Merge branch 'main' into mmdb-reload

Signed-off-by: Kateryna Nezdolii <kateryna.nezdolii@gmail.com>

CODEOWNERS

@@ -62,7 +62,7 @@ extensions/filters/common/original_src @klarose @mattklein123
 # tracers.datadog extension
 /*/extensions/tracers/datadog @dmehala @mattklein123
 # tracers.xray extension
-/*/extensions/tracers/xray @suniltheta @mattklein123
+/*/extensions/tracers/xray @suniltheta @mattklein123 @nbaws
 # tracers.skywalking extension
 /*/extensions/tracers/skywalking @wbpcode @Shikugawa
 # tracers.opentelemetry extension

api/envoy/config/core/v3/socket_option.proto

@@ -36,7 +36,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // :ref:`admin's <envoy_v3_api_field_config.bootstrap.v3.Admin.socket_options>` socket_options etc.
 //
 // It should be noted that the name or level may have different values on different platforms.
-// [#next-free-field: 7]
+// [#next-free-field: 8]
 message SocketOption {
   option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.SocketOption";
 
@@ -51,6 +51,29 @@ message SocketOption {
     STATE_LISTENING = 2;
   }
 
+  // The `socket type <https://linux.die.net/man/2/socket>`_ to apply the socket option to.
+  // Only one field should be set. If multiple fields are set, the precedence order will determine
+  // the selected one. If none of the fields is set, the socket option will be applied to all socket types.
+  //
+  // For example:
+  // If :ref:`stream <envoy_v3_api_field_config.core.v3.SocketOption.SocketType.stream>` is set,
+  // it takes precedence over :ref:`datagram <envoy_v3_api_field_config.core.v3.SocketOption.SocketType.datagram>`.
+  message SocketType {
+    // The stream socket type.
+    message Stream {
+    }
+
+    // The datagram socket type.
+    message Datagram {
+    }
+
+    // Apply the socket option to the stream socket type.
+    Stream stream = 1;
+
+    // Apply the socket option to the datagram socket type.
+    Datagram datagram = 2;
+  }
+
   // An optional name to give this socket option for debugging, etc.
   // Uniqueness is not required and no special meaning is assumed.
   string description = 1;
@@ -74,6 +97,10 @@ message SocketOption {
   // The state in which the option will be applied. When used in BindConfig
   // STATE_PREBIND is currently the only valid value.
   SocketState state = 6 [(validate.rules).enum = {defined_only: true}];
+
+  // Apply the socket option to the specified `socket type <https://linux.die.net/man/2/socket>`_.
+  // If not specified, the socket option will be applied to all socket types.
+  SocketType type = 7;
 }
 
 message SocketOptionsOverride {

api/envoy/config/trace/v3/xray.proto

@@ -21,6 +21,65 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 
 // [#protodoc-title: AWS X-Ray Tracer Configuration]
 // Configuration for AWS X-Ray tracer
+//
+// The X-Ray tracer will automatically attach :ref:`custom_tags <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.custom_tags>` as annotations to the span. (See: `Annotations <https://docs.aws.amazon.com/xray/latest/devguide/xray-concepts.html#xray-concepts-annotations>`_.)
+//
+// AWS X-Ray trace annotations are also created by the tracing subsystem automatically based on metadata provided during creation of a span.
+//
+// An example X-Ray trace span that is generated by the envoy trace subsystem is as follows:
+//
+// .. code-block:: json
+//
+//   {
+//     "Id": "1-6698980d-e829ae270ab34b69b488b098",
+//     "Duration": 0.016,
+//     "LimitExceeded": false,
+//     "Segments":
+//     [
+//       {
+//         "Id": "15d65e5ced8dfe76",
+//         "Document":
+//         {
+//           "id": "15d65e5ced8dfe76",
+//           "name": "envoy-example",
+//           "start_time": 1721276429.410355,
+//           "trace_id": "1-6698980d-e829ae270ab34b69b488b098",
+//           "end_time": 1721276429.426068,
+//           "fault": true,
+//           "http":
+//           {
+//             "request":
+//             {
+//               "url": "http://example/path",
+//               "method": "GET",
+//               "user_agent": "curl/8.5.0",
+//               "client_ip": "127.0.0.1",
+//               "x_forwarded_for": false
+//             },
+//             "response":
+//             {
+//               "status": 503,
+//               "content_length": 216
+//             }
+//           },
+//           "aws": {},
+//           "annotations":
+//           {
+//             "response_flags": "UF",
+//             "component": "proxy",
+//             "upstream_cluster": "upstream_cluster",
+//             "annotation_from_custom_tag": "example",
+//             "http.protocol": "HTTP/1.1",
+//             "request_size": "0",
+//             "downstream_cluster": "-",
+//             "direction": "ingress",
+//             "upstream_cluster.name": "upstream_cluster"
+//           }
+//         }
+//       }
+//     ]
+//   }
+//
 
