auto-merge envoyproxy/envoy[main] into envoyproxy/envoy-openssl[main]

* upstream/main: ci/coverage: Fix accidental ws (#36839) oauth2: enable `use_refresh_token` by default (#36065) Update QUICHE from 408e786de to 0d1ce7087 (#36822) ci/rbe: Boost cpus for more integration tests (#36837) ci/coverage: Fix coverage flake in `source/extensions/common` (#36838) route: Downgrade advisory log message (#36797) runtime: deprecate validate_grpc_header (#36757) rbe/ci: Bump cpus for kv/store integration test (#36834) deps: Bump `build_bazel_rules_apple` -> 3.10.0 (#36833) protobuf.patch: a bunch of updates, mostly backports (#36823) coverage: loosen (#36830) ci/rbe: Boost cpu/mem for more integration tests (#36825) deps: Bump `com_github_awslabs_aws_c_auth` -> 0.8.0 (#36827) deps: Bump `aspect_bazel_lib` -> 2.9.3 (#36726) deps/api: Bump `dev_cel` -> 0.18.0 (#36826) build(deps): bump slack-sdk from 3.33.1 to 3.33.2 in /tools/base (#36824) router: clean up unnecessary field (#36814) request id: minor optimization or fix to the request id logic (#36773) deps: Bump `com_github_nghttp2_nghttp2` -> 1.64.0 (#36743) Set resource `telemetry.sdk.*` and scope `otel.scope.name|version` attributes for the OpenTelemetry tracer (#36787) Backport grpc change to fix some protoc warnings (#36795) wasm: restart wasm vm if it's failed because runtime error (#36456) deps: Bump `rules_python` -> 0.37.1 (#36817) proxy_protocol: use no-throw addresses to remove exception handling (#36815) tools/python: Remove unused loading of old py macro (#36820) tools/python: Use newer `entry_point` rule (#36803) ci/codeql: Only run on main branch (#36806) ci/rbe: Adjust keepalives for cache (envoy and mobile) (#36810) ci/rbe: Boost cpus for a couple more integration tests (#36807) tls: support IP SANs for IP versions not supported by host OS (#36770) dynamic_modules: scaffolds config API & HTTP Filter (#36448) Refactor UDP proxy to support deferred cluster selection (#36700) coverage: ratcheting (#36762) quic: remove runtime guard and code for legacy cert handling (#36772) Deprecating and removing envoy.reloadable_features.edf_lb_host_scheduler_init_fix (#36794) build(deps): bump actions/checkout from 4.2.1 to 4.2.2 (#36798) [balsa] Add runtime flag for http_inspector parser (#36672) tls: reduce memory use per connection by 712 bytes (#36767) ci/tests: Boost more worker cores for flakey integration tests (#36793) bump cel-cpp (#36661) ci/tests: Revert some integration tests to `2core` (#36784) mobile: resolving how forcev6 works on mobile platforms (#36732) build(deps): bump github/codeql-action from 3.26.13 to 3.27.0 (#36774) build(deps): bump protobuf from 5.28.2 to 5.28.3 in /tools/base (#36775) build(deps): bump orjson from 3.10.9 to 3.10.10 in /tools/base (#36776) ci/macos: Increase timeout to 120m (#36719) ci/coverage: Remove more cruft in diskspace hack (#36720) aws: async bugfix for multiple credential handlers in upstream mode (#36707) Allow empty resolver list for cares dns (#36735) runtime: removing dns_reresolve_on_eai_again (#36656) mobile: Adds proxy.pac to test PAC file URL (#36765) ci/rbe: Switch rbe pools `2core` -> `6gig` (#36761) ocsp/formatting: Fix format issue in generated cert (#36763) deps: Switch hosting server for kafka server binary download (#36748) test/ocsp: Renew certificates (#36755) upstream: removing exceptions from hostimpl (#36582) deps: Bump `rules_rust` -> 0.53.0 (#36727) deps: Bump `rules_jvm_external` -> 6.4 (#36721) build(deps): bump actions/dependency-review-action from 4.3.4 to 4.3.5 (#36740) Add support for OtherName, Email SAN substitution formatters (#36502) wasm: remove redundant xds attributes (#36619) apple_dns: Add DNS query trace (#36678) mobile: Fixes for the Apple PAC proxy resolver (#36698) mobile: change to being more aggressive about HTTP/3 retries (#36734) ci/rbe: Switch backend RBE cluster (#36730) deps/release: Bump Ubuntu -> 0e5e4a5 (#36723) Fix documentation for TcpProxy.metadata_match (#36683) build: fix compile commands generation (#36693) add test suites for classes in hash_policy.cc file (#36708) router: remove send_local_reply_when_no_buffer_and_upstream_request guard (#36620) mobile: add knob for h3 keepalive (#36646) test: Add a knob to disable admin server in IntegrationTestServer (#36684) build(deps): bump orjson from 3.10.7 to 3.10.9 in /tools/base (#36714) build(deps): bump envoy-base-utils from 0.5.5 to 0.5.6 in /tools/base (#36690) build(deps): bump cryptography from 43.0.1 to 43.0.3 in /tools/base (#36715) aws_signing: support for dynamically configurable credential (#36217) http: initializes a field of ConnectionManagerImpl::ActiveStream::State. (#36642) test: deflake an integration test (#36674) ci/rbe: Use engflow for non-coverage checks (#36687) xds-failover: fixing runtime feature flag in tests (#36659) security-release: update the q3 release record (#36689) Signed-off-by: tedjpoole <[email protected]>
envoyproxy · Oct 27, 2024 · 1e0c46e · 1e0c46e
2 parents 359eb83 + 8ffdf98
commit 1e0c46e
Show file tree

