envoy: Bump to version v1.38.0

.bazelignore

@@ -0,0 +1 @@
+.cache

.gitignore

@@ -1,5 +1,6 @@
 # Dot files, disallow by default, and enable explicitly
 \.*
+!/\.bazelignore
 !\.bazelrc
 !\.bazelversion
 !\.clangd

ENVOY_VERSION

@@ -1 +1 @@
-envoy-1.37.2
+envoy-1.38.0

Makefile

@@ -126,13 +126,16 @@ clang.bazelrc: bazel/setup_clang.sh
 	bazel/setup_clang.sh /usr/lib/llvm-18
 	echo "# Use system LLVM instead of hermetic download to avoid libtinfo.so.5 mismatch" >> $@
 	echo "build:clang-local --repo_env=BAZEL_LLVM_PATH=/usr/lib/llvm-18" >> $@
+	echo "# Disable module_maps/layering_check — abseil module maps are incompatible with system clang" >> $@
+	echo "build --features=-module_maps --features=-layering_check" >> $@
+	echo "build --host_features=-module_maps --host_features=-layering_check" >> $@
 	echo "build --config=clang-local" >> $@
 
 .PHONY: cargo-repin
 cargo-repin: install-bazelisk
 	@$(ECHO_BAZEL)
 	test -e bazel/envoy_dynamic_modules_rust_sdk.Cargo.Bazel.lock || touch bazel/envoy_dynamic_modules_rust_sdk.Cargo.Bazel.lock
-	CARGO_BAZEL_REPIN=workspace CARGO_BAZEL_REPIN_ONLY=dynamic_modules_rust_sdk_crate_index bazel $(BAZEL_OPTS) sync --only=dynamic_modules_rust_sdk_crate_index
+	CARGO_BAZEL_REPIN=workspace CARGO_BAZEL_REPIN_ONLY=envoy_rust_crate_index bazel $(BAZEL_OPTS) sync --only=envoy_rust_crate_index
 
 .PHONY: bazel-bin/cilium-envoy
 bazel-bin/cilium-envoy: $(COMPILER_DEP) SOURCE_VERSION install-bazelisk

Makefile.api

@@ -24,9 +24,9 @@ PROTO_DEPS = \
 	-I bazel-proxy/external/com_google_protobuf/src \
 	-I bazel-proxy/external/com_google_googleapis \
 	-I bazel-proxy/external/com_envoyproxy_protoc_gen_validate \
-	-I bazel-proxy/external/opentelemetry_proto \
+	-I bazel-proxy/external/opentelemetry-proto \
 	-I bazel-proxy/external/prometheus_metrics_model \
-	-I bazel-proxy/external/com_github_cncf_xds \
+	-I bazel-proxy/external/xds \
 	-I bazel-proxy/external/dev_cel/proto
 
 GO_OUT = go

Makefile.dev

@@ -42,7 +42,7 @@ veryclean: force-non-root clean
 precheck: force-non-root
 	tools/check_repositories.sh
 
-FORMAT_EXCLUDED_PREFIXES = "./linux/" "./proxylib/" "./starter/"  "./vendor/" "./go/" "./envoy_build_config/" "./work/" "./bin/"
+FORMAT_EXCLUDED_PREFIXES = "./linux/" "./proxylib/" "./starter/"  "./vendor/" "./go/" "./envoy_build_config/" "./work/" "./bin/" "./.cache/"
 
 # The default set of sources assumes all relevant sources are dependecies of some tests!
 TIDY_SOURCES ?= $(shell bazel query 'kind("source file", deps(//tests/...))' 2>/dev/null | sed -n "s/\/\/cilium:/cilium\//p; s/\/\/tests:/tests\//p")

WORKSPACE

@@ -12,8 +12,8 @@ ENVOY_REPO = "envoy"
 #
 # No other line in this file may have ENVOY_SHA followed by an equals sign!
 #
-# renovate: datasource=github-releases depName=envoyproxy/envoy digestVersion=v1.37.2
-ENVOY_SHA = "5afe27fb338b16d5bb06b3a7198bcd581b4e3dee"
+# renovate: datasource=github-releases depName=envoyproxy/envoy digestVersion=v1.38.0
+ENVOY_SHA = "f1dd21b16c244bda00edfb5ffce577e12d0d2ec2"
 
 # // clang-format off: unexpected @bazel_tools reference, please indirect via a definition in //bazel
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
@@ -43,7 +43,7 @@ git_repository(
         "@//patches:0004-thread_local-reset-slot-in-worker-threads-first.patch",
         "@//patches:0005-http-header-expose-attribute.patch",
         "@//patches:0006-test-integration-Defer-fake-upstream-read-enable-un.patch",
-        "@//patches:0008-repo-Make-yq-dependency-optional-for-CI-config-parsi.patch",
+        "@//patches:0007-repo-Make-yq-dependency-optional-for-CI-config-parsi.patch",
     ],
     # // clang-format off: Envoy's format check: Only repository_locations.bzl may contains URL references
     remote = "https://github.com/envoyproxy/envoy.git",
@@ -126,7 +126,9 @@ go_repository(
     version = "v0.32.0",
 )
 
