Envoy 1.29

.bazelversion

@@ -1 +1 @@
-6.1.0
+6.3.2

api/envoy/config/filter/http/transformation/v2/BUILD

@@ -16,7 +16,7 @@ api_proto_package(
         "@envoy_api//envoy/type:pkg",
         "@envoy_api//envoy/type/matcher/v3:pkg",
         "@envoy_api//envoy/type/matcher:pkg",
-        "@com_github_cncf_udpa//xds/type/matcher/v3:pkg",
+        "@com_github_cncf_xds//xds/type/matcher/v3:pkg",
     ],
     visibility = ["//visibility:public"],
 )

bazel/extensions/extensions_build_config.bzl

@@ -124,6 +124,7 @@ EXTENSIONS = {
     "envoy.filters.http.aws_lambda":                    "//source/extensions/filters/http/aws_lambda:config",
     "envoy.filters.http.aws_request_signing":           "//source/extensions/filters/http/aws_request_signing:config",
     "envoy.filters.http.bandwidth_limit":               "//source/extensions/filters/http/bandwidth_limit:config",
+    "envoy.filters.http.basic_auth":                    "//source/extensions/filters/http/basic_auth:config",
     "envoy.filters.http.buffer":                        "//source/extensions/filters/http/buffer:config",
     "envoy.filters.http.cache":                         "//source/extensions/filters/http/cache:config",
     "envoy.filters.http.cdn_loop":                      "//source/extensions/filters/http/cdn_loop:config",
@@ -263,6 +264,19 @@ EXTENSIONS = {
     "envoy.tracers.skywalking":                         "//source/extensions/tracers/skywalking:config",
     "envoy.tracers.opentelemetry":                      "//source/extensions/tracers/opentelemetry:config",
 
+    #
+    # OpenTelemetry Resource Detectors
+    #
+
+    "envoy.tracers.opentelemetry.resource_detectors.environment":         "//source/extensions/tracers/opentelemetry/resource_detectors/environment:config",
+    "envoy.tracers.opentelemetry.resource_detectors.dynatrace":           "//source/extensions/tracers/opentelemetry/resource_detectors/dynatrace:config",
+
+    #
+    # OpenTelemetry tracer samplers
+    #
+
+    "envoy.tracers.opentelemetry.samplers.always_on":         "//source/extensions/tracers/opentelemetry/samplers/always_on:config",
+
     #
     # Transport sockets
     #
@@ -482,6 +496,12 @@ EXTENSIONS = {
     # Geolocation Provider
     #
     # "envoy.geoip_providers.maxmind":                         "//source/extensions/geoip_providers/maxmind:config",
+
+    #
+    # cluster specifier plugin
+    #
+
+    "envoy.router.cluster_specifier_plugin.lua": "//source/extensions/router/cluster_specifiers/lua:config",
 }
 
 # These can be changed to ["//visibility:public"], for  downstream builds which

bazel/repositories.bzl

@@ -66,10 +66,6 @@ def _repository_impl(name, **kwargs):
             )
 
 def envoy_gloo_dependencies():
-    # the following 2 patches are needed to support the deprecated cipher
-    # passthrough and only need to be backported onto envoy v1.25.x
-    # these should be removed when moving to v1.26.x since this code exists in
-    # upstream at that point.
     _repository_impl("envoy")
     _repository_impl("json", build_file = "@envoy_gloo//bazel/external:json.BUILD")
     _repository_impl("inja", build_file = "@envoy_gloo//bazel/external:inja.BUILD")

bazel/repository_locations.bzl

@@ -1,7 +1,7 @@
 REPOSITORY_LOCATIONS = dict(
     envoy = dict(
-        # envoy 1.28.1 with backported ext_proc updates
-        commit = "47d4c36d399b9daae47cd7f6c4d41cf75e7e3ff8",
+        # envoy 1.29.2 with backported ext_proc updates
+        commit = "b5c77750dc0f9de19478c89776f580fb9336fc99",
         remote = "https://github.com/solo-io/envoy-fork",
     ),
     inja = dict(

