wangfakang · wangfakang · Sep 6, 2021 · Jul 28, 2021 · Jul 28, 2021 · Jul 28, 2021
diff --git a/.azure-pipelines/cve_scan.yml b/.azure-pipelines/cve_scan.yml
@@ -4,13 +4,14 @@
 trigger: none
 pr: none
 
-schedules:
-- cron: "0 * * * *"
-  displayName: Hourly CVE scan
-  branches:
-    include:
-    - main
-  always: true
+# This appears to be broken right now so disabling until it is fixed.
+# schedules:
+# - cron: "0 * * * *"
+#   displayName: Hourly CVE scan
+#   branches:
+#     include:
+#     - main
+#   always: true
 
 pool:
   vmImage: "ubuntu-18.04"

diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
@@ -244,6 +244,8 @@ stages:
       matrix:
         api:
           CI_TARGET: "bazel.api"
+        api_compat:
+          CI_TARGET: "bazel.api_compat"
         gcc:
           CI_TARGET: "bazel.gcc"
         clang_tidy:
@@ -310,17 +312,33 @@ stages:
         itemPattern: "bazel.release/envoy_binary.tar.gz"
         downloadType: single
         targetPath: $(Build.StagingDirectory)
+    - task: DownloadBuildArtifacts@0
+      inputs:
+        buildType: current
+        artifactName: "bazel.release"
+        itemPattern: "bazel.release/envoy-contrib_binary.tar.gz"
+        downloadType: single
+        targetPath: $(Build.StagingDirectory)
     - task: DownloadBuildArtifacts@0
       inputs:
         buildType: current
         artifactName: "bazel.release.arm64"
         itemPattern: "bazel.release.arm64/envoy_binary.tar.gz"
         downloadType: single
         targetPath: $(Build.StagingDirectory)
+    - task: DownloadBuildArtifacts@0
+      inputs:
+        buildType: current
+        artifactName: "bazel.release.arm64"
+        itemPattern: "bazel.release.arm64/envoy-contrib_binary.tar.gz"
+        downloadType: single
+        targetPath: $(Build.StagingDirectory)
     - bash: |
         set -e
         mkdir -p linux/amd64 && tar zxf $(Build.StagingDirectory)/bazel.release/envoy_binary.tar.gz -C ./linux/amd64
+        tar zxf $(Build.StagingDirectory)/bazel.release/envoy-contrib_binary.tar.gz -C ./linux/amd64
         mkdir -p linux/arm64 && tar zxf $(Build.StagingDirectory)/bazel.release.arm64/envoy_binary.tar.gz -C ./linux/arm64
+        tar zxf $(Build.StagingDirectory)/bazel.release.arm64/envoy-contrib_binary.tar.gz -C ./linux/arm64
         ci/docker_ci.sh
       workingDirectory: $(Build.SourcesDirectory)
       env:

diff --git a/.bazelrc b/.bazelrc
@@ -76,6 +76,8 @@ build:asan --copt -fno-optimize-sibling-calls
 # Clang ASAN/UBSAN
 build:clang-asan --config=asan
 build:clang-asan --linkopt -fuse-ld=lld
+build:clang-asan --linkopt --rtlib=compiler-rt
+build:clang-asan --linkopt --unwindlib=libgcc
 
 # macOS ASAN/UBSAN
 build:macos --cxxopt=-std=c++17
@@ -220,7 +222,7 @@ build:remote --strategy=Javac=remote,sandboxed,local
 build:remote --strategy=Closure=remote,sandboxed,local
 build:remote --strategy=Genrule=remote,sandboxed,local
 build:remote --remote_timeout=7200
-build:remote --auth_enabled=true
+build:remote --google_default_credentials=true
 build:remote --remote_download_toplevel
 
