sync with upstream

.bazelrc

@@ -0,0 +1,82 @@
+# =====================================================================
+# Envoy specific Bazel build/test options.
+# =====================================================================
+
+# Keep envoy.bazelrc up-to-date by run:
+# curl -sSL https://raw.githubusercontent.com/envoyproxy/envoy/master/.bazelrc > envoy.bazelrc
+import %workspace%/envoy.bazelrc
+
+# Istio override: increase JVM heap to 4GB for ARM64 builds (envoy.bazelrc sets 3GB)
+# The 3GB limit causes memory pressure during large downloads which breaks gRPC remote cache connections
+# Also increase direct buffer memory for large file transfers
+# See: https://github.com/istio/proxy/pull/6726
+startup --host_jvm_args=-Xmx4g
+startup --host_jvm_args=-XX:MaxDirectMemorySize=4g
+
+# Overrides workspace_status_command
+build --workspace_status_command=bazel/bazel_get_workspace_status
+build:remote --remote_timeout=7200
+# ========================================
+# Istio specific Bazel build/test options.
+# ========================================
+
+# Enable libc++ and C++20 by default.
+build:linux --config=clang
+
+# put /usr/local/bin before /usr/bin to avoid picking up wrong python3.6 when building envoy.tls.key_providers.cryptomb
+build:linux --action_env=PATH=/usr/local/bin:/bin:/usr/bin
+
+# Need for CI image to pickup docker-credential-gcloud, PATH is fixed in rbe-toolchain-* configs.
+build:remote-ci --action_env=PATH=/usr/local/google-cloud-sdk/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/llvm/bin
+# These flags reduce bazel memory consumption at the cost of slower incremental builds
+# CI builds are not incremental, since we build with a clean state, so the performance impact is not
+# relevant for CI
+build:remote-ci --discard_analysis_cache --nokeep_state_after_build --notrack_incremental_state
+
+# Apply memory optimization flags to all remote cache builds
+build:remote --discard_analysis_cache --nokeep_state_after_build --notrack_incremental_state
+
+# Enable path normalization by default.
+# See: https://github.com/envoyproxy/envoy/pull/6519
+build --define path_normalization_by_default=true
+
+build:macos --define tcmalloc=disabled
+
+# Build with embedded V8-based WebAssembly runtime.
+build --define wasm=v8
+
+# Build Proxy-WASM plugins as native extensions.
+build --copt -DNULL_PLUGIN
+
+# Release builds without debug symbols.
+build:release -c opt
+build:release --strip=always
+
+# Release builds with debug symbols
+build:release-symbol -c opt
+
+# Debug builds
+build:debug -c dbg
+
+# Add compile option for all C++ files
+# TODO(kuat) re-enable after fixing upstream dd/tracing-lib.
+# build --cxxopt -Wnon-virtual-dtor
+build --cxxopt -Wformat
+build --cxxopt -Wformat-security
+
+# CI sanitizer configuration
+#
+build:clang-asan-ci --config=asan
+build:clang-asan-ci --linkopt='-L/usr/lib/llvm/lib/x86_64-unknown-linux-gnu'
+build:clang-asan-ci --linkopt='-Wl,-rpath,/usr/lib/llvm/lib/x86_64-unknown-linux-gnu'
+build:clang-asan-ci --linkopt='-L/usr/lib/llvm/lib/clang/14.0.0/lib/x86_64-unknown-linux-gnu'
+
+build:clang-tsan-ci --config=tsan
+build:clang-tsan-ci --linkopt=-L/opt/libcxx_tsan/lib
+build:clang-tsan-ci --linkopt=-Wl,-rpath,/opt/libcxx_tsan/lib
+
+# get from https://github.com/Homebrew/homebrew-core/blob/master/Formula/e/envoy.rb
+build:macos --cxxopt=-Wno-range-loop-analysis
+build:macos --host_cxxopt=-Wno-range-loop-analysis
+build:macos --cxxopt=-Wno-deprecated-declarations
+build:macos --host_cxxopt=-Wno-deprecated-declarations

