From dd1059d851bfe2aae2357cbf5f5574a98acb1af6 Mon Sep 17 00:00:00 2001
From: phlax <phlax@users.noreply.github.com>
Date: Fri, 18 Aug 2023 16:53:05 +0100
Subject: [PATCH 01/25] ci: Use RBE for coverage (#26049)

Signed-off-by: Ryan Northey <ryan@synca.io>
---
 .azure-pipelines/bazel.yml                    | 33 +++++++++++++++++--
 .azure-pipelines/stage/checks.yml             | 11 +++++--
 .bazelrc                                      |  1 -
 ci/build_setup.sh                             |  8 +++--
 ci/do_ci.sh                                   | 15 +++++----
 ci/run_envoy_docker.sh                        |  1 +
 test/common/router/BUILD                      |  1 +
 test/exe/BUILD                                |  2 ++
 .../filters/http/kill_request/BUILD           |  1 +
 test/integration/BUILD                        |  1 +
 test/run_envoy_bazel_coverage.sh              | 19 ++++++-----
 test/tools/router_check/test/BUILD            |  1 +
 12 files changed, 72 insertions(+), 22 deletions(-)

diff --git a/.azure-pipelines/bazel.yml b/.azure-pipelines/bazel.yml
index e54139807e0d..7a8dad2e3f66 100644
--- a/.azure-pipelines/bazel.yml
+++ b/.azure-pipelines/bazel.yml
@@ -26,6 +26,9 @@ parameters:
   type: string
   default: ''
 
+- name: bazelConfigRBE
+  type: string
+  default: --config=remote-ci --config=rbe-google --jobs=$(RbeJobs)
 - name: cacheKeyBazel
   type: string
   default: $(cacheKeyBazel)
@@ -47,6 +50,13 @@ parameters:
 - name: bazelBuildExtraOptions
   type: string
   default: ""
+- name: bazelStartupExtraOptions
+  type: string
+  default: ""
+- name: bazelUseBES
+  displayName: "Upload bazel run data to BES"
+  type: boolean
+  default: true
 - name: envoyBuildFilterExample
   type: string
   default: ""
@@ -175,12 +185,17 @@ steps:
   displayName: "Enable IPv6"
   condition: ${{ parameters.managedAgent }}
 
-- script: ci/run_envoy_docker.sh 'ci/do_ci.sh ${{ parameters.ciTarget }}'
+- script: |
+    if [[ "${{ parameters.bazelUseBES }}" != 'true' ]]; then
+        unset GOOGLE_BES_PROJECT_ID
+    fi
+    ci/run_envoy_docker.sh 'ci/do_ci.sh ${{ parameters.ciTarget }}'
   workingDirectory: $(Build.SourcesDirectory)
   env:
     ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
     ENVOY_BUILD_FILTER_EXAMPLE: ${{ parameters.envoyBuildFilterExample }}
     GITHUB_TOKEN: "${{ parameters.authGithub }}"
+    BAZEL_STARTUP_EXTRA_OPTIONS: "${{ parameters.bazelStartupExtraOptions }}"
     ${{ if ne(parameters['cacheTestResults'], true) }}:
       BAZEL_NO_CACHE_TEST_RESULTS: 1
     ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
@@ -194,7 +209,7 @@ steps:
     ${{ if parameters.rbe }}:
       GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
       ENVOY_RBE: "1"
-      BAZEL_BUILD_EXTRA_OPTIONS: "--config=remote-ci --config=rbe-google --jobs=$(RbeJobs) ${{ parameters.bazelBuildExtraOptions }}"
+      BAZEL_BUILD_EXTRA_OPTIONS: "${{ parameters.bazelConfigRBE }} ${{ parameters.bazelBuildExtraOptions }}"
     ${{ if eq(parameters.rbe, false) }}:
       BAZEL_BUILD_EXTRA_OPTIONS: "--config=ci ${{ parameters.bazelBuildExtraOptions }}"
       BAZEL_REMOTE_CACHE: $(LocalBuildCache)
@@ -206,6 +221,20 @@ steps:
     echo "disk space at end of build:"
     df -h
 
+    for hprof in $(find "$(Build.StagingDirectory)" -name "*heapdump.hprof"); do
+        echo
+        mkdir -p $(Build.StagingDirectory)/envoy/hprof
+        echo "Copying ${hprof}"
+        cp -a $hprof $(Build.StagingDirectory)/envoy/hprof
+    done
+
+    cp -a "$(Build.StagingDirectory)/bazel_root/base/server/jvm.out" $(Build.StagingDirectory)/envoy
+
+    if [[ "${{ parameters.artifactSuffix }}" == ".arm64" ]]; then
+        # Dump bazel-remote logging (only required for arm/self-hosted).
+        sudo systemctl status --no-pager bazel-remote > $(Build.StagingDirectory)/envoy/br.status
+        sudo journalctl --no-pager -xu bazel-remote > $(Build.StagingDirectory)/envoy/br.journal
+    fi
     echo
     du -ch "$(Build.StagingDirectory)" | grep -E "[0-9]{2,}M|[0-9]G"
 
diff --git a/.azure-pipelines/stage/checks.yml b/.azure-pipelines/stage/checks.yml
index 05f8e8afa763..bdc847ab5ea7 100644
--- a/.azure-pipelines/stage/checks.yml
+++ b/.azure-pipelines/stage/checks.yml
@@ -102,11 +102,14 @@ jobs:
   # TODO(phlax): Make this configurable and ratchet down!
   timeoutInMinutes: 240
   pool: "envoy-x64-large"
+  variables:
+    BAZEL_STARTUP_EXTRA: ''
   strategy:
     maxParallel: 2
     matrix:
       coverage:
         CI_TARGET: "coverage"
+        BAZEL_STARTUP_EXTRA: --host_jvm_args=-Xmx20g --host_jvm_args=-XX:MaxDirectMemorySize=4G
       fuzz_coverage:
         CI_TARGET: "fuzz_coverage"
   steps:
@@ -114,11 +117,13 @@ jobs:
     parameters:
       managedAgent: false
       ciTarget: bazel.$(CI_TARGET)
-      rbe: false
+      rbe: true
       # /tmp/sandbox_base is a tmpfs in CI environment to optimize large I/O for coverage traces
-      bazelBuildExtraOptions: "--define=no_debug_info=1 --linkopt=-Wl,-s --test_env=ENVOY_IP_TEST_VERSIONS=v4only --sandbox_base=/tmp/sandbox_base"
+      bazelConfigRBE: --config=ci --config=rbe-google --jobs=$(RbeJobs)
+      bazelBuildExtraOptions: --sandbox_base=/tmp/sandbox_base --define=no_debug_info=1 --linkopt=-Wl,-s --test_env=ENVOY_IP_TEST_VERSIONS=v4only
+      bazelStartupExtraOptions: $(BAZEL_STARTUP_EXTRA)
+      bazelUseBES: false
       cacheTestResults: ${{ parameters.cacheTestResults }}
-
   - script: ci/run_envoy_docker.sh 'ci/do_ci.sh $(CI_TARGET)-upload'
     displayName: "Upload $(CI_TARGET) Report to GCS"
     env:
diff --git a/.bazelrc b/.bazelrc
index 69b1729bb78f..55fc0647504f 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -9,7 +9,6 @@
 # The number 3G is chosen heuristically to both support large VM and small VM with RBE.
 # Startup options cannot be selected via config.
 startup --host_jvm_args=-Xmx3g
-startup --host_jvm_args=-XX:MaxDirectMemorySize=512m
 
 fetch --color=yes
 run --color=yes
diff --git a/ci/build_setup.sh b/ci/build_setup.sh
index 811371612d4e..9dc4c1b0deb0 100755
--- a/ci/build_setup.sh
+++ b/ci/build_setup.sh
@@ -28,6 +28,7 @@ export ENVOY_BUILD_FILTER_EXAMPLE="${ENVOY_BUILD_FILTER_EXAMPLE:-0}"
 
 read -ra BAZEL_BUILD_EXTRA_OPTIONS <<< "${BAZEL_BUILD_EXTRA_OPTIONS:-}"
 read -ra BAZEL_EXTRA_TEST_OPTIONS <<< "${BAZEL_EXTRA_TEST_OPTIONS:-}"
+read -ra BAZEL_STARTUP_EXTRA_OPTIONS <<< "${BAZEL_STARTUP_EXTRA_OPTIONS:-}"
 read -ra BAZEL_OPTIONS <<< "${BAZEL_OPTIONS:-}"
 
 echo "ENVOY_SRCDIR=${ENVOY_SRCDIR}"
@@ -105,12 +106,15 @@ trap cleanup EXIT
 _bazel="$(which bazel)"
 
 BAZEL_STARTUP_OPTIONS=(
+    "${BAZEL_STARTUP_EXTRA_OPTIONS[@]}"
     "--output_user_root=${BUILD_DIR}/bazel_root"
     "--output_base=${BUILD_DIR}/bazel_root/base")
 
 bazel () {
-    # echo "RUNNING BAZEL (${PWD}): ${BAZEL_STARTUP_OPTIONS[*]} <> ${*}" >&2
-    "$_bazel" "${BAZEL_STARTUP_OPTIONS[@]}" "$@"
+    local startup_options
+    read -ra startup_options <<< "${BAZEL_STARTUP_OPTION_LIST:-}"
+    # echo "RUNNING BAZEL (${PWD}): ${startup_options[*]} <> ${*}" >&2
+    "$_bazel" "${startup_options[@]}" "$@"
 }
 
 export _bazel
diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index 992eac4c6a36..cce2bff00e7a 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -41,12 +41,14 @@ else
 fi
 
 function collect_build_profile() {
-  declare -g build_profile_count=${build_profile_count:-1}
-  mv -f \
-     "$(bazel info "${BAZEL_BUILD_OPTIONS[@]}" output_base)/command.profile.gz" \
-     "${ENVOY_BUILD_PROFILE}/${build_profile_count}-$1.profile.gz" \
-      || :
-  ((build_profile_count++))
+    local output_base
+    declare -g build_profile_count=${build_profile_count:-1}
+    output_base="$(bazel info "${BAZEL_BUILD_OPTIONS[@]}" output_base)"
+    mv -f \
+       "${output_base}/command.profile.gz" \
+       "${ENVOY_BUILD_PROFILE}/${build_profile_count}-$1.profile.gz" \
+        || :
+    ((build_profile_count++))
 }
 
 function bazel_with_collection() {
@@ -416,6 +418,7 @@ case $CI_TARGET in
         if [[ "$CI_TARGET" == "fuzz_coverage" ]]; then
             export FUZZ_COVERAGE=true
         fi
+        export BAZEL_GRPC_LOG="${ENVOY_BUILD_DIR}/grpc.log"
         "${ENVOY_SRCDIR}/test/run_envoy_bazel_coverage.sh" \
             "${COVERAGE_TEST_TARGETS[@]}"
         collect_build_profile coverage
diff --git a/ci/run_envoy_docker.sh b/ci/run_envoy_docker.sh
index e42f4c6ba7f8..65d34d7f0b3f 100755
--- a/ci/run_envoy_docker.sh
+++ b/ci/run_envoy_docker.sh
@@ -119,6 +119,7 @@ docker run --rm \
        -e BAZEL_EXTRA_TEST_OPTIONS \
        -e BAZEL_FAKE_SCM_REVISION \
        -e BAZEL_REMOTE_CACHE \
+       -e BAZEL_STARTUP_EXTRA_OPTIONS \
        -e CI_TARGET_BRANCH \
        -e DOCKERHUB_USERNAME \
        -e DOCKERHUB_PASSWORD \
diff --git a/test/common/router/BUILD b/test/common/router/BUILD
index f7a93e02fd26..982a9c35cb87 100644
--- a/test/common/router/BUILD
+++ b/test/common/router/BUILD
@@ -273,6 +273,7 @@ filegroup(
 
 envoy_cc_fuzz_test(
     name = "route_fuzz_test",
+    size = "large",
     srcs = ["route_fuzz_test.cc"],
     corpus = ":route_corpus",
     deps = [
diff --git a/test/exe/BUILD b/test/exe/BUILD
index f90ff7cd1d88..e2dc8214d977 100644
--- a/test/exe/BUILD
+++ b/test/exe/BUILD
@@ -79,6 +79,7 @@ envoy_cc_test(
 
 envoy_cc_test(
     name = "extra_extensions_test",
+    size = "large",
     srcs = ["extra_extensions_test.cc"],
     deps = [
         "//test/test_common:environment_lib",
@@ -102,6 +103,7 @@ envoy_cc_test(
 
