Remove useless patch files and fix some issues of envoy&istio (#1263)

2026-02-06 23:21:08 +08:00 · 2024-08-30 19:18:18 +08:00
parent abefb35ffb
commit d0ac5946bb
69 changed files with 4 additions and 123475 deletions
--- a/Makefile.core.mk
+++ b/Makefile.core.mk
@@ -180,8 +180,8 @@ install: pre-install
 	cd helm/higress; helm dependency build
 	helm install higress helm/higress -n higress-system --create-namespace --set 'global.local=true'

-ENVOY_LATEST_IMAGE_TAG ?= 580eb0ffc45b1f62a79744f3ae0e6463bf539931
-ISTIO_LATEST_IMAGE_TAG ?= 580eb0ffc45b1f62a79744f3ae0e6463bf539931
+ENVOY_LATEST_IMAGE_TAG ?= a6c313d41b3b54f0e3ed81fc676c520160cfed05
+ISTIO_LATEST_IMAGE_TAG ?= a6c313d41b3b54f0e3ed81fc676c520160cfed05

 install-dev: pre-install
 	helm install higress helm/core -n higress-system --create-namespace --set 'controller.tag=$(TAG)' --set 'gateway.replicas=1' --set 'pilot.tag=$(ISTIO_LATEST_IMAGE_TAG)' --set 'gateway.tag=$(ENVOY_LATEST_IMAGE_TAG)' --set 'global.local=true'
--- a/envoy/1.20/patches/envoy/20221027-init.patch
+++ b/envoy/1.20/patches/envoy/20221027-init.patch
--- a/envoy/1.20/patches/envoy/20230201-wasi-stub.patch
+++ b/envoy/1.20/patches/envoy/20230201-wasi-stub.patch
@@ -1,101 +0,0 @@
-diff --git a/bazel/foreign_cc/proxy_wasm_cpp_host.patch b/bazel/foreign_cc/proxy_wasm_cpp_host.patch
-new file mode 100644
-index 0000000000..a586116e84
--- /dev/null
-+++ b/bazel/foreign_cc/proxy_wasm_cpp_host.patch
-@@ -0,0 +1,78 @@
-+diff --git a/include/proxy-wasm/exports.h b/include/proxy-wasm/exports.h
-+index ded6419..334cee4 100644
-+--- a/include/proxy-wasm/exports.h
-++++ b/include/proxy-wasm/exports.h
-+@@ -129,6 +129,11 @@ Word call_foreign_function(Word function_name, Word function_name_size, Word arg
-+ 
-+ // Runtime environment functions exported from envoy to wasm.
-+ 
-++Word wasi_unstable_path_open(Word fd, Word dir_flags, Word path, Word path_len, Word oflags,
-++                             int64_t fs_rights_base, int64_t fg_rights_inheriting, Word fd_flags,
-++                             Word nwritten_ptr);
-++Word wasi_unstable_fd_prestat_get(Word fd, Word buf_ptr);
-++Word wasi_unstable_fd_prestat_dir_name(Word fd, Word path_ptr, Word path_len);
-+ Word wasi_unstable_fd_write(Word fd, Word iovs, Word iovs_len, Word nwritten_ptr);
-+ Word wasi_unstable_fd_read(Word, Word, Word, Word);
-+ Word wasi_unstable_fd_seek(Word, int64_t, Word, Word);
-+@@ -166,7 +171,7 @@ Word pthread_equal(Word left, Word right);
-+ #define FOR_ALL_WASI_FUNCTIONS(_f)                                                                 \
-+   _f(fd_write) _f(fd_read) _f(fd_seek) _f(fd_close) _f(fd_fdstat_get) _f(environ_get)              \
-+       _f(environ_sizes_get) _f(args_get) _f(args_sizes_get) _f(clock_time_get) _f(random_get)      \
-+-          _f(proc_exit)
-++          _f(proc_exit) _f(path_open) _f(fd_prestat_get) _f(fd_prestat_dir_name)
-+ 
-+ // Helpers to generate a stub to pass to VM, in place of a restricted proxy-wasm capability.
-+ #define _CREATE_PROXY_WASM_STUB(_fn)                                                               \
-+diff --git a/include/proxy-wasm/wasm_vm.h b/include/proxy-wasm/wasm_vm.h
-+index c02bb6e..c13c78c 100644
-+--- a/include/proxy-wasm/wasm_vm.h
-++++ b/include/proxy-wasm/wasm_vm.h
-+@@ -110,6 +110,8 @@ using WasmCallback_WWl = Word (*)(Word, int64_t);
-+ using WasmCallback_WWlWW = Word (*)(Word, int64_t, Word, Word);
-+ using WasmCallback_WWm = Word (*)(Word, uint64_t);
-+ using WasmCallback_WWmW = Word (*)(Word, uint64_t, Word);
-++using WasmCallback_WWWWWWllWW = Word (*)(Word, Word, Word, Word, Word, int64_t, int64_t, Word,
-++                                         Word);
-+ using WasmCallback_dd = double (*)(double);
-+ 
-+ #define FOR_ALL_WASM_VM_IMPORTS(_f)                                                                \
-+@@ -127,7 +129,8 @@ using WasmCallback_dd = double (*)(double);
-+                                               _f(proxy_wasm::WasmCallback_WWlWW)                   \
-+                                                   _f(proxy_wasm::WasmCallback_WWm)                 \
-+                                                       _f(proxy_wasm::WasmCallback_WWmW)            \
-+-                                                          _f(proxy_wasm::WasmCallback_dd)
-++                                                          _f(proxy_wasm::WasmCallback_WWWWWWllWW)  \
-++                                                              _f(proxy_wasm::WasmCallback_dd)
-+ 
-+ enum class Cloneable {
-+   NotCloneable,      // VMs can not be cloned and should be created from scratch.
-+diff --git a/src/exports.cc b/src/exports.cc
-+index 0922b2d..d597914 100644
-+--- a/src/exports.cc
-++++ b/src/exports.cc
-+@@ -648,6 +648,25 @@ Word grpc_send(Word token, Word message_ptr, Word message_size, Word end_stream)
-+   return context->grpcSend(token, message.value(), end_stream);
-+ }
-+ 
-++// __wasi_errno_t path_open(__wasi_fd_t fd, __wasi_lookupflags_t dirflags, const char *path,
-++// size_t path_len, __wasi_oflags_t oflags, __wasi_rights_t fs_rights_base, __wasi_rights_t
-++// fs_rights_inheriting, __wasi_fdflags_t fdflags, __wasi_fd_t *retptr0)
-++Word wasi_unstable_path_open(Word fd, Word dir_flags, Word path, Word path_len, Word oflags,
-++                             int64_t fs_rights_base, int64_t fg_rights_inheriting, Word fd_flags,
-++                             Word nwritten_ptr) {
-++  return 44; // __WASI_ERRNO_NOENT
-++}
-++
-++// __wasi_errno_t __wasi_fd_prestat_get(__wasi_fd_t fd, __wasi_prestat_t *retptr0)
-++Word wasi_unstable_fd_prestat_get(Word fd, Word buf_ptr) {
-++  return 8; // __WASI_ERRNO_BADF
-++}
-++
-++// __wasi_errno_t __wasi_fd_prestat_dir_name(__wasi_fd_t fd, uint8_t * path, __wasi_size_t path_len)
-++Word wasi_unstable_fd_prestat_dir_name(Word fd, Word path_ptr, Word path_len) {
-++  return 52; // __WASI_ERRNO_ENOSYS
-++}
-++
-+ // Implementation of writev-like() syscall that redirects stdout/stderr to Envoy
-+ // logs.
-+ Word writevImpl(Word fd, Word iovs, Word iovs_len, Word *nwritten_ptr) {
-diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
-index bfef00ac85..806100b42d 100644
--- a/bazel/repositories.bzl
-+++ b/bazel/repositories.bzl
-@@ -943,7 +943,11 @@ def _proxy_wasm_cpp_sdk():
-     external_http_archive(name = "proxy_wasm_cpp_sdk")
- 
- def _proxy_wasm_cpp_host():
-    external_http_archive(name = "proxy_wasm_cpp_host")
-+    external_http_archive(
-+        name = "proxy_wasm_cpp_host",
-+        patches = ["@envoy//bazel/foreign_cc:proxy_wasm_cpp_host.patch"],
-+        patch_args = ["-p1"],
-+    )
- 
- def _emscripten_toolchain():
-     external_http_archive(
--- a/envoy/1.20/patches/envoy/20230408-basic-auth.patch
+++ b/envoy/1.20/patches/envoy/20230408-basic-auth.patch
@@ -1,55 +0,0 @@
-diff -Naur envoy/bazel/envoy_binary.bzl envoy-new/bazel/envoy_binary.bzl
--- envoy/bazel/envoy_binary.bzl	2023-04-08 20:52:57.041729111 +0800
-+++ envoy-new/bazel/envoy_binary.bzl	2023-04-08 20:50:53.657603065 +0800
-@@ -80,7 +80,7 @@
-         "@envoy//bazel:boringssl_fips": [],
-         "@envoy//bazel:windows_x86_64": [],
-         "//conditions:default": ["-pie"],
-    }) + _envoy_select_exported_symbols(["-Wl,-E"])
-+    }) + _envoy_select_exported_symbols(["-Wl,-E"]) + envoy_select_alimesh(["-lcrypt"])
- 
- def _envoy_stamped_deps():
-     return select({
-diff -Naur envoy/bazel/repositories.bzl envoy-new/bazel/repositories.bzl
--- envoy/bazel/repositories.bzl	2023-04-08 20:52:57.085730582 +0800
-+++ envoy-new/bazel/repositories.bzl	2023-04-08 20:27:20.110335884 +0800
-@@ -272,6 +272,8 @@
-         actual = "@bazel_tools//tools/cpp/runfiles",
-     )
- 
-+    _com_github_higress_wasm_extensions()
-+
- def _boringssl():
-     external_http_archive(
-         name = "boringssl",
-@@ -1066,6 +1068,17 @@
-         actual = "@com_github_wasm_c_api//:wasmtime_lib",
-     )
- 
-+def _com_github_higress_wasm_extensions():
-+    native.local_repository(
-+        name = "com_github_higress_wasm_extensions",
-+        path = "../../wasm-cpp",
-+    )
-+
-+    native.bind(
-+        name = "basic_auth_lib",
-+        actual = "@com_github_higress_wasm_extensions//extensions/basic_auth:basic_auth_lib",
-+    )
-+    
- def _rules_fuzzing():
-     external_http_archive(
-         name = "rules_fuzzing",
-diff -Naur envoy/source/exe/BUILD envoy-new/source/exe/BUILD
--- envoy/source/exe/BUILD	2023-04-08 20:52:57.053729512 +0800
-+++ envoy-new/source/exe/BUILD	2023-04-08 19:48:37.420667254 +0800
-@@ -43,6 +43,9 @@
-         "//bazel:darwin": envoy_all_extensions(DARWIN_SKIP_TARGETS),
-         "//conditions:default": envoy_all_extensions(),
-     }),
-+    alimesh_deps = [
-+        "//external:basic_auth_lib",
-+    ],
- )
- 
- envoy_cc_library(
--- a/envoy/1.20/patches/envoy/20231008-fallback-origin-cluster.patch
+++ b/envoy/1.20/patches/envoy/20231008-fallback-origin-cluster.patch
@@ -1,111 +0,0 @@
-diff -Naur envoy/contrib/custom_cluster_plugins/cluster_fallback/source/filter.cc envoy-new/contrib/custom_cluster_plugins/cluster_fallback/source/filter.cc
--- envoy/contrib/custom_cluster_plugins/cluster_fallback/source/filter.cc	2023-10-08 15:01:21.960871500 +0800
-+++ envoy-new/contrib/custom_cluster_plugins/cluster_fallback/source/filter.cc	2023-09-27 17:03:41.613256338 +0800
-@@ -60,7 +60,7 @@
- 
-   for (const auto& cluster_name : first_item->second) {
-     if (hasHealthHost(cluster_name)) {
-      return base.clone(cluster_name);
-+      return base.clone(cluster_name, first_item->first);
-     }
-   }
- 
-@@ -75,7 +75,8 @@
- 
-   auto search = clusters_config_.find(route_entry.clusterName());
-   if (search == clusters_config_.end()) {
-    ENVOY_LOG(warn, "there is no fallback cluster config, the original routing cluster is returned");
-+    ENVOY_LOG(warn,
-+              "there is no fallback cluster config, the original routing cluster is returned");
-     return cluster_entry.getRouteConstSharedPtr();
-   }
- 
-@@ -87,7 +88,7 @@
- 
-   for (const auto& cluster_name : search->second) {
-     if (hasHealthHost(cluster_name)) {
-      return cluster_entry.clone(cluster_name);
-+      return cluster_entry.clone(cluster_name, search->first);
-     }
-   }
- 
-diff -Naur envoy/source/common/http/headers.h envoy-new/source/common/http/headers.h
--- envoy/source/common/http/headers.h	2023-10-08 15:01:21.968871828 +0800
-+++ envoy-new/source/common/http/headers.h	2023-09-27 18:48:50.059419606 +0800
-@@ -124,6 +124,7 @@
-     const LowerCaseString TriStartTime{"req-start-time"};
-     const LowerCaseString TriRespStartTime{"resp-start-time"};
-     const LowerCaseString EnvoyOriginalHost{"original-host"};
-+    const LowerCaseString HigressOriginalService{"x-higress-original-service"};
-   } AliExtendedValues;
- #endif
- };
-diff -Naur envoy/source/common/router/config_impl.cc envoy-new/source/common/router/config_impl.cc
--- envoy/source/common/router/config_impl.cc	2023-10-08 15:01:21.968871828 +0800
-+++ envoy-new/source/common/router/config_impl.cc	2023-09-27 18:49:18.656592237 +0800
-@@ -563,7 +563,6 @@
-         route.name());
-   }
-   // End Added
-
- }
- 
- bool RouteEntryImplBase::evaluateRuntimeMatch(const uint64_t random_value) const {
-@@ -662,6 +661,10 @@
-   }
- 
- #if defined(ALIMESH)
-+  if (!origin_cluster_name_.empty()) {
-+    headers.addCopy(Http::CustomHeaders::get().AliExtendedValues.HigressOriginalService,
-+                    origin_cluster_name_);
-+  }
-   headers.setReferenceKey(Http::CustomHeaders::get().AliExtendedValues.EnvoyOriginalHost,
-                           headers.getHostValue());
- #endif
-diff -Naur envoy/source/common/router/config_impl.h envoy-new/source/common/router/config_impl.h
--- envoy/source/common/router/config_impl.h	2023-10-08 15:01:21.968871828 +0800
-+++ envoy-new/source/common/router/config_impl.h	2023-09-27 18:59:11.196893507 +0800
-@@ -584,9 +584,13 @@
-     return internal_active_redirect_policy_;
-   }
- 
-  RouteConstSharedPtr clone(const std::string& name) const {
-    return std::make_shared<DynamicRouteEntry>(this, name);
-+  RouteConstSharedPtr clone(const std::string& name, const std::string& origin_cluster = "") const {
-+    auto entry = std::make_shared<DynamicRouteEntry>(this, name);
-+    entry->setOriginClusterName(origin_cluster);
-+    return entry;
-   }
-+
-+  void setOriginClusterName(const std::string& name) const { origin_cluster_name_ = name; }
- #endif
-   uint32_t retryShadowBufferLimit() const override { return retry_shadow_buffer_limit_; }
-   const std::vector<ShadowPolicyPtr>& shadowPolicies() const override { return shadow_policies_; }
-@@ -787,11 +791,17 @@
-       return parent_->internalActiveRedirectPolicy();
-     }
- 
-    RouteConstSharedPtr clone(const std::string& name) const {
-      return std::make_shared<Envoy::Router::RouteEntryImplBase::DynamicRouteEntry>(parent_, name);
-+    RouteConstSharedPtr clone(const std::string& name,
-+                              const std::string& origin_cluster = "") const {
-+      auto entry =
-+          std::make_shared<Envoy::Router::RouteEntryImplBase::DynamicRouteEntry>(parent_, name);
-+      entry->setOriginClusterName(origin_cluster);
-+      return entry;
-     }
- 
-     virtual RouteConstSharedPtr getRouteConstSharedPtr() const { return shared_from_this(); }
-+
-+    void setOriginClusterName(const std::string& name) { parent_->setOriginClusterName(name); }
- #endif
- 
-   private:
-@@ -1039,6 +1049,7 @@
- 
- #if defined(ALIMESH)
-   const InternalActiveRedirectPoliciesImpl internal_active_redirect_policy_;
-+  mutable std::string origin_cluster_name_;
- #endif
- };
- 
--- a/envoy/1.20/patches/envoy/20231124-rds-optimize.patch
+++ b/envoy/1.20/patches/envoy/20231124-rds-optimize.patch
@@ -1,315 +0,0 @@
-diff -Naur envoy/envoy/router/rds.h envoy-new/envoy/router/rds.h
--- envoy/envoy/router/rds.h	2023-11-24 10:52:39.914235488 +0800
-+++ envoy-new/envoy/router/rds.h	2023-11-24 10:47:36.293873127 +0800
-@@ -51,12 +51,6 @@
-   virtual void onConfigUpdate() PURE;
- 
-   /**
-   * Validate if the route configuration can be applied to the context of the route config provider.
-   */
-  virtual void
-  validateConfig(const envoy::config::route::v3::RouteConfiguration& config) const PURE;
-
-  /**
-    * Callback used to request an update to the route configuration from the management server.
-    * @param for_domain supplies the domain name that virtual hosts must match on
-    * @param thread_local_dispatcher thread-local dispatcher
-diff -Naur envoy/envoy/router/route_config_update_receiver.h envoy-new/envoy/router/route_config_update_receiver.h
--- envoy/envoy/router/route_config_update_receiver.h	2023-11-24 10:52:39.918235651 +0800
-+++ envoy-new/envoy/router/route_config_update_receiver.h	2023-11-24 10:47:36.293873127 +0800
-@@ -27,6 +27,7 @@
-    * @param rc supplies the RouteConfiguration.
-    * @param version_info supplies RouteConfiguration version.
-    * @return bool whether RouteConfiguration has been updated.
-+   * @throw EnvoyException if the new config can't be applied.
-    */
-   virtual bool onRdsUpdate(const envoy::config::route::v3::RouteConfiguration& rc,
-                            const std::string& version_info) PURE;
-diff -Naur envoy/source/common/router/rds_impl.cc envoy-new/source/common/router/rds_impl.cc
--- envoy/source/common/router/rds_impl.cc	2023-11-24 10:52:40.194246888 +0800
-+++ envoy-new/source/common/router/rds_impl.cc	2023-11-24 10:47:36.293873127 +0800
-@@ -122,9 +122,6 @@
-     throw EnvoyException(fmt::format("Unexpected RDS configuration (expecting {}): {}",
-                                      route_config_name_, route_config.name()));
-   }
-  if (route_config_provider_opt_.has_value()) {
-    route_config_provider_opt_.value()->validateConfig(route_config);
-  }
-   std::unique_ptr<Init::ManagerImpl> noop_init_manager;
-   std::unique_ptr<Cleanup> resume_rds;
-   if (config_update_info_->onRdsUpdate(route_config, version_info)) {
-@@ -292,12 +289,6 @@
-   }
- }
- 
-void RdsRouteConfigProviderImpl::validateConfig(
-    const envoy::config::route::v3::RouteConfiguration& config) const {
-  // TODO(lizan): consider cache the config here until onConfigUpdate.
-  ConfigImpl validation_config(config, optional_http_filters_, factory_context_, validator_, false);
-}
-
- // Schedules a VHDS request on the main thread and queues up the callback to use when the VHDS
- // response has been propagated to the worker thread that was the request origin.
- void RdsRouteConfigProviderImpl::requestVirtualHostsUpdate(
-diff -Naur envoy/source/common/router/rds_impl.h envoy-new/source/common/router/rds_impl.h
--- envoy/source/common/router/rds_impl.h	2023-11-24 10:52:40.194246888 +0800
-+++ envoy-new/source/common/router/rds_impl.h	2023-11-24 10:47:36.293873127 +0800
-@@ -81,7 +81,6 @@
-   }
-   SystemTime lastUpdated() const override { return last_updated_; }
-   void onConfigUpdate() override {}
-  void validateConfig(const envoy::config::route::v3::RouteConfiguration&) const override {}
-   void requestVirtualHostsUpdate(const std::string&, Event::Dispatcher&,
-                                  std::weak_ptr<Http::RouteConfigUpdatedCallback>) override {
-     NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
-@@ -209,7 +208,6 @@
-   void requestVirtualHostsUpdate(
-       const std::string& for_domain, Event::Dispatcher& thread_local_dispatcher,
-       std::weak_ptr<Http::RouteConfigUpdatedCallback> route_config_updated_cb) override;
-  void validateConfig(const envoy::config::route::v3::RouteConfiguration& config) const override;
- 
- private:
-   struct ThreadLocalConfig : public ThreadLocal::ThreadLocalObject {
-diff -Naur envoy/source/common/router/route_config_update_receiver_impl.cc envoy-new/source/common/router/route_config_update_receiver_impl.cc
--- envoy/source/common/router/route_config_update_receiver_impl.cc	2023-11-24 10:52:40.194246888 +0800
-+++ envoy-new/source/common/router/route_config_update_receiver_impl.cc	2023-11-24 10:47:36.297873290 +0800
-@@ -1,6 +1,7 @@
- #include "source/common/router/route_config_update_receiver_impl.h"
- 
- #include <string>
-+#include <utility>
- 
- #include "envoy/config/route/v3/route.pb.h"
- #include "envoy/service/discovery/v3/discovery.pb.h"
-@@ -14,23 +15,49 @@
- namespace Envoy {
- namespace Router {
- 
-+namespace {
-+
-+// Resets 'route_config::virtual_hosts' by merging VirtualHost contained in
-+// 'rds_vhosts' and 'vhds_vhosts'.
-+void rebuildRouteConfigVirtualHosts(
-+    const std::map<std::string, envoy::config::route::v3::VirtualHost>& rds_vhosts,
-+    const std::map<std::string, envoy::config::route::v3::VirtualHost>& vhds_vhosts,
-+    envoy::config::route::v3::RouteConfiguration& route_config) {
-+  route_config.clear_virtual_hosts();
-+  for (const auto& vhost : rds_vhosts) {
-+    route_config.mutable_virtual_hosts()->Add()->CopyFrom(vhost.second);
-+  }
-+  for (const auto& vhost : vhds_vhosts) {
-+    route_config.mutable_virtual_hosts()->Add()->CopyFrom(vhost.second);
-+  }
-+}
-+
-+} // namespace
-+
- bool RouteConfigUpdateReceiverImpl::onRdsUpdate(
-     const envoy::config::route::v3::RouteConfiguration& rc, const std::string& version_info) {
-   const uint64_t new_hash = MessageUtil::hash(rc);
-   if (new_hash == last_config_hash_) {
-     return false;
-   }
-  route_config_proto_ = std::make_unique<envoy::config::route::v3::RouteConfiguration>(rc);
-  last_config_hash_ = new_hash;
-   const uint64_t new_vhds_config_hash = rc.has_vhds() ? MessageUtil::hash(rc.vhds()) : 0ul;
-+  std::map<std::string, envoy::config::route::v3::VirtualHost> rds_virtual_hosts;
-+  for (const auto& vhost : rc.virtual_hosts()) {
-+    rds_virtual_hosts.emplace(vhost.name(), vhost);
-+  }
-+  envoy::config::route::v3::RouteConfiguration new_route_config = rc;
-+  rebuildRouteConfigVirtualHosts(rds_virtual_hosts, *vhds_virtual_hosts_, new_route_config);
-+  auto new_config = std::make_shared<ConfigImpl>(
-+      new_route_config, optional_http_filters_, factory_context_,
-+      factory_context_.messageValidationContext().dynamicValidationVisitor(), false);
-+  // If the above validation/validation doesn't raise exception, update the
-+  // other cached config entries.
-+  config_ = new_config;
-+  rds_virtual_hosts_ = std::move(rds_virtual_hosts);
-+  last_config_hash_ = new_hash;
-+  *route_config_proto_ = std::move(new_route_config);
-   vhds_configuration_changed_ = new_vhds_config_hash != last_vhds_config_hash_;
-   last_vhds_config_hash_ = new_vhds_config_hash;
-  initializeRdsVhosts(*route_config_proto_);
-
-  rebuildRouteConfig(rds_virtual_hosts_, *vhds_virtual_hosts_, *route_config_proto_);
-  config_ = std::make_shared<ConfigImpl>(
-      *route_config_proto_, optional_http_filters_, factory_context_,
-      factory_context_.messageValidationContext().dynamicValidationVisitor(), false);
- 
-   onUpdateCommon(version_info);
-   return true;
-@@ -50,8 +77,8 @@
-   auto route_config_after_this_update =
-       std::make_unique<envoy::config::route::v3::RouteConfiguration>();
-   route_config_after_this_update->CopyFrom(*route_config_proto_);
-  rebuildRouteConfig(rds_virtual_hosts_, *vhosts_after_this_update,
-                     *route_config_after_this_update);
-+  rebuildRouteConfigVirtualHosts(rds_virtual_hosts_, *vhosts_after_this_update,
-+                                 *route_config_after_this_update);
- 
-   auto new_config = std::make_shared<ConfigImpl>(
-       *route_config_after_this_update, optional_http_filters_, factory_context_,
-@@ -73,14 +100,6 @@
-   config_info_.emplace(RouteConfigProvider::ConfigInfo{*route_config_proto_, last_config_version_});
- }
- 
-void RouteConfigUpdateReceiverImpl::initializeRdsVhosts(
-    const envoy::config::route::v3::RouteConfiguration& route_configuration) {
-  rds_virtual_hosts_.clear();
-  for (const auto& vhost : route_configuration.virtual_hosts()) {
-    rds_virtual_hosts_.emplace(vhost.name(), vhost);
-  }
-}
-
- bool RouteConfigUpdateReceiverImpl::removeVhosts(
-     std::map<std::string, envoy::config::route::v3::VirtualHost>& vhosts,
-     const Protobuf::RepeatedPtrField<std::string>& removed_vhost_names) {
-@@ -110,18 +129,5 @@
-   return vhosts_added;
- }
- 
-void RouteConfigUpdateReceiverImpl::rebuildRouteConfig(
-    const std::map<std::string, envoy::config::route::v3::VirtualHost>& rds_vhosts,
-    const std::map<std::string, envoy::config::route::v3::VirtualHost>& vhds_vhosts,
-    envoy::config::route::v3::RouteConfiguration& route_config) {
-  route_config.clear_virtual_hosts();
-  for (const auto& vhost : rds_vhosts) {
-    route_config.mutable_virtual_hosts()->Add()->CopyFrom(vhost.second);
-  }
-  for (const auto& vhost : vhds_vhosts) {
-    route_config.mutable_virtual_hosts()->Add()->CopyFrom(vhost.second);
-  }
-}
-
- } // namespace Router
- } // namespace Envoy
-diff -Naur envoy/source/common/router/route_config_update_receiver_impl.h envoy-new/source/common/router/route_config_update_receiver_impl.h
--- envoy/source/common/router/route_config_update_receiver_impl.h	2023-11-24 10:52:40.194246888 +0800
-+++ envoy-new/source/common/router/route_config_update_receiver_impl.h	2023-11-24 10:47:36.297873290 +0800
-@@ -27,15 +27,10 @@
-             std::make_unique<std::map<std::string, envoy::config::route::v3::VirtualHost>>()),
-         vhds_configuration_changed_(true), optional_http_filters_(optional_http_filters) {}
- 
-  void initializeRdsVhosts(const envoy::config::route::v3::RouteConfiguration& route_configuration);
-   bool removeVhosts(std::map<std::string, envoy::config::route::v3::VirtualHost>& vhosts,
-                     const Protobuf::RepeatedPtrField<std::string>& removed_vhost_names);
-   bool updateVhosts(std::map<std::string, envoy::config::route::v3::VirtualHost>& vhosts,
-                     const VirtualHostRefVector& added_vhosts);
-  void rebuildRouteConfig(
-      const std::map<std::string, envoy::config::route::v3::VirtualHost>& rds_vhosts,
-      const std::map<std::string, envoy::config::route::v3::VirtualHost>& vhds_vhosts,
-      envoy::config::route::v3::RouteConfiguration& route_config);
-   bool onDemandFetchFailed(const envoy::service::discovery::v3::Resource& resource) const;
-   void onUpdateCommon(const std::string& version_info);
- 
-diff -Naur envoy/source/server/admin/admin.h envoy-new/source/server/admin/admin.h
--- envoy/source/server/admin/admin.h	2023-11-24 10:52:41.358294284 +0800
-+++ envoy-new/source/server/admin/admin.h	2023-11-24 10:47:36.297873290 +0800
-@@ -234,7 +234,6 @@
-     absl::optional<ConfigInfo> configInfo() const override { return {}; }
-     SystemTime lastUpdated() const override { return time_source_.systemTime(); }
-     void onConfigUpdate() override {}
-    void validateConfig(const envoy::config::route::v3::RouteConfiguration&) const override {}
-     void requestVirtualHostsUpdate(const std::string&, Event::Dispatcher&,
-                                    std::weak_ptr<Http::RouteConfigUpdatedCallback>) override {
-       NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
-diff -Naur envoy/test/common/router/rds_impl_test.cc envoy-new/test/common/router/rds_impl_test.cc
--- envoy/test/common/router/rds_impl_test.cc	2023-11-24 10:52:40.714268062 +0800
-+++ envoy-new/test/common/router/rds_impl_test.cc	2023-11-24 10:47:36.297873290 +0800
-@@ -528,34 +528,66 @@
-   rds_callbacks_->onConfigUpdate(decoded_resources.refvec_, response1.version_info());
- }
- 
-// Validate behavior when the config is delivered but it fails PGV validation.
-+// Validates behavior when the config is delivered but it fails PGV validation.
-+// The invalid config won't affect existing valid config.
- TEST_F(RdsImplTest, FailureInvalidConfig) {
-   InSequence s;
- 
-   setup();
-+  EXPECT_CALL(init_watcher_, ready());
- 
-  const std::string response1_json = R"EOF(
-+  const std::string valid_json = R"EOF(
- {
-   "version_info": "1",
-   "resources": [
-     {
-       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
-      "name": "INVALID_NAME_FOR_route_config",
-+      "name": "foo_route_config",
-       "virtual_hosts": null
-     }
-   ]
- }
- )EOF";
-+
-   auto response1 =
-      TestUtility::parseYaml<envoy::service::discovery::v3::DiscoveryResponse>(response1_json);
-+      TestUtility::parseYaml<envoy::service::discovery::v3::DiscoveryResponse>(valid_json);
-   const auto decoded_resources =
-       TestUtility::decodeResources<envoy::config::route::v3::RouteConfiguration>(response1);
-+  EXPECT_NO_THROW(
-+      rds_callbacks_->onConfigUpdate(decoded_resources.refvec_, response1.version_info()));
-+  // Sadly the RdsRouteConfigSubscription privately inherited from
-+  // SubscriptionCallbacks, so we has to use reinterpret_cast here.
-+  RdsRouteConfigSubscription* rds_subscription =
-+      reinterpret_cast<RdsRouteConfigSubscription*>(rds_callbacks_);
-+  auto config_impl_pointer = rds_subscription->routeConfigProvider().value()->config();
-+  // Now send an invalid config update.
-+  const std::string invalid_json =
-+      R"EOF(
-+{
-+  "version_info": "1",
-+  "resources": [
-+    {
-+      "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
-+      "name": "INVALID_NAME_FOR_route_config",
-+      "virtual_hosts": null
-+    }
-+  ]
-+}
-+)EOF";
-+
-+  auto response2 =
-+      TestUtility::parseYaml<envoy::service::discovery::v3::DiscoveryResponse>(invalid_json);
-+  const auto decoded_resources_2 =
-+      TestUtility::decodeResources<envoy::config::route::v3::RouteConfiguration>(response2);
- 
-  EXPECT_CALL(init_watcher_, ready());
-   EXPECT_THROW_WITH_MESSAGE(
-      rds_callbacks_->onConfigUpdate(decoded_resources.refvec_, response1.version_info()),
-+      rds_callbacks_->onConfigUpdate(decoded_resources_2.refvec_, response2.version_info()),
-       EnvoyException,
-      "Unexpected RDS configuration (expecting foo_route_config): INVALID_NAME_FOR_route_config");
-+      "Unexpected RDS configuration (expecting foo_route_config): "
-+      "INVALID_NAME_FOR_route_config");
-+
-+  // Verify that the config is still the old value.
-+  ASSERT_EQ(config_impl_pointer, rds_subscription->routeConfigProvider().value()->config());
- }
- 
- // rds and vhds configurations change together
-diff -Naur envoy/test/mocks/router/mocks.h envoy-new/test/mocks/router/mocks.h
--- envoy/test/mocks/router/mocks.h	2023-11-24 10:52:41.370294773 +0800
-+++ envoy-new/test/mocks/router/mocks.h	2023-11-24 10:47:36.301873453 +0800
-@@ -538,7 +538,6 @@
-   MOCK_METHOD(absl::optional<ConfigInfo>, configInfo, (), (const));
-   MOCK_METHOD(SystemTime, lastUpdated, (), (const));
-   MOCK_METHOD(void, onConfigUpdate, ());
-  MOCK_METHOD(void, validateConfig, (const envoy::config::route::v3::RouteConfiguration&), (const));
-   MOCK_METHOD(void, requestVirtualHostsUpdate,
-               (const std::string&, Event::Dispatcher&,
-                std::weak_ptr<Http::RouteConfigUpdatedCallback> route_config_updated_cb));
-diff -Naur envoy/tools/spelling/spelling_dictionary.txt envoy-new/tools/spelling/spelling_dictionary.txt
--- envoy/tools/spelling/spelling_dictionary.txt	2023-11-24 10:52:41.370294773 +0800
-+++ envoy-new/tools/spelling/spelling_dictionary.txt	2023-11-24 10:48:54.969076506 +0800
-@@ -1303,6 +1303,7 @@
- ep
- suri
- transid
-+vhosts
- WAF
- TRI
- tmd
--- a/envoy/1.20/patches/envoy/20231218-dubbo-optimize.patch
+++ b/envoy/1.20/patches/envoy/20231218-dubbo-optimize.patch
--- a/envoy/1.20/patches/envoy/20240104-enhance-srds.patch
+++ b/envoy/1.20/patches/envoy/20240104-enhance-srds.patch
@@ -1,483 +0,0 @@
-diff -Naur envoy/api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto envoy-new/api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto
--- envoy/api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto	2024-01-04 21:07:40.000000000 +0800
-+++ envoy-new/api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto	2024-01-04 21:09:13.000000000 +0800
-@@ -888,11 +888,31 @@
-         }
-       }
- 
-+      message HostValueExtractor {
-+        option (udpa.annotations.versioning).previous_message_type =
-+            "envoy.config.filter.network.http_connection_manager.v2.ScopedRoutes.ScopeKeyBuilder."
-+            "FragmentBuilder.HostValueExtractor";
-+
-+        // The maximum number of host superset recomputes. If not specified, defaults to 100.
-+        google.protobuf.UInt32Value max_recompute_num = 1;
-+      }
-+
-+      message LocalPortValueExtractor {
-+        option (udpa.annotations.versioning).previous_message_type =
-+            "envoy.config.filter.network.http_connection_manager.v2.ScopedRoutes.ScopeKeyBuilder."
-+            "FragmentBuilder.LocalPortValueExtractor";
-+      }
-+
-+
-       oneof type {
-         option (validate.required) = true;
- 
-         // Specifies how a header field's value should be extracted.
-         HeaderValueExtractor header_value_extractor = 1;
-+
-+        HostValueExtractor host_value_extractor = 101;
-+
-+        LocalPortValueExtractor local_port_value_extractor = 102;
-       }
-     }
- 
-diff -Naur envoy/envoy/router/scopes.h envoy-new/envoy/router/scopes.h
--- envoy/envoy/router/scopes.h	2024-01-04 21:07:38.000000000 +0800
-+++ envoy-new/envoy/router/scopes.h	2024-01-04 21:09:13.000000000 +0800
-@@ -92,7 +92,12 @@
-    * @param headers the request headers to match the scoped routing configuration against.
-    * @return ConfigConstSharedPtr the router's Config matching the request headers.
-    */
-+#if defined ALIMESH
-+  virtual ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap& headers,
-+                                              const StreamInfo::StreamInfo& info) const PURE;
-+#else
-   virtual ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap& headers) const PURE;
-+#endif
- 
-   /**
-    * Based on the incoming HTTP request headers, returns the hash value of its scope key.
-@@ -100,6 +105,12 @@
-    * @return unique_ptr of the scope key computed from header.
-    */
-   virtual ScopeKeyPtr computeScopeKey(const Http::HeaderMap&) const { return {}; }
-+
-+#if defined(ALIMESH)
-+  virtual ScopeKeyPtr computeScopeKey(const Http::HeaderMap&, const StreamInfo::StreamInfo&) const {
-+    return {};
-+  };
-+#endif
- };
- 
- using ScopedConfigConstSharedPtr = std::shared_ptr<const ScopedConfig>;
-diff -Naur envoy/source/common/http/conn_manager_impl.cc envoy-new/source/common/http/conn_manager_impl.cc
--- envoy/source/common/http/conn_manager_impl.cc	2024-01-04 21:07:41.000000000 +0800
-+++ envoy-new/source/common/http/conn_manager_impl.cc	2024-01-04 21:09:13.000000000 +0800
-@@ -577,8 +577,13 @@
-     requestVhdsUpdate(host_header, thread_local_dispatcher, std::move(route_config_updated_cb));
-     return;
-   } else if (parent_.snapped_scoped_routes_config_ != nullptr) {
-+#if defined(ALIMESH)
-+    Router::ScopeKeyPtr scope_key = parent_.snapped_scoped_routes_config_->computeScopeKey(
-+        *parent_.request_headers_, parent_.connection()->streamInfo());
-+#else
-     Router::ScopeKeyPtr scope_key =
-         parent_.snapped_scoped_routes_config_->computeScopeKey(*parent_.request_headers_);
-+#endif
-     // If scope_key is not null, the scope exists but RouteConfiguration is not initialized.
-     if (scope_key != nullptr) {
-       requestSrdsUpdate(std::move(scope_key), thread_local_dispatcher,
-@@ -1197,7 +1202,13 @@
- void ConnectionManagerImpl::ActiveStream::snapScopedRouteConfig() {
-   // NOTE: if a RDS subscription hasn't got a RouteConfiguration back, a Router::NullConfigImpl is
-   // returned, in that case we let it pass.
-+#if defined(ALIMESH)
-+  snapped_route_config_ =
-+      snapped_scoped_routes_config_->getRouteConfig(*request_headers_, connection()->streamInfo());
-+#else
-   snapped_route_config_ = snapped_scoped_routes_config_->getRouteConfig(*request_headers_);
-+
-+#endif
-   if (snapped_route_config_ == nullptr) {
-     ENVOY_STREAM_LOG(trace, "can't find SRDS scope.", *this);
-     // TODO(stevenzzzz): Consider to pass an error message to router filter, so that it can
-diff -Naur envoy/source/common/router/scoped_config_impl.cc envoy-new/source/common/router/scoped_config_impl.cc
--- envoy/source/common/router/scoped_config_impl.cc	2024-01-04 21:07:36.000000000 +0800
-+++ envoy-new/source/common/router/scoped_config_impl.cc	2024-01-04 21:09:13.000000000 +0800
-@@ -6,6 +6,160 @@
- namespace Envoy {
- namespace Router {
- 
-+#if defined(ALIMESH)
-+namespace {
-+
-+std::string maskFirstDNSLabel(absl::string_view host) {
-+  if (host == "*") {
-+    return std::string(host);
-+  }
-+  if (host.size() < 2) {
-+    return "*";
-+  }
-+  size_t start_pos = (host[0] == '*' && host[1] == '.') ? 2 : 0;
-+  size_t dot_pos = host.find('.', start_pos);
-+  if (dot_pos != absl::string_view::npos) {
-+    return absl::StrCat("*", absl::string_view(host.data() + dot_pos, host.size() - dot_pos));
-+  }
-+  return "*";
-+}
-+
-+} // namespace
-+
-+LocalPortValueExtractorImpl::LocalPortValueExtractorImpl(
-+    ScopedRoutes::ScopeKeyBuilder::FragmentBuilder&& config)
-+    : FragmentBuilderBase(std::move(config)) {
-+  ASSERT(config_.type_case() ==
-+             ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::kLocalPortValueExtractor,
-+         "local_port_value_extractor is not set.");
-+}
-+
-+std::unique_ptr<ScopeKeyFragmentBase> LocalPortValueExtractorImpl::computeFragment(
-+    const Http::HeaderMap&, const StreamInfo::StreamInfo& info, ReComputeCbPtr&) const {
-+  auto port = info.downstreamAddressProvider().localAddress()->ip()->port();
-+  return std::make_unique<StringKeyFragment>(std::to_string(long(port)));
-+}
-+
-+HostValueExtractorImpl::HostValueExtractorImpl(
-+    ScopedRoutes::ScopeKeyBuilder::FragmentBuilder&& config)
-+    : FragmentBuilderBase(std::move(config)),
-+      host_value_extractor_config_(config_.host_value_extractor()),
-+      max_recompute_num_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(
-+          host_value_extractor_config_, max_recompute_num, DefaultMaxRecomputeNum)) {
-+  ASSERT(config_.type_case() == ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::kHostValueExtractor,
-+         "host_value_extractor is not set.");
-+}
-+
-+std::unique_ptr<ScopeKeyFragmentBase>
-+HostValueExtractorImpl::reComputeHelper(const std::string& host, ReComputeCbPtr& next_recompute,
-+                                        uint32_t recompute_seq) const {
-+  if (recompute_seq == max_recompute_num_) {
-+    ENVOY_LOG_MISC(warn,
-+                   "recompute host fragment failed, maximum number of recalculations exceeded");
-+    return nullptr;
-+  }
-+  if (host == "*") {
-+    *next_recompute = nullptr;
-+    return nullptr;
-+  }
-+  auto masked_host = maskFirstDNSLabel(host);
-+  *next_recompute = [this, masked_host, recompute_seq,
-+                     next_recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
-+    return reComputeHelper(masked_host, next_recompute, recompute_seq + 1);
-+  };
-+  return std::make_unique<StringKeyFragment>(masked_host);
-+}
-+
-+std::unique_ptr<ScopeKeyFragmentBase>
-+HostValueExtractorImpl::computeFragment(const Http::HeaderMap& headers,
-+                                        const StreamInfo::StreamInfo&,
-+                                        ReComputeCbPtr& recompute) const {
-+  auto fragment = computeFragment(headers);
-+  auto host = static_cast<const Http::RequestHeaderMap&>(headers).getHostValue();
-+  *recompute = [this, host, recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
-+    return reComputeHelper(std::string(host), recompute, 0);
-+  };
-+  return fragment;
-+}
-+
-+std::unique_ptr<ScopeKeyFragmentBase>
-+HostValueExtractorImpl::computeFragment(const Http::HeaderMap& headers) const {
-+  return std::make_unique<StringKeyFragment>(
-+      static_cast<const Http::RequestHeaderMap&>(headers).getHostValue());
-+}
-+
-+std::unique_ptr<ScopeKeyFragmentBase>
-+HeaderValueExtractorImpl::computeFragment(const Http::HeaderMap& headers,
-+                                          const StreamInfo::StreamInfo&, ReComputeCbPtr&) const {
-+  return computeFragment(headers);
-+}
-+
-+ScopeKeyPtr ScopeKeyBuilderImpl::computeScopeKey(const Http::HeaderMap& headers,
-+                                                 const StreamInfo::StreamInfo& info,
-+                                                 std::function<ScopeKeyPtr()>& recompute) const {
-+  ScopeKey key;
-+  bool recomputeable = false;
-+  auto recompute_cbs = std::make_shared<std::vector<ReComputeCbPtr>>();
-+  for (const auto& builder : fragment_builders_) {
-+    // returns nullopt if a null fragment is found.