Hide file tree

Showing 616 changed files with 7,409 additions and 4,742 deletions.
diff --git a/.bazelrc b/.bazelrc
@@ -505,7 +505,8 @@ build:rbe-engflow --remote_executor=grpcs://envoy.cluster.engflow.com
 build:rbe-engflow --bes_backend=grpcs://envoy.cluster.engflow.com/
 build:rbe-engflow --bes_results_url=https://envoy.cluster.engflow.com/invocation/
 build:rbe-engflow --credential_helper=*.engflow.com=%workspace%/bazel/engflow-bazel-credential-helper.sh
-build:rbe-engflow --grpc_keepalive_time=30s
+build:rbe-engflow --grpc_keepalive_time=60s
+build:rbe-engflow --grpc_keepalive_timeout=30s
 build:rbe-engflow --remote_timeout=3600s
 build:rbe-engflow --bes_timeout=3600s
 build:rbe-engflow --bes_upload_mode=fully_async
@@ -514,16 +515,17 @@ build:rbe-engflow --nolegacy_important_outputs
 # RBE (Engflow Envoy)
 build:common-envoy-engflow --google_default_credentials=false
 build:common-envoy-engflow --credential_helper=*.engflow.com=%workspace%/bazel/engflow-bazel-credential-helper.sh
-build:common-envoy-engflow --grpc_keepalive_time=30s
+build:common-envoy-engflow --grpc_keepalive_time=60s
+build:common-envoy-engflow --grpc_keepalive_timeout=30s
 