 envoy_cc_test(
     name = "check_extensions_against_registry_test",
+    size = "large",
     srcs = ["check_extensions_against_registry_test.cc"],
     data = [
         "//source/extensions:extensions_metadata.yaml",
diff --git a/test/extensions/filters/http/kill_request/BUILD b/test/extensions/filters/http/kill_request/BUILD
index e4d78880db0e..da485bc0394d 100644
--- a/test/extensions/filters/http/kill_request/BUILD
+++ b/test/extensions/filters/http/kill_request/BUILD
@@ -56,6 +56,7 @@ envoy_cc_test(
     name = "crash_integration_test",
     size = "large",
     srcs = ["crash_integration_test.cc"],
+    coverage = False,
     shard_count = 8,
     deps = [
         "//source/extensions/filters/http/kill_request:kill_request_config",
diff --git a/test/integration/BUILD b/test/integration/BUILD
index d558f455311b..7bc510f7d620 100644
--- a/test/integration/BUILD
+++ b/test/integration/BUILD
@@ -373,6 +373,7 @@ envoy_sh_test(
 
 envoy_sh_test(
     name = "run_envoy_test",
+    size = "large",
     srcs = ["run_envoy_test.sh"],
     cc_binary = [":hotrestart_main"],
     data = [
diff --git a/test/run_envoy_bazel_coverage.sh b/test/run_envoy_bazel_coverage.sh
index da2c8b76313c..3261eeded5ab 100755
--- a/test/run_envoy_bazel_coverage.sh
+++ b/test/run_envoy_bazel_coverage.sh
@@ -32,7 +32,6 @@ fi
 COVERAGE_TARGET="${COVERAGE_TARGET:-}"
 read -ra BAZEL_BUILD_OPTIONS <<< "${BAZEL_BUILD_OPTION_LIST:-}"
 read -ra BAZEL_GLOBAL_OPTIONS <<< "${BAZEL_GLOBAL_OPTION_LIST:-}"
-read -ra BAZEL_STARTUP_OPTIONS <<< "${BAZEL_STARTUP_OPTION_LIST:-}"
 
 echo "Starting run_envoy_bazel_coverage.sh..."
 echo "    PWD=$(pwd)"
@@ -50,11 +49,15 @@ else
   COVERAGE_TARGETS=(//test/...)
 fi
 
-BAZEL_COVERAGE_OPTIONS=()
+BAZEL_COVERAGE_OPTIONS=(--heap_dump_on_oom)
+
+if [[ -n "${BAZEL_GRPC_LOG}" ]]; then
+    BAZEL_COVERAGE_OPTIONS+=(--remote_grpc_log="${BAZEL_GRPC_LOG}")
+fi
 
 if [[ "${FUZZ_COVERAGE}" == "true" ]]; then
     # Filter targets to just fuzz tests.
-    _targets=$(bazel "${BAZEL_STARTUP_OPTIONS[@]}" query "${BAZEL_GLOBAL_OPTIONS[@]}" "attr('tags', 'fuzz_target', ${COVERAGE_TARGETS[*]})")
+    _targets=$(bazel query "${BAZEL_GLOBAL_OPTIONS[@]}" --noshow_loading_progress --noshow_progress "attr('tags', 'fuzz_target', ${COVERAGE_TARGETS[*]})")
     COVERAGE_TARGETS=()
     while read -r line; do COVERAGE_TARGETS+=("$line"); done \
         <<< "$_targets"
@@ -67,13 +70,13 @@ fi
 
 # Output unusually long logs due to trace logging.
 BAZEL_COVERAGE_OPTIONS+=("--experimental_ui_max_stdouterr_bytes=80000000")
-BAZEL_OUTPUT_BASE="$(bazel "${BAZEL_STARTUP_OPTIONS[@]}" info "${BAZEL_BUILD_OPTIONS[@]}" output_base)"
+BAZEL_OUTPUT_BASE="$(bazel info "${BAZEL_BUILD_OPTIONS[@]}" output_base)"
 
 echo "Running bazel coverage with:"
 echo "  Options: ${BAZEL_BUILD_OPTIONS[*]} ${BAZEL_COVERAGE_OPTIONS[*]}"
 echo "  Targets: ${COVERAGE_TARGETS[*]}"
 
-bazel "${BAZEL_STARTUP_OPTIONS[@]}" coverage "${BAZEL_BUILD_OPTIONS[@]}" "${BAZEL_COVERAGE_OPTIONS[@]}" "${COVERAGE_TARGETS[@]}"
+bazel coverage "${BAZEL_BUILD_OPTIONS[@]}" "${BAZEL_COVERAGE_OPTIONS[@]}" "${COVERAGE_TARGETS[@]}"
 
 echo "Collecting profile and testlogs"
 if [[ -n "${ENVOY_BUILD_PROFILE}" ]]; then
@@ -86,7 +89,7 @@ if [[ -n "${ENVOY_BUILD_DIR}" ]]; then
     fi
     find bazel-testlogs/ -name test.log \
         | tar cf - -T - \
-        | bazel "${BAZEL_STARTUP_OPTIONS[@]}" run "${BAZEL_BUILD_OPTIONS[@]}" //tools/zstd -- \
+        | bazel run "${BAZEL_BUILD_OPTIONS[@]}" //tools/zstd -- \
                 - -T0 -o "${ENVOY_BUILD_DIR}/testlogs.tar.zst"
     echo "Profile/testlogs collected: ${ENVOY_BUILD_DIR}/testlogs.tar.zst"
 fi
@@ -117,7 +120,7 @@ echo "Compressing coveraged data"
 if [[ "${FUZZ_COVERAGE}" == "true" ]]; then
     if [[ -n "${ENVOY_FUZZ_COVERAGE_ARTIFACT}" ]]; then
         tar cf - -C "${COVERAGE_DIR}" --transform 's/^\./fuzz_coverage/' . \
-            | bazel "${BAZEL_STARTUP_OPTIONS[@]}" run "${BAZEL_BUILD_OPTIONS[@]}" //tools/zstd -- \
+            | bazel run "${BAZEL_BUILD_OPTIONS[@]}" //tools/zstd -- \
                     - -T0 -o "${ENVOY_FUZZ_COVERAGE_ARTIFACT}"
     fi
 elif [[ -n "${ENVOY_COVERAGE_ARTIFACT}" ]]; then
@@ -126,7 +129,7 @@ elif [[ -n "${ENVOY_COVERAGE_ARTIFACT}" ]]; then
     fi
 
      tar cf - -C "${COVERAGE_DIR}" --transform 's/^\./coverage/' . \
-         | bazel "${BAZEL_STARTUP_OPTIONS[@]}" run "${BAZEL_BUILD_OPTIONS[@]}" //tools/zstd -- \
+         | bazel run "${BAZEL_BUILD_OPTIONS[@]}" //tools/zstd -- \
                  - -T0 -o "${ENVOY_COVERAGE_ARTIFACT}"
 fi
 
diff --git a/test/tools/router_check/test/BUILD b/test/tools/router_check/test/BUILD
index 80c55f09aaf3..9f2158dd66f0 100644
--- a/test/tools/router_check/test/BUILD
+++ b/test/tools/router_check/test/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 
 envoy_sh_test(
     name = "router_tool_test",
+    size = "large",
     srcs = ["route_tests.sh"],
     cc_binary = ["//test/tools/router_check:router_check_tool"],
     data = [

From b59cf818304dffa88112a42cae847ea92cfb1509 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 18 Aug 2023 16:57:18 +0100
Subject: [PATCH 02/25] build(deps): bump postgres from `4222320` to `992c539`
 in /examples/shared/postgres (#29077)

build(deps): bump postgres in /examples/shared/postgres

Bumps postgres from `4222320` to `992c539`.

---
updated-dependencies:
- dependency-name: postgres
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 examples/shared/postgres/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/shared/postgres/Dockerfile b/examples/shared/postgres/Dockerfile
index ac291ff802ed..19d614a412f7 100644
--- a/examples/shared/postgres/Dockerfile
+++ b/examples/shared/postgres/Dockerfile
@@ -1,3 +1,3 @@
-FROM postgres:latest@sha256:422232012889e0c0f52b561558876ecb8f6a881ca01acc879b23c3684a0ee0ed
+FROM postgres:latest@sha256:992c5398ca50c716e8c2556a6f6733a0e471e178a6320478a86bb4abe9566299
 COPY docker-healthcheck.sh /usr/local/bin/
 HEALTHCHECK CMD ["docker-healthcheck.sh"]

From 93c92240e09add0548dbbfa6b9a463644d50d84c Mon Sep 17 00:00:00 2001
From: Keith Smiley <keithbsmiley@gmail.com>
Date: Fri, 18 Aug 2023 09:08:27 -0700
Subject: [PATCH 03/25] bazel: update rules_rust (#29068)

Fixes: https://github.com/envoyproxy/envoy/issues/28940

Signed-off-by: Keith Smiley <keithbsmiley@gmail.com>
---
 bazel/repository_locations.bzl | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
index be555de6a084..868bf981b32a 100644
--- a/bazel/repository_locations.bzl
+++ b/bazel/repository_locations.bzl
@@ -1384,12 +1384,13 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "Bazel rust rules",
         project_desc = "Bazel rust rules (used by Wasm)",
         project_url = "https://github.com/bazelbuild/rules_rust",
-        version = "0.26.0",
-        sha256 = "9d04e658878d23f4b00163a72da3db03ddb451273eb347df7d7c50838d698f49",
-        urls = ["https://github.com/bazelbuild/rules_rust/releases/download/{version}/rules_rust-v{version}.tar.gz"],
+        version = "262b6a5ea17ec91b3c07e37e82af0eb15dd6ceef",
+        strip_prefix = "rules_rust-{version}",
+        sha256 = "e968b3d01c305282bd237bcdafe5e5141192e93eaefb22712e8bc4299e672b16",
+        urls = ["https://github.com/bazelbuild/rules_rust/archive/{version}.tar.gz"],
         use_category = ["dataplane_ext"],
         extensions = ["envoy.wasm.runtime.wasmtime"],
-        release_date = "2023-07-28",
+        release_date = "2023-08-11",
         cpe = "N/A",
         license = "Apache-2.0",
         license_url = "https://github.com/bazelbuild/rules_rust/blob/{version}/LICENSE.txt",

From 31874eacb6c7e516a632c3b4b9cc363c3ac9c6f6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 18 Aug 2023 17:51:59 +0100
Subject: [PATCH 04/25] build(deps): bump orjson from 3.9.4 to 3.9.5 in
 /tools/base (#29080)

Bumps [orjson](https://github.com/ijl/orjson) from 3.9.4 to 3.9.5.
- [Release notes](https://github.com/ijl/orjson/releases)
- [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ijl/orjson/compare/3.9.4...3.9.5)

---
updated-dependencies:
- dependency-name: orjson
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 tools/base/requirements.txt | 120 +++++++++++++++++++-----------------
 1 file changed, 62 insertions(+), 58 deletions(-)

