Merge remote-tracking branch 'upstream/main' into eds_caching_part2

Signed-off-by: Adi Suissa-Peleg <adip@google.com>

.azure-pipelines/stage/checks.yml

@@ -58,12 +58,16 @@ jobs:
       msan:
         CI_TARGET: "bazel.msan"
         ENVOY_FILTER_EXAMPLE: true
-      clang_tidy:
-        CI_TARGET: "bazel.clang_tidy"
-        REPO_FETCH_DEPTH: 0
-        REPO_FETCH_TAGS: true
-        PUBLISH_TEST_RESULTS: false
-        PUBLISH_ENVOY: false
+      #
+      # Temporarily disabled to facilitate release CI, should be resolved
+      #    as part of https://github.com/envoyproxy/envoy/issues/28566
+      #
+      # clang_tidy:
+      #   CI_TARGET: "bazel.clang_tidy"
+      #   REPO_FETCH_DEPTH: 0
+      #   REPO_FETCH_TAGS: true
+      #   PUBLISH_TEST_RESULTS: false
+      #   PUBLISH_ENVOY: false
       api:
         CI_TARGET: "bazel.api"
   timeoutInMinutes: 180
@@ -95,7 +99,7 @@ jobs:
   condition: |
     and(not(canceled()),
         eq(${{ parameters.runChecks }}, 'true'))
-  timeoutInMinutes: 240
+  timeoutInMinutes: 300
   pool: "envoy-x64-large"
   strategy:
     maxParallel: 2

.github/actions/env/action.yml

@@ -123,7 +123,11 @@ runs:
   - id: context
     name: 'CI context'
     run: |
-      VERSION_DEV="$(cat VERSION.txt | cut -d- -f2)"
+      if grep dev VERSION.txt; then
+          VERSION_DEV="$(cat VERSION.txt | cut -d- -f2)"
+      else
+          VERSION_DEV=""
+      fi
       VERSION_PATCH="$(cat VERSION.txt | cut -d- -f1 | rev | cut -d. -f1 | rev)"
       # TODO: strip merge from pr names
       REF_NAME=${{ inputs.repo_ref_name || github.ref_name }}

.github/actions/pr_notifier/requirements.txt

@@ -4,9 +4,9 @@
 #
 #    pip-compile --generate-hashes .github/actions/pr_notifier/requirements.txt
 #
-certifi==2022.12.7 \
-    --hash=sha256:35824b4c3a97115964b408844d64aa14db1cc518f6562e8d7261699d1350a9e3 \
-    --hash=sha256:4ad3232f5e926d6718ec31cfc1fcadfde020920e278684144551c91769c7bc18
+certifi==2023.7.22 \
+    --hash=sha256:539cc1d13202e33ca466e88b2807e29f4c13049d6d87031a3c110744495cb082 \
+    --hash=sha256:92d6037539857d8206b8f6ae472e8b77db8058fec5937a1ef3f54304089edbb9
     # via requests
 cffi==1.14.5 \
     --hash=sha256:005a36f41773e148deac64b08f233873a4d0c18b053d37da83f6af4d9087b813 \

.github/actions/publish/release/setup/action.yml

@@ -16,7 +16,7 @@ runs:
     env:
       REF: ${{ inputs.ref }}
     shell: bash
-  - uses: envoyproxy/toolshed/gh-actions/fetch@actions-v0.0.7
+  - uses: envoyproxy/toolshed/gh-actions/fetch@actions-v0.0.10
     id: fetch
     with:
       url: "${{ steps.url.outputs.base }}/release.signed.tar.zst"

.github/workflows/_cache_docker.yml

@@ -38,5 +38,6 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - uses: envoyproxy/toolshed/gh-actions/docker/cache/prime@actions-v0.0.10
+      name: Prime Docker cache (${{ inputs.image_repo }}:${{ inputs.image_tag }}@sha256:${{ inputs.image_sha }})
       with:
         image_tag: "${{ inputs.image_repo }}:${{ inputs.image_tag }}@sha256:${{ inputs.image_sha }}"

.github/workflows/_ci.yml

@@ -77,16 +77,21 @@ on:
         type: string
 
 concurrency:
-  group: ${{ github.head_ref || github.run_id }}-ci-${{ inputs.target }}
+  group: |
+    ${{ github.actor != 'trigger-release-envoy[bot]'
+        && github.event.inputs.head_ref
+        || github.run_id
+    }}-${{ github.workflow }}-${{ inputs.target }}
   cancel-in-progress: true
 
 jobs:
   do_ci:
     if: ${{ ! inputs.skip }}
     runs-on: ubuntu-22.04
-    name: ${{ inputs.command_ci }} (${{ inputs.target }})
+    name: ${{ inputs.command_ci }} ${{ inputs.target }}
     steps:
     - if: ${{ inputs.cache_build_image }}
+      name: Restore Docker cache (${{ inputs.cache_build_image }})
       uses: envoyproxy/toolshed/gh-actions/docker/cache/restore@actions-v0.0.10
       with:
         image_tag: ${{ inputs.cache_build_image }}
@@ -99,6 +104,7 @@ jobs:
         exit 1
 
