jkirschner-hashicorp · jkirschner-hashicorp · Oct 26, 2023 · Jan 16, 2024 · Jan 16, 2024 · Jan 16, 2024
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
@@ -5,7 +5,7 @@ ARG USER_UID=501
 ARG USER_GID=$USER_UID
 
 ENV BUILD_DIR=/build
-ENV ENVOY_STDLIB=libstdc++
+ENV ENVOY_STDLIB=libc++
 
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get -y update \

diff --git a/.devcontainer/setup.sh b/.devcontainer/setup.sh
@@ -5,7 +5,7 @@ BAZELRC_FILE=~/.bazelrc bazel/setup_clang.sh /opt/llvm
 # TODO(phlax): use user.bazelrc
 # Use generated toolchain config because we know the base container is the one we're using in RBE.
 # Not using libc++ here because clangd will raise some tidy issue in libc++ header as of version 9.
-echo "build --config=rbe-toolchain-clang" >> ~/.bazelrc
+echo "build --config=rbe-toolchain-clang-libc++" >> ~/.bazelrc
 echo "build ${BAZEL_BUILD_EXTRA_OPTIONS}" | tee -a ~/.bazelrc
 
 # Ideally we want this line so bazel doesn't pollute things outside of the devcontainer, but some of

diff --git a/.github/workflows/_precheck_deps.yml b/.github/workflows/_precheck_deps.yml
@@ -55,4 +55,4 @@ jobs:
         ref: ${{ fromJSON(inputs.request).request.sha }}
         persist-credentials: false
     - name: Dependency Review
-      uses: actions/dependency-review-action@c74b580d73376b7750d3d2a50bfb8adc2c937507  # v3.1.5
+      uses: actions/dependency-review-action@4901385134134e04cec5fbe5ddfe3b2c5bd5d976  # v4.0.0
diff --git a/.github/workflows/envoy-macos.yml b/.github/workflows/envoy-macos.yml
@@ -48,7 +48,7 @@ jobs:
       command:
       container-command:
       request: ${{ needs.load.outputs.request }}
-      runs-on: macos-12-xl
+      runs-on: macos-14-xlarge
       steps-post:
       steps-pre: ${{ matrix.steps-pre }}
       target: ${{ matrix.target }}

diff --git a/CODEOWNERS b/CODEOWNERS
@@ -4,6 +4,12 @@
 
 # api
 /api/ @envoyproxy/api-shepherds
+
+# docs/examples
+/docs/ @envoyproxy/docs-shepherds
+/examples/ @envoyproxy/docs-shepherds
+/changelogs/ @envoyproxy/docs-shepherds
+
 # access loggers
 /*/extensions/access_loggers/common @auni53 @zuercher
 /*/extensions/access_loggers/open_telemetry @itamarkam @yanavlasov

diff --git a/OWNERS.md b/OWNERS.md
@@ -6,6 +6,7 @@ This page lists all active maintainers and their areas of expertise. This can be
 routing PRs, questions, etc. to the right place.
 
 # Senior maintainers
+<!--- If you modify senior maintainers list, please update the core-maintainers section of SECURITY-INSIGHTS.yml  -->
 
 * Matt Klein ([mattklein123](https://github.com/mattklein123)) (mattklein123@gmail.com)
   * Catch-all, "all the things", and generally trying to make himself obsolete as fast as
@@ -33,6 +34,7 @@ routing PRs, questions, etc. to the right place.
   * Upstream, LB, tracing, logging, performance, and generic/dubbo proxy.
 
