Update Envoy version to 8817b5f (Apr 6th) (#1516)

- Update NH to the latest Envoy.
- Implement `initManager` in `source/client/process_impl.cc` to accommodate envoyproxy/envoy#44100.
- Include a `--path` argument to `tools/check_format.sh` to resolve a Bazel failure after running the newly added rust format check in envoyproxy/envoy#44131.
- Skip assertion in `source/client/flush_worker_impl.cc` as a workaround to accommodate the newly introduced assertion in envoyproxy/envoy#44015.

Signed-off-by: jiajunye <jiajunye@google.com>
Signed-off-by: Jason Ye <jiajunye@google.com>

Author: jiajunye

.bazelrc

@@ -225,7 +225,6 @@ build:compile-time-options --config=boringssl-fips
 build:compile-time-options --define=log_debug_assert_in_release=enabled
 build:compile-time-options --define=path_normalization_by_default=true
 build:compile-time-options --define=deprecated_features=disabled
-build:compile-time-options --define=tcmalloc=gperftools
 build:compile-time-options --define=zlib=ng
 build:compile-time-options --define=uhv=enabled
 # gRPC has a lot of deprecated-enum-enum-conversion warnings with C++20
@@ -254,6 +253,15 @@ common:aws-lc-fips --@envoy//bazel:ssl=@aws_lc//:ssl
 common:aws-lc-fips --@envoy//bazel:crypto=@aws_lc//:crypto
 common:aws-lc-fips --@envoy//bazel:http3=False
 
+# OpenSSL
+common:openssl --//bazel:ssl=//compat/openssl:ssl
+common:openssl --//bazel:crypto=//compat/openssl:crypto
+common:openssl --copt=-DENVOY_SSL_OPENSSL
+common:openssl --host_copt=-DENVOY_SSL_OPENSSL
+common:openssl --@envoy//bazel:http3=False
+common:openssl --test_tag_filters=-nofips
+common:openssl --build_tag_filters=-nofips
+
 
 #############################################################################
 # sanitizers
@@ -406,7 +414,7 @@ build:clang-pch --define=ENVOY_CLANG_PCH=1
 
 # Clang-tidy
 build:clang-tidy --@envoy_toolshed//format/clang_tidy:executable=@envoy//tools/clang-tidy
-build:clang-tidy --@envoy_toolshed//format/clang_tidy:config=//:clang_tidy_config
+build:clang-tidy --@envoy_toolshed//format/clang_tidy:config=@envoy//:clang_tidy_config
 build:clang-tidy --aspects @envoy_toolshed//format/clang_tidy:clang_tidy.bzl%clang_tidy_aspect
 build:clang-tidy --output_groups=report
 build:clang-tidy --build_tag_filters=-notidy

bazel/repositories.bzl

@@ -1,7 +1,7 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-ENVOY_COMMIT = "d078b74b140a7b1d610145d8918f2f0b62df73d6"
-ENVOY_SHA = "786ad16cf44170d369beb5187bdd2e8d8d7b2372b04328301ee6365ee3ca464c"
+ENVOY_COMMIT = "8817b5f1e1cec2b0ca41831ac957befe3381e7bc"
+ENVOY_SHA = "6581b652aee216ecb7d5d6831525c2969aaafce8df18818a8d9065dcfc2277ef"
 
 HDR_HISTOGRAM_C_VERSION = "0.11.8"  # June 18th, 2025
 HDR_HISTOGRAM_C_SHA = "bb95351a6a8b242dc9be1f28562761a84d4cf0a874ffc90a9b630770a6468e94"

source/client/flush_worker_impl.cc

@@ -36,6 +36,7 @@ void FlushWorkerImpl::shutdownThread() {
 }
 
 void FlushWorkerImpl::flushStats() {
+  Envoy::Thread::SkipAsserts skip;
   // Create a snapshot and flush to all sinks. Even if there are no sinks,
   // creating the snapshot has the important property that it latches all counters on a periodic
   // basis.

source/client/process_impl.cc

@@ -208,9 +208,7 @@ class NighthawkServerFactoryContext : public Envoy::Server::Configuration::Serve
 
   Envoy::Regex::Engine& regexEngine() override { return regex_engine_; }
 
-  Envoy::Init::Manager& initManager() override {
-    PANIC("NighthawkServerFactoryContext::initManager not implemented");
-  };
+  Envoy::Init::Manager& initManager() override { return server_.initManager(); };
 
   Envoy::Grpc::Context& grpcContext() override { return server_.grpcContext(); };
 