     - uses: actions/checkout@v3
+      name: Checkout Envoy repository
       with:
         fetch-depth: ${{ inputs.repo_fetch_depth }}
         # WARNING: This allows untrusted code to run!!!
@@ -129,12 +135,14 @@ jobs:
       name: "Check disk space at beginning"
 
     - if: ${{ inputs.run_pre }}
+      name: Run pre action ${{ inputs.run_pre && format('({0})', inputs.run_pre) || '' }}
       uses: envoyproxy/toolshed/gh-actions/using/recurse@actions-v0.0.10
       with:
         uses: ${{ inputs.run_pre }}
         with: ${{ inputs.run_pre_with }}
 
     - uses: ./.github/actions/do_ci
+      name: Do CI
       with:
         target: ${{ inputs.target }}
         rbe: ${{ inputs.rbe }}
@@ -151,6 +159,7 @@ jobs:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
     - if: ${{ inputs.run_post }}
+      name: Run post action ${{ inputs.run_pre && format('({0})', inputs.run_post) || '' }}
       uses: envoyproxy/toolshed/gh-actions/using/recurse@actions-v0.0.10
       with:
         uses: ${{ inputs.run_post }}

.github/workflows/_env.yml

@@ -95,7 +95,11 @@ on:
         value: ${{ jobs.repo.outputs.version_patch }}
 
 concurrency:
-  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}-env
+  group: |
+    ${{ github.actor != 'trigger-release-envoy[bot]'
+        && github.event.inputs.head_ref
+        || github.run_id
+    }}-${{ github.workflow }}-env
   cancel-in-progress: true
 
 jobs:
@@ -128,9 +132,11 @@ jobs:
       version_patch: ${{ steps.env.outputs.version_patch }}
     steps:
     - uses: actions/checkout@v3
+      name: Checkout Envoy repository
       with:
         fetch-depth: ${{ ! inputs.check_mobile_run && 1 || 0 }}
     - uses: ./.github/actions/env
+      name: Generate environment variables
       id: env
       with:
         check_mobile_run: ${{ inputs.check_mobile_run }}
@@ -168,7 +174,7 @@ jobs:
       statuses: write
     with:
       workflow_name: ${{ inputs.start_check_status }}
-      sha: ${{ inputs.repo_ref }}
+      sha: ${{ inputs.repo_ref_sha }}
 
   cache:
     if: ${{ inputs.prime_build_image }}

.github/workflows/envoy-publish.yml

@@ -12,7 +12,11 @@ on:
         description: "Ref for grouping PRs"
 
 concurrency:
-  group: ${{ github.event.inputs.head_ref || github.run_id }}-${{ github.workflow }}
+  group: |
+    ${{ github.actor != 'trigger-release-envoy[bot]'
+        && github.event.inputs.head_ref
+        || github.run_id
+    }}-${{ github.workflow }}
   cancel-in-progress: true
 
 permissions:

VERSION.txt

@@ -1 +1 @@
-1.27.0-dev
+1.28.0-dev

api/bazel/api_build_system.bzl

@@ -10,11 +10,16 @@ load(
     "EXTERNAL_PROTO_GO_BAZEL_DEP_MAP",
     "EXTERNAL_PROTO_PY_BAZEL_DEP_MAP",
 )
+load(
+    "@envoy//bazel/cc_proto_descriptor_library:builddefs.bzl",
+    "cc_proto_descriptor_library",
+)
 
 EnvoyProtoDepsInfo = provider(fields = ["deps"])
 
 _PY_PROTO_SUFFIX = "_py_proto"
 _CC_PROTO_SUFFIX = "_cc_proto"
+_CC_PROTO_DESCRIPTOR_SUFFIX = "_cc_proto_descriptor"
 _CC_GRPC_SUFFIX = "_cc_grpc"
 _GO_PROTO_SUFFIX = "_go_proto"
 _GO_IMPORTPATH_PREFIX = "github.com/envoyproxy/go-control-plane/"
@@ -128,6 +133,17 @@ def api_cc_py_proto_library(
         deps = deps + _COMMON_PROTO_DEPS,
         visibility = visibility,
     )
+
+    # This is to support Envoy Mobile using Protobuf-Lite.
+    # Protobuf-Lite generated C++ code does not include reflection
+    # capabilities but analogous functionality can be provided by
+    # cc_proto_descriptor_library.
+    cc_proto_descriptor_library(
+        name = name + _CC_PROTO_DESCRIPTOR_SUFFIX,
+        visibility = visibility,
+        deps = [name],
+    )
+
     cc_proto_library_name = name + _CC_PROTO_SUFFIX
     pgv_cc_proto_library(
         name = cc_proto_library_name,

api/contrib/envoy/extensions/filters/network/generic_proxy/matcher/v3/matcher.proto

