[protobuf] Update protobuf definitions to v1.39.0

api/src/main/proto/envoy/admin/v3/server_info.proto

@@ -62,7 +62,7 @@ message ServerInfo {
   bool hot_restart_initializing = 8;
 }
 
-// [#next-free-field: 43]
+// [#next-free-field: 44]
 message CommandLineOptions {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.admin.v2alpha.CommandLineOptions";
@@ -197,6 +197,9 @@ message CommandLineOptions {
   // See :option:`--enable-fine-grain-logging` for details.
   bool enable_fine_grain_logging = 34;
 
+  // See :option:`--log-stacktrace-single-entry` for details.
+  bool log_stacktrace_single_entry = 43;
+
   // See :option:`--socket-path` for details.
   string socket_path = 35;
 

api/src/main/proto/envoy/config/bootstrap/v3/bootstrap.proto

@@ -42,7 +42,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // <config_overview_bootstrap>` for more detail.
 
 // Bootstrap :ref:`configuration overview <config_overview_bootstrap>`.
-// [#next-free-field: 43]
+// [#next-free-field: 44]
 message Bootstrap {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.bootstrap.v2.Bootstrap";
@@ -433,6 +433,17 @@ message Bootstrap {
   // Optional configuration for memory allocation manager.
   // Memory releasing is only supported for `tcmalloc allocator <https://github.com/google/tcmalloc>`_.
   MemoryAllocatorManager memory_allocator_manager = 41;
+
+  // When enabled, Envoy pins each worker thread to a distinct CPU from the process affinity mask,
+  // worker ``i`` to the ``i-th`` CPU in ascending order. This improves CPU cache and ``NUMA``
+  // locality for high concurrency deployments on bare metal. It is available on Linux only and is
+  // ignored on other platforms. Pinning requires a worker count no greater than the number of CPUs
+  // in the process affinity mask. When the worker count exceeds the available CPUs no worker is
+  // pinned. Pinning is applied once when the workers start, so a later change to the process
+  // affinity mask does not re-pin.
+  //
+  // Defaults to ``false``.
+  bool enable_worker_cpu_affinity = 43;
 }
 
 // Administration interface :ref:`operations documentation
@@ -813,3 +824,31 @@ message MemoryAllocatorManager {
   // Defaults to ``104857600`` (100 MB).
   uint64 max_unfreed_memory_bytes = 5;
 }
+
+// A placeholder proto so that users can explicitly configure the standard
+// Listener Manager via the bootstrap's :ref:`listener_manager <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.listener_manager>`.
+// [#not-implemented-hide:]
+message ListenerManager {
+}
+
+// A placeholder proto so that users can explicitly configure the standard
+// Validation Listener Manager via the bootstrap's :ref:`listener_manager <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.listener_manager>`.
+// [#not-implemented-hide:]
+message ValidationListenerManager {
+}
+
+// A placeholder proto so that users can explicitly configure the API
+// Listener Manager via the bootstrap's :ref:`listener_manager <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.listener_manager>`.
+// [#not-implemented-hide:]
+message ApiListenerManager {
+  enum ThreadingModel {
+    // Handle HTTP requests on the main Envoy thread which also processes platform-raised events and runs xDS clients.
+    MAIN_THREAD_ONLY = 0;
+
+    // Handle HTTP requests on a standalone worker thread.
+    STANDALONE_WORKER_THREAD = 1;
+  }
+
+  // Default to MainThreadOnly.
+  ThreadingModel threading_model = 1;
+}

api/src/main/proto/envoy/config/cluster/v3/circuit_breaker.proto

@@ -5,6 +5,7 @@ package envoy.config.cluster.v3;
 import "envoy/config/core/v3/base.proto";
 import "envoy/type/v3/percent.proto";
 
+import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/status.proto";
@@ -43,6 +44,25 @@ message CircuitBreakers {
       // This parameter is optional. Defaults to 20%.
       type.v3.Percent budget_percent = 1;
 
