envoy: Upgrade envoy minor version v1.28.0

.bazelversion

@@ -1 +1 @@
-6.1.0
+6.3.2

.github/workflows/ci-tests.yaml

@@ -107,6 +107,6 @@ jobs:
             BUILDER_BASE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:test-${{ env.BAZEL_VERSION }}-${{ env.BUILDER_DOCKER_HASH }}
             ARCHIVE_IMAGE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder:test-main-archive-latest
             BAZEL_BUILD_OPTS=--remote_upload_local_results=false
-            BAZEL_TEST_OPTS=--test_timeout=300 --local_test_jobs=1 --flaky_test_attempts=3
+            BAZEL_TEST_OPTS=--test_timeout=300 --local_test_jobs=1 --flaky_test_attempts=10
           cache-from: type=local,src=/tmp/buildx-cache
           push: false

ENVOY_VERSION

@@ -1 +1 @@
-envoy-1.27.2
+envoy-1.28.0

WORKSPACE

@@ -14,8 +14,8 @@ ENVOY_REPO = "envoy"
 #
 # No other line in this file may have ENVOY_SHA followed by an equals sign!
 #
-# renovate: datasource=github-releases depName=envoyproxy/envoy digestVersion=v1.27.2
-ENVOY_SHA = "ae07f9a11715245f7d25d2a13699c260c2ae8ebb"
+# renovate: datasource=github-releases depName=envoyproxy/envoy digestVersion=v1.28.0
+ENVOY_SHA = "b5ca88acee3453c9459474b8f22215796eff4dde"
 
 # // clang-format off: unexpected @bazel_tools reference, please indirect via a definition in //bazel
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")

cilium/grpc_subscription.cc

@@ -8,6 +8,7 @@
 #include "source/common/config/utility.h"
 #include "source/common/grpc/common.h"
 #include "source/common/protobuf/protobuf.h"
+#include "source/extensions/config_subscription/grpc/grpc_mux_context.h"
 #include "source/extensions/config_subscription/grpc/grpc_mux_impl.h"
 
 namespace Envoy {
@@ -134,19 +135,29 @@ subscribe(const std::string& type_url, const LocalInfo::LocalInfo& local_info,
   Envoy::Config::CustomConfigValidatorsPtr nop_config_validators =
       std::make_unique<NopConfigValidatorsImpl>();
 
+  Config::GrpcMuxContext grpc_mux_context{
+      Config::Utility::factoryForGrpcApiConfigSource(cm.grpcAsyncClientManager(), api_config_source,
+                                                     scope, true)
+          ->createUncachedRawAsyncClient(),
+      /*dispatcher_=*/dispatcher,
+      /*service_method_=*/sotwGrpcMethod(type_url),
+      /*local_info_=*/local_info,
+      /*rate_limit_settings_=*/Config::Utility::parseRateLimitSettings(api_config_source),
+      /*scope_=*/scope,
+      /*config_validators_=*/std::move(nop_config_validators),
+      /*xds_resources_delegate_=*/absl::nullopt,
+      /*xds_config_tracker_=*/absl::nullopt,
+      /*backoff_strategy_=*/
+      std::make_unique<JitteredExponentialBackOffStrategy>(
+          Config::SubscriptionFactory::RetryInitialDelayMs,
+          Config::SubscriptionFactory::RetryMaxDelayMs, random),
+      /*target_xds_authority_=*/"",
+      /*eds_resources_cache_=*/nullptr // EDS cache is only used for ADS.
+  };
+
   return std::make_unique<Config::GrpcSubscriptionImpl>(
-      std::make_shared<Config::GrpcMuxImpl>(
-          local_info,
-          Config::Utility::factoryForGrpcApiConfigSource(cm.grpcAsyncClientManager(),
-                                                         api_config_source, scope, true)
-              ->createUncachedRawAsyncClient(),
-          dispatcher, sotwGrpcMethod(type_url), scope,
-          Config::Utility::parseRateLimitSettings(api_config_source),
-          api_config_source.set_node_on_first_message_only(), std::move(nop_config_validators),
-          std::make_unique<JitteredExponentialBackOffStrategy>(
-              Config::SubscriptionFactory::RetryInitialDelayMs,
-              Config::SubscriptionFactory::RetryMaxDelayMs, random),
-          absl::nullopt, absl::nullopt, ""),
+      std::make_shared<Config::GrpcMuxImpl>(grpc_mux_context,
+                                            api_config_source.set_node_on_first_message_only()),
       callbacks, resource_decoder, stats, type_url, dispatcher, init_fetch_timeout,
       /*is_aggregated*/ false, options);
 }

cilium/host_map.cc

@@ -159,8 +159,9 @@ void PolicyHostMap::startSubscription(Server::Configuration::CommonFactoryContex
   subscription_->start({});
 }
 
