Merge remote-tracking branch 'upstream/main' into e2e-assoc-req-dump

Signed-off-by: Kevin Baichoo <kbaichoo@google.com>

Author: KBaichoo

api/envoy/admin/v3/server_info.proto

@@ -58,7 +58,7 @@ message ServerInfo {
   config.core.v3.Node node = 7;
 }
 
-// [#next-free-field: 37]
+// [#next-free-field: 38]
 message CommandLineOptions {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.admin.v2alpha.CommandLineOptions";
@@ -189,4 +189,7 @@ message CommandLineOptions {
 
   // See :option:`--socket-mode` for details.
   uint32 socket_mode = 36;
+
+  // See :option:`--enable-core-dump` for details.
+  bool enable_core_dump = 37;
 }

api/envoy/admin/v4alpha/server_info.proto

@@ -29,26 +29,15 @@ message AccessLog {
 
   reserved "config";
 
-  // The name of the access log implementation to instantiate. The name must
-  // match a statically registered access log. Current built-in loggers include:
-  //
-  // #. "envoy.access_loggers.file"
-  // #. "envoy.access_loggers.http_grpc"
-  // #. "envoy.access_loggers.tcp_grpc"
+  // The name of the access log extension to instantiate.
+  // The name must match one of the compiled in loggers.
+  // See the :ref:`extensions listed in typed_config below <extension_category_envoy.access_loggers>` for the default list of available loggers.
   string name = 1;
 
   // Filter which is used to determine if the access log needs to be written.
   AccessLogFilter filter = 2;
 
-  // Custom configuration that depends on the access log being instantiated.
-  // Built-in configurations include:
-  //
-  // #. "envoy.access_loggers.file": :ref:`FileAccessLog
-  //    <envoy_api_msg_extensions.access_loggers.file.v3.FileAccessLog>`
-  // #. "envoy.access_loggers.http_grpc": :ref:`HttpGrpcAccessLogConfig
-  //    <envoy_api_msg_extensions.access_loggers.grpc.v3.HttpGrpcAccessLogConfig>`
-  // #. "envoy.access_loggers.tcp_grpc": :ref:`TcpGrpcAccessLogConfig
-  //    <envoy_api_msg_extensions.access_loggers.grpc.v3.TcpGrpcAccessLogConfig>`
+  // Custom configuration that must be set according to the access logger extension being instantiated.
   // [#extension-category: envoy.access_loggers]
   oneof config_type {
     google.protobuf.Any typed_config = 4;

api/envoy/config/accesslog/v3/accesslog.proto

@@ -29,13 +29,8 @@ message StatsSink {
   reserved "config";
 
   // The name of the stats sink to instantiate. The name must match a supported
-  // stats sink. The built-in stats sinks are:
-  //
-  // * :ref:`envoy.stat_sinks.statsd <envoy_api_msg_config.metrics.v3.StatsdSink>`
-  // * :ref:`envoy.stat_sinks.dog_statsd <envoy_api_msg_config.metrics.v3.DogStatsdSink>`
-  // * :ref:`envoy.stat_sinks.metrics_service <envoy_api_msg_config.metrics.v3.MetricsServiceConfig>`
-  // * :ref:`envoy.stat_sinks.hystrix <envoy_api_msg_config.metrics.v3.HystrixSink>`
-  //
+  // stats sink.
+  // See the :ref:`extensions listed in typed_config below <extension_category_envoy.stats_sinks>` for the default list of available stats sink.
   // Sinks optionally support tagged/multiple dimensional metrics.
   string name = 1;
 

api/envoy/config/accesslog/v4alpha/accesslog.proto

@@ -32,12 +32,8 @@ message ResourceMonitor {
   reserved "config";
 
   // The name of the resource monitor to instantiate. Must match a registered
-  // resource monitor type. The built-in resource monitors are:
-  //
-  // * :ref:`envoy.resource_monitors.fixed_heap
-  //   <envoy_api_msg_config.resource_monitor.fixed_heap.v2alpha.FixedHeapConfig>`
-  // * :ref:`envoy.resource_monitors.injected_resource
-  //   <envoy_api_msg_config.resource_monitor.injected_resource.v2alpha.InjectedResourceConfig>`
+  // resource monitor type.
+  // See the :ref:`extensions listed in typed_config below <extension_category_envoy.resource_monitors>` for the default list of available resource monitor.
   string name = 1 [(validate.rules).string = {min_len: 1}];
 