changelog/v1.29.2-patch1/bump-envoy.yaml

@@ -0,0 +1,8 @@
+changelog:
+- type: DEPENDENCY_BUMP
+  dependencyOwner: solo-io
+  dependencyRepo: envoy-fork
+  dependencyTag: v1.29.2
+  resolvesIssue: false
+  description: >-
+    Update Envoy to latest from forked 1.29.2

ci/do_ci.sh

@@ -1,11 +1,13 @@
 #!/bin/bash
 set -e
 
-if [ -n "$ENVOY_DOCKER_BUILD_DIR" ]; then
-  rm -rf "$ENVOY_DOCKER_BUILD_DIR/envoy/x64/bin/"
-else
-  rm -rf "/build/envoy/x64/bin/"
+if [ -z "$BUILD_DIR" ]; then
+  BUILD_DIR=/build
+  echo "using build dir: ${BUILD_DIR}"
+else 
+  echo "using pre-defined build dir: ${BUILD_DIR}"
 fi
+export BUILD_DIR
 
 bazel fetch //source/exe:envoy-static
 
@@ -32,6 +34,7 @@ fi
 export ENVOY_SRCDIR=$SOURCE_DIR
 
 # google cloud build times out when using full throttle.
+# additionally, we see builds killed due to OOM at high concurrency.
 export NUM_CPUS=10
 
 # google cloud build doesn't like ipv6
@@ -42,9 +45,11 @@ export BAZEL_EXTRA_TEST_OPTIONS="--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test
 export ENVOY_CONTRIB_BUILD_TARGET="//source/exe:envoy-static"
 export ENVOY_CONTRIB_BUILD_DEBUG_INFORMATION="//source/exe:envoy-static.dwp"
 
+export BAZEL_BUILD_EXTRA_OPTIONS
 BAZEL_BUILD_EXTRA_OPTIONS+=" --remote_cache=${BAZEL_REMOTE_CACHE}"
 
-export  GCP_SERVICE_ACCOUNT_KEY_PATH=$(mktemp -t gcp_service_account.XXXXXX.json)
+export GCP_SERVICE_ACCOUNT_KEY_PATH
+GCP_SERVICE_ACCOUNT_KEY_PATH=$(mktemp -t gcp_service_account.XXXXXX.json)
 echo "${GCP_SERVICE_ACCOUNT_KEY}" | base64 --decode > "${GCP_SERVICE_ACCOUNT_KEY_PATH}"
 BAZEL_BUILD_EXTRA_OPTIONS+=" --google_credentials=${GCP_SERVICE_ACCOUNT_KEY_PATH}"
 

source/extensions/filters/http/aws_lambda/aws_lambda_filter_config_factory.cc

@@ -17,21 +17,27 @@ AWSLambdaFilterConfigFactory::createFilterFactoryFromProtoTyped(
         &proto_config,
     const std::string &stats_prefix,
     Server::Configuration::FactoryContext &context) {
+  auto& server_context = context.serverFactoryContext();
 
-
+  // ServerFactoryContext::clusterManager() is not available during server initialization
+  // therefore we need to pass absl::nullopt in lieu of the server_context to prevent
+  // the upstream code from attempting to access the method. https://github.com/envoyproxy/envoy/issues/26653
   auto chain = std::make_unique<Extensions::Common::Aws::DefaultCredentialsProviderChain>(
-          context.api(), Extensions::Common::Aws::Utility::fetchMetadata);
-  auto sts_factory = StsCredentialsProviderFactory::create(context.api(),
-                                            context.clusterManager());
+          server_context.api(), absl::nullopt /* ServerFactoryContextOptRef context */,
+          // We pass an empty string if we don't have a region
+          proto_config.has_service_account_credentials() ? proto_config.service_account_credentials().region() : "",
+          Extensions::Common::Aws::Utility::fetchMetadata);
+  auto sts_factory = StsCredentialsProviderFactory::create(server_context.api(),
+                                            server_context.clusterManager());
   auto config = std::make_shared<AWSLambdaConfigImpl>(std::move(chain),
       std::move(sts_factory),
-      context.mainThreadDispatcher(), context.api(), context.threadLocal(), stats_prefix,
-      context.scope(), proto_config);
+      server_context.mainThreadDispatcher(), server_context.api(), server_context.threadLocal(), stats_prefix,
+      server_context.scope(), proto_config);
   return
-      [&context, config]
+      [&server_context, config]
       (Http::FilterChainFactoryCallbacks &callbacks) -> void {
         callbacks.addStreamFilter(std::make_shared<AWSLambdaFilter>(
-            context.clusterManager(), context.api(), config));
+            server_context.clusterManager(), server_context.api(), config));
       };
 }
 

