Merge remote-tracking branch 'upstream/master' into add-stream-info-d…

…ynamic-metadata-header-formatter

.azure-pipelines/pipelines.yml

@@ -122,8 +122,8 @@ jobs:
         condition: always()
 
   - job: docker
-    displayName: "Linux-x64 docker"
-    dependsOn: ["release"]
+    displayName: "Linux multi-arch docker"
+    dependsOn: ["release","release_arm64"]
     condition: and(succeeded(), eq(variables['PostSubmit'], 'true'), ne(variables['Build.Reason'], 'PullRequest'))
     pool:
       vmImage: "ubuntu-18.04"
@@ -135,10 +135,17 @@ jobs:
           itemPattern: "bazel.release/envoy_binary.tar.gz"
           downloadType: single
           targetPath: $(Build.StagingDirectory)
-
+      - task: DownloadBuildArtifacts@0
+        inputs:
+          buildType: current
+          artifactName: "bazel.release.arm64"
+          itemPattern: "bazel.release.arm64/envoy_binary.tar.gz"
+          downloadType: single
+          targetPath: $(Build.StagingDirectory)
       - bash: |
           set -e
-          tar zxf $(Build.StagingDirectory)/bazel.release/envoy_binary.tar.gz
+          mkdir -p linux/amd64 && tar zxf $(Build.StagingDirectory)/bazel.release/envoy_binary.tar.gz -C ./linux/amd64
+          mkdir -p linux/arm64 && tar zxf $(Build.StagingDirectory)/bazel.release.arm64/envoy_binary.tar.gz -C ./linux/arm64
           ci/docker_ci.sh
         workingDirectory: $(Build.SourcesDirectory)
         env:

.bazelrc

@@ -11,7 +11,6 @@
 startup --host_jvm_args=-Xmx2g
 
 build --workspace_status_command="bash bazel/get_workspace_status"
-build --experimental_local_memory_estimate
 build --experimental_strict_action_env=true
 build --host_force_python=PY3
 build --action_env=BAZEL_LINKLIBS=-l%:libstdc++.a
@@ -34,6 +33,9 @@ build --action_env=CXX
 build --action_env=LLVM_CONFIG
 build --action_env=PATH
 
+# Skip system ICU linking.
+build --@com_googlesource_googleurl//build_config:system_icu=0
+
 # Common flags for sanitizers
 build:sanitizer --define tcmalloc=disabled
 build:sanitizer --linkopt -ldl
@@ -52,8 +54,7 @@ build:asan --define signal_trace=disabled
 build:asan --define ENVOY_CONFIG_ASAN=1
 build:asan --copt -fsanitize=address,undefined
 build:asan --linkopt -fsanitize=address,undefined
-# TODO(lizan): vptr and function requires C++ UBSAN runtime which we're not currently linking to.
-# Enable them when bazel has better support for that or with explicit linker options.
+# vptr and function sanitizer are enabled in clang-asan if it is set up via bazel/setup_clang.sh.
 build:asan --copt -fno-sanitize=vptr,function
 build:asan --linkopt -fno-sanitize=vptr,function
 build:asan --copt -DADDRESS_SANITIZER=1
@@ -260,11 +261,7 @@ build:plain-fuzzer --define=FUZZING_ENGINE=libfuzzer
 build:plain-fuzzer --define ENVOY_CONFIG_ASAN=1
 
 # Compile database generation config
-# We don't care about built binaries so always strip and use fastbuild.
-build:compdb -c fastbuild
-build:compdb --strip=always
 build:compdb --build_tag_filters=-nocompdb
-build:compdb --define=ENVOY_CONFIG_COMPILATION_DATABASE=1
 
