Merge remote-tracking branch 'upstream/main' into hqin/cleanup_grpc_h…

…ttp1_reverse_bridge_handle_empty_response

* upstream/main:
  tcp conn pool: honor connection_pool_per_downstream_connection (envoyproxy#34763)
  runtime: deprecating avoid_zombie_streams (envoyproxy#35376)
  tracing: xray annotation documentation and CODEOWNER (envoyproxy#35257)
  overload manager: removing exceptions (envoyproxy#35347)
  runtime: remove runtime flag envoy.reloadable_features.abort_filter_chain_on_stream_reset (envoyproxy#35405)
  build(deps): bump nginx from `67682bd` to `6af79ae` in /examples/local_ratelimit in the examples-local-ratelimit group (envoyproxy#35401)
  build(deps): bump postgres from `0aafd2a` to `7963e57` in /examples/shared/postgres (envoyproxy#35400)
  build(deps): bump node from `426d993` to `2fb92fe` in /examples/shared/node (envoyproxy#35399)
  build(deps): bump mysql from 9.0.0 to 9.0.1 in /examples/mysql (envoyproxy#35402)
  build(deps): bump framer-motion from 11.3.8 to 11.3.12 in /examples/single-page-app/ui (envoyproxy#35398)
  build(deps): bump golang from `6c27802` to `af9b40f` in /examples/shared/golang (envoyproxy#35395)
  build(deps): bump redis from `fb534a3` to `5a82749` in /examples/redis (envoyproxy#35397)
  Add %UPSTREAM_CLUSTER_RAW% formatter (envoyproxy#35265)
  Remove runtime flag envoy_reloadable_features_send_header_raw_value (envoyproxy#35388)
  router: removing a few exceptions (envoyproxy#35346)
  Quiche roll 20240717144914 (envoyproxy#35241)
  ext_proc: flow control in observability mode (envoyproxy#35298)
  tls: remove runtime guard `ssl_transport_failure_reason_format` (envoyproxy#35389)

CODEOWNERS

@@ -62,7 +62,7 @@ extensions/filters/common/original_src @klarose @mattklein123
 # tracers.datadog extension
 /*/extensions/tracers/datadog @dmehala @mattklein123
 # tracers.xray extension
-/*/extensions/tracers/xray @suniltheta @mattklein123
+/*/extensions/tracers/xray @suniltheta @mattklein123 @nbaws
 # tracers.skywalking extension
 /*/extensions/tracers/skywalking @wbpcode @Shikugawa
 # tracers.opentelemetry extension

api/envoy/config/trace/v3/xray.proto

@@ -21,6 +21,65 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 
 // [#protodoc-title: AWS X-Ray Tracer Configuration]
 // Configuration for AWS X-Ray tracer
+//
+// The X-Ray tracer will automatically attach :ref:`custom_tags <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.custom_tags>` as annotations to the span. (See: `Annotations <https://docs.aws.amazon.com/xray/latest/devguide/xray-concepts.html#xray-concepts-annotations>`_.)
+//
+// AWS X-Ray trace annotations are also created by the tracing subsystem automatically based on metadata provided during creation of a span.
+//
+// An example X-Ray trace span that is generated by the envoy trace subsystem is as follows:
+//
+// .. code-block:: json
+//
+//   {
+//     "Id": "1-6698980d-e829ae270ab34b69b488b098",
+//     "Duration": 0.016,
+//     "LimitExceeded": false,
+//     "Segments":
+//     [
+//       {
+//         "Id": "15d65e5ced8dfe76",
+//         "Document":
+//         {
+//           "id": "15d65e5ced8dfe76",
+//           "name": "envoy-example",
+//           "start_time": 1721276429.410355,
+//           "trace_id": "1-6698980d-e829ae270ab34b69b488b098",
+//           "end_time": 1721276429.426068,
+//           "fault": true,
+//           "http":
+//           {
+//             "request":
+//             {
+//               "url": "http://example/path",
+//               "method": "GET",
+//               "user_agent": "curl/8.5.0",
+//               "client_ip": "127.0.0.1",
+//               "x_forwarded_for": false
+//             },
+//             "response":
+//             {
+//               "status": 503,
+//               "content_length": 216
+//             }
+//           },
+//           "aws": {},
+//           "annotations":
+//           {
+//             "response_flags": "UF",
+//             "component": "proxy",
+//             "upstream_cluster": "upstream_cluster",
+//             "annotation_from_custom_tag": "example",
+//             "http.protocol": "HTTP/1.1",
+//             "request_size": "0",
+//             "downstream_cluster": "-",
+//             "direction": "ingress",
+//             "upstream_cluster.name": "upstream_cluster"
+//           }
+//         }
+//       }
+//     ]
+//   }
+//
 
