envoy: Bump envoy version to v1.39.0

.bazelversion

@@ -1 +1 @@
-7.7.1
+8.7.0

.github/renovate.json5

@@ -180,11 +180,11 @@
       ],
     },
     {
-      groupName: 'envoy 1.38.x',
+      groupName: 'envoy 1.39.x',
       matchDepNames: [
         'envoyproxy/envoy',
       ],
-      allowedVersions: '<=1.38',
+      allowedVersions: '<=1.39',
       matchBaseBranches: [
         'main',
       ],

ENVOY_VERSION

@@ -1 +1 @@
-envoy-1.38.3
+envoy-1.39.0

WORKSPACE

@@ -12,8 +12,8 @@ ENVOY_REPO = "envoy"
 #
 # No other line in this file may have ENVOY_SHA followed by an equals sign!
 #
-# renovate: datasource=github-releases depName=envoyproxy/envoy digestVersion=v1.38.3
-ENVOY_SHA = "0ebfcfe5b0484b89ca85b761da9e05ce75dbda8d"
+# renovate: datasource=github-releases depName=envoyproxy/envoy digestVersion=v1.39.0
+ENVOY_SHA = "8eea3285d6bdb89f8ea34632cfe7ce1608a8f374"
 
 # // clang-format off: unexpected @bazel_tools reference, please indirect via a definition in //bazel
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
@@ -34,17 +34,18 @@ local_repository(
 git_repository(
     name = "envoy",
     commit = ENVOY_SHA,
-    patch_args = ["apply"],
-    patch_tool = "git",
+    # Use Bazel's native patch implementation. `patch_tool = "git"` must not be
+    # used: since Bazel 8, `git_repository` carries a `patch_strip` attribute and
+    # prepends its `-pN` to `patch_args`, which `git apply` rejects as an unknown
+    # global option.
+    patch_strip = 1,
     patches = [
         "@//patches:0001-network-Add-callback-for-upstream-authorization.patch",
         "@//patches:0002-listener-add-socket-options.patch",
         "@//patches:0003-original_dst_cluster-Avoid-multiple-hosts-for-the-sa.patch",
         "@//patches:0004-thread_local-reset-slot-in-worker-threads-first.patch",
         "@//patches:0005-http-header-expose-attribute.patch",
-        "@//patches:0006-test-integration-Defer-fake-upstream-read-enable-un.patch",
-        "@//patches:0007-config-add-grpc-mux-stream-event-callback.patch",
-        "@//patches:0008-repo-Make-yq-dependency-optional-for-CI-config-parsi.patch",
+        "@//patches:0006-config-add-grpc-mux-stream-event-callback.patch",
     ],
     # // clang-format off: Envoy's format check: Only repository_locations.bzl may contains URL references
     remote = "https://github.com/envoyproxy/envoy.git",

cilium/BUILD

@@ -135,6 +135,7 @@ envoy_cc_library(
         "//cilium:network_policy_lib",
         "//cilium/api:l7policy_cc_proto",
         "@envoy//envoy/config:subscription_interface",
+        "@envoy//envoy/upstream:host_description_interface",
         "@envoy//source/common/http:utility_lib",
         "@envoy//source/common/network:upstream_server_name_lib",
         "@envoy//source/common/network:upstream_subject_alt_names_lib",

cilium/accesslog.cc

@@ -65,7 +65,10 @@ void AccessLog::log(AccessLog::Entry& log_entry, ::cilium::EntryType entry_type)
 
   // encode protobuf
   std::string msg;
-  entry.SerializeToString(&msg);
+  if (!entry.SerializeToString(&msg)) {
+    ENVOY_LOG_MISC(warn, "cilium.AccessLog: Failed to serialize log entry, skipping it");
+    return;
+  }
 
   UDSClient::log(msg);
 }

cilium/bpf_metadata.cc

@@ -8,6 +8,7 @@
 #include <cstddef>
 #include <cstdint>
 #include <memory>
+#include <optional>
 #include <string>
 #include <utility>
 #include <vector>
@@ -37,7 +38,6 @@
 #include "source/common/protobuf/utility.h"
 
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
 #include "cilium/api/bpf_metadata.pb.h"
 #include "cilium/api/bpf_metadata.pb.validate.h" // IWYU pragma: keep
 #include "cilium/conntrack.h"
@@ -397,7 +397,7 @@ const PolicyInstance& Config::getPolicy(const std::string& pod_ip) const {
 
 bool Config::exists(const std::string& pod_ip) const { return npmap_->exists(pod_ip); }
 
