Merge branch 'main' into mpuncel/hc-after-sds-init-manager

* main: (221 commits)
  deps: Bump `protobuf` -> 3.19.0 (envoyproxy#18471)
  tooling: auto-assign dependency shephards (envoyproxy#18794)
  clang-tidy: Return from diff fun if empty diff (envoyproxy#18815)
  repokitteh: Block PRs pending deps approval (envoyproxy#18814)
  deps: Bump `org_llvm_llvm` -> 12.0.1, `com_github_wavm_wavm` -> 9ffd3e2 (envoyproxy#18747)
  dns resolvers: add All lookup mode (envoyproxy#18464)
  doc: fix link formatting for TLS session_timeout (envoyproxy#18790)
  ext_authz: Set response flag and code details to UAEX when denied (envoyproxy#18740)
  socket options: add support for directly creating ipv4/ipv6 pairs (envoyproxy#18769)
  ecds: make onConfigUpdate generic over filter type (envoyproxy#18061)
  bazel: update CMake instructions in EXTERNAL_DEPS.md (envoyproxy#18799)
  upstream: fix typo in comment (envoyproxy#18798)
  runtime: removing envoy.reloadable_features.grpc_json_transcoder_adhere_to_buffer_limits (envoyproxy#18696)
  bazel: Add CC=clang to clang configuration (envoyproxy#18732)
  fix error request id in the dubbbo local reply (envoyproxy#18741)
  event: assert the case of both read and closed event registered (envoyproxy#18265)
  tcp proxy connect tunneling: improved testing (envoyproxy#18784)
  deps: Bump `protoc-gen-validate` -> 0.6.2 (envoyproxy#18742)
  deps: Bump `rules_pkg` -> ad57589 (envoyproxy#18746)
  bazel: copy .bazelversion for envoy filter examples (envoyproxy#18730)
  ...

Signed-off-by: Michael Puncel <mpuncel@squareup.com>

.azure-pipelines/pipelines.yml

@@ -512,46 +512,23 @@ stages:
         artifactName: windows.release
       condition: always()
 
-  - job: clang_cl
-    timeoutInMinutes: 120
-    pool:
-      vmImage: "windows-latest"
-    steps:
-    - task: Cache@2
-      inputs:
-        key: '"windows.release" | ./WORKSPACE | **/*.bzl'
-        path: $(Build.StagingDirectory)/repository_cache
-      continueOnError: true
-    - bash: ci/run_envoy_docker.sh ci/windows_ci_steps.sh
-      displayName: "Run Windows clang-cl CI"
-      env:
-        CI_TARGET: "windows"
-        ENVOY_DOCKER_BUILD_DIR: "$(Build.StagingDirectory)"
-        SLACK_TOKEN: $(SLACK_TOKEN)
-        REPO_URI: $(Build.Repository.Uri)
-        BUILD_URI: $(Build.BuildUri)
-        ENVOY_RBE: "true"
-        BAZEL_BUILD_EXTRA_OPTIONS: "--config=remote-ci --config=remote-clang-cl --jobs=$(RbeJobs) --flaky_test_attempts=2"
-        BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
-        BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
-        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
-    - task: PublishTestResults@2
-      inputs:
-        testResultsFiles: "**/bazel-out/**/testlogs/**/test.xml"
-        testRunTitle: "clang-cl"
-        searchFolder: $(Build.StagingDirectory)/tmp
-      condition: always()
-    - task: PublishBuildArtifacts@1
-      inputs:
-        pathtoPublish: "$(Build.StagingDirectory)/envoy"
-        artifactName: windows.clang-cl
-      condition: always()
-
   - job: docker
+    strategy:
+      matrix:
+        windows2019:
+          imageName: 'windows-latest'
+          windowsBuildType: "windows"
+          windowsImageBase: "mcr.microsoft.com/windows/servercore"
+          windowsImageTag: "ltsc2019"
+        windows2022:
+          imageName: 'windows-2022'
+          windowsBuildType: "windows-ltsc2022"
+          windowsImageBase: "mcr.microsoft.com/windows/nanoserver"
+          windowsImageTag: "ltsc2022"
     dependsOn: ["release"]
     timeoutInMinutes: 120
     pool:
-      vmImage: "windows-latest"
+      vmImage: $(imageName)
     steps:
     - task: DownloadBuildArtifacts@0
       inputs:
@@ -572,6 +549,9 @@ stages:
         AZP_SHA1: $(Build.SourceVersion)
         DOCKERHUB_USERNAME: $(DockerUsername)
         DOCKERHUB_PASSWORD: $(DockerPassword)
+        WINDOWS_BUILD_TYPE: $(windowsBuildType)
+        WINDOWS_IMAGE_BASE: $(windowsImageBase)
+        WINDOWS_IMAGE_TAG: $(windowsImageTag)
     - task: PublishBuildArtifacts@1
       inputs:
         pathtoPublish: "$(Build.StagingDirectory)/build_images"

