From d74bdb216f4c4d8e076b1be1862edf06c7feaf05 Mon Sep 17 00:00:00 2001
From: Otto van der Schaaf <oschaaf@we-amp.com>
Date: Mon, 16 Nov 2020 19:22:18 +0100
Subject: [PATCH 01/17] Clang tidy deflaking / experiment in ci

Signed-off-by: Otto van der Schaaf <oschaaf@we-amp.com>
---
 ci/do_ci.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index 58a7bdab2..934bed475 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -34,8 +34,8 @@ function do_test() {
 }
 
 function do_clang_tidy() {
-    # TODO(#546): deflake clang tidy runs, and remove '|| true' here.
-    ci/run_clang_tidy.sh || true
+    export CLANG_TIDY=clang-tidy-9
+    ci/run_clang_tidy.sh
 }
 
 function do_unit_test_coverage() {

From e227746b024c7eb903138795dcd1835d980d4794 Mon Sep 17 00:00:00 2001
From: Otto van der Schaaf <oschaaf@we-amp.com>
Date: Mon, 16 Nov 2020 20:06:38 +0100
Subject: [PATCH 02/17] Update Envoy to
 588d9344b31e6544869547c4bcd359b3b0f1d4cf

- Fixes to accommodate upstream connection pool changes.
- Fixes to accommodate upstream cluster related changes.

Signed-off-by: Otto van der Schaaf <oschaaf@we-amp.com>
---
 bazel/repositories.bzl                 |  4 ++--
 source/client/benchmark_client_impl.cc |  2 +-
 source/client/benchmark_client_impl.h  |  4 ++--
 source/client/process_impl.cc          | 15 +++++++++++++--
 source/common/request_source_impl.cc   |  3 ++-
 5 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
index 1592a3271..e3c7d62fe 100644
--- a/bazel/repositories.bzl
+++ b/bazel/repositories.bzl
@@ -1,7 +1,7 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-ENVOY_COMMIT = "8e6b176b89240d1b8ce3f3e4a8e276e4a40fcd1e"  # November 10th, 2020
-ENVOY_SHA = "1eba9e904699bbc43c708f90c9e7b1354aed7bafe3784be2c6bfa04919cc67eb"
+ENVOY_COMMIT = "588d9344b31e6544869547c4bcd359b3b0f1d4cf"  # November 16th, 2020
+ENVOY_SHA = "45935eee5714b4d85e2eb264f6e1a922999ff8e5823a49fb0c4d1255494550a8"
 
 HDR_HISTOGRAM_C_VERSION = "0.11.2"  # October 12th, 2020
 HDR_HISTOGRAM_C_SHA = "637f28b5f64de2e268131e4e34e6eef0b91cf5ff99167db447d9b2825eae6bad"
diff --git a/source/client/benchmark_client_impl.cc b/source/client/benchmark_client_impl.cc
index 405bfc134..83008acad 100644
--- a/source/client/benchmark_client_impl.cc
+++ b/source/client/benchmark_client_impl.cc
@@ -75,7 +75,7 @@ Http1PoolImpl::newStream(Envoy::Http::ResponseDecoder& response_decoder,
   }
 
   // Vanilla Envoy pool behavior.
-  return ConnPoolImpl::newStream(response_decoder, callbacks);
+  return HttpConnPoolImplBase::newStream(response_decoder, callbacks);
 }
 
 BenchmarkClientHttpImpl::BenchmarkClientHttpImpl(
diff --git a/source/client/benchmark_client_impl.h b/source/client/benchmark_client_impl.h
index 0304d4460..7254f83ae 100644
--- a/source/client/benchmark_client_impl.h
+++ b/source/client/benchmark_client_impl.h
@@ -75,13 +75,13 @@ struct BenchmarkClientStatistic {
   StatisticPtr origin_latency_statistic;
 };
 
-class Http1PoolImpl : public Envoy::Http::Http1::ProdConnPoolImpl {
+class Http1PoolImpl : public Envoy::Http::FixedHttpConnPoolImpl {
 public:
   enum class ConnectionReuseStrategy {
     MRU,
     LRU,
   };
-  using Envoy::Http::Http1::ProdConnPoolImpl::ProdConnPoolImpl;
+  using Envoy::Http::FixedHttpConnPoolImpl::FixedHttpConnPoolImpl;
   Envoy::Http::ConnectionPool::Cancellable*
   newStream(Envoy::Http::ResponseDecoder& response_decoder,
             Envoy::Http::ConnectionPool::Callbacks& callbacks) override;
diff --git a/source/client/process_impl.cc b/source/client/process_impl.cc
index 08cbaefe5..69a587c92 100644
--- a/source/client/process_impl.cc
+++ b/source/client/process_impl.cc
@@ -71,8 +71,19 @@ class ClusterManagerFactory : public Envoy::Upstream::ProdClusterManagerFactory
       const Envoy::Network::ConnectionSocket::OptionsSharedPtr& options,
       const Envoy::Network::TransportSocketOptionsSharedPtr& transport_socket_options) override {
     if (protocol == Envoy::Http::Protocol::Http11 || protocol == Envoy::Http::Protocol::Http10) {
-      auto* h1_pool = new Http1PoolImpl(dispatcher, api_.randomGenerator(), host, priority, options,
-                                        transport_socket_options);
+      auto* h1_pool = new Http1PoolImpl(
+          host, priority, dispatcher, options, transport_socket_options, api_.randomGenerator(),
+          [](Envoy::Http::HttpConnPoolImplBase* pool) {
+            return std::make_unique<Envoy::Http::Http1::ActiveClient>(*pool);
+          },
+          [](Envoy::Upstream::Host::CreateConnectionData& data,
+             Envoy::Http::HttpConnPoolImplBase* pool) {
+            Envoy::Http::CodecClientPtr codec{new Envoy::Http::CodecClientProd(
+                Envoy::Http::CodecClient::Type::HTTP1, std::move(data.connection_),
+                data.host_description_, pool->dispatcher(), pool->randomGenerator())};
+            return codec;
+          },
+          std::vector<Envoy::Http::Protocol>{protocol});
       h1_pool->setConnectionReuseStrategy(connection_reuse_strategy_);
       h1_pool->setPrefetchConnections(prefetch_connections_);
       return Envoy::Http::ConnectionPool::InstancePtr{h1_pool};
diff --git a/source/common/request_source_impl.cc b/source/common/request_source_impl.cc
index d7a23bf9d..c2ce7d4b5 100644
--- a/source/common/request_source_impl.cc
+++ b/source/common/request_source_impl.cc
@@ -36,7 +36,8 @@ RemoteRequestSourceImpl::RemoteRequestSourceImpl(
 void RemoteRequestSourceImpl::connectToRequestStreamGrpcService() {
   Envoy::TimeSource& time_source = dispatcher_.timeSource();
   const auto clusters = cluster_manager_->clusters();
-  const bool have_cluster = clusters.find(service_cluster_name_) != clusters.end();
+  const bool have_cluster =
+      clusters.active_clusters_.find(service_cluster_name_) != clusters.active_clusters_.end();
   ASSERT(have_cluster);
   const std::chrono::seconds STREAM_SETUP_TIMEOUT = 60s;
   envoy::config::core::v3::GrpcService grpc_service;

From 282ab3abb76926b8d1ea7c6fbd3d8ddc63034e53 Mon Sep 17 00:00:00 2001
From: Otto van der Schaaf <oschaaf@we-amp.com>
Date: Mon, 16 Nov 2020 20:22:39 +0100
Subject: [PATCH 03/17] Mirror some changes in Envoy just to see what happens.

Signed-off-by: Otto van der Schaaf <oschaaf@we-amp.com>
---
 ci/do_ci.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index 934bed475..b1ae367ff 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -34,8 +34,9 @@ function do_test() {
 }
 
 function do_clang_tidy() {
-    export CLANG_TIDY=clang-tidy-9
-    ci/run_clang_tidy.sh
+    ENVOY_STDLIB=libc++
+    BAZEL_BUILD_OPTIONS="${BAZEL_BUILD_OPTIONS[*]}" NUM_CPUS=$NUM_CPUS ci/run_clang_tidy.sh "$@"
+    exit 0
 }
 
 function do_unit_test_coverage() {

From cb2a3e25ffb2dcda56839e1dcb2043fd1f9bcad7 Mon Sep 17 00:00:00 2001
From: Otto van der Schaaf <oschaaf@we-amp.com>
Date: Mon, 16 Nov 2020 21:04:18 +0100
Subject: [PATCH 04/17] Regenerate README.md for the test server

Signed-off-by: Otto van der Schaaf <oschaaf@we-amp.com>
---
 source/server/README.md | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/source/server/README.md b/source/server/README.md
index d98631126..3e9517139 100644
--- a/source/server/README.md
+++ b/source/server/README.md
@@ -34,7 +34,7 @@ static_resources:
           port_value: 10000
       filter_chains:
         - filters:
-            - name: envoy.http_connection_manager
+            - name: envoy.filters.network.http_connection_manager
               config:
                 generate_request_id: false
                 codec_type: auto
@@ -175,8 +175,7 @@ bazel-bin/nighthawk_test_server  [--socket-mode <string>] [--socket-path
 [--hot-restart-version]
 [--restart-epoch <uint32_t>]
 [--log-path <string>]
-[--log-format-prefix-with-location
-<bool>] [--enable-fine-grain-logging]
+[--enable-fine-grain-logging]
 [--log-format-escaped] [--log-format
 <string>] [--component-log-level
 <string>] [-l <string>]
@@ -252,10 +251,6 @@ hot restart epoch #
 --log-path <string>
 Path to logfile
 
---log-format-prefix-with-location <bool>
-Prefix all occurrences of '%v' in log format with with '[%g:%#] '
-('[path/to/file.cc:99] ').
-
 --enable-fine-grain-logging
 Logger mode: enable file level log control(Fancy Logger)or not
 

From 69d275928eec826a3d53b7838dfc1d4cd3234e84 Mon Sep 17 00:00:00 2001
From: Otto van der Schaaf <oschaaf@we-amp.com>
Date: Fri, 4 Dec 2020 00:01:51 +0100
Subject: [PATCH 05/17] Update Envoy to
 73c2d57aa1dfd4dc91b76aec20723b114a1d17ee

WIP. Connection prefetching needs amendment / Envoy seems to support
overlapping functionality now. Our version broke, but perhaps we can
piggy back and make it non-experimental.

