auto-merge envoyproxy/envoy[main] into envoyproxy/envoy-openssl[main]

* upstream/main:
  build(deps): bump distroless/base-nossl-debian12 from `4cc93c5` to `e130c09` in /ci (#36322)
  postgres_filter: fix build error on m1 (#36274)
  bazel/ci: Fix distribution build (#36320)
  Add `ClientSideWeightedRoundRobin` LB Policy. (#35905)
  opentelemetrytracer: avoid exporting when there are no spans (#36313)
  bazel/rbe: Fix auth for arm job (#36315)
  mac/ci: Remove debugging (#36302)
  Remove some Undefined Behavior (#36288)
  listener: more exception cleanup (#36198)
  Adding new code owner for ext_proc filter (#36307)
  bazel/ci: Mark builds with Engflow pool requirements (#36300)
  bazel/ci: Use workspace rather than action envs for fake scm revision (#36298)
  arm/ci: Fix RBE authentication issue (#36304)
  test: disabling flake (#36287)

.azure-pipelines/ci.yml

@@ -214,11 +214,10 @@ steps:
     # Any PR or CI run in envoy-presubmit uses the fake SCM hash
     if [[ "${{ variables['Build.Reason'] }}" == "PullRequest" || "${{ variables['Build.DefinitionName'] }}" == 'envoy-presubmit' ]]; then
         # sha1sum of `ENVOY_PULL_REQUEST`
-        BAZEL_FAKE_SCM_REVISION=e3b4a6e9570da15ac1caffdded17a8bebdc7dfc9
+        echo "e3b4a6e9570da15ac1caffdded17a8bebdc7dfc9" > .BAZEL_FAKE_SCM_REVISION
     fi
     echo "##vso[task.setvariable variable=BAZEL_BUILD_EXTRA_OPTIONS]${BAZEL_BUILD_EXTRA_OPTIONS}"
     echo "##vso[task.setvariable variable=BAZEL_EXTRA_TEST_OPTIONS]${BAZEL_EXTRA_TEST_OPTIONS}"
-    echo "##vso[task.setvariable variable=BAZEL_FAKE_SCM_REVISION]${BAZEL_FAKE_SCM_REVISION}"
     echo "##vso[task.setvariable variable=BAZEL_STARTUP_EXTRA_OPTIONS]${{ parameters.bazelStartupExtraOptions }}"
     echo "##vso[task.setvariable variable=CI_TARGET_BRANCH]${CI_TARGET_BRANCH}"
     echo "##vso[task.setvariable variable=ENVOY_DOCKER_BUILD_DIR]$(Build.StagingDirectory)"

.bazelrc

@@ -43,9 +43,6 @@ build:windows --action_env=PATH --host_action_env=PATH
 # Requires setting `BAZEL_VOLATILE_DIRTY` in the env.
 build --action_env=BAZEL_VOLATILE_DIRTY --host_action_env=BAZEL_VOLATILE_DIRTY
 
-# Prevent stamped caches from busting (eg in PRs)
-# Requires setting `BAZEL_FAKE_SCM_REVISION` in the env.
-build --action_env=BAZEL_FAKE_SCM_REVISION --host_action_env=BAZEL_FAKE_SCM_REVISION
 build --test_summary=terse
 
 build:docs-ci --action_env=DOCS_RST_CHECK=1 --host_action_env=DOCS_RST_CHECK=1

.github/workflows/_publish_build.yml

@@ -67,6 +67,7 @@ jobs:
           arch: arm64
           bazel-extra: >-
             --config=cache-envoy-engflow
+            --config=common-envoy-engflow
             --config=bes-envoy-engflow
           rbe: false
           runs-on: envoy-arm64-medium
@@ -85,6 +86,7 @@ jobs:
     with:
       bazel-extra: >-
         --config=cache-envoy-engflow
+        --config=common-envoy-engflow
         --config=bes-envoy-engflow
       downloads: |
         release.${{ matrix.arch }}: release/${{ matrix.arch }}/bin/

