sync from master.

.azure-pipelines/bazel.yml

@@ -25,10 +25,6 @@ steps:
     path: $(Build.StagingDirectory)/repository_cache
   continueOnError: true
 
-- bash: .azure-pipelines/cleanup.sh
-  displayName: "Removing tools from agent"
-  condition: ${{ parameters.managedAgent }}
-
 - bash: |
     echo "disk space at beginning of build:"
     df -h

.azure-pipelines/pipelines.yml

@@ -287,8 +287,6 @@ stages:
     pool:
       vmImage: "ubuntu-18.04"
     steps:
-    - bash: .azure-pipelines/cleanup.sh
-      displayName: "Removing tools from agent"
     - bash: |
         echo "disk space at beginning of build:"
         df -h

.bazelrc

@@ -10,6 +10,9 @@
 # Startup options cannot be selected via config.
 startup --host_jvm_args=-Xmx2g
 
+run --color=yes
+
+build --color=yes
 build --workspace_status_command="bash bazel/get_workspace_status"
 build --experimental_strict_action_env=true
 build --host_force_python=PY3

.github/actions/pr_notifier/pr_notifier.py

@@ -13,6 +13,7 @@
 
 MAINTAINERS = {
     'alyssawilk': 'U78RP48V9',
+    'dio': 'U79S2DFV1',
     'mattklein123': 'U5CALEVSL',
     'lizan': 'U79E51EQ6',
     'snowp': 'U93KTPQP6',
@@ -28,6 +29,13 @@
     'asraa': 'UKZKCFRTP',
 }
 
+# Only notify API reviewers who aren't maintainers.
+# Maintainers are already notified of pending PRs.
+API_REVIEWERS = {
+    'markdroth': 'UMN8K55A6',
+    'adisuissa': 'UT17EMMTP',
+}
+
 
 def get_slo_hours():
     # on Monday, allow for 24h + 48h
@@ -44,6 +52,14 @@ def is_waiting(labels):
     return False
 
 
+# Return true if the PR has an API tag, false otherwise.
+def is_api(labels):
+    for label in labels:
+        if label.name == 'api':
+            return True
+    return False
+
+
 # Generate a pr message, bolding the time if it's out-SLO
 def pr_message(pr_age, pr_url, pr_title, delta_days, delta_hours):
     if pr_age < datetime.timedelta(hours=get_slo_hours()):
@@ -54,19 +70,38 @@ def pr_message(pr_age, pr_url, pr_title, delta_days, delta_hours):
             pr_url, pr_title, delta_days, delta_hours)
 
 
-# Adds reminder lines to the appropriate maintainer to review the assigned PRs
-def add_reminders(assignees, maintainers_and_prs, message):
-    has_maintainer_assignee = False
+# Adds reminder lines to the appropriate assignee to review the assigned PRs
+# Returns true if one of the assignees is in the known_assignee_map, false otherwise.
+def add_reminders(assignees, assignees_and_prs, message, known_assignee_map):
+    has_known_assignee = False
     for assignee_info in assignees:
         assignee = assignee_info.login
-        if assignee not in MAINTAINERS:
+        if assignee not in known_assignee_map:
             continue
-        has_maintainer_assignee = True
-        if assignee not in maintainers_and_prs.keys():
-            maintainers_and_prs[
+        has_known_assignee = True
+        if assignee not in assignees_and_prs.keys():
+            assignees_and_prs[
                 assignee] = "Hello, %s, here are your PR reminders for the day \n" % assignee
-        maintainers_and_prs[assignee] = maintainers_and_prs[assignee] + message
-    return has_maintainer_assignee
+        assignees_and_prs[assignee] = assignees_and_prs[assignee] + message
+    return has_known_assignee
+
+
+# Returns true if the PR needs an LGTM from an API shephard.
+def needs_api_review(labels, repo, pr_info):
+    # API reviews should always have the label, so don't bother doing an RPC if
+    # it's not tagged (this helps avoid github rate limiting)
+    if not (is_api(labels)):
+        return False
+    # repokitten tags each commit as pending unless there has been an API LGTM
+    # since the latest API changes. If this PR is tagged pendding it needs an
+    # API review, otherwise it's set.
+    headers, data = repo._requester.requestJsonAndCheck(
+        "GET",
+        ("https://api.github.com/repos/envoyproxy/envoy/statuses/" + pr_info.head.sha),
+    )
+    if (data and data[0]["state"] == 'pending'):
+        return True
+    return False
 
 
 def track_prs():
@@ -79,13 +114,19 @@ def track_prs():
     maintainers_and_prs = {}
     # A placeholder for unassigned PRs, to be sent to #maintainers eventually
     maintainers_and_prs['unassigned'] = ""
+    # A dict of shephard : outstanding_pr_string to be sent to slack
+    api_review_and_prs = {}
     # Out-SLO PRs to be sent to #envoy-maintainer-oncall
     stalled_prs = ""
 
