Merge branch 'main' into test-delay-disconnect

Signed-off-by: Yan Avlasov <yavlasov@google.com>

.github/config.yml

@@ -48,11 +48,6 @@ checks:
     required: true
     on-run:
     - mobile-cc
-  mobile-compile-time-options:
-    name: Mobile/Compile time options
-    on-run:
-    - mobile-compile-time-cc
-    - mobile-compile-time-options
   mobile-coverage:
     name: Mobile/Coverage
     required: true
@@ -217,32 +212,6 @@ run:
     - test/integration/*
     - test/mocks/**/*
     - test/test_common/**/*
-  mobile-compile-time-cc:
-    paths:
-    - .bazelrc
-    - .bazelversion
-    - .github/config.yml
-    - api/**/*
-    - bazel/external/quiche.BUILD
-    - bazel/repository_locations.bzl
-    - envoy/**/*
-    - mobile/.bazelrc
-    - mobile/**/*
-    - source/**/*
-    - test/config/**/*
-    - test/integration/*
-    - test/mocks/**/*
-    - test/test_common/**/*
-  mobile-compile-time-options:
-    paths:
-    - .bazelrc
-    - .bazelversion
-    - .github/config.yml
-    - bazel/external/quiche.BUILD
-    - bazel/repository_locations.bzl
-    - mobile/.bazelrc
-    - mobile/**/*
-    - tools/code_format/check_format.py
   mobile-coverage:
     paths:
     - .bazelrc

.github/workflows/_stage_verify.yml

@@ -49,6 +49,24 @@ jobs:
             export NO_BUILD_SETUP=1
           rbe: false
           steps-pre: |
+            - run: |
+                # TODO(phlax): Remove this once resolved properly
+                # Downgrade Docker to workaround https://github.com/containers/skopeo/issues/2365
+                sudo install -m 0755 -d /etc/apt/keyrings
+                sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
+                sudo chmod a+r /etc/apt/keyrings/docker.asc
+                echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \
+                  https://download.docker.com/linux/ubuntu \
+                  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
+                  | sudo  tee /etc/apt/sources.list.d/docker.list \
+                  > /dev/null
+                sudo apt-get update
+                sudo apt-get install -y -qq --allow-downgrades \
+                  docker-ce=5:24.0.9-1~ubuntu.22.04~jammy \
+                  docker-ce-cli=5:24.0.9-1~ubuntu.22.04~jammy
+                sudo systemctl restart docker
+                sudo docker --version
+              shell: bash
             - id: url
               uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
               with:

.github/workflows/mobile-release.yml

@@ -72,13 +72,6 @@ jobs:
             --define=pom_version=$VERSION
             //:android_dist
           output: envoy
-        - target: xds-release
-          args: >-
-            build
-            --config=mobile-remote-release-clang-android-publish-xds
-            --define=pom_version=$VERSION
-            //:android_xds_dist
-          output: envoy_xds
 
   deploy:
     needs: release
@@ -92,7 +85,6 @@ jobs:
       matrix:
         include:
         - output: envoy
-        - output: envoy_xds
     steps:
     - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29  # v4.1.6
       with:

CODEOWNERS

@@ -32,7 +32,7 @@ extensions/filters/common/original_src @klarose @mattklein123
 /*/extensions/filters/http/ext_proc @gbrail @stevenzzzz @tyxia @mattklein123 @htuch @yanavlasov
 /*/extensions/filters/common/mutation_rules @gbrail @tyxia @mattklein123 @htuch @yanavlasov
 # jwt_authn http filter extension
-/*/extensions/filters/http/jwt_authn @taoxuy @lizan @UNOWNED
+/*/extensions/filters/http/jwt_authn @taoxuy @lizan @tyxia @yanavlasov
 # grpc_field_extraction http filter extension
 /*/extensions/filters/http/grpc_field_extraction @taoxuy @nareddyt @yanavlasov
 # grpc_http1_reverse_bridge http filter extension
@@ -44,21 +44,21 @@ extensions/filters/common/original_src @klarose @mattklein123
 # tls transport socket extension
 /*/extensions/transport_sockets/tls @RyanTheOptimist @ggreenway @botengyao
 # tls SPIFFE certificate validator extension
-/*/extensions/transport_sockets/tls/cert_validator/spiffe @mathetake @botengyao @UNOWNED
+/*/extensions/transport_sockets/tls/cert_validator/spiffe @mathetake @botengyao @tyxia
 # proxy protocol socket extension
 /*/extensions/transport_sockets/proxy_protocol @alyssawilk @wez470
 # common transport socket
 /*/extensions/transport_sockets/common @alyssawilk @wez470
 # starttls transport socket
-/*/extensions/transport_sockets/starttls @cpakulski @botengyao @UNOWNED
+/*/extensions/transport_sockets/starttls @cpakulski @botengyao @ggreenway
 # proxy transport socket
 /*extensions/transport_sockets/http_11_proxy @alyssawilk @ryantheoptimist
 # internal upstream transport socket
 /*/extensions/transport_sockets/internal_upstream @kyessenov @alyssawilk
 # sni_cluster extension
-/*/extensions/filters/network/sni_cluster @rshriram @UNOWNED
+/*/extensions/filters/network/sni_cluster @rshriram @ggreenway
 # sni_dynamic_forward_proxy extension
-/*/extensions/filters/network/sni_dynamic_forward_proxy @rshriram @UNOWNED
+/*/extensions/filters/network/sni_dynamic_forward_proxy @rshriram @soulxu
 # tracers.datadog extension
 /*/extensions/tracers/datadog @dmehala @mattklein123
 # tracers.xray extension
@@ -118,10 +118,10 @@ extensions/filters/common/original_src @klarose @mattklein123
 /*/extensions/filters/http/grpc_http1_bridge @jose @mattklein123
 /*/extensions/filters/http/fault @rshriram @alyssawilk
 /*/extensions/filters/common/fault @rshriram @alyssawilk
-/*/extensions/filters/http/grpc_json_transcoder @taoxuy @nareddyt @lizan @UNOWNED
+/*/extensions/filters/http/grpc_json_transcoder @taoxuy @nareddyt @alyssawilk
 /*/extensions/filters/http/router @alyssawilk @mattklein123
 /*/extensions/filters/common/rbac/matchers @conqerAtapple @ggreenway @alyssawilk
-/*/extensions/filters/http/grpc_web @fengli79 @lizan @UNOWNED
+/*/extensions/filters/http/grpc_web @fengli79 @lizan @alyssawilk
 /*/extensions/filters/http/grpc_stats @kyessenov @botengyao
 /*/extensions/filters/http/connect_grpc_bridge @jchadwick-buf @mattklein123
 /*/extensions/filters/common/original_src @klarose @mattklein123
@@ -170,21 +170,21 @@ extensions/filters/http/oauth2 @derekargueta @mattklein123
 # HTTP Kill Request
 /*/extensions/filters/http/kill_request @qqustc @htuch
 # Rate limit expression descriptor
-/*/extensions/rate_limit_descriptors/expr @kyessenov @UNOWNED
+/*/extensions/rate_limit_descriptors/expr @kyessenov @cpakulski
 # hash input matcher
 /*/extensions/matching/input_matchers/consistent_hashing @donyu @mattklein123
 # runtime fraction input matcher
-/*/extensions/matching/input_matchers/runtime_fraction @ravenblackx @UNOWNED
+/*/extensions/matching/input_matchers/runtime_fraction @ravenblackx @sergkir85
 # CEL input matcher
 /*/extensions/matching/input_matchers/cel_matcher @tyxia @yanavlasov
 # environment generic input
 /*/extensions/matching/common_inputs/environment @donyu @mattklein123
 # format string matching
-/*/extensions/matching/actions/format_string @kyessenov @UNOWNED
+/*/extensions/matching/actions/format_string @kyessenov @cpakulski
 # CEL data input
 /*/extensions/matching/http/cel_input @tyxia @yanavlasov
 # user space socket pair, event, connection and listener
-/*/extensions/io_socket/user_space @kyessenov @UNOWNED
+/*/extensions/io_socket/user_space @kyessenov @lambdai @soulxu
 /*/extensions/bootstrap/internal_listener @kyessenov @adisuissa
 # Default UUID4 request ID extension
 /*/extensions/request_id/uuid @mattklein123 @alyssawilk
@@ -210,7 +210,7 @@ extensions/filters/http/oauth2 @derekargueta @mattklein123
 # set_metadata extension
 /*/extensions/filters/http/set_metadata @aguinet @mattklein123
 # Formatters
-/*/extensions/formatter/metadata @cpakulski @UNOWNED
+/*/extensions/formatter/metadata @cpakulski @ravenblackx
 /*/extensions/formatter/cel @kyessenov @zirain
 # IP address input matcher
 /*/extensions/matching/input_matchers/ip @aguinet @mattklein123
@@ -281,7 +281,7 @@ extensions/filters/http/oauth2 @derekargueta @mattklein123
 /*/extensions/filters/http/ext_authz @esmet @tyxia @ggreenway
 /*/extensions/filters/network/ext_authz @esmet @tyxia @ggreenway
 # original dst
-/*/extensions/filters/listener/original_dst @kyessenov @UNOWNED
+/*/extensions/filters/listener/original_dst @kyessenov @cpakulski @lambdai
 # mongo proxy
 /*/extensions/filters/network/mongo_proxy @mythra @giantcroc @mattklein123
 # formatter
@@ -323,11 +323,11 @@ extensions/filters/http/oauth2 @derekargueta @mattklein123
 /*/extensions/load_balancing_policies/subset @wbpcode @zuercher @nezdolik
 /*/extensions/load_balancing_policies/cluster_provided @wbpcode @zuercher
 # Early header mutation
-/*/extensions/http/early_header_mutation/header_mutation @wbpcode @UNOWNED
+/*/extensions/http/early_header_mutation/header_mutation @wbpcode @tyxia
 # Network matching extensions
 /*/extensions/matching/network/ @kyessenov @mattklein123
 # String matching extensions
-/*/extensions/string_matcher/ @ggreenway @UNOWNED
+/*/extensions/string_matcher/ @ggreenway @cpakulski
 # Header mutation
 /*/extensions/filters/http/header_mutation @wbpcode @htuch @soulxu
 # Health checkers
@@ -365,9 +365,9 @@ extensions/filters/http/oauth2 @derekargueta @mattklein123
 /*/extensions/clusters/logical_dns/ @UNOWNED @UNOWNED
 /*/extensions/clusters/common/ @UNOWNED @UNOWNED
 /*/extensions/clusters/eds/ @UNOWNED @UNOWNED
-/*/source/extensions/listener_managers/listener_manager @UNOWNED @UNOWNED
-/*/source/extensions/listener_managers/validation_listener_manager @UNOWNED @UNOWNED
-/*/source/extensions/config_subscription/ @UNOWNED @UNOWNED
+/*/source/extensions/listener_managers/listener_manager @alyssawilk @ggreenway
+/*/source/extensions/listener_managers/validation_listener_manager @alyssawilk @ggreenway
+/*/source/extensions/config_subscription/ @adisuissa @UNOWNED
 /*/source/extensions/config_subscription/grpc @adisuissa @UNOWNED
 
