[protobuf] Update protobuf definitions to v1.36.2 (#476)

Signed-off-by: envoy-bot <[email protected]>
Co-authored-by: envoy-bot <[email protected]>

Author: github-actions[bot]

api/src/main/proto/cel/expr/conformance/proto3/test_all_types.proto

@@ -63,7 +63,7 @@ message TestAllTypes {
   string single_string = 14;
   bytes single_bytes = 15;
   optional bool optional_bool = 16;
-  optional bool optional_string = 17;
+  optional string optional_string = 17;
 
   // Collides with 'in' operator.
   bool in = 18;

api/src/main/proto/cel/expr/conformance/test/suite.proto

@@ -79,49 +79,44 @@ message TestCase {
   // environments.
   cel.expr.conformance.Environment env = 4;
 
-  // Input for the test case
-  TestInput input = 5;
+  // A map representing a variable binding where the key is the name of the
+  // input variable.
+  map<string, InputValue> input = 5;
+
+  // Input in the form of a context proto for the test case.
+  // Note: Only one of `input_bindings` and `input_context` can be provided. Providing
+  // both should result in an error.
+  InputContext input_context = 6;
 
   // Expected result of the test case.
-  TestOutput output = 6;
+  TestOutput output = 7;
 
   // If specified validates that the deduced type at check time matches
   // If the result kind is not set and this field is set, the test is considered
   // "check-only".
-  cel.expr.Type deduced_type = 7;
+  cel.expr.Type deduced_type = 8;
 
   // Bypass the type-checking and only attempt to evaluate the parsed
   // expression.
-  bool disable_check = 8;
+  bool disable_check = 9;
 }
 
-// Input for the test case
-message TestInput {
-  // The type of input for the test case
-  oneof input_kind {
-    // A set of variable bindings to be used for evaluating a checked
-    // expression.
-    Bindings bindings = 1;
-
+// Input context proto for the test case
+message InputContext {
+  // The type of input context for the test case
+  oneof input_context_kind {
     // A context message represents an input kind in the form of a proto
     // message whose type is defined at runtime.
-    google.protobuf.Any context_message = 2;
+    google.protobuf.Any context_message = 1;
 
     // A context expression representing a context proto variable. The
     // fields of the input proto.Messages are used as top-level variables within
     // an Activation. The expression is evaluated using the cel environment
     // configured for the test suite.
-    string context_expr = 3;
+    string context_expr = 2;
   }
 }
 
-// The bindings of input variables for the test case.
-message Bindings {
-  // A map representing a variable binding where the key is the name of the
-  // input variable.
-  map<string, InputValue> values = 1;
-}
-
 // The input value for a variable binding
 message InputValue {
   // The type of input value that can be used for a variable binding

api/src/main/proto/cel/expr/eval.proto

@@ -16,8 +16,8 @@ syntax = "proto3";
 
 package cel.expr;
 
+import "google/protobuf/any.proto";
 import "cel/expr/value.proto";
-import "google/rpc/status.proto";
 
 option cc_enable_arenas = true;
 option go_package = "cel.dev/expr";
@@ -104,9 +104,31 @@ message ExprValue {
 //
 // The errors included depend on the context. See `ExprValue.error`.
 message ErrorSet {
-  repeated google.rpc.Status errors = 1;
+  // Errors that could come up during evaluation phase.
+  repeated Status errors = 1;
 }
 
+  // Each `Status` message contains three pieces of data: error code, error message,
+  // and error details.
+  //
+  // You can find out more about this error model and how to work with it in the
+  // [API Design Guide](https://cloud.google.com/apis/design/errors).
+  //
+  // Status value is intended to be wire and field compatible with `google.rpc.Status`.
+  message Status {
+    // The status code, which should be an enum value of [google.rpc.Code][].
+    int32 code = 1;
+
+    // A developer-facing error message, which should be in English. Any
+    // user-facing error message should be localized and sent in the
+    // [Status.details][] field, or localized by the client.
+    string message = 2;
+
+    // A list of messages that carry the error details.  There is a common set of
+    // message types for APIs to use.
+    repeated google.protobuf.Any details = 3;
+  }
+
 // A set of expressions for which the value is unknown.
 //
 // The unknowns included depend on the context. See `ExprValue.unknown`.