 # Windows build quirks
 build:windows --action_env=TMPDIR

BUILD

@@ -1,6 +1,36 @@
+load(
+    "@envoy_build_config//:extensions_build_config.bzl",
+    "ADDITIONAL_VISIBILITY",
+)
+
 licenses(["notice"])  # Apache 2
 
 exports_files([
     "VERSION",
     ".clang-format",
 ])
+
+# These two definitions exist to help reduce Envoy upstream core code depending on extensions.
+# To avoid visibility problems, one can extend ADDITIONAL_VISIBILITY in source/extensions/extensions_build_config.bzl
+#
+# TODO(#9953) //test/config_test:__pkg__ should probably be split up and removed.
+# TODO(#9953) the config fuzz tests should be moved somewhere local and //test/config_test and //test/server removed.
+package_group(
+    name = "extension_config",
+    packages = [
+        "//source/exe",
+        "//source/extensions/...",
+        "//test/config_test",
+        "//test/extensions/...",
+        "//test/server",
+        "//test/server/config_validation",
+    ] + ADDITIONAL_VISIBILITY,
+)
+
+package_group(
+    name = "extension_library",
+    packages = [
+        "//source/extensions/...",
+        "//test/extensions/...",
+    ] + ADDITIONAL_VISIBILITY,
+)

CODEOWNERS

@@ -80,6 +80,8 @@ extensions/filters/common/original_src @snowp @klarose
 /*/extensions/filters/common/expr @kyessenov @yangminzhu @lizan
 # webassembly common extension
 /*/extensions/common/wasm @jplevyak @PiotrSikora @lizan
+# common matcher
+/*/extensions/common/matcher @mattklein123 @yangminzhu
 # common crypto extension
 /*/extensions/common/crypto @lizan @PiotrSikora @bdecoste
 /*/extensions/common/proxy_protocol @alyssawilk @wez470

CONTRIBUTING.md

@@ -188,7 +188,7 @@ maintainer's discretion. Generally all runtime guarded features will be set true
 release is cut. Old code paths for refactors can be cleaned up after a release and there has been
 some production run time. Old code for behavioral changes will be deprecated after six months.
 Runtime features are set true by default by inclusion in
-[source/common/runtime/runtime_features.h](https://github.com/envoyproxy/envoy/blob/master/source/common/runtime/runtime_features.h)
+[source/common/runtime/runtime_features.cc](https://github.com/envoyproxy/envoy/blob/master/source/common/runtime/runtime_features.cc)
 
 There are four suggested options for testing new runtime features:
 

api/BUILD

@@ -130,6 +130,7 @@ proto_library(
         "//envoy/config/accesslog/v3:pkg",
         "//envoy/config/bootstrap/v3:pkg",
         "//envoy/config/cluster/v3:pkg",
+        "//envoy/config/common/matcher/v3:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/config/endpoint/v3:pkg",
         "//envoy/config/filter/thrift/router/v2alpha1:pkg",
@@ -154,6 +155,7 @@ proto_library(
         "//envoy/data/tap/v3:pkg",
         "//envoy/extensions/access_loggers/file/v3:pkg",
         "//envoy/extensions/access_loggers/grpc/v3:pkg",
+        "//envoy/extensions/access_loggers/wasm/v3:pkg",
         "//envoy/extensions/clusters/aggregate/v3:pkg",
         "//envoy/extensions/clusters/dynamic_forward_proxy/v3:pkg",
         "//envoy/extensions/clusters/redis/v3:pkg",
@@ -195,6 +197,7 @@ proto_library(
         "//envoy/extensions/filters/http/router/v3:pkg",
         "//envoy/extensions/filters/http/squash/v3:pkg",
         "//envoy/extensions/filters/http/tap/v3:pkg",
+        "//envoy/extensions/filters/http/wasm/v3:pkg",
         "//envoy/extensions/filters/listener/http_inspector/v3:pkg",
         "//envoy/extensions/filters/listener/original_dst/v3:pkg",
         "//envoy/extensions/filters/listener/original_src/v3:pkg",
@@ -221,6 +224,7 @@ proto_library(
         "//envoy/extensions/filters/network/tcp_proxy/v3:pkg",
         "//envoy/extensions/filters/network/thrift_proxy/filters/ratelimit/v3:pkg",
         "//envoy/extensions/filters/network/thrift_proxy/v3:pkg",
+        "//envoy/extensions/filters/network/wasm/v3:pkg",
         "//envoy/extensions/filters/network/zookeeper_proxy/v3:pkg",
         "//envoy/extensions/filters/udp/dns_filter/v3alpha:pkg",
         "//envoy/extensions/filters/udp/udp_proxy/v3:pkg",