-build:cache-envoy-engflow --remote_cache=grpcs://morganite.cluster.engflow.com
+build:cache-envoy-engflow --remote_cache=grpcs://mordenite.cluster.engflow.com
 build:cache-envoy-engflow --remote_timeout=3600s
-build:bes-envoy-engflow --bes_backend=grpcs://morganite.cluster.engflow.com/
-build:bes-envoy-engflow --bes_results_url=https://morganite.cluster.engflow.com/invocation/
+build:bes-envoy-engflow --bes_backend=grpcs://mordenite.cluster.engflow.com/
+build:bes-envoy-engflow --bes_results_url=https://mordenite.cluster.engflow.com/invocation/
 build:bes-envoy-engflow --bes_timeout=3600s
 build:bes-envoy-engflow --bes_upload_mode=fully_async
 build:bes-envoy-engflow --nolegacy_important_outputs
-build:rbe-envoy-engflow --remote_executor=grpcs://morganite.cluster.engflow.com
+build:rbe-envoy-engflow --remote_executor=grpcs://mordenite.cluster.engflow.com
 build:rbe-envoy-engflow --remote_default_exec_properties=container-image=docker://gcr.io/envoy-ci/envoy-build@sha256:7adc40c09508f957624c4d2e0f5aeecb73a59207ee6ded53b107eac828c091b2
 build:rbe-envoy-engflow --jobs=200
 build:rbe-envoy-engflow --define=engflow_rbe=true

diff --git a/.github/workflows/_check_build.yml b/.github/workflows/_check_build.yml
@@ -5,9 +5,6 @@ permissions:
 
 on:
   workflow_call:
-    secrets:
-      gcp-key:
-        required: true
     inputs:
       request:
         type: string
@@ -23,15 +20,13 @@ concurrency:
 
 jobs:
   build:
-    secrets:
-      gcp-key: ${{ secrets.gcp-key }}
     permissions:
       contents: read
       packages: read
     uses: ./.github/workflows/_run.yml
     name: ${{ matrix.name ||matrix.target }}
     with:
-      # bazel-extra: '--config=remote-envoy-engflow'
+      bazel-extra: '--config=remote-envoy-engflow'
       cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
       concurrency-suffix: -${{ matrix.target }}
       error-match: |

diff --git a/.github/workflows/_check_coverage.yml b/.github/workflows/_check_coverage.yml
@@ -35,6 +35,7 @@ jobs:
       cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
       concurrency-suffix: -${{ matrix.target }}
       diskspace-hack: ${{ matrix.diskspace-hack || false }}
+      diskspace-hack-paths: ${{ matrix.diskspace-hack-paths || '' }}
       error-match: |
         ERROR
         error:
@@ -58,5 +59,8 @@ jobs:
         - target: coverage
           name: Coverage
           diskspace-hack: true
+          diskspace-hack-paths: |
+            /opt/hostedtoolcache
+            /usr/local
         - target: fuzz_coverage
           name: Fuzz coverage
diff --git a/.github/workflows/_check_san.yml b/.github/workflows/_check_san.yml
@@ -5,9 +5,6 @@ permissions:
 
 on:
   workflow_call:
-    secrets:
-      gcp-key:
-        required: true
     inputs:
       request:
         type: string
@@ -23,15 +20,13 @@ concurrency:
 
 jobs:
   san:
-    secrets:
-      gcp-key: ${{ secrets.gcp-key }}
     permissions:
       contents: read
       packages: read
     uses: ./.github/workflows/_run.yml
     name: ${{ matrix.target }}
     with:
-      # bazel-extra: '--config=remote-envoy-engflow'
+      bazel-extra: '--config=remote-envoy-engflow'
       cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
       concurrency-suffix: -${{ matrix.target }}
       request: ${{ inputs.request }}

diff --git a/.github/workflows/_precheck_deps.yml b/.github/workflows/_precheck_deps.yml
@@ -51,9 +51,9 @@ jobs:
     if: ${{ inputs.dependency-review }}
     steps:
     - name: Checkout Repository
-      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         ref: ${{ fromJSON(inputs.request).request.sha }}
         persist-credentials: false
     - name: Dependency Review
-      uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c  # v4.3.4
+      uses: actions/dependency-review-action@a6993e2c61fd5dc440b409aa1d6904921c5e1894  # v4.3.5
diff --git a/.github/workflows/codeql-daily.yml b/.github/workflows/codeql-daily.yml
@@ -27,14 +27,14 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
 
