auto-merge envoyproxy/envoy[main] into envoyproxy/envoy-openssl[main]

* upstream/main: http: initializes a field of ConnectionManagerImpl::ActiveStream::State. (#36642) test: deflake an integration test (#36674) ci/rbe: Use engflow for non-coverage checks (#36687) xds-failover: fixing runtime feature flag in tests (#36659) security-release: update the q3 release record (#36689) Signed-off-by: tedjpoole <97459248+tedjpoole@users.noreply.github.com>
envoyproxy · Oct 20, 2024 · 6c08df0 · 6c08df0
2 parents 359eb83 + ee61634
commit 6c08df0
Show file tree

Hide file tree

Showing 14 changed files with 23 additions and 22 deletions.
diff --git a/.github/workflows/_check_build.yml b/.github/workflows/_check_build.yml
@@ -5,9 +5,6 @@ permissions:
 
 on:
   workflow_call:
-    secrets:
-      gcp-key:
-        required: true
     inputs:
       request:
         type: string
@@ -23,15 +20,13 @@ concurrency:
 
 jobs:
   build:
-    secrets:
-      gcp-key: ${{ secrets.gcp-key }}
     permissions:
       contents: read
       packages: read
     uses: ./.github/workflows/_run.yml
     name: ${{ matrix.name ||matrix.target }}
     with:
-      # bazel-extra: '--config=remote-envoy-engflow'
+      bazel-extra: '--config=remote-envoy-engflow'
       cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
       concurrency-suffix: -${{ matrix.target }}
       error-match: |

diff --git a/.github/workflows/_check_san.yml b/.github/workflows/_check_san.yml
@@ -5,9 +5,6 @@ permissions:
 
 on:
   workflow_call:
-    secrets:
-      gcp-key:
-        required: true
     inputs:
       request:
         type: string
@@ -23,15 +20,13 @@ concurrency:
 
 jobs:
   san:
-    secrets:
-      gcp-key: ${{ secrets.gcp-key }}
     permissions:
       contents: read
       packages: read
     uses: ./.github/workflows/_run.yml
     name: ${{ matrix.target }}
     with:
-      # bazel-extra: '--config=remote-envoy-engflow'
+      bazel-extra: '--config=remote-envoy-engflow'
       cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
       concurrency-suffix: -${{ matrix.target }}
       request: ${{ inputs.request }}

diff --git a/.github/workflows/envoy-checks.yml b/.github/workflows/envoy-checks.yml
@@ -41,8 +41,6 @@ jobs:
       # head-sha: ${{ github.sha }}
 
   build:
-    secrets:
-      gcp-key: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
     permissions:
       actions: read
       contents: read
@@ -75,8 +73,6 @@ jobs:
       trusted: ${{ fromJSON(needs.load.outputs.trusted) }}
 
   san:
-    secrets:
-      gcp-key: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
     permissions:
       actions: read
       contents: read

diff --git a/RELEASES.md b/RELEASES.md
@@ -66,6 +66,7 @@ actual mechanics of the release itself.
 | 2023 Q3 | Boteng Yao ([botengyao](https://github.com/botengyao))         | Kateryna Nezdolii ([nezdolik](https://github.com/nezdolik))              |
 | 2023 Q4 | Paul Merrison ([pmerrison](https://github.com/pmerrison))      | Brian Sonnenberg ([briansonnenberg](https://github.com/briansonnenberg)) |
 | 2024 Q2 | Ryan Northey ([phlax](https://github.com/phlax))               | Boteng Yao ([botengyao](https://github.com/botengyao))                   |
+| 2024 Q3 | Ryan Northey ([phlax](https://github.com/phlax))               | Boteng Yao ([botengyao](https://github.com/botengyao))                   |
 