 # Windows bazel does not allow sandboxed as a spawn strategy
@@ -229,7 +231,7 @@ build:remote-windows --strategy=Javac=remote,local
 build:remote-windows --strategy=Closure=remote,local
 build:remote-windows --strategy=Genrule=remote,local
 build:remote-windows --remote_timeout=7200
-build:remote-windows --auth_enabled=true
+build:remote-windows --google_default_credentials=true
 build:remote-windows --remote_download_toplevel
 
 build:remote-clang --config=remote

diff --git a/.dockerignore b/.dockerignore
@@ -3,8 +3,8 @@
 !/ci
 !/configs/google-vrp
 !/configs/*yaml
-!/linux/amd64/build_release*
-!/linux/arm64/build_release*
+!/linux/amd64/build_*release*
+!/linux/arm64/build_*release*
 !/local
 !/test/config/integration/certs
 !/windows
diff --git a/.gitattributes b/.gitattributes
@@ -1,5 +1,4 @@
 /docs/root/version_history/current.rst merge=union
-/api/envoy/**/v4alpha/* linguist-generated=true
 /generated_api_shadow/envoy/** linguist-generated=true
 /generated_api_shadow/bazel/** linguist-generated=true
 *.svg binary

diff --git a/.github/actions/pr_notifier/pr_notifier.py b/.github/actions/pr_notifier/pr_notifier.py
@@ -29,6 +29,21 @@
     'yanavlasov': 'UJHLR5KFS',
     'asraa': 'UKZKCFRTP',
     'davinci26': 'U013608CUDV',
+    'rojkov': 'UH5EXLYQK',
+}
+
+# First pass reviewers who are not maintainers should get
+# notifications but not result in a PR not getting assigned a
+# maintainer owner.
+FIRST_PASS = {
+    'adisuissa': 'UT17EMMTP',
+    'dmitri-d': 'UB1883Q5S',
+    'tonya11en': 'U989BG2CW',
+    'esmet': 'U01BCGBUUAE',
+    'KBaichoo': 'U016ZPU8KBK',
+    'wbpcode': 'U017KF5C0Q6',
+    'mathetake': 'UG9TD2FSB',
+    'RyanTheOptimist': 'U01SW3JC8GP',
 }
 
 # Only notify API reviewers who aren't maintainers.
@@ -73,19 +88,21 @@ def pr_message(pr_age, pr_url, pr_title, delta_days, delta_hours):
 
 
 # Adds reminder lines to the appropriate assignee to review the assigned PRs
-# Returns true if one of the assignees is in the known_assignee_map, false otherwise.
-def add_reminders(assignees, assignees_and_prs, message, known_assignee_map):
-    has_known_assignee = False
+# Returns true if one of the assignees is in the primary_assignee_map, false otherwise.
+def add_reminders(
+        assignees, assignees_and_prs, message, primary_assignee_map, first_pass_assignee_map):
+    has_primary_assignee = False
     for assignee_info in assignees:
         assignee = assignee_info.login
-        if assignee not in known_assignee_map:
+        if assignee in primary_assignee_map:
+            has_primary_assignee = True
+        elif assignee not in first_pass_assignee_map:
             continue
-        has_known_assignee = True
         if assignee not in assignees_and_prs.keys():
             assignees_and_prs[
                 assignee] = "Hello, %s, here are your PR reminders for the day \n" % assignee
         assignees_and_prs[assignee] = assignees_and_prs[assignee] + message
-    return has_known_assignee
+    return has_primary_assignee
 
 
 # Returns true if the PR needs an LGTM from an API shephard.
@@ -146,15 +163,15 @@ def track_prs():
         message = pr_message(delta, pr_info.html_url, pr_info.title, delta_days, delta_hours)
 
         if (needs_api_review(labels, repo, pr_info)):
-            add_reminders(pr_info.assignees, api_review_and_prs, message, API_REVIEWERS)
+            add_reminders(pr_info.assignees, api_review_and_prs, message, API_REVIEWERS, [])
 
         # If the PR has been out-SLO for over a day, inform on-call
         if delta > datetime.timedelta(hours=get_slo_hours() + 36):
             stalled_prs = stalled_prs + message
 
