Maistra 2.3.2 by twghu · Pull Request #225 · maistra/envoy

twghu · 2023-02-08T10:23:39Z

Update Maistra code base to align with 1.22.6 upstream.

Signed-off-by: Alex Xu <hejie.xu@intel.com>

Signed-off-by: Ryan Northey <ryan@synca.io>

ci: disable non-RBE cache for release branches Signed-off-by: Lizan Zhou <lizan@tetrate.io>

Signed-off-by: Ryan Northey <ryan@synca.io>

Previously `/var/run/docker.sock` is readable/writable inside docker run because group ID of `envoygroup` coincidentally matches host docker group, while it is no longer true during rolling out new image. Fixing that by forcing `envoygroup` has host docker group ID. Risk Level: Low Testing: CI Docs Changes: Release Notes: Platform Specific Features: Signed-off-by: Lizan Zhou <lizan@tetrate.io> Signed-off-by: Dario Cillerai <dcillera@redhat.com> Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: Xie Zhihao <zhihao.xie@intel.com> Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: wbpcode <wangbaiping@corp.netease.com> Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: Ryan Northey <ryan@synca.io>

As noted in #21060, building with gcc in "opt" mode results in a compilation error: ``` ERROR: /workspaces/envoy/source/common/config/BUILD:414:17: Compiling source/common/config/watch_map.cc failed: (Exit 1): gcc failed: error executing command /usr/bin/gcc -U_FORTIFY_SOURCE -fstack-protector -Wall -Wunused-but-set-parameter -Wno-free-nonheap-object -fno-omit-frame-pointer -g0 -O2 '-D_FORTIFY_SOURCE=1' -DNDEBUG -ffunction-sections ... (remaining 154 arguments skipped) Use --sandbox_debug to see verbose messages from the sandbox source/common/config/watch_map.cc: In member function 'virtual void Envoy::Config::WatchMap::onConfigUpdate(const google::protobuf::RepeatedPtrField<envoy::service::discovery::v3::Resource>&, const google::protobuf::RepeatedPtrField<std::__cxx11::basic_string<char> >&, const string&)': source/common/config/watch_map.cc:215:69: error: dereferencing type-punned pointer will break strict-aliasing rules [-Werror=strict-aliasing] 215 | type_url_, reinterpret_cast<std::vector<DecodedResourcePtr>&>(decoded_resources), | ^~~~~~~~~~~~~~~~~ cc1plus: all warnings being treated as errors ``` This PR changes the type of the original vector to be the base class type. Risk Level: Low-Medium (no features changes, but updates config-plane code). Testing: N/A Docs Changes: N/A Release Notes: N/A Platform Specific Features: N/A Signed-off-by: Adi Suissa-Peleg <adip@google.com> Signed-off-by: Ryan Northey <ryan@synca.io>

…(#20843) Signed-off-by: johnlanni ztywto@qq.com Commit Message: Handle null plugins handle when skipping config canarying for duplicate filters and also when the remote code fetch is in progress or fails. Risk Level: low Testing: ok Signed-off-by: 澄潭 <ztywto@qq.com> Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: Ingwon Song <igsong@google.com> Signed-off-by: Ingwon Song <102102227+ingwonsong@users.noreply.github.com> Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: Piotr Sikora <piotrsikora@google.com> Signed-off-by: Ryan Northey <ryan@synca.io>

…2117) Signed-off-by: Piotr Sikora <piotrsikora@google.com> Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: Piotr Sikora <piotrsikora@google.com>

…izer for 12 fields) (#21414) Signed-off-by: Adam Kotwasinski <adam.kotwasinski@gmail.com> Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: Adam Kotwasinski <adam.kotwasinski@gmail.com> Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: He Jie Xu <hejie.xu@intel.com> Signed-off-by: Ryan Northey <ryan@synca.io>

Fix #23685 Signed-off-by: Ryan Northey <ryan@synca.io> Signed-off-by: phlax <phlax@users.noreply.github.com>

The HeaderEvaluatorConfigUpdate test needs to wait for a listener to be replaced. Its previous attempt to achieve that did not account for the intermediate warming state of new listeners, which could lead to the test continuing prematurely and failing. Signed-off-by: Benjamin Peterson <benjamin@engflow.com> Signed-off-by: Ryan Northey <ryan@synca.io>

Signed-off-by: Alyssa Wilk <alyssar@chromium.org> Signed-off-by: Ryan Northey <ryan@synca.io>

