Detachable slot

.azure-pipelines/linux.yml

@@ -1,4 +1,25 @@
 jobs:
+- job: format
+  dependsOn: [] # this removes the implicit dependency on previous stage and causes this to run in parallel.
+  pool:
+    vmImage: 'Ubuntu 16.04'
+  steps:
+  - script: |
+      ci/run_envoy_docker.sh '
+        set -e
+        ci/do_ci.sh check_format
+        ci/do_ci.sh check_repositories
+        ci/do_ci.sh check_spelling
+        ci/do_ci.sh check_spelling_pedantic
+      '
+    workingDirectory: $(Build.SourcesDirectory)
+    env:
+      ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+      BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+      BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+      GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+    displayName: "Run check format scripts"
+
 - job: bazel
   strategy:
     matrix:
@@ -10,8 +31,10 @@ jobs:
         CI_TARGET: 'bazel.gcc'
       compile_time_options:
         CI_TARGET: 'bazel.compile_time_options'
-      fuzz:
-        CI_TARGET: 'bazel.fuzz'
+      # This will run on every commit/PR and will make sure the corpus generated by the fuzzers as well as fixed crashes
+      # (on Fuzzit) is not crashing envoy. This will help find bugs BEFORE merging and not after.
+      fuzzit:
+        CI_TARGET: 'bazel.fuzzit_regression'
   dependsOn: [] # this removes the implicit dependency on previous stage and causes this to run in parallel.
   timeoutInMinutes: 360
   pool:
@@ -60,3 +83,39 @@ jobs:
       pathtoPublish: "$(Build.StagingDirectory)/envoy"
       artifactName: $(CI_TARGET)
     condition: always()
+
+- job: fuzzit_fuzzing
+  dependsOn: [] # this removes the implicit dependency on previous stage and causes this to run in parallel.
+  timeoutInMinutes: 360
+  # this runs on every push to master / merge to master. this will build the fuzzers and will update them on Fuzzit where
+  # they will run asynchronously. Essentially this will make sure that the latest master version is always being fuzzed
+  # continuously.
+  condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/master'), ne(variables['Build.Reason'], 'PullRequest'))
+  pool:
+    vmImage: 'Ubuntu 16.04'
+  steps:
+    - bash: |
+        echo "disk space at beginning of build:"
+        df -h
+      displayName: "Check disk space at beginning"
+
+    - bash: |
+        sudo mkdir -p /etc/docker
+        echo '{
+          "ipv6": true,
+          "fixed-cidr-v6": "2001:db8:1::/64"
+        }' | sudo tee /etc/docker/daemon.json
+        sudo service docker restart
+      displayName: "Enable IPv6"
+
+    - script: ci/run_envoy_docker.sh 'ci/do_ci.sh bazel.fuzzit_fuzzing'
+      workingDirectory: $(Build.SourcesDirectory)
+      env:
+        FUZZIT_API_KEY: $(FuzzitApiKey)
+        ENVOY_DOCKER_BUILD_DIR: $(Build.StagingDirectory)
+        ENVOY_RBE: "true"
+        BAZEL_BUILD_EXTRA_OPTIONS: "--config=remote-ci --config=remote --jobs=100 --curses=no"
+        BAZEL_REMOTE_CACHE: grpcs://remotebuildexecution.googleapis.com
+        BAZEL_REMOTE_INSTANCE: projects/envoy-ci/instances/default_instance
+        GCP_SERVICE_ACCOUNT_KEY: $(GcpServiceAccountKey)
+      displayName: "Fuzzit Regression"

.circleci/config.yml

@@ -67,6 +67,7 @@ jobs:
        - store_artifacts:
            path: /build/envoy/generated
            destination: /
+
    filter_example_mirror:
      executor: ubuntu-build
      steps:
@@ -114,17 +115,6 @@ jobs:
              ci/do_circle_ci.sh bazel.clang_tidy
            no_output_timeout: 60m
 
-   format:
-     executor: ubuntu-build
-     resource_class: small
-     steps:
-       - run: rm -rf /home/circleci/project/.git # CircleCI git caching is likely broken
-       - checkout
-       - run: pip install -r tools/requirements.txt
-       - run: ci/do_circle_ci.sh check_format
-       - run: ci/do_circle_ci.sh check_repositories
-       - run: ci/do_circle_ci.sh check_spelling
-       - run: ci/do_circle_ci.sh check_spelling_pedantic
    build_image:
      docker:
        - image: google/cloud-sdk
@@ -165,7 +155,6 @@ workflows:
       - coverage
       - coverage_publish:
           requires: [coverage]
-      - format
       - clang_tidy
       - build_image
       - docs:

README.md

@@ -11,6 +11,7 @@ involved and how Envoy plays a role, read the CNCF
 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1266/badge)](https://bestpractices.coreinfrastructure.org/projects/1266)
 [![Azure Pipelines](https://dev.azure.com/cncf/envoy/_apis/build/status/envoyproxy.envoy.mac?branchName=master)](https://dev.azure.com/cncf/envoy/_build/latest?definitionId=2&branchName=master)
 [![CircleCI](https://circleci.com/gh/envoyproxy/envoy/tree/master.svg?style=shield)](https://circleci.com/gh/envoyproxy/envoy/tree/master)
+[![fuzzit](https://app.fuzzit.dev/badge?org_id=envoyproxy)](https://app.fuzzit.dev/orgs/envoyproxy/dashboard)
 [![Jenkins](https://img.shields.io/jenkins/s/https/powerci.osuosl.org/job/build-envoy-master/badge/icon/.svg?label=ppc64le%20build)](http://powerci.osuosl.org/job/build-envoy-master/)
 
 ## Documentation

api/STYLE.md

@@ -47,9 +47,8 @@ In addition, the following conventions should be followed:
 
 * Protos for configs and services that are not implemented immediately in
   Envoy, or are under active design and development should be versioned
-  "v2alpha". If several iterations of the alpha API are expected, then versions
-  "v2alpha1", "v2alpha2", and so on are preferred. Alpha-versioned protos are
-  considered experimental and are not required to preserve compatibility.
+  "vNalpha". See the [stable API versioning
+  policy](https://github.com/envoyproxy/envoy/issues/6271).
 
 * Every proto directory should have a `README.md` describing its content. See
   for example [envoy.service](envoy/service/README.md).

api/bazel/api_build_system.bzl

@@ -9,7 +9,7 @@ _CC_SUFFIX = "_cc"
 _CC_GRPC_SUFFIX = "_cc_grpc"
 _CC_EXPORT_SUFFIX = "_export_cc"
 _GO_PROTO_SUFFIX = "_go_proto"
-_GO_IMPORTPATH_PREFIX = "github.com/envoyproxy/data-plane-api/api/"
+_GO_IMPORTPATH_PREFIX = "github.com/envoyproxy/go-control-plane/"
 
 _COMMON_PROTO_DEPS = [
     "@com_google_protobuf//:any_proto",
@@ -105,6 +105,7 @@ def api_proto_library(
         visibility = ["//visibility:private"],
         srcs = [],
         deps = [],
+        tags = [],
         external_proto_deps = [],
         external_cc_proto_deps = [],
         external_py_proto_deps = [],
@@ -116,6 +117,7 @@ def api_proto_library(
         name = name,
         srcs = srcs,
         deps = deps + external_proto_deps + _COMMON_PROTO_DEPS,
+        tags = tags,
         visibility = visibility,
     )
     cc_proto_library_name = _Suffix(name, _CC_SUFFIX)

api/bazel/repositories.bzl

@@ -54,7 +54,7 @@ api_proto_library(
 
 go_proto_library(
     name = "client_model_go_proto",
-    importpath = "client_model",
+    importpath = "github.com/prometheus/client_model/go",
     proto = ":client_model",
     visibility = ["//visibility:public"],
 )

api/envoy/admin/v2alpha/certs.proto

@@ -19,7 +19,6 @@ message Certificates {
 }
 
 message Certificate {
-
   // Details of CA certificate.
   repeated CertificateDetails ca_cert = 1;
 
@@ -48,10 +47,10 @@ message CertificateDetails {
 }
 
 message SubjectAlternateName {
-
   // Subject Alternate Name.
   oneof name {
     string dns = 1;
+
     string uri = 2;
   }
 }

api/envoy/admin/v2alpha/clusters.proto

@@ -45,7 +45,7 @@ message ClusterStatus {
   // 2. The threshold is computed to be < 0 because a negative value implies that there was no
   //    threshold for that interval.
   // 3. Outlier detection is not enabled for this cluster.
-  envoy.type.Percent success_rate_ejection_threshold = 3;
+  type.Percent success_rate_ejection_threshold = 3;
 
