sync from master.

.bazelrc

@@ -14,7 +14,7 @@ run --color=yes
 
 build --color=yes
 build --workspace_status_command="bash bazel/get_workspace_status"
-build --experimental_strict_action_env=true
+build --incompatible_strict_action_env
 build --host_force_python=PY3
 build --host_javabase=@bazel_tools//tools/jdk:remote_jdk11
 build --javabase=@bazel_tools//tools/jdk:remote_jdk11
@@ -79,6 +79,8 @@ build:clang-asan --linkopt -fuse-ld=lld
 
 # macOS ASAN/UBSAN
 build:macos --cxxopt=-std=c++17
+build:macos --action_env=PATH=/usr/bin:/bin:/opt/homebrew/bin:/usr/local/bin:/opt/local/bin
+build:macos --host_action_env=PATH=/usr/bin:/bin:/opt/homebrew/bin:/usr/local/bin:/opt/local/bin
 
 build:macos-asan --config=asan
 # Workaround, see https://github.com/bazelbuild/bazel/issues/6932

.github/actions/pr_notifier/pr_notifier.py

@@ -128,8 +128,12 @@ def track_prs():
         # If the PR is waiting, continue.
         if is_waiting(labels):
             continue
+        # Drafts are not covered by our SLO (repokitteh warns of this)
         if pr_info.draft:
             continue
+        # Don't warn for dependabot.
+        if pr_info.user.login == 'dependabot[bot]':
+            continue
 
         # Update the time based on the time zone delta from github's
         pr_age = pr_info.updated_at - datetime.timedelta(hours=4)

.github/dependabot.yml

@@ -21,6 +21,11 @@ updates:
   schedule:
     interval: "daily"
 
+- package-ecosystem: "pip"
+  directory: "/tools/base"
+  schedule:
+    interval: "daily"
+
 - package-ecosystem: "pip"
   directory: "/tools/docs"
   schedule:
@@ -41,6 +46,11 @@ updates:
   schedule:
     interval: "daily"
 
+- package-ecosystem: "pip"
+  directory: "/tools/docker"
+  schedule:
+    interval: "daily"
+
 - package-ecosystem: "pip"
   directory: "/tools/dependency"
   schedule:
@@ -52,7 +62,7 @@ updates:
     interval: "daily"
 
 - package-ecosystem: "pip"
-  directory: "/tools/extensions"
+  directory: "/tools/gpg"
   schedule:
     interval: "daily"
 

.gitignore

@@ -38,3 +38,5 @@ cmake-build-debug
 bazel.output.txt
 *~
 .coverage
+**/.DS_Store
+**/*.iml

RELEASES.md

@@ -71,6 +71,7 @@ deadline of 3 weeks.
 | 1.16.0  | 2020/09/30 | 2020/10/08 |   +8 days  | 2021/10/08  |
 | 1.17.0  | 2020/12/31 | 2021/01/11 |  +11 days  | 2022/01/11  |
 | 1.18.0  | 2021/03/31 | 2021/04/15 |  +15 days  | 2022/04/15  |
-| 1.19.0  | 2021/06/30 |            |            |             |
+| 1.19.0  | 2021/06/30 | 2021/07/13 |  +13 days  | 2022/07/13  |
+| 1.20.0  | 2021/09/30 |            |            |             |
 
 [repokitteh]: https://github.com/repokitteh

api/BUILD

@@ -22,11 +22,6 @@ proto_library(
         "//envoy/config/common/dynamic_forward_proxy/v2alpha:pkg",
         "//envoy/config/filter/accesslog/v2:pkg",
         "//envoy/config/filter/fault/v2:pkg",
-        "//envoy/config/filter/http/compressor/v2:pkg",
-        "//envoy/config/filter/http/ext_authz/v2:pkg",
-        "//envoy/config/filter/http/gzip/v2:pkg",
-        "//envoy/config/filter/http/health_check/v2:pkg",
-        "//envoy/config/filter/http/ip_tagging/v2:pkg",
         "//envoy/config/filter/network/http_connection_manager/v2:pkg",
         "//envoy/config/filter/network/redis_proxy/v2:pkg",
         "//envoy/config/filter/network/tcp_proxy/v2:pkg",

api/envoy/api/v2/listener/listener_components.proto

@@ -230,7 +230,7 @@ message FilterChain {
 //    rules:
 //      - destination_port_range:
 //          start: 3306
-//          end: 3306
+//          end: 3307
 //      - destination_port_range:
 //          start: 15000
 //          end: 15001

api/envoy/config/bootstrap/v3/bootstrap.proto

@@ -40,7 +40,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // <config_overview_bootstrap>` for more detail.
 
