Bump Envoy API to 1.18

.gitignore

@@ -1,7 +1,6 @@
 .idea
 *.iml
 build
-logs
 *.log
 .gradle
 application.pid
@@ -10,4 +9,4 @@ gen/
 .jqwik-database
 .classpath
 .project
-bin/
+bin/

README.md

@@ -4,3 +4,17 @@ This builds a grpc library for the envoy xDS API.
 
 ## Versioning
 Major and minor version follow the envoy version against which they are built. The patch version is this library's patch version. Use the latest patch version for the envoy major.minor you run, e.g. use the latest 1.17.x for this library if you run envoy 1.17.y, regardless of what y is.
+
+## Building
+
+The `tools` directory follows https://github.com/envoyproxy/java-control-plane/commits/main/tools as closely as possible.
+
+1. Update the `API_SHAS` (which are not really just SHAs): run `update-sha.sh MAJOR.MINOR.PATCH`, paste the end of its output to `API_SHAS`.
+
+1. Update the proto files using `update-api.sh`. This will remove the old `src/main/proto` and fetch a new set of protos.
+
+1. Bump the library version accoring to `Versioning` above in `gradle.properties`.
+
+1. Now it should build on CI. Can try locally using `./gradlew assemble`, but see GHA workflow for specific steps.
+
+Note: until we catch up with Envoy head version, slight adjustments might be needed for these scripts, towards matching upstream more closely.

build.gradle

@@ -37,7 +37,7 @@ java {
 }
 
 def grpcVersion = '1.45.1'
-def protobufVersion = '3.19.2'
+def protobufVersion = '3.20.1'
 def protocVersion = protobufVersion
 
 dependencies {

gradle.properties

@@ -1,2 +1,2 @@
-version=1.17.0
+version=1.18.0
 org.gradle.jvmargs=-Xmx2g -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError -Dfile.encoding=UTF-8

src/main/proto/envoy/admin/v3/clusters.proto

@@ -29,7 +29,7 @@ message Clusters {
 }
 
 // Details an individual cluster's current status.
-// [#next-free-field: 7]
+// [#next-free-field: 8]
 message ClusterStatus {
   option (udpa.annotations.versioning).previous_message_type = "envoy.admin.v2alpha.ClusterStatus";
 
@@ -80,6 +80,9 @@ message ClusterStatus {
 
   // :ref:`Circuit breaking <arch_overview_circuit_break>` settings of the cluster.
   config.cluster.v3.CircuitBreakers circuit_breakers = 6;
+
+  // Observability name of the cluster.
+  string observability_name = 7;
 }
 
 // Current state of a particular host.
@@ -139,7 +142,7 @@ message HostStatus {
 }
 
 // Health status for a host.
-// [#next-free-field: 7]
+// [#next-free-field: 9]
 message HostHealthStatus {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.admin.v2alpha.HostHealthStatus";
@@ -160,6 +163,13 @@ message HostHealthStatus {
   // The host has not yet been health checked.
   bool pending_active_hc = 6;
 
+  // The host should be excluded from panic, spillover, etc. calculations because it was explicitly
+  // taken out of rotation via protocol signal and is not meant to be routed to.
+  bool excluded_via_immediate_hc_fail = 7;
+
+  // The host failed active HC due to timeout.
+  bool active_hc_timeout = 8;
+
   // Health status as reported by EDS. Note: only HEALTHY and UNHEALTHY are currently supported
   // here.
   // [#comment:TODO(mrice32): pipe through remaining EDS health status possibilities.]

src/main/proto/envoy/admin/v3/config_dump.proto

@@ -17,6 +17,31 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 
 // [#protodoc-title: ConfigDump]
 
+// Resource status from the view of a xDS client, which tells the synchronization
+// status between the xDS client and the xDS server.
+enum ClientResourceStatus {
+  // Resource status is not available/unknown.
+  UNKNOWN = 0;
+
+  // Client requested this resource but hasn't received any update from management
+  // server. The client will not fail requests, but will queue them until update
+  // arrives or the client times out waiting for the resource.
+  REQUESTED = 1;
+
+  // This resource has been requested by the client but has either not been
+  // delivered by the server or was previously delivered by the server and then
+  // subsequently removed from resources provided by the server. For more
+  // information, please refer to the :ref:`"Knowing When a Requested Resource
+  // Does Not Exist" <xds_protocol_resource_not_existed>` section.
+  DOES_NOT_EXIST = 2;
+
+  // Client received this resource and replied with ACK.
+  ACKED = 3;
+
+  // Client received this resource and replied with NACK.
+  NACKED = 4;
+}
+
 // The :ref:`/config_dump <operations_admin_interface_config_dump>` admin endpoint uses this wrapper
 // message to maintain and serve arbitrary configuration information from any component in Envoy.
 message ConfigDump {
@@ -49,13 +74,18 @@ message UpdateFailureState {
       "envoy.admin.v2alpha.UpdateFailureState";
 