   // Mapping from host address to the host's current status.
   repeated HostStatus host_statuses = 4;
@@ -65,13 +65,13 @@ message ClusterStatus {
   // 2. The threshold is computed to be < 0 because a negative value implies that there was no
   //    threshold for that interval.
   // 3. Outlier detection is not enabled for this cluster.
-  envoy.type.Percent local_origin_success_rate_ejection_threshold = 5;
+  type.Percent local_origin_success_rate_ejection_threshold = 5;
 }
 
 // Current state of a particular host.
 message HostStatus {
   // Address of this host.
-  envoy.api.v2.core.Address address = 1;
+  api.v2.core.Address address = 1;
 
   // List of stats specific to this host.
   repeated SimpleMetric stats = 2;
@@ -92,7 +92,7 @@ message HostStatus {
   // Note: the message will not be present if host did not have enough request volume to calculate
   // success rate or the cluster did not have enough hosts to run through success rate outlier
   // ejection.
-  envoy.type.Percent success_rate = 4;
+  type.Percent success_rate = 4;
 
   // The host's weight. If not configured, the value defaults to 1.
   uint32 weight = 5;
@@ -115,7 +115,7 @@ message HostStatus {
   // Note: the message will not be present if host did not have enough request volume to calculate
   // success rate or the cluster did not have enough hosts to run through success rate outlier
   // ejection.
-  envoy.type.Percent local_origin_success_rate = 8;
+  type.Percent local_origin_success_rate = 8;
 }
 
 // Health status for a host.
@@ -139,5 +139,5 @@ message HostHealthStatus {
   // Health status as reported by EDS. Note: only HEALTHY and UNHEALTHY are currently supported
   // here.
   // TODO(mrice32): pipe through remaining EDS health status possibilities.
-  envoy.api.v2.core.HealthStatus eds_health_status = 3;
+  api.v2.core.HealthStatus eds_health_status = 3;
 }

api/envoy/admin/v2alpha/config_dump.proto

@@ -39,7 +39,7 @@ message ConfigDump {
 // the static portions of an Envoy configuration by reusing the output as the bootstrap
 // configuration for another Envoy.
 message BootstrapConfigDump {
-  envoy.config.bootstrap.v2.Bootstrap bootstrap = 1;
+  config.bootstrap.v2.Bootstrap bootstrap = 1;
 
   // The timestamp when the BootstrapConfig was last updated.
   google.protobuf.Timestamp last_updated = 2;
@@ -49,15 +49,10 @@ message BootstrapConfigDump {
 // configuration information can be used to recreate an Envoy configuration by populating all
 // listeners as static listeners or by returning them in a LDS response.
 message ListenersConfigDump {
-  // This is the :ref:`version_info <envoy_api_field_DiscoveryResponse.version_info>` in the
-  // last processed LDS discovery response. If there are only static bootstrap listeners, this field
-  // will be "".
-  string version_info = 1;
-
   // Describes a statically loaded listener.
   message StaticListener {
     // The listener config.
-    envoy.api.v2.Listener listener = 1;
+    api.v2.Listener listener = 1;
 
     // The timestamp when the Listener was last updated.
     google.protobuf.Timestamp last_updated = 2;
@@ -72,12 +67,17 @@ message ListenersConfigDump {
     string version_info = 1;
 
     // The listener config.
-    envoy.api.v2.Listener listener = 2;
+    api.v2.Listener listener = 2;
 
     // The timestamp when the Listener was last updated.
     google.protobuf.Timestamp last_updated = 3;
   }
 
+  // This is the :ref:`version_info <envoy_api_field_DiscoveryResponse.version_info>` in the
+  // last processed LDS discovery response. If there are only static bootstrap listeners, this field
+  // will be "".
+  string version_info = 1;
+
   // The statically loaded listener configs.
   repeated StaticListener static_listeners = 2;
 
@@ -102,15 +102,10 @@ message ListenersConfigDump {
 // configuration information can be used to recreate an Envoy configuration by populating all
 // clusters as static clusters or by returning them in a CDS response.
 message ClustersConfigDump {
-  // This is the :ref:`version_info <envoy_api_field_DiscoveryResponse.version_info>` in the
-  // last processed CDS discovery response. If there are only static bootstrap clusters, this field
-  // will be "".
-  string version_info = 1;
-
   // Describes a statically loaded cluster.
   message StaticCluster {
     // The cluster config.
-    envoy.api.v2.Cluster cluster = 1;
+    api.v2.Cluster cluster = 1;
 
