fix mcpbridge endpoint port (#1382)

Co-authored-by: Kent Dong <ch3cho@qq.com>

.github/workflows/build-and-push-wasm-plugin-image.yaml

@@ -0,0 +1,115 @@
+name: Build and Push Wasm Plugin Image
+
+on:
+  push:
+    tags:
+    - "wasm-go-*-v*.*.*" # 匹配 wasm-go-{pluginName}-vX.Y.Z 格式的标签
+  workflow_dispatch:
+    inputs:
+      plugin_name:
+        description: 'Name of the plugin'
+        required: true
+        type: string
+      version:
+        description: 'Version of the plugin (optional, without leading v)'
+        required: false
+        type: string
+
+jobs:
+  build-and-push-wasm-plugin-image:
+    runs-on: ubuntu-latest
+    environment:
+      name: image-registry-msg
+    env:
+      IMAGE_REGISTRY_SERVICE: ${{ vars.IMAGE_REGISTRY || 'higress-registry.cn-hangzhou.cr.aliyuncs.com' }}
+      IMAGE_REPOSITORY: ${{ vars.PLUGIN_IMAGE_REPOSITORY || 'plugins' }}
+      GO_VERSION: 1.19
+      TINYGO_VERSION: 0.28.1
+      ORAS_VERSION: 1.0.0
+    steps:
+      - name: Set plugin_name and version from inputs or ref_name
+        id: set_vars
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            plugin_name="${{ github.event.inputs.plugin_name }}"
+            version="${{ github.event.inputs.version }}"
+          else
+            ref_name=${{ github.ref_name }}
+            plugin_name=${ref_name#*-*-} # 删除插件名前面的字段(wasm-go-)
+            plugin_name=${plugin_name%-*} # 删除插件名后面的字段(-vX.Y.Z)
+            version=$(echo "$ref_name" | awk -F'v' '{print $2}')
+          fi
+
+          echo "PLUGIN_NAME=$plugin_name" >> $GITHUB_ENV
+          echo "VERSION=$version" >> $GITHUB_ENV
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+      
+      - name: File Check
+        run: | 
+          workspace=${{ github.workspace }}/plugins/wasm-go/extensions/${PLUGIN_NAME}
+          push_command="./plugin.tar.gz:application/vnd.oci.image.layer.v1.tar+gzip"
+
+          # 查找spec.yaml
+          if [ -f "${workspace}/spec.yaml" ]; then
+            echo "spec.yaml exists"
+            push_command="./spec.yaml:application/vnd.module.wasm.spec.v1+yaml $push_command "
+          fi
+
+          # 查找README.md
+          if [ -f "${workspace}/README.md" ];then
+              echo "README.md exists"
+              push_command="./README.md:application/vnd.module.wasm.doc.v1+markdown $push_command "
+          fi
+          
+          # 查找README_{lang}.md
+          for file in ${workspace}/README_*.md; do
+            if [ -f "$file" ]; then
+              file_name=$(basename $file)
+              echo "$file_name exists"
+              lang=$(basename $file | sed 's/README_//; s/.md//')
+              push_command="./$file_name:application/vnd.module.wasm.doc.v1.$lang+markdown $push_command "
+            fi
+          done
+
+          echo "PUSH_COMMAND=\"$push_command\"" >> $GITHUB_ENV
+        
+      - name: Run a wasm-go-builder
+        env: 
+          PLUGIN_NAME: ${{ env.PLUGIN_NAME }}
+          BUILDER_IMAGE: higress-registry.cn-hangzhou.cr.aliyuncs.com/plugins/wasm-go-builder:go${{ env.GO_VERSION }}-tinygo${{ env.TINYGO_VERSION }}-oras${{ env.ORAS_VERSION }}
+        run: |
+          docker run -itd --name builder -v ${{ github.workspace }}:/workspace -e PLUGIN_NAME=${{ env.PLUGIN_NAME }} --rm ${{ env.BUILDER_IMAGE }} /bin/bash
+
+      - name: Build Image and Push
+        run: |
+          push_command=${{ env.PUSH_COMMAND }}
+          push_command=${push_command#\"}
+          push_command=${push_command%\"} # 删除PUSH_COMMAND中的双引号，确保oras push正常解析
+          
+          target_image="${{ env.IMAGE_REGISTRY_SERVICE }}/${{ env.IMAGE_REPOSITORY}}/${{ env.PLUGIN_NAME }}:${{ env.VERSION }}"
+          target_image_latest="${{ env.IMAGE_REGISTRY_SERVICE }}/${{ env.IMAGE_REPOSITORY}}/${{ env.PLUGIN_NAME }}:latest"
+          echo "TargetImage=${target_image}"
+          echo "TargetImageLatest=${target_image_latest}"
+
+          cd ${{ github.workspace }}/plugins/wasm-go/extensions/${PLUGIN_NAME}
+          if [ -f ./.buildrc ]; then
+            echo 'Found .buildrc file, sourcing it...'
+            . ./.buildrc
+          else
+            echo '.buildrc file not found'
+          fi
+          echo "EXTRA_TAGS=${EXTRA_TAGS}"
+
+          command="
+          set -e
+          cd /workspace/plugins/wasm-go/extensions/${PLUGIN_NAME}
+          go mod tidy
+          tinygo build -o ./plugin.wasm -scheduler=none -target=wasi -gc=custom -tags=\"custommalloc nottinygc_finalizer ${EXTRA_TAGS}\" .
+          tar czvf plugin.tar.gz plugin.wasm
+          echo ${{ secrets.REGISTRY_PASSWORD }} | oras login -u ${{ secrets.REGISTRY_USERNAME }} --password-stdin ${{ env.IMAGE_REGISTRY_SERVICE }}
+          oras push ${target_image} ${push_command}
+          oras push ${target_image_latest} ${push_command}
+          "
+          docker exec builder bash -c "$command"

.github/workflows/build-and-test-plugin.yaml

@@ -11,15 +11,16 @@ on:
     paths:
       - 'plugins/**'
       - 'test/**'
+  workflow_dispatch: ~      
 
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
         with:
-          go-version: 1.19
+          go-version: 1.21.5
     # There are too many lint errors in current code bases
     # uncomment when we decide what lint should be addressed or ignored.
     # - run: make lint
@@ -29,9 +30,9 @@ jobs:
     strategy:
       matrix:
         # TODO(Xunzhuo): Enable C WASM Filters in CI
-        wasmPluginType: [ GO ]
+        wasmPluginType: [ GO, RUST ]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Free Up GitHub Actions Ubuntu Runner Disk Space 🔧
         uses: jlumbroso/free-disk-space@main
@@ -44,12 +45,17 @@ jobs:
           swap-storage: true      
 
       - name: "Setup Go"
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: 1.19
+          go-version: 1.21.5
 
+      - name: Setup Rust
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+        if: matrix.wasmPluginType == 'RUST'
       - name: Setup Golang Caches
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |-
             ~/.cache/go-build
@@ -58,14 +64,6 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-go
 
-      - name: Setup Submodule Caches
-        uses: actions/cache@v3
-        with:
-          path: |-
-            .git/modules
-          key: ${{ runner.os }}-submodules-cache-${{ github.run_id }}
-          restore-keys: ${{ runner.os }}-submodules-cache
-
       - run: git stash # restore patch
 
       - name: "Run Ingress WasmPlugins Tests"
@@ -80,4 +78,4 @@ jobs:
     runs-on: ubuntu-latest
     needs: [ higress-wasmplugin-test ]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4

.github/workflows/build-and-test.yaml

@@ -10,10 +10,10 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-go@v3
+    - uses: actions/checkout@v4
+    - uses: actions/setup-go@v5
       with:
-        go-version: 1.19
+        go-version: 1.21.5
     # There are too many lint errors in current code bases
     # uncomment when we decide what lint should be addressed or ignored.
     # - run: make lint
@@ -21,10 +21,15 @@ jobs:
   coverage-test:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
+
+    - name: "Setup Go"
+      uses: actions/setup-go@v5
+      with:
+        go-version: 1.21.5
 
     - name: Setup Golang Caches
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: |-
           ~/.cache/go-build
@@ -32,23 +37,17 @@ jobs:
         key: ${{ runner.os }}-go-${{ github.run_id }}
         restore-keys: ${{ runner.os }}-go
 
-    - name: Setup Submodule Caches
-      uses: actions/cache@v3
-      with:
-        path: |-
-            .git/modules
-        key: ${{ runner.os }}-submodules-cache-${{ github.run_id }}
-        restore-keys: ${{ runner.os }}-submodules-cache
-    
     - run: git stash # restore patch
 
     # test
     - name: Run Coverage Tests
-      run: GOPROXY="https://proxy.golang.org,direct" make go.test.coverage
+      run: |-
+        go version
+        GOPROXY="https://proxy.golang.org,direct" make go.test.coverage
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@v4
       with:
-        fail_ci_if_error: true
+        fail_ci_if_error: false
         files: ./coverage.xml
         verbose: true
 
@@ -58,17 +57,17 @@ jobs:
     needs: [lint,coverage-test]
     steps:
       - name: "Checkout ${{ github.ref }}"
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 2
 
       - name: "Setup Go"
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: 1.19
+          go-version: 1.21.5
 
       - name: Setup Golang Caches
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |-
             ~/.cache/go-build
@@ -76,21 +75,13 @@ jobs:
           key: ${{ runner.os }}-go-${{ github.run_id }}
           restore-keys: ${{ runner.os }}-go
 
-      - name: Setup Submodule Caches
-        uses: actions/cache@v3
-        with:
-          path: |-
-            .git/modules
-          key: ${{ runner.os }}-submodules-cache-${{ github.run_id }}
-          restore-keys: ${{ runner.os }}-submodules-cache
-
       - run: git stash # restore patch
 
       - name: "Build Higress Binary"
         run: GOPROXY="https://proxy.golang.org,direct" make build
 
       - name: Upload Higress Binary
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: higress
           path: out/
@@ -105,30 +96,31 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
+
+    - name: Free Up GitHub Actions Ubuntu Runner Disk Space 🔧
+      uses: jlumbroso/free-disk-space@main
+      with:
+        tool-cache: false
+        android: true
+        dotnet: true
+        haskell: true
+        large-packages: true
+        swap-storage: true
       
     - name: "Setup Go"
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v5
       with:
-        go-version: 1.19
+        go-version: 1.21.5
 
     - name: Setup Golang Caches
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: |-
           ~/.cache/go-build
           ~/go/pkg/mod
         key: ${{ runner.os }}-go-${{ github.run_id }}
-        restore-keys: |
-          ${{ runner.os }}-go
-      
-    - name: Setup Submodule Caches
-      uses: actions/cache@v3
-      with:
-        path: |-
-            .git/modules
-        key: ${{ runner.os }}-submodules-cache-${{ github.run_id }}
-        restore-keys: ${{ runner.os }}-submodules-cache
+        restore-keys: ${{ runner.os }}-go
           
     - run: git stash # restore patch
 
@@ -139,4 +131,4 @@ jobs:
     runs-on: ubuntu-latest
     needs: [higress-conformance-test,gateway-conformance-test]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4

.github/workflows/build-image-and-push.yaml

@@ -16,7 +16,7 @@ jobs:
       CONTROLLER_IMAGE_NAME: ${{ vars.CONTROLLER_IMAGE_NAME || 'higress/higress' }}
     steps:
       - name: "Checkout ${{ github.ref }}"
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
@@ -31,12 +31,12 @@ jobs:
           swap-storage: true
 
       - name: "Setup Go"
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: 1.19
+          go-version: 1.21.5
 
       - name: Setup Golang Caches
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |-
             ~/.cache/go-build
@@ -44,19 +44,9 @@ jobs:
           key: ${{ runner.os }}-go-${{ github.run_id }}
           restore-keys: ${{ runner.os }}-go
 
-      - name: Setup Submodule Caches
-        uses: actions/cache@v3
-        with:
-          path: |-
-            envoy
-            istio
-            .git/modules
-          key: ${{ runner.os }}-submodules-new-${{ github.run_id }}
-          restore-keys: ${{ runner.os }}-submodules-new
-
       - name: Calculate Docker metadata
         id: docker-meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: |
             ${{ env.CONTROLLER_IMAGE_REGISTRY }}/${{ env.CONTROLLER_IMAGE_NAME }}
@@ -67,7 +57,7 @@ jobs:
             type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
 
       - name: Login to Docker Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ${{ env.CONTROLLER_IMAGE_REGISTRY }}
           username: ${{ secrets.REGISTRY_USERNAME }}
@@ -92,7 +82,7 @@ jobs:
       PILOT_IMAGE_NAME: ${{ vars.PILOT_IMAGE_NAME || 'higress/pilot' }}
     steps:
       - name: "Checkout ${{ github.ref }}"
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
@@ -107,12 +97,12 @@ jobs:
           swap-storage: true
 
       - name: "Setup Go"
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: 1.19
+          go-version: 1.21.5
 
       - name: Setup Golang Caches
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |-
             ~/.cache/go-build
@@ -120,19 +110,20 @@ jobs:
           key: ${{ runner.os }}-go-${{ github.run_id }}
           restore-keys: ${{ runner.os }}-go
 
-      - name: Setup Submodule Caches
-        uses: actions/cache@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Cache Docker layers
+        uses: actions/cache@v2
         with:
-          path: |-
-            envoy
-            istio
-            .git/modules
-          key: ${{ runner.os }}-submodules-${{ github.run_id }}
-          restore-keys: ${{ runner.os }}-submodules-new
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-
 
       - name: Calculate Docker metadata
         id: docker-meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: |
             ${{ env.PILOT_IMAGE_REGISTRY }}/${{ env.PILOT_IMAGE_NAME }}
@@ -143,7 +134,7 @@ jobs:
             type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
 
       - name: Login to Docker Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ${{ env.PILOT_IMAGE_REGISTRY }}
           username: ${{ secrets.REGISTRY_USERNAME }}
@@ -169,7 +160,7 @@ jobs:
       GATEWAY_IMAGE_NAME: ${{ vars.GATEWAY_IMAGE_NAME || 'higress/gateway' }}
     steps:
       - name: "Checkout ${{ github.ref }}"
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
@@ -184,12 +175,12 @@ jobs:
           swap-storage: true
 
       - name: "Setup Go"
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: 1.19
+          go-version: 1.21.5
 
       - name: Setup Golang Caches
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |-
             ~/.cache/go-build
@@ -197,19 +188,20 @@ jobs:
           key: ${{ runner.os }}-go-${{ github.run_id }}
           restore-keys: ${{ runner.os }}-go
 
-      - name: Setup Submodule Caches
-        uses: actions/cache@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Cache Docker layers
+        uses: actions/cache@v2
         with:
-          path: |-
-            envoy
-            istio
-            .git/modules
-          key: ${{ runner.os }}-submodules-${{ github.run_id }}
-          restore-keys: ${{ runner.os }}-submodules-new
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-
 
       - name: Calculate Docker metadata
         id: docker-meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: |
             ${{ env.GATEWAY_IMAGE_REGISTRY }}/${{ env.GATEWAY_IMAGE_NAME }}
@@ -220,7 +212,7 @@ jobs:
             type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
 
       - name: Login to Docker Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ${{ env.GATEWAY_IMAGE_REGISTRY }}
           username: ${{ secrets.REGISTRY_USERNAME }}

.github/workflows/codeql-analysis.yaml

@@ -34,11 +34,11 @@ jobs:
     steps:
       # step 1
       - name: "Checkout repository"
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       # step 2: Initializes the CodeQL tools for scanning.
       - name: "Initialize CodeQL"
-        uses: github/codeql-action/init@v1
+        uses: github/codeql-action/init@v2
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -50,7 +50,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: "Autobuild"
-        uses: github/codeql-action/autobuild@v1
+        uses: github/codeql-action/autobuild@v2
 
       # step 4
       # ℹ️ Command-line programs to run using the OS shell.
@@ -66,4 +66,4 @@ jobs:
 
       # step 5
       - name: "Perform CodeQL Analysis"
-        uses: github/codeql-action/analyze@v1
+        uses: github/codeql-action/analyze@v2

.github/workflows/deploy-standalone-to-oss.yaml

@@ -14,7 +14,7 @@ jobs:
     steps:
       # Step 1
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       # Step 2
       - id: package
         name: Prepare Standalone Package

.github/workflows/deploy-to-oss.yaml

@@ -14,7 +14,7 @@ jobs:
     steps:
       # Step 1
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       # Step 2
       - name: Download Helm Charts Index
         uses: doggycool/ossutil-github-action@master

.github/workflows/latest-release.yaml

@@ -1,72 +0,0 @@
-name: Latest Release
-
-on:
-  push:
-    branches:
-    - "main"
-
-jobs:
-  latest-release:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-
-    - name: Build hgctl latest multiarch binaries
-      run: | 
-        GOPROXY="https://proxy.golang.org,direct" make build-hgctl-multiarch
-        tar -zcvf hgctl_latest_linux_amd64.tar.gz out/linux_amd64/
-        tar -zcvf hgctl_latest_linux_arm64.tar.gz out/linux_arm64/
-        tar -zcvf hgctl_latest_darwin_amd64.tar.gz out/darwin_amd64/
-        tar -zcvf hgctl_latest_darwin_arm64.tar.gz out/darwin_arm64/
-        zip -q -r hgctl_latest_windows_amd64.zip out/windows_amd64/
-        zip -q -r hgctl_latest_windows_arm64.zip out/windows_arm64/
-
-    # Ignore the error when we delete the latest release, it might not exist.
-
-    # GitHub APIs take sometime to make effect, we should make sure before Recreate the Latest Release and Tag,
-    # tag and release all get deleted. So we sleep sometime after deleting tag and release to wait for it taking effect.
-
-    - name: Delete the Latest Release
-      continue-on-error: true
-      run: |
-        gh release delete latest --repo $GITHUB_REPOSITORY
-        sleep 4
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        GITHUB_REPOSITORY: ${{ github.repository_owner }}/${{ github.event.repository.name }}
-
-    # Ignore the error when we delete the latest tag, it might not exist.
-    - name: Delete the Latest Tag
-      continue-on-error: true
-      run: |
-        gh api --method DELETE /repos/$GITHUB_REPOSITORY/git/refs/tags/latest
-        sleep 4
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        GITHUB_REPOSITORY: ${{ github.repository_owner }}/${{ github.event.repository.name }}
-
-    - name: Recreate the Latest Release and Tag
-      uses: softprops/action-gh-release@v1
-      with:
-        draft: false
-        prerelease: true
-        tag_name: latest
-        files: |
-          hgctl_latest_linux_amd64.tar.gz
-          hgctl_latest_linux_arm64.tar.gz
-          hgctl_latest_darwin_amd64.tar.gz
-          hgctl_latest_darwin_arm64.tar.gz
-          hgctl_latest_windows_amd64.zip
-          hgctl_latest_windows_arm64.zip
-        body: |
-          This is the "latest" release of **Higress**, which contains the most recent commits from the main branch.
-          
-          This release **might not be stable**.
-
-          It is only intended for developers wishing to try out the latest features in Higress, some of which may not be fully implemented.
-
-          Try latest version of `hgctl` with:
-
-          ``` shell
-            curl -Ls https://raw.githubusercontent.com/alibaba/higress/main/tools/hack/get-hgctl.sh | VERSION=latest bash
-          ```

.github/workflows/license-checker.yaml

@@ -10,7 +10,7 @@ jobs:
     steps:
       # step 1
       - name: Checkout
-        uses: actions/checkout@v2.4.0
+        uses: actions/checkout@v4
       # step 2
       - name: Check License Header
         uses: apache/skywalking-eyes/header@25edfc2fd8d52fb266653fb5f6c42da633d85c07
@@ -24,4 +24,4 @@ jobs:
         with:
           log: info
           config: .licenserc.yaml
-          mode: check
+          mode: check

.github/workflows/release-hgctl.yaml

@@ -0,0 +1,80 @@
+name: Release hgctl to GitHub
+
+on:
+  push:
+    tags:
+    - "v*.*.*"
+  workflow_dispatch: ~
+
+jobs:
+  release-hgctl:
+    runs-on: ubuntu-latest
+    env:
+      HGCTL_VERSION: ${{github.ref_name}}
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-go@v5
+      with:
+        go-version: 1.21.5
+
+    - name: Build hgctl latest multiarch binaries
+      run: |
+        GOPROXY="https://proxy.golang.org,direct" make build-hgctl-multiarch
+        tar -zcvf hgctl_${{ env.HGCTL_VERSION }}_linux_amd64.tar.gz out/linux_amd64/
+        tar -zcvf hgctl_${{ env.HGCTL_VERSION }}_linux_arm64.tar.gz out/linux_arm64/
+        zip -q -r hgctl_${{ env.HGCTL_VERSION }}_windows_amd64.zip out/windows_amd64/
+        zip -q -r hgctl_${{ env.HGCTL_VERSION }}_windows_arm64.zip out/windows_arm64/
+
+    - name: Upload hgctl packages to the GitHub release
+      uses: softprops/action-gh-release@v2
+      if: startsWith(github.ref, 'refs/tags/')
+      with:
+        files: |
+          hgctl_${{ env.HGCTL_VERSION }}_linux_amd64.tar.gz
+          hgctl_${{ env.HGCTL_VERSION }}_linux_arm64.tar.gz
+          hgctl_${{ env.HGCTL_VERSION }}_windows_amd64.zip
+          hgctl_${{ env.HGCTL_VERSION }}_windows_arm64.zip
+
+  release-hgctl-macos-arm64:
+    runs-on: macos-latest
+    env:
+      HGCTL_VERSION: ${{github.ref_name}}
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-go@v5
+      with:
+        go-version: 1.21.5
+
+    - name: Build hgctl latest macos binaries
+      run: |
+        GOPROXY="https://proxy.golang.org,direct" make build-hgctl-macos-arm64
+        tar -zcvf hgctl_${{ env.HGCTL_VERSION }}_darwin_arm64.tar.gz out/darwin_arm64/
+
+    - name: Upload hgctl packages to the GitHub release
+      uses: softprops/action-gh-release@v2
+      if: startsWith(github.ref, 'refs/tags/')
+      with:
+        files: |
+          hgctl_${{ env.HGCTL_VERSION }}_darwin_arm64.tar.gz
+
+  release-hgctl-macos-amd64:
+    runs-on: macos-12
+    env:
+      HGCTL_VERSION: ${{github.ref_name}}
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-go@v5
+      with:
+        go-version: 1.21.5
+
+    - name: Build hgctl latest macos binaries
+      run: |
+        GOPROXY="https://proxy.golang.org,direct" make build-hgctl-macos-amd64
+        tar -zcvf hgctl_${{ env.HGCTL_VERSION }}_darwin_amd64.tar.gz out/darwin_amd64/
+
+    - name: Upload hgctl packages to the GitHub release
+      uses: softprops/action-gh-release@v2
+      if: startsWith(github.ref, 'refs/tags/')
+      with:
+        files: |
+          hgctl_${{ env.HGCTL_VERSION }}_darwin_amd64.tar.gz

.gitignore

@@ -1,4 +1,3 @@
-external
 out
 *.out
 *.tgz
@@ -11,7 +10,10 @@ bazel-bin
 bazel-out
 bazel-testlogs
 bazel-wasm-cpp
+external/
 tools/bin/
 helm/**/charts/**.tgz
 target/
-tools/hack/cluster.conf
+tools/hack/cluster.conf
+envoy/1.20
+istio/1.12

.gitmodules

@@ -1,21 +1,35 @@
-[submodule "istio/1.12/api"]
-	path = istio/1.12/api
-	url = https://github.com/istio/api
-[submodule "istio/1.12/istio"]
-	path = istio/1.12/istio
-	url = https://github.com/istio/istio
-[submodule "istio/1.12/client-go"]
-	path = istio/1.12/client-go
-	url = https://github.com/istio/client-go
-[submodule "istio/1.12/pkg"]
-	path = istio/1.12/pkg
-	url = https://github.com/istio/pkg
-[submodule "istio/1.12/proxy"]
-	path = istio/1.12/proxy
-	url = https://github.com/istio/proxy
-[submodule "envoy/1.20/go-control-plane"]
-	path = envoy/1.20/go-control-plane
-	url = https://github.com/envoyproxy/go-control-plane
-[submodule "envoy/1.20/envoy"]
-	path = envoy/1.20/envoy
-	url = https://github.com/envoyproxy/envoy
+[submodule "istio/api"]
+	path = istio/api
+	url = https://github.com/higress-group/api
+	branch = istio-1.19
+	shallow = true
+[submodule "istio/istio"]
+	path = istio/istio
+	url = https://github.com/higress-group/istio
+	branch = istio-1.19
+	shallow = true
+[submodule "istio/client-go"]
+	path = istio/client-go
+	url = https://github.com/higress-group/client-go
+	branch = istio-1.19
+	shallow = true
+[submodule "istio/pkg"]
+	path = istio/pkg
+	url = https://github.com/higress-group/pkg
+	branch = istio-1.19
+	shallow = true
+[submodule "istio/proxy"]
+	path = istio/proxy
+	url = https://github.com/higress-group/proxy
+	branch = istio-1.19
+	shallow = true
+[submodule "envoy/go-control-plane"]
+	path = envoy/go-control-plane
+	url = https://github.com/higress-group/go-control-plane
+	branch = istio-1.19
+	shallow = true
+[submodule "envoy/envoy"]
+	path = envoy/envoy
+	url = https://github.com/higress-group/envoy
+	branch = envoy-1.27
+	shallow = true

.licenserc.yaml

@@ -7,6 +7,8 @@ header:
     - '.gitignore'
     - '*.md'
     - '*.yml'
+    - '*.yaml'
+    - '*.golden'
     - 'LICENSE'
     - 'api/**'
     - 'samples/**'
@@ -27,8 +29,9 @@ header:
     - 'tools/'
     - 'test/README.md'
     - 'test/README_CN.md'
-    - 'cmd/hgctl/config/testdata/config'
-    - 'pkg/cmd/hgctl/manifests'
+    - 'hgctl/cmd/hgctl/config/testdata/config'
+    - 'hgctl/pkg/manifests'
+    - 'pkg/ingress/kube/gateway/istio/testdata'
 
   comment: on-failure
 dependency:

CODEOWNERS

@@ -2,7 +2,8 @@
 /envoy @gengleilei @johnlanni
 /istio @SpecialYang @johnlanni
 /pkg @SpecialYang @johnlanni @CH3CHO
-/plugins @johnlanni @WeixinX
+/plugins @johnlanni @WeixinX @CH3CHO
+/plugins/wasm-rust @007gzs
 /registry @NameHaibinZhang @2456868764 @johnlanni
 /test @Xunzhuo @2456868764 @CH3CHO
 /tools @johnlanni @Xunzhuo @2456868764

Makefile

@@ -32,7 +32,7 @@ export BUILD_WITH_CONTAINER ?= 0
 
 ifeq ($(BUILD_WITH_CONTAINER),1)
 
-# An export free of arugments in a Makefile places all variables in the Makefile into the
+# An export free of arguments in a Makefile places all variables in the Makefile into the
 # environment. This is needed to allow overrides from Makefile.overrides.mk.
 export
 
@@ -60,7 +60,7 @@ else
 $(shell mkdir -p out)
 $(shell $(shell pwd)/tools/hack/setup_env.sh envfile > out/.env)
 include out/.env
-# An export free of arugments in a Makefile places all variables in the Makefile into the
+# An export free of arguments in a Makefile places all variables in the Makefile into the
 # environment. This behavior may be surprising to many that use shell often, which simply
 # displays the existing environment
 export

Makefile.core.mk

@@ -1,12 +1,16 @@
 SHELL := /bin/bash -o pipefail
 
-export BASE_VERSION ?= 2022-10-27T19-02-22
+export HIGRESS_BASE_VERSION ?= 2023-07-20T20-50-43
 
 export HUB ?= higress-registry.cn-hangzhou.cr.aliyuncs.com/higress
 
+export ISTIO_BASE_REGISTRY ?= $(HUB)
+
+export BASE_VERSION ?= $(HIGRESS_BASE_VERSION)
+
 export CHARTS ?= higress-registry.cn-hangzhou.cr.aliyuncs.com/charts
 
-VERSION_PACKAGE := github.com/alibaba/higress/pkg/cmd/version
+VERSION_PACKAGE := github.com/alibaba/higress/pkg/cmd/lversion
 
 GIT_COMMIT:=$(shell git rev-parse HEAD)
 
@@ -45,6 +49,7 @@ HIGRESS_DOCKER_BUILD_TOP:=${OUT_LINUX}/docker_build
 
 HIGRESS_BINARIES:=./cmd/higress
 
+HGCTL_PROJECT_DIR=./hgctl
 HGCTL_BINARIES:=./cmd/hgctl
 
 $(OUT):
@@ -52,6 +57,7 @@ $(OUT):
 
 submodule:
 	git submodule update --init
+#	git submodule update --remote
 
 .PHONY: prebuild
 prebuild: submodule
@@ -80,20 +86,27 @@ $(ARM64_OUT_LINUX)/higress:
 
 .PHONY: build-hgctl
 build-hgctl: prebuild $(OUT)
-	GOPROXY=$(GOPROXY) GOOS=$(GOOS_LOCAL) GOARCH=$(GOARCH_LOCAL) LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh $(OUT)/ $(HGCTL_BINARIES)
+	GOPROXY=$(GOPROXY) GOOS=$(GOOS_LOCAL) GOARCH=$(GOARCH_LOCAL) LDFLAGS=$(RELEASE_LDFLAGS) PROJECT_DIR="$(HGCTL_PROJECT_DIR)" tools/hack/gobuild.sh $(OUT)/ $(HGCTL_BINARIES)
 
 .PHONY: build-linux-hgctl
 build-linux-hgctl: prebuild $(OUT)
-	GOPROXY=$(GOPROXY) GOOS=linux GOARCH=$(GOARCH_LOCAL) LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh $(OUT_LINUX)/ $(HGCTL_BINARIES)
+	GOPROXY=$(GOPROXY) GOOS=linux GOARCH=$(GOARCH_LOCAL) LDFLAGS=$(RELEASE_LDFLAGS) PROJECT_DIR="$(HGCTL_PROJECT_DIR)" tools/hack/gobuild.sh $(OUT_LINUX)/ $(HGCTL_BINARIES)
 
 .PHONY: build-hgctl-multiarch
 build-hgctl-multiarch: prebuild $(OUT)
-	GOPROXY=$(GOPROXY) GOOS=linux GOARCH=amd64 LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh ./out/linux_amd64/ $(HGCTL_BINARIES)
-	GOPROXY=$(GOPROXY) GOOS=linux GOARCH=arm64 LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh ./out/linux_arm64/ $(HGCTL_BINARIES)
-	GOPROXY=$(GOPROXY) GOOS=darwin GOARCH=amd64 LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh ./out/darwin_amd64/ $(HGCTL_BINARIES)
-	GOPROXY=$(GOPROXY) GOOS=darwin GOARCH=arm64 LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh ./out/darwin_arm64/ $(HGCTL_BINARIES)
-	GOPROXY=$(GOPROXY) GOOS=windows GOARCH=amd64 LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh ./out/windows_amd64/ $(HGCTL_BINARIES)
-	GOPROXY=$(GOPROXY) GOOS=windows GOARCH=arm64 LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh ./out/windows_arm64/ $(HGCTL_BINARIES)
+	GOPROXY=$(GOPROXY) GOOS=linux GOARCH=amd64 LDFLAGS=$(RELEASE_LDFLAGS) PROJECT_DIR="$(HGCTL_PROJECT_DIR)" tools/hack/gobuild.sh ../out/linux_amd64/ $(HGCTL_BINARIES)
+	GOPROXY=$(GOPROXY) GOOS=linux GOARCH=arm64 LDFLAGS=$(RELEASE_LDFLAGS) PROJECT_DIR="$(HGCTL_PROJECT_DIR)" tools/hack/gobuild.sh ../out/linux_arm64/ $(HGCTL_BINARIES)
+	GOPROXY=$(GOPROXY) GOOS=windows GOARCH=amd64 LDFLAGS=$(RELEASE_LDFLAGS) PROJECT_DIR="$(HGCTL_PROJECT_DIR)" tools/hack/gobuild.sh ../out/windows_amd64/ $(HGCTL_BINARIES)
+	GOPROXY=$(GOPROXY) GOOS=windows GOARCH=arm64 LDFLAGS=$(RELEASE_LDFLAGS) PROJECT_DIR="$(HGCTL_PROJECT_DIR)" tools/hack/gobuild.sh ../out/windows_arm64/ $(HGCTL_BINARIES)
+
+.PHONY: build-hgctl-macos-arm64
+build-hgctl-macos-arm64: prebuild $(OUT)
+	CGO_ENABLED=1 STATIC=0 GOPROXY=$(GOPROXY) GOOS=darwin GOARCH=arm64 PROJECT_DIR="$(HGCTL_PROJECT_DIR)" tools/hack/gobuild.sh ../out/darwin_arm64/ $(HGCTL_BINARIES)
+
+.PHONY: build-hgctl-macos-amd64
+build-hgctl-macos-amd64: prebuild $(OUT)
+	CGO_ENABLED=1 STATIC=0 GOPROXY=$(GOPROXY) GOOS=darwin GOARCH=amd64 PROJECT_DIR="$(HGCTL_PROJECT_DIR)" tools/hack/gobuild.sh ../out/darwin_amd64/ $(HGCTL_BINARIES)
+
 # Create targets for OUT_LINUX/binary
 # There are two use cases here:
 # * Building all docker images (generally in CI). In this case we want to build everything at once, so they share work
@@ -128,40 +141,37 @@ docker-build: docker.higress ## Build and push docker images to registry defined
 
 docker-buildx-push: clean-env docker.higress-buildx
 
-docker-build-base:
-	docker buildx build --no-cache --platform linux/amd64,linux/arm64 -t ${HUB}/base:${BASE_VERSION} -f docker/Dockerfile.base . --push
-
 export PARENT_GIT_TAG:=$(shell cat VERSION)
 export PARENT_GIT_REVISION:=$(TAG)
 
-export ENVOY_TAR_PATH:=/home/package/envoy.tar.gz
+export ENVOY_PACKAGE_URL_PATTERN?=https://github.com/higress-group/proxy/releases/download/v2.0.0/envoy-symbol-ARCH.tar.gz
 
-external/package/envoy-amd64.tar.gz:
-#	cd external/proxy; BUILD_WITH_CONTAINER=1  make test_release
-	cd external/package; wget -O envoy-amd64.tar.gz "https://github.com/alibaba/higress/releases/download/v1.3.4-rc.1/envoy-symbol-amd64.tar.gz"
+build-envoy: prebuild
+	./tools/hack/build-envoy.sh
 
-external/package/envoy-arm64.tar.gz:
-#	cd external/proxy; BUILD_WITH_CONTAINER=1  make test_release
-	cd external/package; wget -O envoy-arm64.tar.gz "https://github.com/alibaba/higress/releases/download/v1.3.4-rc.1/envoy-symbol-arm64.tar.gz"
+build-pilot: prebuild
+	TARGET_ARCH=amd64 ./tools/hack/build-istio-pilot.sh
+	TARGET_ARCH=arm64 ./tools/hack/build-istio-pilot.sh
 
-build-pilot:
-	cd external/istio; rm -rf out/linux_amd64; GOOS_LOCAL=linux TARGET_OS=linux TARGET_ARCH=amd64 BUILD_WITH_CONTAINER=1 make build-linux
-	cd external/istio; rm -rf out/linux_arm64; GOOS_LOCAL=linux TARGET_OS=linux TARGET_ARCH=arm64 BUILD_WITH_CONTAINER=1 make build-linux
+build-pilot-local: prebuild
+	TARGET_ARCH=${TARGET_ARCH} ./tools/hack/build-istio-pilot.sh
 
-build-pilot-local:
-	cd external/istio; rm -rf out/linux_${GOARCH_LOCAL}; GOOS_LOCAL=linux TARGET_OS=linux TARGET_ARCH=${GOARCH_LOCAL} BUILD_WITH_CONTAINER=1 make build-linux
+buildx-prepare:
+	docker buildx inspect multi-arch >/dev/null 2>&1 || docker buildx create --name multi-arch --platform linux/amd64,linux/arm64 --use
 
-build-gateway: prebuild external/package/envoy-amd64.tar.gz external/package/envoy-arm64.tar.gz build-pilot
-	cd external/istio; BUILD_WITH_CONTAINER=1 BUILDX_PLATFORM=true DOCKER_BUILD_VARIANTS=default DOCKER_TARGETS="docker.proxyv2" make docker
+build-gateway: prebuild buildx-prepare
+	USE_REAL_USER=1 TARGET_ARCH=amd64 DOCKER_TARGETS="docker.proxyv2" ./tools/hack/build-istio-image.sh init
+	USE_REAL_USER=1 TARGET_ARCH=arm64 DOCKER_TARGETS="docker.proxyv2" ./tools/hack/build-istio-image.sh init
+	DOCKER_TARGETS="docker.proxyv2" ./tools/hack/build-istio-image.sh docker.buildx
 
-build-gateway-local: prebuild external/package/envoy-amd64.tar.gz external/package/envoy-arm64.tar.gz
-	cd external/istio; rm -rf out/linux_${GOARCH_LOCAL}; GOOS_LOCAL=linux TARGET_OS=linux BUILD_WITH_CONTAINER=1 BUILDX_PLATFORM=false DOCKER_BUILD_VARIANTS=default DOCKER_TARGETS="docker.proxyv2" make docker
+build-gateway-local: prebuild
+	TARGET_ARCH=${TARGET_ARCH} DOCKER_TARGETS="docker.proxyv2" ./tools/hack/build-istio-image.sh docker
 
-build-istio: prebuild build-pilot
-	cd external/istio; BUILD_WITH_CONTAINER=1 BUILDX_PLATFORM=true DOCKER_BUILD_VARIANTS=default DOCKER_TARGETS="docker.pilot" make docker
+build-istio: prebuild buildx-prepare
+	DOCKER_TARGETS="docker.pilot" ./tools/hack/build-istio-image.sh docker.buildx
 
 build-istio-local: prebuild
-	cd external/istio; rm -rf out/linux_${GOARCH_LOCAL}; GOOS_LOCAL=linux TARGET_OS=linux BUILD_WITH_CONTAINER=1 BUILDX_PLATFORM=false DOCKER_BUILD_VARIANTS=default DOCKER_TARGETS="docker.pilot" make docker
+	TARGET_ARCH=${TARGET_ARCH} DOCKER_TARGETS="docker.pilot" ./tools/hack/build-istio-image.sh docker
 
 build-wasmplugins:
 	./tools/hack/build-wasm-plugins.sh
@@ -177,8 +187,8 @@ install: pre-install
 	cd helm/higress; helm dependency build
 	helm install higress helm/higress -n higress-system --create-namespace --set 'global.local=true'
 
-ENVOY_LATEST_IMAGE_TAG ?= sha-eb1f993
-ISTIO_LATEST_IMAGE_TAG ?= sha-eb1f993
+ENVOY_LATEST_IMAGE_TAG ?= 2.0.1
+ISTIO_LATEST_IMAGE_TAG ?= 2.0.1
 
 install-dev: pre-install
 	helm install higress helm/core -n higress-system --create-namespace --set 'controller.tag=$(TAG)' --set 'gateway.replicas=1' --set 'pilot.tag=$(ISTIO_LATEST_IMAGE_TAG)' --set 'gateway.tag=$(ENVOY_LATEST_IMAGE_TAG)' --set 'global.local=true'
@@ -275,17 +285,29 @@ delete-cluster: $(tools/kind) ## Delete kind cluster.
 kube-load-image: $(tools/kind) ## Install the Higress image to a kind cluster using the provided $IMAGE and $TAG.
 	tools/hack/kind-load-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/higress $(TAG)
 	tools/hack/docker-pull-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/dubbo-provider-demo 0.0.3-x86
-	tools/hack/docker-pull-image.sh docker.io/alihigress/nacos-standlone-rc3 1.0.0-RC3
+	tools/hack/docker-pull-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/nacos-standlone-rc3 1.0.0-RC3
 	tools/hack/docker-pull-image.sh docker.io/hashicorp/consul 1.16.0
 	tools/hack/docker-pull-image.sh docker.io/charlie1380/eureka-registry-provider v0.3.0
 	tools/hack/docker-pull-image.sh docker.io/bitinit/eureka latest
-	tools/hack/docker-pull-image.sh docker.io/alihigress/httpbin 1.0.2
+	tools/hack/docker-pull-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/httpbin 1.0.2
+	tools/hack/docker-pull-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/echo-server 1.3.0
+	tools/hack/docker-pull-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/echo-server v1.0
+	tools/hack/docker-pull-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/echo-body 1.0.0
+	tools/hack/docker-pull-image.sh openpolicyagent/opa latest
+	tools/hack/docker-pull-image.sh registry.cn-hangzhou.aliyuncs.com/2456868764/httpbin 1.0.2
+	tools/hack/docker-pull-image.sh registry.cn-hangzhou.aliyuncs.com/hinsteny/nacos-standlone-rc3 1.0.0-RC3
 	tools/hack/kind-load-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/dubbo-provider-demo 0.0.3-x86
-	tools/hack/kind-load-image.sh docker.io/alihigress/nacos-standlone-rc3 1.0.0-RC3
+	tools/hack/kind-load-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/nacos-standlone-rc3 1.0.0-RC3
 	tools/hack/kind-load-image.sh docker.io/hashicorp/consul 1.16.0
-	tools/hack/kind-load-image.sh docker.io/alihigress/httpbin 1.0.2
+	tools/hack/kind-load-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/httpbin 1.0.2
 	tools/hack/kind-load-image.sh docker.io/charlie1380/eureka-registry-provider v0.3.0
 	tools/hack/kind-load-image.sh docker.io/bitinit/eureka latest
+	tools/hack/kind-load-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/echo-server 1.3.0
+	tools/hack/kind-load-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/echo-server v1.0
+	tools/hack/kind-load-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/echo-body 1.0.0
+	tools/hack/kind-load-image.sh openpolicyagent/opa latest
+	tools/hack/kind-load-image.sh registry.cn-hangzhou.aliyuncs.com/2456868764/httpbin 1.0.2
+	tools/hack/kind-load-image.sh registry.cn-hangzhou.aliyuncs.com/hinsteny/nacos-standlone-rc3 1.0.0-RC3
 
 # run-higress-e2e-test-setup starts to setup ingress e2e tests.
 .PHONT: run-higress-e2e-test-setup
@@ -305,7 +327,7 @@ run-higress-e2e-test:
 	kubectl wait --timeout=10m -n higress-system deployment/higress-controller --for=condition=Available
 	@echo -e "\n\033[36mWaiting higress-gateway to be ready...\033[0m\n"
 	kubectl wait --timeout=10m -n higress-system deployment/higress-gateway --for=condition=Available
-	go test -v -tags conformance ./test/e2e/e2e_test.go --ingress-class=higress --debug=true --test-area=all
+	go test -v -tags conformance ./test/e2e/e2e_test.go --ingress-class=higress --debug=true --test-area=all --execute-tests=$(TEST_SHORTNAME)
 
 # run-higress-e2e-test-run starts to run ingress e2e conformance tests.
 .PHONY: run-higress-e2e-test-run
@@ -315,7 +337,7 @@ run-higress-e2e-test-run:
 	kubectl wait --timeout=10m -n higress-system deployment/higress-controller --for=condition=Available
 	@echo -e "\n\033[36mWaiting higress-gateway to be ready...\033[0m\n"
 	kubectl wait --timeout=10m -n higress-system deployment/higress-gateway --for=condition=Available
-	go test -v -tags conformance ./test/e2e/e2e_test.go --ingress-class=higress --debug=true --test-area=run
+	go test -v -tags conformance ./test/e2e/e2e_test.go --ingress-class=higress --debug=true --test-area=run --execute-tests=$(TEST_SHORTNAME)
 
 # run-higress-e2e-test-clean starts to clean ingress e2e tests.
 .PHONY: run-higress-e2e-test-clean
@@ -345,7 +367,7 @@ run-higress-e2e-test-wasmplugin:
 	kubectl wait --timeout=10m -n higress-system deployment/higress-controller --for=condition=Available
 	@echo -e "\n\033[36mWaiting higress-gateway to be ready...\033[0m\n"
 	kubectl wait --timeout=10m -n higress-system deployment/higress-gateway --for=condition=Available
-	go test -v -tags conformance ./test/e2e/e2e_test.go -isWasmPluginTest=true -wasmPluginType=$(PLUGIN_TYPE) -wasmPluginName=$(PLUGIN_NAME) --ingress-class=higress --debug=true --test-area=all
+	go test -v -tags conformance ./test/e2e/e2e_test.go -isWasmPluginTest=true -wasmPluginType=$(PLUGIN_TYPE) -wasmPluginName=$(PLUGIN_NAME) --ingress-class=higress --debug=true --test-area=all --execute-tests=$(TEST_SHORTNAME)
 
 # run-higress-e2e-test-wasmplugin-run starts to run ingress e2e conformance tests.
 .PHONY: run-higress-e2e-test-wasmplugin-run
@@ -355,7 +377,7 @@ run-higress-e2e-test-wasmplugin-run:
 	kubectl wait --timeout=10m -n higress-system deployment/higress-controller --for=condition=Available
 	@echo -e "\n\033[36mWaiting higress-gateway to be ready...\033[0m\n"
 	kubectl wait --timeout=10m -n higress-system deployment/higress-gateway --for=condition=Available
-	go test -v -tags conformance ./test/e2e/e2e_test.go -isWasmPluginTest=true -wasmPluginType=$(PLUGIN_TYPE) -wasmPluginName=$(PLUGIN_NAME) --ingress-class=higress --debug=true --test-area=run
+	go test -v -tags conformance ./test/e2e/e2e_test.go -isWasmPluginTest=true -wasmPluginType=$(PLUGIN_TYPE) -wasmPluginName=$(PLUGIN_NAME) --ingress-class=higress --debug=true --test-area=run --execute-tests=$(TEST_SHORTNAME)
 
 # run-higress-e2e-test-wasmplugin-clean starts to clean ingress e2e tests.
 .PHONY: run-higress-e2e-test-wasmplugin-clean

Makefile.overrides.mk

@@ -25,7 +25,7 @@ GENERATE_API ?= 0
 
 ifeq ($(GENERATE_API),1)
 BUILD_WITH_CONTAINER = 1
-IMAGE_VERSION=release-1.12-2021-11-12T20-52-48
+IMAGE_VERSION=release-1.19-ef344298e65eeb2d9e2d07b87eb4e715c2def613
 endif
 
 ifeq ($(BUILD_WITH_CONTAINER),1)