+      // An optional duration in which requests will be considered when calculating
+      // the budget for retries. This parameter alters the way in which the retry budget
+      // is calculated, overriding the default behavior when specified.
+      //
+      // By default, when budget_interval is set to 0ms, only presently active
+      // and pending requests are considered when calculating the retry budget.
+      //
+      // When a non-zero budget_interval is specified, new requests are
+      // considered for the duration of budget_interval when calculating
+      // the retry budget.
+      //
+      // For example, if 10 requests start at the same time, with a specified budget_interval
+      // of 100ms, all 10 requests will be considered when calculating the retry
+      // budget for the next 100ms, regardless of if they have completed.
+      // All 10 requests will expire after the budget_interval duration.
+      //
+      // This parameter is optional. Defaults to 0ms.
+      google.protobuf.Duration budget_interval = 3;
+
       // Specifies the minimum retry concurrency allowed for the retry budget. The limit on the
       // number of active retries may never go below this number.
       //

api/src/main/proto/envoy/config/core/v3/base.proto

@@ -269,6 +269,15 @@ message RuntimeUInt32 {
   string runtime_key = 3;
 }
 
+// Runtime derived uint64 with a default when not specified.
+message RuntimeUInt64 {
+  // Default value if runtime value is not available.
+  uint64 default_value = 2;
+
+  // Runtime key to get value for comparison. This value is used if defined.
+  string runtime_key = 3;
+}
+
 // Runtime derived percentage with a default when not specified.
 message RuntimePercent {
   // Default value if runtime value is not available.
@@ -493,6 +502,14 @@ message HeaderMap {
 message WatchedDirectory {
   // Directory path to watch.
   string path = 1 [(validate.rules).string = {min_len: 1}];
+
+  // If set to true, the watcher will also subscribe to file modification events
+  // (``IN_MODIFY`` on Linux) in addition to move events (``IN_MOVED_TO``). This allows
+  // in-place file writes to trigger reload callbacks. Use this when the writing process
+  // cannot use atomic rename (e.g. certain secret managers that write certificate files
+  // directly). By default, only move/rename events are watched, which is the safe choice
+  // for atomic updates (e.g. Kubernetes ConfigMap symlink swaps).
+  bool watch_modify = 2;
 }
 
 // Data source consisting of a file, an inline value, or an environment variable.

api/src/main/proto/envoy/config/core/v3/protocol.proto

@@ -284,7 +284,7 @@ message AlternateProtocolsCacheOptions {
   repeated string canonical_suffixes = 5;
 }
 
-// [#next-free-field: 8]
+// [#next-free-field: 9]
 message HttpProtocolOptions {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.api.v2.core.HttpProtocolOptions";
@@ -338,6 +338,22 @@ message HttpProtocolOptions {
   // <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.drain_timeout>`.
   google.protobuf.Duration max_connection_duration = 3;
 
+  // Percentage-based jitter for ``max_connection_duration``. If set, the actual connection duration
+  // limit is extended by a random duration up to ``max_connection_duration * jitter / 100``.
+  // This staggers connection teardowns across time and prevents a thundering-herd of reconnects
+  // when many connections are established at roughly the same time.
+  // This field is ignored if ``max_connection_duration`` is not set. If not set, no jitter is added.
+  //
+  // .. note::
+  //   This field is currently only honored for downstream connections by the HTTP connection
+  //   manager. It is not yet supported for upstream cluster connections.
+  //
+  // This is analogous to
+  // :ref:`max_downstream_connection_duration_jitter_percentage
+  // <envoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.max_downstream_connection_duration_jitter_percentage>`
+  // in the TCP proxy filter.
+  type.v3.Percent max_connection_duration_jitter = 8;
+
   // The maximum number of headers (request headers if configured on HttpConnectionManager,
   // response headers when configured on a cluster).
   // If unconfigured, the default maximum number of headers allowed is ``100``.
@@ -445,8 +461,8 @@ message Http1ProtocolOptions {
   // This is a no-op if ``accept_http_10`` is not true.
   string default_host_for_http_10 = 3;
 
-  // Describes how the keys for response headers should be formatted. By default, all header keys
-  // are lower cased.
+  // Describes how the keys for headers encoded by the HTTP/1 codec should be formatted. By
+  // default, all header keys are lower cased.
   HeaderKeyFormat header_key_format = 4;
 
   // Enables trailers for HTTP/1. By default the HTTP/1 codec drops proxied trailers.
@@ -552,7 +568,7 @@ message KeepaliveSettings {
       [(validate.rules).duration = {gte {nanos: 1000000}}];
 }
 