…24089) * deps: bump `com_github_wasmtime` -> 1.0.0 (#23232) Signed-off-by: river phillips <riverphillips1@gmail.com> Signed-off-by: Ryan Northey <ryan@synca.io> * wasm: update WAVM to nightly/2022-05-14. (#22491) Signed-off-by: Piotr Sikora <piotrsikora@google.com> Signed-off-by: Ryan Northey <ryan@synca.io> * wasm: update Proxy-Wasm C++ Host to latest. (#22575) Signed-off-by: Piotr Sikora <piotrsikora@google.com> Signed-off-by: Ryan Northey <ryan@synca.io> * deps: Bump `com_github_wasmtime` -> 1.0.2 (#24086) Fix: - CVE-2022-39392 - CVE-2022-39393 - CVE-2022-39394 Signed-off-by: Ryan Northey <ryan@synca.io> * bazel: update rules_rust This gets us on rust 1.60 Signed-off-by: Keith Smiley <keithbsmiley@gmail.com> Signed-off-by: Ryan Northey <ryan@synca.io> * deps: Bump `rules_rust` -> 0.8.1 (#22253) Fix #22073 Signed-off-by: Ryan Northey <ryan@synca.io> * wasm: fix V8 build on older versions of Linux. (#22228) wasm: fix build on older versions of Linux. Signed-off-by: Piotr Sikora <piotrsikora@google.com> Signed-off-by: Ryan Northey <ryan@synca.io> * backport: macOS: Allow to load .wasm on Apple silicon (#23299) backport: macOS: Enable wasm and allow to load .wasm on Apple silicon This applies https://chromium-review.googlesource.com/c/v8/v8/+/3700352 as a fix for MemoryAllocator::PartialFreeMemory() which shouldn't try to change permissions of RWX pages. This mainly affects macOS > 11.2 due to mprotect behavior changes (#23243) on Apple silicon. This is cherry-picked from: envoyproxy/envoy@63f27a6 Signed-off-by: Dhi Aurrahman <dio@rockybars.com> Signed-off-by: Dhi Aurrahman <dio@rockybars.com> Signed-off-by: Ryan Northey <ryan@synca.io> * deps: Bump `v8` to 10.7.193.13 and `proxy_wasm_cpp_host` to b0a0594 (#23434) Signed-off-by: Dhi Aurrahman <dio@rockybars.com> * ci: Disable wasm coverage tests (#24169) and adjust-coverage-total Signed-off-by: Ryan Northey <ryan@synca.io> Signed-off-by: phlax <phlax@users.noreply.github.com> * deps: Bump `com_github_wasmtime` -> 2.0.2 (+related) (#24150) deps: Bump `com_github_wasmtime` -> 2.0.2 - `proxy_wasm_cpp_host` - `proxy_wasm_rust_sdk` Signed-off-by: Ryan Northey <ryan@synca.io> Signed-off-by: river phillips <riverphillips1@gmail.com> Signed-off-by: Ryan Northey <ryan@synca.io> Signed-off-by: Piotr Sikora <piotrsikora@google.com> Signed-off-by: Dhi Aurrahman <dio@rockybars.com> Signed-off-by: phlax <phlax@users.noreply.github.com> Co-authored-by: River <6375745+RiverPhillips@users.noreply.github.com> Co-authored-by: Piotr Sikora <piotrsikora@google.com> Co-authored-by: Keith Smiley <keithbsmiley@gmail.com> Co-authored-by: Dhi Aurrahman <dio@rockybars.com>

Signed-off-by: Ryan Northey <ryan@synca.io>

…ian11:nonroot) (#24647) Signed-off-by: Michael Kaufmann <michael.kaufmann@ergon.ch> Signed-off-by: Michael Kaufmann <mkauf@users.noreply.github.com>

…0562a7` in /ci (#24736) build(deps): bump distroless/base-nossl-debian11 in /ci Bumps distroless/base-nossl-debian11 from `036581b` to `50562a7`. --- updated-dependencies: - dependency-name: distroless/base-nossl-debian11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Ryan Northey <ryan@synca.io>

…ee458a` in /ci (#24830) build(deps): bump distroless/base-nossl-debian11 in /ci Bumps distroless/base-nossl-debian11 from `6f20a31` to `3ee458a`. --- updated-dependencies: - dependency-name: distroless/base-nossl-debian11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…d7fe70` in /ci (#25153) build(deps): bump distroless/base-nossl-debian11 in /ci Bumps distroless/base-nossl-debian11 from `3ee458a` to `cd7fe70`. --- updated-dependencies: - dependency-name: distroless/base-nossl-debian11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Ryan Northey <ryan@synca.io>