 // [#extension: envoy.tracers.xray]
 message XRayConfig {

api/envoy/service/ext_proc/v3/external_processor.proto

@@ -206,12 +206,8 @@ message ProcessingResponse {
 message HttpHeaders {
   // The HTTP request headers. All header keys will be
   // lower-cased, because HTTP header keys are case-insensitive.
-  // The ``headers`` encoding is based on the runtime guard
-  // envoy_reloadable_features_send_header_raw_value setting.
-  // When it is true, the header value is encoded in the
+  // The header value is encoded in the
   // :ref:`raw_value <envoy_v3_api_field_config.core.v3.HeaderValue.raw_value>` field.
-  // When it is false, the header value is encoded in the
-  // :ref:`value <envoy_v3_api_field_config.core.v3.HeaderValue.value>` field.
   config.core.v3.HeaderMap headers = 1;
 
   // [#not-implemented-hide:]
@@ -235,12 +231,8 @@ message HttpBody {
 
 // This message contains the trailers.
 message HttpTrailers {
-  // The ``trailers`` encoding is based on the runtime guard
-  // envoy_reloadable_features_send_header_raw_value setting.
-  // When it is true, the header value is encoded in the
+  // The header value is encoded in the
   // :ref:`raw_value <envoy_v3_api_field_config.core.v3.HeaderValue.raw_value>` field.
-  // When it is false, the header value is encoded in the
-  // :ref:`value <envoy_v3_api_field_config.core.v3.HeaderValue.value>` field.
   config.core.v3.HeaderMap trailers = 1;
 }
 
@@ -308,12 +300,8 @@ message CommonResponse {
   // Add new trailers to the message. This may be used when responding to either a
   // HttpHeaders or HttpBody message, but only if this message is returned
   // along with the CONTINUE_AND_REPLACE status.
-  // The ``trailers`` encoding is based on the runtime guard
-  // envoy_reloadable_features_send_header_raw_value setting.
-  // When it is true, the header value is encoded in the
+  // The header value is encoded in the
   // :ref:`raw_value <envoy_v3_api_field_config.core.v3.HeaderValue.raw_value>` field.
-  // When it is false, the header value is encoded in the
-  // :ref:`value <envoy_v3_api_field_config.core.v3.HeaderValue.value>` field.
   config.core.v3.HeaderMap trailers = 4;
 
   // Clear the route cache for the current client request. This is necessary
@@ -362,12 +350,8 @@ message HeaderMutation {
   // Add or replace HTTP headers. Attempts to set the value of
   // any ``x-envoy`` header, and attempts to set the ``:method``,
   // ``:authority``, ``:scheme``, or ``host`` headers will be ignored.
-  // The ``set_headers`` encoding is based on the runtime guard
-  // envoy_reloadable_features_send_header_raw_value setting.
-  // When it is true, the header value is encoded in the
+  // The header value is encoded in the
   // :ref:`raw_value <envoy_v3_api_field_config.core.v3.HeaderValue.raw_value>` field.
-  // When it is false, the header value is encoded in the
-  // :ref:`value <envoy_v3_api_field_config.core.v3.HeaderValue.value>` field.
   repeated config.core.v3.HeaderValueOption set_headers = 1;
 