     // The timestamp when the Cluster was last updated.
     google.protobuf.Timestamp last_updated = 2;
@@ -125,12 +120,17 @@ message ClustersConfigDump {
     string version_info = 1;
 
     // The cluster config.
-    envoy.api.v2.Cluster cluster = 2;
+    api.v2.Cluster cluster = 2;
 
     // The timestamp when the Cluster was last updated.
     google.protobuf.Timestamp last_updated = 3;
   }
 
+  // This is the :ref:`version_info <envoy_api_field_DiscoveryResponse.version_info>` in the
+  // last processed CDS discovery response. If there are only static bootstrap clusters, this field
+  // will be "".
+  string version_info = 1;
+
   // The statically loaded cluster configs.
   repeated StaticCluster static_clusters = 2;
 
@@ -153,7 +153,7 @@ message ClustersConfigDump {
 message RoutesConfigDump {
   message StaticRouteConfig {
     // The route config.
-    envoy.api.v2.RouteConfiguration route_config = 1;
+    api.v2.RouteConfiguration route_config = 1;
 
     // The timestamp when the Route was last updated.
     google.protobuf.Timestamp last_updated = 2;
@@ -166,7 +166,7 @@ message RoutesConfigDump {
     string version_info = 1;
 
     // The route config.
-    envoy.api.v2.RouteConfiguration route_config = 2;
+    api.v2.RouteConfiguration route_config = 2;
 
     // The timestamp when the Route was last updated.
     google.protobuf.Timestamp last_updated = 3;
@@ -189,7 +189,7 @@ message ScopedRoutesConfigDump {
     string name = 1;
 
     // The scoped route configurations.
-    repeated envoy.api.v2.ScopedRouteConfiguration scoped_route_configs = 2;
+    repeated api.v2.ScopedRouteConfiguration scoped_route_configs = 2;
 
     // The timestamp when the scoped route config set was last updated.
     google.protobuf.Timestamp last_updated = 3;
@@ -205,7 +205,7 @@ message ScopedRoutesConfigDump {
     string version_info = 2;
 
     // The scoped route configurations.
-    repeated envoy.api.v2.ScopedRouteConfiguration scoped_route_configs = 3;
+    repeated api.v2.ScopedRouteConfiguration scoped_route_configs = 3;
 
     // The timestamp when the scoped route config set was last updated.
     google.protobuf.Timestamp last_updated = 4;
@@ -234,7 +234,7 @@ message SecretsConfigDump {
     // The actual secret information.
     // Security sensitive information is redacted (replaced with "[redacted]") for
     // private keys and passwords in TLS certificates.
-    envoy.api.v2.auth.Secret secret = 4;
+    api.v2.auth.Secret secret = 4;
   }
 
   // StaticSecret specifies statically loaded secret in bootstrap.
@@ -248,7 +248,7 @@ message SecretsConfigDump {
     // The actual secret information.
     // Security sensitive information is redacted (replaced with "[redacted]") for
     // private keys and passwords in TLS certificates.
-    envoy.api.v2.auth.Secret secret = 3;
+    api.v2.auth.Secret secret = 3;
   }
 
   // The statically loaded secrets.

api/envoy/admin/v2alpha/listeners.proto

@@ -24,5 +24,5 @@ message ListenerStatus {
 
   // The actual local address that the listener is listening on. If a listener was configured
   // to listen on port 0, then this address has the port that was allocated by the OS.
-  envoy.api.v2.core.Address local_address = 2;
+  api.v2.core.Address local_address = 2;
 }

api/envoy/admin/v2alpha/memory.proto

@@ -12,7 +12,6 @@ option java_package = "io.envoyproxy.envoy.admin.v2alpha";
 // values extracted from an internal TCMalloc instance. For more information, see the section of the
 // docs entitled ["Generic Tcmalloc Status"](https://gperftools.github.io/gperftools/tcmalloc.html).
 message Memory {
-
   // The number of bytes allocated by the heap for Envoy. This is an alias for
   // `generic.current_allocated_bytes`.
   uint64 allocated = 1;

api/envoy/admin/v2alpha/mutex_stats.proto

@@ -16,7 +16,6 @@ option java_package = "io.envoyproxy.envoy.admin.v2alpha";
 // correspond to core clock frequency. For more information, see the `CycleClock`
 // [docs](https://github.com/abseil/abseil-cpp/blob/master/absl/base/internal/cycleclock.h).
 message MutexStats {
-
   // The number of individual mutex contentions which have occurred since startup.
   uint64 num_contentions = 1;