   // *not* set, no additional headers will be added to the client's response on success.

api/envoy/extensions/filters/network/thrift_proxy/filters/payload_to_metadata/v3/BUILD

@@ -0,0 +1,12 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/type/matcher/v3:pkg",
+        "@com_github_cncf_udpa//udpa/annotations:pkg",
+    ],
+)