api/src/main/proto/envoy/admin/v3/clusters.proto

@@ -143,8 +143,8 @@ message HostStatus {
   //
   // .. note::
   //
-  //   The message will be missing if the host didn’t receive enough traffic to compute a success rate, or if the
-  //   cluster didn’t have enough hosts to perform outlier ejection based on success rate.
+  //   The message will be missing if the host didn't receive enough traffic to compute a success rate, or if the
+  //   cluster didn't have enough hosts to perform outlier ejection based on success rate.
   //
   type.v3.Percent local_origin_success_rate = 8;
 
@@ -171,18 +171,22 @@ message HostHealthStatus {
   // health checking.
   bool pending_dynamic_removal = 5;
 
-  // The host has not yet been health checked.
+  // The host is awaiting first health check.
   bool pending_active_hc = 6;
 
   // The host should be excluded from panic, spillover, etc. calculations because it was explicitly
   // taken out of rotation via protocol signal and is not meant to be routed to.
   bool excluded_via_immediate_hc_fail = 7;
 
-  // The host failed active HC due to timeout.
+  // The host failed active health check due to timeout.
   bool active_hc_timeout = 8;
 
-  // Health status as reported by EDS. Note: only HEALTHY and UNHEALTHY are currently supported
-  // here.
+  // Health status as reported by EDS.
+  //
+  // .. note::
+  //
+  //   Currently, only ``HEALTHY`` and ``UNHEALTHY`` are supported.
+  //
   // [#comment:TODO(mrice32): pipe through remaining EDS health status possibilities.]
   config.core.v3.HealthStatus eds_health_status = 3;
 }

api/src/main/proto/envoy/config/bootstrap/v3/bootstrap.proto

@@ -41,7 +41,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // <config_overview_bootstrap>` for more detail.
 
 // Bootstrap :ref:`configuration overview <config_overview_bootstrap>`.
-// [#next-free-field: 42]
+// [#next-free-field: 43]
 message Bootstrap {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.bootstrap.v2.Bootstrap";
@@ -57,9 +57,7 @@ message Bootstrap {
     // If a network based configuration source is specified for :ref:`cds_config
     // <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.DynamicResources.cds_config>`, it's necessary
     // to have some initial cluster definitions available to allow Envoy to know
-    // how to speak to the management server. These cluster definitions may not
-    // use :ref:`EDS <arch_overview_dynamic_config_eds>` (i.e. they should be static
-    // IP or DNS-based).
+    // how to speak to the management server.
     repeated cluster.v3.Cluster clusters = 2;
 
     // These static secrets can be used by :ref:`SdsSecretConfig
@@ -232,6 +230,14 @@ message Bootstrap {
     bool stats_flush_on_admin = 29 [(validate.rules).bool = {const: true}];
   }
 
+  oneof stats_eviction {
+    // Optional duration to perform metric eviction. At every interval, during the stats flush
+    // the unused metrics are removed from the worker caches and the used metrics
+    // are marked as unused. Must be a multiple of the ``stats_flush_interval``.
+    google.protobuf.Duration stats_eviction_interval = 42
+        [(validate.rules).duration = {gte {nanos: 1000000}}];
+  }
+
   // Optional watchdog configuration.
   // This is for a single watchdog configuration for the entire system.
   // Deprecated in favor of ``watchdogs`` which has finer granularity.