-+    ReComputeCbPtr recompute_fragment_cb = std::make_shared<ReComputeCb>();
-+    std::unique_ptr<ScopeKeyFragmentBase> fragment =
-+        builder->computeFragment(headers, info, recompute_fragment_cb);
-+    if (fragment == nullptr) {
-+      return nullptr;
-+    }
-+    if (*recompute_fragment_cb == nullptr) {
-+      auto key_fragment = static_cast<StringKeyFragment*>(fragment.get());
-+      auto copied_fragment = std::make_shared<StringKeyFragment>(*key_fragment);
-+      auto recompute_cb =
-+          std::make_shared<ReComputeCb>([copied_fragment]() -> std::unique_ptr<StringKeyFragment> {
-+            return std::make_unique<StringKeyFragment>(*copied_fragment);
-+          });
-+      recompute_cbs->push_back(recompute_cb);
-+    } else {
-+      recomputeable = true;
-+      recompute_cbs->push_back(recompute_fragment_cb);
-+    }
-+    key.addFragment(std::move(fragment));
-+  }
-+  if (recomputeable) {
-+    recompute = [&recompute, recompute_cbs]() mutable -> ScopeKeyPtr {
-+      ScopeKey new_key;
-+      for (auto& cb : *recompute_cbs) {
-+        auto new_fragment = (*cb)();
-+        if (new_fragment == nullptr) {
-+          return nullptr;
-+        }
-+        if (*cb == nullptr) {
-+          recompute = nullptr;
-+        }
-+        new_key.addFragment(std::move(new_fragment));
-+      }
-+      return std::make_unique<ScopeKey>(std::move(new_key));
-+    };
-+  }
-+  return std::make_unique<ScopeKey>(std::move(key));
-+}
-+
-+ScopeKeyPtr ScopedConfigImpl::computeScopeKey(const Http::HeaderMap& headers,
-+                                              const StreamInfo::StreamInfo& info) const {
-+  std::function<Router::ScopeKeyPtr()> recompute;
-+  ScopeKeyPtr scope_key = scope_key_builder_.computeScopeKey(headers, info, recompute);
-+  if (scope_key == nullptr) {
-+    return nullptr;
-+  }
-+  decltype(scoped_route_info_by_key_.begin()) iter;
-+  do {
-+    iter = scoped_route_info_by_key_.find(scope_key->hash());
-+    if (iter != scoped_route_info_by_key_.end()) {
-+      return scope_key;
-+    }
-+  } while (recompute != nullptr && (scope_key = recompute()));
-+  return nullptr;
-+}
-+
-+#endif
-+
- bool ScopeKey::operator!=(const ScopeKey& other) const { return !(*this == other); }
- 
- bool ScopeKey::operator==(const ScopeKey& other) const {
-@@ -95,6 +249,16 @@
-     : ScopeKeyBuilderBase(std::move(config)) {
-   for (const auto& fragment_builder : config_.fragments()) {
-     switch (fragment_builder.type_case()) {
-+#if defined(ALIMESH)
-+    case ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::kHostValueExtractor:
-+      fragment_builders_.emplace_back(std::make_unique<HostValueExtractorImpl>(
-+          ScopedRoutes::ScopeKeyBuilder::FragmentBuilder(fragment_builder)));
-+      break;
-+    case ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::kLocalPortValueExtractor:
-+      fragment_builders_.emplace_back(std::make_unique<LocalPortValueExtractorImpl>(
-+          ScopedRoutes::ScopeKeyBuilder::FragmentBuilder(fragment_builder)));
-+      break;
-+#endif
-     case ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::kHeaderValueExtractor:
-       fragment_builders_.emplace_back(std::make_unique<HeaderValueExtractorImpl>(
-           ScopedRoutes::ScopeKeyBuilder::FragmentBuilder(fragment_builder)));
-@@ -143,6 +307,22 @@
- }
- 
- Router::ConfigConstSharedPtr
-+#if defined(ALIMESH)
-+ScopedConfigImpl::getRouteConfig(const Http::HeaderMap& headers,
-+                                 const StreamInfo::StreamInfo& info) const {
-+  std::function<ScopeKeyPtr()> recompute;
-+  ScopeKeyPtr scope_key = scope_key_builder_.computeScopeKey(headers, info, recompute);
-+  if (scope_key == nullptr) {
-+    return nullptr;
-+  }
-+  decltype(scoped_route_info_by_key_.begin()) iter;
-+  do {
-+    iter = scoped_route_info_by_key_.find(scope_key->hash());
-+    if (iter != scoped_route_info_by_key_.end()) {
-+      return iter->second->routeConfig();
-+    }
-+  } while (recompute != nullptr && (scope_key = recompute()));
-+#else
- ScopedConfigImpl::getRouteConfig(const Http::HeaderMap& headers) const {
-   ScopeKeyPtr scope_key = scope_key_builder_.computeScopeKey(headers);
-   if (scope_key == nullptr) {
-@@ -152,6 +332,7 @@
-   if (iter != scoped_route_info_by_key_.end()) {
-     return iter->second->routeConfig();
-   }
-+#endif
-   return nullptr;
- }
- 
-diff -Naur envoy/source/common/router/scoped_config_impl.h envoy-new/source/common/router/scoped_config_impl.h
--- envoy/source/common/router/scoped_config_impl.h	2024-01-04 21:07:36.000000000 +0800
-+++ envoy-new/source/common/router/scoped_config_impl.h	2024-01-04 21:09:13.000000000 +0800
-@@ -22,6 +22,11 @@
- 
- using envoy::extensions::filters::network::http_connection_manager::v3::ScopedRoutes;
- 
-+#if defined(ALIMESH)
-+using ReComputeCb = std::function<std::unique_ptr<ScopeKeyFragmentBase>()>;
-+using ReComputeCbPtr = std::shared_ptr<ReComputeCb>;
-+#endif
-+
- /**
-  * Base class for fragment builders.
-  */
-@@ -36,6 +41,12 @@
-   virtual std::unique_ptr<ScopeKeyFragmentBase>
-   computeFragment(const Http::HeaderMap& headers) const PURE;
- 
-+#if defined(ALIMESH)
-+  virtual std::unique_ptr<ScopeKeyFragmentBase>
-+  computeFragment(const Http::HeaderMap& headers, const StreamInfo::StreamInfo& info,
-+                  ReComputeCbPtr& recompute) const PURE;
-+#endif
-+
- protected:
-   const ScopedRoutes::ScopeKeyBuilder::FragmentBuilder config_;
- };
-@@ -47,11 +58,54 @@
-   std::unique_ptr<ScopeKeyFragmentBase>
-   computeFragment(const Http::HeaderMap& headers) const override;
- 
-+#if defined(ALIMESH)
-+  std::unique_ptr<ScopeKeyFragmentBase> computeFragment(const Http::HeaderMap& headers,
-+                                                        const StreamInfo::StreamInfo& info,
-+                                                        ReComputeCbPtr& recompute) const override;
-+#endif
-+
- private:
-   const ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::HeaderValueExtractor&
-       header_value_extractor_config_;
- };
- 
-+#if defined(ALIMESH)
-+class HostValueExtractorImpl : public FragmentBuilderBase {
-+public:
-+  explicit HostValueExtractorImpl(ScopedRoutes::ScopeKeyBuilder::FragmentBuilder&& config);
-+
-+  std::unique_ptr<ScopeKeyFragmentBase>
-+  computeFragment(const Http::HeaderMap& headers) const override;
-+
-+  std::unique_ptr<ScopeKeyFragmentBase> computeFragment(const Http::HeaderMap& headers,
-+                                                        const StreamInfo::StreamInfo& info,
-+                                                        ReComputeCbPtr& recompute) const override;
-+
-+private:
-+  std::unique_ptr<ScopeKeyFragmentBase> reComputeHelper(const std::string& host,
-+                                                        ReComputeCbPtr& next_recompute,
-+                                                        uint32_t recompute_seq) const;
-+
-+  static constexpr uint32_t DefaultMaxRecomputeNum = 100;
-+
-+  const ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::HostValueExtractor&
-+      host_value_extractor_config_;
-+  const uint32_t max_recompute_num_;
-+};
-+
-+class LocalPortValueExtractorImpl : public FragmentBuilderBase {
-+public:
-+  explicit LocalPortValueExtractorImpl(ScopedRoutes::ScopeKeyBuilder::FragmentBuilder&& config);
-+
-+  std::unique_ptr<ScopeKeyFragmentBase> computeFragment(const Http::HeaderMap&) const override {
-+    return nullptr;
-+  };
-+
-+  std::unique_ptr<ScopeKeyFragmentBase> computeFragment(const Http::HeaderMap& headers,
-+                                                        const StreamInfo::StreamInfo& info,
-+                                                        ReComputeCbPtr& recompute) const override;
-+};
-+#endif
- /**
-  * Base class for ScopeKeyBuilder implementations.
-  */
-@@ -64,6 +118,12 @@
-   // Computes scope key for given headers, returns nullptr if a key can't be computed.
-   virtual ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers) const PURE;
- 
-+#if defined(ALIMESH)
-+  virtual ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers,
-+                                      const StreamInfo::StreamInfo& info,
-+                                      std::function<ScopeKeyPtr()>& recompute) const PURE;
-+#endif
-+
- protected:
-   const ScopedRoutes::ScopeKeyBuilder config_;
- };
-@@ -74,6 +134,11 @@
- 
-   ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers) const override;
- 
-+#if defined(ALIMESH)
-+  ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers, const StreamInfo::StreamInfo& info,
-+                              std::function<ScopeKeyPtr()>& recompute) const override;
-+#endif
-+
- private:
-   std::vector<std::unique_ptr<FragmentBuilderBase>> fragment_builders_;
- };
-@@ -118,10 +183,20 @@
-   void removeRoutingScopes(const std::vector<std::string>& scope_names);
- 
-   // Envoy::Router::ScopedConfig
-+#if defined(ALIMESH)
-+  Router::ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap& headers,
-+                                              const StreamInfo::StreamInfo& info) const override;
-+#else
-   Router::ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap& headers) const override;
-+#endif
-   // The return value is not null only if the scope corresponding to the header exists.
-   ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers) const override;
- 
-+#if defined(ALIMESH)
-+  ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers,
-+                              const StreamInfo::StreamInfo& info) const override;
-+#endif
-+
- private:
-   ScopeKeyBuilderImpl scope_key_builder_;
-   // From scope name to cached ScopedRouteInfo.
-@@ -135,9 +210,16 @@
-  */
- class NullScopedConfigImpl : public ScopedConfig {
- public:
-+#if defined(ALIMESH)
-+  Router::ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap&,
-+                                              const StreamInfo::StreamInfo&) const override {
-+    return std::make_shared<const NullConfigImpl>();
-+  }
-+#else
-   Router::ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap&) const override {
-     return std::make_shared<const NullConfigImpl>();
-   }
-+#endif
- };
- 
- } // namespace Router
-diff -Naur envoy/source/extensions/filters/http/on_demand/on_demand_update.cc envoy-new/source/extensions/filters/http/on_demand/on_demand_update.cc
--- envoy/source/extensions/filters/http/on_demand/on_demand_update.cc	2024-01-04 21:07:33.000000000 +0800
-+++ envoy-new/source/extensions/filters/http/on_demand/on_demand_update.cc	2024-01-04 21:09:13.000000000 +0800
-@@ -50,7 +50,11 @@
- // This is the callback which is called when an update requested in requestRouteConfigUpdate()
- // has been propagated to workers, at which point the request processing is restarted from the
- // beginning.
-+#if defined(ALIMESH)
-+void OnDemandRouteUpdate::onRouteConfigUpdateCompletion(bool) {
-+#else
- void OnDemandRouteUpdate::onRouteConfigUpdateCompletion(bool route_exists) {
-+#endif
-   filter_iteration_state_ = Http::FilterHeadersStatus::Continue;
- 
-   // Don't call continueDecoding in the middle of decodeHeaders()
-@@ -58,12 +62,14 @@
-     return;
-   }
- 
-+#if !defined(ALIMESH)
-   if (route_exists &&                  // route can be resolved after an on-demand
-                                        // VHDS update
-       !callbacks_->decodingBuffer() && // Redirects with body not yet supported.
-       callbacks_->recreateStream(/*headers=*/nullptr)) {
-     return;
-   }
-+#endif
- 
-   // route cannot be resolved after an on-demand VHDS update or
-   // recreating stream failed, continue the filter-chain
--- a/envoy/1.20/patches/envoy/20240110-fix-srds.patch
+++ b/envoy/1.20/patches/envoy/20240110-fix-srds.patch
@@ -1,49 +0,0 @@
-diff -Naur envoy/source/common/router/BUILD envoy-new/source/common/router/BUILD
--- envoy/source/common/router/BUILD	2024-01-10 20:10:14.505600746 +0800
-+++ envoy-new/source/common/router/BUILD	2024-01-10 20:07:25.960379955 +0800
-@@ -212,6 +212,7 @@
-         "//envoy/router:rds_interface",
-         "//envoy/router:scopes_interface",
-         "//envoy/thread_local:thread_local_interface",
-+        "//source/common/http:header_utility_lib",
-         "@envoy_api//envoy/config/route/v3:pkg_cc_proto",
-         "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3:pkg_cc_proto",
-     ],
-diff -Naur envoy/source/common/router/scoped_config_impl.cc envoy-new/source/common/router/scoped_config_impl.cc
--- envoy/source/common/router/scoped_config_impl.cc	2024-01-10 20:10:14.529600924 +0800
-+++ envoy-new/source/common/router/scoped_config_impl.cc	2024-01-10 20:09:50.161422411 +0800
-@@ -3,6 +3,8 @@
- #include "envoy/config/route/v3/scoped_route.pb.h"
- #include "envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.h"
- 
-+#include "source/common/http/header_utility.h"
-+
- namespace Envoy {
- namespace Router {
- 
-@@ -74,18 +76,20 @@
- HostValueExtractorImpl::computeFragment(const Http::HeaderMap& headers,
-                                         const StreamInfo::StreamInfo&,
-                                         ReComputeCbPtr& recompute) const {
-  auto fragment = computeFragment(headers);
-   auto host = static_cast<const Http::RequestHeaderMap&>(headers).getHostValue();
-+  auto port_start = Http::HeaderUtility::getPortStart(host);
-+  if (port_start != absl::string_view::npos) {
-+    host = host.substr(0, port_start);
-+  }
-   *recompute = [this, host, recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
-     return reComputeHelper(std::string(host), recompute, 0);
-   };
-  return fragment;
-+  return std::make_unique<StringKeyFragment>(host);
- }
- 
- std::unique_ptr<ScopeKeyFragmentBase>
-HostValueExtractorImpl::computeFragment(const Http::HeaderMap& headers) const {
-  return std::make_unique<StringKeyFragment>(
-      static_cast<const Http::RequestHeaderMap&>(headers).getHostValue());
-+HostValueExtractorImpl::computeFragment(const Http::HeaderMap&) const {
-+  return nullptr;
- }
- 
- std::unique_ptr<ScopeKeyFragmentBase>
--- a/envoy/1.20/patches/envoy/20240111-fix-srds-compute.patch
+++ b/envoy/1.20/patches/envoy/20240111-fix-srds-compute.patch
@@ -1,65 +0,0 @@
-diff -Naur envoy/source/common/router/scoped_config_impl.cc envoy-new/source/common/router/scoped_config_impl.cc
--- envoy/source/common/router/scoped_config_impl.cc	2024-01-11 16:23:55.407881263 +0800
-+++ envoy-new/source/common/router/scoped_config_impl.cc	2024-01-11 16:23:42.311786814 +0800
-@@ -53,21 +53,26 @@
- }
- 
- std::unique_ptr<ScopeKeyFragmentBase>
-HostValueExtractorImpl::reComputeHelper(const std::string& host, ReComputeCbPtr& next_recompute,
-+HostValueExtractorImpl::reComputeHelper(const std::string& host,
-+                                        ReComputeCbWeakPtr& weak_next_recompute,
-                                         uint32_t recompute_seq) const {
-   if (recompute_seq == max_recompute_num_) {
-     ENVOY_LOG_MISC(warn,
-                    "recompute host fragment failed, maximum number of recalculations exceeded");
-     return nullptr;
-   }
-+  auto next_recompute = weak_next_recompute.lock();
-+  if (!next_recompute) {
-+    return nullptr;
-+  }
-   if (host == "*") {
-     *next_recompute = nullptr;
-     return nullptr;
-   }
-   auto masked_host = maskFirstDNSLabel(host);
-   *next_recompute = [this, masked_host, recompute_seq,
-                     next_recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
-    return reComputeHelper(masked_host, next_recompute, recompute_seq + 1);
-+                     weak_next_recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
-+    return reComputeHelper(masked_host, weak_next_recompute, recompute_seq + 1);
-   };
-   return std::make_unique<StringKeyFragment>(masked_host);
- }
-@@ -81,8 +86,9 @@
-   if (port_start != absl::string_view::npos) {
-     host = host.substr(0, port_start);
-   }
-  *recompute = [this, host, recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
-    return reComputeHelper(std::string(host), recompute, 0);
-+  *recompute = [this, host, weak_recompute = ReComputeCbWeakPtr(recompute)]() mutable
-+      -> std::unique_ptr<ScopeKeyFragmentBase> {
-+    return reComputeHelper(std::string(host), weak_recompute, 0);
-   };
-   return std::make_unique<StringKeyFragment>(host);
- }
-diff -Naur envoy/source/common/router/scoped_config_impl.h envoy-new/source/common/router/scoped_config_impl.h
--- envoy/source/common/router/scoped_config_impl.h	2024-01-11 16:23:55.407881263 +0800
-+++ envoy-new/source/common/router/scoped_config_impl.h	2024-01-11 16:23:42.311786814 +0800
-@@ -25,6 +25,7 @@
- #if defined(ALIMESH)
- using ReComputeCb = std::function<std::unique_ptr<ScopeKeyFragmentBase>()>;
- using ReComputeCbPtr = std::shared_ptr<ReComputeCb>;
-+using ReComputeCbWeakPtr = std::weak_ptr<ReComputeCb>;
- #endif
- 
- /**
-@@ -83,7 +84,7 @@
- 
- private:
-   std::unique_ptr<ScopeKeyFragmentBase> reComputeHelper(const std::string& host,
-                                                        ReComputeCbPtr& next_recompute,
-+                                                        ReComputeCbWeakPtr& weak_next_recompute,
-                                                         uint32_t recompute_seq) const;
- 
-   static constexpr uint32_t DefaultMaxRecomputeNum = 100;
--- a/envoy/1.20/patches/envoy/20240116-fix-cve.patch
+++ b/envoy/1.20/patches/envoy/20240116-fix-cve.patch
--- a/envoy/1.20/patches/envoy/20240201-virtual-host-allow-server-name.patch
+++ b/envoy/1.20/patches/envoy/20240201-virtual-host-allow-server-name.patch
--- a/envoy/1.20/patches/envoy/20240519-wasm-upgrade.patch
+++ b/envoy/1.20/patches/envoy/20240519-wasm-upgrade.patch
--- a/envoy/1.20/patches/envoy/20240521-fix-wasm-host.patch
+++ b/envoy/1.20/patches/envoy/20240521-fix-wasm-host.patch
@@ -1,14 +0,0 @@
-diff -Naur envoy/bazel/repository_locations.bzl envoy-new/bazel/repository_locations.bzl
--- envoy/bazel/repository_locations.bzl	2024-05-21 22:49:46.686598518 +0800
-+++ envoy-new/bazel/repository_locations.bzl	2024-05-21 22:49:02.554597652 +0800
-@@ -1031,8 +1031,8 @@
-         project_name = "WebAssembly for Proxies (C++ host implementation)",
-         project_desc = "WebAssembly for Proxies (C++ host implementation)",
-         project_url = "https://github.com/higress-group/proxy-wasm-cpp-host",
-        version = "f8b624dc6c37d4e0a3c1b332652746793e2031ad",
-        sha256 = "ba20328101c91d0ae6383947ced99620cd9b4ea22ab2fda6b26f343b38c3be83",
-+        version = "cad2eb04d402dbf559101f3cb4f44da0d9c5b0b0",
-+        sha256 = "4efbcc97c58994fab92c9dc50c051ad16463647d4c0c6df36a7204d2984c1e63",
-         strip_prefix = "proxy-wasm-cpp-host-{version}",
-         urls = ["https://github.com/higress-group/proxy-wasm-cpp-host/archive/{version}.tar.gz"],
-         use_category = ["dataplane_ext"],
--- a/envoy/1.20/patches/envoy/20240527-fix-wasm-recover.patch
+++ b/envoy/1.20/patches/envoy/20240527-fix-wasm-recover.patch
@@ -1,25 +0,0 @@
-diff -Naur envoy/bazel/repository_locations.bzl envoy-new/bazel/repository_locations.bzl
--- envoy/bazel/repository_locations.bzl	2024-05-27 18:04:13.116443196 +0800
-+++ envoy-new/bazel/repository_locations.bzl	2024-05-27 18:02:24.812441069 +0800
-@@ -1031,8 +1031,8 @@
-         project_name = "WebAssembly for Proxies (C++ host implementation)",
-         project_desc = "WebAssembly for Proxies (C++ host implementation)",
-         project_url = "https://github.com/higress-group/proxy-wasm-cpp-host",
-        version = "cad2eb04d402dbf559101f3cb4f44da0d9c5b0b0",
-        sha256 = "4efbcc97c58994fab92c9dc50c051ad16463647d4c0c6df36a7204d2984c1e63",
-+        version = "28a33a5a3e6c1ff8f53128a74e89aeca47850f68",
-+        sha256 = "1aaa5898c169aeff115eff2fedf58095b3509d2e59861ad498e661a990d78b3d",
-         strip_prefix = "proxy-wasm-cpp-host-{version}",
-         urls = ["https://github.com/higress-group/proxy-wasm-cpp-host/archive/{version}.tar.gz"],
-         use_category = ["dataplane_ext"],
-diff -Naur envoy/source/extensions/filters/http/wasm/wasm_filter.h envoy-new/source/extensions/filters/http/wasm/wasm_filter.h
--- envoy/source/extensions/filters/http/wasm/wasm_filter.h	2024-05-27 18:04:13.112443196 +0800
-+++ envoy-new/source/extensions/filters/http/wasm/wasm_filter.h	2024-05-27 18:03:25.360442258 +0800
-@@ -51,6 +51,7 @@
-       if (opt_ref->recover()) {
-         ENVOY_LOG(info, "wasm vm recover success");
-         wasm = opt_ref->handle()->wasmHandle()->wasm().get();
-+        handle = opt_ref->handle();
-       } else {
-         ENVOY_LOG(info, "wasm vm recover failed");
-         failed = true;
--- a/envoy/1.20/patches/envoy/20240610-optimize-xds.patch
+++ b/envoy/1.20/patches/envoy/20240610-optimize-xds.patch
@@ -1,259 +0,0 @@
-diff --git a/source/common/router/BUILD b/source/common/router/BUILD
-index 5c58501..4db76cd 100644
--- a/source/common/router/BUILD
-+++ b/source/common/router/BUILD
-@@ -212,6 +212,7 @@ envoy_cc_library(
-         "//envoy/router:rds_interface",
-         "//envoy/router:scopes_interface",
-         "//envoy/thread_local:thread_local_interface",
-+        "//source/common/protobuf:utility_lib",
-         "@envoy_api//envoy/config/route/v3:pkg_cc_proto",
-         "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3:pkg_cc_proto",
-     ],
-diff --git a/source/common/router/config_impl.cc b/source/common/router/config_impl.cc
-index ff7b4c8..5ac4523 100644
--- a/source/common/router/config_impl.cc
-+++ b/source/common/router/config_impl.cc
-@@ -550,19 +550,11 @@ RouteEntryImplBase::RouteEntryImplBase(const VirtualHostImpl& vhost,
-               "not be stripped: {}",
-               path_redirect_);
-   }
-  ENVOY_LOG(info, "route stats is {}, name is {}", route.stat_prefix(), route.name());
-   if (!route.stat_prefix().empty()) {
-     route_stats_context_ = std::make_unique<RouteStatsContext>(
-         factory_context.scope(), factory_context.routerContext().routeStatNames(), vhost.statName(),
-         route.stat_prefix());
-  } else if (!route.name().empty()) {
-    // Added by Ingress
-    // use route_name as default stat_prefix
-    route_stats_context_ = std::make_unique<RouteStatsContext>(
-        factory_context.scope(), factory_context.routerContext().routeStatNames(), vhost.statName(),
-        route.name());
-   }
-  // End Added
- }
- 
- bool RouteEntryImplBase::evaluateRuntimeMatch(const uint64_t random_value) const {
-@@ -1415,9 +1407,7 @@ VirtualHostImpl::VirtualHostImpl(
-       retry_shadow_buffer_limit_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(
-           virtual_host, per_request_buffer_limit_bytes, std::numeric_limits<uint32_t>::max())),
-       include_attempt_count_in_request_(virtual_host.include_request_attempt_count()),
-      include_attempt_count_in_response_(virtual_host.include_attempt_count_in_response()),
-      virtual_cluster_catch_all_(*vcluster_scope_,
-                                 factory_context.routerContext().virtualClusterStatNames()) {
-+      include_attempt_count_in_response_(virtual_host.include_attempt_count_in_response()) {
-   switch (virtual_host.require_tls()) {
-   case envoy::config::route::v3::VirtualHost::NONE:
-     ssl_requirements_ = SslRequirements::None;
-@@ -1478,10 +1468,14 @@ VirtualHostImpl::VirtualHostImpl(
-     }
-   }
- 
-  for (const auto& virtual_cluster : virtual_host.virtual_clusters()) {
-    virtual_clusters_.push_back(
-        VirtualClusterEntry(virtual_cluster, *vcluster_scope_,
-                            factory_context.routerContext().virtualClusterStatNames()));
-+  if (!virtual_host.virtual_clusters().empty()) {
-+    virtual_cluster_catch_all_ = std::make_unique<CatchAllVirtualCluster>(
-+        *vcluster_scope_, factory_context.routerContext().virtualClusterStatNames());
-+    for (const auto& virtual_cluster : virtual_host.virtual_clusters()) {
-+      virtual_clusters_.push_back(
-+          VirtualClusterEntry(virtual_cluster, *vcluster_scope_,
-+                              factory_context.routerContext().virtualClusterStatNames()));
-+    }
-   }
- 
-   if (virtual_host.has_cors()) {
-@@ -1774,7 +1768,7 @@ VirtualHostImpl::virtualClusterFromEntries(const Http::HeaderMap& headers) const
-   }
- 
-   if (!virtual_clusters_.empty()) {
-    return &virtual_cluster_catch_all_;
-+    return virtual_cluster_catch_all_.get();
-   }
- 
-   return nullptr;
-diff --git a/source/common/router/config_impl.h b/source/common/router/config_impl.h
-index cf0ddf3..d83eb94 100644
--- a/source/common/router/config_impl.h
-+++ b/source/common/router/config_impl.h
-@@ -352,10 +352,10 @@ private:
-   const bool include_attempt_count_in_response_;
-   absl::optional<envoy::config::route::v3::RetryPolicy> retry_policy_;
-   absl::optional<envoy::config::route::v3::HedgePolicy> hedge_policy_;
-  const CatchAllVirtualCluster virtual_cluster_catch_all_;
- #if defined(ALIMESH)
-   std::vector<std::string> allow_server_names_;
- #endif
-+  std::unique_ptr<const CatchAllVirtualCluster> virtual_cluster_catch_all_;
- };
- 
- using VirtualHostSharedPtr = std::shared_ptr<VirtualHostImpl>;
-diff --git a/source/common/router/scoped_config_impl.cc b/source/common/router/scoped_config_impl.cc
-index 594d571..6482615 100644
--- a/source/common/router/scoped_config_impl.cc
-+++ b/source/common/router/scoped_config_impl.cc
-@@ -7,6 +7,8 @@
- #include "source/common/http/header_utility.h"
- #endif
- 
-+#include "source/common/protobuf/utility.h"
-+
- namespace Envoy {
- namespace Router {
- 
-@@ -239,7 +241,8 @@ HeaderValueExtractorImpl::computeFragment(const Http::HeaderMap& headers) const
- 
- ScopedRouteInfo::ScopedRouteInfo(envoy::config::route::v3::ScopedRouteConfiguration&& config_proto,
-                                  ConfigConstSharedPtr&& route_config)
-    : config_proto_(std::move(config_proto)), route_config_(std::move(route_config)) {
-+    : config_proto_(std::move(config_proto)), route_config_(std::move(route_config)),
-+      config_hash_(MessageUtil::hash(config_proto)) {
-   // TODO(stevenzzzz): Maybe worth a KeyBuilder abstraction when there are more than one type of
-   // Fragment.
-   for (const auto& fragment : config_proto_.key().fragments()) {
-diff --git a/source/common/router/scoped_config_impl.h b/source/common/router/scoped_config_impl.h
-index 9f6a1b2..28e2ee5 100644
--- a/source/common/router/scoped_config_impl.h
-+++ b/source/common/router/scoped_config_impl.h
-@@ -154,11 +154,13 @@ public:
-     return config_proto_;
-   }
-   const std::string& scopeName() const { return config_proto_.name(); }
-+  uint64_t configHash() const { return config_hash_; }
- 
- private:
-   envoy::config::route::v3::ScopedRouteConfiguration config_proto_;
-   ScopeKey scope_key_;
-   ConfigConstSharedPtr route_config_;
-+  const uint64_t config_hash_;
- };
- using ScopedRouteInfoConstSharedPtr = std::shared_ptr<const ScopedRouteInfo>;
- // Ordered map for consistent config dumping.
-diff --git a/source/common/router/scoped_rds.cc b/source/common/router/scoped_rds.cc
-index 133e91e..9b2096e 100644
--- a/source/common/router/scoped_rds.cc
-+++ b/source/common/router/scoped_rds.cc
-@@ -245,6 +245,11 @@ bool ScopedRdsConfigSubscription::addOrUpdateScopes(
-         dynamic_cast<const envoy::config::route::v3::ScopedRouteConfiguration&>(
-             resource.get().resource());
-     const std::string scope_name = scoped_route_config.name();
-+    if (const auto& scope_info_iter = scoped_route_map_.find(scope_name);
-+        scope_info_iter != scoped_route_map_.end() &&
-+        scope_info_iter->second->configHash() == MessageUtil::hash(scoped_route_config)) {
-+      continue;
-+    }
-     rds.set_route_config_name(scoped_route_config.route_configuration_name());
-     std::unique_ptr<RdsRouteConfigProviderHelper> rds_config_provider_helper;
-     std::shared_ptr<ScopedRouteInfo> scoped_route_info = nullptr;
-@@ -398,6 +403,7 @@ void ScopedRdsConfigSubscription::onRdsConfigUpdate(const std::string& scope_nam
-   auto new_scoped_route_info = std::make_shared<ScopedRouteInfo>(
-       envoy::config::route::v3::ScopedRouteConfiguration(iter->second->configProto()),
-       std::move(new_rds_config));
-+  scoped_route_map_[new_scoped_route_info->scopeName()] = new_scoped_route_info;
-   applyConfigUpdate([new_scoped_route_info](ConfigProvider::ConfigConstSharedPtr config)
-                         -> ConfigProvider::ConfigConstSharedPtr {
-     auto* thread_local_scoped_config =
-diff --git a/source/common/router/scoped_rds.h b/source/common/router/scoped_rds.h
-index d21d812..a510c1f 100644
--- a/source/common/router/scoped_rds.h
-+++ b/source/common/router/scoped_rds.h
-@@ -104,7 +104,7 @@ struct ScopedRdsStats {
- // A scoped RDS subscription to be used with the dynamic scoped RDS ConfigProvider.
- class ScopedRdsConfigSubscription
-     : public Envoy::Config::DeltaConfigSubscriptionInstance,
-      Envoy::Config::SubscriptionBase<envoy::config::route::v3::ScopedRouteConfiguration> {
-+      public Envoy::Config::SubscriptionBase<envoy::config::route::v3::ScopedRouteConfiguration> {
- public:
-   using ScopedRouteConfigurationMap =
-       std::map<std::string, envoy::config::route::v3::ScopedRouteConfiguration>;
-diff --git a/test/common/router/scoped_config_impl_test.cc b/test/common/router/scoped_config_impl_test.cc
-index f63f258..69a2f4b 100644
--- a/test/common/router/scoped_config_impl_test.cc
-+++ b/test/common/router/scoped_config_impl_test.cc
-@@ -452,6 +452,24 @@ TEST_F(ScopedRouteInfoTest, Creation) {
-   EXPECT_EQ(info_->scopeKey(), makeKey({"foo", "bar"}));
- }
- 
-+// Tests that config hash changes if ScopedRouteConfiguration of the ScopedRouteInfo changes.
-+TEST_F(ScopedRouteInfoTest, Hash) {
-+  const envoy::config::route::v3::ScopedRouteConfiguration config_copy = scoped_route_config_;
-+  info_ = std::make_unique<ScopedRouteInfo>(scoped_route_config_, route_config_);
-+  EXPECT_EQ(info_->routeConfig().get(), route_config_.get());
-+  EXPECT_TRUE(TestUtility::protoEqual(info_->configProto(), config_copy));
-+  EXPECT_EQ(info_->scopeName(), "foo_scope");
-+  EXPECT_EQ(info_->scopeKey(), makeKey({"foo", "bar"}));
-+
-+  const auto info2 = std::make_unique<ScopedRouteInfo>(scoped_route_config_, route_config_);
-+  ASSERT_EQ(info2->configHash(), info_->configHash());
-+
-+  // Mutate the config and hash should be different now.
-+  scoped_route_config_.set_on_demand(true);
-+  const auto info3 = std::make_unique<ScopedRouteInfo>(scoped_route_config_, route_config_);
-+  ASSERT_NE(info3->configHash(), info_->configHash());
-+}
-+
- class ScopedConfigImplTest : public testing::Test {
- public:
-   void SetUp() override {
-diff --git a/test/common/router/scoped_rds_test.cc b/test/common/router/scoped_rds_test.cc
-index 09b96a6..b4776c9 100644
--- a/test/common/router/scoped_rds_test.cc
-+++ b/test/common/router/scoped_rds_test.cc
-@@ -13,6 +13,7 @@
- #include "envoy/stats/scope.h"
- 
- #include "source/common/config/api_version.h"
-+#include "source/common/config/config_provider_impl.h"
- #include "source/common/config/grpc_mux_impl.h"
- #include "source/common/protobuf/message_validator_impl.h"
- #include "source/common/router/scoped_rds.h"
-@@ -365,6 +366,48 @@ key:
-                             "Didn't find a registered implementation for name: 'filter.unknown'");
- }
- 
-+// Test that scopes with same config as existing scopes will be skipped in a config push.
-+TEST_F(ScopedRdsTest, UnchangedScopesAreSkipped) {
-+  setup();
-+  init_watcher_.expectReady();
-+  const std::string config_yaml = R"EOF(
-+name: foo_scope
-+route_configuration_name: foo_routes
-+key:
-+  fragments:
-+    - string_key: x-foo-key
-+)EOF";
-+  const auto resource = parseScopedRouteConfigurationFromYaml(config_yaml);
-+  const std::string config_yaml2 = R"EOF(
-+name: foo_scope2
-+route_configuration_name: foo_routes
-+key:
-+  fragments:
-+    - string_key: x-bar-key
-+)EOF";
-+  const auto resource_2 = parseScopedRouteConfigurationFromYaml(config_yaml2);
-+
-+  // Delta API.
-+  const auto decoded_resources = TestUtility::decodeResources({resource, resource_2});
-+  context_init_manager_.initialize(init_watcher_);
-+  EXPECT_NO_THROW(srds_subscription_->onConfigUpdate(decoded_resources.refvec_, {}, "v1"));
-+  EXPECT_EQ(1UL,
-+            server_factory_context_.scope_.counter("foo.scoped_rds.foo_scoped_routes.config_reload")
-+                .value());
-+  EXPECT_EQ(2UL, all_scopes_.value());
-+  pushRdsConfig({"foo_routes"}, "111");
-+  Envoy::Router::ScopedRdsConfigSubscription* srds_delta_subscription =
-+      static_cast<Envoy::Router::ScopedRdsConfigSubscription*>(srds_subscription_);
-+  ASSERT_NE(srds_delta_subscription, nullptr);
-+  ASSERT_EQ("v1", srds_delta_subscription->configInfo()->last_config_version_);
-+  // Push again the same set of config with different version number, the config will be skipped.
-+  EXPECT_NO_THROW(srds_subscription_->onConfigUpdate(decoded_resources.refvec_, {}, "123"));
-+  ASSERT_EQ("v1", srds_delta_subscription->configInfo()->last_config_version_);
-+  EXPECT_EQ(2UL,
-+            server_factory_context_.scope_.counter("foo.scoped_rds.foo_scoped_routes.config_reload")
-+                .value());
-+}
-+
- // Test ignoring the optional unknown factory in the per-virtualhost typed config.
- TEST_F(ScopedRdsTest, OptionalUnknownFactoryForPerVirtualHostTypedConfig) {
-   OptionalHttpFilters optional_http_filters;
--- a/envoy/1.20/patches/envoy/20240725-rename-original-host-header.patch
+++ b/envoy/1.20/patches/envoy/20240725-rename-original-host-header.patch
@@ -1,13 +0,0 @@
-diff --git a/source/common/http/headers.h b/source/common/http/headers.h
-index a7a8a3393e..6af4a2852d 100644
--- a/source/common/http/headers.h
-+++ b/source/common/http/headers.h
-@@ -123,7 +123,7 @@ public:
-     const LowerCaseString TriCostTime{"req-cost-time"};
-     const LowerCaseString TriStartTime{"req-start-time"};
-     const LowerCaseString TriRespStartTime{"resp-start-time"};
-    const LowerCaseString EnvoyOriginalHost{"original-host"};
-+    const LowerCaseString EnvoyOriginalHost{"x-envoy-original-host"};
-     const LowerCaseString HigressOriginalService{"x-higress-original-service"};
-   } AliExtendedValues;
- #endif
--- a/envoy/1.20/patches/envoy/20240725-set-buffer-limit.patch
+++ b/envoy/1.20/patches/envoy/20240725-set-buffer-limit.patch
@@ -1,43 +0,0 @@
-diff --git a/source/extensions/common/wasm/context.cc b/source/extensions/common/wasm/context.cc
-index 9642d8abd3..410baa856f 100644
--- a/source/extensions/common/wasm/context.cc
-+++ b/source/extensions/common/wasm/context.cc
-@@ -62,6 +62,21 @@ constexpr absl::string_view CelStateKeyPrefix = "wasm.";
- #if defined(ALIMESH)
- constexpr std::string_view ClearRouteCacheKey = "clear_route_cache";
- constexpr std::string_view DisableClearRouteCache = "off";
-+constexpr std::string_view SetDecoderBufferLimit = "set_decoder_buffer_limit";
-+constexpr std::string_view SetEncoderBufferLimit = "set_encoder_buffer_limit";
-+
-+bool stringViewToUint32(std::string_view str, uint32_t& out_value) {
-+  try {
-+    unsigned long temp = std::stoul(std::string(str));
-+    if (temp <= std::numeric_limits<uint32_t>::max()) {
-+      out_value = static_cast<uint32_t>(temp);
-+      return true;
-+    }
-+  } catch (const std::exception& e) {
-+    ENVOY_LOG_MISC(critical, "stringToUint exception '{}'", e.what());
-+  }
-+  return false;
-+}
- #endif
- 
- using HashPolicy = envoy::config::route::v3::RouteAction::HashPolicy;
-@@ -1280,6 +1295,16 @@ WasmResult Context::setProperty(std::string_view path, std::string_view value) {
-     } else {
-       disable_clear_route_cache_ = false;
-     }
-+  } else if (path == SetDecoderBufferLimit && decoder_callbacks_) {
-+    uint32_t buffer_limit;
-+    if (stringViewToUint32(value, buffer_limit)) {
-+      decoder_callbacks_->setDecoderBufferLimit(buffer_limit);
-+    }
-+  } else if (path == SetEncoderBufferLimit && encoder_callbacks_) {
-+    uint32_t buffer_limit;
-+    if (stringViewToUint32(value, buffer_limit)) {
-+      encoder_callbacks_->setEncoderBufferLimit(buffer_limit);
-+    }
-   }
- #endif
-   if (!state->setValue(toAbslStringView(value))) {
--- a/envoy/1.20/patches/envoy/20240726-custom-span-tag.patch
+++ b/envoy/1.20/patches/envoy/20240726-custom-span-tag.patch
@@ -1,106 +0,0 @@
-diff --git a/envoy/stream_info/stream_info.h b/envoy/stream_info/stream_info.h
-index c6d82db4f4..09717673b0 100644
--- a/envoy/stream_info/stream_info.h
-+++ b/envoy/stream_info/stream_info.h
-@@ -613,7 +613,21 @@ public:
-    * @return the number of times the request was attempted upstream, absl::nullopt if the request
-    * was never attempted upstream.
-    */
-+
-   virtual absl::optional<uint32_t> attemptCount() const PURE;
-+
-+#ifdef ALIMESH
-+  /**
-+   * @param key the filter state key set by wasm filter.
-+   * @param value the filter state value set by wasm filter.
-+   */
-+  virtual void setCustomSpanTag(const std::string& key, const std::string& value) PURE;
-+
-+  /**
-+   * @return the key-value map of filter states set by wasm filter.
-+   */
-+  virtual const std::unordered_map<std::string, std::string>& getCustomSpanTagMap() const PURE;
-+#endif
- };
- 
- } // namespace StreamInfo
-diff --git a/source/common/stream_info/stream_info_impl.h b/source/common/stream_info/stream_info_impl.h
-index 6ce2afe773..d5e7a80b37 100644
--- a/source/common/stream_info/stream_info_impl.h
-+++ b/source/common/stream_info/stream_info_impl.h
-@@ -291,6 +291,20 @@ struct StreamInfoImpl : public StreamInfo {
- 
-   absl::optional<uint32_t> attemptCount() const override { return attempt_count_; }
- 
-+#ifdef ALIMESH
-+  void setCustomSpanTag(const std::string& key, const std::string& value) override {
-+    auto it = custom_span_tags_.find(key);
-+    if (it != custom_span_tags_.end()) {
-+      it->second = value;
-+    } else {
-+      custom_span_tags_.emplace(key, value);
-+    }
-+  }
-+
-+  const std::unordered_map<std::string, std::string>& getCustomSpanTagMap() const override {
-+    return custom_span_tags_;
-+  }
-+#endif
-   TimeSource& time_source_;
-   const SystemTime start_time_;
-   const MonotonicTime start_time_monotonic_;
-@@ -350,6 +364,9 @@ private:
-   absl::optional<Upstream::ClusterInfoConstSharedPtr> upstream_cluster_info_;
-   std::string filter_chain_name_;
-   Tracing::Reason trace_reason_;
-+#ifdef ALIMESH
-+  std::unordered_map<std::string, std::string> custom_span_tags_;
-+#endif
- };
- 
- } // namespace StreamInfo
-diff --git a/source/common/tracing/http_tracer_impl.cc b/source/common/tracing/http_tracer_impl.cc
-index e55cf00e0a..f94e9101d7 100644
--- a/source/common/tracing/http_tracer_impl.cc
-+++ b/source/common/tracing/http_tracer_impl.cc
-@@ -214,6 +214,14 @@ void HttpTracerUtility::setCommonTags(Span& span, const Http::ResponseHeaderMap*
- 
-   span.setTag(Tracing::Tags::get().Component, Tracing::Tags::get().Proxy);
- 
-+#ifdef ALIMESH
-+  // Wasm filter state
-+  const auto& custom_span_tags = stream_info.getCustomSpanTagMap();
-+  for (const auto& it : custom_span_tags) {
-+    span.setTag(it.first, it.second);
-+  }
-+#endif
-+
-   if (nullptr != stream_info.upstreamHost()) {
-     span.setTag(Tracing::Tags::get().UpstreamCluster, stream_info.upstreamHost()->cluster().name());
-     span.setTag(Tracing::Tags::get().UpstreamClusterName,
-diff --git a/source/extensions/common/wasm/context.cc b/source/extensions/common/wasm/context.cc
-index 410baa856f..b11ecf1cd6 100644
--- a/source/extensions/common/wasm/context.cc
-+++ b/source/extensions/common/wasm/context.cc
-@@ -60,6 +60,7 @@ namespace {
- constexpr absl::string_view CelStateKeyPrefix = "wasm.";
- 
- #if defined(ALIMESH)
-+constexpr absl::string_view CustomeTraceSpanTagPrefix = "trace_span_tag.";
- constexpr std::string_view ClearRouteCacheKey = "clear_route_cache";
- constexpr std::string_view DisableClearRouteCache = "off";
- constexpr std::string_view SetDecoderBufferLimit = "set_decoder_buffer_limit";
-@@ -1271,6 +1272,13 @@ WasmResult Context::setProperty(std::string_view path, std::string_view value) {
-   if (!stream_info) {
-     return WasmResult::NotFound;
-   }
-+#ifdef ALIMESH
-+  if (absl::StartsWith(absl::string_view{path.data(), path.size()}, CustomeTraceSpanTagPrefix)) {
-+    stream_info->setCustomSpanTag(std::string(path.substr(CustomeTraceSpanTagPrefix.size())),
-+                                  std::string(value));
-+    return WasmResult::Ok;
-+  }
-+#endif
-   std::string key;
-   absl::StrAppend(&key, CelStateKeyPrefix, toAbslStringView(path));
-   CelState* state;
--- a/envoy/1.20/patches/go-control-plane/20221027-init.patch
+++ b/envoy/1.20/patches/go-control-plane/20221027-init.patch
--- a/envoy/1.20/patches/go-control-plane/20221129-fix-xds-version.patch
+++ b/envoy/1.20/patches/go-control-plane/20221129-fix-xds-version.patch
@@ -1,24 +0,0 @@
-diff -Naur go-control-plane/go.mod new/go.mod
--- go-control-plane/go.mod	2022-11-29 18:48:27.000000000 +0800
-+++ new/go.mod	2022-11-29 18:49:13.000000000 +0800
-@@ -4,7 +4,7 @@
- 
- require (
- 	github.com/census-instrumentation/opencensus-proto v0.2.1
-	github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158
-+	github.com/cncf/xds/go v0.0.0-20220520190051-1e77728a1eaa
- 	github.com/envoyproxy/protoc-gen-validate v0.1.0
- 	github.com/golang/protobuf v1.4.3
- 	github.com/google/go-cmp v0.5.0
-diff -Naur go-control-plane/go.sum new/go.sum
--- go-control-plane/go.sum	2022-11-29 18:48:27.000000000 +0800
-+++ new/go.sum	2022-11-29 18:49:13.000000000 +0800
-@@ -9,6 +9,8 @@
- github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
- github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158 h1:CevA8fI91PAnP8vpnXuB8ZYAZ5wqY86nAbxfgK8tWO4=
- github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-+github.com/cncf/xds/go v0.0.0-20220520190051-1e77728a1eaa h1:B/lvg4tQ5hfFZd4V2hcSfFVfUvAK6GSFKxIIzwnkv8g=
-+github.com/cncf/xds/go v0.0.0-20220520190051-1e77728a1eaa/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
- github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
- github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
- github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
--- a/envoy/1.20/patches/go-control-plane/20240104-enhance-srds.patch
+++ b/envoy/1.20/patches/go-control-plane/20240104-enhance-srds.patch
@@ -1,931 +0,0 @@
-diff -Naur go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.go go-control-plane-new/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.go
--- go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.go	2024-01-04 21:07:22.000000000 +0800
-+++ go-control-plane-new/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.go	2024-01-04 21:02:10.000000000 +0800
-@@ -2286,6 +2286,8 @@
- 
- 	// Types that are assignable to Type:
- 	//	*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_
-+	//	*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor_
-+	//	*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor_
- 	Type isScopedRoutes_ScopeKeyBuilder_FragmentBuilder_Type `protobuf_oneof:"type"`
- }
- 
-@@ -2335,6 +2337,20 @@
- 	return nil
- }
- 
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder) GetHostValueExtractor() *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor {
-+	if x, ok := x.GetType().(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor_); ok {
-+		return x.HostValueExtractor
-+	}
-+	return nil
-+}
-+
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder) GetLocalPortValueExtractor() *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor {
-+	if x, ok := x.GetType().(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor_); ok {
-+		return x.LocalPortValueExtractor
-+	}
-+	return nil
-+}
-+
- type isScopedRoutes_ScopeKeyBuilder_FragmentBuilder_Type interface {
- 	isScopedRoutes_ScopeKeyBuilder_FragmentBuilder_Type()
- }
-@@ -2344,9 +2360,23 @@
- 	HeaderValueExtractor *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor `protobuf:"bytes,1,opt,name=header_value_extractor,json=headerValueExtractor,proto3,oneof"`
- }
- 
-+type ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor_ struct {
-+	HostValueExtractor *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor `protobuf:"bytes,101,opt,name=host_value_extractor,json=hostValueExtractor,proto3,oneof"`
-+}
-+
-+type ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor_ struct {
-+	LocalPortValueExtractor *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor `protobuf:"bytes,102,opt,name=local_port_value_extractor,json=localPortValueExtractor,proto3,oneof"`
-+}
-+
- func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_) isScopedRoutes_ScopeKeyBuilder_FragmentBuilder_Type() {
- }
- 
-+func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor_) isScopedRoutes_ScopeKeyBuilder_FragmentBuilder_Type() {
-+}
-+
-+func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor_) isScopedRoutes_ScopeKeyBuilder_FragmentBuilder_Type() {
-+}
-+
- // Specifies how the value of a header should be extracted.
