Merge branch 'main' into mpuncel/sds-hc-sequence

* main: (687 commits)
  ci: set build debug information from env (envoyproxy#17635)
  ext_authz: do the authentication even the direct response is set (envoyproxy#17546)
  upstream: various cleanups in connection pool code (envoyproxy#17644)
  owners: promote Dmitry to maintainer (envoyproxy#17642)
  quiche: client session supports creating bidi stream (envoyproxy#17543)
  Update HTTP/2 METADATA documentation. (envoyproxy#17637)
  ext_proc: Check validity of the :status header (envoyproxy#17596)
  test: add ASSERT indicating that gRPC stream has not been started yet (envoyproxy#17614)
  ensure that the inline cookie header will be folded correctly  (envoyproxy#17560)
  cluster_manager: Make ClusterEntry a class instead of a struct (envoyproxy#17616)
  owners: make Raúl a Thrift senior extension maintainer (envoyproxy#17641)
  quiche: update QUICHE dependency (envoyproxy#17618)
  Delete mock for removed RouteEntry::perFilterConfig() method (envoyproxy#17623)
  REPO_LAYOUT.md: fix outdated link (envoyproxy#17626)
  hcm: forbid use of detection extensions with use_remote_addr/xff_num_trusted_hops (envoyproxy#17558)
  thrift proxy: add request shadowing support (envoyproxy#17544)
  ext_proc: Ensure that timer is always cancelled (envoyproxy#17569)
  Proposal: Add CachePolicy interface to allow for custom cache behavior (envoyproxy#17362)
  proto: fix verify to point at v3 only (envoyproxy#17622)
  api: move generic matcher proto to its own package (envoyproxy#17096)
  ...

.azure-pipelines/bazel.yml

@@ -1,85 +1,81 @@
 parameters:
-  - name: ciTarget
-    displayName: "CI target"
-    type: string
-    default: bazel.release
-  - name: artifactSuffix
-    displayName: "Suffix of artifact"
-    type: string
-    default: ""
-  - name: rbe
-    displayName: "Enable RBE"
-    type: boolean
-    default: true
-  - name: managedAgent
-    type: boolean
-    default: true
-  - name: bazelBuildExtraOptions
-    type: string
-    default: "--flaky_test_attempts=2"
+- name: ciTarget
+  displayName: "CI target"
+  type: string
+  default: bazel.release
+- name: artifactSuffix
+  displayName: "Suffix of artifact"
+  type: string
+  default: ""
+- name: rbe
+  displayName: "Enable RBE"
+  type: boolean
+  default: true
+- name: managedAgent
+  type: boolean
+  default: true
+- name: bazelBuildExtraOptions
+  type: string
+  default: "--flaky_test_attempts=2"
 
 steps:
-  - task: Cache@2
-    inputs:
-      key: '"${{ parameters.ciTarget }}" | ./WORKSPACE | **/*.bzl'
-      path: $(Build.StagingDirectory)/repository_cache
-    continueOnError: true
+- task: Cache@2
+  inputs:
+    key: '"${{ parameters.ciTarget }}" | ./WORKSPACE | **/*.bzl'
+    path: $(Build.StagingDirectory)/repository_cache
+  continueOnError: true
 
-  - bash: .azure-pipelines/cleanup.sh
-    displayName: "Removing tools from agent"
-    condition: ${{ parameters.managedAgent }}
+- bash: |
+    echo "disk space at beginning of build:"
+    df -h
+  displayName: "Check disk space at beginning"
 
-  - bash: |
-      echo "disk space at beginning of build:"
-      df -h
-    displayName: "Check disk space at beginning"
+- bash: |
+    sudo mkdir -p /etc/docker
+    echo '{
+      "ipv6": true,
+      "fixed-cidr-v6": "2001:db8:1::/64"
+    }' | sudo tee /etc/docker/daemon.json
+    sudo service docker restart
+  displayName: "Enable IPv6"
+  condition: ${{ parameters.managedAgent }}
 