source/extensions/filters/http/aws_lambda/sts_credentials_provider.h

@@ -62,6 +62,7 @@ class StsCredentialsProviderFactory {
 
   static StsCredentialsProviderFactoryPtr create(Api::Api &api,
                                                  Upstream::ClusterManager &cm);
+
 };
 
 } // namespace AwsLambda

source/extensions/filters/http/nats/streaming/nats_streaming_filter_config_factory.cc

@@ -24,7 +24,7 @@ NatsStreamingFilterConfigFactory::createFilterFactoryFromProtoTyped(
 
   NatsStreamingFilterConfigSharedPtr config =
       std::make_shared<NatsStreamingFilterConfig>(
-          NatsStreamingFilterConfig(proto_config, context.clusterManager()));
+          NatsStreamingFilterConfig(proto_config, context.serverFactoryContext().clusterManager()));
 
   Tcp::ConnPoolNats::ClientFactory<Envoy::Nats::Message> &client_factory =
       Tcp::ConnPoolNats::ClientFactoryImpl<Envoy::Nats::Message,
@@ -33,8 +33,8 @@ NatsStreamingFilterConfigFactory::createFilterFactoryFromProtoTyped(
 
   Envoy::Nats::Streaming::ClientPtr nats_streaming_client =
       std::make_shared<Envoy::Nats::Streaming::ClientPool>(
-          config->cluster(), context.clusterManager(), client_factory,
-          context.threadLocal(), context.api().randomGenerator(), config->opTimeout());
+          config->cluster(), context.serverFactoryContext().clusterManager(), client_factory,
+          context.serverFactoryContext().threadLocal(), context.serverFactoryContext().api().randomGenerator(), config->opTimeout());
 
   return [config, nats_streaming_client](
              Envoy::Http::FilterChainFactoryCallbacks &callbacks) -> void {

source/extensions/filters/http/transformation/transformation_filter_config.cc

@@ -29,7 +29,7 @@ void TransformationFilterConfig::addTransformationLegacy(
           request_transformation, response_transformation,
           on_stream_completion_transformation, clear_route_cache);
   if (rule.has_route_transformations()) {
-    transformer_pair = createTransformations(rule.route_transformations(), context);
+    transformer_pair = createTransformations(rule.route_transformations(), context.serverFactoryContext());
   }
   transformer_pairs_.emplace_back(MatcherCopy::Matcher::create(rule.match()),
                                   transformer_pair);
@@ -38,10 +38,10 @@ void TransformationFilterConfig::addTransformationLegacy(
 TransformationFilterConfig::TransformationFilterConfig(
     const TransformationConfigProto &proto_config, const std::string &prefix,
     Server::Configuration::FactoryContext &context)
-    : FilterConfig(prefix, context.scope(), proto_config.stage(),
+    : FilterConfig(prefix, context.serverFactoryContext().scope(), proto_config.stage(),
                    proto_config.log_request_response_info()) {
     if (proto_config.has_matcher()) {
-      matcher_ = createTransformationMatcher(proto_config.matcher(), context.getServerFactoryContext());
+      matcher_ = createTransformationMatcher(proto_config.matcher(), context.serverFactoryContext());
       return;
     }
   for (const auto &rule : proto_config.transformations()) {