   // Remove these HTTP headers. Attempts to remove system headers --

bazel/repositories.bzl

@@ -1139,7 +1139,6 @@ def _com_github_google_quiche():
         patch_cmds = ["find quiche/ -type f -name \"*.bazel\" -delete"],
         patches = [
             "@envoy//bazel/external:quiche_sequencer_fix.patch",
-            "@envoy//bazel/external:quiche_stream_fix.patch",
         ],
         patch_args = ["-p1"],
         build_file = "@envoy//bazel/external:quiche.BUILD",

bazel/repository_locations.bzl

@@ -1191,12 +1191,12 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "QUICHE",
         project_desc = "QUICHE (QUIC, HTTP/2, Etc) is Google‘s implementation of QUIC and related protocols",
         project_url = "https://github.com/google/quiche",
-        version = "7880417d1eec571527443008ac7bad4735232a62",
-        sha256 = "e6b658d0c109b561c580ec66768ffdda737e6332bb195150bf1622ce6415dbf5",
+        version = "f8ca4ffbe5eb5c099bd11ba3e90553fa282c8421",
+        sha256 = "7648ede3f32bc6367a629b245d268c9be47ba05e23b4345a54152dabeba387d9",
         urls = ["https://github.com/google/quiche/archive/{version}.tar.gz"],
         strip_prefix = "quiche-{version}",
         use_category = ["controlplane", "dataplane_core"],
-        release_date = "2024-07-11",
+        release_date = "2024-07-17",
         cpe = "N/A",
         license = "BSD-3-Clause",
         license_url = "https://github.com/google/quiche/blob/{version}/LICENSE",

changelogs/current.yaml

@@ -5,6 +5,10 @@ behavior_changes:
 
 minor_behavior_changes:
 # *Changes that may cause incompatibilities for some users, but should not for most*
+- area: tcp
+  change: |
+    Added support for :ref:`connection_pool_per_downstream_connection
+    <envoy_v3_api_field_config.cluster.v3.Cluster.connection_pool_per_downstream_connection>` flag in tcp connection pool.
 - area: lua
   change: |
     When Lua script executes httpCall, backpressure is exercised when receiving body from downstream client. This behavior can be reverted
@@ -24,13 +28,26 @@ bug_fixes:
 
 removed_config_or_runtime:
 # *Normally occurs at the end of the* :ref:`deprecation period <deprecated>`
+- area: upstream
+  change: |
+    Removed runtime flag ``envoy.reloadable_features.avoid_zombie_streams`` and legacy code paths.
+- area: ext_proc
+  change: |
+    Removed runtime flag ``envoy_reloadable_features_send_header_raw_value`` and legacy code path.
 - area: http
   change: |
     Removed runtime flag ``envoy.reloadable_features.no_downgrade_to_canonical_name`` and legacy code
     path.
 - area: DNS
   change: |
     Removed ``envoy.reloadable_features.dns_cache_set_first_resolve_complete`` runtime flag and legacy code paths.
+- area: tls
+  change: |
+    Removed runtime flag ``envoy.reloadable_features.ssl_transport_failure_reason_format``.
+- area: http
+  change: |
+    Removed runtime flag ``envoy.reloadable_features.abort_filter_chain_on_stream_reset`` and legacy
+    code path.
 - area: grpc reverse bridge
   change: |
     Removed ``envoy.reloadable_features.grpc_http1_reverse_bridge_handle_empty_response`` runtime
@@ -47,5 +64,9 @@ new_features:
     Added config field
     :ref:`filter_metadata <envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.filter_metadata>`
     for injecting arbitrary data to the filter state for logging.
+- area: access_log
+  change: |
+    added %UPSTREAM_CLUSTER_RAW% access log formatter to log the original upstream cluster name, regadless of whether
+    ``alt_stat_name`` is set.
 
 deprecated:

docs/root/configuration/observability/access_log/usage.rst

@@ -576,6 +576,10 @@ UDP
   Upstream cluster to which the upstream host belongs to. :ref:`alt_stat_name
   <envoy_v3_api_field_config.cluster.v3.Cluster.alt_stat_name>` will be used if provided.
 