     # Snag all PRs, including drafts
     for pr_info in repo.get_pulls("open", "updated", "desc"):
+        labels = pr_info.labels
+        assignees = pr_info.assignees
         # If the PR is waiting, continue.
-        if is_waiting(pr_info.labels):
+        if is_waiting(labels):
+            continue
+        if pr_info.draft:
             continue
 
         # Update the time based on the time zone delta from github's
@@ -98,37 +139,40 @@ def track_prs():
         # SLO, nudge in bold if not.
         message = pr_message(delta, pr_info.html_url, pr_info.title, delta_days, delta_hours)
 
+        if (needs_api_review(labels, repo, pr_info)):
+            add_reminders(pr_info.assignees, api_review_and_prs, message, API_REVIEWERS)
+
         # If the PR has been out-SLO for over a day, inform on-call
         if delta > datetime.timedelta(hours=get_slo_hours() + 36):
             stalled_prs = stalled_prs + message
 
         # Add a reminder to each maintainer-assigner on the PR.
-        has_maintainer_assignee = add_reminders(pr_info.assignees, maintainers_and_prs, message)
+        has_maintainer_assignee = add_reminders(
+            pr_info.assignees, maintainers_and_prs, message, MAINTAINERS)
 
         # If there was no maintainer, track it as unassigned.
         if not has_maintainer_assignee:
-            # don't bother assigning maintainer WIPs.
-            if pr_info.draft and pr_info.user.login in maintainers_and_prs.keys():
-                continue
             maintainers_and_prs['unassigned'] = maintainers_and_prs['unassigned'] + message
 
-    # Return the dict of {maintainers : PR notifications}, and stalled PRs
-    return maintainers_and_prs, stalled_prs
+    # Return the dict of {maintainers : PR notifications},
+    # the dict of {api-shephards-who-are-not-maintainers: PR notifications},
+    # and stalled PRs
+    return maintainers_and_prs, api_review_and_prs, stalled_prs
 
 
-def post_to_maintainers(client, maintainers_and_messages):
-    # Post updates to individual maintainers
-    for key in maintainers_and_messages:
-        message = maintainers_and_messages[key]
+def post_to_assignee(client, assignees_and_messages, assignees_map):
+    # Post updates to individual assignees
+    for key in assignees_and_messages:
+        message = assignees_and_messages[key]
 
-        # Only send messages if we have the maintainer UID
-        if key not in MAINTAINERS:
+        # Only send messages if we have the slack UID
+        if key not in assignees_map:
             continue
-        uid = MAINTAINERS[key]
+        uid = assignees_map[key]
 
         # Ship messages off to slack.
         try:
-            print(maintainers_and_messages[key])
+            print(assignees_and_messages[key])
             response = client.conversations_open(users=uid, text="hello")
             channel_id = response["channel"]["id"]
             response = client.chat_postMessage(channel=channel_id, text=message)
@@ -151,15 +195,16 @@ def post_to_oncall(client, unassigned_prs, out_slo_prs):
 
 
 if __name__ == '__main__':
+    maintainers_and_messages, shephards_and_messages, stalled_prs = track_prs()
+
     SLACK_BOT_TOKEN = os.getenv('SLACK_BOT_TOKEN')
     if not SLACK_BOT_TOKEN:
         print(
             'Missing SLACK_BOT_TOKEN: please export token from https://api.slack.com/apps/A023NPQQ33K/oauth?'
         )
         sys.exit(1)
 
-    maintainers_and_messages, stalled_prs = track_prs()
-
     client = WebClient(token=SLACK_BOT_TOKEN)
-    post_to_maintainers(client, maintainers_and_messages)
     post_to_oncall(client, maintainers_and_messages['unassigned'], stalled_prs)
+    post_to_assignee(client, shephards_and_messages, API_REVIEWERS)
+    post_to_assignee(client, maintainers_and_messages, MAINTAINERS)

.github/actions/pr_notifier/requirements.txt

@@ -111,9 +111,9 @@ six==1.16.0 \
     --hash=sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926 \
     --hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254
     # via pynacl
-slack-sdk==3.6.0 \
-    --hash=sha256:195f044e02a2844579a7a26818ce323e85dde8de224730c859644918d793399e \
-    --hash=sha256:e1b257923a1ef88b8620dd3abff94dc5b3eee16ef37975d101ba9e60123ac3af
+slack-sdk==3.7.0 \
+    --hash=sha256:50b9fd6d8f83af7e8ad6d8e76882d04931842241f85ccfd30da09b4a7b9b1516 \
+    --hash=sha256:f0bf3e38ac393eba7fe1a99191b0e72f710860c6d2edc1271606fcfc08bea2e1
     # via -r .github/actions/pr_notifier/requirements.txt
 urllib3==1.26.5 \
     --hash=sha256:753a0374df26658f99d826cfe40394a686d05985786d946fbe4165b5148f5a7c \