 # Maintainers
+<!--- If you modify maintainers list, please update the core-maintainers section of SECURITY-INSIGHTS.yml -->
 
 * Joshua Marantz ([jmarantz](https://github.com/jmarantz)) (jmarantz@google.com)
   * Stats, abseil, scalability, and performance.
@@ -76,7 +78,7 @@ without further review.
 * Otto van der Schaaf ([oschaaf](https://github.com/oschaaf)) (oschaaf@redhat.com)
 * Tim Walsh ([twghu](https://github.com/twghu)) (twalsh@redhat.com)
 * Pradeep Rao ([pradeepcrao](https://github.com/pradeepcrao)) (pcrao@google.com)
-* Kateryna Nezdolii ([nezdolik](https://github.com/nezdolik)) (nezdolik@spotify.com)
+* Kateryna Nezdolii ([nezdolik](https://github.com/nezdolik)) (kateryna.nezdolii@gmail.com)
 * Boteng Yao ([botengyao](https://github.com/botengyao)) (boteng@google.com)
 * Kevin Baichoo ([KBaichoo](https://github.com/KBaichoo)) (kbaichoo@google.com)
 * Tianyu Xia ([tyxia](https://github.com/tyxia)) (tyxia@google.com)

diff --git a/README.md b/README.md
@@ -10,6 +10,7 @@ involved and how Envoy plays a role, read the CNCF
 
 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1266/badge)](https://bestpractices.coreinfrastructure.org/projects/1266)
 [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/envoyproxy/envoy/badge)](https://securityscorecards.dev/viewer/?uri=github.com/envoyproxy/envoy)
+[![CLOMonitor](https://img.shields.io/endpoint?url=https://clomonitor.io/api/projects/cncf/envoy/badge)](https://clomonitor.io/projects/cncf/envoy)
 [![Azure Pipelines](https://dev.azure.com/cncf/envoy/_apis/build/status/11?branchName=main)](https://dev.azure.com/cncf/envoy/_build/latest?definitionId=11&branchName=main)
 [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/envoy.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:envoy)
 [![Jenkins](https://powerci.osuosl.org/buildStatus/icon?job=build-envoy-static-master&subject=ppc64le%20build)](https://powerci.osuosl.org/job/build-envoy-static-master/)

diff --git a/RELEASES.md b/RELEASES.md
@@ -63,8 +63,8 @@ actual mechanics of the release itself.
 | 2022 Q1 | Otto van der Schaaf ([oschaaf](https://github.com/oschaaf))    | Ryan Hamilton ([RyanTheOptimist](https://github.com/RyanTheOptimist))    |
 | 2022 Q2 | Pradeep Rao ([pradeepcrao](https://github.com/pradeepcrao))    | Matt Klein ([mattklein123](https://github.com/mattklein123)              |
 | 2022 Q4 | Can Cecen ([cancecen](https://github.com/cancecen))            | Tony Allen ([tonya11en](https://github.com/tonya11en))                   |
-| 2022 Q3 | Boteng Yao ([botengyao](https://github.com/botengyao))         | Kateryna Nezdolii ([nezdolik](https://github.com/nezdolik))              |
-| 2022 Q4 | Paul Merrison ([pmerrison](https://github.com/pmerrison))      | Brian Sonnenberg ([briansonnenberg](https://github.com/briansonnenberg)) |
+| 2023 Q3 | Boteng Yao ([botengyao](https://github.com/botengyao))         | Kateryna Nezdolii ([nezdolik](https://github.com/nezdolik))              |
+| 2023 Q4 | Paul Merrison ([pmerrison](https://github.com/pmerrison))      | Brian Sonnenberg ([briansonnenberg](https://github.com/briansonnenberg)) |
 
 ## Major release schedule
 
@@ -90,8 +90,9 @@ deadline of 3 weeks.
 | 1.25.0  | 2023/01/15 | 2023/01/18 |   +3 days  | 2024/01/18  |
 | 1.26.0  | 2023/04/15 | 2023/04/18 |   +3 days  | 2024/04/18  |
 | 1.27.0  | 2023/07/14 | 2023/07/27 |  +13 days  | 2024/07/27  |
-| 1.28.0  | 2023/10/16 | 2023/10/19 |  +3 days   | 2024/10/19  |
-| 1.29.0  | 2024/01/16 |            |            |             |
+| 1.28.0  | 2023/10/16 | 2023/10/19 |   +3 days  | 2024/10/19  |
+| 1.29.0  | 2024/01/16 | 2024/01/16 |    0 days  | 2025/01/16  |
+| 1.30.0  | 2024/04/16 |            |            |             |
 