   // Configuration for the resource monitor being instantiated.

api/envoy/config/metrics/v3/stats.proto

@@ -43,25 +43,11 @@ message Tracing {
     reserved "config";
 
     // The name of the HTTP trace driver to instantiate. The name must match a
-    // supported HTTP trace driver. Built-in trace drivers:
-    //
-    // - *envoy.tracers.lightstep*
-    // - *envoy.tracers.zipkin*
-    // - *envoy.tracers.dynamic_ot*
-    // - *envoy.tracers.datadog*
-    // - *envoy.tracers.opencensus*
-    // - *envoy.tracers.xray*
+    // supported HTTP trace driver.
+    // See the :ref:`extensions listed in typed_config below <extension_category_envoy.tracers>` for the default list of the HTTP trace driver.
     string name = 1 [(validate.rules).string = {min_len: 1}];
 
-    // Trace driver specific configuration which depends on the driver being instantiated.
-    // See the trace drivers for examples:
-    //
-    // - :ref:`LightstepConfig <envoy_api_msg_config.trace.v3.LightstepConfig>`
-    // - :ref:`ZipkinConfig <envoy_api_msg_config.trace.v3.ZipkinConfig>`
-    // - :ref:`DynamicOtConfig <envoy_api_msg_config.trace.v3.DynamicOtConfig>`
-    // - :ref:`DatadogConfig <envoy_api_msg_config.trace.v3.DatadogConfig>`
-    // - :ref:`OpenCensusConfig <envoy_api_msg_config.trace.v3.OpenCensusConfig>`
-    // - :ref:`AWS X-Ray <envoy_api_msg_config.trace.v3.XRayConfig>`
+    // Trace driver specific configuration which must be set according to the driver being instantiated.
     // [#extension-category: envoy.tracers]
     oneof config_type {
       google.protobuf.Any typed_config = 3;

api/envoy/config/metrics/v4alpha/stats.proto

@@ -41,7 +41,7 @@ message OAuth2Credentials {
 
 // OAuth config
 //
-// [#next-free-field: 10]
+// [#next-free-field: 11]
 message OAuth2Config {
   // Endpoint on the authorization server to retrieve the access token from.
   config.core.v3.HttpUri token_endpoint = 1;
@@ -76,6 +76,10 @@ message OAuth2Config {
   // defaults to "user" scope.
   // OAuth RFC https://tools.ietf.org/html/rfc6749#section-3.3
   repeated string auth_scopes = 9;
+
+  // Optional resource parameter for authorization request
+  // RFC: https://tools.ietf.org/html/rfc8707
+  repeated string resources = 10;
 }
 
 // Filter config.

api/envoy/config/overload/v3/overload.proto

@@ -29,6 +29,11 @@ message RBAC {
   // but will emit stats and logs and can be used for rule testing.
   // If absent, no shadow RBAC policy will be applied.
   config.rbac.v3.RBAC shadow_rules = 2;
+
+  // If specified, shadow rules will emit stats with the given prefix.
+  // This is useful to distinguish the stat when there are more than 1 RBAC filter configured with
+  // shadow rules.
+  string shadow_rules_stat_prefix = 3;
 }
 
 message RBACPerRoute {

api/envoy/config/trace/v3/http_tracer.proto

@@ -21,6 +21,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 //
 // Header should not be used in rules/shadow_rules in RBAC network filter as
 // this information is only available in :ref:`RBAC http filter <config_http_filters_rbac>`.
+// [#next-free-field: 6]
 message RBAC {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.filter.network.rbac.v2.RBAC";
@@ -45,6 +46,11 @@ message RBAC {
   // If absent, no shadow RBAC policy will be applied.
   config.rbac.v3.RBAC shadow_rules = 2;
 