-  - bash: |
-      sudo mkdir -p /etc/docker
-      echo '{
-        "ipv6": true,
-        "fixed-cidr-v6": "2001:db8:1::/64"
-      }' | sudo tee /etc/docker/daemon.json
-      sudo service docker restart
-    displayName: "Enable IPv6"
-    condition: ${{ parameters.managedAgent }}
+- script: ci/run_envoy_docker.sh 'ci/do_ci.sh ${{ parameters.ciTarget }}'
+  workingDirectory: $(Build.SourcesDirectory)
+  env:
+    ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+    SLACK_TOKEN: $(SLACK_TOKEN)
+    REPO_URI: $(Build.Repository.Uri)
+    BUILD_URI: $(Build.BuildUri)
+    ${{ if parameters.rbe }}:
+      ENVOY_RBE: "1"
+      BAZEL_BUILD_EXTRA_OPTIONS: "--config=remote-ci --jobs=$(RbeJobs) ${{ parameters.bazelBuildExtraOptions }}"
+      BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+      BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+      GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+    ${{ if eq(parameters.rbe, false) }}:
+      BAZEL_BUILD_EXTRA_OPTIONS: "${{ parameters.bazelBuildExtraOptions }}"
+      BAZEL_REMOTE_CACHE: $(LocalBuildCache)
 
-  - script: ci/run_envoy_docker.sh 'ci/do_ci.sh ${{ parameters.ciTarget }}'
-    workingDirectory: $(Build.SourcesDirectory)
-    env:
-      ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
-      SLACK_TOKEN: $(SLACK_TOKEN)
-      REPO_URI: $(Build.Repository.Uri)
-      BUILD_URI: $(Build.BuildUri)
-      ${{ if parameters.rbe }}:
-        ENVOY_RBE: "1"
-        BAZEL_BUILD_EXTRA_OPTIONS: "--config=remote-ci --jobs=$(RbeJobs) ${{ parameters.bazelBuildExtraOptions }}"
-        BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
-        BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
-        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
-      ${{ if eq(parameters.rbe, false) }}:
-        BAZEL_BUILD_EXTRA_OPTIONS: "${{ parameters.bazelBuildExtraOptions }}"
-        BAZEL_REMOTE_CACHE: $(LocalBuildCache)
+  displayName: "Run CI script"
 
-    displayName: "Run CI script"
+- bash: |
+    echo "disk space at end of build:"
+    df -h
+    # Cleanup offending files with unicode names
+    rm -rf $(Build.StagingDirectory)/tmp/*/*/external/go_sdk/test/fixedbugs
+  displayName: "Check disk space at end"
+  condition: always()
 
-  - bash: |
-      echo "disk space at end of build:"
-      df -h
-      # Cleanup offending files with unicode names
-      rm -rf $(Build.StagingDirectory)/tmp/*/*/external/go_sdk/test/fixedbugs
-    displayName: "Check disk space at end"
-    condition: always()
+- task: PublishTestResults@2
+  inputs:
+    testResultsFiles: "**/bazel-out/**/testlogs/**/test.xml"
+    testRunTitle: "${{ parameters.ciTarget }}"
+    searchFolder: $(Build.StagingDirectory)/tmp
+  condition: always()
 
-  - task: PublishTestResults@2
-    inputs:
-      testResultsFiles: "**/bazel-out/**/testlogs/**/test.xml"
-      testRunTitle: "${{ parameters.ciTarget }}"
-      searchFolder: $(Build.StagingDirectory)/tmp
-    condition: always()
-
-  - task: PublishBuildArtifacts@1
-    inputs:
-      pathtoPublish: "$(Build.StagingDirectory)/envoy"
-      artifactName: ${{ parameters.ciTarget }}${{ parameters.artifactSuffix }}
-    condition: always()
+- task: PublishBuildArtifacts@1
+  inputs:
+    pathtoPublish: "$(Build.StagingDirectory)/envoy"
+    artifactName: ${{ parameters.ciTarget }}${{ parameters.artifactSuffix }}
+  condition: always()

.azure-pipelines/cve_scan.yml

@@ -15,8 +15,8 @@ schedules:
 pool:
   vmImage: "ubuntu-18.04"
 steps:
-  - script: ci/run_envoy_docker.sh 'ci/do_ci.sh cve_scan'
-    workingDirectory: $(Build.SourcesDirectory)
-    env:
-      ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
-    displayName: "Scan for CVEs in dependencies"
+- script: ci/run_envoy_docker.sh 'ci/do_ci.sh cve_scan'
+  workingDirectory: $(Build.SourcesDirectory)
+  env:
+    ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+  displayName: "Scan for CVEs in dependencies"