Merge remote-tracking branch 'origin/main' into wasm-env-api

CODEOWNERS

@@ -168,3 +168,5 @@ extensions/filters/http/oauth2 @rgs1 @derekargueta @snowp
 /*/extensions/rate_limit_descriptors/expr @kyessenov @lizan
 # user space socket pair and event
 /*/extensions/io_socket/user_space @lambdai @antoniovicente
+# Default UUID4 request ID extension
+/*/extensions/request_id/uuid @mattklein123 @alyssawilk

OWNERS.md

@@ -57,13 +57,9 @@ routing PRs, questions, etc. to the right place.
 This section lists a few people that are not maintainers but typically help out with subject
 matter expert reviews. Feel free to loop them in as needed.
 
-* Shriram Rajagopalan ([rshriram](https://github.com/rshriram)) ([email protected])
-  * Istio, APIs, HTTP routing, and WebSocket.
-* John Millikin ([jmillikin-stripe](https://github.com/jmillikin-stripe)) ([email protected])
-  * Bazel/build.
-* Daniel Hochman ([danielhochman](https://github.com/danielhochman)) ([email protected])
-  * Redis, Python, configuration/operational questions.
 * Yuchen Dai ([lambdai](https://github.com/lambdai)) ([email protected])
   * v2 xDS, listeners, filter chain discovery service.
 * Michael Payne ([moderation](https://github.com/moderation)) ([email protected])
   * External dependencies, Envoy's supply chain and documentation.
+* Dmitry Rozhkov ([rojkov](https://github.com/rojkov)) ([email protected])
+  * Scalability and performance.

api/BUILD

@@ -245,6 +245,7 @@ proto_library(
         "//envoy/extensions/internal_redirect/safe_cross_scheme/v3:pkg",
         "//envoy/extensions/network/socket_interface/v3:pkg",
         "//envoy/extensions/rate_limit_descriptors/expr/v3:pkg",
+        "//envoy/extensions/request_id/uuid/v3:pkg",
         "//envoy/extensions/resource_monitors/fixed_heap/v3:pkg",
         "//envoy/extensions/resource_monitors/injected_resource/v3:pkg",
         "//envoy/extensions/retry/host/omit_canary_hosts/v3:pkg",
@@ -285,6 +286,7 @@ proto_library(
         "//envoy/service/status/v3:pkg",
         "//envoy/service/tap/v3:pkg",
         "//envoy/service/trace/v3:pkg",
+        "//envoy/type/http/v3:pkg",
         "//envoy/type/matcher/v3:pkg",
         "//envoy/type/metadata/v3:pkg",
         "//envoy/type/tracing/v3:pkg",

api/envoy/admin/v3/server_info.proto

@@ -58,7 +58,7 @@ message ServerInfo {
   config.core.v3.Node node = 7;
 }
 
-// [#next-free-field: 37]
+// [#next-free-field: 38]
 message CommandLineOptions {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.admin.v2alpha.CommandLineOptions";
@@ -189,4 +189,7 @@ message CommandLineOptions {
 
   // See :option:`--socket-mode` for details.
   uint32 socket_mode = 36;
+
+  // See :option:`--enable-core-dump` for details.
+  bool enable_core_dump = 37;
 }

api/envoy/config/accesslog/v3/accesslog.proto

@@ -29,26 +29,15 @@ message AccessLog {
 
   reserved "config";
 
-  // The name of the access log implementation to instantiate. The name must
-  // match a statically registered access log. Current built-in loggers include:
-  //
-  // #. "envoy.access_loggers.file"
-  // #. "envoy.access_loggers.http_grpc"
-  // #. "envoy.access_loggers.tcp_grpc"
+  // The name of the access log extension to instantiate.
+  // The name must match one of the compiled in loggers.
+  // See the :ref:`extensions listed in typed_config below <extension_category_envoy.access_loggers>` for the default list of available loggers.
   string name = 1;
 
   // Filter which is used to determine if the access log needs to be written.
   AccessLogFilter filter = 2;
 
-  // Custom configuration that depends on the access log being instantiated.
-  // Built-in configurations include:
-  //
-  // #. "envoy.access_loggers.file": :ref:`FileAccessLog
-  //    <envoy_api_msg_extensions.access_loggers.file.v3.FileAccessLog>`
-  // #. "envoy.access_loggers.http_grpc": :ref:`HttpGrpcAccessLogConfig
-  //    <envoy_api_msg_extensions.access_loggers.grpc.v3.HttpGrpcAccessLogConfig>`
-  // #. "envoy.access_loggers.tcp_grpc": :ref:`TcpGrpcAccessLogConfig
-  //    <envoy_api_msg_extensions.access_loggers.grpc.v3.TcpGrpcAccessLogConfig>`
+  // Custom configuration that must be set according to the access logger extension being instantiated.
   // [#extension-category: envoy.access_loggers]
   oneof config_type {
     google.protobuf.Any typed_config = 4;

api/envoy/config/metrics/v3/stats.proto

@@ -29,13 +29,8 @@ message StatsSink {
   reserved "config";
 