diff --git a/tools/base/requirements.txt b/tools/base/requirements.txt
index 950085796116..99740743fe04 100644
--- a/tools/base/requirements.txt
+++ b/tools/base/requirements.txt
@@ -922,63 +922,67 @@ oauth2client==4.1.3 \
     # via
     #   gcs-oauth2-boto-plugin
     #   google-apitools
-orjson==3.9.4 \
-    --hash=sha256:004f0d307473af210717260dab2ddceab26750ef5d2c6b1f7454c33f7bb69f0c \
-    --hash=sha256:04cd7f4a4f4cd2fe43d104eb70e7435c6fcbdde7aa0cde4230e444fbc66924d3 \
-    --hash=sha256:0725260a12d7102b6e66f9925a027f55567255d8455f8288b02d5eedc8925c3e \
-    --hash=sha256:0a31c2cab0ba86998205c2eba550c178a8b4ee7905cadeb402eed45392edb178 \
-    --hash=sha256:0b400cf89c15958cd829c8a4ade8f5dd73588e63d2fb71a00483e7a74e9f92da \
-    --hash=sha256:0e7c3b7e29572ef2d845a59853475f40fdabec53b8b7d6effda4bb26119c07f5 \
-    --hash=sha256:144a3b8c7cbdd301e1b8cd7dd33e3cbfe7b011df2bebd45b84bacc8cb490302d \
-    --hash=sha256:149d1b7630771222f73ecb024ab5dd8e7f41502402b02015494d429bacc4d5c1 \
-    --hash=sha256:161cc72dd3ff569fd67da4af3a23c0c837029085300f0cebc287586ae3b559e0 \
-    --hash=sha256:1e4b20164809b21966b63e063f894927bc85391e60d0a96fa0bb552090f1319c \
-    --hash=sha256:1fb36efdf2a35286fb87cfaa195fc34621389da1c7b28a8eb51a4d212d60e56d \
-    --hash=sha256:220ca4125416636a3d6b53a77d50434987a83da243f9080ee4cce7ac6a34bb4a \
-    --hash=sha256:224ad19dcdc21bb220d893807f2563e219319a8891ead3c54243b51a4882d767 \
-    --hash=sha256:23d3b6f2706cb324661899901e6b1fcaee4f5aac7d7588306df3f43e68173840 \
-    --hash=sha256:264637cad35a1755ab90a8ea290076d444deda20753e55a0eb75496a4645f7bc \
-    --hash=sha256:2e83ec1ee66d83b558a6d273d8a01b86563daa60bea9bc040e2c1cb8008de61f \
-    --hash=sha256:2f57ccb50e9e123709e9f2d7b1a9e09e694e49d1fa5c5585e34b8e3f01929dc3 \
-    --hash=sha256:32a9e0f140c7d0d52f79553cabd1a471f6a4f187c59742239939f1139258a053 \
-    --hash=sha256:336ec8471102851f0699198031924617b7a77baadea889df3ffda6000bd59f4c \
-    --hash=sha256:3932b06abf49135c93816c74139c7937fa54079fce3f44db2d598859894c344a \
-    --hash=sha256:3b9f8bf43a5367d5522f80e7d533c98d880868cd0b640b9088c9237306eca6e8 \
-    --hash=sha256:3d947366127abef192419257eb7db7fcee0841ced2b49ccceba43b65e9ce5e3f \
-    --hash=sha256:4974cc2ebb53196081fef96743c02c8b073242b20a40b65d2aa2365ba8c949df \
-    --hash=sha256:4fdb59cfa00e10c82e09d1c32a9ce08a38bd29496ba20a73cd7f498e3a0a5024 \
-    --hash=sha256:53b417cc9465dbb42ec9cd7be744a921a0ce583556315d172a246d6e71aa043b \
-    --hash=sha256:562cf24f9f11df8099e0e78859ba6729e7caa25c2f3947cb228d9152946c854b \
-    --hash=sha256:5e876ef36801b3d4d3a4b0613b6144b0b47f13f3043fd1fcdfafd783c174b538 \
-    --hash=sha256:644728d803200d7774164d252a247e2fcb0d19e4ef7a4a19a1a139ae472c551b \
-    --hash=sha256:6bae10f4e7a9145b120e37b6456f1d3853a953e5131fe4740a764e46420289f5 \
-    --hash=sha256:73d9507a547202f0dd0672e529ce3ca45582d152369c684a9ce75677ce5ae089 \
-    --hash=sha256:915da36bc93ef0c659fa50fe7939d4f208804ad252fc4fc8d55adbbb82293c48 \
-    --hash=sha256:94d15ee45c2aaed334688e511aa73b4681f7c08a0810884c6b3ae5824dea1222 \
-    --hash=sha256:9ab3720fba68cc1c0bad00803d2c5e2c70177da5af12c45e18cc4d14426d56d8 \
-    --hash=sha256:9c32dea3b27a97ac88783c1eb61ccb531865bf478a37df3707cbc96ca8f34a04 \
-    --hash=sha256:a4c9254d21fc44526a3850355b89afd0d00ed73bdf902a5ab416df14a61eac6b \
-    --hash=sha256:a4f12e9ec62679c3f2717d9ec41b497a2c2af0b1361229db0dc86ef078a4c034 \
-    --hash=sha256:a533e664a0e3904307d662c5d45775544dc2b38df6e39e213ff6a86ceaa3d53c \
-    --hash=sha256:a7d029fc34a516f7eae29b778b30371fcb621134b2acfe4c51c785102aefc6cf \
-    --hash=sha256:b39747f8e57728b9d8c26bd1d28e9a31c028717617a5938a179244b9436c0b31 \
-    --hash=sha256:b5b5038187b74e2d33e5caee8a7e83ddeb6a21da86837fa2aac95c69aeb366e6 \
-    --hash=sha256:b749d06a3d84ac27311cb85fb5e8f965efd1c5f27556ad8fcfd1853c323b4d54 \
-    --hash=sha256:b75f0fc7a64a95027c6f0c70f17969299bdf2b6a85e342b29fc23be2788bad6f \
-    --hash=sha256:ba21fe581a83555024f3cfc9182a2390a61bc50430364855022c518b8ba285a4 \
-    --hash=sha256:bcda6179eb863c295eb5ea832676d33ef12c04d227b4c98267876c8322e5a96e \
-    --hash=sha256:c2fb7963c17ab347428412a0689f5c89ea480f5d5f7ba3e46c6c2f14f3159ee4 \
-    --hash=sha256:c416c50f63bfcf453b6e28d1df956938486191fd1a15aeb95107e810e6e219c8 \
-    --hash=sha256:c4fcd1ac0b7850f85398fd9fdbc7150ac4e82d2ae6754cc6acaf49ca7c30d79a \
-    --hash=sha256:c65df12f92e771361dca45765fcac3d97491799ee8ab3c6c5ecf0155a397a313 \
-    --hash=sha256:d73c0fd54a52a1a1abfad69d4f1dfb7048cd0b3ef1828ddb4920ef2d3739d8fb \
-    --hash=sha256:daeed2502ddf1f2b29ec8da2fe2ea82807a5c4acf869608ce6c476db8171d070 \
-    --hash=sha256:e12492ce65cb10f385e70a88badc6046bc720fa7d468db27b7429d85d41beaeb \
-    --hash=sha256:edcbccfe852d1d3d56cc8bfc5fa3688c866619328a73cb2394e79b29b4ab24d2 \
-    --hash=sha256:ef7119ebc9b76d5e37c330596616c697d1957779c916aec30cefd28df808f796 \
-    --hash=sha256:f009c1a02773bdecdd1157036918fef1da47f7193d4ad599c9edb1e1960a0491 \
-    --hash=sha256:f0a4cf31bfa94cd235aa50030bef3df529e4eb2893ea6a7771c0fb087e4e53b2 \
-    --hash=sha256:fb429c56ea645e084e34976c2ea0efca7661ee961f61e51405f28bc5a9d1fb24
+orjson==3.9.5 \
+    --hash=sha256:0abcd039f05ae9ab5b0ff11624d0b9e54376253b7d3217a358d09c3edf1d36f7 \
+    --hash=sha256:0eefb7cfdd9c2bc65f19f974a5d1dfecbac711dae91ed635820c6b12da7a3c11 \
+    --hash=sha256:10cc8ad5ff7188efcb4bec196009d61ce525a4e09488e6d5db41218c7fe4f001 \
+    --hash=sha256:1225d2d5ee76a786bda02f8c5e15017462f8432bb960de13d7c2619dba6f0275 \
+    --hash=sha256:15df211469625fa27eced4aa08dc03e35f99c57d45a33855cc35f218ea4071b8 \
+    --hash=sha256:17404333c40047888ac40bd8c4d49752a787e0a946e728a4e5723f111b6e55a5 \
+    --hash=sha256:1a7aa5573a949760d6161d826d34dc36db6011926f836851fe9ccb55b5a7d8e8 \
+    --hash=sha256:2493f1351a8f0611bc26e2d3d407efb873032b4f6b8926fed8cfed39210ca4ba \
+    --hash=sha256:25b81aca8c7be61e2566246b6a0ca49f8aece70dd3f38c7f5c837f398c4cb142 \
+    --hash=sha256:2bcec0b1024d0031ab3eab7a8cb260c8a4e4a5e35993878a2da639d69cdf6a65 \
+    --hash=sha256:385c1c713b1e47fd92e96cf55fd88650ac6dfa0b997e8aa7ecffd8b5865078b1 \
+    --hash=sha256:4449f84bbb13bcef493d8aa669feadfced0f7c5eea2d0d88b5cc21f812183af8 \
+    --hash=sha256:4a3943234342ab37d9ed78fb0a8f81cd4b9532f67bf2ac0d3aa45fa3f0a339f3 \
+    --hash=sha256:50ced24a7b23058b469ecdb96e36607fc611cbaee38b58e62a55c80d1b3ad4e1 \
+    --hash=sha256:5793a21a21bf34e1767e3d61a778a25feea8476dcc0bdf0ae1bc506dc34561ea \
+    --hash=sha256:591ad7d9e4a9f9b104486ad5d88658c79ba29b66c5557ef9edf8ca877a3f8d11 \
+    --hash=sha256:5bfa79916ef5fef75ad1f377e54a167f0de334c1fa4ebb8d0224075f3ec3d8c0 \
+    --hash=sha256:664cff27f85939059472afd39acff152fbac9a091b7137092cb651cf5f7747b5 \
+    --hash=sha256:68c78b2a3718892dc018adbc62e8bab6ef3c0d811816d21e6973dee0ca30c152 \
+    --hash=sha256:6900f0248edc1bec2a2a3095a78a7e3ef4e63f60f8ddc583687eed162eedfd69 \
+    --hash=sha256:6cc2cbf302fbb2d0b2c3c142a663d028873232a434d89ce1b2604ebe5cc93ce8 \
+    --hash=sha256:6daf5ee0b3cf530b9978cdbf71024f1c16ed4a67d05f6ec435c6e7fe7a52724c \
+    --hash=sha256:83c9939073281ef7dd7c5ca7f54cceccb840b440cec4b8a326bda507ff88a0a6 \
+    --hash=sha256:8547b95ca0e2abd17e1471973e6d676f1d8acedd5f8fb4f739e0612651602d66 \
+    --hash=sha256:86127bf194f3b873135e44ce5dc9212cb152b7e06798d5667a898a00f0519be4 \
+    --hash=sha256:87ce174d6a38d12b3327f76145acbd26f7bc808b2b458f61e94d83cd0ebb4d76 \
+    --hash=sha256:88e18a74d916b74f00d0978d84e365c6bf0e7ab846792efa15756b5fb2f7d49d \
+    --hash=sha256:89670fe2732e3c0c54406f77cad1765c4c582f67b915c74fda742286809a0cdc \
+    --hash=sha256:89c9332695b838438ea4b9a482bce8ffbfddde4df92750522d928fb00b7b8dce \
+    --hash=sha256:8b2852afca17d7eea85f8e200d324e38c851c96598ac7b227e4f6c4e59fbd3df \
+    --hash=sha256:9006b1eb645ecf460da067e2dd17768ccbb8f39b01815a571bfcfab7e8da5e52 \
+    --hash=sha256:91dda66755795ac6100e303e206b636568d42ac83c156547634256a2e68de694 \
+    --hash=sha256:a26fafe966e9195b149950334bdbe9026eca17fe8ffe2d8fa87fdc30ca925d30 \
+    --hash=sha256:a461dc9fb60cac44f2d3218c36a0c1c01132314839a0e229d7fb1bba69b810d8 \
+    --hash=sha256:a7cb961efe013606913d05609f014ad43edfaced82a576e8b520a5574ce3b2b9 \
+    --hash=sha256:a960bb1bc9a964d16fcc2d4af5a04ce5e4dfddca84e3060c35720d0a062064fe \
+    --hash=sha256:aa185959c082475288da90f996a82e05e0c437216b96f2a8111caeb1d54ef926 \
+    --hash=sha256:ad6845912a71adcc65df7c8a7f2155eba2096cf03ad2c061c93857de70d699ad \
+    --hash=sha256:b1b74ea2a3064e1375da87788897935832e806cc784de3e789fd3c4ab8eb3fa5 \
+    --hash=sha256:b26b5aa5e9ee1bad2795b925b3adb1b1b34122cb977f30d89e0a1b3f24d18450 \
+    --hash=sha256:bd19bc08fa023e4c2cbf8294ad3f2b8922f4de9ba088dbc71e6b268fdf54591c \
+    --hash=sha256:c74df28749c076fd6e2157190df23d43d42b2c83e09d79b51694ee7315374ad5 \
+    --hash=sha256:ca6b96659c7690773d8cebb6115c631f4a259a611788463e9c41e74fa53bf33f \
+    --hash=sha256:d28514b5b6dfaf69097be70d0cf4f1407ec29d0f93e0b4131bf9cc8fd3f3e374 \
+    --hash=sha256:d748cc48caf5a91c883d306ab648df1b29e16b488c9316852844dd0fd000d1c2 \
+    --hash=sha256:d9f17c59fe6c02bc5f89ad29edb0253d3059fe8ba64806d789af89a45c35269a \
+    --hash=sha256:dedf1a6173748202df223aea29de814b5836732a176b33501375c66f6ab7d822 \
+    --hash=sha256:e174cc579904a48ee1ea3acb7045e8a6c5d52c17688dfcb00e0e842ec378cabf \
+    --hash=sha256:e298e0aacfcc14ef4476c3f409e85475031de24e5b23605a465e9bf4b2156273 \
+    --hash=sha256:e6762755470b5c82f07b96b934af32e4d77395a11768b964aaa5eb092817bc31 \
+    --hash=sha256:e87dfa6ac0dae764371ab19b35eaaa46dfcb6ef2545dfca03064f21f5d08239f \
+    --hash=sha256:ebfdbf695734b1785e792a1315e41835ddf2a3e907ca0e1c87a53f23006ce01d \
+    --hash=sha256:ef84724f7d29dcfe3aafb1fc5fc7788dca63e8ae626bb9298022866146091a3e \
+    --hash=sha256:f13d61c0c7414ddee1ef4d0f303e2222f8cced5a2e26d9774751aecd72324c9e \
+    --hash=sha256:f39f4b99199df05c7ecdd006086259ed25886cdbd7b14c8cdb10c7675cfcca7d \
+    --hash=sha256:f8d51702f42c785b115401e1d64a27a2ea767ae7cf1fb8edaa09c7cf1571c660 \
+    --hash=sha256:f9850c03a8e42fba1a508466e6a0f99472fd2b4a5f30235ea49b2a1b32c04c11 \
+    --hash=sha256:fa504082f53efcbacb9087cc8676c163237beb6e999d43e72acb4bb6f0db11e6 \
+    --hash=sha256:ff27e98532cb87379d1a585837d59b187907228268e7b0a87abe122b2be6968e \
+    --hash=sha256:ffc544e0e24e9ae69301b9a79df87a971fa5d1c20a6b18dca885699709d01be0
     # via
     #   -r requirements.in
     #   envoy-base-utils
@@ -1231,7 +1235,7 @@ sphinxcontrib-httpdomain==1.8.1 \
     --hash=sha256:21eefe1270e4d9de8d717cc89ee92cc4871b8736774393bafc5e38a6bb77b1d5 \
     --hash=sha256:6c2dfe6ca282d75f66df333869bb0ce7331c01b475db6809ff9d107b7cdfe04b
     # via envoy-docs-sphinx-runner
-sphinxcontrib.jquery @ https://github.com/sphinx-contrib/jquery/archive/refs/tags/v3.0.0.zip \
+sphinxcontrib-jquery @ https://github.com/sphinx-contrib/jquery/archive/refs/tags/v3.0.0.zip \
     --hash=sha256:562ad9ac0ac3d8f04a363eb3507ae4b2b856aa04aabab6df7543530fafb849ca
     # via
     #   -r requirements.in