.bazelrc

@@ -47,6 +47,7 @@ build:sanitizer --test_tag_filters=-no_san
 
 # Common flags for Clang
 build:clang --action_env=BAZEL_COMPILER=clang
+build:clang --action_env=CC=clang --action_env=CXX=clang++
 build:clang --linkopt=-fuse-ld=lld
 
 # Flags for Clang + PCH
@@ -79,11 +80,13 @@ build:clang-asan --linkopt -fuse-ld=lld
 build:clang-asan --linkopt --rtlib=compiler-rt
 build:clang-asan --linkopt --unwindlib=libgcc
 
-# macOS ASAN/UBSAN
+# macOS
 build:macos --cxxopt=-std=c++17
 build:macos --action_env=PATH=/usr/bin:/bin:/opt/homebrew/bin:/usr/local/bin:/opt/local/bin
 build:macos --host_action_env=PATH=/usr/bin:/bin:/opt/homebrew/bin:/usr/local/bin:/opt/local/bin
+build:macos --define tcmalloc=disabled
 
+# macOS ASAN/UBSAN
 build:macos-asan --config=asan
 # Workaround, see https://github.com/bazelbuild/bazel/issues/6932
 build:macos-asan --copt -Wno-macro-redefined
@@ -158,7 +161,7 @@ build:coverage --strategy=CoverageReport=sandboxed,local
 build:coverage --experimental_use_llvm_covmap
 build:coverage --collect_code_coverage
 build:coverage --test_tag_filters=-nocoverage
-build:coverage --instrumentation_filter="//source(?!/common/chromium_url|/common/quic/platform)[/:],//include[/:]"
+build:coverage --instrumentation_filter="//source(?!/common/quic/platform)[/:],//include[/:]"
 build:test-coverage --test_arg="-l trace"
 build:fuzz-coverage --config=plain-fuzzer
 build:fuzz-coverage --run_under=@envoy//bazel/coverage:fuzz_coverage_wrapper.sh
@@ -189,7 +192,7 @@ build:rbe-toolchain-asan --linkopt -fuse-ld=lld
 build:rbe-toolchain-asan --action_env=ENVOY_UBSAN_VPTR=1
 build:rbe-toolchain-asan --copt=-fsanitize=vptr,function
 build:rbe-toolchain-asan --linkopt=-fsanitize=vptr,function
-build:rbe-toolchain-asan --linkopt=-L/opt/llvm/lib/clang/11.0.1/lib/linux
+build:rbe-toolchain-asan --linkopt=-L/opt/llvm/lib/clang/12.0.1/lib/linux
 build:rbe-toolchain-asan --linkopt=-l:libclang_rt.ubsan_standalone-x86_64.a
 build:rbe-toolchain-asan --linkopt=-l:libclang_rt.ubsan_standalone_cxx-x86_64.a
 
@@ -265,7 +268,7 @@ build:remote-clang-cl --config=rbe-toolchain-clang-cl
 
 # Docker sandbox
 # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/main/toolchains/rbe_toolchains_config.bzl#L8
-build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:8ca107a75ee98b255aa59db2ab40fd0800a3ce99
+build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:81a93046060dbe5620d5b3aa92632090a9ee4da6
 build:docker-sandbox --spawn_strategy=docker
 build:docker-sandbox --strategy=Javac=docker
 build:docker-sandbox --strategy=Closure=docker

.bazelversion

@@ -1 +1 @@
-4.1.0
+4.2.1

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM gcr.io/envoy-ci/envoy-build:8ca107a75ee98b255aa59db2ab40fd0800a3ce99
+FROM gcr.io/envoy-ci/envoy-build:81a93046060dbe5620d5b3aa92632090a9ee4da6
 
