upgrade to envoy 1.22.2

This bumps the envoy version used from 1.17 to 1.22. The commit address's refactoring that occurred with the protobufs and fixes. It also regenerates

- re-ran `make generate` & `make go-mod-tidy`
- fixed small issue due to dropping envoy backported fields to v2 apis
- add `no_extension_lookup_by_name` to bootstrap config

In Envoy 1.22, the default for looking up extensions is now by `@type` rather than just `name`. This adds the `envoy.reloadable_features.no_extension_lookup_by_name: False` to the bootstrap to temporarily revert this behavior so that our current config continues to work.

See https://www.envoyproxy.io/docs/envoy/v1.22.0/version_history/current#minor-behavior-changes for more information. Future PR's should address converting over to using @types.

Co-authored-by: Luke Shumaker <[email protected]>
Signed-off-by: Lance Austin <[email protected]>

CHANGELOG.md

@@ -77,6 +77,11 @@ it will be removed; but as it won't be user-visible this isn't considered a brea
 
 ### Emissary-ingress and Ambassador Edge Stack
 
+- Change: The envoy version included in Emissary-ingress has been upgraded from 1.17 to latest patch
+  release of 1.22. This provides $produceName$ with the latest security patches, performances
+  enhancments, and features offered by the envoy proxy. One notable change that will effect users is
+  the removal of support for V2 tranport protocol. See below for more information.
+
 - Change: Emissary-ingress can no longer be made to configure Envoy using the v2 xDS configuration
   API; it now always uses the v3 xDS API to configure Envoy.  This change should be mostly invisible
   to users, with one notable exception: It removes support for `regex_type: unsafe`.

DEPENDENCIES.md

@@ -22,7 +22,6 @@ following Free and Open Source software:
     github.com/armon/go-metrics                                                                v0.3.10                                      MIT license
     github.com/asaskevich/govalidator                                                          v0.0.0-20210307081110-f21760c49a8d           MIT license
     github.com/census-instrumentation/opencensus-proto                                         v0.3.0                                       Apache License 2.0
-    github.com/cncf/udpa/go                                                                    v0.0.0-20220112060539-c52dc94e7fbe           Apache License 2.0
     github.com/cncf/xds/go                                                                     v0.0.0-20220121163655-4a2b9fdd466b           Apache License 2.0
     github.com/datawire/dlib                                                                   v1.2.5-0.20211116212847-0316f8d7af2b         Apache License 2.0
     github.com/datawire/dtest                                                                  v0.0.0-20210928162311-722b199c4c2f           Apache License 2.0
@@ -94,6 +93,7 @@ following Free and Open Source software:
     github.com/spf13/pflag                                                                     v1.0.5                                       3-clause BSD license
     github.com/stretchr/testify                                                                v1.7.0                                       MIT license
     github.com/xlab/treeprint                                                                  v1.1.0                                       MIT license
+    go.opentelemetry.io/proto/otlp                                                             v0.7.0                                       Apache License 2.0
     go.starlark.net                                                                            v0.0.0-20220203230714-bb14e151c28f           3-clause BSD license
     golang.org/x/crypto                                                                        v0.0.0-20220131195533-30dcbda58838           3-clause BSD license
     golang.org/x/mod                                                                           v0.5.1                                       3-clause BSD license

_cxx/envoy.mk

@@ -13,7 +13,7 @@ RSYNC_EXTRAS ?=
 
 # IF YOU MESS WITH ANY OF THESE VALUES, YOU MUST RUN `make update-base`.
   ENVOY_REPO ?= $(if $(IS_PRIVATE),[email protected]:datawire/envoy-private.git,https://github.com/datawire/envoy.git)
-  ENVOY_COMMIT ?= 8151e9a87cde33721a1b1f864d0c54ae72e4aa78
+  ENVOY_COMMIT ?= f96adbeb45342bb8b37345df11fc395aa4b1fcda
   ENVOY_COMPILATION_MODE ?= opt
   # Increment BASE_ENVOY_RELVER on changes to `docker/base-envoy/Dockerfile`, or Envoy recipes.
   # You may reset BASE_ENVOY_RELVER when adjusting ENVOY_COMMIT.
@@ -249,16 +249,16 @@ envoy-shell: $(ENVOY_BASH.deps)
 # These targets are depended on by `make generate` in `build-aux/generate.mk`.
 