-absl::optional<Cilium::BpfMetadata::SocketMetadata>
+std::optional<Cilium::BpfMetadata::SocketMetadata>
 Config::extractSocketMetadata(Network::ConnectionSocket& socket) {
   Network::Address::InstanceConstSharedPtr src_address =
       socket.connectionInfoProvider().remoteAddress();
@@ -410,7 +410,7 @@ Config::extractSocketMetadata(Network::ConnectionSocket& socket) {
   if (!sip || !dip) {
     ENVOY_LOG(debug, "Non-IP addresses: src: {} dst: {}", src_address->asString(),
               dst_address->asString());
-    return absl::nullopt;
+    return std::nullopt;
   }
 
   std::string pod_ip, other_ip, ingress_policy_name;
@@ -459,7 +459,7 @@ Config::extractSocketMetadata(Network::ConnectionSocket& socket) {
                 "cilium.bpf_metadata (east/west L7 LB): Non-local pod can not use original "
                 "source address: {}",
                 pod_ip);
-      return absl::nullopt;
+      return std::nullopt;
     }
     // Use original source address with L7 LB for local endpoint sources if requested, as policy
     // enforcement after the proxy depends on it (i.e., for "east/west" LB).
@@ -479,7 +479,7 @@ Config::extractSocketMetadata(Network::ConnectionSocket& socket) {
           "cilium.bpf_metadata (north/south L7 LB): No local Ingress IP source address configured "
           "for the family of {}",
           sip->addressAsString());
-      return absl::nullopt;
+      return std::nullopt;
     }
 
     // Enforce pod policy only for local pods.
@@ -502,7 +502,7 @@ Config::extractSocketMetadata(Network::ConnectionSocket& socket) {
                 "cilium.bpf_metadata (north/south L7 LB): Unknown local Ingress IP source address "
                 "configured: {}",
                 ingress_ip->addressAsString());
-      return absl::nullopt;
+      return std::nullopt;
     }
 
     // Original source address is never used for north/south LB
@@ -579,13 +579,13 @@ Network::FilterStatus Instance::onAccept(Network::ListenerFilterCallbacks& cb) {
     const auto policy_fs = socket_metadata->buildCiliumPolicyFilterState();
     cb.filterState().setData(
         Cilium::CiliumPolicyFilterState::key(), policy_fs,
-        StreamInfo::FilterState::StateType::ReadOnly, StreamInfo::FilterState::LifeSpan::Connection,
+        StreamInfo::FilterState::LifeSpan::Connection,
         StreamInfo::StreamSharingMayImpactPooling::SharedWithUpstreamConnection);
 
     const auto dest_fs = socket_metadata->buildCiliumDestinationFilterState();
     cb.filterState().setData(
         Cilium::CiliumDestinationFilterState::key(), dest_fs,
-        StreamInfo::FilterState::StateType::Mutable, StreamInfo::FilterState::LifeSpan::Connection,
+        StreamInfo::FilterState::LifeSpan::Connection,
         StreamInfo::StreamSharingMayImpactPooling::SharedWithUpstreamConnection);
 
     // Restoring original source address on the upstream socket

cilium/bpf_metadata.h

@@ -3,6 +3,7 @@
 #include <chrono>
 #include <cstddef>
 #include <memory>
+#include <optional>
 #include <string>
 #include <utility>
 #include <vector>
@@ -18,7 +19,6 @@
 #include "source/common/common/logger.h"
 
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
 #include "cilium/api/bpf_metadata.pb.h"
 #include "cilium/conntrack.h"
 #include "cilium/filter_state_cilium_destination.h"
@@ -156,7 +156,7 @@ class Config : public Cilium::PolicyResolver,
   const PolicyInstance& getPolicy(const std::string&) const override;
   bool exists(const std::string&) const override;
 
-  virtual absl::optional<SocketMetadata> extractSocketMetadata(Network::ConnectionSocket& socket);
+  virtual std::optional<SocketMetadata> extractSocketMetadata(Network::ConnectionSocket& socket);
 
   // Possibility to prevent socket options that require
   // NET_ADMIN privileges from being applied. Used by tests.