- // The following example maps the structure of a header to the fields in this message.
- //
-@@ -2475,6 +2505,92 @@
- func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_Element) isScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_ExtractType() {
- }
- 
-+type ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor struct {
-+	state         protoimpl.MessageState
-+	sizeCache     protoimpl.SizeCache
-+	unknownFields protoimpl.UnknownFields
-+
-+	// The maximum number of host superset recomputes. If not specified, defaults to 100.
-+	MaxRecomputeNum *wrappers.UInt32Value `protobuf:"bytes,1,opt,name=max_recompute_num,json=maxRecomputeNum,proto3" json:"max_recompute_num,omitempty"`
-+}
-+
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor) Reset() {
-+	*x = ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor{}
-+	if protoimpl.UnsafeEnabled {
-+		mi := &file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[18]
-+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-+		ms.StoreMessageInfo(mi)
-+	}
-+}
-+
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor) String() string {
-+	return protoimpl.X.MessageStringOf(x)
-+}
-+
-+func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor) ProtoMessage() {}
-+
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor) ProtoReflect() protoreflect.Message {
-+	mi := &file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[18]
-+	if protoimpl.UnsafeEnabled && x != nil {
-+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-+		if ms.LoadMessageInfo() == nil {
-+			ms.StoreMessageInfo(mi)
-+		}
-+		return ms
-+	}
-+	return mi.MessageOf(x)
-+}
-+
-+// Deprecated: Use ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor.ProtoReflect.Descriptor instead.
-+func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor) Descriptor() ([]byte, []int) {
-+	return file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_rawDescGZIP(), []int{5, 0, 0, 1}
-+}
-+
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor) GetMaxRecomputeNum() *wrappers.UInt32Value {
-+	if x != nil {
-+		return x.MaxRecomputeNum
-+	}
-+	return nil
-+}
-+
-+type ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor struct {
-+	state         protoimpl.MessageState
-+	sizeCache     protoimpl.SizeCache
-+	unknownFields protoimpl.UnknownFields
-+}
-+
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor) Reset() {
-+	*x = ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor{}
-+	if protoimpl.UnsafeEnabled {
-+		mi := &file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[19]
-+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-+		ms.StoreMessageInfo(mi)
-+	}
-+}
-+
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor) String() string {
-+	return protoimpl.X.MessageStringOf(x)
-+}
-+
-+func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor) ProtoMessage() {}
-+
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor) ProtoReflect() protoreflect.Message {
-+	mi := &file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[19]
-+	if protoimpl.UnsafeEnabled && x != nil {
-+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-+		if ms.LoadMessageInfo() == nil {
-+			ms.StoreMessageInfo(mi)
-+		}
-+		return ms
-+	}
-+	return mi.MessageOf(x)
-+}
-+
-+// Deprecated: Use ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor.ProtoReflect.Descriptor instead.
-+func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor) Descriptor() ([]byte, []int) {
-+	return file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_rawDescGZIP(), []int{5, 0, 0, 2}
-+}
-+
- // Specifies a header field's key value pair to match on.
- type ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement struct {
- 	state         protoimpl.MessageState
-@@ -2494,7 +2610,7 @@
- func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement) Reset() {
- 	*x = ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement{}
- 	if protoimpl.UnsafeEnabled {
-		mi := &file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[18]
-+		mi := &file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[20]
- 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
- 		ms.StoreMessageInfo(mi)
- 	}
-@@ -2507,7 +2623,7 @@
- func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement) ProtoMessage() {}
- 
- func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement) ProtoReflect() protoreflect.Message {
-	mi := &file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[18]
-+	mi := &file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[20]
- 	if protoimpl.UnsafeEnabled && x != nil {
- 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
- 		if ms.LoadMessageInfo() == nil {
-@@ -3079,7 +3195,7 @@
- 	0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61,
- 	0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52,
- 	0x6f, 0x75, 0x74, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x22, 0xe9, 0x0e, 0x0a, 0x0c, 0x53, 0x63, 0x6f, 0x70, 0x65,
-+	0x6e, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x22, 0xe1, 0x14, 0x0a, 0x0c, 0x53, 0x63, 0x6f, 0x70, 0x65,
- 	0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x1b, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
- 	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xfa, 0x42, 0x04, 0x72, 0x02, 0x10, 0x01, 0x52, 0x04,
- 	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x8f, 0x01, 0x0a, 0x11, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x6b,
-@@ -3114,7 +3230,7 @@
- 	0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
- 	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x33, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65,
- 	0x64, 0x52, 0x64, 0x73, 0x48, 0x00, 0x52, 0x09, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x64,
-	0x73, 0x1a, 0xd9, 0x09, 0x0a, 0x0f, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75,
-+	0x73, 0x1a, 0xd1, 0x0f, 0x0a, 0x0f, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75,
- 	0x69, 0x6c, 0x64, 0x65, 0x72, 0x12, 0x91, 0x01, 0x0a, 0x09, 0x66, 0x72, 0x61, 0x67, 0x6d, 0x65,
- 	0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x69, 0x2e, 0x65, 0x6e, 0x76, 0x6f,
- 	0x79, 0x2e, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x69, 0x6c,
-@@ -3124,7 +3240,7 @@
- 	0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69,
- 	0x6c, 0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42, 0x75, 0x69,
- 	0x6c, 0x64, 0x65, 0x72, 0x42, 0x08, 0xfa, 0x42, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x09,
-	0x66, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x1a, 0xd5, 0x07, 0x0a, 0x0f, 0x46, 0x72,
-+	0x66, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x1a, 0xcd, 0x0d, 0x0a, 0x0f, 0x46, 0x72,
- 	0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x12, 0xb6, 0x01,
- 	0x0a, 0x16, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x65,
- 	0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x7e,
-@@ -3137,131 +3253,178 @@
- 	0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72,
- 	0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x48, 0x00,
- 	0x52, 0x14, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74,
-	0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x1a, 0x8f, 0x05, 0x0a, 0x14, 0x48, 0x65, 0x61, 0x64, 0x65,
-	0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x12,
-	0x1b, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xfa,
-	0x42, 0x04, 0x72, 0x02, 0x10, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2b, 0x0a, 0x11,
-	0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x65, 0x70, 0x61, 0x72, 0x61, 0x74, 0x6f,
-	0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x53, 0x65, 0x70, 0x61, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x16, 0x0a, 0x05, 0x69, 0x6e, 0x64,
-	0x65, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x48, 0x00, 0x52, 0x05, 0x69, 0x6e, 0x64, 0x65,
-	0x78, 0x12, 0xa5, 0x01, 0x0a, 0x07, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x18, 0x04, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x88, 0x01, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x65, 0x78, 0x74,
-	0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x2e,
-+	0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x12, 0xb0, 0x01, 0x0a, 0x14, 0x68, 0x6f, 0x73, 0x74, 0x5f,
-+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x65, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x18,
-+	0x65, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x7c, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x65, 0x78,
-+	0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73,
-+	0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f,
-+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72,
-+	0x2e, 0x76, 0x33, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73,
-+	0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72,
-+	0x2e, 0x46, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72,
-+	0x2e, 0x48, 0x6f, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63,
-+	0x74, 0x6f, 0x72, 0x48, 0x00, 0x52, 0x12, 0x68, 0x6f, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65,
-+	0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x12, 0xc1, 0x01, 0x0a, 0x1a, 0x6c, 0x6f,
-+	0x63, 0x61, 0x6c, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x65,
-+	0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x18, 0x66, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x81,
-+	0x01, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f,
-+	0x6e, 0x73, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f,
-+	0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
-+	0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x33, 0x2e, 0x53, 0x63,
-+	0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65,
-+	0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61, 0x67, 0x6d,
-+	0x65, 0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x4c, 0x6f, 0x63, 0x61, 0x6c,
-+	0x50, 0x6f, 0x72, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74,
-+	0x6f, 0x72, 0x48, 0x00, 0x52, 0x17, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x50, 0x6f, 0x72, 0x74, 0x56,
-+	0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x1a, 0x8f, 0x05,
-+	0x0a, 0x14, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74,
-+	0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x12, 0x1b, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
-+	0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xfa, 0x42, 0x04, 0x72, 0x02, 0x10, 0x01, 0x52, 0x04, 0x6e,
-+	0x61, 0x6d, 0x65, 0x12, 0x2b, 0x0a, 0x11, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x73,
-+	0x65, 0x70, 0x61, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10,
-+	0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x70, 0x61, 0x72, 0x61, 0x74, 0x6f, 0x72,
-+	0x12, 0x16, 0x0a, 0x05, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x48,
-+	0x00, 0x52, 0x05, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x12, 0xa5, 0x01, 0x0a, 0x07, 0x65, 0x6c, 0x65,
-+	0x6d, 0x65, 0x6e, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x88, 0x01, 0x2e, 0x65, 0x6e,
-+	0x76, 0x6f, 0x79, 0x2e, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66,
-+	0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68,
-+	0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d,
-+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x33, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64,
-+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42,
-+	0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42,
-+	0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56, 0x61, 0x6c,
-+	0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x4b, 0x76, 0x45, 0x6c,
-+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x07, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-+	0x1a, 0xdb, 0x01, 0x0a, 0x09, 0x4b, 0x76, 0x45, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x25,
-+	0x0a, 0x09, 0x73, 0x65, 0x70, 0x61, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28,
-+	0x09, 0x42, 0x07, 0xfa, 0x42, 0x04, 0x72, 0x02, 0x10, 0x01, 0x52, 0x09, 0x73, 0x65, 0x70, 0x61,
-+	0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x19, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01,
-+	0x28, 0x09, 0x42, 0x07, 0xfa, 0x42, 0x04, 0x72, 0x02, 0x10, 0x01, 0x52, 0x03, 0x6b, 0x65, 0x79,
-+	0x3a, 0x8b, 0x01, 0x9a, 0xc5, 0x88, 0x1e, 0x85, 0x01, 0x0a, 0x82, 0x01, 0x65, 0x6e, 0x76, 0x6f,
-+	0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e,
- 	0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e,
- 	0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e,
-	0x76, 0x33, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e,
-+	0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e,
- 	0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e,
- 	0x46, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e,
- 	0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61,
-	0x63, 0x74, 0x6f, 0x72, 0x2e, 0x4b, 0x76, 0x45, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x48, 0x00,
-	0x52, 0x07, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x1a, 0xdb, 0x01, 0x0a, 0x09, 0x4b, 0x76,
-	0x45, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x25, 0x0a, 0x09, 0x73, 0x65, 0x70, 0x61, 0x72,
-	0x61, 0x74, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xfa, 0x42, 0x04, 0x72,
-	0x02, 0x10, 0x01, 0x52, 0x09, 0x73, 0x65, 0x70, 0x61, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x19,
-	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xfa, 0x42, 0x04,
-	0x72, 0x02, 0x10, 0x01, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x3a, 0x8b, 0x01, 0x9a, 0xc5, 0x88, 0x1e,
-	0x85, 0x01, 0x0a, 0x82, 0x01, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69,
-+	0x63, 0x74, 0x6f, 0x72, 0x2e, 0x4b, 0x76, 0x45, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x3a, 0x7f,
-+	0x9a, 0xc5, 0x88, 0x1e, 0x7a, 0x0a, 0x78, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e,
-+	0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f,
-+	0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
-+	0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63,
-+	0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65,
-+	0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61, 0x67, 0x6d,
-+	0x65, 0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65,
-+	0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x42,
-+	0x0e, 0x0a, 0x0c, 0x65, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x1a,
-+	0xdd, 0x01, 0x0a, 0x12, 0x48, 0x6f, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74,
-+	0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x12, 0x48, 0x0a, 0x11, 0x6d, 0x61, 0x78, 0x5f, 0x72, 0x65,
-+	0x63, 0x6f, 0x6d, 0x70, 0x75, 0x74, 0x65, 0x5f, 0x6e, 0x75, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28,
-+	0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-+	0x62, 0x75, 0x66, 0x2e, 0x55, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52,
-+	0x0f, 0x6d, 0x61, 0x78, 0x52, 0x65, 0x63, 0x6f, 0x6d, 0x70, 0x75, 0x74, 0x65, 0x4e, 0x75, 0x6d,
-+	0x3a, 0x7d, 0x9a, 0xc5, 0x88, 0x1e, 0x78, 0x0a, 0x76, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63,
-+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74,
-+	0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
-+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e,
-+	0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f,
-+	0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61,
-+	0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x48, 0x6f, 0x73,
-+	0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x1a,
-+	0x9e, 0x01, 0x0a, 0x17, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x50, 0x6f, 0x72, 0x74, 0x56, 0x61, 0x6c,
-+	0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x3a, 0x82, 0x01, 0x9a, 0xc5,
-+	0x88, 0x1e, 0x7d, 0x0a, 0x7b, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69,
- 	0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
- 	0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
- 	0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f, 0x70,
- 	0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65,
- 	0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e,
-	0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56,
-	0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x4b, 0x76,
-	0x45, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x3a, 0x7f, 0x9a, 0xc5, 0x88, 0x1e, 0x7a, 0x0a, 0x78,
-	0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c,
-	0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70,
-	0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75,
-	0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c,
-	0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c,
-	0x64, 0x65, 0x72, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45,
-	0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x42, 0x0e, 0x0a, 0x0c, 0x65, 0x78, 0x74, 0x72,
-	0x61, 0x63, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x3a, 0x6a, 0x9a, 0xc5, 0x88, 0x1e, 0x65, 0x0a,
-	0x63, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69,
-	0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74,
-	0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69,
-	0x6c, 0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42, 0x75, 0x69,
-	0x6c, 0x64, 0x65, 0x72, 0x42, 0x0b, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x03, 0xf8, 0x42,
-	0x01, 0x3a, 0x5a, 0x9a, 0xc5, 0x88, 0x1e, 0x55, 0x0a, 0x53, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e,
-	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65,
-	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32,
-	0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63,
-	0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x3a, 0x4a, 0x9a,
-	0xc5, 0x88, 0x1e, 0x45, 0x0a, 0x43, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
-	0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f,
-	0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x42, 0x17, 0x0a, 0x10, 0x63, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x5f, 0x73, 0x70, 0x65, 0x63, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x03, 0xf8,
-	0x42, 0x01, 0x22, 0xf1, 0x01, 0x0a, 0x09, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x64, 0x73,
-	0x12, 0x65, 0x0a, 0x18, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x5f, 0x72, 0x64, 0x73, 0x5f, 0x63,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x2e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x33, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x08, 0xfa, 0x42, 0x05, 0x8a, 0x01, 0x02, 0x10, 0x01,
-	0x52, 0x15, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x64, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x34, 0x0a, 0x16, 0x73, 0x72, 0x64, 0x73, 0x5f,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x5f, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x6f,
-	0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x14, 0x73, 0x72, 0x64, 0x73, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x4c, 0x6f, 0x63, 0x61, 0x74, 0x6f, 0x72, 0x3a, 0x47, 0x9a,
-	0xc5, 0x88, 0x1e, 0x42, 0x0a, 0x40, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
-	0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
-	0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f,
-	0x70, 0x65, 0x64, 0x52, 0x64, 0x73, 0x22, 0xcc, 0x02, 0x0a, 0x0a, 0x48, 0x74, 0x74, 0x70, 0x46,
-	0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x1b, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x42, 0x07, 0xfa, 0x42, 0x04, 0x72, 0x02, 0x10, 0x01, 0x52, 0x04, 0x6e, 0x61,
-	0x6d, 0x65, 0x12, 0x39, 0x0a, 0x0c, 0x74, 0x79, 0x70, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x48, 0x00,
-	0x52, 0x0b, 0x74, 0x79, 0x70, 0x65, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x58, 0x0a,
-	0x10, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72,
-	0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e,
-	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x33, 0x2e, 0x45,
-	0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x48, 0x00, 0x52, 0x0f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x44, 0x69,
-	0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x69, 0x73, 0x5f, 0x6f, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x69, 0x73,
-	0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x3a, 0x48, 0x9a, 0xc5, 0x88, 0x1e, 0x43, 0x0a,
-	0x41, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69,
-	0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74,
-	0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x48, 0x74, 0x74, 0x70, 0x46, 0x69, 0x6c, 0x74,
-	0x65, 0x72, 0x42, 0x0d, 0x0a, 0x0b, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x74, 0x79, 0x70,
-	0x65, 0x4a, 0x04, 0x08, 0x03, 0x10, 0x04, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x52, 0x06, 0x63,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x9f, 0x01, 0x0a, 0x12, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x49, 0x44, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x37, 0x0a, 0x0c,
-	0x74, 0x79, 0x70, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x0b, 0x74, 0x79, 0x70, 0x65, 0x64, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x3a, 0x50, 0x9a, 0xc5, 0x88, 0x1e, 0x4b, 0x0a, 0x49, 0x65, 0x6e,
-+	0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x50, 0x6f,
-+	0x72, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72,
-+	0x3a, 0x6a, 0x9a, 0xc5, 0x88, 0x1e, 0x65, 0x0a, 0x63, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63,
-+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74,
-+	0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
-+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e,
-+	0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f,
-+	0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61,
-+	0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x42, 0x0b, 0x0a, 0x04,
-+	0x74, 0x79, 0x70, 0x65, 0x12, 0x03, 0xf8, 0x42, 0x01, 0x3a, 0x5a, 0x9a, 0xc5, 0x88, 0x1e, 0x55,
-+	0x0a, 0x53, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66,
-+	0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74,
-+	0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61,
-+	0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52,
-+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75,
-+	0x69, 0x6c, 0x64, 0x65, 0x72, 0x3a, 0x4a, 0x9a, 0xc5, 0x88, 0x1e, 0x45, 0x0a, 0x43, 0x65, 0x6e,
- 	0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65,
- 	0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63,
- 	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x72, 0x2e, 0x76, 0x32, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x49, 0x44, 0x45, 0x78,
-	0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x8e, 0x01, 0x0a, 0x20, 0x45, 0x6e, 0x76, 0x6f,
-	0x79, 0x4d, 0x6f, 0x62, 0x69, 0x6c, 0x65, 0x48, 0x74, 0x74, 0x70, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x12, 0x6a, 0x0a, 0x06,
-	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x52, 0x2e, 0x65,
-	0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e,
-	0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e,
-	0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
-	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x33, 0x2e, 0x48, 0x74, 0x74, 0x70, 0x43,
-	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72,
-	0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x42, 0x71, 0x0a, 0x49, 0x69, 0x6f, 0x2e, 0x65,
-	0x6e, 0x76, 0x6f, 0x79, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e,
-	0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65,
-	0x72, 0x73, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f,
-	0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x72, 0x2e, 0x76, 0x33, 0x42, 0x1a, 0x48, 0x74, 0x74, 0x70, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x50, 0x72, 0x6f, 0x74,
-	0x6f, 0x50, 0x01, 0xba, 0x80, 0xc8, 0xd1, 0x06, 0x02, 0x10, 0x02, 0x62, 0x06, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x33,
-+	0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65,
-+	0x73, 0x42, 0x17, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x73, 0x70, 0x65, 0x63,
-+	0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x03, 0xf8, 0x42, 0x01, 0x22, 0xf1, 0x01, 0x0a, 0x09, 0x53,
-+	0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x64, 0x73, 0x12, 0x65, 0x0a, 0x18, 0x73, 0x63, 0x6f, 0x70,
-+	0x65, 0x64, 0x5f, 0x72, 0x64, 0x73, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x73, 0x6f,
-+	0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x76,
-+	0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x76,
-+	0x33, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x08,
-+	0xfa, 0x42, 0x05, 0x8a, 0x01, 0x02, 0x10, 0x01, 0x52, 0x15, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x64,
-+	0x52, 0x64, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12,
-+	0x34, 0x0a, 0x16, 0x73, 0x72, 0x64, 0x73, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-+	0x73, 0x5f, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-+	0x14, 0x73, 0x72, 0x64, 0x73, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x4c, 0x6f,
-+	0x63, 0x61, 0x74, 0x6f, 0x72, 0x3a, 0x47, 0x9a, 0xc5, 0x88, 0x1e, 0x42, 0x0a, 0x40, 0x65, 0x6e,
-+	0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65,
-+	0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63,
-+	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-+	0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x64, 0x73, 0x22, 0xcc,
-+	0x02, 0x0a, 0x0a, 0x48, 0x74, 0x74, 0x70, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x1b, 0x0a,
-+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xfa, 0x42, 0x04,
-+	0x72, 0x02, 0x10, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x39, 0x0a, 0x0c, 0x74, 0x79,
-+	0x70, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b,
-+	0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-+	0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x48, 0x00, 0x52, 0x0b, 0x74, 0x79, 0x70, 0x65, 0x64, 0x43,
-+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x58, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f,
-+	0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32,
-+	0x2b, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x63,
-+	0x6f, 0x72, 0x65, 0x2e, 0x76, 0x33, 0x2e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e,
-+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x48, 0x00, 0x52, 0x0f,
-+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x12,
-+	0x1f, 0x0a, 0x0b, 0x69, 0x73, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18, 0x06,
-+	0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x69, 0x73, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c,
-+	0x3a, 0x48, 0x9a, 0xc5, 0x88, 0x1e, 0x43, 0x0a, 0x41, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63,
-+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74,
-+	0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
-+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e,
-+	0x48, 0x74, 0x74, 0x70, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x42, 0x0d, 0x0a, 0x0b, 0x63, 0x6f,
-+	0x6e, 0x66, 0x69, 0x67, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x4a, 0x04, 0x08, 0x03, 0x10, 0x04, 0x4a,
-+	0x04, 0x08, 0x02, 0x10, 0x03, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x9f, 0x01,
-+	0x0a, 0x12, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x49, 0x44, 0x45, 0x78, 0x74, 0x65, 0x6e,
-+	0x73, 0x69, 0x6f, 0x6e, 0x12, 0x37, 0x0a, 0x0c, 0x74, 0x79, 0x70, 0x65, 0x64, 0x5f, 0x63, 0x6f,
-+	0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f,
-+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79,
-+	0x52, 0x0b, 0x74, 0x79, 0x70, 0x65, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x3a, 0x50, 0x9a,
-+	0xc5, 0x88, 0x1e, 0x4b, 0x0a, 0x49, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66,
-+	0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
-+	0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
-+	0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x52, 0x65, 0x71,
-+	0x75, 0x65, 0x73, 0x74, 0x49, 0x44, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x22,
-+	0x8e, 0x01, 0x0a, 0x20, 0x45, 0x6e, 0x76, 0x6f, 0x79, 0x4d, 0x6f, 0x62, 0x69, 0x6c, 0x65, 0x48,
-+	0x74, 0x74, 0x70, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x6e,
-+	0x61, 0x67, 0x65, 0x72, 0x12, 0x6a, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01,
-+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x52, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x65, 0x78, 0x74,
-+	0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x2e,
-+	0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e,
-+	0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e,
-+	0x76, 0x33, 0x2e, 0x48, 0x74, 0x74, 0x70, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
-+	0x6e, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-+	0x42, 0x71, 0x0a, 0x49, 0x69, 0x6f, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x70, 0x72, 0x6f, 0x78,
-+	0x79, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f,
-+	0x6e, 0x73, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f,
-+	0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
-+	0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x33, 0x42, 0x1a, 0x48,
-+	0x74, 0x74, 0x70, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x6e,
-+	0x61, 0x67, 0x65, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0xba, 0x80, 0xc8, 0xd1, 0x06,
-+	0x02, 0x10, 0x02, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
- }
- 
- var (
-@@ -3277,7 +3440,7 @@
- }
- 
- var file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_enumTypes = make([]protoimpl.EnumInfo, 5)
-var file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes = make([]protoimpl.MessageInfo, 19)
-+var file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes = make([]protoimpl.MessageInfo, 21)
- var file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_goTypes = []interface{}{
- 	(HttpConnectionManager_CodecType)(0),                                                // 0: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.CodecType
- 	(HttpConnectionManager_ServerHeaderTransformation)(0),                               // 1: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ServerHeaderTransformation
-@@ -3302,102 +3465,107 @@
- 	(*ScopedRoutes_ScopeKeyBuilder)(nil),                                                // 20: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder
- 	(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder)(nil),                                // 21: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder
- 	(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor)(nil),           // 22: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor
-	(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement)(nil), // 23: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.KvElement
-	(*v32.RouteConfiguration)(nil),                                                      // 24: envoy.config.route.v3.RouteConfiguration
-	(*wrappers.BoolValue)(nil),                                                          // 25: google.protobuf.BoolValue
-	(*v3.HttpProtocolOptions)(nil),                                                      // 26: envoy.config.core.v3.HttpProtocolOptions
-	(*v3.Http1ProtocolOptions)(nil),                                                     // 27: envoy.config.core.v3.Http1ProtocolOptions
-	(*v3.Http2ProtocolOptions)(nil),                                                     // 28: envoy.config.core.v3.Http2ProtocolOptions
-	(*v3.Http3ProtocolOptions)(nil),                                                     // 29: envoy.config.core.v3.Http3ProtocolOptions
-	(*v3.SchemeHeaderTransformation)(nil),                                               // 30: envoy.config.core.v3.SchemeHeaderTransformation
-	(*wrappers.UInt32Value)(nil),                                                        // 31: google.protobuf.UInt32Value
-	(*duration.Duration)(nil),                                                           // 32: google.protobuf.Duration
-	(*v31.AccessLog)(nil),                                                               // 33: envoy.config.accesslog.v3.AccessLog
-	(*v3.TypedExtensionConfig)(nil),                                                     // 34: envoy.config.core.v3.TypedExtensionConfig
-	(*v3.SubstitutionFormatString)(nil),                                                 // 35: envoy.config.core.v3.SubstitutionFormatString
-	(*v31.AccessLogFilter)(nil),                                                         // 36: envoy.config.accesslog.v3.AccessLogFilter
-	(*v3.DataSource)(nil),                                                               // 37: envoy.config.core.v3.DataSource
-	(*v3.HeaderValueOption)(nil),                                                        // 38: envoy.config.core.v3.HeaderValueOption
-	(*v3.ConfigSource)(nil),                                                             // 39: envoy.config.core.v3.ConfigSource
-	(*v32.ScopedRouteConfiguration)(nil),                                                // 40: envoy.config.route.v3.ScopedRouteConfiguration
-	(*any.Any)(nil),                                                                     // 41: google.protobuf.Any
-	(*v3.ExtensionConfigSource)(nil),                                                    // 42: envoy.config.core.v3.ExtensionConfigSource
-	(*v33.Percent)(nil),                                                                 // 43: envoy.type.v3.Percent
-	(*v34.CustomTag)(nil),                                                               // 44: envoy.type.tracing.v3.CustomTag
-	(*v35.Tracing_Http)(nil),                                                            // 45: envoy.config.trace.v3.Tracing.Http
-	(*v36.PathTransformation)(nil),                                                      // 46: envoy.type.http.v3.PathTransformation
-+	(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor)(nil),             // 23: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HostValueExtractor
-+	(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor)(nil),        // 24: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.LocalPortValueExtractor
-+	(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement)(nil), // 25: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.KvElement
-+	(*v32.RouteConfiguration)(nil),                                                      // 26: envoy.config.route.v3.RouteConfiguration
-+	(*wrappers.BoolValue)(nil),                                                          // 27: google.protobuf.BoolValue
-+	(*v3.HttpProtocolOptions)(nil),                                                      // 28: envoy.config.core.v3.HttpProtocolOptions
-+	(*v3.Http1ProtocolOptions)(nil),                                                     // 29: envoy.config.core.v3.Http1ProtocolOptions
-+	(*v3.Http2ProtocolOptions)(nil),                                                     // 30: envoy.config.core.v3.Http2ProtocolOptions
-+	(*v3.Http3ProtocolOptions)(nil),                                                     // 31: envoy.config.core.v3.Http3ProtocolOptions
-+	(*v3.SchemeHeaderTransformation)(nil),                                               // 32: envoy.config.core.v3.SchemeHeaderTransformation
-+	(*wrappers.UInt32Value)(nil),                                                        // 33: google.protobuf.UInt32Value
-+	(*duration.Duration)(nil),                                                           // 34: google.protobuf.Duration
-+	(*v31.AccessLog)(nil),                                                               // 35: envoy.config.accesslog.v3.AccessLog
-+	(*v3.TypedExtensionConfig)(nil),                                                     // 36: envoy.config.core.v3.TypedExtensionConfig
-+	(*v3.SubstitutionFormatString)(nil),                                                 // 37: envoy.config.core.v3.SubstitutionFormatString
-+	(*v31.AccessLogFilter)(nil),                                                         // 38: envoy.config.accesslog.v3.AccessLogFilter
-+	(*v3.DataSource)(nil),                                                               // 39: envoy.config.core.v3.DataSource
-+	(*v3.HeaderValueOption)(nil),                                                        // 40: envoy.config.core.v3.HeaderValueOption
-+	(*v3.ConfigSource)(nil),                                                             // 41: envoy.config.core.v3.ConfigSource
-+	(*v32.ScopedRouteConfiguration)(nil),                                                // 42: envoy.config.route.v3.ScopedRouteConfiguration
-+	(*any.Any)(nil),                                                                     // 43: google.protobuf.Any
-+	(*v3.ExtensionConfigSource)(nil),                                                    // 44: envoy.config.core.v3.ExtensionConfigSource
-+	(*v33.Percent)(nil),                                                                 // 45: envoy.type.v3.Percent
-+	(*v34.CustomTag)(nil),                                                               // 46: envoy.type.tracing.v3.CustomTag
-+	(*v35.Tracing_Http)(nil),                                                            // 47: envoy.config.trace.v3.Tracing.Http
-+	(*v36.PathTransformation)(nil),                                                      // 48: envoy.type.http.v3.PathTransformation
- }
- var file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_depIdxs = []int32{
- 	0,  // 0: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.codec_type:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.CodecType
- 	8,  // 1: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.rds:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.Rds
-	24, // 2: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.route_config:type_name -> envoy.config.route.v3.RouteConfiguration
-+	26, // 2: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.route_config:type_name -> envoy.config.route.v3.RouteConfiguration
- 	10, // 3: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.scoped_routes:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes
- 	12, // 4: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.http_filters:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter
-	25, // 5: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.add_user_agent:type_name -> google.protobuf.BoolValue
-+	27, // 5: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.add_user_agent:type_name -> google.protobuf.BoolValue
- 	15, // 6: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.tracing:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing
-	26, // 7: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.common_http_protocol_options:type_name -> envoy.config.core.v3.HttpProtocolOptions
-	27, // 8: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.http_protocol_options:type_name -> envoy.config.core.v3.Http1ProtocolOptions
-	28, // 9: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.http2_protocol_options:type_name -> envoy.config.core.v3.Http2ProtocolOptions
-	29, // 10: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.http3_protocol_options:type_name -> envoy.config.core.v3.Http3ProtocolOptions
-+	28, // 7: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.common_http_protocol_options:type_name -> envoy.config.core.v3.HttpProtocolOptions
-+	29, // 8: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.http_protocol_options:type_name -> envoy.config.core.v3.Http1ProtocolOptions
-+	30, // 9: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.http2_protocol_options:type_name -> envoy.config.core.v3.Http2ProtocolOptions
-+	31, // 10: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.http3_protocol_options:type_name -> envoy.config.core.v3.Http3ProtocolOptions
- 	1,  // 11: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.server_header_transformation:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ServerHeaderTransformation
-	30, // 12: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.scheme_header_transformation:type_name -> envoy.config.core.v3.SchemeHeaderTransformation
-	31, // 13: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.max_request_headers_kb:type_name -> google.protobuf.UInt32Value
-	32, // 14: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.stream_idle_timeout:type_name -> google.protobuf.Duration
-	32, // 15: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.request_timeout:type_name -> google.protobuf.Duration
-	32, // 16: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.request_headers_timeout:type_name -> google.protobuf.Duration
-	32, // 17: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.drain_timeout:type_name -> google.protobuf.Duration
-	32, // 18: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.delayed_close_timeout:type_name -> google.protobuf.Duration
-	33, // 19: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.access_log:type_name -> envoy.config.accesslog.v3.AccessLog
-	25, // 20: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.use_remote_address:type_name -> google.protobuf.BoolValue
-	34, // 21: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.original_ip_detection_extensions:type_name -> envoy.config.core.v3.TypedExtensionConfig
-+	32, // 12: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.scheme_header_transformation:type_name -> envoy.config.core.v3.SchemeHeaderTransformation
-+	33, // 13: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.max_request_headers_kb:type_name -> google.protobuf.UInt32Value
-+	34, // 14: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.stream_idle_timeout:type_name -> google.protobuf.Duration
-+	34, // 15: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.request_timeout:type_name -> google.protobuf.Duration
-+	34, // 16: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.request_headers_timeout:type_name -> google.protobuf.Duration
-+	34, // 17: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.drain_timeout:type_name -> google.protobuf.Duration
-+	34, // 18: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.delayed_close_timeout:type_name -> google.protobuf.Duration
-+	35, // 19: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.access_log:type_name -> envoy.config.accesslog.v3.AccessLog
-+	27, // 20: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.use_remote_address:type_name -> google.protobuf.BoolValue
-+	36, // 21: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.original_ip_detection_extensions:type_name -> envoy.config.core.v3.TypedExtensionConfig
- 	16, // 22: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.internal_address_config:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.InternalAddressConfig
-	25, // 23: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.generate_request_id:type_name -> google.protobuf.BoolValue
-+	27, // 23: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.generate_request_id:type_name -> google.protobuf.BoolValue
- 	2,  // 24: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.forward_client_cert_details:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertDetails
- 	17, // 25: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.set_current_client_cert_details:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.SetCurrentClientCertDetails
- 	18, // 26: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.upgrade_configs:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.UpgradeConfig
-	25, // 27: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.normalize_path:type_name -> google.protobuf.BoolValue
-+	27, // 27: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.normalize_path:type_name -> google.protobuf.BoolValue
- 	3,  // 28: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.path_with_escaped_slashes_action:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathWithEscapedSlashesAction
- 	13, // 29: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.request_id_extension:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.RequestIDExtension
- 	6,  // 30: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.local_reply_config:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.LocalReplyConfig
-	25, // 31: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.stream_error_on_invalid_http_message:type_name -> google.protobuf.BoolValue
-+	27, // 31: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.stream_error_on_invalid_http_message:type_name -> google.protobuf.BoolValue
- 	19, // 32: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.path_normalization_options:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathNormalizationOptions
- 	7,  // 33: envoy.extensions.filters.network.http_connection_manager.v3.LocalReplyConfig.mappers:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper
-	35, // 34: envoy.extensions.filters.network.http_connection_manager.v3.LocalReplyConfig.body_format:type_name -> envoy.config.core.v3.SubstitutionFormatString
-	36, // 35: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.filter:type_name -> envoy.config.accesslog.v3.AccessLogFilter
-	31, // 36: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.status_code:type_name -> google.protobuf.UInt32Value
-	37, // 37: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.body:type_name -> envoy.config.core.v3.DataSource
-	35, // 38: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.body_format_override:type_name -> envoy.config.core.v3.SubstitutionFormatString
-	38, // 39: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.headers_to_add:type_name -> envoy.config.core.v3.HeaderValueOption
-	39, // 40: envoy.extensions.filters.network.http_connection_manager.v3.Rds.config_source:type_name -> envoy.config.core.v3.ConfigSource
-	40, // 41: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRouteConfigurationsList.scoped_route_configurations:type_name -> envoy.config.route.v3.ScopedRouteConfiguration
-+	37, // 34: envoy.extensions.filters.network.http_connection_manager.v3.LocalReplyConfig.body_format:type_name -> envoy.config.core.v3.SubstitutionFormatString
-+	38, // 35: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.filter:type_name -> envoy.config.accesslog.v3.AccessLogFilter
-+	33, // 36: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.status_code:type_name -> google.protobuf.UInt32Value
-+	39, // 37: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.body:type_name -> envoy.config.core.v3.DataSource
-+	37, // 38: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.body_format_override:type_name -> envoy.config.core.v3.SubstitutionFormatString
-+	40, // 39: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.headers_to_add:type_name -> envoy.config.core.v3.HeaderValueOption
-+	41, // 40: envoy.extensions.filters.network.http_connection_manager.v3.Rds.config_source:type_name -> envoy.config.core.v3.ConfigSource
-+	42, // 41: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRouteConfigurationsList.scoped_route_configurations:type_name -> envoy.config.route.v3.ScopedRouteConfiguration
- 	20, // 42: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.scope_key_builder:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder
-	39, // 43: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.rds_config_source:type_name -> envoy.config.core.v3.ConfigSource
-+	41, // 43: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.rds_config_source:type_name -> envoy.config.core.v3.ConfigSource
- 	9,  // 44: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.scoped_route_configurations_list:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRouteConfigurationsList
- 	11, // 45: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.scoped_rds:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRds
-	39, // 46: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRds.scoped_rds_config_source:type_name -> envoy.config.core.v3.ConfigSource
-	41, // 47: envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter.typed_config:type_name -> google.protobuf.Any
-	42, // 48: envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter.config_discovery:type_name -> envoy.config.core.v3.ExtensionConfigSource
-	41, // 49: envoy.extensions.filters.network.http_connection_manager.v3.RequestIDExtension.typed_config:type_name -> google.protobuf.Any
-+	41, // 46: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRds.scoped_rds_config_source:type_name -> envoy.config.core.v3.ConfigSource
-+	43, // 47: envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter.typed_config:type_name -> google.protobuf.Any
-+	44, // 48: envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter.config_discovery:type_name -> envoy.config.core.v3.ExtensionConfigSource
-+	43, // 49: envoy.extensions.filters.network.http_connection_manager.v3.RequestIDExtension.typed_config:type_name -> google.protobuf.Any
- 	5,  // 50: envoy.extensions.filters.network.http_connection_manager.v3.EnvoyMobileHttpConnectionManager.config:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
-	43, // 51: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.client_sampling:type_name -> envoy.type.v3.Percent
-	43, // 52: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.random_sampling:type_name -> envoy.type.v3.Percent
-	43, // 53: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.overall_sampling:type_name -> envoy.type.v3.Percent
-	31, // 54: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.max_path_tag_length:type_name -> google.protobuf.UInt32Value
-	44, // 55: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.custom_tags:type_name -> envoy.type.tracing.v3.CustomTag
-	45, // 56: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.provider:type_name -> envoy.config.trace.v3.Tracing.Http
-	25, // 57: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.SetCurrentClientCertDetails.subject:type_name -> google.protobuf.BoolValue
-+	45, // 51: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.client_sampling:type_name -> envoy.type.v3.Percent
-+	45, // 52: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.random_sampling:type_name -> envoy.type.v3.Percent
-+	45, // 53: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.overall_sampling:type_name -> envoy.type.v3.Percent
-+	33, // 54: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.max_path_tag_length:type_name -> google.protobuf.UInt32Value
-+	46, // 55: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.custom_tags:type_name -> envoy.type.tracing.v3.CustomTag
-+	47, // 56: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.provider:type_name -> envoy.config.trace.v3.Tracing.Http
-+	27, // 57: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.SetCurrentClientCertDetails.subject:type_name -> google.protobuf.BoolValue
- 	12, // 58: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.UpgradeConfig.filters:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter
-	25, // 59: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.UpgradeConfig.enabled:type_name -> google.protobuf.BoolValue
-	46, // 60: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathNormalizationOptions.forwarding_transformation:type_name -> envoy.type.http.v3.PathTransformation
-	46, // 61: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathNormalizationOptions.http_filter_transformation:type_name -> envoy.type.http.v3.PathTransformation
-+	27, // 59: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.UpgradeConfig.enabled:type_name -> google.protobuf.BoolValue
-+	48, // 60: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathNormalizationOptions.forwarding_transformation:type_name -> envoy.type.http.v3.PathTransformation
-+	48, // 61: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathNormalizationOptions.http_filter_transformation:type_name -> envoy.type.http.v3.PathTransformation
- 	21, // 62: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.fragments:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder
- 	22, // 63: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.header_value_extractor:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor
-	23, // 64: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.element:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.KvElement
-	65, // [65:65] is the sub-list for method output_type
-	65, // [65:65] is the sub-list for method input_type
-	65, // [65:65] is the sub-list for extension type_name
-	65, // [65:65] is the sub-list for extension extendee
-	0,  // [0:65] is the sub-list for field type_name
-+	23, // 64: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.host_value_extractor:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HostValueExtractor
-+	24, // 65: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.local_port_value_extractor:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.LocalPortValueExtractor
-+	25, // 66: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.element:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.KvElement
-+	33, // 67: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HostValueExtractor.max_recompute_num:type_name -> google.protobuf.UInt32Value
-+	68, // [68:68] is the sub-list for method output_type
-+	68, // [68:68] is the sub-list for method input_type
-+	68, // [68:68] is the sub-list for extension type_name
-+	68, // [68:68] is the sub-list for extension extendee
-+	0,  // [0:68] is the sub-list for field type_name
- }
- 
- func init() {
-@@ -3625,6 +3793,30 @@
- 			}
- 		}
- 		file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-+			switch v := v.(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor); i {
-+			case 0:
-+				return &v.state
-+			case 1:
-+				return &v.sizeCache
-+			case 2:
-+				return &v.unknownFields
-+			default:
-+				return nil
-+			}
-+		}
-+		file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
-+			switch v := v.(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor); i {
-+			case 0:
-+				return &v.state
-+			case 1:
-+				return &v.sizeCache
-+			case 2:
-+				return &v.unknownFields
-+			default:
-+				return nil
-+			}
-+		}
-+		file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
- 			switch v := v.(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement); i {
- 			case 0:
- 				return &v.state
-@@ -3653,6 +3845,8 @@
- 	}
- 	file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[16].OneofWrappers = []interface{}{
- 		(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_)(nil),
-+		(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor_)(nil),
-+		(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor_)(nil),
- 	}
- 	file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[17].OneofWrappers = []interface{}{
- 		(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_Index)(nil),
-@@ -3664,7 +3858,7 @@
- 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
- 			RawDescriptor: file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_rawDesc,
- 			NumEnums:      5,
-			NumMessages:   19,
-+			NumMessages:   21,
- 			NumExtensions: 0,
- 			NumServices:   0,
- 		},
-diff -Naur go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.validate.go go-control-plane-new/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.validate.go
--- go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.validate.go	2024-01-04 21:07:22.000000000 +0800
-+++ go-control-plane-new/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.validate.go	2024-01-04 21:02:10.000000000 +0800
-@@ -1986,6 +1986,30 @@
- 			}
- 		}
- 
-+	case *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor_:
-+
-+		if v, ok := interface{}(m.GetHostValueExtractor()).(interface{ Validate() error }); ok {
-+			if err := v.Validate(); err != nil {
-+				return ScopedRoutes_ScopeKeyBuilder_FragmentBuilderValidationError{
-+					field:  "HostValueExtractor",
-+					reason: "embedded message failed validation",
-+					cause:  err,
-+				}
-+			}
-+		}
-+
-+	case *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor_:
-+
-+		if v, ok := interface{}(m.GetLocalPortValueExtractor()).(interface{ Validate() error }); ok {
-+			if err := v.Validate(); err != nil {
-+				return ScopedRoutes_ScopeKeyBuilder_FragmentBuilderValidationError{
-+					field:  "LocalPortValueExtractor",
-+					reason: "embedded message failed validation",
-+					cause:  err,
-+				}
-+			}
-+		}
-+
- 	default:
- 		return ScopedRoutes_ScopeKeyBuilder_FragmentBuilderValidationError{
- 			field:  "Type",
-@@ -2162,6 +2186,172 @@
- } = ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractorValidationError{}
- 
- // Validate checks the field values on
-+// ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor with the
-+// rules defined in the proto definition for this message. If any rules are
-+// violated, an error is returned.
-+func (m *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor) Validate() error {
-+	if m == nil {
-+		return nil
-+	}
-+
-+	if v, ok := interface{}(m.GetMaxRecomputeNum()).(interface{ Validate() error }); ok {
-+		if err := v.Validate(); err != nil {
-+			return ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError{
-+				field:  "MaxRecomputeNum",
-+				reason: "embedded message failed validation",
-+				cause:  err,
-+			}
-+		}
-+	}
-+
-+	return nil
-+}
-+
-+// ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError
-+// is the validation error returned by
-+// ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor.Validate if
-+// the designated constraints aren't met.