-// [#next-free-field: 21]
+// [#next-free-field: 23]
 message Http2ProtocolOptions {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.api.v2.core.Http2ProtocolOptions";
@@ -669,7 +685,7 @@ message Http2ProtocolOptions {
   // the connection is terminated. For downstream connections the ``opened_streams`` is incremented when
   // Envoy receives complete response headers from the upstream server. For upstream connections the
   // ``opened_streams`` is incremented when Envoy sends the ``HEADERS`` frame for a new stream. The
-  // ``http2.inbound_priority_frames_flood`` stat tracks the number of connections terminated due to
+  // ``http2.inbound_window_update_frames_flood`` stat tracks the number of connections terminated due to
   // flood mitigation. The default ``max_inbound_window_update_frames_per_data_frame_sent`` value is ``10``.
   // Setting this to ``1`` should be enough to support HTTP/2 implementations with basic flow control,
   // but more complex implementations that try to estimate available bandwidth require at least ``2``.
@@ -791,6 +807,26 @@ message Http2ProtocolOptions {
   // From RFC 9110, https://www.rfc-editor.org/rfc/rfc9110.html#section-5.5:
   // obs-text = %x80-FF
   google.protobuf.BoolValue disallow_obs_text = 20;
+
+  // Configures the initial token count for the RST_STREAM rate limiter used by the ``nghttp2``
+  // server-side connection. This uses a token-bucket algorithm where each received RST_STREAM
+  // frame consumes one token, and tokens are replenished at :ref:`stream_reset_rate
+  // <envoy_v3_api_field_config.core.v3.Http2ProtocolOptions.stream_reset_rate>` per second.
+  // When no tokens remain, ``nghttp2`` sends GOAWAY with ``INTERNAL_ERROR`` to close the
+  // connection, protecting against CVE-2023-44487 (HTTP/2 Rapid Reset). Defaults to ``1000``.
+  //
+  // This option only applies when using ``nghttp2`` as a server. It has no effect on ``oghttp2``
+  // or on client-side connections.
+  google.protobuf.UInt64Value stream_reset_burst = 21;
+
+  // Configures the token replenishment rate (tokens per second) for the RST_STREAM rate limiter
+  // used by the ``nghttp2`` server-side connection. See :ref:`stream_reset_burst
+  // <envoy_v3_api_field_config.core.v3.Http2ProtocolOptions.stream_reset_burst>` for details.
+  // Defaults to ``33``.
+  //
+  // This option only applies when using ``nghttp2`` as a server. It has no effect on ``oghttp2``
+  // or on client-side connections.
+  google.protobuf.UInt64Value stream_reset_rate = 22;
 }
 
 // [#not-implemented-hide:]

api/src/main/proto/envoy/config/endpoint/v3/endpoint_components.proto

@@ -25,6 +25,7 @@ option (udpa.annotations.file_status).package_version_status = ACTIVE;
 // [#protodoc-title: Endpoints]
 
 // Upstream host identifier.
+// [#next-free-field: 6]
 message Endpoint {
   option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.endpoint.Endpoint";
 
@@ -97,6 +98,20 @@ message Endpoint {
   // sorted by preference order of the addresses. This will only be supported
   // for STATIC and EDS clusters.
   repeated AdditionalAddress additional_addresses = 4;
+
+  // Optional alternative stat name for this endpoint. If not specified, the main address will be used
+  // as the stat name and be extracted as ``envoy.endpoint_address`` tag value in generated stats.
+  // If specified, the ``observability_name`` here will be used to replace the main address.
+  //
+  // .. note::
+  //
+  //   This field is ignored for logical DNS host implementation..
+  //
+  // This is useful when there are duplicate addresses in the cluster, for example when multiple
+  // endpoints share the same address but have different hostnames or metadata.
+  // In this case, the observability name can be used to differentiate between these endpoints in
+  // stats and logs.
+  string observability_name = 5;
 }
 
 // An Endpoint that Envoy can route traffic to.
@@ -139,7 +154,7 @@ message LbEndpoint {
 // LbEndpoint list collection. Entries are `LbEndpoint` resources or references.
 // [#not-implemented-hide:]
 message LbEndpointCollection {
-  xds.core.v3.CollectionEntry entries = 1;
+  repeated xds.core.v3.CollectionEntry entries = 1;
 }
 
 // A configuration for an LEDS collection.

api/src/main/proto/envoy/config/listener/v3/listener.proto

@@ -106,6 +106,29 @@ message Listener {
           "envoy.api.v2.Listener.ConnectionBalanceConfig.ExactBalance";
     }
 