 # Raw protobufs
-$(OSS_HOME)/api/envoy $(OSS_HOME)/api/pb: $(OSS_HOME)/api/%: $(OSS_HOME)/_cxx/envoy
+$(OSS_HOME)/api/envoy: $(OSS_HOME)/api/%: $(OSS_HOME)/_cxx/envoy
 	rsync --recursive --delete --delete-excluded --prune-empty-dirs --include='*/' --include='*.proto' --exclude='*' $</api/$*/ $@
 
 # Go generated from the protobufs
 $(OSS_HOME)/_cxx/envoy/build_go: $(ENVOY_BASH.deps) FORCE
 	$(call ENVOY_BASH.cmd, \
-	    $(ENVOY_DOCKER_EXEC) python3 -c 'from tools.api.generate_go_protobuf import generateProtobufs; generateProtobufs("/root/envoy/build_go")'; \
+	    $(ENVOY_DOCKER_EXEC) python3 -c 'from tools.api.generate_go_protobuf import generate_protobufs; generate_protobufs("@envoy_api//...", "/root/envoy/build_go", "envoy_api")'; \
 	)
 	test -d $@ && touch $@
-$(OSS_HOME)/pkg/api/pb $(OSS_HOME)/pkg/api/envoy: $(OSS_HOME)/pkg/api/%: $(OSS_HOME)/_cxx/envoy/build_go
+$(OSS_HOME)/pkg/api/envoy: $(OSS_HOME)/pkg/api/%: $(OSS_HOME)/_cxx/envoy/build_go
 	rm -rf $@
 	@PS4=; set -ex; { \
 	  unset GIT_DIR GIT_WORK_TREE; \
@@ -269,7 +269,6 @@ $(OSS_HOME)/pkg/api/pb $(OSS_HOME)/pkg/api/envoy: $(OSS_HOME)/pkg/api/%: $(OSS_H
 	    -exec chmod 644 {} + \
 	    -exec sed -E -i.bak \
 	      -e 's,github\.com/envoyproxy/go-control-plane/envoy,github.com/emissary-ingress/emissary/v3/pkg/api/envoy,g' \
-	      -e 's,github\.com/envoyproxy/go-control-plane/pb,github.com/emissary-ingress/emissary/v3/pkg/api/pb,g' \
 	      -- {} +; \
 	  find "$$tmpdir" -name '*.bak' -delete; \
 	  mv "$$tmpdir/$*" $@; \

api/envoy/admin/v2alpha/certs.proto

@@ -9,6 +9,7 @@ import "udpa/annotations/status.proto";
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
 option java_outer_classname = "CertsProto";
 option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/admin/v2alpha";
 option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 // [#protodoc-title: Certificates]

api/envoy/admin/v2alpha/clusters.proto

@@ -13,6 +13,7 @@ import "udpa/annotations/status.proto";
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
 option java_outer_classname = "ClustersProto";
 option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/admin/v2alpha";
 option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 // [#protodoc-title: Clusters]

api/envoy/admin/v2alpha/config_dump.proto

@@ -12,6 +12,7 @@ import "udpa/annotations/status.proto";
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
 option java_outer_classname = "ConfigDumpProto";
 option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/admin/v2alpha";
 option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 // [#protodoc-title: ConfigDump]

api/envoy/admin/v2alpha/listeners.proto

@@ -9,6 +9,7 @@ import "udpa/annotations/status.proto";
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
 option java_outer_classname = "ListenersProto";
 option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/admin/v2alpha";
 option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 // [#protodoc-title: Listeners]

api/envoy/admin/v2alpha/memory.proto

@@ -7,6 +7,7 @@ import "udpa/annotations/status.proto";
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
 option java_outer_classname = "MemoryProto";
 option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/admin/v2alpha";
 option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 // [#protodoc-title: Memory]

api/envoy/admin/v2alpha/metrics.proto

@@ -7,6 +7,7 @@ import "udpa/annotations/status.proto";
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
 option java_outer_classname = "MetricsProto";
 option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/admin/v2alpha";
 option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 // [#protodoc-title: Metrics]

api/envoy/admin/v2alpha/mutex_stats.proto

@@ -7,6 +7,7 @@ import "udpa/annotations/status.proto";
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
 option java_outer_classname = "MutexStatsProto";
 option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/admin/v2alpha";
 option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 // [#protodoc-title: MutexStats]

api/envoy/admin/v2alpha/server_info.proto

@@ -10,6 +10,7 @@ import "udpa/annotations/status.proto";
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
 option java_outer_classname = "ServerInfoProto";
 option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/admin/v2alpha";
 option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 // [#protodoc-title: Server State]

api/envoy/admin/v2alpha/tap.proto

@@ -10,6 +10,7 @@ import "validate/validate.proto";
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
 option java_outer_classname = "TapProto";
 option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/admin/v2alpha";
 option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 // [#protodoc-title: Tap]

api/envoy/admin/v3/certs.proto

@@ -10,6 +10,7 @@ import "udpa/annotations/versioning.proto";
 option java_package = "io.envoyproxy.envoy.admin.v3";
 option java_outer_classname = "CertsProto";
 option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/admin/v3;adminv3";
 option (udpa.annotations.file_status).package_version_status = ACTIVE;
 
