From 58a797c0e1b96468d9a78cc8a4da6cb35d62fdaa Mon Sep 17 00:00:00 2001
From: Lizan Zhou <lizan@tetrate.io>
Date: Mon, 12 Oct 2020 07:42:40 -0700
Subject: [PATCH 01/11] ci: use azp to generate docs (#13481)

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
---
 .azure-pipelines/pipelines.yml | 43 ++++++++++++++++++++++++++++++++++
 .circleci/config.yml           | 17 --------------
 ci/run_envoy_docker.sh         | 43 +++++++++++++++++++++++++++-------
 docs/build.sh                  | 17 +++++++++-----
 docs/publish.sh                | 37 +++++++++++++++--------------
 5 files changed, 107 insertions(+), 50 deletions(-)

diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index 582d2e2216996..714e5de13ebf6 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -37,6 +37,49 @@ jobs:
           artifactName: format
         condition: failed()
 
+  - job: docs
+    dependsOn: [] # this removes the implicit dependency on previous stage and causes this to run in parallel.
+    pool:
+      vmImage: "ubuntu-18.04"
+    steps:
+      - task: Cache@2
+        inputs:
+          key: "docs | ./WORKSPACE | **/*.bzl"
+          path: $(Build.StagingDirectory)/repository_cache
+        continueOnError: true
+
+      - script: ci/run_envoy_docker.sh 'ci/do_ci.sh docs'
+        workingDirectory: $(Build.SourcesDirectory)
+        env:
+          ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+          BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+          BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+        displayName: "Generate docs"
+
+      - script: ci/run_envoy_docker.sh 'ci/upload_gcs_artifact.sh /source/generated/docs docs'
+        displayName: "Upload Docs to GCS"
+        env:
+          ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+          GCS_ARTIFACT_BUCKET: $(GcsArtifactBucket)
+
+      - task: InstallSSHKey@0
+        inputs:
+          hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
+          sshPublicKey: "$(DocsPublicKey)"
+          sshPassphrase: "$(SshDeployKeyPassphrase)"
+          sshKeySecureFile: "$(DocsPrivateKey)"
+        condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'), eq(variables['PostSubmit'], true))
+
+      - script: docs/publish.sh
+        displayName: "Publish to GitHub"
+        workingDirectory: $(Build.SourcesDirectory)
+        env:
+          AZP_BRANCH: $(Build.SourceBranch)
+          AZP_SHA1: $(Build.SourceVersion)
+        condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'), eq(variables['PostSubmit'], true))
+
   - job: release
     displayName: "Linux-x64 release"
     dependsOn: ["format"]
diff --git a/.circleci/config.yml b/.circleci/config.yml
index 3bdaab466ba6d..35cd314b68da5 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -45,19 +45,6 @@ jobs:
              - "f6:f9:df:90:9c:4b:5f:9c:f4:69:fd:42:94:ff:88:24"
        - run: ci/filter_example_mirror.sh
 
-   docs:
-     executor: ubuntu-build
-     steps:
-       - run: rm -rf /home/circleci/project/.git # CircleCI git caching is likely broken
-       - checkout
-       - run: ci/do_circle_ci.sh docs
-       - add_ssh_keys:
-           fingerprints:
-             - "44:c7:a1:9e:f4:9e:a5:33:11:f1:0e:79:e1:55:c9:04"
-       - run: docs/publish.sh
-       - store_artifacts:
-           path: generated/docs
-
 workflows:
   version: 2
   all:
@@ -65,7 +52,3 @@ workflows:
       - api
       - go_control_plane_mirror
       - filter_example_mirror
-      - docs:
-          filters:
-            tags:
-              only: /^v.*/
diff --git a/ci/run_envoy_docker.sh b/ci/run_envoy_docker.sh
index 886a2347d3787..c95e2502b3489 100755
--- a/ci/run_envoy_docker.sh
+++ b/ci/run_envoy_docker.sh
@@ -23,12 +23,37 @@ export ENVOY_BUILD_IMAGE="${IMAGE_NAME}:${IMAGE_ID}"
 
 mkdir -p "${ENVOY_DOCKER_BUILD_DIR}"
 # Since we specify an explicit hash, docker-run will pull from the remote repo if missing.
-docker run --rm ${ENVOY_DOCKER_OPTIONS} -e HTTP_PROXY=${http_proxy} -e HTTPS_PROXY=${https_proxy} -e NO_PROXY=${no_proxy} \
-  -u "${USER}":"${USER_GROUP}" -v "${ENVOY_DOCKER_BUILD_DIR}":/build -v /var/run/docker.sock:/var/run/docker.sock  \
-  -e BAZEL_BUILD_EXTRA_OPTIONS -e BAZEL_EXTRA_TEST_OPTIONS -e BAZEL_REMOTE_CACHE -e ENVOY_STDLIB -e BUILD_REASON \
-  -e BAZEL_REMOTE_INSTANCE -e GCP_SERVICE_ACCOUNT_KEY -e NUM_CPUS -e ENVOY_RBE -e FUZZIT_API_KEY -e ENVOY_BUILD_IMAGE \
-  -e ENVOY_SRCDIR -e ENVOY_BUILD_TARGET -e SYSTEM_PULLREQUEST_TARGETBRANCH -e SYSTEM_PULLREQUEST_PULLREQUESTNUMBER \
-  -e GCS_ARTIFACT_BUCKET -e BUILD_SOURCEBRANCHNAME -e BAZELISK_BASE_URL \
-  -v "$PWD":/source --cap-add SYS_PTRACE --cap-add NET_RAW --cap-add NET_ADMIN "${ENVOY_BUILD_IMAGE}" \
-  /bin/bash -lc "groupadd --gid $(id -g) -f envoygroup && useradd -o --uid $(id -u) --gid $(id -g) --no-create-home \
-  --home-dir /build envoybuild && usermod -a -G pcap envoybuild && sudo -EHs -u envoybuild bash -c \"cd /source && $*\""
+docker run --rm \
+       ${ENVOY_DOCKER_OPTIONS} \
+       -v "${ENVOY_DOCKER_BUILD_DIR}":"${BUILD_DIR_MOUNT_DEST}" \
+       -v "${SOURCE_DIR}":"${SOURCE_DIR_MOUNT_DEST}" \
+       -e AZP_BRANCH \
+       -e HTTP_PROXY \
+       -e HTTPS_PROXY \
+       -e NO_PROXY \
+       -e BAZEL_STARTUP_OPTIONS \
+       -e BAZEL_BUILD_EXTRA_OPTIONS \
+       -e BAZEL_EXTRA_TEST_OPTIONS \
+       -e BAZEL_REMOTE_CACHE \
+       -e ENVOY_STDLIB \
+       -e BUILD_REASON \
+       -e BAZEL_REMOTE_INSTANCE \
+       -e GCP_SERVICE_ACCOUNT_KEY \
+       -e NUM_CPUS \
+       -e ENVOY_RBE \
+       -e FUZZIT_API_KEY \
+       -e ENVOY_BUILD_IMAGE \
+       -e ENVOY_SRCDIR \
+       -e ENVOY_BUILD_TARGET \
+       -e SYSTEM_PULLREQUEST_TARGETBRANCH \
+       -e SYSTEM_PULLREQUEST_PULLREQUESTNUMBER \
+       -e GCS_ARTIFACT_BUCKET \
+       -e BUILD_SOURCEBRANCHNAME \
+       -e BAZELISK_BASE_URL \
+       -e ENVOY_BUILD_ARCH \
+       -e SLACK_TOKEN \
+       -e BUILD_URI\
+       -e REPO_URI \
+       "${ENVOY_BUILD_IMAGE}" \
+       /bin/bash -lc "groupadd --gid $(id -g) -f envoygroup && useradd -o --uid $(id -u) --gid $(id -g) --no-create-home \
+       --home-dir /build envoybuild && usermod -a -G pcap envoybuild && sudo -EHs -u envoybuild bash -c \"cd /source && $*\""
diff --git a/docs/build.sh b/docs/build.sh
index bc0c302414a16..ab9e4fcad5620 100755
--- a/docs/build.sh
+++ b/docs/build.sh
@@ -4,15 +4,20 @@
 
 set -e
 
+RELEASE_TAG_REGEX="^refs/tags/v.*"
+
+if [[ "${AZP_BRANCH}" =~ ${RELEASE_TAG_REGEX} ]]; then
+  DOCS_TAG="${AZP_BRANCH/refs\/tags\//}"
+fi
+
 # We need to set ENVOY_DOCS_VERSION_STRING and ENVOY_DOCS_RELEASE_LEVEL for Sphinx.
 # We also validate that the tag and version match at this point if needed.
-if [ -n "$CIRCLE_TAG" ]
-then
+if [[ -n "${DOCS_TAG}" ]]; then
   # Check the git tag matches the version number in the VERSION file.
   VERSION_NUMBER=$(cat VERSION)
-  if [ "v${VERSION_NUMBER}" != "${CIRCLE_TAG}" ]; then
+  if [[ "v${VERSION_NUMBER}" != "${DOCS_TAG}" ]]; then
     echo "Given git tag does not match the VERSION file content:"
-    echo "${CIRCLE_TAG} vs $(cat VERSION)"
+    echo "${DOCS_TAG} vs $(cat VERSION)"
     exit 1
   fi
   # Check the version_history.rst contains current release version.
@@ -20,9 +25,9 @@ then
     || (echo "Git tag not found in version_history/current.rst" && exit 1)
 