   // The name of the stats sink to instantiate. The name must match a supported
-  // stats sink. The built-in stats sinks are:
-  //
-  // * :ref:`envoy.stat_sinks.statsd <envoy_api_msg_config.metrics.v3.StatsdSink>`
-  // * :ref:`envoy.stat_sinks.dog_statsd <envoy_api_msg_config.metrics.v3.DogStatsdSink>`
-  // * :ref:`envoy.stat_sinks.metrics_service <envoy_api_msg_config.metrics.v3.MetricsServiceConfig>`
-  // * :ref:`envoy.stat_sinks.hystrix <envoy_api_msg_config.metrics.v3.HystrixSink>`
-  //
+  // stats sink.
+  // See the :ref:`extensions listed in typed_config below <extension_category_envoy.stats_sinks>` for the default list of available stats sink.
   // Sinks optionally support tagged/multiple dimensional metrics.
   string name = 1;
 

api/envoy/config/overload/v3/overload.proto

@@ -32,12 +32,8 @@ message ResourceMonitor {
   reserved "config";
 
   // The name of the resource monitor to instantiate. Must match a registered
-  // resource monitor type. The built-in resource monitors are:
-  //
-  // * :ref:`envoy.resource_monitors.fixed_heap
-  //   <envoy_api_msg_config.resource_monitor.fixed_heap.v2alpha.FixedHeapConfig>`
-  // * :ref:`envoy.resource_monitors.injected_resource
-  //   <envoy_api_msg_config.resource_monitor.injected_resource.v2alpha.InjectedResourceConfig>`
+  // resource monitor type.
+  // See the :ref:`extensions listed in typed_config below <extension_category_envoy.resource_monitors>` for the default list of available resource monitor.
   string name = 1 [(validate.rules).string = {min_len: 1}];
 
   // Configuration for the resource monitor being instantiated.

api/envoy/config/trace/v3/http_tracer.proto

@@ -43,25 +43,11 @@ message Tracing {
     reserved "config";
 
     // The name of the HTTP trace driver to instantiate. The name must match a
-    // supported HTTP trace driver. Built-in trace drivers:
-    //
-    // - *envoy.tracers.lightstep*
-    // - *envoy.tracers.zipkin*
-    // - *envoy.tracers.dynamic_ot*
-    // - *envoy.tracers.datadog*
-    // - *envoy.tracers.opencensus*
-    // - *envoy.tracers.xray*
+    // supported HTTP trace driver.
+    // See the :ref:`extensions listed in typed_config below <extension_category_envoy.tracers>` for the default list of the HTTP trace driver.
     string name = 1 [(validate.rules).string = {min_len: 1}];
 
-    // Trace driver specific configuration which depends on the driver being instantiated.
-    // See the trace drivers for examples:
-    //
-    // - :ref:`LightstepConfig <envoy_api_msg_config.trace.v3.LightstepConfig>`
-    // - :ref:`ZipkinConfig <envoy_api_msg_config.trace.v3.ZipkinConfig>`
-    // - :ref:`DynamicOtConfig <envoy_api_msg_config.trace.v3.DynamicOtConfig>`
-    // - :ref:`DatadogConfig <envoy_api_msg_config.trace.v3.DatadogConfig>`
-    // - :ref:`OpenCensusConfig <envoy_api_msg_config.trace.v3.OpenCensusConfig>`
-    // - :ref:`AWS X-Ray <envoy_api_msg_config.trace.v3.XRayConfig>`
+    // Trace driver specific configuration which must be set according to the driver being instantiated.
     // [#extension-category: envoy.tracers]
     oneof config_type {
       google.protobuf.Any typed_config = 3;

api/envoy/extensions/filters/http/rbac/v3/rbac.proto

@@ -29,6 +29,11 @@ message RBAC {
   // but will emit stats and logs and can be used for rule testing.
   // If absent, no shadow RBAC policy will be applied.
   config.rbac.v3.RBAC shadow_rules = 2;
+
+  // If specified, shadow rules will emit stats with the given prefix.
+  // This is useful to distinguish the stat when there are more than 1 RBAC filter configured with
+  // shadow rules.
+  string shadow_rules_stat_prefix = 3;
 }
 
 message RBACPerRoute {

api/envoy/extensions/filters/network/http_connection_manager/v3/BUILD

@@ -11,6 +11,7 @@ api_proto_package(
         "//envoy/config/filter/network/http_connection_manager/v2:pkg",
         "//envoy/config/route/v3:pkg",
         "//envoy/config/trace/v3:pkg",
+        "//envoy/type/http/v3:pkg",
         "//envoy/type/tracing/v3:pkg",
         "//envoy/type/v3:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",

api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto

@@ -11,6 +11,7 @@ import "envoy/config/core/v3/substitution_format_string.proto";
 import "envoy/config/route/v3/route.proto";
 import "envoy/config/route/v3/scoped_route.proto";
 import "envoy/config/trace/v3/http_tracer.proto";
+import "envoy/type/http/v3/path_transformation.proto";
 import "envoy/type/tracing/v3/custom_tag.proto";
 import "envoy/type/v3/percent.proto";
 