 // [#protodoc-title: Certificates]

api/envoy/admin/v3/clusters.proto

@@ -15,6 +15,7 @@ import "udpa/annotations/versioning.proto";
 option java_package = "io.envoyproxy.envoy.admin.v3";
 option java_outer_classname = "ClustersProto";
 option java_multiple_files = true;
+option go_package = "github.com/envoyproxy/go-control-plane/envoy/admin/v3;adminv3";
 option (udpa.annotations.file_status).package_version_status = ACTIVE;
 
 // [#protodoc-title: Clusters]
@@ -29,7 +30,7 @@ message Clusters {
 }
 
 // Details an individual cluster's current status.
-// [#next-free-field: 7]
+// [#next-free-field: 8]
 message ClusterStatus {
   option (udpa.annotations.versioning).previous_message_type = "envoy.admin.v2alpha.ClusterStatus";
 
@@ -41,10 +42,10 @@ message ClusterStatus {
 
   // The success rate threshold used in the last interval.
   // If
-  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
+  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_v3_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
   // is *false*, all errors: externally and locally generated were used to calculate the threshold.
   // If
-  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
+  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_v3_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
   // is *true*, only externally generated errors were used to calculate the threshold.
   // The threshold is used to eject hosts based on their success rate. See
   // :ref:`Cluster outlier detection <arch_overview_outlier_detection>` documentation for details.
@@ -64,7 +65,7 @@ message ClusterStatus {
   // The success rate threshold used in the last interval when only locally originated failures were
   // taken into account and externally originated errors were treated as success.
   // This field should be interpreted only when
-  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
+  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_v3_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
   // is *true*. The threshold is used to eject hosts based on their success rate.
   // See :ref:`Cluster outlier detection <arch_overview_outlier_detection>` documentation for
   // details.
@@ -80,6 +81,9 @@ message ClusterStatus {
 
   // :ref:`Circuit breaking <arch_overview_circuit_break>` settings of the cluster.
   config.cluster.v3.CircuitBreakers circuit_breakers = 6;
+
+  // Observability name of the cluster.
+  string observability_name = 7;
 }
 
 // Current state of a particular host.
@@ -98,10 +102,10 @@ message HostStatus {
 
   // Request success rate for this host over the last calculated interval.
   // If
-  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
+  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_v3_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
   // is *false*, all errors: externally and locally generated were used in success rate
   // calculation. If
-  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
+  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_v3_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
   // is *true*, only externally generated errors were used in success rate calculation.
   // See :ref:`Cluster outlier detection <arch_overview_outlier_detection>` documentation for
   // details.
@@ -124,7 +128,7 @@ message HostStatus {
   // interval when only locally originated errors are taken into account and externally originated
   // errors were treated as success.
   // This field should be interpreted only when
-  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
+  // :ref:`outlier_detection.split_external_local_origin_errors<envoy_v3_api_field_config.cluster.v3.OutlierDetection.split_external_local_origin_errors>`
   // is *true*.
   // See :ref:`Cluster outlier detection <arch_overview_outlier_detection>` documentation for
   // details.
@@ -139,7 +143,7 @@ message HostStatus {
 }
 
 // Health status for a host.
-// [#next-free-field: 7]
+// [#next-free-field: 9]
 message HostHealthStatus {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.admin.v2alpha.HostHealthStatus";
@@ -160,6 +164,13 @@ message HostHealthStatus {
   // The host has not yet been health checked.
   bool pending_active_hc = 6;
 
+  // The host should be excluded from panic, spillover, etc. calculations because it was explicitly
+  // taken out of rotation via protocol signal and is not meant to be routed to.
+  bool excluded_via_immediate_hc_fail = 7;
+
+  // The host failed active HC due to timeout.
+  bool active_hc_timeout = 8;
+
   // Health status as reported by EDS. Note: only HEALTHY and UNHEALTHY are currently supported
   // here.
   // [#comment:TODO(mrice32): pipe through remaining EDS health status possibilities.]