 # URL Pattern Match and Rewrite Library
@@ -378,8 +378,8 @@ extensions/filters/http/oauth2 @derekargueta @mattklein123
 /mobile/ @RyanTheOptimist @alyssawilk @abeyad @fredyw
 
 # Contrib
-/contrib/exe/ @mattklein123 @UNOWNED
-/contrib/client_ssl_auth/ @UNOWNED @UNOWNED
+/contrib/exe/ @mattklein123 @alyssawilk
+/contrib/client_ssl_auth/ @ggreenway @UNOWNED
 /contrib/checksum/ @ravenblackx @phlax
 /contrib/common/sqlutils/ @cpakulski @cpakulski
 /contrib/dynamo/ @UNOWNED @UNOWNED

api/bazel/api_build_system.bzl

@@ -22,6 +22,7 @@ _CC_PROTO_DESCRIPTOR_SUFFIX = "_cc_proto_descriptor"
 _CC_GRPC_SUFFIX = "_cc_grpc"
 _GO_PROTO_SUFFIX = "_go_proto"
 _GO_IMPORTPATH_PREFIX = "github.com/envoyproxy/go-control-plane/"
+_JAVA_PROTO_SUFFIX = "_java_proto"
 
 _COMMON_PROTO_DEPS = [
     "@com_google_protobuf//:any_proto",
@@ -67,7 +68,8 @@ def api_cc_py_proto_library(
         srcs = [],
         deps = [],
         linkstatic = 0,
-        has_services = 0):
+        has_services = 0,
+        java = True):
     relative_name = ":" + name
     proto_library(
         name = name,
@@ -109,6 +111,13 @@ def api_cc_py_proto_library(
         visibility = ["//visibility:public"],
     )
 
+    if java:
+        native.java_proto_library(
+            name = name + _JAVA_PROTO_SUFFIX,
+            visibility = ["//visibility:public"],
+            deps = [relative_name],
+        )
+
     # Optionally define gRPC services
     if has_services:
         # TODO: when Python services are required, add to the below stub generations.

api/bazel/repositories.bzl

@@ -16,6 +16,9 @@ def api_dependencies():
     external_http_archive(
         name = "bazel_skylib",
     )
+    external_http_archive(
+        name = "rules_jvm_external",
+    )
     external_http_archive(
         name = "com_envoyproxy_protoc_gen_validate",
         patch_args = ["-p1"],