 ### Cutting a major release
 
@@ -106,24 +107,26 @@ deadline of 3 weeks.
   * Make any needed corrections (grammar, punctuation, formatting, etc.).
   * Check to see if any security/stable version release notes are duplicated in
     the major version release notes. These should not be duplicated.
-  * Switch the repo to "release" mode by running `bazel run @envoy_repo//:release`. See the [project
-    tool](tools/project/README.md#bazel-run-toolsprojectrelease) for further information. This tool
+  * Switch the repo to "release" mode by running `bazel run @envoy_repo//:release`. This tool
     will create a commit with the necessary changes for a release.
   * Update the [RELEASES](RELEASES.md) doc with the relevant dates. Now, or after you cut the
     release, please also make sure there's a stable maintainer signed up for next quarter,
     and the deadline for the next release is documented in the release schedule.
   * Get a review and merge.
-* Create a pull request with the commit created by the project tool and **wait for tests to
-  pass**.
+* Create a pull request with that commit and **wait for tests to pass**.
 * Once the tests have passed, and the PR has landed, CI will automatically create the tagged release and corresponding release branch.
-* Craft a witty/uplifting email and send it to all the email aliases: envoy-announce@ envoy-users@ envoy-dev@ envoy-maintainers
-* Make sure we tweet the new release: either have Matt do it or email social@cncf.io and ask them to do an Envoy account
-  post.
-* Switch the repo back to "dev" mode by running `bazel run @envoy_repo//:dev`. See the [project
-  tool](tools/project/README.md#bazel-run-toolsprojectdev) for further information. This tool will create a commit with the
+* Switch the repo back to "dev" mode by running `bazel run @envoy_repo//:dev`. This tool will create a commit with the
   necessary changes to continue development.
-* Create a pull request with commit created by the project tool.
+* Create a pull request with that commit.
 * Run the deprecate_versions.py script (`bazel run //tools/deprecate_version:deprecate_version`)
+* If you haven't done this before, request posting permission from admins for all the groups in the next bullet.
+* Craft a witty/uplifting email and send it to all the email aliases:
+envoy-announce@googlegroups.com
+envoy-users@googlegroups.com
+envoy-dev@googlegroups.com
+envoy-maintainers@googlegroups.com -
+include in this email a link to the latest [release page](https://github.com/envoyproxy/envoy/releases) (ending in `tag/[version]`)
+* Announce in [#envoy-dev](https://envoyproxy.slack.com/archives/C78HA81DH) and [#envoy-users](https://envoyproxy.slack.com/archives/C78M4KW76) slack channels.
 