From 2e19a87cc67b06a76a191362960f155f851f6e95 Mon Sep 17 00:00:00 2001
From: phlax <phlax@users.noreply.github.com>
Date: Fri, 18 Aug 2023 18:10:37 +0100
Subject: [PATCH 05/25] opentracing/deprecation: Minor changelog cleanup
 (#29065)

* tracing: Set opentracing deprecation -> 1.30

Signed-off-by: Ryan Northey <ryan@synca.io>
---
 changelogs/current.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/changelogs/current.yaml b/changelogs/current.yaml
index 0203d6ab1897..77ae08227708 100644
--- a/changelogs/current.yaml
+++ b/changelogs/current.yaml
@@ -2,9 +2,6 @@ date: Pending
 
 behavior_changes:
 # *Changes that are expected to cause an incompatibility if applicable; deployment changes are likely required*
-- area: tracing
-  change: |
-    OpenTracing is now deprecated since the upstream project has been abandoned.
 
 - area: eds
   change: |
@@ -83,3 +80,6 @@ new_features:
     added support for lmove command.
 
 deprecated:
+- area: tracing
+  change: |
+    OpenTracing is deprecated and will be removed at version 1.30, since the upstream project has been abandoned.

From 1c259b5a58b60b49bae8f3b27a3cb657515b769c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 18 Aug 2023 17:46:48 +0000
Subject: [PATCH 06/25] build(deps): bump sphinx from 7.1.2 to 7.2.2 in
 /tools/base (#29127)

Bumps [sphinx](https://github.com/sphinx-doc/sphinx) from 7.1.2 to 7.2.2.
- [Release notes](https://github.com/sphinx-doc/sphinx/releases)
- [Changelog](https://github.com/sphinx-doc/sphinx/blob/master/CHANGES)
- [Commits](https://github.com/sphinx-doc/sphinx/compare/v7.1.2...v7.2.2)

---
updated-dependencies:
- dependency-name: sphinx
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 tools/base/requirements.txt | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/base/requirements.txt b/tools/base/requirements.txt
index 99740743fe04..d12859bdd567 100644
--- a/tools/base/requirements.txt
+++ b/tools/base/requirements.txt
@@ -1206,9 +1206,9 @@ snowballstemmer==2.2.0 \
     --hash=sha256:09b16deb8547d3412ad7b590689584cd0fe25ec8db3be37788be3810cbf19cb1 \
     --hash=sha256:c8e1716e83cc398ae16824e5572ae04e0d9fc2c6b985fb0f900f5f0c96ecba1a
     # via sphinx
-sphinx==7.1.2 \
-    --hash=sha256:780f4d32f1d7d1126576e0e5ecc19dc32ab76cd24e950228dcf7b1f6d3d9e22f \
-    --hash=sha256:d170a81825b2fcacb6dfd5a0d7f578a053e45d3f2b153fecc948c37344eb4cbe
+sphinx==7.2.2 \
+    --hash=sha256:1c0abe6d4de7a6b2c2b109a2e18387bf27b240742e1b34ea42ac3ed2ac99978c \
+    --hash=sha256:ed33bc597dd8f05cd37118f64cbac0b8bf773389a628ddfe95ab9e915c9308dc
     # via
     #   -r requirements.in
     #   envoy-docs-sphinx-runner

From 9189bb6c145e3cfb2f6cf5ea46d6f9c533e38251 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 19 Aug 2023 07:56:23 +0100
Subject: [PATCH 07/25] build(deps): bump nginx from `9787454` to `104c7c5` in
 /examples/local_ratelimit (#29129)

build(deps): bump nginx in /examples/local_ratelimit

Bumps nginx from `9787454` to `104c7c5`.

---
updated-dependencies:
- dependency-name: nginx
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 examples/local_ratelimit/Dockerfile-nginx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/local_ratelimit/Dockerfile-nginx b/examples/local_ratelimit/Dockerfile-nginx
index fbbbd39e066b..4bd5843f76b4 100644
--- a/examples/local_ratelimit/Dockerfile-nginx
+++ b/examples/local_ratelimit/Dockerfile-nginx
@@ -1 +1 @@
-FROM nginx@sha256:97874547333e20ac39699be3af3dbc052759a8b89417d84586a7cbc2ee72ae9f
+FROM nginx@sha256:104c7c5c54f2685f0f46f3be607ce60da7085da3eaa5ad22d3d9f01594295e9c

From d44815e4e1d625ac49882b57944f3bc2d80ca462 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 19 Aug 2023 07:56:37 +0100
Subject: [PATCH 08/25] build(deps): bump redis from `efc55e9` to `c45b9ac` in
 /examples/redis (#29128)

Bumps redis from `efc55e9` to `c45b9ac`.

---
updated-dependencies:
- dependency-name: redis
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 examples/redis/Dockerfile-redis | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/redis/Dockerfile-redis b/examples/redis/Dockerfile-redis
index c96e37773144..c3e78dd15a5c 100644
--- a/examples/redis/Dockerfile-redis
+++ b/examples/redis/Dockerfile-redis
@@ -1 +1 @@
-FROM redis@sha256:efc55e99795a34addd2b9030b0209953152398f2c57af316500043da11f19b86
+FROM redis@sha256:c45b9ac48fde5e7ffc59e785719165511b1327151c392c891c2f552a83446847

From 065a9aa0c3342f5ed58cd089ccf674180082c7ff Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 19 Aug 2023 07:56:47 +0100
Subject: [PATCH 09/25] build(deps): bump golang from `0ed2638` to `bb4608b` in
 /examples/shared/golang (#29078)

build(deps): bump golang in /examples/shared/golang

Bumps golang from `0ed2638` to `bb4608b`.

---
updated-dependencies:
- dependency-name: golang
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 examples/shared/golang/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/shared/golang/Dockerfile b/examples/shared/golang/Dockerfile
index f4dd3f340ae0..d0416489aee3 100644
--- a/examples/shared/golang/Dockerfile
+++ b/examples/shared/golang/Dockerfile
@@ -3,7 +3,7 @@ RUN rm -f /etc/apt/apt.conf.d/docker-clean \
     && echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' | tee /etc/apt/apt.conf.d/keep-cache
 
 
-FROM golang:1.21.0-bullseye@sha256:0ed263861f71db3c4fed4d900b621aca03a3b91b8bc5f1dd56584af191c89d68 as golang-base
+FROM golang:1.21.0-bullseye@sha256:bb4608b685d422dd1e7ac03bf16b136d2780854e908fa0a571fd2370ca4dae1b as golang-base
 
 
 FROM golang-base as golang-control-plane-builder

From f837d7524368ff851960aa17d79f0774668acd2c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 19 Aug 2023 07:57:04 +0100
Subject: [PATCH 10/25] build(deps): bump python from `9369202` to `48c5fa0` in
 /examples/shared/python (#29073)

build(deps): bump python in /examples/shared/python

Bumps python from `9369202` to `48c5fa0`.

---
updated-dependencies:
- dependency-name: python
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 examples/shared/python/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/shared/python/Dockerfile b/examples/shared/python/Dockerfile
index 3ebc3005faac..50cf835fd01f 100644
--- a/examples/shared/python/Dockerfile
+++ b/examples/shared/python/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.11.4-slim-bullseye@sha256:9369202819097adbabd05576fb719e97e7157a53295e0a07a1ed1d6fb3aa5853 as python-base
+FROM python:3.11.4-slim-bullseye@sha256:48c5fa0689f8d7de2cd117b9a51d4c9baeb1337d31fb0c0345a657731ac0ab36 as python-base
 RUN rm -f /etc/apt/apt.conf.d/docker-clean \
     && echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' | tee /etc/apt/apt.conf.d/keep-cache
 ARG PYTHON_REQUIREMENTS_FILE=aiohttp/requirements.txt

From 76ade2a8ac9b92f93028cfbd6ab507e8a69456d3 Mon Sep 17 00:00:00 2001
From: code <wangbaiping@corp.netease.com>
Date: Sat, 19 Aug 2023 20:31:58 +0800
Subject: [PATCH 11/25] docs: fix format of lb API comments (#29126)

Signed-off-by: wbpcode <wangbaiping@corp.netease.com>
---
 .../cluster_provided/v3/cluster_provided.proto                | 2 +-
 .../load_balancing_policies/ring_hash/v3/ring_hash.proto      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/api/envoy/extensions/load_balancing_policies/cluster_provided/v3/cluster_provided.proto b/api/envoy/extensions/load_balancing_policies/cluster_provided/v3/cluster_provided.proto
index bf12abc6e899..12c1913e9210 100644
--- a/api/envoy/extensions/load_balancing_policies/cluster_provided/v3/cluster_provided.proto
+++ b/api/envoy/extensions/load_balancing_policies/cluster_provided/v3/cluster_provided.proto
@@ -17,7 +17,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // If this extension is configured, the target cluster must provide load balancer when the cluster
 // is created.
 //
-// ..note::
+// .. note::
 //   Cluster provided load balancing policy could not be used as sub-policy of other hierarchical
 //   load balancing policies, such as subset load balancing policy.
 message ClusterProvided {
diff --git a/api/envoy/extensions/load_balancing_policies/ring_hash/v3/ring_hash.proto b/api/envoy/extensions/load_balancing_policies/ring_hash/v3/ring_hash.proto
index ce29a0ac1789..c121bb05796d 100644
--- a/api/envoy/extensions/load_balancing_policies/ring_hash/v3/ring_hash.proto
+++ b/api/envoy/extensions/load_balancing_policies/ring_hash/v3/ring_hash.proto
@@ -56,7 +56,7 @@ message RingHash {
   // If set to `true`, the cluster will use hostname instead of the resolved
   // address as the key to consistently hash to an upstream host. Only valid for StrictDNS clusters with hostnames which resolve to a single IP address.
   //
-  // ..note::
+  // .. note::
   //   This is deprecated and please use :ref:`consistent_hashing_lb_config
   //   <envoy_v3_api_field_extensions.load_balancing_policies.ring_hash.v3.RingHash.consistent_hashing_lb_config>` instead.
   bool use_hostname_for_hashing = 4
@@ -79,7 +79,7 @@ message RingHash {
   // This is an O(N) algorithm, unlike other load balancers. Using a lower `hash_balance_factor` results in more hosts
   // being probed, so use a higher value if you require better performance.
   //
-  // ..note::
+  // .. note::
   //   This is deprecated and please use :ref:`consistent_hashing_lb_config
   //   <envoy_v3_api_field_extensions.load_balancing_policies.ring_hash.v3.RingHash.consistent_hashing_lb_config>` instead.
   google.protobuf.UInt32Value hash_balance_factor = 5 [