     - name: Free disk space
       uses: envoyproxy/toolshed/gh-actions/[email protected]
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@f779452ac5af1c261dce0346a8f964149f49322b  # codeql-bundle-v3.26.13
+      uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd  # codeql-bundle-v3.27.0
       # Override language selection by uncommenting this and choosing your languages
       with:
         languages: cpp
@@ -74,4 +74,4 @@ jobs:
         git clean -xdf
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@f779452ac5af1c261dce0346a8f964149f49322b  # codeql-bundle-v3.26.13
+      uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd  # codeql-bundle-v3.27.0
diff --git a/.github/workflows/codeql-push.yml b/.github/workflows/codeql-push.yml
@@ -8,9 +8,11 @@ on:
     paths:
     - include/**
     - source/common/**
-    branches-ignore:
-    - dependabot/**
+    branches:
+    - main
   pull_request:
+    branches:
+    - main
 
 concurrency:
   group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}
@@ -32,7 +34,7 @@ jobs:
     if: github.repository == 'envoyproxy/envoy'
     steps:
     - name: Checkout repository
-      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         fetch-depth: 2
 
@@ -65,7 +67,7 @@ jobs:
 
     - name: Initialize CodeQL
       if: ${{ env.BUILD_TARGETS != '' }}
-      uses: github/codeql-action/init@f779452ac5af1c261dce0346a8f964149f49322b  # codeql-bundle-v3.26.13
+      uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd  # codeql-bundle-v3.27.0
       with:
         languages: cpp
 
@@ -109,4 +111,4 @@ jobs:
 
     - name: Perform CodeQL Analysis
       if: ${{ env.BUILD_TARGETS != '' }}
-      uses: github/codeql-action/analyze@f779452ac5af1c261dce0346a8f964149f49322b  # codeql-bundle-v3.26.13
+      uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd  # codeql-bundle-v3.27.0
diff --git a/.github/workflows/envoy-checks.yml b/.github/workflows/envoy-checks.yml
@@ -41,8 +41,6 @@ jobs:
       # head-sha: ${{ github.sha }}
 
   build:
-    secrets:
-      gcp-key: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
     permissions:
       actions: read
       contents: read
@@ -75,8 +73,6 @@ jobs:
       trusted: ${{ fromJSON(needs.load.outputs.trusted) }}
 
   san:
-    secrets:
-      gcp-key: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
     permissions:
       actions: read
       contents: read

diff --git a/.github/workflows/envoy-dependency.yml b/.github/workflows/envoy-dependency.yml
@@ -146,7 +146,7 @@ jobs:
           path: envoy
           fetch-depth: 0
         token: ${{ steps.appauth.outputs.token }}
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       name: Checkout Envoy build tools repository
       with:
         repository: envoyproxy/envoy-build-tools
@@ -238,7 +238,7 @@ jobs:
       issues: write
     steps:
     - name: Checkout repository
-      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - name: Run dependency checker
       run: |
         TODAY_DATE=$(date -u -I"date")

diff --git a/.github/workflows/envoy-macos.yml b/.github/workflows/envoy-macos.yml
@@ -53,7 +53,7 @@ jobs:
       steps-pre: ${{ matrix.steps-pre }}
       target: ${{ matrix.target }}
       target-name: ${{ matrix.target-name }}
-      timeout-minutes: 90
+      timeout-minutes: 120
       trusted: ${{ fromJSON(needs.load.outputs.trusted) }}
     strategy:
       fail-fast: false

diff --git a/.github/workflows/mobile-release.yml b/.github/workflows/mobile-release.yml
@@ -86,7 +86,7 @@ jobs:
         include:
         - output: envoy
     steps:
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         fetch-depth: 0
     - name: Add safe directory

diff --git a/.github/workflows/mobile-traffic_director.yml b/.github/workflows/mobile-traffic_director.yml
@@ -30,7 +30,7 @@ jobs:
     timeout-minutes: 120
     steps:
     - name: Checkout repository
-      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - name: Add safe directory
       run: git config --global --add safe.directory /__w/envoy/envoy
     - name: 'Run GcpTrafficDirectorIntegrationTest'

diff --git a/.github/workflows/pr_notifier.yml b/.github/workflows/pr_notifier.yml
@@ -22,7 +22,7 @@ jobs:
               || !contains(github.actor, '[bot]'))
       }}
     steps:
-    - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
     - name: Notify about PRs
       run: |
         ARGS=()