-+type ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError struct {
-+	field  string
-+	reason string
-+	cause  error
-+	key    bool
-+}
-+
-+// Field function returns field value.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError) Field() string {
-+	return e.field
-+}
-+
-+// Reason function returns reason value.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError) Reason() string {
-+	return e.reason
-+}
-+
-+// Cause function returns cause value.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError) Cause() error {
-+	return e.cause
-+}
-+
-+// Key function returns key value.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError) Key() bool {
-+	return e.key
-+}
-+
-+// ErrorName returns error name.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError) ErrorName() string {
-+	return "ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError"
-+}
-+
-+// Error satisfies the builtin error interface
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError) Error() string {
-+	cause := ""
-+	if e.cause != nil {
-+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
-+	}
-+
-+	key := ""
-+	if e.key {
-+		key = "key for "
-+	}
-+
-+	return fmt.Sprintf(
-+		"invalid %sScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor.%s: %s%s",
-+		key,
-+		e.field,
-+		e.reason,
-+		cause)
-+}
-+
-+var _ error = ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError{}
-+
-+var _ interface {
-+	Field() string
-+	Reason() string
-+	Key() bool
-+	Cause() error
-+	ErrorName() string
-+} = ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError{}
-+
-+// Validate checks the field values on
-+// ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor with
-+// the rules defined in the proto definition for this message. If any rules
-+// are violated, an error is returned.
-+func (m *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor) Validate() error {
-+	if m == nil {
-+		return nil
-+	}
-+
-+	return nil
-+}
-+
-+// ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError
-+// is the validation error returned by
-+// ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor.Validate
-+// if the designated constraints aren't met.
-+type ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError struct {
-+	field  string
-+	reason string
-+	cause  error
-+	key    bool
-+}
-+
-+// Field function returns field value.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError) Field() string {
-+	return e.field
-+}
-+
-+// Reason function returns reason value.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError) Reason() string {
-+	return e.reason
-+}
-+
-+// Cause function returns cause value.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError) Cause() error {
-+	return e.cause
-+}
-+
-+// Key function returns key value.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError) Key() bool {
-+	return e.key
-+}
-+
-+// ErrorName returns error name.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError) ErrorName() string {
-+	return "ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError"
-+}
-+
-+// Error satisfies the builtin error interface
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError) Error() string {
-+	cause := ""
-+	if e.cause != nil {
-+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
-+	}
-+
-+	key := ""
-+	if e.key {
-+		key = "key for "
-+	}
-+
-+	return fmt.Sprintf(
-+		"invalid %sScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor.%s: %s%s",
-+		key,
-+		e.field,
-+		e.reason,
-+		cause)
-+}
-+
-+var _ error = ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError{}
-+
-+var _ interface {
-+	Field() string
-+	Reason() string
-+	Key() bool
-+	Cause() error
-+	ErrorName() string
-+} = ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError{}
-+
-+// Validate checks the field values on
- // ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement
- // with the rules defined in the proto definition for this message. If any
- // rules are violated, an error is returned.
--- a/envoy/1.20/patches/go-control-plane/20240201-virtual-host-allow-server-name.patch
+++ b/envoy/1.20/patches/go-control-plane/20240201-virtual-host-allow-server-name.patch
--- a/envoy/envoy
+++ b/envoy/envoy
--- a/istio/1.12/patches/api/20221027-init.patch
+++ b/istio/1.12/patches/api/20221027-init.patch
--- a/istio/1.12/patches/client-go/20221027-init.patch
+++ b/istio/1.12/patches/client-go/20221027-init.patch
--- a/istio/1.12/patches/istio/20221027-init.patch
+++ b/istio/1.12/patches/istio/20221027-init.patch
--- a/istio/1.12/patches/istio/20221103-fix-multi-namespace.patch
+++ b/istio/1.12/patches/istio/20221103-fix-multi-namespace.patch
@@ -1,189 +0,0 @@
-diff --git a/pilot/docker/Dockerfile.pilot b/pilot/docker/Dockerfile.pilot
-index 601d78d12a..4a63a71ff5 100644
--- a/pilot/docker/Dockerfile.pilot
-+++ b/pilot/docker/Dockerfile.pilot
-@@ -25,6 +25,8 @@ COPY gcp_envoy_bootstrap.json /var/lib/istio/envoy/gcp_envoy_bootstrap_tmpl.json
- 
- COPY higress-pilot-start.sh /usr/local/bin/higress-pilot-start.sh
- 
-+RUN chmod +x /usr/local/bin/higress-pilot-start.sh
-+
- USER 1337:1337
- 
- ENTRYPOINT ["/usr/local/bin/higress-pilot-start.sh"]
-diff --git a/pilot/pkg/model/ali_push_context.go b/pilot/pkg/model/ali_push_context.go
-index 459bd78469..55ba7331e0 100644
--- a/pilot/pkg/model/ali_push_context.go
-+++ b/pilot/pkg/model/ali_push_context.go
-@@ -1,6 +1,7 @@
- package model
- 
- import (
-+	"path"
- 	"sort"
- 	"strings"
- 	"time"
-@@ -123,7 +124,7 @@ func createCRName(clusterId, autoGenerated string) string {
- 
- // virtualServiceFilter will modify copied configs from underlying store.
- // We merge routes into pre host of virtual service.
-func virtualServiceFilter(configs []config.Config) []config.Config {
-+func VirtualServiceFilter(configs []config.Config) []config.Config {
- 	var autoGenerated []*config.Config
- 	configsForName := make(map[string]*config.Config, len(configs))
- 
-@@ -134,7 +135,7 @@ func virtualServiceFilter(configs []config.Config) []config.Config {
- 		if strings.HasPrefix(c.Name, constants.IstioIngressGatewayName) {
- 			autoGenerated = append(autoGenerated, &c)
- 		} else {
-			configsForName[c.Name] = &c
-+			configsForName[path.Join(c.Namespace, c.Name)] = &c
- 		}
- 	}
- 
-@@ -142,7 +143,7 @@ func virtualServiceFilter(configs []config.Config) []config.Config {
- 
- 	for _, c := range autoGenerated {
- 		targetName := createCRName(istioClusterId, c.Name)
-		rawVS, exist := configsForName[targetName]
-+		rawVS, exist := configsForName[path.Join(c.Namespace, targetName)]
- 		if exist {
- 			vs := rawVS.Spec.(*networking.VirtualService)
- 			autoGeneratedVS := c.Spec.(*networking.VirtualService)
-@@ -155,7 +156,7 @@ func virtualServiceFilter(configs []config.Config) []config.Config {
- 			// We change the auto-generated config name to the format of cr name same with ops when ops
- 			// don't have this host.
- 			c.Name = targetName
-			configsForName[targetName] = c
-+			configsForName[path.Join(c.Namespace, targetName)] = c
- 		}
- 	}
- 
-@@ -167,7 +168,7 @@ func virtualServiceFilter(configs []config.Config) []config.Config {
- }
- 
- // destinationFilter will modify copied configs from underlying store.
-func destinationFilter(configs []config.Config) []config.Config {
-+func DestinationFilter(configs []config.Config) []config.Config {
- 	var autoGenerated []*config.Config
- 	configsForName := make(map[string]*config.Config, len(configs))
- 
-@@ -176,7 +177,7 @@ func destinationFilter(configs []config.Config) []config.Config {
- 		if strings.HasPrefix(c.Name, constants.IstioIngressGatewayName) {
- 			autoGenerated = append(autoGenerated, &c)
- 		} else {
-			configsForName[c.Name] = &c
-+			configsForName[path.Join(c.Namespace, c.Name)] = &c
- 		}
- 	}
- 
-@@ -185,12 +186,12 @@ func destinationFilter(configs []config.Config) []config.Config {
- 	for _, c := range autoGenerated {
- 		// DestinationRule name of ops is md5 without cluster id.
- 		targetName := strings.TrimPrefix(c.Name, constants.IstioIngressGatewayName+"-")
-		_, exist := configsForName[targetName]
-+		_, exist := configsForName[path.Join(c.Namespace, targetName)]
- 		if !exist {
- 			// We change the auto-generated config name to the format of cr name same with ops when ops
- 			// don't have destination rule for this service.
- 			c.Name = targetName
-			configsForName[targetName] = c
-+			configsForName[path.Join(c.Namespace, targetName)] = c
- 		}
- 	}
- 
-@@ -203,7 +204,7 @@ func destinationFilter(configs []config.Config) []config.Config {
- 
- // gatewayFilter will modify copied configs from underlying store.
- // We merge routes into pre host of virtual service.
-func gatewayFilter(configs []config.Config) []config.Config {
-+func GatewayFilter(configs []config.Config) []config.Config {
- 	var autoGenerated []*config.Config
- 	configsForName := make(map[string]*config.Config, len(configs))
- 
-@@ -214,7 +215,7 @@ func gatewayFilter(configs []config.Config) []config.Config {
- 		if strings.HasPrefix(c.Name, constants.IstioIngressGatewayName) {
- 			autoGenerated = append(autoGenerated, &c)
- 		} else {
-			configsForName[c.Name] = &c
-+			configsForName[path.Join(c.Namespace, c.Name)] = &c
- 		}
- 	}
- 
-@@ -222,14 +223,14 @@ func gatewayFilter(configs []config.Config) []config.Config {
- 
- 	for _, c := range autoGenerated {
- 		targetName := createCRName(istioClusterId, c.Name)
-		_, exist := configsForName[targetName]
-+		_, exist := configsForName[path.Join(c.Namespace, targetName)]
- 		// Note, if ops already has the host without tls and ingress has the same host with tls,
- 		// we don't merge tls settings, i.e, we don't adopt ingress tls for this host.
- 		if !exist {
- 			// We change the auto-generated config name to the format of cr name same with ops when ops
- 			// don't have this host.
- 			c.Name = targetName
-			configsForName[targetName] = c
-+			configsForName[path.Join(c.Namespace, targetName)] = c
- 		}
- 	}
- 
-diff --git a/pilot/pkg/model/push_context.go b/pilot/pkg/model/push_context.go
-index b7e4957b62..89bc9e4e36 100644
--- a/pilot/pkg/model/push_context.go
-+++ b/pilot/pkg/model/push_context.go
-@@ -1406,7 +1406,7 @@ func (ps *PushContext) initVirtualServices(env *Environment) error {
- 	}
- 
- 	// Added by ingress
-	vservices = virtualServiceFilter(vservices)
-+	vservices = VirtualServiceFilter(vservices)
- 	// End added by ingress
- 
- 	totalVirtualServices.Record(float64(len(virtualServices)))
-@@ -1608,7 +1608,7 @@ func (ps *PushContext) initDestinationRules(env *Environment) error {
- 		destRules[i] = configs[i].DeepCopy()
- 	}
- 
-	destRules = destinationFilter(destRules)
-+	destRules = DestinationFilter(destRules)
- 
- 	ps.SetDestinationRules(destRules)
- 	return nil
-@@ -1937,7 +1937,7 @@ func (ps *PushContext) initGateways(env *Environment) error {
- 	for i := range gateways {
- 		gateways[i] = gatewayConfigs[i].DeepCopy()
- 	}
-	gatewayConfigs = gatewayFilter(gateways)
-+	gatewayConfigs = GatewayFilter(gateways)
- 	// End added by ingress
- 
- 	sortConfigByCreationTime(gatewayConfigs)
-diff --git a/pilot/pkg/xds/debug.go b/pilot/pkg/xds/debug.go
-index ac91ef312a..a5b4ea6943 100644
--- a/pilot/pkg/xds/debug.go
-+++ b/pilot/pkg/xds/debug.go
-@@ -42,6 +42,7 @@ import (
- 	v3 "istio.io/istio/pilot/pkg/xds/v3"
- 	"istio.io/istio/pkg/config"
- 	"istio.io/istio/pkg/config/schema/collection"
-+	"istio.io/istio/pkg/config/schema/gvk"
- 	"istio.io/istio/pkg/network"
- 	"istio.io/istio/pkg/util/protomarshal"
- 	istiolog "istio.io/pkg/log"
-@@ -463,6 +464,16 @@ func (s *DiscoveryServer) configz(w http.ResponseWriter, req *http.Request) {
- 	configs := make([]kubernetesConfig, 0)
- 	s.Env.IstioConfigStore.Schemas().ForEach(func(schema collection.Schema) bool {
- 		cfg, _ := s.Env.IstioConfigStore.List(schema.Resource().GroupVersionKind(), "")
-+		// Added by ingress
-+		switch schema.Resource().GroupVersionKind().String() {
-+		case gvk.Gateway.String():
-+			cfg = model.GatewayFilter(cfg)
-+		case gvk.VirtualService.String():
-+			cfg = model.VirtualServiceFilter(cfg)
-+		case gvk.DestinationRule.String():
-+			cfg = model.DestinationFilter(cfg)
-+		}
-+		// End added by ingress
- 		for _, c := range cfg {
- 			configs = append(configs, kubernetesConfig{c})
- 		}
--- a/istio/1.12/patches/istio/20221107-mcp-skip-validate.patch
+++ b/istio/1.12/patches/istio/20221107-mcp-skip-validate.patch
@@ -1,12 +0,0 @@
-diff -Naur istio/pilot/pkg/bootstrap/configcontroller.go new/pilot/pkg/bootstrap/configcontroller.go
--- istio/pilot/pkg/bootstrap/configcontroller.go	2022-11-07 21:47:11.000000000 +0800
-+++ new/pilot/pkg/bootstrap/configcontroller.go	2022-11-07 21:50:31.000000000 +0800
-@@ -250,7 +250,7 @@
- 			if err != nil {
- 				return fmt.Errorf("failed to dial XDS %s %v", configSource.Address, err)
- 			}
-			store := memory.Make(collections.Pilot)
-+			store := memory.MakeSkipValidation(collections.Pilot)
- 			configController := memory.NewController(store)
- 			configController.RegisterHasSyncedHandler(xdsMCP.HasSynced)
- 			xdsMCP.Store = model.MakeIstioStore(configController)
--- a/istio/1.12/patches/istio/20221107-support-ingress-secret.patch
+++ b/istio/1.12/patches/istio/20221107-support-ingress-secret.patch
@@ -1,37 +0,0 @@
-diff -Naur istio/pilot/pkg/model/credentials/ali_resource.go new/pilot/pkg/model/credentials/ali_resource.go
--- istio/pilot/pkg/model/credentials/ali_resource.go	2022-11-07 21:40:10.000000000 +0800
-+++ new/pilot/pkg/model/credentials/ali_resource.go	2022-11-07 19:03:22.000000000 +0800
-@@ -4,6 +4,7 @@
- 	"fmt"
- 	"strings"
- 
-+	"istio.io/istio/pilot/pkg/features"
- 	"istio.io/istio/pkg/cluster"
- )
- 
-@@ -13,6 +14,9 @@
- )
- 
- func ToKubernetesIngressResource(clusterId, namespace, name string) string {
-+	if clusterId == "" {
-+		clusterId = features.ClusterName
-+	}
- 	return fmt.Sprintf("%s://%s/%s/%s", KubernetesIngressSecretType, clusterId, namespace, name)
- }
- 
-diff -Naur istio/pilot/pkg/xds/sds.go new/pilot/pkg/xds/sds.go
--- istio/pilot/pkg/xds/sds.go	2022-11-07 21:40:10.000000000 +0800
-+++ new/pilot/pkg/xds/sds.go	2022-11-07 21:44:28.000000000 +0800
-@@ -229,6 +229,12 @@
- 			} else {
- 				deniedResources = append(deniedResources, r.Name)
- 			}
-+		case credentials.KubernetesIngressSecretType:
-+			if isAuthorized() {
-+				allowedResources = append(allowedResources, r)
-+			} else {
-+				deniedResources = append(deniedResources, r.Name)
-+			}
- 		default:
- 			// Should never happen
- 			log.Warnf("unknown credential type %q", r.Type)
--- a/istio/1.12/patches/istio/20221110-fix-deadlock.patch
+++ b/istio/1.12/patches/istio/20221110-fix-deadlock.patch
@@ -1,185 +0,0 @@
-diff --git a/pkg/istio-agent/xds_proxy.go b/pkg/istio-agent/xds_proxy.go
-index 51766751e1..5b33234024 100644
--- a/pkg/istio-agent/xds_proxy.go
-+++ b/pkg/istio-agent/xds_proxy.go
-@@ -47,6 +47,7 @@ import (
- 	"istio.io/istio/pilot/pkg/features"
- 	istiogrpc "istio.io/istio/pilot/pkg/grpc"
- 	v3 "istio.io/istio/pilot/pkg/xds/v3"
-+	"istio.io/istio/pkg/channels"
- 	"istio.io/istio/pkg/config/constants"
- 	dnsProto "istio.io/istio/pkg/dns/proto"
- 	"istio.io/istio/pkg/istio-agent/health"
-@@ -233,24 +234,14 @@ func initXdsProxy(ia *Agent) (*XdsProxy, error) {
- // PersistRequest sends a request to the currently connected proxy. Additionally, on any reconnection
- // to the upstream XDS request we will resend this request.
- func (p *XdsProxy) PersistRequest(req *discovery.DiscoveryRequest) {
-	var ch chan *discovery.DiscoveryRequest
-	var stop chan struct{}
-
- 	p.connectedMutex.Lock()
-	if p.connected != nil {
-		ch = p.connected.requestsChan
-		stop = p.connected.stopChan
-+	// Immediately send if we are currently connect
-+	if p.connected != nil && p.connected.requestsChan != nil {
-+		p.connected.requestsChan.Put(req)
- 	}
-+	// Otherwise place it as our initial request for new connections
- 	p.initialRequest = req
- 	p.connectedMutex.Unlock()
-
-	// Immediately send if we are currently connect
-	if ch != nil {
-		select {
-		case ch <- req:
-		case <-stop:
-		}
-	}
- }
- 
- func (p *XdsProxy) UnregisterStream(c *ProxyConnection) {
-@@ -276,9 +267,9 @@ type ProxyConnection struct {
- 	conID              uint32
- 	upstreamError      chan error
- 	downstreamError    chan error
-	requestsChan       chan *discovery.DiscoveryRequest
-+	requestsChan       *channels.Unbounded
- 	responsesChan      chan *discovery.DiscoveryResponse
-	deltaRequestsChan  chan *discovery.DeltaDiscoveryRequest
-+	deltaRequestsChan  *channels.Unbounded
- 	deltaResponsesChan chan *discovery.DeltaDiscoveryResponse
- 	stopChan           chan struct{}
- 	downstream         adsStream
-@@ -290,10 +281,7 @@ type ProxyConnection struct {
- // sendRequest is a small wrapper around sending to con.requestsChan. This ensures that we do not
- // block forever on
- func (con *ProxyConnection) sendRequest(req *discovery.DiscoveryRequest) {
-	select {
-	case con.requestsChan <- req:
-	case <-con.stopChan:
-	}
-+	con.requestsChan.Put(req)
- }
- 
- type adsStream interface {
-@@ -315,10 +303,29 @@ func (p *XdsProxy) handleStream(downstream adsStream) error {
- 		conID:           connectionNumber.Inc(),
- 		upstreamError:   make(chan error, 2), // can be produced by recv and send
- 		downstreamError: make(chan error, 2), // can be produced by recv and send
-		requestsChan:    make(chan *discovery.DiscoveryRequest, 10),
-		responsesChan:   make(chan *discovery.DiscoveryResponse, 10),
-		stopChan:        make(chan struct{}),
-		downstream:      downstream,
-+		// Requests channel is unbounded. The Envoy<->XDS Proxy<->Istiod system produces a natural
-+		// looping of Recv and Send. Due to backpressure introduce by gRPC natively (that is, Send() can
-+		// only send so much data without being Recv'd before it starts blocking), along with the
-+		// backpressure provided by our channels, we have a risk of deadlock where both xdsproxy and
-+		// Istiod are trying to Send, but both are blocked by gRPC backpressure until Recv() is called.
-+		// However, Recv can fail to be called by Send being blocked. This can be triggered by the two
-+		// sources in our system (Envoy request and Istiod pushes) producing more events than we can keep
-+		// up with.
-+		// See https://github.com/istio/istio/issues/39209 for more information
-+		//
-+		// To prevent these issues, we need to either:
-+		// 1. Apply backpressure directly to Envoy requests or Istiod pushes
-+		// 2. Make part of the system unbounded
-+		//
-+		// (1) is challenging because we cannot do a conditional Recv (for Envoy requests), and changing
-+		// the control plane requires substantial changes. Instead, we make the requests channel
-+		// unbounded. This is the least likely to cause issues as the messages we store here are the
-+		// smallest relative to other channels.
-+		requestsChan: channels.NewUnbounded(),
-+		// Allow a buffer of 1. This ensures we queue up at most 2 (one in process, 1 pending) responses before forwarding.
-+		responsesChan: make(chan *discovery.DiscoveryResponse, 1),
-+		stopChan:      make(chan struct{}),
-+		downstream:    downstream,
- 	}
- 
- 	p.RegisterStream(con)
-@@ -452,7 +459,9 @@ func (p *XdsProxy) handleUpstreamRequest(con *ProxyConnection) {
- 	defer con.upstream.CloseSend() // nolint
- 	for {
- 		select {
-		case req := <-con.requestsChan:
-+		case requ := <-con.requestsChan.Get():
-+			con.requestsChan.Load()
-+			req := requ.(*discovery.DiscoveryRequest)
- 			proxyLog.Debugf("request for type url %s", req.TypeUrl)
- 			metrics.XdsProxyRequests.Increment()
- 			if req.TypeUrl == v3.ExtensionConfigurationType {
-diff --git a/pkg/istio-agent/xds_proxy_delta.go b/pkg/istio-agent/xds_proxy_delta.go
-index 2cd82b4059..c2245f9918 100644
--- a/pkg/istio-agent/xds_proxy_delta.go
-+++ b/pkg/istio-agent/xds_proxy_delta.go
-@@ -27,6 +27,7 @@ import (
- 	"istio.io/istio/pilot/pkg/features"
- 	istiogrpc "istio.io/istio/pilot/pkg/grpc"
- 	v3 "istio.io/istio/pilot/pkg/xds/v3"
-+	"istio.io/istio/pkg/channels"
- 	"istio.io/istio/pkg/istio-agent/metrics"
- 	"istio.io/istio/pkg/wasm"
- )
-@@ -34,10 +35,7 @@ import (
- // sendDeltaRequest is a small wrapper around sending to con.requestsChan. This ensures that we do not
- // block forever on
- func (con *ProxyConnection) sendDeltaRequest(req *discovery.DeltaDiscoveryRequest) {
-	select {
-	case con.deltaRequestsChan <- req:
-	case <-con.stopChan:
-	}
-+	con.deltaRequestsChan.Put(req)
- }
- 
- // requests from envoy
-@@ -48,10 +46,11 @@ func (p *XdsProxy) DeltaAggregatedResources(downstream discovery.AggregatedDisco
- 	proxyLog.Debugf("accepted delta xds connection from envoy, forwarding to upstream")
- 
- 	con := &ProxyConnection{
-		upstreamError:      make(chan error, 2), // can be produced by recv and send
-		downstreamError:    make(chan error, 2), // can be produced by recv and send
-		deltaRequestsChan:  make(chan *discovery.DeltaDiscoveryRequest, 10),
-		deltaResponsesChan: make(chan *discovery.DeltaDiscoveryResponse, 10),
-+		upstreamError:     make(chan error, 2), // can be produced by recv and send
-+		downstreamError:   make(chan error, 2), // can be produced by recv and send
-+		deltaRequestsChan: channels.NewUnbounded(),
-+		// Allow a buffer of 1. This ensures we queue up at most 2 (one in process, 1 pending) responses before forwarding.
-+		deltaResponsesChan: make(chan *discovery.DeltaDiscoveryResponse, 1),
- 		stopChan:           make(chan struct{}),
- 		downstreamDeltas:   downstream,
- 	}
-@@ -190,7 +189,9 @@ func (p *XdsProxy) handleUpstreamDeltaRequest(con *ProxyConnection) {
- 	}()
- 	for {
- 		select {
-		case req := <-con.deltaRequestsChan:
-+		case requ := <-con.deltaRequestsChan.Get():
-+			con.deltaRequestsChan.Load()
-+			req := requ.(*discovery.DeltaDiscoveryRequest)
- 			proxyLog.Debugf("delta request for type url %s", req.TypeUrl)
- 			metrics.XdsProxyRequests.Increment()
- 			if req.TypeUrl == v3.ExtensionConfigurationType {
-@@ -296,22 +297,10 @@ func sendDownstreamDelta(deltaDownstream discovery.AggregatedDiscoveryService_De
- }
- 
- func (p *XdsProxy) PersistDeltaRequest(req *discovery.DeltaDiscoveryRequest) {
-	var ch chan *discovery.DeltaDiscoveryRequest
-	var stop chan struct{}
-
- 	p.connectedMutex.Lock()
- 	if p.connected != nil {
-		ch = p.connected.deltaRequestsChan
-		stop = p.connected.stopChan
-+		p.connected.deltaRequestsChan.Put(req)
- 	}
- 	p.initialDeltaRequest = req
- 	p.connectedMutex.Unlock()
-
-	// Immediately send if we are currently connect
-	if ch != nil {
-		select {
-		case ch <- req:
-		case <-stop:
-		}
-	}
- }
--- a/istio/1.12/patches/istio/20221110-fix-xds-push.patch
+++ b/istio/1.12/patches/istio/20221110-fix-xds-push.patch
@@ -1,139 +0,0 @@
-diff -Naur base/pilot/pkg/xds/xdsgen.go istio/pilot/pkg/xds/xdsgen.go
--- base/pilot/pkg/xds/xdsgen.go	2022-11-10 20:45:14.000000000 +0800
-+++ istio/pilot/pkg/xds/xdsgen.go	2022-11-10 20:16:35.000000000 +0800
-@@ -96,40 +96,23 @@
- 	return nil
- }
- 
-// End added by ingress
-
-// Push an XDS resource for the given connection. Configuration will be generated
-// based on the passed in generator. Based on the updates field, generators may
-// choose to send partial or even no response if there are no changes.
-func (s *DiscoveryServer) pushXds(con *Connection, push *model.PushContext,
-	w *model.WatchedResource, req *model.PushRequest) error {
-+func (s *DiscoveryServer) pushMcpXds(con *Connection, push *model.PushContext, w *model.WatchedResource, req *model.PushRequest) error {
- 	if w == nil {
- 		return nil
- 	}
- 
- 	t0 := time.Now()
-	// Modified by ingress
-+
- 	var (
-		res     []*any.Any
- 		logdata model.XdsLogDetails
- 		err     error
- 	)
-	if s.Env.MCPMode {
-		res = make([]*any.Any, 0)
-		gen := s.findMcpGenerator(w.TypeUrl, con)
-		if gen != nil {
-			res, logdata, err = gen.Generate(con.proxy, push, w, req)
-		}
-	} else {
-		gen := s.findGenerator(w.TypeUrl, con)
-		if gen == nil {
-			return nil
-		}
-		var resource model.Resources
-		resource, logdata, err = gen.Generate(con.proxy, push, w, req)
-		res = model.ResourcesToAny(resource)
-+	res := make([]*any.Any, 0)
-+	gen := s.findMcpGenerator(w.TypeUrl, con)
-+	if gen != nil {
-+		res, logdata, err = gen.Generate(con.proxy, push, w, req)
- 	}
-	if err != nil || res == nil {
-+	if err != nil {
- 		// If we have nothing to send, report that we got an ACK for this version.
- 		if s.StatusReporter != nil {
- 			s.StatusReporter.RegisterEvent(con.ConID, w.TypeUrl, push.LedgerVersion)
-@@ -181,7 +164,86 @@
- 		log.Infof("%s: %s%s for node:%s resources:%d size:%v%s%s", v3.GetShortType(w.TypeUrl), ptype, req.PushReason(), con.proxy.ID, len(res),
- 			util.ByteCount(AnyResourceSize(res)), info, debug)
- 	}
-	// End modified by ingress
-+	return nil
-+}
-+
-+// End added by ingress
-+
-+// Push an XDS resource for the given connection. Configuration will be generated
-+// based on the passed in generator. Based on the updates field, generators may
-+// choose to send partial or even no response if there are no changes.
-+func (s *DiscoveryServer) pushXds(con *Connection, push *model.PushContext,
-+	w *model.WatchedResource, req *model.PushRequest) error {
-+	// Added by ingress
-+	if s.Env.MCPMode {
-+		return s.pushMcpXds(con, push, w, req)
-+	}
-+	// End added by ingress
-+	if w == nil {
-+		return nil
-+	}
-+	gen := s.findGenerator(w.TypeUrl, con)
-+	if gen == nil {
-+		return nil
-+	}
-+
-+	t0 := time.Now()
-+
-+	res, logdata, err := gen.Generate(con.proxy, push, w, req)
-+	if err != nil || res == nil {
-+		// If we have nothing to send, report that we got an ACK for this version.
-+		if s.StatusReporter != nil {
-+			s.StatusReporter.RegisterEvent(con.ConID, w.TypeUrl, push.LedgerVersion)
-+		}
-+		return err
-+	}
-+	defer func() { recordPushTime(w.TypeUrl, time.Since(t0)) }()
-+
-+	resp := &discovery.DiscoveryResponse{
-+		ControlPlane: ControlPlane(),
-+		TypeUrl:      w.TypeUrl,
-+		// TODO: send different version for incremental eds
-+		VersionInfo: push.PushVersion,
-+		Nonce:       nonce(push.LedgerVersion),
-+		Resources:   model.ResourcesToAny(res),
-+	}
-+
-+	configSize := ResourceSize(res)
-+	configSizeBytes.With(typeTag.Value(w.TypeUrl)).Record(float64(configSize))
-+
-+	ptype := "PUSH"
-+	info := ""
-+	if logdata.Incremental {
-+		ptype = "PUSH INC"
-+	}
-+	if len(logdata.AdditionalInfo) > 0 {
-+		info = " " + logdata.AdditionalInfo
-+	}
-+
-+	if err := con.send(resp); err != nil {
-+		if recordSendError(w.TypeUrl, err) {
-+			log.Warnf("%s: Send failure for node:%s resources:%d size:%s%s: %v",
-+				v3.GetShortType(w.TypeUrl), con.proxy.ID, len(res), util.ByteCount(configSize), info, err)
-+		}
-+		return err
-+	}
-+
-+	switch {
-+	case logdata.Incremental:
-+		if log.DebugEnabled() {
-+			log.Debugf("%s: %s%s for node:%s resources:%d size:%s%s",
-+				v3.GetShortType(w.TypeUrl), ptype, req.PushReason(), con.proxy.ID, len(res), util.ByteCount(configSize), info)
-+		}
-+	default:
-+		debug := ""
-+		if log.DebugEnabled() {
-+			// Add additional information to logs when debug mode enabled.
-+			debug = " nonce:" + resp.Nonce + " version:" + resp.VersionInfo
-+		}
-+		log.Infof("%s: %s%s for node:%s resources:%d size:%v%s%s", v3.GetShortType(w.TypeUrl), ptype, req.PushReason(), con.proxy.ID, len(res),
-+			util.ByteCount(ResourceSize(res)), info, debug)
-+	}
-+
- 	return nil
- }
- 
--- a/istio/1.12/patches/istio/20221210-mcp-service-entry.patch
+++ b/istio/1.12/patches/istio/20221210-mcp-service-entry.patch
@@ -1,85 +0,0 @@
-diff -Naur istio/pilot/pkg/model/push_context.go istio-new/pilot/pkg/model/push_context.go
--- istio/pilot/pkg/model/push_context.go	2022-12-10 16:49:42.000000000 +0800
-+++ istio-new/pilot/pkg/model/push_context.go	2022-12-10 15:56:09.000000000 +0800
-@@ -245,6 +245,7 @@
- 	initializeMutex sync.Mutex
- 
- 	// Added by ingress
-+	AllServiceEntries   []config.Config
- 	AllVirtualServices  []config.Config
- 	AllDestinationRules []config.Config
- 	AllEnvoyFilters     []config.Config
-@@ -1199,6 +1200,9 @@
- 		// make sure we copy over things that would be generated in initServiceRegistry
- 		ps.ServiceIndex = oldPushContext.ServiceIndex
- 		ps.ServiceAccounts = oldPushContext.ServiceAccounts
-+		// Added by ingress
-+		ps.AllServiceEntries = oldPushContext.AllServiceEntries
-+		// End added by ingress
- 	}
- 
- 	if servicesChanged || gatewayAPIChanged {
-@@ -1214,6 +1218,9 @@
- 		}
- 	} else {
- 		ps.virtualServiceIndex = oldPushContext.virtualServiceIndex
-+		// Added by ingress
-+		ps.AllVirtualServices = oldPushContext.AllVirtualServices
-+		// End added by ingress
- 	}
- 
- 	if destinationRulesChanged {
-@@ -1222,6 +1229,9 @@
- 		}
- 	} else {
- 		ps.destinationRuleIndex = oldPushContext.destinationRuleIndex
-+		// Added by ingress
-+		ps.AllDestinationRules = oldPushContext.AllDestinationRules
-+		// End added by ingress
- 	}
- 
- 	if authnChanged {
-@@ -1255,6 +1265,9 @@
- 		}
- 	} else {
- 		ps.wasmPluginsByNamespace = oldPushContext.wasmPluginsByNamespace
-+		// Added by ingress
-+		ps.AllWasmplugins = oldPushContext.AllWasmplugins
-+		// End added by ingress
- 	}
- 
- 	if envoyFiltersChanged {
-@@ -1263,6 +1276,9 @@
- 		}
- 	} else {
- 		ps.envoyFiltersByNamespace = oldPushContext.envoyFiltersByNamespace
-+		// Added by ingress
-+		ps.AllEnvoyFilters = oldPushContext.AllEnvoyFilters
-+		// End added by ingress
- 	}
- 
- 	if gatewayChanged {
-@@ -1271,6 +1287,9 @@
- 		}
- 	} else {
- 		ps.gatewayIndex = oldPushContext.gatewayIndex
-+		// Added by ingress
-+		ps.AllGateways = oldPushContext.AllGateways
-+		// End added by ingress
- 	}
- 
- 	// Must be initialized in the end
-@@ -1289,6 +1308,13 @@
- // Caches list of services in the registry, and creates a map
- // of hostname to service
- func (ps *PushContext) initServiceRegistry(env *Environment) error {
-+	// Added by ingress
-+	if env.MCPMode {
-+		ps.AllServiceEntries = env.ServiceEntries()
-+		return nil
-+	}
-+	// End added by ingress
-+
- 	services, err := env.Services()
- 	if err != nil {
- 		return err
--- a/istio/1.12/patches/istio/20230119-custom-ca-cert-name.patch
+++ b/istio/1.12/patches/istio/20230119-custom-ca-cert-name.patch
@@ -1,30 +0,0 @@
-diff -Naur istio/pilot/pkg/features/pilot.go istio_new/pilot/pkg/features/pilot.go
--- istio/pilot/pkg/features/pilot.go	2023-01-19 11:17:16.000000000 +0800
-+++ istio_new/pilot/pkg/features/pilot.go	2023-01-19 11:03:37.000000000 +0800
-@@ -562,6 +562,11 @@
- 
- 	PrioritizedLeaderElection = env.RegisterBoolVar("PRIORITIZED_LEADER_ELECTION", true,
- 		"If enabled, the default revision will steal leader locks from non-default revisions").Get()
-+
-+	// Added by ingress
-+	CustomCACertConfigMapName = env.RegisterStringVar("CUSTOM_CA_CERT_NAME", "",
-+		"Defines the configmap's name of  istio's root ca certificate").Get()
-+	// End added by ingress
- )
- 
- // UnsafeFeaturesEnabled returns true if any unsafe features are enabled.
-diff -Naur istio/pilot/pkg/serviceregistry/kube/controller/namespacecontroller.go istio_new/pilot/pkg/serviceregistry/kube/controller/namespacecontroller.go
--- istio/pilot/pkg/serviceregistry/kube/controller/namespacecontroller.go	2023-01-19 11:17:19.000000000 +0800
-+++ istio_new/pilot/pkg/serviceregistry/kube/controller/namespacecontroller.go	2023-01-19 11:20:32.000000000 +0800
-@@ -50,6 +50,11 @@
- 	if features.ClusterName != "" && features.ClusterName != "Kubernetes" {
- 		dynamicCACertNamespaceConfigMap = fmt.Sprintf("%s-ca-root-cert", features.ClusterName)
- 	}
-+	// Added by ingress
-+	if features.CustomCACertConfigMapName != "" {
-+		dynamicCACertNamespaceConfigMap = features.CustomCACertConfigMapName
-+	}
-+	// End added by ingress
- }
- 
- // NamespaceController manages reconciles a configmap in each namespace with a desired set of data.
--- a/istio/1.12/patches/istio/20230208-waf-stats.patch
+++ b/istio/1.12/patches/istio/20230208-waf-stats.patch
@@ -1,18 +0,0 @@
-diff -Naur istio/tools/packaging/common/envoy_bootstrap.json istio_new/tools/packaging/common/envoy_bootstrap.json
--- istio/tools/packaging/common/envoy_bootstrap.json	2023-02-08 22:42:41.000000000 +0800
-+++ istio_new/tools/packaging/common/envoy_bootstrap.json	2023-02-08 22:19:04.000000000 +0800
-@@ -37,6 +37,14 @@
-     "use_all_default_tags": false,
-     "stats_tags": [
-       {
-+        "tag_name": "phase",
-+        "regex": "(_phase=([a-z_]+))"
-+      },
-+      {
-+        "tag_name": "ruleid",
-+        "regex": "(_ruleid=([0-9]+))"
-+      },
-+      {
-         "tag_name": "route",
-         "regex": "^vhost\\..*?\\.route\\.([^\\.]+\\.)upstream"
-       },
--- a/istio/1.12/patches/istio/20230319-imagefetcher-oci.patch
+++ b/istio/1.12/patches/istio/20230319-imagefetcher-oci.patch
@@ -1,20 +0,0 @@
-diff --color -Naur external/istio/pkg/wasm/imagefetcher.go external/istio_new/pkg/wasm/imagefetcher.go
--- istio/pkg/wasm/imagefetcher.go	2023-03-19 17:56:55.238354950 +0800
-+++ istio_new/pkg/wasm/imagefetcher.go	2023-03-19 17:56:40.630410241 +0800
-@@ -176,12 +176,12 @@
- 		return nil, fmt.Errorf("could not fetch layers: %v", err)
- 	}
- 
-	// The image must be single-layered.
-	if len(layers) != 1 {
-		return nil, fmt.Errorf("number of layers must be 1 but got %d", len(layers))
-+	// The image must have at least one layer.
-+	if len(layers) == 0 {
-+		return nil, fmt.Errorf("number of layers must be greater than zero")
- 	}
- 
-	layer := layers[0]
-+	layer := layers[len(layers)-1]
- 	mt, err := layer.MediaType()
- 	if err != nil {
- 		return nil, fmt.Errorf("could not get media type: %v", err)
--- a/istio/1.12/patches/istio/20230408-ignore-ns.patch
+++ b/istio/1.12/patches/istio/20230408-ignore-ns.patch
@@ -1,54 +0,0 @@
-diff -Naur istio/pilot/pkg/networking/core/v1alpha3/route/route.go istio-new/pilot/pkg/networking/core/v1alpha3/route/route.go
--- istio/pilot/pkg/networking/core/v1alpha3/route/route.go	2023-04-08 16:02:02.000000000 +0800
-+++ istio-new/pilot/pkg/networking/core/v1alpha3/route/route.go	2023-04-07 18:19:20.000000000 +0800
-@@ -1049,6 +1049,10 @@
- 		out.QueryParameterMatchSpecifier = &route.QueryParameterMatcher_StringMatch{
- 			StringMatch: &matcher.StringMatcher{MatchPattern: &matcher.StringMatcher_Exact{Exact: m.Exact}},
- 		}
-+	case *networking.StringMatch_Prefix:
-+		out.QueryParameterMatchSpecifier = &route.QueryParameterMatcher_StringMatch{
-+			StringMatch: &matcher.StringMatcher{MatchPattern: &matcher.StringMatcher_Prefix{Prefix: m.Prefix}},
-+		}
- 	case *networking.StringMatch_Regex:
- 		out.QueryParameterMatchSpecifier = &route.QueryParameterMatcher_StringMatch{
- 			StringMatch: &matcher.StringMatcher{
-diff -Naur istio/pilot/pkg/serviceregistry/kube/controller/namespacecontroller.go istio-new/pilot/pkg/serviceregistry/kube/controller/namespacecontroller.go
--- istio/pilot/pkg/serviceregistry/kube/controller/namespacecontroller.go	2023-04-08 16:02:02.000000000 +0800
-+++ istio-new/pilot/pkg/serviceregistry/kube/controller/namespacecontroller.go	2023-04-08 14:35:57.000000000 +0800
-@@ -16,6 +16,7 @@
- 
- import (
- 	"fmt"
-+	"os"
- 	"time"
- 
- 	v1 "k8s.io/api/core/v1"
-@@ -171,9 +172,16 @@
- 	return k8s.InsertDataToConfigMap(nc.client, nc.configmapLister, meta, nc.caBundleWatcher.GetCABundle())
- }
- 
-+var podNs = os.Getenv("POD_NAMESPACE")
-+
- // On namespace change, update the config map.
- // If terminating, this will be skipped
- func (nc *NamespaceController) namespaceChange(ns *v1.Namespace) {
-+	// Added by ingress
-+	if ns.Name != podNs {
-+		return
-+	}
-+	// End added by ingress
- 	if ns.Status.Phase != v1.NamespaceTerminating {
- 		nc.syncNamespace(ns.Name)
- 	}
-@@ -186,6 +194,11 @@
- 		log.Errorf("failed to convert to configmap: %v", err)
- 		return
- 	}
-+	// Added by ingress
-+	if cm.Namespace != podNs {
-+		return
-+	}
-+	// End added by ingress
- 	// This is a change to a configmap we don't watch, ignore it
- 	if cm.Name != dynamicCACertNamespaceConfigMap {
- 		return
--- a/istio/1.12/patches/istio/20230618-debug-api-anonymous.patch
+++ b/istio/1.12/patches/istio/20230618-debug-api-anonymous.patch
@@ -1,30 +0,0 @@
-diff --color -Naur istio/pilot/pkg/features/pilot.go istio_new/pilot/pkg/features/pilot.go
--- istio/pilot/pkg/features/pilot.go	2023-06-18 20:13:57.715044832 +0800
-+++ istio_new/pilot/pkg/features/pilot.go	2023-06-18 20:11:40.310406690 +0800
-@@ -359,6 +359,9 @@
- 	EnableUnsafeAdminEndpoints = env.RegisterBoolVar("UNSAFE_ENABLE_ADMIN_ENDPOINTS", false,
- 		"If this is set to true, dangerous admin endpoints will be exposed on the debug interface. Not recommended for production.").Get()
- 
-+	DebugAuth = env.RegisterBoolVar("DEBUG_AUTH", true,
-+		"If this is set to false, the debug interface will allow all anonymous request from any remote host, which is not recommended for production").Get()
-+
- 	XDSAuth = env.RegisterBoolVar("XDS_AUTH", true,
- 		"If true, will authenticate XDS clients.").Get()
- 
-diff --color -Naur istio/pilot/pkg/xds/debug.go istio_new/pilot/pkg/xds/debug.go
--- istio/pilot/pkg/xds/debug.go	2023-06-18 20:13:57.695044739 +0800
-+++ istio_new/pilot/pkg/xds/debug.go	2023-06-18 20:11:40.286406579 +0800
-@@ -218,8 +218,12 @@
- 	if internalMux != nil {
- 		internalMux.HandleFunc(path, handler)
- 	}
-+	handlerFunc := http.HandlerFunc(handler)
-+	if features.DebugAuth {
-+		handlerFunc = s.allowAuthenticatedOrLocalhost(handlerFunc)
-+	}
- 	// Add handler with auth; this is expose on an HTTP server
-	mux.HandleFunc(path, s.allowAuthenticatedOrLocalhost(http.HandlerFunc(handler)))
-+	mux.HandleFunc(path, handlerFunc)
- }
- 
- func (s *DiscoveryServer) allowAuthenticatedOrLocalhost(next http.Handler) http.HandlerFunc {
--- a/istio/1.12/patches/istio/20230627-debug-fix-configz.patch
+++ b/istio/1.12/patches/istio/20230627-debug-fix-configz.patch
@@ -1,15 +0,0 @@
-diff -Naur istio/pilot/pkg/xds/debug.go istio-new/pilot/pkg/xds/debug.go
--- istio/pilot/pkg/xds/debug.go	2023-06-27 14:08:00.000000000 +0800
-+++ istio-new/pilot/pkg/xds/debug.go	2023-06-27 14:07:04.000000000 +0800
-@@ -469,6 +469,11 @@
- 	s.Env.IstioConfigStore.Schemas().ForEach(func(schema collection.Schema) bool {
- 		cfg, _ := s.Env.IstioConfigStore.List(schema.Resource().GroupVersionKind(), "")
- 		// Added by ingress
-+		copied := make([]config.Config, len(cfg))
-+		for i := range copied {
-+			copied[i] = cfg[i].DeepCopy()
-+		}
-+		cfg = copied
- 		switch schema.Resource().GroupVersionKind().String() {
- 		case gvk.Gateway.String():
- 			cfg = model.GatewayFilter(cfg)
--- a/istio/1.12/patches/istio/20230815-multi-arch.patch
+++ b/istio/1.12/patches/istio/20230815-multi-arch.patch
@@ -1,124 +0,0 @@
-diff -Naur istio/bin/init.sh istio-new/bin/init.sh
--- istio/bin/init.sh	2023-08-15 21:01:53.601636573 +0800
-+++ istio-new/bin/init.sh	2023-08-15 21:04:56.144783484 +0800
-@@ -151,7 +151,8 @@
- # download_envoy_if_necessary "${ISTIO_ENVOY_LINUX_RELEASE_URL}" "$ISTIO_ENVOY_LINUX_RELEASE_PATH" "${SIDECAR}"
- # download_envoy_if_necessary "${ISTIO_ENVOY_CENTOS_RELEASE_URL}" "$ISTIO_ENVOY_CENTOS_LINUX_RELEASE_PATH" "${SIDECAR}-centos"
- 
-untar_envoy_if_necessary "${ENVOY_TAR_PATH}" "$ISTIO_ENVOY_LINUX_RELEASE_PATH" "${SIDECAR}"
-+untar_envoy_if_necessary "${ENVOY_TAR_DIR}/envoy-arm64.tar.gz" "$ISTIO_ENVOY_LINUX_ARM64_RELEASE_PATH" "${SIDECAR}"
-+untar_envoy_if_necessary "${ENVOY_TAR_DIR}/envoy-amd64.tar.gz" "$ISTIO_ENVOY_LINUX_AMD64_RELEASE_PATH" "${SIDECAR}"
- 
- if [[ "$GOOS_LOCAL" == "darwin" ]]; then
-   # Download and extract the Envoy macOS release binary
-diff -Naur istio/common/scripts/run.sh istio-new/common/scripts/run.sh
--- istio/common/scripts/run.sh	2023-08-15 21:01:53.601636573 +0800
-+++ istio-new/common/scripts/run.sh	2023-08-15 17:37:57.754600731 +0800
-@@ -36,7 +36,7 @@
- 
- HUB="${HUB:-istio}"
- MOUNT_SOURCE="${MOUNT_SOURCE:-${PWD}}"
-ENVOY_TAR_PATH="${ENVOY_TAR_PATH:-/home/package/envoy.tar.gz}"
-+ENVOY_TAR_DIR="${ENVOY_TAR_DIR:-/home/package}"
- MOUNT_DEST="${MOUNT_DEST:-/work}"
- MOUNT_ROOT_SOURCE="${MOUNT_ROOT_SOURCE:-`cd $MOUNT_SOURCE/..;pwd`}"
- MOUNT_PACKAGE_SOURCE="${MOUNT_PACKAGE_SOURCE:-`cd $MOUNT_SOURCE/../package;pwd`}"
-@@ -61,7 +61,7 @@
-     -e TZ="${TIMEZONE:-$TZ}" \
-     -e GOPROXY="${GOPROXY}" \
-     -e HUB="${HUB}" \
-    -e ENVOY_TAR_PATH="${ENVOY_TAR_PATH}" \
-+    -e ENVOY_TAR_DIR="${ENVOY_TAR_DIR}" \
-     --mount "type=bind,source=${MOUNT_PACKAGE_SOURCE},destination=/home/package" \
-     --mount "type=bind,source=${MOUNT_SOURCE},destination=/work" \
-     --mount "type=bind,source=${MOUNT_ROOT_SOURCE}/..,destination=/parent" \
-diff -Naur istio/common/scripts/setup_env.sh istio-new/common/scripts/setup_env.sh
--- istio/common/scripts/setup_env.sh	2023-08-15 21:01:53.601636573 +0800
-+++ istio-new/common/scripts/setup_env.sh	2023-08-15 20:15:23.292391629 +0800
-@@ -81,6 +81,9 @@
- export TARGET_OUT="${TARGET_OUT:-$(pwd)/out/${TARGET_OS}_${TARGET_ARCH}}"
- export TARGET_OUT_LINUX="${TARGET_OUT_LINUX:-$(pwd)/out/linux_${TARGET_ARCH}}"
- 
-+export ARM64_OUT_LINUX=/work/out/linux_arm64
-+export AMD64_OUT_LINUX=/work/out/linux_amd64
-+
- export CONTAINER_TARGET_OUT="${CONTAINER_TARGET_OUT:-/work/out/${TARGET_OS}_${TARGET_ARCH}}"
- export CONTAINER_TARGET_OUT_LINUX="${CONTAINER_TARGET_OUT_LINUX:-/work/out/linux_${TARGET_ARCH}}"
- 
-diff -Naur istio/Makefile.core.mk istio-new/Makefile.core.mk
--- istio/Makefile.core.mk	2023-08-15 21:01:53.601636573 +0800
-+++ istio-new/Makefile.core.mk	2023-08-15 20:03:25.384280274 +0800
-@@ -150,6 +150,11 @@
- export ISTIO_ENVOY_CENTOS_LINUX_RELEASE_NAME ?= envoy-centos-${ISTIO_ENVOY_LINUX_VERSION}
- export ISTIO_ENVOY_CENTOS_LINUX_RELEASE_PATH ?= ${ISTIO_ENVOY_LINUX_RELEASE_DIR}/${ISTIO_ENVOY_CENTOS_LINUX_RELEASE_NAME}
- 
-+export ISTIO_ENVOY_LINUX_ARM64_RELEASE_DIR ?= ${ARM64_OUT_LINUX}/release
-+export ISTIO_ENVOY_LINUX_ARM64_RELEASE_PATH ?= ${ISTIO_ENVOY_LINUX_ARM64_RELEASE_DIR}/${ISTIO_ENVOY_LINUX_RELEASE_NAME}
-+export ISTIO_ENVOY_LINUX_AMD64_RELEASE_DIR ?= ${AMD64_OUT_LINUX}/release
-+export ISTIO_ENVOY_LINUX_AMD64_RELEASE_PATH ?= ${ISTIO_ENVOY_LINUX_AMD64_RELEASE_DIR}/${ISTIO_ENVOY_LINUX_RELEASE_NAME}
-+
- # Envoy macOS vars.