From 822ef563dde32aa7ce3c9794288b6a4dc427e02d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=BE=84=E6=BD=AD?= <ztywto@qq.com>
Date: Sat, 19 Aug 2023 20:53:38 +0800
Subject: [PATCH 12/25] fix the memory leak in skywalking trace reporter
 (#29140)

Signed-off-by: johnlanni <ztywto@qq.com>
---
 .../skywalking/trace_segment_reporter.cc        |  5 +++++
 .../skywalking/trace_segment_reporter_test.cc   | 17 +++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/source/extensions/tracers/skywalking/trace_segment_reporter.cc b/source/extensions/tracers/skywalking/trace_segment_reporter.cc
index fe3a5cb45b64..6ee0e9105703 100644
--- a/source/extensions/tracers/skywalking/trace_segment_reporter.cc
+++ b/source/extensions/tracers/skywalking/trace_segment_reporter.cc
@@ -48,6 +48,11 @@ void TraceSegmentReporter::report(TracingContextPtr tracing_context) {
   ENVOY_LOG(trace, "Try to report segment to SkyWalking Server:\n{}", request.DebugString());
 
   if (stream_ != nullptr) {
+    if (stream_->isAboveWriteBufferHighWatermark()) {
+      ENVOY_LOG(debug, "Failed to report segment to SkyWalking Server since buffer is over limit");
+      tracing_stats_->segments_dropped_.inc();
+      return;
+    }
     tracing_stats_->segments_sent_.inc();
     stream_->sendMessage(request, false);
     return;
diff --git a/test/extensions/tracers/skywalking/trace_segment_reporter_test.cc b/test/extensions/tracers/skywalking/trace_segment_reporter_test.cc
index 9f2e8e664788..76fd05b3ba98 100644
--- a/test/extensions/tracers/skywalking/trace_segment_reporter_test.cc
+++ b/test/extensions/tracers/skywalking/trace_segment_reporter_test.cc
@@ -236,6 +236,23 @@ TEST_F(TraceSegmentReporterTest, CallAsyncCallbackAndNothingTodo) {
   reporter_->onReceiveMessage(std::make_unique<skywalking::v3::Commands>());
 }
 
+TEST_F(TraceSegmentReporterTest, NoReportWithHighWatermark) {
+  setupTraceSegmentReporter("{}");
+
+  TracingContextPtr segment_context =
+      SkyWalkingTestHelper::createSegmentContext(true, "NEW", "PRE");
+  SkyWalkingTestHelper::createSpanStore(segment_context, nullptr, "CHILD");
+
+  EXPECT_CALL(*mock_stream_ptr_, isAboveWriteBufferHighWatermark()).WillOnce(Return(true));
+  EXPECT_CALL(*mock_stream_ptr_, sendMessageRaw_(_, _)).Times(0);
+  reporter_->report(segment_context);
+
+  EXPECT_EQ(0U, mock_scope_.counter("tracing.skywalking.segments_sent").value());
+  EXPECT_EQ(1U, mock_scope_.counter("tracing.skywalking.segments_dropped").value());
+  EXPECT_EQ(0U, mock_scope_.counter("tracing.skywalking.cache_flushed").value());
+  EXPECT_EQ(0U, mock_scope_.counter("tracing.skywalking.segments_flushed").value());
+}
+
 } // namespace
 } // namespace SkyWalking
 } // namespace Tracers

From 365c97c30da20c35200043cceaab8d99e95252dc Mon Sep 17 00:00:00 2001
From: Tianyu <72890320+tyxia@users.noreply.github.com>
Date: Sat, 19 Aug 2023 13:03:38 -0400
Subject: [PATCH 13/25] Add htuch to code owner of ext_proc (#29135)

update code owner

Signed-off-by: tyxia <tyxia@google.com>
---
 CODEOWNERS | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/CODEOWNERS b/CODEOWNERS
index 9151de087d85..15561c068e38 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -23,8 +23,8 @@ extensions/filters/common/original_src @klarose @mattklein123
 # cdn_loop extension
 /*/extensions/filters/http/cdn_loop @justin-mp @penguingao @alyssawilk
 # external processing filter
-/*/extensions/filters/http/ext_proc @gbrail @stevenzzzz @tyxia @mattklein123
-/*/extensions/filters/common/mutation_rules @gbrail @chaoqin-li1123 @tyxia @mattklein123
+/*/extensions/filters/http/ext_proc @gbrail @stevenzzzz @tyxia @mattklein123 @htuch
+/*/extensions/filters/common/mutation_rules @gbrail @chaoqin-li1123 @tyxia @mattklein123 @htuch
 # jwt_authn http filter extension
 /*/extensions/filters/http/jwt_authn @qiwzhang @lizan
 # grpc_field_extraction http filter extension

From c745c1956cdaffa35d6f4933b57a431a2d2e9fc7 Mon Sep 17 00:00:00 2001
From: ashish b <108897222+ashishb-solo@users.noreply.github.com>
Date: Sat, 19 Aug 2023 13:04:42 -0400
Subject: [PATCH 14/25] Tap sink typed extension (#28808)

Signed-off-by: Ashish Banerjee <ashish.banerjee@solo.io>
---
 api/envoy/config/tap/v3/common.proto          |  6 +-
 changelogs/current.yaml                       |  4 +
 source/extensions/common/tap/BUILD            |  1 +
 source/extensions/common/tap/tap.h            | 21 +++++
 .../extensions/common/tap/tap_config_base.cc  | 32 ++++++-
 .../extensions/common/tap/tap_config_base.h   |  2 +-
 source/extensions/filters/http/tap/config.cc  | 16 +++-
 .../filters/http/tap/tap_config_impl.cc       |  5 +-
 .../filters/http/tap/tap_config_impl.h        |  3 +-
 .../transport_sockets/tap/config.cc           | 11 ++-
 .../transport_sockets/tap/tap_config_impl.h   |  7 +-
 test/extensions/common/tap/BUILD              |  3 +
 test/extensions/common/tap/admin_test.cc      | 91 +++++++++++++++++++
 13 files changed, 185 insertions(+), 17 deletions(-)

diff --git a/api/envoy/config/tap/v3/common.proto b/api/envoy/config/tap/v3/common.proto
index 1884bd57d3d1..126993d0f7b4 100644
--- a/api/envoy/config/tap/v3/common.proto
+++ b/api/envoy/config/tap/v3/common.proto
@@ -4,6 +4,7 @@ package envoy.config.tap.v3;
 
 import "envoy/config/common/matcher/v3/matcher.proto";
 import "envoy/config/core/v3/base.proto";
+import "envoy/config/core/v3/extension.proto";
 import "envoy/config/core/v3/grpc_service.proto";
 import "envoy/config/route/v3/route_components.proto";
 
@@ -183,7 +184,7 @@ message OutputConfig {
 }
 
 // Tap output sink configuration.
-// [#next-free-field: 6]
+// [#next-free-field: 7]
 message OutputSink {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.service.tap.v2alpha.OutputSink";
@@ -259,6 +260,9 @@ message OutputSink {
     //   been configured to receive tap configuration from some other source (e.g., static
     //   file, XDS, etc.) configuring the buffered admin output type will fail.
     BufferedAdminSink buffered_admin = 5;
+
+    // Tap output filter will be defined by an extension type
+    core.v3.TypedExtensionConfig custom_sink = 6;
   }
 }
 
diff --git a/changelogs/current.yaml b/changelogs/current.yaml
index 77ae08227708..b4e5d3d96e8f 100644
--- a/changelogs/current.yaml
+++ b/changelogs/current.yaml
@@ -78,6 +78,10 @@ new_features:
 - area: redis
   change: |
     added support for lmove command.
+- area: tap
+  change: |
+    added :ref:`custom_sink <envoy_v3_api_field_config.tap.v3.OutputSink.custom_sink>` type to enable writing tap data
+    out to a custom sink extension.
 
 deprecated:
 - area: tracing
diff --git a/source/extensions/common/tap/BUILD b/source/extensions/common/tap/BUILD
index 452fa65c6161..68e8617581a8 100644
--- a/source/extensions/common/tap/BUILD
+++ b/source/extensions/common/tap/BUILD
@@ -28,6 +28,7 @@ envoy_cc_library(
         ":tap_interface",
         "//source/common/common:assert_lib",
         "//source/common/common:hex_lib",
+        "//source/common/config:utility_lib",
         "//source/extensions/common/matcher:matcher_lib",
         "@envoy_api//envoy/config/tap/v3:pkg_cc_proto",
         "@envoy_api//envoy/data/tap/v3:pkg_cc_proto",
diff --git a/source/extensions/common/tap/tap.h b/source/extensions/common/tap/tap.h
index 107152f9d08b..9f3a86966eab 100644
--- a/source/extensions/common/tap/tap.h
+++ b/source/extensions/common/tap/tap.h
@@ -76,6 +76,27 @@ class Sink {
 };
 
 using SinkPtr = std::unique_ptr<Sink>;
+using SinkContext =
+    absl::variant<std::reference_wrapper<Server::Configuration::FactoryContext>,
+                  std::reference_wrapper<Server::Configuration::TransportSocketFactoryContext>>;
+
+/**
+ * Abstract tap sink factory. Produces a factory that can instantiate SinkPtr objects
+ */
+class TapSinkFactory : public Config::TypedFactory {
+public:
+  ~TapSinkFactory() override = default;
+  std::string category() const override { return "envoy.tap.sinks"; }
+
+  /**
+   * Create a Sink that can be used for writing out data produced by the tap filter.
+   * @param config supplies the protobuf configuration for the sink factory
+   * @param cluster_manager is a ClusterManager from the HTTP/transport socket context
+   */
+  virtual SinkPtr createSinkPtr(const Protobuf::Message& config, SinkContext context) PURE;
+};
+
+using TapSinkFactoryPtr = std::unique_ptr<TapSinkFactory>;
 
 /**
  * Generic configuration for a tap extension (filter, transport socket, etc.).
diff --git a/source/extensions/common/tap/tap_config_base.cc b/source/extensions/common/tap/tap_config_base.cc
index 5d91f81bf927..7f75f4636f77 100644
--- a/source/extensions/common/tap/tap_config_base.cc
+++ b/source/extensions/common/tap/tap_config_base.cc
@@ -3,9 +3,11 @@
 #include "envoy/config/tap/v3/common.pb.h"
 #include "envoy/data/tap/v3/common.pb.h"
 #include "envoy/data/tap/v3/wrapper.pb.h"
+#include "envoy/server/transport_socket_config.h"
 
 #include "source/common/common/assert.h"
 #include "source/common/common/fmt.h"
+#include "source/common/config/utility.h"
 #include "source/common/protobuf/utility.h"
 #include "source/extensions/common/matcher/matcher.h"
 
@@ -45,12 +47,13 @@ bool Utility::addBufferToProtoBytes(envoy::data::tap::v3::Body& output_body,
 }
 