 
 ## Security release schedule

diff --git a/SECURITY-INSIGHTS.yml b/SECURITY-INSIGHTS.yml
@@ -0,0 +1,67 @@
+header:
+  schema-version: '1.0.0'
+  expiration-date: '2025-01-24T01:00:00.000Z'
+  last-updated: '2024-01-24'
+  last-reviewed: '2024-01-24'
+  project-url: https://github.com/envoyproxy/envoy
+  changelog: https://www.envoyproxy.io/docs/envoy/latest/version_history/version_history#version-history
+  license: https://github.com/envoyproxy/envoy/blob/main/LICENSE
+project-lifecycle:
+  status: active
+  bug-fixes-only: false
+  core-maintainers:  # from https://github.com/envoyproxy/envoy/blob/main/OWNERS.md
+# Senior maintainers
+    - github:mattklein123
+    - github:htuch
+    - github:alyssawilk
+    - github:zuercher
+    - github:lizan
+    - github:ggreenway
+    - github:yanavlasov
+    - github:phlax
+    - github:RyanTheOptimist
+    - github:wbpcode
+# Maintainers
+    - github:jmarantz
+    - github:adisuissa
+    - github:KBaichoo
+    - github:keith
+    - github:kyessenov
+    - github:ravenblackx
+    - github:soulxu
+    - github:nezdolik
+contribution-policy:
+  accepts-pull-requests: true
+  accepts-automated-pull-requests: true
+  code-of-conduct: https://github.com/envoyproxy/envoy/blob/main/CODE_OF_CONDUCT.md
+dependencies:
+  third-party-packages: true
+  dependencies-lists:
+    - https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/external_deps
+  env-dependencies-policy:
+    policy-url: https://github.com/envoyproxy/envoy/blob/main/DEPENDENCY_POLICY.md
+distribution-points:
+  - https://github.com/envoyproxy/envoy
+documentation:
+  - https://www.envoyproxy.io/docs
+security-contacts:
+  - type: email
+    value: envoy-security@googlegroups.com
+security-testing:
+- tool-type: sca
+  tool-name: Dependabot
+  tool-version: latest
+  integration:
+    ad-hoc: false
+    ci: true
+    before-release: true
+- tool-type: sast
+  tool-name: CodeQL
+  tool-version: '2.13.4'
+  integration:
+    ad-hoc: false
+    ci: true
+    before-release: true
+vulnerability-reporting:
+  accepts-vulnerability-reports: true
+  security-policy: https://github.com/envoyproxy/envoy/security/policy
diff --git a/api/BUILD b/api/BUILD
@@ -203,6 +203,7 @@ proto_library(
         "//envoy/extensions/filters/http/oauth2/v3:pkg",
         "//envoy/extensions/filters/http/on_demand/v3:pkg",
         "//envoy/extensions/filters/http/original_src/v3:pkg",
+        "//envoy/extensions/filters/http/proto_message_logging/v3:pkg",
         "//envoy/extensions/filters/http/rate_limit_quota/v3:pkg",
         "//envoy/extensions/filters/http/ratelimit/v3:pkg",
         "//envoy/extensions/filters/http/rbac/v3:pkg",

diff --git a/api/bazel/BUILD b/api/bazel/BUILD
@@ -26,6 +26,15 @@ go_proto_compiler(
     visibility = ["//visibility:public"],
 )
 
+go_proto_compiler(
+    name = "vtprotobuf_plugin_go",
+    options = ["features=marshal_strict+size"],
+    plugin = "@com_github_planetscale_vtprotobuf//cmd/protoc-gen-go-vtproto",
+    suffix = "_vtproto.pb.go",
+    valid_archive = False,
+    visibility = ["//visibility:public"],
+)
+
 json_data(
     name = "repository_locations",
     data = load_repository_locations_spec(REPOSITORY_LOCATIONS_SPEC),

diff --git a/api/bazel/api_build_system.bzl b/api/bazel/api_build_system.bzl
@@ -146,9 +146,9 @@ def api_proto_package(
         has_services = has_services,
     )
 
-    compilers = ["@io_bazel_rules_go//proto:go_proto", "@envoy_api//bazel:pgv_plugin_go"]
+    compilers = ["@io_bazel_rules_go//proto:go_proto", "@envoy_api//bazel:pgv_plugin_go", "@envoy_api//bazel:vtprotobuf_plugin_go"]
     if has_services:
-        compilers = ["@io_bazel_rules_go//proto:go_grpc", "@envoy_api//bazel:pgv_plugin_go"]
+        compilers = ["@io_bazel_rules_go//proto:go_grpc", "@envoy_api//bazel:pgv_plugin_go", "@envoy_api//bazel:vtprotobuf_plugin_go"]
 