- # TODO Change url when official envoy release for macOS is available
- export ISTIO_ENVOY_MACOS_VERSION ?= 1.0.2
-@@ -240,6 +245,8 @@
- ${ISTIO_ENVOY_LINUX_DEBUG_PATH}: init
- ${ISTIO_ENVOY_LINUX_RELEASE_PATH}: init
- ${ISTIO_ENVOY_MACOS_RELEASE_PATH}: init
-+${ISTIO_ENVOY_LINUX_ARM64_RELEASE_PATH}: init
-+${ISTIO_ENVOY_LINUX_AMD64_RELEASE_PATH}: init
- 
- # Pull dependencies, based on the checked in Gopkg.lock file.
- # Developers must manually run `dep ensure` if adding new deps
-@@ -312,8 +319,8 @@
- # various platform images.
- .PHONY: build-linux
- build-linux: depend
-	GOOS=linux GOARCH=$(GOARCH_LOCAL) LDFLAGS=$(RELEASE_LDFLAGS) common/scripts/gobuild.sh $(ISTIO_OUT_LINUX)/ $(STANDARD_BINARIES)
-	GOOS=linux GOARCH=$(GOARCH_LOCAL) LDFLAGS=$(RELEASE_LDFLAGS) common/scripts/gobuild.sh $(ISTIO_OUT_LINUX)/ -tags=agent $(AGENT_BINARIES)
-+	GOOS=linux GOARCH=$(GOARCH_LOCAL) LDFLAGS=$(RELEASE_LDFLAGS) GOBUILDFLAGS='-buildvcs=false' common/scripts/gobuild.sh $(ISTIO_OUT_LINUX)/ $(STANDARD_BINARIES)
-+	GOOS=linux GOARCH=$(GOARCH_LOCAL) LDFLAGS=$(RELEASE_LDFLAGS) GOBUILDFLAGS='-buildvcs=false' common/scripts/gobuild.sh $(ISTIO_OUT_LINUX)/ -tags=agent $(AGENT_BINARIES)
- 
- # Create targets for ISTIO_OUT_LINUX/binary
- # There are two use cases here:
-diff -Naur istio/tools/istio-docker.mk istio-new/tools/istio-docker.mk
--- istio/tools/istio-docker.mk	2023-08-15 21:01:53.621637356 +0800
-+++ istio-new/tools/istio-docker.mk	2023-08-15 20:02:11.881402098 +0800
-@@ -77,6 +77,14 @@
- ${ISTIO_ENVOY_BOOTSTRAP_CONFIG_DIR}/envoy_bootstrap.json: ${ISTIO_ENVOY_BOOTSTRAP_CONFIG_PATH}
- 	cp ${ISTIO_ENVOY_BOOTSTRAP_CONFIG_PATH} ${ISTIO_ENVOY_BOOTSTRAP_CONFIG_DIR}/envoy_bootstrap.json
- 
-+${ISTIO_ENVOY_LINUX_ARM64_RELEASE_DIR}/${SIDECAR}: ${ISTIO_ENVOY_LINUX_ARM64_RELEASE_PATH}
-+	mkdir -p $(DOCKER_BUILD_TOP)/proxyv2
-+	cp ${ISTIO_ENVOY_LINUX_ARM64_RELEASE_PATH} ${ISTIO_ENVOY_LINUX_ARM64_RELEASE_DIR}/${SIDECAR}
-+
-+${ISTIO_ENVOY_LINUX_AMD64_RELEASE_DIR}/${SIDECAR}: ${ISTIO_ENVOY_LINUX_AMD64_RELEASE_PATH}
-+	mkdir -p $(DOCKER_BUILD_TOP)/proxyv2
-+	cp ${ISTIO_ENVOY_LINUX_AMD64_RELEASE_PATH} ${ISTIO_ENVOY_LINUX_AMD64_RELEASE_DIR}/${SIDECAR}
-+
- # rule for wasm extensions.
- $(ISTIO_ENVOY_LINUX_RELEASE_DIR)/stats-filter.wasm: init
- $(ISTIO_ENVOY_LINUX_RELEASE_DIR)/stats-filter.compiled.wasm: init
-@@ -88,7 +96,8 @@
- docker.proxyv2: BUILD_ARGS=--build-arg proxy_version=istio-proxy:${PROXY_REPO_SHA} --build-arg istio_version=${VERSION} --build-arg BASE_VERSION=${BASE_VERSION} --build-arg SIDECAR=${SIDECAR} --build-arg HUB=${HUB}
- docker.proxyv2: ${ISTIO_ENVOY_BOOTSTRAP_CONFIG_DIR}/envoy_bootstrap.json
- docker.proxyv2: ${ISTIO_ENVOY_BOOTSTRAP_CONFIG_DIR}/gcp_envoy_bootstrap.json
-docker.proxyv2: $(ISTIO_ENVOY_LINUX_RELEASE_DIR)/${SIDECAR}
-+docker.proxyv2: ${ISTIO_ENVOY_LINUX_ARM64_RELEASE_DIR}/${SIDECAR}
-+docker.proxyv2: ${ISTIO_ENVOY_LINUX_AMD64_RELEASE_DIR}/${SIDECAR}
- docker.proxyv2: $(ISTIO_OUT_LINUX)/pilot-agent
- docker.proxyv2: pilot/docker/Dockerfile.proxyv2
- # docker.proxyv2: $(ISTIO_ENVOY_LINUX_RELEASE_DIR)/stats-filter.wasm
-@@ -324,7 +333,13 @@
- # This can be done with DOCKER_BUILD_VARIANTS="default debug" as well, but at the expense of building twice vs building once and tagging twice
- INCLUDE_UNTAGGED_DEFAULT ?= false
- DEFAULT_DISTRIBUTION=debug
-+
-+
-+ifeq ($(BUILDX_PLATFORM), true)
-+DOCKER_RULE ?= $(foreach VARIANT,$(DOCKER_BUILD_VARIANTS), time (mkdir -p $(DOCKER_BUILD_TOP)/$@ && TARGET_ARCH=$(TARGET_ARCH) ./tools/docker-copy.sh $^ $(DOCKER_BUILD_TOP)/$@ && cd $(DOCKER_BUILD_TOP)/$@ $(BUILD_PRE) && docker buildx create --use && docker buildx build --no-cache --platform linux/amd64,linux/arm64 $(BUILD_ARGS) --build-arg BASE_DISTRIBUTION=$(call normalize-tag,$(VARIANT)) -t $(HUB)/$(subst docker.,,$@):$(TAG)$(call variant-tag,$(VARIANT)) -f Dockerfile$(suffix $@) . --push  ); )
-+else
- DOCKER_RULE ?= $(foreach VARIANT,$(DOCKER_BUILD_VARIANTS), time (mkdir -p $(DOCKER_BUILD_TOP)/$@ && TARGET_ARCH=$(TARGET_ARCH) ./tools/docker-copy.sh $^ $(DOCKER_BUILD_TOP)/$@ && cd $(DOCKER_BUILD_TOP)/$@ $(BUILD_PRE) && docker build $(BUILD_ARGS) --build-arg BASE_DISTRIBUTION=$(call normalize-tag,$(VARIANT)) -t $(HUB)/$(subst docker.,,$@):$(TAG)$(call variant-tag,$(VARIANT)) -f Dockerfile$(suffix $@) . ); )
-+endif
- RENAME_TEMPLATE ?= mkdir -p $(DOCKER_BUILD_TOP)/$@ && cp $(ECHO_DOCKER)/$(VM_OS_DOCKERFILE_TEMPLATE) $(DOCKER_BUILD_TOP)/$@/Dockerfile$(suffix $@)
- 
- # This target will package all docker images used in test and release, without re-building
--- a/istio/1.12/patches/istio/20230922-gateway-class.patch
+++ b/istio/1.12/patches/istio/20230922-gateway-class.patch
@@ -1,14 +0,0 @@
-diff -Naur istio/pilot/pkg/config/kube/gateway/conversion.go istio_new/pilot/pkg/config/kube/gateway/conversion.go
--- istio/pilot/pkg/config/kube/gateway/conversion.go	2023-09-22 11:06:50.400535200 +0800
-+++ istio_new/pilot/pkg/config/kube/gateway/conversion.go	2023-09-22 11:07:52.954982700 +0800
-@@ -37,8 +37,8 @@
- )
- 
- const (
-	DefaultClassName = "istio"
-	ControllerName   = "istio.io/gateway-controller"
-+	DefaultClassName = "higress"
-+	ControllerName   = "higress.io/gateway-controller"
- )
- 
- // KubernetesResources stores all inputs to our conversion
--- a/istio/1.12/patches/istio/20230925-gateway-httproute.patch
+++ b/istio/1.12/patches/istio/20230925-gateway-httproute.patch
@@ -1,71 +0,0 @@
-diff -Naur istio/pilot/pkg/config/kube/gateway/conversion.go istio-new/pilot/pkg/config/kube/gateway/conversion.go
--- istio/pilot/pkg/config/kube/gateway/conversion.go	2023-09-25 17:26:32.000000000 +0800
-+++ istio-new/pilot/pkg/config/kube/gateway/conversion.go	2023-09-25 17:25:27.000000000 +0800
-@@ -656,6 +656,16 @@
- 			Port: &istio.PortSelector{Number: uint32(*to.Port)},
- 		}, nil
- 	}
-+	if equal((*string)(to.Group), "networking.higress.io") && nilOrEqual((*string)(to.Kind), "Service") {
-+		var port *istio.PortSelector
-+		if to.Port != nil {
-+			port = &istio.PortSelector{Number: uint32(*to.Port)}
-+		}
-+		return &istio.Destination{
-+			Host: string(to.Name),
-+			Port: port,
-+		}, nil
-+	}
- 	return nil, &ConfigError{
- 		Reason:  InvalidDestination,
- 		Message: fmt.Sprintf("referencing unsupported backendRef: group %q kind %q", emptyIfNil((*string)(to.Group)), emptyIfNil((*string)(to.Kind))),
-@@ -912,7 +922,7 @@
- 					ObservedGeneration: obj.Generation,
- 					LastTransitionTime: metav1.Now(),
- 					Reason:             string(k8s.GatewayClassConditionStatusAccepted),
-					Message:            "Handled by Istio controller",
-+					Message:            "Handled by Higress controller",
- 				})
- 				return gcs
- 			})
-@@ -1371,6 +1381,10 @@
- 	return d
- }
- 
-+func equal(have *string, expected string) bool {
-+	return have != nil && *have == expected
-+}
-+
- func nilOrEqual(have *string, expected string) bool {
- 	return have == nil || *have == expected
- }
-diff -Naur istio/pilot/pkg/leaderelection/leaderelection.go istio-new/pilot/pkg/leaderelection/leaderelection.go
--- istio/pilot/pkg/leaderelection/leaderelection.go	2023-09-25 17:26:31.000000000 +0800
-+++ istio-new/pilot/pkg/leaderelection/leaderelection.go	2023-09-25 14:59:39.000000000 +0800
-@@ -35,20 +35,20 @@
- 
- // Various locks used throughout the code
- const (
-	NamespaceController     = "istio-namespace-controller-election"
-	ServiceExportController = "istio-serviceexport-controller-election"
-+	NamespaceController     = "higress-namespace-controller-election"
-+	ServiceExportController = "higress-serviceexport-controller-election"
- 	// This holds the legacy name to not conflict with older control plane deployments which are just
- 	// doing the ingress syncing.
-	IngressController = "istio-leader"
-+	IngressController = "higress-leader"
- 	// GatewayStatusController controls the status of gateway.networking.k8s.io objects. For the v1alpha1
- 	// this was formally "istio-gateway-leader"; because they are a different API group we need a different
- 	// election to ensure we do not only handle one or the other.
-	GatewayStatusController = "istio-gateway-status-leader"
-+	GatewayStatusController = "higress-gateway-status-leader"
- 	// GatewayDeploymentController controls the Deployment/Service generation from Gateways. This is
- 	// separate from GatewayStatusController to allow running in a separate process (for low priv).
-	GatewayDeploymentController = "istio-gateway-deployment-leader"
-	StatusController            = "istio-status-leader"
-	AnalyzeController           = "istio-analyze-leader"
-+	GatewayDeploymentController = "higress-gateway-deployment-leader"
-+	StatusController            = "higress-status-leader"
-+	AnalyzeController           = "higress-analyze-leader"
- )
- 
- var ClusterScopedNamespaceController = NamespaceController
--- a/istio/1.12/patches/istio/20231008-gateway-fallback.patch
+++ b/istio/1.12/patches/istio/20231008-gateway-fallback.patch
@@ -1,90 +0,0 @@
-diff -Naur istio/pilot/pkg/config/kube/gateway/conversion.go istio-new/pilot/pkg/config/kube/gateway/conversion.go
--- istio/pilot/pkg/config/kube/gateway/conversion.go	2023-10-08 19:54:47.000000000 +0800
-+++ istio-new/pilot/pkg/config/kube/gateway/conversion.go	2023-09-27 16:10:42.000000000 +0800
-@@ -18,6 +18,7 @@
- 	"fmt"
- 	"regexp"
- 	"sort"
-+	"strconv"
- 	"strings"
- 
- 	corev1 "k8s.io/api/core/v1"
-@@ -176,7 +177,9 @@
- 	hosts := hostnameToStringList(route.Hostnames)
- 	for _, r := range route.Rules {
- 		// TODO: implement rewrite, timeout, mirror, corspolicy, retries
-		vs := &istio.HTTPRoute{}
-+		vs := &istio.HTTPRoute{
-+			Name: obj.Name,
-+		}
- 		for _, match := range r.Matches {
- 			uri, err := createURIMatch(match)
- 			if err != nil {
-@@ -246,7 +249,9 @@
- 			}}
- 		}
- 
-		route, err := buildHTTPDestination(r.BackendRefs, obj.Namespace, domain, zero)
-+		fallbackCluster := obj.Annotations["higress.io/fallback-service"]
-+
-+		route, err := buildHTTPDestination(r.BackendRefs, obj.Namespace, domain, zero, fallbackCluster)
- 		if err != nil {
- 			reportError(err)
- 			return nil
-@@ -581,11 +586,33 @@
- 	return r
- }
- 
-func buildHTTPDestination(forwardTo []k8s.HTTPBackendRef, ns string, domain string, totalZero bool) ([]*istio.HTTPRouteDestination, *ConfigError) {
-+func buildHTTPDestination(forwardTo []k8s.HTTPBackendRef, ns string, domain string, totalZero bool, fallbackCluster string) ([]*istio.HTTPRouteDestination, *ConfigError) {
- 	if forwardTo == nil {
- 		return nil, nil
- 	}
- 
-+	var fallbackDest *istio.Destination
-+	if fallbackCluster != "" {
-+		var port uint64
-+		host := fallbackCluster
-+		colon := strings.LastIndex(fallbackCluster, ":")
-+		if colon != -1 {
-+			var err error
-+			port, err = strconv.ParseUint(fallbackCluster[colon+1:], 10, 32)
-+			if err == nil && port > 0 && port < 65536 {
-+				host = fallbackCluster[:colon]
-+			}
-+		}
-+		fallbackDest = &istio.Destination{
-+			Host: host,
-+		}
-+		if port > 0 {
-+			fallbackDest.Port = &istio.PortSelector{
-+				Number: uint32(port),
-+			}
-+		}
-+	}
-+
- 	weights := []int{}
- 	action := []k8s.HTTPBackendRef{}
- 	for i, w := range forwardTo {
-@@ -612,6 +639,9 @@
- 			Destination: dst,
- 			Weight:      int32(weights[i]),
- 		}
-+		if fallbackDest != nil {
-+			rd.FallbackClusters = append(rd.FallbackClusters, fallbackDest)
-+		}
- 		for _, filter := range fwd.Filters {
- 			switch filter.Type {
- 			case k8s.HTTPRouteFilterRequestHeaderModifier:
-diff -Naur istio/pilot/pkg/networking/core/v1alpha3/route/route.go istio-new/pilot/pkg/networking/core/v1alpha3/route/route.go
--- istio/pilot/pkg/networking/core/v1alpha3/route/route.go	2023-10-08 19:54:46.000000000 +0800
-+++ istio-new/pilot/pkg/networking/core/v1alpha3/route/route.go	2023-09-27 16:18:16.000000000 +0800
-@@ -669,7 +669,7 @@
- 		}
- 		var singleClusterConfig *fallback.ClusterFallbackConfig
- 		var weightedClusterConfig *fallback.ClusterFallbackConfig
-		isSupportFallback := supportFallback(node)
-+		isSupportFallback := true
- 		// Added by ingress
- 		if len(in.Route) == 1 {
- 			route := in.Route[0]
--- a/istio/1.12/patches/istio/20231024-cds-add-fallback.patch
+++ b/istio/1.12/patches/istio/20231024-cds-add-fallback.patch
@@ -1,13 +0,0 @@
-diff -Naur istio/pilot/pkg/model/push_context.go istio-new/pilot/pkg/model/push_context.go
--- istio/pilot/pkg/model/push_context.go	2023-10-24 10:55:51.000000000 +0800
-+++ istio-new/pilot/pkg/model/push_context.go	2023-10-20 17:00:06.000000000 +0800
-@@ -704,6 +704,9 @@
- 			if r.Destination != nil {
- 				out = append(out, r.Destination.Host)
- 			}
-+			for _, d := range r.FallbackClusters {
-+				out = append(out, d.Host)
-+			}
- 		}
- 		if h.Mirror != nil {
- 			out = append(out, h.Mirror.Host)
--- a/istio/1.12/patches/istio/20231031-gatewayapi-v1beta1.patch
+++ b/istio/1.12/patches/istio/20231031-gatewayapi-v1beta1.patch
--- a/istio/1.12/patches/istio/20231103-gatewayapi-sort.patch
+++ b/istio/1.12/patches/istio/20231103-gatewayapi-sort.patch
@@ -1,377 +0,0 @@
-diff -Naur istio/pilot/pkg/config/kube/gateway/conversion.go istio-new/pilot/pkg/config/kube/gateway/conversion.go
--- istio/pilot/pkg/config/kube/gateway/conversion.go	2023-11-03 17:18:56.000000000 +0800
-+++ istio-new/pilot/pkg/config/kube/gateway/conversion.go	2023-11-03 17:14:50.000000000 +0800
-@@ -151,15 +151,113 @@
- 		}
- 	}
- 
-+	// for gateway routes, build one VS per gateway+host
-+	gatewayRoutes := make(map[string]map[string]*config.Config)
-+
- 	for _, obj := range r.HTTPRoute {
-		if vsConfig := buildHTTPVirtualServices(obj, gatewayMap, r.Domain); vsConfig != nil {
-+		buildHTTPVirtualServices(r, obj, gatewayMap, gatewayRoutes, r.Domain)
-+	}
-+	for _, vsByHost := range gatewayRoutes {
-+		for _, vsConfig := range vsByHost {
- 			result = append(result, *vsConfig)
- 		}
- 	}
- 	return result
- }
- 
-func buildHTTPVirtualServices(obj config.Config, gateways map[parentKey]map[gatewayapiV1beta1.SectionName]*parentInfo, domain string) *config.Config {
-+// getURIRank ranks a URI match type. Exact > Prefix > Regex
-+func getURIRank(match *istio.HTTPMatchRequest) int {
-+	if match.Uri == nil {
-+		return -1
-+	}
-+	switch match.Uri.MatchType.(type) {
-+	case *istio.StringMatch_Exact:
-+		return 3
-+	case *istio.StringMatch_Prefix:
-+		return 2
-+	case *istio.StringMatch_Regex:
-+		// TODO optimize in new verison envoy
-+		if strings.HasSuffix(match.Uri.GetRegex(), prefixMatchRegex) &&
-+			!strings.ContainsAny(strings.TrimSuffix(match.Uri.GetRegex(), prefixMatchRegex), `\.+*?()|[]{}^$`) {
-+			return 2
-+		}
-+		return 1
-+	}
-+	// should not happen
-+	return -1
-+}
-+
-+func getURILength(match *istio.HTTPMatchRequest) int {
-+	if match.Uri == nil {
-+		return 0
-+	}
-+	switch match.Uri.MatchType.(type) {
-+	case *istio.StringMatch_Prefix:
-+		return len(match.Uri.GetPrefix())
-+	case *istio.StringMatch_Exact:
-+		return len(match.Uri.GetExact())
-+	case *istio.StringMatch_Regex:
-+		return len(match.Uri.GetRegex())
-+	}
-+	// should not happen
-+	return -1
-+}
-+
-+// sortHTTPRoutes sorts generated vs routes to meet gateway-api requirements
-+// see https://gateway-api.sigs.k8s.io/v1alpha2/references/spec/#gateway.networking.k8s.io/v1alpha2.HTTPRouteRule
-+func sortHTTPRoutes(routes []*istio.HTTPRoute) {
-+	sort.SliceStable(routes, func(i, j int) bool {
-+		if len(routes[i].Match) == 0 {
-+			return false
-+		} else if len(routes[j].Match) == 0 {
-+			return true
-+		}
-+		// Only look at match[0], we always generate only one match
-+		m1, m2 := routes[i].Match[0], routes[j].Match[0]
-+		r1, r2 := getURIRank(m1), getURIRank(m2)
-+		len1, len2 := getURILength(m1), getURILength(m2)
-+		switch {
-+		// 1: Exact/Prefix/Regex
-+		case r1 != r2:
-+			return r1 > r2
-+		case len1 != len2:
-+			return len1 > len2
-+			// 2: method math
-+		case (m1.Method == nil) != (m2.Method == nil):
-+			return m1.Method != nil
-+			// 3: number of header matches
-+		case len(m1.Headers) != len(m2.Headers):
-+			return len(m1.Headers) > len(m2.Headers)
-+			// 4: number of query matches
-+		default:
-+			return len(m1.QueryParams) > len(m2.QueryParams)
-+		}
-+	})
-+}
-+
-+func routeMeta(obj config.Config) map[string]string {
-+	m := parentMeta(obj, nil)
-+	m[constants.InternalRouteSemantics] = constants.RouteSemanticsGateway
-+	return m
-+}
-+
-+func filteredReferences(parents []routeParentReference) []routeParentReference {
-+	ret := make([]routeParentReference, 0, len(parents))
-+	for _, p := range parents {
-+		if p.DeniedReason != nil {
-+			// We should filter this out
-+			continue
-+		}
-+		ret = append(ret, p)
-+	}
-+	// To ensure deterministic order, sort them
-+	sort.Slice(ret, func(i, j int) bool {
-+		return ret[i].InternalName < ret[j].InternalName
-+	})
-+	return ret
-+}
-+
-+func buildHTTPVirtualServices(ctx *KubernetesResources, obj config.Config, gateways map[parentKey]map[gatewayapiV1beta1.SectionName]*parentInfo, gatewayRoutes map[string]map[string]*config.Config, domain string) {
- 	route := obj.Spec.(*gatewayapiV1beta1.HTTPRouteSpec)
- 
- 	parentRefs := extractParentReferenceInfo(gateways, route.ParentRefs, route.Hostnames, gvk.HTTPRoute, obj.Namespace)
-@@ -172,10 +270,7 @@
- 		})
- 	}
- 
-	name := fmt.Sprintf("%s-%s", obj.Name, constants.KubernetesGatewayName)
-
- 	httproutes := []*istio.HTTPRoute{}
-	hosts := hostnameToStringList(route.Hostnames)
- 	for _, r := range route.Rules {
- 		// TODO: implement rewrite, timeout, mirror, corspolicy, retries
- 		vs := &istio.HTTPRoute{
-@@ -185,22 +280,22 @@
- 			uri, err := createURIMatch(match)
- 			if err != nil {
- 				reportError(err)
-				return nil
-+				return
- 			}
- 			headers, err := createHeadersMatch(match)
- 			if err != nil {
- 				reportError(err)
-				return nil
-+				return
- 			}
- 			qp, err := createQueryParamsMatch(match)
- 			if err != nil {
- 				reportError(err)
-				return nil
-+				return
- 			}
- 			method, err := createMethodMatch(match)
- 			if err != nil {
- 				reportError(err)
-				return nil
-+				return
- 			}
- 			vs.Match = append(vs.Match, &istio.HTTPMatchRequest{
- 				Uri:         uri,
-@@ -219,7 +314,7 @@
- 				mirror, err := createMirrorFilter(filter.RequestMirror, obj.Namespace, domain)
- 				if err != nil {
- 					reportError(err)
-					return nil
-+					return
- 				}
- 				vs.Mirror = mirror
- 			default:
-@@ -227,7 +322,7 @@
- 					Reason:  InvalidFilter,
- 					Message: fmt.Sprintf("unsupported filter type %q", filter.Type),
- 				})
-				return nil
-+				return
- 			}
- 		}
- 
-@@ -255,33 +350,65 @@
- 		route, err := buildHTTPDestination(r.BackendRefs, obj.Namespace, domain, zero, fallbackCluster)
- 		if err != nil {
- 			reportError(err)
-			return nil
-+			return
- 		}
- 		vs.Route = route
- 
- 		httproutes = append(httproutes, vs)
- 	}
- 	reportError(nil)
-	gatewayNames := referencesToInternalNames(parentRefs)
-	if len(gatewayNames) == 0 {
-		return nil
-+
-+	count := 0
-+	for _, parent := range filteredReferences(parentRefs) {
-+		// for gateway routes, build one VS per gateway+host
-+		routeMap := gatewayRoutes
-+		routeKey := parent.InternalName
-+		vsHosts := hostnameToStringList(route.Hostnames)
-+		routes := httproutes
-+		if len(routes) == 0 {
-+			continue
-+		}
-+		if _, f := routeMap[routeKey]; !f {
-+			routeMap[routeKey] = make(map[string]*config.Config)
-+		}
-+
-+		// Create one VS per hostname with a single hostname.
-+		// This ensures we can treat each hostname independently, as the spec requires
-+		for _, h := range vsHosts {
-+			if cfg := routeMap[routeKey][h]; cfg != nil {
-+				// merge http routes
-+				vs := cfg.Spec.(*istio.VirtualService)
-+				vs.Http = append(vs.Http, routes...)
-+				// append parents
-+				cfg.Annotations[constants.InternalParentNames] = fmt.Sprintf("%s,%s/%s.%s",
-+					cfg.Annotations[constants.InternalParentNames], obj.GroupVersionKind.Kind, obj.Name, obj.Namespace)
-+			} else {
-+				name := fmt.Sprintf("%s-%d-%s", obj.Name, count, constants.KubernetesGatewayName)
-+				routeMap[routeKey][h] = &config.Config{
-+					Meta: config.Meta{
-+						CreationTimestamp: obj.CreationTimestamp,
-+						GroupVersionKind:  gvk.VirtualService,
-+						Name:              name,
-+						Annotations:       routeMeta(obj),
-+						Namespace:         obj.Namespace,
-+						Domain:            ctx.Domain,
-+					},
-+					Spec: &istio.VirtualService{
-+						Hosts:    []string{h},
-+						Gateways: []string{parent.InternalName},
-+						Http:     routes,
-+					},
-+				}
-+				count++
-+			}
-+		}
- 	}
-	vsConfig := config.Config{
-		Meta: config.Meta{
-			CreationTimestamp: obj.CreationTimestamp,
-			GroupVersionKind:  gvk.VirtualService,
-			Name:              name,
-			Annotations:       parentMeta(obj, nil),
-			Namespace:         obj.Namespace,
-			Domain:            domain,
-		},
-		Spec: &istio.VirtualService{
-			Hosts:    hosts,
-			Gateways: gatewayNames,
-			Http:     httproutes,
-		},
-+	for _, vsByHost := range gatewayRoutes {
-+		for _, cfg := range vsByHost {
-+			vs := cfg.Spec.(*istio.VirtualService)
-+			sortHTTPRoutes(vs.Http)
-+		}
- 	}
-	return &vsConfig
- }
- 
- func parentMeta(obj config.Config, sectionName *gatewayapiV1beta1.SectionName) map[string]string {
-@@ -1155,9 +1282,11 @@
- 			}
- 			gs.Addresses = make([]gatewayapiV1beta1.GatewayAddress, 0, len(addressesToReport))
- 			for _, addr := range addressesToReport {
-+				addrPairs := strings.Split(addr, ":")
- 				gs.Addresses = append(gs.Addresses, gatewayapiV1beta1.GatewayAddress{
-					Type:  &addrType,
-					Value: addr,
-+					Type: &addrType,
-+					// strip the port
-+					Value: addrPairs[0],
- 				})
- 			}
- 			return gs
-diff -Naur istio/pilot/pkg/model/push_context.go istio-new/pilot/pkg/model/push_context.go
--- istio/pilot/pkg/model/push_context.go	2023-11-03 17:18:56.000000000 +0800
-+++ istio-new/pilot/pkg/model/push_context.go	2023-11-03 17:05:47.000000000 +0800
-@@ -841,7 +841,19 @@
- func (ps *PushContext) VirtualServicesForGateway(proxy *Proxy, gateway string) []config.Config {
- 	res := ps.virtualServiceIndex.privateByNamespaceAndGateway[proxy.ConfigNamespace][gateway]
- 	res = append(res, ps.virtualServiceIndex.exportedToNamespaceByGateway[proxy.ConfigNamespace][gateway]...)
-	res = append(res, ps.virtualServiceIndex.publicByGateway[gateway]...)
-+
-+	// Favor same-namespace Gateway routes, to give the "consumer override" preference.
-+	// We do 2 iterations here to avoid extra allocations.
-+	for _, vs := range ps.virtualServiceIndex.publicByGateway[gateway] {
-+		if UseGatewaySemantics(vs) && vs.Namespace == proxy.ConfigNamespace {
-+			res = append(res, vs)
-+		}
-+	}
-+	for _, vs := range ps.virtualServiceIndex.publicByGateway[gateway] {
-+		if !(UseGatewaySemantics(vs) && vs.Namespace == proxy.ConfigNamespace) {
-+			res = append(res, vs)
-+		}
-+	}
- 	return res
- }
- 
-diff -Naur istio/pilot/pkg/model/virtualservice.go istio-new/pilot/pkg/model/virtualservice.go
--- istio/pilot/pkg/model/virtualservice.go	2023-11-03 17:18:55.000000000 +0800
-+++ istio-new/pilot/pkg/model/virtualservice.go	2023-11-03 15:19:08.000000000 +0800
-@@ -76,6 +76,11 @@
- }
- 
- func resolveVirtualServiceShortnames(rule *networking.VirtualService, meta config.Meta) {
-+	// Kubernetes Gateway API semantics support shortnames
-+	// if UseGatewaySemantics(config.Config{Meta: meta}) {
-+	// 	return
-+	// }
-+
- 	// resolve top level hosts
- 	for i, h := range rule.Hosts {
- 		rule.Hosts[i] = string(ResolveShortnameToFQDN(h, meta))
-@@ -524,3 +529,10 @@
- 	}
- 	return false
- }
-+
-+// UseGatewaySemantics determines which logic we should use for VirtualService
-+// This allows gateway-api and VS to both be represented by VirtualService, but have different
-+// semantics.
-+func UseGatewaySemantics(cfg config.Config) bool {
-+	return cfg.Annotations[constants.InternalRouteSemantics] == constants.RouteSemanticsGateway
-+}
-diff -Naur istio/pilot/pkg/networking/core/v1alpha3/route/route.go istio-new/pilot/pkg/networking/core/v1alpha3/route/route.go
--- istio/pilot/pkg/networking/core/v1alpha3/route/route.go	2023-11-03 17:18:56.000000000 +0800
-+++ istio-new/pilot/pkg/networking/core/v1alpha3/route/route.go	2023-11-03 17:05:55.000000000 +0800
-@@ -408,7 +408,6 @@
- 			break
- 		}
- 	}
-
- 	if len(out) == 0 {
- 		return nil, fmt.Errorf("no routes matched")
- 	}
-@@ -493,6 +492,14 @@
- 			},
- 		}
- 
-+		if model.UseGatewaySemantics(virtualService) {
-+			if uri, isPrefixReplace := cutPrefix(redirect.Uri, "%PREFIX()%"); isPrefixReplace {
-+				action.Redirect.PathRewriteSpecifier = &route.RedirectAction_PrefixRewrite{
-+					PrefixRewrite: uri,
-+				}
-+			}
-+		}
-+
- 		if redirect.Scheme != "" {
- 			action.Redirect.SchemeRewriteSpecifier = &route.RedirectAction_SchemeRedirect{SchemeRedirect: redirect.Scheme}
- 		}
-@@ -1616,3 +1623,10 @@
- 	isSupport = curVersion.GreaterThan(notSupportFallback)
- 	return
- }
-+
-+func cutPrefix(s, prefix string) (after string, found bool) {
-+	if !strings.HasPrefix(s, prefix) {
-+		return s, false
-+	}
-+	return s[len(prefix):], true
-+}
-diff -Naur istio/pkg/config/constants/constants.go istio-new/pkg/config/constants/constants.go
--- istio/pkg/config/constants/constants.go	2023-11-03 17:18:54.000000000 +0800
-+++ istio-new/pkg/config/constants/constants.go	2023-11-03 14:29:27.000000000 +0800
-@@ -15,6 +15,12 @@
- package constants
- 
- const (
-+	InternalParentNames = "internal.istio.io/parents"
-+
-+	InternalRouteSemantics = "internal.istio.io/route-semantics"
-+
-+	RouteSemanticsGateway = "gateway"
-+
- 	// UnspecifiedIP constant for empty IP address
- 	UnspecifiedIP = "0.0.0.0"
- 
--- a/istio/1.12/patches/istio/20231104-gatewayapi-catchall.patch
+++ b/istio/1.12/patches/istio/20231104-gatewayapi-catchall.patch
@@ -1,50 +0,0 @@
-diff -Naur istio/pilot/pkg/config/kube/gateway/conversion.go istio-new/pilot/pkg/config/kube/gateway/conversion.go
--- istio/pilot/pkg/config/kube/gateway/conversion.go	2023-11-03 20:09:38.000000000 +0800
-+++ istio-new/pilot/pkg/config/kube/gateway/conversion.go	2023-11-03 20:02:26.000000000 +0800
-@@ -165,6 +165,34 @@
- 	return result
- }
- 
-+// isCatchAll returns true if HTTPMatchRequest is a catchall match otherwise
-+// false. Note - this may not be exactly "catch all" as we don't know the full
-+// class of possible inputs As such, this is used only for optimization.
-+func isCatchAllMatch(m *istio.HTTPMatchRequest) bool {
-+	catchall := false
-+	if m.Uri != nil {
-+		switch m := m.Uri.MatchType.(type) {
-+		case *istio.StringMatch_Prefix:
-+			catchall = m.Prefix == "/"
-+		case *istio.StringMatch_Regex:
-+			catchall = m.Regex == "*"
-+		}
-+	}
-+	// A Match is catch all if and only if it has no match set
-+	// and URI has a prefix / or regex *.
-+	return catchall &&
-+		len(m.Headers) == 0 &&
-+		len(m.QueryParams) == 0 &&
-+		len(m.SourceLabels) == 0 &&
-+		len(m.WithoutHeaders) == 0 &&
-+		len(m.Gateways) == 0 &&
-+		m.Method == nil &&
-+		m.Scheme == nil &&
-+		m.Port == 0 &&
-+		m.Authority == nil &&
-+		m.SourceNamespace == ""
-+}
-+
- // getURIRank ranks a URI match type. Exact > Prefix > Regex
- func getURIRank(match *istio.HTTPMatchRequest) int {
- 	if match.Uri == nil {
-@@ -212,6 +240,11 @@
- 		} else if len(routes[j].Match) == 0 {
- 			return true
- 		}
-+		if isCatchAllMatch(routes[i].Match[0]) {
-+			return false
-+		} else if isCatchAllMatch(routes[j].Match[0]) {
-+			return true
-+		}
- 		// Only look at match[0], we always generate only one match
- 		m1, m2 := routes[i].Match[0], routes[j].Match[0]
- 		r1, r2 := getURIRank(m1), getURIRank(m2)
--- a/istio/1.12/patches/istio/20231115-optimize-xds-push.patch
+++ b/istio/1.12/patches/istio/20231115-optimize-xds-push.patch
@@ -1,62 +0,0 @@
-diff -Naur istio/pilot/pkg/xds/ads.go istio-new/pilot/pkg/xds/ads.go
--- istio/pilot/pkg/xds/ads.go	2023-11-15 20:25:18.000000000 +0800
-+++ istio-new/pilot/pkg/xds/ads.go	2023-11-15 20:24:20.000000000 +0800
-@@ -318,6 +318,27 @@
- 	<-con.initialized
- 
- 	for {
-+		// Go select{} statements are not ordered; the same channel can be chosen many times.
-+		// For requests, these are higher priority (client may be blocked on startup until these are done)
-+		// and often very cheap to handle (simple ACK), so we check it first.
-+		select {
-+		case req, ok := <-con.reqChan:
-+			if ok {
-+				if err := s.processRequest(req, con); err != nil {
-+					return err
-+				}
-+			} else {
-+				// Remote side closed connection or error processing the request.
-+				return <-con.errorChan
-+			}
-+		case <-con.stop:
-+			return nil
-+		default:
-+		}
-+		// If there wasn't already a request, poll for requests and pushes. Note: if we have a huge
-+		// amount of incoming requests, we may still send some pushes, as we do not `continue` above;
-+		// however, requests will be handled ~2x as much as pushes. This ensures a wave of requests
-+		// cannot completely starve pushes. However, this scenario is unlikely.
- 		select {
- 		case req, ok := <-con.reqChan:
- 			if ok {
-diff -Naur istio/pilot/pkg/xds/delta.go istio-new/pilot/pkg/xds/delta.go
--- istio/pilot/pkg/xds/delta.go	2023-11-15 20:25:18.000000000 +0800
-+++ istio-new/pilot/pkg/xds/delta.go	2023-11-15 20:24:44.000000000 +0800
-@@ -102,6 +102,27 @@
- 	<-con.initialized
- 
- 	for {
-+		// Go select{} statements are not ordered; the same channel can be chosen many times.
-+		// For requests, these are higher priority (client may be blocked on startup until these are done)
-+		// and often very cheap to handle (simple ACK), so we check it first.
-+		select {
-+		case req, ok := <-con.deltaReqChan:
-+			if ok {
-+				if err := s.processDeltaRequest(req, con); err != nil {
-+					return err
-+				}
-+			} else {
-+				// Remote side closed connection or error processing the request.
-+				return <-con.errorChan
-+			}
-+		case <-con.stop:
-+			return nil
-+		default:
-+		}
-+		// If there wasn't already a request, poll for requests and pushes. Note: if we have a huge
-+		// amount of incoming requests, we may still send some pushes, as we do not `continue` above;
-+		// however, requests will be handled ~2x as much as pushes. This ensures a wave of requests
-+		// cannot completely starve pushes. However, this scenario is unlikely.
