Update Envoy SHA to latest with deterministic hash (master).

.bazelrc

@@ -2,6 +2,11 @@
 # Envoy specific Bazel build/test options.
 
 build --workspace_status_command=tools/bazel_get_workspace_status
+# Bazel doesn't need more than 200MB of memory based on memory profiling:
+# https://docs.bazel.build/versions/master/skylark/performance.html#memory-profiling
+# Limiting JVM heapsize here to let it do GC more when approaching the limit to
+# leave room for compiler/linker.
+startup --host_jvm_args=-Xmx512m
 
 # Basic ASAN/UBSAN that works for gcc
 build:asan --define ENVOY_CONFIG_ASAN=1
@@ -18,6 +23,7 @@ build:asan --define signal_trace=disabled
 # Clang 5.0 ASAN
 build:clang-asan --define ENVOY_CONFIG_ASAN=1
 build:clang-asan --copt -D__SANITIZE_ADDRESS__
+build:clang-asan --copt -DADDRESS_SANITIZER=1
 build:clang-asan --copt -fsanitize=address,undefined
 build:clang-asan --linkopt -fsanitize=address,undefined
 build:clang-asan --copt -fno-sanitize=vptr

.circleci/config.yml

@@ -3,9 +3,10 @@ version: 2
 jobs:
   build:
     docker:
-      - image: istio/ci:go1.10-bazel0.18-clang6.0
+      - image: istio/ci:go1.11-bazel0.22-clang7
     environment:
-      - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all"
+      - BAZEL_BUILD_ARGS: "--local_resources=12288,5,1"
+      - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all --local_resources=12288,5,1 --local_test_jobs=8"
     resource_class: xlarge
     steps:
       - checkout
@@ -30,9 +31,10 @@ jobs:
           destination: /proxy/bin
   linux_asan:
     docker:
-      - image: istio/ci:go1.10-bazel0.18-clang6.0
+      - image: istio/ci:go1.11-bazel0.22-clang7
     environment:
-      - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all"
+      - BAZEL_BUILD_ARGS: "--local_resources=12288,5,1"
+      - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all --local_resources=12288,5,1 --local_test_jobs=8"
     resource_class: xlarge
     steps:
       - checkout
@@ -49,9 +51,10 @@ jobs:
             - /home/circleci/.cache/bazel
   linux_tsan:
     docker:
-      - image: istio/ci:go1.10-bazel0.18-clang6.0
+      - image: istio/ci:go1.11-bazel0.22-clang7
     environment:
-      - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all"
+      - BAZEL_BUILD_ARGS: "--local_resources=12288,5,1"
+      - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all --local_resources=12288,5,1 --local_test_jobs=8"
     resource_class: xlarge
     steps:
       - checkout
@@ -71,7 +74,8 @@ jobs:
       xcode: "9.3.0"
     environment:
       - BAZEL_STARTUP_ARGS: "--output_base /Users/distiller/.cache/bazel"
-      - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all"
+      - BAZEL_BUILD_ARGS: "--local_resources=12288,5,1"
+      - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all --local_resources=12288,5,1 --local_test_jobs=8"
       - CC: clang
       - CXX: clang++
     steps:

Makefile

@@ -23,10 +23,10 @@ BAZEL_TEST_ARGS ?=
 HUB ?=
 TAG ?=
 ifeq "$(origin CC)" "default"
-CC := clang-6.0
+CC := clang-7
 endif
 ifeq "$(origin CXX)" "default"
-CXX := clang++-6.0
+CXX := clang++-7
 endif
 
 build:

WORKSPACE

@@ -35,9 +35,9 @@ bind(
 # When updating envoy sha manually please update the sha in istio.deps file also
 #
 # Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/COMMIT.tar.gz && sha256sum COMMIT.tar.gz`
-ENVOY_SHA = "b3be5713f2100ab5c40316e73ce34581245bd26a"
+ENVOY_SHA = "925810d00b0d3095a8e67fd4e04e0f597ed188bb"
 
-ENVOY_SHA256 = "79629284ae143d66b873c08883dc6382fac2e8ed45f6f3521f7e7282b6650216"
+ENVOY_SHA256 = "26d1f14e881455546cf0e222ec92a8e1e5f65cb2c5761d63c66598b39cd9c47d"
 
 http_archive(
     name = "envoy",
@@ -50,6 +50,10 @@ load("@envoy//bazel:repositories.bzl", "envoy_dependencies")
 
 envoy_dependencies()
 
+load("@rules_foreign_cc//:workspace_definitions.bzl", "rules_foreign_cc_dependencies")
+
+rules_foreign_cc_dependencies()
+
 load("@envoy//bazel:cc_configure.bzl", "cc_configure")
 
 cc_configure()

istio.deps

@@ -11,6 +11,6 @@
 		"name": "ENVOY_SHA",
 		"repoName": "envoyproxy/envoy",
 		"file": "WORKSPACE",
-		"lastStableSHA": "b3be5713f2100ab5c40316e73ce34581245bd26a"
+		"lastStableSHA": "925810d00b0d3095a8e67fd4e04e0f597ed188bb"
 	}
 ]

script/release-binary

@@ -19,8 +19,8 @@
 set -ex
 
 # Use clang for the release builds.
-CC=${CC:-clang-6.0}
-CXX=${CXX:-clang++-6.0}
+CC=${CC:-clang-7}
+CXX=${CXX:-clang++-7}
 
 # The bucket name to store proxy binary
 DST="gs://istio-build/proxy"