.github/workflows/_publish_verify.yml

@@ -131,5 +131,6 @@ jobs:
           arch: arm64
           bazel-extra: >-
             --config=cache-envoy-engflow
+            --config=common-envoy-engflow
             --config=bes-envoy-engflow
           runs-on: envoy-arm64-small

.github/workflows/_run.yml

@@ -250,6 +250,11 @@ jobs:
         passphrase-path: "${{ runner.temp }}/gpg-passphrase"
         configured-passphrase-path: /build/gpg-passphrase
 
+    - run: |
+        echo "e3b4a6e9570da15ac1caffdded17a8bebdc7dfc9" > .BAZEL_FAKE_SCM_REVISION
+      if: >-
+        ${{ fromJSON(inputs.request).request.pr == '' }}
+
     - uses: envoyproxy/toolshed/gh-actions/github/[email protected]
       name: Run CI ${{ inputs.command }} ${{ inputs.target }}
       with:
@@ -290,7 +295,6 @@ jobs:
           --config=remote-ci
           ${{ inputs.bazel-extra }}
           ${{ inputs.rbe == true && format('--jobs={0}', inputs.bazel-rbe-jobs) || '' }}
-        BAZEL_FAKE_SCM_REVISION: ${{ github.event_name == 'pull_request' && 'e3b4a6e9570da15ac1caffdded17a8bebdc7dfc9' || '' }}
         CI_BRANCH: >-
           ${{ inputs.trusted
               && format('refs/heads/{0}', fromJSON(inputs.request).request.target-branch)

CODEOWNERS

@@ -29,7 +29,7 @@ extensions/filters/common/original_src @klarose @mattklein123
 # cdn_loop extension
 /*/extensions/filters/http/cdn_loop @justin-mp @penguingao @alyssawilk
 # external processing filter
-/*/extensions/filters/http/ext_proc @gbrail @stevenzzzz @tyxia @mattklein123 @yanavlasov
+/*/extensions/filters/http/ext_proc @gbrail @stevenzzzz @tyxia @mattklein123 @yanavlasov @yanjunxiang-google
 /*/extensions/filters/common/mutation_rules @gbrail @tyxia @mattklein123 @yanavlasov
 # jwt_authn http filter extension
 /*/extensions/filters/http/jwt_authn @taoxuy @lizan @tyxia @yanavlasov
@@ -329,6 +329,7 @@ extensions/filters/http/oauth2 @derekargueta @mattklein123
 /*/extensions/load_balancing_policies/maglev @wbpcode @nezdolik
 /*/extensions/load_balancing_policies/subset @wbpcode @zuercher @nezdolik
 /*/extensions/load_balancing_policies/cluster_provided @wbpcode @zuercher
+/*/extensions/load_balancing_policies/client_side_weighted_round_robin @wbpcode @adisuissa @efimki
 # Early header mutation
 /*/extensions/http/early_header_mutation/header_mutation @wbpcode @tyxia
 # Network matching extensions

api/BUILD

@@ -276,6 +276,7 @@ proto_library(
         "//envoy/extensions/internal_redirect/previous_routes/v3:pkg",
         "//envoy/extensions/internal_redirect/safe_cross_scheme/v3:pkg",
         "//envoy/extensions/key_value/file_based/v3:pkg",
+        "//envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3:pkg",
         "//envoy/extensions/load_balancing_policies/cluster_provided/v3:pkg",
         "//envoy/extensions/load_balancing_policies/common/v3:pkg",
         "//envoy/extensions/load_balancing_policies/least_request/v3:pkg",

api/envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.proto

@@ -15,7 +15,7 @@ option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/loa
 option (udpa.annotations.file_status).package_version_status = ACTIVE;
 
 // [#protodoc-title: Client-Side Weighted Round Robin Load Balancing Policy]
-// [#not-implemented-hide:]
+// [#extension: envoy.load_balancing_policies.client_side_weighted_round_robin]
 