   # Now that we know there is a match, we can use the tag.
-  export ENVOY_DOCS_VERSION_STRING="tag-$CIRCLE_TAG"
+  export ENVOY_DOCS_VERSION_STRING="tag-${DOCS_TAG}"
   export ENVOY_DOCS_RELEASE_LEVEL=tagged
-  export ENVOY_BLOB_SHA="$CIRCLE_TAG"
+  export ENVOY_BLOB_SHA="${DOCS_TAG}"
 else
   BUILD_SHA=$(git rev-parse HEAD)
   VERSION_NUM=$(cat VERSION)
diff --git a/docs/publish.sh b/docs/publish.sh
index b146c42994cbb..c56e9bb31066f 100755
--- a/docs/publish.sh
+++ b/docs/publish.sh
@@ -10,35 +10,36 @@
 set -e
 
 DOCS_DIR=generated/docs
-CHECKOUT_DIR=../envoy-docs
-BUILD_SHA=`git rev-parse HEAD`
-
-if [ -n "$CIRCLE_TAG" ]
-then
-  PUBLISH_DIR="$CHECKOUT_DIR"/docs/envoy/"$CIRCLE_TAG"
-elif [ -z "$CIRCLE_PULL_REQUEST" ] && [ "$CIRCLE_BRANCH" == "master" ]
-then
-  PUBLISH_DIR="$CHECKOUT_DIR"/docs/envoy/latest
+CHECKOUT_DIR=envoy-docs
+BUILD_SHA=$(git rev-parse HEAD)
+
+MAIN_BRANCH="refs/heads/master"
+RELEASE_TAG_REGEX="^refs/tags/v.*"
+
+if [[ "${AZP_BRANCH}" =~ ${RELEASE_TAG_REGEX} ]]; then
+  PUBLISH_DIR="${CHECKOUT_DIR}"/docs/envoy/"${AZP_BRANCH/refs\/tags\//}"
+elif [[ "$AZP_BRANCH" == "${MAIN_BRANCH}" ]]; then
+  PUBLISH_DIR="${CHECKOUT_DIR}"/docs/envoy/latest
 else
   echo "Ignoring docs push"
   exit 0
 fi
 
+DOCS_MAIN_BRANCH="master"
+
 echo 'cloning'
-git clone git@github.com:envoyproxy/envoyproxy.github.io "$CHECKOUT_DIR"
+git clone git@github.com:envoyproxy/envoyproxy.github.io "${CHECKOUT_DIR}" -b "${DOCS_MAIN_BRANCH}" --depth 1
 
-git -C "$CHECKOUT_DIR" fetch
-git -C "$CHECKOUT_DIR" checkout -B master origin/master
 rm -fr "$PUBLISH_DIR"
 mkdir -p "$PUBLISH_DIR"
 cp -r "$DOCS_DIR"/* "$PUBLISH_DIR"
-cd "$CHECKOUT_DIR"
+cd "${CHECKOUT_DIR}"
 
-git config user.name "envoy-docs(travis)"
+git config user.name "envoy-docs(Azure Pipelines)"
 git config user.email envoy-docs@users.noreply.github.com
-echo 'add'
+
+set -x
+
 git add .
-echo 'commit'
 git commit -m "docs envoy@$BUILD_SHA"
-echo 'push'
-git push origin master
+git push origin "${DOCS_MAIN_BRANCH}"

From d8c9ed27f1971d57bdd8255587da8cf8bcc10b8e Mon Sep 17 00:00:00 2001
From: Lizan Zhou <lizan@tetrate.io>
Date: Mon, 12 Oct 2020 18:24:20 -0700
Subject: [PATCH 02/11] ci use azp to sync filter example (#13501)

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
---
 .azure-pipelines/pipelines.yml | 18 ++++++++++++++++++
 .circleci/config.yml           | 11 -----------
 ci/filter_example_mirror.sh    | 13 ++++++-------
 3 files changed, 24 insertions(+), 18 deletions(-)

diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index 714e5de13ebf6..b724150f5548c 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -106,6 +106,24 @@ jobs:
           rbe: false
           artifactSuffix: ".arm64"
 
+  - job: filter_example
+    displayName: "filter-example sync"
+    dependsOn: []
+    condition: and(succeeded(), eq(variables['PostSubmit'], true))
+    steps:
+      - task: InstallSSHKey@0
+        inputs:
+          hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
+          sshPublicKey: "$(FilterExamplePublicKey)"
+          sshPassphrase: "$(SshDeployKeyPassphrase)"
+          sshKeySecureFile: "$(FilterExamplePrivateKey)"
+
+      - bash: ci/filter_example_mirror.sh
+        displayName: "Sync envoy-filter-example"
+        workingDirectory: $(Build.SourcesDirectory)
+        env:
+          AZP_BRANCH: $(Build.SourceBranch)
+
   - job: bazel
     displayName: "Linux-x64"
     dependsOn: ["release"]
diff --git a/.circleci/config.yml b/.circleci/config.yml
index 35cd314b68da5..4ca2f4fe62dd2 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -35,20 +35,9 @@ jobs:
              - "9d:3b:fe:7c:09:3b:ce:a9:6a:de:de:41:fb:6b:52:62"
        - run: ci/go_mirror.sh
 
-   filter_example_mirror:
-     executor: ubuntu-build
-     steps:
-       - run: rm -rf /home/circleci/project/.git # CircleCI git caching is likely broken
-       - checkout
-       - add_ssh_keys:
-           fingerprints:
-             - "f6:f9:df:90:9c:4b:5f:9c:f4:69:fd:42:94:ff:88:24"
-       - run: ci/filter_example_mirror.sh
-
 workflows:
   version: 2
   all:
     jobs:
       - api
       - go_control_plane_mirror
-      - filter_example_mirror
diff --git a/ci/filter_example_mirror.sh b/ci/filter_example_mirror.sh
index 1d6d5ae05b238..8602b1677e4b9 100755
--- a/ci/filter_example_mirror.sh
+++ b/ci/filter_example_mirror.sh
@@ -4,16 +4,15 @@ set -e
 
 ENVOY_SRCDIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/../" && pwd)
 CHECKOUT_DIR=../envoy-filter-example
+MAIN_BRANCH="refs/heads/master"
+FILTER_EXAMPLE_MAIN_BRANCH="master"
 
-if [ -z "$CIRCLE_PULL_REQUEST" ] && [ "$CIRCLE_BRANCH" == "master" ]
-then
+if [[ "${AZP_BRANCH}" == "${MAIN_BRANCH}" ]]; then
   echo "Cloning..."
-  git clone git@github.com:envoyproxy/envoy-filter-example "$CHECKOUT_DIR"
+  git clone git@github.com:envoyproxy/envoy-filter-example "$CHECKOUT_DIR" -b "${FILTER_EXAMPLE_MAIN_BRANCH}"
 
-  git -C "$CHECKOUT_DIR" config user.name "envoy-filter-example(CircleCI)"
+  git -C "$CHECKOUT_DIR" config user.name "envoy-filter-example(Azure Pipelines)"
   git -C "$CHECKOUT_DIR" config user.email envoy-filter-example@users.noreply.github.com
-  git -C "$CHECKOUT_DIR" fetch
-  git -C "$CHECKOUT_DIR" checkout -B master origin/master
 
   echo "Updating Submodule..."
   # Update submodule to latest Envoy SHA
@@ -26,6 +25,6 @@ then
 
   echo "Committing, and Pushing..."
   git -C "$CHECKOUT_DIR" commit -a -m "Update Envoy submodule to $ENVOY_SHA"
-  git -C "$CHECKOUT_DIR" push origin master
+  git -C "$CHECKOUT_DIR" push origin "${FILTER_EXAMPLE_MAIN_BRANCH}"
   echo "Done"
 fi