Signed-off-by: Otto van der Schaaf <oschaaf@we-amp.com>
---
 .bazelrc                               | 30 ++++++++++++++------------
 bazel/repositories.bzl                 |  4 ++--
 extensions_build_config.bzl            |  3 +++
 nighthawk.code-workspace               |  6 +++++-
 source/client/benchmark_client_impl.cc | 11 ----------
 source/client/process_impl.cc          | 21 ++++++++++++------
 source/client/stream_decoder.cc        |  3 ++-
 source/client/stream_decoder.h         |  3 ++-
 test/benchmark_http_client_test.cc     |  3 +--
 test/stream_decoder_test.cc            |  6 ++++--
 10 files changed, 49 insertions(+), 41 deletions(-)

diff --git a/.bazelrc b/.bazelrc
index 525535336..57944aae0 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -152,9 +152,9 @@ build:coverage --experimental_use_llvm_covmap
 build:coverage --collect_code_coverage
 build:coverage --test_tag_filters=-nocoverage
 build:coverage --instrumentation_filter="//source(?!/common/chromium_url|/extensions/quic_listeners/quiche/platform)[/:],//include[/:]"
-coverage:test-coverage --test_arg="-l trace"
-coverage:fuzz-coverage --config=plain-fuzzer
-coverage:fuzz-coverage --run_under=@envoy//bazel/coverage:fuzz_coverage_wrapper.sh
+build:test-coverage --test_arg="-l trace"
+build:fuzz-coverage --config=plain-fuzzer
+build:fuzz-coverage --run_under=@envoy//bazel/coverage:fuzz_coverage_wrapper.sh
 
 # Remote execution: https://docs.bazel.build/versions/master/remote-execution.html
 build:rbe-toolchain --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
@@ -285,22 +285,18 @@ build:remote-ci --remote_cache=grpcs://remotebuildexecution.googleapis.com
 build:remote-ci --remote_executor=grpcs://remotebuildexecution.googleapis.com
 
 # Fuzz builds
-# -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION is passed in in the bazel build target
-# rules for fuzz tests. Passing it in the CLI will cause dependencies to be build
-# with the macro. Causing issues in RouteMatcherTest.TestRoutes that expect prod
-# behavior from RE2 library.
-build:asan-fuzzer --config=asan
-build:asan-fuzzer --define=FUZZING_ENGINE=libfuzzer
-build:asan-fuzzer --copt=-fsanitize=fuzzer-no-link
-build:asan-fuzzer --copt=-fno-omit-frame-pointer
-# Remove UBSAN halt_on_error to avoid crashing on protobuf errors.
-build:asan-fuzzer --test_env=UBSAN_OPTIONS=print_stacktrace=1
-
 # Fuzzing without ASAN. This is useful for profiling fuzzers without any ASAN artifacts.
 build:plain-fuzzer --define=FUZZING_ENGINE=libfuzzer
 build:plain-fuzzer --define ENVOY_CONFIG_ASAN=1
 build:plain-fuzzer --copt=-fsanitize=fuzzer-no-link
 build:plain-fuzzer --linkopt=-fsanitize=fuzzer-no-link
+build:plain-fuzzer --copt=-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+
+build:asan-fuzzer --config=plain-fuzzer
+build:asan-fuzzer --config=asan
+build:asan-fuzzer --copt=-fno-omit-frame-pointer
+# Remove UBSAN halt_on_error to avoid crashing on protobuf errors.
+build:asan-fuzzer --test_env=UBSAN_OPTIONS=print_stacktrace=1
 
 # Compile database generation config
 build:compdb --build_tag_filters=-nocompdb
@@ -334,6 +330,12 @@ build:clang-cl --define clang_cl=1
 # Override determinism flags (DATE etc) is valid on clang-cl compiler
 build:clang-cl --copt="-Wno-macro-redefined"
 build:clang-cl --copt="-Wno-builtin-macro-redefined"
+# Workaround problematic missing override declarations of mocks
+# TODO: resolve this class of problematic mocks, e.g.
+# ./test/mocks/http/stream.h(16,21): error: 'addCallbacks'
+#     overrides a member function but is not marked 'override'
+#   MOCK_METHOD(void, addCallbacks, (StreamCallbacks & callbacks));
+build:clang-cl --copt="-Wno-inconsistent-missing-override"
 build:clang-cl --action_env=USE_CLANG_CL=1
 
 # Defaults to 'auto' - Off for windows, so override to linux behavior
diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
index e3c7d62fe..8ee37e7ed 100644
--- a/bazel/repositories.bzl
+++ b/bazel/repositories.bzl
@@ -1,7 +1,7 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-ENVOY_COMMIT = "588d9344b31e6544869547c4bcd359b3b0f1d4cf"  # November 16th, 2020
-ENVOY_SHA = "45935eee5714b4d85e2eb264f6e1a922999ff8e5823a49fb0c4d1255494550a8"
+ENVOY_COMMIT = "73c2d57aa1dfd4dc91b76aec20723b114a1d17ee"  # December 3rd, 2020
+ENVOY_SHA = "d7cc2e1ff47858c32c51b3f21338c9c0fb527fc0e810113929dd95aae6627565"
 
 HDR_HISTOGRAM_C_VERSION = "0.11.2"  # October 12th, 2020
 HDR_HISTOGRAM_C_SHA = "637f28b5f64de2e268131e4e34e6eef0b91cf5ff99167db447d9b2825eae6bad"
diff --git a/extensions_build_config.bzl b/extensions_build_config.bzl
index 050877713..b77ba36a4 100644
--- a/extensions_build_config.bzl
+++ b/extensions_build_config.bzl
@@ -8,6 +8,9 @@ EXTENSIONS = {
     "envoy.transport_sockets.raw_buffer": "//source/extensions/transport_sockets/raw_buffer:config",
 }
 
+DISABLED_BY_DEFAULT_EXTENSIONS = {
+}
+
 # These can be changed to ["//visibility:public"], for  downstream builds which
 # need to directly reference Envoy extensions.
 EXTENSION_CONFIG_VISIBILITY = ["//visibility:public"]
diff --git a/nighthawk.code-workspace b/nighthawk.code-workspace
index 876a1499c..dda7f9dda 100644
--- a/nighthawk.code-workspace
+++ b/nighthawk.code-workspace
@@ -4,5 +4,9 @@
 			"path": "."
 		}
 	],
-	"settings": {}
+	"settings": {
+		"files.associations": {
+			"*.tcc": "cpp"
+		}
+	}
 }
\ No newline at end of file
diff --git a/source/client/benchmark_client_impl.cc b/source/client/benchmark_client_impl.cc
index 83008acad..b209a7482 100644
--- a/source/client/benchmark_client_impl.cc
+++ b/source/client/benchmark_client_impl.cc
@@ -54,17 +54,6 @@ BenchmarkClientStatistic::BenchmarkClientStatistic(
 Envoy::Http::ConnectionPool::Cancellable*
 Http1PoolImpl::newStream(Envoy::Http::ResponseDecoder& response_decoder,
                          Envoy::Http::ConnectionPool::Callbacks& callbacks) {
-  // In prefetch mode we try to keep the amount of connections at the configured limit.
-  if (prefetch_connections_) {
-    while (host_->cluster().resourceManager(priority_).connections().canCreate()) {
-      // We cannot rely on ::tryCreateConnection here, because that might decline without
-      // updating connections().canCreate() above. We would risk an infinite loop.
-      Envoy::ConnectionPool::ActiveClientPtr client = instantiateActiveClient();
-      connecting_stream_capacity_ += client->effectiveConcurrentStreamLimit();
-      Envoy::LinkedList::moveIntoList(std::move(client), owningList(client->state_));
-    }
-  }
-
   // By default, Envoy re-uses the most recent free connection. Here we pop from the back
   // of ready_clients_, which will pick the oldest one instead. This makes us cycle through
   // all the available connections.
diff --git a/source/client/process_impl.cc b/source/client/process_impl.cc
index 69a587c92..84a491784 100644
--- a/source/client/process_impl.cc
+++ b/source/client/process_impl.cc
@@ -65,14 +65,16 @@ class ClusterManagerFactory : public Envoy::Upstream::ProdClusterManagerFactory
 public:
   using Envoy::Upstream::ProdClusterManagerFactory::ProdClusterManagerFactory;
 
-  Envoy::Http::ConnectionPool::InstancePtr allocateConnPool(
-      Envoy::Event::Dispatcher& dispatcher, Envoy::Upstream::HostConstSharedPtr host,
-      Envoy::Upstream::ResourcePriority priority, Envoy::Http::Protocol protocol,
-      const Envoy::Network::ConnectionSocket::OptionsSharedPtr& options,
-      const Envoy::Network::TransportSocketOptionsSharedPtr& transport_socket_options) override {
+  Envoy::Http::ConnectionPool::InstancePtr
+  allocateConnPool(Envoy::Event::Dispatcher& dispatcher, Envoy::Upstream::HostConstSharedPtr host,
+                   Envoy::Upstream::ResourcePriority priority, Envoy::Http::Protocol protocol,
+                   const Envoy::Network::ConnectionSocket::OptionsSharedPtr& options,
+                   const Envoy::Network::TransportSocketOptionsSharedPtr& transport_socket_options,
+                   Envoy::Upstream::ClusterConnectivityState& state) override {
     if (protocol == Envoy::Http::Protocol::Http11 || protocol == Envoy::Http::Protocol::Http10) {
       auto* h1_pool = new Http1PoolImpl(
           host, priority, dispatcher, options, transport_socket_options, api_.randomGenerator(),
+          state,
           [](Envoy::Http::HttpConnPoolImplBase* pool) {
             return std::make_unique<Envoy::Http::Http1::ActiveClient>(*pool);
           },
@@ -89,7 +91,7 @@ class ClusterManagerFactory : public Envoy::Upstream::ProdClusterManagerFactory
       return Envoy::Http::ConnectionPool::InstancePtr{h1_pool};
     }
     return Envoy::Upstream::ProdClusterManagerFactory::allocateConnPool(
-        dispatcher, host, priority, protocol, options, transport_socket_options);
+        dispatcher, host, priority, protocol, options, transport_socket_options, state);
   }
 
   void setConnectionReuseStrategy(
@@ -503,7 +505,12 @@ bool ProcessImpl::runInternal(OutputCollector& collector, const std::vector<UriP
         [this]() -> void { init_manager_.initialize(init_watcher_); });
 