test/extensions/filters/http/aws_lambda/aws_lambda_filter_test.cc

@@ -83,8 +83,8 @@ class AWSLambdaFilterTest : public testing::Test {
   void setupRoute(bool sessionToken = false, bool noCredentials = false,
                 bool persistOriginalHeaders = false, bool unwrapAsAlb = false,
                 bool unmanagedCredentials = false, bool unwrapAsApiGateway = false) {
-    factory_context_.cluster_manager_.initializeClusters({"fake_cluster"}, {});
-    factory_context_.cluster_manager_.initializeThreadLocalClusters({"fake_cluster"});
+    factory_context_.server_factory_context_.cluster_manager_.initializeClusters({"fake_cluster"}, {});
+    factory_context_.server_factory_context_.cluster_manager_.initializeThreadLocalClusters({"fake_cluster"});
 
     routeconfig_.set_name("func");
     routeconfig_.set_qualifier("v1");
@@ -131,15 +131,15 @@ class AWSLambdaFilterTest : public testing::Test {
     filter_config_->propagate_original_routing_=persistOriginalHeaders;
 
     ON_CALL(
-        *factory_context_.cluster_manager_.thread_local_cluster_.cluster_.info_,
+        *factory_context_.server_factory_context_.cluster_manager_.thread_local_cluster_.cluster_.info_,
         extensionProtocolOptions(SoloHttpFilterNames::get().AwsLambda))
         .WillByDefault(
             Return(std::make_shared<AWSLambdaProtocolExtensionConfig>(
                 protoextconfig)));
 
 
     filter_ = std::make_unique<AWSLambdaFilter>(
-        factory_context_.cluster_manager_, factory_context_.api_,
+        factory_context_.server_factory_context_.cluster_manager_, factory_context_.server_factory_context_.api_,
         filter_config_);
     filter_->setDecoderFilterCallbacks(filter_callbacks_);
 
@@ -402,7 +402,7 @@ TEST_F(AWSLambdaFilterTest, SignsDataSetByPreviousFilters) {
   auto hex_sha1 = auth1.getBodyHexSha();
 
   filter_ = std::make_unique<AWSLambdaFilter>(
-      factory_context_.cluster_manager_, factory_context_.api_,
+      factory_context_.server_factory_context_.cluster_manager_, factory_context_.server_factory_context_.api_,
       filter_config_);
   filter_->setDecoderFilterCallbacks(filter_callbacks_);
 
@@ -423,7 +423,7 @@ TEST_F(AWSLambdaFilterTest, SignsDataSetByPreviousFilters) {
   EXPECT_EQ(hex_sha1, hex_sha2);
 
   filter_ = std::make_unique<AWSLambdaFilter>(
-      factory_context_.cluster_manager_, factory_context_.api_,
+      factory_context_.server_factory_context_.cluster_manager_, factory_context_.server_factory_context_.api_,
       filter_config_);
   filter_->setDecoderFilterCallbacks(filter_callbacks_);
 

test/extensions/filters/http/aws_lambda/aws_lambda_transformer_test.cc

@@ -76,8 +76,8 @@ class AWSLambdaTransformerTest : public testing::Test,
   }
 
   void setupRoute(bool unwrapAsApiGateway = false, bool wrapAsApiGateway = false) {
-    factory_context_.cluster_manager_.initializeClusters({"fake_cluster"}, {});
-    factory_context_.cluster_manager_.initializeThreadLocalClusters({"fake_cluster"});
+    factory_context_.server_factory_context_.cluster_manager_.initializeClusters({"fake_cluster"}, {});
+    factory_context_.server_factory_context_.cluster_manager_.initializeThreadLocalClusters({"fake_cluster"});
 
     routeconfig_.set_name("func");
     routeconfig_.set_qualifier("v1");
@@ -109,14 +109,14 @@ class AWSLambdaTransformerTest : public testing::Test,
     filter_config_->propagate_original_routing_=false;
 