@@ -274,7 +272,7 @@ class NighthawkServerFactoryContext : public Envoy::Server::Configuration::Serve
 class NighthawkServerInstance : public Envoy::Server::Instance {
 public:
   NighthawkServerInstance(Envoy::OptRef<Envoy::Server::Admin> admin, Envoy::Api::Api& api,
-                          Envoy::Event::Dispatcher& dispatcher,
+                          Envoy::Init::Manager& init_manager, Envoy::Event::Dispatcher& dispatcher,
                           Envoy::AccessLog::AccessLogManager& log_manager,
                           Envoy::Server::Options& options, Envoy::Runtime::Loader& runtime,
                           Envoy::Singleton::Manager& singleton_manager,
@@ -284,11 +282,11 @@ class NighthawkServerInstance : public Envoy::Server::Instance {
                           Envoy::Grpc::Context& grpc_context, Envoy::Http::Context& http_context,
                           Envoy::Router::Context& router_context, Envoy::Stats::StoreRoot& store,
                           Envoy::Secret::SecretManagerImpl& secret_manager)
-      : admin_(admin), api_(api), dispatcher_(dispatcher), log_manager_(log_manager),
-        options_(options), runtime_(runtime), singleton_manager_(singleton_manager),
-        stats_store_(store), tls_(tls), local_info_(local_info),
-        validation_context_(validation_context), grpc_context_(grpc_context),
-        http_context_(http_context), router_context_(router_context),
+      : admin_(admin), api_(api), init_manager_(init_manager), dispatcher_(dispatcher),
+        log_manager_(log_manager), options_(options), runtime_(runtime),
+        singleton_manager_(singleton_manager), stats_store_(store), tls_(tls),
+        local_info_(local_info), validation_context_(validation_context),
+        grpc_context_(grpc_context), http_context_(http_context), router_context_(router_context),
         server_factory_context_(*this),
         http_server_properties_cache_manager_(
             server_factory_context_, Envoy::ProtobufMessage::getStrictValidationVisitor(), tls),
@@ -331,9 +329,7 @@ class NighthawkServerInstance : public Envoy::Server::Instance {
   Envoy::Server::HotRestart& hotRestart() override {
     PANIC("NighthawkServerInstance::hotRestart not implemented");
   }
-  Envoy::Init::Manager& initManager() override {
-    PANIC("NighthawkServerInstance::initManager not implemented");
-  }
+  Envoy::Init::Manager& initManager() override { return init_manager_; }
   Envoy::Server::ListenerManager& listenerManager() override {
     PANIC("NighthawkServerInstance::listenerManager not implemented");
   }
@@ -405,6 +401,7 @@ class NighthawkServerInstance : public Envoy::Server::Instance {
 private:
   Envoy::OptRef<Envoy::Server::Admin> admin_;
   Envoy::Api::Api& api_;
+  Envoy::Init::Manager& init_manager_;
   Envoy::Event::Dispatcher& dispatcher_;
   Envoy::AccessLog::AccessLogManager& log_manager_;
   Envoy::Server::Options& options_;
@@ -1001,9 +998,9 @@ bool ProcessImpl::runInternal(OutputCollector& collector, const UriPtr& tracing_
       runtime_loader_ = *std::move(loader);
 
       server_ = std::make_unique<NighthawkServerInstance>(
-          admin_, *api_, *dispatcher_, access_log_manager_, envoy_options_, *runtime_loader_.get(),
-          *singleton_manager_, tls_, *local_info_, validation_context_, grpc_context_,
-          http_context_, router_context_, store_root_, secret_manager_);
+          admin_, *api_, init_manager_, *dispatcher_, access_log_manager_, envoy_options_,
+          *runtime_loader_.get(), *singleton_manager_, tls_, *local_info_, validation_context_,
+          grpc_context_, http_context_, router_context_, store_root_, secret_manager_);
       ssl_context_manager_ =
           std::make_unique<Envoy::Extensions::TransportSockets::Tls::ContextManagerImpl>(
               server_->serverFactoryContext());

tools/check_format.sh

@@ -8,6 +8,7 @@ TO_CHECK="${2:-$FULL_CHECK}"
 # TODO(https://github.com/envoyproxy/nighthawk/issues/165): fully excluding everything
 # from the build fixer isn't ideal.
 bazel run @envoy//tools/code_format:check_format -- \
+  --path=${PWD} \
   --config_path=${PWD}/tools/code_format/config.yaml \
   --skip_envoy_build_rule_check  --namespace_check Nighthawk \
   --build_fixer_check_excluded_paths=$TO_CHECK \

tools/code_format/config.yaml

@@ -42,6 +42,7 @@ paths:
   - bazel/external/http_parser/
   - bazel/rbe/toolchains/configs/
   - bazel-
+  - compat/openssl/
   - build
   - contrib/contrib_build_config.bzl
   - examples/wasm-cc
@@ -105,6 +106,7 @@ paths:
     - source/extensions/watchdog/profile_action/config.cc
     - source/common/router/route_config_update_receiver_impl.cc
     - source/common/upstream/upstream_impl.cc
+    - source/common/matcher/actions/string_returning_action.cc
     - source/common/network/listen_socket_impl.cc
     - source/common/network/io_socket_handle_base_impl.cc
     - source/common/network/address_impl.cc
@@ -323,9 +325,12 @@ paths:
     include:
     - api/bazel/cc_proto_descriptor_library/file_descriptor_generator.cc
     - contrib/config/source/kv_store_xds_delegate.cc
+    - contrib/kafka/stat_sinks/source/kafka_stats_sink_impl.cc
     - contrib/istio/filters/network/metadata_exchange/source/metadata_exchange.cc
     - contrib/istio/filters/network/metadata_exchange/test/metadata_exchange_test.cc
     - contrib/istio/filters/http/peer_metadata/source/peer_metadata.cc
+    - contrib/istio/filters/network/peer_metadata/source/peer_metadata.cc
+    - contrib/istio/filters/network/peer_metadata/test/peer_metadata_test.cc
     - source/common/protobuf/utility.h
     - source/common/protobuf/utility.cc
     - source/extensions/filters/http/grpc_json_transcoder/json_transcoder_filter.cc