README.md

@@ -1,17 +1,19 @@
 <h1 align="center">
     <img src="https://img.alicdn.com/imgextra/i2/O1CN01NwxLDd20nxfGBjxmZ_!!6000000006895-2-tps-960-290.png" alt="Higress" width="240" height="72.5">
   <br>
-  Next-generation Cloud Native Gateway
+  AI Gateway
 </h1>
+<h4 align="center"> AI Native API Gateway </h4>
 
-[![Build Status](https://github.com/alibaba/higress/workflows/build%20and%20codecov/badge.svg?branch=main)](https://github.com/alibaba/higress/actions)
+[![Build Status](https://github.com/alibaba/higress/actions/workflows/build-and-test.yaml/badge.svg?branch=main)](https://github.com/alibaba/higress/actions)
 [![license](https://img.shields.io/github/license/alibaba/higress.svg)](https://www.apache.org/licenses/LICENSE-2.0.html)
 
-[**官网**](https://higress.io/) &nbsp; |
-&nbsp; [**文档**](https://higress.io/zh-cn/docs/overview/what-is-higress) &nbsp; |
-&nbsp; [**博客**](https://higress.io/zh-cn/blog) &nbsp; |
-&nbsp; [**开发指引**](https://higress.io/zh-cn/docs/developers/developers_dev) &nbsp; |
-&nbsp; [**Higress 企业版**](https://www.aliyun.com/product/aliware/mse?spm=higress-website.topbar.0.0.0) &nbsp;
+[**官网**](https://higress.cn/) &nbsp; |
+&nbsp; [**文档**](https://higress.cn/docs/latest/user/quickstart/) &nbsp; |
+&nbsp; [**博客**](https://higress.cn/blog/) &nbsp; |
+&nbsp; [**电子书**](https://higress.cn/docs/ebook/wasm14/) &nbsp; |
+&nbsp; [**开发指引**](https://higress.cn/docs/latest/dev/architecture/) &nbsp; |
+&nbsp; [**AI插件**](https://higress.cn/plugin/) &nbsp;
 
 
 <p>
@@ -19,21 +21,54 @@
 </p>
 
 
-Higress 是基于阿里内部两年多的 Envoy Gateway 实践沉淀，以开源 [Istio](https://github.com/istio/istio) 与 [Envoy](https://github.com/envoyproxy/envoy) 为核心构建的下一代云原生网关。Higress 实现了安全防护网关、流量网关、微服务网关三层网关合一，可以显著降低网关的部署和运维成本。
+Higress 是基于阿里内部多年的 Envoy Gateway 实践沉淀，以开源 [Istio](https://github.com/istio/istio) 与 [Envoy](https://github.com/envoyproxy/envoy) 为核心构建的云原生 API 网关。
+
+Higress 在阿里内部作为 AI 网关，承载了通义千问 APP、百炼大模型 API、机器学习 PAI 平台等 AI 业务的流量。
+
+Higress 能够用统一的协议对接国内外所有 LLM 模型厂商，同时具备丰富的 AI 可观测、多模型负载均衡/fallback、AI token 流控、AI 缓存等能力：
+
+![](https://img.alicdn.com/imgextra/i1/O1CN01fNnhCp1cV8mYPRFeS_!!6000000003605-0-tps-1080-608.jpg)
+
 
-![arch](https://img.alicdn.com/imgextra/i1/O1CN01iO9ph825juHbOIg75_!!6000000007563-2-tps-2483-2024.png)
 
 ## Summary
-    
+
+- [**快速开始**](#快速开始)    
 - [**功能展示**](#功能展示)
 - [**使用场景**](#使用场景)
 - [**核心优势**](#核心优势)
-- [**Quick Start**](https://higress.io/zh-cn/docs/user/quickstart)
 - [**社区**](#社区)
 
+## 快速开始
+
+Higress 只需 Docker 即可启动，方便个人开发者在本地搭建学习，或者用于搭建简易站点:
+
+```bash
+# 创建一个工作目录
+mkdir higress; cd higress
+# 启动 higress，配置文件会写到工作目录下
+docker run -d --rm --name higress-ai -v ${PWD}:/data \
+        -p 8001:8001 -p 8080:8080 -p 8443:8443  \
+        higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/all-in-one:latest
+```
+
+监听端口说明如下：
+
+- 8001 端口：Higress UI 控制台入口
+- 8080 端口：网关 HTTP 协议入口
+- 8443 端口：网关 HTTPS 协议入口
+
+**Higress 的所有 Docker 镜像都一直使用自己独享的仓库，不受 Docker Hub 境内不可访问的影响**
+
+K8s 下使用 Helm 部署等其他安装方式可以参考官网 [Quick Start 文档](https://higress.cn/docs/latest/user/quickstart/)。
+
 
 ## 使用场景
 
+- **AI 网关**:
+
+  Higress 提供了一站式的 AI 插件集，可以增强依赖 AI 能力业务的稳定性、灵活性、可观测性，使得业务与 AI 的集成更加便捷和高效。
+
 - **Kubernetes Ingress 网关**:
 
   Higress 可以作为 K8s 集群的 Ingress 入口网关, 并且兼容了大量 K8s Nginx Ingress 的注解，可以从 K8s Nginx Ingress 快速平滑迁移到 Higress。
@@ -56,27 +91,36 @@ Higress 是基于阿里内部两年多的 Envoy Gateway 实践沉淀，以开源
 
   脱胎于阿里巴巴2年多生产验证的内部产品，支持每秒请求量达数十万级的大规模场景。
 
-  彻底摆脱 reload 引起的流量抖动，配置变更毫秒级生效且业务无感。
-  
-- **平滑演进**
+  彻底摆脱 Nginx reload 引起的流量抖动，配置变更毫秒级生效且业务无感。对 AI 业务等长连接场景特别友好。
 
-  支持 Nacos/Zookeeper/Eureka 等多种注册中心，可以不依赖 K8s Service 进行服务发现，支持非容器架构平滑演进到云原生架构。
+- **流式处理**
 
-  支持从 Nginx Ingress Controller 平滑迁移，支持平滑过渡到 Gateway API，支持业务架构平滑演进到 ServiceMesh。
+  支持真正的完全流式处理请求/响应 Body，Wasm 插件很方便地自定义处理 SSE （Server-Sent Events）等流式协议的报文。
 
-- **兼收并蓄**
-  
-  兼容 Nginx Ingress Annotation 80%+ 的使用场景，且提供功能更丰富的 Higress Annotation 注解。
-  
-  兼容 Ingress API/Gateway API/Istio API，可以组合多种 CRD 实现流量精细化管理。
-  
+  在 AI 业务等大带宽场景下，可以显著降低内存开销。  
+    
 - **便于扩展**
   
-  提供 Wasm、Lua、进程外三种插件扩展机制，支持多语言编写插件，生效粒度支持全局级、域名级，路由级。
+  提供丰富的官方插件库，涵盖 AI、流量管理、安全防护等常用功能，满足90%以上的业务场景需求。
+
+  主打 Wasm 插件扩展，通过沙箱隔离确保内存安全，支持多种编程语言，允许插件版本独立升级，实现流量无损热更新网关逻辑。
+
+- **安全易用**
+  
+  基于 Ingress API 和 Gateway API 标准，提供开箱即用的 UI 控制台，WAF 防护插件、IP/Cookie CC 防护插件开箱即用。
+
+  支持对接 Let's Encrypt 自动签发和续签免费证书，并且可以脱离 K8s 部署，一行 Docker 命令即可启动，方便个人开发者使用。
 
-  插件支持热更新，变更插件逻辑和配置都对流量无损。
 
 ## 功能展示
+
+### AI 网关 Demo 展示
+
+[从 OpenAI 到其他大模型，30 秒完成迁移
+](https://www.bilibili.com/video/BV1dT421a7w7/?spm_id_from=333.788.recommend_more_video.14)
+
+
+### Higress UI 控制台
     
 - **丰富的可观测**
 
@@ -119,9 +163,17 @@ Higress 是基于阿里内部两年多的 Envoy Gateway 实践沉淀，以开源
 
 如果没有 Envoy 和 Istio 的开源工作，Higress 就不可能实现，在这里向这两个项目献上最诚挚的敬意。
 
-### 联系我们
-
-社区交流群: 
+### 交流群
 
 ![image](https://img.alicdn.com/imgextra/i2/O1CN01qPd7Ix1uZPVEsWjWp_!!6000000006051-0-tps-720-405.jpg)
 
+### 技术分享
+
+微信公众号：
+
+![](https://img.alicdn.com/imgextra/i1/O1CN01WnQt0q1tcmqVDU73u_!!6000000005923-0-tps-258-258.jpg)
+
+### 关联仓库
+
+- Higress 控制台：https://github.com/higress-group/higress-console
+- Higress（独立运行版）：https://github.com/higress-group/higress-standalone

README_EN.md

@@ -1,10 +1,10 @@
 <h1 align="center">
     <img src="https://img.alicdn.com/imgextra/i2/O1CN01NwxLDd20nxfGBjxmZ_!!6000000006895-2-tps-960-290.png" alt="Higress" width="240" height="72.5">
   <br>
-  Next-generation Cloud Native Gateway
+  Cloud Native API Gateway
 </h1>
 
-[![Build Status](https://github.com/alibaba/higress/workflows/build%20and%20codecov/badge.svg?branch=main)](https://github.com/alibaba/higress/actions)
+[![Build Status](https://github.com/alibaba/higress/actions/workflows/build-and-test.yaml/badge.svg?branch=main)](https://github.com/alibaba/higress/actions)
 [![license](https://img.shields.io/github/license/alibaba/higress.svg)](https://www.apache.org/licenses/LICENSE-2.0.html)
 
 [**Official Site**](https://higress.io/en-us/) &nbsp; |
@@ -18,7 +18,7 @@
    English | <a href="README.md">中文<a/>
 </p>
 
-Higress is a next-generation cloud-native gateway based on Alibaba's internal gateway practices. 
+Higress is a cloud-native api gateway based on Alibaba's internal gateway practices. 
 
 Powered by [Istio](https://github.com/istio/istio) and [Envoy](https://github.com/envoyproxy/envoy), Higress realizes the integration of the triple gateway architecture of traffic gateway, microservice gateway and security gateway, thereby greatly reducing the costs of deployment, operation and maintenance.
 
@@ -82,3 +82,8 @@ Powered by [Istio](https://github.com/istio/istio) and [Envoy](https://github.co
 ### Thanks
 
 Higress would not be possible without the valuable open-source work of projects in the community. We would like to extend a special thank-you to Envoy and Istio.
+
+### Related Repositories
+
+- Higress Console: https://github.com/higress-group/higress-console
+- Higress Standalone: https://github.com/higress-group/higress-standalone

VERSION

@@ -1 +1 @@
-v1.3.5
+v2.0.1

api/buf.gen.yaml

@@ -1,11 +1,17 @@
-version: v1beta1
+# buf.gen.yaml sets up the generation configuration for all of our plugins.
+# Note: buf does not allow multi roots that are within each other; as a result, the common-protos folders are
+# symlinked into the top level directory.
+version: v1
 plugins:
-- name: gogofast
+- name: go
   out: .
-  opt: plugins=grpc,paths=source_relative,Mgogoproto/gogo.proto=github.com/gogo/protobuf/gogoproto,Mgoogle/protobuf/any.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/descriptor.proto=github.com/gogo/protobuf/protoc-gen-gogo/descriptor,Mgoogle/protobuf/duration.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/struct.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/timestamp.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/wrappers.proto=github.com/gogo/protobuf/types,Mgoogle/rpc/status.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/rpc/code.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/rpc/error_details.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/api/field_behavior.proto=istio.io/gogo-genproto/googleapis/google/api
-- name: deepcopy
+  opt: paths=source_relative
+- name: go-grpc
   out: .
-  opt: paths=source_relative,Mgogoproto/gogo.proto=github.com/gogo/protobuf/gogoproto,Mgoogle/protobuf/any.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/descriptor.proto=github.com/gogo/protobuf/protoc-gen-gogo/descriptor,Mgoogle/protobuf/duration.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/struct.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/timestamp.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/wrappers.proto=github.com/gogo/protobuf/types,Mgoogle/rpc/status.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/rpc/code.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/rpc/error_details.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/api/field_behavior.proto=istio.io/gogo-genproto/googleapis/google/api
-- name: jsonshim
+  opt: paths=source_relative
+- name: golang-deepcopy
   out: .
-  opt: paths=source_relative,Mgogoproto/gogo.proto=github.com/gogo/protobuf/gogoproto,Mgoogle/protobuf/any.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/descriptor.proto=github.com/gogo/protobuf/protoc-gen-gogo/descriptor,Mgoogle/protobuf/duration.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/struct.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/timestamp.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/wrappers.proto=github.com/gogo/protobuf/types,Mgoogle/rpc/status.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/rpc/code.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/rpc/error_details.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/api/field_behavior.proto=istio.io/gogo-genproto/googleapis/google/api
+  opt: paths=source_relative
+- name: golang-jsonshim
+  out: .
+  opt: paths=source_relative

api/extensions/v1alpha1/wasm_deepcopy.gen.go

@@ -1,58 +0,0 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: extensions/v1alpha1/wasm.proto
-
-package v1alpha1
-
-import (
-	fmt "fmt"
-	proto "github.com/gogo/protobuf/proto"
-	_ "github.com/gogo/protobuf/types"
-	math "math"
-)
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-// DeepCopyInto supports using WasmPlugin within kubernetes types, where deepcopy-gen is used.
-func (in *WasmPlugin) DeepCopyInto(out *WasmPlugin) {
-	p := proto.Clone(in).(*WasmPlugin)
-	*out = *p
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WasmPlugin. Required by controller-gen.
-func (in *WasmPlugin) DeepCopy() *WasmPlugin {
-	if in == nil {
-		return nil
-	}
-	out := new(WasmPlugin)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new WasmPlugin. Required by controller-gen.
-func (in *WasmPlugin) DeepCopyInterface() interface{} {
-	return in.DeepCopy()
-}
-
-// DeepCopyInto supports using MatchRule within kubernetes types, where deepcopy-gen is used.
-func (in *MatchRule) DeepCopyInto(out *MatchRule) {
-	p := proto.Clone(in).(*MatchRule)
-	*out = *p
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MatchRule. Required by controller-gen.
-func (in *MatchRule) DeepCopy() *MatchRule {
-	if in == nil {
-		return nil
-	}
-	out := new(MatchRule)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new MatchRule. Required by controller-gen.
-func (in *MatchRule) DeepCopyInterface() interface{} {
-	return in.DeepCopy()
-}

api/extensions/v1alpha1/wasm_json.gen.go

@@ -1,45 +0,0 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: extensions/v1alpha1/wasm.proto
-
-package v1alpha1
-
-import (
-	bytes "bytes"
-	fmt "fmt"
-	github_com_gogo_protobuf_jsonpb "github.com/gogo/protobuf/jsonpb"
-	proto "github.com/gogo/protobuf/proto"
-	_ "github.com/gogo/protobuf/types"
-	math "math"
-)
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-// MarshalJSON is a custom marshaler for WasmPlugin
-func (this *WasmPlugin) MarshalJSON() ([]byte, error) {
-	str, err := WasmMarshaler.MarshalToString(this)
-	return []byte(str), err
-}
-
-// UnmarshalJSON is a custom unmarshaler for WasmPlugin
-func (this *WasmPlugin) UnmarshalJSON(b []byte) error {
-	return WasmUnmarshaler.Unmarshal(bytes.NewReader(b), this)
-}
-
-// MarshalJSON is a custom marshaler for MatchRule
-func (this *MatchRule) MarshalJSON() ([]byte, error) {
-	str, err := WasmMarshaler.MarshalToString(this)
-	return []byte(str), err
-}
-
-// UnmarshalJSON is a custom unmarshaler for MatchRule
-func (this *MatchRule) UnmarshalJSON(b []byte) error {
-	return WasmUnmarshaler.Unmarshal(bytes.NewReader(b), this)
-}
-
-var (
-	WasmMarshaler   = &github_com_gogo_protobuf_jsonpb.Marshaler{}
-	WasmUnmarshaler = &github_com_gogo_protobuf_jsonpb.Unmarshaler{AllowUnknownFields: true}
-)

api/extensions/v1alpha1/wasmplugin.pb.go

@@ -0,0 +1,901 @@
+// Copyright Istio Authors
+//
+//   Licensed under the Apache License, Version 2.0 (the "License");
+//   you may not use this file except in compliance with the License.
+//   You may obtain a copy of the License at
+//
+//       http://www.apache.org/licenses/LICENSE-2.0
+//
+//   Unless required by applicable law or agreed to in writing, software
+//   distributed under the License is distributed on an "AS IS" BASIS,
+//   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//   See the License for the specific language governing permissions and
+//   limitations under the License.
+// Modified by Higress Authors
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.31.0
+// 	protoc        (unknown)
+// source: extensions/v1alpha1/wasmplugin.proto
+
+// $schema: higress.extensions.v1alpha1.WasmPlugin
+// $title: WasmPlugin
+// $description: Extend the functionality provided by the envoy through WebAssembly filters.
+
+package v1alpha1
+
+import (
+	_struct "github.com/golang/protobuf/ptypes/struct"
+	wrappers "github.com/golang/protobuf/ptypes/wrappers"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// The phase in the filter chain where the plugin will be injected.
+type PluginPhase int32
+
+const (
+	// Control plane decides where to insert the plugin. This will generally
+	// be at the end of the filter chain, right before the Router.
+	// Do not specify `PluginPhase` if the plugin is independent of others.
+	PluginPhase_UNSPECIFIED_PHASE PluginPhase = 0
+	// Insert plugin before Istio authentication filters.
+	PluginPhase_AUTHN PluginPhase = 1
+	// Insert plugin before Istio authorization filters and after Istio authentication filters.
+	PluginPhase_AUTHZ PluginPhase = 2
+	// Insert plugin before Istio stats filters and after Istio authorization filters.
+	PluginPhase_STATS PluginPhase = 3
+)
+
+// Enum value maps for PluginPhase.
+var (
+	PluginPhase_name = map[int32]string{
+		0: "UNSPECIFIED_PHASE",
+		1: "AUTHN",
+		2: "AUTHZ",
+		3: "STATS",
+	}
+	PluginPhase_value = map[string]int32{
+		"UNSPECIFIED_PHASE": 0,
+		"AUTHN":             1,
+		"AUTHZ":             2,
+		"STATS":             3,
+	}
+)
+
+func (x PluginPhase) Enum() *PluginPhase {
+	p := new(PluginPhase)
+	*p = x
+	return p
+}
+
+func (x PluginPhase) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (PluginPhase) Descriptor() protoreflect.EnumDescriptor {
+	return file_extensions_v1alpha1_wasmplugin_proto_enumTypes[0].Descriptor()
+}
+
+func (PluginPhase) Type() protoreflect.EnumType {
+	return &file_extensions_v1alpha1_wasmplugin_proto_enumTypes[0]
+}
+
+func (x PluginPhase) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use PluginPhase.Descriptor instead.
+func (PluginPhase) EnumDescriptor() ([]byte, []int) {
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP(), []int{0}
+}
+
+// The pull behaviour to be applied when fetching an OCI image,
+// mirroring K8s behaviour.
+//
+// <!--
+// buf:lint:ignore ENUM_VALUE_UPPER_SNAKE_CASE
+// -->
+type PullPolicy int32
+
+const (
+	// Defaults to IfNotPresent, except for OCI images with tag `latest`, for which
+	// the default will be Always.
+	PullPolicy_UNSPECIFIED_POLICY PullPolicy = 0
+	// If an existing version of the image has been pulled before, that
+	// will be used. If no version of the image is present locally, we
+	// will pull the latest version.
+	PullPolicy_IfNotPresent PullPolicy = 1
+	// We will always pull the latest version of an image when applying
+	// this plugin.
+	PullPolicy_Always PullPolicy = 2
+)
+
+// Enum value maps for PullPolicy.
+var (
+	PullPolicy_name = map[int32]string{
+		0: "UNSPECIFIED_POLICY",
+		1: "IfNotPresent",
+		2: "Always",
+	}
+	PullPolicy_value = map[string]int32{
+		"UNSPECIFIED_POLICY": 0,
+		"IfNotPresent":       1,
+		"Always":             2,
+	}
+)
+
+func (x PullPolicy) Enum() *PullPolicy {
+	p := new(PullPolicy)
+	*p = x
+	return p
+}
+
+func (x PullPolicy) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (PullPolicy) Descriptor() protoreflect.EnumDescriptor {
+	return file_extensions_v1alpha1_wasmplugin_proto_enumTypes[1].Descriptor()
+}
+
+func (PullPolicy) Type() protoreflect.EnumType {
+	return &file_extensions_v1alpha1_wasmplugin_proto_enumTypes[1]
+}
+
+func (x PullPolicy) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use PullPolicy.Descriptor instead.
+func (PullPolicy) EnumDescriptor() ([]byte, []int) {
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP(), []int{1}
+}
+
+type EnvValueSource int32
+
+const (
+	// Explicitly given key-value pairs to be injected to this VM
+	EnvValueSource_INLINE EnvValueSource = 0
+	// *Istio-proxy's* environment variables exposed to this VM.
+	EnvValueSource_HOST EnvValueSource = 1
+)
+
+// Enum value maps for EnvValueSource.
+var (
+	EnvValueSource_name = map[int32]string{
+		0: "INLINE",
+		1: "HOST",
+	}
+	EnvValueSource_value = map[string]int32{
+		"INLINE": 0,
+		"HOST":   1,
+	}
+)
+
+func (x EnvValueSource) Enum() *EnvValueSource {
+	p := new(EnvValueSource)
+	*p = x
+	return p
+}
+
+func (x EnvValueSource) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (EnvValueSource) Descriptor() protoreflect.EnumDescriptor {
+	return file_extensions_v1alpha1_wasmplugin_proto_enumTypes[2].Descriptor()
+}
+
+func (EnvValueSource) Type() protoreflect.EnumType {
+	return &file_extensions_v1alpha1_wasmplugin_proto_enumTypes[2]
+}
+
+func (x EnvValueSource) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use EnvValueSource.Descriptor instead.
+func (EnvValueSource) EnumDescriptor() ([]byte, []int) {
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP(), []int{2}
+}
+
+type FailStrategy int32
+
+const (
+	// A fatal error in the binary fetching or during the plugin execution causes
+	// all subsequent requests to fail with 5xx.
+	FailStrategy_FAIL_CLOSE FailStrategy = 0
+	// Enables the fail open behavior for the Wasm plugin fatal errors to bypass
+	// the plugin execution. A fatal error can be a failure to fetch the remote
+	// binary, an exception, or abort() on the VM. This flag is not recommended
+	// for the authentication or the authorization plugins.
+	FailStrategy_FAIL_OPEN FailStrategy = 1
+)
+
+// Enum value maps for FailStrategy.
+var (
+	FailStrategy_name = map[int32]string{
+		0: "FAIL_CLOSE",
+		1: "FAIL_OPEN",
+	}
+	FailStrategy_value = map[string]int32{
+		"FAIL_CLOSE": 0,
+		"FAIL_OPEN":  1,
+	}
+)
+
+func (x FailStrategy) Enum() *FailStrategy {
+	p := new(FailStrategy)
+	*p = x
+	return p
+}
+
+func (x FailStrategy) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (FailStrategy) Descriptor() protoreflect.EnumDescriptor {
+	return file_extensions_v1alpha1_wasmplugin_proto_enumTypes[3].Descriptor()
+}
+
+func (FailStrategy) Type() protoreflect.EnumType {
+	return &file_extensions_v1alpha1_wasmplugin_proto_enumTypes[3]
+}
+
+func (x FailStrategy) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use FailStrategy.Descriptor instead.
+func (FailStrategy) EnumDescriptor() ([]byte, []int) {
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP(), []int{3}
+}
+
+// <!-- crd generation tags
+// +cue-gen:WasmPlugin:groupName:extensions.higress.io
+// +cue-gen:WasmPlugin:version:v1alpha1
+// +cue-gen:WasmPlugin:storageVersion
+// +cue-gen:WasmPlugin:annotations:helm.sh/resource-policy=keep
+// +cue-gen:WasmPlugin:subresource:status
+// +cue-gen:WasmPlugin:scope:Namespaced
+// +cue-gen:WasmPlugin:resource:categories=higress-io,extensions-higress-io
+// +cue-gen:WasmPlugin:preserveUnknownFields:pluginConfig,defaultConfig,matchRules.[].config
+// +cue-gen:WasmPlugin:printerColumn:name=Age,type=date,JSONPath=.metadata.creationTimestamp,description="CreationTimestamp is a timestamp
+// representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations.
+// Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+// Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata"
+// -->
+//
+// <!-- go code generation tags
+// +kubetype-gen
+// +kubetype-gen:groupVersion=extensions.higress.io/v1alpha1
+// +genclient
+// +k8s:deepcopy-gen=true
+// -->
+type WasmPlugin struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// URL of a Wasm module or OCI container. If no scheme is present,
+	// defaults to `oci://`, referencing an OCI image. Other valid schemes
+	// are `file://` for referencing .wasm module files present locally
+	// within the proxy container, and `http[s]://` for .wasm module files
+	// hosted remotely.
+	Url string `protobuf:"bytes,2,opt,name=url,proto3" json:"url,omitempty"`
+	// SHA256 checksum that will be used to verify Wasm module or OCI container.
+	// If the `url` field already references a SHA256 (using the `@sha256:`
+	// notation), it must match the value of this field. If an OCI image is
+	// referenced by tag and this field is set, its checksum will be verified
+	// against the contents of this field after pulling.
+	Sha256 string `protobuf:"bytes,3,opt,name=sha256,proto3" json:"sha256,omitempty"`
+	// The pull behaviour to be applied when fetching an OCI image. Only
+	// relevant when images are referenced by tag instead of SHA. Defaults
+	// to IfNotPresent, except when an OCI image is referenced in the `url`
+	// and the `latest` tag is used, in which case `Always` is the default,
+	// mirroring K8s behaviour.
+	// Setting is ignored if `url` field is referencing a Wasm module directly
+	// using `file://` or `http[s]://`
+	ImagePullPolicy PullPolicy `protobuf:"varint,4,opt,name=image_pull_policy,json=imagePullPolicy,proto3,enum=higress.extensions.v1alpha1.PullPolicy" json:"image_pull_policy,omitempty"`
+	// Credentials to use for OCI image pulling.
+	// Name of a K8s Secret in the same namespace as the `WasmPlugin` that
+	// contains a docker pull secret which is to be used to authenticate
+	// against the registry when pulling the image.
+	ImagePullSecret string `protobuf:"bytes,5,opt,name=image_pull_secret,json=imagePullSecret,proto3" json:"image_pull_secret,omitempty"`
+	// Public key that will be used to verify signatures of signed OCI images
+	// or Wasm modules. Must be supplied in PEM format.
+	VerificationKey string `protobuf:"bytes,6,opt,name=verification_key,json=verificationKey,proto3" json:"verification_key,omitempty"`
+	// The configuration that will be passed on to the plugin.
+	PluginConfig *_struct.Struct `protobuf:"bytes,7,opt,name=plugin_config,json=pluginConfig,proto3" json:"plugin_config,omitempty"`
+	// The plugin name to be used in the Envoy configuration (used to be called
+	// `rootID`). Some .wasm modules might require this value to select the Wasm
+	// plugin to execute.
+	PluginName string `protobuf:"bytes,8,opt,name=plugin_name,json=pluginName,proto3" json:"plugin_name,omitempty"`
+	// Determines where in the filter chain this `WasmPlugin` is to be injected.
+	Phase PluginPhase `protobuf:"varint,9,opt,name=phase,proto3,enum=higress.extensions.v1alpha1.PluginPhase" json:"phase,omitempty"`
+	// Determines ordering of `WasmPlugins` in the same `phase`.
+	// When multiple `WasmPlugins` are applied to the same workload in the
+	// same `phase`, they will be applied by priority, in descending order.
+	// If `priority` is not set, or two `WasmPlugins` exist with the same
+	// value, the ordering will be deterministically derived from name and
+	// namespace of the `WasmPlugins`. Defaults to `0`.
+	Priority *wrappers.Int32Value `protobuf:"bytes,10,opt,name=priority,proto3" json:"priority,omitempty"`
+	// Specifies the failure behavior for the plugin due to fatal errors.
+	FailStrategy FailStrategy `protobuf:"varint,13,opt,name=fail_strategy,json=failStrategy,proto3,enum=higress.extensions.v1alpha1.FailStrategy" json:"fail_strategy,omitempty"`
+	// Configuration for a Wasm VM.
+	// more details can be found [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/wasm/v3/wasm.proto#extensions-wasm-v3-vmconfig).
+	VmConfig *VmConfig `protobuf:"bytes,11,opt,name=vm_config,json=vmConfig,proto3" json:"vm_config,omitempty"`
+	// Extended by Higress, the default configuration takes effect globally
+	DefaultConfig *_struct.Struct `protobuf:"bytes,101,opt,name=default_config,json=defaultConfig,proto3" json:"default_config,omitempty"`
+	// Extended by Higress, matching rules take effect
+	MatchRules []*MatchRule `protobuf:"bytes,102,rep,name=match_rules,json=matchRules,proto3" json:"match_rules,omitempty"`
+	// disable the default config
+	DefaultConfigDisable bool `protobuf:"varint,103,opt,name=default_config_disable,json=defaultConfigDisable,proto3" json:"default_config_disable,omitempty"`
+}
+
+func (x *WasmPlugin) Reset() {
+	*x = WasmPlugin{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_extensions_v1alpha1_wasmplugin_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WasmPlugin) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WasmPlugin) ProtoMessage() {}
+
+func (x *WasmPlugin) ProtoReflect() protoreflect.Message {
+	mi := &file_extensions_v1alpha1_wasmplugin_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WasmPlugin.ProtoReflect.Descriptor instead.
+func (*WasmPlugin) Descriptor() ([]byte, []int) {
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *WasmPlugin) GetUrl() string {
+	if x != nil {
+		return x.Url
+	}
+	return ""
+}
+
+func (x *WasmPlugin) GetSha256() string {
+	if x != nil {
+		return x.Sha256
+	}
+	return ""
+}
+
+func (x *WasmPlugin) GetImagePullPolicy() PullPolicy {
+	if x != nil {
+		return x.ImagePullPolicy
+	}
+	return PullPolicy_UNSPECIFIED_POLICY
+}
+
+func (x *WasmPlugin) GetImagePullSecret() string {
+	if x != nil {
+		return x.ImagePullSecret
+	}
+	return ""
+}
+
+func (x *WasmPlugin) GetVerificationKey() string {
+	if x != nil {
+		return x.VerificationKey
+	}
+	return ""
+}
+
+func (x *WasmPlugin) GetPluginConfig() *_struct.Struct {
+	if x != nil {
+		return x.PluginConfig
+	}
+	return nil
+}
+
+func (x *WasmPlugin) GetPluginName() string {
+	if x != nil {
+		return x.PluginName
+	}
+	return ""
+}
+
+func (x *WasmPlugin) GetPhase() PluginPhase {
+	if x != nil {
+		return x.Phase
+	}
+	return PluginPhase_UNSPECIFIED_PHASE
+}
+
+func (x *WasmPlugin) GetPriority() *wrappers.Int32Value {
+	if x != nil {
+		return x.Priority
+	}
+	return nil
+}
+
+func (x *WasmPlugin) GetFailStrategy() FailStrategy {
+	if x != nil {
+		return x.FailStrategy
+	}
+	return FailStrategy_FAIL_CLOSE
+}
+
+func (x *WasmPlugin) GetVmConfig() *VmConfig {
+	if x != nil {
+		return x.VmConfig
+	}
+	return nil
+}
+
+func (x *WasmPlugin) GetDefaultConfig() *_struct.Struct {
+	if x != nil {
+		return x.DefaultConfig
+	}
+	return nil
+}
+
+func (x *WasmPlugin) GetMatchRules() []*MatchRule {
+	if x != nil {
+		return x.MatchRules
+	}
+	return nil
+}
+
+func (x *WasmPlugin) GetDefaultConfigDisable() bool {
+	if x != nil {
+		return x.DefaultConfigDisable
+	}
+	return false
+}
+
+// Extended by Higress
+type MatchRule struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Ingress       []string        `protobuf:"bytes,1,rep,name=ingress,proto3" json:"ingress,omitempty"`
+	Domain        []string        `protobuf:"bytes,2,rep,name=domain,proto3" json:"domain,omitempty"`
+	Config        *_struct.Struct `protobuf:"bytes,3,opt,name=config,proto3" json:"config,omitempty"`
+	ConfigDisable bool            `protobuf:"varint,4,opt,name=config_disable,json=configDisable,proto3" json:"config_disable,omitempty"`
+	Service       []string        `protobuf:"bytes,5,rep,name=service,proto3" json:"service,omitempty"`
+}
+
+func (x *MatchRule) Reset() {
+	*x = MatchRule{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_extensions_v1alpha1_wasmplugin_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MatchRule) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MatchRule) ProtoMessage() {}
+
+func (x *MatchRule) ProtoReflect() protoreflect.Message {
+	mi := &file_extensions_v1alpha1_wasmplugin_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MatchRule.ProtoReflect.Descriptor instead.
+func (*MatchRule) Descriptor() ([]byte, []int) {
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *MatchRule) GetIngress() []string {
+	if x != nil {
+		return x.Ingress
+	}
+	return nil
+}
+
+func (x *MatchRule) GetDomain() []string {
+	if x != nil {
+		return x.Domain
+	}
+	return nil
+}
+
+func (x *MatchRule) GetConfig() *_struct.Struct {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
+func (x *MatchRule) GetConfigDisable() bool {
+	if x != nil {
+		return x.ConfigDisable
+	}
+	return false
+}
+
+func (x *MatchRule) GetService() []string {
+	if x != nil {
+		return x.Service
+	}
+	return nil
+}
+
+// Configuration for a Wasm VM.
+// more details can be found [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/wasm/v3/wasm.proto#extensions-wasm-v3-vmconfig).
+type VmConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Specifies environment variables to be injected to this VM.
+	// Note that if a key does not exist, it will be ignored.
+	Env []*EnvVar `protobuf:"bytes,1,rep,name=env,proto3" json:"env,omitempty"`
+}
+
+func (x *VmConfig) Reset() {
+	*x = VmConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_extensions_v1alpha1_wasmplugin_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *VmConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VmConfig) ProtoMessage() {}
+
+func (x *VmConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_extensions_v1alpha1_wasmplugin_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VmConfig.ProtoReflect.Descriptor instead.
+func (*VmConfig) Descriptor() ([]byte, []int) {
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *VmConfig) GetEnv() []*EnvVar {
+	if x != nil {
+		return x.Env
+	}
+	return nil
+}
+
+type EnvVar struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Required
+	// Name of the environment variable. Must be a C_IDENTIFIER.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Required
+	// Source for the environment variable's value.
+	ValueFrom EnvValueSource `protobuf:"varint,3,opt,name=value_from,json=valueFrom,proto3,enum=higress.extensions.v1alpha1.EnvValueSource" json:"value_from,omitempty"`
+	// Value for the environment variable.
+	// Note that if `value_from` is `HOST`, it will be ignored.
+	// Defaults to "".
+	Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (x *EnvVar) Reset() {
+	*x = EnvVar{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_extensions_v1alpha1_wasmplugin_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EnvVar) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EnvVar) ProtoMessage() {}
+
+func (x *EnvVar) ProtoReflect() protoreflect.Message {
+	mi := &file_extensions_v1alpha1_wasmplugin_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EnvVar.ProtoReflect.Descriptor instead.
+func (*EnvVar) Descriptor() ([]byte, []int) {
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *EnvVar) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *EnvVar) GetValueFrom() EnvValueSource {
+	if x != nil {
+		return x.ValueFrom
+	}
+	return EnvValueSource_INLINE
+}
+
+func (x *EnvVar) GetValue() string {
+	if x != nil {
+		return x.Value
+	}
+	return ""
+}
+
+var File_extensions_v1alpha1_wasmplugin_proto protoreflect.FileDescriptor
+
+var file_extensions_v1alpha1_wasmplugin_proto_rawDesc = []byte{
+	0x0a, 0x24, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x77, 0x61, 0x73, 0x6d, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1b, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2e,
+	0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2f, 0x77, 0x72, 0x61, 0x70, 0x70, 0x65, 0x72, 0x73, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x1a, 0x1c, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2f, 0x73, 0x74, 0x72, 0x75, 0x63, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x22, 0x8d, 0x06, 0x0a, 0x0a, 0x57, 0x61, 0x73, 0x6d, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e,
+	0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75,
+	0x72, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x68, 0x61, 0x32, 0x35, 0x36, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x06, 0x73, 0x68, 0x61, 0x32, 0x35, 0x36, 0x12, 0x53, 0x0a, 0x11, 0x69, 0x6d,
+	0x61, 0x67, 0x65, 0x5f, 0x70, 0x75, 0x6c, 0x6c, 0x5f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x27, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2e,
+	0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x2e, 0x50, 0x75, 0x6c, 0x6c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x0f,
+	0x69, 0x6d, 0x61, 0x67, 0x65, 0x50, 0x75, 0x6c, 0x6c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12,
+	0x2a, 0x0a, 0x11, 0x69, 0x6d, 0x61, 0x67, 0x65, 0x5f, 0x70, 0x75, 0x6c, 0x6c, 0x5f, 0x73, 0x65,
+	0x63, 0x72, 0x65, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x69, 0x6d, 0x61, 0x67,
+	0x65, 0x50, 0x75, 0x6c, 0x6c, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x29, 0x0a, 0x10, 0x76,
+	0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6b, 0x65, 0x79, 0x18,
+	0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x4b, 0x65, 0x79, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
+	0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x0c, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x3e, 0x0a, 0x05, 0x70, 0x68, 0x61, 0x73, 0x65, 0x18, 0x09,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x28, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2e, 0x65,
+	0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x2e, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x50, 0x68, 0x61, 0x73, 0x65, 0x52, 0x05,
+	0x70, 0x68, 0x61, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x08, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x69, 0x74,
+	0x79, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x4e,
+	0x0a, 0x0d, 0x66, 0x61, 0x69, 0x6c, 0x5f, 0x73, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x18,
+	0x0d, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x29, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2e,
+	0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x2e, 0x46, 0x61, 0x69, 0x6c, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79,
+	0x52, 0x0c, 0x66, 0x61, 0x69, 0x6c, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x12, 0x42,
+	0x0a, 0x09, 0x76, 0x6d, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x0b, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x25, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2e, 0x65, 0x78, 0x74, 0x65,
+	0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e,
+	0x56, 0x6d, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x08, 0x76, 0x6d, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x12, 0x3e, 0x0a, 0x0e, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x63, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72,
+	0x75, 0x63, 0x74, 0x52, 0x0d, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x12, 0x47, 0x0a, 0x0b, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x5f, 0x72, 0x75, 0x6c, 0x65,
+	0x73, 0x18, 0x66, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73,
+	0x73, 0x2e, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x52, 0x75, 0x6c, 0x65, 0x52,
+	0x0a, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x34, 0x0a, 0x16, 0x64,
+	0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x64, 0x69,
+	0x73, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x67, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x64, 0x65, 0x66,
+	0x61, 0x75, 0x6c, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x22, 0xaf, 0x01, 0x0a, 0x09, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x52, 0x75, 0x6c, 0x65, 0x12,
+	0x18, 0x0a, 0x07, 0x69, 0x6e, 0x67, 0x72, 0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x07, 0x69, 0x6e, 0x67, 0x72, 0x65, 0x73, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x12, 0x2f, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x12, 0x25, 0x0a, 0x0e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x64, 0x69, 0x73,
+	0x61, 0x62, 0x6c, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x73, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x22, 0x41, 0x0a, 0x08, 0x56, 0x6d, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
+	0x35, 0x0a, 0x03, 0x65, 0x6e, 0x76, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68,
+	0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2e, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e,
+	0x73, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x45, 0x6e, 0x76, 0x56, 0x61,
+	0x72, 0x52, 0x03, 0x65, 0x6e, 0x76, 0x22, 0x7e, 0x0a, 0x06, 0x45, 0x6e, 0x76, 0x56, 0x61, 0x72,
+	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x4a, 0x0a, 0x0a, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x66, 0x72,
+	0x6f, 0x6d, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2b, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65,
+	0x73, 0x73, 0x2e, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x45, 0x6e, 0x76, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x53,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x09, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x46, 0x72, 0x6f, 0x6d,
+	0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x2a, 0x45, 0x0a, 0x0b, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e,
+	0x50, 0x68, 0x61, 0x73, 0x65, 0x12, 0x15, 0x0a, 0x11, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49,
+	0x46, 0x49, 0x45, 0x44, 0x5f, 0x50, 0x48, 0x41, 0x53, 0x45, 0x10, 0x00, 0x12, 0x09, 0x0a, 0x05,
+	0x41, 0x55, 0x54, 0x48, 0x4e, 0x10, 0x01, 0x12, 0x09, 0x0a, 0x05, 0x41, 0x55, 0x54, 0x48, 0x5a,
+	0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x53, 0x54, 0x41, 0x54, 0x53, 0x10, 0x03, 0x2a, 0x42, 0x0a,
+	0x0a, 0x50, 0x75, 0x6c, 0x6c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x16, 0x0a, 0x12, 0x55,
+	0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x5f, 0x50, 0x4f, 0x4c, 0x49, 0x43,
+	0x59, 0x10, 0x00, 0x12, 0x10, 0x0a, 0x0c, 0x49, 0x66, 0x4e, 0x6f, 0x74, 0x50, 0x72, 0x65, 0x73,
+	0x65, 0x6e, 0x74, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x41, 0x6c, 0x77, 0x61, 0x79, 0x73, 0x10,
+	0x02, 0x2a, 0x26, 0x0a, 0x0e, 0x45, 0x6e, 0x76, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x53, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x12, 0x0a, 0x0a, 0x06, 0x49, 0x4e, 0x4c, 0x49, 0x4e, 0x45, 0x10, 0x00, 0x12,
+	0x08, 0x0a, 0x04, 0x48, 0x4f, 0x53, 0x54, 0x10, 0x01, 0x2a, 0x2d, 0x0a, 0x0c, 0x46, 0x61, 0x69,
+	0x6c, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x12, 0x0e, 0x0a, 0x0a, 0x46, 0x41, 0x49,
+	0x4c, 0x5f, 0x43, 0x4c, 0x4f, 0x53, 0x45, 0x10, 0x00, 0x12, 0x0d, 0x0a, 0x09, 0x46, 0x41, 0x49,
+	0x4c, 0x5f, 0x4f, 0x50, 0x45, 0x4e, 0x10, 0x01, 0x42, 0x34, 0x5a, 0x32, 0x67, 0x69, 0x74, 0x68,
+	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x61, 0x6c, 0x69, 0x62, 0x61, 0x62, 0x61, 0x2f, 0x68,
+	0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x65, 0x78, 0x74, 0x65, 0x6e,
+	0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_extensions_v1alpha1_wasmplugin_proto_rawDescOnce sync.Once
+	file_extensions_v1alpha1_wasmplugin_proto_rawDescData = file_extensions_v1alpha1_wasmplugin_proto_rawDesc
+)
+
+func file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP() []byte {
+	file_extensions_v1alpha1_wasmplugin_proto_rawDescOnce.Do(func() {
+		file_extensions_v1alpha1_wasmplugin_proto_rawDescData = protoimpl.X.CompressGZIP(file_extensions_v1alpha1_wasmplugin_proto_rawDescData)
+	})
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescData
+}
+
+var file_extensions_v1alpha1_wasmplugin_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
+var file_extensions_v1alpha1_wasmplugin_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_extensions_v1alpha1_wasmplugin_proto_goTypes = []interface{}{
+	(PluginPhase)(0),            // 0: higress.extensions.v1alpha1.PluginPhase
+	(PullPolicy)(0),             // 1: higress.extensions.v1alpha1.PullPolicy
+	(EnvValueSource)(0),         // 2: higress.extensions.v1alpha1.EnvValueSource
+	(FailStrategy)(0),           // 3: higress.extensions.v1alpha1.FailStrategy
+	(*WasmPlugin)(nil),          // 4: higress.extensions.v1alpha1.WasmPlugin
+	(*MatchRule)(nil),           // 5: higress.extensions.v1alpha1.MatchRule
+	(*VmConfig)(nil),            // 6: higress.extensions.v1alpha1.VmConfig
+	(*EnvVar)(nil),              // 7: higress.extensions.v1alpha1.EnvVar
+	(*_struct.Struct)(nil),      // 8: google.protobuf.Struct
+	(*wrappers.Int32Value)(nil), // 9: google.protobuf.Int32Value
+}
+var file_extensions_v1alpha1_wasmplugin_proto_depIdxs = []int32{
+	1,  // 0: higress.extensions.v1alpha1.WasmPlugin.image_pull_policy:type_name -> higress.extensions.v1alpha1.PullPolicy
+	8,  // 1: higress.extensions.v1alpha1.WasmPlugin.plugin_config:type_name -> google.protobuf.Struct
+	0,  // 2: higress.extensions.v1alpha1.WasmPlugin.phase:type_name -> higress.extensions.v1alpha1.PluginPhase
+	9,  // 3: higress.extensions.v1alpha1.WasmPlugin.priority:type_name -> google.protobuf.Int32Value
+	3,  // 4: higress.extensions.v1alpha1.WasmPlugin.fail_strategy:type_name -> higress.extensions.v1alpha1.FailStrategy
+	6,  // 5: higress.extensions.v1alpha1.WasmPlugin.vm_config:type_name -> higress.extensions.v1alpha1.VmConfig
+	8,  // 6: higress.extensions.v1alpha1.WasmPlugin.default_config:type_name -> google.protobuf.Struct
+	5,  // 7: higress.extensions.v1alpha1.WasmPlugin.match_rules:type_name -> higress.extensions.v1alpha1.MatchRule
+	8,  // 8: higress.extensions.v1alpha1.MatchRule.config:type_name -> google.protobuf.Struct
+	7,  // 9: higress.extensions.v1alpha1.VmConfig.env:type_name -> higress.extensions.v1alpha1.EnvVar
+	2,  // 10: higress.extensions.v1alpha1.EnvVar.value_from:type_name -> higress.extensions.v1alpha1.EnvValueSource
+	11, // [11:11] is the sub-list for method output_type
+	11, // [11:11] is the sub-list for method input_type
+	11, // [11:11] is the sub-list for extension type_name
+	11, // [11:11] is the sub-list for extension extendee
+	0,  // [0:11] is the sub-list for field type_name
+}
+
+func init() { file_extensions_v1alpha1_wasmplugin_proto_init() }
+func file_extensions_v1alpha1_wasmplugin_proto_init() {
+	if File_extensions_v1alpha1_wasmplugin_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_extensions_v1alpha1_wasmplugin_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WasmPlugin); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_extensions_v1alpha1_wasmplugin_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MatchRule); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_extensions_v1alpha1_wasmplugin_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*VmConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_extensions_v1alpha1_wasmplugin_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EnvVar); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_extensions_v1alpha1_wasmplugin_proto_rawDesc,
+			NumEnums:      4,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_extensions_v1alpha1_wasmplugin_proto_goTypes,
+		DependencyIndexes: file_extensions_v1alpha1_wasmplugin_proto_depIdxs,
+		EnumInfos:         file_extensions_v1alpha1_wasmplugin_proto_enumTypes,
+		MessageInfos:      file_extensions_v1alpha1_wasmplugin_proto_msgTypes,
+	}.Build()
+	File_extensions_v1alpha1_wasmplugin_proto = out.File
+	file_extensions_v1alpha1_wasmplugin_proto_rawDesc = nil
+	file_extensions_v1alpha1_wasmplugin_proto_goTypes = nil
+	file_extensions_v1alpha1_wasmplugin_proto_depIdxs = nil
+}

api/extensions/v1alpha1/wasmplugin.proto

@@ -98,7 +98,14 @@ message WasmPlugin {
   // If `priority` is not set, or two `WasmPlugins` exist with the same
   // value, the ordering will be deterministically derived from name and
   // namespace of the `WasmPlugins`. Defaults to `0`.
-  google.protobuf.Int64Value priority = 10;
+  google.protobuf.Int32Value priority = 10;
+
+  // Specifies the failure behavior for the plugin due to fatal errors.
+  FailStrategy fail_strategy = 13;
+
+  // Configuration for a Wasm VM.
+  // more details can be found [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/wasm/v3/wasm.proto#extensions-wasm-v3-vmconfig).
+  VmConfig vm_config = 11;
 