     Envoy::Runtime::LoaderSingleton::get().initialize(*cluster_manager_);
-
+    // TODO(oschaaf): enable prefetching, configure it
+    // see
+    // https://github.com/envoyproxy/envoy/blob/8d6299006e2f6adf160825e0d0febb3a0cb57c08/source/common/conn_pool/conn_pool_base.cc#L67
+    // if (options_.prefetch) {
+    // envoy.reloadable_features.allow_prefetch
+    //}
     std::list<std::unique_ptr<Envoy::Stats::Sink>> stats_sinks;
     setupStatsSinks(bootstrap, stats_sinks);
     std::chrono::milliseconds stats_flush_interval = std::chrono::milliseconds(
diff --git a/source/client/stream_decoder.cc b/source/client/stream_decoder.cc
index 4c935e959..21c09d74c 100644
--- a/source/client/stream_decoder.cc
+++ b/source/client/stream_decoder.cc
@@ -103,7 +103,8 @@ void StreamDecoder::onPoolFailure(Envoy::Http::ConnectionPool::PoolFailureReason
 
 void StreamDecoder::onPoolReady(Envoy::Http::RequestEncoder& encoder,
                                 Envoy::Upstream::HostDescriptionConstSharedPtr,
-                                const Envoy::StreamInfo::StreamInfo&) {
+                                const Envoy::StreamInfo::StreamInfo&,
+                                absl::optional<Envoy::Http::Protocol>) {
   // Make sure we hear about stream resets on the encoder.
   encoder.getStream().addCallbacks(*this);
   upstream_timing_.onFirstUpstreamTxByteSent(time_source_); // XXX(oschaaf): is this correct?
diff --git a/source/client/stream_decoder.h b/source/client/stream_decoder.h
index f641d171f..cb0f454dc 100644
--- a/source/client/stream_decoder.h
+++ b/source/client/stream_decoder.h
@@ -84,7 +84,8 @@ class StreamDecoder : public Envoy::Http::ResponseDecoder,
                      Envoy::Upstream::HostDescriptionConstSharedPtr host) override;
   void onPoolReady(Envoy::Http::RequestEncoder& encoder,
                    Envoy::Upstream::HostDescriptionConstSharedPtr host,
-                   const Envoy::StreamInfo::StreamInfo& stream_info) override;
+                   const Envoy::StreamInfo::StreamInfo& stream_info,
+                   absl::optional<Envoy::Http::Protocol> protocol) override;
 
   static Envoy::StreamInfo::ResponseFlag
   streamResetReasonToResponseFlag(Envoy::Http::StreamResetReason reset_reason);
diff --git a/test/benchmark_http_client_test.cc b/test/benchmark_http_client_test.cc
index e92cbaf13..afe062372 100644
--- a/test/benchmark_http_client_test.cc
+++ b/test/benchmark_http_client_test.cc
@@ -69,7 +69,6 @@ class BenchmarkClientHttpTest : public Test {
         (std::make_shared<Envoy::Http::TestRequestHeaderMapImpl>(header_map_param));
     EXPECT_CALL(cluster_manager(), httpConnPoolForCluster(_, _, _, _))
         .WillRepeatedly(Return(&pool_));
-    EXPECT_CALL(cluster_manager(), get(_)).WillRepeatedly(Return(&thread_local_cluster_));
     EXPECT_CALL(thread_local_cluster_, info()).WillRepeatedly(Return(cluster_info_));
 
     auto& tracer = static_cast<Envoy::Tracing::MockHttpTracer&>(*http_tracer_);
@@ -120,7 +119,7 @@ class BenchmarkClientHttpTest : public Test {
           decoders_.push_back(&decoder);
           NiceMock<Envoy::StreamInfo::MockStreamInfo> stream_info;
           callbacks.onPoolReady(stream_encoder_, Envoy::Upstream::HostDescriptionConstSharedPtr{},
-                                stream_info);
+                                stream_info, {} /*absl::optional<Envoy::Http::Protocol> protocol*/);
           return nullptr;
         });
 
diff --git a/test/stream_decoder_test.cc b/test/stream_decoder_test.cc
index cd7630389..ee00310a9 100644
--- a/test/stream_decoder_test.cc
+++ b/test/stream_decoder_test.cc
@@ -118,7 +118,8 @@ TEST_F(StreamDecoderTest, LatencyIsNotMeasured) {
   NiceMock<Envoy::StreamInfo::MockStreamInfo> stream_info;
   EXPECT_CALL(stream_encoder,
               encodeHeaders(Envoy::HeaderMapEqualRef(request_headers_.get()), true));
-  decoder->onPoolReady(stream_encoder, ptr, stream_info);
+  decoder->onPoolReady(stream_encoder, ptr, stream_info,
+                       {} /*absl::optional<Envoy::Http::Protocol> protocol*/);
   decoder->decodeHeaders(std::move(test_header_), true);
   EXPECT_EQ(0, connect_statistic_.count());
   EXPECT_EQ(0, latency_statistic_.count());
@@ -153,7 +154,8 @@ TEST_F(StreamDecoderTest, LatencyIsMeasured) {
   Envoy::Upstream::HostDescriptionConstSharedPtr ptr;
   NiceMock<Envoy::StreamInfo::MockStreamInfo> stream_info;
   EXPECT_CALL(stream_encoder, encodeHeaders(_, true));
-  decoder->onPoolReady(stream_encoder, ptr, stream_info);
+  decoder->onPoolReady(stream_encoder, ptr, stream_info,
+                       {} /*absl::optional<Envoy::Http::Protocol> protocol*/);
   EXPECT_EQ(1, connect_statistic_.count());
   decoder->decodeHeaders(std::move(test_header_), false);
   EXPECT_EQ(0, stream_decoder_export_latency_callbacks_);

From de03d427fe1e609ff6b72d3aeff7ec8302e1a7b7 Mon Sep 17 00:00:00 2001
From: Otto van der Schaaf <oschaaf@we-amp.com>
Date: Mon, 7 Dec 2020 21:00:18 +0100
Subject: [PATCH 06/17] Back out change to source/server/README.md

Signed-off-by: Otto van der Schaaf <oschaaf@we-amp.com>
---
 source/server/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source/server/README.md b/source/server/README.md
index 3e9517139..5687360a7 100644
--- a/source/server/README.md
+++ b/source/server/README.md
@@ -34,7 +34,7 @@ static_resources:
           port_value: 10000
       filter_chains:
         - filters:
-            - name: envoy.filters.network.http_connection_manager
+            - name: envoy.http_connection_manager
               config:
                 generate_request_id: false
                 codec_type: auto

From 22fb2c6f0dcc1e5577f7500cd3e07d99a3edff67 Mon Sep 17 00:00:00 2001
From: Otto van der Schaaf <oschaaf@we-amp.com>
Date: Tue, 8 Dec 2020 10:46:51 +0100
Subject: [PATCH 07/17] Bump Envoy to 8188e232a9e0b15111d30f4724cbc7bf77d3964a

Signed-off-by: Otto van der Schaaf <oschaaf@we-amp.com>
---
 bazel/repositories.bzl                 |  4 ++--
 source/client/BUILD                    |  1 +
 source/client/benchmark_client_impl.cc | 14 ++++++++++++++
 source/client/process_impl.cc          |  5 +++--
 source/client/process_impl.h           |  2 ++
 5 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
index 8ee37e7ed..b3b8b03b3 100644
--- a/bazel/repositories.bzl
+++ b/bazel/repositories.bzl
@@ -1,7 +1,7 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-ENVOY_COMMIT = "73c2d57aa1dfd4dc91b76aec20723b114a1d17ee"  # December 3rd, 2020
-ENVOY_SHA = "d7cc2e1ff47858c32c51b3f21338c9c0fb527fc0e810113929dd95aae6627565"
+ENVOY_COMMIT = "8188e232a9e0b15111d30f4724cbc7bf77d3964a"  # December 8th, 2020
+ENVOY_SHA = "35478b1c133197a7dd1ea1349cd3e8a09ad0169614fa5de1e2336b37ea563c67"
 
 HDR_HISTOGRAM_C_VERSION = "0.11.2"  # October 12th, 2020
 HDR_HISTOGRAM_C_SHA = "637f28b5f64de2e268131e4e34e6eef0b91cf5ff99167db447d9b2825eae6bad"
diff --git a/source/client/BUILD b/source/client/BUILD
index 4fe97d170..affc901d1 100644
--- a/source/client/BUILD
+++ b/source/client/BUILD
@@ -92,6 +92,7 @@ envoy_cc_library(
         "@envoy//source/server/config_validation:admin_lib_with_external_headers",
         "@envoy//include/envoy/http:protocol_interface_with_external_headers",
         "@envoy//source/common/common:statusor_lib_with_external_headers",
+        "@envoy//source/common/router:context_lib_with_external_headers",
     ] + select({
         "//bazel:zipkin_disabled": [],
         "//conditions:default": [
diff --git a/source/client/benchmark_client_impl.cc b/source/client/benchmark_client_impl.cc
index b209a7482..c583080a3 100644
--- a/source/client/benchmark_client_impl.cc
+++ b/source/client/benchmark_client_impl.cc
@@ -54,10 +54,24 @@ BenchmarkClientStatistic::BenchmarkClientStatistic(
 Envoy::Http::ConnectionPool::Cancellable*
 Http1PoolImpl::newStream(Envoy::Http::ResponseDecoder& response_decoder,
                          Envoy::Http::ConnectionPool::Callbacks& callbacks) {
+  // In prefetch mode we try to keep the amount of connections at the configured limit.
+  if (prefetch_connections_) {
+    tryCreateNewConnections();
+    // while (currentUnusedCapacity()) {
+    // We cannot rely on ::tryCreateConnection here, because that might decline without
+    // updating connections().canCreate() above. We would risk an infinite loop.
+
+    // Envoy::ConnectionPool::ActiveClientPtr client = instantiateActiveClient();
+    // connecting_stream_capacity_ += client->effectiveConcurrentStreamLimit();
+    // Envoy::LinkedList::moveIntoList(std::move(client), owningList(client->state_));
+    //}
+  }
+
   // By default, Envoy re-uses the most recent free connection. Here we pop from the back
   // of ready_clients_, which will pick the oldest one instead. This makes us cycle through
   // all the available connections.
   if (!ready_clients_.empty() && connection_reuse_strategy_ == ConnectionReuseStrategy::LRU) {
+    std::cerr << "@2" << std::endl;
     Envoy::Http::HttpAttachContext context({&response_decoder, &callbacks});
     attachStreamToClient(*ready_clients_.back(), context);
     return nullptr;
diff --git a/source/client/process_impl.cc b/source/client/process_impl.cc
index f7f3ff31f..96c7ae919 100644
--- a/source/client/process_impl.cc
+++ b/source/client/process_impl.cc
@@ -128,7 +128,8 @@ ProcessImpl::ProcessImpl(const Options& options, Envoy::Event::TimeSystem& time_
       singleton_manager_(std::make_unique<Envoy::Singleton::ManagerImpl>(api_->threadFactory())),
       access_log_manager_(std::chrono::milliseconds(1000), *api_, *dispatcher_, access_log_lock_,
                           store_root_),
-      init_watcher_("Nighthawk", []() {}), validation_context_(false, false, false) {
+      init_watcher_("Nighthawk", []() {}), validation_context_(false, false, false),
+      router_context_(store_root_.symbolTable()) {
   // Any dispatchers created after the following call will use hr timers.
   setupForHRTimers();
   std::string lower = absl::AsciiStrToLower(
@@ -519,7 +520,7 @@ bool ProcessImpl::runInternal(OutputCollector& collector, const std::vector<UriP
         admin_, Envoy::Runtime::LoaderSingleton::get(), store_root_, tls_,
         dispatcher_->createDnsResolver({}, false), *ssl_context_manager_, *dispatcher_,
         *local_info_, secret_manager_, validation_context_, *api_, http_context_, grpc_context_,
-        access_log_manager_, *singleton_manager_);
+        router_context_, access_log_manager_, *singleton_manager_);
     cluster_manager_factory_->setConnectionReuseStrategy(
         options_.h1ConnectionReuseStrategy() == nighthawk::client::H1ConnectionReuseStrategy::LRU
             ? Http1PoolImpl::ConnectionReuseStrategy::LRU
diff --git a/source/client/process_impl.h b/source/client/process_impl.h
index 03a99a72a..0344262db 100644
--- a/source/client/process_impl.h
+++ b/source/client/process_impl.h
@@ -21,6 +21,7 @@
 #include "external/envoy/source/common/grpc/context_impl.h"
 #include "external/envoy/source/common/http/context_impl.h"
 #include "external/envoy/source/common/protobuf/message_validator_impl.h"
+#include "external/envoy/source/common/router/context_impl.h"
 #include "external/envoy/source/common/secret/secret_manager_impl.h"
 #include "external/envoy/source/common/stats/allocator_impl.h"
 #include "external/envoy/source/common/stats/thread_local_store.h"
@@ -207,6 +208,7 @@ class ProcessImpl : public Process, public Envoy::Logger::Loggable<Envoy::Logger
   Envoy::Thread::MutexBasicLockable workers_lock_;
   bool cancelled_{false};
   std::unique_ptr<FlushWorkerImpl> flush_worker_;
+  Envoy::Router::ContextImpl router_context_;
 };
 