api/envoy/config/accesslog/v3/BUILD

@@ -9,6 +9,7 @@ api_proto_package(
         "//envoy/config/core/v3:pkg",
         "//envoy/config/filter/accesslog/v2:pkg",
         "//envoy/config/route/v3:pkg",
+        "//envoy/type/matcher/v3:pkg",
         "//envoy/type/v3:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
     ],

api/envoy/config/accesslog/v3/accesslog.proto

@@ -4,10 +4,12 @@ package envoy.config.accesslog.v3;
 
 import "envoy/config/core/v3/base.proto";
 import "envoy/config/route/v3/route_components.proto";
+import "envoy/type/matcher/v3/metadata.proto";
 import "envoy/type/v3/percent.proto";
 
 import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
+import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
@@ -39,8 +41,8 @@ message AccessLog {
   // Filter which is used to determine if the access log needs to be written.
   AccessLogFilter filter = 2;
 
-  // Custom configuration that depends on the access log being instantiated. Built-in
-  // configurations include:
+  // Custom configuration that depends on the access log being instantiated.
+  // Built-in configurations include:
   //
   // #. "envoy.access_loggers.file": :ref:`FileAccessLog
   //    <envoy_api_msg_extensions.access_loggers.file.v3.FileAccessLog>`
@@ -53,7 +55,7 @@ message AccessLog {
   }
 }
 
-// [#next-free-field: 12]
+// [#next-free-field: 13]
 message AccessLogFilter {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.filter.accesslog.v2.AccessLogFilter";
@@ -93,6 +95,9 @@ message AccessLogFilter {
 
     // Extension filter.
     ExtensionFilter extension_filter = 11;
+
+    // Metadata Filter
+    MetadataFilter metadata_filter = 12;
   }
 }
 
@@ -156,25 +161,30 @@ message RuntimeFilter {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.filter.accesslog.v2.RuntimeFilter";
 
-  // Runtime key to get an optional overridden numerator for use in the *percent_sampled* field.
-  // If found in runtime, this value will replace the default numerator.
+  // Runtime key to get an optional overridden numerator for use in the
+  // *percent_sampled* field. If found in runtime, this value will replace the
+  // default numerator.
   string runtime_key = 1 [(validate.rules).string = {min_bytes: 1}];
 
-  // The default sampling percentage. If not specified, defaults to 0% with denominator of 100.
+  // The default sampling percentage. If not specified, defaults to 0% with
+  // denominator of 100.
   type.v3.FractionalPercent percent_sampled = 2;
 
   // By default, sampling pivots on the header
-  // :ref:`x-request-id<config_http_conn_man_headers_x-request-id>` being present. If
-  // :ref:`x-request-id<config_http_conn_man_headers_x-request-id>` is present, the filter will
-  // consistently sample across multiple hosts based on the runtime key value and the value
-  // extracted from :ref:`x-request-id<config_http_conn_man_headers_x-request-id>`. If it is
-  // missing, or *use_independent_randomness* is set to true, the filter will randomly sample based
-  // on the runtime key value alone. *use_independent_randomness* can be used for logging kill
-  // switches within complex nested :ref:`AndFilter
+  // :ref:`x-request-id<config_http_conn_man_headers_x-request-id>` being
+  // present. If :ref:`x-request-id<config_http_conn_man_headers_x-request-id>`
+  // is present, the filter will consistently sample across multiple hosts based
+  // on the runtime key value and the value extracted from
+  // :ref:`x-request-id<config_http_conn_man_headers_x-request-id>`. If it is
+  // missing, or *use_independent_randomness* is set to true, the filter will
+  // randomly sample based on the runtime key value alone.
+  // *use_independent_randomness* can be used for logging kill switches within
+  // complex nested :ref:`AndFilter
   // <envoy_api_msg_config.accesslog.v3.AndFilter>` and :ref:`OrFilter
-  // <envoy_api_msg_config.accesslog.v3.OrFilter>` blocks that are easier to reason about
-  // from a probability perspective (i.e., setting to true will cause the filter to behave like
-  // an independent random variable when composed within logical operator filters).
+  // <envoy_api_msg_config.accesslog.v3.OrFilter>` blocks that are easier to
+  // reason about from a probability perspective (i.e., setting to true will
+  // cause the filter to behave like an independent random variable when
+  // composed within logical operator filters).
   bool use_independent_randomness = 3;
 }
 