         # Add a reminder to each maintainer-assigner on the PR.
         has_maintainer_assignee = add_reminders(
-            pr_info.assignees, maintainers_and_prs, message, MAINTAINERS)
+            pr_info.assignees, maintainers_and_prs, message, MAINTAINERS, FIRST_PASS)
 
         # If there was no maintainer, track it as unassigned.
         if not has_maintainer_assignee:
@@ -214,3 +231,4 @@ def post_to_oncall(client, unassigned_prs, out_slo_prs):
     post_to_oncall(client, maintainers_and_messages['unassigned'], stalled_prs)
     post_to_assignee(client, shephards_and_messages, API_REVIEWERS)
     post_to_assignee(client, maintainers_and_messages, MAINTAINERS)
+    post_to_assignee(client, maintainers_and_messages, FIRST_PASS)
diff --git a/.github/actions/pr_notifier/requirements.txt b/.github/actions/pr_notifier/requirements.txt
@@ -111,9 +111,9 @@ six==1.16.0 \
     --hash=sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926 \
     --hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254
     # via pynacl
-slack-sdk==3.7.0 \
-    --hash=sha256:50b9fd6d8f83af7e8ad6d8e76882d04931842241f85ccfd30da09b4a7b9b1516 \
-    --hash=sha256:f0bf3e38ac393eba7fe1a99191b0e72f710860c6d2edc1271606fcfc08bea2e1
+slack-sdk==3.10.1 \
+    --hash=sha256:f17b71a578e94204d9033bffded634475f4ca0a6274c6c7a4fd8a9cb0ac7cd8b \
+    --hash=sha256:2b4dde7728eb4ff5a581025d204578ccff25a5d8f0fe11ae175e3ce6e074434f
     # via -r .github/actions/pr_notifier/requirements.txt
 urllib3==1.26.6 \
     --hash=sha256:39fb8672126159acb139a7718dd10806104dec1e2f0f6c88aab05d17df10c8d4 \

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -12,7 +12,7 @@ updates:
     interval: "daily"
 
 - package-ecosystem: "pip"
-  directory: "/source/extensions/filters/network/kafka"
+  directory: "/contrib/kafka/filters/network/source"
   schedule:
     interval: "daily"
 
@@ -36,21 +36,11 @@ updates:
   schedule:
     interval: "daily"
 
-- package-ecosystem: "pip"
-  directory: "/tools/github"
-  schedule:
-    interval: "daily"
-
 - package-ecosystem: "pip"
   directory: "/tools/config_validation"
   schedule:
     interval: "daily"
 
-- package-ecosystem: "pip"
-  directory: "/tools/docker"
-  schedule:
-    interval: "daily"
-
 - package-ecosystem: "pip"
   directory: "/tools/dependency"
   schedule:
@@ -62,7 +52,7 @@ updates:
     interval: "daily"
 
 - package-ecosystem: "pip"
-  directory: "/tools/gpg"
+  directory: "/tools/distribution"
   schedule:
     interval: "daily"
 