.github/dependabot.yml

@@ -21,11 +21,6 @@ updates:
   schedule:
     interval: "daily"
 
-- package-ecosystem: "pip"
-  directory: "/docs"
-  schedule:
-    interval: "daily"
-
 - package-ecosystem: "pip"
   directory: "/tools/docs"
   schedule:

.github/workflows/codeql-daily.yml

@@ -34,7 +34,8 @@ jobs:
     - name: Install deps
       shell: bash
       run: |
-       sudo apt-get update && sudo apt-get install libtool cmake automake autoconf make ninja-build curl unzip virtualenv openjdk-11-jdk build-essential libc++1
+       sudo apt-get update --error-on=any
+       sudo apt-get install --yes libtool cmake automake autoconf make ninja-build curl unzip virtualenv openjdk-11-jdk build-essential libc++1
        mkdir -p bin/clang11
        cd bin/clang11
        wget https://github.com/llvm/llvm-project/releases/download/llvmorg-11.0.1/clang+llvm-11.0.1-x86_64-linux-gnu-ubuntu-16.04.tar.xz

.github/workflows/codeql-push.yml

@@ -42,7 +42,8 @@ jobs:
     - name: Install deps
       shell: bash
       run: |
-       sudo apt-get update && sudo apt-get install libtool cmake automake autoconf make ninja-build curl unzip virtualenv openjdk-11-jdk build-essential libc++1
+       sudo apt-get update --error-on=any
+       sudo apt-get install --yes libtool cmake automake autoconf make ninja-build curl unzip virtualenv openjdk-11-jdk build-essential libc++1
        mkdir -p bin/clang11
        cd bin/clang11
        wget https://github.com/llvm/llvm-project/releases/download/llvmorg-11.0.1/clang+llvm-11.0.1-x86_64-linux-gnu-ubuntu-16.04.tar.xz

CODEOWNERS

@@ -196,3 +196,5 @@ extensions/filters/http/oauth2 @rgs1 @derekargueta @snowp
 /*/extensions/filters/http/set_metadata @aguinet @snowp
 # Formatters
 /*/extensions/formatter/req_without_query @dio @tsaarni
+# IP address input matcher
+/*/extensions/matching/input_matchers/ip @aguinet @snowp

CONTRIBUTING.md

@@ -102,7 +102,7 @@ versioning guidelines:
 
   Please see [support/README.md](support/README.md) for more information on these hooks.
 
-* Create your PR. If your PR adds new code, it should include tests [covering](source/docs/coverage.md) the new code.
+* Create your PR. If your PR adds new code, it should include tests [covering](source/docs/coverage.md) the new code. Please note that draft PRs may not be reviewed and will likely not be triaged, so do not create your PR as a draft if you want prompt reviews!
 * Tests will automatically run for you.
 * We will **not** merge any PR that is not passing tests.
 * PRs are expected to have 100% test coverage for added code. This can be verified with a coverage

OWNERS.md

@@ -44,6 +44,15 @@ routing PRs, questions, etc. to the right place.
 * Antonio Vicente ([antoniovicente](https://github.com/antoniovicente)) ([email protected])
   * Event management, security, performance, data plane.
 
+# Senior extension maintainers
+
+The following extension maintainers have final say over the extensions mentioned below. Once they
+approve an extension PR, it will be merged by the maintainer on-call (or any other maintainer)
+without further review.
+
+* Piotr Sikora ([PiotrSikora](https://github.com/PiotrSikora)) ([email protected])
+  * Wasm
+
 # Envoy security team
 
 * All maintainers

api/BUILD

@@ -195,6 +195,7 @@ proto_library(
         "//envoy/extensions/internal_redirect/safe_cross_scheme/v3:pkg",
         "//envoy/extensions/matching/common_inputs/environment_variable/v3:pkg",
         "//envoy/extensions/matching/input_matchers/consistent_hashing/v3:pkg",
+        "//envoy/extensions/matching/input_matchers/ip/v3:pkg",
         "//envoy/extensions/network/socket_interface/v3:pkg",
         "//envoy/extensions/quic/crypto_stream/v3:pkg",
         "//envoy/extensions/quic/proof_source/v3:pkg",