-void PolicyHostMap::onConfigUpdate(const std::vector<Envoy::Config::DecodedResourceRef>& resources,
-                                   const std::string& version_info) {
+absl::Status
+PolicyHostMap::onConfigUpdate(const std::vector<Envoy::Config::DecodedResourceRef>& resources,
+                              const std::string& version_info) {
   ENVOY_LOG(debug, "PolicyHostMap::onConfigUpdate({}), {} resources, version: {}", name_,
             resources.size(), version_info);
 
@@ -189,6 +190,7 @@ void PolicyHostMap::onConfigUpdate(const std::vector<Envoy::Config::DecodedResou
     return newmap;
   });
   logmaps("onConfigUpdate");
+  return absl::OkStatus();
 }
 
 void PolicyHostMap::onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReason,

cilium/host_map.h

@@ -199,15 +199,16 @@ class PolicyHostMap : public Singleton::Instance,
   }
 
   // Config::SubscriptionCallbacks
-  void onConfigUpdate(const std::vector<Envoy::Config::DecodedResourceRef>& resources,
-                      const std::string& version_info) override;
-  void onConfigUpdate(const std::vector<Envoy::Config::DecodedResourceRef>& added_resources,
-                      const Protobuf::RepeatedPtrField<std::string>& removed_resources,
-                      const std::string& system_version_info) override {
+  absl::Status onConfigUpdate(const std::vector<Envoy::Config::DecodedResourceRef>& resources,
+                              const std::string& version_info) override;
+  absl::Status onConfigUpdate(const std::vector<Envoy::Config::DecodedResourceRef>& added_resources,
+                              const Protobuf::RepeatedPtrField<std::string>& removed_resources,
+                              const std::string& system_version_info) override {
     // NOT IMPLEMENTED YET.
     UNREFERENCED_PARAMETER(added_resources);
     UNREFERENCED_PARAMETER(removed_resources);
     UNREFERENCED_PARAMETER(system_version_info);
+    return absl::OkStatus();
   }
   void onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReason,
                             const EnvoyException* e) override;

cilium/network_policy.cc

@@ -1155,9 +1155,9 @@ void ThreadLocalPolicyMap::Update(std::vector<std::shared_ptr<PolicyInstanceImpl
   }
 }
 
-void NetworkPolicyMap::onConfigUpdate(
-    const std::vector<Envoy::Config::DecodedResourceRef>& resources,
-    const std::string& version_info) {
+absl::Status
+NetworkPolicyMap::onConfigUpdate(const std::vector<Envoy::Config::DecodedResourceRef>& resources,
+                                 const std::string& version_info) {
   ENVOY_LOG(debug, "NetworkPolicyMap::onConfigUpdate({}), {} resources, version: {}", name_,
             resources.size(), version_info);
 
@@ -1312,6 +1312,7 @@ void NetworkPolicyMap::onConfigUpdate(
 #pragma clang diagnostic ignored "-Wnull-dereference"
   transport_factory_context_->setInitManager(*static_cast<Init::Manager*>(nullptr));
 #pragma clang diagnostic pop
+  return absl::OkStatus();
 }
 
 void NetworkPolicyMap::onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReason,

cilium/network_policy.h

@@ -195,15 +195,16 @@ class NetworkPolicyMap : public Singleton::Instance,
   void runAfterAllThreads(std::function<void()>) const;
 
   // Config::SubscriptionCallbacks
-  void onConfigUpdate(const std::vector<Envoy::Config::DecodedResourceRef>& resources,
-                      const std::string& version_info) override;
-  void onConfigUpdate(const std::vector<Envoy::Config::DecodedResourceRef>& added_resources,
-                      const Protobuf::RepeatedPtrField<std::string>& removed_resources,
-                      const std::string& system_version_info) override {
+  absl::Status onConfigUpdate(const std::vector<Envoy::Config::DecodedResourceRef>& resources,
+                              const std::string& version_info) override;
+  absl::Status onConfigUpdate(const std::vector<Envoy::Config::DecodedResourceRef>& added_resources,
+                              const Protobuf::RepeatedPtrField<std::string>& removed_resources,
+                              const std::string& system_version_info) override {
     // NOT IMPLEMENTED YET.
     UNREFERENCED_PARAMETER(added_resources);
     UNREFERENCED_PARAMETER(removed_resources);
     UNREFERENCED_PARAMETER(system_version_info);
+    return absl::OkStatus();
   }
   void onConfigUpdateFailed(Envoy::Config::ConfigUpdateFailureReason,
                             const EnvoyException* e) override;