From f1b758089e0472c492ee0ebf09da6a77aa2f2706 Mon Sep 17 00:00:00 2001
From: Lizan Zhou <lizan@tetrate.io>
Date: Wed, 14 Oct 2020 08:16:42 -0700
Subject: [PATCH 03/11] ci: use azp for api and go-control-plane sync (#13550)

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
---
 .azure-pipelines/pipelines.yml    | 48 +++++++++++++++++++++++++++++++
 .circleci/config.yml              | 43 ---------------------------
 ci/api_mirror.sh                  | 13 ++++-----
 ci/do_ci.sh                       |  9 +++++-
 ci/go_mirror.sh                   | 10 +++++--
 ci/run_envoy_docker.sh            |  1 +
 tools/api/generate_go_protobuf.py | 12 ++++----
 tools/api_boost/api_boost.py      |  1 -
 8 files changed, 77 insertions(+), 60 deletions(-)
 delete mode 100644 .circleci/config.yml

diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index b724150f5548c..48eb0e1879fe2 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -109,6 +109,8 @@ jobs:
   - job: filter_example
     displayName: "filter-example sync"
     dependsOn: []
+    pool:
+      vmImage: "ubuntu-18.04"
     condition: and(succeeded(), eq(variables['PostSubmit'], true))
     steps:
       - task: InstallSSHKey@0
@@ -124,6 +126,50 @@ jobs:
         env:
           AZP_BRANCH: $(Build.SourceBranch)
 
+  - job: api
+    displayName: "data-plane-api sync"
+    dependsOn: []
+    condition: and(succeeded(), eq(variables['PostSubmit'], true))
+    pool:
+      vmImage: "ubuntu-18.04"
+    steps:
+      - task: InstallSSHKey@0
+        inputs:
+          hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
+          sshPublicKey: "$(DataPlaneApiPublicKey)"
+          sshPassphrase: "$(SshDeployKeyPassphrase)"
+          sshKeySecureFile: "$(DataPlaneApiPrivateKey)"
+
+      - bash: ci/api_mirror.sh
+        displayName: "Sync data-plane-api"
+        workingDirectory: $(Build.SourcesDirectory)
+        env:
+          AZP_BRANCH: $(Build.SourceBranch)
+
+  - job: go_control_plane
+    displayName: "go-control-plane sync"
+    dependsOn: []
+    condition: and(succeeded(), eq(variables['PostSubmit'], true))
+    steps:
+      - task: InstallSSHKey@0
+        inputs:
+          hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
+          sshPublicKey: "$(GoControlPlanePublicKey)"
+          sshPassphrase: "$(SshDeployKeyPassphrase)"
+          sshKeySecureFile: "$(GoControlPlanePrivateKey)"
+
+      - bash: |
+          cp -a ~/.ssh $(Build.StagingDirectory)/
+          ci/run_envoy_docker.sh 'ci/go_mirror.sh'
+        displayName: "Sync go-control-plane"
+        workingDirectory: $(Build.SourcesDirectory)
+        env:
+          ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+          BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+          BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+          AZP_BRANCH: $(Build.SourceBranch)
+
   - job: bazel
     displayName: "Linux-x64"
     dependsOn: ["release"]
@@ -132,6 +178,8 @@ jobs:
     strategy:
       maxParallel: 3
       matrix:
+        api:
+          CI_TARGET: "bazel.api"
         gcc:
           CI_TARGET: "bazel.gcc"
         clang_tidy:
diff --git a/.circleci/config.yml b/.circleci/config.yml
deleted file mode 100644
index 4ca2f4fe62dd2..0000000000000
--- a/.circleci/config.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-version: 2.1
-
-executors:
-  ubuntu-build:
-    description: "A regular build executor based on ubuntu image"
-    docker:
-      # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/master/toolchains/rbe_toolchains_config.bzl#L8
-      - image: envoyproxy/envoy-build-ubuntu:f21773ab398a879f976936f72c78c9dd3718ca1e
-    resource_class: xlarge
-    working_directory: /source
-
-jobs:
-   api:
-     executor: ubuntu-build
-     steps:
-       - run: rm -rf /home/circleci/project/.git # CircleCI git caching is likely broken
-       - checkout
-       - run: ci/do_circle_ci.sh bazel.api
-       - add_ssh_keys:
-           fingerprints:
-             - "fb:f3:fe:be:1c:b2:ec:b6:25:f9:7b:a6:87:54:02:8c"
-       - run: ci/api_mirror.sh
-       - store_artifacts:
-           path: /build/envoy/generated
-           destination: /
-
-   go_control_plane_mirror:
-     executor: ubuntu-build
-     steps:
-       - run: rm -rf /home/circleci/project/.git # CircleCI git caching is likely broken
-       - checkout
-       - run: ci/do_circle_ci.sh bazel.api
-       - add_ssh_keys:
-           fingerprints:
-             - "9d:3b:fe:7c:09:3b:ce:a9:6a:de:de:41:fb:6b:52:62"
-       - run: ci/go_mirror.sh
-
-workflows:
-  version: 2
-  all:
-    jobs:
-      - api
-      - go_control_plane_mirror
diff --git a/ci/api_mirror.sh b/ci/api_mirror.sh
index 077cdd1d3cfe6..03e8ab85d80cb 100755
--- a/ci/api_mirror.sh
+++ b/ci/api_mirror.sh
@@ -3,16 +3,15 @@
 set -e
 
 CHECKOUT_DIR=../data-plane-api
+MAIN_BRANCH="refs/heads/master"
+API_MAIN_BRANCH="master"
 
-if [ -z "$CIRCLE_PULL_REQUEST" ] && [ "$CIRCLE_BRANCH" == "master" ]
-then
+if [[ "${AZP_BRANCH}" == "${MAIN_BRANCH}" ]]; then
   echo "Cloning..."
-  git clone git@github.com:envoyproxy/data-plane-api "$CHECKOUT_DIR"
+  git clone git@github.com:envoyproxy/data-plane-api "$CHECKOUT_DIR" -b "${API_MAIN_BRANCH}"
 
-  git -C "$CHECKOUT_DIR" config user.name "data-plane-api(CircleCI)"
+  git -C "$CHECKOUT_DIR" config user.name "data-plane-api(Azure Pipelines)"
   git -C "$CHECKOUT_DIR" config user.email data-plane-api@users.noreply.github.com
-  git -C "$CHECKOUT_DIR" fetch
-  git -C "$CHECKOUT_DIR" checkout -B master origin/master
 
   # Determine last envoyproxy/envoy SHA in envoyproxy/data-plane-api
   MIRROR_MSG="Mirrored from https://github.com/envoyproxy/envoy"
@@ -40,6 +39,6 @@ then
   done
 
   echo "Pushing..."
-  git -C "$CHECKOUT_DIR" push origin master
+  git -C "$CHECKOUT_DIR" push origin "${API_MAIN_BRANCH}"
   echo "Done"
 fi
diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index f87e3de67eb5a..eb6a038dc5e80 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -246,9 +246,16 @@ elif [[ "$CI_TARGET" == "bazel.compile_time_options" ]]; then
 
   exit 0
 elif [[ "$CI_TARGET" == "bazel.api" ]]; then
+  # Use libstdc++ because the API booster links to prebuilt libclang*/libLLVM* installed in /opt/llvm/lib,
+  # which is built with libstdc++. Using libstdc++ for whole of the API CI job to avoid unnecessary rebuild.
+  ENVOY_STDLIB="libstdc++"
   setup_clang_toolchain
+  export LLVM_CONFIG="${LLVM_ROOT}"/bin/llvm-config
   echo "Validating API structure..."
   ./tools/api/validate_structure.py
+  echo "Testing API and API Boosting..."
+  bazel_with_collection test "${BAZEL_BUILD_OPTIONS[@]}" -c fastbuild @envoy_api_canonical//test/... @envoy_api_canonical//tools/... \
+    @envoy_api_canonical//tools:tap2pcap_test @envoy_dev//clang_tools/api_booster/...
   echo "Building API..."
   bazel build ${BAZEL_BUILD_OPTIONS} -c fastbuild @envoy_api_canonical//envoy/...
   echo "Testing API..."
@@ -258,7 +265,7 @@ elif [[ "$CI_TARGET" == "bazel.api" ]]; then
   bazel_with_collection test ${BAZEL_BUILD_OPTIONS} -c fastbuild @envoy_dev//clang_tools/api_booster/...
   echo "Testing API boosting (golden C++ tests)..."
   # We use custom BAZEL_BUILD_OPTIONS here; the API booster isn't capable of working with libc++ yet.
-  LLVM_CONFIG="${LLVM_ROOT}"/bin/llvm-config BAZEL_BUILD_OPTIONS="--config=clang" python3.8 ./tools/api_boost/api_boost_test.py
+  BAZEL_BUILD_OPTIONS="${BAZEL_BUILD_OPTIONS[*]}" python3.8 ./tools/api_boost/api_boost_test.py
   exit 0
 elif [[ "$CI_TARGET" == "bazel.coverage" ]]; then
   setup_clang_toolchain
diff --git a/ci/go_mirror.sh b/ci/go_mirror.sh
index 80be4cc0b5321..63f96d0d79697 100755
--- a/ci/go_mirror.sh
+++ b/ci/go_mirror.sh
@@ -2,7 +2,11 @@
 