 // Bootstrap :ref:`configuration overview <config_overview_bootstrap>`.
-// [#next-free-field: 32]
+// [#next-free-field: 33]
 message Bootstrap {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.bootstrap.v2.Bootstrap";
@@ -322,6 +322,13 @@ message Bootstrap {
   // field.
   // [#not-implemented-hide:]
   map<string, core.v3.TypedExtensionConfig> certificate_provider_instances = 25;
+
+  // Specifies a set of headers that need to be registered as inline header. This configuration
+  // allows users to customize the inline headers on-demand at Envoy startup without modifying
+  // Envoy's source code.
+  //
+  // Note that the 'set-cookie' header cannot be registered as inline header.
+  repeated CustomInlineHeader inline_headers = 32;
 }
 
 // Administration interface :ref:`operations documentation
@@ -595,3 +602,43 @@ message LayeredRuntime {
   // such that later layers in the list overlay earlier entries.
   repeated RuntimeLayer layers = 1;
 }
+
+// Used to specify the header that needs to be registered as an inline header.
+//
+// If request or response contain multiple headers with the same name and the header
+// name is registered as an inline header. Then multiple headers will be folded
+// into one, and multiple header values will be concatenated by a suitable delimiter.
+// The delimiter is generally a comma.
+//
+// For example, if 'foo' is registered as an inline header, and the headers contains
+// the following two headers:
+//
+// .. code-block:: text
+//
+//   foo: bar
+//   foo: eep
+//
+// Then they will eventually be folded into:
+//
+// .. code-block:: text
+//
+//   foo: bar, eep
+//
+// Inline headers provide O(1) search performance, but each inline header imposes
+// an additional memory overhead on all instances of the corresponding type of
+// HeaderMap or TrailerMap.
+message CustomInlineHeader {
+  enum InlineHeaderType {
+    REQUEST_HEADER = 0;
+    REQUEST_TRAILER = 1;
+    RESPONSE_HEADER = 2;
+    RESPONSE_TRAILER = 3;
+  }
+
+  // The name of the header that is expected to be set as the inline header.
+  string inline_header_name = 1
+      [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}];
+
+  // The type of the header that is expected to be set as the inline header.
+  InlineHeaderType inline_header_type = 2 [(validate.rules).enum = {defined_only: true}];
+}

api/envoy/config/cluster/v3/cluster.proto

@@ -746,7 +746,11 @@ message Cluster {
   // is respected by both the HTTP/1.1 and HTTP/2 connection pool
   // implementations. If not specified, there is no limit. Setting this
   // parameter to 1 will effectively disable keep alive.
-  google.protobuf.UInt32Value max_requests_per_connection = 9;
+  //
+  // .. attention::
+  //   This field has been deprecated in favor of the :ref:`max_requests_per_connection <envoy_v3_api_field_config.core.v3.HttpProtocolOptions.max_requests_per_connection>` field.
+  google.protobuf.UInt32Value max_requests_per_connection = 9
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Optional :ref:`circuit breaking <arch_overview_circuit_break>` for the cluster.
   CircuitBreakers circuit_breakers = 10;

api/envoy/config/core/v3/protocol.proto

@@ -93,7 +93,7 @@ message AlternateProtocolsCacheOptions {
   google.protobuf.UInt32Value max_entries = 2 [(validate.rules).uint32 = {gt: 0}];
 }
 