cilium/grpc_subscription.cc

@@ -5,6 +5,7 @@
 #include <cstdint>
 #include <functional>
 #include <memory>
+#include <optional>
 #include <string>
 #include <utility>
 #include <vector>
@@ -38,7 +39,6 @@
 #include "absl/status/statusor.h"
 #include "absl/strings/match.h"
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
 
 namespace Envoy {
 namespace Cilium {
@@ -176,8 +176,8 @@ void ManagedGrpcSubscription::create() {
         rate_limit_settings_or_error.value(),
         *scope_,
         std::move(nop_config_validators),
-        /*xds_resources_delegate_=*/absl::nullopt,
-        /*xds_config_tracker_=*/absl::nullopt,
+        /*xds_resources_delegate_=*/std::nullopt,
+        /*xds_config_tracker_=*/std::nullopt,
         std::make_unique<JitteredExponentialBackOffStrategy>(
             Config::SubscriptionFactory::RetryInitialDelayMs,
             Config::SubscriptionFactory::RetryMaxDelayMs, context_.api().randomGenerator()),

cilium/health_check_sink.cc

@@ -52,7 +52,11 @@ void HealthCheckEventPipeSink::log(envoy::data::core::v3::HealthCheckEvent event
     return;
   }
   std::string msg;
-  event.SerializeToString(&msg);
+  if (!event.SerializeToString(&msg)) {
+    ENVOY_LOG_MISC(warn, "HealthCheckEventPipeSink: failed to serialize event, skipping it: {}",
+                   event.DebugString());
+    return;
+  }
   uds_client_->log(msg);
 };
 

cilium/l7policy.cc

@@ -5,6 +5,7 @@
 #include <cstddef>
 #include <cstdint>
 #include <memory>
+#include <optional>
 #include <string>
 #include <utility>
 
@@ -31,7 +32,6 @@
 
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
 #include "cilium/accesslog.h"
 #include "cilium/api/accesslog.pb.h"
 #include "cilium/api/l7policy.pb.h"
@@ -98,7 +98,7 @@ void AccessFilter::onDestroy() {}
 
 void AccessFilter::sendLocalError(absl::string_view details) {
   ENVOY_LOG(warn, details);
-  callbacks_->sendLocalReply(Http::Code::InternalServerError, "", nullptr, absl::nullopt,
+  callbacks_->sendLocalReply(Http::Code::InternalServerError, "", nullptr, std::nullopt,
                              StringUtil::replaceAllEmptySpace(details));
 }
 
@@ -112,7 +112,6 @@ void AccessFilter::setDecoderFilterCallbacks(Http::StreamDecoderFilterCallbacks&
     auto log_entry = std::make_unique<AccessLog::Entry>();
     log_entry_ = log_entry.get();
     callbacks_->streamInfo().filterState()->setData(AccessLogKey, std::move(log_entry),
-                                                    StreamInfo::FilterState::StateType::Mutable,
                                                     StreamInfo::FilterState::LifeSpan::Request);
   }
 
@@ -202,7 +201,7 @@ Http::FilterHeadersStatus AccessFilter::decodeHeaders(Http::RequestHeaderMap& he
       if (!allowed) {
         config_->log(*log_entry_, ::cilium::EntryType::Denied);
         callbacks_->sendLocalReply(Http::Code::Forbidden, config_->denied_403_body_, nullptr,
-                                   absl::nullopt, absl::string_view());
+                                   std::nullopt, absl::string_view());
         return Http::FilterHeadersStatus::StopIteration;
       }
 
@@ -272,7 +271,7 @@ Http::FilterHeadersStatus AccessFilter::decodeHeaders(Http::RequestHeaderMap& he
       if (!allowed) {
         config_->log(*log_entry_, ::cilium::EntryType::Denied);
         callbacks_->sendLocalReply(Http::Code::Forbidden, config_->denied_403_body_, nullptr,
-                                   absl::nullopt, absl::string_view());
+                                   std::nullopt, absl::string_view());
         return Http::FilterHeadersStatus::StopIteration;
       }
     }
@@ -288,7 +287,7 @@ Http::FilterHeadersStatus AccessFilter::decodeHeaders(Http::RequestHeaderMap& he
       if (!allowed) {
         config_->log(*log_entry_, ::cilium::EntryType::Denied);
         callbacks_->sendLocalReply(Http::Code::Forbidden, config_->denied_403_body_, nullptr,
-                                   absl::nullopt, absl::string_view());
+                                   std::nullopt, absl::string_view());
         return Http::FilterHeadersStatus::StopIteration;
       }
     }

cilium/l7policy.h

@@ -1,6 +1,7 @@
 #pragma once
 
 #include <memory>
+#include <optional>
 #include <string>
 
 #include "envoy/buffer/buffer.h"
@@ -11,11 +12,11 @@
 #include "envoy/http/metadata_interface.h"
 #include "envoy/stats/scope.h"
 #include "envoy/stats/stats_macros.h" // IWYU pragma: keep
+#include "envoy/upstream/host_description.h"
 
 #include "source/common/common/logger.h"
 