…f61596` in /ci (#25291) build(deps): bump distroless/base-nossl-debian11 in /ci Bumps distroless/base-nossl-debian11 from `cd7fe70` to `bf61596`. --- updated-dependencies: - dependency-name: distroless/base-nossl-debian11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Ryan Northey <ryan@synca.io>

…wasm patch

jwendell · 2023-02-27T14:45:05Z

bazel/repositories.bzl

-        # patches = ["@envoy//bazel/external:proxy-wasm-cpp-host-s390x-support.patch"],
-        # patch_args = ["-p1"],
-    )
+    external_http_archive(name = "proxy_wasm_cpp_host")


If I understand correctly the upstream fix is only present in our 2.4 branch, so I think we still need this in 2.3.

jwendell · 2023-02-27T14:48:53Z

test/extensions/filters/udp/dns_filter/dns_filter_test.cc


-TEST_F(DnsFilterTest, RandomizeFirstAnswerTest) {
+// FIXME (Maistra): See https://github.com/envoyproxy/envoy/pull/24330
+TEST_F(DnsFilterTest, DISABLED_RandomizeFirstAnswerTest) {


Do you want to track this in our Jira? If so, create an issue and mention it here.

BTW, next time it might be easier to just cherry-pick the commit from one branch to another, e.g. git cherry-pick d032ce917328e388d40c3fe5ba1a49c3b570486d. This preserves the original metadata (title, author, etc).

jwendell · 2023-02-27T15:06:00Z

bazel/repository_locations.bzl

        strip_prefix = "compiler-rt-{version}.src",
        urls = ["https://github.com/llvm/llvm-project/releases/download/llvmorg-{version}/compiler-rt-{version}.src.tar.xz"],
-        release_date = "2021-07-09",
+        release_date = "2022-03-23",


I think you could just cherry-pick / use my commit, which has a better message: jwendell@bf597f3

And probably you should mention OSSM-3429 in the commit title (which my commit message does), which I think should not have been closed until the fix is actually merged.

twghu · 2023-02-28T22:36:16Z

Closing as replaced with #234

soulxu and others added 30 commits August 11, 2022 16:23

connection handler: correct the handling of listener update (#22643)

5caf0b0

Signed-off-by: Alex Xu <hejie.xu@intel.com>

repo: Release 1.22.5 (#22556)

2ba6db6

Signed-off-by: Ryan Northey <ryan@synca.io>

[v1.22] ci: disable non-RBE cache for release branches (#22745)

fee1c20

ci: disable non-RBE cache for release branches Signed-off-by: Lizan Zhou <lizan@tetrate.io>

repo: Dev 1.22.6 (#23856)

b80d293

Signed-off-by: Ryan Northey <ryan@synca.io>

deps: fix mismatch release date in OpenCensus Proto (#23220)

ba44f65

Signed-off-by: Xie Zhihao <zhihao.xie@intel.com> Signed-off-by: Ryan Northey <ryan@synca.io>

codeql-fix

cd49529

Signed-off-by: Ryan Northey <ryan@synca.io>

refresh certs for tls and ocsp tests

3c8c534

Signed-off-by: wbpcode <wangbaiping@corp.netease.com> Signed-off-by: Ryan Northey <ryan@synca.io>

api/deps: Fix bufbuild links

cf976ae

Signed-off-by: Ryan Northey <ryan@synca.io>

wasm: update proxy-wasm to apply canary always (#22469)

15fd1cb

Signed-off-by: Ingwon Song <igsong@google.com> Signed-off-by: Ingwon Song <102102227+ingwonsong@users.noreply.github.com> Signed-off-by: Ryan Northey <ryan@synca.io>

wasm: update Wasmtime to v0.39.1. (#22490)

d0ab9f7

Signed-off-by: Piotr Sikora <piotrsikora@google.com> Signed-off-by: Ryan Northey <ryan@synca.io>

wasm: update V8 to v10.4.132.18. (#22154)

ff41a36

Signed-off-by: Piotr Sikora <piotrsikora@google.com> Signed-off-by: Ryan Northey <ryan@synca.io>

