Merge branch 'master' into ztunniss3_addcargodeny

cmd/protoc-gen-golang-jsonshim/test/jsonshim_test.go

@@ -20,7 +20,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/golang/protobuf/jsonpb"
+	"github.com/golang/protobuf/jsonpb" // nolint: depguard // We need the deprecated module since the jsonpb replacement is not backwards compatible.
 	// nolint: staticcheck
 	legacyproto "github.com/golang/protobuf/proto"
 	"github.com/google/go-cmp/cmp"

common/.commonfiles.sha

@@ -1 +1 @@
-83f898fdd0aa0b903785a75eaf7bc4d7c4849413
+a5d4510eedcf54765e8a2e6a365944b2e05bc342

common/config/.golangci.yml

@@ -239,6 +239,8 @@ linters-settings:
     packages-with-error-message:
     - github.com/gogo/protobuf: "gogo/protobuf is deprecated, use golang/protobuf"
     - golang.org/x/net/http2/h2c: "h2c.NewHandler is unsafe; use wrapper istio.io/istio/pkg/h2c"
+    - github.com/golang/protobuf/jsonpb: "don't use the jsonpb package directly; use util/protomarshal instead"
+    - google.golang.org/protobuf/encoding/protojson: "don't use the protojson package directly; use util/protomarshal instead"
   gosec:
     includes:
     - G401

common/scripts/check_clean_repo.sh

@@ -35,7 +35,10 @@ function write_patch_file() {
     fi
     outName="artifacts/${PATCH_OUT#"${ARTIFACTS}"/}"
     patchFile="${PROW_ARTIFACTS_BASE:-https://gcsweb.istio.io/gcs/istio-prow}/pr-logs/pull/${REPO_OWNER}_${REPO_NAME}/${PULL_NUMBER}/${JOB_NAME}/${BUILD_ID}/${outName}"
-    echo "You can also try applying the patch file from the build artifacts: 'git apply <(curl -sL \"${patchFile}\")'"
+    echo "You can also try applying the patch file from the build artifacts:
+
+git apply <(curl -sL \"${patchFile}\")
+"
 }
 
 if [[ -n $(git status --porcelain) ]]; then

common/scripts/kind_provisioner.sh

@@ -32,7 +32,7 @@ set -x
 ####################################################################
 
 # DEFAULT_KIND_IMAGE is used to set the Kubernetes version for KinD unless overridden in params to setup_kind_cluster(s)
-DEFAULT_KIND_IMAGE="gcr.io/istio-testing/kind-node:v1.25.4"
+DEFAULT_KIND_IMAGE="gcr.io/istio-testing/kind-node:v1.26.0"
 
 # COMMON_SCRIPTS contains the directory this file is in.
 COMMON_SCRIPTS=$(dirname "${BASH_SOURCE:-$0}")

common/scripts/setup_env.sh

@@ -73,7 +73,7 @@ fi
 
 # Build image to use
 if [[ "${IMAGE_VERSION:-}" == "" ]]; then
-  IMAGE_VERSION=master-3b306fb6fdfa5d521d12c5e3a01f134bdc1c6020
+  IMAGE_VERSION=master-cfe6fd8635ece336ce562daaf6fd8cb60d9c99ac
 fi
 if [[ "${IMAGE_NAME:-}" == "" ]]; then
   IMAGE_NAME=build-tools