 TapConfigBaseImpl::TapConfigBaseImpl(const envoy::config::tap::v3::TapConfig& proto_config,
-                                     Common::Tap::Sink* admin_streamer)
+                                     Common::Tap::Sink* admin_streamer, SinkContext context)
     : max_buffered_rx_bytes_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(
           proto_config.output_config(), max_buffered_rx_bytes, DefaultMaxBufferedBytes)),
       max_buffered_tx_bytes_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(
           proto_config.output_config(), max_buffered_tx_bytes, DefaultMaxBufferedBytes)),
       streaming_(proto_config.output_config().streaming()) {
+
   using ProtoOutputSink = envoy::config::tap::v3::OutputSink;
   auto& sinks = proto_config.output_config().sinks();
   ASSERT(sinks.size() == 1);
@@ -86,6 +89,33 @@ TapConfigBaseImpl::TapConfigBaseImpl(const envoy::config::tap::v3::TapConfig& pr
     sink_ = std::make_unique<FilePerTapSink>(sinks[0].file_per_tap());
     sink_to_use_ = sink_.get();
     break;
+  case ProtoOutputSink::OutputSinkTypeCase::kCustomSink: {
+    TapSinkFactory& tap_sink_factory =
+        Envoy::Config::Utility::getAndCheckFactory<TapSinkFactory>(sinks[0].custom_sink());
+
+    // extract message validation visitor from the context and use it to define config
+    ProtobufTypes::MessagePtr config;
+    using TsfContextRef =
+        std::reference_wrapper<Server::Configuration::TransportSocketFactoryContext>;
+    using HttpContextRef = std::reference_wrapper<Server::Configuration::FactoryContext>;
+    if (absl::holds_alternative<TsfContextRef>(context)) {
+      Server::Configuration::TransportSocketFactoryContext& tsf_context =
+          absl::get<TsfContextRef>(context).get();
+      config = Config::Utility::translateAnyToFactoryConfig(sinks[0].custom_sink().typed_config(),
+                                                            tsf_context.messageValidationVisitor(),
+                                                            tap_sink_factory);
+    } else {
+      Server::Configuration::FactoryContext& http_context =
+          absl::get<HttpContextRef>(context).get();
+      config = Config::Utility::translateAnyToFactoryConfig(
+          sinks[0].custom_sink().typed_config(),
+          http_context.messageValidationContext().staticValidationVisitor(), tap_sink_factory);
+    }
+
+    sink_ = tap_sink_factory.createSinkPtr(*config, context);
+    sink_to_use_ = sink_.get();
+    break;
+  }
   case envoy::config::tap::v3::OutputSink::OutputSinkTypeCase::kStreamingGrpc:
     PANIC("not implemented");
   case envoy::config::tap::v3::OutputSink::OutputSinkTypeCase::OUTPUT_SINK_TYPE_NOT_SET:
diff --git a/source/extensions/common/tap/tap_config_base.h b/source/extensions/common/tap/tap_config_base.h
index 77a997929b74..aca6eb1cf485 100644
--- a/source/extensions/common/tap/tap_config_base.h
+++ b/source/extensions/common/tap/tap_config_base.h
@@ -103,7 +103,7 @@ class TapConfigBaseImpl : public virtual TapConfig {
 
 protected:
   TapConfigBaseImpl(const envoy::config::tap::v3::TapConfig& proto_config,
-                    Common::Tap::Sink* admin_streamer);
+                    Common::Tap::Sink* admin_streamer, SinkContext context);
 
 private:
   // This is the default setting for both RX/TX max buffered bytes. (This means that per tap, the
diff --git a/source/extensions/filters/http/tap/config.cc b/source/extensions/filters/http/tap/config.cc
index 5c573924f768..c9051d7c68b6 100644
--- a/source/extensions/filters/http/tap/config.cc
+++ b/source/extensions/filters/http/tap/config.cc
@@ -15,21 +15,27 @@ namespace TapFilter {
 
 class HttpTapConfigFactoryImpl : public Extensions::Common::Tap::TapConfigFactory {
 public:
+  HttpTapConfigFactoryImpl(Server::Configuration::FactoryContext& context)
+      : factory_context_(context) {}
   // TapConfigFactory
   Extensions::Common::Tap::TapConfigSharedPtr
   createConfigFromProto(const envoy::config::tap::v3::TapConfig& proto_config,
                         Extensions::Common::Tap::Sink* admin_streamer) override {
-    return std::make_shared<HttpTapConfigImpl>(std::move(proto_config), admin_streamer);
+    return std::make_shared<HttpTapConfigImpl>(std::move(proto_config), admin_streamer,
+                                               factory_context_);
   }
+
+private:
+  Server::Configuration::FactoryContext& factory_context_;
 };
 
 Http::FilterFactoryCb TapFilterFactory::createFilterFactoryFromProtoTyped(
     const envoy::extensions::filters::http::tap::v3::Tap& proto_config,
     const std::string& stats_prefix, Server::Configuration::FactoryContext& context) {
-  FilterConfigSharedPtr filter_config(
-      new FilterConfigImpl(proto_config, stats_prefix, std::make_unique<HttpTapConfigFactoryImpl>(),
-                           context.scope(), context.admin(), context.singletonManager(),
-                           context.threadLocal(), context.mainThreadDispatcher()));
+  FilterConfigSharedPtr filter_config(new FilterConfigImpl(
+      proto_config, stats_prefix, std::make_unique<HttpTapConfigFactoryImpl>(context),
+      context.scope(), context.admin(), context.singletonManager(), context.threadLocal(),
+      context.mainThreadDispatcher()));
   return [filter_config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
     auto filter = std::make_shared<Filter>(filter_config);
     callbacks.addStreamFilter(filter);
diff --git a/source/extensions/filters/http/tap/tap_config_impl.cc b/source/extensions/filters/http/tap/tap_config_impl.cc
index b3d844c7a48e..2aa2653a4ffe 100644
--- a/source/extensions/filters/http/tap/tap_config_impl.cc
+++ b/source/extensions/filters/http/tap/tap_config_impl.cc
@@ -29,8 +29,9 @@ fillHeaderList(Protobuf::RepeatedPtrField<envoy::config::core::v3::HeaderValue>*
 } // namespace
 
 HttpTapConfigImpl::HttpTapConfigImpl(const envoy::config::tap::v3::TapConfig& proto_config,
-                                     Common::Tap::Sink* admin_streamer)
-    : TapCommon::TapConfigBaseImpl(std::move(proto_config), admin_streamer) {}
+                                     Common::Tap::Sink* admin_streamer,
+                                     Server::Configuration::FactoryContext& context)
+    : TapCommon::TapConfigBaseImpl(std::move(proto_config), admin_streamer, context) {}
 
 HttpPerRequestTapperPtr HttpTapConfigImpl::createPerRequestTapper(uint64_t stream_id) {
   return std::make_unique<HttpPerRequestTapperImpl>(shared_from_this(), stream_id);
diff --git a/source/extensions/filters/http/tap/tap_config_impl.h b/source/extensions/filters/http/tap/tap_config_impl.h
index d79ef4cc4842..5938d38076fc 100644
--- a/source/extensions/filters/http/tap/tap_config_impl.h
+++ b/source/extensions/filters/http/tap/tap_config_impl.h
@@ -19,7 +19,8 @@ class HttpTapConfigImpl : public Extensions::Common::Tap::TapConfigBaseImpl,
                           public std::enable_shared_from_this<HttpTapConfigImpl> {
 public:
   HttpTapConfigImpl(const envoy::config::tap::v3::TapConfig& proto_config,
-                    Extensions::Common::Tap::Sink* admin_streamer);
+                    Extensions::Common::Tap::Sink* admin_streamer,
+                    Server::Configuration::FactoryContext& context);
 
   // TapFilter::HttpTapConfig
   HttpPerRequestTapperPtr createPerRequestTapper(uint64_t stream_id) override;
diff --git a/source/extensions/transport_sockets/tap/config.cc b/source/extensions/transport_sockets/tap/config.cc
index 3b565bee92e9..c8267771e854 100644
--- a/source/extensions/transport_sockets/tap/config.cc
+++ b/source/extensions/transport_sockets/tap/config.cc
@@ -17,18 +17,21 @@ namespace Tap {
 
 class SocketTapConfigFactoryImpl : public Extensions::Common::Tap::TapConfigFactory {
 public:
-  SocketTapConfigFactoryImpl(TimeSource& time_source) : time_source_(time_source) {}
+  SocketTapConfigFactoryImpl(TimeSource& time_source,
+                             Server::Configuration::TransportSocketFactoryContext& context)
+      : time_source_(time_source), factory_context_(context) {}
 
   // TapConfigFactory
   Extensions::Common::Tap::TapConfigSharedPtr
   createConfigFromProto(const envoy::config::tap::v3::TapConfig& proto_config,
                         Extensions::Common::Tap::Sink* admin_streamer) override {
     return std::make_shared<SocketTapConfigImpl>(std::move(proto_config), admin_streamer,
-                                                 time_source_);
+                                                 time_source_, factory_context_);
   }
 
 private:
   TimeSource& time_source_;
+  Server::Configuration::TransportSocketFactoryContext& factory_context_;
 };
 
 Network::UpstreamTransportSocketFactoryPtr
@@ -49,7 +52,7 @@ UpstreamTapSocketConfigFactory::createTransportSocketFactory(
   return std::make_unique<TapSocketFactory>(
       outer_config,
       std::make_unique<SocketTapConfigFactoryImpl>(
-          server_context.mainThreadDispatcher().timeSource()),
+          server_context.mainThreadDispatcher().timeSource(), context),
       server_context.admin(), server_context.singletonManager(), server_context.threadLocal(),
       server_context.mainThreadDispatcher(), std::move(inner_transport_factory));
 }
@@ -72,7 +75,7 @@ DownstreamTapSocketConfigFactory::createTransportSocketFactory(
   return std::make_unique<DownstreamTapSocketFactory>(
       outer_config,
       std::make_unique<SocketTapConfigFactoryImpl>(
-          server_context.mainThreadDispatcher().timeSource()),
+          server_context.mainThreadDispatcher().timeSource(), context),
       server_context.admin(), server_context.singletonManager(), server_context.threadLocal(),
       server_context.mainThreadDispatcher(), std::move(inner_transport_factory));
 }
diff --git a/source/extensions/transport_sockets/tap/tap_config_impl.h b/source/extensions/transport_sockets/tap/tap_config_impl.h
index cf715c3df973..38556025c140 100644
--- a/source/extensions/transport_sockets/tap/tap_config_impl.h
+++ b/source/extensions/transport_sockets/tap/tap_config_impl.h
@@ -3,6 +3,7 @@
 #include "envoy/config/tap/v3/common.pb.h"
 #include "envoy/data/tap/v3/transport.pb.h"
 #include "envoy/event/timer.h"
+#include "envoy/server/transport_socket_config.h"
 
 #include "source/extensions/common/tap/tap_config_base.h"
 #include "source/extensions/transport_sockets/tap/tap_config.h"
@@ -51,8 +52,10 @@ class SocketTapConfigImpl : public Extensions::Common::Tap::TapConfigBaseImpl,
                             public std::enable_shared_from_this<SocketTapConfigImpl> {
 public:
   SocketTapConfigImpl(const envoy::config::tap::v3::TapConfig& proto_config,
-                      Extensions::Common::Tap::Sink* admin_streamer, TimeSource& time_system)
-      : Extensions::Common::Tap::TapConfigBaseImpl(std::move(proto_config), admin_streamer),
+                      Extensions::Common::Tap::Sink* admin_streamer, TimeSource& time_system,
+                      Server::Configuration::TransportSocketFactoryContext& context)
+      : Extensions::Common::Tap::TapConfigBaseImpl(std::move(proto_config), admin_streamer,
+                                                   context),
         time_source_(time_system) {}
 
   // SocketTapConfig
diff --git a/test/extensions/common/tap/BUILD b/test/extensions/common/tap/BUILD
index f65ad733eaf5..dea02d4f722a 100644
--- a/test/extensions/common/tap/BUILD
+++ b/test/extensions/common/tap/BUILD
@@ -26,9 +26,12 @@ envoy_cc_test(
     srcs = envoy_select_admin_functionality(["admin_test.cc"]),
     deps = [
         "//source/extensions/common/tap:admin",
+        "//source/extensions/common/tap:tap_config_base",
         "//test/mocks/server:admin_mocks",
         "//test/mocks/server:admin_stream_mocks",
+        "//test/mocks/server:server_mocks",
         "//test/test_common:logging_lib",
+        "//test/test_common:registry_lib",
         "@envoy_api//envoy/config/tap/v3:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/common/tap/admin_test.cc b/test/extensions/common/tap/admin_test.cc
index 2a9807893971..f25c56a4340b 100644
--- a/test/extensions/common/tap/admin_test.cc
+++ b/test/extensions/common/tap/admin_test.cc
@@ -5,10 +5,13 @@
 
 #include "source/extensions/common/tap/admin.h"
 #include "source/extensions/common/tap/tap.h"
+#include "source/extensions/common/tap/tap_config_base.h"
 
 #include "test/mocks/server/admin.h"
 #include "test/mocks/server/admin_stream.h"
+#include "test/mocks/server/mocks.h"
 #include "test/test_common/logging.h"
+#include "test/test_common/registry.h"
 
 #include "gtest/gtest.h"
 
@@ -20,6 +23,7 @@ using ::testing::_;
 using ::testing::AtLeast;
 using ::testing::Between;
 using ::testing::DoAll;
+using ::testing::Invoke;
 using ::testing::Return;
 using ::testing::ReturnRef;
 using ::testing::SaveArg;
@@ -146,6 +150,93 @@ config_id: test_config_id
   StrictMock<Http::MockStreamDecoderFilterCallbacks> sink_;
 };
 