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
     - name: "Checkout code"
-      uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871  # v4.2.1
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       with:
         persist-credentials: false
 
@@ -40,6 +40,6 @@ jobs:
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@f779452ac5af1c261dce0346a8f964149f49322b  # v3.26.13
+      uses: github/codeql-action/upload-sarif@662472033e021d55d94146f66f6058822b0b39fd  # v3.27.0
       with:
         sarif_file: results.sarif
diff --git a/CODEOWNERS b/CODEOWNERS
@@ -356,6 +356,7 @@ extensions/filters/http/oauth2 @derekargueta @mattklein123
 /*/extensions/filters/network/generic_proxy/ @wbpcode @soulxu
 # Dynamic Modules
 /*/extensions/dynamic_modules @mattklein123 @mathetake @marc-barry
+/*/extensions/filters/http/dynamic_modules @mattklein123 @mathetake @marc-barry
 
 # HTTP credential injector
 /*/extensions/filters/http/credential_injector @zhaohuabing @kyessenov

diff --git a/RELEASES.md b/RELEASES.md
@@ -66,6 +66,7 @@ actual mechanics of the release itself.
 | 2023 Q3 | Boteng Yao ([botengyao](https://github.com/botengyao))         | Kateryna Nezdolii ([nezdolik](https://github.com/nezdolik))              |
 | 2023 Q4 | Paul Merrison ([pmerrison](https://github.com/pmerrison))      | Brian Sonnenberg ([briansonnenberg](https://github.com/briansonnenberg)) |
 | 2024 Q2 | Ryan Northey ([phlax](https://github.com/phlax))               | Boteng Yao ([botengyao](https://github.com/botengyao))                   |
+| 2024 Q3 | Ryan Northey ([phlax](https://github.com/phlax))               | Boteng Yao ([botengyao](https://github.com/botengyao))                   |
 
 ## Major release schedule
 

diff --git a/api/BUILD b/api/BUILD
@@ -140,6 +140,7 @@ proto_library(
         "//envoy/extensions/clusters/dynamic_forward_proxy/v3:pkg",
         "//envoy/extensions/clusters/redis/v3:pkg",
         "//envoy/extensions/common/async_files/v3:pkg",
+        "//envoy/extensions/common/aws/v3:pkg",
         "//envoy/extensions/common/dynamic_forward_proxy/v3:pkg",
         "//envoy/extensions/common/matching/v3:pkg",
         "//envoy/extensions/common/ratelimit/v3:pkg",
@@ -151,6 +152,7 @@ proto_library(
         "//envoy/extensions/compression/zstd/compressor/v3:pkg",
         "//envoy/extensions/compression/zstd/decompressor/v3:pkg",
         "//envoy/extensions/config/validators/minimum_clusters/v3:pkg",
+        "//envoy/extensions/dynamic_modules/v3:pkg",
         "//envoy/extensions/early_data/v3:pkg",
         "//envoy/extensions/filters/common/dependency/v3:pkg",
         "//envoy/extensions/filters/common/fault/v3:pkg",
@@ -175,6 +177,7 @@ proto_library(
         "//envoy/extensions/filters/http/custom_response/v3:pkg",
         "//envoy/extensions/filters/http/decompressor/v3:pkg",
         "//envoy/extensions/filters/http/dynamic_forward_proxy/v3:pkg",
+        "//envoy/extensions/filters/http/dynamic_modules/v3:pkg",
         "//envoy/extensions/filters/http/ext_authz/v3:pkg",
         "//envoy/extensions/filters/http/ext_proc/v3:pkg",
         "//envoy/extensions/filters/http/fault/v3:pkg",