 } // namespace Client

From ec71f337746cd7407e387d3bd59c98ed56b8fa2e Mon Sep 17 00:00:00 2001
From: Otto van der Schaaf <oschaaf@we-amp.com>
Date: Tue, 8 Dec 2020 11:21:21 +0100
Subject: [PATCH 08/17] Fix prefetch/connection re-use

Signed-off-by: Otto van der Schaaf <oschaaf@we-amp.com>
---
 .bazelrc                               |  1 +
 nighthawk.code-workspace               |  6 +-----
 source/client/benchmark_client_impl.cc | 17 +++++++----------
 source/client/process_impl.cc          |  9 +++------
 test/process_test.cc                   |  6 ++++++
 5 files changed, 18 insertions(+), 21 deletions(-)

diff --git a/.bazelrc b/.bazelrc
index 57944aae0..3473656f5 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -306,6 +306,7 @@ build:windows --action_env=TMPDIR
 build:windows --define signal_trace=disabled
 build:windows --define hot_restart=disabled
 build:windows --define tcmalloc=disabled
+build:windows --define wasm=disabled
 build:windows --define manual_stamp=manual_stamp
 build:windows --cxxopt="/std:c++17"
 
diff --git a/nighthawk.code-workspace b/nighthawk.code-workspace
index dda7f9dda..876a1499c 100644
--- a/nighthawk.code-workspace
+++ b/nighthawk.code-workspace
@@ -4,9 +4,5 @@
 			"path": "."
 		}
 	],
-	"settings": {
-		"files.associations": {
-			"*.tcc": "cpp"
-		}
-	}
+	"settings": {}
 }
\ No newline at end of file
diff --git a/source/client/benchmark_client_impl.cc b/source/client/benchmark_client_impl.cc
index c583080a3..28c3ac6e3 100644
--- a/source/client/benchmark_client_impl.cc
+++ b/source/client/benchmark_client_impl.cc
@@ -56,22 +56,19 @@ Http1PoolImpl::newStream(Envoy::Http::ResponseDecoder& response_decoder,
                          Envoy::Http::ConnectionPool::Callbacks& callbacks) {
   // In prefetch mode we try to keep the amount of connections at the configured limit.
   if (prefetch_connections_) {
-    tryCreateNewConnections();
-    // while (currentUnusedCapacity()) {
-    // We cannot rely on ::tryCreateConnection here, because that might decline without
-    // updating connections().canCreate() above. We would risk an infinite loop.
-
-    // Envoy::ConnectionPool::ActiveClientPtr client = instantiateActiveClient();
-    // connecting_stream_capacity_ += client->effectiveConcurrentStreamLimit();
-    // Envoy::LinkedList::moveIntoList(std::move(client), owningList(client->state_));
-    //}
+    while (host_->cluster().resourceManager(priority_).connections().canCreate()) {
+      // We pass in a high prefetch ratio, because we don't want to throttle the prefetched
+      // connection amount like Envoy does out of the box.
+      if (!tryCreateNewConnection(10000.0)) {
+        break;
+      }
+    }
   }
 
   // By default, Envoy re-uses the most recent free connection. Here we pop from the back
   // of ready_clients_, which will pick the oldest one instead. This makes us cycle through
   // all the available connections.
   if (!ready_clients_.empty() && connection_reuse_strategy_ == ConnectionReuseStrategy::LRU) {
-    std::cerr << "@2" << std::endl;
     Envoy::Http::HttpAttachContext context({&response_decoder, &callbacks});
     attachStreamToClient(*ready_clients_.back(), context);
     return nullptr;
diff --git a/source/client/process_impl.cc b/source/client/process_impl.cc
index 96c7ae919..0bca5b763 100644
--- a/source/client/process_impl.cc
+++ b/source/client/process_impl.cc
@@ -301,6 +301,8 @@ void ProcessImpl::allowEnvoyDeprecatedV2Api(envoy::config::bootstrap::v3::Bootst
   proto_true.set_string_value("true");
   (*runtime_layer->mutable_static_layer()
         ->mutable_fields())["envoy.reloadable_features.enable_deprecated_v2_api"] = proto_true;
+  (*runtime_layer->mutable_static_layer()
+        ->mutable_fields())["envoy.reloadable_features.allow_prefetch"] = proto_true;
 }
 
 void ProcessImpl::createBootstrapConfiguration(envoy::config::bootstrap::v3::Bootstrap& bootstrap,
@@ -537,12 +539,7 @@ bool ProcessImpl::runInternal(OutputCollector& collector, const std::vector<UriP
         [this]() -> void { init_manager_.initialize(init_watcher_); });
 
     Envoy::Runtime::LoaderSingleton::get().initialize(*cluster_manager_);
-    // TODO(oschaaf): enable prefetching, configure it
-    // see
-    // https://github.com/envoyproxy/envoy/blob/8d6299006e2f6adf160825e0d0febb3a0cb57c08/source/common/conn_pool/conn_pool_base.cc#L67
-    // if (options_.prefetch) {
-    // envoy.reloadable_features.allow_prefetch
-    //}
+
     std::list<std::unique_ptr<Envoy::Stats::Sink>> stats_sinks;
     setupStatsSinks(bootstrap, stats_sinks);
     std::chrono::milliseconds stats_flush_interval = std::chrono::milliseconds(
diff --git a/test/process_test.cc b/test/process_test.cc
index 077f60ef4..4296ef770 100644
--- a/test/process_test.cc
+++ b/test/process_test.cc
@@ -195,6 +195,12 @@ TEST(RuntimeConfiguration, allowEnvoyDeprecatedV2Api) {
   layers {
     name: "static_layer"
     static_layer {
+      fields {
+        key: "envoy.reloadable_features.allow_prefetch"
+        value {
+          string_value: "true"
+        }
+      }
       fields {
         key: "envoy.reloadable_features.enable_deprecated_v2_api"
         value {

From 937d26aaefe3b363b3cabd03534681de16d5e779 Mon Sep 17 00:00:00 2001
From: Otto van der Schaaf <oschaaf@we-amp.com>
Date: Tue, 8 Dec 2020 11:46:14 +0100
Subject: [PATCH 09/17] Regen README.md

Signed-off-by: Otto van der Schaaf <oschaaf@we-amp.com>
---
 source/server/README.md | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/source/server/README.md b/source/server/README.md
index f1c27000d..48cca55fd 100644
--- a/source/server/README.md
+++ b/source/server/README.md
@@ -165,8 +165,7 @@ USAGE:
 
 bazel-bin/nighthawk_test_server  [--socket-mode <string>] [--socket-path
 <string>] [--disable-extensions
-<string>] [--use-fake-symbol-table
-<bool>] [--cpuset-threads]
+<string>] [--cpuset-threads]
 [--enable-mutex-tracing]
 [--disable-hot-restart] [--mode
 <string>] [--parent-shutdown-time-s
@@ -208,9 +207,6 @@ Path to hot restart socket file
 --disable-extensions <string>
 Comma-separated list of extensions to disable
 
---use-fake-symbol-table <bool>
-Use fake symbol table implementation
-
 --cpuset-threads
 Get the default # of worker threads from cpuset size
 

From 3df8c4ccb8eaa60cd22842bfbcde0a7a53221bb4 Mon Sep 17 00:00:00 2001
From: Otto van der Schaaf <ovanders@redhat.com>
Date: Sun, 14 Feb 2021 12:30:55 +0100
Subject: [PATCH 10/17] clang-tidy: address complaints

Fixes #629

Signed-off-by: Otto van der Schaaf <ovanders@redhat.com>
---
 .../adaptive_load_client_main.cc              | 16 ++---
 .../adaptive_load_client_main_test.cc         | 68 +++++++++----------
 2 files changed, 42 insertions(+), 42 deletions(-)

diff --git a/source/adaptive_load/adaptive_load_client_main.cc b/source/adaptive_load/adaptive_load_client_main.cc
index b28c2ebf5..be23d1051 100644
--- a/source/adaptive_load/adaptive_load_client_main.cc
+++ b/source/adaptive_load/adaptive_load_client_main.cc
@@ -65,29 +65,29 @@ AdaptiveLoadClientMain::AdaptiveLoadClientMain(int argc, const char* const* argv
                                                AdaptiveLoadController& controller,
                                                Envoy::Filesystem::Instance& filesystem)
     : controller_{controller}, filesystem_{filesystem} {
-  TCLAP::CmdLine cmd("Adaptive Load tool that finds the optimal load on the target "
+  TCLAP::CmdLine cmd("Adaptive Load tool that finds the optimal load on the target " // NOLINT
                      "through a series of Nighthawk Service benchmarks.",
                      /*delimiter=*/' ', VersionInfo::version());
 