-// [#next-free-field: 6]
+// [#next-free-field: 7]
 message HttpProtocolOptions {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.api.v2.core.HttpProtocolOptions";
@@ -157,6 +157,12 @@ message HttpProtocolOptions {
   // If this setting is not specified, the value defaults to ALLOW.
   // Note: upstream responses are not affected by this setting.
   HeadersWithUnderscoresAction headers_with_underscores_action = 5;
+
+  // Optional maximum requests for both upstream and downstream connections.
+  // If not specified, there is no limit.
+  // Setting this parameter to 1 will effectively disable keep alive.
+  // For HTTP/2 and HTTP/3, due to concurrent stream processing, the limit is approximate.
+  google.protobuf.UInt32Value max_requests_per_connection = 6;
 }
 
 // [#next-free-field: 8]

api/envoy/config/listener/v3/api_listener.proto

@@ -23,6 +23,7 @@ message ApiListener {
   // The type in this field determines the type of API listener. At present, the following
   // types are supported:
   // envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager (HTTP)
+  // envoy.extensions.filters.network.http_connection_manager.v3.EnvoyMobileHttpConnectionManager (HTTP)
   // [#next-major-version: In the v3 API, replace this Any field with a oneof containing the
   // specific config message for each type of API listener. We could not do this in v2 because
   // it would have caused circular dependencies for go protos: lds.proto depends on this file,

api/envoy/config/listener/v3/listener.proto

@@ -35,7 +35,7 @@ message ListenerCollection {
   repeated xds.core.v3.CollectionEntry entries = 1;
 }
 
-// [#next-free-field: 29]
+// [#next-free-field: 30]
 message Listener {
   option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.Listener";
 
@@ -255,17 +255,30 @@ message Listener {
   // enable the balance config in Y1 and Y2 to balance the connections among the workers.
   ConnectionBalanceConfig connection_balance_config = 20;
 
+  // Deprecated. Use `enable_reuse_port` instead.
+  bool reuse_port = 21 [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
+
   // When this flag is set to true, listeners set the *SO_REUSEPORT* socket option and
   // create one socket for each worker thread. This makes inbound connections
   // distribute among worker threads roughly evenly in cases where there are a high number
-  // of connections. When this flag is set to false, all worker threads share one socket.
+  // of connections. When this flag is set to false, all worker threads share one socket. This field
+  // defaults to true.
+  //
+  // .. attention::
+  //
+  //   Although this field defaults to true, it has different behavior on different platforms. See
+  //   the following text for more information.
   //
-  // Before Linux v4.19-rc1, new TCP connections may be rejected during hot restart
-  // (see `3rd paragraph in 'soreuseport' commit message
-  // <https://github.com/torvalds/linux/commit/c617f398edd4db2b8567a28e89>`_).
-  // This issue was fixed by `tcp: Avoid TCP syncookie rejected by SO_REUSEPORT socket
-  // <https://github.com/torvalds/linux/commit/40a1227ea845a37ab197dd1caffb60b047fa36b1>`_.
-  bool reuse_port = 21;
+  // * On Linux, reuse_port is respected for both TCP and UDP listeners. It also works correctly
+  //   with hot restart.
+  // * On macOS, reuse_port for TCP does not do what it does on Linux. Instead of load balancing,
+  //   the last socket wins and receives all connections/packets. For TCP, reuse_port is force
+  //   disabled and the user is warned. For UDP, it is enabled, but only one worker will receive
+  //   packets. For QUIC/H3, SW routing will send packets to other workers. For "raw" UDP, only
+  //   a single worker will currently receive packets.
+  // * On Windows, reuse_port for TCP has undefined behavior. It is force disabled and the user
+  //   is warned similar to macOS. It is left enabled for UDP with undefined behavior currently.
+  google.protobuf.BoolValue enable_reuse_port = 29;
 
   // Configuration for :ref:`access logs <arch_overview_access_logs>`
   // emitted by this listener.

api/envoy/config/listener/v3/listener_components.proto

@@ -290,7 +290,7 @@ message FilterChain {
 //    rules:
 //      - destination_port_range:
 //          start: 3306
-//          end: 3306
+//          end: 3307
 //      - destination_port_range:
 //          start: 15000
 //          end: 15001