diff --git a/api/bazel/repository_locations.bzl b/api/bazel/repository_locations.bzl
@@ -38,11 +38,11 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "Java Rules for Bazel",
         project_desc = "Bazel rules for Java",
         project_url = "https://github.com/bazelbuild/rules_jvm_external",
-        version = "6.2",
+        version = "6.4",
         strip_prefix = "rules_jvm_external-{version}",
-        sha256 = "808cb5c30b5f70d12a2a745a29edc46728fd35fa195c1762a596b63ae9cebe05",
+        sha256 = "85776be6d8fe64abf26f463a8e12cd4c15be927348397180a01693610da7ec90",
         urls = ["https://github.com/bazelbuild/rules_jvm_external/releases/download/{version}/rules_jvm_external-{version}.tar.gz"],
-        release_date = "2024-07-04",
+        release_date = "2024-09-18",
         use_category = ["build"],
         license = "Apache-2.0",
         license_url = "https://github.com/bazelbuild/rules_jvm_external/blob/{version}/LICENSE",
@@ -169,11 +169,11 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_desc = "Common Expression Language -- specification and binary representation",
         project_url = "https://github.com/google/cel-spec",
         strip_prefix = "cel-spec-{version}",
-        sha256 = "ad735dcea00992c36c7e94a56bceebedad475a01ee63b49c6796c1fcb7b6a41c",
-        version = "0.16.2",
+        sha256 = "669b0208f88c15239aa7289faef4d807b3d2d8efcd0961a782e4426e0855dc19",
+        version = "0.18.0",
         urls = ["https://github.com/google/cel-spec/archive/v{version}.tar.gz"],
         use_category = ["api"],
-        release_date = "2024-09-18",
+        release_date = "2024-10-23",
     ),
     envoy_toolshed = dict(
         project_name = "envoy_toolshed",

diff --git a/api/envoy/config/core/v3/protocol.proto b/api/envoy/config/core/v3/protocol.proto
@@ -39,19 +39,16 @@ message QuicKeepAliveSettings {
   //
   // If zero, disable keepalive probing.
   // If absent, use the QUICHE default interval to probe.
-  google.protobuf.Duration max_interval = 1 [(validate.rules).duration = {
-    lte {}
-    gte {seconds: 1}
-  }];
+  google.protobuf.Duration max_interval = 1;
 
   // The interval to send the first few keep-alive probing packets to prevent connection from hitting the idle timeout. Subsequent probes will be sent, each one with an interval exponentially longer than previous one, till it reaches :ref:`max_interval <envoy_v3_api_field_config.core.v3.QuicKeepAliveSettings.max_interval>`. And the probes afterwards will always use :ref:`max_interval <envoy_v3_api_field_config.core.v3.QuicKeepAliveSettings.max_interval>`.
   //
   // The value should be smaller than :ref:`connection idle_timeout <envoy_v3_api_field_config.listener.v3.QuicProtocolOptions.idle_timeout>` to prevent idle timeout and smaller than max_interval to take effect.
   //
-  // If absent or zero, disable keepalive probing for a server connection. For a client connection, if :ref:`max_interval <envoy_v3_api_field_config.core.v3.QuicKeepAliveSettings.max_interval>`  is also zero, do not keepalive, otherwise use max_interval or QUICHE default to probe all the time.
+  // If absent, disable keepalive probing for a server connection. For a client connection, if :ref:`max_interval <envoy_v3_api_field_config.core.v3.QuicKeepAliveSettings.max_interval>` is zero, do not keepalive, otherwise use max_interval or QUICHE default to probe all the time.
   google.protobuf.Duration initial_interval = 2 [(validate.rules).duration = {
     lte {}
-    gte {seconds: 1}
+    gte {nanos: 1000000}
   }];
 }
 

diff --git a/api/envoy/extensions/common/aws/v3/BUILD b/api/envoy/extensions/common/aws/v3/BUILD
@@ -0,0 +1,9 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = ["@com_github_cncf_xds//udpa/annotations:pkg"],
+)