- 		select {
- 		case req, ok := <-con.deltaReqChan:
- 			if ok {
--- a/istio/1.12/patches/istio/20240104-enhance-srds.patch
+++ b/istio/1.12/patches/istio/20240104-enhance-srds.patch
@@ -1,633 +0,0 @@
-diff -Naur istio/pilot/pkg/features/pilot.go istio-new/pilot/pkg/features/pilot.go
--- istio/pilot/pkg/features/pilot.go	2024-01-05 17:58:08.000000000 +0800
-+++ istio-new/pilot/pkg/features/pilot.go	2024-01-04 21:20:00.000000000 +0800
-@@ -569,6 +569,12 @@
- 	// Added by ingress
- 	CustomCACertConfigMapName = env.RegisterStringVar("CUSTOM_CA_CERT_NAME", "",
- 		"Defines the configmap's name of  istio's root ca certificate").Get()
-+	HostRDSMergeSubset = env.RegisterBoolVar("HOST_RDS_MERGE_SUBSET", true,
-+		"If enabled, if host A is a subset of B, then we merge B's routes into A's hostRDS").Get()
-+	EnableScopedRDS = env.RegisterBoolVar("ENBALE_SCOPED_RDS", true,
-+		"If enabled, each host in virtualservice will have an independent RDS, which is used with SRDS").Get()
-+	OnDemandRDS = env.RegisterBoolVar("ON_DEMAND_RDS", false,
-+		"If enabled, the on demand filter will be added to the HCM filters").Get()
- 	// End added by ingress
- )
- 
-diff -Naur istio/pilot/pkg/networking/core/configgen.go istio-new/pilot/pkg/networking/core/configgen.go
--- istio/pilot/pkg/networking/core/configgen.go	2024-01-05 17:58:02.000000000 +0800
-+++ istio-new/pilot/pkg/networking/core/configgen.go	2024-01-04 21:20:00.000000000 +0800
-@@ -17,6 +17,7 @@
- import (
- 	core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
- 	listener "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
-+	route "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
- 	discovery "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
- 
- 	meshconfig "istio.io/api/mesh/v1alpha1"
-@@ -44,6 +45,10 @@
- 	// BuildHTTPRoutes returns the list of HTTP routes for the given proxy. This is the RDS output
- 	BuildHTTPRoutes(node *model.Proxy, req *model.PushRequest, routeNames []string) ([]*discovery.Resource, model.XdsLogDetails)
- 
-+	// Added by ingress
-+	BuildScopedRoutes(node *model.Proxy, push *model.PushContext) []*route.ScopedRouteConfiguration
-+	// End added by ingress
-+
- 	// BuildNameTable returns list of hostnames and the associated IPs
- 	BuildNameTable(node *model.Proxy, push *model.PushContext) *dnsProto.NameTable
- 
-diff -Naur istio/pilot/pkg/networking/core/v1alpha3/gateway.go istio-new/pilot/pkg/networking/core/v1alpha3/gateway.go
--- istio/pilot/pkg/networking/core/v1alpha3/gateway.go	2024-01-05 17:58:07.000000000 +0800
-+++ istio-new/pilot/pkg/networking/core/v1alpha3/gateway.go	2024-01-05 11:19:54.000000000 +0800
-@@ -41,7 +41,9 @@
- 	"istio.io/istio/pilot/pkg/networking/plugin"
- 	"istio.io/istio/pilot/pkg/networking/util"
- 	authn_model "istio.io/istio/pilot/pkg/security/model"
-+	"istio.io/istio/pilot/pkg/util/sets"
- 	"istio.io/istio/pkg/config"
-+	"istio.io/istio/pkg/config/constants"
- 	"istio.io/istio/pkg/config/gateway"
- 	"istio.io/istio/pkg/config/host"
- 	"istio.io/istio/pkg/config/protocol"
-@@ -104,10 +106,15 @@
- 			// We can also have QUIC on a given port along with HTTPS/TLS on a given port. It does not
- 			// cause port-conflict as they use different transport protocols
- 			opts := &buildListenerOpts{
-				push:       builder.push,
-				proxy:      builder.node,
-				bind:       bind,
-				port:       &model.Port{Port: int(port.Number)},
-+				push:  builder.push,
-+				proxy: builder.node,
-+				bind:  bind,
-+				port: &model.Port{
-+					Port: int(port.Number),
-+					// Added by ingress
-+					Protocol: protocol.Parse(port.Protocol),
-+					// End added by ingress
-+				},
- 				bindToPort: true,
- 				class:      istionetworking.ListenerClassGateway,
- 				transport:  transport,
-@@ -340,6 +347,269 @@
- 	return nameToServiceMap
- }
- 
-+// Added by ingress
-+func (configgen *ConfigGeneratorImpl) BuildScopedRoutes(node *model.Proxy, push *model.PushContext) []*route.ScopedRouteConfiguration {
-+	if node.MergedGateway == nil {
-+		log.Warnf("buildScopedRoutes: no gateways for router %v", node.ID)
-+		return nil
-+	}
-+	merged := node.MergedGateway
-+	var out []*route.ScopedRouteConfiguration
-+	gatewayVirtualServices := make(map[string][]config.Config)
-+	serverIterator := func(listenerPort int, mergedServers map[model.ServerPort]*model.MergedServers) sets.Set {
-+		hostSet := sets.NewSet()
-+		for port, servers := range mergedServers {
-+			if port.Number != uint32(listenerPort) {
-+				continue
-+			}
-+			for _, server := range servers.Servers {
-+				gatewayName := merged.GatewayNameForServer[server]
-+
-+				var virtualServices []config.Config
-+				var exists bool
-+
-+				if virtualServices, exists = gatewayVirtualServices[gatewayName]; !exists {
-+					virtualServices = push.VirtualServicesForGateway(node, gatewayName)
-+					gatewayVirtualServices[gatewayName] = virtualServices
-+				}
-+				for _, virtualService := range virtualServices {
-+					for _, host := range virtualService.Spec.(*networking.VirtualService).Hosts {
-+						hostSet.Insert(host)
-+					}
-+				}
-+			}
-+		}
-+		return hostSet
-+	}
-+	buildPortHostScopedRoute := func(listenerPort model.ServerPort) {
-+		p := protocol.Parse(listenerPort.Protocol)
-+		if !p.IsHTTP() && p != protocol.HTTPS {
-+			return
-+		}
-+		port := strconv.Itoa(int(listenerPort.Number))
-+		hostSet := serverIterator(int(listenerPort.Number), merged.MergedServers).
-+			Union(serverIterator(int(listenerPort.Number), merged.MergedQUICTransportServers))
-+		for host, _ := range hostSet {
-+			portKey := &route.ScopedRouteConfiguration_Key_Fragment{
-+				Type: &route.ScopedRouteConfiguration_Key_Fragment_StringKey{
-+					StringKey: port,
-+				},
-+			}
-+			hostKey := &route.ScopedRouteConfiguration_Key_Fragment{
-+				Type: &route.ScopedRouteConfiguration_Key_Fragment_StringKey{
-+					StringKey: host,
-+				},
-+			}
-+			name := strings.Join([]string{port, host}, ".")
-+			out = append(out, &route.ScopedRouteConfiguration{
-+				OnDemand:               features.OnDemandRDS,
-+				Name:                   name,
-+				RouteConfigurationName: constants.HigressHostRDSNamePrefix + name,
-+				Key: &route.ScopedRouteConfiguration_Key{
-+					Fragments: []*route.ScopedRouteConfiguration_Key_Fragment{portKey, hostKey},
-+				},
-+			})
-+		}
-+	}
-+	for _, port := range merged.ServerPorts {
-+		buildPortHostScopedRoute(port)
-+	}
-+	return out
-+}
-+
-+type virtualServiceContext struct {
-+	virtualService config.Config
-+	server         *networking.Server
-+	gatewayName    string
-+}
-+
-+func (configgen *ConfigGeneratorImpl) buildHostRDSConfig(node *model.Proxy, push *model.PushContext,
-+	routeName string) *route.RouteConfiguration {
-+	var (
-+		hostRDSPort string
-+		hostRDSHost string
-+	)
-+	portAndHost := strings.SplitN(strings.TrimPrefix(routeName, constants.HigressHostRDSNamePrefix), ".", 2)
-+	if len(portAndHost) != 2 {
-+		log.Errorf("Invalid route %s when using Higress hostRDS", routeName)
-+		return nil
-+	}
-+	hostRDSPort = portAndHost[0]
-+	hostRDSHost = portAndHost[1]
-+	merged := node.MergedGateway
-+	log.Debugf("buildGatewayRoutes: gateways after merging: %v", merged)
-+	rdsPort, err := strconv.Atoi(hostRDSPort)
-+	if err != nil {
-+		log.Errorf("Invalid port %s of route %s when using Higress hostRDS", hostRDSPort, routeName)
-+		return nil
-+	}
-+	listenerPort := uint32(rdsPort)
-+	globalHTTPFilters := mseingress.ExtractGlobalHTTPFilters(node, push)
-+
-+	isH3DiscoveryNeeded := false
-+
-+	// When this is true, we add alt-svc header to the response to tell the client
-+	// that HTTP/3 over QUIC is available on the same port for this host. This is
-+	// very important for discovering HTTP/3 services
-+	for port, servers := range merged.MergedQUICTransportServers {
-+		if port.Number == listenerPort && len(servers.Servers) > 0 {
-+			isH3DiscoveryNeeded = true
-+			break
-+		}
-+	}
-+
-+	gatewayRoutes := make(map[string]map[string][]*route.Route)
-+	gatewayVirtualServices := make(map[string][]config.Config)
-+	var selectedVirtualServices []virtualServiceContext
-+	var vHost *route.VirtualHost
-+	serverIterator := func(mergedServers map[model.ServerPort]*model.MergedServers) {
-+		for port, servers := range mergedServers {
-+			if port.Number != listenerPort {
-+				continue
-+			}
-+			for _, server := range servers.Servers {
-+				gatewayName := merged.GatewayNameForServer[server]
-+
-+				var virtualServices []config.Config
-+				var exists bool
-+
-+				if virtualServices, exists = gatewayVirtualServices[gatewayName]; !exists {
-+					virtualServices = push.VirtualServicesForGateway(node, gatewayName)
-+					gatewayVirtualServices[gatewayName] = virtualServices
-+				}
-+				for _, virtualService := range virtualServices {
-+					hostMatch := false
-+					var selectHost string
-+					virtualServiceHosts := host.NewNames(virtualService.Spec.(*networking.VirtualService).Hosts)
-+					for _, hostname := range virtualServiceHosts {
-+						// exact match
-+						if hostname == host.Name(hostRDSHost) {
-+							hostMatch = true
-+							selectHost = hostRDSHost
-+							break
-+						}
-+						if features.HostRDSMergeSubset {
-+							// subset match
-+							if host.Name(hostRDSHost).SubsetOf(hostname) {
-+								hostMatch = true
-+								selectHost = string(hostname)
-+							}
-+						}
-+					}
-+					if !hostMatch {
-+						continue
-+					}
-+					copiedVS := virtualService.DeepCopy()
-+					copiedVS.Spec.(*networking.VirtualService).Hosts = []string{selectHost}
-+					selectedVirtualServices = append(selectedVirtualServices, virtualServiceContext{
-+						virtualService: copiedVS,
-+						server:         server,
-+						gatewayName:    gatewayName,
-+					})
-+				}
-+			}
-+		}
-+	}
-+	serverIterator(merged.MergedServers)
-+	serverIterator(merged.MergedQUICTransportServers)
-+	// Sort by subset
-+	// before: ["*.abc.com", "*.com", "www.abc.com"]
-+	// after: ["www.abc.com", "*.abc.com", "*.com"]
-+	sort.SliceStable(selectedVirtualServices, func(i, j int) bool {
-+		return host.Name(selectedVirtualServices[i].virtualService.Spec.(*networking.VirtualService).Hosts[0]).SubsetOf(
-+			host.Name(selectedVirtualServices[j].virtualService.Spec.(*networking.VirtualService).Hosts[0]))
-+	})
-+	port := int(listenerPort)
-+	for _, ctx := range selectedVirtualServices {
-+		virtualService := ctx.virtualService
-+		server := ctx.server
-+		gatewayName := ctx.gatewayName
-+		// Make sure we can obtain services which are visible to this virtualService as much as possible.
-+		nameToServiceMap := buildNameToServiceMapForHTTPRoutes(node, push, virtualService)
-+
-+		var routes []*route.Route
-+		var exists bool
-+		var err error
-+		if _, exists = gatewayRoutes[gatewayName]; !exists {
-+			gatewayRoutes[gatewayName] = make(map[string][]*route.Route)
-+		}
-+
-+		vskey := virtualService.Name + "/" + virtualService.Namespace
-+
-+		if routes, exists = gatewayRoutes[gatewayName][vskey]; !exists {
-+			hashByDestination := istio_route.GetConsistentHashForVirtualService(push, node, virtualService, nameToServiceMap)
-+			routes, err = istio_route.BuildHTTPRoutesForVirtualServiceWithHTTPFilters(node, virtualService, nameToServiceMap,
-+				hashByDestination, port, map[string]bool{gatewayName: true}, isH3DiscoveryNeeded, push.Mesh, globalHTTPFilters)
-+			if err != nil {
-+				log.Debugf("%s omitting routes for virtual service %v/%v due to error: %v", node.ID, virtualService.Namespace, virtualService.Name, err)
-+				continue
-+			}
-+			gatewayRoutes[gatewayName][vskey] = routes
-+		}
-+
-+		if vHost != nil {
-+			vHost.Routes = append(vHost.Routes, routes...)
-+			if server.Tls != nil && server.Tls.HttpsRedirect {
-+				vHost.RequireTls = route.VirtualHost_ALL
-+			}
-+		} else {
-+			vHost = &route.VirtualHost{
-+				Name:                       util.DomainName(hostRDSHost, port),
-+				Domains:                    buildGatewayVirtualHostDomains(hostRDSHost, port),
-+				Routes:                     routes,
-+				IncludeRequestAttemptCount: true,
-+				TypedPerFilterConfig:       mseingress.ConstructTypedPerFilterConfigForVHost(globalHTTPFilters, virtualService),
-+			}
-+			if server.Tls != nil && server.Tls.HttpsRedirect {
-+				vHost.RequireTls = route.VirtualHost_ALL
-+			}
-+		}
-+
-+		// check all hostname if is not exist with HttpsRedirect set to true
-+		// create VirtualHost to redirect
-+		for _, hostname := range server.Hosts {
-+			if !server.GetTls().GetHttpsRedirect() {
-+				continue
-+			}
-+			if vHost != nil && host.Name(hostname) == host.Name(hostRDSHost) {
-+				vHost.RequireTls = route.VirtualHost_ALL
-+				continue
-+			}
-+			vHost = &route.VirtualHost{
-+				Name:                       util.DomainName(hostname, port),
-+				Domains:                    buildGatewayVirtualHostDomains(hostname, port),
-+				IncludeRequestAttemptCount: true,
-+				RequireTls:                 route.VirtualHost_ALL,
-+			}
-+		}
-+
-+	}
-+	var virtualHosts []*route.VirtualHost
-+	if vHost == nil {
-+		log.Warnf("constructed http route config for route %s on port %d with no vhosts; Setting up a default 404 vhost", routeName, port)
-+		virtualHosts = []*route.VirtualHost{{
-+			Name:    util.DomainName("blackhole", port),
-+			Domains: []string{"*"},
-+			// Empty route list will cause Envoy to 404 NR any requests
-+			Routes: []*route.Route{},
-+		}}
-+	} else {
-+		vHost.Routes = istio_route.CombineVHostRoutes(vHost.Routes)
-+		virtualHosts = append(virtualHosts, vHost)
-+	}
-+
-+	routeCfg := &route.RouteConfiguration{
-+		// Retain the routeName as its used by EnvoyFilter patching logic
-+		Name:             routeName,
-+		VirtualHosts:     virtualHosts,
-+		ValidateClusters: proto.BoolFalse,
-+	}
-+
-+	return routeCfg
-+}
-+
-+// End added by ingress
-+
- func (configgen *ConfigGeneratorImpl) buildGatewayHTTPRouteConfig(node *model.Proxy, push *model.PushContext,
- 	routeName string) *route.RouteConfiguration {
- 	if node.MergedGateway == nil {
-@@ -351,6 +621,12 @@
- 		}
- 	}
- 
-+	// Added by ingress
-+	if strings.HasPrefix(routeName, constants.HigressHostRDSNamePrefix) {
-+		return configgen.buildHostRDSConfig(node, push, routeName)
-+	}
-+	// End added by ingress
-+
- 	merged := node.MergedGateway
- 	log.Debugf("buildGatewayRoutes: gateways after merging: %v", merged)
- 
-@@ -670,7 +946,9 @@
- // TLS mode      | Mesh-wide SDS | Ingress SDS | Resulting Configuration
- // SIMPLE/MUTUAL |    ENABLED    |   ENABLED   | support SDS at ingress gateway to terminate SSL communication outside the mesh
- // ISTIO_MUTUAL  |    ENABLED    |   DISABLED  | support SDS at gateway to terminate workload mTLS, with internal workloads
-// 											   | for egress or with another trusted cluster for ingress)
-+//
-+//	| for egress or with another trusted cluster for ingress)
-+//
- // ISTIO_MUTUAL  |    DISABLED   |   DISABLED  | use file-mounted secret paths to terminate workload mTLS from gateway
- //
- // Note that ISTIO_MUTUAL TLS mode and ingressSds should not be used simultaneously on the same ingress gateway.
-diff -Naur istio/pilot/pkg/networking/core/v1alpha3/listener.go istio-new/pilot/pkg/networking/core/v1alpha3/listener.go
--- istio/pilot/pkg/networking/core/v1alpha3/listener.go	2024-01-05 17:58:07.000000000 +0800
-+++ istio-new/pilot/pkg/networking/core/v1alpha3/listener.go	2024-01-05 17:31:10.000000000 +0800
-@@ -1279,8 +1279,48 @@
- 
- 	notimeout := durationpb.New(0 * time.Second)
- 	connectionManager.StreamIdleTimeout = notimeout
-
-	if httpOpts.rds != "" {
-+	// Added by ingress
-+	enableSRDS := false
-+	if features.EnableScopedRDS &&
-+		(listenerOpts.port.Protocol.IsHTTP() || (listenerOpts.port.Protocol == protocol.HTTPS)) {
-+		enableSRDS = true
-+		portFragment := &hcm.ScopedRoutes_ScopeKeyBuilder_FragmentBuilder{
-+			Type: &hcm.ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor_{
-+				LocalPortValueExtractor: &hcm.ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor{},
-+			}}
-+		hostFragment := &hcm.ScopedRoutes_ScopeKeyBuilder_FragmentBuilder{
-+			Type: &hcm.ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor_{
-+				HostValueExtractor: &hcm.ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor{},
-+			}}
-+		scopedRoutes := &hcm.HttpConnectionManager_ScopedRoutes{
-+			ScopedRoutes: &hcm.ScopedRoutes{
-+				Name: constants.DefaultScopedRouteName,
-+				ScopeKeyBuilder: &hcm.ScopedRoutes_ScopeKeyBuilder{
-+					Fragments: []*hcm.ScopedRoutes_ScopeKeyBuilder_FragmentBuilder{portFragment, hostFragment},
-+				},
-+				RdsConfigSource: &core.ConfigSource{
-+					ConfigSourceSpecifier: &core.ConfigSource_Ads{
-+						Ads: &core.AggregatedConfigSource{},
-+					},
-+					InitialFetchTimeout: durationpb.New(0),
-+					ResourceApiVersion:  core.ApiVersion_V3,
-+				},
-+				ConfigSpecifier: &hcm.ScopedRoutes_ScopedRds{
-+					ScopedRds: &hcm.ScopedRds{
-+						ScopedRdsConfigSource: &core.ConfigSource{
-+							ConfigSourceSpecifier: &core.ConfigSource_Ads{
-+								Ads: &core.AggregatedConfigSource{},
-+							},
-+							InitialFetchTimeout: durationpb.New(0),
-+							ResourceApiVersion:  core.ApiVersion_V3,
-+						},
-+					},
-+				},
-+			},
-+		}
-+		connectionManager.RouteSpecifier = scopedRoutes
-+	} else if httpOpts.rds != "" {
-+		// End added by ingress
- 		rds := &hcm.HttpConnectionManager_Rds{
- 			Rds: &hcm.Rds{
- 				ConfigSource: &core.ConfigSource{
-@@ -1304,8 +1344,15 @@
- 
- 	filters := make([]*hcm.HttpFilter, len(httpFilters))
- 	copy(filters, httpFilters)
-	// Make sure cors filter always in the first.
-	filters = append([]*hcm.HttpFilter{xdsfilters.Cors}, filters...)
-+	// Added by ingress
-+	// Now only support onDemandRDS when enable SRDS
-+	if features.OnDemandRDS && enableSRDS {
-+		filters = append([]*hcm.HttpFilter{xdsfilters.OnDemand, xdsfilters.Cors}, filters...)
-+	} else {
-+		// End added by ingress
-+		// Make sure cors filter always in the first.
-+		filters = append([]*hcm.HttpFilter{xdsfilters.Cors}, filters...)
-+	}
- 
- 	if features.MetadataExchange {
- 		filters = append(filters, xdsfilters.HTTPMx)
-diff -Naur istio/pilot/pkg/xds/ads.go istio-new/pilot/pkg/xds/ads.go
--- istio/pilot/pkg/xds/ads.go	2024-01-05 17:58:08.000000000 +0800
-+++ istio-new/pilot/pkg/xds/ads.go	2024-01-05 17:31:44.000000000 +0800
-@@ -797,15 +797,18 @@
- 
- // PushOrder defines the order that updates will be pushed in. Any types not listed here will be pushed in random
- // order after the types listed here
-var PushOrder = []string{v3.ClusterType, v3.EndpointType, v3.ListenerType, v3.RouteType, v3.SecretType}
-+var PushOrder = []string{v3.ClusterType, v3.EndpointType, v3.ListenerType, v3.ScopedRouteType, v3.RouteType, v3.SecretType}
- 
- // KnownOrderedTypeUrls has typeUrls for which we know the order of push.
- var KnownOrderedTypeUrls = map[string]struct{}{
- 	v3.ClusterType:  {},
- 	v3.EndpointType: {},
- 	v3.ListenerType: {},
-	v3.RouteType:    {},
-	v3.SecretType:   {},
-+	// Added by ingress
-+	v3.ScopedRouteType: {},
-+	// End added by ingress
-+	v3.RouteType:  {},
-+	v3.SecretType: {},
- }
- 
- // orderWatchedResources orders the resources in accordance with known push order.
-diff -Naur istio/pilot/pkg/xds/discovery.go istio-new/pilot/pkg/xds/discovery.go
--- istio/pilot/pkg/xds/discovery.go	2024-01-05 17:58:07.000000000 +0800
-+++ istio-new/pilot/pkg/xds/discovery.go	2024-01-04 21:20:00.000000000 +0800
-@@ -589,6 +589,9 @@
- 	s.Generators[v3.ClusterType] = &CdsGenerator{Server: s}
- 	s.Generators[v3.ListenerType] = &LdsGenerator{Server: s}
- 	s.Generators[v3.RouteType] = &RdsGenerator{Server: s}
-+	// Added by ingress
-+	s.Generators[v3.ScopedRouteType] = &SrdsGenerator{Server: s}
-+	// End added by ingress
- 	s.Generators[v3.EndpointType] = edsGen
- 	s.Generators[v3.NameTableType] = &NdsGenerator{Server: s}
- 	s.Generators[v3.ExtensionConfigurationType] = &EcdsGenerator{Server: s}
-diff -Naur istio/pilot/pkg/xds/filters/filters.go istio-new/pilot/pkg/xds/filters/filters.go
--- istio/pilot/pkg/xds/filters/filters.go	2024-01-05 17:58:03.000000000 +0800
-+++ istio-new/pilot/pkg/xds/filters/filters.go	2024-01-04 21:20:00.000000000 +0800
-@@ -21,6 +21,7 @@
- 	fault "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/fault/v3"
- 	grpcstats "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/grpc_stats/v3"
- 	grpcweb "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/grpc_web/v3"
-+	ondemand "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/on_demand/v3"
- 	router "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/router/v3"
- 	httpwasm "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/wasm/v3"
- 	httpinspector "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/listener/http_inspector/v3"
-@@ -54,6 +55,14 @@
- // Define static filters to be reused across the codebase. This avoids duplicate marshaling/unmarshaling
- // This should not be used for filters that will be mutated
- var (
-+	// Added by ingress
-+	OnDemand = &hcm.HttpFilter{
-+		Name: "envoy.filters.http.on_demand.v3.OnDemand",
-+		ConfigType: &hcm.HttpFilter_TypedConfig{
-+			TypedConfig: util.MessageToAny(&ondemand.OnDemand{}),
-+		},
-+	}
-+	// End added by ingress
- 	Cors = &hcm.HttpFilter{
- 		Name: wellknown.CORS,
- 		ConfigType: &hcm.HttpFilter_TypedConfig{
-diff -Naur istio/pilot/pkg/xds/srds.go istio-new/pilot/pkg/xds/srds.go
--- istio/pilot/pkg/xds/srds.go	1970-01-01 08:00:00.000000000 +0800
-+++ istio-new/pilot/pkg/xds/srds.go	2024-01-05 13:45:49.000000000 +0800
-@@ -0,0 +1,79 @@
-+// Copyright Istio Authors
-+//
-+// Licensed under the Apache License, Version 2.0 (the "License");
-+// you may not use this file except in compliance with the License.
-+// You may obtain a copy of the License at
-+//
-+//     http://www.apache.org/licenses/LICENSE-2.0
-+//
-+// Unless required by applicable law or agreed to in writing, software
-+// distributed under the License is distributed on an "AS IS" BASIS,
-+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-+// See the License for the specific language governing permissions and
-+// limitations under the License.
-+
-+package xds
-+
-+import (
-+	discovery "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
-+	"istio.io/istio/pilot/pkg/features"
-+	"istio.io/istio/pilot/pkg/model"
-+	"istio.io/istio/pilot/pkg/networking/util"
-+	"istio.io/istio/pkg/config"
-+	"istio.io/istio/pkg/config/schema/gvk"
-+)
-+
-+type SrdsGenerator struct {
-+	Server *DiscoveryServer
-+}
-+
-+var _ model.XdsResourceGenerator = &SrdsGenerator{}
-+
-+// Map of all configs that do not impact SRDS
-+var skippedSrdsConfigs = map[config.GroupVersionKind]struct{}{
-+	gvk.WorkloadEntry:         {},
-+	gvk.WorkloadGroup:         {},
-+	gvk.RequestAuthentication: {},
-+	gvk.PeerAuthentication:    {},
-+	gvk.Secret:                {},
-+}
-+
-+func srdsNeedsPush(req *model.PushRequest) bool {
-+	if !features.EnableScopedRDS {
-+		return false
-+	}
-+	if req == nil {
-+		return true
-+	}
-+	if !req.Full {
-+		// SRDS only handles full push
-+		return false
-+	}
-+	// If none set, we will always push
-+	if len(req.ConfigsUpdated) == 0 {
-+		return true
-+	}
-+	for config := range req.ConfigsUpdated {
-+		if _, f := skippedSrdsConfigs[config.Kind]; !f {
-+			return true
-+		}
-+	}
-+	return false
-+}
-+
-+func (s SrdsGenerator) Generate(proxy *model.Proxy, push *model.PushContext, w *model.WatchedResource,
-+	req *model.PushRequest) (model.Resources, model.XdsLogDetails, error) {
-+	if !srdsNeedsPush(req) {
-+		return nil, model.DefaultXdsLogDetails, nil
-+	}
-+
-+	scopedRoutes := s.Server.ConfigGenerator.BuildScopedRoutes(proxy, push)
-+	resources := model.Resources{}
-+	for _, sr := range scopedRoutes {
-+		resources = append(resources, &discovery.Resource{
-+			Name:     sr.Name,
-+			Resource: util.MessageToAny(sr),
-+		})
-+	}
-+	return resources, model.DefaultXdsLogDetails, nil
-+}
-diff -Naur istio/pilot/pkg/xds/v3/model.go istio-new/pilot/pkg/xds/v3/model.go
--- istio/pilot/pkg/xds/v3/model.go	2024-01-05 17:58:03.000000000 +0800
-+++ istio-new/pilot/pkg/xds/v3/model.go	2024-01-05 16:55:49.000000000 +0800
-@@ -31,6 +31,10 @@
- 	SecretType                 = resource.SecretType
- 	ExtensionConfigurationType = resource.ExtensionConfigType
- 
-+	// Added by ingress
-+	ScopedRouteType = apiTypePrefix + "envoy.config.route.v3.ScopedRouteConfiguration"
-+	// End added by ingress
-+
- 	NameTableType   = apiTypePrefix + "istio.networking.nds.v1.NameTable"
- 	HealthInfoType  = apiTypePrefix + "istio.v1.HealthInformation"
- 	ProxyConfigType = apiTypePrefix + "istio.mesh.v1alpha1.ProxyConfig"
-@@ -61,6 +65,10 @@
- 		return "PCDS"
- 	case ExtensionConfigurationType:
- 		return "ECDS"
-+	// Added by ingress
-+	case ScopedRouteType:
-+		return "SRDS"
-+	// End added by ingress
- 	default:
- 		return typeURL
- 	}
-@@ -87,6 +95,10 @@
- 		return "ecds"
- 	case BootstrapType:
- 		return "bds"
-+	// Added by ingress
-+	case ScopedRouteType:
-+		return "srds"
-+	// End added by ingress
- 	default:
- 		return typeURL
- 	}
-diff -Naur istio/pkg/config/constants/constants.go istio-new/pkg/config/constants/constants.go
--- istio/pkg/config/constants/constants.go	2024-01-05 17:58:08.000000000 +0800
-+++ istio-new/pkg/config/constants/constants.go	2024-01-04 21:20:00.000000000 +0800
-@@ -143,4 +143,9 @@
- 	// CertProviderNone does not create any certificates for the control plane. It is assumed that some external
- 	// load balancer, such as an Istio Gateway, is terminating the TLS.
- 	CertProviderNone = "none"
-+
-+	// Added by ingress
-+	HigressHostRDSNamePrefix = "higress-rds-"
-+	DefaultScopedRouteName   = "scoped-route"
-+	// End added by ingress
- )
--- a/istio/1.12/patches/istio/20240115-optimize-rds-cache.patch
+++ b/istio/1.12/patches/istio/20240115-optimize-rds-cache.patch
@@ -1,373 +0,0 @@
-diff -Naur istio/pilot/pkg/model/push_context.go istio-new/pilot/pkg/model/push_context.go
--- istio/pilot/pkg/model/push_context.go	2024-01-15 20:46:45.000000000 +0800
-+++ istio-new/pilot/pkg/model/push_context.go	2024-01-15 19:20:45.000000000 +0800
-@@ -96,6 +96,9 @@
- 	publicByGateway map[string][]config.Config
- 	// root vs namespace/name ->delegate vs virtualservice gvk/namespace/name
- 	delegates map[ConfigKey][]ConfigKey
-+	// Added by ingress
-+	byHost map[string][]config.Config
-+	// End added by ingress
- }
- 
- func newVirtualServiceIndex() virtualServiceIndex {
-@@ -104,6 +107,9 @@
- 		privateByNamespaceAndGateway: map[string]map[string][]config.Config{},
- 		exportedToNamespaceByGateway: map[string]map[string][]config.Config{},
- 		delegates:                    map[ConfigKey][]ConfigKey{},
-+		// Added by ingress
-+		byHost: map[string][]config.Config{},
-+		// End added by ingress
- 	}
- }
- 
-@@ -857,6 +863,13 @@
- 	return res
- }
- 
-+// Added by ingress
-+func (ps *PushContext) VirtualServicesForHost(proxy *Proxy, host string) []config.Config {
-+	return ps.virtualServiceIndex.byHost[host]
-+}
-+
-+// End added by ingress
-+
- // DelegateVirtualServicesConfigKey lists all the delegate virtual services configkeys associated with the provided virtual services
- func (ps *PushContext) DelegateVirtualServicesConfigKey(vses []config.Config) []ConfigKey {
- 	var out []ConfigKey
-@@ -1468,6 +1481,11 @@
- 	for _, virtualService := range vservices {
- 		ns := virtualService.Namespace
- 		rule := virtualService.Spec.(*networking.VirtualService)
-+		// Added by ingress
-+		for _, host := range rule.Hosts {
-+			ps.virtualServiceIndex.byHost[host] = append(ps.virtualServiceIndex.byHost[host], virtualService)
-+		}
-+		// End added by ingress
- 		gwNames := getGatewayNames(rule)
- 		if len(rule.ExportTo) == 0 {
- 			// No exportTo in virtualService. Use the global default
-diff -Naur istio/pilot/pkg/networking/core/v1alpha3/gateway.go istio-new/pilot/pkg/networking/core/v1alpha3/gateway.go
--- istio/pilot/pkg/networking/core/v1alpha3/gateway.go	2024-01-15 20:46:45.000000000 +0800
-+++ istio-new/pilot/pkg/networking/core/v1alpha3/gateway.go	2024-01-15 20:04:05.000000000 +0800
-@@ -28,6 +28,7 @@
- 	route "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
- 	hcm "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
- 	tls "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
-+	discovery "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
- 	"github.com/hashicorp/go-multierror"
- 
- 	meshconfig "istio.io/api/mesh/v1alpha1"
-@@ -35,6 +36,7 @@
- 	"istio.io/istio/pilot/pkg/features"
- 	"istio.io/istio/pilot/pkg/model"
- 	istionetworking "istio.io/istio/pilot/pkg/networking"
-+	"istio.io/istio/pilot/pkg/networking/core/v1alpha3/envoyfilter"
- 	"istio.io/istio/pilot/pkg/networking/core/v1alpha3/extension"
- 	"istio.io/istio/pilot/pkg/networking/core/v1alpha3/mseingress"
- 	istio_route "istio.io/istio/pilot/pkg/networking/core/v1alpha3/route"
-@@ -423,8 +425,15 @@
- 	gatewayName    string
- }
- 
-func (configgen *ConfigGeneratorImpl) buildHostRDSConfig(node *model.Proxy, push *model.PushContext,
-	routeName string) *route.RouteConfiguration {
-+func (configgen *ConfigGeneratorImpl) buildHostRDSConfig(
-+	node *model.Proxy,
-+	req *model.PushRequest,
-+	routeName string,
-+	vsCache map[int][]virtualServiceContext,
-+	efw *model.EnvoyFilterWrapper,
-+	efKeys []string,
-+) (*discovery.Resource, bool) {
-+	push := req.Push
- 	var (
- 		hostRDSPort string
- 		hostRDSHost string
-@@ -432,7 +441,7 @@
- 	portAndHost := strings.SplitN(strings.TrimPrefix(routeName, constants.HigressHostRDSNamePrefix), ".", 2)
- 	if len(portAndHost) != 2 {
- 		log.Errorf("Invalid route %s when using Higress hostRDS", routeName)
-		return nil
-+		return nil, false
- 	}
- 	hostRDSPort = portAndHost[0]
- 	hostRDSHost = portAndHost[1]
-@@ -441,10 +450,24 @@
- 	rdsPort, err := strconv.Atoi(hostRDSPort)
- 	if err != nil {
- 		log.Errorf("Invalid port %s of route %s when using Higress hostRDS", hostRDSPort, routeName)
-		return nil
-+		return nil, false
-+	}
-+
-+	routeCache := &istio_route.Cache{
-+		RouteName:    routeName,
-+		ProxyVersion: node.Metadata.IstioVersion,
-+		ListenerPort: rdsPort,
-+		// Use same host vs to cache, although the cache can be cleared when the port is different, this can be accepted
-+		VirtualServices: push.VirtualServicesForHost(node, hostRDSHost),
-+		EnvoyFilterKeys: efKeys,
-+	}
-+
-+	resource, exist := configgen.Cache.Get(routeCache)
-+	if exist {
-+		return resource, true
- 	}
-+
- 	listenerPort := uint32(rdsPort)
-	globalHTTPFilters := mseingress.ExtractGlobalHTTPFilters(node, push)
- 
- 	isH3DiscoveryNeeded := false
- 
-@@ -457,9 +480,9 @@
- 			break
- 		}
- 	}
-
- 	gatewayRoutes := make(map[string]map[string][]*route.Route)
- 	gatewayVirtualServices := make(map[string][]config.Config)
-+	var listenerVirtualServices []virtualServiceContext
- 	var selectedVirtualServices []virtualServiceContext
- 	var vHost *route.VirtualHost
- 	serverIterator := func(mergedServers map[model.ServerPort]*model.MergedServers) {
-@@ -478,31 +501,8 @@
- 					gatewayVirtualServices[gatewayName] = virtualServices
- 				}
- 				for _, virtualService := range virtualServices {
-					hostMatch := false
-					var selectHost string
-					virtualServiceHosts := host.NewNames(virtualService.Spec.(*networking.VirtualService).Hosts)
-					for _, hostname := range virtualServiceHosts {
-						// exact match
-						if hostname == host.Name(hostRDSHost) {
-							hostMatch = true
-							selectHost = hostRDSHost
-							break
-						}
-						if features.HostRDSMergeSubset {
-							// subset match
-							if host.Name(hostRDSHost).SubsetOf(hostname) {
-								hostMatch = true
-								selectHost = string(hostname)
-							}
-						}
-					}
-					if !hostMatch {
-						continue
-					}
-					copiedVS := virtualService.DeepCopy()
-					copiedVS.Spec.(*networking.VirtualService).Hosts = []string{selectHost}
-					selectedVirtualServices = append(selectedVirtualServices, virtualServiceContext{
-						virtualService: copiedVS,
-+					listenerVirtualServices = append(listenerVirtualServices, virtualServiceContext{
-+						virtualService: virtualService,
- 						server:         server,
- 						gatewayName:    gatewayName,
- 					})
-@@ -510,15 +510,63 @@
- 			}
- 		}
- 	}
-	serverIterator(merged.MergedServers)
-	serverIterator(merged.MergedQUICTransportServers)
-	// Sort by subset
-	// before: ["*.abc.com", "*.com", "www.abc.com"]
-	// after: ["www.abc.com", "*.abc.com", "*.com"]
-	sort.SliceStable(selectedVirtualServices, func(i, j int) bool {
-		return host.Name(selectedVirtualServices[i].virtualService.Spec.(*networking.VirtualService).Hosts[0]).SubsetOf(
-			host.Name(selectedVirtualServices[j].virtualService.Spec.(*networking.VirtualService).Hosts[0]))
-	})
-+	var vsExists bool
-+	if listenerVirtualServices, vsExists = vsCache[rdsPort]; !vsExists {
-+		serverIterator(merged.MergedServers)
-+		serverIterator(merged.MergedQUICTransportServers)
-+		vsCache[rdsPort] = listenerVirtualServices
-+	}
-+	for _, vsCtx := range listenerVirtualServices {
-+		virtualService := vsCtx.virtualService
-+		hostMatch := false
-+		var selectHost string
-+		for _, hostname := range virtualService.Spec.(*networking.VirtualService).Hosts {
-+			// exact match
-+			if hostname == hostRDSHost {
-+				hostMatch = true
-+				selectHost = hostRDSHost
-+				break
-+			}
-+			if features.HostRDSMergeSubset {
-+				// subset match
-+				if host.Name(hostRDSHost).SubsetOf(host.Name(hostname)) {
-+					hostMatch = true
-+					selectHost = hostname
-+				}
-+			}
-+		}
-+		if !hostMatch {
-+			continue
-+		}
-+		if len(virtualService.Spec.(*networking.VirtualService).Hosts) > 1 {
-+			copiedVS := &networking.VirtualService{}
-+			copiedVS = virtualService.Spec.(*networking.VirtualService)
-+			copiedVS.Hosts = []string{selectHost}
-+			selectedVirtualServices = append(selectedVirtualServices, virtualServiceContext{
-+				virtualService: config.Config{
-+					Meta:   virtualService.Meta,
-+					Spec:   copiedVS,
-+					Status: virtualService.Status,
-+				},
-+				server:      vsCtx.server,
-+				gatewayName: vsCtx.gatewayName,
-+			})
-+		} else {
-+			selectedVirtualServices = append(selectedVirtualServices, vsCtx)
-+		}
-+	}
-+	if features.HostRDSMergeSubset {
-+		// Sort by subset
-+		// before: ["*.abc.com", "*.com", "www.abc.com"]
-+		// after: ["www.abc.com", "*.abc.com", "*.com"]
-+		sort.SliceStable(selectedVirtualServices, func(i, j int) bool {
-+			return host.Name(selectedVirtualServices[i].virtualService.Spec.(*networking.VirtualService).Hosts[0]).SubsetOf(
-+				host.Name(selectedVirtualServices[j].virtualService.Spec.(*networking.VirtualService).Hosts[0]))
-+		})
-+	}
-+
-+	globalHTTPFilters := mseingress.ExtractGlobalHTTPFilters(node, push)
-+
- 	port := int(listenerPort)
- 	for _, ctx := range selectedVirtualServices {
- 		virtualService := ctx.virtualService
-@@ -605,25 +653,42 @@
- 		ValidateClusters: proto.BoolFalse,
- 	}
- 
-	return routeCfg
-+	routeCfg = envoyfilter.ApplyRouteConfigurationPatches(networking.EnvoyFilter_GATEWAY, node, efw, routeCfg)
-+	resource = &discovery.Resource{
-+		Name:     routeName,
-+		Resource: util.MessageToAny(routeCfg),
-+	}
-+
-+	if features.EnableRDSCaching {
-+		configgen.Cache.Add(routeCache, req, resource)
-+	}
-+
-+	return resource, false
- }
- 
- // End added by ingress
- 
-func (configgen *ConfigGeneratorImpl) buildGatewayHTTPRouteConfig(node *model.Proxy, push *model.PushContext,
-	routeName string) *route.RouteConfiguration {
-+// Modifed by ingress
-+func (configgen *ConfigGeneratorImpl) buildGatewayHTTPRouteConfig(
-+	node *model.Proxy,
-+	req *model.PushRequest,
-+	routeName string,
-+	vsCache map[int][]virtualServiceContext,
-+	efw *model.EnvoyFilterWrapper,
-+	efKeys []string,
-+) (*discovery.Resource, bool) {
- 	if node.MergedGateway == nil {
- 		log.Warnf("buildGatewayRoutes: no gateways for router %v", node.ID)
-		return &route.RouteConfiguration{
-			Name:             routeName,
-			VirtualHosts:     []*route.VirtualHost{},
-			ValidateClusters: proto.BoolFalse,
-		}
-+		return nil, false
- 	}
-
- 	// Added by ingress
-+	push := req.Push
- 	if strings.HasPrefix(routeName, constants.HigressHostRDSNamePrefix) {
-		return configgen.buildHostRDSConfig(node, push, routeName)
-+		resource, cacheHit := configgen.buildHostRDSConfig(node, req, routeName, vsCache, efw, efKeys)
-+		if resource == nil {
-+			return nil, false
-+		}
-+		return resource, cacheHit
- 	}
- 	// End added by ingress
- 
-@@ -636,7 +701,7 @@
- 
- 		// This can happen when a gateway has recently been deleted. Envoy will still request route
- 		// information due to the draining of listeners, so we should not return an error.
-		return nil
-+		return nil, false
- 	}
- 
- 	servers := merged.ServersByRouteName[routeName]
-@@ -768,9 +833,16 @@
- 		ValidateClusters: proto.BoolFalse,
- 	}
- 
-	return routeCfg
-+	routeCfg = envoyfilter.ApplyRouteConfigurationPatches(networking.EnvoyFilter_GATEWAY, node, efw, routeCfg)
-+	resource := &discovery.Resource{
-+		Name:     routeName,
-+		Resource: util.MessageToAny(routeCfg),
-+	}
-+	return resource, false
- }
- 
-+// End modified by ingress
-+
- // hashRouteList returns a hash of a list of pointers
- func hashRouteList(r []*route.Route) uint64 {
- 	hash := md5.New()
-diff -Naur istio/pilot/pkg/networking/core/v1alpha3/httproute.go istio-new/pilot/pkg/networking/core/v1alpha3/httproute.go
--- istio/pilot/pkg/networking/core/v1alpha3/httproute.go	2024-01-15 20:46:41.000000000 +0800
-+++ istio-new/pilot/pkg/networking/core/v1alpha3/httproute.go	2024-01-15 10:29:09.000000000 +0800
-@@ -78,17 +78,30 @@
- 			routeConfigurations = append(routeConfigurations, rc)
- 		}
- 	case model.Router:
-+		// Modified by ingress
-+		vsCache := make(map[int][]virtualServiceContext)
-+		envoyfilterKeys := efw.Keys()
- 		for _, routeName := range routeNames {
-			rc := configgen.buildGatewayHTTPRouteConfig(node, req.Push, routeName)
-			if rc != nil {
-				rc = envoyfilter.ApplyRouteConfigurationPatches(networking.EnvoyFilter_GATEWAY, node, efw, rc)
-				resource := &discovery.Resource{
-+			rc, cached := configgen.buildGatewayHTTPRouteConfig(node, req, routeName, vsCache, efw, envoyfilterKeys)
-+			if cached && !features.EnableUnsafeAssertions {
-+				hit++
-+			} else {
-+				miss++
-+			}
-+			if rc == nil {
-+				emptyRoute := &route.RouteConfiguration{
-+					Name:             routeName,
-+					VirtualHosts:     []*route.VirtualHost{},
-+					ValidateClusters: proto.BoolFalse,
-+				}
-+				rc = &discovery.Resource{
- 					Name:     routeName,
-					Resource: util.MessageToAny(rc),
-+					Resource: util.MessageToAny(emptyRoute),
- 				}
-				routeConfigurations = append(routeConfigurations, resource)
- 			}
-+			routeConfigurations = append(routeConfigurations, rc)
- 		}
-+		// End modified by ingress
- 	}
- 	if !features.EnableRDSCaching {
- 		return routeConfigurations, model.DefaultXdsLogDetails
-diff -Naur istio/pilot/pkg/xds/discovery.go istio-new/pilot/pkg/xds/discovery.go
--- istio/pilot/pkg/xds/discovery.go	2024-01-15 20:46:45.000000000 +0800
-+++ istio-new/pilot/pkg/xds/discovery.go	2024-01-12 19:56:02.000000000 +0800
-@@ -392,6 +392,9 @@
- // ConfigUpdate implements ConfigUpdater interface, used to request pushes.
- // It replaces the 'clear cache' from v1.
- func (s *DiscoveryServer) ConfigUpdate(req *model.PushRequest) {
-+	if req.Full {
-+		log.Infof("full push happen, reason:%v", req.Reason)
-+	}
- 	inboundConfigUpdates.Increment()
- 	s.InboundUpdates.Inc()
- 	s.pushChannel <- req
--- a/istio/1.12/patches/istio/20240201-optimize-default-arg.patch
+++ b/istio/1.12/patches/istio/20240201-optimize-default-arg.patch
@@ -1,60 +0,0 @@
-diff -Naur istio/pilot/cmd/pilot-agent/status/util/stats.go istio-new/pilot/cmd/pilot-agent/status/util/stats.go
--- istio/pilot/cmd/pilot-agent/status/util/stats.go	2024-02-01 10:20:13.000000000 +0800
-+++ istio-new/pilot/cmd/pilot-agent/status/util/stats.go	2024-01-31 22:44:53.000000000 +0800
-@@ -73,7 +73,7 @@
- 		localHostAddr = "localhost"
- 	}
- 
-	readinessURL := fmt.Sprintf("http://%s:%d/stats?usedonly&filter=%s", localHostAddr, adminPort, readyStatsRegex)
-+	readinessURL := fmt.Sprintf("http://%s:%d/stats?usedonly", localHostAddr, adminPort)
- 	stats, err := http.DoHTTPGetWithTimeout(readinessURL, readinessTimeout)
- 	if err != nil {
- 		return nil, false, err
-@@ -105,7 +105,7 @@
- 		localHostAddr = "localhost"
- 	}
- 
-	stats, err := http.DoHTTPGet(fmt.Sprintf("http://%s:%d/stats?usedonly&filter=%s", localHostAddr, adminPort, updateStatsRegex))
-+	stats, err := http.DoHTTPGet(fmt.Sprintf("http://%s:%d/stats?usedonly", localHostAddr, adminPort))
- 	if err != nil {
- 		return nil, err
- 	}
-diff -Naur istio/pilot/pkg/features/pilot.go istio-new/pilot/pkg/features/pilot.go
--- istio/pilot/pkg/features/pilot.go	2024-02-01 10:20:17.000000000 +0800
-+++ istio-new/pilot/pkg/features/pilot.go	2024-02-01 10:16:18.000000000 +0800
-@@ -575,6 +575,8 @@
- 		"If enabled, each host in virtualservice will have an independent RDS, which is used with SRDS").Get()
- 	OnDemandRDS = env.RegisterBoolVar("ON_DEMAND_RDS", false,
- 		"If enabled, the on demand filter will be added to the HCM filters").Get()
-+	DefaultUpstreamConcurrencyThreshold = env.RegisterIntVar("DEFAULT_UPSTREAM_CONCURRENCY_THRESHOLD", 1000000,
-+		"The default threshold of max_requests/max_pending_requests/max_connections of circuit breaker").Get()
- 	// End added by ingress
- )
- 
-diff -Naur istio/pilot/pkg/networking/core/v1alpha3/cluster.go istio-new/pilot/pkg/networking/core/v1alpha3/cluster.go
--- istio/pilot/pkg/networking/core/v1alpha3/cluster.go	2024-02-01 10:20:17.000000000 +0800
-+++ istio-new/pilot/pkg/networking/core/v1alpha3/cluster.go	2024-02-01 10:16:05.000000000 +0800
-@@ -61,6 +61,7 @@
- 
- // getDefaultCircuitBreakerThresholds returns a copy of the default circuit breaker thresholds for the given traffic direction.