 set -e
 
-if [ -z "$CIRCLE_PULL_REQUEST" ] && [ "$CIRCLE_BRANCH" == "master" ]
-then
-  tools/api/generate_go_protobuf.py
+MAIN_BRANCH="refs/heads/master"
+
+# shellcheck source=ci/setup_cache.sh
+. "$(dirname "$0")"/setup_cache.sh
+
+if [[ "${AZP_BRANCH}" == "${MAIN_BRANCH}" ]]; then
+  BAZEL_BUILD_OPTIONS="${BAZEL_BUILD_EXTRA_OPTIONS}" tools/api/generate_go_protobuf.py
 fi
diff --git a/ci/run_envoy_docker.sh b/ci/run_envoy_docker.sh
index c95e2502b3489..f61bd2b32a309 100755
--- a/ci/run_envoy_docker.sh
+++ b/ci/run_envoy_docker.sh
@@ -18,6 +18,7 @@ USER_GROUP=root
 
 [[ -t 1 ]] && ENVOY_DOCKER_OPTIONS+=" -it"
 [[ -f .git ]] && [[ ! -d .git ]] && ENVOY_DOCKER_OPTIONS+=" -v $(git rev-parse --git-common-dir):$(git rev-parse --git-common-dir)"
+[[ -n "${SSH_AUTH_SOCK}" ]] && ENVOY_DOCKER_OPTIONS+="-v ${SSH_AUTH_SOCK}:${SSH_AUTH_SOCK} -e SSH_AUTH_SOCK"
 
 export ENVOY_BUILD_IMAGE="${IMAGE_NAME}:${IMAGE_ID}"
 
diff --git a/tools/api/generate_go_protobuf.py b/tools/api/generate_go_protobuf.py
index 620e80bb32c58..126a782b91936 100755
--- a/tools/api/generate_go_protobuf.py
+++ b/tools/api/generate_go_protobuf.py
@@ -4,17 +4,21 @@
 from subprocess import check_call
 import glob
 import os
+import shlex
 import shutil
 import sys
 import re
 
+# Needed for CI to pass down bazel options.
+BAZEL_BUILD_OPTIONS = shlex.split(os.environ.get('BAZEL_BUILD_OPTIONS', ''))
+
 TARGETS = '@envoy_api//...'
 IMPORT_BASE = 'github.com/envoyproxy/go-control-plane'
 OUTPUT_BASE = 'build_go'
 REPO_BASE = 'go-control-plane'
 BRANCH = 'master'
 MIRROR_MSG = 'Mirrored from envoyproxy/envoy @ '
-USER_NAME = 'go-control-plane(CircleCI)'
+USER_NAME = 'go-control-plane(Azure Pipelines)'
 USER_EMAIL = 'go-control-plane@users.noreply.github.com'
 
 
@@ -28,7 +32,7 @@ def generateProtobufs(output):
 
   # Each rule has the form @envoy_api//foo/bar:baz_go_proto.
   # First build all the rules to ensure we have the output files.
-  check_call(['bazel', 'build', '-c', 'fastbuild'] + go_protos)
+  check_call(['bazel', 'build', '-c', 'fastbuild'] + BAZEL_BUILD_OPTIONS + go_protos)
 
   for rule in go_protos:
     # Example rule:
@@ -63,9 +67,7 @@ def git(repo, *args):
 
 def cloneGoProtobufs(repo):
   # Create a local clone of go-control-plane
-  git(None, 'clone', 'git@github.com:envoyproxy/go-control-plane', repo)
-  git(repo, 'fetch')
-  git(repo, 'checkout', '-B', BRANCH, 'origin/master')
+  git(None, 'clone', 'git@github.com:envoyproxy/go-control-plane', repo, '-b', BRANCH)
 
 
 def findLastSyncSHA(repo):
diff --git a/tools/api_boost/api_boost.py b/tools/api_boost/api_boost.py
index 8916e8b828227..8e91de1201587 100755
--- a/tools/api_boost/api_boost.py
+++ b/tools/api_boost/api_boost.py
@@ -133,7 +133,6 @@ def ApiBoostTree(target_paths,
     sp.run([
         'bazel',
         'build',
-        '--config=libc++',
         '--strip=always',
     ] + BAZEL_BUILD_OPTIONS + dep_lib_build_targets,
            check=True)

From fdf2b83491ed98d2880cb0976cf2f254a6038cb7 Mon Sep 17 00:00:00 2001
From: Lizan Zhou <lizan@tetrate.io>
Date: Thu, 15 Oct 2020 08:15:53 -0700
Subject: [PATCH 04/11] ci: use multiple stage (#13557)

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
---
 .azure-pipelines/pipelines.yml | 558 ++++++++++++++++++---------------
 1 file changed, 311 insertions(+), 247 deletions(-)

diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index 48eb0e1879fe2..d19f69f783e7c 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -10,275 +10,339 @@ trigger:
 # PR build config is manually overridden in Azure pipelines UI with different secrets
 pr: none
 
-jobs:
-  - job: format
-    dependsOn: [] # this removes the implicit dependency on previous stage and causes this to run in parallel.
-    pool:
-      vmImage: "ubuntu-18.04"
-    steps:
-      - task: Cache@2
-        inputs:
-          key: "format | ./WORKSPACE | **/*.bzl"
-          path: $(Build.StagingDirectory)/repository_cache
-        continueOnError: true
+stages:
+  - stage: precheck
+    jobs:
+      - job: format
+        dependsOn: [] # this removes the implicit dependency on previous stage and causes this to run in parallel.
+        pool:
+          vmImage: "ubuntu-18.04"
+        steps:
+          - task: Cache@2
+            inputs:
+              key: "format | ./WORKSPACE | **/*.bzl"
+              path: $(Build.StagingDirectory)/repository_cache
+            continueOnError: true
 
-      - script: ci/run_envoy_docker.sh 'ci/check_and_fix_format.sh'
-        workingDirectory: $(Build.SourcesDirectory)
-        env:
-          ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
-          BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
-          BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
-          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
-        displayName: "Run check format scripts"
+          - script: ci/run_envoy_docker.sh 'ci/check_and_fix_format.sh'
+            workingDirectory: $(Build.SourcesDirectory)
+            env:
+              ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+              BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+              BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+              GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+            displayName: "Run check format scripts"
 
-      - task: PublishBuildArtifacts@1
-        inputs:
-          pathtoPublish: "$(Build.StagingDirectory)/fix_format.diff"
-          artifactName: format
-        condition: failed()
+          - task: PublishBuildArtifacts@1
+            inputs:
+              pathtoPublish: "$(Build.StagingDirectory)/fix_format.diff"
+              artifactName: format
+            condition: failed()
 
-  - job: docs
-    dependsOn: [] # this removes the implicit dependency on previous stage and causes this to run in parallel.
-    pool:
-      vmImage: "ubuntu-18.04"
-    steps:
-      - task: Cache@2
-        inputs:
-          key: "docs | ./WORKSPACE | **/*.bzl"
-          path: $(Build.StagingDirectory)/repository_cache
-        continueOnError: true
+      - job: docs
+        dependsOn: [] # this removes the implicit dependency on previous stage and causes this to run in parallel.
+        pool:
+          vmImage: "ubuntu-18.04"
+        steps:
+          - task: Cache@2
+            inputs:
+              key: "docs | ./WORKSPACE | **/*.bzl"
+              path: $(Build.StagingDirectory)/repository_cache
+            continueOnError: true
 
-      - script: ci/run_envoy_docker.sh 'ci/do_ci.sh docs'
-        workingDirectory: $(Build.SourcesDirectory)
-        env:
-          ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
-          BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
-          BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
-          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
-        displayName: "Generate docs"
+          - script: ci/run_envoy_docker.sh 'ci/do_ci.sh docs'
+            workingDirectory: $(Build.SourcesDirectory)
+            env:
+              ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+              BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+              BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+              GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+            displayName: "Generate docs"
 