     ON_CALL(
-        *factory_context_.cluster_manager_.thread_local_cluster_.cluster_.info_,
+        *factory_context_.server_factory_context_.cluster_manager_.thread_local_cluster_.cluster_.info_,
         extensionProtocolOptions(SoloHttpFilterNames::get().AwsLambda))
         .WillByDefault(
             Return(std::make_shared<AWSLambdaProtocolExtensionConfig>(
                 protoextconfig)));
 
     filter_ = std::make_unique<AWSLambdaFilter>(
-        factory_context_.cluster_manager_, factory_context_.api_,
+        factory_context_.server_factory_context_.cluster_manager_, factory_context_.server_factory_context_.api_,
         filter_config_);
     filter_->setDecoderFilterCallbacks(filter_callbacks_);
   }

test/extensions/filters/http/aws_lambda/config_test.cc

@@ -49,9 +49,9 @@ class ConfigTest : public testing::Test {
 
   NiceMock<Event::MockTimer> *prepareTimer() {
     NiceMock<Event::MockTimer> *timer =
-        new NiceMock<Event::MockTimer>(&context_.dispatcher_);
+        new NiceMock<Event::MockTimer>(&context_.server_factory_context_.dispatcher_);
     protoconfig.mutable_use_default_credentials()->set_value(true);
-    EXPECT_CALL(context_.thread_local_, allocateSlot()).Times(1);
+    EXPECT_CALL(context_.server_factory_context_.thread_local_, allocateSlot()).Times(1);
     return timer;
   }
 
@@ -84,8 +84,8 @@ TEST_F(ConfigTest, WithUseDefaultCreds) {
   std::unique_ptr<NiceMock<MockStsCredentialsProviderFactory>> unique_factory{
       sts_factory_};
   auto config = std::make_shared<AWSLambdaConfigImpl>(
-      std::move(cred_provider), std::move(unique_factory), context_.dispatcher_,
-      context_.api_, context_.thread_local_, "prefix.", *stats_.rootScope(), protoconfig);
+      std::move(cred_provider), std::move(unique_factory), context_.server_factory_context_.dispatcher_,
+      context_.server_factory_context_.api_, context_.server_factory_context_.thread_local_, "prefix.", *stats_.rootScope(), protoconfig);
 
   NiceMock<MockStsContextCallbacks> callbacks_1;
 
@@ -150,8 +150,8 @@ TEST_F(ConfigTest, FailingToRotate) {
   std::unique_ptr<NiceMock<MockStsCredentialsProviderFactory>> unique_factory{
       sts_factory_};
   auto config = std::make_shared<AWSLambdaConfigImpl>(
-      std::move(cred_provider), std::move(unique_factory), context_.dispatcher_,
-      context_.api_, context_.thread_local_, "prefix.", *stats_.rootScope(), protoconfig);
+      std::move(cred_provider), std::move(unique_factory), context_.server_factory_context_.dispatcher_,
+      context_.server_factory_context_.api_, context_.server_factory_context_.thread_local_, "prefix.", *stats_.rootScope(), protoconfig);
 
   std::shared_ptr<const AWSLambdaProtocolExtensionConfig> ext_config_1 =
       std::make_shared<const AWSLambdaProtocolExtensionConfig>(protoextconfig);
@@ -200,8 +200,8 @@ TEST_F(ConfigTest, WithProtocolExtensionCreds) {
   std::unique_ptr<NiceMock<MockStsCredentialsProviderFactory>> unique_factory{
       sts_factory_};
   auto config = std::make_shared<AWSLambdaConfigImpl>(
-      std::move(cred_provider), std::move(unique_factory), context_.dispatcher_,
-      context_.api_, context_.thread_local_, "prefix.", *stats_.rootScope(), protoconfig);
+      std::move(cred_provider), std::move(unique_factory), context_.server_factory_context_.dispatcher_,
+      context_.server_factory_context_.api_, context_.server_factory_context_.thread_local_, "prefix.", *stats_.rootScope(), protoconfig);
 
   NiceMock<MockStsContextCallbacks> callbacks_1;
 
@@ -254,10 +254,10 @@ TEST_F(ConfigTest, WithStsCreds) {
   setenv("AWS_WEB_IDENTITY_TOKEN_FILE", "test", 1);
   setenv("AWS_ROLE_ARN", "test_arn", 1);
 