 // [#extension: envoy.tracers.xray]
 message XRayConfig {

changelogs/current.yaml

@@ -5,6 +5,10 @@ behavior_changes:
 
 minor_behavior_changes:
 # *Changes that may cause incompatibilities for some users, but should not for most*
+- area: tcp
+  change: |
+    Added support for :ref:`connection_pool_per_downstream_connection
+    <envoy_v3_api_field_config.cluster.v3.Cluster.connection_pool_per_downstream_connection>` flag in tcp connection pool.
 - area: lua
   change: |
     When Lua script executes httpCall, backpressure is exercised when receiving body from downstream client. This behavior can be reverted
@@ -24,6 +28,13 @@ bug_fixes:
 
 removed_config_or_runtime:
 # *Normally occurs at the end of the* :ref:`deprecation period <deprecated>`
+- area: upstream
+  change: |
+    Removed runtime flag ``envoy.reloadable_features.avoid_zombie_streams`` and legacy code paths.
+- area: ext_proc
+  change: |
+    Removed runtime flag ``envoy_reloadable_features_immediate_response_use_filter_mutation_rule`` and legacy code
+    path.
 - area: ext_proc
   change: |
     Removed runtime flag ``envoy_reloadable_features_send_header_raw_value`` and legacy code path.
@@ -37,6 +48,14 @@ removed_config_or_runtime:
 - area: tls
   change: |
     Removed runtime flag ``envoy.reloadable_features.ssl_transport_failure_reason_format``.
+- area: http
+  change: |
+    Removed runtime flag ``envoy.reloadable_features.abort_filter_chain_on_stream_reset`` and legacy
+    code path.
+- area: grpc reverse bridge
+  change: |
+    Removed ``envoy.reloadable_features.grpc_http1_reverse_bridge_handle_empty_response`` runtime
+    flag and legacy code paths.
 
 new_features:
 - area: tls
@@ -53,6 +72,11 @@ new_features:
   change: |
     added %UPSTREAM_CLUSTER_RAW% access log formatter to log the original upstream cluster name, regadless of whether
     ``alt_stat_name`` is set.
+- area: sockets
+  change: |
+    Added socket ``type`` field for specifying a socket type to apply the socket option to under :ref:`SocketOption
+    <envoy_v3_api_msg_config.core.v3.SocketOption>`. If not specified, the socket option will be applied to all socket
+    types.
 - area: geoip
   change: |
     Added ``envoy.reloadable_features.mmdb_files_reload_enabled`` runtime flag that enables reload of mmdb files by default.

envoy/grpc/async_client.h

@@ -77,7 +77,7 @@ class RawAsyncStream {
    * removeWatermarkCallbacks. If there's already a watermark callback registered, this method
    * will trigger ENVOY_BUG.
    */
-  virtual void setWatermarkCallbacks(Http::DecoderFilterWatermarkCallbacks& callbacks) PURE;
+  virtual void setWatermarkCallbacks(Http::SidestreamWatermarkCallbacks& callbacks) PURE;
 
   /***
    * Remove previously set watermark callbacks. If there's no watermark callback registered, this

envoy/http/async_client.h

@@ -24,6 +24,31 @@ using FilterConfigSharedPtr = std::shared_ptr<FilterConfig>;
 } // namespace Router
 namespace Http {
 