-      - script: ci/run_envoy_docker.sh 'ci/upload_gcs_artifact.sh /source/generated/docs docs'
-        displayName: "Upload Docs to GCS"
-        env:
-          ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
-          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
-          GCS_ARTIFACT_BUCKET: $(GcsArtifactBucket)
+          - script: ci/run_envoy_docker.sh 'ci/upload_gcs_artifact.sh /source/generated/docs docs'
+            displayName: "Upload Docs to GCS"
+            env:
+              ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+              GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+              GCS_ARTIFACT_BUCKET: $(GcsArtifactBucket)
 
-      - task: InstallSSHKey@0
-        inputs:
-          hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
-          sshPublicKey: "$(DocsPublicKey)"
-          sshPassphrase: "$(SshDeployKeyPassphrase)"
-          sshKeySecureFile: "$(DocsPrivateKey)"
-        condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'), eq(variables['PostSubmit'], true))
+          - task: PublishBuildArtifacts@1
+            inputs:
+              pathtoPublish: "$(Build.SourcesDirectory)/generated/docs"
+              artifactName: docs
+            condition: and(succeeded(), eq(variables['Build.Reason'], 'PullRequest'))
 
-      - script: docs/publish.sh
-        displayName: "Publish to GitHub"
-        workingDirectory: $(Build.SourcesDirectory)
-        env:
-          AZP_BRANCH: $(Build.SourceBranch)
-          AZP_SHA1: $(Build.SourceVersion)
-        condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'), eq(variables['PostSubmit'], true))
+          - task: InstallSSHKey@0
+            inputs:
+              hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
+              sshPublicKey: "$(DocsPublicKey)"
+              sshPassphrase: "$(SshDeployKeyPassphrase)"
+              sshKeySecureFile: "$(DocsPrivateKey)"
+            condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'), eq(variables['PostSubmit'], true))
 
-  - job: release
-    displayName: "Linux-x64 release"
-    dependsOn: ["format"]
-    # For master builds, continue even if format fails
-    condition: and(not(canceled()), or(succeeded(), ne(variables['Build.Reason'], 'PullRequest')))
-    timeoutInMinutes: 360
-    pool:
-      vmImage: "ubuntu-18.04"
-    steps:
-      - template: bazel.yml
-        parameters:
-          ciTarget: bazel.release
-
-  - job: release_arm64
-    displayName: "Linux-arm64 release.server_only"
-    dependsOn: ["format"]
-    condition: ne(variables['Build.Reason'], 'PullRequest')
-    pool: "arm-large"
-    steps:
-      - template: bazel.yml
-        parameters:
-          managedAgent: false
-          ciTarget: bazel.release.server_only
-          rbe: false
-          artifactSuffix: ".arm64"
+          - script: docs/publish.sh
+            displayName: "Publish to GitHub"
+            workingDirectory: $(Build.SourcesDirectory)
+            env:
+              AZP_BRANCH: $(Build.SourceBranch)
+              AZP_SHA1: $(Build.SourceVersion)
+            condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'), eq(variables['PostSubmit'], true))
 
-  - job: filter_example
-    displayName: "filter-example sync"
-    dependsOn: []
-    pool:
-      vmImage: "ubuntu-18.04"
+  - stage: sync
     condition: and(succeeded(), eq(variables['PostSubmit'], true))
-    steps:
-      - task: InstallSSHKey@0
-        inputs:
-          hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
-          sshPublicKey: "$(FilterExamplePublicKey)"
-          sshPassphrase: "$(SshDeployKeyPassphrase)"
-          sshKeySecureFile: "$(FilterExamplePrivateKey)"
+    dependsOn: []
+    jobs:
+      - job: filter_example
+        dependsOn: []
+        pool:
+          vmImage: "ubuntu-18.04"
+        steps:
+          - task: InstallSSHKey@0
+            inputs:
+              hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
+              sshPublicKey: "$(FilterExamplePublicKey)"
+              sshPassphrase: "$(SshDeployKeyPassphrase)"
+              sshKeySecureFile: "$(FilterExamplePrivateKey)"
 
-      - bash: ci/filter_example_mirror.sh
-        displayName: "Sync envoy-filter-example"
-        workingDirectory: $(Build.SourcesDirectory)
-        env:
-          AZP_BRANCH: $(Build.SourceBranch)
+          - bash: ci/filter_example_mirror.sh
+            displayName: "Sync envoy-filter-example"
+            workingDirectory: $(Build.SourcesDirectory)
+            env:
+              AZP_BRANCH: $(Build.SourceBranch)
 
-  - job: api
-    displayName: "data-plane-api sync"
-    dependsOn: []
-    condition: and(succeeded(), eq(variables['PostSubmit'], true))
-    pool:
-      vmImage: "ubuntu-18.04"
-    steps:
-      - task: InstallSSHKey@0
-        inputs:
-          hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
-          sshPublicKey: "$(DataPlaneApiPublicKey)"
-          sshPassphrase: "$(SshDeployKeyPassphrase)"
-          sshKeySecureFile: "$(DataPlaneApiPrivateKey)"
+      - job: data_plane_api
+        dependsOn: []
+        pool:
+          vmImage: "ubuntu-18.04"
+        steps:
+          - task: InstallSSHKey@0
+            inputs:
+              hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
+              sshPublicKey: "$(DataPlaneApiPublicKey)"
+              sshPassphrase: "$(SshDeployKeyPassphrase)"
+              sshKeySecureFile: "$(DataPlaneApiPrivateKey)"
 
-      - bash: ci/api_mirror.sh
-        displayName: "Sync data-plane-api"
-        workingDirectory: $(Build.SourcesDirectory)
-        env:
-          AZP_BRANCH: $(Build.SourceBranch)
+          - bash: ci/api_mirror.sh
+            displayName: "Sync data-plane-api"
+            workingDirectory: $(Build.SourcesDirectory)
+            env:
+              AZP_BRANCH: $(Build.SourceBranch)
 
-  - job: go_control_plane
-    displayName: "go-control-plane sync"
-    dependsOn: []
-    condition: and(succeeded(), eq(variables['PostSubmit'], true))
-    steps:
-      - task: InstallSSHKey@0
-        inputs:
-          hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
-          sshPublicKey: "$(GoControlPlanePublicKey)"
-          sshPassphrase: "$(SshDeployKeyPassphrase)"
-          sshKeySecureFile: "$(GoControlPlanePrivateKey)"
+      - job: go_control_plane
+        dependsOn: []
+        steps:
+          - task: InstallSSHKey@0
+            inputs:
+              hostName: "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
+              sshPublicKey: "$(GoControlPlanePublicKey)"
+              sshPassphrase: "$(SshDeployKeyPassphrase)"
+              sshKeySecureFile: "$(GoControlPlanePrivateKey)"
 
-      - bash: |
-          cp -a ~/.ssh $(Build.StagingDirectory)/
-          ci/run_envoy_docker.sh 'ci/go_mirror.sh'
-        displayName: "Sync go-control-plane"
-        workingDirectory: $(Build.SourcesDirectory)
-        env:
-          ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
-          BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
-          BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
-          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
-          AZP_BRANCH: $(Build.SourceBranch)
+          - bash: |
+              cp -a ~/.ssh $(Build.StagingDirectory)/
+              ci/run_envoy_docker.sh 'ci/go_mirror.sh'
+            displayName: "Sync go-control-plane"
+            workingDirectory: $(Build.SourcesDirectory)
+            env:
+              ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+              BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+              BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+              GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+              AZP_BRANCH: $(Build.SourceBranch)
 