   // Extended by Higress, the default configuration takes effect globally
   google.protobuf.Struct default_config = 101;
@@ -114,6 +121,7 @@ message MatchRule {
   repeated string domain = 2;
   google.protobuf.Struct config = 3;
   bool config_disable = 4;
+  repeated string service = 5;
 }
 
 // The phase in the filter chain where the plugin will be injected.
@@ -153,3 +161,46 @@ enum PullPolicy {
   // this plugin.
   Always = 2;
 }
+
+// Configuration for a Wasm VM.
+// more details can be found [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/wasm/v3/wasm.proto#extensions-wasm-v3-vmconfig).
+message VmConfig {
+  // Specifies environment variables to be injected to this VM.
+  // Note that if a key does not exist, it will be ignored.
+  repeated EnvVar env = 1;
+}
+
+message EnvVar {
+  // Required
+  // Name of the environment variable. Must be a C_IDENTIFIER.
+  string name = 1;
+
+  // Required
+  // Source for the environment variable's value.
+  EnvValueSource value_from = 3;
+
+  // Value for the environment variable.
+  // Note that if `value_from` is `HOST`, it will be ignored.
+  // Defaults to "".
+  string value = 2;
+}
+
+enum EnvValueSource {
+  // Explicitly given key-value pairs to be injected to this VM
+  INLINE = 0;
+
+  // *Istio-proxy's* environment variables exposed to this VM.
+  HOST = 1;
+}
+
+enum FailStrategy {
+  // A fatal error in the binary fetching or during the plugin execution causes
+  // all subsequent requests to fail with 5xx.
+  FAIL_CLOSE = 0;
+
+  // Enables the fail open behavior for the Wasm plugin fatal errors to bypass
+  // the plugin execution. A fatal error can be a failure to fetch the remote
+  // binary, an exception, or abort() on the VM. This flag is not recommended
+  // for the authentication or the authorization plugins.
+  FAIL_OPEN = 1;
+}

api/extensions/v1alpha1/wasmplugin_deepcopy.gen.go

@@ -0,0 +1,90 @@
+// Code generated by protoc-gen-deepcopy. DO NOT EDIT.
+package v1alpha1
+
+import (
+	proto "google.golang.org/protobuf/proto"
+)
+
+// DeepCopyInto supports using WasmPlugin within kubernetes types, where deepcopy-gen is used.
+func (in *WasmPlugin) DeepCopyInto(out *WasmPlugin) {
+	p := proto.Clone(in).(*WasmPlugin)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WasmPlugin. Required by controller-gen.
+func (in *WasmPlugin) DeepCopy() *WasmPlugin {
+	if in == nil {
+		return nil
+	}
+	out := new(WasmPlugin)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new WasmPlugin. Required by controller-gen.
+func (in *WasmPlugin) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using MatchRule within kubernetes types, where deepcopy-gen is used.
+func (in *MatchRule) DeepCopyInto(out *MatchRule) {
+	p := proto.Clone(in).(*MatchRule)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MatchRule. Required by controller-gen.
+func (in *MatchRule) DeepCopy() *MatchRule {
+	if in == nil {
+		return nil
+	}
+	out := new(MatchRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new MatchRule. Required by controller-gen.
+func (in *MatchRule) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using VmConfig within kubernetes types, where deepcopy-gen is used.
+func (in *VmConfig) DeepCopyInto(out *VmConfig) {
+	p := proto.Clone(in).(*VmConfig)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VmConfig. Required by controller-gen.
+func (in *VmConfig) DeepCopy() *VmConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(VmConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new VmConfig. Required by controller-gen.
+func (in *VmConfig) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using EnvVar within kubernetes types, where deepcopy-gen is used.
+func (in *EnvVar) DeepCopyInto(out *EnvVar) {
+	p := proto.Clone(in).(*EnvVar)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvVar. Required by controller-gen.
+func (in *EnvVar) DeepCopy() *EnvVar {
+	if in == nil {
+		return nil
+	}
+	out := new(EnvVar)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new EnvVar. Required by controller-gen.
+func (in *EnvVar) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}

api/extensions/v1alpha1/wasmplugin_json.gen.go

@@ -0,0 +1,56 @@
+// Code generated by protoc-gen-jsonshim. DO NOT EDIT.
+package v1alpha1
+
+import (
+	bytes "bytes"
+	jsonpb "github.com/golang/protobuf/jsonpb"
+)
+
+// MarshalJSON is a custom marshaler for WasmPlugin
+func (this *WasmPlugin) MarshalJSON() ([]byte, error) {
+	str, err := WasmpluginMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for WasmPlugin
+func (this *WasmPlugin) UnmarshalJSON(b []byte) error {
+	return WasmpluginUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for MatchRule
+func (this *MatchRule) MarshalJSON() ([]byte, error) {
+	str, err := WasmpluginMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for MatchRule
+func (this *MatchRule) UnmarshalJSON(b []byte) error {
+	return WasmpluginUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for VmConfig
+func (this *VmConfig) MarshalJSON() ([]byte, error) {
+	str, err := WasmpluginMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for VmConfig
+func (this *VmConfig) UnmarshalJSON(b []byte) error {
+	return WasmpluginUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for EnvVar
+func (this *EnvVar) MarshalJSON() ([]byte, error) {
+	str, err := WasmpluginMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for EnvVar
+func (this *EnvVar) UnmarshalJSON(b []byte) error {
+	return WasmpluginUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+var (
+	WasmpluginMarshaler   = &jsonpb.Marshaler{}
+	WasmpluginUnmarshaler = &jsonpb.Unmarshaler{AllowUnknownFields: true}
+)

api/kubernetes/customresourcedefinitions.gen.yaml

@@ -37,6 +37,13 @@ spec:
                 x-kubernetes-preserve-unknown-fields: true
               defaultConfigDisable:
                 type: boolean
+              failStrategy:
+                description: Specifies the failure behavior for the plugin due to
+                  fatal errors.
+                enum:
+                - FAIL_CLOSE
+                - FAIL_OPEN
+                type: string
               imagePullPolicy:
                 description: The pull behaviour to be applied when fetching an OCI
                   image.
@@ -64,6 +71,10 @@ spec:
                       items:
                         type: string
                       type: array
+                    service:
+                      items:
+                        type: string
+                      type: array
                   type: object
                 type: array
               phase:
@@ -94,6 +105,27 @@ spec:
                 type: string
               verificationKey:
                 type: string
+              vmConfig:
+                description: Configuration for a Wasm VM.
+                properties:
+                  env:
+                    description: Specifies environment variables to be injected to
+                      this VM.
+                    items:
+                      properties:
+                        name:
+                          type: string
+                        value:
+                          description: Value for the environment variable.
+                          type: string
+                        valueFrom:
+                          enum:
+                          - INLINE
+                          - HOST
+                          type: string
+                      type: object
+                    type: array
+                type: object
             type: object
           status:
             type: object
@@ -252,6 +284,10 @@ spec:
                       type: string
                     port:
                       type: integer
+                    protocol:
+                      type: string
+                    sni:
+                      type: string
                     type:
                       type: string
                     zkServicesPath:

api/networking/v1/http_2_rpc_deepcopy.gen.go

@@ -1,20 +1,10 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: networking/v1/http_2_rpc.proto
-
+// Code generated by protoc-gen-deepcopy. DO NOT EDIT.
 package v1
 
 import (
-	fmt "fmt"
-	proto "github.com/gogo/protobuf/proto"
-	_ "istio.io/gogo-genproto/googleapis/google/api"
-	math "math"
+	proto "google.golang.org/protobuf/proto"
 )
 
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
 // DeepCopyInto supports using Http2Rpc within kubernetes types, where deepcopy-gen is used.
 func (in *Http2Rpc) DeepCopyInto(out *Http2Rpc) {
 	p := proto.Clone(in).(*Http2Rpc)

api/networking/v1/http_2_rpc_json.gen.go

@@ -1,22 +1,11 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: networking/v1/http_2_rpc.proto
-
+// Code generated by protoc-gen-jsonshim. DO NOT EDIT.
 package v1
 
 import (
 	bytes "bytes"
-	fmt "fmt"
-	github_com_gogo_protobuf_jsonpb "github.com/gogo/protobuf/jsonpb"
-	proto "github.com/gogo/protobuf/proto"
-	_ "istio.io/gogo-genproto/googleapis/google/api"
-	math "math"
+	jsonpb "github.com/golang/protobuf/jsonpb"
 )
 
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
 // MarshalJSON is a custom marshaler for Http2Rpc
 func (this *Http2Rpc) MarshalJSON() ([]byte, error) {
 	str, err := Http_2RpcMarshaler.MarshalToString(this)
@@ -84,6 +73,6 @@ func (this *GrpcService) UnmarshalJSON(b []byte) error {
 }
 
 var (
-	Http_2RpcMarshaler   = &github_com_gogo_protobuf_jsonpb.Marshaler{}
-	Http_2RpcUnmarshaler = &github_com_gogo_protobuf_jsonpb.Unmarshaler{AllowUnknownFields: true}
+	Http_2RpcMarshaler   = &jsonpb.Marshaler{}
+	Http_2RpcUnmarshaler = &jsonpb.Unmarshaler{AllowUnknownFields: true}
 )

api/networking/v1/mcp_bridge.proto

@@ -64,4 +64,6 @@ message RegistryConfig {
   string consulServiceTag = 15;
   int64  consulRefreshInterval = 16;
   string authSecretName = 17;
+  string protocol = 18;
+  string sni = 19;
 }

api/networking/v1/mcp_bridge_deepcopy.gen.go

@@ -1,20 +1,10 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: networking/v1/mcp_bridge.proto
-
+// Code generated by protoc-gen-deepcopy. DO NOT EDIT.
 package v1
 
 import (
-	fmt "fmt"
-	proto "github.com/gogo/protobuf/proto"
-	_ "istio.io/gogo-genproto/googleapis/google/api"
-	math "math"
+	proto "google.golang.org/protobuf/proto"
 )
 
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
 // DeepCopyInto supports using McpBridge within kubernetes types, where deepcopy-gen is used.
 func (in *McpBridge) DeepCopyInto(out *McpBridge) {
 	p := proto.Clone(in).(*McpBridge)

api/networking/v1/mcp_bridge_json.gen.go

@@ -1,22 +1,11 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: networking/v1/mcp_bridge.proto
-
+// Code generated by protoc-gen-jsonshim. DO NOT EDIT.
 package v1
 
 import (
 	bytes "bytes"
-	fmt "fmt"
-	github_com_gogo_protobuf_jsonpb "github.com/gogo/protobuf/jsonpb"
-	proto "github.com/gogo/protobuf/proto"
-	_ "istio.io/gogo-genproto/googleapis/google/api"
-	math "math"
+	jsonpb "github.com/golang/protobuf/jsonpb"
 )
 
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
 // MarshalJSON is a custom marshaler for McpBridge
 func (this *McpBridge) MarshalJSON() ([]byte, error) {
 	str, err := McpBridgeMarshaler.MarshalToString(this)
@@ -40,6 +29,6 @@ func (this *RegistryConfig) UnmarshalJSON(b []byte) error {
 }
 
 var (
-	McpBridgeMarshaler   = &github_com_gogo_protobuf_jsonpb.Marshaler{}
-	McpBridgeUnmarshaler = &github_com_gogo_protobuf_jsonpb.Unmarshaler{AllowUnknownFields: true}
+	McpBridgeMarshaler   = &jsonpb.Marshaler{}
+	McpBridgeUnmarshaler = &jsonpb.Unmarshaler{AllowUnknownFields: true}
 )

client/Makefile

@@ -16,6 +16,7 @@
 ########################
 # kubernetes code generators
 ########################
+applyconfiguration_gen = applyconfiguration-gen
 kubetype_gen = kubetype-gen
 deepcopy_gen = deepcopy-gen
 client_gen = client-gen
@@ -42,6 +43,8 @@ kube_api_packages = $(subst $(space),$(empty), \
 	$(kube_api_base_package)/networking/v1, \
 	$(kube_api_base_package)/extensions/v1alpha1 \
 	)
+# this is needed to properly generate ssa functions
+kube_api_applyconfiguration_packages = $(kube_api_packages),k8s.io/apimachinery/pkg/apis/meta/v1
 # base output package used by kubernetes client-gen
 kube_clientset_package = $(kube_base_output_package)/clientset
 # clientset name used by kubernetes client-gen
@@ -50,6 +53,8 @@ kube_clientset_name = versioned
 kube_listers_package = $(kube_base_output_package)/listers
 # base output package used by kubernetes informer-gen
 kube_informers_package = $(kube_base_output_package)/informers
+# base output package used by kubernetes applyconfiguration-gen
+kube_applyconfiguration_package = $(kube_base_output_package)/applyconfiguration
 
 # file header text
 kube_go_header_text = header.go.txt
@@ -73,12 +78,14 @@ rename_generated_files=\
 .PHONY: generate-k8s-client
 generate-k8s-client:
 	# generate kube api type wrappers for higress types
-	@$(kubetype_gen) --input-dirs $(kube_source_packages) --output-package $(kube_api_base_package) -h $(kube_go_header_text)
+	@KUBETYPE_GOLANG_PROTOBUF=true $(kubetype_gen) --input-dirs $(kube_source_packages) --output-package $(kube_api_base_package) -h $(kube_go_header_text)
 	@$(move_generated)
 	# generate deepcopy for kube api types
 	@$(deepcopy_gen) --input-dirs $(kube_api_packages) -O zz_generated.deepcopy  -h $(kube_go_header_text)
+	# generate ssa for kube api types
+	@$(applyconfiguration_gen) --input-dirs $(kube_api_applyconfiguration_packages) --output-package $(kube_applyconfiguration_package) -h $(kube_go_header_text)
 	# generate clientsets for kube api types
-	@$(client_gen) --clientset-name $(kube_clientset_name) --input-base "" --input  $(kube_api_packages) --output-package $(kube_clientset_package) -h $(kube_go_header_text)
+	@$(client_gen) --clientset-name $(kube_clientset_name) --input-base "" --input  $(kube_api_packages) --output-package $(kube_clientset_package) -h $(kube_go_header_text) --apply-configuration-package $(kube_applyconfiguration_package)
 	# generate listers for kube api types
 	@$(lister_gen) --input-dirs $(kube_api_packages) --output-package $(kube_listers_package) -h $(kube_go_header_text)
 	# generate informers for kube api types
@@ -88,6 +95,6 @@ generate-k8s-client:
 
 
 .PHONY: clean-k8s-client
-clean-k8s-client:
+clean-k8s-cliennt:
     # remove generated code
 	@rm -rf pkg/

client/pkg/apis/extensions/v1alpha1/types.gen.go

@@ -65,5 +65,5 @@ type WasmPluginList struct {
 	v1.TypeMeta `json:",inline"`
 	// +optional
 	v1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-	Items       []WasmPlugin `json:"items" protobuf:"bytes,2,rep,name=items"`
+	Items       []*WasmPlugin `json:"items" protobuf:"bytes,2,rep,name=items"`
 }

client/pkg/apis/extensions/v1alpha1/zz_generated.deepcopy.gen.go

@@ -58,9 +58,13 @@ func (in *WasmPluginList) DeepCopyInto(out *WasmPluginList) {
 	in.ListMeta.DeepCopyInto(&out.ListMeta)
 	if in.Items != nil {
 		in, out := &in.Items, &out.Items
-		*out = make([]WasmPlugin, len(*in))
+		*out = make([]*WasmPlugin, len(*in))
 		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(WasmPlugin)
+				(*in).DeepCopyInto(*out)
+			}
 		}
 	}
 	return

client/pkg/apis/networking/v1/types.gen.go

@@ -22,7 +22,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-// please upgrade the proto package
+//
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
 // <!-- crd generation tags
@@ -61,10 +61,10 @@ type Http2RpcList struct {
 	metav1.TypeMeta `json:",inline"`
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-	Items           []Http2Rpc `json:"items" protobuf:"bytes,2,rep,name=items"`
+	Items           []*Http2Rpc `json:"items" protobuf:"bytes,2,rep,name=items"`
 }
 
-// please upgrade the proto package
+//
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
 // <!-- crd generation tags
@@ -103,5 +103,5 @@ type McpBridgeList struct {
 	metav1.TypeMeta `json:",inline"`
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-	Items           []McpBridge `json:"items" protobuf:"bytes,2,rep,name=items"`
+	Items           []*McpBridge `json:"items" protobuf:"bytes,2,rep,name=items"`
 }

client/pkg/apis/networking/v1/zz_generated.deepcopy.gen.go

@@ -58,9 +58,13 @@ func (in *Http2RpcList) DeepCopyInto(out *Http2RpcList) {
 	in.ListMeta.DeepCopyInto(&out.ListMeta)
 	if in.Items != nil {
 		in, out := &in.Items, &out.Items
-		*out = make([]Http2Rpc, len(*in))
+		*out = make([]*Http2Rpc, len(*in))
 		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(Http2Rpc)
+				(*in).DeepCopyInto(*out)
+			}
 		}
 	}
 	return
@@ -119,9 +123,13 @@ func (in *McpBridgeList) DeepCopyInto(out *McpBridgeList) {
 	in.ListMeta.DeepCopyInto(&out.ListMeta)
 	if in.Items != nil {
 		in, out := &in.Items, &out.Items
-		*out = make([]McpBridge, len(*in))
+		*out = make([]*McpBridge, len(*in))
 		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(McpBridge)
+				(*in).DeepCopyInto(*out)
+			}
 		}
 	}
 	return

client/pkg/applyconfiguration/extensions/v1alpha1/wasmplugin.go

@@ -0,0 +1,219 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1alpha1 "github.com/alibaba/higress/api/extensions/v1alpha1"
+	v1 "github.com/alibaba/higress/client/pkg/applyconfiguration/meta/v1"
+	metav1alpha1 "istio.io/api/meta/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+)
+
+// WasmPluginApplyConfiguration represents an declarative configuration of the WasmPlugin type for use
+// with apply.
+type WasmPluginApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *v1alpha1.WasmPlugin      `json:"spec,omitempty"`
+	Status                           *metav1alpha1.IstioStatus `json:"status,omitempty"`
+}
+
+// WasmPlugin constructs an declarative configuration of the WasmPlugin type for use with
+// apply.
+func WasmPlugin(name, namespace string) *WasmPluginApplyConfiguration {
+	b := &WasmPluginApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("WasmPlugin")
+	b.WithAPIVersion("extensions.higress.io/v1alpha1")
+	return b
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithKind(value string) *WasmPluginApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithAPIVersion(value string) *WasmPluginApplyConfiguration {
+	b.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithName(value string) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithGenerateName(value string) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithNamespace(value string) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithUID(value types.UID) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithResourceVersion(value string) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithGeneration(value int64) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithCreationTimestamp(value metav1.Time) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *WasmPluginApplyConfiguration) WithLabels(entries map[string]string) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.Labels == nil && len(entries) > 0 {
+		b.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *WasmPluginApplyConfiguration) WithAnnotations(entries map[string]string) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.Annotations == nil && len(entries) > 0 {
+		b.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *WasmPluginApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.OwnerReferences = append(b.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *WasmPluginApplyConfiguration) WithFinalizers(values ...string) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.Finalizers = append(b.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *WasmPluginApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithSpec(value v1alpha1.WasmPlugin) *WasmPluginApplyConfiguration {
+	b.Spec = &value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithStatus(value metav1alpha1.IstioStatus) *WasmPluginApplyConfiguration {
+	b.Status = &value
+	return b
+}

client/pkg/applyconfiguration/internal/internal.go

@@ -0,0 +1,60 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package internal
+
+import (
+	"fmt"
+	"sync"
+
+	typed "sigs.k8s.io/structured-merge-diff/v4/typed"
+)
+
+func Parser() *typed.Parser {
+	parserOnce.Do(func() {
+		var err error
+		parser, err = typed.NewParser(schemaYAML)
+		if err != nil {
+			panic(fmt.Sprintf("Failed to parse schema: %v", err))
+		}
+	})
+	return parser
+}
+
+var parserOnce sync.Once
+var parser *typed.Parser
+var schemaYAML = typed.YAMLObject(`types:
+- name: __untyped_atomic_
+  scalar: untyped
+  list:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+  map:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+- name: __untyped_deduced_
+  scalar: untyped
+  list:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+  map:
+    elementType:
+      namedType: __untyped_deduced_
+    elementRelationship: separable
+`)

client/pkg/applyconfiguration/meta/v1/managedfieldsentry.go

@@ -0,0 +1,95 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// ManagedFieldsEntryApplyConfiguration represents an declarative configuration of the ManagedFieldsEntry type for use
+// with apply.
+type ManagedFieldsEntryApplyConfiguration struct {
+	Manager     *string                        `json:"manager,omitempty"`
+	Operation   *v1.ManagedFieldsOperationType `json:"operation,omitempty"`
+	APIVersion  *string                        `json:"apiVersion,omitempty"`
+	Time        *v1.Time                       `json:"time,omitempty"`
+	FieldsType  *string                        `json:"fieldsType,omitempty"`
+	FieldsV1    *v1.FieldsV1                   `json:"fieldsV1,omitempty"`
+	Subresource *string                        `json:"subresource,omitempty"`
+}
+
+// ManagedFieldsEntryApplyConfiguration constructs an declarative configuration of the ManagedFieldsEntry type for use with
+// apply.
+func ManagedFieldsEntry() *ManagedFieldsEntryApplyConfiguration {
+	return &ManagedFieldsEntryApplyConfiguration{}
+}
+
+// WithManager sets the Manager field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Manager field is set to the value of the last call.
+func (b *ManagedFieldsEntryApplyConfiguration) WithManager(value string) *ManagedFieldsEntryApplyConfiguration {
+	b.Manager = &value
+	return b
+}
+
+// WithOperation sets the Operation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Operation field is set to the value of the last call.
+func (b *ManagedFieldsEntryApplyConfiguration) WithOperation(value v1.ManagedFieldsOperationType) *ManagedFieldsEntryApplyConfiguration {
+	b.Operation = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *ManagedFieldsEntryApplyConfiguration) WithAPIVersion(value string) *ManagedFieldsEntryApplyConfiguration {
+	b.APIVersion = &value
+	return b
+}
+
+// WithTime sets the Time field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Time field is set to the value of the last call.
+func (b *ManagedFieldsEntryApplyConfiguration) WithTime(value v1.Time) *ManagedFieldsEntryApplyConfiguration {
+	b.Time = &value
+	return b
+}
+
+// WithFieldsType sets the FieldsType field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the FieldsType field is set to the value of the last call.
+func (b *ManagedFieldsEntryApplyConfiguration) WithFieldsType(value string) *ManagedFieldsEntryApplyConfiguration {
+	b.FieldsType = &value
+	return b
+}
+
+// WithFieldsV1 sets the FieldsV1 field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the FieldsV1 field is set to the value of the last call.
+func (b *ManagedFieldsEntryApplyConfiguration) WithFieldsV1(value v1.FieldsV1) *ManagedFieldsEntryApplyConfiguration {
+	b.FieldsV1 = &value
+	return b
+}
+
+// WithSubresource sets the Subresource field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Subresource field is set to the value of the last call.
+func (b *ManagedFieldsEntryApplyConfiguration) WithSubresource(value string) *ManagedFieldsEntryApplyConfiguration {
+	b.Subresource = &value
+	return b
+}

client/pkg/applyconfiguration/meta/v1/objectmeta.go

@@ -0,0 +1,169 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+)
+
+// ObjectMetaApplyConfiguration represents an declarative configuration of the ObjectMeta type for use
+// with apply.
+type ObjectMetaApplyConfiguration struct {
+	Name                       *string                            `json:"name,omitempty"`
+	GenerateName               *string                            `json:"generateName,omitempty"`
+	Namespace                  *string                            `json:"namespace,omitempty"`
+	UID                        *types.UID                         `json:"uid,omitempty"`
+	ResourceVersion            *string                            `json:"resourceVersion,omitempty"`
+	Generation                 *int64                             `json:"generation,omitempty"`
+	CreationTimestamp          *v1.Time                           `json:"creationTimestamp,omitempty"`
+	DeletionTimestamp          *v1.Time                           `json:"deletionTimestamp,omitempty"`
+	DeletionGracePeriodSeconds *int64                             `json:"deletionGracePeriodSeconds,omitempty"`
+	Labels                     map[string]string                  `json:"labels,omitempty"`
+	Annotations                map[string]string                  `json:"annotations,omitempty"`
+	OwnerReferences            []OwnerReferenceApplyConfiguration `json:"ownerReferences,omitempty"`
+	Finalizers                 []string                           `json:"finalizers,omitempty"`
+}
+
+// ObjectMetaApplyConfiguration constructs an declarative configuration of the ObjectMeta type for use with
+// apply.
+func ObjectMeta() *ObjectMetaApplyConfiguration {
+	return &ObjectMetaApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithName(value string) *ObjectMetaApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithGenerateName(value string) *ObjectMetaApplyConfiguration {
+	b.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithNamespace(value string) *ObjectMetaApplyConfiguration {
+	b.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithUID(value types.UID) *ObjectMetaApplyConfiguration {
+	b.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithResourceVersion(value string) *ObjectMetaApplyConfiguration {
+	b.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithGeneration(value int64) *ObjectMetaApplyConfiguration {
+	b.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithCreationTimestamp(value v1.Time) *ObjectMetaApplyConfiguration {
+	b.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithDeletionTimestamp(value v1.Time) *ObjectMetaApplyConfiguration {
+	b.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *ObjectMetaApplyConfiguration {
+	b.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *ObjectMetaApplyConfiguration) WithLabels(entries map[string]string) *ObjectMetaApplyConfiguration {
+	if b.Labels == nil && len(entries) > 0 {
+		b.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *ObjectMetaApplyConfiguration) WithAnnotations(entries map[string]string) *ObjectMetaApplyConfiguration {
+	if b.Annotations == nil && len(entries) > 0 {
+		b.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *ObjectMetaApplyConfiguration) WithOwnerReferences(values ...*OwnerReferenceApplyConfiguration) *ObjectMetaApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.OwnerReferences = append(b.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *ObjectMetaApplyConfiguration) WithFinalizers(values ...string) *ObjectMetaApplyConfiguration {
+	for i := range values {
+		b.Finalizers = append(b.Finalizers, values[i])
+	}
+	return b
+}

client/pkg/applyconfiguration/meta/v1/ownerreference.go

@@ -0,0 +1,86 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	types "k8s.io/apimachinery/pkg/types"
+)
+
+// OwnerReferenceApplyConfiguration represents an declarative configuration of the OwnerReference type for use
+// with apply.
+type OwnerReferenceApplyConfiguration struct {
+	APIVersion         *string    `json:"apiVersion,omitempty"`
+	Kind               *string    `json:"kind,omitempty"`
+	Name               *string    `json:"name,omitempty"`
+	UID                *types.UID `json:"uid,omitempty"`
+	Controller         *bool      `json:"controller,omitempty"`
+	BlockOwnerDeletion *bool      `json:"blockOwnerDeletion,omitempty"`
+}
+
+// OwnerReferenceApplyConfiguration constructs an declarative configuration of the OwnerReference type for use with
+// apply.
+func OwnerReference() *OwnerReferenceApplyConfiguration {
+	return &OwnerReferenceApplyConfiguration{}
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *OwnerReferenceApplyConfiguration) WithAPIVersion(value string) *OwnerReferenceApplyConfiguration {
+	b.APIVersion = &value
+	return b
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *OwnerReferenceApplyConfiguration) WithKind(value string) *OwnerReferenceApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *OwnerReferenceApplyConfiguration) WithName(value string) *OwnerReferenceApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *OwnerReferenceApplyConfiguration) WithUID(value types.UID) *OwnerReferenceApplyConfiguration {
+	b.UID = &value
+	return b
+}
+
+// WithController sets the Controller field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Controller field is set to the value of the last call.
+func (b *OwnerReferenceApplyConfiguration) WithController(value bool) *OwnerReferenceApplyConfiguration {
+	b.Controller = &value
+	return b
+}
+
+// WithBlockOwnerDeletion sets the BlockOwnerDeletion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the BlockOwnerDeletion field is set to the value of the last call.
+func (b *OwnerReferenceApplyConfiguration) WithBlockOwnerDeletion(value bool) *OwnerReferenceApplyConfiguration {
+	b.BlockOwnerDeletion = &value
+	return b
+}

client/pkg/applyconfiguration/meta/v1/typemeta.go

@@ -0,0 +1,46 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// TypeMetaApplyConfiguration represents an declarative configuration of the TypeMeta type for use
+// with apply.
+type TypeMetaApplyConfiguration struct {
+	Kind       *string `json:"kind,omitempty"`
+	APIVersion *string `json:"apiVersion,omitempty"`
+}
+
+// TypeMetaApplyConfiguration constructs an declarative configuration of the TypeMeta type for use with
+// apply.
+func TypeMeta() *TypeMetaApplyConfiguration {
+	return &TypeMetaApplyConfiguration{}
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *TypeMetaApplyConfiguration) WithKind(value string) *TypeMetaApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *TypeMetaApplyConfiguration) WithAPIVersion(value string) *TypeMetaApplyConfiguration {
+	b.APIVersion = &value
+	return b
+}

client/pkg/applyconfiguration/networking/v1/http2rpc.go

@@ -0,0 +1,219 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	networkingv1 "github.com/alibaba/higress/api/networking/v1"
+	v1 "github.com/alibaba/higress/client/pkg/applyconfiguration/meta/v1"
+	v1alpha1 "istio.io/api/meta/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+)
+
+// Http2RpcApplyConfiguration represents an declarative configuration of the Http2Rpc type for use
+// with apply.
+type Http2RpcApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *networkingv1.Http2Rpc `json:"spec,omitempty"`
+	Status                           *v1alpha1.IstioStatus  `json:"status,omitempty"`
+}
+
+// Http2Rpc constructs an declarative configuration of the Http2Rpc type for use with
+// apply.
+func Http2Rpc(name, namespace string) *Http2RpcApplyConfiguration {
+	b := &Http2RpcApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("Http2Rpc")
+	b.WithAPIVersion("networking.higress.io/v1")
+	return b
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithKind(value string) *Http2RpcApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithAPIVersion(value string) *Http2RpcApplyConfiguration {
+	b.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithName(value string) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithGenerateName(value string) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithNamespace(value string) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithUID(value types.UID) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithResourceVersion(value string) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithGeneration(value int64) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithCreationTimestamp(value metav1.Time) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *Http2RpcApplyConfiguration) WithLabels(entries map[string]string) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.Labels == nil && len(entries) > 0 {
+		b.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *Http2RpcApplyConfiguration) WithAnnotations(entries map[string]string) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.Annotations == nil && len(entries) > 0 {
+		b.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *Http2RpcApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.OwnerReferences = append(b.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *Http2RpcApplyConfiguration) WithFinalizers(values ...string) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.Finalizers = append(b.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *Http2RpcApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithSpec(value networkingv1.Http2Rpc) *Http2RpcApplyConfiguration {
+	b.Spec = &value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithStatus(value v1alpha1.IstioStatus) *Http2RpcApplyConfiguration {
+	b.Status = &value
+	return b
+}

client/pkg/applyconfiguration/networking/v1/mcpbridge.go

@@ -0,0 +1,219 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	networkingv1 "github.com/alibaba/higress/api/networking/v1"
+	v1 "github.com/alibaba/higress/client/pkg/applyconfiguration/meta/v1"
+	v1alpha1 "istio.io/api/meta/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+)
+
+// McpBridgeApplyConfiguration represents an declarative configuration of the McpBridge type for use
+// with apply.
+type McpBridgeApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *networkingv1.McpBridge `json:"spec,omitempty"`
+	Status                           *v1alpha1.IstioStatus   `json:"status,omitempty"`
+}
+
+// McpBridge constructs an declarative configuration of the McpBridge type for use with
+// apply.
+func McpBridge(name, namespace string) *McpBridgeApplyConfiguration {
+	b := &McpBridgeApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("McpBridge")
+	b.WithAPIVersion("networking.higress.io/v1")
+	return b
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithKind(value string) *McpBridgeApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithAPIVersion(value string) *McpBridgeApplyConfiguration {
+	b.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithName(value string) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithGenerateName(value string) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithNamespace(value string) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithUID(value types.UID) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithResourceVersion(value string) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithGeneration(value int64) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithCreationTimestamp(value metav1.Time) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *McpBridgeApplyConfiguration) WithLabels(entries map[string]string) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.Labels == nil && len(entries) > 0 {
+		b.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *McpBridgeApplyConfiguration) WithAnnotations(entries map[string]string) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.Annotations == nil && len(entries) > 0 {
+		b.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *McpBridgeApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.OwnerReferences = append(b.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *McpBridgeApplyConfiguration) WithFinalizers(values ...string) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.Finalizers = append(b.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *McpBridgeApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithSpec(value networkingv1.McpBridge) *McpBridgeApplyConfiguration {
+	b.Spec = &value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithStatus(value v1alpha1.IstioStatus) *McpBridgeApplyConfiguration {
+	b.Status = &value
+	return b
+}

client/pkg/applyconfiguration/utils.go

@@ -0,0 +1,55 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package applyconfiguration
+
+import (
+	v1alpha1 "github.com/alibaba/higress/client/pkg/apis/extensions/v1alpha1"
+	networkingv1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
+	extensionsv1alpha1 "github.com/alibaba/higress/client/pkg/applyconfiguration/extensions/v1alpha1"
+	metav1 "github.com/alibaba/higress/client/pkg/applyconfiguration/meta/v1"
+	applyconfigurationnetworkingv1 "github.com/alibaba/higress/client/pkg/applyconfiguration/networking/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// ForKind returns an apply configuration type for the given GroupVersionKind, or nil if no
+// apply configuration type exists for the given GroupVersionKind.
+func ForKind(kind schema.GroupVersionKind) interface{} {
+	switch kind {
+	// Group=extensions.higress.io, Version=v1alpha1
+	case v1alpha1.SchemeGroupVersion.WithKind("WasmPlugin"):
+		return &extensionsv1alpha1.WasmPluginApplyConfiguration{}
+
+		// Group=meta.k8s.io, Version=v1
+	case v1.SchemeGroupVersion.WithKind("ManagedFieldsEntry"):
+		return &metav1.ManagedFieldsEntryApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("ObjectMeta"):
+		return &metav1.ObjectMetaApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("OwnerReference"):
+		return &metav1.OwnerReferenceApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("TypeMeta"):
+		return &metav1.TypeMetaApplyConfiguration{}
+
+		// Group=networking.higress.io, Version=v1
+	case networkingv1.SchemeGroupVersion.WithKind("Http2Rpc"):
+		return &applyconfigurationnetworkingv1.Http2RpcApplyConfiguration{}
+	case networkingv1.SchemeGroupVersion.WithKind("McpBridge"):
+		return &applyconfigurationnetworkingv1.McpBridgeApplyConfiguration{}
+
+	}
+	return nil
+}

client/pkg/clientset/versioned/clientset.gen.go

@@ -18,6 +18,7 @@ package versioned
 
 import (
 	"fmt"
+	"net/http"
 
 	extensionsv1alpha1 "github.com/alibaba/higress/client/pkg/clientset/versioned/typed/extensions/v1alpha1"
 	networkingv1 "github.com/alibaba/higress/client/pkg/clientset/versioned/typed/networking/v1"
@@ -32,8 +33,7 @@ type Interface interface {
 	NetworkingV1() networkingv1.NetworkingV1Interface
 }
 
-// Clientset contains the clients for groups. Each group has exactly one
-// version included in a Clientset.
+// Clientset contains the clients for groups.
 type Clientset struct {
 	*discovery.DiscoveryClient
 	extensionsV1alpha1 *extensionsv1alpha1.ExtensionsV1alpha1Client
@@ -61,26 +61,49 @@ func (c *Clientset) Discovery() discovery.DiscoveryInterface {
 // NewForConfig creates a new Clientset for the given config.
 // If config's RateLimiter is not set and QPS and Burst are acceptable,
 // NewForConfig will generate a rate-limiter in configShallowCopy.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*Clientset, error) {
 	configShallowCopy := *c
+
+	if configShallowCopy.UserAgent == "" {
+		configShallowCopy.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	// share the transport between all clients
+	httpClient, err := rest.HTTPClientFor(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewForConfigAndClient(&configShallowCopy, httpClient)
+}
+
+// NewForConfigAndClient creates a new Clientset for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfigAndClient will generate a rate-limiter in configShallowCopy.
+func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset, error) {
+	configShallowCopy := *c
 	if configShallowCopy.RateLimiter == nil && configShallowCopy.QPS > 0 {
 		if configShallowCopy.Burst <= 0 {
 			return nil, fmt.Errorf("burst is required to be greater than 0 when RateLimiter is not set and QPS is set to greater than 0")
 		}
 		configShallowCopy.RateLimiter = flowcontrol.NewTokenBucketRateLimiter(configShallowCopy.QPS, configShallowCopy.Burst)
 	}
+
 	var cs Clientset
 	var err error
-	cs.extensionsV1alpha1, err = extensionsv1alpha1.NewForConfig(&configShallowCopy)
+	cs.extensionsV1alpha1, err = extensionsv1alpha1.NewForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
 	}
-	cs.networkingV1, err = networkingv1.NewForConfig(&configShallowCopy)
+	cs.networkingV1, err = networkingv1.NewForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
 	}
 
-	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfig(&configShallowCopy)
+	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
 	}
@@ -90,12 +113,11 @@ func NewForConfig(c *rest.Config) (*Clientset, error) {
 // NewForConfigOrDie creates a new Clientset for the given config and
 // panics if there is an error in the config.
 func NewForConfigOrDie(c *rest.Config) *Clientset {
-	var cs Clientset
-	cs.extensionsV1alpha1 = extensionsv1alpha1.NewForConfigOrDie(c)
-	cs.networkingV1 = networkingv1.NewForConfigOrDie(c)
-
-	cs.DiscoveryClient = discovery.NewDiscoveryClientForConfigOrDie(c)
-	return &cs
+	cs, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return cs
 }
 
 // New creates a new Clientset for the given RESTClient.

client/pkg/clientset/versioned/fake/clientset_generated.gen.go

@@ -74,7 +74,10 @@ func (c *Clientset) Tracker() testing.ObjectTracker {
 	return c.tracker
 }
 
-var _ clientset.Interface = &Clientset{}
+var (
+	_ clientset.Interface = &Clientset{}
+	_ testing.FakeClient  = &Clientset{}
+)
 
 // ExtensionsV1alpha1 retrieves the ExtensionsV1alpha1Client
 func (c *Clientset) ExtensionsV1alpha1() extensionsv1alpha1.ExtensionsV1alpha1Interface {

client/pkg/clientset/versioned/fake/register.gen.go

@@ -28,7 +28,7 @@ import (
 
 var scheme = runtime.NewScheme()
 var codecs = serializer.NewCodecFactory(scheme)
-var parameterCodec = runtime.NewParameterCodec(scheme)
+
 var localSchemeBuilder = runtime.SchemeBuilder{
 	extensionsv1alpha1.AddToScheme,
 	networkingv1.AddToScheme,
@@ -37,14 +37,14 @@ var localSchemeBuilder = runtime.SchemeBuilder{
 // AddToScheme adds all types of this clientset into the given scheme. This allows composition
 // of clientsets, like in:
 //
-//   import (
-//     "k8s.io/client-go/kubernetes"
-//     clientsetscheme "k8s.io/client-go/kubernetes/scheme"
-//     aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
-//   )
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
 //
-//   kclientset, _ := kubernetes.NewForConfig(c)
-//   _ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
 //
 // After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
 // correctly.

client/pkg/clientset/versioned/scheme/register.gen.go

@@ -37,14 +37,14 @@ var localSchemeBuilder = runtime.SchemeBuilder{
 // AddToScheme adds all types of this clientset into the given scheme. This allows composition
 // of clientsets, like in:
 //
-//   import (
-//     "k8s.io/client-go/kubernetes"
-//     clientsetscheme "k8s.io/client-go/kubernetes/scheme"
-//     aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
-//   )
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
 //
-//   kclientset, _ := kubernetes.NewForConfig(c)
-//   _ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
 //
 // After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
 // correctly.

client/pkg/clientset/versioned/typed/extensions/v1alpha1/extensions_client.gen.go

@@ -17,6 +17,8 @@
 package v1alpha1
 
 import (
+	"net/http"
+
 	v1alpha1 "github.com/alibaba/higress/client/pkg/apis/extensions/v1alpha1"
 	"github.com/alibaba/higress/client/pkg/clientset/versioned/scheme"
 	rest "k8s.io/client-go/rest"
@@ -37,12 +39,28 @@ func (c *ExtensionsV1alpha1Client) WasmPlugins(namespace string) WasmPluginInter
 }
 
 // NewForConfig creates a new ExtensionsV1alpha1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*ExtensionsV1alpha1Client, error) {
 	config := *c
 	if err := setConfigDefaults(&config); err != nil {
 		return nil, err
 	}
-	client, err := rest.RESTClientFor(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new ExtensionsV1alpha1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ExtensionsV1alpha1Client, error) {
+	config := *c
+	if err := setConfigDefaults(&config); err != nil {
+		return nil, err
+	}
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
 	if err != nil {
 		return nil, err
 	}

client/pkg/clientset/versioned/typed/extensions/v1alpha1/fake/fake_wasmplugin.gen.go

@@ -18,11 +18,13 @@ package fake
 
 import (
 	"context"
+	json "encoding/json"
+	"fmt"
 
 	v1alpha1 "github.com/alibaba/higress/client/pkg/apis/extensions/v1alpha1"
+	extensionsv1alpha1 "github.com/alibaba/higress/client/pkg/applyconfiguration/extensions/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	labels "k8s.io/apimachinery/pkg/labels"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
@@ -34,9 +36,9 @@ type FakeWasmPlugins struct {
 	ns   string
 }
 
-var wasmpluginsResource = schema.GroupVersionResource{Group: "extensions.higress.io", Version: "v1alpha1", Resource: "wasmplugins"}
+var wasmpluginsResource = v1alpha1.SchemeGroupVersion.WithResource("wasmplugins")
 
-var wasmpluginsKind = schema.GroupVersionKind{Group: "extensions.higress.io", Version: "v1alpha1", Kind: "WasmPlugin"}
+var wasmpluginsKind = v1alpha1.SchemeGroupVersion.WithKind("WasmPlugin")
 
 // Get takes name of the wasmPlugin, and returns the corresponding wasmPlugin object, and an error if there is any.
 func (c *FakeWasmPlugins) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.WasmPlugin, err error) {
@@ -115,7 +117,7 @@ func (c *FakeWasmPlugins) UpdateStatus(ctx context.Context, wasmPlugin *v1alpha1
 // Delete takes name of the wasmPlugin and deletes it. Returns an error if one occurs.
 func (c *FakeWasmPlugins) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
 	_, err := c.Fake.
-		Invokes(testing.NewDeleteAction(wasmpluginsResource, c.ns, name), &v1alpha1.WasmPlugin{})
+		Invokes(testing.NewDeleteActionWithOptions(wasmpluginsResource, c.ns, name, opts), &v1alpha1.WasmPlugin{})
 
 	return err
 }
@@ -138,3 +140,48 @@ func (c *FakeWasmPlugins) Patch(ctx context.Context, name string, pt types.Patch
 	}
 	return obj.(*v1alpha1.WasmPlugin), err
 }
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied wasmPlugin.
+func (c *FakeWasmPlugins) Apply(ctx context.Context, wasmPlugin *extensionsv1alpha1.WasmPluginApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.WasmPlugin, err error) {
+	if wasmPlugin == nil {
+		return nil, fmt.Errorf("wasmPlugin provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(wasmPlugin)
+	if err != nil {
+		return nil, err
+	}
+	name := wasmPlugin.Name
+	if name == nil {
+		return nil, fmt.Errorf("wasmPlugin.Name must be provided to Apply")
+	}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(wasmpluginsResource, c.ns, *name, types.ApplyPatchType, data), &v1alpha1.WasmPlugin{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.WasmPlugin), err
+}
+
+// ApplyStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+func (c *FakeWasmPlugins) ApplyStatus(ctx context.Context, wasmPlugin *extensionsv1alpha1.WasmPluginApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.WasmPlugin, err error) {
+	if wasmPlugin == nil {
+		return nil, fmt.Errorf("wasmPlugin provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(wasmPlugin)
+	if err != nil {
+		return nil, err
+	}
+	name := wasmPlugin.Name
+	if name == nil {
+		return nil, fmt.Errorf("wasmPlugin.Name must be provided to Apply")
+	}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(wasmpluginsResource, c.ns, *name, types.ApplyPatchType, data, "status"), &v1alpha1.WasmPlugin{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.WasmPlugin), err
+}

client/pkg/clientset/versioned/typed/extensions/v1alpha1/wasmplugin.gen.go

@@ -18,9 +18,12 @@ package v1alpha1
 
 import (
 	"context"
+	json "encoding/json"
+	"fmt"
 	"time"
 
 	v1alpha1 "github.com/alibaba/higress/client/pkg/apis/extensions/v1alpha1"
+	extensionsv1alpha1 "github.com/alibaba/higress/client/pkg/applyconfiguration/extensions/v1alpha1"
 	scheme "github.com/alibaba/higress/client/pkg/clientset/versioned/scheme"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
@@ -45,6 +48,8 @@ type WasmPluginInterface interface {
 	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.WasmPluginList, error)
 	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
 	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.WasmPlugin, err error)
+	Apply(ctx context.Context, wasmPlugin *extensionsv1alpha1.WasmPluginApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.WasmPlugin, err error)
+	ApplyStatus(ctx context.Context, wasmPlugin *extensionsv1alpha1.WasmPluginApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.WasmPlugin, err error)
 	WasmPluginExpansion
 }
 