@@ -33,7 +34,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // HTTP connection manager :ref:`configuration overview <config_http_conn_man>`.
 // [#extension: envoy.filters.network.http_connection_manager]
 
-// [#next-free-field: 43]
+// [#next-free-field: 44]
 message HttpConnectionManager {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager";
@@ -238,6 +239,38 @@ message HttpConnectionManager {
     google.protobuf.BoolValue enabled = 3;
   }
 
+  // [#not-implemented-hide] Transformations that apply to path headers. Transformations are applied
+  // before any processing of requests by HTTP filters, routing, and matching. Only the normalized
+  // path will be visible internally if a transformation is enabled. Any path rewrites that the
+  // router performs (e.g. :ref:`regex_rewrite
+  // <envoy_api_field_config.route.v3.RouteAction.regex_rewrite>` or :ref:`prefix_rewrite
+  // <envoy_api_field_config.route.v3.RouteAction.prefix_rewrite>`) will apply to the *:path* header
+  // destined for the upstream.
+  //
+  // Note: access logging and tracing will show the original *:path* header.
+  message PathNormalizationOptions {
+    // [#not-implemented-hide] Normalization applies internally before any processing of requests by
+    // HTTP filters, routing, and matching *and* will affect the forwarded *:path* header. Defaults
+    // to :ref:`NormalizePathRFC3986
+    // <envoy_api_msg_type.http.v3.PathTransformation.Operation.NormalizePathRFC3986>`. When not
+    // specified, this value may be overridden by the runtime variable
+    // :ref:`http_connection_manager.normalize_path<config_http_conn_man_runtime_normalize_path>`.
+    // Envoy will respond with 400 to paths that are malformed (e.g. for paths that fail RFC 3986
+    // normalization due to disallowed characters.)
+    type.http.v3.PathTransformation forwarding_transformation = 1;
+
+    // [#not-implemented-hide] Normalization only applies internally before any processing of
+    // requests by HTTP filters, routing, and matching. These will be applied after full
+    // transformation is applied. The *:path* header before this transformation will be restored in
+    // the router filter and sent upstream unless it was mutated by a filter. Defaults to no
+    // transformations.
+    // Multiple actions can be applied in the same Transformation, forming a sequential
+    // pipeline. The transformations will be performed in the order that they appear. Envoy will
+    // respond with 400 to paths that are malformed (e.g. for paths that fail RFC 3986
+    // normalization due to disallowed characters.)
+    type.http.v3.PathTransformation http_filter_transformation = 2;
+  }
+
   reserved 27, 11;
 
   reserved "idle_timeout";
@@ -528,15 +561,21 @@ message HttpConnectionManager {
   bool merge_slashes = 33;
 
   // The configuration of the request ID extension. This includes operations such as
-  // generation, validation, and associated tracing operations.
-  //
-  // If not set, Envoy uses the default UUID-based behavior:
+  // generation, validation, and associated tracing operations. If empty, the
+  // :ref:`UuidRequestIdConfig <envoy_v3_api_msg_extensions.request_id.uuid.v3.UuidRequestIdConfig>`
+  // default extension is used with default parameters. See the documentation for that extension
+  // for details on what it does. Customizing the configuration for the default extension can be
+  // achieved by configuring it explicitly here. For example, to disable trace reason packing,
+  // the following configuration can be used:
   //
-  // 1. Request ID is propagated using *x-request-id* header.
+  // .. validated-code-block:: yaml
+  //   :type-name: envoy.extensions.filters.network.http_connection_manager.v3.RequestIDExtension
   //
-  // 2. Request ID is a universally unique identifier (UUID).
+  //   typed_config:
+  //     "@type": type.googleapis.com/envoy.extensions.request_id.uuid.v3.UuidRequestIdConfig
+  //     pack_trace_reason: false
   //
-  // 3. Tracing decision (sampled, forced, etc) is set in 14th byte of the UUID.
+  // [#extension-category: envoy.request_id]
   RequestIDExtension request_id_extension = 36;
 
   // The configuration to customize local reply returned by Envoy. It can customize status code,
@@ -582,6 +621,16 @@ message HttpConnectionManager {
   // *not* the deprecated but similarly named :ref:`stream_error_on_invalid_http_messaging
   // <envoy_v3_api_field_config.core.v3.Http2ProtocolOptions.stream_error_on_invalid_http_messaging>`
   google.protobuf.BoolValue stream_error_on_invalid_http_message = 40;
+
+  // [#not-implemented-hide:] Path normalization configuration. This includes
+  // configurations for transformations (e.g. RFC 3986 normalization or merge
+  // adjacent slashes) and the policy to apply them. The policy determines
+  // whether transformations affect the forwarded *:path* header. RFC 3986 path
+  // normalization is enabled by default and the default policy is that the
+  // normalized header will be forwarded. See :ref:`PathNormalizationOptions
+  // <envoy_api_msg_extensions.filters.network.http_connection_manager.v3.PathNormalizationOptions>`
+  // for details.
+  PathNormalizationOptions path_normalization_options = 43;
 }
 
 // The configuration to customize local reply returned by Envoy.