 ## Major release schedule
 

diff --git a/source/common/http/conn_manager_impl.h b/source/common/http/conn_manager_impl.h
@@ -338,7 +338,8 @@ class ConnectionManagerImpl : Logger::Loggable<Logger::Id::http>,
           : codec_saw_local_complete_(false), codec_encode_complete_(false),
             on_reset_stream_called_(false), is_zombie_stream_(false), successful_upgrade_(false),
             is_internally_destroyed_(false), is_internally_created_(false), is_tunneling_(false),
-            decorated_propagate_(true), deferred_to_next_io_iteration_(false) {}
+            decorated_propagate_(true), deferred_to_next_io_iteration_(false),
+            deferred_end_stream_(false) {}
 
       // It's possibly for the codec to see the completed response but not fully
       // encode it.

diff --git a/test/common/upstream/BUILD b/test/common/upstream/BUILD
@@ -87,7 +87,7 @@ envoy_cc_test(
     name = "cluster_manager_impl_test",
     size = "large",
     srcs = ["cluster_manager_impl_test.cc"],
-    rbe_pool = "2core",
+    rbe_pool = "4core",
     deps = [
         ":test_cluster_manager",
         "//source/common/router:context_lib",

diff --git a/test/extensions/common/aws/BUILD b/test/extensions/common/aws/BUILD
@@ -43,6 +43,7 @@ envoy_cc_test(
     name = "sigv4_signer_corpus_test",
     srcs = ["sigv4_signer_corpus_test.cc"],
     data = ["@com_github_awslabs_aws_c_auth//:sigv4_tests"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/http:message_lib",
@@ -58,6 +59,7 @@ envoy_cc_test(
     name = "sigv4a_signer_corpus_test",
     srcs = ["sigv4a_signer_corpus_test.cc"],
     data = ["@com_github_awslabs_aws_c_auth//:sigv4a_tests"],
+    rbe_pool = "4core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/http:message_lib",

diff --git a/test/extensions/config_subscription/grpc/grpc_mux_failover_test.cc b/test/extensions/config_subscription/grpc/grpc_mux_failover_test.cc
@@ -409,6 +409,9 @@ TEST_F(GrpcMuxFailoverTest, PrimaryOnlyAttemptsAfterPrimaryAvailable) {
 // will try to reconnect to the primary (and then failover), and keep
 // alternating between the two.
 TEST_F(GrpcMuxFailoverTest, AlternatingPrimaryAndFailoverAttemptsAfterFailoverAvailable) {
+  TestScopedRuntime scoped_runtime;
+  scoped_runtime.mergeValues(
+      {{"envoy.reloadable_features.xds_failover_to_primary_enabled", "true"}});
   connectToFailover();
 
   // Emulate a 5 times disconnects.

diff --git a/test/extensions/config_subscription/grpc/xds_failover_integration_test.cc b/test/extensions/config_subscription/grpc/xds_failover_integration_test.cc
@@ -575,6 +575,8 @@ TEST_P(XdsFailoverAdsIntegrationTest, NoFailoverUseAfterPrimaryResponse) {
 
 // Validate that once failover responds, and then disconnects, primary will be attempted.
 TEST_P(XdsFailoverAdsIntegrationTest, PrimaryUseAfterFailoverResponseAndDisconnect) {
+  config_helper_.addRuntimeOverride("envoy.reloadable_features.xds_failover_to_primary_enabled",
+                                    "true");
   // These tests are not executed with GoogleGrpc because they are flaky due to
   // the large timeout values for retries.
   SKIP_IF_GRPC_CLIENT(Grpc::ClientType::GoogleGrpc);
@@ -692,6 +694,8 @@ TEST_P(XdsFailoverAdsIntegrationTest, PrimaryUseAfterFailoverResponseAndDisconne
 // still doesn't respond, failover will be attempted with the correct
 // initial_resource_versions.
 TEST_P(XdsFailoverAdsIntegrationTest, FailoverUseAfterFailoverResponseAndDisconnect) {
+  config_helper_.addRuntimeOverride("envoy.reloadable_features.xds_failover_to_primary_enabled",
+                                    "true");
   // These tests are not executed with GoogleGrpc because they are flaky due to
   // the large timeout values for retries.
   SKIP_IF_GRPC_CLIENT(Grpc::ClientType::GoogleGrpc);
@@ -814,6 +818,8 @@ TEST_P(XdsFailoverAdsIntegrationTest, FailoverUseAfterFailoverResponseAndDisconn
 // both are not responding.
 TEST_P(XdsFailoverAdsIntegrationTest,
        PrimaryAndFailoverAttemptsAfterFailoverResponseAndDisconnect) {
+  config_helper_.addRuntimeOverride("envoy.reloadable_features.xds_failover_to_primary_enabled",
+                                    "true");
   // These tests are not executed with GoogleGrpc because they are flaky due to
   // the large timeout values for retries.
   SKIP_IF_GRPC_CLIENT(Grpc::ClientType::GoogleGrpc);