   TCLAP::ValueArg<std::string> nighthawk_service_address(
-      /*flag_name=*/"", "nighthawk-service-address",
+      /*flag=*/"", "nighthawk-service-address",
       "host:port for Nighthawk Service. To enable TLS, set --use-tls.",
-      /*required=*/false, "localhost:8443", "string", cmd);
+      /*req=*/false, "localhost:8443", "string", cmd);
   TCLAP::SwitchArg use_tls(
-      /*flag_name=*/"", "use-tls",
+      /*flag=*/"", "use-tls",
       "Use TLS for the gRPC connection from this program to the Nighthawk Service. Set environment "
       "variable GRPC_DEFAULT_SSL_ROOTS_FILE_PATH to override the default root certificates.",
       cmd);
   TCLAP::ValueArg<std::string> spec_filename(
-      /*flag_name=*/"", "spec-file",
+      /*flag=*/"", "spec-file",
       "Path to a textproto file describing the adaptive load session "
       "(nighthawk::adaptive_load::AdaptiveLoadSessionSpec).",
-      /*required=*/true, /*default_value=*/"", "string", cmd);
+      /*req=*/true, /*val=*/"", "string", cmd);
   TCLAP::ValueArg<std::string> output_filename(
-      /*flag_name=*/"", "output-file",
+      /*flag=*/"", "output-file",
       "Path to write adaptive load session output textproto "
       "(nighthawk::adaptive_load::AdaptiveLoadSessionOutput).",
-      /*required=*/true, /*default_value=*/"", "string", cmd);
+      /*req=*/true, /*val=*/"", "string", cmd);
 
   Nighthawk::Utility::parseCommand(cmd, argc, argv);
 
diff --git a/test/adaptive_load/adaptive_load_client_main_test.cc b/test/adaptive_load/adaptive_load_client_main_test.cc
index 49fee0928..3ecef25bd 100644
--- a/test/adaptive_load/adaptive_load_client_main_test.cc
+++ b/test/adaptive_load/adaptive_load_client_main_test.cc
@@ -59,19 +59,19 @@ nighthawk::adaptive_load::AdaptiveLoadSessionOutput MakeBasicAdaptiveLoadSession
 }
 
 TEST(AdaptiveLoadClientMainTest, FailsWithNoInputs) {
-  const char* const argv[] = {
+  const std::vector<const char*> argv = {
       "executable-name-here",
   };
   NiceMock<MockAdaptiveLoadController> controller;
   Envoy::Filesystem::Instance& filesystem = Envoy::Filesystem::fileSystemForTest();
 
-  EXPECT_THROW_WITH_REGEX(AdaptiveLoadClientMain(1, argv, controller, filesystem),
+  EXPECT_THROW_WITH_REGEX(AdaptiveLoadClientMain(1, argv.data(), controller, filesystem),
                           Nighthawk::Client::MalformedArgvException, "Required arguments missing");
 }
 
 TEST(AdaptiveLoadClientMainTest, FailsIfSpecFileNotSet) {
   std::string outfile = Nighthawk::TestEnvironment::runfilesPath("unused.textproto");
-  const char* const argv[] = {
+  const std::vector<const char*> argv = {
       "executable-name-here",
       "--output-file",
       outfile.c_str(),
@@ -80,14 +80,14 @@ TEST(AdaptiveLoadClientMainTest, FailsIfSpecFileNotSet) {
   NiceMock<MockAdaptiveLoadController> controller;
   Envoy::Filesystem::Instance& filesystem = Envoy::Filesystem::fileSystemForTest();
 
-  EXPECT_THROW_WITH_REGEX(AdaptiveLoadClientMain(3, argv, controller, filesystem),
+  EXPECT_THROW_WITH_REGEX(AdaptiveLoadClientMain(3, argv.data(), controller, filesystem),
                           Nighthawk::Client::MalformedArgvException,
                           "Required argument missing: spec-file");
 }
 
 TEST(AdaptiveLoadClientMainTest, FailsIfOutputFileNotSet) {
   std::string infile = Nighthawk::TestEnvironment::runfilesPath("unused.textproto");
-  const char* const argv[] = {
+  const std::vector<const char*> argv = {
       "executable-name-here",
       "--spec-file",
       infile.c_str(),
@@ -96,7 +96,7 @@ TEST(AdaptiveLoadClientMainTest, FailsIfOutputFileNotSet) {
   NiceMock<MockAdaptiveLoadController> controller;
   Envoy::Filesystem::Instance& filesystem = Envoy::Filesystem::fileSystemForTest();
 
-  EXPECT_THROW_WITH_REGEX(AdaptiveLoadClientMain main(3, argv, controller, filesystem),
+  EXPECT_THROW_WITH_REGEX(AdaptiveLoadClientMain main(3, argv.data(), controller, filesystem),
                           Nighthawk::Client::MalformedArgvException,
                           "Required argument missing: output-file");
 }
@@ -104,14 +104,14 @@ TEST(AdaptiveLoadClientMainTest, FailsIfOutputFileNotSet) {
 TEST(AdaptiveLoadClientMainTest, FailsWithNonexistentInputFile) {
   std::string infile = Nighthawk::TestEnvironment::runfilesPath("nonexistent.textproto");
   std::string outfile = Nighthawk::TestEnvironment::runfilesPath("unused.textproto");
-  const char* const argv[] = {
+  const std::vector<const char*> argv = {
       "executable-name-here", "--spec-file", infile.c_str(), "--output-file", outfile.c_str(),
   };
 
   NiceMock<MockAdaptiveLoadController> controller;
   Envoy::Filesystem::Instance& filesystem = Envoy::Filesystem::fileSystemForTest();
 
-  AdaptiveLoadClientMain main(5, argv, controller, filesystem);
+  AdaptiveLoadClientMain main(5, argv.data(), controller, filesystem);
   EXPECT_THROW_WITH_REGEX(main.Run(), Nighthawk::NighthawkException,
                           "Failed to read spec textproto file");
 }
@@ -120,14 +120,14 @@ TEST(AdaptiveLoadClientMainTest, FailsWithUnparseableInputFile) {
   std::string infile = Nighthawk::TestEnvironment::runfilesPath(
       "test/adaptive_load/test_data/invalid_session_spec.textproto");
   std::string outfile = Nighthawk::TestEnvironment::runfilesPath("unused.textproto");
-  const char* const argv[] = {
+  const std::vector<const char*> argv = {
       "executable-name-here", "--spec-file", infile.c_str(), "--output-file", outfile.c_str(),
   };
 
   NiceMock<MockAdaptiveLoadController> controller;
   Envoy::Filesystem::Instance& filesystem = Envoy::Filesystem::fileSystemForTest();
 
-  AdaptiveLoadClientMain main(5, argv, controller, filesystem);
+  AdaptiveLoadClientMain main(5, argv.data(), controller, filesystem);
   EXPECT_THROW_WITH_REGEX(main.Run(), Nighthawk::NighthawkException, "Unable to parse file");
 }
 
@@ -136,7 +136,7 @@ TEST(AdaptiveLoadClientMainTest, ExitsProcessWithNonzeroStatusOnAdaptiveControll
       "test/adaptive_load/test_data/valid_session_spec.textproto");
   std::string outfile = Nighthawk::TestEnvironment::runfilesPath(
       "test/adaptive_load/test_data/nonexistent-dir/out.textproto");
-  const char* const argv[] = {
+  const std::vector<const char*> argv = {
       "executable-name-here", "--spec-file", infile.c_str(), "--output-file", outfile.c_str(),
   };
 
@@ -145,7 +145,7 @@ TEST(AdaptiveLoadClientMainTest, ExitsProcessWithNonzeroStatusOnAdaptiveControll
       .WillOnce(Return(absl::DataLossError("error message")));
   Envoy::Filesystem::Instance& filesystem = Envoy::Filesystem::fileSystemForTest();
 
-  AdaptiveLoadClientMain main(5, argv, controller, filesystem);
+  AdaptiveLoadClientMain main(5, argv.data(), controller, filesystem);
   EXPECT_EQ(main.Run(), 1);
 }
 
@@ -154,7 +154,7 @@ TEST(AdaptiveLoadClientMainTest, FailsIfCreatingOutputFileFails) {
       "test/adaptive_load/test_data/valid_session_spec.textproto");
   std::string outfile = Nighthawk::TestEnvironment::runfilesPath(
       "test/adaptive_load/test_data/nonexistent-dir/out.textproto");
-  const char* const argv[] = {
+  const std::vector<const char*> argv = {
       "executable-name-here", "--spec-file", infile.c_str(), "--output-file", outfile.c_str(),
   };
 
@@ -163,12 +163,12 @@ TEST(AdaptiveLoadClientMainTest, FailsIfCreatingOutputFileFails) {
       .WillOnce(Return(MakeBasicAdaptiveLoadSessionOutput()));
   Envoy::Filesystem::Instance& filesystem = Envoy::Filesystem::fileSystemForTest();
 
-  AdaptiveLoadClientMain main(5, argv, controller, filesystem);
+  AdaptiveLoadClientMain main(5, argv.data(), controller, filesystem);
   EXPECT_THROW_WITH_REGEX(main.Run(), Nighthawk::NighthawkException, "Unable to open output file");
 }
 
 TEST(AdaptiveLoadClientMainTest, FailsIfOpeningOutputFileFails) {
-  const char* const argv[] = {
+  const std::vector<const char*> argv = {
       "executable-name-here", "--spec-file",         "in-dummy.textproto",
       "--output-file",        "out-dummy.textproto",
   };
@@ -184,7 +184,7 @@ TEST(AdaptiveLoadClientMainTest, FailsIfOpeningOutputFileFails) {
           std::string("test/adaptive_load/test_data/valid_session_spec.textproto")));
   EXPECT_CALL(filesystem, fileReadToEnd(_)).WillOnce(Return(infile_contents));
 