docker/build-tools/Dockerfile

@@ -25,7 +25,7 @@
 ################
 # Binary tools
 ################
-ARG GOLANG_IMAGE=golang:1.19.4
+ARG GOLANG_IMAGE=golang:1.19.5
 # hadolint ignore=DL3006
 FROM ${GOLANG_IMAGE} as binary_tools_context
 # TARGETARCH is an automatic platform ARG enabled by Docker BuildKit.
@@ -42,37 +42,37 @@ ENV GO_JUNIT_REPORT_VERSION=df0ed838addb0fa189c4d76ad4657f6007a5811c
 ENV GOCOVMERGE_VERSION=b5bfa59ec0adc420475f97f89b58045c721d761c
 ENV GOIMPORTS_VERSION=v0.1.0
 ENV BENCHSTAT_VERSION=9c9101da8316
-ENV GH_VERSION=2.20.2
+ENV GH_VERSION=2.21.2
 ENV GOLANG_PROTOBUF_VERSION=v1.28.1
 ENV GOLANG_GRPC_PROTOBUF_VERSION=v1.2.0
 # When updating the golangci version, you may want to update the common-files config/.golangci* files as well.
 ENV GOLANGCI_LINT_VERSION=v1.50.1
 ENV HADOLINT_VERSION=v2.12.0
-ENV HELM3_VERSION=v3.10.3
-ENV HUGO_VERSION=0.108.0
+ENV HELM3_VERSION=v3.11.0
+ENV HUGO_VERSION=0.110.0
 ENV JB_VERSION=v0.3.1
 ENV JSONNET_VERSION=v0.15.0
 ENV JUNIT_MERGER_VERSION=adf1545b49509db1f83c49d1de90bbcb235642a8
 ENV K8S_CODE_GENERATOR_VERSION=1.26.0
 ENV K8S_TEST_INFRA_VERSION=2acdc6800510dd422bfd2a5d8c02aedc19d15f8d
 ENV KIND_VERSION=v0.17.0
-ENV KUBECTL_VERSION=1.26.0
+ENV KUBECTL_VERSION=1.26.1
 ENV PROTOC_GEN_GRPC_GATEWAY_VERSION=v1.8.6
 ENV PROTOC_GEN_SWAGGER_VERSION=v1.8.6
 ENV PROTOC_GEN_VALIDATE_VERSION=v0.9.0
-ENV PROTOC_VERSION=21.9
+ENV PROTOC_VERSION=21.12
 ENV PROTOLOCK_VERSION=v0.14.0
 ENV PROTOTOOL_VERSION=v1.10.0
-ENV SHELLCHECK_VERSION=v0.8.0
+ENV SHELLCHECK_VERSION=v0.9.0
 ENV SU_EXEC_VERSION=0.2
-ENV YQ_VERSION=4.30.5
+ENV YQ_VERSION=4.30.8
 ENV KPT_VERSION=v0.39.3
-ENV BUF_VERSION=v1.9.0
-ENV GCLOUD_VERSION=410.0.0
+ENV BUF_VERSION=v1.12.0
+ENV GCLOUD_VERSION=413.0.0
 ENV KUBETEST2_VERSION=b019714a389563c9a788f119f801520d059b6533
 ENV COSIGN_VERSION=v1.13.1
 ENV CRANE_VERSION=v0.12.1
-ENV TRIVY_VERSION=0.35.0
+ENV TRIVY_VERSION=0.36.1
 ENV CARGODENY_VERSION=0.13.5
 
 ENV GO111MODULE=on
@@ -317,7 +317,7 @@ ENV BABEL_PRESET_ENV=v7.18.2
 ENV BABEL_PRESET_MINIFY_VERSION=v0.5.2
 ENV LINKINATOR_VERSION=v2.0.5
 ENV MARKDOWN_SPELLCHECK_VERSION=v1.3.1
-ENV NODEJS_VERSION=18.12.1
+ENV NODEJS_VERSION=18.13.0
 ENV SASS_LINT_VERSION=v1.13.1
 ENV SASS_VERSION=v1.52.1
 ENV SVGO_VERSION=v1.3.2
@@ -423,7 +423,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 
 # Pinned versions of stuff we pull in
 ENV AUTOPEP8_VERSION=1.4.4
-ENV YAMLLINT_VERSION=1.28.0
+ENV YAMLLINT_VERSION=1.29.0
 ENV PIP_INSTALL_VERSION=21.0.1
 ENV REQUESTS_VERSION=2.22.0
 ENV PYTHON_PROTOBUF_VERSION=3.11.2
@@ -458,9 +458,9 @@ FROM ubuntu:jammy as base_os_context
 
 ENV DEBIAN_FRONTEND=noninteractive
 
-ENV DOCKER_VERSION=5:20.10.21~3-0~ubuntu-jammy
-ENV CONTAINERD_VERSION=1.6.10-1
-ENV RUST_VERSION=1.65.0
+ENV DOCKER_VERSION=5:20.10.23~3-0~ubuntu-jammy
+ENV CONTAINERD_VERSION=1.6.15-1
+ENV RUST_VERSION=1.66.1
 
 ENV OUTDIR=/out
 
@@ -495,7 +495,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     gettext-base \
     locales-all \
     file \
-    libclang-dev
+    libclang-dev \
+    iproute2 \
+    ipset \
+    rsync
 
 # Fix Docker issue
 RUN update-alternatives --set iptables /usr/sbin/iptables-legacy && update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy

docker/build-tools/docker-entrypoint.sh

@@ -21,7 +21,8 @@ gid=$(id -g)
 shopt -s dotglob
 
 # Make a copy of the hosts's config secrets
-su-exec 0:0 cp -R /config/* /config-copy/
+# Do not copy the Docker sockets
+su-exec 0:0 rsync -a --exclude=docker*.sock /config/ /config-copy/
 