-  EXPECT_CALL(context_.api_.file_system_, fileExists(_))
+  EXPECT_CALL(context_.server_factory_context_.api_.file_system_, fileExists(_))
       .Times(1)
       .WillOnce(Return(true));
-  EXPECT_CALL(context_.api_.file_system_, fileReadToEnd(_))
+  EXPECT_CALL(context_.server_factory_context_.api_.file_system_, fileReadToEnd(_))
       .Times(1)
       .WillOnce(Return("web_token"));
 
@@ -273,15 +273,15 @@ TEST_F(ConfigTest, WithStsCreds) {
           }));
 
   auto watcher = new Filesystem::MockWatcher();
-  EXPECT_CALL(context_.dispatcher_, createFilesystemWatcher_())
+  EXPECT_CALL(context_.server_factory_context_.dispatcher_, createFilesystemWatcher_())
       .WillOnce(Return(watcher));
   EXPECT_CALL(*watcher, addWatch("test", _, _)).Times(1);
 
   std::unique_ptr<NiceMock<MockStsCredentialsProviderFactory>> unique_factory{
       sts_factory_};
   auto config = std::make_shared<AWSLambdaConfigImpl>(
-      std::move(cred_provider), std::move(unique_factory), context_.dispatcher_,
-      context_.api_, context_.thread_local_, "prefix.", *stats_.rootScope(), protoconfig);
+      std::move(cred_provider), std::move(unique_factory), context_.server_factory_context_.dispatcher_,
+      context_.server_factory_context_.api_, context_.server_factory_context_.thread_local_, "prefix.", *stats_.rootScope(), protoconfig);
 
   NiceMock<MockStsContextCallbacks> callbacks;
 

test/extensions/filters/http/aws_lambda/sts_connection_pool_test.cc

@@ -83,7 +83,7 @@ TEST_F(StsConnectionPoolTest, TestSuccessfulCallback) {
   std::unique_ptr<testing::NiceMock<MockStsFetcher>> unique_fetcher{
       sts_fetcher_};
   auto sts_conn_pool = StsConnectionPool::create(
-      mock_factory_ctx_.api_, mock_factory_ctx_.dispatcher_, role_arn, role_arn,
+      mock_factory_ctx_.server_factory_context_.api_, mock_factory_ctx_.server_factory_context_.dispatcher_, role_arn, role_arn,
       &pool_callbacks, std::move(unique_fetcher));
 
   // Fetch credentials first call as they are not in the cache
@@ -133,7 +133,7 @@ TEST_F(StsConnectionPoolTest, TestPostInitAdd) {
   std::unique_ptr<testing::NiceMock<MockStsFetcher>> unique_fetcher{
       sts_fetcher_};
   auto sts_conn_pool = StsConnectionPool::create(
-      mock_factory_ctx_.api_, mock_factory_ctx_.dispatcher_, role_arn, role_arn,
+      mock_factory_ctx_.server_factory_context_.api_, mock_factory_ctx_.server_factory_context_.dispatcher_, role_arn, role_arn,
       &pool_callbacks, std::move(unique_fetcher));
 
   StsFetcher::Callbacks *lambda_callbacks;
@@ -154,7 +154,7 @@ TEST_F(StsConnectionPoolTest, TestPostInitAdd) {
   auto context_1 = sts_conn_pool->add(&ctx_callbacks);
 
   // Expect the context to be removed
-  EXPECT_CALL(mock_factory_ctx_.dispatcher_, deferredDelete_(_));
+  EXPECT_CALL(mock_factory_ctx_.server_factory_context_.dispatcher_, deferredDelete_(_));
 
   context_1->cancel();
 
@@ -193,7 +193,7 @@ TEST_F(StsConnectionPoolTest, TestFailure) {
   std::unique_ptr<testing::NiceMock<MockStsFetcher>> unique_fetcher{
       sts_fetcher_};
   auto sts_conn_pool = StsConnectionPool::create(
-      mock_factory_ctx_.api_, mock_factory_ctx_.dispatcher_, role_arn, role_arn,
+      mock_factory_ctx_.server_factory_context_.api_, mock_factory_ctx_.server_factory_context_.dispatcher_, role_arn, role_arn,
       &pool_callbacks, std::move(unique_fetcher));
 
   // Fetch credentials first call as they are not in the cache