+/**
+ * Callbacks for sidestream connection (from http async client) watermark limits.
+ */
+class SidestreamWatermarkCallbacks {
+public:
+  virtual ~SidestreamWatermarkCallbacks() = default;
+
+  /**
+   * Called when the sidestream connection or stream goes over its high watermark. Note that this
+   * may be called separately for both the stream going over and the connection going over. It
+   * is the responsibility of the sidestreamWatermarkCallbacks implementation to handle unwinding
+   * multiple high and low watermark calls.
+   */
+  virtual void onSidestreamAboveHighWatermark() PURE;
+
+  /**
+   * Called when the sidestream connection or stream goes from over its high watermark to under its
+   * low watermark. As with onSidestreamAboveHighWatermark above, this may be called independently
+   * when both the stream and the connection go under the low watermark limit, and the callee must
+   * ensure that the flow of data does not resume until all callers which were above their high
+   * watermarks have gone below.
+   */
+  virtual void onSidestreamBelowLowWatermark() PURE;
+};
+
 /**
  * Supports sending an HTTP request message and receiving a response asynchronously.
  */
@@ -191,7 +216,7 @@ class AsyncClient {
      * removeWatermarkCallbacks. If there's already a watermark callback registered, this method
      * will trigger ENVOY_BUG.
      */
-    virtual void setWatermarkCallbacks(DecoderFilterWatermarkCallbacks& callbacks) PURE;
+    virtual void setWatermarkCallbacks(Http::SidestreamWatermarkCallbacks& callbacks) PURE;
 
     /***
      * Remove previously set watermark callbacks. If there's no watermark callback registered, this

envoy/http/filter.h

@@ -526,33 +526,12 @@ class StreamFilterCallbacks {
   virtual ResponseTrailerMapOptRef responseTrailers() PURE;
 };
 
-class DecoderFilterWatermarkCallbacks {
-public:
-  virtual ~DecoderFilterWatermarkCallbacks() = default;
-
-  /**
-   * Called when the buffer for a decoder filter or any buffers the filter sends data to go over
-   * their high watermark.
-   *
-   * In the case of a filter such as the router filter, which spills into multiple buffers (codec,
-   * connection etc.) this may be called multiple times. Any such filter is responsible for calling
-   * the low watermark callbacks an equal number of times as the respective buffers are drained.
-   */
-  virtual void onDecoderFilterAboveWriteBufferHighWatermark() PURE;
-
-  /**
-   * Called when a decoder filter or any buffers the filter sends data to go from over its high
-   * watermark to under its low watermark.
-   */
-  virtual void onDecoderFilterBelowWriteBufferLowWatermark() PURE;
-};
 /**
  * Stream decoder filter callbacks add additional callbacks that allow a
  * decoding filter to restart decoding if they decide to hold data (e.g. for
  * buffering or rate limiting).
  */
-class StreamDecoderFilterCallbacks : public virtual StreamFilterCallbacks,
-                                     public virtual DecoderFilterWatermarkCallbacks {
+class StreamDecoderFilterCallbacks : public virtual StreamFilterCallbacks {
 public:
   /**
    * Continue iterating through the filter chain with buffered headers and body data. This routine
@@ -727,6 +706,22 @@ class StreamDecoderFilterCallbacks : public virtual StreamFilterCallbacks,
    */
   virtual void encodeMetadata(MetadataMapPtr&& metadata_map) PURE;
 
+  /**
+   * Called when the buffer for a decoder filter or any buffers the filter sends data to go over
+   * their high watermark.
+   *
+   * In the case of a filter such as the router filter, which spills into multiple buffers (codec,
+   * connection etc.) this may be called multiple times. Any such filter is responsible for calling
+   * the low watermark callbacks an equal number of times as the respective buffers are drained.
+   */
+  virtual void onDecoderFilterAboveWriteBufferHighWatermark() PURE;
+
+  /**
+   * Called when a decoder filter or any buffers the filter sends data to go from over its high
+   * watermark to under its low watermark.
+   */
+  virtual void onDecoderFilterBelowWriteBufferLowWatermark() PURE;
+
   /**
    * This routine can be called by a filter to subscribe to watermark events on the downstream
    * stream and downstream connection.