- func getDefaultCircuitBreakerThresholds() *cluster.CircuitBreakers_Thresholds {
-+	// Modified by ingress
- 	return &cluster.CircuitBreakers_Thresholds{
- 		// DefaultMaxRetries specifies the default for the Envoy circuit breaker parameter max_retries. This
- 		// defines the maximum number of parallel retries a given Envoy will allow to the upstream cluster. Envoy defaults
-@@ -68,11 +69,12 @@
- 		// where multiple endpoints in a cluster are terminated. In these scenarios the circuit breaker can kick
- 		// in before Pilot is able to deliver an updated endpoint list to Envoy, leading to client-facing 503s.
- 		MaxRetries:         &wrappers.UInt32Value{Value: math.MaxUint32},
-		MaxRequests:        &wrappers.UInt32Value{Value: math.MaxUint32},
-		MaxConnections:     &wrappers.UInt32Value{Value: math.MaxUint32},
-		MaxPendingRequests: &wrappers.UInt32Value{Value: math.MaxUint32},
-+		MaxRequests:        &wrappers.UInt32Value{Value: uint32(features.DefaultUpstreamConcurrencyThreshold)},
-+		MaxConnections:     &wrappers.UInt32Value{Value: uint32(features.DefaultUpstreamConcurrencyThreshold)},
-+		MaxPendingRequests: &wrappers.UInt32Value{Value: uint32(features.DefaultUpstreamConcurrencyThreshold)},
- 		TrackRemaining:     true,
- 	}
-+	// End modified by ingress
- }
- 
- // BuildClusters returns the list of clusters for the given proxy. This is the CDS output
--- a/istio/1.12/patches/istio/20240201-virtual-host-allow-server-name.patch
+++ b/istio/1.12/patches/istio/20240201-virtual-host-allow-server-name.patch
@@ -1,88 +0,0 @@
-diff -Naur istio/pilot/pkg/networking/core/v1alpha3/gateway.go istio-new/pilot/pkg/networking/core/v1alpha3/gateway.go
--- istio/pilot/pkg/networking/core/v1alpha3/gateway.go	2024-02-01 13:53:17.000000000 +0800
-+++ istio-new/pilot/pkg/networking/core/v1alpha3/gateway.go	2024-02-01 13:52:11.000000000 +0800
-@@ -501,6 +501,16 @@
- 					gatewayVirtualServices[gatewayName] = virtualServices
- 				}
- 				for _, virtualService := range virtualServices {
-+					virtualServiceHosts := host.NewNames(virtualService.Spec.(*networking.VirtualService).Hosts)
-+					serverHosts := host.NamesForNamespace(server.Hosts, virtualService.Namespace)
-+
-+					// We have two cases here:
-+					// 1. virtualService hosts are 1.foo.com, 2.foo.com, 3.foo.com and server hosts are ns/*.foo.com
-+					// 2. virtualService hosts are *.foo.com, and server hosts are ns/1.foo.com, ns/2.foo.com, ns/3.foo.com
-+					intersectingHosts := serverHosts.Intersection(virtualServiceHosts)
-+					if len(intersectingHosts) == 0 {
-+						continue
-+					}
- 					listenerVirtualServices = append(listenerVirtualServices, virtualServiceContext{
- 						virtualService: virtualService,
- 						server:         server,
-@@ -615,22 +625,24 @@
- 
- 		// check all hostname if is not exist with HttpsRedirect set to true
- 		// create VirtualHost to redirect
-		for _, hostname := range server.Hosts {
-			if !server.GetTls().GetHttpsRedirect() {
-				continue
-			}
-			if vHost != nil && host.Name(hostname) == host.Name(hostRDSHost) {
-+		if server.GetTls().GetHttpsRedirect() {
-+			if vHost != nil {
- 				vHost.RequireTls = route.VirtualHost_ALL
-				continue
-+			} else {
-+				vHost = &route.VirtualHost{
-+					Name:                       util.DomainName(hostRDSHost, port),
-+					Domains:                    buildGatewayVirtualHostDomains(hostRDSHost, port),
-+					IncludeRequestAttemptCount: true,
-+					RequireTls:                 route.VirtualHost_ALL,
-+				}
- 			}
-			vHost = &route.VirtualHost{
-				Name:                       util.DomainName(hostname, port),
-				Domains:                    buildGatewayVirtualHostDomains(hostname, port),
-				IncludeRequestAttemptCount: true,
-				RequireTls:                 route.VirtualHost_ALL,
-+		} else if vHost != nil {
-+			mode := server.GetTls().GetMode()
-+			if mode == networking.ServerTLSSettings_MUTUAL ||
-+				mode == networking.ServerTLSSettings_ISTIO_MUTUAL {
-+				vHost.AllowServerNames = append(vHost.AllowServerNames, server.Hosts...)
- 			}
- 		}
-
- 	}
- 	var virtualHosts []*route.VirtualHost
- 	if vHost == nil {
-@@ -642,6 +654,30 @@
- 			Routes: []*route.Route{},
- 		}}
- 	} else {
-+		sort.SliceStable(vHost.AllowServerNames, func(i, j int) bool {
-+			hostI := vHost.AllowServerNames[i]
-+			hostJ := vHost.AllowServerNames[j]
-+			if host.Name(hostI).SubsetOf(host.Name(hostJ)) {
-+				return true
-+			}
-+			return hostI < hostJ
-+		})
-+		var uniqueServerNames []string
-+		hasAllCatch := false
-+		for i, name := range vHost.AllowServerNames {
-+			if name == "*" {
-+				hasAllCatch = true
-+				break
-+			}
-+			if i == 0 || vHost.AllowServerNames[i-1] != name {
-+				uniqueServerNames = append(uniqueServerNames, name)
-+			}
-+		}
-+		if hasAllCatch {
-+			vHost.AllowServerNames = nil
-+		} else {
-+			vHost.AllowServerNames = uniqueServerNames
-+		}
- 		vHost.Routes = istio_route.CombineVHostRoutes(vHost.Routes)
- 		virtualHosts = append(virtualHosts, vHost)
- 	}
--- a/istio/1.12/patches/istio/20240202-fix-rds-cache.patch
+++ b/istio/1.12/patches/istio/20240202-fix-rds-cache.patch
@@ -1,41 +0,0 @@
-diff -Naur istio/pilot/pkg/xds/discovery.go istio-new/pilot/pkg/xds/discovery.go
--- istio/pilot/pkg/xds/discovery.go	2024-02-02 16:26:49.000000000 +0800
-+++ istio-new/pilot/pkg/xds/discovery.go	2024-02-02 15:38:53.000000000 +0800
-@@ -18,6 +18,7 @@
- 	"context"
- 	"fmt"
- 	"strconv"
-+	"strings"
- 	"sync"
- 	"time"
- 
-@@ -41,6 +42,7 @@
- 	"istio.io/istio/pilot/pkg/util/sets"
- 	v3 "istio.io/istio/pilot/pkg/xds/v3"
- 	"istio.io/istio/pkg/cluster"
-+	"istio.io/istio/pkg/config/constants"
- 	"istio.io/istio/pkg/security"
- )
- 
-@@ -332,6 +334,21 @@
- 	} else {
- 		// Otherwise, just clear the updated configs
- 		s.Cache.Clear(req.ConfigsUpdated)
-+		//Added by ingress
-+		trimKeyMap := make(map[model.ConfigKey]struct{})
-+		for configKey := range req.ConfigsUpdated {
-+			if strings.HasPrefix(configKey.Name, constants.IstioIngressGatewayName+"-") {
-+				trimKeyMap[model.ConfigKey{
-+					Kind:      configKey.Kind,
-+					Name:      strings.TrimPrefix(configKey.Name, constants.IstioIngressGatewayName+"-"),
-+					Namespace: configKey.Namespace,
-+				}] = struct{}{}
-+			}
-+		}
-+		if len(trimKeyMap) > 0 {
-+			s.Cache.Clear(trimKeyMap)
-+		}
-+		//End added by ingress
- 	}
- }
- 
--- a/istio/1.12/patches/istio/20240204-increase-healthcheck-timeout.patch
+++ b/istio/1.12/patches/istio/20240204-increase-healthcheck-timeout.patch
@@ -1,21 +0,0 @@
-diff -Naur istio/pilot/cmd/pilot-agent/status/util/stats.go istio-new/pilot/cmd/pilot-agent/status/util/stats.go
--- istio/pilot/cmd/pilot-agent/status/util/stats.go	2024-02-04 18:48:18.000000000 +0800
-+++ istio-new/pilot/cmd/pilot-agent/status/util/stats.go	2024-02-04 09:35:42.000000000 +0800
-@@ -37,7 +37,7 @@
- 	updateStatsRegex   = "^(cluster_manager\\.cds|listener_manager\\.lds)\\.(update_success|update_rejected)$"
- )
- 
-var readinessTimeout = time.Second * 3 // Default Readiness timeout. It is set the same in helm charts.
-+var readinessTimeout = time.Second * 60 // Default Readiness timeout. It is set the same in helm charts.
- 
- type stat struct {
- 	name  string
-@@ -105,7 +105,7 @@
- 		localHostAddr = "localhost"
- 	}
- 
-	stats, err := http.DoHTTPGet(fmt.Sprintf("http://%s:%d/stats?usedonly", localHostAddr, adminPort))
-+	stats, err := http.DoHTTPGetWithTimeout(fmt.Sprintf("http://%s:%d/stats?usedonly", localHostAddr, adminPort), readinessTimeout)
- 	if err != nil {
- 		return nil, err
- 	}
--- a/istio/1.12/patches/istio/20240304-fix-gwapi-rds-cache.patch
+++ b/istio/1.12/patches/istio/20240304-fix-gwapi-rds-cache.patch
@@ -1,132 +0,0 @@
-diff -Naur istio/pilot/pkg/config/kube/gateway/conversion.go istio-new/pilot/pkg/config/kube/gateway/conversion.go
--- istio/pilot/pkg/config/kube/gateway/conversion.go	2024-03-04 17:35:34.000000000 +0800
-+++ istio-new/pilot/pkg/config/kube/gateway/conversion.go	2024-03-04 16:58:26.000000000 +0800
-@@ -450,7 +450,7 @@
- 		name = fmt.Sprintf("%s/%s/%s.%s", obj.GroupVersionKind.Kind, obj.Name, *sectionName, obj.Namespace)
- 	}
- 	return map[string]string{
-		constants.InternalParentName: name,
-+		constants.InternalParentNames: name,
- 	}
- }
- 
-diff -Naur istio/pilot/pkg/networking/core/v1alpha3/gateway.go istio-new/pilot/pkg/networking/core/v1alpha3/gateway.go
--- istio/pilot/pkg/networking/core/v1alpha3/gateway.go	2024-03-04 17:35:34.000000000 +0800
-+++ istio-new/pilot/pkg/networking/core/v1alpha3/gateway.go	2024-03-04 17:23:10.000000000 +0800
-@@ -49,6 +49,7 @@
- 	"istio.io/istio/pkg/config/gateway"
- 	"istio.io/istio/pkg/config/host"
- 	"istio.io/istio/pkg/config/protocol"
-+	"istio.io/istio/pkg/config/schema/gvk"
- 	"istio.io/istio/pkg/config/security"
- 	"istio.io/istio/pkg/proto"
- 	"istio.io/istio/pkg/util/istiomultierror"
-@@ -453,12 +454,43 @@
- 		return nil, false
- 	}
- 
-+	hostVs := push.VirtualServicesForHost(node, hostRDSHost)
-+
-+	var httpRoutes []config.Config
-+
-+	for _, vs := range hostVs {
-+		if len(vs.Annotations) == 0 {
-+			continue
-+		}
-+		if parents, ok := vs.Annotations[constants.InternalParentNames]; ok {
-+			typeNames := strings.Split(parents, ",")
-+			for _, typeName := range typeNames {
-+				if !strings.HasPrefix(typeName, "HTTPRoute/") {
-+					continue
-+				}
-+				nsNameStr := strings.TrimPrefix(typeName, "HTTPRoute/")
-+				nsName := strings.SplitN(nsNameStr, ".", 2)
-+				if len(nsName) != 2 {
-+					continue
-+				}
-+				httpRoutes = append(httpRoutes, config.Config{
-+					Meta: config.Meta{
-+						GroupVersionKind: gvk.HTTPRoute,
-+						Name:             nsName[0],
-+						Namespace:        nsName[1],
-+					},
-+				})
-+			}
-+		}
-+	}
-+
- 	routeCache := &istio_route.Cache{
- 		RouteName:    routeName,
- 		ProxyVersion: node.Metadata.IstioVersion,
- 		ListenerPort: rdsPort,
- 		// Use same host vs to cache, although the cache can be cleared when the port is different, this can be accepted
-		VirtualServices: push.VirtualServicesForHost(node, hostRDSHost),
-+		VirtualServices: hostVs,
-+		HTTPRoutes:      httpRoutes,
- 		EnvoyFilterKeys: efKeys,
- 	}
- 
-diff -Naur istio/pilot/pkg/networking/core/v1alpha3/route/route_cache.go istio-new/pilot/pkg/networking/core/v1alpha3/route/route_cache.go
--- istio/pilot/pkg/networking/core/v1alpha3/route/route_cache.go	2024-03-04 17:35:30.000000000 +0800
-+++ istio-new/pilot/pkg/networking/core/v1alpha3/route/route_cache.go	2024-03-04 17:24:19.000000000 +0800
-@@ -43,9 +43,12 @@
- 	// This depends on DNSCapture.
- 	DNSAutoAllocate bool
- 
-	ListenerPort     int
-	Services         []*model.Service
-	VirtualServices  []config.Config
-+	ListenerPort    int
-+	Services        []*model.Service
-+	VirtualServices []config.Config
-+	// Added by ingress
-+	HTTPRoutes []config.Config
-+	// End added by ingress
- 	DestinationRules []*config.Config
- 	EnvoyFilterKeys  []string
- }
-@@ -81,6 +84,11 @@
- 	for _, vs := range r.VirtualServices {
- 		configs = append(configs, model.ConfigKey{Kind: gvk.VirtualService, Name: vs.Name, Namespace: vs.Namespace})
- 	}
-+	// Added by ingress
-+	for _, route := range r.HTTPRoutes {
-+		configs = append(configs, model.ConfigKey{Kind: gvk.HTTPRoute, Name: route.Name, Namespace: route.Namespace})
-+	}
-+	// End added by ingress
- 	for _, dr := range r.DestinationRules {
- 		configs = append(configs, model.ConfigKey{Kind: gvk.DestinationRule, Name: dr.Name, Namespace: dr.Namespace})
- 	}
-@@ -107,6 +115,11 @@
- 	for _, vs := range r.VirtualServices {
- 		params = append(params, vs.Name+"/"+vs.Namespace)
- 	}
-+	// Added by ingress
-+	for _, route := range r.HTTPRoutes {
-+		params = append(params, route.Name+"/"+route.Namespace)
-+	}
-+	// End added by ingress
- 	for _, dr := range r.DestinationRules {
- 		params = append(params, dr.Name+"/"+dr.Namespace)
- 	}
-diff -Naur istio/pkg/config/constants/constants.go istio-new/pkg/config/constants/constants.go
--- istio/pkg/config/constants/constants.go	2024-03-04 17:35:34.000000000 +0800
-+++ istio-new/pkg/config/constants/constants.go	2024-03-04 16:58:05.000000000 +0800
-@@ -15,8 +15,6 @@
- package constants
- 
- const (
-	InternalParentNames = "internal.istio.io/parents"
-
- 	InternalRouteSemantics = "internal.istio.io/route-semantics"
- 
- 	RouteSemanticsGateway = "gateway"
-@@ -129,7 +127,7 @@
- 	AlwaysPushLabel = "internal.istio.io/always-push"
- 
- 	// InternalParentName declares the original resource of an internally-generate config. This is used by the gateway-api.
-	InternalParentName = "internal.istio.io/parent"
-+	InternalParentNames = "internal.istio.io/parents"
- 
- 	// TrustworthyJWTPath is the default 3P token to authenticate with third party services
- 	TrustworthyJWTPath = "./var/run/secrets/tokens/istio-token"
--- a/istio/1.12/patches/istio/20240308-fix-gateway-api-route-name.patch
+++ b/istio/1.12/patches/istio/20240308-fix-gateway-api-route-name.patch
@@ -1,56 +0,0 @@
-diff -Naur istio/pilot/pkg/config/kube/gateway/conversion.go istio-new/pilot/pkg/config/kube/gateway/conversion.go
--- istio/pilot/pkg/config/kube/gateway/conversion.go	2024-03-08 17:23:49.000000000 +0800
-+++ istio-new/pilot/pkg/config/kube/gateway/conversion.go	2024-03-08 17:02:50.000000000 +0800
-@@ -16,6 +16,7 @@
- 
- import (
- 	"fmt"
-+	"path"
- 	"regexp"
- 	"sort"
- 	"strconv"
-@@ -28,6 +29,7 @@
- 	gatewayapiV1beta1 "sigs.k8s.io/gateway-api/apis/v1beta1"
- 
- 	istio "istio.io/api/networking/v1alpha3"
-+	"istio.io/istio/pilot/pkg/features"
- 	"istio.io/istio/pilot/pkg/model"
- 	"istio.io/istio/pilot/pkg/model/credentials"
- 	"istio.io/istio/pilot/pkg/model/kstatus"
-@@ -290,6 +292,16 @@
- 	return ret
- }
- 
-+// Added by ingress
-+func generateRouteName(obj config.Config) string {
-+	if obj.Namespace == features.HigressSystemNs {
-+		return obj.Name
-+	}
-+	return path.Join(obj.Namespace, obj.Name)
-+}
-+
-+// End added by ingress
-+
- func buildHTTPVirtualServices(ctx *KubernetesResources, obj config.Config, gateways map[parentKey]map[gatewayapiV1beta1.SectionName]*parentInfo, gatewayRoutes map[string]map[string]*config.Config, domain string) {
- 	route := obj.Spec.(*gatewayapiV1beta1.HTTPRouteSpec)
- 
-@@ -307,7 +319,7 @@
- 	for _, r := range route.Rules {
- 		// TODO: implement rewrite, timeout, mirror, corspolicy, retries
- 		vs := &istio.HTTPRoute{
-			Name: obj.Name,
-+			Name: generateRouteName(obj),
- 		}
- 		for _, match := range r.Matches {
- 			uri, err := createURIMatch(match)
-diff -Naur istio/pilot/pkg/features/pilot.go istio-new/pilot/pkg/features/pilot.go
--- istio/pilot/pkg/features/pilot.go	2024-03-08 17:23:49.000000000 +0800
-+++ istio-new/pilot/pkg/features/pilot.go	2024-03-08 17:00:05.000000000 +0800
-@@ -577,6 +577,7 @@
- 		"If enabled, the on demand filter will be added to the HCM filters").Get()
- 	DefaultUpstreamConcurrencyThreshold = env.RegisterIntVar("DEFAULT_UPSTREAM_CONCURRENCY_THRESHOLD", 1000000,
- 		"The default threshold of max_requests/max_pending_requests/max_connections of circuit breaker").Get()
-+	HigressSystemNs = env.RegisterStringVar("HIGRESS_SYSTEM_NS", "higress-system", "The system namespace of Higress").Get()
- 	// End added by ingress
- )
- 
--- a/istio/1.12/patches/istio/20240422-fix-copyvs.patch
+++ b/istio/1.12/patches/istio/20240422-fix-copyvs.patch
@@ -1,20 +0,0 @@
-diff -Naur istio/pilot/pkg/networking/core/v1alpha3/gateway.go istio-new/pilot/pkg/networking/core/v1alpha3/gateway.go
--- istio/pilot/pkg/networking/core/v1alpha3/gateway.go	2024-04-22 18:08:26.000000000 +0800
-+++ istio-new/pilot/pkg/networking/core/v1alpha3/gateway.go	2024-04-22 18:07:46.000000000 +0800
-@@ -581,13 +581,13 @@
- 			continue
- 		}
- 		if len(virtualService.Spec.(*networking.VirtualService).Hosts) > 1 {
-			copiedVS := &networking.VirtualService{}
-			copiedVS = virtualService.Spec.(*networking.VirtualService)
-+			copiedVS := networking.VirtualService{}
-+			copiedVS = *(virtualService.Spec.(*networking.VirtualService))
- 			copiedVS.Hosts = []string{selectHost}
- 			selectedVirtualServices = append(selectedVirtualServices, virtualServiceContext{
- 				virtualService: config.Config{
- 					Meta:   virtualService.Meta,
-					Spec:   copiedVS,
-+					Spec:   &copiedVS,
- 					Status: virtualService.Status,
- 				},
- 				server:      vsCtx.server,
--- a/istio/1.12/patches/istio/20240518-optimize-rds-cache.patch
+++ b/istio/1.12/patches/istio/20240518-optimize-rds-cache.patch
@@ -1,83 +0,0 @@
-diff -Naur istio/pilot/pkg/networking/core/v1alpha3/gateway.go istio-new/pilot/pkg/networking/core/v1alpha3/gateway.go
--- istio/pilot/pkg/networking/core/v1alpha3/gateway.go	2024-05-18 19:09:14.000000000 +0800
-+++ istio-new/pilot/pkg/networking/core/v1alpha3/gateway.go	2024-05-18 18:08:30.000000000 +0800
-@@ -457,8 +457,46 @@
- 	hostVs := push.VirtualServicesForHost(node, hostRDSHost)
- 
- 	var httpRoutes []config.Config
-+	var vsDependent []config.Config
-+
-+	cacheable := true
- 
- 	for _, vs := range hostVs {
-+		vsSpec := vs.Spec.(*networking.VirtualService)
-+		for _, vsHttpRoute := range vsSpec.Http {
-+			// check if dynamic port exists, we should not cache RDS
-+			for _, vsRoute := range vsHttpRoute.Route {
-+				if vsRoute.Destination.Port == nil {
-+					cacheable = false
-+				}
-+				for _, fallbackDestination := range vsRoute.FallbackClusters {
-+					if fallbackDestination.Port == nil {
-+						cacheable = false
-+					}
-+				}
-+			}
-+			if vsHttpRoute.Mirror != nil && vsHttpRoute.Mirror.Port == nil {
-+				cacheable = false
-+			}
-+			if vsHttpRoute.Delegate != nil {
-+				vsDependent = append(vsDependent, config.Config{
-+					Meta: config.Meta{
-+						GroupVersionKind: gvk.VirtualService,
-+						Name:             vsHttpRoute.Delegate.Name,
-+						Namespace:        vsHttpRoute.Delegate.Namespace,
-+					},
-+					Spec: networking.VirtualService{},
-+				})
-+			}
-+		}
-+		vsDependent = append(vsDependent, config.Config{
-+			Meta: config.Meta{
-+				GroupVersionKind: gvk.VirtualService,
-+				Name:             vs.Name,
-+				Namespace:        vs.Namespace,
-+			},
-+			Spec: vs.Spec,
-+		})
- 		if len(vs.Annotations) == 0 {
- 			continue
- 		}
-@@ -489,14 +527,19 @@
- 		ProxyVersion: node.Metadata.IstioVersion,
- 		ListenerPort: rdsPort,
- 		// Use same host vs to cache, although the cache can be cleared when the port is different, this can be accepted
-		VirtualServices: hostVs,
-+		VirtualServices: vsDependent,
- 		HTTPRoutes:      httpRoutes,
- 		EnvoyFilterKeys: efKeys,
- 	}
- 
-	resource, exist := configgen.Cache.Get(routeCache)
-	if exist {
-		return resource, true
-+	var resource *discovery.Resource
-+	if cacheable {
-+		resource, exist := configgen.Cache.Get(routeCache)
-+		if exist {
-+			return resource, true
-+		}
-+	} else {
-+		log.Warnf("route cache is disabled for RDS:%s", routeName)
- 	}
- 
- 	listenerPort := uint32(rdsPort)
-@@ -727,7 +770,7 @@
- 		Resource: util.MessageToAny(routeCfg),
- 	}
- 
-	if features.EnableRDSCaching {
-+	if features.EnableRDSCaching && cacheable {
- 		configgen.Cache.Add(routeCache, req, resource)
- 	}
- 
--- a/istio/1.12/patches/istio/20240519-proxy-start-script.patch
+++ b/istio/1.12/patches/istio/20240519-proxy-start-script.patch
@@ -1,752 +0,0 @@
-diff -Naur istio/pilot/docker/Dockerfile.proxyv2 istio-new/pilot/docker/Dockerfile.proxyv2
--- istio/pilot/docker/Dockerfile.proxyv2	2024-05-19 16:40:42.706769894 +0800
-+++ istio-new/pilot/docker/Dockerfile.proxyv2	2024-05-19 16:07:20.630730574 +0800
-@@ -28,6 +28,7 @@
- 
- # Copy Envoy bootstrap templates used by pilot-agent
- COPY envoy_bootstrap.json /var/lib/istio/envoy/envoy_bootstrap_tmpl.json
-+COPY envoy_bootstrap_lite.json /var/lib/istio/envoy/envoy_bootstrap_lite_tmpl.json
- COPY gcp_envoy_bootstrap.json /var/lib/istio/envoy/gcp_envoy_bootstrap_tmpl.json
- 
- # Install Envoy.
-@@ -47,5 +48,30 @@
- # COPY metadata-exchange-filter.wasm /etc/istio/extensions/metadata-exchange-filter.wasm
- # COPY metadata-exchange-filter.compiled.wasm /etc/istio/extensions/metadata-exchange-filter.compiled.wasm
- 
-+RUN apt-get update && \
-+  apt-get install --no-install-recommends -y \
-+  logrotate \
-+  cron \
-+  && apt-get upgrade -y \
-+  && apt-get clean
-+
-+# Latest releases available at https://github.com/aptible/supercronic/releases
-+ENV SUPERCRONIC_URL=https://higress.io/release-binary/supercronic-linux-${TARGETARCH:-amd64} \
-+    SUPERCRONIC=supercronic-linux-${TARGETARCH:-amd64}
-+
-+RUN curl -fsSLO "$SUPERCRONIC_URL" \
-+ && chmod +x "$SUPERCRONIC" \
-+ && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
-+ && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic
-+
-+
-+COPY higress-proxy-start.sh /usr/local/bin/higress-proxy-start.sh
-+
-+COPY higress-proxy-container-init.sh /usr/local/bin/higress-proxy-container-init.sh
-+
-+RUN chmod a+x /usr/local/bin/higress-proxy-container-init.sh;/usr/local/bin/higress-proxy-container-init.sh
-+
-+RUN chmod a+x /usr/local/bin/higress-proxy-start.sh
-+
- # The pilot-agent will bootstrap Envoy.
-ENTRYPOINT ["/usr/local/bin/pilot-agent"]
-+ENTRYPOINT ["/usr/local/bin/higress-proxy-start.sh"]
-diff -Naur istio/tools/istio-docker.mk istio-new/tools/istio-docker.mk
--- istio/tools/istio-docker.mk	2024-05-19 16:40:42.734769895 +0800
-+++ istio-new/tools/istio-docker.mk	2024-05-19 16:02:43.222725126 +0800
-@@ -96,6 +96,9 @@
- docker.proxyv2: BUILD_ARGS=--build-arg proxy_version=istio-proxy:${PROXY_REPO_SHA} --build-arg istio_version=${VERSION} --build-arg BASE_VERSION=${BASE_VERSION} --build-arg SIDECAR=${SIDECAR} --build-arg HUB=${HUB}
- docker.proxyv2: ${ISTIO_ENVOY_BOOTSTRAP_CONFIG_DIR}/envoy_bootstrap.json
- docker.proxyv2: ${ISTIO_ENVOY_BOOTSTRAP_CONFIG_DIR}/gcp_envoy_bootstrap.json
-+docker.proxyv2: ${ISTIO_ENVOY_BOOTSTRAP_CONFIG_DIR}/higress-proxy-start.sh
-+docker.proxyv2: ${ISTIO_ENVOY_BOOTSTRAP_CONFIG_DIR}/higress-proxy-container-init.sh
-+docker.proxyv2: ${ISTIO_ENVOY_BOOTSTRAP_CONFIG_DIR}/envoy_bootstrap_lite.json
- docker.proxyv2: ${ISTIO_ENVOY_LINUX_ARM64_RELEASE_DIR}/${SIDECAR}
- docker.proxyv2: ${ISTIO_ENVOY_LINUX_AMD64_RELEASE_DIR}/${SIDECAR}
- docker.proxyv2: $(ISTIO_OUT_LINUX)/pilot-agent
-diff -Naur istio/tools/packaging/common/envoy_bootstrap_lite.json istio-new/tools/packaging/common/envoy_bootstrap_lite.json
--- istio/tools/packaging/common/envoy_bootstrap_lite.json	1970-01-01 08:00:00.000000000 +0800
-+++ istio-new/tools/packaging/common/envoy_bootstrap_lite.json	2024-05-19 16:36:39.274765113 +0800
-@@ -0,0 +1,642 @@
-+{
-+  "node": {
-+    "id": "{{ .nodeID }}",
-+    "cluster": "{{ .cluster }}",
-+    "locality": {
-+      {{- if .region }}
-+      "region": "{{ .region }}"
-+      {{- end }}
-+      {{- if .zone }}
-+      {{- if .region }}
-+      ,
-+      {{- end }}
-+      "zone": "{{ .zone }}"
-+      {{- end }}
-+      {{- if .sub_zone }}
-+      {{- if or .region .zone }}
-+      ,
-+      {{- end }}
-+      "sub_zone": "{{ .sub_zone }}"
-+      {{- end }}
-+    },
-+    "metadata": {{ .meta_json_str }}
-+  },
-+  "layered_runtime": {
-+      "layers": [
-+          {
-+            "name": "global config",
-+            "static_layer": {{ .runtime_flags }}
-+          },
-+          {
-+              "name": "admin",
-+              "admin_layer": {}
-+          }
-+      ]
-+  },
-+  "stats_config": {
-+    "use_all_default_tags": false,
-+    "stats_tags": [
-+      {
-+        "tag_name": "response_code_class",
-+        "regex": "_rq(_(\\dxx))$"
-+      },
-+      {
-+        "tag_name": "listener_address",
-+        "regex": "^listener\\.(((?:[_.[:digit:]]*|[_\\[\\]aAbBcCdDeEfF[:digit:]]*))\\.)"
-+      },
-+      {
-+        "tag_name": "http_conn_manager_prefix",
-+        "regex": "^http\\.(((outbound_([0-9]{1,3}\\.{0,1}){4}_\\d{0,5})|([^\\.]+))\\.)"
-+      },
-+      {
-+        "tag_name": "cluster_name",
-+        "regex": "^cluster\\.((.*?)\\.)(http1\\.|http2\\.|health_check\\.|zone\\.|external\\.|circuit_breakers\\.|[^\\.]+$)"
-+      }
-+    ],
-+    "stats_matcher": {
-+      "exclusion_list": {
-+        "patterns": [
-+          {
-+            "prefix": "vhost"
-+          },
-+          {
-+            "safe_regex": {"regex": "^http.*rds.*", "google_re2":{}}
-+          }
-+        ]
-+      }
-+    }
-+  },
-+  "admin": {
-+    "access_log_path": "/dev/null",
-+    "profile_path": "/var/lib/istio/data/envoy.prof",
-+    "address": {
-+      "socket_address": {
-+        "address": "{{ .localhost }}",
-+        "port_value": {{ .config.ProxyAdminPort }}
-+      }
-+    }
-+  },
-+  "dynamic_resources": {
-+    "lds_config": {
-+      "ads": {},
-+      "initial_fetch_timeout": "0s",
-+      "resource_api_version": "V3"
-+    },
-+    "cds_config": {
-+      "ads": {},
-+      "initial_fetch_timeout": "0s",
-+      "resource_api_version": "V3"
-+    },
-+    "ads_config": {
-+      "api_type": "{{ .xds_type }}",
-+      "set_node_on_first_message_only": true,
-+      "transport_api_version": "V3",
-+      "grpc_services": [
-+        {
-+          "envoy_grpc": {
-+            "cluster_name": "xds-grpc"
-+          }
-+        }
-+      ]
-+    }
-+  },
-+  "static_resources": {
-+    "clusters": [
-+      {
-+        "name": "prometheus_stats",
-+        "type": "STATIC",
-+        "connect_timeout": "0.250s",
-+        "lb_policy": "ROUND_ROBIN",
-+        "load_assignment": {
-+          "cluster_name": "prometheus_stats",
-+          "endpoints": [{
-+            "lb_endpoints": [{
-+              "endpoint": {
-+                "address":{
-+                  "socket_address": {
-+                    "protocol": "TCP",
-+                    "address": "{{ .localhost }}",
-+                    "port_value": {{ .config.ProxyAdminPort }}
-+                  }
-+                }
-+              }
-+            }]
-+          }]
-+        }
-+      },
-+      {
-+        "name": "agent",
-+        "type": "STATIC",
-+        "connect_timeout": "0.250s",
-+        "lb_policy": "ROUND_ROBIN",
-+        "load_assignment": {
-+          "cluster_name": "agent",
-+          "endpoints": [{
-+            "lb_endpoints": [{
-+              "endpoint": {
-+                "address":{
-+                  "socket_address": {
-+                    "protocol": "TCP",
-+                    "address": "{{ .localhost }}",
-+                    "port_value": {{ .config.StatusPort }}
-+                  }
-+                }
-+              }
-+            }]
-+          }]
-+        }
-+      },
-+      {
-+        "name": "sds-grpc",
-+        "type": "STATIC",
-+        "typed_extension_protocol_options": {
-+          "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
-+           "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-+           "explicit_http_config": {
-+            "http2_protocol_options": {}
-+           }
-+          }
-+        },
-+        "connect_timeout": "1s",
-+        "lb_policy": "ROUND_ROBIN",
-+        "load_assignment": {
-+          "cluster_name": "sds-grpc",
-+          "endpoints": [{
-+            "lb_endpoints": [{
-+              "endpoint": {
-+                "address":{
-+                  "pipe": {
-+                    "path": "{{ .config.ConfigPath }}/SDS"
-+                  }
-+                }
-+              }
-+            }]
-+          }]
-+        }
-+      },
-+      {
-+        "name": "xds-grpc",
-+        "type" : "STATIC",
-+        "connect_timeout": "1s",
-+        "lb_policy": "ROUND_ROBIN",
-+        "load_assignment": {
-+          "cluster_name": "xds-grpc",
-+          "endpoints": [{
-+            "lb_endpoints": [{
-+              "endpoint": {
-+                "address":{
-+                  "pipe": {
-+                    "path": "{{ .config.ConfigPath }}/XDS"
-+                  }
-+                }
-+              }
-+            }]
-+          }]
-+        },
-+        "circuit_breakers": {
-+          "thresholds": [
-+            {
-+              "priority": "DEFAULT",
-+              "max_connections": 100000,
-+              "max_pending_requests": 100000,
-+              "max_requests": 100000
-+            },
-+            {
-+              "priority": "HIGH",
-+              "max_connections": 100000,
-+              "max_pending_requests": 100000,
-+              "max_requests": 100000
-+            }
-+          ]
-+        },
-+        "upstream_connection_options": {
-+          "tcp_keepalive": {
-+            "keepalive_time": 300
-+          }
-+        },
-+        "max_requests_per_connection": 1,
-+        "typed_extension_protocol_options": {
-+          "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
-+           "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-+           "explicit_http_config": {
-+            "http2_protocol_options": {}
-+           }
-+          }
-+        }
-+      }
-+      {{ if .zipkin }}
-+      ,
-+      {
-+        "name": "zipkin",
-+        {{- if .tracing_tls }}
-+        "transport_socket": {{ .tracing_tls }},
-+        {{- end }}
-+        "type": "STRICT_DNS",
-+        "respect_dns_ttl": true,
-+        "dns_lookup_family": "{{ .dns_lookup_family }}",
-+        "dns_refresh_rate": "30s",
-+        "connect_timeout": "1s",
-+        "lb_policy": "ROUND_ROBIN",
-+        "load_assignment": {
-+          "cluster_name": "zipkin",
-+          "endpoints": [{
-+            "lb_endpoints": [{
-+              "endpoint": {
-+                "address":{
-+                  "socket_address": {{ .zipkin }}
-+                }
-+              }
-+            }]
-+          }]
-+        }
-+      }
-+      {{ else if .lightstep }}
-+      ,
-+      {
-+        "name": "lightstep",
-+        {{- if .tracing_tls }}
-+        "transport_socket": {{ .tracing_tls }},
-+        {{- end }}
-+        "typed_extension_protocol_options": {
-+          "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
-+           "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-+           "explicit_http_config": {
-+            "http2_protocol_options": {}
-+           }
-+          }
-+        },
-+        "type": "STRICT_DNS",
-+        "respect_dns_ttl": true,
-+        "dns_lookup_family": "{{ .dns_lookup_family }}",
-+        "connect_timeout": "1s",
-+        "lb_policy": "ROUND_ROBIN",
-+        "load_assignment": {
-+          "cluster_name": "lightstep",
-+          "endpoints": [{
-+            "lb_endpoints": [{
-+              "endpoint": {
-+                "address":{
-+                  "socket_address": {{ .lightstep }}
-+                }
-+              }
-+            }]
-+          }]
-+        }
-+      }
-+      {{ else if .datadog }}
-+      ,
-+      {
-+        "name": "datadog_agent",
-+        {{- if .tracing_tls }}
-+        "transport_socket": {{ .tracing_tls }},
-+        {{- end }}
-+        "connect_timeout": "1s",
-+        "type": "STRICT_DNS",
-+        "respect_dns_ttl": true,
-+        "dns_lookup_family": "{{ .dns_lookup_family }}",
-+        "lb_policy": "ROUND_ROBIN",
-+        "load_assignment": {
-+          "cluster_name": "datadog_agent",
-+          "endpoints": [{
-+            "lb_endpoints": [{
-+              "endpoint": {
-+                "address":{
-+                  "socket_address": {{ .datadog }}
-+                }
-+              }
-+            }]
-+          }]
-+        }
-+      }
-+      {{ end }}
-+      {{- if .envoy_metrics_service_address }}
-+      ,
-+      {
-+        "name": "envoy_metrics_service",
-+        "type": "STRICT_DNS",
-+      {{- if .envoy_metrics_service_tls }}
-+        "transport_socket": {{ .envoy_metrics_service_tls }},
-+      {{- end }}
-+      {{- if .envoy_metrics_service_tcp_keepalive }}
-+        "upstream_connection_options": {{ .envoy_metrics_service_tcp_keepalive }},
-+      {{- end }}
-+        "respect_dns_ttl": true,
-+        "dns_lookup_family": "{{ .dns_lookup_family }}",
-+        "connect_timeout": "1s",
-+        "lb_policy": "ROUND_ROBIN",
-+        "typed_extension_protocol_options": {
-+          "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
-+           "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-+           "explicit_http_config": {
-+            "http2_protocol_options": {}
-+           }
-+          }
-+        },
-+        "load_assignment": {
-+          "cluster_name": "envoy_metrics_service",
-+          "endpoints": [{
-+            "lb_endpoints": [{
-+              "endpoint": {
-+                "address":{
-+                  "socket_address": {{ .envoy_metrics_service_address }}
-+                }
-+              }
-+            }]
-+          }]
-+        }
-+      }
-+      {{ end }}
-+      {{ if .envoy_accesslog_service_address }}
-+      ,
-+      {
-+        "name": "envoy_accesslog_service",
-+        "type": "STRICT_DNS",
-+      {{- if .envoy_accesslog_service_tls }}
-+        "transport_socket": {{ .envoy_accesslog_service_tls }},
-+      {{- end }}
-+      {{- if .envoy_accesslog_service_tcp_keepalive }}
-+        "upstream_connection_options": {{ .envoy_accesslog_service_tcp_keepalive }},
-+      {{ end }}
-+        "respect_dns_ttl": true,
-+        "dns_lookup_family": "{{ .dns_lookup_family }}",
-+        "connect_timeout": "1s",
-+        "lb_policy": "ROUND_ROBIN",
-+        "typed_extension_protocol_options": {
-+          "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
-+           "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-+           "explicit_http_config": {
-+            "http2_protocol_options": {}
-+           }
-+          }
-+        },
-+        "load_assignment": {
-+          "cluster_name": "envoy_accesslog_service",
-+          "endpoints": [{
-+            "lb_endpoints": [{
-+              "endpoint": {
-+                "address":{
-+                  "socket_address": {{ .envoy_accesslog_service_address }}
-+                }
-+              }
-+            }]
-+          }]
-+        }
-+      }
-+      {{ end }}
-+    ],
-+    "listeners":[
-+      {
-+        "address": {
-+          "socket_address": {
-+            "protocol": "TCP",
-+            "address": "{{ .wildcard }}",
-+            "port_value": {{ .envoy_prometheus_port }}
-+          }
-+        },
-+        "filter_chains": [
-+          {
-+            "filters": [
-+              {
-+                "name": "envoy.filters.network.http_connection_manager",
-+                "typed_config": {
-+                  "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
-+                  "codec_type": "AUTO",
-+                  "stat_prefix": "stats",
-+                  "route_config": {
-+                    "virtual_hosts": [
-+                      {
-+                        "name": "backend",
-+                        "domains": [
-+                          "*"
-+                        ],
-+                        "routes": [
-+                          {
-+                            "match": {
-+                              "prefix": "/stats/prometheus"
-+                            },
-+                            "route": {
-+                              "cluster": "prometheus_stats"
-+                            }
-+                          }
-+                        ]
-+                      }
-+                    ]
-+                  },
-+                  "http_filters": [{
-+                    "name": "envoy.filters.http.router",
-+                    "typed_config": {
-+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
-+                    }
-+                  }]
-+                }
-+              }
-+            ]
-+          }
-+        ]
-+      },
-+      {
-+        "address": {
-+           "socket_address": {
-+             "protocol": "TCP",
-+             "address": "{{ .wildcard }}",
-+             "port_value": {{ .envoy_status_port }}
-+           }
-+        },
-+        "filter_chains": [
-+          {
-+            "filters": [
-+              {
-+                "name": "envoy.filters.network.http_connection_manager",
-+                "typed_config": {
-+                  "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
-+                  "codec_type": "AUTO",
-+                  "stat_prefix": "agent",
-+                  "route_config": {
-+                    "virtual_hosts": [
-+                      {
-+                        "name": "backend",
-+                        "domains": [
-+                          "*"
-+                        ],
-+                        "routes": [
-+                          {
-+                            "match": {
-+                              "prefix": "/healthz/ready"
-+                            },
-+                            "route": {
-+                              "cluster": "agent"
-+                            }
-+                          }
-+                        ]
-+                      }
-+                    ]
-+                  },
-+                  "http_filters": [{
-+                    "name": "envoy.filters.http.router",
-+                    "typed_config": {
-+                      "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
-+                    }
-+                  }]
-+                }
-+              }
-+            ]
-+          }
-+        ]
-+      }
-+    ]
-+  }
-+  {{- if .zipkin }}
-+  ,
-+  "tracing": {
-+    "http": {
-+      "name": "envoy.tracers.zipkin",
-+      "typed_config": {
-+        "@type": "type.googleapis.com/envoy.config.trace.v3.ZipkinConfig",
-+        "collector_cluster": "zipkin",
-+        "collector_endpoint": "/api/v2/spans",
-+        "collector_endpoint_version": "HTTP_JSON",
-+        "trace_id_128bit": true,
-+        "shared_span_context": false
-+      }
-+    }
-+  }
-+  {{- else if .lightstep }}
-+  ,
-+  "tracing": {
-+    "http": {
-+      "name": "envoy.tracers.lightstep",
-+      "typed_config": {
-+        "@type": "type.googleapis.com/envoy.config.trace.v3.LightstepConfig",
-+        "collector_cluster": "lightstep",
-+        "access_token_file": "{{ .lightstepToken}}"
-+      }
-+    }
-+  }
-+  {{- else if .datadog }}
-+  ,
-+  "tracing": {
-+    "http": {
-+      "name": "envoy.tracers.datadog",
-+      "typed_config": {
-+        "@type": "type.googleapis.com/envoy.config.trace.v3.DatadogConfig",
-+        "collector_cluster": "datadog_agent",
-+        "service_name": "{{ .cluster }}"
-+      }
-+    }
-+  }
-+  {{- else if .openCensusAgent }}
-+  ,
-+  "tracing": {
-+    "http": {
-+      "name": "envoy.tracers.opencensus",
-+      "typed_config": {
-+        "@type": "type.googleapis.com/envoy.config.trace.v3.OpenCensusConfig",
-+        "ocagent_exporter_enabled": true,
-+        "ocagent_address": "{{ .openCensusAgent }}",
-+        "incoming_trace_context": {{ .openCensusAgentContexts }},
-+        "outgoing_trace_context": {{ .openCensusAgentContexts }},
-+        "trace_config": {
-+          "constant_sampler": {
-+            "decision": "ALWAYS_PARENT"
-+          },
-+          "max_number_of_annotations": 200,
-+          "max_number_of_attributes": 200,
-+          "max_number_of_message_events": 200,
-+          "max_number_of_links": 200
-+        }
-+      }
-+    }
-+  }
-+  {{- else if .stackdriver }}
-+  ,
-+  "tracing": {
-+    "http": {
-+      "name": "envoy.tracers.opencensus",
-+      "typed_config": {
-+      "@type": "type.googleapis.com/envoy.config.trace.v3.OpenCensusConfig",
-+      "stackdriver_exporter_enabled": true,
-+      "stackdriver_project_id": "{{ .stackdriverProjectID }}",
-+      {{ if .sts_port }}
-+      "stackdriver_grpc_service": {
-+        "google_grpc": {
-+          "target_uri": "cloudtrace.googleapis.com",
-+          "stat_prefix": "oc_stackdriver_tracer",
-+          "channel_credentials": {
-+            "ssl_credentials": {}
-+          },
-+          "call_credentials": [{
-+            "sts_service": {
-+              "token_exchange_service_uri": "http://localhost:{{ .sts_port }}/token",
-+              "subject_token_path": "/var/run/secrets/tokens/istio-token",
-+              "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
-+              "scope": "https://www.googleapis.com/auth/cloud-platform"
-+            }
-+          }]
-+        },
-+        "initial_metadata": [
-+        {{ if .gcp_project_id }}
-+          {
-+            "key": "x-goog-user-project",
-+            "value": "{{ .gcp_project_id }}"
-+          }
-+        {{ end }}
-+        ]
-+      },
-+      {{ end }}
-+      "stdout_exporter_enabled": {{ .stackdriverDebug }},
-+      "incoming_trace_context": ["CLOUD_TRACE_CONTEXT", "TRACE_CONTEXT", "GRPC_TRACE_BIN", "B3"],
-+      "outgoing_trace_context": ["CLOUD_TRACE_CONTEXT", "TRACE_CONTEXT", "GRPC_TRACE_BIN", "B3"],
-+      "trace_config":{
-+        "constant_sampler":{
-+          "decision": "ALWAYS_PARENT"
-+        },
-+        "max_number_of_annotations": {{ .stackdriverMaxAnnotations }},
-+        "max_number_of_attributes": {{ .stackdriverMaxAttributes }},
-+        "max_number_of_message_events": {{ .stackdriverMaxEvents }},
-+        "max_number_of_links": 200
-+       }
-+     }
-+  }}
-+  {{ end }}
-+  {{ if or .envoy_metrics_service_address .statsd }}
-+  ,
-+  "stats_sinks": [
-+    {{ if .envoy_metrics_service_address }}
-+    {
-+      "name": "envoy.stat_sinks.metrics_service",
-+      "typed_config": {
-+        "@type": "type.googleapis.com/envoy.config.metrics.v3.MetricsServiceConfig",
-+        "transport_api_version": "V3",
-+        "grpc_service": {
-+          "envoy_grpc": {
-+            "cluster_name": "envoy_metrics_service"
-+          }
-+        }
-+      }
-+    }
-+    {{ end }}
-+    {{ if and .envoy_metrics_service_address .statsd }}
-+    ,
-+    {{ end }}
-+    {{ if .statsd }}
-+    {
-+      "name": "envoy.stat_sinks.statsd",
-+      "typed_config": {
-+        "@type": "type.googleapis.com/envoy.config.metrics.v3.StatsdSink",
-+        "address": {
-+          "socket_address": {{ .statsd }}
-+        }
-+      }
-+    }
-+    {{ end }}
-+  ]
-+  {{ end }}
-+  {{ if .outlier_log_path }}
-+  ,
-+  "cluster_manager": {
-+    "outlier_detection": {
-+      "event_log_path": "{{ .outlier_log_path }}"
-+    }
-+  }
-+  {{ end }}
-+}
-diff -Naur istio/tools/packaging/common/higress-proxy-container-init.sh istio-new/tools/packaging/common/higress-proxy-container-init.sh
--- istio/tools/packaging/common/higress-proxy-container-init.sh	1970-01-01 08:00:00.000000000 +0800
-+++ istio-new/tools/packaging/common/higress-proxy-container-init.sh	2024-05-19 16:30:06.202757394 +0800
-@@ -0,0 +1,32 @@
-+#!/bin/bash
-+
-+mkdir -p /var/log/proxy
-+
-+mkdir -p /var/lib/istio
-+
-+chown -R 1337.1337 /var/log/proxy
-+
-+chown -R 1337.1337 /var/lib/logrotate
-+
-+chown -R 1337.1337 /var/lib/istio
-+
-+cat <<EOF > /etc/logrotate.d/higress-logrotate
-+/var/log/proxy/access.log
-+{
-+su 1337 1337
-+rotate 5
-+create 644 1337 1337
-+nocompress
-+notifempty
-+minsize 100M
-+postrotate
-+    ps aux|grep "envoy -c"|grep -v "grep"|awk  '{print $2}'|xargs -i kill -SIGUSR1 {}
-+endscript
-+}
-+EOF
-+
-+chmod -R 0644 /etc/logrotate.d/higress-logrotate
-+
-+cat <<EOF > /var/lib/istio/cron.txt
-+* * * * * /usr/sbin/logrotate /etc/logrotate.d/higress-logrotate
-+EOF
-diff -Naur istio/tools/packaging/common/higress-proxy-start.sh istio-new/tools/packaging/common/higress-proxy-start.sh
--- istio/tools/packaging/common/higress-proxy-start.sh	1970-01-01 08:00:00.000000000 +0800
-+++ istio-new/tools/packaging/common/higress-proxy-start.sh	2024-05-19 16:33:18.802761176 +0800
-@@ -0,0 +1,10 @@
-+#!/bin/bash
-+
-+if [ -n "$LITE_METRICS" ]; then
-+    cp /var/lib/istio/envoy/envoy_bootstrap_lite_tmpl.json /var/lib/istio/envoy/envoy_bootstrap_tmpl.json
-+fi
-+
-+nohup supercronic /var/lib/istio/cron.txt &> /dev/null &
-+
-+/usr/local/bin/pilot-agent $*
-+
--- a/istio/1.12/patches/istio/20240521-optimize-bootstrap.patch
+++ b/istio/1.12/patches/istio/20240521-optimize-bootstrap.patch
@@ -1,83 +0,0 @@
-diff -Naur istio/tools/packaging/common/envoy_bootstrap.json istio-new/tools/packaging/common/envoy_bootstrap.json
--- istio/tools/packaging/common/envoy_bootstrap.json	2024-05-21 23:46:21.000000000 +0800
-+++ istio-new/tools/packaging/common/envoy_bootstrap.json	2024-05-21 23:47:54.000000000 +0800
-@@ -37,55 +37,15 @@
-     "use_all_default_tags": false,
-     "stats_tags": [
-       {
-        "tag_name": "phase",
-        "regex": "(_phase=([a-z_]+))"
-      },
-      {
-        "tag_name": "ruleid",
-        "regex": "(_ruleid=([0-9]+))"
-      },
-      {
-        "tag_name": "route",
-        "regex": "^vhost\\..*?\\.route\\.([^\\.]+\\.)upstream"
-      },
-      {
-        "tag_name": "ecds_name",
-        "regex": "extension_config_discovery\\.(.*?\\.)[^\\.]+$"
-      },
-      {
-        "tag_name": "rds_name",
-        "regex": "rds\\.(.*?\\.)[^\\.]+$"
-      },
-      {
-        "tag_name": "sds_name",
-        "regex": "sds\\.(.*?\\.)[^\\.]+$"
-      },
-      {
-        "tag_name": "vhost",
-        "regex": "^vhost\\.((.*?)\\.)(vcluster|route)"
-      },
-      {
-        "tag_name": "vcluster",
-        "regex": "vcluster\\.((.*?)\\.)upstream"
-      },
-      {
-        "tag_name": "dest_zone",
-        "regex": "zone\\.[^\\.]+\\.([^\\.]+\\.)"