 ARG USERNAME=vscode
 ARG USER_UID=501

.github/actions/pr_notifier/pr_notifier.py

@@ -30,6 +30,7 @@
     'asraa': 'UKZKCFRTP',
     'davinci26': 'U013608CUDV',
     'rojkov': 'UH5EXLYQK',
+    'RyanTheOptimist': 'U01SW3JC8GP',
 }
 
 # First pass reviewers who are not maintainers should get
@@ -43,7 +44,6 @@
     'KBaichoo': 'U016ZPU8KBK',
     'wbpcode': 'U017KF5C0Q6',
     'mathetake': 'UG9TD2FSB',
-    'RyanTheOptimist': 'U01SW3JC8GP',
 }
 
 # Only notify API reviewers who aren't maintainers.

.github/actions/pr_notifier/requirements.txt

@@ -111,9 +111,9 @@ six==1.16.0 \
     --hash=sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926 \
     --hash=sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254
     # via pynacl
-slack_sdk==3.11.0 \
-    --hash=sha256:4d9854ee158c3137cfe1ba587dc4b777b6881aee58436d8071f36bad842acbf4 \
-    --hash=sha256:8dc858cd106b639191ee3dc38fb957e55ab8dd28c2cc22feafa1223ab2def646
+slack_sdk==3.11.2 \
+    --hash=sha256:131bf605894525c2d66da064677eabc19f53f02ce0f82a3f2fa130d4ec3bc1b0 \
+    --hash=sha256:35245ec34c8549fbb5c43ccc17101afd725b3508bb784da46530b214f496bf93
     # via -r requirements.in
 urllib3==1.26.6 \
     --hash=sha256:39fb8672126159acb139a7718dd10806104dec1e2f0f6c88aab05d17df10c8d4 \

.github/workflows/check-deps.yml

@@ -0,0 +1,36 @@
+name: Check for latest_release of deps
+
+on :
+  schedule :
+    - cron : '0 8 * * *'
+
+  workflow_dispatch :
+
+jobs :
+  build :
+    runs-on : ubuntu-latest
+    if: github.repository_owner == 'envoyproxy'
+
+    steps :
+      - name : checkout
+        uses : actions/checkout/@v2
+        with :
+          ref : ${{ github.head_ref }}
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v2
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install virtualenv
+
+      - name: setting up virtualenv
+        run : |
+          export GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
+          # --create_issues flag to create issue only in github action
+          # and not interfere with the CI
+          ./tools/dependency/release_dates.sh ./bazel/repository_locations.bzl --create_issues
+          ./tools/dependency/release_dates.sh ./api/bazel/repository_locations.bzl --create_issues

.github/workflows/pr_notifier.yml

@@ -7,6 +7,7 @@ jobs:
   pr_notifier:
     name: PR Notifier
     runs-on: ubuntu-latest
+    if: github.repository_owner == 'envoyproxy'
 
     steps:
     - uses: actions/checkout@v2

CODEOWNERS

@@ -40,6 +40,8 @@ extensions/filters/common/original_src @snowp @klarose
 /*/extensions/filters/http/header_to_metadata @rgs1 @zuercher
 # alts transport socket extension
 /*/extensions/transport_sockets/alts @antoniovicente @asraa @yangminzhu
+# tcp_stats transport socket extension
+/*/extensions/transport_sockets/tcp_stats @ggreenway @mattklein123
 # tls transport socket extension
 /*/extensions/transport_sockets/tls @lizan @asraa @ggreenway
 # tls SPIFFE certificate validator extension
@@ -192,6 +194,9 @@ extensions/filters/http/oauth2 @rgs1 @derekargueta @snowp
 /*/extensions/matching/input_matchers/ip @aguinet @snowp
 # Key Value store
 /*/extensions/key_value @alyssawilk @ryantheoptimist
+# DNS Resolver
+/*/extensions/network/dns_resolver/cares @junr03 @yanavlasov
+/*/extensions/network/dns_resolver/apple @junr03 @yanavlasov
 
 # Contrib
 /contrib/exe/ @mattklein123 @lizan
@@ -204,3 +209,4 @@ extensions/filters/http/oauth2 @rgs1 @derekargueta @snowp
 /contrib/sxg/ @cpapazian @rgs1 @alyssawilk
 /contrib/sip_proxy/ @durd07 @nearbyfly @dorisd0102
 /contrib/cryptomb/ @rojkov @ipuustin
+/contrib/vcl/ @florincoras @rojkov