 // Configuration for the client_side_weighted_round_robin LB policy.
 //

bazel/get_workspace_status

@@ -29,7 +29,8 @@ then
     exit 0
 fi
 
-if [[ -n "$BAZEL_FAKE_SCM_REVISION" ]]; then
+if [[ -e ".BAZEL_FAKE_SCM_REVISION" ]]; then
+    BAZEL_FAKE_SCM_REVISION="$(cat .BAZEL_FAKE_SCM_REVISION)"
     echo "BUILD_SCM_REVISION $BAZEL_FAKE_SCM_REVISION"
     echo "ENVOY_BUILD_SCM_REVISION $BAZEL_FAKE_SCM_REVISION"
     echo "STABLE_BUILD_SCM_REVISION $BAZEL_FAKE_SCM_REVISION"

changelogs/current.yaml

@@ -189,6 +189,9 @@ bug_fixes:
   change: |
     Set token cookies in response regardless of :ref:`forward_bearer_token
     <envoy_v3_api_field_extensions.filters.http.oauth2.v3.OAuth2Config.forward_bearer_token>` config option.
+- area: tracing
+  change: |
+    Fixed a bug where the OpenTelemetry tracer exports the OTLP request even when no spans are present.
 
 removed_config_or_runtime:
 # *Normally occurs at the end of the* :ref:`deprecation period <deprecated>`
@@ -426,5 +429,10 @@ new_features:
     Added allow list
     :ref:`allowed_override_modes <envoy_v3_api_field_extensions.filters.http.ext_proc.v3.ExternalProcessor.allowed_override_modes>`
     for :ref:`mode_override <envoy_v3_api_field_service.ext_proc.v3.ProcessingResponse.mode_override>`.
+- area: load_balancing
+  change: |
+    WIP: Added implementation of :ref:`client_side_weighted_round_robin
+    <envoy_v3_api_msg_extensions.load_balancing_policies.client_side_weighted_round_robin.v3.ClientSideWeightedRoundRobin>`
+    load balancing policy that uses ``OrcaLoadReport`` provided by the upstream host to calculate host load balancing weight.
 
 deprecated:

ci/Dockerfile-envoy

@@ -59,7 +59,7 @@ COPY --chown=0:0 --chmod=755 \
 
 
 # STAGE: envoy-distroless
-FROM gcr.io/distroless/base-nossl-debian12:nonroot@sha256:4cc93c5b247e24470905bf3cdf8285aeac176bb0e7c62ee2b748a95c0c4123b5 AS envoy-distroless
+FROM gcr.io/distroless/base-nossl-debian12:nonroot@sha256:e130c09889f3b6c05dacd52d2612c30811e04eefe3280a6659037cfdd018de6c AS envoy-distroless
 EXPOSE 10000
 ENTRYPOINT ["/usr/local/bin/envoy"]
 CMD ["-c", "/etc/envoy/envoy.yaml"]

ci/mac_ci_steps.sh

@@ -17,8 +17,6 @@ BAZEL_BUILD_OPTIONS=(
     "${BAZEL_BUILD_EXTRA_OPTIONS[@]}"
     "${BAZEL_EXTRA_TEST_OPTIONS[@]}")
 
-echo "RUN MAC: ${BAZEL_BUILD_OPTIONS[*]}"
-
 NCPU=$(sysctl -n hw.ncpu)
 if [[ $NCPU -gt 0 ]]; then
     echo "limiting build to $NCPU jobs, based on CPU count"

ci/run_envoy_docker.sh

@@ -131,7 +131,6 @@ docker run --rm \
        -e BAZEL_STARTUP_OPTIONS \
        -e BAZEL_BUILD_EXTRA_OPTIONS \
        -e BAZEL_EXTRA_TEST_OPTIONS \
-       -e BAZEL_FAKE_SCM_REVISION \
        -e BAZEL_REMOTE_CACHE \
        -e BAZEL_STARTUP_EXTRA_OPTIONS \
        -e CI_BRANCH \

contrib/checksum/filters/http/test/BUILD

@@ -11,6 +11,7 @@ envoy_contrib_package()
 envoy_cc_test(
     name = "checksum_filter_test",
     srcs = ["checksum_filter_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/checksum/filters/http/source:checksum_filter_lib",
         "//source/common/buffer:buffer_lib",
@@ -25,6 +26,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/checksum/filters/http/source:config",
         "//test/mocks/server:factory_context_mocks",