 #include "absl/strings/string_view.h"
-#include "absl/types/optional.h"
 #include "cilium/accesslog.h"
 #include "cilium/api/accesslog.pb.h"
 #include "cilium/api/l7policy.pb.h"
@@ -72,6 +73,9 @@ class AccessFilter : public Http::StreamFilter,
   AccessFilter(ConfigSharedPtr& config) : config_(config) {}
 
   // UpstreamCallbacks
+  // Upstream host authorization is enforced by the Cilium network filter via the network-level
+  // upstream authorization callbacks, so nothing is done here.
+  void onHostSelected(const Upstream::HostDescriptionConstSharedPtr&) override {}
   void onUpstreamConnectionEstablished() override;
 
   // Http::StreamFilterBase
@@ -114,7 +118,7 @@ class AccessFilter : public Http::StreamFilter,
   AccessLog::Entry* log_entry_ = nullptr;
 
   OptRef<Http::RequestHeaderMap> latched_headers_;
-  absl::optional<bool> latched_end_stream_;
+  std::optional<bool> latched_end_stream_;
 };
 
 } // namespace Cilium

cilium/network_filter.cc

@@ -12,7 +12,6 @@
 #include "envoy/registry/registry.h"
 #include "envoy/server/factory_context.h"
 #include "envoy/server/filter_config.h"
-#include "envoy/stream_info/filter_state.h"
 #include "envoy/stream_info/stream_info.h"
 #include "envoy/upstream/host_description.h"
 
@@ -196,12 +195,10 @@ Network::FilterStatus Instance::onNewConnection() {
         Network::UpstreamSubjectAltNames::key());
     if (!have_sni && !have_san) {
       filter_state->setData(Network::UpstreamServerName::key(),
-                            std::make_unique<Network::UpstreamServerName>(sni),
-                            StreamInfo::FilterState::StateType::Mutable);
+                            std::make_unique<Network::UpstreamServerName>(sni));
       filter_state->setData(Network::UpstreamSubjectAltNames::key(),
                             std::make_unique<Network::UpstreamSubjectAltNames>(
-                                std::vector<std::string>{std::string(sni)}),
-                            StreamInfo::FilterState::StateType::Mutable);
+                                std::vector<std::string>{std::string(sni)}));
     }
   }
 

cilium/network_policy.cc

@@ -8,6 +8,7 @@
 #include <algorithm>
 #include <atomic>
 #include <cstdint>
+#include <format>
 #include <functional>
 #include <memory>
 #include <ranges>
@@ -57,6 +58,7 @@
 #include "absl/status/status.h"
 #include "absl/strings/ascii.h"
 #include "absl/strings/match.h"
+#include "absl/strings/str_join.h"
 #include "absl/strings/str_replace.h"
 #include "absl/strings/string_view.h"
 #include "cilium/accesslog.h"
@@ -86,13 +88,18 @@ using RuleVerdict = enum {
 } // namespace Cilium
 } // namespace Envoy
 
-namespace fmt {
+// Envoy routes ENVOY_LOG() through spdlog, which is built with SPDLOG_USE_STD_FORMAT, so this
+// has to be a std::formatter rather than a fmt::formatter.
+namespace std {
 
-template <> struct formatter<Envoy::Cilium::RuleVerdict> {
-  constexpr auto parse(fmt::format_parse_context& ctx) { return ctx.begin(); }
+// NOLINTNEXTLINE(readability-identifier-naming)
+template <> struct formatter<Envoy::Cilium::RuleVerdict, char> {
+  template <class ParseContext> constexpr ParseContext::iterator parse(ParseContext& ctx) {
+    return ctx.begin();
+  }
 
-  template <typename FormatContext>
-  auto format(Envoy::Cilium::RuleVerdict verdict, FormatContext& ctx) const {
+  template <class FmtContext>
+  FmtContext::iterator format(Envoy::Cilium::RuleVerdict verdict, FmtContext& ctx) const {
     absl::string_view name;
     switch (verdict) {
     case Envoy::Cilium::RuleVerdict::None:
@@ -115,7 +122,7 @@ template <> struct formatter<Envoy::Cilium::RuleVerdict> {
   }
 };
 
-} // namespace fmt
+} // namespace std
 
 namespace Envoy {
 namespace Cilium {
@@ -2086,7 +2093,7 @@ void NetworkPolicyMapImpl::removeInitManager() {
           warn,
           "Cilium NetworkPolicyMap parked init manager unexpectedly accumulated targets [{}]{}; "
           "replacing it before re-installing",
-          fmt::join(parked_dump.target_names(), ", "),
+          absl::StrJoin(parked_dump.target_names(), ", "),
           parked_wrong_state
               ? fmt::format(" in state {}", static_cast<int>(parked_init_manager_->state()))
               : "");