envoy_build_config/extensions_build_config.bzl

@@ -137,6 +137,7 @@ EXTENSIONS = {
     # "envoy.filters.http.fault":                         "//source/extensions/filters/http/fault:config",
     # "envoy.filters.http.file_system_buffer":            "//source/extensions/filters/http/file_system_buffer:config",
     # "envoy.filters.http.gcp_authn":                     "//source/extensions/filters/http/gcp_authn:config",
+    # "envoy.filters.http.geoip":                         "//source/extensions/filters/http/geoip:config",
     # "envoy.filters.http.geoip":                     "//source/extensions/filters/http/geoip:config",
     # "envoy.filters.http.grpc_field_extraction":         "//source/extensions/filters/http/grpc_field_extraction:config",
     # "envoy.filters.http.grpc_http1_bridge":             "//source/extensions/filters/http/grpc_http1_bridge:config",
@@ -147,9 +148,12 @@ EXTENSIONS = {
     # "envoy.filters.http.header_to_metadata":            "//source/extensions/filters/http/header_to_metadata:config",
     "envoy.filters.http.health_check":                  "//source/extensions/filters/http/health_check:config",
     # "envoy.filters.http.ip_tagging":                    "//source/extensions/filters/http/ip_tagging:config",
+    # "envoy.filters.http.json_to_metadata":            "//source/extensions/filters/http/json_to_metadata:config",
     "envoy.filters.http.jwt_authn": "//source/extensions/filters/http/jwt_authn:config",
     "envoy.filters.http.rate_limit_quota": "//source/extensions/filters/http/rate_limit_quota:config",
-    # Disabled by default
+    # Disabled by default. kill_request is not built into most prebuilt images.
+    # For instructions for building with disabled-by-default filters enabled, see
+    # https://github.com/envoyproxy/envoy/blob/main/bazel/README.md#enabling-and-disabling-extensions
     # "envoy.filters.http.kill_request":                  "//source/extensions/filters/http/kill_request:kill_request_config",
     "envoy.filters.http.local_ratelimit": "//source/extensions/filters/http/local_ratelimit:config",
     # "envoy.filters.http.lua":                           "//source/extensions/filters/http/lua:config",
@@ -159,6 +163,7 @@ EXTENSIONS = {
     "envoy.filters.http.ratelimit": "//source/extensions/filters/http/ratelimit:config",
     # "envoy.filters.http.rbac":                          "//source/extensions/filters/http/rbac:config",
     "envoy.filters.http.router": "//source/extensions/filters/http/router:config",
+    # "envoy.filters.http.set_filter_state":              "//source/extensions/filters/http/set_filter_state:config",
     "envoy.filters.http.set_metadata": "//source/extensions/filters/http/set_metadata:config",
     # "envoy.filters.http.tap":                           "//source/extensions/filters/http/tap:config",
     "envoy.filters.http.wasm": "//source/extensions/filters/http/wasm:config",
@@ -199,6 +204,7 @@ EXTENSIONS = {
     # "envoy.filters.network.redis_proxy":                          "//source/extensions/filters/network/redis_proxy:config",
     "envoy.filters.network.tcp_proxy": "//source/extensions/filters/network/tcp_proxy:config",
     # "envoy.filters.network.thrift_proxy":                         "//source/extensions/filters/network/thrift_proxy:config",
+    # "envoy.filters.network.set_filter_state":                     "//source/extensions/filters/network/set_filter_state:config",
     "envoy.filters.network.sni_cluster": "//source/extensions/filters/network/sni_cluster:config",
     "envoy.filters.network.sni_dynamic_forward_proxy": "//source/extensions/filters/network/sni_dynamic_forward_proxy:config",
     "envoy.filters.network.wasm": "//source/extensions/filters/network/wasm:config",
@@ -211,6 +217,13 @@ EXTENSIONS = {
     # "envoy.filters.udp.dns_filter":                     "//source/extensions/filters/udp/dns_filter:config",
     # "envoy.filters.udp_listener.udp_proxy":             "//source/extensions/filters/udp/udp_proxy:config",
 
+    #
+    # UDP Session filters
+    #
+
+    # "envoy.filters.udp.session.http_capsule":           "//source/extensions/filters/udp/udp_proxy/session_filters/http_capsule:config",
+    # "envoy.filters.udp.session.dynamic_forward_proxy":  "//source/extensions/filters/udp/udp_proxy/session_filters/dynamic_forward_proxy:config",
+
     #
     # Resource monitors
     #
@@ -458,6 +471,11 @@ EXTENSIONS = {
     "envoy.config_subscription.ads_collection": "//source/extensions/config_subscription/grpc:grpc_collection_subscription_lib",
     "envoy.config_mux.delta_grpc_mux_factory": "//source/extensions/config_subscription/grpc/xds_mux:grpc_mux_lib",
     "envoy.config_mux.sotw_grpc_mux_factory": "//source/extensions/config_subscription/grpc/xds_mux:grpc_mux_lib",
+
+    #
+    # Geolocation Provider
+    #
+    # "envoy.geoip_providers.maxmind":                         "//source/extensions/geoip_providers/maxmind:config",
 }
 
 # These can be changed to ["//visibility:public"], for  downstream builds which