   // What the component configuration would have been if the update had succeeded.
+  // This field may not be populated by xDS clients due to storage overhead.
   google.protobuf.Any failed_configuration = 1;
 
   // Time of the latest failed update attempt.
   google.protobuf.Timestamp last_update_attempt = 2;
 
   // Details about the last failed update attempt.
   string details = 3;
+
+  // This is the version of the rejected resource.
+  // [#not-implemented-hide:]
+  string version_info = 4;
 }
 
 // This message describes the bootstrap configuration that Envoy was started with. This includes
@@ -109,7 +139,7 @@ message ListenersConfigDump {
   }
 
   // Describes a dynamically loaded listener via the LDS API.
-  // [#next-free-field: 6]
+  // [#next-free-field: 7]
   message DynamicListener {
     option (udpa.annotations.versioning).previous_message_type =
         "envoy.admin.v2alpha.ListenersConfigDump.DynamicListener";
@@ -134,7 +164,14 @@ message ListenersConfigDump {
     DynamicListenerState draining_state = 4;
 
     // Set if the last update failed, cleared after the next successful update.
+    // The *error_state* field contains the rejected version of this particular
+    // resource along with the reason and timestamp. For successfully updated or
+    // acknowledged resource, this field should be empty.
     UpdateFailureState error_state = 5;
+
+    // The client status of this resource.
+    // [#not-implemented-hide:]
+    ClientResourceStatus client_status = 6;
   }
 
   // This is the :ref:`version_info <envoy_api_field_service.discovery.v3.DiscoveryResponse.version_info>` in the
@@ -169,6 +206,7 @@ message ClustersConfigDump {
   }
 
   // Describes a dynamically loaded cluster via the CDS API.
+  // [#next-free-field: 6]
   message DynamicCluster {
     option (udpa.annotations.versioning).previous_message_type =
         "envoy.admin.v2alpha.ClustersConfigDump.DynamicCluster";
@@ -184,6 +222,17 @@ message ClustersConfigDump {
 
     // The timestamp when the Cluster was last updated.
     google.protobuf.Timestamp last_updated = 3;
+
+    // Set if the last update failed, cleared after the next successful update.
+    // The *error_state* field contains the rejected version of this particular
+    // resource along with the reason and timestamp. For successfully updated or
+    // acknowledged resource, this field should be empty.
+    // [#not-implemented-hide:]
+    UpdateFailureState error_state = 4;
+
+    // The client status of this resource.
+    // [#not-implemented-hide:]
+    ClientResourceStatus client_status = 5;
   }
 
   // This is the :ref:`version_info <envoy_api_field_service.discovery.v3.DiscoveryResponse.version_info>` in the
@@ -225,6 +274,7 @@ message RoutesConfigDump {
     google.protobuf.Timestamp last_updated = 2;
   }
 
+  // [#next-free-field: 6]
   message DynamicRouteConfig {
     option (udpa.annotations.versioning).previous_message_type =
         "envoy.admin.v2alpha.RoutesConfigDump.DynamicRouteConfig";
@@ -239,6 +289,17 @@ message RoutesConfigDump {
 
     // The timestamp when the Route was last updated.
     google.protobuf.Timestamp last_updated = 3;
+
+    // Set if the last update failed, cleared after the next successful update.
+    // The *error_state* field contains the rejected version of this particular
+    // resource along with the reason and timestamp. For successfully updated or
+    // acknowledged resource, this field should be empty.
+    // [#not-implemented-hide:]
+    UpdateFailureState error_state = 4;
+
+    // The client status of this resource.
+    // [#not-implemented-hide:]
+    ClientResourceStatus client_status = 5;
   }
 
   // The statically loaded route configs.
@@ -270,6 +331,7 @@ message ScopedRoutesConfigDump {
     google.protobuf.Timestamp last_updated = 3;
   }
 
+  // [#next-free-field: 7]
   message DynamicScopedRouteConfigs {
     option (udpa.annotations.versioning).previous_message_type =
         "envoy.admin.v2alpha.ScopedRoutesConfigDump.DynamicScopedRouteConfigs";
@@ -287,6 +349,17 @@ message ScopedRoutesConfigDump {
 
     // The timestamp when the scoped route config set was last updated.
     google.protobuf.Timestamp last_updated = 4;
+
+    // Set if the last update failed, cleared after the next successful update.
+    // The *error_state* field contains the rejected version of this particular
+    // resource along with the reason and timestamp. For successfully updated or
+    // acknowledged resource, this field should be empty.
+    // [#not-implemented-hide:]
+    UpdateFailureState error_state = 5;
+
+    // The client status of this resource.
+    // [#not-implemented-hide:]
+    ClientResourceStatus client_status = 6;
   }
 
   // The statically loaded scoped route configs.
@@ -302,6 +375,7 @@ message SecretsConfigDump {
       "envoy.admin.v2alpha.SecretsConfigDump";
 