     deps = (
         [_go_proto_mapping(dep) for dep in deps] +
@@ -162,6 +162,13 @@ def api_proto_package(
             "@io_bazel_rules_go//proto/wkt:struct_go_proto",
             "@io_bazel_rules_go//proto/wkt:timestamp_go_proto",
             "@io_bazel_rules_go//proto/wkt:wrappers_go_proto",
+            "@com_github_planetscale_vtprotobuf//types/known/anypb",
+            "@com_github_planetscale_vtprotobuf//types/known/durationpb",
+            "@com_github_planetscale_vtprotobuf//types/known/emptypb",
+            "@com_github_planetscale_vtprotobuf//types/known/fieldmaskpb",
+            "@com_github_planetscale_vtprotobuf//types/known/structpb",
+            "@com_github_planetscale_vtprotobuf//types/known/timestamppb",
+            "@com_github_planetscale_vtprotobuf//types/known/wrapperspb",
         ]
     )
     go_proto_library(

diff --git a/api/bazel/repository_locations.bzl b/api/bazel/repository_locations.bzl
@@ -17,11 +17,11 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_desc = "protoc plugin to generate polyglot message validators",
         project_url = "https://github.com/bufbuild/protoc-gen-validate",
         use_category = ["api"],
-        sha256 = "0b1b1ea8c248dce8c7592dc1a93e4adebd116f0d68123f8eb34251e7ce410866",
-        version = "1.0.2",
+        sha256 = "9372f9ecde8fbadf83c8c7de3dbb49b11067aa26fb608c501106d0b4bf06c28f",
+        version = "1.0.4",
         urls = ["https://github.com/bufbuild/protoc-gen-validate/archive/refs/tags/v{version}.zip"],
         strip_prefix = "protoc-gen-validate-{version}",
-        release_date = "2023-06-26",
+        release_date = "2024-01-17",
         implied_untracked_deps = [
             "com_github_iancoleman_strcase",
             "com_github_lyft_protoc_gen_star_v2",
@@ -118,9 +118,9 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "OpenTelemetry Proto",
         project_desc = "Language Independent Interface Types For OpenTelemetry",
         project_url = "https://github.com/open-telemetry/opentelemetry-proto",
-        version = "1.0.0",
-        sha256 = "a13a1a7b76a1f22a0ca2e6c293e176ffef031413ab8ba653a82a1dbc286a3a33",
-        release_date = "2023-07-03",
+        version = "1.1.0",
+        sha256 = "df491a05f3fcbf86cc5ba5c9de81f6a624d74d4773d7009d573e37d6e2b6af64",
+        release_date = "2024-01-11",
         strip_prefix = "opentelemetry-proto-{version}",
         urls = ["https://github.com/open-telemetry/opentelemetry-proto/archive/v{version}.tar.gz"],
         use_category = ["api"],
@@ -131,11 +131,11 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "buf",
         project_desc = "A new way of working with Protocol Buffers.",  # Used for breaking change detection in API protobufs
         project_url = "https://buf.build",
-        version = "1.28.1",
-        sha256 = "870cf492d381a967d36636fdee9da44b524ea62aad163659b8dbf16a7da56987",
+        version = "1.29.0",
+        sha256 = "1033f26361e6fc30ffcfab9d4e4274ffd4af88d9c97de63d2e1721c4a07c1380",
         strip_prefix = "buf",
         urls = ["https://github.com/bufbuild/buf/releases/download/v{version}/buf-Linux-x86_64.tar.gz"],
-        release_date = "2023-11-15",
+        release_date = "2024-01-24",
         use_category = ["api"],
         license = "Apache-2.0",
         license_url = "https://github.com/bufbuild/buf/blob/v{version}/LICENSE",

diff --git a/api/contrib/envoy/extensions/private_key_providers/cryptomb/v3alpha/cryptomb.proto b/api/contrib/envoy/extensions/private_key_providers/cryptomb/v3alpha/cryptomb.proto
@@ -21,10 +21,10 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 
 // A CryptoMbPrivateKeyMethodConfig message specifies how the CryptoMb private
 // key provider is configured. The private key provider provides ``SIMD``
-// processing for RSA sign and decrypt operations (ECDSA signing uses regular
-// BoringSSL functions). The provider works by gathering the operations into a
-// worker-thread specific queue, and processing the queue using ``ipp-crypto``
-// library when the queue is full or when a timer expires.
+// processing for ECDSA sign operations and RSA sign and decrypt operations.
+// The provider works by gathering the operations into a worker-thread specific
+// queue, and processing the queue using ``ipp-crypto`` library when the queue
+// is full or when a timer expires.
 // [#extension-category: envoy.tls.key_providers]
 message CryptoMbPrivateKeyMethodConfig {
   // Private key to use in the private key provider. If set to inline_bytes or