.bazelversion

@@ -0,0 +1 @@
+7.7.1

.clang-format

@@ -0,0 +1,17 @@
+---
+Language:        Cpp
+AccessModifierOffset: -2
+ColumnLimit: 100
+DerivePointerAlignment: false
+PointerAlignment: Left
+SortIncludes: false
+TypenameMacros: ['STACK_OF']
+...
+
+---
+Language: Proto
+ColumnLimit: 100
+SpacesInContainerLiterals: false
+AllowShortFunctionsOnASingleLine: false
+ReflowComments: false
+...

.devcontainer/devcontainer.json

@@ -0,0 +1,33 @@
+{
+  "name": "istio build-tools",
+  "image": "registry.istio.io/testing/build-tools-proxy:master-63fd6eec6f3df5a3ed4e190e60153ef3425f66b4",
+  "privileged": true,
+  "remoteEnv": {
+    "USE_GKE_GCLOUD_AUTH_PLUGIN": "True",
+    "BUILD_WITH_CONTAINER": "0",
+    "CARGO_HOME": "/home/.cargo",
+    "RUSTUP_HOME": "/home/.rustup"
+  },
+  "features": {
+    "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {},
+    "ghcr.io/mpriscella/features/kind:1": {}
+  },
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "golang.go",
+        "rust-lang.rust-analyzer",
+        "eamodio.gitlens",
+        "zxh404.vscode-proto3",
+        "ms-azuretools.vscode-docker",
+        "redhat.vscode-yaml",
+        "IBM.output-colorizer"
+      ],
+      "settings": {
+        "files.eol": "\n",
+        "go.useLanguageServer": true,
+        "go.lintTool": "golangci-lint"
+      }
+    }
+  }
+}

.gitattributes

@@ -0,0 +1,16 @@
+*.descriptor      linguist-generated=true
+*.descriptor      -diff -merge
+*.descriptor_set  linguist-generated=true
+*.descriptor_set  -diff -merge
+*.pb.html linguist-generated=true
+*.pb.go linguist-generated=true
+*.gen.go linguist-generated=true
+*.gen.yaml linguist-generated=true
+*.gen.json linguist-generated=true
+*_pb2.py linguist-generated=true
+manifests/charts/**/profile*.yaml linguist-generated=true
+go.sum merge=union
+vendor/**  linguist-vendored
+common/**  linguist-vendored
+archive/**  linquist-vendored
+**/vmlinux.h  linquist-vendored

.github/PULL_REQUEST_TEMPLATE.md

@@ -3,11 +3,3 @@
 **Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #
 
 **Special notes for your reviewer**:
-
-**Release note**:
-<!--  Steps to write your release note:
-1. Use the release-note-* labels to set the release note state (if you have access)
-2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`.
--->
-```release-note
-```

.github/SECURITY.md

@@ -0,0 +1 @@
+Refer to [Istio Security Overview](https://github.com/istio/istio/blob/master/.github/SECURITY.md) for more details.

.github/dependabot.yml

@@ -0,0 +1,14 @@
+# Configures Depdendabot to PR go security updates only
+
+version: 2
+updates:
+  # Go configuration for master branch
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    # Limit number of open PRs to 0 so that we only get security updates
+    # See https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates
+    open-pull-requests-limit: 0
+    labels:
+      - "release-notes-none"

.gitignore

@@ -2,4 +2,15 @@
 .idea/*
 docker/envoy
 *.iml
+*.swp
+*.test
 /artifacts
+clang.bazelrc
+user.bazelrc
+compile_commands.json
+test/envoye2e/tcp_metadata_exchange/testoutput
+test/envoye2e/http_metadata_exchange/testoutput
+*.wasm
+.vscode
+out/
+.cache