   // DynamicSecret contains secret information fetched via SDS.
+  // [#next-free-field: 7]
   message DynamicSecret {
     option (udpa.annotations.versioning).previous_message_type =
         "envoy.admin.v2alpha.SecretsConfigDump.DynamicSecret";
@@ -319,6 +393,17 @@ message SecretsConfigDump {
     // Security sensitive information is redacted (replaced with "[redacted]") for
     // private keys and passwords in TLS certificates.
     google.protobuf.Any secret = 4;
+
+    // Set if the last update failed, cleared after the next successful update.
+    // The *error_state* field contains the rejected version of this particular
+    // resource along with the reason and timestamp. For successfully updated or
+    // acknowledged resource, this field should be empty.
+    // [#not-implemented-hide:]
+    UpdateFailureState error_state = 5;
+
+    // The client status of this resource.
+    // [#not-implemented-hide:]
+    ClientResourceStatus client_status = 6;
   }
 
   // StaticSecret specifies statically loaded secret in bootstrap.
@@ -362,6 +447,7 @@ message EndpointsConfigDump {
     google.protobuf.Timestamp last_updated = 2;
   }
 
+  // [#next-free-field: 6]
   message DynamicEndpointConfig {
     // [#not-implemented-hide:] This is the per-resource version information. This version is currently taken from the
     // :ref:`version_info <envoy_api_field_service.discovery.v3.DiscoveryResponse.version_info>` field at the time that
@@ -373,6 +459,17 @@ message EndpointsConfigDump {
 
     // [#not-implemented-hide:] The timestamp when the Endpoint was last updated.
     google.protobuf.Timestamp last_updated = 3;
+
+    // Set if the last update failed, cleared after the next successful update.
+    // The *error_state* field contains the rejected version of this particular
+    // resource along with the reason and timestamp. For successfully updated or
+    // acknowledged resource, this field should be empty.
+    // [#not-implemented-hide:]
+    UpdateFailureState error_state = 4;
+
+    // The client status of this resource.
+    // [#not-implemented-hide:]
+    ClientResourceStatus client_status = 5;
   }
 
   // The statically loaded endpoint configs.

src/main/proto/envoy/admin/v3/init_dump.proto

@@ -3,7 +3,6 @@ syntax = "proto3";
 package envoy.admin.v3;
 
 import "udpa/annotations/status.proto";
-import "udpa/annotations/versioning.proto";
 
 option java_package = "io.envoyproxy.envoy.admin.v3";
 option java_outer_classname = "InitDumpProto";

src/main/proto/envoy/admin/v3/server_info.proto

@@ -6,7 +6,6 @@ import "envoy/config/core/v3/base.proto";
 
 import "google/protobuf/duration.proto";
 
-import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 
@@ -59,7 +58,7 @@ message ServerInfo {
   config.core.v3.Node node = 7;
 }
 
-// [#next-free-field: 37]
+// [#next-free-field: 38]
 message CommandLineOptions {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.admin.v2alpha.CommandLineOptions";
@@ -190,4 +189,7 @@ message CommandLineOptions {
 
   // See :option:`--socket-mode` for details.
   uint32 socket_mode = 36;
+
+  // See :option:`--enable-core-dump` for details.
+  bool enable_core_dump = 37;
 }

src/main/proto/envoy/admin/v4alpha/clusters.proto

@@ -29,7 +29,7 @@ message Clusters {
 }
 
 // Details an individual cluster's current status.
-// [#next-free-field: 7]
+// [#next-free-field: 8]
 message ClusterStatus {
   option (udpa.annotations.versioning).previous_message_type = "envoy.admin.v3.ClusterStatus";
 
@@ -80,6 +80,9 @@ message ClusterStatus {
 
   // :ref:`Circuit breaking <arch_overview_circuit_break>` settings of the cluster.
   config.cluster.v4alpha.CircuitBreakers circuit_breakers = 6;
+
+  // Observability name of the cluster.
+  string observability_name = 7;
 }
 
 // Current state of a particular host.
@@ -139,7 +142,7 @@ message HostStatus {
 }
 
 // Health status for a host.
-// [#next-free-field: 7]
+// [#next-free-field: 9]
 message HostHealthStatus {
   option (udpa.annotations.versioning).previous_message_type = "envoy.admin.v3.HostHealthStatus";
 
@@ -159,6 +162,13 @@ message HostHealthStatus {
   // The host has not yet been health checked.
   bool pending_active_hc = 6;
 
+  // The host should be excluded from panic, spillover, etc. calculations because it was explicitly
+  // taken out of rotation via protocol signal and is not meant to be routed to.
+  bool excluded_via_immediate_hc_fail = 7;
+
+  // The host failed active HC due to timeout.
+  bool active_hc_timeout = 8;
+
   // Health status as reported by EDS. Note: only HEALTHY and UNHEALTHY are currently supported
   // here.
   // [#comment:TODO(mrice32): pipe through remaining EDS health status possibilities.]