@@ -191,3 +196,59 @@ func (c *wasmPlugins) Patch(ctx context.Context, name string, pt types.PatchType
 		Into(result)
 	return
 }
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied wasmPlugin.
+func (c *wasmPlugins) Apply(ctx context.Context, wasmPlugin *extensionsv1alpha1.WasmPluginApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.WasmPlugin, err error) {
+	if wasmPlugin == nil {
+		return nil, fmt.Errorf("wasmPlugin provided to Apply must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	data, err := json.Marshal(wasmPlugin)
+	if err != nil {
+		return nil, err
+	}
+	name := wasmPlugin.Name
+	if name == nil {
+		return nil, fmt.Errorf("wasmPlugin.Name must be provided to Apply")
+	}
+	result = &v1alpha1.WasmPlugin{}
+	err = c.client.Patch(types.ApplyPatchType).
+		Namespace(c.ns).
+		Resource("wasmplugins").
+		Name(*name).
+		VersionedParams(&patchOpts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// ApplyStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+func (c *wasmPlugins) ApplyStatus(ctx context.Context, wasmPlugin *extensionsv1alpha1.WasmPluginApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.WasmPlugin, err error) {
+	if wasmPlugin == nil {
+		return nil, fmt.Errorf("wasmPlugin provided to Apply must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	data, err := json.Marshal(wasmPlugin)
+	if err != nil {
+		return nil, err
+	}
+
+	name := wasmPlugin.Name
+	if name == nil {
+		return nil, fmt.Errorf("wasmPlugin.Name must be provided to Apply")
+	}
+
+	result = &v1alpha1.WasmPlugin{}
+	err = c.client.Patch(types.ApplyPatchType).
+		Namespace(c.ns).
+		Resource("wasmplugins").
+		Name(*name).
+		SubResource("status").
+		VersionedParams(&patchOpts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}

client/pkg/clientset/versioned/typed/networking/v1/fake/fake_http2rpc.gen.go

@@ -18,11 +18,13 @@ package fake
 
 import (
 	"context"
+	json "encoding/json"
+	"fmt"
 
-	networkingv1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	v1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
+	networkingv1 "github.com/alibaba/higress/client/pkg/applyconfiguration/networking/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	labels "k8s.io/apimachinery/pkg/labels"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
@@ -34,25 +36,25 @@ type FakeHttp2Rpcs struct {
 	ns   string
 }
 
-var http2rpcsResource = schema.GroupVersionResource{Group: "networking.higress.io", Version: "v1", Resource: "http2rpcs"}
+var http2rpcsResource = v1.SchemeGroupVersion.WithResource("http2rpcs")
 
-var http2rpcsKind = schema.GroupVersionKind{Group: "networking.higress.io", Version: "v1", Kind: "Http2Rpc"}
+var http2rpcsKind = v1.SchemeGroupVersion.WithKind("Http2Rpc")
 
 // Get takes name of the http2Rpc, and returns the corresponding http2Rpc object, and an error if there is any.
-func (c *FakeHttp2Rpcs) Get(ctx context.Context, name string, options v1.GetOptions) (result *networkingv1.Http2Rpc, err error) {
+func (c *FakeHttp2Rpcs) Get(ctx context.Context, name string, options metav1.GetOptions) (result *v1.Http2Rpc, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(http2rpcsResource, c.ns, name), &networkingv1.Http2Rpc{})
+		Invokes(testing.NewGetAction(http2rpcsResource, c.ns, name), &v1.Http2Rpc{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.Http2Rpc), err
+	return obj.(*v1.Http2Rpc), err
 }
 
 // List takes label and field selectors, and returns the list of Http2Rpcs that match those selectors.
-func (c *FakeHttp2Rpcs) List(ctx context.Context, opts v1.ListOptions) (result *networkingv1.Http2RpcList, err error) {
+func (c *FakeHttp2Rpcs) List(ctx context.Context, opts metav1.ListOptions) (result *v1.Http2RpcList, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewListAction(http2rpcsResource, http2rpcsKind, c.ns, opts), &networkingv1.Http2RpcList{})
+		Invokes(testing.NewListAction(http2rpcsResource, http2rpcsKind, c.ns, opts), &v1.Http2RpcList{})
 
 	if obj == nil {
 		return nil, err
@@ -62,8 +64,8 @@ func (c *FakeHttp2Rpcs) List(ctx context.Context, opts v1.ListOptions) (result *
 	if label == nil {
 		label = labels.Everything()
 	}
-	list := &networkingv1.Http2RpcList{ListMeta: obj.(*networkingv1.Http2RpcList).ListMeta}
-	for _, item := range obj.(*networkingv1.Http2RpcList).Items {
+	list := &v1.Http2RpcList{ListMeta: obj.(*v1.Http2RpcList).ListMeta}
+	for _, item := range obj.(*v1.Http2RpcList).Items {
 		if label.Matches(labels.Set(item.Labels)) {
 			list.Items = append(list.Items, item)
 		}
@@ -72,69 +74,114 @@ func (c *FakeHttp2Rpcs) List(ctx context.Context, opts v1.ListOptions) (result *
 }
 
 // Watch returns a watch.Interface that watches the requested http2Rpcs.
-func (c *FakeHttp2Rpcs) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+func (c *FakeHttp2Rpcs) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
 	return c.Fake.
 		InvokesWatch(testing.NewWatchAction(http2rpcsResource, c.ns, opts))
 
 }
 
 // Create takes the representation of a http2Rpc and creates it.  Returns the server's representation of the http2Rpc, and an error, if there is any.
-func (c *FakeHttp2Rpcs) Create(ctx context.Context, http2Rpc *networkingv1.Http2Rpc, opts v1.CreateOptions) (result *networkingv1.Http2Rpc, err error) {
+func (c *FakeHttp2Rpcs) Create(ctx context.Context, http2Rpc *v1.Http2Rpc, opts metav1.CreateOptions) (result *v1.Http2Rpc, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(http2rpcsResource, c.ns, http2Rpc), &networkingv1.Http2Rpc{})
+		Invokes(testing.NewCreateAction(http2rpcsResource, c.ns, http2Rpc), &v1.Http2Rpc{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.Http2Rpc), err
+	return obj.(*v1.Http2Rpc), err
 }
 
 // Update takes the representation of a http2Rpc and updates it. Returns the server's representation of the http2Rpc, and an error, if there is any.
-func (c *FakeHttp2Rpcs) Update(ctx context.Context, http2Rpc *networkingv1.Http2Rpc, opts v1.UpdateOptions) (result *networkingv1.Http2Rpc, err error) {
+func (c *FakeHttp2Rpcs) Update(ctx context.Context, http2Rpc *v1.Http2Rpc, opts metav1.UpdateOptions) (result *v1.Http2Rpc, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(http2rpcsResource, c.ns, http2Rpc), &networkingv1.Http2Rpc{})
+		Invokes(testing.NewUpdateAction(http2rpcsResource, c.ns, http2Rpc), &v1.Http2Rpc{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.Http2Rpc), err
+	return obj.(*v1.Http2Rpc), err
 }
 
 // UpdateStatus was generated because the type contains a Status member.
 // Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *FakeHttp2Rpcs) UpdateStatus(ctx context.Context, http2Rpc *networkingv1.Http2Rpc, opts v1.UpdateOptions) (*networkingv1.Http2Rpc, error) {
+func (c *FakeHttp2Rpcs) UpdateStatus(ctx context.Context, http2Rpc *v1.Http2Rpc, opts metav1.UpdateOptions) (*v1.Http2Rpc, error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewUpdateSubresourceAction(http2rpcsResource, "status", c.ns, http2Rpc), &networkingv1.Http2Rpc{})
+		Invokes(testing.NewUpdateSubresourceAction(http2rpcsResource, "status", c.ns, http2Rpc), &v1.Http2Rpc{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.Http2Rpc), err
+	return obj.(*v1.Http2Rpc), err
 }
 
 // Delete takes name of the http2Rpc and deletes it. Returns an error if one occurs.
-func (c *FakeHttp2Rpcs) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+func (c *FakeHttp2Rpcs) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
 	_, err := c.Fake.
-		Invokes(testing.NewDeleteAction(http2rpcsResource, c.ns, name), &networkingv1.Http2Rpc{})
+		Invokes(testing.NewDeleteActionWithOptions(http2rpcsResource, c.ns, name, opts), &v1.Http2Rpc{})
 
 	return err
 }
 
 // DeleteCollection deletes a collection of objects.
-func (c *FakeHttp2Rpcs) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+func (c *FakeHttp2Rpcs) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
 	action := testing.NewDeleteCollectionAction(http2rpcsResource, c.ns, listOpts)
 
-	_, err := c.Fake.Invokes(action, &networkingv1.Http2RpcList{})
+	_, err := c.Fake.Invokes(action, &v1.Http2RpcList{})
 	return err
 }
 
 // Patch applies the patch and returns the patched http2Rpc.
-func (c *FakeHttp2Rpcs) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *networkingv1.Http2Rpc, err error) {
+func (c *FakeHttp2Rpcs) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *v1.Http2Rpc, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(http2rpcsResource, c.ns, name, pt, data, subresources...), &networkingv1.Http2Rpc{})
+		Invokes(testing.NewPatchSubresourceAction(http2rpcsResource, c.ns, name, pt, data, subresources...), &v1.Http2Rpc{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.Http2Rpc), err
+	return obj.(*v1.Http2Rpc), err
+}
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied http2Rpc.
+func (c *FakeHttp2Rpcs) Apply(ctx context.Context, http2Rpc *networkingv1.Http2RpcApplyConfiguration, opts metav1.ApplyOptions) (result *v1.Http2Rpc, err error) {
+	if http2Rpc == nil {
+		return nil, fmt.Errorf("http2Rpc provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(http2Rpc)
+	if err != nil {
+		return nil, err
+	}
+	name := http2Rpc.Name
+	if name == nil {
+		return nil, fmt.Errorf("http2Rpc.Name must be provided to Apply")
+	}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(http2rpcsResource, c.ns, *name, types.ApplyPatchType, data), &v1.Http2Rpc{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1.Http2Rpc), err
+}
+
+// ApplyStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+func (c *FakeHttp2Rpcs) ApplyStatus(ctx context.Context, http2Rpc *networkingv1.Http2RpcApplyConfiguration, opts metav1.ApplyOptions) (result *v1.Http2Rpc, err error) {
+	if http2Rpc == nil {
+		return nil, fmt.Errorf("http2Rpc provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(http2Rpc)
+	if err != nil {
+		return nil, err
+	}
+	name := http2Rpc.Name
+	if name == nil {
+		return nil, fmt.Errorf("http2Rpc.Name must be provided to Apply")
+	}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(http2rpcsResource, c.ns, *name, types.ApplyPatchType, data, "status"), &v1.Http2Rpc{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1.Http2Rpc), err
 }

client/pkg/clientset/versioned/typed/networking/v1/fake/fake_mcpbridge.gen.go

@@ -18,11 +18,13 @@ package fake
 
 import (
 	"context"
+	json "encoding/json"
+	"fmt"
 
-	networkingv1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	v1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
+	networkingv1 "github.com/alibaba/higress/client/pkg/applyconfiguration/networking/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	labels "k8s.io/apimachinery/pkg/labels"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
@@ -34,25 +36,25 @@ type FakeMcpBridges struct {
 	ns   string
 }
 
-var mcpbridgesResource = schema.GroupVersionResource{Group: "networking.higress.io", Version: "v1", Resource: "mcpbridges"}
+var mcpbridgesResource = v1.SchemeGroupVersion.WithResource("mcpbridges")
 
-var mcpbridgesKind = schema.GroupVersionKind{Group: "networking.higress.io", Version: "v1", Kind: "McpBridge"}
+var mcpbridgesKind = v1.SchemeGroupVersion.WithKind("McpBridge")
 
 // Get takes name of the mcpBridge, and returns the corresponding mcpBridge object, and an error if there is any.
-func (c *FakeMcpBridges) Get(ctx context.Context, name string, options v1.GetOptions) (result *networkingv1.McpBridge, err error) {
+func (c *FakeMcpBridges) Get(ctx context.Context, name string, options metav1.GetOptions) (result *v1.McpBridge, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(mcpbridgesResource, c.ns, name), &networkingv1.McpBridge{})
+		Invokes(testing.NewGetAction(mcpbridgesResource, c.ns, name), &v1.McpBridge{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.McpBridge), err
+	return obj.(*v1.McpBridge), err
 }
 
 // List takes label and field selectors, and returns the list of McpBridges that match those selectors.
-func (c *FakeMcpBridges) List(ctx context.Context, opts v1.ListOptions) (result *networkingv1.McpBridgeList, err error) {
+func (c *FakeMcpBridges) List(ctx context.Context, opts metav1.ListOptions) (result *v1.McpBridgeList, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewListAction(mcpbridgesResource, mcpbridgesKind, c.ns, opts), &networkingv1.McpBridgeList{})
+		Invokes(testing.NewListAction(mcpbridgesResource, mcpbridgesKind, c.ns, opts), &v1.McpBridgeList{})
 
 	if obj == nil {
 		return nil, err
@@ -62,8 +64,8 @@ func (c *FakeMcpBridges) List(ctx context.Context, opts v1.ListOptions) (result
 	if label == nil {
 		label = labels.Everything()
 	}
-	list := &networkingv1.McpBridgeList{ListMeta: obj.(*networkingv1.McpBridgeList).ListMeta}
-	for _, item := range obj.(*networkingv1.McpBridgeList).Items {
+	list := &v1.McpBridgeList{ListMeta: obj.(*v1.McpBridgeList).ListMeta}
+	for _, item := range obj.(*v1.McpBridgeList).Items {
 		if label.Matches(labels.Set(item.Labels)) {
 			list.Items = append(list.Items, item)
 		}
@@ -72,69 +74,114 @@ func (c *FakeMcpBridges) List(ctx context.Context, opts v1.ListOptions) (result
 }
 
 // Watch returns a watch.Interface that watches the requested mcpBridges.
-func (c *FakeMcpBridges) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+func (c *FakeMcpBridges) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
 	return c.Fake.
 		InvokesWatch(testing.NewWatchAction(mcpbridgesResource, c.ns, opts))
 
 }
 
 // Create takes the representation of a mcpBridge and creates it.  Returns the server's representation of the mcpBridge, and an error, if there is any.
-func (c *FakeMcpBridges) Create(ctx context.Context, mcpBridge *networkingv1.McpBridge, opts v1.CreateOptions) (result *networkingv1.McpBridge, err error) {
+func (c *FakeMcpBridges) Create(ctx context.Context, mcpBridge *v1.McpBridge, opts metav1.CreateOptions) (result *v1.McpBridge, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(mcpbridgesResource, c.ns, mcpBridge), &networkingv1.McpBridge{})
+		Invokes(testing.NewCreateAction(mcpbridgesResource, c.ns, mcpBridge), &v1.McpBridge{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.McpBridge), err
+	return obj.(*v1.McpBridge), err
 }
 
 // Update takes the representation of a mcpBridge and updates it. Returns the server's representation of the mcpBridge, and an error, if there is any.
-func (c *FakeMcpBridges) Update(ctx context.Context, mcpBridge *networkingv1.McpBridge, opts v1.UpdateOptions) (result *networkingv1.McpBridge, err error) {
+func (c *FakeMcpBridges) Update(ctx context.Context, mcpBridge *v1.McpBridge, opts metav1.UpdateOptions) (result *v1.McpBridge, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(mcpbridgesResource, c.ns, mcpBridge), &networkingv1.McpBridge{})
+		Invokes(testing.NewUpdateAction(mcpbridgesResource, c.ns, mcpBridge), &v1.McpBridge{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.McpBridge), err
+	return obj.(*v1.McpBridge), err
 }
 
 // UpdateStatus was generated because the type contains a Status member.
 // Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *FakeMcpBridges) UpdateStatus(ctx context.Context, mcpBridge *networkingv1.McpBridge, opts v1.UpdateOptions) (*networkingv1.McpBridge, error) {
+func (c *FakeMcpBridges) UpdateStatus(ctx context.Context, mcpBridge *v1.McpBridge, opts metav1.UpdateOptions) (*v1.McpBridge, error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewUpdateSubresourceAction(mcpbridgesResource, "status", c.ns, mcpBridge), &networkingv1.McpBridge{})
+		Invokes(testing.NewUpdateSubresourceAction(mcpbridgesResource, "status", c.ns, mcpBridge), &v1.McpBridge{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.McpBridge), err
+	return obj.(*v1.McpBridge), err
 }
 
 // Delete takes name of the mcpBridge and deletes it. Returns an error if one occurs.
-func (c *FakeMcpBridges) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+func (c *FakeMcpBridges) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
 	_, err := c.Fake.
-		Invokes(testing.NewDeleteAction(mcpbridgesResource, c.ns, name), &networkingv1.McpBridge{})
+		Invokes(testing.NewDeleteActionWithOptions(mcpbridgesResource, c.ns, name, opts), &v1.McpBridge{})
 
 	return err
 }
 
 // DeleteCollection deletes a collection of objects.
-func (c *FakeMcpBridges) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+func (c *FakeMcpBridges) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
 	action := testing.NewDeleteCollectionAction(mcpbridgesResource, c.ns, listOpts)
 
-	_, err := c.Fake.Invokes(action, &networkingv1.McpBridgeList{})
+	_, err := c.Fake.Invokes(action, &v1.McpBridgeList{})
 	return err
 }
 
 // Patch applies the patch and returns the patched mcpBridge.
-func (c *FakeMcpBridges) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *networkingv1.McpBridge, err error) {
+func (c *FakeMcpBridges) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *v1.McpBridge, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(mcpbridgesResource, c.ns, name, pt, data, subresources...), &networkingv1.McpBridge{})
+		Invokes(testing.NewPatchSubresourceAction(mcpbridgesResource, c.ns, name, pt, data, subresources...), &v1.McpBridge{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.McpBridge), err
+	return obj.(*v1.McpBridge), err
+}
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied mcpBridge.
+func (c *FakeMcpBridges) Apply(ctx context.Context, mcpBridge *networkingv1.McpBridgeApplyConfiguration, opts metav1.ApplyOptions) (result *v1.McpBridge, err error) {
+	if mcpBridge == nil {
+		return nil, fmt.Errorf("mcpBridge provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(mcpBridge)
+	if err != nil {
+		return nil, err
+	}
+	name := mcpBridge.Name
+	if name == nil {
+		return nil, fmt.Errorf("mcpBridge.Name must be provided to Apply")
+	}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(mcpbridgesResource, c.ns, *name, types.ApplyPatchType, data), &v1.McpBridge{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1.McpBridge), err
+}
+
+// ApplyStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+func (c *FakeMcpBridges) ApplyStatus(ctx context.Context, mcpBridge *networkingv1.McpBridgeApplyConfiguration, opts metav1.ApplyOptions) (result *v1.McpBridge, err error) {
+	if mcpBridge == nil {
+		return nil, fmt.Errorf("mcpBridge provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(mcpBridge)
+	if err != nil {
+		return nil, err
+	}
+	name := mcpBridge.Name
+	if name == nil {
+		return nil, fmt.Errorf("mcpBridge.Name must be provided to Apply")
+	}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(mcpbridgesResource, c.ns, *name, types.ApplyPatchType, data, "status"), &v1.McpBridge{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1.McpBridge), err
 }

client/pkg/clientset/versioned/typed/networking/v1/http2rpc.gen.go

@@ -18,9 +18,12 @@ package v1
 
 import (
 	"context"
+	json "encoding/json"
+	"fmt"
 	"time"
 
 	v1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
+	networkingv1 "github.com/alibaba/higress/client/pkg/applyconfiguration/networking/v1"
 	scheme "github.com/alibaba/higress/client/pkg/clientset/versioned/scheme"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
@@ -45,6 +48,8 @@ type Http2RpcInterface interface {
 	List(ctx context.Context, opts metav1.ListOptions) (*v1.Http2RpcList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
 	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *v1.Http2Rpc, err error)
+	Apply(ctx context.Context, http2Rpc *networkingv1.Http2RpcApplyConfiguration, opts metav1.ApplyOptions) (result *v1.Http2Rpc, err error)
+	ApplyStatus(ctx context.Context, http2Rpc *networkingv1.Http2RpcApplyConfiguration, opts metav1.ApplyOptions) (result *v1.Http2Rpc, err error)
 	Http2RpcExpansion
 }
 
@@ -191,3 +196,59 @@ func (c *http2Rpcs) Patch(ctx context.Context, name string, pt types.PatchType,
 		Into(result)
 	return
 }
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied http2Rpc.
+func (c *http2Rpcs) Apply(ctx context.Context, http2Rpc *networkingv1.Http2RpcApplyConfiguration, opts metav1.ApplyOptions) (result *v1.Http2Rpc, err error) {
+	if http2Rpc == nil {
+		return nil, fmt.Errorf("http2Rpc provided to Apply must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	data, err := json.Marshal(http2Rpc)
+	if err != nil {
+		return nil, err
+	}
+	name := http2Rpc.Name
+	if name == nil {
+		return nil, fmt.Errorf("http2Rpc.Name must be provided to Apply")
+	}
+	result = &v1.Http2Rpc{}
+	err = c.client.Patch(types.ApplyPatchType).
+		Namespace(c.ns).
+		Resource("http2rpcs").
+		Name(*name).
+		VersionedParams(&patchOpts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// ApplyStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+func (c *http2Rpcs) ApplyStatus(ctx context.Context, http2Rpc *networkingv1.Http2RpcApplyConfiguration, opts metav1.ApplyOptions) (result *v1.Http2Rpc, err error) {
+	if http2Rpc == nil {
+		return nil, fmt.Errorf("http2Rpc provided to Apply must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	data, err := json.Marshal(http2Rpc)
+	if err != nil {
+		return nil, err
+	}
+
+	name := http2Rpc.Name
+	if name == nil {
+		return nil, fmt.Errorf("http2Rpc.Name must be provided to Apply")
+	}
+
+	result = &v1.Http2Rpc{}
+	err = c.client.Patch(types.ApplyPatchType).
+		Namespace(c.ns).
+		Resource("http2rpcs").
+		Name(*name).
+		SubResource("status").
+		VersionedParams(&patchOpts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}

client/pkg/clientset/versioned/typed/networking/v1/mcpbridge.gen.go

@@ -18,9 +18,12 @@ package v1
 
 import (
 	"context"
+	json "encoding/json"
+	"fmt"
 	"time"
 
 	v1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
+	networkingv1 "github.com/alibaba/higress/client/pkg/applyconfiguration/networking/v1"
 	scheme "github.com/alibaba/higress/client/pkg/clientset/versioned/scheme"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
@@ -45,6 +48,8 @@ type McpBridgeInterface interface {
 	List(ctx context.Context, opts metav1.ListOptions) (*v1.McpBridgeList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
 	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *v1.McpBridge, err error)
+	Apply(ctx context.Context, mcpBridge *networkingv1.McpBridgeApplyConfiguration, opts metav1.ApplyOptions) (result *v1.McpBridge, err error)
+	ApplyStatus(ctx context.Context, mcpBridge *networkingv1.McpBridgeApplyConfiguration, opts metav1.ApplyOptions) (result *v1.McpBridge, err error)
 	McpBridgeExpansion
 }
 
@@ -191,3 +196,59 @@ func (c *mcpBridges) Patch(ctx context.Context, name string, pt types.PatchType,
 		Into(result)
 	return
 }
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied mcpBridge.
+func (c *mcpBridges) Apply(ctx context.Context, mcpBridge *networkingv1.McpBridgeApplyConfiguration, opts metav1.ApplyOptions) (result *v1.McpBridge, err error) {
+	if mcpBridge == nil {
+		return nil, fmt.Errorf("mcpBridge provided to Apply must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	data, err := json.Marshal(mcpBridge)
+	if err != nil {
+		return nil, err
+	}
+	name := mcpBridge.Name
+	if name == nil {
+		return nil, fmt.Errorf("mcpBridge.Name must be provided to Apply")
+	}
+	result = &v1.McpBridge{}
+	err = c.client.Patch(types.ApplyPatchType).
+		Namespace(c.ns).
+		Resource("mcpbridges").
+		Name(*name).
+		VersionedParams(&patchOpts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// ApplyStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+func (c *mcpBridges) ApplyStatus(ctx context.Context, mcpBridge *networkingv1.McpBridgeApplyConfiguration, opts metav1.ApplyOptions) (result *v1.McpBridge, err error) {
+	if mcpBridge == nil {
+		return nil, fmt.Errorf("mcpBridge provided to Apply must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	data, err := json.Marshal(mcpBridge)
+	if err != nil {
+		return nil, err
+	}
+
+	name := mcpBridge.Name
+	if name == nil {
+		return nil, fmt.Errorf("mcpBridge.Name must be provided to Apply")
+	}
+
+	result = &v1.McpBridge{}
+	err = c.client.Patch(types.ApplyPatchType).
+		Namespace(c.ns).
+		Resource("mcpbridges").
+		Name(*name).
+		SubResource("status").
+		VersionedParams(&patchOpts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}

client/pkg/clientset/versioned/typed/networking/v1/networking_client.gen.go

@@ -17,6 +17,8 @@
 package v1
 
 import (
+	"net/http"
+
 	v1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
 	"github.com/alibaba/higress/client/pkg/clientset/versioned/scheme"
 	rest "k8s.io/client-go/rest"
@@ -42,12 +44,28 @@ func (c *NetworkingV1Client) McpBridges(namespace string) McpBridgeInterface {
 }
 
 // NewForConfig creates a new NetworkingV1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*NetworkingV1Client, error) {
 	config := *c
 	if err := setConfigDefaults(&config); err != nil {
 		return nil, err
 	}
-	client, err := rest.RESTClientFor(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new NetworkingV1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*NetworkingV1Client, error) {
+	config := *c
+	if err := setConfigDefaults(&config); err != nil {
+		return nil, err
+	}
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
 	if err != nil {
 		return nil, err
 	}

client/pkg/informers/externalversions/factory.gen.go

@@ -46,6 +46,11 @@ type sharedInformerFactory struct {
 	// startedInformers is used for tracking which informers have been started.
 	// This allows Start() to be called multiple times safely.
 	startedInformers map[reflect.Type]bool
+	// wg tracks how many goroutines were started.
+	wg sync.WaitGroup
+	// shuttingDown is true when Shutdown has been called. It may still be running
+	// because it needs to wait for goroutines.
+	shuttingDown bool
 }
 
 // WithCustomResyncConfig sets a custom resync period for the specified informer types.
@@ -106,20 +111,39 @@ func NewSharedInformerFactoryWithOptions(client versioned.Interface, defaultResy
 	return factory
 }
 
-// Start initializes all requested informers.
 func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
 	f.lock.Lock()
 	defer f.lock.Unlock()
 
+	if f.shuttingDown {
+		return
+	}
+
 	for informerType, informer := range f.informers {
 		if !f.startedInformers[informerType] {
-			go informer.Run(stopCh)
+			f.wg.Add(1)
+			// We need a new variable in each loop iteration,
+			// otherwise the goroutine would use the loop variable
+			// and that keeps changing.
+			informer := informer
+			go func() {
+				defer f.wg.Done()
+				informer.Run(stopCh)
+			}()
 			f.startedInformers[informerType] = true
 		}
 	}
 }
 
-// WaitForCacheSync waits for all started informers' cache were synced.
+func (f *sharedInformerFactory) Shutdown() {
+	f.lock.Lock()
+	f.shuttingDown = true
+	f.lock.Unlock()
+
+	// Will return immediately if there is nothing to wait for.
+	f.wg.Wait()
+}
+
 func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool {
 	informers := func() map[reflect.Type]cache.SharedIndexInformer {
 		f.lock.Lock()
@@ -141,7 +165,7 @@ func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[ref
 	return res
 }
 
-// InternalInformerFor returns the SharedIndexInformer for obj using an internal
+// InformerFor returns the SharedIndexInformer for obj using an internal
 // client.
 func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer {
 	f.lock.Lock()
@@ -166,11 +190,58 @@ func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internal
 
 // SharedInformerFactory provides shared informers for resources in all known
 // API group versions.
+//
+// It is typically used like this:
+//
+//	ctx, cancel := context.Background()
+//	defer cancel()
+//	factory := NewSharedInformerFactory(client, resyncPeriod)
+//	defer factory.WaitForStop()    // Returns immediately if nothing was started.
+//	genericInformer := factory.ForResource(resource)
+//	typedInformer := factory.SomeAPIGroup().V1().SomeType()
+//	factory.Start(ctx.Done())          // Start processing these informers.
+//	synced := factory.WaitForCacheSync(ctx.Done())
+//	for v, ok := range synced {
+//	    if !ok {
+//	        fmt.Fprintf(os.Stderr, "caches failed to sync: %v", v)
+//	        return
+//	    }
+//	}
+//
+//	// Creating informers can also be created after Start, but then
+//	// Start must be called again:
+//	anotherGenericInformer := factory.ForResource(resource)
+//	factory.Start(ctx.Done())
 type SharedInformerFactory interface {
 	internalinterfaces.SharedInformerFactory
-	ForResource(resource schema.GroupVersionResource) (GenericInformer, error)
+
+	// Start initializes all requested informers. They are handled in goroutines
+	// which run until the stop channel gets closed.
+	Start(stopCh <-chan struct{})
+
+	// Shutdown marks a factory as shutting down. At that point no new
+	// informers can be started anymore and Start will return without
+	// doing anything.
+	//
+	// In addition, Shutdown blocks until all goroutines have terminated. For that
+	// to happen, the close channel(s) that they were started with must be closed,
+	// either before Shutdown gets called or while it is waiting.
+	//
+	// Shutdown may be called multiple times, even concurrently. All such calls will
+	// block until all goroutines have terminated.
+	Shutdown()
+
+	// WaitForCacheSync blocks until all started informers' caches were synced
+	// or the stop channel gets closed.
 	WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool
 
+	// ForResource gives generic access to a shared informer of the matching type.
+	ForResource(resource schema.GroupVersionResource) (GenericInformer, error)
+
+	// InformerFor returns the SharedIndexInformer for obj using an internal
+	// client.
+	InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer
+
 	Extensions() extensions.Interface
 	Networking() networking.Interface
 }

client/pkg/listers/extensions/v1alpha1/wasmplugin.gen.go

@@ -24,8 +24,10 @@ import (
 )
 
 // WasmPluginLister helps list WasmPlugins.
+// All objects returned here must be treated as read-only.
 type WasmPluginLister interface {
 	// List lists all WasmPlugins in the indexer.
+	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*v1alpha1.WasmPlugin, err error)
 	// WasmPlugins returns an object that can list and get WasmPlugins.
 	WasmPlugins(namespace string) WasmPluginNamespaceLister
@@ -56,10 +58,13 @@ func (s *wasmPluginLister) WasmPlugins(namespace string) WasmPluginNamespaceList
 }
 
 // WasmPluginNamespaceLister helps list and get WasmPlugins.
+// All objects returned here must be treated as read-only.
 type WasmPluginNamespaceLister interface {
 	// List lists all WasmPlugins in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*v1alpha1.WasmPlugin, err error)
 	// Get retrieves the WasmPlugin from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
 	Get(name string) (*v1alpha1.WasmPlugin, error)
 	WasmPluginNamespaceListerExpansion
 }

client/pkg/listers/networking/v1/http2rpc.gen.go

@@ -24,8 +24,10 @@ import (
 )
 
 // Http2RpcLister helps list Http2Rpcs.
+// All objects returned here must be treated as read-only.
 type Http2RpcLister interface {
 	// List lists all Http2Rpcs in the indexer.
+	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*v1.Http2Rpc, err error)
 	// Http2Rpcs returns an object that can list and get Http2Rpcs.
 	Http2Rpcs(namespace string) Http2RpcNamespaceLister
@@ -56,10 +58,13 @@ func (s *http2RpcLister) Http2Rpcs(namespace string) Http2RpcNamespaceLister {
 }
 
 // Http2RpcNamespaceLister helps list and get Http2Rpcs.
+// All objects returned here must be treated as read-only.
 type Http2RpcNamespaceLister interface {
 	// List lists all Http2Rpcs in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*v1.Http2Rpc, err error)
 	// Get retrieves the Http2Rpc from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
 	Get(name string) (*v1.Http2Rpc, error)
 	Http2RpcNamespaceListerExpansion
 }

client/pkg/listers/networking/v1/mcpbridge.gen.go

@@ -24,8 +24,10 @@ import (
 )
 
 // McpBridgeLister helps list McpBridges.
+// All objects returned here must be treated as read-only.
 type McpBridgeLister interface {
 	// List lists all McpBridges in the indexer.
+	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*v1.McpBridge, err error)
 	// McpBridges returns an object that can list and get McpBridges.
 	McpBridges(namespace string) McpBridgeNamespaceLister
@@ -56,10 +58,13 @@ func (s *mcpBridgeLister) McpBridges(namespace string) McpBridgeNamespaceLister
 }
 
 // McpBridgeNamespaceLister helps list and get McpBridges.
+// All objects returned here must be treated as read-only.
 type McpBridgeNamespaceLister interface {
 	// List lists all McpBridges in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*v1.McpBridge, err error)
 	// Get retrieves the McpBridge from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
 	Get(name string) (*v1.McpBridge, error)
 	McpBridgeNamespaceListerExpansion
 }

docker/docker.mk

@@ -12,12 +12,12 @@
 ## See the License for the specific language governing permissions and
 ## limitations under the License.
 
-docker.higress: BUILD_ARGS=--build-arg BASE_VERSION=${BASE_VERSION} --build-arg HUB=${HUB}
+docker.higress: BUILD_ARGS=--build-arg BASE_VERSION=${HIGRESS_BASE_VERSION} --build-arg HUB=${HUB}
 docker.higress: $(OUT_LINUX)/higress
 docker.higress: docker/Dockerfile.higress
 	$(HIGRESS_DOCKER_RULE)
 
-docker.higress-buildx: BUILD_ARGS=--build-arg BASE_VERSION=${BASE_VERSION} --build-arg HUB=${HUB}
+docker.higress-buildx: BUILD_ARGS=--build-arg BASE_VERSION=${HIGRESS_BASE_VERSION} --build-arg HUB=${HUB}
 docker.higress-buildx: $(AMD64_OUT_LINUX)/higress
 docker.higress-buildx: $(ARM64_OUT_LINUX)/higress
 docker.higress-buildx: docker/Dockerfile.higress

envoy/1.20/patches/envoy/20230201-wasi-stub.patch

@@ -1,101 +0,0 @@
-diff --git a/bazel/foreign_cc/proxy_wasm_cpp_host.patch b/bazel/foreign_cc/proxy_wasm_cpp_host.patch
-new file mode 100644
-index 0000000000..a586116e84
---- /dev/null
-+++ b/bazel/foreign_cc/proxy_wasm_cpp_host.patch
-@@ -0,0 +1,78 @@
-+diff --git a/include/proxy-wasm/exports.h b/include/proxy-wasm/exports.h
-+index ded6419..334cee4 100644
-+--- a/include/proxy-wasm/exports.h
-++++ b/include/proxy-wasm/exports.h
-+@@ -129,6 +129,11 @@ Word call_foreign_function(Word function_name, Word function_name_size, Word arg
-+ 
-+ // Runtime environment functions exported from envoy to wasm.
-+ 
-++Word wasi_unstable_path_open(Word fd, Word dir_flags, Word path, Word path_len, Word oflags,
-++                             int64_t fs_rights_base, int64_t fg_rights_inheriting, Word fd_flags,
-++                             Word nwritten_ptr);
-++Word wasi_unstable_fd_prestat_get(Word fd, Word buf_ptr);
-++Word wasi_unstable_fd_prestat_dir_name(Word fd, Word path_ptr, Word path_len);
-+ Word wasi_unstable_fd_write(Word fd, Word iovs, Word iovs_len, Word nwritten_ptr);
-+ Word wasi_unstable_fd_read(Word, Word, Word, Word);
-+ Word wasi_unstable_fd_seek(Word, int64_t, Word, Word);
-+@@ -166,7 +171,7 @@ Word pthread_equal(Word left, Word right);
-+ #define FOR_ALL_WASI_FUNCTIONS(_f)                                                                 \
-+   _f(fd_write) _f(fd_read) _f(fd_seek) _f(fd_close) _f(fd_fdstat_get) _f(environ_get)              \
-+       _f(environ_sizes_get) _f(args_get) _f(args_sizes_get) _f(clock_time_get) _f(random_get)      \
-+-          _f(proc_exit)
-++          _f(proc_exit) _f(path_open) _f(fd_prestat_get) _f(fd_prestat_dir_name)
-+ 
-+ // Helpers to generate a stub to pass to VM, in place of a restricted proxy-wasm capability.
-+ #define _CREATE_PROXY_WASM_STUB(_fn)                                                               \
-+diff --git a/include/proxy-wasm/wasm_vm.h b/include/proxy-wasm/wasm_vm.h
-+index c02bb6e..c13c78c 100644
-+--- a/include/proxy-wasm/wasm_vm.h
-++++ b/include/proxy-wasm/wasm_vm.h
-+@@ -110,6 +110,8 @@ using WasmCallback_WWl = Word (*)(Word, int64_t);
-+ using WasmCallback_WWlWW = Word (*)(Word, int64_t, Word, Word);
-+ using WasmCallback_WWm = Word (*)(Word, uint64_t);
-+ using WasmCallback_WWmW = Word (*)(Word, uint64_t, Word);
-++using WasmCallback_WWWWWWllWW = Word (*)(Word, Word, Word, Word, Word, int64_t, int64_t, Word,
-++                                         Word);
-+ using WasmCallback_dd = double (*)(double);
-+ 
-+ #define FOR_ALL_WASM_VM_IMPORTS(_f)                                                                \
-+@@ -127,7 +129,8 @@ using WasmCallback_dd = double (*)(double);
-+                                               _f(proxy_wasm::WasmCallback_WWlWW)                   \
-+                                                   _f(proxy_wasm::WasmCallback_WWm)                 \
-+                                                       _f(proxy_wasm::WasmCallback_WWmW)            \
-+-                                                          _f(proxy_wasm::WasmCallback_dd)
-++                                                          _f(proxy_wasm::WasmCallback_WWWWWWllWW)  \
-++                                                              _f(proxy_wasm::WasmCallback_dd)
-+ 
-+ enum class Cloneable {
-+   NotCloneable,      // VMs can not be cloned and should be created from scratch.
-+diff --git a/src/exports.cc b/src/exports.cc
-+index 0922b2d..d597914 100644
-+--- a/src/exports.cc
-++++ b/src/exports.cc
-+@@ -648,6 +648,25 @@ Word grpc_send(Word token, Word message_ptr, Word message_size, Word end_stream)
-+   return context->grpcSend(token, message.value(), end_stream);
-+ }
-+ 
-++// __wasi_errno_t path_open(__wasi_fd_t fd, __wasi_lookupflags_t dirflags, const char *path,
-++// size_t path_len, __wasi_oflags_t oflags, __wasi_rights_t fs_rights_base, __wasi_rights_t
-++// fs_rights_inheriting, __wasi_fdflags_t fdflags, __wasi_fd_t *retptr0)
-++Word wasi_unstable_path_open(Word fd, Word dir_flags, Word path, Word path_len, Word oflags,
-++                             int64_t fs_rights_base, int64_t fg_rights_inheriting, Word fd_flags,
-++                             Word nwritten_ptr) {
-++  return 44; // __WASI_ERRNO_NOENT
-++}
-++
-++// __wasi_errno_t __wasi_fd_prestat_get(__wasi_fd_t fd, __wasi_prestat_t *retptr0)
-++Word wasi_unstable_fd_prestat_get(Word fd, Word buf_ptr) {
-++  return 8; // __WASI_ERRNO_BADF
-++}
-++
-++// __wasi_errno_t __wasi_fd_prestat_dir_name(__wasi_fd_t fd, uint8_t * path, __wasi_size_t path_len)
-++Word wasi_unstable_fd_prestat_dir_name(Word fd, Word path_ptr, Word path_len) {
-++  return 52; // __WASI_ERRNO_ENOSYS
-++}
-++
-+ // Implementation of writev-like() syscall that redirects stdout/stderr to Envoy
-+ // logs.
-+ Word writevImpl(Word fd, Word iovs, Word iovs_len, Word *nwritten_ptr) {
-diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
-index bfef00ac85..806100b42d 100644
---- a/bazel/repositories.bzl
-+++ b/bazel/repositories.bzl
-@@ -943,7 +943,11 @@ def _proxy_wasm_cpp_sdk():
-     external_http_archive(name = "proxy_wasm_cpp_sdk")
- 
- def _proxy_wasm_cpp_host():
--    external_http_archive(name = "proxy_wasm_cpp_host")
-+    external_http_archive(
-+        name = "proxy_wasm_cpp_host",
-+        patches = ["@envoy//bazel/foreign_cc:proxy_wasm_cpp_host.patch"],
-+        patch_args = ["-p1"],
-+    )
- 
- def _emscripten_toolchain():
-     external_http_archive(

envoy/1.20/patches/envoy/20230408-basic-auth.patch

@@ -1,55 +0,0 @@
-diff -Naur envoy/bazel/envoy_binary.bzl envoy-new/bazel/envoy_binary.bzl
---- envoy/bazel/envoy_binary.bzl	2023-04-08 20:52:57.041729111 +0800
-+++ envoy-new/bazel/envoy_binary.bzl	2023-04-08 20:50:53.657603065 +0800
-@@ -80,7 +80,7 @@
-         "@envoy//bazel:boringssl_fips": [],
-         "@envoy//bazel:windows_x86_64": [],
-         "//conditions:default": ["-pie"],
--    }) + _envoy_select_exported_symbols(["-Wl,-E"])
-+    }) + _envoy_select_exported_symbols(["-Wl,-E"]) + envoy_select_alimesh(["-lcrypt"])
- 
- def _envoy_stamped_deps():
-     return select({
-diff -Naur envoy/bazel/repositories.bzl envoy-new/bazel/repositories.bzl
---- envoy/bazel/repositories.bzl	2023-04-08 20:52:57.085730582 +0800
-+++ envoy-new/bazel/repositories.bzl	2023-04-08 20:27:20.110335884 +0800
-@@ -272,6 +272,8 @@
-         actual = "@bazel_tools//tools/cpp/runfiles",
-     )
- 
-+    _com_github_higress_wasm_extensions()
-+
- def _boringssl():
-     external_http_archive(
-         name = "boringssl",
-@@ -1066,6 +1068,17 @@
-         actual = "@com_github_wasm_c_api//:wasmtime_lib",
-     )
- 
-+def _com_github_higress_wasm_extensions():
-+    native.local_repository(
-+        name = "com_github_higress_wasm_extensions",
-+        path = "../../wasm-cpp",
-+    )
-+
-+    native.bind(
-+        name = "basic_auth_lib",
-+        actual = "@com_github_higress_wasm_extensions//extensions/basic_auth:basic_auth_lib",
-+    )
-+    
- def _rules_fuzzing():
-     external_http_archive(
-         name = "rules_fuzzing",
-diff -Naur envoy/source/exe/BUILD envoy-new/source/exe/BUILD
---- envoy/source/exe/BUILD	2023-04-08 20:52:57.053729512 +0800
-+++ envoy-new/source/exe/BUILD	2023-04-08 19:48:37.420667254 +0800
-@@ -43,6 +43,9 @@
-         "//bazel:darwin": envoy_all_extensions(DARWIN_SKIP_TARGETS),
-         "//conditions:default": envoy_all_extensions(),
-     }),
-+    alimesh_deps = [
-+        "//external:basic_auth_lib",
-+    ],
- )
- 
- envoy_cc_library(