+%UPSTREAM_CLUSTER_RAW%
+  Upstream cluster to which the upstream host belongs to. :ref:`alt_stat_name
+  <envoy_v3_api_field_config.cluster.v3.Cluster.alt_stat_name>` does NOT modify this value.
+
 %UPSTREAM_LOCAL_ADDRESS%
   Local address of the upstream connection. If the address is an IP address it includes both
   address and port.

examples/local_ratelimit/Dockerfile-nginx

@@ -1 +1 @@
-FROM nginx@sha256:67682bda769fae1ccf5183192b8daf37b64cae99c6c3302650f6f8bf5f0f95df
+FROM nginx@sha256:6af79ae5de407283dcea8b00d5c37ace95441fd58a8b1d2aa1ed93f5511bb18c

examples/mysql/Dockerfile-mysql

@@ -1 +1 @@
-FROM mysql:9.0.0@sha256:72a37ddc9f839cfd84f1f6815fb31ba26f37f4c200b90e49607797480e3be446
+FROM mysql:9.0.1@sha256:d8df069848906979fd7511db00dc22efeb0a33a990d87c3c6d3fcdafd6fc6123

examples/redis/Dockerfile-redis

@@ -1 +1 @@
-FROM redis@sha256:fb534a36ac2034a6374933467d971fbcbfa5d213805507f560d564851a720355
+FROM redis@sha256:5a82749600e03e4c4208276283f1f39d2dfde31700582c5a0b3e4ab48a2ddf7e

examples/shared/golang/Dockerfile

@@ -3,7 +3,7 @@ RUN rm -f /etc/apt/apt.conf.d/docker-clean \
     && echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' | tee /etc/apt/apt.conf.d/keep-cache
 
 
-FROM golang:1.22.5-bookworm@sha256:6c2780255bb7b881e904e303be0d7a079054160b2ce1efde446693c0850a39ad AS golang-base
+FROM golang:1.22.5-bookworm@sha256:af9b40f2b1851be993763b85288f8434af87b5678af04355b1e33ff530b5765f AS golang-base
 
 
 FROM golang-base AS golang-control-plane-builder

examples/shared/node/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22.5-bookworm-slim@sha256:426d99333b9d35f568cc604b604ea484aef7d12b21e78a36c4bfbdf5cfa4afe2 AS node-base
+FROM node:22.5-bookworm-slim@sha256:2fb92fe9d7350866a73c5cc311c1a19919ffd47e8592d4233374ee330e3bdb1e AS node-base
 
 
 FROM node-base AS node-http-auth

examples/shared/postgres/Dockerfile

@@ -1,3 +1,3 @@
-FROM postgres:latest@sha256:0aafd2ae7e6c391f39fb6b7621632d79f54068faebc726caf469e87bd1d301c0
+FROM postgres:latest@sha256:7963e577a0ac17c9718b5f8cbc1b10da3147e2de97c534e3c3ac6e54108957cb
 COPY docker-healthcheck.sh /usr/local/bin/
 HEALTHCHECK CMD ["docker-healthcheck.sh"]

examples/single-page-app/ui/package.json

@@ -14,7 +14,7 @@
     "@chakra-ui/react": "^2.8.2",
     "@emotion/react": "^11.13.0",
     "@emotion/styled": "^11.13.0",
-    "framer-motion": "^11.3.8",
+    "framer-motion": "^11.3.12",
     "mdi-react": "^9.3.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",

examples/single-page-app/ui/yarn.lock

@@ -2723,10 +2723,10 @@ for-each@^0.3.3:
   dependencies:
     is-callable "^1.1.3"
 
-framer-motion@^11.3.8:
-  version "11.3.8"
-  resolved "https://registry.yarnpkg.com/framer-motion/-/framer-motion-11.3.8.tgz#682df8cbac6a9667b48af427e5a8bdaea7203713"
-  integrity sha512-1D+RDTsIp4Rz2dq/oToqSEc9idEQwgBRQyBq4rGpFba+0Z+GCbj9z1s0+ikFbanWe3YJ0SqkNlDe08GcpFGj5A==
+framer-motion@^11.3.12:
+  version "11.3.12"
+  resolved "https://registry.yarnpkg.com/framer-motion/-/framer-motion-11.3.12.tgz#28927129824ce2ce52b5da1f7a4930a4063bafa2"
+  integrity sha512-ulc8EHFZpKIj+NAyJv+alLUEUIXZKOQnE+JHkGjfoIcxbZwV+CSvfOoACaOpAW4nVznFMF2y3r+ViUtPtP4qiw==
   dependencies:
     tslib "^2.4.0"
 

