envoy: Bump to version v1.38.3

.bazelignore

@@ -0,0 +1 @@
+.cache

.gitignore

@@ -1,5 +1,6 @@
 # Dot files, disallow by default, and enable explicitly
 \.*
+!/\.bazelignore
 !\.bazelrc
 !\.bazelversion
 !\.clangd

ENVOY_VERSION

@@ -1 +1 @@
-envoy-1.37.5
+envoy-1.38.3

Makefile

@@ -126,13 +126,16 @@ clang.bazelrc: bazel/setup_clang.sh
 	bazel/setup_clang.sh /usr/lib/llvm-18
 	echo "# Use system LLVM instead of hermetic download to avoid libtinfo.so.5 mismatch" >> $@
 	echo "build:clang-local --repo_env=BAZEL_LLVM_PATH=/usr/lib/llvm-18" >> $@
+	echo "# Disable module_maps/layering_check — abseil module maps are incompatible with system clang" >> $@
+	echo "build:clang-local --features=-module_maps --features=-layering_check" >> $@
+	echo "build:clang-local --host_features=-module_maps --host_features=-layering_check" >> $@
 	echo "build --config=clang-local" >> $@
 
 .PHONY: cargo-repin
 cargo-repin: install-bazelisk
 	@$(ECHO_BAZEL)
 	test -e bazel/envoy_dynamic_modules_rust_sdk.Cargo.Bazel.lock || touch bazel/envoy_dynamic_modules_rust_sdk.Cargo.Bazel.lock
-	CARGO_BAZEL_REPIN=workspace CARGO_BAZEL_REPIN_ONLY=dynamic_modules_rust_sdk_crate_index bazel $(BAZEL_OPTS) sync --only=dynamic_modules_rust_sdk_crate_index
+	CARGO_BAZEL_REPIN=workspace CARGO_BAZEL_REPIN_ONLY=envoy_rust_crate_index bazel $(BAZEL_OPTS) sync --only=envoy_rust_crate_index
 
 .PHONY: bazel-bin/cilium-envoy
 bazel-bin/cilium-envoy: $(COMPILER_DEP) SOURCE_VERSION install-bazelisk

Makefile.api

@@ -24,9 +24,9 @@ PROTO_DEPS = \
 	-I bazel-proxy/external/com_google_protobuf/src \
 	-I bazel-proxy/external/com_google_googleapis \
 	-I bazel-proxy/external/com_envoyproxy_protoc_gen_validate \
-	-I bazel-proxy/external/opentelemetry_proto \
+	-I bazel-proxy/external/opentelemetry-proto \
 	-I bazel-proxy/external/prometheus_metrics_model \
-	-I bazel-proxy/external/com_github_cncf_xds \
+	-I bazel-proxy/external/xds \
 	-I bazel-proxy/external/dev_cel/proto
 
 GO_OUT = go

Makefile.dev

@@ -42,7 +42,7 @@ veryclean: force-non-root clean
 precheck: force-non-root
 	tools/check_repositories.sh
 
-FORMAT_EXCLUDED_PREFIXES = "./linux/" "./proxylib/" "./starter/"  "./vendor/" "./go/" "./envoy_build_config/" "./work/" "./bin/"
+FORMAT_EXCLUDED_PREFIXES = "./linux/" "./proxylib/" "./starter/"  "./vendor/" "./go/" "./envoy_build_config/" "./work/" "./bin/" "./.cache/"
 
 # The default set of sources assumes all relevant sources are dependecies of some tests!
 TIDY_SOURCES ?= $(shell bazel query 'kind("source file", deps(//tests/...))' 2>/dev/null | sed -n "s/\/\/cilium:/cilium\//p; s/\/\/tests:/tests\//p")
@@ -52,7 +52,6 @@ COMPILATION_DATABASE_DEPS = \
 	.bazelrc \
 	envoy.bazelrc \
 	bazel/BUILD \
-	bazel/envoy_dependency_imports.bzl \
 	bazel/local_llvm.bzl \
 	bazel/toolchains/BUILD \
 	bazel/toolchains/cc_toolchain_config.bzl \

WORKSPACE

@@ -12,8 +12,8 @@ ENVOY_REPO = "envoy"
 #
 # No other line in this file may have ENVOY_SHA followed by an equals sign!
 #
-# renovate: datasource=github-releases depName=envoyproxy/envoy digestVersion=v1.37.5
-ENVOY_SHA = "f97695a50e11f5ff6719e129a466bf9204b64a7f"
+# renovate: datasource=github-releases depName=envoyproxy/envoy digestVersion=v1.38.3
+ENVOY_SHA = "0ebfcfe5b0484b89ca85b761da9e05ce75dbda8d"
 
 # // clang-format off: unexpected @bazel_tools reference, please indirect via a definition in //bazel
 load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
@@ -85,7 +85,7 @@ load("@envoy//bazel:python_dependencies.bzl", "envoy_python_dependencies")
 envoy_python_dependencies()
 
 load("@bazel_gazelle//:deps.bzl", "go_repository")
-load("//bazel:envoy_dependency_imports.bzl", "envoy_dependency_imports")
+load("@envoy//bazel:dependency_imports.bzl", "envoy_dependency_imports")
 
 go_repository(
     name = "org_golang_x_text",
@@ -127,23 +127,31 @@ go_repository(
     version = "v0.32.0",
 )
 
-envoy_dependency_imports()
+# rules_rust hashes the crate manifest label into the crate_universe lockfile, so
+# Envoy's own Cargo.Bazel.lock never matches when Envoy is embedded as @envoy.
+# Point the crate index at a Cilium-owned lockfile instead. Refresh it with
+# `make cargo-repin` whenever Envoy changes its Rust dependencies.
+envoy_dependency_imports(
+    cargo_bazel_lockfile = "@//bazel:envoy_dynamic_modules_rust_sdk.Cargo.Bazel.lock",
+)
 
 load("@envoy//bazel:repo.bzl", "envoy_repo")
 
 envoy_repo()
 
-load("@envoy//bazel:toolchains.bzl", "envoy_toolchains")
-
-envoy_toolchains()
-
-# When BAZEL_LLVM_PATH is set, envoy_toolchains() skips creating the
-# llvm_toolchain_llvm repo, but envoy's clang-format target still depends on it.
-# Provide it only if it wasn't already created.
+# Pre-create @llvm_toolchain_llvm from the local LLVM (BAZEL_LLVM_PATH) BEFORE
+# envoy_toolchains(). envoy_toolchains() (and toolchains_llvm's llvm_toolchain())
+# only create @llvm_toolchain_llvm when it does not already exist, and the repo
+# envoy would create lacks the //:clang-format target that the format check needs.
+# Providing a complete repo here makes both compilation and the format check work.
 load("//bazel:local_llvm.bzl", "local_llvm_repo")
 
 local_llvm_repo(name = "llvm_toolchain_llvm")
 
+load("@envoy//bazel:toolchains.bzl", "envoy_toolchains")
+
+envoy_toolchains()
+
 load("@envoy//bazel:dependency_imports_extra.bzl", "envoy_dependency_imports_extra")
 
 envoy_dependency_imports_extra()