wasm: set upper limit for maximum Wasm memory size when using V8. (#2…

10bb0b9

…2117) Signed-off-by: Piotr Sikora <piotrsikora@google.com> Signed-off-by: Ryan Northey <ryan@synca.io>

wasm: update WAMR to WAMR-05-18-2022. (#22157)

ebc710b

Signed-off-by: Piotr Sikora <piotrsikora@google.com>

kafka: upgrade dependencies to 3.2.0 (requires new composite deserial…

2aa7ab5

…izer for 12 fields) (#21414) Signed-off-by: Adam Kotwasinski <adam.kotwasinski@gmail.com> Signed-off-by: Ryan Northey <ryan@synca.io>

kafka: upgrade kafka deps to 3.2.3 (mitigate CVE-2022-34917) (#23311)

d98ea80

Signed-off-by: Adam Kotwasinski <adam.kotwasinski@gmail.com> Signed-off-by: Ryan Northey <ryan@synca.io>

kafka: upgrade to kafka 3.3.1 (#23354)

2cbe138

Signed-off-by: Adam Kotwasinski <adam.kotwasinski@gmail.com> Signed-off-by: Ryan Northey <ryan@synca.io>

docker: Bump distroless/base-debian11:nonroot -> 4b22ca3c6 (#23987)

a22bd18

Signed-off-by: Ryan Northey <ryan@synca.io>

listener: fix flaky listener integration test (#22383)

63c3f4d

Signed-off-by: He Jie Xu <hejie.xu@intel.com> Signed-off-by: Ryan Northey <ryan@synca.io>

deps: Bump com_github_curl -> 7.86.0 (#23688)

c08e6e3

Fix #23685 Signed-off-by: Ryan Northey <ryan@synca.io> Signed-off-by: phlax <phlax@users.noreply.github.com>

test: fixing lds flake (#24071)

dcf0599

Signed-off-by: Alyssa Wilk <alyssar@chromium.org> Signed-off-by: Ryan Northey <ryan@synca.io>

repo: Release 1.22.6

28872e8

Signed-off-by: Ryan Northey <ryan@synca.io>

repo: Dev 1.22.7

89016d7

Signed-off-by: Ryan Northey <ryan@synca.io>

ci: Add noop circleci config

5a63671

Signed-off-by: Ryan Northey <ryan@synca.io>

ci: Fix flakey coverage

f2404ab

Signed-off-by: Ryan Northey <ryan@synca.io>

docker: Use the distroless base image without OpenSSL (base-nossl-deb…

798afd1

…ian11:nonroot) (#24647) Signed-off-by: Michael Kaufmann <michael.kaufmann@ergon.ch> Signed-off-by: Michael Kaufmann <mkauf@users.noreply.github.com>

dependabot bot and others added 5 commits January 4, 2023 16:32

merge-wip-1

22b0671

twghu requested a review from jwendell February 8, 2023 10:23

maistra-bot added the size/XXL label Feb 8, 2023

jwendell added the merge strategy label Feb 8, 2023

twghu added the do-not-merge label Feb 16, 2023

twghurh added 4 commits February 20, 2023 22:28

Added update to compiler-rt to fix missing limits header

f26f6ad

proxy-wasm-cpp-host commit 483ecfd moved and refactored code used in …

5ec97d9

…wasm patch

Update to match changes for PR 232

938d704

Disabled test

5779270

jwendell reviewed Feb 27, 2023

View reviewed changes

twghu requested a review from tedjpoole February 28, 2023 12:00

twghu closed this Feb 28, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Maistra 2.3.2#225

Maistra 2.3.2#225
twghu wants to merge 39 commits intomaistra:maistra-2.3from
twghu:maistra-2.3.2

twghu commented Feb 8, 2023

Uh oh!

jwendell Feb 27, 2023

Uh oh!

jwendell Feb 27, 2023

Uh oh!

jwendell Feb 27, 2023

Uh oh!

jwendell Feb 27, 2023

Uh oh!

twghu commented Feb 28, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

16 participants

Conversation

twghu commented Feb 8, 2023

Uh oh!

jwendell Feb 27, 2023

Choose a reason for hiding this comment

Uh oh!

jwendell Feb 27, 2023

Choose a reason for hiding this comment

Uh oh!

jwendell Feb 27, 2023

Choose a reason for hiding this comment

Uh oh!

jwendell Feb 27, 2023

Choose a reason for hiding this comment

Uh oh!

twghu commented Feb 28, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

16 participants