+  // If specified, shadow rules will emit stats with the given prefix.
+  // This is useful to distinguish the stat when there are more than 1 RBAC filter configured with
+  // shadow rules.
+  string shadow_rules_stat_prefix = 5;
+
   // The prefix to use when emitting statistics.
   string stat_prefix = 3 [(validate.rules).string = {min_len: 1}];
 

api/envoy/config/trace/v4alpha/http_tracer.proto

@@ -40,7 +40,7 @@ message SanitizationConfig {
 }
 
 // Configuration for a Wasm VM.
-// [#next-free-field: 7]
+// [#next-free-field: 8]
 message VmConfig {
   // An ID which will be used along with a hash of the wasm code (or the name of the registered Null
   // VM plugin) to determine which VM will be used for the plugin. All plugins which use the same
@@ -93,6 +93,22 @@ message VmConfig {
   // update and do a background fetch to fill the cache, otherwise fetch the code asynchronously and enter
   // warming state.
   bool nack_on_code_cache_miss = 6;
+
+  // Specifies environment variables to be injected to this VM which will be available through
+  // WASI's ``environ_get`` and ``environ_get_sizes`` system calls. Note that these functions are mostly implicitly
+  // called in your language's standard library, so you do not need to call them directly and you can access to env
+  // vars just like when you do on native platforms.
+  // Warning: Envoy rejects the configuration if there's conflict of key space.
+  EnvironmentVariables environment_variables = 7;
+}
+
+message EnvironmentVariables {
+  // The keys of *Envoy's* environment variables exposed to this VM. In other words, if a key exists in Envoy's environment
+  // variables, then that key-value pair will be injected. Note that if a key does not exist, it will be ignored.
+  repeated string host_env_keys = 1;
+
+  // Explicitly given key-value pairs to be injected to this VM in the form of "KEY=VALUE".
+  map<string, string> key_values = 2;
 }
 
 // Base Configuration for Wasm Plugins e.g. filters and services.

api/envoy/extensions/filters/http/oauth2/v3alpha/oauth.proto

@@ -8,7 +8,9 @@ load(
     _envoy_basic_cc_library = "envoy_basic_cc_library",
     _envoy_cc_extension = "envoy_cc_extension",
     _envoy_cc_library = "envoy_cc_library",
+    _envoy_cc_linux_library = "envoy_cc_linux_library",
     _envoy_cc_posix_library = "envoy_cc_posix_library",
+    _envoy_cc_posix_without_linux_library = "envoy_cc_posix_without_linux_library",
     _envoy_cc_win32_library = "envoy_cc_win32_library",
     _envoy_include_prefix = "envoy_include_prefix",
     _envoy_proto_library = "envoy_proto_library",
@@ -32,6 +34,7 @@ load(
     _envoy_cc_test = "envoy_cc_test",
     _envoy_cc_test_binary = "envoy_cc_test_binary",
     _envoy_cc_test_library = "envoy_cc_test_library",
+    _envoy_py_test = "envoy_py_test",
     _envoy_py_test_binary = "envoy_py_test_binary",
     _envoy_sh_test = "envoy_sh_test",
 )
@@ -145,6 +148,16 @@ def envoy_cc_platform_dep(name):
         "//conditions:default": [name + "_posix"],
     })
 
+# Used to select a dependency that has different implementations on Linux vs rest of POSIX vs Windows.
+# The platform-specific implementations should be specified with envoy_cc_linux_library,
+# envoy_cc_posix_without_library and envoy_cc_win32_library respectively
+def envoy_cc_platform_specific_dep(name):
+    return select({
+        "@envoy//bazel:windows_x86_64": [name + "_win32"],
+        "@envoy//bazel:linux": [name + "_linux"],
+        "//conditions:default": [name + "_posix"],
+    })
+
 # Envoy proto descriptor targets should be specified with this function.
 # This is used for testing only.
 def envoy_proto_descriptor(name, out, srcs = [], external_deps = []):
@@ -202,7 +215,9 @@ envoy_cc_binary = _envoy_cc_binary
 envoy_basic_cc_library = _envoy_basic_cc_library
 envoy_cc_extension = _envoy_cc_extension
 envoy_cc_library = _envoy_cc_library
+envoy_cc_linux_library = _envoy_cc_linux_library
 envoy_cc_posix_library = _envoy_cc_posix_library
+envoy_cc_posix_without_linux_library = _envoy_cc_posix_without_linux_library
 envoy_cc_win32_library = _envoy_cc_win32_library
 envoy_include_prefix = _envoy_include_prefix
 envoy_proto_library = _envoy_proto_library
@@ -215,5 +230,6 @@ envoy_cc_test_binary = _envoy_cc_test_binary
 envoy_cc_test_library = _envoy_cc_test_library
 envoy_cc_benchmark_binary = _envoy_cc_benchmark_binary
 envoy_benchmark_test = _envoy_benchmark_test
+envoy_py_test = _envoy_py_test
 envoy_py_test_binary = _envoy_py_test_binary
 envoy_sh_test = _envoy_sh_test