diff --git a/BUILD b/BUILD
@@ -33,3 +33,10 @@ package_group(
         "//test/extensions/...",
     ],
 )
+
+package_group(
+    name = "contrib_library",
+    packages = [
+        "//contrib/...",
+    ],
+)
diff --git a/CODEOWNERS b/CODEOWNERS
@@ -22,9 +22,7 @@
 # original_src common extension
 extensions/filters/common/original_src @snowp @klarose
 # dubbo_proxy extension
-/*/extensions/filters/network/dubbo_proxy @zyfjeff @lizan
-# rocketmq_proxy extension
-/*/extensions/filters/network/rocketmq_proxy @aaron-ai @lizhanhui @lizan
+/*/extensions/filters/network/dubbo_proxy @zyfjeff @lizan @wbpcode
 # thrift_proxy extension
 /*/extensions/filters/network/thrift_proxy @zuercher @rgs1
 # cdn_loop extension
@@ -62,10 +60,6 @@ extensions/filters/common/original_src @snowp @klarose
 /*/extensions/tracers/xray @abaptiste @lavignes @mattklein123
 # tracers.skywalking extension
 /*/extensions/tracers/skywalking @wbpcode @dio @lizan @Shikugawa
-# mysql_proxy extension
-/*/extensions/filters/network/mysql_proxy @rshriram @venilnoronha @mattklein123
-# postgres_proxy extension
-/*/extensions/filters/network/postgres_proxy @fabriziomello @cpakulski @dio
 # quic extension
 /*/extensions/quic/ @alyssawilk @danzh2010 @mattklein123 @mpwarres @wu-bin @ggreenway
 # zookeeper_proxy extension
@@ -110,7 +104,6 @@ extensions/filters/common/original_src @snowp @klarose
 # common crypto extension
 /*/extensions/common/crypto @lizan @bdecoste @asraa
 /*/extensions/common/proxy_protocol @alyssawilk @wez470
-/*/extensions/common/sqlutils @cpakulski @dio
 /*/extensions/filters/http/grpc_http1_bridge @snowp @jose
 /*/extensions/filters/http/gzip @gsagula @dio
 /*/extensions/filters/http/fault @rshriram @alyssawilk
@@ -119,7 +112,6 @@ extensions/filters/common/original_src @snowp @klarose
 /*/extensions/filters/http/router @alyssawilk @mattklein123 @snowp
 /*/extensions/filters/http/grpc_web @fengli79 @lizan
 /*/extensions/filters/http/grpc_stats @kyessenov @lizan
-/*/extensions/filters/http/squash @yuval-k @alyssawilk
 /*/extensions/filters/common/original_src @klarose @snowp
 /*/extensions/filters/listener/tls_inspector @ggreenway @asraa
 /*/extensions/grpc_credentials/example @wozz @htuch
@@ -195,8 +187,19 @@ extensions/filters/http/oauth2 @rgs1 @derekargueta @snowp
 # set_metadata extension
 /*/extensions/filters/http/set_metadata @aguinet @snowp
 # Formatters
+/*/extensions/formatter/metadata @cpakulski @lizan
 /*/extensions/formatter/req_without_query @dio @tsaarni
 # IP address input matcher
 /*/extensions/matching/input_matchers/ip @aguinet @snowp
-# Kafka
-/*/extensions/filters/network/kafka @mattklein123 @adamkotwasinski
+# Key Value store
+/*/extensions/key_value @alyssawilk @ryantheoptimist
+
+# Contrib
+/contrib/exe/ @mattklein123 @lizan
+/contrib/common/sqlutils/ @cpakulski @dio
+/contrib/squash/ @yuval-k @alyssawilk
+/contrib/kafka/ @mattklein123 @adamkotwasinski
+/contrib/rocketmq_proxy/ @aaron-ai @lizhanhui @lizan
+/contrib/mysql_proxy/ @rshriram @venilnoronha
+/contrib/postgres_proxy/ @fabriziomello @cpakulski @dio
+/contrib/sxg/ @cpapazian @rgs1 @alyssawilk
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -262,7 +262,17 @@ Other changes will likely include
   * Editing [source/extensions/extensions_metadata.yaml](source/extensions/extensions_metadata.yaml) to include metadata for the new extensions
   * Editing [docs/root/api-v3/config/config.rst](docs/root/api-v3/config/config.rst) to add area/area
   * Adding `docs/root/api-v3/config/area/area.rst` to add a table of contents for the API docs
-  * Adding `source/extensions/area/well_known_names.h` for registered plugins
+
+# Adding contrib extensions
+
+See [EXTENSION_POLICY.md](EXTENSION_POLICY.md) for more information on contrib. Adding a contrib
+extension mostly mirrors adding a normal extension above. Some differences are noted here:
+
+* API files should be added in `api/contrib/envoy/`, but the protos' namespaces should still be as
+  in normal extensions (which will make file movement easier later if the extension gets promoted
+  to core).
+* Build config and metadata should be included in [contrib/contrib_build_config.bzl](contrib/contrib_build_config.bzl)
+  and [contrib/extensions_metadata.yaml](contrib/extensions_metadata.yaml).
 