EXTENSION_POLICY.md

@@ -92,8 +92,8 @@ The `status` is one of:
 The extension status may be adjusted by the extension [CODEOWNERS](./CODEOWNERS) and/or Envoy
 maintainers based on an assessment of the above criteria. Note that the status of the extension
 reflects the implementation status. It is orthogonal to the API stability, for example, an extension
-with configuration `envoy.foo.v3alpha.Bar` might have a `stable` implementation and
-`envoy.foo.v3.Baz` can have a `wip` implementation.
+API marked with `(xds.annotations.v3.file_status).work_in_progress` might have a `stable` implementation and
+and an extension with a stable config proto can have a `wip` implementation.
 
 The `security_posture` is one of:
 * `robust_to_untrusted_downstream`: The extension is hardened against untrusted downstream traffic. It

GOVERNANCE.md

@@ -98,7 +98,8 @@ or you can subscribe to the iCal feed [here](webcal://kubernetes.app.opsgenie.co
 * From the envoy [landing page](https://github.com/envoyproxy/envoy) use the branch drop-down to create a branch
   from the tagged release, e.g. "release/v1.6". It will be used for the
   [stable releases](RELEASES.md#stable-releases).
-* Monitor the AZP tag build to make sure that the final docker images get pushed along with
+* Tagging will kick off another run of [AZP postsubmit](https://dev.azure.com/cncf/envoy/_build?definitionId=11). Monitor that
+  tag build to make sure that the final docker images get pushed along with
   the final docs. The final documentation will end up in the
   [envoyproxy.github.io repository](https://github.com/envoyproxy/envoyproxy.github.io/tree/main/docs/envoy).
 * Update the website ([example PR](https://github.com/envoyproxy/envoyproxy.github.io/pull/148)) for the new release.

OWNERS.md

@@ -47,6 +47,8 @@ routing PRs, questions, etc. to the right place.
   * Windows, low level networking.
 * Dmitry Rozhkov ([rojkov](https://github.com/rojkov)) (dmitry.rozhkov@intel.com)
   * Scalability and performance.
+* Ryan Hamilton ([RyanTheOptimist](https://github.com/ryantheoptimist)) (rch@google.com)
+  * HTTP/3, upstream connection management.
 
 # Senior extension maintainers
 
@@ -63,7 +65,6 @@ without further review.
 
 * All senior maintainers
 * Tony Allen ([tonya11en](https://github.com/tonya11en)) (tony@allen.gg)
-* Dmitri Dolguikh ([dmitri-d](https://github.com/dmitri-d)) (ddolguik@redhat.com)
 * Yan Avlasov ([yanavlasov](https://github.com/yanavlasov)) (yavlasov@google.com)
 * William A Rowe Jr ([wrowe](https://github.com/wrowe)) (wrowe@vmware.com)
 

README.md

@@ -17,7 +17,7 @@ involved and how Envoy plays a role, read the CNCF
 
 * [Official documentation](https://www.envoyproxy.io/)
 * [FAQ](https://www.envoyproxy.io/docs/envoy/latest/faq/overview)
-* [Unofficial Chinese documentation](https://www.servicemesher.com/envoy/)
+* [Unofficial Chinese documentation](https://cloudnative.to/envoy/)
 * Watch [a video overview of Envoy](https://www.youtube.com/watch?v=RVZX4CwKhGE)
 ([transcript](https://www.microservices.com/talks/lyfts-envoy-monolith-service-mesh-matt-klein/))
 to find out more about the origin story and design philosophy of Envoy

RELEASES.md

@@ -72,6 +72,7 @@ deadline of 3 weeks.
 | 1.17.0  | 2020/12/31 | 2021/01/11 |  +11 days  | 2022/01/11  |
 | 1.18.0  | 2021/03/31 | 2021/04/15 |  +15 days  | 2022/04/15  |
 | 1.19.0  | 2021/06/30 | 2021/07/13 |  +13 days  | 2022/07/13  |
-| 1.20.0  | 2021/09/30 |            |            |             |
+| 1.20.0  | 2021/09/30 | 2021/10/05 |   +5 days  | 2022/10/13  |
+| 1.21.0  | 2021/12/30 |            |            |             |
 
 [repokitteh]: https://github.com/repokitteh

VERSION

@@ -1 +1 @@
-1.20.0-dev
+1.21.0-dev