+    // A connection balancer that steers each new TCP connection to the worker thread pinned to the
+    // CPU that received the connection, using a kernel ``SO_REUSEPORT`` BPF program. This removes
+    // the lock that the :ref:`exact balancer
+    // <envoy_v3_api_msg_config.listener.v3.Listener.ConnectionBalanceConfig.ExactBalance>` takes on
+    // every accept and keeps each connection on a single worker for cache and ``NUMA`` locality. To
+    // realize locality the operator should align ``NIC`` receive steering so connections arrive on
+    // the worker CPUs, for example with receive side scaling or ``IRQ`` affinity.
+    //
+    // It is available on Linux only and requires :ref:`enable_worker_cpu_affinity
+    // <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.enable_worker_cpu_affinity>` so worker ``i``
+    // is pinned to the CPU the program steers to it, :ref:`enable_reuse_port
+    // <envoy_v3_api_field_config.listener.v3.Listener.enable_reuse_port>`, a kernel that supports
+    // reuse port BPF steering, and a worker count no greater than the number of CPUs in the process
+    // affinity mask. When any of these is not met, or if the kernel rejects the steering program at
+    // runtime, the listener keeps serving with the kernel default reuse port hashing and without CPU
+    // locality.
+    //
+    // Worker affinity is fixed when the worker threads start, so a listener added dynamically via LDS
+    // steers with the same mapping. During a hot restart new connections may be steered to the
+    // draining parent process until it exits.
+    message CpuLocalityBalance {
+    }
+
     oneof balance_type {
       option (validate.required) = true;
 
@@ -118,6 +141,12 @@ message Listener {
       // because the only registered member (``envoy.network.connection_balance.dlb``)
       // is disabled. See https://github.com/envoyproxy/envoy/issues/45491.
       core.v3.TypedExtensionConfig extend_balance = 2;
+
+      // If specified, the listener will steer new connections to worker threads using a kernel
+      // ``SO_REUSEPORT`` BPF program. See :ref:`CpuLocalityBalance
+      // <envoy_v3_api_msg_config.listener.v3.Listener.ConnectionBalanceConfig.CpuLocalityBalance>`
+      // for the requirements and fallback behavior.
+      CpuLocalityBalance cpu_locality_balance = 3;
     }
   }
 
@@ -450,21 +479,3 @@ message Listener {
   // to explicitly configure TCP keepalive settings for individual additional addresses.
   core.v3.TcpKeepalive tcp_keepalive = 37;
 }
-
-// A placeholder proto so that users can explicitly configure the standard
-// Listener Manager via the bootstrap's :ref:`listener_manager <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.listener_manager>`.
-// [#not-implemented-hide:]
-message ListenerManager {
-}
-
-// A placeholder proto so that users can explicitly configure the standard
-// Validation Listener Manager via the bootstrap's :ref:`listener_manager <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.listener_manager>`.
-// [#not-implemented-hide:]
-message ValidationListenerManager {
-}
-
-// A placeholder proto so that users can explicitly configure the API
-// Listener Manager via the bootstrap's :ref:`listener_manager <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.listener_manager>`.
-// [#not-implemented-hide:]
-message ApiListenerManager {
-}

api/src/main/proto/envoy/config/metrics/v3/stats.proto

@@ -44,6 +44,7 @@ message StatsSink {
 }
 
 // Statistics configuration such as tagging.
+// [#next-free-field: 6]
 message StatsConfig {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.metrics.v2.StatsConfig";
@@ -104,6 +105,19 @@ message StatsConfig {
   //       3600000
   //     ]
   repeated HistogramBucketSettings histogram_bucket_settings = 4;
+
+  // When set to ``true``, tag extractors specified in :ref:`stats_tags
+  // <envoy_v3_api_field_config.metrics.v3.StatsConfig.stats_tags>` take precedence over the built-in
+  // default tag extractors that share the same ``tag_name``, instead of the default taking
+  // precedence. This allows overriding individual default Envoy tags (for example
+  // ``envoy.cluster_name``) while keeping :ref:`use_all_default_tags
+  // <envoy_v3_api_field_config.metrics.v3.StatsConfig.use_all_default_tags>` enabled, so it is not
+  // necessary to disable all defaults and re-declare every extractor.
+  //
+  // Has no effect when ``use_all_default_tags`` is ``false`` (no default extractors are added in
+  // that case). If not provided, the value is assumed to be false, preserving existing behavior
+  // where the default extractor takes precedence over custom extractors with the same ``tag_name``.
+  google.protobuf.BoolValue allow_default_tag_overrides = 5;
 }
 
 // Configuration for disabling stat instantiation.