-  NiceMock<Envoy::Filesystem::MockFile>* mock_file = new NiceMock<Envoy::Filesystem::MockFile>;
+  auto* mock_file = new NiceMock<Envoy::Filesystem::MockFile>;
   EXPECT_CALL(filesystem, createFile(_))
       .WillOnce(Return(ByMove(std::unique_ptr<NiceMock<Envoy::Filesystem::MockFile>>(mock_file))));
 
@@ -193,12 +193,12 @@ TEST(AdaptiveLoadClientMainTest, FailsIfOpeningOutputFileFails) {
           false, Envoy::Api::IoErrorPtr(new UnknownIoError(),
                                         [](Envoy::Api::IoError* err) { delete err; })))));
 
-  AdaptiveLoadClientMain main(5, argv, controller, filesystem);
+  AdaptiveLoadClientMain main(5, argv.data(), controller, filesystem);
   EXPECT_THROW_WITH_REGEX(main.Run(), Nighthawk::NighthawkException, "Unable to open output file");
 }
 
 TEST(AdaptiveLoadClientMainTest, FailsIfWritingOutputFileFails) {
-  const char* const argv[] = {
+  const std::vector<const char*> argv = {
       "executable-name-here", "--spec-file",         "in-dummy.textproto",
       "--output-file",        "out-dummy.textproto",
   };
@@ -214,7 +214,7 @@ TEST(AdaptiveLoadClientMainTest, FailsIfWritingOutputFileFails) {
           std::string("test/adaptive_load/test_data/valid_session_spec.textproto")));
   EXPECT_CALL(filesystem, fileReadToEnd(_)).WillOnce(Return(infile_contents));
 
-  NiceMock<Envoy::Filesystem::MockFile>* mock_file = new NiceMock<Envoy::Filesystem::MockFile>;
+  auto* mock_file = new NiceMock<Envoy::Filesystem::MockFile>;
   EXPECT_CALL(filesystem, createFile(_))
       .WillOnce(Return(ByMove(std::unique_ptr<NiceMock<Envoy::Filesystem::MockFile>>(mock_file))));
 
@@ -225,13 +225,13 @@ TEST(AdaptiveLoadClientMainTest, FailsIfWritingOutputFileFails) {
       .WillOnce(Return(ByMove(Envoy::Api::IoCallSizeResult(
           -1, Envoy::Api::IoErrorPtr(new UnknownIoError(),
                                      [](Envoy::Api::IoError* err) { delete err; })))));
-  AdaptiveLoadClientMain main(5, argv, controller, filesystem);
+  AdaptiveLoadClientMain main(5, argv.data(), controller, filesystem);
   EXPECT_THROW_WITH_REGEX(main.Run(), Nighthawk::NighthawkException,
                           "Unable to write to output file");
 }
 
 TEST(AdaptiveLoadClientMainTest, FailsIfClosingOutputFileFails) {
-  const char* const argv[] = {
+  const std::vector<const char*> argv = {
       "executable-name-here", "--spec-file",         "in-dummy.textproto",
       "--output-file",        "out-dummy.textproto",
   };
@@ -247,7 +247,7 @@ TEST(AdaptiveLoadClientMainTest, FailsIfClosingOutputFileFails) {
           std::string("test/adaptive_load/test_data/valid_session_spec.textproto")));
   EXPECT_CALL(filesystem, fileReadToEnd(_)).WillOnce(Return(infile_contents));
 
-  NiceMock<Envoy::Filesystem::MockFile>* mock_file = new NiceMock<Envoy::Filesystem::MockFile>;
+  auto* mock_file = new NiceMock<Envoy::Filesystem::MockFile>;
   EXPECT_CALL(filesystem, createFile(_))
       .WillOnce(Return(ByMove(std::unique_ptr<NiceMock<Envoy::Filesystem::MockFile>>(mock_file))));
 
@@ -265,12 +265,12 @@ TEST(AdaptiveLoadClientMainTest, FailsIfClosingOutputFileFails) {
           false, Envoy::Api::IoErrorPtr(new UnknownIoError(),
                                         [](Envoy::Api::IoError* err) { delete err; })))));
 
-  AdaptiveLoadClientMain main(5, argv, controller, filesystem);
+  AdaptiveLoadClientMain main(5, argv.data(), controller, filesystem);
   EXPECT_THROW_WITH_REGEX(main.Run(), Nighthawk::NighthawkException, "Unable to close output file");
 }
 
 TEST(AdaptiveLoadClientMainTest, WritesOutputProtoToFile) {
-  const char* const argv[] = {
+  const std::vector<const char*> argv = {
       "executable-name-here", "--spec-file",         "in-dummy.textproto",
       "--output-file",        "out-dummy.textproto",
   };
@@ -287,7 +287,7 @@ TEST(AdaptiveLoadClientMainTest, WritesOutputProtoToFile) {
   EXPECT_CALL(filesystem, fileReadToEnd(_)).WillOnce(Return(infile_contents));
 
   std::string actual_outfile_contents;
-  NiceMock<Envoy::Filesystem::MockFile>* mock_file = new NiceMock<Envoy::Filesystem::MockFile>;
+  auto* mock_file = new NiceMock<Envoy::Filesystem::MockFile>;
   EXPECT_CALL(filesystem, createFile(_))
       .WillOnce(Return(ByMove(std::unique_ptr<NiceMock<Envoy::Filesystem::MockFile>>(mock_file))));
 
@@ -307,7 +307,7 @@ TEST(AdaptiveLoadClientMainTest, WritesOutputProtoToFile) {
       .WillOnce(Return(ByMove(Envoy::Api::IoCallBoolResult(
           true, Envoy::Api::IoErrorPtr(nullptr, [](Envoy::Api::IoError*) {})))));
 
-  AdaptiveLoadClientMain main(5, argv, controller, filesystem);
+  AdaptiveLoadClientMain main(5, argv.data(), controller, filesystem);
   main.Run();
 
   std::string golden_output =
@@ -317,46 +317,46 @@ TEST(AdaptiveLoadClientMainTest, WritesOutputProtoToFile) {
 }
 
 TEST(AdaptiveLoadClientMainTest, DefaultsToInsecureConnection) {
-  const char* const argv[] = {
+  const std::vector<const char*> argv = {
       "executable-name-here", "--spec-file", "a", "--output-file", "b",
   };
 
   NiceMock<MockAdaptiveLoadController> controller;
   Envoy::Filesystem::Instance& filesystem = Envoy::Filesystem::fileSystemForTest();
 
-  AdaptiveLoadClientMain main(5, argv, controller, filesystem);
+  AdaptiveLoadClientMain main(5, argv.data(), controller, filesystem);
 
   EXPECT_THAT(main.DescribeInputs(), HasSubstr("insecure"));
 }
 
 TEST(AdaptiveLoadClientMainTest, UsesTlsConnectionWhenSpecified) {
-  const char* const argv[] = {
+  const std::vector<const char*> argv = {
       "executable-name-here", "--use-tls", "--spec-file", "a", "--output-file", "b",
   };
 
   NiceMock<MockAdaptiveLoadController> controller;
   Envoy::Filesystem::Instance& filesystem = Envoy::Filesystem::fileSystemForTest();
 
-  AdaptiveLoadClientMain main(6, argv, controller, filesystem);
+  AdaptiveLoadClientMain main(6, argv.data(), controller, filesystem);
 
   EXPECT_THAT(main.DescribeInputs(), HasSubstr("TLS"));
 }
 
 TEST(AdaptiveLoadClientMainTest, UsesDefaultNighthawkServiceAddress) {
-  const char* const argv[] = {
+  const std::vector<const char*> argv = {
       "executable-name-here", "--spec-file", "a", "--output-file", "b",
   };
 
   NiceMock<MockAdaptiveLoadController> controller;
   Envoy::Filesystem::Instance& filesystem = Envoy::Filesystem::fileSystemForTest();
 
-  AdaptiveLoadClientMain main(5, argv, controller, filesystem);
+  AdaptiveLoadClientMain main(5, argv.data(), controller, filesystem);
 
   EXPECT_THAT(main.DescribeInputs(), HasSubstr("localhost:8443"));
 }
 
 TEST(AdaptiveLoadClientMainTest, UsesCustomNighthawkServiceAddress) {
-  const char* const argv[] = {
+  const std::vector<const char*> argv = {
       "executable-name-here",
       "--nighthawk-service-address",
       "1.2.3.4:5678",
@@ -369,7 +369,7 @@ TEST(AdaptiveLoadClientMainTest, UsesCustomNighthawkServiceAddress) {
   NiceMock<MockAdaptiveLoadController> controller;
   Envoy::Filesystem::Instance& filesystem = Envoy::Filesystem::fileSystemForTest();
 
-  AdaptiveLoadClientMain main(7, argv, controller, filesystem);
+  AdaptiveLoadClientMain main(7, argv.data(), controller, filesystem);
 
   EXPECT_THAT(main.DescribeInputs(), HasSubstr("1.2.3.4:5678"));
 }

From c3bf404b52ce1978928dd51a021a4407c935b8c9 Mon Sep 17 00:00:00 2001
From: Otto van der Schaaf <ovanders@redhat.com>
Date: Sun, 14 Feb 2021 13:43:24 +0100
Subject: [PATCH 11/17] attempt to sync with envoy

Signed-off-by: Otto van der Schaaf <ovanders@redhat.com>
---
 ci/do_ci.sh          |  4 ++--
 ci/run_clang_tidy.sh | 13 ++++++++-----
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index b1ae367ff..41ac2dfa8 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -34,8 +34,8 @@ function do_test() {
 }
 
 function do_clang_tidy() {
-    ENVOY_STDLIB=libc++
-    BAZEL_BUILD_OPTIONS="${BAZEL_BUILD_OPTIONS[*]}" NUM_CPUS=$NUM_CPUS ci/run_clang_tidy.sh "$@"
+    # clang-tidy will warn on standard library issues with libc++    
+    BAZEL_BUILD_OPTIONS="--config=clang ${BAZEL_BUILD_OPTIONS[*]}" NUM_CPUS=$NUM_CPUS ci/run_clang_tidy.sh "$@"
     exit 0
 }
 
diff --git a/ci/run_clang_tidy.sh b/ci/run_clang_tidy.sh
index 040b5a46b..6412bedc1 100755
--- a/ci/run_clang_tidy.sh
+++ b/ci/run_clang_tidy.sh
@@ -31,7 +31,7 @@ echo "Generating compilation database..."
 # Do not run clang-tidy against win32 impl
 # TODO(scw00): We should run clang-tidy against win32 impl once we have clang-cl support for Windows
 function exclude_win32_impl() {
-  grep -v source/common/filesystem/win32/ | grep -v source/common/common/win32 | grep -v source/exe/win32 | grep -v source/common/api/win32
+  grep -v source/common/filesystem/win32/ | grep -v source/common/common/win32 | grep -v source/exe/win32 | grep -v source/common/api/win32 | grep -v source/common/event/win32
 }
 