api/src/main/proto/envoy/config/cluster/v3/cluster.proto

@@ -652,9 +652,10 @@ message Cluster {
     // If this is not set, we default to a merge window of 1000ms. To disable it, set the merge
     // window to 0.
     //
-    // Note: merging does not apply to cluster membership changes (e.g.: adds/removes); this is
-    // because merging those updates isn't currently safe. See
-    // https://github.com/envoyproxy/envoy/pull/3941.
+    // .. note::
+    //   Merging does not apply to cluster membership changes (e.g.: adds/removes); this is
+    //   because merging those updates isn't currently safe. See
+    //   https://github.com/envoyproxy/envoy/pull/3941.
     google.protobuf.Duration update_merge_window = 4;
 
     // If set to true, Envoy will :ref:`exclude <arch_overview_load_balancing_excluded>` new hosts
@@ -816,12 +817,14 @@ message Cluster {
   string name = 1 [(validate.rules).string = {min_len: 1}];
 
   // An optional alternative to the cluster name to be used for observability. This name is used
-  // emitting stats for the cluster and access logging the cluster name. This will appear as
+  // for emitting stats for the cluster and access logging the cluster name. This will appear as
   // additional information in configuration dumps of a cluster's current status as
   // :ref:`observability_name <envoy_v3_api_field_admin.v3.ClusterStatus.observability_name>`
-  // and as an additional tag "upstream_cluster.name" while tracing. Note: Any ``:`` in the name
-  // will be converted to ``_`` when emitting statistics. This should not be confused with
-  // :ref:`Router Filter Header <config_http_filters_router_x-envoy-upstream-alt-stat-name>`.
+  // and as an additional tag "upstream_cluster.name" while tracing.
+  //
+  // .. note::
+  //   Any ``:`` in the name will be converted to ``_`` when emitting statistics. This should not be confused with
+  //   :ref:`Router Filter Header <config_http_filters_router_x-envoy-upstream-alt-stat-name>`.
   string alt_stat_name = 28 [(udpa.annotations.field_migrate).rename = "observability_name"];
 
   oneof cluster_discovery_type {

api/src/main/proto/envoy/config/common/matcher/v3/matcher.proto

@@ -41,6 +41,17 @@ message Matcher {
       // Protocol-specific action to take.
       core.v3.TypedExtensionConfig action = 2;
     }
+
+    // If true, the action will be taken but the caller will behave as if no
+    // match was found. This applies both to actions directly encoded in the
+    // action field and to actions returned from a nested matcher tree in the
+    // matcher field. A subsequent matcher on_no_match action will be used
+    // instead.
+    //
+    // This field is not supported in all contexts in which the matcher API is
+    // used. If this field is set in a context in which it's not supported,
+    // the resource will be rejected.
+    bool keep_matching = 3;
   }
 
   // A linear list of field matchers.
@@ -84,7 +95,7 @@ message Matcher {
         // A list of predicates to be AND-ed together.
         PredicateList and_matcher = 3;
 
-        // The invert of a predicate
+        // The inverse of a predicate
         Predicate not_matcher = 4;
       }
     }
@@ -137,8 +148,8 @@ message Matcher {
     MatcherTree matcher_tree = 2;
   }
 
-  // Optional OnMatch to use if the matcher failed.
-  // If specified, the OnMatch is used, and the matcher is considered
+  // Optional ``OnMatch`` to use if the matcher failed.
+  // If specified, the ``OnMatch`` is used, and the matcher is considered
   // to have matched.
   // If not specified, the matcher is considered not to have matched.
   OnMatch on_no_match = 3;
@@ -204,9 +215,9 @@ message HttpHeadersMatch {
 //
 // .. attention::
 //
-//   Searching for patterns in HTTP body is potentially cpu intensive. For each specified pattern, http body is scanned byte by byte to find a match.
+//   Searching for patterns in HTTP body is potentially CPU-intensive. For each specified pattern, HTTP body is scanned byte by byte to find a match.
 //   If multiple patterns are specified, the process is repeated for each pattern. If location of a pattern is known, ``bytes_limit`` should be specified
-//   to scan only part of the http body.
+//   to scan only part of the HTTP body.
 message HttpGenericBodyMatch {
   message GenericTextMatch {
     oneof rule {

api/src/main/proto/envoy/config/common/mutation_rules/v3/mutation_rules.proto

@@ -4,6 +4,7 @@ package envoy.config.common.mutation_rules.v3;
 
 import "envoy/config/core/v3/base.proto";
 import "envoy/type/matcher/v3/regex.proto";
+import "envoy/type/matcher/v3/string.proto";
 
 import "google/protobuf/wrappers.proto";
 