contrib/client_ssl_auth/filters/network/test/BUILD

@@ -12,6 +12,7 @@ envoy_cc_test(
     name = "client_ssl_auth_test",
     srcs = ["client_ssl_auth_test.cc"],
     data = glob(["test_data/**"]),
+    rbe_pool = "2core",
     deps = [
         "//contrib/client_ssl_auth/filters/network/source:client_ssl_auth",
         "//test/mocks/network:network_mocks",
@@ -28,6 +29,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/client_ssl_auth/filters/network/source:config",
         "//source/common/protobuf:utility_lib",

contrib/config/test/BUILD

@@ -39,6 +39,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     deps = [
         ":invalid_proto_kv_store_config_proto_cc_proto",
         "//contrib/config/source:kv_store_xds_delegate",

contrib/cryptomb/private_key_providers/test/BUILD

@@ -50,6 +50,7 @@ envoy_cc_test(
     data = [
         "//contrib/cryptomb/private_key_providers/test/test_data:certs",
     ],
+    rbe_pool = "2core",
     deps = [
         ":test_fake_factory",
         "//source/common/common:random_generator_lib",

contrib/dlb/test/BUILD

@@ -14,6 +14,7 @@ envoy_cc_test(
         "//bazel:linux_x86_64": ["config_test.cc"],
         "//conditions:default": [],
     }),
+    rbe_pool = "2core",
     deps = [
         "//contrib/dlb/source:connection_balancer",
         "//source/common/protobuf:utility_lib",

contrib/dynamo/filters/http/test/BUILD

@@ -47,6 +47,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/dynamo/filters/http/source:config",
         "//test/mocks/server:factory_context_mocks",

contrib/exe/BUILD

@@ -30,6 +30,7 @@ SELECTED_CONTRIB_EXTENSIONS = select({
 
 envoy_cc_binary(
     name = "envoy-static",
+    rbe_pool = "2core",
     stamped = True,
     visibility = ["//visibility:public"],
     deps = ["//source/exe:envoy_main_entry_lib"] + SELECTED_CONTRIB_EXTENSIONS,
@@ -47,6 +48,7 @@ envoy_cc_test(
         "DISABLE_TEST_MERGE": "true",
         "GODEBUG": "cgocheck=0",
     },
+    rbe_pool = "2core",
     deps = [
         "//test/config_test:example_configs_test_lib",
     ] + SELECTED_CONTRIB_EXTENSIONS,

contrib/generic_proxy/filters/network/test/codecs/kafka/BUILD

@@ -13,6 +13,7 @@ envoy_cc_test(
     srcs = [
         "config_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//contrib/generic_proxy/filters/network/source/codecs/kafka:config",
         "//test/extensions/filters/network/generic_proxy/mocks:codec_mocks",

contrib/golang/filters/http/test/BUILD

@@ -16,6 +16,7 @@ envoy_cc_test(
     data = [
         "//contrib/golang/filters/http/test/test_data/passthrough:filter.so",
     ],
+    rbe_pool = "2core",
     deps = [
         "//contrib/golang/filters/http/source:config",
         "//test/mocks/server:factory_context_mocks",
@@ -30,6 +31,7 @@ envoy_cc_test(
         "//contrib/golang/filters/http/test/test_data/passthrough:filter.so",
         "//contrib/golang/filters/http/test/test_data/routeconfig:filter.so",
     ],
+    rbe_pool = "2core",
     deps = [
         "//contrib/golang/filters/http/source:golang_filter_lib",
         "//source/common/stream_info:stream_info_lib",
@@ -60,6 +62,7 @@ envoy_cc_test(
         "//contrib/golang/filters/http/test/test_data/property:filter.so",
         "//contrib/golang/filters/http/test/test_data/routeconfig:filter.so",
     ],
+    rbe_pool = "2core",
     deps = [
         "//contrib/golang/filters/http/source:config",
         "//source/exe:main_common_lib",
@@ -85,6 +88,7 @@ envoy_cc_fuzz_test(
     name = "golang_filter_fuzz_test",
     srcs = ["golang_filter_fuzz_test.cc"],
     corpus = "golang_filter_corpus",
+    rbe_pool = "2core",
     deps = [
         ":golang_filter_fuzz_proto_cc_proto",
         "//contrib/golang/common/dso/test:dso_mocks",
@@ -106,6 +110,7 @@ envoy_cc_test(
     data = [
         "//contrib/golang/filters/http/test/test_data/websocket:filter.so",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],