envoy/1.20/patches/envoy/20231008-fallback-origin-cluster.patch

@@ -1,111 +0,0 @@
-diff -Naur envoy/contrib/custom_cluster_plugins/cluster_fallback/source/filter.cc envoy-new/contrib/custom_cluster_plugins/cluster_fallback/source/filter.cc
---- envoy/contrib/custom_cluster_plugins/cluster_fallback/source/filter.cc	2023-10-08 15:01:21.960871500 +0800
-+++ envoy-new/contrib/custom_cluster_plugins/cluster_fallback/source/filter.cc	2023-09-27 17:03:41.613256338 +0800
-@@ -60,7 +60,7 @@
- 
-   for (const auto& cluster_name : first_item->second) {
-     if (hasHealthHost(cluster_name)) {
--      return base.clone(cluster_name);
-+      return base.clone(cluster_name, first_item->first);
-     }
-   }
- 
-@@ -75,7 +75,8 @@
- 
-   auto search = clusters_config_.find(route_entry.clusterName());
-   if (search == clusters_config_.end()) {
--    ENVOY_LOG(warn, "there is no fallback cluster config, the original routing cluster is returned");
-+    ENVOY_LOG(warn,
-+              "there is no fallback cluster config, the original routing cluster is returned");
-     return cluster_entry.getRouteConstSharedPtr();
-   }
- 
-@@ -87,7 +88,7 @@
- 
-   for (const auto& cluster_name : search->second) {
-     if (hasHealthHost(cluster_name)) {
--      return cluster_entry.clone(cluster_name);
-+      return cluster_entry.clone(cluster_name, search->first);
-     }
-   }
- 
-diff -Naur envoy/source/common/http/headers.h envoy-new/source/common/http/headers.h
---- envoy/source/common/http/headers.h	2023-10-08 15:01:21.968871828 +0800
-+++ envoy-new/source/common/http/headers.h	2023-09-27 18:48:50.059419606 +0800
-@@ -124,6 +124,7 @@
-     const LowerCaseString TriStartTime{"req-start-time"};
-     const LowerCaseString TriRespStartTime{"resp-start-time"};
-     const LowerCaseString EnvoyOriginalHost{"original-host"};
-+    const LowerCaseString HigressOriginalService{"x-higress-original-service"};
-   } AliExtendedValues;
- #endif
- };
-diff -Naur envoy/source/common/router/config_impl.cc envoy-new/source/common/router/config_impl.cc
---- envoy/source/common/router/config_impl.cc	2023-10-08 15:01:21.968871828 +0800
-+++ envoy-new/source/common/router/config_impl.cc	2023-09-27 18:49:18.656592237 +0800
-@@ -563,7 +563,6 @@
-         route.name());
-   }
-   // End Added
--
- }
- 
- bool RouteEntryImplBase::evaluateRuntimeMatch(const uint64_t random_value) const {
-@@ -662,6 +661,10 @@
-   }
- 
- #if defined(ALIMESH)
-+  if (!origin_cluster_name_.empty()) {
-+    headers.addCopy(Http::CustomHeaders::get().AliExtendedValues.HigressOriginalService,
-+                    origin_cluster_name_);
-+  }
-   headers.setReferenceKey(Http::CustomHeaders::get().AliExtendedValues.EnvoyOriginalHost,
-                           headers.getHostValue());
- #endif
-diff -Naur envoy/source/common/router/config_impl.h envoy-new/source/common/router/config_impl.h
---- envoy/source/common/router/config_impl.h	2023-10-08 15:01:21.968871828 +0800
-+++ envoy-new/source/common/router/config_impl.h	2023-09-27 18:59:11.196893507 +0800
-@@ -584,9 +584,13 @@
-     return internal_active_redirect_policy_;
-   }
- 
--  RouteConstSharedPtr clone(const std::string& name) const {
--    return std::make_shared<DynamicRouteEntry>(this, name);
-+  RouteConstSharedPtr clone(const std::string& name, const std::string& origin_cluster = "") const {
-+    auto entry = std::make_shared<DynamicRouteEntry>(this, name);
-+    entry->setOriginClusterName(origin_cluster);
-+    return entry;
-   }
-+
-+  void setOriginClusterName(const std::string& name) const { origin_cluster_name_ = name; }
- #endif
-   uint32_t retryShadowBufferLimit() const override { return retry_shadow_buffer_limit_; }
-   const std::vector<ShadowPolicyPtr>& shadowPolicies() const override { return shadow_policies_; }
-@@ -787,11 +791,17 @@
-       return parent_->internalActiveRedirectPolicy();
-     }
- 
--    RouteConstSharedPtr clone(const std::string& name) const {
--      return std::make_shared<Envoy::Router::RouteEntryImplBase::DynamicRouteEntry>(parent_, name);
-+    RouteConstSharedPtr clone(const std::string& name,
-+                              const std::string& origin_cluster = "") const {
-+      auto entry =
-+          std::make_shared<Envoy::Router::RouteEntryImplBase::DynamicRouteEntry>(parent_, name);
-+      entry->setOriginClusterName(origin_cluster);
-+      return entry;
-     }
- 
-     virtual RouteConstSharedPtr getRouteConstSharedPtr() const { return shared_from_this(); }
-+
-+    void setOriginClusterName(const std::string& name) { parent_->setOriginClusterName(name); }
- #endif
- 
-   private:
-@@ -1039,6 +1049,7 @@
- 
- #if defined(ALIMESH)
-   const InternalActiveRedirectPoliciesImpl internal_active_redirect_policy_;
-+  mutable std::string origin_cluster_name_;
- #endif
- };
- 

envoy/1.20/patches/envoy/20231124-rds-optimize.patch

@@ -1,315 +0,0 @@
-diff -Naur envoy/envoy/router/rds.h envoy-new/envoy/router/rds.h
---- envoy/envoy/router/rds.h	2023-11-24 10:52:39.914235488 +0800
-+++ envoy-new/envoy/router/rds.h	2023-11-24 10:47:36.293873127 +0800
-@@ -51,12 +51,6 @@
-   virtual void onConfigUpdate() PURE;
- 
-   /**
--   * Validate if the route configuration can be applied to the context of the route config provider.
--   */
--  virtual void
--  validateConfig(const envoy::config::route::v3::RouteConfiguration& config) const PURE;
--
--  /**
-    * Callback used to request an update to the route configuration from the management server.
-    * @param for_domain supplies the domain name that virtual hosts must match on
-    * @param thread_local_dispatcher thread-local dispatcher
-diff -Naur envoy/envoy/router/route_config_update_receiver.h envoy-new/envoy/router/route_config_update_receiver.h
---- envoy/envoy/router/route_config_update_receiver.h	2023-11-24 10:52:39.918235651 +0800
-+++ envoy-new/envoy/router/route_config_update_receiver.h	2023-11-24 10:47:36.293873127 +0800
-@@ -27,6 +27,7 @@
-    * @param rc supplies the RouteConfiguration.
-    * @param version_info supplies RouteConfiguration version.
-    * @return bool whether RouteConfiguration has been updated.
-+   * @throw EnvoyException if the new config can't be applied.
-    */
-   virtual bool onRdsUpdate(const envoy::config::route::v3::RouteConfiguration& rc,
-                            const std::string& version_info) PURE;
-diff -Naur envoy/source/common/router/rds_impl.cc envoy-new/source/common/router/rds_impl.cc
---- envoy/source/common/router/rds_impl.cc	2023-11-24 10:52:40.194246888 +0800
-+++ envoy-new/source/common/router/rds_impl.cc	2023-11-24 10:47:36.293873127 +0800
-@@ -122,9 +122,6 @@
-     throw EnvoyException(fmt::format("Unexpected RDS configuration (expecting {}): {}",
-                                      route_config_name_, route_config.name()));
-   }
--  if (route_config_provider_opt_.has_value()) {
--    route_config_provider_opt_.value()->validateConfig(route_config);
--  }
-   std::unique_ptr<Init::ManagerImpl> noop_init_manager;
-   std::unique_ptr<Cleanup> resume_rds;
-   if (config_update_info_->onRdsUpdate(route_config, version_info)) {
-@@ -292,12 +289,6 @@
-   }
- }
- 
--void RdsRouteConfigProviderImpl::validateConfig(
--    const envoy::config::route::v3::RouteConfiguration& config) const {
--  // TODO(lizan): consider cache the config here until onConfigUpdate.
--  ConfigImpl validation_config(config, optional_http_filters_, factory_context_, validator_, false);
--}
--
- // Schedules a VHDS request on the main thread and queues up the callback to use when the VHDS
- // response has been propagated to the worker thread that was the request origin.
- void RdsRouteConfigProviderImpl::requestVirtualHostsUpdate(
-diff -Naur envoy/source/common/router/rds_impl.h envoy-new/source/common/router/rds_impl.h
---- envoy/source/common/router/rds_impl.h	2023-11-24 10:52:40.194246888 +0800
-+++ envoy-new/source/common/router/rds_impl.h	2023-11-24 10:47:36.293873127 +0800
-@@ -81,7 +81,6 @@
-   }
-   SystemTime lastUpdated() const override { return last_updated_; }
-   void onConfigUpdate() override {}
--  void validateConfig(const envoy::config::route::v3::RouteConfiguration&) const override {}
-   void requestVirtualHostsUpdate(const std::string&, Event::Dispatcher&,
-                                  std::weak_ptr<Http::RouteConfigUpdatedCallback>) override {
-     NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
-@@ -209,7 +208,6 @@
-   void requestVirtualHostsUpdate(
-       const std::string& for_domain, Event::Dispatcher& thread_local_dispatcher,
-       std::weak_ptr<Http::RouteConfigUpdatedCallback> route_config_updated_cb) override;
--  void validateConfig(const envoy::config::route::v3::RouteConfiguration& config) const override;
- 
- private:
-   struct ThreadLocalConfig : public ThreadLocal::ThreadLocalObject {
-diff -Naur envoy/source/common/router/route_config_update_receiver_impl.cc envoy-new/source/common/router/route_config_update_receiver_impl.cc
---- envoy/source/common/router/route_config_update_receiver_impl.cc	2023-11-24 10:52:40.194246888 +0800
-+++ envoy-new/source/common/router/route_config_update_receiver_impl.cc	2023-11-24 10:47:36.297873290 +0800
-@@ -1,6 +1,7 @@
- #include "source/common/router/route_config_update_receiver_impl.h"
- 
- #include <string>
-+#include <utility>
- 
- #include "envoy/config/route/v3/route.pb.h"
- #include "envoy/service/discovery/v3/discovery.pb.h"
-@@ -14,23 +15,49 @@
- namespace Envoy {
- namespace Router {
- 
-+namespace {
-+
-+// Resets 'route_config::virtual_hosts' by merging VirtualHost contained in
-+// 'rds_vhosts' and 'vhds_vhosts'.
-+void rebuildRouteConfigVirtualHosts(
-+    const std::map<std::string, envoy::config::route::v3::VirtualHost>& rds_vhosts,
-+    const std::map<std::string, envoy::config::route::v3::VirtualHost>& vhds_vhosts,
-+    envoy::config::route::v3::RouteConfiguration& route_config) {
-+  route_config.clear_virtual_hosts();
-+  for (const auto& vhost : rds_vhosts) {
-+    route_config.mutable_virtual_hosts()->Add()->CopyFrom(vhost.second);
-+  }
-+  for (const auto& vhost : vhds_vhosts) {
-+    route_config.mutable_virtual_hosts()->Add()->CopyFrom(vhost.second);
-+  }
-+}
-+
-+} // namespace
-+
- bool RouteConfigUpdateReceiverImpl::onRdsUpdate(
-     const envoy::config::route::v3::RouteConfiguration& rc, const std::string& version_info) {
-   const uint64_t new_hash = MessageUtil::hash(rc);
-   if (new_hash == last_config_hash_) {
-     return false;
-   }
--  route_config_proto_ = std::make_unique<envoy::config::route::v3::RouteConfiguration>(rc);
--  last_config_hash_ = new_hash;
-   const uint64_t new_vhds_config_hash = rc.has_vhds() ? MessageUtil::hash(rc.vhds()) : 0ul;
-+  std::map<std::string, envoy::config::route::v3::VirtualHost> rds_virtual_hosts;
-+  for (const auto& vhost : rc.virtual_hosts()) {
-+    rds_virtual_hosts.emplace(vhost.name(), vhost);
-+  }
-+  envoy::config::route::v3::RouteConfiguration new_route_config = rc;
-+  rebuildRouteConfigVirtualHosts(rds_virtual_hosts, *vhds_virtual_hosts_, new_route_config);
-+  auto new_config = std::make_shared<ConfigImpl>(
-+      new_route_config, optional_http_filters_, factory_context_,
-+      factory_context_.messageValidationContext().dynamicValidationVisitor(), false);
-+  // If the above validation/validation doesn't raise exception, update the
-+  // other cached config entries.
-+  config_ = new_config;
-+  rds_virtual_hosts_ = std::move(rds_virtual_hosts);
-+  last_config_hash_ = new_hash;
-+  *route_config_proto_ = std::move(new_route_config);
-   vhds_configuration_changed_ = new_vhds_config_hash != last_vhds_config_hash_;
-   last_vhds_config_hash_ = new_vhds_config_hash;
--  initializeRdsVhosts(*route_config_proto_);
--
--  rebuildRouteConfig(rds_virtual_hosts_, *vhds_virtual_hosts_, *route_config_proto_);
--  config_ = std::make_shared<ConfigImpl>(
--      *route_config_proto_, optional_http_filters_, factory_context_,
--      factory_context_.messageValidationContext().dynamicValidationVisitor(), false);
- 
-   onUpdateCommon(version_info);
-   return true;
-@@ -50,8 +77,8 @@
-   auto route_config_after_this_update =
-       std::make_unique<envoy::config::route::v3::RouteConfiguration>();
-   route_config_after_this_update->CopyFrom(*route_config_proto_);
--  rebuildRouteConfig(rds_virtual_hosts_, *vhosts_after_this_update,
--                     *route_config_after_this_update);
-+  rebuildRouteConfigVirtualHosts(rds_virtual_hosts_, *vhosts_after_this_update,
-+                                 *route_config_after_this_update);
- 
-   auto new_config = std::make_shared<ConfigImpl>(
-       *route_config_after_this_update, optional_http_filters_, factory_context_,
-@@ -73,14 +100,6 @@
-   config_info_.emplace(RouteConfigProvider::ConfigInfo{*route_config_proto_, last_config_version_});
- }
- 
--void RouteConfigUpdateReceiverImpl::initializeRdsVhosts(
--    const envoy::config::route::v3::RouteConfiguration& route_configuration) {
--  rds_virtual_hosts_.clear();
--  for (const auto& vhost : route_configuration.virtual_hosts()) {
--    rds_virtual_hosts_.emplace(vhost.name(), vhost);
--  }
--}
--
- bool RouteConfigUpdateReceiverImpl::removeVhosts(
-     std::map<std::string, envoy::config::route::v3::VirtualHost>& vhosts,
-     const Protobuf::RepeatedPtrField<std::string>& removed_vhost_names) {
-@@ -110,18 +129,5 @@
-   return vhosts_added;
- }
- 
--void RouteConfigUpdateReceiverImpl::rebuildRouteConfig(
--    const std::map<std::string, envoy::config::route::v3::VirtualHost>& rds_vhosts,
--    const std::map<std::string, envoy::config::route::v3::VirtualHost>& vhds_vhosts,
--    envoy::config::route::v3::RouteConfiguration& route_config) {
--  route_config.clear_virtual_hosts();
--  for (const auto& vhost : rds_vhosts) {
--    route_config.mutable_virtual_hosts()->Add()->CopyFrom(vhost.second);
--  }
--  for (const auto& vhost : vhds_vhosts) {
--    route_config.mutable_virtual_hosts()->Add()->CopyFrom(vhost.second);
--  }
--}
--
- } // namespace Router
- } // namespace Envoy
-diff -Naur envoy/source/common/router/route_config_update_receiver_impl.h envoy-new/source/common/router/route_config_update_receiver_impl.h
---- envoy/source/common/router/route_config_update_receiver_impl.h	2023-11-24 10:52:40.194246888 +0800
-+++ envoy-new/source/common/router/route_config_update_receiver_impl.h	2023-11-24 10:47:36.297873290 +0800
-@@ -27,15 +27,10 @@
-             std::make_unique<std::map<std::string, envoy::config::route::v3::VirtualHost>>()),
-         vhds_configuration_changed_(true), optional_http_filters_(optional_http_filters) {}
- 
--  void initializeRdsVhosts(const envoy::config::route::v3::RouteConfiguration& route_configuration);
-   bool removeVhosts(std::map<std::string, envoy::config::route::v3::VirtualHost>& vhosts,
-                     const Protobuf::RepeatedPtrField<std::string>& removed_vhost_names);
-   bool updateVhosts(std::map<std::string, envoy::config::route::v3::VirtualHost>& vhosts,
-                     const VirtualHostRefVector& added_vhosts);
--  void rebuildRouteConfig(
--      const std::map<std::string, envoy::config::route::v3::VirtualHost>& rds_vhosts,
--      const std::map<std::string, envoy::config::route::v3::VirtualHost>& vhds_vhosts,
--      envoy::config::route::v3::RouteConfiguration& route_config);
-   bool onDemandFetchFailed(const envoy::service::discovery::v3::Resource& resource) const;
-   void onUpdateCommon(const std::string& version_info);
- 
-diff -Naur envoy/source/server/admin/admin.h envoy-new/source/server/admin/admin.h
---- envoy/source/server/admin/admin.h	2023-11-24 10:52:41.358294284 +0800
-+++ envoy-new/source/server/admin/admin.h	2023-11-24 10:47:36.297873290 +0800
-@@ -234,7 +234,6 @@
-     absl::optional<ConfigInfo> configInfo() const override { return {}; }
-     SystemTime lastUpdated() const override { return time_source_.systemTime(); }
-     void onConfigUpdate() override {}
--    void validateConfig(const envoy::config::route::v3::RouteConfiguration&) const override {}
-     void requestVirtualHostsUpdate(const std::string&, Event::Dispatcher&,
-                                    std::weak_ptr<Http::RouteConfigUpdatedCallback>) override {
-       NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
-diff -Naur envoy/test/common/router/rds_impl_test.cc envoy-new/test/common/router/rds_impl_test.cc
---- envoy/test/common/router/rds_impl_test.cc	2023-11-24 10:52:40.714268062 +0800
-+++ envoy-new/test/common/router/rds_impl_test.cc	2023-11-24 10:47:36.297873290 +0800
-@@ -528,34 +528,66 @@
-   rds_callbacks_->onConfigUpdate(decoded_resources.refvec_, response1.version_info());
- }
- 
--// Validate behavior when the config is delivered but it fails PGV validation.
-+// Validates behavior when the config is delivered but it fails PGV validation.
-+// The invalid config won't affect existing valid config.
- TEST_F(RdsImplTest, FailureInvalidConfig) {
-   InSequence s;
- 
-   setup();
-+  EXPECT_CALL(init_watcher_, ready());
- 
--  const std::string response1_json = R"EOF(
-+  const std::string valid_json = R"EOF(
- {
-   "version_info": "1",
-   "resources": [
-     {
-       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
--      "name": "INVALID_NAME_FOR_route_config",
-+      "name": "foo_route_config",
-       "virtual_hosts": null
-     }
-   ]
- }
- )EOF";
-+
-   auto response1 =
--      TestUtility::parseYaml<envoy::service::discovery::v3::DiscoveryResponse>(response1_json);
-+      TestUtility::parseYaml<envoy::service::discovery::v3::DiscoveryResponse>(valid_json);
-   const auto decoded_resources =
-       TestUtility::decodeResources<envoy::config::route::v3::RouteConfiguration>(response1);
-+  EXPECT_NO_THROW(
-+      rds_callbacks_->onConfigUpdate(decoded_resources.refvec_, response1.version_info()));
-+  // Sadly the RdsRouteConfigSubscription privately inherited from
-+  // SubscriptionCallbacks, so we has to use reinterpret_cast here.
-+  RdsRouteConfigSubscription* rds_subscription =
-+      reinterpret_cast<RdsRouteConfigSubscription*>(rds_callbacks_);
-+  auto config_impl_pointer = rds_subscription->routeConfigProvider().value()->config();
-+  // Now send an invalid config update.
-+  const std::string invalid_json =
-+      R"EOF(
-+{
-+  "version_info": "1",
-+  "resources": [
-+    {
-+      "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
-+      "name": "INVALID_NAME_FOR_route_config",
-+      "virtual_hosts": null
-+    }
-+  ]
-+}
-+)EOF";
-+
-+  auto response2 =
-+      TestUtility::parseYaml<envoy::service::discovery::v3::DiscoveryResponse>(invalid_json);
-+  const auto decoded_resources_2 =
-+      TestUtility::decodeResources<envoy::config::route::v3::RouteConfiguration>(response2);
- 
--  EXPECT_CALL(init_watcher_, ready());
-   EXPECT_THROW_WITH_MESSAGE(
--      rds_callbacks_->onConfigUpdate(decoded_resources.refvec_, response1.version_info()),
-+      rds_callbacks_->onConfigUpdate(decoded_resources_2.refvec_, response2.version_info()),
-       EnvoyException,
--      "Unexpected RDS configuration (expecting foo_route_config): INVALID_NAME_FOR_route_config");
-+      "Unexpected RDS configuration (expecting foo_route_config): "
-+      "INVALID_NAME_FOR_route_config");
-+
-+  // Verify that the config is still the old value.
-+  ASSERT_EQ(config_impl_pointer, rds_subscription->routeConfigProvider().value()->config());
- }
- 
- // rds and vhds configurations change together
-diff -Naur envoy/test/mocks/router/mocks.h envoy-new/test/mocks/router/mocks.h
---- envoy/test/mocks/router/mocks.h	2023-11-24 10:52:41.370294773 +0800
-+++ envoy-new/test/mocks/router/mocks.h	2023-11-24 10:47:36.301873453 +0800
-@@ -538,7 +538,6 @@
-   MOCK_METHOD(absl::optional<ConfigInfo>, configInfo, (), (const));
-   MOCK_METHOD(SystemTime, lastUpdated, (), (const));
-   MOCK_METHOD(void, onConfigUpdate, ());
--  MOCK_METHOD(void, validateConfig, (const envoy::config::route::v3::RouteConfiguration&), (const));
-   MOCK_METHOD(void, requestVirtualHostsUpdate,
-               (const std::string&, Event::Dispatcher&,
-                std::weak_ptr<Http::RouteConfigUpdatedCallback> route_config_updated_cb));
-diff -Naur envoy/tools/spelling/spelling_dictionary.txt envoy-new/tools/spelling/spelling_dictionary.txt
---- envoy/tools/spelling/spelling_dictionary.txt	2023-11-24 10:52:41.370294773 +0800
-+++ envoy-new/tools/spelling/spelling_dictionary.txt	2023-11-24 10:48:54.969076506 +0800
-@@ -1303,6 +1303,7 @@
- ep
- suri
- transid
-+vhosts
- WAF
- TRI
- tmd

envoy/1.20/patches/envoy/20240104-enhance-srds.patch

@@ -1,483 +0,0 @@
-diff -Naur envoy/api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto envoy-new/api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto
---- envoy/api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto	2024-01-04 21:07:40.000000000 +0800
-+++ envoy-new/api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto	2024-01-04 21:09:13.000000000 +0800
-@@ -888,11 +888,31 @@
-         }
-       }
- 
-+      message HostValueExtractor {
-+        option (udpa.annotations.versioning).previous_message_type =
-+            "envoy.config.filter.network.http_connection_manager.v2.ScopedRoutes.ScopeKeyBuilder."
-+            "FragmentBuilder.HostValueExtractor";
-+
-+        // The maximum number of host superset recomputes. If not specified, defaults to 100.
-+        google.protobuf.UInt32Value max_recompute_num = 1;
-+      }
-+
-+      message LocalPortValueExtractor {
-+        option (udpa.annotations.versioning).previous_message_type =
-+            "envoy.config.filter.network.http_connection_manager.v2.ScopedRoutes.ScopeKeyBuilder."
-+            "FragmentBuilder.LocalPortValueExtractor";
-+      }
-+
-+
-       oneof type {
-         option (validate.required) = true;
- 
-         // Specifies how a header field's value should be extracted.
-         HeaderValueExtractor header_value_extractor = 1;
-+
-+        HostValueExtractor host_value_extractor = 101;
-+
-+        LocalPortValueExtractor local_port_value_extractor = 102;
-       }
-     }
- 
-diff -Naur envoy/envoy/router/scopes.h envoy-new/envoy/router/scopes.h
---- envoy/envoy/router/scopes.h	2024-01-04 21:07:38.000000000 +0800
-+++ envoy-new/envoy/router/scopes.h	2024-01-04 21:09:13.000000000 +0800
-@@ -92,7 +92,12 @@
-    * @param headers the request headers to match the scoped routing configuration against.
-    * @return ConfigConstSharedPtr the router's Config matching the request headers.
-    */
-+#if defined ALIMESH
-+  virtual ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap& headers,
-+                                              const StreamInfo::StreamInfo& info) const PURE;
-+#else
-   virtual ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap& headers) const PURE;
-+#endif
- 
-   /**
-    * Based on the incoming HTTP request headers, returns the hash value of its scope key.
-@@ -100,6 +105,12 @@
-    * @return unique_ptr of the scope key computed from header.
-    */
-   virtual ScopeKeyPtr computeScopeKey(const Http::HeaderMap&) const { return {}; }
-+
-+#if defined(ALIMESH)
-+  virtual ScopeKeyPtr computeScopeKey(const Http::HeaderMap&, const StreamInfo::StreamInfo&) const {
-+    return {};
-+  };
-+#endif
- };
- 
- using ScopedConfigConstSharedPtr = std::shared_ptr<const ScopedConfig>;
-diff -Naur envoy/source/common/http/conn_manager_impl.cc envoy-new/source/common/http/conn_manager_impl.cc
---- envoy/source/common/http/conn_manager_impl.cc	2024-01-04 21:07:41.000000000 +0800
-+++ envoy-new/source/common/http/conn_manager_impl.cc	2024-01-04 21:09:13.000000000 +0800
-@@ -577,8 +577,13 @@
-     requestVhdsUpdate(host_header, thread_local_dispatcher, std::move(route_config_updated_cb));
-     return;
-   } else if (parent_.snapped_scoped_routes_config_ != nullptr) {
-+#if defined(ALIMESH)
-+    Router::ScopeKeyPtr scope_key = parent_.snapped_scoped_routes_config_->computeScopeKey(
-+        *parent_.request_headers_, parent_.connection()->streamInfo());
-+#else
-     Router::ScopeKeyPtr scope_key =
-         parent_.snapped_scoped_routes_config_->computeScopeKey(*parent_.request_headers_);
-+#endif
-     // If scope_key is not null, the scope exists but RouteConfiguration is not initialized.
-     if (scope_key != nullptr) {
-       requestSrdsUpdate(std::move(scope_key), thread_local_dispatcher,
-@@ -1197,7 +1202,13 @@
- void ConnectionManagerImpl::ActiveStream::snapScopedRouteConfig() {
-   // NOTE: if a RDS subscription hasn't got a RouteConfiguration back, a Router::NullConfigImpl is
-   // returned, in that case we let it pass.
-+#if defined(ALIMESH)
-+  snapped_route_config_ =
-+      snapped_scoped_routes_config_->getRouteConfig(*request_headers_, connection()->streamInfo());
-+#else
-   snapped_route_config_ = snapped_scoped_routes_config_->getRouteConfig(*request_headers_);
-+
-+#endif
-   if (snapped_route_config_ == nullptr) {
-     ENVOY_STREAM_LOG(trace, "can't find SRDS scope.", *this);
-     // TODO(stevenzzzz): Consider to pass an error message to router filter, so that it can
-diff -Naur envoy/source/common/router/scoped_config_impl.cc envoy-new/source/common/router/scoped_config_impl.cc
---- envoy/source/common/router/scoped_config_impl.cc	2024-01-04 21:07:36.000000000 +0800
-+++ envoy-new/source/common/router/scoped_config_impl.cc	2024-01-04 21:09:13.000000000 +0800
-@@ -6,6 +6,160 @@
- namespace Envoy {
- namespace Router {
- 
-+#if defined(ALIMESH)
-+namespace {
-+
-+std::string maskFirstDNSLabel(absl::string_view host) {
-+  if (host == "*") {
-+    return std::string(host);
-+  }
-+  if (host.size() < 2) {
-+    return "*";
-+  }
-+  size_t start_pos = (host[0] == '*' && host[1] == '.') ? 2 : 0;
-+  size_t dot_pos = host.find('.', start_pos);
-+  if (dot_pos != absl::string_view::npos) {
-+    return absl::StrCat("*", absl::string_view(host.data() + dot_pos, host.size() - dot_pos));
-+  }
-+  return "*";
-+}
-+
-+} // namespace
-+
-+LocalPortValueExtractorImpl::LocalPortValueExtractorImpl(
-+    ScopedRoutes::ScopeKeyBuilder::FragmentBuilder&& config)
-+    : FragmentBuilderBase(std::move(config)) {
-+  ASSERT(config_.type_case() ==
-+             ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::kLocalPortValueExtractor,
-+         "local_port_value_extractor is not set.");
-+}
-+
-+std::unique_ptr<ScopeKeyFragmentBase> LocalPortValueExtractorImpl::computeFragment(
-+    const Http::HeaderMap&, const StreamInfo::StreamInfo& info, ReComputeCbPtr&) const {
-+  auto port = info.downstreamAddressProvider().localAddress()->ip()->port();
-+  return std::make_unique<StringKeyFragment>(std::to_string(long(port)));
-+}
-+
-+HostValueExtractorImpl::HostValueExtractorImpl(
-+    ScopedRoutes::ScopeKeyBuilder::FragmentBuilder&& config)
-+    : FragmentBuilderBase(std::move(config)),
-+      host_value_extractor_config_(config_.host_value_extractor()),
-+      max_recompute_num_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(
-+          host_value_extractor_config_, max_recompute_num, DefaultMaxRecomputeNum)) {
-+  ASSERT(config_.type_case() == ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::kHostValueExtractor,
-+         "host_value_extractor is not set.");
-+}
-+
-+std::unique_ptr<ScopeKeyFragmentBase>
-+HostValueExtractorImpl::reComputeHelper(const std::string& host, ReComputeCbPtr& next_recompute,
-+                                        uint32_t recompute_seq) const {
-+  if (recompute_seq == max_recompute_num_) {
-+    ENVOY_LOG_MISC(warn,
-+                   "recompute host fragment failed, maximum number of recalculations exceeded");
-+    return nullptr;
-+  }
-+  if (host == "*") {
-+    *next_recompute = nullptr;
-+    return nullptr;
-+  }
-+  auto masked_host = maskFirstDNSLabel(host);
-+  *next_recompute = [this, masked_host, recompute_seq,
-+                     next_recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
-+    return reComputeHelper(masked_host, next_recompute, recompute_seq + 1);
-+  };
-+  return std::make_unique<StringKeyFragment>(masked_host);
-+}
-+
-+std::unique_ptr<ScopeKeyFragmentBase>
-+HostValueExtractorImpl::computeFragment(const Http::HeaderMap& headers,
-+                                        const StreamInfo::StreamInfo&,
-+                                        ReComputeCbPtr& recompute) const {
-+  auto fragment = computeFragment(headers);
-+  auto host = static_cast<const Http::RequestHeaderMap&>(headers).getHostValue();
-+  *recompute = [this, host, recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
-+    return reComputeHelper(std::string(host), recompute, 0);
-+  };
-+  return fragment;
-+}
-+
-+std::unique_ptr<ScopeKeyFragmentBase>
-+HostValueExtractorImpl::computeFragment(const Http::HeaderMap& headers) const {
-+  return std::make_unique<StringKeyFragment>(
-+      static_cast<const Http::RequestHeaderMap&>(headers).getHostValue());
-+}
-+
-+std::unique_ptr<ScopeKeyFragmentBase>
-+HeaderValueExtractorImpl::computeFragment(const Http::HeaderMap& headers,
-+                                          const StreamInfo::StreamInfo&, ReComputeCbPtr&) const {
-+  return computeFragment(headers);
-+}
-+
-+ScopeKeyPtr ScopeKeyBuilderImpl::computeScopeKey(const Http::HeaderMap& headers,
-+                                                 const StreamInfo::StreamInfo& info,
-+                                                 std::function<ScopeKeyPtr()>& recompute) const {
-+  ScopeKey key;
-+  bool recomputeable = false;
-+  auto recompute_cbs = std::make_shared<std::vector<ReComputeCbPtr>>();
-+  for (const auto& builder : fragment_builders_) {
-+    // returns nullopt if a null fragment is found.
-+    ReComputeCbPtr recompute_fragment_cb = std::make_shared<ReComputeCb>();
-+    std::unique_ptr<ScopeKeyFragmentBase> fragment =
-+        builder->computeFragment(headers, info, recompute_fragment_cb);
-+    if (fragment == nullptr) {
-+      return nullptr;
-+    }
-+    if (*recompute_fragment_cb == nullptr) {
-+      auto key_fragment = static_cast<StringKeyFragment*>(fragment.get());
-+      auto copied_fragment = std::make_shared<StringKeyFragment>(*key_fragment);
-+      auto recompute_cb =
-+          std::make_shared<ReComputeCb>([copied_fragment]() -> std::unique_ptr<StringKeyFragment> {
-+            return std::make_unique<StringKeyFragment>(*copied_fragment);
-+          });
-+      recompute_cbs->push_back(recompute_cb);
-+    } else {
-+      recomputeable = true;
-+      recompute_cbs->push_back(recompute_fragment_cb);
-+    }
-+    key.addFragment(std::move(fragment));
-+  }
-+  if (recomputeable) {
-+    recompute = [&recompute, recompute_cbs]() mutable -> ScopeKeyPtr {
-+      ScopeKey new_key;
-+      for (auto& cb : *recompute_cbs) {
-+        auto new_fragment = (*cb)();
-+        if (new_fragment == nullptr) {
-+          return nullptr;
-+        }
-+        if (*cb == nullptr) {
-+          recompute = nullptr;
-+        }
-+        new_key.addFragment(std::move(new_fragment));
-+      }
-+      return std::make_unique<ScopeKey>(std::move(new_key));
-+    };
-+  }
-+  return std::make_unique<ScopeKey>(std::move(key));
-+}
-+
-+ScopeKeyPtr ScopedConfigImpl::computeScopeKey(const Http::HeaderMap& headers,
-+                                              const StreamInfo::StreamInfo& info) const {
-+  std::function<Router::ScopeKeyPtr()> recompute;
-+  ScopeKeyPtr scope_key = scope_key_builder_.computeScopeKey(headers, info, recompute);
-+  if (scope_key == nullptr) {
-+    return nullptr;
-+  }
-+  decltype(scoped_route_info_by_key_.begin()) iter;
-+  do {
-+    iter = scoped_route_info_by_key_.find(scope_key->hash());
-+    if (iter != scoped_route_info_by_key_.end()) {
-+      return scope_key;
-+    }
-+  } while (recompute != nullptr && (scope_key = recompute()));
-+  return nullptr;
-+}
-+
-+#endif
-+
- bool ScopeKey::operator!=(const ScopeKey& other) const { return !(*this == other); }
- 
- bool ScopeKey::operator==(const ScopeKey& other) const {
-@@ -95,6 +249,16 @@
-     : ScopeKeyBuilderBase(std::move(config)) {
-   for (const auto& fragment_builder : config_.fragments()) {
-     switch (fragment_builder.type_case()) {
-+#if defined(ALIMESH)
-+    case ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::kHostValueExtractor:
-+      fragment_builders_.emplace_back(std::make_unique<HostValueExtractorImpl>(
-+          ScopedRoutes::ScopeKeyBuilder::FragmentBuilder(fragment_builder)));
-+      break;
-+    case ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::kLocalPortValueExtractor:
-+      fragment_builders_.emplace_back(std::make_unique<LocalPortValueExtractorImpl>(
-+          ScopedRoutes::ScopeKeyBuilder::FragmentBuilder(fragment_builder)));
-+      break;
-+#endif
-     case ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::kHeaderValueExtractor:
-       fragment_builders_.emplace_back(std::make_unique<HeaderValueExtractorImpl>(
-           ScopedRoutes::ScopeKeyBuilder::FragmentBuilder(fragment_builder)));
-@@ -143,6 +307,22 @@
- }
- 
- Router::ConfigConstSharedPtr
-+#if defined(ALIMESH)
-+ScopedConfigImpl::getRouteConfig(const Http::HeaderMap& headers,
-+                                 const StreamInfo::StreamInfo& info) const {
-+  std::function<ScopeKeyPtr()> recompute;
-+  ScopeKeyPtr scope_key = scope_key_builder_.computeScopeKey(headers, info, recompute);
-+  if (scope_key == nullptr) {
-+    return nullptr;
-+  }
-+  decltype(scoped_route_info_by_key_.begin()) iter;
-+  do {
-+    iter = scoped_route_info_by_key_.find(scope_key->hash());
-+    if (iter != scoped_route_info_by_key_.end()) {
-+      return iter->second->routeConfig();
-+    }
-+  } while (recompute != nullptr && (scope_key = recompute()));
-+#else
- ScopedConfigImpl::getRouteConfig(const Http::HeaderMap& headers) const {
-   ScopeKeyPtr scope_key = scope_key_builder_.computeScopeKey(headers);
-   if (scope_key == nullptr) {
-@@ -152,6 +332,7 @@
-   if (iter != scoped_route_info_by_key_.end()) {
-     return iter->second->routeConfig();
-   }
-+#endif
-   return nullptr;
- }
- 
-diff -Naur envoy/source/common/router/scoped_config_impl.h envoy-new/source/common/router/scoped_config_impl.h
---- envoy/source/common/router/scoped_config_impl.h	2024-01-04 21:07:36.000000000 +0800
-+++ envoy-new/source/common/router/scoped_config_impl.h	2024-01-04 21:09:13.000000000 +0800
-@@ -22,6 +22,11 @@
- 
- using envoy::extensions::filters::network::http_connection_manager::v3::ScopedRoutes;
- 
-+#if defined(ALIMESH)
-+using ReComputeCb = std::function<std::unique_ptr<ScopeKeyFragmentBase>()>;
-+using ReComputeCbPtr = std::shared_ptr<ReComputeCb>;
-+#endif
-+
- /**
-  * Base class for fragment builders.
-  */
-@@ -36,6 +41,12 @@
-   virtual std::unique_ptr<ScopeKeyFragmentBase>
-   computeFragment(const Http::HeaderMap& headers) const PURE;
- 
-+#if defined(ALIMESH)
-+  virtual std::unique_ptr<ScopeKeyFragmentBase>
-+  computeFragment(const Http::HeaderMap& headers, const StreamInfo::StreamInfo& info,
-+                  ReComputeCbPtr& recompute) const PURE;
-+#endif
-+
- protected:
-   const ScopedRoutes::ScopeKeyBuilder::FragmentBuilder config_;
- };
-@@ -47,11 +58,54 @@
-   std::unique_ptr<ScopeKeyFragmentBase>
-   computeFragment(const Http::HeaderMap& headers) const override;
- 
-+#if defined(ALIMESH)
-+  std::unique_ptr<ScopeKeyFragmentBase> computeFragment(const Http::HeaderMap& headers,
-+                                                        const StreamInfo::StreamInfo& info,
-+                                                        ReComputeCbPtr& recompute) const override;
-+#endif
-+
- private:
-   const ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::HeaderValueExtractor&
-       header_value_extractor_config_;
- };
- 
-+#if defined(ALIMESH)
-+class HostValueExtractorImpl : public FragmentBuilderBase {
-+public:
-+  explicit HostValueExtractorImpl(ScopedRoutes::ScopeKeyBuilder::FragmentBuilder&& config);
-+
-+  std::unique_ptr<ScopeKeyFragmentBase>
-+  computeFragment(const Http::HeaderMap& headers) const override;
-+
-+  std::unique_ptr<ScopeKeyFragmentBase> computeFragment(const Http::HeaderMap& headers,
-+                                                        const StreamInfo::StreamInfo& info,
-+                                                        ReComputeCbPtr& recompute) const override;
-+
-+private:
-+  std::unique_ptr<ScopeKeyFragmentBase> reComputeHelper(const std::string& host,
-+                                                        ReComputeCbPtr& next_recompute,
-+                                                        uint32_t recompute_seq) const;
-+
-+  static constexpr uint32_t DefaultMaxRecomputeNum = 100;
-+
-+  const ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::HostValueExtractor&
-+      host_value_extractor_config_;
-+  const uint32_t max_recompute_num_;
-+};
-+
-+class LocalPortValueExtractorImpl : public FragmentBuilderBase {
-+public:
-+  explicit LocalPortValueExtractorImpl(ScopedRoutes::ScopeKeyBuilder::FragmentBuilder&& config);
-+
-+  std::unique_ptr<ScopeKeyFragmentBase> computeFragment(const Http::HeaderMap&) const override {
-+    return nullptr;
-+  };
-+
-+  std::unique_ptr<ScopeKeyFragmentBase> computeFragment(const Http::HeaderMap& headers,
-+                                                        const StreamInfo::StreamInfo& info,
-+                                                        ReComputeCbPtr& recompute) const override;
-+};
-+#endif
- /**
-  * Base class for ScopeKeyBuilder implementations.
-  */
-@@ -64,6 +118,12 @@
-   // Computes scope key for given headers, returns nullptr if a key can't be computed.
-   virtual ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers) const PURE;
- 
-+#if defined(ALIMESH)
-+  virtual ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers,
-+                                      const StreamInfo::StreamInfo& info,
-+                                      std::function<ScopeKeyPtr()>& recompute) const PURE;
-+#endif
-+
- protected:
-   const ScopedRoutes::ScopeKeyBuilder config_;
- };
-@@ -74,6 +134,11 @@
- 
-   ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers) const override;
- 
-+#if defined(ALIMESH)
-+  ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers, const StreamInfo::StreamInfo& info,
-+                              std::function<ScopeKeyPtr()>& recompute) const override;
-+#endif
-+
- private:
-   std::vector<std::unique_ptr<FragmentBuilderBase>> fragment_builders_;
- };
-@@ -118,10 +183,20 @@
-   void removeRoutingScopes(const std::vector<std::string>& scope_names);
- 
-   // Envoy::Router::ScopedConfig
-+#if defined(ALIMESH)
-+  Router::ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap& headers,
-+                                              const StreamInfo::StreamInfo& info) const override;
-+#else
-   Router::ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap& headers) const override;
-+#endif
-   // The return value is not null only if the scope corresponding to the header exists.
-   ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers) const override;
- 
-+#if defined(ALIMESH)
-+  ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers,
-+                              const StreamInfo::StreamInfo& info) const override;
-+#endif
-+
- private:
-   ScopeKeyBuilderImpl scope_key_builder_;
-   // From scope name to cached ScopedRouteInfo.
-@@ -135,9 +210,16 @@
-  */
- class NullScopedConfigImpl : public ScopedConfig {
- public:
-+#if defined(ALIMESH)
-+  Router::ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap&,
-+                                              const StreamInfo::StreamInfo&) const override {
-+    return std::make_shared<const NullConfigImpl>();
-+  }
-+#else
-   Router::ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap&) const override {
-     return std::make_shared<const NullConfigImpl>();
-   }
-+#endif
- };
- 
- } // namespace Router
-diff -Naur envoy/source/extensions/filters/http/on_demand/on_demand_update.cc envoy-new/source/extensions/filters/http/on_demand/on_demand_update.cc
---- envoy/source/extensions/filters/http/on_demand/on_demand_update.cc	2024-01-04 21:07:33.000000000 +0800
-+++ envoy-new/source/extensions/filters/http/on_demand/on_demand_update.cc	2024-01-04 21:09:13.000000000 +0800
-@@ -50,7 +50,11 @@
- // This is the callback which is called when an update requested in requestRouteConfigUpdate()
- // has been propagated to workers, at which point the request processing is restarted from the
- // beginning.
-+#if defined(ALIMESH)
-+void OnDemandRouteUpdate::onRouteConfigUpdateCompletion(bool) {
-+#else
- void OnDemandRouteUpdate::onRouteConfigUpdateCompletion(bool route_exists) {
-+#endif
-   filter_iteration_state_ = Http::FilterHeadersStatus::Continue;
- 
-   // Don't call continueDecoding in the middle of decodeHeaders()
-@@ -58,12 +62,14 @@
-     return;
-   }
- 
-+#if !defined(ALIMESH)
-   if (route_exists &&                  // route can be resolved after an on-demand
-                                        // VHDS update
-       !callbacks_->decodingBuffer() && // Redirects with body not yet supported.
-       callbacks_->recreateStream(/*headers=*/nullptr)) {
-     return;
-   }
-+#endif
- 
-   // route cannot be resolved after an on-demand VHDS update or
-   // recreating stream failed, continue the filter-chain

envoy/1.20/patches/envoy/20240110-fix-srds.patch

@@ -1,49 +0,0 @@
-diff -Naur envoy/source/common/router/BUILD envoy-new/source/common/router/BUILD
---- envoy/source/common/router/BUILD	2024-01-10 20:10:14.505600746 +0800
-+++ envoy-new/source/common/router/BUILD	2024-01-10 20:07:25.960379955 +0800
-@@ -212,6 +212,7 @@
-         "//envoy/router:rds_interface",
-         "//envoy/router:scopes_interface",
-         "//envoy/thread_local:thread_local_interface",
-+        "//source/common/http:header_utility_lib",
-         "@envoy_api//envoy/config/route/v3:pkg_cc_proto",
-         "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3:pkg_cc_proto",
-     ],
-diff -Naur envoy/source/common/router/scoped_config_impl.cc envoy-new/source/common/router/scoped_config_impl.cc
---- envoy/source/common/router/scoped_config_impl.cc	2024-01-10 20:10:14.529600924 +0800
-+++ envoy-new/source/common/router/scoped_config_impl.cc	2024-01-10 20:09:50.161422411 +0800
-@@ -3,6 +3,8 @@
- #include "envoy/config/route/v3/scoped_route.pb.h"
- #include "envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.h"
- 
-+#include "source/common/http/header_utility.h"
-+
- namespace Envoy {
- namespace Router {
- 
-@@ -74,18 +76,20 @@
- HostValueExtractorImpl::computeFragment(const Http::HeaderMap& headers,
-                                         const StreamInfo::StreamInfo&,
-                                         ReComputeCbPtr& recompute) const {
--  auto fragment = computeFragment(headers);
-   auto host = static_cast<const Http::RequestHeaderMap&>(headers).getHostValue();
-+  auto port_start = Http::HeaderUtility::getPortStart(host);
-+  if (port_start != absl::string_view::npos) {
-+    host = host.substr(0, port_start);
-+  }
-   *recompute = [this, host, recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
-     return reComputeHelper(std::string(host), recompute, 0);
-   };
--  return fragment;
-+  return std::make_unique<StringKeyFragment>(host);
- }
- 
- std::unique_ptr<ScopeKeyFragmentBase>
--HostValueExtractorImpl::computeFragment(const Http::HeaderMap& headers) const {
--  return std::make_unique<StringKeyFragment>(
--      static_cast<const Http::RequestHeaderMap&>(headers).getHostValue());
-+HostValueExtractorImpl::computeFragment(const Http::HeaderMap&) const {
-+  return nullptr;
- }
- 
- std::unique_ptr<ScopeKeyFragmentBase>

envoy/1.20/patches/envoy/20240111-fix-srds-compute.patch

@@ -1,65 +0,0 @@
-diff -Naur envoy/source/common/router/scoped_config_impl.cc envoy-new/source/common/router/scoped_config_impl.cc
---- envoy/source/common/router/scoped_config_impl.cc	2024-01-11 16:23:55.407881263 +0800
-+++ envoy-new/source/common/router/scoped_config_impl.cc	2024-01-11 16:23:42.311786814 +0800
-@@ -53,21 +53,26 @@
- }
- 
- std::unique_ptr<ScopeKeyFragmentBase>
--HostValueExtractorImpl::reComputeHelper(const std::string& host, ReComputeCbPtr& next_recompute,
-+HostValueExtractorImpl::reComputeHelper(const std::string& host,
-+                                        ReComputeCbWeakPtr& weak_next_recompute,
-                                         uint32_t recompute_seq) const {
-   if (recompute_seq == max_recompute_num_) {
-     ENVOY_LOG_MISC(warn,
-                    "recompute host fragment failed, maximum number of recalculations exceeded");
-     return nullptr;
-   }
-+  auto next_recompute = weak_next_recompute.lock();
-+  if (!next_recompute) {
-+    return nullptr;
-+  }
-   if (host == "*") {
-     *next_recompute = nullptr;
-     return nullptr;
-   }
-   auto masked_host = maskFirstDNSLabel(host);
-   *next_recompute = [this, masked_host, recompute_seq,
--                     next_recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
--    return reComputeHelper(masked_host, next_recompute, recompute_seq + 1);
-+                     weak_next_recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
-+    return reComputeHelper(masked_host, weak_next_recompute, recompute_seq + 1);
-   };
-   return std::make_unique<StringKeyFragment>(masked_host);
- }
-@@ -81,8 +86,9 @@
-   if (port_start != absl::string_view::npos) {
-     host = host.substr(0, port_start);
-   }
--  *recompute = [this, host, recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
--    return reComputeHelper(std::string(host), recompute, 0);
-+  *recompute = [this, host, weak_recompute = ReComputeCbWeakPtr(recompute)]() mutable
-+      -> std::unique_ptr<ScopeKeyFragmentBase> {
-+    return reComputeHelper(std::string(host), weak_recompute, 0);
-   };
-   return std::make_unique<StringKeyFragment>(host);
- }
-diff -Naur envoy/source/common/router/scoped_config_impl.h envoy-new/source/common/router/scoped_config_impl.h
---- envoy/source/common/router/scoped_config_impl.h	2024-01-11 16:23:55.407881263 +0800
-+++ envoy-new/source/common/router/scoped_config_impl.h	2024-01-11 16:23:42.311786814 +0800
-@@ -25,6 +25,7 @@
- #if defined(ALIMESH)
- using ReComputeCb = std::function<std::unique_ptr<ScopeKeyFragmentBase>()>;
- using ReComputeCbPtr = std::shared_ptr<ReComputeCb>;
-+using ReComputeCbWeakPtr = std::weak_ptr<ReComputeCb>;
- #endif
- 
- /**
-@@ -83,7 +84,7 @@
- 
- private:
-   std::unique_ptr<ScopeKeyFragmentBase> reComputeHelper(const std::string& host,
--                                                        ReComputeCbPtr& next_recompute,
-+                                                        ReComputeCbWeakPtr& weak_next_recompute,
-                                                         uint32_t recompute_seq) const;
- 
-   static constexpr uint32_t DefaultMaxRecomputeNum = 100;