-envoy_dependency_imports()
+envoy_dependency_imports(
+    cargo_bazel_lockfile = "@//bazel:envoy_dynamic_modules_rust_sdk.Cargo.Bazel.lock",
+)
 
 load("@envoy//bazel:repo.bzl", "envoy_repo")
 

bazel/envoy_dependency_imports.bzl

@@ -7,14 +7,13 @@
 # Refresh bazel/envoy_dynamic_modules_rust_sdk.Cargo.Bazel.lock after Envoy
 # changes the Rust SDK dependencies with:
 #
-#   CARGO_BAZEL_REPIN=workspace CARGO_BAZEL_REPIN_ONLY=dynamic_modules_rust_sdk_crate_index bazel sync --only=dynamic_modules_rust_sdk_crate_index
+#   CARGO_BAZEL_REPIN=workspace CARGO_BAZEL_REPIN_ONLY=envoy_rust_crate_index bazel sync --only=envoy_rust_crate_index
 load("@aspect_bazel_lib//lib:repositories.bzl", "register_jq_toolchains", "register_yq_toolchains")
 load("@base_pip3//:requirements.bzl", pip_dependencies = "install_deps")
 load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies", "go_repository")
 load("@build_bazel_rules_apple//apple:repositories.bzl", "apple_rules_dependencies")
-load("@com_github_aignas_rules_shellcheck//:deps.bzl", "shellcheck_dependencies")
+load("@cel-cpp//bazel:deps.bzl", "parser_deps")
 load("@com_github_chrusty_protoc_gen_jsonschema//:deps.bzl", protoc_gen_jsonschema_go_dependencies = "go_dependencies")
-load("@com_google_cel_cpp//bazel:deps.bzl", "parser_deps")
 load("@dev_pip3//:requirements.bzl", pip_dev_dependencies = "install_deps")
 load("@emsdk//:emscripten_deps.bzl", "emscripten_deps")
 load("@emsdk//:toolchains.bzl", "register_emscripten_toolchains")
@@ -33,6 +32,7 @@ load("@rules_rust//crate_universe:defs.bzl", "crates_repository")
 load("@rules_rust//crate_universe:repositories.bzl", "crate_universe_dependencies")
 load("@rules_rust//rust:defs.bzl", "rust_common")
 load("@rules_rust//rust:repositories.bzl", "rules_rust_dependencies", "rust_register_toolchains", "rust_repository_set")
+load("@shellcheck//:deps.bzl", "shellcheck_dependencies")
 
 # go version for rules_go
 GO_VERSION = "1.24.6"
@@ -48,7 +48,12 @@ def envoy_dependency_imports(
         jq_version = JQ_VERSION,
         yq_version = YQ_VERSION,
         buf_sha = BUF_SHA,
-        buf_version = BUF_VERSION):
+        buf_version = BUF_VERSION,
+        # This allows the downstream repo to point to a different locally re-generated lockfile,
+        # which can be used to workaround a rules_rust bug. See:
+        # - https://github.com/bazelbuild/rules_rust/issues/3521
+        # - https://github.com/envoyproxy/envoy/issues/38951
+        cargo_bazel_lockfile = "@envoy//:Cargo.Bazel.lock"):
     compatibility_proxy_repo()
     rules_foreign_cc_dependencies()
     go_rules_dependencies()
@@ -71,17 +76,21 @@ def envoy_dependency_imports(
             "wasm32-unknown-unknown",
             "wasm32-wasi",
         ],
-        versions = [rust_common.default_version],
+        versions = ["1.88.0"],
     )
     rules_rust_dependencies()
     rust_register_toolchains(
         extra_target_triples = [
             "wasm32-unknown-unknown",
             "wasm32-wasi",
+            # Unconditionally specify the target triples for x-compilations.
+            # Note that the toolchain won't be fetched/used unless the target triple is actually used in the build.
+            "x86_64-unknown-linux-gnu",
+            "aarch64-unknown-linux-gnu",
         ],
     )
     crate_universe_dependencies()
-    crates_repositories()
+    crates_repositories(cargo_bazel_lockfile = cargo_bazel_lockfile)
     grcov_repository()
     shellcheck_dependencies()
     proxy_wasm_rust_sdk_dependencies()
@@ -93,10 +102,10 @@ def envoy_dependency_imports(
     register_yq_toolchains(version = yq_version)
     parser_deps()
 
-    rules_buf_toolchains(**{
-        "sha256": buf_sha,
-        "version": buf_version,
-    })
+    rules_buf_toolchains(
+        sha256 = buf_sha,
+        version = buf_version,
+    )
 
     setup_sanitizer_libs()
 
@@ -165,7 +174,7 @@ def envoy_dependency_imports(
         version = "v1.36.10",
     )
     go_repository(
-        name = "com_github_cncf_xds_go",
+        name = "xds_go",
         importpath = "github.com/cncf/xds/go",
         sum = "h1:gt7U1Igw0xbJdyaCM5H2CnlAlPSkzrhsebQB6WQWjLA=",
         version = "v0.0.0-20251110193048-8bfbf64dc13e",
@@ -248,10 +257,10 @@ def envoy_download_go_sdks(go_version):
         version = go_version,
     )
 
-def crates_repositories():
+def crates_repositories(cargo_bazel_lockfile):
     crates_repository(
-        name = "dynamic_modules_rust_sdk_crate_index",
-        cargo_lockfile = "@envoy//source/extensions/dynamic_modules/sdk/rust:Cargo.lock",
+        name = "envoy_rust_crate_index",
+        cargo_lockfile = "@envoy//:Cargo.lock",
         lockfile = Label("@//bazel:envoy_dynamic_modules_rust_sdk.Cargo.Bazel.lock"),
-        manifests = ["@envoy//source/extensions/dynamic_modules/sdk/rust:Cargo.toml"],
+        manifests = ["@envoy//:Cargo.toml"],
     )