mobile/library/common/engine_common.cc

@@ -59,7 +59,7 @@ class ServerLite : public Server::InstanceBase {
 public:
   using Server::InstanceBase::InstanceBase;
   void maybeCreateHeapShrinker() override {}
-  std::unique_ptr<Envoy::Server::OverloadManager> createOverloadManager() override {
+  absl::StatusOr<std::unique_ptr<Envoy::Server::OverloadManager>> createOverloadManager() override {
     return std::make_unique<Envoy::Server::NullOverloadManager>(threadLocal(), true);
   }
   std::unique_ptr<Envoy::Server::OverloadManager> createNullOverloadManager() override {

source/common/formatter/stream_info_formatter.cc

@@ -1123,6 +1123,22 @@ const StreamInfoFormatterProviderLookupTable& getKnownStreamInfoFormatterProvide
                           stream_info.upstreamClusterInfo().value()->observabilityName();
                     }
 
+                    return upstream_cluster_name.empty()
+                               ? absl::nullopt
+                               : absl::make_optional<std::string>(upstream_cluster_name);
+                  });
+            }}},
+          {"UPSTREAM_CLUSTER_RAW",
+           {CommandSyntaxChecker::COMMAND_ONLY,
+            [](const std::string&, absl::optional<size_t>) {
+              return std::make_unique<StreamInfoStringFormatterProvider>(
+                  [](const StreamInfo::StreamInfo& stream_info) {
+                    std::string upstream_cluster_name;
+                    if (stream_info.upstreamClusterInfo().has_value() &&
+                        stream_info.upstreamClusterInfo().value() != nullptr) {
+                      upstream_cluster_name = stream_info.upstreamClusterInfo().value()->name();
+                    }
+
                     return upstream_cluster_name.empty()
                                ? absl::nullopt
                                : absl::make_optional<std::string>(upstream_cluster_name);

source/common/http/conn_pool_grid.cc

@@ -215,7 +215,7 @@ void ConnectivityGrid::WrapperCallbacks::onConnectionAttemptReady(
   }
   if (callbacks != nullptr) {
     callbacks->onPoolReady(encoder, host, info, protocol);
-  } else if (Runtime::runtimeFeatureEnabled("envoy.reloadable_features.avoid_zombie_streams")) {
+  } else {
     encoder.getStream().resetStream(StreamResetReason::LocalReset);
   }
 }

source/common/http/filter_manager.cc

@@ -1743,15 +1743,12 @@ void ActiveStreamEncoderFilter::responseDataDrained() {
 
 void FilterManager::resetStream(StreamResetReason reason,
                                 absl::string_view transport_failure_reason) {
-  if (Runtime::runtimeFeatureEnabled(
-          "envoy.reloadable_features.abort_filter_chain_on_stream_reset")) {
-    // Stop filter chain iteration if stream is reset while filter decoding or encoding callbacks
-    // are running.
-    if (state_.filter_call_state_ & FilterCallState::IsDecodingMask) {
-      state_.decoder_filter_chain_aborted_ = true;
-    } else if (state_.filter_call_state_ & FilterCallState::IsEncodingMask) {
-      state_.encoder_filter_chain_aborted_ = true;
-    }
+  // Stop filter chain iteration if stream is reset while filter decoding or encoding callbacks
+  // are running.
+  if (state_.filter_call_state_ & FilterCallState::IsDecodingMask) {
+    state_.decoder_filter_chain_aborted_ = true;
+  } else if (state_.filter_call_state_ & FilterCallState::IsEncodingMask) {
+    state_.encoder_filter_chain_aborted_ = true;
   }
 
   filter_manager_callbacks_.resetStream(reason, transport_failure_reason);