+using Extensions::Common::Tap::TapSinkFactory;
+class MockTapSinkFactory : public TapSinkFactory {
+public:
+  MockTapSinkFactory() {}
+  ~MockTapSinkFactory() override{};
+
+  MOCK_METHOD(SinkPtr, createSinkPtr, (const Protobuf::Message& config, SinkContext), (override));
+
+  MOCK_METHOD(std::string, name, (), (const, override));
+  MOCK_METHOD(ProtobufTypes::MessagePtr, createEmptyConfigProto, (), (override));
+};
+
+class TestConfigImpl : public TapConfigBaseImpl {
+public:
+  TestConfigImpl(const envoy::config::tap::v3::TapConfig& proto_config,
+                 Extensions::Common::Tap::Sink* admin_streamer, SinkContext context)
+      : TapConfigBaseImpl(std::move(proto_config), admin_streamer, context) {}
+};
+
+TEST(TypedExtensionConfigTest, AddTestConfigHttpContext) {
+
+  const std::string tap_config_yaml =
+      R"EOF(
+  match:
+    any_match: true
+  output_config:
+    sinks:
+      - format: PROTO_BINARY
+        custom_sink:
+          name: custom_sink
+          typed_config:
+            "@type": type.googleapis.cm/google.protobuf.StringValue
+)EOF";
+  envoy::config::tap::v3::TapConfig tap_config;
+  TestUtility::loadFromYaml(tap_config_yaml, tap_config);
+
+  MockTapSinkFactory factory_impl;
+  EXPECT_CALL(factory_impl, name).Times(AtLeast(1));
+  EXPECT_CALL(factory_impl, createEmptyConfigProto)
+      .WillRepeatedly(Invoke([]() -> ProtobufTypes::MessagePtr {
+        return std::make_unique<ProtobufWkt::StringValue>();
+      }));
+  EXPECT_CALL(
+      factory_impl,
+      createSinkPtr(
+          _,
+          testing::VariantWith<std::reference_wrapper<Server::Configuration::FactoryContext>>(_)));
+  Registry::InjectFactory<TapSinkFactory> factory(factory_impl);
+
+  NiceMock<Server::Configuration::MockFactoryContext> factory_context;
+  TestConfigImpl(tap_config, NULL, factory_context);
+}
+
+TEST(TypedExtensionConfigTest, AddTestConfigTransportSocketContext) {
+
+  const std::string tap_config_yaml =
+      R"EOF(
+  match:
+    any_match: true
+  output_config:
+    sinks:
+      - format: PROTO_BINARY
+        custom_sink:
+          name: custom_sink
+          typed_config:
+            "@type": type.googleapis.cm/google.protobuf.StringValue
+)EOF";
+  envoy::config::tap::v3::TapConfig tap_config;
+  TestUtility::loadFromYaml(tap_config_yaml, tap_config);
+
+  MockTapSinkFactory factory_impl;
+  EXPECT_CALL(factory_impl, name).Times(AtLeast(1));
+  EXPECT_CALL(factory_impl, createEmptyConfigProto)
+      .WillRepeatedly(Invoke([]() -> ProtobufTypes::MessagePtr {
+        return std::make_unique<ProtobufWkt::StringValue>();
+      }));
+  EXPECT_CALL(
+      factory_impl,
+      createSinkPtr(
+          _, testing::VariantWith<
+                 std::reference_wrapper<Server::Configuration::TransportSocketFactoryContext>>(_)));
+  Registry::InjectFactory<TapSinkFactory> factory(factory_impl);
+
+  NiceMock<Server::Configuration::MockTransportSocketFactoryContext> factory_context;
+  TestConfigImpl(tap_config, NULL, factory_context);
+}
+
 // Make sure warn if using a pipe address for the admin handler.
 TEST_F(AdminHandlerTest, AdminWithPipeSocket) {
   EXPECT_LOG_CONTAINS(

From ffaddbb00ac0cc195dd36702280589ee512c4df1 Mon Sep 17 00:00:00 2001
From: phlax <phlax@users.noreply.github.com>
Date: Sun, 20 Aug 2023 23:16:17 +0100
Subject: [PATCH 15/25] ci/retest: Update retest to add AZP (#29149)

Signed-off-by: Ryan Northey <ryan@synca.io>
---
 .github/workflows/commands.yml | 8 ++++++--
 repokitteh.star                | 2 --
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/commands.yml b/.github/workflows/commands.yml
index 8742e8b75099..7550d2972cef 100644
--- a/.github/workflows/commands.yml
+++ b/.github/workflows/commands.yml
@@ -2,7 +2,8 @@ name: commands
 
 on:
   issue_comment:
-    types: [created]
+    types:
+    - created
 
 permissions:
   contents: read
@@ -21,7 +22,10 @@ jobs:
     permissions:
       pull-requests: write
       actions: write
+      checks: read
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/retest@actions-v0.0.10
+    - uses: envoyproxy/toolshed/gh-actions/retest@actions-v0.0.15
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
+        azp_org: cncf
+        azp_token: ${{ secrets.AZP_TOKEN }}
diff --git a/repokitteh.star b/repokitteh.star
index 5d7b55d6af3b..9ee51d6afe40 100644
--- a/repokitteh.star
+++ b/repokitteh.star
@@ -52,8 +52,6 @@ use(
 )
 use("github.com/envoyproxy/envoy/ci/repokitteh/modules/versionchange.star")
 
-alias('retest', 'retry-azp')
-
 def _backport():
   github.issue_label('backport/review')
 

From 40a826e1eba9a0bc37ca74fa350d86af287c2357 Mon Sep 17 00:00:00 2001
From: doujiang24 <doujiang24@gmail.com>
Date: Mon, 21 Aug 2023 17:14:59 +0800
Subject: [PATCH 16/25] add spacewander & antJack to go extension code owner
 (#29151)

Signed-off-by: doujiang24 <doujiang24@gmail.com>
---
 CODEOWNERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CODEOWNERS b/CODEOWNERS
index 15561c068e38..af350f9c058e 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -351,7 +351,7 @@ extensions/filters/http/oauth2 @derekargueta @mattklein123
 /contrib/client_ssl_auth/ @UNOWNED @UNOWNED
 /contrib/common/sqlutils/ @cpakulski @cpakulski
 /contrib/dynamo/ @UNOWNED @UNOWNED
-/contrib/golang/ @doujiang24 @wangfakang @StarryVae
+/contrib/golang/ @doujiang24 @wangfakang @StarryVae @spacewander @antJack
 /contrib/squash/ @yuval-k @alyssawilk
 /contrib/kafka/ @mattklein123 @adamkotwasinski
 /contrib/rocketmq_proxy/ @aaron-ai @lizhanhui @lizan

From d6a5e466ffe29052fe28dca1949fb04e5c81ec79 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=BD=97=E6=B3=BD=E8=BD=A9?= <spacewanderlzx@gmail.com>
Date: Mon, 21 Aug 2023 18:25:58 +0800
Subject: [PATCH 17/25] golang filter: don't track useless go.sum (#29049)

`go.sum` is useless according to:
https://github.com/envoyproxy/envoy/pull/28595#discussion_r1276272831
Add it to the gitignore so it won't be committed
Signed-off-by: spacewander <spacewanderlzx@gmail.com>

Signed-off-by: spacewander <spacewanderlzx@gmail.com>
---
 .gitignore                                                | 2 ++
 .../golang/filters/http/test/test_data/passthrough/go.sum | 8 --------
 2 files changed, 2 insertions(+), 8 deletions(-)
 delete mode 100644 contrib/golang/filters/http/test/test_data/passthrough/go.sum

diff --git a/.gitignore b/.gitignore
index de313efb4416..6aad749804db 100644
--- a/.gitignore
+++ b/.gitignore
@@ -55,3 +55,5 @@ bazel.output.txt
 tools/dev/src
 distribution/custom
 examples/websocket/certs
+/contrib/golang/**/test_data/go.sum
+/contrib/golang/**/test_data/*/go.sum
diff --git a/contrib/golang/filters/http/test/test_data/passthrough/go.sum b/contrib/golang/filters/http/test/test_data/passthrough/go.sum
deleted file mode 100644
index 00f5993c956c..000000000000
--- a/contrib/golang/filters/http/test/test_data/passthrough/go.sum
+++ /dev/null
@@ -1,8 +0,0 @@
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
-google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=

From 196d9c11ae7cd9ba81bcebe57461c36e40f7704d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 21 Aug 2023 11:30:38 +0100
Subject: [PATCH 18/25] build(deps): bump setuptools from 68.1.0 to 68.1.2 in
 /tools/base (#29156)

Bumps [setuptools](https://github.com/pypa/setuptools) from 68.1.0 to 68.1.2.
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](https://github.com/pypa/setuptools/compare/v68.1.0...v68.1.2)

---
updated-dependencies:
- dependency-name: setuptools
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 tools/base/requirements.txt | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/base/requirements.txt b/tools/base/requirements.txt
index d12859bdd567..766da25098f1 100644
--- a/tools/base/requirements.txt
+++ b/tools/base/requirements.txt
@@ -1543,9 +1543,9 @@ zstandard==0.21.0 \
     # via envoy-base-utils
 
 # The following packages are considered to be unsafe in a requirements file:
-setuptools==68.1.0 \
-    --hash=sha256:d59c97e7b774979a5ccb96388efc9eb65518004537e85d52e81eaee89ab6dd91 \
-    --hash=sha256:e13e1b0bc760e9b0127eda042845999b2f913e12437046e663b833aa96d89715
+setuptools==68.1.2 \
+    --hash=sha256:3d4dfa6d95f1b101d695a6160a7626e15583af71a5f52176efa5d39a054d475d \
+    --hash=sha256:3d8083eed2d13afc9426f227b24fd1659489ec107c0e86cec2ffdde5c92e790b
     # via
     #   -r requirements.in
     #   sphinxcontrib-jquery

From c9b98dedd3b75c0324812e2527cc420cfaf59f6c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 21 Aug 2023 11:30:50 +0100
Subject: [PATCH 19/25] build(deps): bump protobuf from 4.24.0 to 4.24.1 in
 /examples/grpc-bridge/client (#29157)

build(deps): bump protobuf in /examples/grpc-bridge/client

Bumps [protobuf](https://github.com/protocolbuffers/protobuf) from 4.24.0 to 4.24.1.
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Changelog](https://github.com/protocolbuffers/protobuf/blob/main/protobuf_release.bzl)
- [Commits](https://github.com/protocolbuffers/protobuf/compare/v4.24.0...v4.24.1)

---
updated-dependencies:
- dependency-name: protobuf
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 examples/grpc-bridge/client/requirements.txt | 28 ++++++++++----------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/examples/grpc-bridge/client/requirements.txt b/examples/grpc-bridge/client/requirements.txt
index 3f8ec6c5ca70..719929bee84b 100644
--- a/examples/grpc-bridge/client/requirements.txt
+++ b/examples/grpc-bridge/client/requirements.txt
@@ -112,20 +112,20 @@ idna==3.2 \
     --hash=sha256:14475042e284991034cb48e06f6851428fb14c4dc953acd9be9a5e95c7b6dd7a \
     --hash=sha256:467fbad99067910785144ce333826c71fb0e63a425657295239737f7ecd125f3
     # via requests
-protobuf==4.24.0 \
-    --hash=sha256:44825e963008f8ea0d26c51911c30d3e82e122997c3c4568fd0385dd7bacaedf \
-    --hash=sha256:567fe6b0647494845d0849e3d5b260bfdd75692bf452cdc9cb660d12457c055d \
-    --hash=sha256:5ab19ee50037d4b663c02218a811a5e1e7bb30940c79aac385b96e7a4f9daa61 \
-    --hash=sha256:5d0ceb9de6e08311832169e601d1fc71bd8e8c779f3ee38a97a78554945ecb85 \
-    --hash=sha256:6c817cf4a26334625a1904b38523d1b343ff8b637d75d2c8790189a4064e51c3 \
-    --hash=sha256:81cb9c4621d2abfe181154354f63af1c41b00a4882fb230b4425cbaed65e8f52 \
-    --hash=sha256:82e6e9ebdd15b8200e8423676eab38b774624d6a1ad696a60d86a2ac93f18201 \
-    --hash=sha256:8bb52a2be32db82ddc623aefcedfe1e0eb51da60e18fcc908fb8885c81d72109 \
-    --hash=sha256:a38400a692fd0c6944c3c58837d112f135eb1ed6cdad5ca6c5763336e74f1a04 \
-    --hash=sha256:a6b1ca92ccabfd9903c0c7dde8876221dc7d8d87ad5c42e095cc11b15d3569c7 \
-    --hash=sha256:ae7a1835721086013de193311df858bc12cd247abe4ef9710b715d930b95b33e \
-    --hash=sha256:ae97b5de10f25b7a443b40427033e545a32b0e9dda17bcd8330d70033379b3e5 \
-    --hash=sha256:e8834ef0b4c88666ebb7c7ec18045aa0f4325481d724daa624a4cf9f28134653
+protobuf==4.24.1 \
+    --hash=sha256:06437f0d4bb0d5f29e3d392aba69600188d4be5ad1e0a3370e581a9bf75a3081 \
+    --hash=sha256:0b2b224e9541fe9f046dd7317d05f08769c332b7e4c54d93c7f0f372dedb0b1a \
+    --hash=sha256:302e8752c760549ed4c7a508abc86b25d46553c81989343782809e1a062a2ef9 \
+    --hash=sha256:44837a5ed9c9418ad5d502f89f28ba102e9cd172b6668bc813f21716f9273348 \
+    --hash=sha256:55dd644adc27d2a624339332755fe077c7f26971045b469ebb9732a69ce1f2ca \
+    --hash=sha256:5906c5e79ff50fe38b2d49d37db5874e3c8010826f2362f79996d83128a8ed9b \
+    --hash=sha256:5d32363d14aca6e5c9e9d5918ad8fb65b091b6df66740ae9de50ac3916055e43 \
+    --hash=sha256:970c701ee16788d74f3de20938520d7a0aebc7e4fff37096a48804c80d2908cf \
+    --hash=sha256:bd39b9094a4cc003a1f911b847ab379f89059f478c0b611ba1215053e295132e \
+    --hash=sha256:d414199ca605eeb498adc4d2ba82aedc0379dca4a7c364ff9bc9a179aa28e71b \
+    --hash=sha256:d4af4fd9e9418e819be30f8df2a16e72fbad546a7576ac7f3653be92a6966d30 \
+    --hash=sha256:df015c47d6855b8efa0b9be706c70bf7f050a4d5ac6d37fb043fbd95157a0e25 \
+    --hash=sha256:fc361148e902949dcb953bbcb148c99fe8f8854291ad01107e4120361849fd0e
     # via
     #   -r requirements.in
     #   grpcio-tools