@@ -47,7 +47,6 @@ message PropertyMatchInput {
   string property_name = 1 [(validate.rules).string = {min_len: 1}];
 }
 
-// [#not-implemented-hide:]
 // Used to match an whole generic downstream request.
 message RequestMatchInput {
 }

api/contrib/envoy/extensions/filters/network/postgres_proxy/v3alpha/postgres_proxy.proto

@@ -55,6 +55,8 @@ message PostgresProxy {
   // Postgres filter is able to read Postgres payload in clear-text. It happens when
   // a client established a clear-text connection to Envoy or when a client established
   // SSL connection to Envoy and Postgres filter is configured to terminate SSL.
-  // Defaults to SSL_DISABLE.
+  // In order for upstream encryption to work, the corresponding cluster must be configured to use
+  // :ref:`starttls transport socket <envoy_v3_api_msg_extensions.transport_sockets.starttls.v3.UpstreamStartTlsConfig>`.
+  // Defaults to ``SSL_DISABLE``.
   SSLMode upstream_ssl = 4;
 }

api/envoy/extensions/http/header_validators/envoy_default/v3/header_validator.proto

@@ -27,6 +27,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 //    without `case normalization <https://datatracker.ietf.org/doc/html/rfc3986#section-6.2.2.1>`_
 //
 // [#comment:TODO(yanavlasov): Put #extension: envoy.http.header_validators.envoy_default after it is not hidden any more]
+// [#next-free-field: 6]
 message HeaderValidatorConfig {
   // Action to take when Envoy receives client request with header names containing underscore
   // characters.
@@ -144,4 +145,8 @@ message HeaderValidatorConfig {
   // Action to take when a client request with a header name containing underscore characters is received.
   // If this setting is not specified, the value defaults to ALLOW.
   HeadersWithUnderscoresAction headers_with_underscores_action = 4;
+
+  // Allow requests with fragment in URL path and strip the fragment before request processing.
+  // By default Envoy rejects requests with fragment in URL path.
+  bool strip_fragment_from_path = 5;
 }

bazel/cc_proto_descriptor_library/BUILD

@@ -0,0 +1,66 @@
+licenses(["notice"])  # Apache 2
+
+cc_library(
+    name = "file_descriptor_info",
+    hdrs = ["file_descriptor_info.h"],
+    visibility = ["//visibility:public"],
+    deps = [
+        "@com_google_absl//absl/strings",
+    ],
+)
+
+cc_library(
+    name = "text_format_transcoder",
+    srcs = [
+        "create_dynamic_message.h",
+        "text_format_transcoder.cc",
+    ],
+    hdrs = ["text_format_transcoder.h"],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":file_descriptor_info",
+        "@com_google_absl//absl/memory",
+        "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/strings:str_format",
+        "@com_google_protobuf//:protobuf",
+    ],
+)
+
+cc_library(
+    name = "file_descriptor_generator_lib",
+    srcs = ["file_descriptor_generator.cc"],
+    hdrs = ["file_descriptor_generator.h"],
+    deps = [
+        "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/strings:str_format",
+        "@com_google_protobuf//:protobuf",
+        "@com_google_protobuf//src/google/protobuf/compiler:code_generator",
+        "@com_google_protobuf//src/google/protobuf/compiler:retention",
+    ],
+)
+
+cc_binary(
+    name = "file_descriptor_generator",
+    srcs = ["file_descriptor_generator_main.cc"],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":file_descriptor_generator_lib",
+        "@com_google_protobuf//:protobuf",
+        "@com_google_protobuf//:protoc_lib",
+        "@com_google_protobuf//src/google/protobuf/compiler:code_generator",
+    ],
+)
+
+cc_library(
+    name = "create_dynamic_message",
+    srcs = ["create_dynamic_message.cc"],
+    hdrs = ["create_dynamic_message.h"],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":text_format_transcoder",
+        "@com_google_absl//absl/memory",
+        "@com_google_absl//absl/strings",
+        "@com_google_absl//absl/strings:str_format",
+        "@com_google_protobuf//:protobuf",
+    ],
+)