@@ -203,21 +213,22 @@ message HeaderFilter {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.filter.accesslog.v2.HeaderFilter";
 
-  // Only requests with a header which matches the specified HeaderMatcher will pass the filter
-  // check.
+  // Only requests with a header which matches the specified HeaderMatcher will
+  // pass the filter check.
   route.v3.HeaderMatcher header = 1 [(validate.rules).message = {required: true}];
 }
 
 // Filters requests that received responses with an Envoy response flag set.
 // A list of the response flags can be found
-// in the access log formatter :ref:`documentation<config_access_log_format_response_flags>`.
+// in the access log formatter
+// :ref:`documentation<config_access_log_format_response_flags>`.
 message ResponseFlagFilter {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.filter.accesslog.v2.ResponseFlagFilter";
 
-  // Only responses with the any of the flags listed in this field will be logged.
-  // This field is optional. If it is not specified, then any response flag will pass
-  // the filter check.
+  // Only responses with the any of the flags listed in this field will be
+  // logged. This field is optional. If it is not specified, then any response
+  // flag will pass the filter check.
   repeated string flags = 1 [(validate.rules).repeated = {
     items {
       string {
@@ -248,8 +259,8 @@ message ResponseFlagFilter {
   }];
 }
 
-// Filters gRPC requests based on their response status. If a gRPC status is not provided, the
-// filter will infer the status from the HTTP status code.
+// Filters gRPC requests based on their response status. If a gRPC status is not
+// provided, the filter will infer the status from the HTTP status code.
 message GrpcStatusFilter {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.filter.accesslog.v2.GrpcStatusFilter";
@@ -277,11 +288,32 @@ message GrpcStatusFilter {
   // Logs only responses that have any one of the gRPC statuses in this field.
   repeated Status statuses = 1 [(validate.rules).repeated = {items {enum {defined_only: true}}}];
 
-  // If included and set to true, the filter will instead block all responses with a gRPC status or
-  // inferred gRPC status enumerated in statuses, and allow all other responses.
+  // If included and set to true, the filter will instead block all responses
+  // with a gRPC status or inferred gRPC status enumerated in statuses, and
+  // allow all other responses.
   bool exclude = 2;
 }
 
+// Filters based on matching dynamic metadata.
+// If the matcher path and key correspond to an existing key in dynamic
+// metadata, the request is logged only if the matcher value is equal to the
+// metadata value. If the matcher path and key *do not* correspond to an
+// existing key in dynamic metadata, the request is logged only if
+// match_if_key_not_found is "true" or unset.
+message MetadataFilter {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.config.filter.accesslog.v2.MetadataFilter";
+
+  // Matcher to check metadata for specified value. For example, to match on the
+  // access_log_hint metadata, set the filter to "envoy.common" and the path to
+  // "access_log_hint", and the value to "true".
+  type.matcher.v3.MetadataMatcher matcher = 1;
+
+  // Default result if the key does not exist in dynamic metadata: if unset or
+  // true, then log; if false, then don't log.
+  google.protobuf.BoolValue match_if_key_not_found = 2;
+}
+
 // Extension filter is statically registered at runtime.
 message ExtensionFilter {
   option (udpa.annotations.versioning).previous_message_type =