examples/redis/Dockerfile-redis

@@ -1 +1 @@
-FROM redis@sha256:5a82749600e03e4c4208276283f1f39d2dfde31700582c5a0b3e4ab48a2ddf7e
+FROM redis@sha256:68edcadfac2eba9ae95651ef4f736b9a3871afb57f7275c6ca243793bff5a55d

examples/shared/postgres/Dockerfile

@@ -1,3 +1,3 @@
-FROM postgres:latest@sha256:7963e577a0ac17c9718b5f8cbc1b10da3147e2de97c534e3c3ac6e54108957cb
+FROM postgres:latest@sha256:d0f363f8366fbc3f52d172c6e76bc27151c3d643b870e1062b4e8bfe65baf609
 COPY docker-healthcheck.sh /usr/local/bin/
 HEALTHCHECK CMD ["docker-healthcheck.sh"]

examples/single-page-app/ui/package.json

@@ -14,7 +14,7 @@
     "@chakra-ui/react": "^2.8.2",
     "@emotion/react": "^11.13.0",
     "@emotion/styled": "^11.13.0",
-    "framer-motion": "^11.3.12",
+    "framer-motion": "^11.3.17",
     "mdi-react": "^9.3.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",

examples/single-page-app/ui/yarn.lock

@@ -2723,10 +2723,10 @@ for-each@^0.3.3:
   dependencies:
     is-callable "^1.1.3"
 
-framer-motion@^11.3.12:
-  version "11.3.12"
-  resolved "https://registry.yarnpkg.com/framer-motion/-/framer-motion-11.3.12.tgz#28927129824ce2ce52b5da1f7a4930a4063bafa2"
-  integrity sha512-ulc8EHFZpKIj+NAyJv+alLUEUIXZKOQnE+JHkGjfoIcxbZwV+CSvfOoACaOpAW4nVznFMF2y3r+ViUtPtP4qiw==
+framer-motion@^11.3.17:
+  version "11.3.17"
+  resolved "https://registry.yarnpkg.com/framer-motion/-/framer-motion-11.3.17.tgz#47bd13fe3af660e4e3eebaf21f3a0d9d32c7939b"
+  integrity sha512-LZcckvZL8Rjod03bud8LQcp+R0PLmWIlOSu+NVc+v6Uh43fQr4IBsEAX7sSn7CdBQ1L0fZ/IqSXZVPnGFSMxHw==
   dependencies:
     tslib "^2.4.0"
 

mobile/library/common/engine_common.cc

@@ -59,7 +59,7 @@ class ServerLite : public Server::InstanceBase {
 public:
   using Server::InstanceBase::InstanceBase;
   void maybeCreateHeapShrinker() override {}
-  std::unique_ptr<Envoy::Server::OverloadManager> createOverloadManager() override {
+  absl::StatusOr<std::unique_ptr<Envoy::Server::OverloadManager>> createOverloadManager() override {
     return std::make_unique<Envoy::Server::NullOverloadManager>(threadLocal(), true);
   }
   std::unique_ptr<Envoy::Server::OverloadManager> createNullOverloadManager() override {

mobile/test/swift/BUILD

@@ -20,10 +20,14 @@ envoy_mobile_swift_test(
         "RetryPolicyMapperTests.swift",
         "RetryPolicyTests.swift",
     ],
-    exec_properties = {
-        "sandboxNetwork": "standard",
-    },
     flaky = True,  # TODO(jpsim): Fix timeouts when running these tests on CI
+    # TODO(fredyw): Re-enable remote-exec.
+    # exec_properties = {
+    #     "sandboxNetwork": "standard",
+    # },
+    tags = [
+        "no-remote-exec",
+    ],
     visibility = ["//visibility:public"],
     deps = [
         "//library/objective-c:envoy_engine_objc_lib",