diff --git a/test/extensions/filters/common/ratelimit_config/BUILD b/test/extensions/filters/common/ratelimit_config/BUILD
@@ -20,6 +20,7 @@ envoy_proto_library(
 envoy_cc_test(
     name = "ratelimit_config_test",
     srcs = ["ratelimit_config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":ratelimit_config_test_proto_cc_proto",
         "//source/common/http:header_map_lib",

diff --git a/test/extensions/filters/http/ext_proc/BUILD b/test/extensions/filters/http/ext_proc/BUILD
@@ -170,7 +170,7 @@ envoy_extension_cc_test(
         # TODO(jbohanon) use a test filter here instead of production filter
         "envoy.filters.http.set_metadata",
     ],
-    rbe_pool = "2core",
+    rbe_pool = "4core",
     shard_count = 8,
     tags = [
         "cpu:3",

diff --git a/test/extensions/load_balancing_policies/client_side_weighted_round_robin/BUILD b/test/extensions/load_balancing_policies/client_side_weighted_round_robin/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.load_balancing_policies.client_side_weighted_round_robin"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/client_side_weighted_round_robin:config",
         "//test/mocks/server:factory_context_mocks",

diff --git a/test/integration/BUILD b/test/integration/BUILD
@@ -1539,7 +1539,7 @@ envoy_cc_test(
     name = "load_stats_integration_test",
     size = "large",
     srcs = ["load_stats_integration_test.cc"],
-    rbe_pool = "2core",
+    rbe_pool = "4core",
     deps = [
         ":http_integration_lib",
         "//test/config:utility_lib",
@@ -2546,7 +2546,7 @@ envoy_cc_test(
         "//conditions:default": ["quic_http_integration_test.cc"],
     }),
     data = ["//test/config/integration/certs"],
-    rbe_pool = "2core",
+    rbe_pool = "4core",
     # TODO(envoyproxy/windows-dev): Diagnose failure shown only on clang-cl build, see:
     #   https://gist.github.com/wrowe/a152cb1d12c2f751916122aed39d8517
     # TODO(envoyproxy/windows-dev): Diagnose timeout, why opt build test under Windows GCP RBE

diff --git a/test/integration/protocol_integration_test.cc b/test/integration/protocol_integration_test.cc
@@ -462,7 +462,7 @@ TEST_P(ProtocolIntegrationTest, PeriodicAccessLog) {
       {":method", "GET"}, {":path", "/test"}, {":scheme", "http"}, {":authority", "host.com"}});
   waitForNextUpstreamRequest();
   EXPECT_EQ(AccessLogType_Name(AccessLog::AccessLogType::DownstreamPeriodic),
-            waitForAccessLog(access_log_name_));
+            waitForAccessLog(access_log_name_, 0, true));
 
   upstream_request_->encodeHeaders(Http::TestResponseHeaderMapImpl{{":status", "200"}}, true);
   ASSERT_TRUE(response->waitForEndStream());