-  - job: bazel
-    displayName: "Linux-x64"
-    dependsOn: ["release"]
-    # For master builds, continue even if format fails
+  - stage: linux_x64
+    dependsOn: ["precheck"]
+    # For master builds, continue even if precheck fails
     condition: and(not(canceled()), or(succeeded(), ne(variables['Build.Reason'], 'PullRequest')))
-    strategy:
-      maxParallel: 3
-      matrix:
-        api:
-          CI_TARGET: "bazel.api"
-        gcc:
-          CI_TARGET: "bazel.gcc"
-        clang_tidy:
-          CI_TARGET: "bazel.clang_tidy"
-        asan:
-          CI_TARGET: "bazel.asan"
-        tsan:
-          CI_TARGET: "bazel.tsan"
-        compile_time_options:
-          CI_TARGET: "bazel.compile_time_options"
-    timeoutInMinutes: 360
-    pool:
-      vmImage: "ubuntu-18.04"
-    steps:
-      - template: bazel.yml
-        parameters:
-          ciTarget: $(CI_TARGET)
+    jobs:
+      - job: release
+        # For master builds, continue even if format fails
+        timeoutInMinutes: 360
+        pool:
+          vmImage: "ubuntu-18.04"
+        steps:
+          - template: bazel.yml
+            parameters:
+              ciTarget: bazel.release
+
+  - stage: linux_arm64
+    dependsOn: ["precheck"]
+    # For master builds, continue even if precheck fails
+    condition: and(not(canceled()), or(succeeded(), ne(variables['Build.Reason'], 'PullRequest')))
+    jobs:
+      - job: release
+        timeoutInMinutes: 360
+        pool: "arm-large"
+        steps:
+          - template: bazel.yml
+            parameters:
+              managedAgent: false
+              ciTarget: bazel.release.server_only
+              rbe: false
+              artifactSuffix: ".arm64"
+              bazelBuildExtraOptions: "--sandbox_base=/tmp/sandbox_base"
+
+  - stage: check
+    dependsOn: ["linux_x64"]
+    jobs:
+      - job: bazel
+        displayName: "linux_x64"
+        dependsOn: []
+        strategy:
+          maxParallel: 3
+          matrix:
+            api:
+              CI_TARGET: "bazel.api"
+            gcc:
+              CI_TARGET: "bazel.gcc"
+            clang_tidy:
+              CI_TARGET: "bazel.clang_tidy"
+            asan:
+              CI_TARGET: "bazel.asan"
+            tsan:
+              CI_TARGET: "bazel.tsan"
+            compile_time_options:
+              CI_TARGET: "bazel.compile_time_options"
+        timeoutInMinutes: 360
+        pool:
+          vmImage: "ubuntu-18.04"
+        steps:
+          - template: bazel.yml
+            parameters:
+              ciTarget: $(CI_TARGET)
 
-  - job: coverage
-    displayName: "Linux-x64 coverage"
-    dependsOn: ["format"]
-    timeoutInMinutes: 360
-    pool: "x64-large"
-    steps:
-      - template: bazel.yml
-        parameters:
-          managedAgent: false
-          ciTarget: bazel.coverage
-          rbe: false
-          # /tmp/sandbox_base is a tmpfs in CI environment to optimize large I/O for coverage traces
-          bazelBuildExtraOptions: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --sandbox_base=/tmp/sandbox_base"
+      - job: coverage
+        displayName: "linux_x64"
+        dependsOn: []
+        timeoutInMinutes: 360
+        pool: "x64-large"
+        strategy:
+          maxParallel: 2
+          matrix:
+            coverage:
+              CI_TARGET: "coverage"
+            fuzz_coverage:
+              CI_TARGET: "fuzz_coverage"
+        steps:
+          - template: bazel.yml
+            parameters:
+              managedAgent: false
+              ciTarget: bazel.$(CI_TARGET)
+              rbe: false
+              # /tmp/sandbox_base is a tmpfs in CI environment to optimize large I/O for coverage traces
+              bazelBuildExtraOptions: "--define=no_debug_info=1 --linkopt=-Wl,-s --test_env=ENVOY_IP_TEST_VERSIONS=v4only --sandbox_base=/tmp/sandbox_base"
 
-      - script: ci/run_envoy_docker.sh 'ci/upload_gcs_artifact.sh /source/generated/coverage coverage'
-        displayName: "Upload Report to GCS"
-        env:
-          ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
-          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
-          GCS_ARTIFACT_BUCKET: $(GcsArtifactBucket)
-        condition: always()
+          - script: ci/run_envoy_docker.sh 'ci/upload_gcs_artifact.sh /source/generated/$(CI_TARGET) $(CI_TARGET)'
+            displayName: "Upload $(CI_TARGET) Report to GCS"
+            env:
+              ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+              GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+              GCS_ARTIFACT_BUCKET: $(GcsArtifactBucket)
+            condition: always()
 
-  - job: docker
-    displayName: "Linux-x64 docker"
-    dependsOn: ["release"]
-    condition: and(succeeded(), eq(variables['PostSubmit'], 'true'), ne(variables['Build.Reason'], 'PullRequest'))
-    pool:
-      vmImage: "ubuntu-18.04"
-    steps:
-      - task: DownloadBuildArtifacts@0
-        inputs:
-          buildType: current
-          artifactName: "bazel.release"
-          itemPattern: "bazel.release/envoy_binary.tar.gz"
-          downloadType: single
-          targetPath: $(Build.StagingDirectory)
+  - stage: docker
+    dependsOn: ["linux_x64"]
+    jobs:
+      - job: docker
+        displayName: "linux multiarch"
+        pool:
+          vmImage: "ubuntu-18.04"
+        steps:
+          - bash: .azure-pipelines/cleanup.sh
+            displayName: "Removing tools from agent"
+          - task: DownloadBuildArtifacts@0
+            inputs:
+              buildType: current
+              artifactName: "bazel.release"
+              itemPattern: "bazel.release/envoy_binary.tar.gz"
+              downloadType: single
+              targetPath: $(Build.StagingDirectory)
+          - task: DownloadBuildArtifacts@0
+            inputs:
+              buildType: current
+              artifactName: "bazel.release.arm64"
+              itemPattern: "bazel.release.arm64/envoy_binary.tar.gz"
+              downloadType: single
+              targetPath: $(Build.StagingDirectory)
+          - bash: |
+              set -e
+              tar zxf $(Build.StagingDirectory)/bazel.release/envoy_binary.tar.gz
+              ci/docker_ci.sh
+            workingDirectory: $(Build.SourcesDirectory)
+            env:
+              AZP_BRANCH: $(Build.SourceBranch)
+              AZP_SHA1: $(Build.SourceVersion)
+              DOCKERHUB_USERNAME: $(DockerUsername)
+              DOCKERHUB_PASSWORD: $(DockerPassword)
+          - task: PublishBuildArtifacts@1
+            inputs:
+              pathtoPublish: "$(Build.StagingDirectory)/build_images"
+              artifactName: docker
+            condition: always()
 
-      - bash: |
-          set -e
-          tar zxf $(Build.StagingDirectory)/bazel.release/envoy_binary.tar.gz
-          ci/docker_ci.sh
-        workingDirectory: $(Build.SourcesDirectory)
-        env:
-          AZP_BRANCH: $(Build.SourceBranch)
-          AZP_SHA1: $(Build.SourceVersion)
-          DOCKERHUB_USERNAME: $(DockerUsername)
-          DOCKERHUB_PASSWORD: $(DockerPassword)
+  - stage: verify
+    dependsOn: ["docker"]
+    jobs:
+      - job: examples
+        pool:
+          vmImage: "ubuntu-18.04"
+        steps:
+          - task: DownloadBuildArtifacts@0
+            inputs:
+              buildType: current
+              artifactName: "docker"
+              itemPattern: "docker/envoy-docker-images.tar.xz"
+              downloadType: single
+              targetPath: $(Build.StagingDirectory)
+          - bash: ./ci/do_ci.sh verify_examples
+            env:
+              ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+              NO_BUILD_SETUP: 1
 
-  - job: macOS
-    dependsOn: ["format"]
-    timeoutInMinutes: 360
-    pool:
-      vmImage: "macos-latest"
-    steps:
-      - script: ./ci/mac_ci_setup.sh
-        displayName: "Install dependencies"
+  - stage: macos
+    dependsOn: ["precheck"]
+    jobs:
+      - job: test
+        timeoutInMinutes: 360
+        pool:
+          vmImage: "macos-latest"
+        steps:
+          - script: ./ci/mac_ci_setup.sh
+            displayName: "Install dependencies"
 
-      - script: ./ci/mac_ci_steps.sh
-        displayName: "Run Mac CI"
-        env:
-          BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
-          BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
-          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+          - script: ./ci/mac_ci_steps.sh
+            displayName: "Run Mac CI"
+            env:
+              BAZEL_BUILD_EXTRA_OPTIONS: "--remote_download_toplevel --flaky_test_attempts=2"
+              BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+              BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+              GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
 
-      - task: PublishTestResults@2
-        inputs:
-          testResultsFiles: "**/bazel-testlogs/**/test.xml"
-          testRunTitle: "macOS"
-        condition: always()
+          - task: PublishTestResults@2
+            inputs:
+              testResultsFiles: "**/bazel-testlogs/**/test.xml"
+              testRunTitle: "macOS"
+            condition: always()
 