From 2f38e3a59a7a4f3694d5992cad02113a718369c7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 21 Aug 2023 11:31:06 +0100
Subject: [PATCH 20/25] build(deps): bump postgres from `992c539` to `a5e89e5`
 in /examples/shared/postgres (#29158)

build(deps): bump postgres in /examples/shared/postgres

Bumps postgres from `992c539` to `a5e89e5`.

---
updated-dependencies:
- dependency-name: postgres
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 examples/shared/postgres/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/shared/postgres/Dockerfile b/examples/shared/postgres/Dockerfile
index 19d614a412f7..50380518a3a7 100644
--- a/examples/shared/postgres/Dockerfile
+++ b/examples/shared/postgres/Dockerfile
@@ -1,3 +1,3 @@
-FROM postgres:latest@sha256:992c5398ca50c716e8c2556a6f6733a0e471e178a6320478a86bb4abe9566299
+FROM postgres:latest@sha256:a5e89e5f2679863bedef929c4a7ec5d1a2cb3c045f13b47680d86f8701144ed7
 COPY docker-healthcheck.sh /usr/local/bin/
 HEALTHCHECK CMD ["docker-healthcheck.sh"]

From f3da098a34a666ea97e2c8b07df90a64a87a77aa Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 21 Aug 2023 11:31:42 +0100
Subject: [PATCH 21/25] build(deps): bump python from `48c5fa0` to `40319d0` in
 /examples/shared/python (#29154)

build(deps): bump python in /examples/shared/python

Bumps python from `48c5fa0` to `40319d0`.

---
updated-dependencies:
- dependency-name: python
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 examples/shared/python/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/shared/python/Dockerfile b/examples/shared/python/Dockerfile
index 50cf835fd01f..b0549b7e516d 100644
--- a/examples/shared/python/Dockerfile
+++ b/examples/shared/python/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.11.4-slim-bullseye@sha256:48c5fa0689f8d7de2cd117b9a51d4c9baeb1337d31fb0c0345a657731ac0ab36 as python-base
+FROM python:3.11.4-slim-bullseye@sha256:40319d0a897896e746edf877783ef39685d44e90e1e6de8d964d0382df0d4952 as python-base
 RUN rm -f /etc/apt/apt.conf.d/docker-clean \
     && echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' | tee /etc/apt/apt.conf.d/keep-cache
 ARG PYTHON_REQUIREMENTS_FILE=aiohttp/requirements.txt

From eae0751f9d347cf18b7f7b1d90fabd2f7cbfcd7b Mon Sep 17 00:00:00 2001
From: phlax <phlax@users.noreply.github.com>
Date: Mon, 21 Aug 2023 12:14:10 +0100
Subject: [PATCH 22/25] ci/retest: Minor fix (#29162)

Signed-off-by: Ryan Northey <ryan@synca.io>
---
 .github/workflows/commands.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/commands.yml b/.github/workflows/commands.yml
index 7550d2972cef..795b1ccafebd 100644
--- a/.github/workflows/commands.yml
+++ b/.github/workflows/commands.yml
@@ -24,7 +24,7 @@ jobs:
       actions: write
       checks: read
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/retest@actions-v0.0.15
+    - uses: envoyproxy/toolshed/gh-actions/retest@actions-v0.0.16
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         azp_org: cncf

From 674b427a59d4946e32b25d5d8ea6dbbd80f4346c Mon Sep 17 00:00:00 2001
From: phlax <phlax@users.noreply.github.com>
Date: Mon, 21 Aug 2023 12:57:55 +0100
Subject: [PATCH 23/25] ci/cache: Ensure failure on cache non-fetch (#29164)

Signed-off-by: Ryan Northey <ryan@synca.io>
---
 .azure-pipelines/pipelines.yml | 2 +-
 ci/do_ci.sh                    | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index 14406ecf7e96..d757dbb23978 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -47,7 +47,7 @@ variables:
 - name: cacheKeyName
   value: envoy
 - name: cacheKeyVersion
-  value: v0
+  value: v1
 - name: cacheKeyBazel
   value: '.bazelversion | ./WORKSPACE | **/*.bzl, !mobile/**, !envoy-docs/**'
 - name: cacheKeyDocker
diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index cce2bff00e7a..0e5cec26719d 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -581,9 +581,12 @@ case $CI_TARGET in
                   "${FETCH_TARGETS[@]}" \
                 && break
             n=$((n+1))
-            if [[ "$n" -ne 10 ]]; then
+            if [[ "$n" -lt 10 ]]; then
                 sleep 15
                 echo "Retrying fetch ..."
+            else
+                echo "Fetch failed"
+                exit 1
             fi
         done
         ;;

From 8482ae2a5c64d25577be40af89b0fe807af29ec1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 21 Aug 2023 12:11:54 +0000
Subject: [PATCH 24/25] build(deps): update envoyproxy/toolshed requirement to
 actions-v0.0.16 (#29165)

Updates the requirements on [envoyproxy/toolshed](https://github.com/envoyproxy/toolshed) to permit the latest version.
- [Release notes](https://github.com/envoyproxy/toolshed/releases)
- [Commits](https://github.com/envoyproxy/toolshed/commits/actions-v0.0.16)

---
updated-dependencies:
- dependency-name: envoyproxy/toolshed
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/_cache_docker.yml     | 2 +-
 .github/workflows/_ci.yml               | 6 +++---
 .github/workflows/_workflow-start.yml   | 2 +-
 .github/workflows/envoy-sync.yml        | 2 +-
 .github/workflows/workflow-complete.yml | 2 +-
 5 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/_cache_docker.yml b/.github/workflows/_cache_docker.yml
index f0d653cab024..c141c578bedd 100644
--- a/.github/workflows/_cache_docker.yml
+++ b/.github/workflows/_cache_docker.yml
@@ -37,7 +37,7 @@ jobs:
   docker:
     runs-on: ubuntu-22.04
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/docker/cache/prime@actions-v0.0.10
+    - uses: envoyproxy/toolshed/gh-actions/docker/cache/prime@actions-v0.0.16
       name: Prime Docker cache (${{ inputs.image_repo }}:${{ inputs.image_tag }}@sha256:${{ inputs.image_sha }})
       with:
         image_tag: "${{ inputs.image_repo }}:${{ inputs.image_tag }}@sha256:${{ inputs.image_sha }}"
diff --git a/.github/workflows/_ci.yml b/.github/workflows/_ci.yml
index 11a61854caf7..cf1af8523da5 100644
--- a/.github/workflows/_ci.yml
+++ b/.github/workflows/_ci.yml
@@ -92,7 +92,7 @@ jobs:
     steps:
     - if: ${{ inputs.cache_build_image }}
       name: Restore Docker cache (${{ inputs.cache_build_image }})
-      uses: envoyproxy/toolshed/gh-actions/docker/cache/restore@actions-v0.0.10
+      uses: envoyproxy/toolshed/gh-actions/docker/cache/restore@actions-v0.0.16
       with:
         image_tag: ${{ inputs.cache_build_image }}
 
@@ -123,7 +123,7 @@ jobs:
 
     - if: ${{ inputs.run_pre }}
       name: Run pre action ${{ inputs.run_pre && format('({0})', inputs.run_pre) || '' }}
-      uses: envoyproxy/toolshed/gh-actions/using/recurse@actions-v0.0.10
+      uses: envoyproxy/toolshed/gh-actions/using/recurse@actions-v0.0.16
       with:
         uses: ${{ inputs.run_pre }}
         with: ${{ inputs.run_pre_with }}
@@ -147,7 +147,7 @@ jobs:
 
     - if: ${{ inputs.run_post }}
       name: Run post action ${{ inputs.run_pre && format('({0})', inputs.run_post) || '' }}
-      uses: envoyproxy/toolshed/gh-actions/using/recurse@actions-v0.0.10
+      uses: envoyproxy/toolshed/gh-actions/using/recurse@actions-v0.0.16
       with:
         uses: ${{ inputs.run_post }}
         with: ${{ inputs.run_post_with }}
diff --git a/.github/workflows/_workflow-start.yml b/.github/workflows/_workflow-start.yml
index b4e758778c2b..6efed49fff73 100644
--- a/.github/workflows/_workflow-start.yml
+++ b/.github/workflows/_workflow-start.yml
@@ -29,7 +29,7 @@ jobs:
 
     - if: ${{ steps.env.outputs.trusted != 'true' }}
       name: Start status check
-      uses: envoyproxy/toolshed/gh-actions/status@actions-v0.0.10
+      uses: envoyproxy/toolshed/gh-actions/status@actions-v0.0.16
       with:
         authToken: ${{ secrets.GITHUB_TOKEN }}
         context: ${{ inputs.workflow_name }}
diff --git a/.github/workflows/envoy-sync.yml b/.github/workflows/envoy-sync.yml
index a534c5e8be06..86b656dfef6f 100644
--- a/.github/workflows/envoy-sync.yml
+++ b/.github/workflows/envoy-sync.yml
@@ -27,7 +27,7 @@ jobs:
         - envoy-filter-example
         - data-plane-api
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/dispatch@actions-v0.0.10
+    - uses: envoyproxy/toolshed/gh-actions/dispatch@actions-v0.0.16
       with:
         repository: "envoyproxy/${{ matrix.downstream }}"
         ref: main
diff --git a/.github/workflows/workflow-complete.yml b/.github/workflows/workflow-complete.yml
index e81503bcca99..2dea9c187a08 100644
--- a/.github/workflows/workflow-complete.yml
+++ b/.github/workflows/workflow-complete.yml
@@ -53,7 +53,7 @@ jobs:
         echo "state=${STATE}" >> "$GITHUB_OUTPUT"
       id: job
     - name: Complete status check
-      uses: envoyproxy/toolshed/gh-actions/status@actions-v0.0.10
+      uses: envoyproxy/toolshed/gh-actions/status@actions-v0.0.16
       with:
         authToken: ${{ secrets.GITHUB_TOKEN }}
         context: Verify/examples

From 4806568974d114b2f1a63e559579c409e84b7aac Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 21 Aug 2023 15:00:53 +0100
Subject: [PATCH 25/25] build(deps): bump golang from `bb4608b` to `02f350d` in
 /examples/shared/golang (#29153)

build(deps): bump golang in /examples/shared/golang

Bumps golang from `bb4608b` to `02f350d`.

---
updated-dependencies:
- dependency-name: golang
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 examples/shared/golang/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/shared/golang/Dockerfile b/examples/shared/golang/Dockerfile
index d0416489aee3..abf71524ec02 100644
--- a/examples/shared/golang/Dockerfile
+++ b/examples/shared/golang/Dockerfile
@@ -3,7 +3,7 @@ RUN rm -f /etc/apt/apt.conf.d/docker-clean \
     && echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' | tee /etc/apt/apt.conf.d/keep-cache
 
 
-FROM golang:1.21.0-bullseye@sha256:bb4608b685d422dd1e7ac03bf16b136d2780854e908fa0a571fd2370ca4dae1b as golang-base
+FROM golang:1.21.0-bullseye@sha256:02f350d8452d3f9693a450586659ecdc6e40e9be8f8dfc6d402300d87223fdfa as golang-base
 
 
 FROM golang-base as golang-control-plane-builder