Pr/tammach/envoy 1.37 upgrade

ENVOY_VERSION

@@ -1 +1 @@
-envoy-1.36.5
+envoy-1.37.0

WORKSPACE

@@ -12,8 +12,8 @@ ENVOY_REPO = "envoy"
 #
 # No other line in this file may have ENVOY_SHA followed by an equals sign!
 #
-# renovate: datasource=github-releases depName=envoyproxy/envoy digestVersion=v1.36.4
-ENVOY_SHA = "0c30f2cfb88356984f8089fd973919deeb1cf7c2"
+# renovate: datasource=github-releases depName=envoyproxy/envoy digestVersion=v1.37.0
+ENVOY_SHA = "6d9bb7d9a85d616b220d1f8fe67b61f82bbdb8d3"
 
 # // clang-format off: unexpected @bazel_tools reference, please indirect via a definition in //bazel
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
@@ -41,7 +41,7 @@ git_repository(
         "@//patches:0002-listener-add-socket-options.patch",
         "@//patches:0003-original_dst_cluster-Avoid-multiple-hosts-for-the-sa.patch",
         "@//patches:0004-thread_local-reset-slot-in-worker-threads-first.patch",
-        "@//patches:0005-http-header-expose-attribute.patch",
+        "//patches:0005-http-header-expose-attribute.patch",
         "@//patches:0006-build-Fix-arm-build-for-liburing.patch",
         "@//patches:0007-Add-latomic-back-for-arm-build.patch",
     ],
@@ -67,14 +67,14 @@ load("@envoy//bazel:api_repositories.bzl", "envoy_api_dependencies")
 
 envoy_api_dependencies()
 
-load("@envoy//bazel:repo.bzl", "envoy_repo")
-
-envoy_repo()
-
 load("@envoy//bazel:repositories.bzl", "envoy_dependencies")
 
 envoy_dependencies()
 
+load("@envoy//bazel:bazel_deps.bzl", "envoy_bazel_dependencies")
+
+envoy_bazel_dependencies()
+
 load("@envoy//bazel:repositories_extra.bzl", "envoy_dependencies_extra")
 
 envoy_dependencies_extra()
@@ -87,6 +87,14 @@ load("@envoy//bazel:dependency_imports.bzl", "envoy_dependency_imports")
 
 envoy_dependency_imports()
 
+load("@envoy//bazel:repo.bzl", "envoy_repo")
+
+envoy_repo()
+
+load("@envoy//bazel:toolchains.bzl", "envoy_toolchains")
+
+envoy_toolchains()
+
 load("@envoy//bazel:dependency_imports_extra.bzl", "envoy_dependency_imports_extra")
 
 envoy_dependency_imports_extra()

cilium/grpc_subscription.cc

@@ -183,13 +183,13 @@ subscribe(const std::string& type_url, const LocalInfo::LocalInfo& local_info,
           Config::SubscriptionFactory::RetryInitialDelayMs,
           Config::SubscriptionFactory::RetryMaxDelayMs, random),
       /*target_xds_authority_=*/"",
-      /*eds_resources_cache_=*/nullptr // EDS cache is only used for ADS.
+      /*eds_resources_cache_=*/nullptr, // EDS cache is only used for ADS.
+      /*skip_subsequent_node_=*/api_config_source.set_node_on_first_message_only(),
   };
 
   return std::make_unique<Config::GrpcSubscriptionImpl>(
-      std::make_shared<GrpcMuxImpl>(grpc_mux_context,
-                                    api_config_source.set_node_on_first_message_only()),
-      callbacks, resource_decoder, stats, type_url, dispatcher, init_fetch_timeout,
+      std::make_shared<GrpcMuxImpl>(grpc_mux_context), callbacks, resource_decoder, stats, type_url,
+      dispatcher, init_fetch_timeout,
       /*is_aggregated*/ false, options);
 }
 

cilium/grpc_subscription.h

@@ -25,8 +25,8 @@ extern envoy::config::core::v3::ConfigSource cilium_xds_api_config;
 // GrpcMux wrapper to get access to control plane identifier
 class GrpcMuxImpl : public Config::GrpcMuxImpl {
 public:
-  GrpcMuxImpl(Config::GrpcMuxContext& grpc_mux_context, bool skip_subsequent_node)
-      : Config::GrpcMuxImpl(grpc_mux_context, skip_subsequent_node) {}
+  explicit GrpcMuxImpl(Config::GrpcMuxContext& grpc_mux_context)
+      : Config::GrpcMuxImpl(grpc_mux_context) {}
 
   ~GrpcMuxImpl() override = default;
 

cilium/secret_watcher.cc

@@ -156,15 +156,14 @@ DownstreamTLSContext::DownstreamTLSContext(const NetworkPolicyMapImpl& parent,
     server_names_.emplace_back(config.server_names(i));
   }
   auto server_config_or_error = Extensions::TransportSockets::Tls::ServerContextConfigImpl::create(
-      context_config, parent.transportFactoryContext(), false);
+      context_config, parent.transportFactoryContext(), server_names_, false);
   // NOLINTNEXTLINE(performance-unnecessary-copy-initialization)
   THROW_IF_NOT_OK(server_config_or_error.status());
   server_config_ = std::move(server_config_or_error.value());
 
   auto create_server_context = [this]() {
     ENVOY_LOG(debug, "Server secret is updated.");
-    auto ctx_or_error =
-        manager_.createSslServerContext(scope_, *server_config_, server_names_, nullptr);
+    auto ctx_or_error = manager_.createSslServerContext(scope_, *server_config_, nullptr);
     // NOLINTNEXTLINE(performance-unnecessary-copy-initialization)
     THROW_IF_NOT_OK(ctx_or_error.status());
     auto ctx = std::move(ctx_or_error.value());