 # Do not run clang-tidy against macOS impl
@@ -81,8 +81,13 @@ function exclude_wasm_test_data() {
   grep -v wasm/test_data
 }
 
+# Exclude files which are part of the Wasm examples
+function exclude_wasm_examples() {
+  grep -v examples/wasm
+}
+
 function filter_excludes() {
-  exclude_check_format_testdata | exclude_headersplit_testdata | exclude_chromium_url | exclude_win32_impl | exclude_macos_impl | exclude_third_party | exclude_wasm_emscripten | exclude_wasm_sdk | exclude_wasm_host | exclude_wasm_test_data
+  exclude_check_format_testdata | exclude_headersplit_testdata | exclude_chromium_url | exclude_win32_impl | exclude_macos_impl | exclude_third_party | exclude_wasm_emscripten | exclude_wasm_sdk | exclude_wasm_host | exclude_wasm_test_data | exclude_wasm_examples
 }
 
 function run_clang_tidy() {
@@ -108,9 +113,7 @@ elif [[ "${RUN_FULL_CLANG_TIDY}" == 1 ]]; then
   run_clang_tidy
 else
   if [[ -z "${DIFF_REF}" ]]; then
-    if [[ "${BUILD_REASON}" == "PullRequest" ]]; then
-      DIFF_REF="remotes/origin/${SYSTEM_PULLREQUEST_TARGETBRANCH}"
-    elif [[ "${BUILD_REASON}" == *CI ]]; then
+    if [[ "${BUILD_REASON}" == *CI ]]; then
       DIFF_REF="HEAD^"
     else
       DIFF_REF=$("${ENVOY_SRCDIR}"/tools/git/last_github_commit.sh)

From 58b6d1674477ac410423a0f9b8f96be50ce35b14 Mon Sep 17 00:00:00 2001
From: Otto van der Schaaf <ovanders@redhat.com>
Date: Sun, 14 Feb 2021 18:13:24 +0100
Subject: [PATCH 12/17] test

Signed-off-by: Otto van der Schaaf <ovanders@redhat.com>
---
 ci/run_clang_tidy.sh | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/ci/run_clang_tidy.sh b/ci/run_clang_tidy.sh
index 6412bedc1..f7ac4a8d8 100755
--- a/ci/run_clang_tidy.sh
+++ b/ci/run_clang_tidy.sh
@@ -91,6 +91,7 @@ function filter_excludes() {
 }
 
 function run_clang_tidy() {
+  set -x
   python3 "${LLVM_PREFIX}/share/clang/run-clang-tidy.py" \
     -clang-tidy-binary="${CLANG_TIDY}" \
     -clang-apply-replacements-binary="${CLANG_APPLY_REPLACEMENTS}" \
@@ -124,7 +125,9 @@ else
 fi
 
 if [[ -s "${FIX_YAML}" ]]; then
-  echo "clang-tidy check failed, potentially fixed by clang-apply-replacements:"
-  cat "${FIX_YAML}"
-  exit 1
+  if grep -q '[^[:space:]]' "${FIX_YAML}"; then
+    echo "clang-tidy check failed, potentially fixed by clang-apply-replacements:"
+    cat "${FIX_YAML}"
+    exit 1
+  fi
 fi

From b86a6ce83efb4498f069c77e396d492f833b6356 Mon Sep 17 00:00:00 2001
From: Otto van der Schaaf <ovanders@redhat.com>
Date: Sun, 14 Feb 2021 22:05:19 +0100
Subject: [PATCH 13/17] test

Signed-off-by: Otto van der Schaaf <ovanders@redhat.com>
---
 ci/do_ci.sh          |  5 ++++-
 ci/run_clang_tidy.sh | 12 ++++++------
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index 41ac2dfa8..96bd30b5b 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -34,8 +34,11 @@ function do_test() {
 }
 
 function do_clang_tidy() {
+    set -x
     # clang-tidy will warn on standard library issues with libc++    
-    BAZEL_BUILD_OPTIONS="--config=clang ${BAZEL_BUILD_OPTIONS[*]}" NUM_CPUS=$NUM_CPUS ci/run_clang_tidy.sh "$@"
+    ENVOY_STDLIB="libstdc++"
+    BAZEL_BUILD_OPTIONS=("--config=clang" "${BAZEL_BUILD_OPTIONS[@]}")
+    BAZEL_BUILD_OPTIONS="${BAZEL_BUILD_OPTIONS[*]}" NUM_CPUS=$NUM_CPUS ci/run_clang_tidy.sh "$@"
     exit 0
 }
 
diff --git a/ci/run_clang_tidy.sh b/ci/run_clang_tidy.sh
index f7ac4a8d8..e1c9e1a9b 100755
--- a/ci/run_clang_tidy.sh
+++ b/ci/run_clang_tidy.sh
@@ -91,7 +91,6 @@ function filter_excludes() {
 }
 
 function run_clang_tidy() {
-  set -x
   python3 "${LLVM_PREFIX}/share/clang/run-clang-tidy.py" \
     -clang-tidy-binary="${CLANG_TIDY}" \
     -clang-apply-replacements-binary="${CLANG_APPLY_REPLACEMENTS}" \
@@ -125,9 +124,10 @@ else
 fi
 
 if [[ -s "${FIX_YAML}" ]]; then
-  if grep -q '[^[:space:]]' "${FIX_YAML}"; then
-    echo "clang-tidy check failed, potentially fixed by clang-apply-replacements:"
-    cat "${FIX_YAML}"
-    exit 1
-  fi
+  echo "clang-tidy check failed, potentially fixed by clang-apply-replacements:"
+  cat "${FIX_YAML}"
+  exit 1
+else
+  echo "clang-tidy check passes"
+  exit 0
 fi

From ba20a40d765de7ad3a02e2fc7d4b321e20479081 Mon Sep 17 00:00:00 2001
From: Otto van der Schaaf <ovanders@redhat.com>
Date: Sun, 14 Feb 2021 22:29:02 +0100
Subject: [PATCH 14/17] test

Signed-off-by: Otto van der Schaaf <ovanders@redhat.com>
---
 ci/do_ci.sh          | 5 +----
 ci/run_clang_tidy.sh | 3 ---
 2 files changed, 1 insertion(+), 7 deletions(-)

diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index 96bd30b5b..267fb1c11 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -34,12 +34,9 @@ function do_test() {
 }
 
 function do_clang_tidy() {
-    set -x
     # clang-tidy will warn on standard library issues with libc++    
-    ENVOY_STDLIB="libstdc++"
     BAZEL_BUILD_OPTIONS=("--config=clang" "${BAZEL_BUILD_OPTIONS[@]}")
-    BAZEL_BUILD_OPTIONS="${BAZEL_BUILD_OPTIONS[*]}" NUM_CPUS=$NUM_CPUS ci/run_clang_tidy.sh "$@"
-    exit 0
+    BAZEL_BUILD_OPTIONS="${BAZEL_BUILD_OPTIONS[*]}" NUM_CPUS=$NUM_CPUS ci/run_clang_tidy.sh
 }
 
 function do_unit_test_coverage() {
diff --git a/ci/run_clang_tidy.sh b/ci/run_clang_tidy.sh
index e1c9e1a9b..6412bedc1 100755
--- a/ci/run_clang_tidy.sh
+++ b/ci/run_clang_tidy.sh
@@ -127,7 +127,4 @@ if [[ -s "${FIX_YAML}" ]]; then
   echo "clang-tidy check failed, potentially fixed by clang-apply-replacements:"
   cat "${FIX_YAML}"
   exit 1
-else
-  echo "clang-tidy check passes"
-  exit 0
 fi

From 8551a3c6382dfe7bba7f2961b72229738fc8a084 Mon Sep 17 00:00:00 2001
From: Otto van der Schaaf <ovanders@redhat.com>
Date: Sun, 14 Feb 2021 23:47:48 +0100
Subject: [PATCH 15/17] Couple of fixes

- Update the docker image sha for the circleci configuration
- Update run_envoy_docker.sh
- Update MAINTAINERS.md to mention that we should keep these
  things in sync when updating the Envoy dependency.

Signed-off-by: Otto van der Schaaf <ovanders@redhat.com>
---
 .circleci/config.yml   |   4 +-
 MAINTAINERS.md         |   6 ++-
 ci/run_envoy_docker.sh | 103 +++++++++++++++++++++++++++++++++++------
 3 files changed, 95 insertions(+), 18 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 2ade7ad40..53aa67c25 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -1,6 +1,6 @@
 references:
-  envoy-build-image: &envoy-build-image # November 10th, 2020
-    envoyproxy/envoy-build-ubuntu:19a268cfe3d12625380e7c61d2467c8779b58b56
+  envoy-build-image: &envoy-build-image # Februari 14th, 2021
+    envoyproxy/envoy-build-ubuntu:c8fa4235714003ba0896287ee2f91cae06e0e407
 version: 2
 jobs:
   build:
diff --git a/MAINTAINERS.md b/MAINTAINERS.md
index 1ba6beb17..b4f8a5c40 100644
--- a/MAINTAINERS.md
+++ b/MAINTAINERS.md
@@ -56,15 +56,19 @@ important maintenance task. When performing the update, follow this procedure:
   ```
   INFO: SHA256 (https://github.com/envoyproxy/envoy/archive/9753819331d1547c4b8294546a6461a3777958f5.tar.gz) = f4d26c7e78c0a478d959ea8bc877f260d4658a8b44e294e3a400f20ad44d41a3
   ```
-  1. Update `ENVOY_SHA` in [bazel/repositories.bzl](bazel/repositories.bzl) to
+1. Update `ENVOY_SHA` in [bazel/repositories.bzl](bazel/repositories.bzl) to
      this value.
 1. Sync (copy) [.bazelrc](.bazelrc) from
    [Envoy's version](https://github.com/envoyproxy/envoy/blob/main/.bazelrc) to
    update our build configurations. Be sure to retain our local modifications,
    all lines that are unique to Nighthawk are marked with comment `# unique`.
+1. In the updated [.bazelrc](.bazelrc) search for `experimental_docker_image`.
+   Copy the SHA and update `envoy-build-image:sha` over at the top of [.circleci/config.yml](.circleci/config.yml).
 1. Sync (copy) [.bazelversion](.bazelversion) from
    [Envoy's version](https://github.com/envoyproxy/envoy/blob/main/.bazelversion)
    to ensure we are using the same build system version.
+1. Sync (copy) [ci/run_envoy_docker.sh](ci/run_envoy_docker.sh) from
+   [Envoy's version](https://github.com/envoyproxy/envoy/blob/main/ci/run_envoy_docker.sh).
 1. Run `ci/do_ci.sh test`. Sometimes the dependency update comes with changes
    that break our build. Include any changes required to Nighthawk to fix that
    in the same PR.
diff --git a/ci/run_envoy_docker.sh b/ci/run_envoy_docker.sh
index c6b91fae5..0ba9c5ec9 100755
--- a/ci/run_envoy_docker.sh
+++ b/ci/run_envoy_docker.sh
@@ -2,26 +2,99 @@
 
 set -e
 
-. ci/envoy_build_sha.sh
+# shellcheck source=ci/envoy_build_sha.sh
+. "$(dirname "$0")"/envoy_build_sha.sh
 