 # Set the ownershp of the host's config secrets to that of the container
 su-exec 0:0 chown -R "${uid}":"${gid}" /config-copy

isotope/service/pkg/srv/header.go

@@ -20,13 +20,27 @@ import (
 
 var (
 	forwardableHeaders = []string{
+		// Request ID
 		"X-Request-Id",
+		// B3 multi-header propagation
 		"X-B3-Traceid",
 		"X-B3-Spanid",
 		"X-B3-Parentspanid",
 		"X-B3-Sampled",
 		"X-B3-Flags",
+		// Lightstep
 		"X-Ot-Span-Context",
+		// Datadog
+		"x-datadog-trace-id",
+		"x-datadog-parent-id",
+		"x-datadog-sampling-priority",
+		// W3C Trace Context
+		"traceparent",
+		"tracestate",
+		// Cloud Trace Context
+		"X-Cloud-Trace-Context",
+		// Grpc binary trace context
+		"grpc-trace-bin",
 	}
 	forwardableHeadersSet = make(map[string]bool, len(forwardableHeaders))
 )
@@ -40,7 +54,8 @@ func init() {
 func extractForwardableHeader(header http.Header) http.Header {
 	forwardableHeader := make(http.Header, len(forwardableHeaders))
 	for key := range forwardableHeadersSet {
-		if values, ok := header[key]; ok {
+		// retrieve header values case-insensitively
+		if values := header.Values(key); len(values) > 0 {
 			forwardableHeader[key] = values
 		}
 	}

perf/benchmark/run_benchmark_job.sh

@@ -55,10 +55,12 @@ export TRIALRUN=${TRIALRUN:-"False"}
 
 CLEANUP_PIDS=()
 
-# Step 1: setup cluster
+# Step 1: create cluster
 # shellcheck disable=SC1090,SC1091
-source "${ROOT}/../bin/setup_cluster.sh"
-setup_e2e_cluster
+export KUBECONFIG="${WD}/tmp/kube.yaml"
+pushd "${ROOT}/istio-install"
+  ./cluster.sh create
+popd
 
 # Step 2: install Istio
 # Setup release info
@@ -142,8 +144,10 @@ function exit_handling() {
   kubectl --namespace "${NAMESPACE}" cp "${FORTIO_CLIENT_POD}":/var/lib/fortio /tmp/rawdata -c shell
   gsutil -q cp -r /tmp/rawdata "gs://${GCS_BUCKET}/${OUTPUT_DIR}/rawdata"
 
-  # Cleanup cluster resources
-  cleanup
+  # Delete cluster
+  pushd "${ROOT}/istio-install"
+    ./cluster.sh delete
+  popd
 }
 
 # add trap to copy raw data when exiting, also output logging information for debugging
@@ -160,7 +164,7 @@ function collect_flame_graph() {
 function collect_metrics() {
   # shellcheck disable=SC2155
   export CSV_OUTPUT="$(mktemp /tmp/benchmark_XXXX)"
-  pipenv run python3 fortio.py ${FORTIO_CLIENT_URL} --csv_output="$CSV_OUTPUT" --prometheus=${PROMETHEUS_URL} \
+  pipenv run python3 fortio.py "${FORTIO_CLIENT_URL}" --csv_output="$CSV_OUTPUT" --prometheus=${PROMETHEUS_URL} \
    --csv StartTime,ActualDuration,Labels,NumThreads,ActualQPS,p50,p90,p99,p999,cpu_mili_avg_istio_proxy_fortioclient,\
 cpu_mili_avg_istio_proxy_fortioserver,cpu_mili_avg_istio_proxy_istio-ingressgateway,mem_Mi_avg_istio_proxy_fortioclient,\
 mem_Mi_avg_istio_proxy_fortioserver,mem_Mi_avg_istio_proxy_istio-ingressgateway

perf/benchmark/security/generate_policies/generate_policies.go

@@ -26,7 +26,7 @@ import (
 	"os"
 	"strings"
 
-	"github.com/golang/protobuf/jsonpb"
+	"github.com/golang/protobuf/jsonpb" // nolint: depguard // We need the deprecated module since the jsonpb replacement is not backwards compatible.
 	// nolint: staticcheck
 	legacyproto "github.com/golang/protobuf/proto"
 	"google.golang.org/protobuf/proto"