-  - job: Windows
-    dependsOn: ["format"]
-    timeoutInMinutes: 360
-    pool:
-      vmImage: "windows-latest"
-    steps:
-      - bash: ci/run_envoy_docker_windows.sh ci/windows_ci_steps.sh
-        displayName: "Run Windows CI"
-        env:
-          ENVOY_RBE: "true"
-          BAZEL_BUILD_EXTRA_OPTIONS: "--config=remote-ci --config=remote-msvc-cl --jobs=$(RbeJobs)"
-          BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
-          BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
-          GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+  - stage: windows
+    dependsOn: ["precheck"]
+    jobs:
+      - job: release
+        timeoutInMinutes: 360
+        pool:
+          vmImage: "windows-latest"
+        steps:
+          - bash: ci/run_envoy_docker.sh ci/windows_ci_steps.sh
+            displayName: "Run Windows CI"
+            env:
+              ENVOY_DOCKER_BUILD_DIR: "$(Build.StagingDirectory)"
+              ENVOY_RBE: "true"
+              BAZEL_BUILD_EXTRA_OPTIONS: "--config=remote-ci --config=remote-msvc-cl --jobs=$(RbeJobs)"
+              BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+              BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+              GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+          - task: PublishBuildArtifacts@1
+            inputs:
+              pathtoPublish: "$(Build.StagingDirectory)/envoy"
+              artifactName: windows.release
+            condition: always()

From fe8e12e0fc3c7ad2dbb5eb1f6075e213adba6baf Mon Sep 17 00:00:00 2001
From: Lizan Zhou <lizan@tetrate.io>
Date: Tue, 20 Oct 2020 16:12:33 -0700
Subject: [PATCH 05/11] ci: various improvements (#13660)

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
---
 .azure-pipelines/pipelines.yml | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index d19f69f783e7c..2422a1357b235 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -70,7 +70,6 @@ stages:
             inputs:
               pathtoPublish: "$(Build.SourcesDirectory)/generated/docs"
               artifactName: docs
-            condition: and(succeeded(), eq(variables['Build.Reason'], 'PullRequest'))
 
           - task: InstallSSHKey@0
             inputs:
@@ -78,7 +77,7 @@ stages:
               sshPublicKey: "$(DocsPublicKey)"
               sshPassphrase: "$(SshDeployKeyPassphrase)"
               sshKeySecureFile: "$(DocsPrivateKey)"
-            condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'), eq(variables['PostSubmit'], true))
+            condition: and(succeeded(), eq(variables['PostSubmit'], true), ne(variables['NoSync'], true))
 
           - script: docs/publish.sh
             displayName: "Publish to GitHub"
@@ -86,10 +85,10 @@ stages:
             env:
               AZP_BRANCH: $(Build.SourceBranch)
               AZP_SHA1: $(Build.SourceVersion)
-            condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest'), eq(variables['PostSubmit'], true))
+            condition: and(succeeded(), eq(variables['PostSubmit'], true), ne(variables['NoSync'], true))
 
   - stage: sync
-    condition: and(succeeded(), eq(variables['PostSubmit'], true))
+    condition: and(succeeded(), eq(variables['PostSubmit'], true), ne(variables['NoSync'], true))
     dependsOn: []
     jobs:
       - job: filter_example
@@ -130,6 +129,8 @@ stages:
 
       - job: go_control_plane
         dependsOn: []
+        pool:
+          vmImage: "ubuntu-18.04"
         steps:
           - task: InstallSSHKey@0
             inputs:
@@ -152,12 +153,11 @@ stages:
 
   - stage: linux_x64
     dependsOn: ["precheck"]
-    # For master builds, continue even if precheck fails
-    condition: and(not(canceled()), or(succeeded(), ne(variables['Build.Reason'], 'PullRequest')))
+    # For post-submit builds, continue even if precheck fails
+    condition: and(not(canceled()), or(succeeded(), eq(variables['PostSubmit'], true)))
     jobs:
       - job: release
-        # For master builds, continue even if format fails
-        timeoutInMinutes: 360
+        timeoutInMinutes: 120
         pool:
           vmImage: "ubuntu-18.04"
         steps:
@@ -167,11 +167,11 @@ stages:
 
   - stage: linux_arm64
     dependsOn: ["precheck"]
-    # For master builds, continue even if precheck fails
-    condition: and(not(canceled()), or(succeeded(), ne(variables['Build.Reason'], 'PullRequest')))
+    # For post-submit builds, continue even if precheck fails
+    condition: and(not(canceled()), or(succeeded(), eq(variables['PostSubmit'], true)))
     jobs:
       - job: release
-        timeoutInMinutes: 360
+        timeoutInMinutes: 120
         pool: "arm-large"
         steps:
           - template: bazel.yml
@@ -203,7 +203,7 @@ stages:
               CI_TARGET: "bazel.tsan"
             compile_time_options:
               CI_TARGET: "bazel.compile_time_options"
-        timeoutInMinutes: 360
+        timeoutInMinutes: 120
         pool:
           vmImage: "ubuntu-18.04"
         steps:
@@ -214,7 +214,7 @@ stages:
       - job: coverage
         displayName: "linux_x64"
         dependsOn: []
-        timeoutInMinutes: 360
+        timeoutInMinutes: 120
         pool: "x64-large"
         strategy:
           maxParallel: 2
@@ -303,7 +303,7 @@ stages:
     dependsOn: ["precheck"]
     jobs:
       - job: test
-        timeoutInMinutes: 360
+        timeoutInMinutes: 180
         pool:
           vmImage: "macos-latest"
         steps:
@@ -328,7 +328,7 @@ stages:
     dependsOn: ["precheck"]
     jobs:
       - job: release
-        timeoutInMinutes: 360
+        timeoutInMinutes: 120
         pool:
           vmImage: "windows-latest"
         steps:

From 20c221c84e32cbacf27cf844344b02ab0e404d0b Mon Sep 17 00:00:00 2001
From: asraa <asraa@google.com>
Date: Tue, 20 Oct 2020 14:02:21 -0400
Subject: [PATCH 06/11] mac ci: try ignoring update failure (#13658)

Signed-off-by: Asra Ali <asraa@google.com>
---
 ci/mac_ci_setup.sh | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/ci/mac_ci_setup.sh b/ci/mac_ci_setup.sh
index b9870f9426968..5cd363afa60eb 100755
--- a/ci/mac_ci_setup.sh
+++ b/ci/mac_ci_setup.sh
@@ -20,9 +20,23 @@ function install {
     fi
 }
 
-if ! brew update; then
-    echo "Failed to update homebrew"
-    exit 1
+function retry () {
+    local returns=1 i=1
+    while ((i<=HOMEBREW_RETRY_ATTEMPTS)); do
+	if "$@"; then
+	    returns=0
+	    break
+	else
+	    sleep "$HOMEBREW_RETRY_INTERVAL";
+	    ((i++))
+	fi
+    done
+    return "$returns"
+}
+
+if ! retry brew update; then
+  # Do not exit early if update fails.
+  echo "Failed to update homebrew"
 fi
 
 DEPS="automake cmake coreutils go libtool wget ninja"

From 5495180e44eefb9068b6ee245460a2f9af6c8dbc Mon Sep 17 00:00:00 2001
From: Lizan Zhou <lizan@tetrate.io>
Date: Wed, 21 Oct 2020 18:08:43 -0700
Subject: [PATCH 07/11] revert run_docker.sh

---
 ci/run_envoy_docker.sh | 44 ++++++++++--------------------------------
 1 file changed, 10 insertions(+), 34 deletions(-)

diff --git a/ci/run_envoy_docker.sh b/ci/run_envoy_docker.sh
index f61bd2b32a309..987dbf48e30b9 100755
--- a/ci/run_envoy_docker.sh
+++ b/ci/run_envoy_docker.sh
@@ -24,37 +24,13 @@ export ENVOY_BUILD_IMAGE="${IMAGE_NAME}:${IMAGE_ID}"
 