contrib/golang/filters/network/test/BUILD

@@ -14,6 +14,7 @@ envoy_cc_test(
     data = [
         "//contrib/golang/filters/network/test/test_data:filter.so",
     ],
+    rbe_pool = "2core",
     deps = [
         "//contrib/golang/filters/network/source:config",
         "//test/mocks/server:factory_context_mocks",
@@ -25,6 +26,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "filter_test",
     srcs = ["filter_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/golang/common/dso/test:dso_mocks",
         "//contrib/golang/filters/network/source:golang",
@@ -43,6 +45,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "upstream_test",
     srcs = ["upstream_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/golang/common/dso/test:dso_mocks",
         "//contrib/golang/filters/network/source:upstream",

contrib/golang/router/cluster_specifier/test/BUILD

@@ -15,6 +15,7 @@ envoy_cc_test(
         "//contrib/golang/router/cluster_specifier/test/test_data/simple:plugin.so",
     ],
     env = {"GODEBUG": "cgocheck=0"},
+    rbe_pool = "2core",
     deps = [
         "//contrib/golang/router/cluster_specifier/source:config",
         "//source/exe:main_common_lib",

contrib/hyperscan/matching/input_matchers/test/BUILD

@@ -12,6 +12,7 @@ envoy_contrib_package()
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/hyperscan/matching/input_matchers/source:config",
         "//test/mocks/server:factory_context_mocks",

contrib/hyperscan/regex_engines/test/BUILD

@@ -11,6 +11,7 @@ envoy_contrib_package()
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/hyperscan/regex_engines/source:config",
         "//test/mocks/server:factory_context_mocks",
@@ -31,6 +32,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "integration_test",
     srcs = ["integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/hyperscan/regex_engines/source:config",
         "//test/integration:integration_lib",

contrib/kafka/filters/network/source/BUILD

@@ -109,6 +109,7 @@ envoy_cc_library(
         "external/responses.h",
         "kafka_response_parser.h",
     ],
+    rbe_pool = "2core",
     deps = [
         ":kafka_response_lib",
         ":parser_lib",

contrib/kafka/filters/network/test/broker/BUILD

@@ -12,6 +12,7 @@ envoy_contrib_package()
 envoy_cc_test(
     name = "config_unit_test",
     srcs = ["config_unit_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/kafka/filters/network/source/broker:config_lib",
         "//test/mocks/server:factory_context_mocks",
@@ -21,6 +22,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "filter_unit_test",
     srcs = ["filter_unit_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/kafka/filters/network/source/broker:filter_lib",
         "//envoy/event:timer_interface",

contrib/kafka/filters/network/test/mesh/BUILD

@@ -12,6 +12,7 @@ envoy_contrib_package()
 envoy_cc_test(
     name = "config_unit_test",
     srcs = ["config_unit_test.cc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//contrib/kafka/filters/network/source/mesh:config_lib",
@@ -23,6 +24,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "filter_unit_test",
     srcs = ["filter_unit_test.cc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//contrib/kafka/filters/network/source/mesh:filter_lib",

contrib/language/filters/http/test/BUILD

@@ -11,6 +11,7 @@ envoy_contrib_package()
 envoy_cc_test(
     name = "language_config_test",
     srcs = ["language_config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/language/filters/http/source:config_lib",
         "//test/mocks/server:factory_context_mocks",
@@ -22,6 +23,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "language_integration_test",
     srcs = ["language_integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/language/filters/http/source:config_lib",
         "//test/integration:http_protocol_integration_lib",