envoy/1.20/patches/go-control-plane/20221129-fix-xds-version.patch

@@ -1,24 +0,0 @@
-diff -Naur go-control-plane/go.mod new/go.mod
---- go-control-plane/go.mod	2022-11-29 18:48:27.000000000 +0800
-+++ new/go.mod	2022-11-29 18:49:13.000000000 +0800
-@@ -4,7 +4,7 @@
- 
- require (
- 	github.com/census-instrumentation/opencensus-proto v0.2.1
--	github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158
-+	github.com/cncf/xds/go v0.0.0-20220520190051-1e77728a1eaa
- 	github.com/envoyproxy/protoc-gen-validate v0.1.0
- 	github.com/golang/protobuf v1.4.3
- 	github.com/google/go-cmp v0.5.0
-diff -Naur go-control-plane/go.sum new/go.sum
---- go-control-plane/go.sum	2022-11-29 18:48:27.000000000 +0800
-+++ new/go.sum	2022-11-29 18:49:13.000000000 +0800
-@@ -9,6 +9,8 @@
- github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
- github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158 h1:CevA8fI91PAnP8vpnXuB8ZYAZ5wqY86nAbxfgK8tWO4=
- github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-+github.com/cncf/xds/go v0.0.0-20220520190051-1e77728a1eaa h1:B/lvg4tQ5hfFZd4V2hcSfFVfUvAK6GSFKxIIzwnkv8g=
-+github.com/cncf/xds/go v0.0.0-20220520190051-1e77728a1eaa/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
- github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
- github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
- github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=

envoy/1.20/patches/go-control-plane/20240104-enhance-srds.patch

@@ -1,931 +0,0 @@
-diff -Naur go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.go go-control-plane-new/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.go
---- go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.go	2024-01-04 21:07:22.000000000 +0800
-+++ go-control-plane-new/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.go	2024-01-04 21:02:10.000000000 +0800
-@@ -2286,6 +2286,8 @@
- 
- 	// Types that are assignable to Type:
- 	//	*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_
-+	//	*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor_
-+	//	*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor_
- 	Type isScopedRoutes_ScopeKeyBuilder_FragmentBuilder_Type `protobuf_oneof:"type"`
- }
- 
-@@ -2335,6 +2337,20 @@
- 	return nil
- }
- 
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder) GetHostValueExtractor() *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor {
-+	if x, ok := x.GetType().(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor_); ok {
-+		return x.HostValueExtractor
-+	}
-+	return nil
-+}
-+
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder) GetLocalPortValueExtractor() *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor {
-+	if x, ok := x.GetType().(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor_); ok {
-+		return x.LocalPortValueExtractor
-+	}
-+	return nil
-+}
-+
- type isScopedRoutes_ScopeKeyBuilder_FragmentBuilder_Type interface {
- 	isScopedRoutes_ScopeKeyBuilder_FragmentBuilder_Type()
- }
-@@ -2344,9 +2360,23 @@
- 	HeaderValueExtractor *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor `protobuf:"bytes,1,opt,name=header_value_extractor,json=headerValueExtractor,proto3,oneof"`
- }
- 
-+type ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor_ struct {
-+	HostValueExtractor *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor `protobuf:"bytes,101,opt,name=host_value_extractor,json=hostValueExtractor,proto3,oneof"`
-+}
-+
-+type ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor_ struct {
-+	LocalPortValueExtractor *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor `protobuf:"bytes,102,opt,name=local_port_value_extractor,json=localPortValueExtractor,proto3,oneof"`
-+}
-+
- func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_) isScopedRoutes_ScopeKeyBuilder_FragmentBuilder_Type() {
- }
- 
-+func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor_) isScopedRoutes_ScopeKeyBuilder_FragmentBuilder_Type() {
-+}
-+
-+func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor_) isScopedRoutes_ScopeKeyBuilder_FragmentBuilder_Type() {
-+}
-+
- // Specifies how the value of a header should be extracted.
- // The following example maps the structure of a header to the fields in this message.
- //
-@@ -2475,6 +2505,92 @@
- func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_Element) isScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_ExtractType() {
- }
- 
-+type ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor struct {
-+	state         protoimpl.MessageState
-+	sizeCache     protoimpl.SizeCache
-+	unknownFields protoimpl.UnknownFields
-+
-+	// The maximum number of host superset recomputes. If not specified, defaults to 100.
-+	MaxRecomputeNum *wrappers.UInt32Value `protobuf:"bytes,1,opt,name=max_recompute_num,json=maxRecomputeNum,proto3" json:"max_recompute_num,omitempty"`
-+}
-+
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor) Reset() {
-+	*x = ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor{}
-+	if protoimpl.UnsafeEnabled {
-+		mi := &file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[18]
-+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-+		ms.StoreMessageInfo(mi)
-+	}
-+}
-+
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor) String() string {
-+	return protoimpl.X.MessageStringOf(x)
-+}
-+
-+func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor) ProtoMessage() {}
-+
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor) ProtoReflect() protoreflect.Message {
-+	mi := &file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[18]
-+	if protoimpl.UnsafeEnabled && x != nil {
-+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-+		if ms.LoadMessageInfo() == nil {
-+			ms.StoreMessageInfo(mi)
-+		}
-+		return ms
-+	}
-+	return mi.MessageOf(x)
-+}
-+
-+// Deprecated: Use ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor.ProtoReflect.Descriptor instead.
-+func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor) Descriptor() ([]byte, []int) {
-+	return file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_rawDescGZIP(), []int{5, 0, 0, 1}
-+}
-+
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor) GetMaxRecomputeNum() *wrappers.UInt32Value {
-+	if x != nil {
-+		return x.MaxRecomputeNum
-+	}
-+	return nil
-+}
-+
-+type ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor struct {
-+	state         protoimpl.MessageState
-+	sizeCache     protoimpl.SizeCache
-+	unknownFields protoimpl.UnknownFields
-+}
-+
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor) Reset() {
-+	*x = ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor{}
-+	if protoimpl.UnsafeEnabled {
-+		mi := &file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[19]
-+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-+		ms.StoreMessageInfo(mi)
-+	}
-+}
-+
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor) String() string {
-+	return protoimpl.X.MessageStringOf(x)
-+}
-+
-+func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor) ProtoMessage() {}
-+
-+func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor) ProtoReflect() protoreflect.Message {
-+	mi := &file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[19]
-+	if protoimpl.UnsafeEnabled && x != nil {
-+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-+		if ms.LoadMessageInfo() == nil {
-+			ms.StoreMessageInfo(mi)
-+		}
-+		return ms
-+	}
-+	return mi.MessageOf(x)
-+}
-+
-+// Deprecated: Use ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor.ProtoReflect.Descriptor instead.
-+func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor) Descriptor() ([]byte, []int) {
-+	return file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_rawDescGZIP(), []int{5, 0, 0, 2}
-+}
-+
- // Specifies a header field's key value pair to match on.
- type ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement struct {
- 	state         protoimpl.MessageState
-@@ -2494,7 +2610,7 @@
- func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement) Reset() {
- 	*x = ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement{}
- 	if protoimpl.UnsafeEnabled {
--		mi := &file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[18]
-+		mi := &file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[20]
- 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
- 		ms.StoreMessageInfo(mi)
- 	}
-@@ -2507,7 +2623,7 @@
- func (*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement) ProtoMessage() {}
- 
- func (x *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement) ProtoReflect() protoreflect.Message {
--	mi := &file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[18]
-+	mi := &file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[20]
- 	if protoimpl.UnsafeEnabled && x != nil {
- 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
- 		if ms.LoadMessageInfo() == nil {
-@@ -3079,7 +3195,7 @@
- 	0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61,
- 	0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52,
- 	0x6f, 0x75, 0x74, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f,
--	0x6e, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x22, 0xe9, 0x0e, 0x0a, 0x0c, 0x53, 0x63, 0x6f, 0x70, 0x65,
-+	0x6e, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x22, 0xe1, 0x14, 0x0a, 0x0c, 0x53, 0x63, 0x6f, 0x70, 0x65,
- 	0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x12, 0x1b, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
- 	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xfa, 0x42, 0x04, 0x72, 0x02, 0x10, 0x01, 0x52, 0x04,
- 	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x8f, 0x01, 0x0a, 0x11, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x5f, 0x6b,
-@@ -3114,7 +3230,7 @@
- 	0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
- 	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x33, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65,
- 	0x64, 0x52, 0x64, 0x73, 0x48, 0x00, 0x52, 0x09, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x64,
--	0x73, 0x1a, 0xd9, 0x09, 0x0a, 0x0f, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75,
-+	0x73, 0x1a, 0xd1, 0x0f, 0x0a, 0x0f, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75,
- 	0x69, 0x6c, 0x64, 0x65, 0x72, 0x12, 0x91, 0x01, 0x0a, 0x09, 0x66, 0x72, 0x61, 0x67, 0x6d, 0x65,
- 	0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x69, 0x2e, 0x65, 0x6e, 0x76, 0x6f,
- 	0x79, 0x2e, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x69, 0x6c,
-@@ -3124,7 +3240,7 @@
- 	0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69,
- 	0x6c, 0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42, 0x75, 0x69,
- 	0x6c, 0x64, 0x65, 0x72, 0x42, 0x08, 0xfa, 0x42, 0x05, 0x92, 0x01, 0x02, 0x08, 0x01, 0x52, 0x09,
--	0x66, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x1a, 0xd5, 0x07, 0x0a, 0x0f, 0x46, 0x72,
-+	0x66, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x1a, 0xcd, 0x0d, 0x0a, 0x0f, 0x46, 0x72,
- 	0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x12, 0xb6, 0x01,
- 	0x0a, 0x16, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x65,
- 	0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x7e,
-@@ -3137,131 +3253,178 @@
- 	0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72,
- 	0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x48, 0x00,
- 	0x52, 0x14, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74,
--	0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x1a, 0x8f, 0x05, 0x0a, 0x14, 0x48, 0x65, 0x61, 0x64, 0x65,
--	0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x12,
--	0x1b, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xfa,
--	0x42, 0x04, 0x72, 0x02, 0x10, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2b, 0x0a, 0x11,
--	0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x65, 0x70, 0x61, 0x72, 0x61, 0x74, 0x6f,
--	0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74,
--	0x53, 0x65, 0x70, 0x61, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x16, 0x0a, 0x05, 0x69, 0x6e, 0x64,
--	0x65, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x48, 0x00, 0x52, 0x05, 0x69, 0x6e, 0x64, 0x65,
--	0x78, 0x12, 0xa5, 0x01, 0x0a, 0x07, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x18, 0x04, 0x20,
--	0x01, 0x28, 0x0b, 0x32, 0x88, 0x01, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x65, 0x78, 0x74,
--	0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x2e,
-+	0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x12, 0xb0, 0x01, 0x0a, 0x14, 0x68, 0x6f, 0x73, 0x74, 0x5f,
-+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x65, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x18,
-+	0x65, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x7c, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x65, 0x78,
-+	0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73,
-+	0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f,
-+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72,
-+	0x2e, 0x76, 0x33, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73,
-+	0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72,
-+	0x2e, 0x46, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72,
-+	0x2e, 0x48, 0x6f, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63,
-+	0x74, 0x6f, 0x72, 0x48, 0x00, 0x52, 0x12, 0x68, 0x6f, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65,
-+	0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x12, 0xc1, 0x01, 0x0a, 0x1a, 0x6c, 0x6f,
-+	0x63, 0x61, 0x6c, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x65,
-+	0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x18, 0x66, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x81,
-+	0x01, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f,
-+	0x6e, 0x73, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f,
-+	0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
-+	0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x33, 0x2e, 0x53, 0x63,
-+	0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65,
-+	0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61, 0x67, 0x6d,
-+	0x65, 0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x4c, 0x6f, 0x63, 0x61, 0x6c,
-+	0x50, 0x6f, 0x72, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74,
-+	0x6f, 0x72, 0x48, 0x00, 0x52, 0x17, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x50, 0x6f, 0x72, 0x74, 0x56,
-+	0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x1a, 0x8f, 0x05,
-+	0x0a, 0x14, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74,
-+	0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x12, 0x1b, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
-+	0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xfa, 0x42, 0x04, 0x72, 0x02, 0x10, 0x01, 0x52, 0x04, 0x6e,
-+	0x61, 0x6d, 0x65, 0x12, 0x2b, 0x0a, 0x11, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x73,
-+	0x65, 0x70, 0x61, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10,
-+	0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x53, 0x65, 0x70, 0x61, 0x72, 0x61, 0x74, 0x6f, 0x72,
-+	0x12, 0x16, 0x0a, 0x05, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x48,
-+	0x00, 0x52, 0x05, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x12, 0xa5, 0x01, 0x0a, 0x07, 0x65, 0x6c, 0x65,
-+	0x6d, 0x65, 0x6e, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x88, 0x01, 0x2e, 0x65, 0x6e,
-+	0x76, 0x6f, 0x79, 0x2e, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66,
-+	0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68,
-+	0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d,
-+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x33, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64,
-+	0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42,
-+	0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42,
-+	0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56, 0x61, 0x6c,
-+	0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x4b, 0x76, 0x45, 0x6c,
-+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x48, 0x00, 0x52, 0x07, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-+	0x1a, 0xdb, 0x01, 0x0a, 0x09, 0x4b, 0x76, 0x45, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x25,
-+	0x0a, 0x09, 0x73, 0x65, 0x70, 0x61, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28,
-+	0x09, 0x42, 0x07, 0xfa, 0x42, 0x04, 0x72, 0x02, 0x10, 0x01, 0x52, 0x09, 0x73, 0x65, 0x70, 0x61,
-+	0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x19, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01,
-+	0x28, 0x09, 0x42, 0x07, 0xfa, 0x42, 0x04, 0x72, 0x02, 0x10, 0x01, 0x52, 0x03, 0x6b, 0x65, 0x79,
-+	0x3a, 0x8b, 0x01, 0x9a, 0xc5, 0x88, 0x1e, 0x85, 0x01, 0x0a, 0x82, 0x01, 0x65, 0x6e, 0x76, 0x6f,
-+	0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e,
- 	0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e,
- 	0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e,
--	0x76, 0x33, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e,
-+	0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e,
- 	0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e,
- 	0x46, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e,
- 	0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61,
--	0x63, 0x74, 0x6f, 0x72, 0x2e, 0x4b, 0x76, 0x45, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x48, 0x00,
--	0x52, 0x07, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x1a, 0xdb, 0x01, 0x0a, 0x09, 0x4b, 0x76,
--	0x45, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x25, 0x0a, 0x09, 0x73, 0x65, 0x70, 0x61, 0x72,
--	0x61, 0x74, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xfa, 0x42, 0x04, 0x72,
--	0x02, 0x10, 0x01, 0x52, 0x09, 0x73, 0x65, 0x70, 0x61, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x19,
--	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xfa, 0x42, 0x04,
--	0x72, 0x02, 0x10, 0x01, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x3a, 0x8b, 0x01, 0x9a, 0xc5, 0x88, 0x1e,
--	0x85, 0x01, 0x0a, 0x82, 0x01, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69,
-+	0x63, 0x74, 0x6f, 0x72, 0x2e, 0x4b, 0x76, 0x45, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x3a, 0x7f,
-+	0x9a, 0xc5, 0x88, 0x1e, 0x7a, 0x0a, 0x78, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e,
-+	0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f,
-+	0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
-+	0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63,
-+	0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65,
-+	0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61, 0x67, 0x6d,
-+	0x65, 0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65,
-+	0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x42,
-+	0x0e, 0x0a, 0x0c, 0x65, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x1a,
-+	0xdd, 0x01, 0x0a, 0x12, 0x48, 0x6f, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74,
-+	0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x12, 0x48, 0x0a, 0x11, 0x6d, 0x61, 0x78, 0x5f, 0x72, 0x65,
-+	0x63, 0x6f, 0x6d, 0x70, 0x75, 0x74, 0x65, 0x5f, 0x6e, 0x75, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28,
-+	0x0b, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-+	0x62, 0x75, 0x66, 0x2e, 0x55, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52,
-+	0x0f, 0x6d, 0x61, 0x78, 0x52, 0x65, 0x63, 0x6f, 0x6d, 0x70, 0x75, 0x74, 0x65, 0x4e, 0x75, 0x6d,
-+	0x3a, 0x7d, 0x9a, 0xc5, 0x88, 0x1e, 0x78, 0x0a, 0x76, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63,
-+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74,
-+	0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
-+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e,
-+	0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f,
-+	0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61,
-+	0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x48, 0x6f, 0x73,
-+	0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x1a,
-+	0x9e, 0x01, 0x0a, 0x17, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x50, 0x6f, 0x72, 0x74, 0x56, 0x61, 0x6c,
-+	0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x3a, 0x82, 0x01, 0x9a, 0xc5,
-+	0x88, 0x1e, 0x7d, 0x0a, 0x7b, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69,
- 	0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
- 	0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
- 	0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f, 0x70,
- 	0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65,
- 	0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e,
--	0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56,
--	0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x4b, 0x76,
--	0x45, 0x6c, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x3a, 0x7f, 0x9a, 0xc5, 0x88, 0x1e, 0x7a, 0x0a, 0x78,
--	0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c,
--	0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70,
--	0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61,
--	0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75,
--	0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c,
--	0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c,
--	0x64, 0x65, 0x72, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45,
--	0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72, 0x42, 0x0e, 0x0a, 0x0c, 0x65, 0x78, 0x74, 0x72,
--	0x61, 0x63, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x3a, 0x6a, 0x9a, 0xc5, 0x88, 0x1e, 0x65, 0x0a,
--	0x63, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69,
--	0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74,
--	0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e,
--	0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f,
--	0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69,
--	0x6c, 0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42, 0x75, 0x69,
--	0x6c, 0x64, 0x65, 0x72, 0x42, 0x0b, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x03, 0xf8, 0x42,
--	0x01, 0x3a, 0x5a, 0x9a, 0xc5, 0x88, 0x1e, 0x55, 0x0a, 0x53, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e,
--	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65,
--	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65,
--	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32,
--	0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63,
--	0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x3a, 0x4a, 0x9a,
--	0xc5, 0x88, 0x1e, 0x45, 0x0a, 0x43, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66,
--	0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
--	0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
--	0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f,
--	0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x42, 0x17, 0x0a, 0x10, 0x63, 0x6f, 0x6e,
--	0x66, 0x69, 0x67, 0x5f, 0x73, 0x70, 0x65, 0x63, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x03, 0xf8,
--	0x42, 0x01, 0x22, 0xf1, 0x01, 0x0a, 0x09, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x64, 0x73,
--	0x12, 0x65, 0x0a, 0x18, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x5f, 0x72, 0x64, 0x73, 0x5f, 0x63,
--	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01,
--	0x28, 0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69,
--	0x67, 0x2e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x33, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
--	0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x08, 0xfa, 0x42, 0x05, 0x8a, 0x01, 0x02, 0x10, 0x01,
--	0x52, 0x15, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x64, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69,
--	0x67, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x34, 0x0a, 0x16, 0x73, 0x72, 0x64, 0x73, 0x5f,
--	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x5f, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x6f,
--	0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x14, 0x73, 0x72, 0x64, 0x73, 0x52, 0x65, 0x73,
--	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x4c, 0x6f, 0x63, 0x61, 0x74, 0x6f, 0x72, 0x3a, 0x47, 0x9a,
--	0xc5, 0x88, 0x1e, 0x42, 0x0a, 0x40, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66,
--	0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
--	0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
--	0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f,
--	0x70, 0x65, 0x64, 0x52, 0x64, 0x73, 0x22, 0xcc, 0x02, 0x0a, 0x0a, 0x48, 0x74, 0x74, 0x70, 0x46,
--	0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x1b, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
--	0x01, 0x28, 0x09, 0x42, 0x07, 0xfa, 0x42, 0x04, 0x72, 0x02, 0x10, 0x01, 0x52, 0x04, 0x6e, 0x61,
--	0x6d, 0x65, 0x12, 0x39, 0x0a, 0x0c, 0x74, 0x79, 0x70, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x66,
--	0x69, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
--	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x48, 0x00,
--	0x52, 0x0b, 0x74, 0x79, 0x70, 0x65, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x58, 0x0a,
--	0x10, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72,
--	0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e,
--	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x76, 0x33, 0x2e, 0x45,
--	0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x6f,
--	0x75, 0x72, 0x63, 0x65, 0x48, 0x00, 0x52, 0x0f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x44, 0x69,
--	0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x69, 0x73, 0x5f, 0x6f, 0x70,
--	0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x69, 0x73,
--	0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x3a, 0x48, 0x9a, 0xc5, 0x88, 0x1e, 0x43, 0x0a,
--	0x41, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69,
--	0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74,
--	0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e,
--	0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x48, 0x74, 0x74, 0x70, 0x46, 0x69, 0x6c, 0x74,
--	0x65, 0x72, 0x42, 0x0d, 0x0a, 0x0b, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x74, 0x79, 0x70,
--	0x65, 0x4a, 0x04, 0x08, 0x03, 0x10, 0x04, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x52, 0x06, 0x63,
--	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x9f, 0x01, 0x0a, 0x12, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
--	0x74, 0x49, 0x44, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x37, 0x0a, 0x0c,
--	0x74, 0x79, 0x70, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01,
--	0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
--	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x0b, 0x74, 0x79, 0x70, 0x65, 0x64, 0x43,
--	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x3a, 0x50, 0x9a, 0xc5, 0x88, 0x1e, 0x4b, 0x0a, 0x49, 0x65, 0x6e,
-+	0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x50, 0x6f,
-+	0x72, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x45, 0x78, 0x74, 0x72, 0x61, 0x63, 0x74, 0x6f, 0x72,
-+	0x3a, 0x6a, 0x9a, 0xc5, 0x88, 0x1e, 0x65, 0x0a, 0x63, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63,
-+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74,
-+	0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
-+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e,
-+	0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f,
-+	0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x2e, 0x46, 0x72, 0x61,
-+	0x67, 0x6d, 0x65, 0x6e, 0x74, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x65, 0x72, 0x42, 0x0b, 0x0a, 0x04,
-+	0x74, 0x79, 0x70, 0x65, 0x12, 0x03, 0xf8, 0x42, 0x01, 0x3a, 0x5a, 0x9a, 0xc5, 0x88, 0x1e, 0x55,
-+	0x0a, 0x53, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66,
-+	0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74,
-+	0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61,
-+	0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52,
-+	0x6f, 0x75, 0x74, 0x65, 0x73, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4b, 0x65, 0x79, 0x42, 0x75,
-+	0x69, 0x6c, 0x64, 0x65, 0x72, 0x3a, 0x4a, 0x9a, 0xc5, 0x88, 0x1e, 0x45, 0x0a, 0x43, 0x65, 0x6e,
- 	0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65,
- 	0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63,
- 	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
--	0x72, 0x2e, 0x76, 0x32, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x49, 0x44, 0x45, 0x78,
--	0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x8e, 0x01, 0x0a, 0x20, 0x45, 0x6e, 0x76, 0x6f,
--	0x79, 0x4d, 0x6f, 0x62, 0x69, 0x6c, 0x65, 0x48, 0x74, 0x74, 0x70, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
--	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x12, 0x6a, 0x0a, 0x06,
--	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x52, 0x2e, 0x65,
--	0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e,
--	0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e,
--	0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
--	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x33, 0x2e, 0x48, 0x74, 0x74, 0x70, 0x43,
--	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72,
--	0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x42, 0x71, 0x0a, 0x49, 0x69, 0x6f, 0x2e, 0x65,
--	0x6e, 0x76, 0x6f, 0x79, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e,
--	0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65,
--	0x72, 0x73, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f,
--	0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67,
--	0x65, 0x72, 0x2e, 0x76, 0x33, 0x42, 0x1a, 0x48, 0x74, 0x74, 0x70, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
--	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x50, 0x72, 0x6f, 0x74,
--	0x6f, 0x50, 0x01, 0xba, 0x80, 0xc8, 0xd1, 0x06, 0x02, 0x10, 0x02, 0x62, 0x06, 0x70, 0x72, 0x6f,
--	0x74, 0x6f, 0x33,
-+	0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x6f, 0x75, 0x74, 0x65,
-+	0x73, 0x42, 0x17, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x73, 0x70, 0x65, 0x63,
-+	0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x03, 0xf8, 0x42, 0x01, 0x22, 0xf1, 0x01, 0x0a, 0x09, 0x53,
-+	0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x64, 0x73, 0x12, 0x65, 0x0a, 0x18, 0x73, 0x63, 0x6f, 0x70,
-+	0x65, 0x64, 0x5f, 0x72, 0x64, 0x73, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x73, 0x6f,
-+	0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x76,
-+	0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x76,
-+	0x33, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x08,
-+	0xfa, 0x42, 0x05, 0x8a, 0x01, 0x02, 0x10, 0x01, 0x52, 0x15, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x64,
-+	0x52, 0x64, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12,
-+	0x34, 0x0a, 0x16, 0x73, 0x72, 0x64, 0x73, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-+	0x73, 0x5f, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-+	0x14, 0x73, 0x72, 0x64, 0x73, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x4c, 0x6f,
-+	0x63, 0x61, 0x74, 0x6f, 0x72, 0x3a, 0x47, 0x9a, 0xc5, 0x88, 0x1e, 0x42, 0x0a, 0x40, 0x65, 0x6e,
-+	0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65,
-+	0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63,
-+	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-+	0x72, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x64, 0x52, 0x64, 0x73, 0x22, 0xcc,
-+	0x02, 0x0a, 0x0a, 0x48, 0x74, 0x74, 0x70, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x1b, 0x0a,
-+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x07, 0xfa, 0x42, 0x04,
-+	0x72, 0x02, 0x10, 0x01, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x39, 0x0a, 0x0c, 0x74, 0x79,
-+	0x70, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b,
-+	0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-+	0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x48, 0x00, 0x52, 0x0b, 0x74, 0x79, 0x70, 0x65, 0x64, 0x43,
-+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x58, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f,
-+	0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32,
-+	0x2b, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x63,
-+	0x6f, 0x72, 0x65, 0x2e, 0x76, 0x33, 0x2e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e,
-+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x48, 0x00, 0x52, 0x0f,
-+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x12,
-+	0x1f, 0x0a, 0x0b, 0x69, 0x73, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18, 0x06,
-+	0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x69, 0x73, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c,
-+	0x3a, 0x48, 0x9a, 0xc5, 0x88, 0x1e, 0x43, 0x0a, 0x41, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63,
-+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74,
-+	0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
-+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e,
-+	0x48, 0x74, 0x74, 0x70, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x42, 0x0d, 0x0a, 0x0b, 0x63, 0x6f,
-+	0x6e, 0x66, 0x69, 0x67, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x4a, 0x04, 0x08, 0x03, 0x10, 0x04, 0x4a,
-+	0x04, 0x08, 0x02, 0x10, 0x03, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x9f, 0x01,
-+	0x0a, 0x12, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x49, 0x44, 0x45, 0x78, 0x74, 0x65, 0x6e,
-+	0x73, 0x69, 0x6f, 0x6e, 0x12, 0x37, 0x0a, 0x0c, 0x74, 0x79, 0x70, 0x65, 0x64, 0x5f, 0x63, 0x6f,
-+	0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f,
-+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79,
-+	0x52, 0x0b, 0x74, 0x79, 0x70, 0x65, 0x64, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x3a, 0x50, 0x9a,
-+	0xc5, 0x88, 0x1e, 0x4b, 0x0a, 0x49, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66,
-+	0x69, 0x67, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
-+	0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
-+	0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x2e, 0x52, 0x65, 0x71,
-+	0x75, 0x65, 0x73, 0x74, 0x49, 0x44, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x22,
-+	0x8e, 0x01, 0x0a, 0x20, 0x45, 0x6e, 0x76, 0x6f, 0x79, 0x4d, 0x6f, 0x62, 0x69, 0x6c, 0x65, 0x48,
-+	0x74, 0x74, 0x70, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x6e,
-+	0x61, 0x67, 0x65, 0x72, 0x12, 0x6a, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01,
-+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x52, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x65, 0x78, 0x74,
-+	0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x2e,
-+	0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e,
-+	0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e,
-+	0x76, 0x33, 0x2e, 0x48, 0x74, 0x74, 0x70, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
-+	0x6e, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-+	0x42, 0x71, 0x0a, 0x49, 0x69, 0x6f, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x70, 0x72, 0x6f, 0x78,
-+	0x79, 0x2e, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x2e, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f,
-+	0x6e, 0x73, 0x2e, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f,
-+	0x72, 0x6b, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
-+	0x6f, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2e, 0x76, 0x33, 0x42, 0x1a, 0x48,
-+	0x74, 0x74, 0x70, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x61, 0x6e,
-+	0x61, 0x67, 0x65, 0x72, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0xba, 0x80, 0xc8, 0xd1, 0x06,
-+	0x02, 0x10, 0x02, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
- }
- 
- var (
-@@ -3277,7 +3440,7 @@
- }
- 
- var file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_enumTypes = make([]protoimpl.EnumInfo, 5)
--var file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes = make([]protoimpl.MessageInfo, 19)
-+var file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes = make([]protoimpl.MessageInfo, 21)
- var file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_goTypes = []interface{}{
- 	(HttpConnectionManager_CodecType)(0),                                                // 0: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.CodecType
- 	(HttpConnectionManager_ServerHeaderTransformation)(0),                               // 1: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ServerHeaderTransformation
-@@ -3302,102 +3465,107 @@
- 	(*ScopedRoutes_ScopeKeyBuilder)(nil),                                                // 20: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder
- 	(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder)(nil),                                // 21: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder
- 	(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor)(nil),           // 22: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor
--	(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement)(nil), // 23: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.KvElement
--	(*v32.RouteConfiguration)(nil),                                                      // 24: envoy.config.route.v3.RouteConfiguration
--	(*wrappers.BoolValue)(nil),                                                          // 25: google.protobuf.BoolValue
--	(*v3.HttpProtocolOptions)(nil),                                                      // 26: envoy.config.core.v3.HttpProtocolOptions
--	(*v3.Http1ProtocolOptions)(nil),                                                     // 27: envoy.config.core.v3.Http1ProtocolOptions
--	(*v3.Http2ProtocolOptions)(nil),                                                     // 28: envoy.config.core.v3.Http2ProtocolOptions
--	(*v3.Http3ProtocolOptions)(nil),                                                     // 29: envoy.config.core.v3.Http3ProtocolOptions
--	(*v3.SchemeHeaderTransformation)(nil),                                               // 30: envoy.config.core.v3.SchemeHeaderTransformation
--	(*wrappers.UInt32Value)(nil),                                                        // 31: google.protobuf.UInt32Value
--	(*duration.Duration)(nil),                                                           // 32: google.protobuf.Duration
--	(*v31.AccessLog)(nil),                                                               // 33: envoy.config.accesslog.v3.AccessLog
--	(*v3.TypedExtensionConfig)(nil),                                                     // 34: envoy.config.core.v3.TypedExtensionConfig
--	(*v3.SubstitutionFormatString)(nil),                                                 // 35: envoy.config.core.v3.SubstitutionFormatString
--	(*v31.AccessLogFilter)(nil),                                                         // 36: envoy.config.accesslog.v3.AccessLogFilter
--	(*v3.DataSource)(nil),                                                               // 37: envoy.config.core.v3.DataSource
--	(*v3.HeaderValueOption)(nil),                                                        // 38: envoy.config.core.v3.HeaderValueOption
--	(*v3.ConfigSource)(nil),                                                             // 39: envoy.config.core.v3.ConfigSource
--	(*v32.ScopedRouteConfiguration)(nil),                                                // 40: envoy.config.route.v3.ScopedRouteConfiguration
--	(*any.Any)(nil),                                                                     // 41: google.protobuf.Any
--	(*v3.ExtensionConfigSource)(nil),                                                    // 42: envoy.config.core.v3.ExtensionConfigSource
--	(*v33.Percent)(nil),                                                                 // 43: envoy.type.v3.Percent
--	(*v34.CustomTag)(nil),                                                               // 44: envoy.type.tracing.v3.CustomTag
--	(*v35.Tracing_Http)(nil),                                                            // 45: envoy.config.trace.v3.Tracing.Http
--	(*v36.PathTransformation)(nil),                                                      // 46: envoy.type.http.v3.PathTransformation
-+	(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor)(nil),             // 23: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HostValueExtractor
-+	(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor)(nil),        // 24: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.LocalPortValueExtractor
-+	(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement)(nil), // 25: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.KvElement
-+	(*v32.RouteConfiguration)(nil),                                                      // 26: envoy.config.route.v3.RouteConfiguration
-+	(*wrappers.BoolValue)(nil),                                                          // 27: google.protobuf.BoolValue
-+	(*v3.HttpProtocolOptions)(nil),                                                      // 28: envoy.config.core.v3.HttpProtocolOptions
-+	(*v3.Http1ProtocolOptions)(nil),                                                     // 29: envoy.config.core.v3.Http1ProtocolOptions
-+	(*v3.Http2ProtocolOptions)(nil),                                                     // 30: envoy.config.core.v3.Http2ProtocolOptions
-+	(*v3.Http3ProtocolOptions)(nil),                                                     // 31: envoy.config.core.v3.Http3ProtocolOptions
-+	(*v3.SchemeHeaderTransformation)(nil),                                               // 32: envoy.config.core.v3.SchemeHeaderTransformation
-+	(*wrappers.UInt32Value)(nil),                                                        // 33: google.protobuf.UInt32Value
-+	(*duration.Duration)(nil),                                                           // 34: google.protobuf.Duration
-+	(*v31.AccessLog)(nil),                                                               // 35: envoy.config.accesslog.v3.AccessLog
-+	(*v3.TypedExtensionConfig)(nil),                                                     // 36: envoy.config.core.v3.TypedExtensionConfig
-+	(*v3.SubstitutionFormatString)(nil),                                                 // 37: envoy.config.core.v3.SubstitutionFormatString
-+	(*v31.AccessLogFilter)(nil),                                                         // 38: envoy.config.accesslog.v3.AccessLogFilter
-+	(*v3.DataSource)(nil),                                                               // 39: envoy.config.core.v3.DataSource
-+	(*v3.HeaderValueOption)(nil),                                                        // 40: envoy.config.core.v3.HeaderValueOption
-+	(*v3.ConfigSource)(nil),                                                             // 41: envoy.config.core.v3.ConfigSource
-+	(*v32.ScopedRouteConfiguration)(nil),                                                // 42: envoy.config.route.v3.ScopedRouteConfiguration
-+	(*any.Any)(nil),                                                                     // 43: google.protobuf.Any
-+	(*v3.ExtensionConfigSource)(nil),                                                    // 44: envoy.config.core.v3.ExtensionConfigSource
-+	(*v33.Percent)(nil),                                                                 // 45: envoy.type.v3.Percent
-+	(*v34.CustomTag)(nil),                                                               // 46: envoy.type.tracing.v3.CustomTag
-+	(*v35.Tracing_Http)(nil),                                                            // 47: envoy.config.trace.v3.Tracing.Http
-+	(*v36.PathTransformation)(nil),                                                      // 48: envoy.type.http.v3.PathTransformation
- }
- var file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_depIdxs = []int32{
- 	0,  // 0: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.codec_type:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.CodecType
- 	8,  // 1: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.rds:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.Rds
--	24, // 2: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.route_config:type_name -> envoy.config.route.v3.RouteConfiguration
-+	26, // 2: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.route_config:type_name -> envoy.config.route.v3.RouteConfiguration
- 	10, // 3: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.scoped_routes:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes
- 	12, // 4: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.http_filters:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter
--	25, // 5: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.add_user_agent:type_name -> google.protobuf.BoolValue
-+	27, // 5: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.add_user_agent:type_name -> google.protobuf.BoolValue
- 	15, // 6: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.tracing:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing
--	26, // 7: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.common_http_protocol_options:type_name -> envoy.config.core.v3.HttpProtocolOptions
--	27, // 8: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.http_protocol_options:type_name -> envoy.config.core.v3.Http1ProtocolOptions
--	28, // 9: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.http2_protocol_options:type_name -> envoy.config.core.v3.Http2ProtocolOptions
--	29, // 10: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.http3_protocol_options:type_name -> envoy.config.core.v3.Http3ProtocolOptions
-+	28, // 7: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.common_http_protocol_options:type_name -> envoy.config.core.v3.HttpProtocolOptions
-+	29, // 8: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.http_protocol_options:type_name -> envoy.config.core.v3.Http1ProtocolOptions
-+	30, // 9: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.http2_protocol_options:type_name -> envoy.config.core.v3.Http2ProtocolOptions
-+	31, // 10: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.http3_protocol_options:type_name -> envoy.config.core.v3.Http3ProtocolOptions
- 	1,  // 11: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.server_header_transformation:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ServerHeaderTransformation
--	30, // 12: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.scheme_header_transformation:type_name -> envoy.config.core.v3.SchemeHeaderTransformation
--	31, // 13: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.max_request_headers_kb:type_name -> google.protobuf.UInt32Value
--	32, // 14: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.stream_idle_timeout:type_name -> google.protobuf.Duration
--	32, // 15: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.request_timeout:type_name -> google.protobuf.Duration
--	32, // 16: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.request_headers_timeout:type_name -> google.protobuf.Duration
--	32, // 17: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.drain_timeout:type_name -> google.protobuf.Duration
--	32, // 18: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.delayed_close_timeout:type_name -> google.protobuf.Duration
--	33, // 19: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.access_log:type_name -> envoy.config.accesslog.v3.AccessLog
--	25, // 20: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.use_remote_address:type_name -> google.protobuf.BoolValue
--	34, // 21: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.original_ip_detection_extensions:type_name -> envoy.config.core.v3.TypedExtensionConfig
-+	32, // 12: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.scheme_header_transformation:type_name -> envoy.config.core.v3.SchemeHeaderTransformation
-+	33, // 13: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.max_request_headers_kb:type_name -> google.protobuf.UInt32Value
-+	34, // 14: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.stream_idle_timeout:type_name -> google.protobuf.Duration
-+	34, // 15: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.request_timeout:type_name -> google.protobuf.Duration
-+	34, // 16: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.request_headers_timeout:type_name -> google.protobuf.Duration
-+	34, // 17: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.drain_timeout:type_name -> google.protobuf.Duration
-+	34, // 18: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.delayed_close_timeout:type_name -> google.protobuf.Duration
-+	35, // 19: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.access_log:type_name -> envoy.config.accesslog.v3.AccessLog
-+	27, // 20: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.use_remote_address:type_name -> google.protobuf.BoolValue
-+	36, // 21: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.original_ip_detection_extensions:type_name -> envoy.config.core.v3.TypedExtensionConfig
- 	16, // 22: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.internal_address_config:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.InternalAddressConfig
--	25, // 23: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.generate_request_id:type_name -> google.protobuf.BoolValue
-+	27, // 23: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.generate_request_id:type_name -> google.protobuf.BoolValue
- 	2,  // 24: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.forward_client_cert_details:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertDetails
- 	17, // 25: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.set_current_client_cert_details:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.SetCurrentClientCertDetails
- 	18, // 26: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.upgrade_configs:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.UpgradeConfig
--	25, // 27: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.normalize_path:type_name -> google.protobuf.BoolValue
-+	27, // 27: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.normalize_path:type_name -> google.protobuf.BoolValue
- 	3,  // 28: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.path_with_escaped_slashes_action:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathWithEscapedSlashesAction
- 	13, // 29: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.request_id_extension:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.RequestIDExtension
- 	6,  // 30: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.local_reply_config:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.LocalReplyConfig
--	25, // 31: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.stream_error_on_invalid_http_message:type_name -> google.protobuf.BoolValue
-+	27, // 31: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.stream_error_on_invalid_http_message:type_name -> google.protobuf.BoolValue
- 	19, // 32: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.path_normalization_options:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathNormalizationOptions
- 	7,  // 33: envoy.extensions.filters.network.http_connection_manager.v3.LocalReplyConfig.mappers:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper
--	35, // 34: envoy.extensions.filters.network.http_connection_manager.v3.LocalReplyConfig.body_format:type_name -> envoy.config.core.v3.SubstitutionFormatString
--	36, // 35: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.filter:type_name -> envoy.config.accesslog.v3.AccessLogFilter
--	31, // 36: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.status_code:type_name -> google.protobuf.UInt32Value
--	37, // 37: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.body:type_name -> envoy.config.core.v3.DataSource
--	35, // 38: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.body_format_override:type_name -> envoy.config.core.v3.SubstitutionFormatString
--	38, // 39: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.headers_to_add:type_name -> envoy.config.core.v3.HeaderValueOption
--	39, // 40: envoy.extensions.filters.network.http_connection_manager.v3.Rds.config_source:type_name -> envoy.config.core.v3.ConfigSource
--	40, // 41: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRouteConfigurationsList.scoped_route_configurations:type_name -> envoy.config.route.v3.ScopedRouteConfiguration
-+	37, // 34: envoy.extensions.filters.network.http_connection_manager.v3.LocalReplyConfig.body_format:type_name -> envoy.config.core.v3.SubstitutionFormatString
-+	38, // 35: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.filter:type_name -> envoy.config.accesslog.v3.AccessLogFilter
-+	33, // 36: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.status_code:type_name -> google.protobuf.UInt32Value
-+	39, // 37: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.body:type_name -> envoy.config.core.v3.DataSource
-+	37, // 38: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.body_format_override:type_name -> envoy.config.core.v3.SubstitutionFormatString
-+	40, // 39: envoy.extensions.filters.network.http_connection_manager.v3.ResponseMapper.headers_to_add:type_name -> envoy.config.core.v3.HeaderValueOption
-+	41, // 40: envoy.extensions.filters.network.http_connection_manager.v3.Rds.config_source:type_name -> envoy.config.core.v3.ConfigSource
-+	42, // 41: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRouteConfigurationsList.scoped_route_configurations:type_name -> envoy.config.route.v3.ScopedRouteConfiguration
- 	20, // 42: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.scope_key_builder:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder
--	39, // 43: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.rds_config_source:type_name -> envoy.config.core.v3.ConfigSource
-+	41, // 43: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.rds_config_source:type_name -> envoy.config.core.v3.ConfigSource
- 	9,  // 44: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.scoped_route_configurations_list:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRouteConfigurationsList
- 	11, // 45: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.scoped_rds:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRds
--	39, // 46: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRds.scoped_rds_config_source:type_name -> envoy.config.core.v3.ConfigSource
--	41, // 47: envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter.typed_config:type_name -> google.protobuf.Any
--	42, // 48: envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter.config_discovery:type_name -> envoy.config.core.v3.ExtensionConfigSource
--	41, // 49: envoy.extensions.filters.network.http_connection_manager.v3.RequestIDExtension.typed_config:type_name -> google.protobuf.Any
-+	41, // 46: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRds.scoped_rds_config_source:type_name -> envoy.config.core.v3.ConfigSource
-+	43, // 47: envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter.typed_config:type_name -> google.protobuf.Any
-+	44, // 48: envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter.config_discovery:type_name -> envoy.config.core.v3.ExtensionConfigSource
-+	43, // 49: envoy.extensions.filters.network.http_connection_manager.v3.RequestIDExtension.typed_config:type_name -> google.protobuf.Any
- 	5,  // 50: envoy.extensions.filters.network.http_connection_manager.v3.EnvoyMobileHttpConnectionManager.config:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
--	43, // 51: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.client_sampling:type_name -> envoy.type.v3.Percent
--	43, // 52: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.random_sampling:type_name -> envoy.type.v3.Percent
--	43, // 53: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.overall_sampling:type_name -> envoy.type.v3.Percent
--	31, // 54: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.max_path_tag_length:type_name -> google.protobuf.UInt32Value
--	44, // 55: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.custom_tags:type_name -> envoy.type.tracing.v3.CustomTag
--	45, // 56: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.provider:type_name -> envoy.config.trace.v3.Tracing.Http
--	25, // 57: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.SetCurrentClientCertDetails.subject:type_name -> google.protobuf.BoolValue
-+	45, // 51: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.client_sampling:type_name -> envoy.type.v3.Percent
-+	45, // 52: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.random_sampling:type_name -> envoy.type.v3.Percent
-+	45, // 53: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.overall_sampling:type_name -> envoy.type.v3.Percent
-+	33, // 54: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.max_path_tag_length:type_name -> google.protobuf.UInt32Value
-+	46, // 55: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.custom_tags:type_name -> envoy.type.tracing.v3.CustomTag
-+	47, // 56: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.provider:type_name -> envoy.config.trace.v3.Tracing.Http
-+	27, // 57: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.SetCurrentClientCertDetails.subject:type_name -> google.protobuf.BoolValue
- 	12, // 58: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.UpgradeConfig.filters:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.HttpFilter
--	25, // 59: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.UpgradeConfig.enabled:type_name -> google.protobuf.BoolValue
--	46, // 60: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathNormalizationOptions.forwarding_transformation:type_name -> envoy.type.http.v3.PathTransformation
--	46, // 61: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathNormalizationOptions.http_filter_transformation:type_name -> envoy.type.http.v3.PathTransformation
-+	27, // 59: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.UpgradeConfig.enabled:type_name -> google.protobuf.BoolValue
-+	48, // 60: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathNormalizationOptions.forwarding_transformation:type_name -> envoy.type.http.v3.PathTransformation
-+	48, // 61: envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathNormalizationOptions.http_filter_transformation:type_name -> envoy.type.http.v3.PathTransformation
- 	21, // 62: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.fragments:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder
- 	22, // 63: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.header_value_extractor:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor
--	23, // 64: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.element:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.KvElement
--	65, // [65:65] is the sub-list for method output_type
--	65, // [65:65] is the sub-list for method input_type
--	65, // [65:65] is the sub-list for extension type_name
--	65, // [65:65] is the sub-list for extension extendee
--	0,  // [0:65] is the sub-list for field type_name
-+	23, // 64: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.host_value_extractor:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HostValueExtractor
-+	24, // 65: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.local_port_value_extractor:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.LocalPortValueExtractor
-+	25, // 66: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.element:type_name -> envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.KvElement
-+	33, // 67: envoy.extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HostValueExtractor.max_recompute_num:type_name -> google.protobuf.UInt32Value
-+	68, // [68:68] is the sub-list for method output_type
-+	68, // [68:68] is the sub-list for method input_type
-+	68, // [68:68] is the sub-list for extension type_name
-+	68, // [68:68] is the sub-list for extension extendee
-+	0,  // [0:68] is the sub-list for field type_name
- }
- 
- func init() {
-@@ -3625,6 +3793,30 @@
- 			}
- 		}
- 		file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-+			switch v := v.(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor); i {
-+			case 0:
-+				return &v.state
-+			case 1:
-+				return &v.sizeCache
-+			case 2:
-+				return &v.unknownFields
-+			default:
-+				return nil
-+			}
-+		}
-+		file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
-+			switch v := v.(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor); i {
-+			case 0:
-+				return &v.state
-+			case 1:
-+				return &v.sizeCache
-+			case 2:
-+				return &v.unknownFields
-+			default:
-+				return nil
-+			}
-+		}
-+		file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
- 			switch v := v.(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement); i {
- 			case 0:
- 				return &v.state
-@@ -3653,6 +3845,8 @@
- 	}
- 	file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[16].OneofWrappers = []interface{}{
- 		(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_)(nil),
-+		(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor_)(nil),
-+		(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor_)(nil),
- 	}
- 	file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_msgTypes[17].OneofWrappers = []interface{}{
- 		(*ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_Index)(nil),
-@@ -3664,7 +3858,7 @@
- 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
- 			RawDescriptor: file_envoy_extensions_filters_network_http_connection_manager_v3_http_connection_manager_proto_rawDesc,
- 			NumEnums:      5,
--			NumMessages:   19,
-+			NumMessages:   21,
- 			NumExtensions: 0,
- 			NumServices:   0,
- 		},
-diff -Naur go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.validate.go go-control-plane-new/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.validate.go
---- go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.validate.go	2024-01-04 21:07:22.000000000 +0800
-+++ go-control-plane-new/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.validate.go	2024-01-04 21:02:10.000000000 +0800
-@@ -1986,6 +1986,30 @@
- 			}
- 		}
- 
-+	case *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor_:
-+
-+		if v, ok := interface{}(m.GetHostValueExtractor()).(interface{ Validate() error }); ok {
-+			if err := v.Validate(); err != nil {
-+				return ScopedRoutes_ScopeKeyBuilder_FragmentBuilderValidationError{
-+					field:  "HostValueExtractor",
-+					reason: "embedded message failed validation",
-+					cause:  err,
-+				}
-+			}
-+		}
-+
-+	case *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor_:
-+
-+		if v, ok := interface{}(m.GetLocalPortValueExtractor()).(interface{ Validate() error }); ok {
-+			if err := v.Validate(); err != nil {
-+				return ScopedRoutes_ScopeKeyBuilder_FragmentBuilderValidationError{
-+					field:  "LocalPortValueExtractor",
-+					reason: "embedded message failed validation",
-+					cause:  err,
-+				}
-+			}
-+		}
-+
- 	default:
- 		return ScopedRoutes_ScopeKeyBuilder_FragmentBuilderValidationError{
- 			field:  "Type",
-@@ -2162,6 +2186,172 @@
- } = ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractorValidationError{}
- 
- // Validate checks the field values on
-+// ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor with the
-+// rules defined in the proto definition for this message. If any rules are
-+// violated, an error is returned.
-+func (m *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor) Validate() error {
-+	if m == nil {
-+		return nil
-+	}
-+
-+	if v, ok := interface{}(m.GetMaxRecomputeNum()).(interface{ Validate() error }); ok {
-+		if err := v.Validate(); err != nil {
-+			return ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError{
-+				field:  "MaxRecomputeNum",
-+				reason: "embedded message failed validation",
-+				cause:  err,
-+			}
-+		}
-+	}
-+
-+	return nil
-+}
-+
-+// ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError
-+// is the validation error returned by
-+// ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor.Validate if
-+// the designated constraints aren't met.
-+type ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError struct {
-+	field  string
-+	reason string
-+	cause  error
-+	key    bool
-+}
-+
-+// Field function returns field value.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError) Field() string {
-+	return e.field
-+}
-+
-+// Reason function returns reason value.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError) Reason() string {
-+	return e.reason
-+}
-+
-+// Cause function returns cause value.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError) Cause() error {
-+	return e.cause
-+}
-+
-+// Key function returns key value.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError) Key() bool {
-+	return e.key
-+}
-+
-+// ErrorName returns error name.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError) ErrorName() string {
-+	return "ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError"
-+}
-+
-+// Error satisfies the builtin error interface
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError) Error() string {
-+	cause := ""
-+	if e.cause != nil {
-+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
-+	}
-+
-+	key := ""
-+	if e.key {
-+		key = "key for "
-+	}
-+
-+	return fmt.Sprintf(
-+		"invalid %sScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractor.%s: %s%s",
-+		key,
-+		e.field,
-+		e.reason,
-+		cause)
-+}
-+
-+var _ error = ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError{}
-+
-+var _ interface {
-+	Field() string
-+	Reason() string
-+	Key() bool
-+	Cause() error
-+	ErrorName() string
-+} = ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HostValueExtractorValidationError{}
-+
-+// Validate checks the field values on
-+// ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor with
-+// the rules defined in the proto definition for this message. If any rules
-+// are violated, an error is returned.
-+func (m *ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor) Validate() error {
-+	if m == nil {
-+		return nil
-+	}
-+
-+	return nil
-+}
-+
-+// ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError
-+// is the validation error returned by
-+// ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor.Validate
-+// if the designated constraints aren't met.
-+type ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError struct {
-+	field  string
-+	reason string
-+	cause  error
-+	key    bool
-+}
-+
-+// Field function returns field value.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError) Field() string {
-+	return e.field
-+}
-+
-+// Reason function returns reason value.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError) Reason() string {
-+	return e.reason
-+}
-+
-+// Cause function returns cause value.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError) Cause() error {
-+	return e.cause
-+}
-+
-+// Key function returns key value.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError) Key() bool {
-+	return e.key
-+}
-+
-+// ErrorName returns error name.
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError) ErrorName() string {
-+	return "ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError"
-+}
-+
-+// Error satisfies the builtin error interface
-+func (e ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError) Error() string {
-+	cause := ""
-+	if e.cause != nil {
-+		cause = fmt.Sprintf(" | caused by: %v", e.cause)
-+	}
-+
-+	key := ""
-+	if e.key {
-+		key = "key for "
-+	}
-+
-+	return fmt.Sprintf(
-+		"invalid %sScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractor.%s: %s%s",
-+		key,
-+		e.field,
-+		e.reason,
-+		cause)
-+}
-+
-+var _ error = ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError{}
-+
-+var _ interface {
-+	Field() string
-+	Reason() string
-+	Key() bool
-+	Cause() error
-+	ErrorName() string
-+} = ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_LocalPortValueExtractorValidationError{}
-+
-+// Validate checks the field values on
- // ScopedRoutes_ScopeKeyBuilder_FragmentBuilder_HeaderValueExtractor_KvElement
- // with the rules defined in the proto definition for this message. If any
- // rules are violated, an error is returned.