 # DCO: Sign your work
 

diff --git a/EXTENSION_POLICY.md b/EXTENSION_POLICY.md
@@ -137,3 +137,16 @@ case we need to install an extension point, which can be done as follows:
   3. Update [extending envoy](docs/root/extending/extending.rst) to list the new
      extension point and add any documentation explaining the extension point.
      At the very least this should link to the corresponding proto.
+
+## Contrib extensions
+
+As described in [this document](https://docs.google.com/document/d/1yl7GOZK1TDm_7vxQvt8UQEAu07UQFru1uEKXM6ZZg_g/edit#),
+Envoy allows an alternate path to adding extensions called `contrib/`. The barrier to entry for a
+contrib extension is lower than a core extension, with the tradeoff that contrib extensions are not
+included by default in the main image builds. Consumers need to pull directly from the contrib
+images described in the installation guide. Please read the linked document in detail to determine
+whether contrib extensions are the right choice for a newly proposed extension.
+
+**NOTE:** Contrib extensions are not eligible for Envoy security team coverage.
+**NOTE:** As per the linked Google Doc, contrib extensions generally should use `v3alpha` to avoid
+requiring API shepherd reviews.
diff --git a/OWNERS.md b/OWNERS.md
@@ -45,6 +45,8 @@ routing PRs, questions, etc. to the right place.
   * Event management, security, performance, data plane.
 * Sotiris Nanopoulos ([davinci26](https://github.com/davinci26)) (Sotiris.Nanopoulos@microsoft.com)
   * Windows, low level networking.
+* Dmitry Rozhkov ([rojkov](https://github.com/rojkov)) (dmitry.rozhkov@intel.com)
+  * Scalability and performance.
 
 # Senior extension maintainers
 
@@ -54,11 +56,15 @@ without further review.
 
 * Piotr Sikora ([PiotrSikora](https://github.com/PiotrSikora)) (piotrsikora@google.com)
   * Wasm
+* Raúl Gutiérrez Segalés ([rgs1](https://github.com/rgs1)) (rgs@pinterest.com)
+  * Thrift
 
 # Envoy security team
 
-* All maintainers
-* Tony Allen ([tonya11en](https://github.com/tonya11en)) (tallen@lyft.com)
+* All senior maintainers
+* Tony Allen ([tonya11en](https://github.com/tonya11en)) (tony@allen.gg)
+* Dmitri Dolguikh ([dmitri-d](https://github.com/dmitri-d)) (ddolguik@redhat.com)
+* Yan Avlasov ([yanavlasov](https://github.com/yanavlasov)) (yavlasov@google.com)
 
 # Emeritus maintainers
 
@@ -76,5 +82,3 @@ matter expert reviews. Feel free to loop them in as needed.
   * v2 xDS, listeners, filter chain discovery service.
 * Michael Payne ([moderation](https://github.com/moderation)) (m@m17e.org)
   * External dependencies, Envoy's supply chain and documentation.
-* Dmitry Rozhkov ([rojkov](https://github.com/rojkov)) (dmitry.rozhkov@intel.com)
-  * Scalability and performance.
diff --git a/README.md b/README.md
@@ -74,7 +74,7 @@ The Envoy team meets twice per month on Tuesday at 9am PT. The public
 Google calendar is here: https://goo.gl/PkDijT
 
 * Meeting minutes are [here](https://goo.gl/5Cergb)
-* Recorded videos are posted [here](https://www.youtube.com/channel/UCvqbFHwN-nwalWPjPUKpvTA/videos?view=0&sort=dd&shelf_id=1)
+* Recorded videos are posted [here](https://www.youtube.com/channel/UC5z5mvPgqMs1xo5VuIWzYTA)
 
 ## Security