diff --git a/api/envoy/config/cluster/v3/cluster.proto b/api/envoy/config/cluster/v3/cluster.proto
@@ -1236,13 +1236,38 @@ message UpstreamConnectionOptions {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.api.v2.UpstreamConnectionOptions";
 
+  enum FirstAddressFamilyVersion {
+    // respect the native ranking of destination ip addresses returned from dns
+    // resolution
+    DEFAULT = 0;
+
+    V4 = 1;
+
+    V6 = 2;
+  }
+
+  message HappyEyeballsConfig {
+    // Specify the IP address family to attempt connection first in happy
+    // eyeballs algorithm according to RFC8305#section-4.
+    FirstAddressFamilyVersion first_address_family_version = 1;
+
+    // Specify the number of addresses of the first_address_family_version being
+    // attempted for connection before the other address family.
+    google.protobuf.UInt32Value first_address_family_count = 2 [(validate.rules).uint32 = {gte: 1}];
+  }
+
   // If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.
   core.v3.TcpKeepalive tcp_keepalive = 1;
 
   // If enabled, associates the interface name of the local address with the upstream connection.
   // This can be used by extensions during processing of requests. The association mechanism is
   // implementation specific. Defaults to false due to performance concerns.
   bool set_local_interface_name_on_upstream_connections = 2;
+
+  // Configurations for happy eyeballs algorithm.
+  // Add configs for first_address_family_version and first_address_family_count
+  // when sorting destination ip addresses.
+  HappyEyeballsConfig happy_eyeballs_config = 3;
 }
 
 message TrackClusterStats {

diff --git a/api/envoy/config/listener/v3/quic_config.proto b/api/envoy/config/listener/v3/quic_config.proto
@@ -24,7 +24,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // [#protodoc-title: QUIC listener config]
 
 // Configuration specific to the UDP QUIC listener.
-// [#next-free-field: 10]
+// [#next-free-field: 11]
 message QuicProtocolOptions {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.api.v2.listener.QuicProtocolOptions";
@@ -77,4 +77,8 @@ message QuicProtocolOptions {
   // [#extension-category: envoy.quic.server_preferred_address]
   core.v3.TypedExtensionConfig server_preferred_address_config = 9
       [(xds.annotations.v3.field_status).work_in_progress = true];
+
+  // Configure the server to send transport parameter `disable_active_migration <https://www.rfc-editor.org/rfc/rfc9000#section-18.2-4.30.1>`_.
+  // Defaults to false (do not send this transport parameter).
+  google.protobuf.BoolValue send_disable_active_migration = 10;
 }
diff --git a/api/envoy/config/rbac/v3/rbac.proto b/api/envoy/config/rbac/v3/rbac.proto
@@ -194,7 +194,7 @@ message Policy {
 }
 
 // Permission defines an action (or actions) that a principal can take.
-// [#next-free-field: 13]
+// [#next-free-field: 14]
 message Permission {
   option (udpa.annotations.versioning).previous_message_type = "envoy.config.rbac.v2.Permission";
 
@@ -270,6 +270,10 @@ message Permission {
     // Extension for configuring custom matchers for RBAC.
     // [#extension-category: envoy.rbac.matchers]
     core.v3.TypedExtensionConfig matcher = 12;
+
+    // URI template path matching.
+    // [#extension-category: envoy.path.match]
+    core.v3.TypedExtensionConfig uri_template = 13;
   }
 }