@@ -90,6 +91,12 @@ message HeaderMutationRules {
 // The HeaderMutation structure specifies an action that may be taken on HTTP
 // headers.
 message HeaderMutation {
+  message RemoveOnMatch {
+    // A string matcher that will be applied to the header key. If the header key
+    // matches, the header will be removed.
+    type.matcher.v3.StringMatcher key_matcher = 1 [(validate.rules).message = {required: true}];
+  }
+
   oneof action {
     option (validate.required) = true;
 
@@ -99,5 +106,8 @@ message HeaderMutation {
 
     // Append new header by the specified HeaderValueOption.
     core.v3.HeaderValueOption append = 2;
+
+    // Remove the header if the key matches the specified string matcher.
+    RemoveOnMatch remove_on_match = 3;
   }
 }

api/src/main/proto/envoy/config/core/v3/address.proto

@@ -98,9 +98,15 @@ message SocketAddress {
   // IPv6 space as ``::FFFF:<IPv4-address>``.
   bool ipv4_compat = 6;
 
-  // The Linux network namespace to bind the socket to. If this is set, Envoy will
-  // create the socket in the specified network namespace. Only supported on Linux.
-  // [#not-implemented-hide:]
+  // Filepath that specifies the Linux network namespace this socket will be created in (see ``man 7
+  // network_namespaces``). If this field is set, Envoy will create the socket in the specified
+  // network namespace.
+  //
+  // .. note::
+  //    Setting this parameter requires Envoy to run with the ``CAP_NET_ADMIN`` capability.
+  //
+  // .. attention::
+  //     Network namespaces are only configurable on Linux. Otherwise, this field has no effect.
   string network_namespace_filepath = 7;
 }
 

api/src/main/proto/envoy/config/core/v3/base.proto

@@ -266,7 +266,7 @@ message RuntimeUInt32 {
   uint32 default_value = 2;
 
   // Runtime key to get value for comparison. This value is used if defined.
-  string runtime_key = 3 [(validate.rules).string = {min_len: 1}];
+  string runtime_key = 3;
 }
 
 // Runtime derived percentage with a default when not specified.
@@ -275,7 +275,7 @@ message RuntimePercent {
   type.v3.Percent default_value = 1;
 
   // Runtime key to get value for comparison. This value is used if defined.
-  string runtime_key = 2 [(validate.rules).string = {min_len: 1}];
+  string runtime_key = 2;
 }
 
 // Runtime derived double with a default when not specified.
@@ -286,7 +286,7 @@ message RuntimeDouble {
   double default_value = 1;
 
   // Runtime key to get value for comparison. This value is used if defined.
-  string runtime_key = 2 [(validate.rules).string = {min_len: 1}];
+  string runtime_key = 2;
 }
 
 // Runtime derived bool with a default when not specified.
@@ -300,7 +300,7 @@ message RuntimeFeatureFlag {
   // Runtime key to get value for comparison. This value is used if defined. The boolean value must
   // be represented via its
   // `canonical JSON encoding <https://developers.google.com/protocol-buffers/docs/proto3#json>`_.
-  string runtime_key = 2 [(validate.rules).string = {min_len: 1}];
+  string runtime_key = 2;
 }
 
 // Please use :ref:`KeyValuePair <envoy_api_msg_config.core.v3.KeyValuePair>` instead.