-      },
-      {
-        "tag_name": "from_zone",
-        "regex": "zone\\.([^\\.]+\\.)"
-      },
-      {
-         "tag_name": "cluster_name",
-        "regex": "^cluster\\.((.*?)\\.)(http1\\.|http2\\.|health_check\\.|zone\\.|external\\.|circuit_breakers\\.|[^\\.]+$)"
-+        "regex": "^cluster\\.((.+?(\\..+?\\.svc\\.cluster\\.local)?)\\.)"
-       },
-       {
-         "tag_name": "tcp_prefix",
-         "regex": "^tcp\\.((.*?)\\.)\\w+?$"
-       },
-       {
-        "regex": "(response_code=\\.=(.+?);\\.;)|_rq(_(\\.d{3}))$",
-+        "regex": "_rq(_(\\d{3}))$",
-         "tag_name": "response_code"
-       },
-       {
-@@ -98,7 +58,7 @@
-       },
-       {
-         "tag_name": "http_conn_manager_prefix",
-        "regex": "^http\\.(((outbound_([0-9]{1,3}\\.{0,1}){4}_\\d{0,5})|([^\\.]+))\\.)"
-+        "regex": "^http\\.(((?:[_.[:digit:]]*|[_\\[\\]aAbBcCdDeEfF[:digit:]]*))\\.)"
-       },
-       {
-         "tag_name": "listener_address",
-@@ -108,12 +68,6 @@
-         "tag_name": "mongo_prefix",
-         "regex": "^mongo\\.(.+?)\\.(collection|cmd|cx_|op_|delays_|decoding_)(.*?)$"
-       },
-      {{- range $a, $tag := .extraStatTags }}
-      {
-        "regex": "({{ $tag }}=\\.=(.*?);\\.;)",
-        "tag_name": "{{ $tag }}"
-      },
-      {{- end }}
-       {
-         "regex": "(cache\\.(.+?)\\.)",
-         "tag_name": "cache"
--- a/istio/1.12/patches/istio/20240527-fix-vs-merge.patch
+++ b/istio/1.12/patches/istio/20240527-fix-vs-merge.patch
@@ -1,69 +0,0 @@
-diff -Naur istio/pilot/pkg/model/push_context.go istio-new/pilot/pkg/model/push_context.go
--- istio/pilot/pkg/model/push_context.go	2024-05-27 23:03:09.000000000 +0800
-+++ istio-new/pilot/pkg/model/push_context.go	2024-05-27 21:33:45.000000000 +0800
-@@ -1482,8 +1482,14 @@
- 		ns := virtualService.Namespace
- 		rule := virtualService.Spec.(*networking.VirtualService)
- 		// Added by ingress
-		for _, host := range rule.Hosts {
-			ps.virtualServiceIndex.byHost[host] = append(ps.virtualServiceIndex.byHost[host], virtualService)
-+		if len(rule.Gateways) > 0 {
-+			if len(rule.Hosts) == 0 {
-+				ps.virtualServiceIndex.byHost[constants.GlobalWildcardHost] = append(ps.virtualServiceIndex.byHost[constants.GlobalWildcardHost], virtualService)
-+			} else {
-+				for _, host := range rule.Hosts {
-+					ps.virtualServiceIndex.byHost[host] = append(ps.virtualServiceIndex.byHost[host], virtualService)
-+				}
-+			}
- 		}
- 		// End added by ingress
- 		gwNames := getGatewayNames(rule)
-diff -Naur istio/pilot/pkg/networking/core/v1alpha3/gateway.go istio-new/pilot/pkg/networking/core/v1alpha3/gateway.go
--- istio/pilot/pkg/networking/core/v1alpha3/gateway.go	2024-05-27 23:03:09.000000000 +0800
-+++ istio-new/pilot/pkg/networking/core/v1alpha3/gateway.go	2024-05-27 22:58:33.000000000 +0800
-@@ -376,8 +376,15 @@
- 					gatewayVirtualServices[gatewayName] = virtualServices
- 				}
- 				for _, virtualService := range virtualServices {
-					for _, host := range virtualService.Spec.(*networking.VirtualService).Hosts {
-						hostSet.Insert(host)
-+					rule := virtualService.Spec.(*networking.VirtualService)
-+					if len(rule.Gateways) > 0 {
-+						if len(rule.Hosts) == 0 {
-+							hostSet.Insert(constants.GlobalWildcardHost)
-+							break
-+						}
-+						for _, host := range rule.Hosts {
-+							hostSet.Insert(host)
-+						}
- 					}
- 				}
- 			}
-@@ -689,7 +696,7 @@
- 			vHost = &route.VirtualHost{
- 				Name:                       util.DomainName(hostRDSHost, port),
- 				Domains:                    buildGatewayVirtualHostDomains(hostRDSHost, port),
-				Routes:                     routes,
-+				Routes:                     append(routes[:0:0], routes...),
- 				IncludeRequestAttemptCount: true,
- 				TypedPerFilterConfig:       mseingress.ConstructTypedPerFilterConfigForVHost(globalHTTPFilters, virtualService),
- 			}
-@@ -884,7 +891,7 @@
- 					newVHost := &route.VirtualHost{
- 						Name:                       util.DomainName(string(hostname), port),
- 						Domains:                    buildGatewayVirtualHostDomains(string(hostname), port),
-						Routes:                     routes,
-+						Routes:                     append(routes[:0:0], routes...),
- 						IncludeRequestAttemptCount: true,
- 						TypedPerFilterConfig:       mseingress.ConstructTypedPerFilterConfigForVHost(globalHTTPFilters, virtualService),
- 					}
-diff -Naur istio/pkg/config/constants/constants.go istio-new/pkg/config/constants/constants.go
--- istio/pkg/config/constants/constants.go	2024-05-27 23:03:09.000000000 +0800
-+++ istio-new/pkg/config/constants/constants.go	2024-05-27 21:31:58.000000000 +0800
-@@ -145,5 +145,6 @@
- 	// Added by ingress
- 	HigressHostRDSNamePrefix = "higress-rds-"
- 	DefaultScopedRouteName   = "scoped-route"
-+	GlobalWildcardHost       = "*"
- 	// End added by ingress
- )
--- a/istio/1.12/patches/istio/20240529-optimize-mcp-cds.patch
+++ b/istio/1.12/patches/istio/20240529-optimize-mcp-cds.patch
@@ -1,17 +0,0 @@
-diff -Naur istio/pilot/pkg/model/push_context.go istio-new/pilot/pkg/model/push_context.go
--- istio/pilot/pkg/model/push_context.go	2024-05-29 19:29:45.000000000 +0800
-+++ istio-new/pilot/pkg/model/push_context.go	2024-05-29 19:11:03.000000000 +0800
-@@ -769,6 +769,13 @@
- 	for _, s := range svcs {
- 		svcHost := string(s.Hostname)
- 
-+		// Added by ingress
-+		if s.Attributes.Namespace == "mcp" {
-+			gwSvcs = append(gwSvcs, s)
-+			continue
-+		}
-+		// End added by ingress
-+
- 		if _, ok := hostsFromGateways[svcHost]; ok {
- 			gwSvcs = append(gwSvcs, s)
- 		}
--- a/istio/1.12/patches/istio/20240607-fix-stats.patch
+++ b/istio/1.12/patches/istio/20240607-fix-stats.patch
@@ -1,21 +0,0 @@
-diff -Naur istio/tools/packaging/common/envoy_bootstrap.json istio-new/tools/packaging/common/envoy_bootstrap.json
--- istio/tools/packaging/common/envoy_bootstrap.json	2024-06-07 16:50:21.000000000 +0800
-+++ istio-new/tools/packaging/common/envoy_bootstrap.json	2024-06-07 16:47:42.000000000 +0800
-@@ -38,7 +38,7 @@
-     "stats_tags": [
-       {
-         "tag_name": "cluster_name",
-        "regex": "^cluster\\.((.+?(\\..+?\\.svc\\.cluster\\.local)?)\\.)"
-+        "regex": "^cluster\\.((.*?)\\.)(http1\\.|http2\\.|health_check\\.|zone\\.|external\\.|circuit_breakers\\.|[^\\.]+$)"
-       },
-       {
-         "tag_name": "tcp_prefix",
-@@ -58,7 +58,7 @@
-       },
-       {
-         "tag_name": "http_conn_manager_prefix",
-        "regex": "^http\\.(((?:[_.[:digit:]]*|[_\\[\\]aAbBcCdDeEfF[:digit:]]*))\\.)"
-+        "regex": "^http\\.(((outbound_([0-9]{1,3}\\.{0,1}){4}_\\d{0,5})|([^\\.]+))\\.)"
-       },
-       {
-         "tag_name": "listener_address",
--- a/istio/1.12/patches/istio/20240619-ai-stats.patch
+++ b/istio/1.12/patches/istio/20240619-ai-stats.patch
@@ -1,53 +0,0 @@
-diff -Naur istio/tools/packaging/common/envoy_bootstrap.json istio-new/tools/packaging/common/envoy_bootstrap.json
--- istio/tools/packaging/common/envoy_bootstrap.json	2024-06-19 13:39:49.179159469 +0800
-+++ istio-new/tools/packaging/common/envoy_bootstrap.json	2024-06-19 13:39:28.299159059 +0800
-@@ -37,6 +37,18 @@
-     "use_all_default_tags": false,
-     "stats_tags": [
-       {
-+          "tag_name": "ai_route",
-+          "regex": "^wasmcustom\\.route\\.((.*?)\\.)upstream"
-+      },
-+      {
-+          "tag_name": "ai_cluster",
-+          "regex": "^wasmcustom\\..*?\\.upstream\\.((.*?)\\.)model"
-+      },
-+      {
-+          "tag_name": "ai_model",
-+          "regex": "^wasmcustom\\..*?\\.model\\.((.*?)\\.)(input_token|output_token)"
-+      },
-+      {
-         "tag_name": "cluster_name",
-         "regex": "^cluster\\.((.*?)\\.)(http1\\.|http2\\.|health_check\\.|zone\\.|external\\.|circuit_breakers\\.|[^\\.]+$)"
-       },
-diff -Naur istio/tools/packaging/common/envoy_bootstrap_lite.json istio-new/tools/packaging/common/envoy_bootstrap_lite.json
--- istio/tools/packaging/common/envoy_bootstrap_lite.json	2024-06-19 13:39:49.175159469 +0800
-+++ istio-new/tools/packaging/common/envoy_bootstrap_lite.json	2024-06-19 13:38:52.283158352 +0800
-@@ -37,6 +37,18 @@
-     "use_all_default_tags": false,
-     "stats_tags": [
-       {
-+          "tag_name": "ai_route",
-+          "regex": "^wasmcustom\\.route\\.((.*?)\\.)upstream"
-+      },
-+      {
-+          "tag_name": "ai_cluster",
-+          "regex": "^wasmcustom\\..*?\\.upstream\\.((.*?)\\.)model"
-+      },
-+      {
-+          "tag_name": "ai_model",
-+          "regex": "^wasmcustom\\..*?\\.model\\.((.*?)\\.)(input_token|output_token)"
-+      },
-+      {
-         "tag_name": "response_code_class",
-         "regex": "_rq(_(\\dxx))$"
-       },
-@@ -60,7 +72,7 @@
-             "prefix": "vhost"
-           },
-           {
-            "safe_regex": {"regex": "^http.*rds.*", "google_re2":{}}
-+            "safe_regex": {"regex": "^http.*\\.rds\\..*", "google_re2":{}}
-           }
-         ]
-       }
--- a/istio/1.12/patches/pkg/20221027-init.patch
+++ b/istio/1.12/patches/pkg/20221027-init.patch
@@ -1,74 +0,0 @@
-diff --git a/log/config.go b/log/config.go
-index f0d9c0c..8e008c9 100644
--- a/log/config.go
-+++ b/log/config.go
-@@ -141,6 +141,12 @@ func prepZap(options *Options) (zapcore.Core, zapcore.Core, zapcore.WriteSyncer,
- 	} else {
- 		encCfg := defaultEncoderConfig
- 
-+		// Added by ingress
-+		// Support local time format
-+		if options.LocalTime {
-+			encCfg.EncodeTime = formatLocalDate
-+		}
-+
- 		if options.JSONEncoding {
- 			enc = zapcore.NewJSONEncoder(encCfg)
- 			useJSON.Store(true)
-@@ -239,6 +245,42 @@ func formatDate(t time.Time, enc zapcore.PrimitiveArrayEncoder) {
- 	enc.AppendString(string(buf))
- }
- 
-+func formatLocalDate(t time.Time, enc zapcore.PrimitiveArrayEncoder) {
-+	t = t.Local()
-+	year, month, day := t.Date()
-+	hour, minute, second := t.Clock()
-+	micros := t.Nanosecond() / 1000
-+	buf := make([]byte, 27)
-+	buf[0] = byte((year/1000)%10) + '0'
-+	buf[1] = byte((year/100)%10) + '0'
-+	buf[2] = byte((year/10)%10) + '0'
-+	buf[3] = byte(year%10) + '0'
-+	buf[4] = '-'
-+	buf[5] = byte((month)/10) + '0'
-+	buf[6] = byte((month)%10) + '0'
-+	buf[7] = '-'
-+	buf[8] = byte((day)/10) + '0'
-+	buf[9] = byte((day)%10) + '0'
-+	buf[10] = 'T'
-+	buf[11] = byte((hour)/10) + '0'
-+	buf[12] = byte((hour)%10) + '0'
-+	buf[13] = ':'
-+	buf[14] = byte((minute)/10) + '0'
-+	buf[15] = byte((minute)%10) + '0'
-+	buf[16] = ':'
-+	buf[17] = byte((second)/10) + '0'
-+	buf[18] = byte((second)%10) + '0'
-+	buf[19] = '.'
-+	buf[20] = byte((micros/100000)%10) + '0'
-+	buf[21] = byte((micros/10000)%10) + '0'
-+	buf[22] = byte((micros/1000)%10) + '0'
-+	buf[23] = byte((micros/100)%10) + '0'
-+	buf[24] = byte((micros/10)%10) + '0'
-+	buf[25] = byte((micros)%10) + '0'
-+	buf[26] = 'Z'
-+	enc.AppendString(string(buf))
-+}
-+
- func updateScopes(options *Options) error {
- 	// snapshot what's there
- 	allScopes := Scopes()
-diff --git a/log/options.go b/log/options.go
-index e1833fe..999e4b2 100644
--- a/log/options.go
-+++ b/log/options.go
-@@ -133,6 +133,9 @@ type Options struct {
- 	teeToUDSServer   bool
- 	udsSocketAddress string
- 	udsServerPath    string
-+
-+	// localTime determines whether the time format of istio log is local time format.
-+	LocalTime bool
- }
- 
- // DefaultOptions returns a new set of options, initialized to the defaults
--- a/istio/1.12/patches/proxy/20221027-init.patch
+++ b/istio/1.12/patches/proxy/20221027-init.patch
@@ -1,309 +0,0 @@
-diff --git a/Makefile.core.mk b/Makefile.core.mk
-index 60709804..ba73de92 100644
--- a/Makefile.core.mk
-+++ b/Makefile.core.mk
-@@ -206,6 +206,10 @@ test_release_centos:
- push_release: build
- 	export PATH=$(PATH) CC=$(CC) CXX=$(CXX) BAZEL_BUILD_ARGS="$(BAZEL_BUILD_ARGS)" && ./scripts/release-binary.sh -d "$(RELEASE_GCS_PATH)" -p
- 
-+push_release_simple: build
-+	export PATH=$(PATH) CC=$(CC) CXX=$(CXX) BAZEL_BUILD_ARGS="$(BAZEL_BUILD_ARGS)" && ./scripts/release-binary.sh -p
-+
-+
- push_release_centos:
- 	export PATH=$(PATH) CC=$(CC) CXX=$(CXX) BAZEL_BUILD_ARGS="$(BAZEL_BUILD_ARGS) $(CENTOS_BUILD_ARGS)" BUILD_ENVOY_BINARY_ONLY=1 BASE_BINARY_NAME=envoy-centos && ./scripts/release-binary.sh -c -d "$(RELEASE_GCS_PATH)"
- 
-diff --git a/WORKSPACE b/WORKSPACE
-index 0455bd98..0d248bed 100644
--- a/WORKSPACE
-+++ b/WORKSPACE
-@@ -49,11 +49,16 @@ ENVOY_REPO = "envoy"
- 
- # To override with local envoy, just pass `--override_repository=envoy=/PATH/TO/ENVOY` to Bazel or
- # persist the option in `user.bazelrc`.
-http_archive(
-+# http_archive(
-+#     name = "envoy",
-+#     sha256 = ENVOY_SHA256,
-+#     strip_prefix = ENVOY_REPO + "-" + ENVOY_SHA,
-+#     url = "https://github.com/" + ENVOY_ORG + "/" + ENVOY_REPO + "/archive/" + ENVOY_SHA + ".tar.gz",
-+# )
-+
-+local_repository(
-     name = "envoy",
-    sha256 = ENVOY_SHA256,
-    strip_prefix = ENVOY_REPO + "-" + ENVOY_SHA,
-    url = "https://github.com/" + ENVOY_ORG + "/" + ENVOY_REPO + "/archive/" + ENVOY_SHA + ".tar.gz",
-+    path = "../envoy",
- )
- 
- load("@envoy//bazel:api_binding.bzl", "envoy_api_binding")
-diff --git a/bazel/extension_config/extensions_build_config.bzl b/bazel/extension_config/extensions_build_config.bzl
-index 07003785..f0a56715 100644
--- a/bazel/extension_config/extensions_build_config.bzl
-+++ b/bazel/extension_config/extensions_build_config.bzl
-@@ -342,6 +342,11 @@ ENVOY_CONTRIB_EXTENSIONS = {
-     #
- 
-     "envoy.bootstrap.vcl":                                      "//contrib/vcl/source:config",
-+
-+    # waf extension
-+
-+    # Custom cluster plugins
-+    "envoy.router.cluster_specifier_plugin.cluster_fallback":   "//contrib/custom_cluster_plugins/cluster_fallback/source:config",
- }
- 
- 
-@@ -362,6 +367,7 @@ ISTIO_ENABLED_CONTRIB_EXTENSIONS = [
-     "envoy.filters.network.sip_proxy",
-     "envoy.filters.sip.router",
-     "envoy.tls.key_providers.cryptomb",
-+    "envoy.router.cluster_specifier_plugin.cluster_fallback",
- ]
- 
- EXTENSIONS = dict([(k,v) for k,v in ENVOY_EXTENSIONS.items() if not k in ISTIO_DISABLED_EXTENSIONS] +
-diff --git a/common/scripts/run.sh b/common/scripts/run.sh
-index 271fe77a..79e43d7b 100755
--- a/common/scripts/run.sh
-+++ b/common/scripts/run.sh
-@@ -36,6 +36,10 @@ export REPO_ROOT=/work
- 
- MOUNT_SOURCE="${MOUNT_SOURCE:-${PWD}}"
- MOUNT_DEST="${MOUNT_DEST:-/work}"
-+CONTAINER_OPTIONS="${CONTAINER_OPTIONS:---net=host}"
-+MOUNT_ENVOY_SOURCE="${MOUNT_ENVOY_SOURCE:-`cd $MOUNT_SOURCE/../envoy;pwd`}"
-+MOUNT_PACKAGE_SOURCE="${MOUNT_PACKAGE_SOURCE:-`cd $MOUNT_SOURCE/../package;pwd`}"
-+MOUNT_ROOT_SOURCE="${MOUNT_ROOT_SOURCE:-`cd $MOUNT_SOURCE/..;pwd`}"
- 
- read -ra DOCKER_RUN_OPTIONS <<< "${DOCKER_RUN_OPTIONS:-}"
- 
-@@ -55,7 +59,11 @@ read -ra DOCKER_RUN_OPTIONS <<< "${DOCKER_RUN_OPTIONS:-}"
-     --env-file <(env | grep -v ${ENV_BLOCKLIST}) \
-     -e IN_BUILD_CONTAINER=1 \
-     -e TZ="${TIMEZONE:-$TZ}" \
-+    --mount "type=bind,source=${MOUNT_PACKAGE_SOURCE},destination=/home/package" \
-+    --mount "type=bind,source=${HOME}/.docker,destination=/home/.docker" \
-     --mount "type=bind,source=${MOUNT_SOURCE},destination=/work" \
-+    --mount "type=bind,source=${MOUNT_ROOT_SOURCE}/..,destination=/parent" \
-+    --mount "type=bind,source=${MOUNT_ENVOY_SOURCE},destination=/envoy" \
-     --mount "type=volume,source=go,destination=/go" \
-     --mount "type=volume,source=gocache,destination=/gocache" \
-     --mount "type=volume,source=cache,destination=/home/.cache" \
-diff --git a/common/scripts/setup_env.sh b/common/scripts/setup_env.sh
-index 4a5e80bb..f6174941 100755
--- a/common/scripts/setup_env.sh
-+++ b/common/scripts/setup_env.sh
-@@ -84,7 +84,8 @@ export TARGET_OUT_LINUX="${TARGET_OUT_LINUX:-$(pwd)/out/linux_${TARGET_ARCH}}"
- export CONTAINER_TARGET_OUT="${CONTAINER_TARGET_OUT:-/work/out/${TARGET_OS}_${TARGET_ARCH}}"
- export CONTAINER_TARGET_OUT_LINUX="${CONTAINER_TARGET_OUT_LINUX:-/work/out/linux_${TARGET_ARCH}}"
- 
-export IMG="${IMG:-gcr.io/istio-testing/${IMAGE_NAME}:${IMAGE_VERSION}}"
-+#export IMG="${IMG:-gcr.io/istio-testing/${IMAGE_NAME}:${IMAGE_VERSION}}"
-+export IMG="${IMG:-higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/${IMAGE_NAME}:${IMAGE_VERSION}}"
- 
- export CONTAINER_CLI="${CONTAINER_CLI:-docker}"
- 
-diff --git a/scripts/release-binary.sh b/scripts/release-binary.sh
-index 7059f5c1..8673b982 100755
--- a/scripts/release-binary.sh
-+++ b/scripts/release-binary.sh
-@@ -19,7 +19,7 @@
- set -ex
- 
- # Use clang for the release builds.
-export PATH=/usr/lib/llvm-10/bin:$PATH
-+export PATH=/usr/lib/llvm/bin:$PATH
- export CC=${CC:-clang}
- export CXX=${CXX:-clang++}
- 
-@@ -98,25 +98,26 @@ fi
- # The proxy binary name.
- SHA="$(git rev-parse --verify HEAD)"
- 
-if [ -n "${DST}" ]; then
-  # If binary already exists skip.
-  # Use the name of the last artifact to make sure that everything was uploaded.
-  BINARY_NAME="${HOME}/istio-proxy-debug-${SHA}.deb"
-  gsutil stat "${DST}/${BINARY_NAME}" \
-    && { echo 'Binary already exists'; exit 0; } \
-    || echo 'Building a new binary.'
-fi
-+# if [ -n "${DST}" ]; then
-+#   # If binary already exists skip.
-+#   # Use the name of the last artifact to make sure that everything was uploaded.
-+#   BINARY_NAME="${HOME}/istio-proxy-debug-${SHA}.deb"
-+#   gsutil stat "${DST}/${BINARY_NAME}" \
-+#     && { echo 'Binary already exists'; exit 0; } \
-+#     || echo 'Building a new binary.'
-+# fi
- 
- # BAZEL_OUT: Symlinks don't work, use full path as a temporary workaround.
- # See: https://github.com/istio/istio/issues/15714 for details.
- # k8-opt is the output directory for x86_64 optimized builds (-c opt, so --config=release-symbol and --config=release).
- # k8-dbg is the output directory for -c dbg builds.
-for config in release release-symbol debug
-+#for config in release release-symbol debug
-+for config in release
- do
-   case $config in
-     "release" )
-       CONFIG_PARAMS="--config=release"
-      BINARY_BASE_NAME="${BASE_BINARY_NAME}-alpha"
-+      BINARY_BASE_NAME="${BASE_BINARY_NAME}"
-       PACKAGE_BASE_NAME="istio-proxy"
-       # shellcheck disable=SC2086
-       BAZEL_OUT="$(bazel info ${BAZEL_BUILD_ARGS} output_path)/k8-opt/bin"
-@@ -149,7 +150,7 @@ do
-   export BUILD_CONFIG=${config}
- 
-   echo "Building ${config} proxy"
-  BINARY_NAME="${HOME}/${BINARY_BASE_NAME}-${SHA}.tar.gz"
-+  BINARY_NAME="${HOME}/package/${BINARY_BASE_NAME}.tar.gz"
-   SHA256_NAME="${HOME}/${BINARY_BASE_NAME}-${SHA}.sha256"
-   # All cores are used by com_googlesource_chromium_v8:build within. 
-   # Prebuild this target to avoid stacking this ram intensive task with others.
-@@ -174,14 +175,12 @@ do
-   echo "Building ${config} docker image"
-   # shellcheck disable=SC2086
-   bazel build ${BAZEL_BUILD_ARGS} ${CONFIG_PARAMS} \
-    //tools/docker:envoy_distroless \
-     //tools/docker:envoy_ubuntu
- 
-   if [ "${PUSH_DOCKER_IMAGE}" -eq 1 ]; then
-     echo "Pushing ${config} docker image"
-     # shellcheck disable=SC2086
-     bazel run ${BAZEL_BUILD_ARGS} ${CONFIG_PARAMS} \
-      //tools/docker:push_envoy_distroless \
-       //tools/docker:push_envoy_ubuntu
-   fi
- 
-@@ -209,36 +208,36 @@ if [ "${BUILD_ENVOY_BINARY_ONLY}" -eq 1 ]; then
- fi
- 
- # Build and publish Wasm plugins
-extensions=(stats metadata_exchange attributegen)
-TMP_WASM=$(mktemp -d -t wasm-plugins-XXXXXXXXXX)
-trap 'rm -rf ${TMP_WASM}' EXIT
-make build_wasm
-if [ -n "${DST}" ]; then
-  for extension in "${extensions[@]}"; do
-    # Rename the plugin file and generate sha256 for it
-    WASM_NAME="${extension}-${SHA}.wasm"
-    WASM_COMPILED_NAME="${extension}-${SHA}.compiled.wasm"
-    WASM_PATH="${TMP_WASM}/${WASM_NAME}"
-    WASM_COMPILED_PATH="${TMP_WASM}/${WASM_COMPILED_NAME}"
-    SHA256_PATH="${WASM_PATH}.sha256"
-    SHA256_COMPILED_PATH="${WASM_COMPILED_PATH}.sha256"
-    # shellcheck disable=SC2086
-    BAZEL_TARGET=$(bazel info ${BAZEL_BUILD_ARGS} output_path)/k8-opt/bin/extensions/${extension}.wasm
-    # shellcheck disable=SC2086
-    BAZEL_COMPILED_TARGET=$(bazel info ${BAZEL_BUILD_ARGS} output_path)/k8-opt/bin/extensions/${extension}.compiled.wasm
-    cp "${BAZEL_TARGET}" "${WASM_PATH}"
-    cp "${BAZEL_COMPILED_TARGET}" "${WASM_COMPILED_PATH}"
-    sha256sum "${WASM_PATH}" > "${SHA256_PATH}"
-    sha256sum "${WASM_COMPILED_PATH}" > "${SHA256_COMPILED_PATH}"
-+# extensions=(stats metadata_exchange attributegen)
-+# TMP_WASM=$(mktemp -d -t wasm-plugins-XXXXXXXXXX)
-+# trap 'rm -rf ${TMP_WASM}' EXIT
-+# make build_wasm
-+# if [ -n "${DST}" ]; then
-+#   for extension in "${extensions[@]}"; do
-+#     # Rename the plugin file and generate sha256 for it
-+#     WASM_NAME="${extension}-${SHA}.wasm"
-+#     WASM_COMPILED_NAME="${extension}-${SHA}.compiled.wasm"
-+#     WASM_PATH="${TMP_WASM}/${WASM_NAME}"
-+#     WASM_COMPILED_PATH="${TMP_WASM}/${WASM_COMPILED_NAME}"
-+#     SHA256_PATH="${WASM_PATH}.sha256"
-+#     SHA256_COMPILED_PATH="${WASM_COMPILED_PATH}.sha256"
-+#     # shellcheck disable=SC2086
-+#     BAZEL_TARGET=$(bazel info ${BAZEL_BUILD_ARGS} output_path)/k8-opt/bin/extensions/${extension}.wasm
-+#     # shellcheck disable=SC2086
-+#     BAZEL_COMPILED_TARGET=$(bazel info ${BAZEL_BUILD_ARGS} output_path)/k8-opt/bin/extensions/${extension}.compiled.wasm
-+#     cp "${BAZEL_TARGET}" "${WASM_PATH}"
-+#     cp "${BAZEL_COMPILED_TARGET}" "${WASM_COMPILED_PATH}"
-+#     sha256sum "${WASM_PATH}" > "${SHA256_PATH}"
-+#     sha256sum "${WASM_COMPILED_PATH}" > "${SHA256_COMPILED_PATH}"
-     
-    # push wasm files and sha to the given bucket
-    gsutil stat "${DST}/${WASM_NAME}" \
-      && { echo "WASM file ${WASM_NAME} already exist"; continue; } \
-      || echo "Pushing the WASM file ${WASM_NAME}"
-    gsutil stat "${DST}/${WASM_COMPILED_NAME}" \
-      && { echo "WASM file ${WASM_COMPILED_NAME} already exist"; continue; } \
-      || echo "Pushing the WASM file ${WASM_COMPILED_NAME}"
-    gsutil cp "${WASM_PATH}" "${SHA256_PATH}" "${DST}"
-    gsutil cp "${WASM_COMPILED_PATH}" "${SHA256_COMPILED_PATH}" "${DST}"
-  done
-fi
-+#     # push wasm files and sha to the given bucket
-+#     gsutil stat "${DST}/${WASM_NAME}" \
-+#       && { echo "WASM file ${WASM_NAME} already exist"; continue; } \
-+#       || echo "Pushing the WASM file ${WASM_NAME}"
-+#     gsutil stat "${DST}/${WASM_COMPILED_NAME}" \
-+#       && { echo "WASM file ${WASM_COMPILED_NAME} already exist"; continue; } \
-+#       || echo "Pushing the WASM file ${WASM_COMPILED_NAME}"
-+#     gsutil cp "${WASM_PATH}" "${SHA256_PATH}" "${DST}"
-+#     gsutil cp "${WASM_COMPILED_PATH}" "${SHA256_COMPILED_PATH}" "${DST}"
-+#   done
-+# fi
-diff --git a/src/envoy/BUILD b/src/envoy/BUILD
-index 5f35b0f7..671640cb 100644
--- a/src/envoy/BUILD
-+++ b/src/envoy/BUILD
-@@ -18,6 +18,15 @@ load("@rules_pkg//:pkg.bzl", "pkg_tar")
- load(
-     "@envoy//bazel:envoy_build_system.bzl",
-     "envoy_cc_binary",
-+    "envoy_cc_contrib_extension",
-+    "envoy_cc_library",
-+    "envoy_contrib_package",
-+)
-+load(
-+    "@envoy//contrib:all_contrib_extensions.bzl",
-+    "ARM64_SKIP_CONTRIB_TARGETS",
-+    "PPC_SKIP_CONTRIB_TARGETS",
-+    "envoy_all_contrib_extensions",
- )
- 
- envoy_cc_binary(
-@@ -37,6 +46,18 @@ envoy_cc_binary(
-         "//src/envoy/tcp/sni_verifier:config_lib",
-         "//src/envoy/tcp/tcp_cluster_rewrite:config_lib",
-         "@envoy//source/exe:envoy_main_entry_lib",
-+    ] + [
-+        "@envoy//contrib/custom_cluster_plugins/cluster_fallback/source:config",
-+        "@envoy//contrib/http_dubbo_transcoder/filters/http/source:config",
-+        "@envoy//contrib/kafka/filters/network/source:kafka_broker_config_lib",
-+        "@envoy//contrib/kafka/filters/network/source/mesh:config_lib",
-+        "@envoy//contrib/mysql_proxy/filters/network/source:config",
-+        "@envoy//contrib/postgres_proxy/filters/network/source:config",
-+        "@envoy//contrib/rocketmq_proxy/filters/network/source:config",
-+        "@envoy//contrib/sip_proxy/filters/network/source:config",
-+        "@envoy//contrib/sip_proxy/filters/network/source/router:config",
-+        "@envoy//contrib/squash/filters/http/source:config",
-+        "@envoy//contrib/upstreams/http/dubbo_tcp/source:config"
-     ],
- )
- 
-diff --git a/tools/docker/BUILD b/tools/docker/BUILD
-index d5a6e5fd..f949c13f 100644
--- a/tools/docker/BUILD
-+++ b/tools/docker/BUILD
-@@ -36,7 +36,7 @@ container_push(
-     name = "push_envoy_distroless",
-     format = "Docker",
-     image = ":envoy_distroless",
-    registry = "gcr.io",
-+    registry = "registry.cn-hangzhou.aliyuncs.com",
-     repository = "{DOCKER_REPOSITORY}",
-     tag = "{BUILD_CONFIG}-{BUILD_SCM_REVISION}",
- )
-@@ -45,7 +45,7 @@ container_push(
-     name = "push_envoy_ubuntu",
-     format = "Docker",
-     image = ":envoy_ubuntu",
-    registry = "gcr.io",
-+    registry = "registry.cn-hangzhou.aliyuncs.com",
-     repository = "{DOCKER_REPOSITORY}",
-     tag = "ubuntu-{BUILD_CONFIG}-{BUILD_SCM_REVISION}",
- )
--- a/istio/1.12/patches/proxy/20230408-build-extensions.patch
+++ b/istio/1.12/patches/proxy/20230408-build-extensions.patch
@@ -1,19 +0,0 @@
-diff -Naur proxy/common/scripts/run.sh proxy-new/common/scripts/run.sh
--- proxy/common/scripts/run.sh	2023-04-08 21:12:05.896147208 +0800
-+++ proxy-new/common/scripts/run.sh	2023-04-08 20:33:51.935437889 +0800
-@@ -40,6 +40,7 @@
- MOUNT_ENVOY_SOURCE="${MOUNT_ENVOY_SOURCE:-`cd $MOUNT_SOURCE/../envoy;pwd`}"
- MOUNT_PACKAGE_SOURCE="${MOUNT_PACKAGE_SOURCE:-`cd $MOUNT_SOURCE/../package;pwd`}"
- MOUNT_ROOT_SOURCE="${MOUNT_ROOT_SOURCE:-`cd $MOUNT_SOURCE/..;pwd`}"
-+MOUNT_PLUGINS_SOURCE="${MOUNT_PLUGINS_SOURCE:-`cd $MOUNT_SOURCE/../../plugins/wasm-cpp;pwd`}"
- 
- read -ra DOCKER_RUN_OPTIONS <<< "${DOCKER_RUN_OPTIONS:-}"
- 
-@@ -64,6 +65,7 @@
-     --mount "type=bind,source=${MOUNT_SOURCE},destination=/work" \
-     --mount "type=bind,source=${MOUNT_ROOT_SOURCE}/..,destination=/parent" \
-     --mount "type=bind,source=${MOUNT_ENVOY_SOURCE},destination=/envoy" \
-+    --mount "type=bind,source=${MOUNT_PLUGINS_SOURCE},destination=/wasm-cpp" \
-     --mount "type=volume,source=go,destination=/go" \
-     --mount "type=volume,source=gocache,destination=/gocache" \
-     --mount "type=volume,source=cache,destination=/home/.cache" \
--- a/istio/1.12/patches/proxy/20240519-v8-upgrade.patch
+++ b/istio/1.12/patches/proxy/20240519-v8-upgrade.patch
@@ -1,38 +0,0 @@
-diff -Naur proxy/scripts/release-binary.sh proxy-new/scripts/release-binary.sh
--- proxy/scripts/release-binary.sh     2024-05-19 12:33:33.254478650 +0800
-+++ proxy-new/scripts/release-binary.sh 2024-05-19 12:31:11.714475870 +0800
-@@ -112,7 +112,7 @@
- # k8-opt is the output directory for x86_64 optimized builds (-c opt, so --config=release-symbol and --config=release).
- # k8-dbg is the output directory for -c dbg builds.
- #for config in release release-symbol debug
-for config in release
-+for config in release release-symbol
- do
-   case $config in
-     "release" )
-diff -Naur proxy/scripts/release-binary.sh proxy-new/scripts/release-binary.sh
--- proxy/scripts/release-binary.sh	2024-05-19 12:27:51.030471929 +0800
-+++ proxy-new/scripts/release-binary.sh	2024-05-19 12:04:55.738444918 +0800
-@@ -152,10 +152,6 @@
-   echo "Building ${config} proxy"
-   BINARY_NAME="${HOME}/package/${BINARY_BASE_NAME}.tar.gz"
-   SHA256_NAME="${HOME}/${BINARY_BASE_NAME}-${SHA}.sha256"
-  # All cores are used by com_googlesource_chromium_v8:build within. 
-  # Prebuild this target to avoid stacking this ram intensive task with others.
-  # shellcheck disable=SC2086
-  bazel build ${BAZEL_BUILD_ARGS} ${CONFIG_PARAMS} @com_googlesource_chromium_v8//:build
-   # shellcheck disable=SC2086
-   bazel build ${BAZEL_BUILD_ARGS} ${CONFIG_PARAMS} //src/envoy:envoy_tar
-   BAZEL_TARGET="${BAZEL_OUT}/src/envoy/envoy_tar.tar.gz"
-diff -Naur proxy/tools/deb/test/build_docker.sh proxy-new/tools/deb/test/build_docker.sh
--- proxy/tools/deb/test/build_docker.sh	2024-05-19 12:27:51.030471929 +0800
-+++ proxy-new/tools/deb/test/build_docker.sh	2024-05-19 12:05:07.978445159 +0800
-@@ -20,8 +20,6 @@
- # Script requires a working docker on the test machine
- # It is run in the proxy dir, will create a docker image with proxy deb installed
- 
-
-bazel build @com_googlesource_chromium_v8//:build
- bazel build tools/deb:istio-proxy
- 
- PROJECT="istio-testing"
--- a/istio/istio
+++ b/istio/istio