api/bazel/external_proto_deps.bzl

@@ -11,7 +11,7 @@
 EXTERNAL_PROTO_IMPORT_BAZEL_DEP_MAP = {
     "google/api/expr/v1alpha1/checked.proto": "@com_google_googleapis//google/api/expr/v1alpha1:checked_proto",
     "google/api/expr/v1alpha1/syntax.proto": "@com_google_googleapis//google/api/expr/v1alpha1:syntax_proto",
-    "metrics.proto": "@prometheus_metrics_model//:client_model",
+    "io/prometheus/client/metrics.proto": "@prometheus_metrics_model//:client_model",
     "opencensus/proto/trace/v1/trace.proto": "@opencensus_proto//opencensus/proto/trace/v1:trace_proto",
     "opencensus/proto/trace/v1/trace_config.proto": "@opencensus_proto//opencensus/proto/trace/v1:trace_config_proto",
     "opentelemetry/proto/common/v1/common.proto": "@opentelemetry_proto//:common",

api/bazel/repositories.bzl

@@ -55,7 +55,7 @@ load("@io_bazel_rules_go//proto:def.bzl", "go_proto_library")
 api_cc_py_proto_library(
     name = "client_model",
     srcs = [
-        "metrics.proto",
+        "io/prometheus/client/metrics.proto",
     ],
     visibility = ["//visibility:public"],
 )

api/bazel/repository_locations.bzl

@@ -89,9 +89,9 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "Prometheus client model",
         project_desc = "Data model artifacts for Prometheus",
         project_url = "https://github.com/prometheus/client_model",
-        version = "0255a22d35ad5661ef7aa89c95fdf5dfd685283f",
-        sha256 = "a83fd26a80c5f9b82d1231448141a148c1d7a0c8f581ddf49fdbd8c1545e5661",
-        release_date = "2021-01-16",
+        version = "147c58e9608a4f9628b53b6cc863325ca746f63a",
+        sha256 = "f7da30879dcdfae367fa65af1969945c3148cfbfc462b30b7d36f17134675047",
+        release_date = "2021-06-07",
         strip_prefix = "client_model-{version}",
         urls = ["https://github.com/prometheus/client_model/archive/{version}.tar.gz"],
         use_category = ["api"],

api/envoy/config/accesslog/v3/accesslog.proto

@@ -246,6 +246,7 @@ message ResponseFlagFilter {
         in: "DT"
         in: "UPE"
         in: "NC"
+        in: "OM"
       }
     }
   }];

api/envoy/config/cluster/v3/cluster.proto

@@ -43,7 +43,7 @@ message ClusterCollection {
 }
 
 // Configuration for a single upstream cluster.
-// [#next-free-field: 54]
+// [#next-free-field: 55]
 message Cluster {
   option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.Cluster";
 
@@ -413,8 +413,8 @@ message Cluster {
     // The table size for Maglev hashing. The Maglev aims for ‘minimal disruption’ rather than an absolute guarantee.
     // Minimal disruption means that when the set of upstreams changes, a connection will likely be sent to the same
     // upstream as it was before. Increasing the table size reduces the amount of disruption.
-    // The table size must be prime number. If it is not specified, the default is 65537.
-    google.protobuf.UInt64Value table_size = 1;
+    // The table size must be prime number limited to 5000011. If it is not specified, the default is 65537.
+    google.protobuf.UInt64Value table_size = 1 [(validate.rules).uint64 = {lte: 5000011}];
   }
 
   // Specific configuration for the
@@ -876,6 +876,13 @@ message Cluster {
   // DNS resolution configuration which includes the underlying dns resolver addresses and options.
   core.v3.DnsResolutionConfig dns_resolution_config = 53;
 
+  // Optional configuration for having cluster readiness block on warm-up. Currently, only applicable for
+  // :ref:`STRICT_DNS<envoy_v3_api_enum_value_config.cluster.v3.Cluster.DiscoveryType.STRICT_DNS>`,
+  // or :ref:`LOGICAL_DNS<envoy_v3_api_enum_value_config.cluster.v3.Cluster.DiscoveryType.LOGICAL_DNS>`.
+  // If true, cluster readiness blocks on warm-up. If false, the cluster will complete
+  // initialization whether or not warm-up has completed. Defaults to true.
+  google.protobuf.BoolValue wait_for_warm_on_init = 54;
+
   // If specified, outlier detection will be enabled for this upstream cluster.
   // Each of the configuration values can be overridden via
   // :ref:`runtime values <config_cluster_manager_cluster_runtime_outlier_detection>`.
@@ -930,7 +937,7 @@ message Cluster {
   CommonLbConfig common_lb_config = 27;
 
   // Optional custom transport socket implementation to use for upstream connections.
-  // To setup TLS, set a transport socket with name `tls` and
+  // To setup TLS, set a transport socket with name `envoy.transport_sockets.tls` and
   // :ref:`UpstreamTlsContexts <envoy_v3_api_msg_extensions.transport_sockets.tls.v3.UpstreamTlsContext>` in the `typed_config`.
   // If no transport socket configuration is specified, new connections
   // will be set up with plaintext.