get_helm.sh

@@ -0,0 +1,341 @@
+#!/usr/bin/env bash
+
+# Copyright The Helm Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# The install script is based off of the MIT-licensed script from glide,
+# the package manager for Go: https://github.com/Masterminds/glide.sh/blob/master/get
+
+: ${BINARY_NAME:="helm"}
+: ${USE_SUDO:="true"}
+: ${DEBUG:="false"}
+: ${VERIFY_CHECKSUM:="true"}
+: ${VERIFY_SIGNATURES:="false"}
+: ${HELM_INSTALL_DIR:="/usr/local/bin"}
+: ${GPG_PUBRING:="pubring.kbx"}
+
+HAS_CURL="$(type "curl" &> /dev/null && echo true || echo false)"
+HAS_WGET="$(type "wget" &> /dev/null && echo true || echo false)"
+HAS_OPENSSL="$(type "openssl" &> /dev/null && echo true || echo false)"
+HAS_GPG="$(type "gpg" &> /dev/null && echo true || echo false)"
+HAS_GIT="$(type "git" &> /dev/null && echo true || echo false)"
+
+# initArch discovers the architecture for this system.
+initArch() {
+  ARCH=$(uname -m)
+  case $ARCH in
+    armv5*) ARCH="armv5";;
+    armv6*) ARCH="armv6";;
+    armv7*) ARCH="arm";;
+    aarch64) ARCH="arm64";;
+    x86) ARCH="386";;
+    x86_64) ARCH="amd64";;
+    i686) ARCH="386";;
+    i386) ARCH="386";;
+  esac
+}
+
+# initOS discovers the operating system for this system.
+initOS() {
+  OS=$(echo `uname`|tr '[:upper:]' '[:lower:]')
+
+  case "$OS" in
+    # Minimalist GNU for Windows
+    mingw*|cygwin*) OS='windows';;
+  esac
+}
+
+# runs the given command as root (detects if we are root already)
+runAsRoot() {
+  if [ $EUID -ne 0 -a "$USE_SUDO" = "true" ]; then
+    sudo "${@}"
+  else
+    "${@}"
+  fi
+}
+
+# verifySupported checks that the os/arch combination is supported for
+# binary builds, as well whether or not necessary tools are present.
+verifySupported() {
+  local supported="darwin-amd64\ndarwin-arm64\nlinux-386\nlinux-amd64\nlinux-arm\nlinux-arm64\nlinux-ppc64le\nlinux-s390x\nlinux-riscv64\nwindows-amd64\nwindows-arm64"
+  if ! echo "${supported}" | grep -q "${OS}-${ARCH}"; then
+    echo "No prebuilt binary for ${OS}-${ARCH}."
+    echo "To build from source, go to https://github.com/helm/helm"
+    exit 1
+  fi
+
+  if [ "${HAS_CURL}" != "true" ] && [ "${HAS_WGET}" != "true" ]; then
+    echo "Either curl or wget is required"
+    exit 1
+  fi
+
+  if [ "${VERIFY_CHECKSUM}" == "true" ] && [ "${HAS_OPENSSL}" != "true" ]; then
+    echo "In order to verify checksum, openssl must first be installed."
+    echo "Please install openssl or set VERIFY_CHECKSUM=false in your environment."
+    exit 1
+  fi
+
+  if [ "${VERIFY_SIGNATURES}" == "true" ]; then
+    if [ "${HAS_GPG}" != "true" ]; then
+      echo "In order to verify signatures, gpg must first be installed."
+      echo "Please install gpg or set VERIFY_SIGNATURES=false in your environment."
+      exit 1
+    fi
+    if [ "${OS}" != "linux" ]; then
+      echo "Signature verification is currently only supported on Linux."
+      echo "Please set VERIFY_SIGNATURES=false or verify the signatures manually."
+      exit 1
+    fi
+  fi
+
+  if [ "${HAS_GIT}" != "true" ]; then
+    echo "[WARNING] Could not find git. It is required for plugin installation."
+  fi
+}
+
+# checkDesiredVersion checks if the desired version is available.
+checkDesiredVersion() {
+  if [ "x$DESIRED_VERSION" == "x" ]; then
+    # Get tag from release URL
+    local latest_release_url="https://get.helm.sh/helm-latest-version"
+    local latest_release_response=""
+    if [ "${HAS_CURL}" == "true" ]; then
+      latest_release_response=$( curl -L --silent --show-error --fail "$latest_release_url" 2>&1 || true )
+    elif [ "${HAS_WGET}" == "true" ]; then
+      latest_release_response=$( wget "$latest_release_url" -q -O - 2>&1 || true )
+    fi
+    TAG=$( echo "$latest_release_response" | grep '^v[0-9]' )
+    if [ "x$TAG" == "x" ]; then
+      printf "Could not retrieve the latest release tag information from %s: %s\n" "${latest_release_url}" "${latest_release_response}"
+      exit 1
+    fi
+  else
+    TAG=$DESIRED_VERSION
+  fi
+}
+
+# checkHelmInstalledVersion checks which version of helm is installed and
+# if it needs to be changed.
+checkHelmInstalledVersion() {
+  if [[ -f "${HELM_INSTALL_DIR}/${BINARY_NAME}" ]]; then
+    local version=$("${HELM_INSTALL_DIR}/${BINARY_NAME}" version --template="{{ .Version }}")
+    if [[ "$version" == "$TAG" ]]; then
+      echo "Helm ${version} is already ${DESIRED_VERSION:-latest}"
+      return 0
+    else
+      echo "Helm ${TAG} is available. Changing from version ${version}."
+      return 1
+    fi
+  else
+    return 1
+  fi
+}
+
+# downloadFile downloads the latest binary package and also the checksum
+# for that binary.
+downloadFile() {
+  HELM_DIST="helm-$TAG-$OS-$ARCH.tar.gz"
+  DOWNLOAD_URL="https://get.helm.sh/$HELM_DIST"
+  CHECKSUM_URL="$DOWNLOAD_URL.sha256"
+  HELM_TMP_ROOT="$(mktemp -dt helm-installer-XXXXXX)"
+  HELM_TMP_FILE="$HELM_TMP_ROOT/$HELM_DIST"
+  HELM_SUM_FILE="$HELM_TMP_ROOT/$HELM_DIST.sha256"
+  echo "Downloading $DOWNLOAD_URL"
+  if [ "${HAS_CURL}" == "true" ]; then
+    curl -SsL "$CHECKSUM_URL" -o "$HELM_SUM_FILE"
+    curl -SsL "$DOWNLOAD_URL" -o "$HELM_TMP_FILE"
+  elif [ "${HAS_WGET}" == "true" ]; then
+    wget -q -O "$HELM_SUM_FILE" "$CHECKSUM_URL"
+    wget -q -O "$HELM_TMP_FILE" "$DOWNLOAD_URL"
+  fi
+}
+
+# verifyFile verifies the SHA256 checksum of the binary package
+# and the GPG signatures for both the package and checksum file
+# (depending on settings in environment).
+verifyFile() {
+  if [ "${VERIFY_CHECKSUM}" == "true" ]; then
+    verifyChecksum
+  fi
+  if [ "${VERIFY_SIGNATURES}" == "true" ]; then
+    verifySignatures
+  fi
+}
+
+# installFile installs the Helm binary.
+installFile() {
+  HELM_TMP="$HELM_TMP_ROOT/$BINARY_NAME"
+  mkdir -p "$HELM_TMP"
+  tar xf "$HELM_TMP_FILE" -C "$HELM_TMP"
+  HELM_TMP_BIN="$HELM_TMP/$OS-$ARCH/helm"
+  echo "Preparing to install $BINARY_NAME into ${HELM_INSTALL_DIR}"
+  runAsRoot cp "$HELM_TMP_BIN" "$HELM_INSTALL_DIR/$BINARY_NAME"
+  echo "$BINARY_NAME installed into $HELM_INSTALL_DIR/$BINARY_NAME"
+}
+
+# verifyChecksum verifies the SHA256 checksum of the binary package.
+verifyChecksum() {
+  printf "Verifying checksum... "
+  local sum=$(openssl sha1 -sha256 ${HELM_TMP_FILE} | awk '{print $2}')
+  local expected_sum=$(cat ${HELM_SUM_FILE})
+  if [ "$sum" != "$expected_sum" ]; then
+    echo "SHA sum of ${HELM_TMP_FILE} does not match. Aborting."
+    exit 1
+  fi
+  echo "Done."
+}
+
+# verifySignatures obtains the latest KEYS file from GitHub main branch
+# as well as the signature .asc files from the specific GitHub release,
+# then verifies that the release artifacts were signed by a maintainer's key.
+verifySignatures() {
+  printf "Verifying signatures... "
+  local keys_filename="KEYS"
+  local github_keys_url="https://raw.githubusercontent.com/helm/helm/main/${keys_filename}"
+  if [ "${HAS_CURL}" == "true" ]; then
+    curl -SsL "${github_keys_url}" -o "${HELM_TMP_ROOT}/${keys_filename}"
+  elif [ "${HAS_WGET}" == "true" ]; then
+    wget -q -O "${HELM_TMP_ROOT}/${keys_filename}" "${github_keys_url}"
+  fi
+  local gpg_keyring="${HELM_TMP_ROOT}/keyring.gpg"
+  local gpg_homedir="${HELM_TMP_ROOT}/gnupg"
+  mkdir -p -m 0700 "${gpg_homedir}"
+  local gpg_stderr_device="/dev/null"
+  if [ "${DEBUG}" == "true" ]; then
+    gpg_stderr_device="/dev/stderr"
+  fi
+  gpg --batch --quiet --homedir="${gpg_homedir}" --import "${HELM_TMP_ROOT}/${keys_filename}" 2> "${gpg_stderr_device}"
+  gpg --batch --no-default-keyring --keyring "${gpg_homedir}/${GPG_PUBRING}" --export > "${gpg_keyring}"
+  local github_release_url="https://github.com/helm/helm/releases/download/${TAG}"
+  if [ "${HAS_CURL}" == "true" ]; then
+    curl -SsL "${github_release_url}/helm-${TAG}-${OS}-${ARCH}.tar.gz.sha256.asc" -o "${HELM_TMP_ROOT}/helm-${TAG}-${OS}-${ARCH}.tar.gz.sha256.asc"
+    curl -SsL "${github_release_url}/helm-${TAG}-${OS}-${ARCH}.tar.gz.asc" -o "${HELM_TMP_ROOT}/helm-${TAG}-${OS}-${ARCH}.tar.gz.asc"
+  elif [ "${HAS_WGET}" == "true" ]; then
+    wget -q -O "${HELM_TMP_ROOT}/helm-${TAG}-${OS}-${ARCH}.tar.gz.sha256.asc" "${github_release_url}/helm-${TAG}-${OS}-${ARCH}.tar.gz.sha256.asc"
+    wget -q -O "${HELM_TMP_ROOT}/helm-${TAG}-${OS}-${ARCH}.tar.gz.asc" "${github_release_url}/helm-${TAG}-${OS}-${ARCH}.tar.gz.asc"
+  fi
+  local error_text="If you think this might be a potential security issue,"
+  error_text="${error_text}\nplease see here: https://github.com/helm/community/blob/master/SECURITY.md"
+  local num_goodlines_sha=$(gpg --verify --keyring="${gpg_keyring}" --status-fd=1 "${HELM_TMP_ROOT}/helm-${TAG}-${OS}-${ARCH}.tar.gz.sha256.asc" 2> "${gpg_stderr_device}" | grep -c -E '^\[GNUPG:\] (GOODSIG|VALIDSIG)')
+  if [[ ${num_goodlines_sha} -lt 2 ]]; then
+    echo "Unable to verify the signature of helm-${TAG}-${OS}-${ARCH}.tar.gz.sha256!"
+    echo -e "${error_text}"
+    exit 1
+  fi
+  local num_goodlines_tar=$(gpg --verify --keyring="${gpg_keyring}" --status-fd=1 "${HELM_TMP_ROOT}/helm-${TAG}-${OS}-${ARCH}.tar.gz.asc" 2> "${gpg_stderr_device}" | grep -c -E '^\[GNUPG:\] (GOODSIG|VALIDSIG)')
+  if [[ ${num_goodlines_tar} -lt 2 ]]; then
+    echo "Unable to verify the signature of helm-${TAG}-${OS}-${ARCH}.tar.gz!"
+    echo -e "${error_text}"
+    exit 1
+  fi
+  echo "Done."
+}
+
+# fail_trap is executed if an error occurs.
+fail_trap() {
+  result=$?
+  if [ "$result" != "0" ]; then
+    if [[ -n "$INPUT_ARGUMENTS" ]]; then
+      echo "Failed to install $BINARY_NAME with the arguments provided: $INPUT_ARGUMENTS"
+      help
+    else
+      echo "Failed to install $BINARY_NAME"
+    fi
+    echo -e "\tFor support, go to https://github.com/helm/helm."
+  fi
+  cleanup
+  exit $result
+}
+
+# testVersion tests the installed client to make sure it is working.
+testVersion() {
+  set +e
+  HELM="$(command -v $BINARY_NAME)"
+  if [ "$?" = "1" ]; then
+    echo "$BINARY_NAME not found. Is $HELM_INSTALL_DIR on your "'$PATH?'
+    exit 1
+  fi
+  set -e
+}
+
+# help provides possible cli installation arguments
+help () {
+  echo "Accepted cli arguments are:"
+  echo -e "\t[--help|-h ] ->> prints this help"
+  echo -e "\t[--version|-v <desired_version>] . When not defined it fetches the latest release from GitHub"
+  echo -e "\te.g. --version v3.0.0 or -v canary"
+  echo -e "\t[--no-sudo]  ->> install without sudo"
+}
+
+# cleanup temporary files to avoid https://github.com/helm/helm/issues/2977
+cleanup() {
+  if [[ -d "${HELM_TMP_ROOT:-}" ]]; then
+    rm -rf "$HELM_TMP_ROOT"
+  fi
+}
+
+# Execution
+
+#Stop execution on any error
+trap "fail_trap" EXIT
+set -e
+
+# Set debug if desired
+if [ "${DEBUG}" == "true" ]; then
+  set -x
+fi
+
+# Parsing input arguments (if any)
+export INPUT_ARGUMENTS="${@}"
+set -u
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    '--version'|-v)
+       shift
+       if [[ $# -ne 0 ]]; then
+           export DESIRED_VERSION="${1}"
+           if [[ "$1" != "v"* ]]; then
+               echo "Expected version arg ('${DESIRED_VERSION}') to begin with 'v', fixing..."
+               export DESIRED_VERSION="v${1}"
+           fi
+       else
+           echo -e "Please provide the desired version. e.g. --version v3.0.0 or -v canary"
+           exit 0
+       fi
+       ;;
+    '--no-sudo')
+       USE_SUDO="false"
+       ;;
+    '--help'|-h)
+       help
+       exit 0
+       ;;
+    *) exit 1
+       ;;
+  esac
+  shift
+done
+set +u
+
+initArch
+initOS
+verifySupported
+checkDesiredVersion
+if ! checkHelmInstalledVersion; then
+  downloadFile
+  verifyFile
+  installFile
+fi
+testVersion
+cleanup

go.mod

@@ -1,6 +1,8 @@
 module github.com/alibaba/higress
 
-go 1.19
+go 1.21.0
+
+toolchain go1.22.2
 
 replace github.com/spf13/viper => github.com/istio/viper v1.3.3-0.20190515210538-2789fed3109c
 
@@ -14,282 +16,226 @@ replace github.com/docker/distribution => github.com/docker/distribution v0.0.0-
 replace github.com/imdario/mergo => github.com/imdario/mergo v0.3.5
 
 require (
-	github.com/AlecAivazis/survey/v2 v2.3.6
 	github.com/agiledragon/gomonkey/v2 v2.11.0
+	github.com/alibaba/higress/hgctl v0.0.0-00010101000000-000000000000
 	github.com/avast/retry-go/v4 v4.3.4
-	github.com/compose-spec/compose-go v1.8.2
-	github.com/docker/cli v20.10.20+incompatible
-	github.com/docker/compose/v2 v2.0.0-00010101000000-000000000000
-	github.com/docker/docker v20.10.20+incompatible
+	github.com/caddyserver/certmagic v0.21.3
 	github.com/dubbogo/go-zookeeper v1.0.4-0.20211212162352-f9d2183d89d5
 	github.com/dubbogo/gost v1.13.1
-	github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1
-	github.com/fatih/color v1.14.1
-	github.com/fatih/structtag v1.2.0
+	github.com/envoyproxy/go-control-plane v0.11.2-0.20230725211550-11bfe846bcd4
 	github.com/gogo/protobuf v1.3.2
-	github.com/golang/protobuf v1.5.2
-	github.com/google/go-cmp v0.5.9
+	github.com/golang/protobuf v1.5.3
+	github.com/google/go-cmp v0.6.0
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
-	github.com/hashicorp/consul/api v1.23.0
+	github.com/hashicorp/consul/api v1.21.0
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hudl/fargo v1.4.0
-	github.com/iancoleman/orderedmap v0.3.0
-	github.com/mitchellh/go-homedir v1.1.0
-	github.com/mitchellh/mapstructure v1.5.0
+	github.com/mholt/acmez v1.2.0
 	github.com/nacos-group/nacos-sdk-go v1.0.8
 	github.com/nacos-group/nacos-sdk-go/v2 v2.1.2
-	github.com/pkg/errors v0.9.1
-	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1
-	github.com/spf13/cobra v1.6.1
+	github.com/onsi/gomega v1.27.10
+	github.com/spf13/cobra v1.8.0
 	github.com/spf13/pflag v1.0.5
-	github.com/spf13/viper v1.8.1
-	github.com/stretchr/testify v1.8.3
-	go.uber.org/atomic v1.9.0
-	google.golang.org/grpc v1.48.0
-	google.golang.org/protobuf v1.28.1
-	gopkg.in/yaml.v2 v2.4.0
-	gopkg.in/yaml.v3 v3.0.1
-	istio.io/api v0.0.0-20211122181927-8da52c66ff23
-	istio.io/client-go v1.12.0-rc.1.0.20211118171212-b744b6f111e4
-	istio.io/gogo-genproto v0.0.0-20211115195057-0e34bdd2be67
+	github.com/stretchr/testify v1.8.4
+	github.com/tidwall/gjson v1.17.0
+	go.uber.org/atomic v1.11.0
+	go.uber.org/zap v1.27.0
+	golang.org/x/net v0.27.0
+	google.golang.org/genproto/googleapis/api v0.0.0-20230920204549-e6e6cdab5c13
+	google.golang.org/grpc v1.59.0
+	google.golang.org/protobuf v1.33.0
+	istio.io/api v1.19.5-0.20231206014255-f55a2b1e931e
 	istio.io/istio v0.0.0
-	istio.io/pkg v0.0.0-20211115195056-e379f31ee62a
-	k8s.io/api v0.24.1
-	k8s.io/apimachinery v0.24.1
-	k8s.io/cli-runtime v0.22.2
-	k8s.io/client-go v0.24.1
-	k8s.io/kubectl v0.22.2
-	sigs.k8s.io/controller-runtime v0.10.2
-	sigs.k8s.io/yaml v1.3.0
+	istio.io/pkg v0.0.0-20231221211216-7635388a563e
+	k8s.io/api v0.28.3
+	k8s.io/apiextensions-apiserver v0.28.3
+	k8s.io/apimachinery v0.28.3
+	k8s.io/cli-runtime v0.28.0
+	k8s.io/client-go v0.28.3
+	knative.dev/networking v0.0.0-20220302134042-e8b2eb995165
+	knative.dev/pkg v0.0.0-20220301181942-2fdd5f232e77
+	sigs.k8s.io/controller-runtime v0.16.3
+	sigs.k8s.io/gateway-api v0.8.0
+	sigs.k8s.io/structured-merge-diff/v4 v4.3.0
+	sigs.k8s.io/yaml v1.4.0
 )
 
 require (
-	cloud.google.com/go v0.98.0 // indirect
-	cloud.google.com/go/logging v1.4.2 // indirect
-	contrib.go.opencensus.io/exporter/prometheus v0.4.0 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
-	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
-	github.com/Azure/go-autorest/autorest v0.11.27 // indirect
-	github.com/Azure/go-autorest/autorest/adal v0.9.20 // indirect
-	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
-	github.com/Azure/go-autorest/logger v0.2.1 // indirect
-	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
-	github.com/BurntSushi/toml v0.3.1 // indirect
-	github.com/MakeNowJust/heredoc v0.0.0-20170808103936-bb23615498cd // indirect
+	cloud.google.com/go v0.110.8 // indirect
+	cloud.google.com/go/compute v1.23.0 // indirect
+	cloud.google.com/go/compute/metadata v0.2.3 // indirect
+	cloud.google.com/go/logging v1.8.1 // indirect
+	cloud.google.com/go/longrunning v0.5.1 // indirect
+	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.1.1 // indirect
-	github.com/Masterminds/sprig/v3 v3.2.2 // indirect
-	github.com/Masterminds/squirrel v1.5.0 // indirect
-	github.com/Microsoft/go-winio v0.5.2 // indirect
-	github.com/Microsoft/hcsshim v0.9.6 // indirect
-	github.com/PuerkitoBio/purell v1.1.1 // indirect
-	github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
-	github.com/RageCage64/multilinediff v0.2.0 // indirect
+	github.com/Masterminds/semver/v3 v3.2.1 // indirect
+	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
+	github.com/alecholmes/xfccparser v0.1.0 // indirect
+	github.com/alecthomas/participle v0.4.1 // indirect
 	github.com/aliyun/alibaba-cloud-sdk-go v1.61.1704 // indirect
+	github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df // indirect
 	github.com/armon/go-metrics v0.4.1 // indirect
-	github.com/asaskevich/govalidator v0.0.0-20200428143746-21a406dcc535 // indirect
-	github.com/aws/aws-sdk-go v1.43.16 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bmatcuk/doublestar/v4 v4.6.0 // indirect
-	github.com/braydonk/yaml v0.7.0 // indirect
-	github.com/buger/goterm v1.0.4 // indirect
+	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/buger/jsonparser v1.1.1 // indirect
-	github.com/cenkalti/backoff/v4 v4.1.2 // indirect
-	github.com/census-instrumentation/opencensus-proto v0.3.0 // indirect
-	github.com/cespare/xxhash/v2 v2.1.2 // indirect
-	github.com/chai2010/gettext-go v0.0.0-20160711120539-c6fed771bfd5 // indirect
+	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
+	github.com/census-instrumentation/opencensus-proto v0.4.1 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/clbanning/mxj v1.8.4 // indirect
-	github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4 // indirect
-	github.com/cncf/xds/go v0.0.0-20220520190051-1e77728a1eaa // indirect
-	github.com/compose-spec/godotenv v1.1.1 // indirect
-	github.com/containerd/cgroups v1.0.4 // indirect
-	github.com/containerd/console v1.0.3 // indirect
-	github.com/containerd/containerd v1.6.14 // indirect
-	github.com/containerd/continuity v0.3.0 // indirect
-	github.com/containerd/typeurl v1.0.2 // indirect
-	github.com/coreos/go-oidc/v3 v3.1.0 // indirect
-	github.com/cyphar/filepath-securejoin v0.2.3 // indirect
+	github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
+	github.com/coreos/go-oidc/v3 v3.6.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/decred/dcrd/dcrec/secp256k1/v3 v3.0.0 // indirect
-	github.com/distribution/distribution/v3 v3.0.0-20221201083218-92d136e113cf // indirect
-	github.com/docker/buildx v0.9.1 // indirect
-	github.com/docker/distribution v2.8.1+incompatible // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
+	github.com/docker/cli v24.0.7+incompatible // indirect
+	github.com/docker/distribution v2.8.2+incompatible // indirect
+	github.com/docker/docker v24.0.7+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.7.0 // indirect
-	github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c // indirect
-	github.com/docker/go-connections v0.4.0 // indirect
-	github.com/docker/go-metrics v0.0.1 // indirect
-	github.com/docker/go-units v0.5.0 // indirect
-	github.com/envoyproxy/protoc-gen-validate v0.1.0 // indirect
-	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
-	github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d // indirect
+	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.0.2 // indirect
+	github.com/evanphx/json-patch v5.7.0+incompatible // indirect
+	github.com/evanphx/json-patch/v5 v5.7.0 // indirect
+	github.com/fatih/color v1.15.0 // indirect
 	github.com/franela/goreq v0.0.0-20171204163338-bcd34c9993f8 // indirect
-	github.com/fsnotify/fsnotify v1.5.1 // indirect
-	github.com/fvbommel/sortorder v1.0.2 // indirect
-	github.com/ghodss/yaml v1.0.0 // indirect
-	github.com/go-errors/errors v1.0.1 // indirect
-	github.com/go-kit/log v0.1.0 // indirect
-	github.com/go-logfmt/logfmt v0.5.0 // indirect
-	github.com/go-logr/logr v1.2.3 // indirect
-	github.com/go-openapi/jsonpointer v0.19.5 // indirect
-	github.com/go-openapi/jsonreference v0.19.5 // indirect
-	github.com/go-openapi/swag v0.19.15 // indirect
-	github.com/gobwas/glob v0.2.3 // indirect
-	github.com/goccy/go-json v0.4.8 // indirect
-	github.com/gofrs/flock v0.8.0 // indirect
-	github.com/gogo/googleapis v1.4.1 // indirect
-	github.com/golang-jwt/jwt/v4 v4.2.0 // indirect
+	github.com/fsnotify/fsnotify v1.7.0 // indirect
+	github.com/go-errors/errors v1.4.2 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.0 // indirect
+	github.com/go-logr/logr v1.2.4 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-openapi/jsonpointer v0.20.0 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.22.4 // indirect
+	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/mock v1.6.0 // indirect
-	github.com/google/btree v1.0.1 // indirect
-	github.com/google/go-containerregistry v0.6.0 // indirect
+	github.com/google/btree v1.1.2 // indirect
+	github.com/google/cel-go v0.16.1 // indirect
+	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/google/go-containerregistry v0.15.2 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/s2a-go v0.1.4 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
-	github.com/google/uuid v1.3.0 // indirect
-	github.com/googleapis/gax-go/v2 v2.1.1 // indirect
-	github.com/googleapis/gnostic v0.5.5 // indirect
-	github.com/gorilla/mux v1.8.0 // indirect
-	github.com/gosuri/uitable v0.0.4 // indirect
-	github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 // indirect
-	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
-	github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect
+	github.com/google/uuid v1.3.1 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.2.5 // indirect
+	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
+	github.com/grafana/regexp v0.0.0-20221122212121-6b5c0a4cb7fd // indirect
+	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
+	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-hclog v1.5.0 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-version v1.6.0 // indirect
-	github.com/hashicorp/golang-lru v0.5.4 // indirect
-	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/hashicorp/golang-lru v0.6.0 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.4 // indirect
 	github.com/hashicorp/serf v0.10.1 // indirect
-	github.com/huandu/xstrings v1.3.2 // indirect
-	github.com/imdario/mergo v0.3.13 // indirect
-	github.com/inconshreveable/mousetrap v1.0.1 // indirect
-	github.com/jaguilar/vt100 v0.0.0-20150826170717-2703a27b14ea // indirect
+	github.com/huandu/xstrings v1.4.0 // indirect
+	github.com/imdario/mergo v1.0.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
-	github.com/jmoiron/sqlx v1.3.1 // indirect
-	github.com/jonboulle/clockwork v0.2.2 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
-	github.com/klauspost/compress v1.15.9 // indirect
-	github.com/kr/pretty v0.3.0 // indirect
-	github.com/kr/text v0.2.0 // indirect
-	github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
-	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
-	github.com/lestrrat-go/backoff/v2 v2.0.7 // indirect
-	github.com/lestrrat-go/blackmagic v1.0.0 // indirect
-	github.com/lestrrat-go/httpcc v1.0.0 // indirect
-	github.com/lestrrat-go/iter v1.0.1 // indirect
-	github.com/lestrrat-go/jwx v1.2.0 // indirect
-	github.com/lestrrat-go/option v1.0.0 // indirect
+	github.com/klauspost/compress v1.16.5 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
+	github.com/lestrrat-go/backoff/v2 v2.0.8 // indirect
+	github.com/lestrrat-go/blackmagic v1.0.1 // indirect
+	github.com/lestrrat-go/httpcc v1.0.1 // indirect
+	github.com/lestrrat-go/iter v1.0.2 // indirect
+	github.com/lestrrat-go/jwx v1.2.26 // indirect
+	github.com/lestrrat-go/option v1.0.1 // indirect
 	github.com/lestrrat/go-file-rotatelogs v0.0.0-20180223000712-d3151e2a480f // indirect
 	github.com/lestrrat/go-strftime v0.0.0-20180220042222-ba3bf9c1d042 // indirect
-	github.com/lib/pq v1.10.0 // indirect
+	github.com/libdns/libdns v0.2.2 // indirect
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
-	github.com/magiconair/properties v1.8.5 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.17 // indirect
-	github.com/mattn/go-runewidth v0.0.12 // indirect
-	github.com/mattn/go-shellwords v1.0.12 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
-	github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
-	github.com/miekg/dns v1.1.43 // indirect
-	github.com/miekg/pkcs11 v1.1.1 // indirect
+	github.com/mattn/go-isatty v0.0.19 // indirect
+	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
+	github.com/miekg/dns v1.1.59 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
-	github.com/mitchellh/go-wordwrap v1.0.0 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/buildkit v0.10.4 // indirect
-	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/spdystream v0.2.0 // indirect
-	github.com/moby/sys/mount v0.3.0 // indirect
-	github.com/moby/sys/mountinfo v0.6.0 // indirect
-	github.com/moby/sys/signal v0.7.0 // indirect
-	github.com/moby/sys/symlink v0.2.0 // indirect
-	github.com/moby/term v0.0.0-20221128092401-c43b287e0e0f // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
-	github.com/morikuni/aec v1.0.0 // indirect
-	github.com/natefinch/lumberjack v2.0.0+incompatible // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/op/go-logging v0.0.0-20160315200505-970db520ece7 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0-rc2 // indirect
-	github.com/opencontainers/runc v1.1.3 // indirect
-	github.com/openshift/api v0.0.0-20200713203337-b2494ecb17dd // indirect
-	github.com/opentracing/opentracing-go v1.2.0 // indirect
-	github.com/pelletier/go-toml v1.9.4 // indirect
+	github.com/opencontainers/image-spec v1.1.0-rc5 // indirect
+	github.com/openshift/api v0.0.0-20230720094506-afcbe27aec7c // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
+	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_golang v1.12.2 // indirect
-	github.com/prometheus/client_model v0.2.0 // indirect
-	github.com/prometheus/common v0.32.1 // indirect
-	github.com/prometheus/procfs v0.7.3 // indirect
-	github.com/prometheus/statsd_exporter v0.21.0 // indirect
-	github.com/rivo/uniseg v0.2.0 // indirect
-	github.com/rogpeppe/go-internal v1.6.1 // indirect
-	github.com/rubenv/sql-migrate v0.0.0-20210614095031-55d5740dbbcc // indirect
-	github.com/russross/blackfriday v1.6.0 // indirect
-	github.com/sanathkr/go-yaml v0.0.0-20170819195128-ed9d249f429b // indirect
-	github.com/shopspring/decimal v1.2.0 // indirect
-	github.com/sirupsen/logrus v1.9.0 // indirect
+	github.com/prometheus/client_golang v1.17.0 // indirect
+	github.com/prometheus/client_model v0.5.0 // indirect
+	github.com/prometheus/common v0.45.0 // indirect
+	github.com/prometheus/procfs v0.12.0 // indirect
+	github.com/prometheus/prometheus v0.45.0 // indirect
+	github.com/sergi/go-diff v1.2.0 // indirect
+	github.com/shopspring/decimal v1.3.1 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
-	github.com/spf13/afero v1.2.2 // indirect
-	github.com/spf13/cast v1.3.1 // indirect
-	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/theupdateframework/notary v0.7.0 // indirect
+	github.com/spf13/cast v1.5.1 // indirect
+	github.com/stoewer/go-strcase v1.3.0 // indirect
+	github.com/tetratelabs/wazero v1.7.3 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.0 // indirect
-	github.com/tonistiigi/fsutil v0.0.0-20220930225714-4638ad635be5 // indirect
-	github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea // indirect
 	github.com/toolkits/concurrent v0.0.0-20150624120057-a4371d70e3e3 // indirect
-	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
-	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	github.com/xlab/treeprint v0.0.0-20181112141820-a009c3971eca // indirect
+	github.com/vbatts/tar-split v0.11.3 // indirect
+	github.com/xlab/treeprint v1.2.0 // indirect
 	github.com/yl2chen/cidranger v1.0.2 // indirect
-	go.opencensus.io v0.23.0 // indirect
-	go.opentelemetry.io/proto/otlp v0.12.0 // indirect
-	go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
-	go.uber.org/multierr v1.7.0 // indirect
-	go.uber.org/zap v1.21.0 // indirect
-	golang.org/x/crypto v0.11.0 // indirect
-	golang.org/x/exp v0.0.0-20230321023759-10a507213a29 // indirect
-	golang.org/x/net v0.12.0 // indirect
-	golang.org/x/oauth2 v0.6.0 // indirect
-	golang.org/x/sync v0.2.0 // indirect
-	golang.org/x/sys v0.10.0 // indirect
-	golang.org/x/term v0.10.0 // indirect
-	golang.org/x/text v0.11.0 // indirect
-	golang.org/x/time v0.0.0-20220722155302-e5dcc9cfc0b9 // indirect
-	gomodules.xyz/jsonpatch/v2 v2.2.0 // indirect
-	gomodules.xyz/jsonpatch/v3 v3.0.1 // indirect
-	gomodules.xyz/orderedmap v0.1.0 // indirect
-	google.golang.org/api v0.61.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21 // indirect
+	github.com/zeebo/blake3 v0.2.3 // indirect
+	go.opencensus.io v0.24.0 // indirect
+	go.opentelemetry.io/otel v1.17.0 // indirect
+	go.opentelemetry.io/otel/exporters/prometheus v0.39.1-0.20230714155235-03b8c47770f2 // indirect
+	go.opentelemetry.io/otel/metric v1.17.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.16.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v0.39.0 // indirect
+	go.opentelemetry.io/otel/trace v1.17.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
+	go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	golang.org/x/crypto v0.25.0 // indirect
+	golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
+	golang.org/x/mod v0.17.0 // indirect
+	golang.org/x/oauth2 v0.13.0 // indirect
+	golang.org/x/sync v0.7.0 // indirect
+	golang.org/x/sys v0.22.0 // indirect
+	golang.org/x/term v0.22.0 // indirect
+	golang.org/x/text v0.16.0 // indirect
+	golang.org/x/time v0.3.0 // indirect
+	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
+	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
+	google.golang.org/api v0.132.0 // indirect
+	google.golang.org/appengine v1.6.8 // indirect
+	google.golang.org/genproto v0.0.0-20231002182017-d307bd883b97 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20231009173412-8bfb1ae86b6c // indirect
 	gopkg.in/gcfg.v1 v1.2.3 // indirect
-	gopkg.in/gorp.v1 v1.7.2 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/ini.v1 v1.66.2 // indirect
-	gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
+	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
-	k8s.io/apiserver v0.22.5 // indirect
-	k8s.io/component-base v0.22.5 // indirect
-	k8s.io/klog/v2 v2.60.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20211109043538-20434351676c // indirect
-	k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed // indirect
-	oras.land/oras-go v0.4.0 // indirect
-	sigs.k8s.io/gateway-api v0.4.0 // indirect
-	sigs.k8s.io/kustomize/api v0.8.11 // indirect
-	sigs.k8s.io/kustomize/kyaml v0.11.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	gotest.tools/v3 v3.5.0 // indirect
+	istio.io/client-go v1.19.5-0.20231206015206-8cdf6a3b3cfd // indirect
+	k8s.io/apiserver v0.28.3 // indirect
+	k8s.io/component-base v0.28.3 // indirect
+	k8s.io/klog/v2 v2.100.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
+	k8s.io/kubectl v0.28.0 // indirect
+	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.14.3 // indirect
 	sigs.k8s.io/mcs-api v0.1.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
 )
 