-# We run as root and later drop permissions. This is required to setup the USER
-# in useradd below, which is need for correct Python execution in the Docker
-# environment.
-USER=root
-USER_GROUP=root
+function is_windows() {
+  [[ "$(uname -s)" == *NT* ]]
+}
+
+read -ra ENVOY_DOCKER_OPTIONS <<< "${ENVOY_DOCKER_OPTIONS:-}"
+
+# TODO(phlax): uppercase these env vars
+export HTTP_PROXY="${http_proxy:-}"
+export HTTPS_PROXY="${https_proxy:-}"
+export NO_PROXY="${no_proxy:-}"
+
+if is_windows; then
+  [[ -z "${IMAGE_NAME}" ]] && IMAGE_NAME="envoyproxy/envoy-build-windows2019"
+  # TODO(sunjayBhatia): Currently ENVOY_DOCKER_OPTIONS is ignored on Windows because
+  # CI sets it to a Linux-specific value. Undo this once https://github.com/envoyproxy/envoy/issues/13272
+  # is resolved.
+  ENVOY_DOCKER_OPTIONS=()
+  DEFAULT_ENVOY_DOCKER_BUILD_DIR=C:/Windows/Temp/envoy-docker-build
+  BUILD_DIR_MOUNT_DEST=C:/build
+  # Replace MSYS style drive letter (/c/) with driver letter designation (C:/)
+  SOURCE_DIR=$(echo "${PWD}" | sed -E "s#/([a-zA-Z])/#\1:/#")
+  SOURCE_DIR_MOUNT_DEST=C:/source
+  START_COMMAND=("bash" "-c" "cd source && $*")
+else
+  [[ -z "${IMAGE_NAME}" ]] && IMAGE_NAME="envoyproxy/envoy-build-ubuntu"
+  # We run as root and later drop permissions. This is required to setup the USER
+  # in useradd below, which is need for correct Python execution in the Docker
+  # environment.
+  ENVOY_DOCKER_OPTIONS+=(-u root:root)
+  ENVOY_DOCKER_OPTIONS+=(-v /var/run/docker.sock:/var/run/docker.sock)
+  ENVOY_DOCKER_OPTIONS+=(--cap-add SYS_PTRACE --cap-add NET_RAW --cap-add NET_ADMIN)
+  DEFAULT_ENVOY_DOCKER_BUILD_DIR=/tmp/envoy-docker-build
+  BUILD_DIR_MOUNT_DEST=/build
+  SOURCE_DIR="${PWD}"
+  SOURCE_DIR_MOUNT_DEST=/source
+  START_COMMAND=("/bin/bash" "-lc" "groupadd --gid $(id -g) -f envoygroup \
+    && useradd -o --uid $(id -u) --gid $(id -g) --no-create-home --home-dir /build envoybuild \
+    && usermod -a -G pcap envoybuild \
+    && chown envoybuild:envoygroup /build \
+    && sudo -EHs -u envoybuild bash -c 'cd /source && $*'")
+fi
 
-[[ -z "${IMAGE_NAME}" ]] && IMAGE_NAME="envoyproxy/envoy-build-ubuntu"
 # The IMAGE_ID defaults to the CI hash but can be set to an arbitrary image ID (found with 'docker
 # images').
 [[ -z "${IMAGE_ID}" ]] && IMAGE_ID="${ENVOY_BUILD_SHA}"
-[[ -z "${ENVOY_DOCKER_BUILD_DIR}" ]] && ENVOY_DOCKER_BUILD_DIR=/tmp/envoy-docker-build
+[[ -z "${ENVOY_DOCKER_BUILD_DIR}" ]] && ENVOY_DOCKER_BUILD_DIR="${DEFAULT_ENVOY_DOCKER_BUILD_DIR}"
+# Replace backslash with forward slash for Windows style paths
+ENVOY_DOCKER_BUILD_DIR="${ENVOY_DOCKER_BUILD_DIR//\\//}"
+mkdir -p "${ENVOY_DOCKER_BUILD_DIR}"
 
-[[ -f .git ]] && [[ ! -d .git ]] && GIT_VOLUME_OPTION="-v $(git rev-parse --git-common-dir):$(git rev-parse --git-common-dir)"
+[[ -t 1 ]] && ENVOY_DOCKER_OPTIONS+=("-it")
+[[ -f .git ]] && [[ ! -d .git ]] && ENVOY_DOCKER_OPTIONS+=(-v "$(git rev-parse --git-common-dir):$(git rev-parse --git-common-dir)")
+[[ -n "${SSH_AUTH_SOCK}" ]] && ENVOY_DOCKER_OPTIONS+=(-v "${SSH_AUTH_SOCK}:${SSH_AUTH_SOCK}" -e SSH_AUTH_SOCK)
+
+export ENVOY_BUILD_IMAGE="${IMAGE_NAME}:${IMAGE_ID}"
 
-mkdir -p "${ENVOY_DOCKER_BUILD_DIR}"
 # Since we specify an explicit hash, docker-run will pull from the remote repo if missing.
-docker run --rm -t -i -e HTTP_PROXY=${http_proxy} -e HTTPS_PROXY=${https_proxy} \
-  -u "${USER}":"${USER_GROUP}" -v "${ENVOY_DOCKER_BUILD_DIR}":/build ${GIT_VOLUME_OPTION} \
-  -v "$PWD":/source -e NUM_CPUS --cap-add SYS_PTRACE --cap-add NET_RAW --cap-add NET_ADMIN "${IMAGE_NAME}":"${IMAGE_ID}" \
-  /bin/bash -lc "groupadd --gid $(id -g) -f envoygroup && useradd -o --uid $(id -u) --gid $(id -g) --no-create-home \
-  --home-dir /source envoybuild && usermod -a -G pcap envoybuild && su envoybuild -c \"cd source && $*\""
+docker run --rm \
+       "${ENVOY_DOCKER_OPTIONS[@]}" \
+       -v "${ENVOY_DOCKER_BUILD_DIR}":"${BUILD_DIR_MOUNT_DEST}" \
+       -v "${SOURCE_DIR}":"${SOURCE_DIR_MOUNT_DEST}" \
+       -e AZP_BRANCH \
+       -e HTTP_PROXY \
+       -e HTTPS_PROXY \
+       -e NO_PROXY \
+       -e BAZEL_STARTUP_OPTIONS \
+       -e BAZEL_BUILD_EXTRA_OPTIONS \
+       -e BAZEL_EXTRA_TEST_OPTIONS \
+       -e BAZEL_REMOTE_CACHE \
+       -e ENVOY_STDLIB \
+       -e BUILD_REASON \
+       -e BAZEL_REMOTE_INSTANCE \
+       -e GCP_SERVICE_ACCOUNT_KEY \
+       -e NUM_CPUS \
+       -e ENVOY_RBE \
+       -e ENVOY_BUILD_IMAGE \
+       -e ENVOY_SRCDIR \
+       -e ENVOY_BUILD_TARGET \
+       -e SYSTEM_PULLREQUEST_PULLREQUESTNUMBER \
+       -e GCS_ARTIFACT_BUCKET \
+       -e GITHUB_TOKEN \
+       -e BUILD_SOURCEBRANCHNAME \
+       -e BAZELISK_BASE_URL \
+       -e ENVOY_BUILD_ARCH \
+       -e SLACK_TOKEN \
+       -e BUILD_URI\
+       -e REPO_URI \
+       -e SYSTEM_STAGEDISPLAYNAME \
+       -e SYSTEM_JOBDISPLAYNAME \
+       -e SYSTEM_PULLREQUEST_PULLREQUESTID \
+       "${ENVOY_BUILD_IMAGE}" \
+       "${START_COMMAND[@]}"
+      
\ No newline at end of file

From e122081c5a830b6937c43f7d8192d6736995085e Mon Sep 17 00:00:00 2001
From: Otto van der Schaaf <ovanders@redhat.com>
Date: Wed, 17 Feb 2021 13:24:24 +0100
Subject: [PATCH 16/17] Fix typo

Signed-off-by: Otto van der Schaaf <ovanders@redhat.com>
---
 .circleci/config.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 53aa67c25..f82b4cc15 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -1,5 +1,5 @@
 references:
-  envoy-build-image: &envoy-build-image # Februari 14th, 2021
+  envoy-build-image: &envoy-build-image # February 14th, 2021
     envoyproxy/envoy-build-ubuntu:c8fa4235714003ba0896287ee2f91cae06e0e407
 version: 2
 jobs:

From 358643a1cc1feb89830e2c43f9948f6770ee6928 Mon Sep 17 00:00:00 2001
From: Otto van der Schaaf <ovanders@redhat.com>
Date: Wed, 17 Feb 2021 22:01:14 +0100
Subject: [PATCH 17/17] clang-tidy: Reduce parallelism.

Signed-off-by: Otto van der Schaaf <ovanders@redhat.com>
---
 ci/do_ci.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index f2411ac5c..0fe4ac51a 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -36,7 +36,7 @@ function do_test() {
 function do_clang_tidy() {
     # clang-tidy will warn on standard library issues with libc++    
     BAZEL_BUILD_OPTIONS=("--config=clang" "${BAZEL_BUILD_OPTIONS[@]}")
-    BAZEL_BUILD_OPTIONS="${BAZEL_BUILD_OPTIONS[*]}" NUM_CPUS=$NUM_CPUS ci/run_clang_tidy.sh
+    BAZEL_BUILD_OPTIONS="${BAZEL_BUILD_OPTIONS[*]}" NUM_CPUS=4 ci/run_clang_tidy.sh
 }
 
 function do_unit_test_coverage() {