 mkdir -p "${ENVOY_DOCKER_BUILD_DIR}"
 # Since we specify an explicit hash, docker-run will pull from the remote repo if missing.
-docker run --rm \
-       ${ENVOY_DOCKER_OPTIONS} \
-       -v "${ENVOY_DOCKER_BUILD_DIR}":"${BUILD_DIR_MOUNT_DEST}" \
-       -v "${SOURCE_DIR}":"${SOURCE_DIR_MOUNT_DEST}" \
-       -e AZP_BRANCH \
-       -e HTTP_PROXY \
-       -e HTTPS_PROXY \
-       -e NO_PROXY \
-       -e BAZEL_STARTUP_OPTIONS \
-       -e BAZEL_BUILD_EXTRA_OPTIONS \
-       -e BAZEL_EXTRA_TEST_OPTIONS \
-       -e BAZEL_REMOTE_CACHE \
-       -e ENVOY_STDLIB \
-       -e BUILD_REASON \
-       -e BAZEL_REMOTE_INSTANCE \
-       -e GCP_SERVICE_ACCOUNT_KEY \
-       -e NUM_CPUS \
-       -e ENVOY_RBE \
-       -e FUZZIT_API_KEY \
-       -e ENVOY_BUILD_IMAGE \
-       -e ENVOY_SRCDIR \
-       -e ENVOY_BUILD_TARGET \
-       -e SYSTEM_PULLREQUEST_TARGETBRANCH \
-       -e SYSTEM_PULLREQUEST_PULLREQUESTNUMBER \
-       -e GCS_ARTIFACT_BUCKET \
-       -e BUILD_SOURCEBRANCHNAME \
-       -e BAZELISK_BASE_URL \
-       -e ENVOY_BUILD_ARCH \
-       -e SLACK_TOKEN \
-       -e BUILD_URI\
-       -e REPO_URI \
-       "${ENVOY_BUILD_IMAGE}" \
-       /bin/bash -lc "groupadd --gid $(id -g) -f envoygroup && useradd -o --uid $(id -u) --gid $(id -g) --no-create-home \
-       --home-dir /build envoybuild && usermod -a -G pcap envoybuild && sudo -EHs -u envoybuild bash -c \"cd /source && $*\""
+docker run --rm ${ENVOY_DOCKER_OPTIONS} -e HTTP_PROXY=${http_proxy} -e HTTPS_PROXY=${https_proxy} -e NO_PROXY=${no_proxy} \
+  -u "${USER}":"${USER_GROUP}" -v "${ENVOY_DOCKER_BUILD_DIR}":/build -v /var/run/docker.sock:/var/run/docker.sock  \
+  -e AZP_BRANCH \
+  -e BAZEL_BUILD_EXTRA_OPTIONS -e BAZEL_EXTRA_TEST_OPTIONS -e BAZEL_REMOTE_CACHE -e ENVOY_STDLIB -e BUILD_REASON \
+  -e BAZEL_REMOTE_INSTANCE -e GCP_SERVICE_ACCOUNT_KEY -e NUM_CPUS -e ENVOY_RBE -e FUZZIT_API_KEY -e ENVOY_BUILD_IMAGE \
+  -e ENVOY_SRCDIR -e ENVOY_BUILD_TARGET -e SYSTEM_PULLREQUEST_TARGETBRANCH -e SYSTEM_PULLREQUEST_PULLREQUESTNUMBER \
+  -e GCS_ARTIFACT_BUCKET -e BUILD_SOURCEBRANCHNAME -e BAZELISK_BASE_URL \
+  -v "$PWD":/source --cap-add SYS_PTRACE --cap-add NET_RAW --cap-add NET_ADMIN "${ENVOY_BUILD_IMAGE}" \
+  /bin/bash -lc "groupadd --gid $(id -g) -f envoygroup && useradd -o --uid $(id -u) --gid $(id -g) --no-create-home \
+  --home-dir /build envoybuild && usermod -a -G pcap envoybuild && sudo -EHs -u envoybuild bash -c \"cd /source && $*\""

From e8c42a6b483901f3697cc32a8116670523d19dd0 Mon Sep 17 00:00:00 2001
From: Lizan Zhou <lizan@tetrate.io>
Date: Wed, 21 Oct 2020 19:56:54 -0700
Subject: [PATCH 08/11] fix

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
---
 .azure-pipelines/pipelines.yml | 15 ---------------
 1 file changed, 15 deletions(-)

diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index 2422a1357b235..5bd2c212d0b54 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -217,12 +217,9 @@ stages:
         timeoutInMinutes: 120
         pool: "x64-large"
         strategy:
-          maxParallel: 2
           matrix:
             coverage:
               CI_TARGET: "coverage"
-            fuzz_coverage:
-              CI_TARGET: "fuzz_coverage"
         steps:
           - template: bazel.yml
             parameters:
@@ -257,13 +254,6 @@ stages:
               itemPattern: "bazel.release/envoy_binary.tar.gz"
               downloadType: single
               targetPath: $(Build.StagingDirectory)
-          - task: DownloadBuildArtifacts@0
-            inputs:
-              buildType: current
-              artifactName: "bazel.release.arm64"
-              itemPattern: "bazel.release.arm64/envoy_binary.tar.gz"
-              downloadType: single
-              targetPath: $(Build.StagingDirectory)
           - bash: |
               set -e
               tar zxf $(Build.StagingDirectory)/bazel.release/envoy_binary.tar.gz
@@ -341,8 +331,3 @@ stages:
               BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
               BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
               GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
-          - task: PublishBuildArtifacts@1
-            inputs:
-              pathtoPublish: "$(Build.StagingDirectory)/envoy"
-              artifactName: windows.release
-            condition: always()

From 990176b9afe0a0aa1f3a23249cc2abcbb41990e8 Mon Sep 17 00:00:00 2001
From: Lizan Zhou <lizan@tetrate.io>
Date: Wed, 21 Oct 2020 21:18:29 -0700
Subject: [PATCH 09/11] fix

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
---
 .azure-pipelines/pipelines.yml | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index 5bd2c212d0b54..57968fc2cb8a0 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -264,11 +264,6 @@ stages:
               AZP_SHA1: $(Build.SourceVersion)
               DOCKERHUB_USERNAME: $(DockerUsername)
               DOCKERHUB_PASSWORD: $(DockerPassword)
-          - task: PublishBuildArtifacts@1
-            inputs:
-              pathtoPublish: "$(Build.StagingDirectory)/build_images"
-              artifactName: docker
-            condition: always()
 
   - stage: verify
     dependsOn: ["docker"]
@@ -322,10 +317,9 @@ stages:
         pool:
           vmImage: "windows-latest"
         steps:
-          - bash: ci/run_envoy_docker.sh ci/windows_ci_steps.sh
+          - bash: ci/run_envoy_docker_windows.sh ci/windows_ci_steps.sh
             displayName: "Run Windows CI"
             env:
-              ENVOY_DOCKER_BUILD_DIR: "$(Build.StagingDirectory)"
               ENVOY_RBE: "true"
               BAZEL_BUILD_EXTRA_OPTIONS: "--config=remote-ci --config=remote-msvc-cl --jobs=$(RbeJobs)"
               BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com

From 7131262f499b117fbdf5cf9ce6b586e053fc5e20 Mon Sep 17 00:00:00 2001
From: Lizan Zhou <lizan@tetrate.io>
Date: Thu, 22 Oct 2020 01:19:40 -0700
Subject: [PATCH 10/11] no verify examples

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
---
 .azure-pipelines/pipelines.yml | 19 -------------------
 1 file changed, 19 deletions(-)

diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index 57968fc2cb8a0..cc15adbb5eeb7 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -265,25 +265,6 @@ stages:
               DOCKERHUB_USERNAME: $(DockerUsername)
               DOCKERHUB_PASSWORD: $(DockerPassword)
 
-  - stage: verify
-    dependsOn: ["docker"]
-    jobs:
-      - job: examples
-        pool:
-          vmImage: "ubuntu-18.04"
-        steps:
-          - task: DownloadBuildArtifacts@0
-            inputs:
-              buildType: current
-              artifactName: "docker"
-              itemPattern: "docker/envoy-docker-images.tar.xz"
-              downloadType: single
-              targetPath: $(Build.StagingDirectory)
-          - bash: ./ci/do_ci.sh verify_examples
-            env:
-              ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
-              NO_BUILD_SETUP: 1
-
   - stage: macos
     dependsOn: ["precheck"]
     jobs:

From 687d0e22e6bfa737375fc40e3585e839ca8cd2e0 Mon Sep 17 00:00:00 2001
From: Lizan Zhou <lizan@tetrate.io>
Date: Thu, 22 Oct 2020 02:19:32 -0700
Subject: [PATCH 11/11] no windows

Signed-off-by: Lizan Zhou <lizan@tetrate.io>
---
 .azure-pipelines/pipelines.yml | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index cc15adbb5eeb7..9a6dd664f5478 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -289,20 +289,3 @@ stages:
               testResultsFiles: "**/bazel-testlogs/**/test.xml"
               testRunTitle: "macOS"
             condition: always()
-
-  - stage: windows
-    dependsOn: ["precheck"]
-    jobs:
-      - job: release
-        timeoutInMinutes: 120
-        pool:
-          vmImage: "windows-latest"
-        steps:
-          - bash: ci/run_envoy_docker_windows.sh ci/windows_ci_steps.sh
-            displayName: "Run Windows CI"
-            env:
-              ENVOY_RBE: "true"
-              BAZEL_BUILD_EXTRA_OPTIONS: "--config=remote-ci --config=remote-msvc-cl --jobs=$(RbeJobs)"
-              BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
-              BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
-              GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)