-replace github.com/dubbogo/gost => github.com/johnlanni/gost v1.11.23-0.20220713132522-0967a24036c6
-
 replace istio.io/api => ./external/api
 
 replace github.com/envoyproxy/go-control-plane => ./external/go-control-plane
@@ -300,59 +246,11 @@ replace istio.io/client-go => ./external/client-go
 
 replace istio.io/istio => ./external/istio
 
-require (
-	github.com/evanphx/json-patch/v5 v5.6.0
-	github.com/google/yamlfmt v0.10.0
-	github.com/kylelemons/godebug v1.1.0
-	github.com/tidwall/gjson v1.17.0
-	helm.sh/helm/v3 v3.7.1
-	k8s.io/apiextensions-apiserver v0.25.4
-	knative.dev/networking v0.0.0-20220302134042-e8b2eb995165
-	knative.dev/pkg v0.0.0-20220301181942-2fdd5f232e77
-)
+replace github.com/alibaba/higress/hgctl => ./hgctl
+
+replace github.com/caddyserver/certmagic => github.com/2456868764/certmagic v1.0.2
 
 replace (
-	github.com/Sirupsen/logrus => github.com/sirupsen/logrus v1.9.3
-	github.com/go-logr/logr => github.com/go-logr/logr v0.4.0
-
-	k8s.io/api => k8s.io/api v0.22.2
-	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.22.2
-	k8s.io/apimachinery => k8s.io/apimachinery v0.22.2
-	k8s.io/cli-runtime => k8s.io/cli-runtime v0.22.2
-	k8s.io/client-go => k8s.io/client-go v0.22.2
-	k8s.io/code-generator => k8s.io/code-generator v0.22.2
-	k8s.io/component-base => k8s.io/component-base v0.22.2
-	k8s.io/component-helpers => k8s.io/component-helpers v0.22.2
-	k8s.io/klog/v2 => k8s.io/klog/v2 v2.10.0
-	k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e
-	k8s.io/kubectl => k8s.io/kubectl v0.22.2
-	k8s.io/metrics => k8s.io/metrics v0.22.2
-
-	k8s.io/utils => k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed // indirect
-	sigs.k8s.io/kustomize/api => sigs.k8s.io/kustomize/api v0.8.11 // indirect
-	sigs.k8s.io/kustomize/kyaml => sigs.k8s.io/kustomize/kyaml v0.11.0 // indirect
-)
-
-// for pkg/cmd/hgctl/docker/compose.go
-// TODO(WeixinX): Wait for the dependency library to upgrade, such as github.com/go-logr/logr from v0.4.0 to v1.2+
-// replace (
-// github.com/compose-spec/compose-go => github.com/compose-spec/compose-go v1.8.2
-// github.com/cucumber/godog => github.com/laurazard/godog v0.0.0-20220922095256-4c4b17abdae7
-// github.com/docker/buildx => github.com/docker/buildx v0.9.1
-// github.com/docker/cli => github.com/docker/cli v20.10.3-0.20221013132413-1d6c6e2367e2+incompatible
-// github.com/docker/compose/v2 => github.com/docker/compose/v2 v2.15.1
-// github.com/docker/docker => github.com/moby/moby v20.10.3-0.20221021173910-5aac513617f0+incompatible
-// github.com/moby/buildkit => github.com/moby/buildkit v0.10.1-0.20220816171719-55ba9d14360a
-// )
-
-replace (
-	github.com/compose-spec/compose-go => github.com/compose-spec/compose-go v1.0.8
-	github.com/docker/buildx => github.com/docker/buildx v0.5.2-0.20210422185057-908a856079fc
-	github.com/docker/cli => github.com/docker/cli v20.10.7+incompatible
-	github.com/docker/compose/v2 => github.com/docker/compose/v2 v2.2.0
-	github.com/docker/docker => github.com/docker/docker v20.10.3+incompatible
-	github.com/jaguilar/vt100 => github.com/tonistiigi/vt100 v0.0.0-20190402012908-ad4c4a574305
-	github.com/moby/buildkit => github.com/moby/buildkit v0.8.2-0.20210401015549-df49b648c8bf
-	github.com/tonistiigi/fsutil => github.com/tonistiigi/fsutil v0.0.0-20201103201449-0834f99b7b85
-	sigs.k8s.io/gateway-api => github.com/johnlanni/gateway-api v0.0.0-20231031082632-72137664e7c7
+	github.com/dubbogo/gost => github.com/johnlanni/gost v1.11.23-0.20220713132522-0967a24036c6
+	golang.org/x/exp => golang.org/x/exp v0.0.0-20230713183714-613f0c0eb8a1
 )

helm/core/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 1.3.5
+appVersion: 2.0.1
 description: Helm chart for deploying higress gateways
 icon: https://higress.io/img/higress_logo_small.png
 home: http://higress.io/
@@ -10,4 +10,4 @@ name: higress-core
 sources:
 - http://github.com/alibaba/higress
 type: application
-version: 1.3.5
+version: 2.0.1

helm/core/crds/customresourcedefinitions.gen.yaml

@@ -37,6 +37,13 @@ spec:
                 x-kubernetes-preserve-unknown-fields: true
               defaultConfigDisable:
                 type: boolean
+              failStrategy:
+                description: Specifies the failure behavior for the plugin due to
+                  fatal errors.
+                enum:
+                - FAIL_CLOSE
+                - FAIL_OPEN
+                type: string
               imagePullPolicy:
                 description: The pull behaviour to be applied when fetching an OCI
                   image.
@@ -64,6 +71,10 @@ spec:
                       items:
                         type: string
                       type: array
+                    service:
+                      items:
+                        type: string
+                      type: array
                   type: object
                 type: array
               phase:
@@ -94,6 +105,27 @@ spec:
                 type: string
               verificationKey:
                 type: string
+              vmConfig:
+                description: Configuration for a Wasm VM.
+                properties:
+                  env:
+                    description: Specifies environment variables to be injected to
+                      this VM.
+                    items:
+                      properties:
+                        name:
+                          type: string
+                        value:
+                          description: Value for the environment variable.
+                          type: string
+                        valueFrom:
+                          enum:
+                          - INLINE
+                          - HOST
+                          type: string
+                      type: object
+                    type: array
+                type: object
             type: object
           status:
             type: object
@@ -252,6 +284,10 @@ spec:
                       type: string
                     port:
                       type: integer
+                    protocol:
+                      type: string
+                    sni:
+                      type: string
                     type:
                       type: string
                     zkServicesPath:

helm/core/crds/istio-envoyfilter.yaml

@@ -0,0 +1,236 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    "helm.sh/resource-policy": keep
+  name: envoyfilters.networking.istio.io
+spec:
+  group: networking.istio.io
+  names:
+    categories:
+    - istio-io
+    - networking-istio-io
+    kind: EnvoyFilter
+    listKind: EnvoyFilterList
+    plural: envoyfilters
+    singular: envoyfilter
+  scope: Namespaced
+  versions:
+  - name: v1alpha3
+    schema:
+      openAPIV3Schema:
+        properties:
+          spec:
+            description: 'Customizing Envoy configuration generated by Istio. See
+              more details at: https://istio.io/docs/reference/config/networking/envoy-filter.html'
+            properties:
+              configPatches:
+                description: One or more patches with match conditions.
+                items:
+                  properties:
+                    applyTo:
+                      enum:
+                      - INVALID
+                      - LISTENER
+                      - FILTER_CHAIN
+                      - NETWORK_FILTER
+                      - HTTP_FILTER
+                      - ROUTE_CONFIGURATION
+                      - VIRTUAL_HOST
+                      - HTTP_ROUTE
+                      - CLUSTER
+                      - EXTENSION_CONFIG
+                      - BOOTSTRAP
+                      - LISTENER_FILTER
+                      type: string
+                    match:
+                      description: Match on listener/route configuration/cluster.
+                      oneOf:
+                      - not:
+                          anyOf:
+                          - required:
+                            - listener
+                          - required:
+                            - routeConfiguration
+                          - required:
+                            - cluster
+                      - required:
+                        - listener
+                      - required:
+                        - routeConfiguration
+                      - required:
+                        - cluster
+                      properties:
+                        cluster:
+                          description: Match on envoy cluster attributes.
+                          properties:
+                            name:
+                              description: The exact name of the cluster to match.
+                              type: string
+                            portNumber:
+                              description: The service port for which this cluster
+                                was generated.
+                              type: integer
+                            service:
+                              description: The fully qualified service name for this
+                                cluster.
+                              type: string
+                            subset:
+                              description: The subset associated with the service.
+                              type: string
+                          type: object
+                        context:
+                          description: The specific config generation context to match
+                            on.
+                          enum:
+                          - ANY
+                          - SIDECAR_INBOUND
+                          - SIDECAR_OUTBOUND
+                          - GATEWAY
+                          type: string
+                        listener:
+                          description: Match on envoy listener attributes.
+                          properties:
+                            filterChain:
+                              description: Match a specific filter chain in a listener.
+                              properties:
+                                applicationProtocols:
+                                  description: Applies only to sidecars.
+                                  type: string
+                                destinationPort:
+                                  description: The destination_port value used by
+                                    a filter chain's match condition.
+                                  type: integer
+                                filter:
+                                  description: The name of a specific filter to apply
+                                    the patch to.
+                                  properties:
+                                    name:
+                                      description: The filter name to match on.
+                                      type: string
+                                    subFilter:
+                                      properties:
+                                        name:
+                                          description: The filter name to match on.
+                                          type: string
+                                      type: object
+                                  type: object
+                                name:
+                                  description: The name assigned to the filter chain.
+                                  type: string
+                                sni:
+                                  description: The SNI value used by a filter chain's
+                                    match condition.
+                                  type: string
+                                transportProtocol:
+                                  description: Applies only to `SIDECAR_INBOUND` context.
+                                  type: string
+                              type: object
+                            listenerFilter:
+                              description: Match a specific listener filter.
+                              type: string
+                            name:
+                              description: Match a specific listener by its name.
+                              type: string
+                            portName:
+                              type: string
+                            portNumber:
+                              type: integer
+                          type: object
+                        proxy:
+                          description: Match on properties associated with a proxy.
+                          properties:
+                            metadata:
+                              additionalProperties:
+                                type: string
+                              type: object
+                            proxyVersion:
+                              type: string
+                          type: object
+                        routeConfiguration:
+                          description: Match on envoy HTTP route configuration attributes.
+                          properties:
+                            gateway:
+                              type: string
+                            name:
+                              description: Route configuration name to match on.
+                              type: string
+                            portName:
+                              description: Applicable only for GATEWAY context.
+                              type: string
+                            portNumber:
+                              type: integer
+                            vhost:
+                              properties:
+                                name:
+                                  type: string
+                                route:
+                                  description: Match a specific route within the virtual
+                                    host.
+                                  properties:
+                                    action:
+                                      description: Match a route with specific action
+                                        type.
+                                      enum:
+                                      - ANY
+                                      - ROUTE
+                                      - REDIRECT
+                                      - DIRECT_RESPONSE
+                                      type: string
+                                    name:
+                                      type: string
+                                  type: object
+                              type: object
+                          type: object
+                      type: object
+                    patch:
+                      description: The patch to apply along with the operation.
+                      properties:
+                        filterClass:
+                          description: Determines the filter insertion order.
+                          enum:
+                          - UNSPECIFIED
+                          - AUTHN
+                          - AUTHZ
+                          - STATS
+                          type: string
+                        operation:
+                          description: Determines how the patch should be applied.
+                          enum:
+                          - INVALID
+                          - MERGE
+                          - ADD
+                          - REMOVE
+                          - INSERT_BEFORE
+                          - INSERT_AFTER
+                          - INSERT_FIRST
+                          - REPLACE
+                          type: string
+                        value:
+                          description: The JSON config of the object being patched.
+                          type: object
+                          x-kubernetes-preserve-unknown-fields: true
+                      type: object
+                  type: object
+                type: array
+              priority:
+                description: Priority defines the order in which patch sets are applied
+                  within a context.
+                format: int32
+                type: integer
+              workloadSelector:
+                properties:
+                  labels:
+                    additionalProperties:
+                      type: string
+                    type: object
+                type: object
+            type: object
+          status:
+            type: object
+            x-kubernetes-preserve-unknown-fields: true
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

helm/core/templates/_helpers.tpl

@@ -97,7 +97,19 @@ higress: {{ include "controller.name" . }}
 {{- end }}
 
 {{- define "skywalking.enabled" -}}
-{{- if and .Values.skywalking.enabled .Values.skywalking.service.address }}
+{{- if and (hasKey .Values "tracing") .Values.tracing.enable (hasKey .Values.tracing "skywalking") .Values.tracing.skywalking.service }}
 true
 {{- end }}
 {{- end }}
+
+{{- define "gateway.podMonitor.gvk" -}}
+{{- if eq .Values.gateway.metrics.provider "monitoring.coreos.com" -}}
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+{{- else if eq .Values.gateway.metrics.provider "operator.victoriametrics.com" -}}
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+{{- else -}}
+{{- fail "unexpected gateway.metrics.provider" -}}
+{{- end -}}
+{{- end -}}

helm/core/templates/_pod.tpl

@@ -0,0 +1,326 @@
+
+{{/*
+Rendering the pod template of gateway component.
+*/}}
+{{- define "gateway.podTemplate" -}}
+{{- $o11y := .Values.global.o11y -}}
+template:
+  metadata:
+    annotations:
+    {{- if .Values.global.enableHigressIstio }}
+      "enableHigressIstio": "true"
+    {{- end }}
+    {{- if .Values.gateway.podAnnotations }}
+      {{- toYaml .Values.gateway.podAnnotations | nindent 6 }}
+    {{- end }}
+    labels:
+      sidecar.istio.io/inject: "false"
+      {{- with .Values.gateway.revision }}
+      istio.io/rev: {{ . }}
+      {{- end }}
+      {{- include "gateway.selectorLabels" . | nindent 6 }}
+  spec:
+    {{- with .Values.gateway.imagePullSecrets }}
+    imagePullSecrets:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+    serviceAccountName: {{ include "gateway.serviceAccountName" . }}
+    {{- if .Values.global.priorityClassName }}
+    priorityClassName: "{{ .Values.global.priorityClassName }}"
+    {{- end }}
+    securityContext:
+    {{- if .Values.gateway.securityContext }}
+      {{- toYaml .Values.gateway.securityContext | nindent 6 }}
+    {{- else if and .Values.gateway.unprivilegedPortSupported (and (not .Values.gateway.hostNetwork) (semverCompare ">=1.22-0" .Capabilities.KubeVersion.GitVersion)) }}
+      # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
+      sysctls:
+      - name: net.ipv4.ip_unprivileged_port_start
+        value: "0"
+    {{- end }}
+    containers:
+      - name: higress-gateway
+        image: "{{ .Values.gateway.hub | default .Values.global.hub }}/{{ .Values.gateway.image | default "gateway" }}:{{ .Values.gateway.tag | default .Chart.AppVersion }}"
+        args:
+          - proxy
+          - router
+          - --domain
+          - $(POD_NAMESPACE).svc.cluster.local
+          - --proxyLogLevel=warning
+          - --proxyComponentLogLevel=misc:error
+          - --log_output_level=all:info
+          - --serviceCluster=higress-gateway
+        securityContext:
+        {{- if .Values.gateway.containerSecurityContext }}
+          {{- toYaml .Values.gateway.containerSecurityContext | nindent 10 }}
+        {{- else if and .Values.gateway.unprivilegedPortSupported (and (not .Values.gateway.hostNetwork) (semverCompare ">=1.22-0" .Capabilities.KubeVersion.GitVersion)) }}
+          # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
+          capabilities:
+            drop:
+            - ALL
+          allowPrivilegeEscalation: false
+          privileged: false
+          # When enabling lite metrics, the configuration template files need to be replaced.
+          {{- if not .Values.global.liteMetrics }}
+          readOnlyRootFilesystem: true
+          {{- end }}
+          runAsUser: 1337
+          runAsGroup: 1337
+          runAsNonRoot: true
+        {{- else }}
+          capabilities:
+            drop:
+            - ALL
+            add:
+            - NET_BIND_SERVICE
+          runAsUser: 0
+          runAsGroup: 1337
+          runAsNonRoot: false
+          allowPrivilegeEscalation: true
+        {{- end }}
+        env:
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: spec.nodeName
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: INSTANCE_IP
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: status.podIP
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: status.hostIP
+        - name: SERVICE_ACCOUNT
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        - name: PROXY_XDS_VIA_AGENT
+          value: "true"
+        - name: ENABLE_INGRESS_GATEWAY_SDS
+          value: "false"
+        - name: JWT_POLICY
+          value: {{ include "controller.jwtPolicy" . }}
+        - name: ISTIO_META_HTTP10
+          value: "1"
+        - name: ISTIO_META_CLUSTER_ID
+          value: "{{ $.Values.clusterName | default `Kubernetes` }}"
+        - name: INSTANCE_NAME
+          value: "higress-gateway"
+        {{- if .Values.global.liteMetrics }}
+        - name: LITE_METRICS
+          value: "on"
+        {{- end }}
+        {{- if include "skywalking.enabled" . }}
+        - name: ISTIO_BOOTSTRAP_OVERRIDE
+          value: /etc/istio/custom-bootstrap/custom_bootstrap.json
+        {{- end }}
+        {{- with .Values.gateway.networkGateway }}
+        - name: ISTIO_META_REQUESTED_NETWORK_VIEW
+          value: "{{.}}"
+        {{- end }}
+        {{- range $key, $val := .Values.env }}
+        - name: {{ $key }}
+          value: {{ $val | quote }}
+        {{- end }}
+        ports:
+        - containerPort: 15020
+          protocol: TCP
+          name: istio-prom
+        - containerPort: 15090
+          protocol: TCP
+          name: http-envoy-prom
+        {{- if or .Values.global.local .Values.global.kind }}
+        - containerPort: {{ .Values.gateway.httpPort }}
+          hostPort:  {{ .Values.gateway.httpPort }}
+          name: http
+          protocol: TCP
+        - containerPort:  {{ .Values.gateway.httpsPort }}
+          hostPort:  {{ .Values.gateway.httpsPort }}
+          name: https
+          protocol: TCP
+        {{- end }}
+        readinessProbe:
+          failureThreshold: {{ .Values.gateway.readinessFailureThreshold }}
+          httpGet:
+            path: /healthz/ready
+            port: 15021
+            scheme: HTTP
+          initialDelaySeconds: {{ .Values.gateway.readinessInitialDelaySeconds }}
+          periodSeconds: {{ .Values.gateway.readinessPeriodSeconds }}
+          successThreshold: {{ .Values.gateway.readinessSuccessThreshold }}
+          timeoutSeconds: {{ .Values.gateway.readinessTimeoutSeconds }}
+        {{- if not (or .Values.global.local .Values.global.kind) }}
+        resources:
+          {{- toYaml .Values.gateway.resources | nindent 10 }}
+        {{- end }}
+        volumeMounts:
+        - mountPath: /var/run/secrets/workload-spiffe-uds
+          name: workload-socket
+        - mountPath: /var/run/secrets/credential-uds
+          name: credential-socket
+        - mountPath: /var/run/secrets/workload-spiffe-credentials
+          name: workload-certs
+        {{- if eq (include "controller.jwtPolicy" .) "third-party-jwt" }}
+        - name: istio-token
+          mountPath: /var/run/secrets/tokens
+          readOnly: true
+        {{- end }}
+        - name: config
+          mountPath: /etc/istio/config
+        - name: higress-ca-root-cert
+          mountPath: /var/run/secrets/istio
+        - name: istio-data
+          mountPath: /var/lib/istio/data
+        - name: podinfo
+          mountPath: /etc/istio/pod
+        - name: proxy-socket
+          mountPath: /etc/istio/proxy
+        {{- if include "skywalking.enabled" . }}
+        - mountPath: /etc/istio/custom-bootstrap
+          name: custom-bootstrap-volume
+        {{- end }}
+        {{- if .Values.global.volumeWasmPlugins }}
+        - mountPath: /opt/plugins
+          name: local-wasmplugins-volume
+        {{- end }}
+        {{- if $o11y.enabled }}
+        - mountPath: /var/log/proxy
+          name: log
+        {{- end }}
+      {{- if $o11y.enabled }}
+        {{- $config := $o11y.promtail }}
+      - name: promtail
+        image: {{ $config.image.repository }}:{{ $config.image.tag }}
+        imagePullPolicy: IfNotPresent
+        args:
+          - -config.file=/etc/promtail/promtail.yaml
+        env:
+          - name: 'HOSTNAME'
+            valueFrom:
+              fieldRef:
+                fieldPath: 'spec.nodeName'
+        ports:
+          - containerPort: {{ $config.port }}
+            name: http-metrics
+            protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: {{ $config.port }}
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        volumeMounts:
+          - name: promtail-config
+            mountPath: "/etc/promtail"
+          - name: log
+            mountPath: /var/log/proxy
+          - name: tmp
+            mountPath: /tmp
+      {{- end }}
+    {{- if .Values.gateway.hostNetwork }}
+    hostNetwork: {{ .Values.gateway.hostNetwork }}
+    dnsPolicy: ClusterFirstWithHostNet
+    {{- end }}
+    {{- with .Values.gateway.nodeSelector }}
+    nodeSelector:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+    {{- with .Values.gateway.affinity }}
+    affinity:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+    {{- with .Values.gateway.tolerations }}
+    tolerations:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+    volumes:
+    - emptyDir: {}
+      name: workload-socket
+    - emptyDir: {}
+      name: credential-socket
+    - emptyDir: {}
+      name: workload-certs
+    {{- if eq (include "controller.jwtPolicy" .) "third-party-jwt" }}
+    - name: istio-token
+      projected:
+        sources:
+          - serviceAccountToken:
+              audience: istio-ca
+              expirationSeconds: 43200
+              path: istio-token
+    {{- end }}
+    - name: higress-ca-root-cert
+      configMap:
+    {{- if .Values.global.enableHigressIstio }}
+        name: istio-ca-root-cert
+    {{- else }}
+        name: higress-ca-root-cert
+    {{- end }}
+    - name: config
+      configMap:
+        name: higress-config
+    {{- if include "skywalking.enabled" . }}
+    - configMap:
+        defaultMode: 420
+        name: higress-custom-bootstrap
+      name: custom-bootstrap-volume
+    {{- end }}
+    - name: istio-data
+      emptyDir: {}
+    - name: proxy-socket
+      emptyDir: {}
+    {{- if $o11y.enabled }}
+    - name: log
+      emptyDir: {}
+    - name: tmp
+      emptyDir: {}
+    - name: promtail-config
+      configMap:
+        name: higress-promtail
+    {{- end }}
+    - name: podinfo
+      downwardAPI:
+        defaultMode: 420
+        items:
+        - fieldRef:
+            apiVersion: v1
+            fieldPath: metadata.labels
+          path: labels
+        - fieldRef:
+            apiVersion: v1
+            fieldPath: metadata.annotations
+          path: annotations
+        - path: cpu-request
+          resourceFieldRef:
+            containerName: higress-gateway
+            divisor: 1m
+            resource: requests.cpu
+        - path: cpu-limit
+          resourceFieldRef:
+            containerName: higress-gateway
+            divisor: 1m
+            resource: limits.cpu
+    {{- if .Values.global.volumeWasmPlugins }}
+    - name: local-wasmplugins-volume
+      hostPath:
+        path: /opt/plugins
+        type: Directory
+    {{- end }}
+{{- end -}}

helm/core/templates/configmap.yaml

@@ -3,9 +3,13 @@
     # Refer to https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md#21-trust-domain
     trustDomain: "cluster.local"
     accessLogEncoding: TEXT
+    {{- if .Values.global.o11y.enabled }}
+    accessLogFile: "/var/log/proxy/access.log"
+    {{- else }}
     accessLogFile: "/dev/stdout"
+    {{- end }}
     ingressControllerMode: "OFF"
-    accessLogFormat: '{"authority":"%REQ(:AUTHORITY)%","bytes_received":"%BYTES_RECEIVED%","bytes_sent":"%BYTES_SENT%","downstream_local_address":"%DOWNSTREAM_LOCAL_ADDRESS%","downstream_remote_address":"%DOWNSTREAM_REMOTE_ADDRESS%","duration":"%DURATION%","istio_policy_status":"%DYNAMIC_METADATA(istio.mixer:status)%","method":"%REQ(:METHOD)%","path":"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%","protocol":"%PROTOCOL%","request_id":"%REQ(X-REQUEST-ID)%","requested_server_name":"%REQUESTED_SERVER_NAME%","response_code":"%RESPONSE_CODE%","response_flags":"%RESPONSE_FLAGS%","route_name":"%ROUTE_NAME%","start_time":"%START_TIME%","trace_id":"%REQ(X-B3-TRACEID)%","upstream_cluster":"%UPSTREAM_CLUSTER%","upstream_host":"%UPSTREAM_HOST%","upstream_local_address":"%UPSTREAM_LOCAL_ADDRESS%","upstream_service_time":"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%","upstream_transport_failure_reason":"%UPSTREAM_TRANSPORT_FAILURE_REASON%","user_agent":"%REQ(USER-AGENT)%","x_forwarded_for":"%REQ(X-FORWARDED-FOR)%"}
+    accessLogFormat: '{"authority":"%REQ(X-ENVOY-ORIGINAL-HOST?:AUTHORITY)%","bytes_received":"%BYTES_RECEIVED%","bytes_sent":"%BYTES_SENT%","downstream_local_address":"%DOWNSTREAM_LOCAL_ADDRESS%","downstream_remote_address":"%DOWNSTREAM_REMOTE_ADDRESS%","duration":"%DURATION%","istio_policy_status":"%DYNAMIC_METADATA(istio.mixer:status)%","method":"%REQ(:METHOD)%","path":"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%","protocol":"%PROTOCOL%","request_id":"%REQ(X-REQUEST-ID)%","requested_server_name":"%REQUESTED_SERVER_NAME%","response_code":"%RESPONSE_CODE%","response_flags":"%RESPONSE_FLAGS%","route_name":"%ROUTE_NAME%","start_time":"%START_TIME%","trace_id":"%REQ(X-B3-TRACEID)%","upstream_cluster":"%UPSTREAM_CLUSTER%","upstream_host":"%UPSTREAM_HOST%","upstream_local_address":"%UPSTREAM_LOCAL_ADDRESS%","upstream_service_time":"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%","upstream_transport_failure_reason":"%UPSTREAM_TRANSPORT_FAILURE_REASON%","user_agent":"%REQ(USER-AGENT)%","x_forwarded_for":"%REQ(X-FORWARDED-FOR)%","response_code_details":"%RESPONSE_CODE_DETAILS%"}
 
     '
     dnsRefreshRate: 200s
@@ -28,6 +32,10 @@
       - address: "k8s://"
     {{- end }}
 
+    mseIngressGlobalConfig:
+      enableH3: {{ .Values.global.enableH3 }}
+      enableProxyProtocol: {{ .Values.global.enableProxyProtocol }}
+
     defaultConfig:
       {{- if .Values.global.disableAlpnH2 }}
       disableAlpnH2: true
@@ -42,10 +50,6 @@
           address: {{ .Values.global.tracer.lightstep.address }}
           # Access Token used to communicate with the Satellite pool
           accessToken: {{ .Values.global.tracer.lightstep.accessToken }}
-      {{- else if eq .Values.global.proxy.tracer "zipkin" }}
-        zipkin:
-          # Address of the Zipkin collector
-          address: {{ .Values.global.tracer.zipkin.address | default (print "zipkin." .Release.Namespace ":9411") }}
       {{- else if eq .Values.global.proxy.tracer "datadog" }}
         datadog:
           # Address of the Datadog Agent
@@ -84,7 +88,7 @@
       {{- if .Values.global.enableHigressIstio }}
       discoveryAddress: {{ printf "istiod.%s.svc" .Values.global.istioNamespace }}:15012
       {{- else }}
-      discoveryAddress: higress-controller.{{.Release.Namespace}}.svc:15012
+      discoveryAddress: {{ include "controller.name" . }}.{{.Release.Namespace}}.svc:15012
       {{- end }}
       {{- end }}
       proxyStatsMatcher:
@@ -105,7 +109,17 @@ metadata:
   labels:
     {{- include "gateway.labels" . | nindent 4 }}    
 data:
-
+  higress: |-
+    {{- $existingConfig := lookup "v1" "ConfigMap" .Release.Namespace "higress-config" }}
+    {{- $existingData := dict }}
+    {{- if $existingConfig }}
+    {{- $existingData = index $existingConfig.data "higress" | default "{}" | fromYaml }}
+    {{- end }}
+    {{- $newData := dict }}
+    {{- if and (hasKey .Values "tracing") .Values.tracing.enable }}
+    {{- $_ := set $newData "tracing" .Values.tracing }}
+    {{- end }}
+    {{- toYaml (merge $existingData $newData) | nindent 4 }}
   # Configuration file for the mesh networks to be used by the Split Horizon EDS.
   meshNetworks: |-
   {{- if .Values.global.meshNetworks }}
@@ -141,44 +155,12 @@ data:
             "transport_api_version": "V3",
             "grpc_service": {
               "envoy_grpc": {
-                "cluster_name": "service_skywalking"
+                "cluster_name": "outbound|{{ .Values.tracing.skywalking.port }}||{{ .Values.tracing.skywalking.service }}"
               }
             }
           }
         }
-      ],
-      "static_resources": {
-        "clusters": [
-          {
-            "name": "service_skywalking",
-            "type": "LOGICAL_DNS",
-            "connect_timeout": "5s",
-            "http2_protocol_options": {
-            },
-            "dns_lookup_family": "V4_ONLY",
-            "lb_policy": "ROUND_ROBIN",
-            "load_assignment": {
-              "cluster_name": "service_skywalking",
-              "endpoints": [
-                {
-                  "lb_endpoints": [
-                    {
-                      "endpoint": {
-                        "address": {
-                          "socket_address": {
-                            "address": "{{ .Values.skywalking.service.address }}",
-                            "port_value": "{{ .Values.skywalking.service.port }}"
-                          }
-                        }
-                      }
-                    }
-                  ]
-                }
-              ]
-            }
-          }
-        ]
-      }
+      ]
     }
 ---
 {{- end }}

helm/core/templates/controller-clusterrole.yaml

@@ -9,7 +9,7 @@ rules:
   # ingress controller
   - apiGroups: ["extensions", "networking.k8s.io"]
     resources: ["ingresses"]
-    verbs: ["get", "list", "watch"]
+    verbs: ["create", "get", "list", "watch", "update", "delete", "patch"]
   - apiGroups: ["extensions", "networking.k8s.io"]
     resources: ["ingresses/status"]
     verbs: ["*"]
@@ -26,17 +26,22 @@ rules:
     verbs: ["create", "get", "list", "watch", "update"]
 
   # Use for Kubernetes Service APIs
-  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
+  - apiGroups: ["networking.x-k8s.io"]
     resources: ["*"]
     verbs: ["get", "watch", "list"]
-  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
+  - apiGroups: ["networking.x-k8s.io"]
     resources: ["*"] # TODO: should be on just */status but wildcard is not supported
     verbs: ["update"]
 
+  # Gateway api controller
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources: ["*"]
+    verbs: ["get", "watch", "list", "create", "update", "delete", "patch"]
+
   # Needed for multicluster secret reading, possibly ingress certs in the future
   - apiGroups: [""]
     resources: ["secrets"]
-    verbs: ["get", "watch", "list"]
+    verbs: ["get", "watch", "list", "create", "update", "delete", "patch"]
 
   - apiGroups: ["networking.higress.io"]
     resources: ["mcpbridges"]
@@ -61,12 +66,12 @@ rules:
 
   # discovery and routing
   - apiGroups: [""]
-    resources: ["pods", "nodes", "services", "namespaces", "endpoints"]
+    resources: ["pods", "nodes", "services", "namespaces", "endpoints", "deployments"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["discovery.k8s.io"]
     resources: ["endpointslices"]
     verbs: ["get", "list", "watch"]
-    
+
   # Istiod and bootstrap.
   - apiGroups: ["certificates.k8s.io"]
     resources:
@@ -100,7 +105,7 @@ rules:
   - apiGroups: ["multicluster.x-k8s.io"]
     resources: ["serviceimports"]
     verbs: ["get", "watch", "list"]
-    
+
   # sidecar injection controller
   - apiGroups: ["admissionregistration.k8s.io"]
     resources: ["mutatingwebhookconfigurations"]
@@ -123,4 +128,4 @@ rules:
     resources: ["ingresses"]
   - apiGroups: ["networking.internal.knative.dev"]
     resources: ["ingresses/status"]
-    verbs: ["get","patch","update"]
+    verbs: ["get","patch","update"]

helm/core/templates/controller-deployment.yaml

@@ -26,9 +26,70 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "controller.serviceAccountName" . }}
+      {{- if .Values.global.priorityClassName }}
+      priorityClassName: "{{ .Values.global.priorityClassName }}"
+      {{- end }}
       securityContext:
         {{- toYaml .Values.controller.podSecurityContext | nindent 8 }}
       containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.controller.securityContext | nindent 12 }}
+          image: "{{ .Values.controller.hub | default .Values.global.hub }}/{{ .Values.controller.image | default "higress" }}:{{ .Values.controller.tag | default .Chart.AppVersion }}"
+          args:
+          - "serve"
+          - --gatewaySelectorKey=higress
+          - --gatewaySelectorValue={{ .Release.Namespace }}-{{ include "gateway.name" . }}
+          - --gatewayHttpPort={{ .Values.gateway.httpPort }}
+          - --gatewayHttpsPort={{ .Values.gateway.httpsPort }}
+          {{- if not .Values.global.enableStatus }}
+          - --enableStatus={{ .Values.global.enableStatus }}
+          {{- end }}
+          - --ingressClass={{ .Values.global.ingressClass }}
+          {{- if .Values.global.watchNamespace }}
+          - --watchNamespace={{ .Values.global.watchNamespace }}
+          {{- end }}
+          - --enableAutomaticHttps={{ .Values.controller.automaticHttps.enabled }}
+          - --automaticHttpsEmail={{ .Values.controller.automaticHttps.email }}
+          env:
+          - name: POD_NAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.name
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: metadata.namespace
+          - name: SERVICE_ACCOUNT
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: spec.serviceAccountName
+          - name: DOMAIN_SUFFIX
+            value: {{ .Values.global.proxy.clusterDomain }}
+          {{- if .Values.controller.env }}
+          {{- range $key, $val := .Values.controller.env }}
+          - name: {{ $key }}
+            value: "{{ $val }}"
+          {{- end }}
+          {{- end }}
+          ports:
+            {{- range $idx, $port := .Values.controller.ports }}
+            - name: {{ $port.name }}
+              containerPort: {{ $port.port }}
+              protocol: {{ $port.protocol }}
+            {{- end }}
+          readinessProbe:
+            {{- toYaml .Values.controller.probe | nindent 12 }}
+          {{- if not (or .Values.global.local .Values.global.kind) }}
+          resources:
+            {{- toYaml .Values.controller.resources | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+          - name: log
+            mountPath: /var/log
 {{- if not .Values.global.enableHigressIstio }}
         - name: discovery
           image: "{{ .Values.pilot.hub | default .Values.global.hub }}/{{ .Values.pilot.image | default "pilot" }}:{{ .Values.pilot.tag | default .Chart.AppVersion }}"
@@ -70,6 +131,22 @@ spec:
             periodSeconds: 3
             timeoutSeconds: 5
           env:
+          - name: PILOT_ENABLE_QUIC_LISTENERS
+            value: "true"
+          - name: VALIDATION_WEBHOOK_CONFIG_NAME
+            value: ""
+          - name: ISTIO_DUAL_STACK
+            value: "{{ .Values.global.enableIPv6 }}"
+          - name: PILOT_ENABLE_HEADLESS_SERVICE_POD_LISTENERS
+            value: "false"
+          - name: PILOT_ENABLE_ALPN_FILTER
+            value: "false"
+          - name: ENABLE_OPTIMIZED_CONFIG_REBUILD
+            value: "false"
+          - name: PILOT_ENABLE_K8S_SELECT_WORKLOAD_ENTRIES
+            value: "false"
+          - name: HIGRESS_SYSTEM_NS
+            value: "{{ .Release.Namespace }}"
           - name: DEFAULT_UPSTREAM_CONCURRENCY_THRESHOLD
             value: "{{ .Values.global.defaultUpstreamConcurrencyThreshold }}"
           - name: ISTIO_GPRC_MAXRECVMSGSIZE
@@ -187,62 +264,6 @@ spec:
             mountPath: /cacerts
           {{- end }}
 {{- end }}
-        - name: {{ .Chart.Name }}
-          securityContext:
-            {{- toYaml .Values.controller.securityContext | nindent 12 }}
-          image: "{{ .Values.controller.hub | default .Values.global.hub }}/{{ .Values.controller.image | default "higress" }}:{{ .Values.controller.tag | default .Chart.AppVersion }}"
-          args:
-          - "serve"
-          - --gatewaySelectorKey=higress
-          - --gatewaySelectorValue={{ .Release.Namespace }}-{{ include "gateway.name" . }}
-          - --gatewayHttpPort={{ .Values.gateway.httpPort }}
-          - --gatewayHttpsPort={{ .Values.gateway.httpsPort }}
-          {{- if not .Values.global.enableStatus }}
-          - --enableStatus={{ .Values.global.enableStatus }}
-          {{- end }}
-          - --ingressClass={{ .Values.global.ingressClass }}
-          {{- if .Values.global.watchNamespace }}
-          - --watchNamespace={{ .Values.global.watchNamespace }}
-          {{- end }}
-          env:
-          - name: POD_NAME
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.name
-          - name: POD_NAMESPACE
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.namespace
-          - name: SERVICE_ACCOUNT
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: spec.serviceAccountName
-          - name: DOMAIN_SUFFIX
-            value: {{ .Values.global.proxy.clusterDomain }}
-          {{- if .Values.controller.env }}
-          {{- range $key, $val := .Values.controller.env }}
-          - name: {{ $key }}
-            value: "{{ $val }}"
-          {{- end }}
-          {{- end }}
-          ports:
-            {{- range $idx, $port := .Values.controller.ports }}
-            - name: {{ $port.name }}
-              containerPort: {{ $port.port }}
-              protocol: {{ $port.protocol }}
-            {{- end }}
-          readinessProbe:
-            {{- toYaml .Values.controller.probe | nindent 12 }}
-          {{- if not (or .Values.global.local .Values.global.kind) }}
-          resources:
-            {{- toYaml .Values.controller.resources | nindent 12 }}
-          {{- end }}
-          volumeMounts:
-          - name: log
-            mountPath: /var/log
       {{- with .Values.controller.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

helm/core/templates/daemonset.yaml

@@ -0,0 +1,29 @@
+{{- if eq .Values.gateway.kind "DaemonSet" -}}
+{{- $o11y := .Values.global.o11y  }}
+{{- $unprivilegedPortSupported := true }}
+{{- range $index, $node := (lookup "v1" "Node" "default" "").items }}
+    {{- $kernelVersion := $node.status.nodeInfo.kernelVersion }}
+    {{- if $kernelVersion }}
+      {{- $kernelVersion = regexFind "^(\\d+\\.\\d+\\.\\d+)" $kernelVersion }}
+      {{- if and $kernelVersion (semverCompare "<4.11.0" $kernelVersion) }}
+      {{- $unprivilegedPortSupported = false }}
+      {{- end }}
+    {{- end }}
+{{- end -}}
+{{- $_ := set .Values.gateway "unprivilegedPortSupported" $unprivilegedPortSupported -}}
+
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "gateway.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "gateway.labels" . | nindent 4}}
+  annotations:
+    {{- .Values.gateway.annotations | toYaml | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "gateway.selectorLabels" . | nindent 6 }}
+  {{- include "gateway.podTemplate" $ | nindent 2 -}}
+{{- end }}

helm/core/templates/deployment.yaml

@@ -1,13 +1,16 @@
+{{- if eq .Values.gateway.kind "Deployment" -}}
 {{- $unprivilegedPortSupported := true }}
 {{- range $index, $node := (lookup "v1" "Node" "default" "").items }}
     {{- $kernelVersion := $node.status.nodeInfo.kernelVersion }}
     {{- if $kernelVersion }}
       {{- $kernelVersion = regexFind "^(\\d+\\.\\d+\\.\\d+)" $kernelVersion }}
       {{- if and $kernelVersion (semverCompare "<4.11.0" $kernelVersion) }}
-      {{-   $unprivilegedPortSupported = false }}
+      {{- $unprivilegedPortSupported = false }}
       {{- end }}
     {{- end }}
 {{- end -}}
+{{- $_ := set .Values.gateway "unprivilegedPortSupported" $unprivilegedPortSupported -}}
+
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -36,253 +39,7 @@ spec:
       {{- else }}
       maxUnavailable: {{ .Values.gateway.rollingMaxUnavailable }}
       {{- end }}
-  template:
-    metadata:
-      annotations:
-      {{- if .Values.global.enableHigressIstio }}
-        "enableHigressIstio": "true"
-      {{- end }}
-      {{- if .Values.gateway.podAnnotations }}
-        {{- toYaml .Values.gateway.podAnnotations | nindent 8 }}
-      {{- end }}
-      labels:
-        sidecar.istio.io/inject: "false"
-        {{- with .Values.gateway.revision }}
-        istio.io/rev: {{ . }}
-        {{- end }}
-        {{- include "gateway.selectorLabels" . | nindent 8 }}
-    spec:
-      {{- with .Values.gateway.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "gateway.serviceAccountName" . }}
-      securityContext:
-      {{- if .Values.gateway.securityContext }}
-        {{- toYaml .Values.gateway.securityContext | nindent 8 }}
-      {{- else if and $unprivilegedPortSupported (and (not .Values.gateway.hostNetwork) (semverCompare ">=1.22-0" .Capabilities.KubeVersion.GitVersion)) }}
-        # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
-        sysctls:
-        - name: net.ipv4.ip_unprivileged_port_start
-          value: "0"
-      {{- end }}
-      containers:
-        - name: higress-gateway
-          image: "{{ .Values.gateway.hub | default .Values.global.hub }}/{{ .Values.gateway.image | default "gateway" }}:{{ .Values.gateway.tag | default .Chart.AppVersion }}"
-          args:
-            - proxy
-            - router
-            - --domain
-            - $(POD_NAMESPACE).svc.cluster.local
-            - --proxyLogLevel=warning
-            - --proxyComponentLogLevel=misc:error
-            - --log_output_level=all:info
-            - --serviceCluster=higress-gateway
-          securityContext:
-          {{- if .Values.gateway.containerSecurityContext }}
-            {{- toYaml .Values.gateway.containerSecurityContext | nindent 12 }}
-          {{- else if and $unprivilegedPortSupported (and (not .Values.gateway.hostNetwork) (semverCompare ">=1.22-0" .Capabilities.KubeVersion.GitVersion)) }}
-            # Safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326
-            capabilities:
-              drop:
-              - ALL
-            allowPrivilegeEscalation: false
-            privileged: false
-            readOnlyRootFilesystem: true
-            runAsUser: 1337
-            runAsGroup: 1337
-            runAsNonRoot: true
-          {{- else }}
-            capabilities:
-              drop:
-              - ALL
-              add:
-              - NET_BIND_SERVICE
-            runAsUser: 0
-            runAsGroup: 1337
-            runAsNonRoot: false
-            allowPrivilegeEscalation: true
-            readOnlyRootFilesystem: true
-          {{- end }}
-          env:
-          - name: NODE_NAME
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: spec.nodeName
-          - name: POD_NAME
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.name
-          - name: POD_NAMESPACE
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: metadata.namespace
-          - name: INSTANCE_IP
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: status.podIP
-          - name: HOST_IP
-            valueFrom:
-              fieldRef:
-                apiVersion: v1
-                fieldPath: status.hostIP
-          - name: SERVICE_ACCOUNT
-            valueFrom:
-              fieldRef:
-                fieldPath: spec.serviceAccountName
-          - name: PILOT_XDS_SEND_TIMEOUT
-            value: 60s
-          - name: PROXY_XDS_VIA_AGENT
-            value: "true"
-          - name: ENABLE_INGRESS_GATEWAY_SDS
-            value: "false"
-          - name: JWT_POLICY
-            value: {{ include "controller.jwtPolicy" . }}
-          - name: ISTIO_META_HTTP10
-            value: "1"
-          - name: ISTIO_META_CLUSTER_ID
-            value: "{{ $.Values.clusterName | default `Kubernetes` }}"
-          - name: INSTANCE_NAME
-            value: "higress-gateway"
-          {{- if include "skywalking.enabled" . }}
-          - name: ISTIO_BOOTSTRAP_OVERRIDE
-            value: /etc/istio/custom-bootstrap/custom_bootstrap.json
-          {{- end }}
-          {{- with .Values.gateway.networkGateway }}
-          - name: ISTIO_META_REQUESTED_NETWORK_VIEW
-            value: "{{.}}"
-          {{- end }}
-          {{- range $key, $val := .Values.env }}
-          - name: {{ $key }}
-            value: {{ $val | quote }}
-          {{- end }}
-          ports:
-          - containerPort: 15090
-            protocol: TCP
-            name: http-envoy-prom
-          {{- if or .Values.global.local .Values.global.kind }}
-          - containerPort: {{ .Values.gateway.httpPort }}
-            hostPort:  {{ .Values.gateway.httpPort }}
-            name: http
-            protocol: TCP
-          - containerPort:  {{ .Values.gateway.httpsPort }}
-            hostPort:  {{ .Values.gateway.httpsPort }}
-            name: https
-            protocol: TCP
-          {{- end }}
-          readinessProbe:
-            failureThreshold: {{ .Values.gateway.readinessFailureThreshold }}
-            httpGet:
-              path: /healthz/ready
-              port: 15021
-              scheme: HTTP
-            initialDelaySeconds: {{ .Values.gateway.readinessInitialDelaySeconds }}
-            periodSeconds: {{ .Values.gateway.readinessPeriodSeconds }}
-            successThreshold: {{ .Values.gateway.readinessSuccessThreshold }}
-            timeoutSeconds: {{ .Values.gateway.readinessTimeoutSeconds }}
-          {{- if not (or .Values.global.local .Values.global.kind) }}
-          resources:
-            {{- toYaml .Values.gateway.resources | nindent 12 }}
-          {{- end }}
-          volumeMounts:
-          {{- if eq (include "controller.jwtPolicy" .) "third-party-jwt" }}
-          - name: istio-token
-            mountPath: /var/run/secrets/tokens
-            readOnly: true
-          {{- end }}
-          - name: config
-            mountPath: /etc/istio/config
-          - name: istio-ca-root-cert
-            mountPath: /var/run/secrets/istio
-          - name: istio-data
-            mountPath: /var/lib/istio/data
-          - name: podinfo            
-            mountPath: /etc/istio/pod
-          - name: proxy-socket
-            mountPath: /etc/istio/proxy
-          {{- if include "skywalking.enabled" . }}
-          - mountPath: /etc/istio/custom-bootstrap
-            name: custom-bootstrap-volume
-          {{- end }}
-          {{- if .Values.global.volumeWasmPlugins }}
-          - mountPath: /opt/plugins
-            name: local-wasmplugins-volume
-          {{- end }}
-      {{- if .Values.gateway.hostNetwork }}
-      hostNetwork: {{ .Values.gateway.hostNetwork }}
-      dnsPolicy: ClusterFirstWithHostNet
-      {{- end }}
-      {{- with .Values.gateway.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.gateway.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.gateway.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      volumes:
-      {{- if eq (include "controller.jwtPolicy" .) "third-party-jwt" }}
-      - name: istio-token
-        projected:
-          sources:
-            - serviceAccountToken:
-                audience: istio-ca
-                expirationSeconds: 43200
-                path: istio-token
-      {{- end }}
-      - name: istio-ca-root-cert
-        configMap:
-      {{- if .Values.global.enableHigressIstio }}
-          name: istio-ca-root-cert
-      {{- else }}
-          name: higress-ca-root-cert
-      {{- end }}
-      - name: config
-        configMap:
-          name: higress-config
-      {{- if include "skywalking.enabled" . }}
-      - configMap:
-          defaultMode: 420
-          name: higress-custom-bootstrap
-        name: custom-bootstrap-volume
-      {{- end }}
-      - name: istio-data
-        emptyDir: {}
-      - name: proxy-socket
-        emptyDir: {}
-      - name: podinfo
-        downwardAPI:
-          defaultMode: 420
-          items:
-          - fieldRef:
-              apiVersion: v1
-              fieldPath: metadata.labels
-            path: labels
-          - fieldRef:
-              apiVersion: v1
-              fieldPath: metadata.annotations
-            path: annotations
-          - path: cpu-request
-            resourceFieldRef:
-              containerName: higress-gateway
-              divisor: 1m
-              resource: requests.cpu
-          - path: cpu-limit
-            resourceFieldRef:
-              containerName: higress-gateway
-              divisor: 1m
-              resource: limits.cpu
-      {{- if .Values.global.volumeWasmPlugins }}
-      - name: local-wasmplugins-volume
-        hostPath:
-          path: /opt/plugins
-          type: Directory
-      {{- end }}
+
+  {{- include "gateway.podTemplate" $ | nindent 2 -}}
+
+{{- end }}

helm/core/templates/ingressclass.yaml

@@ -0,0 +1,6 @@
+apiVersion: networking.k8s.io/v1
+kind: IngressClass
+metadata:
+  name: {{ .Values.global.ingressClass }}
+spec:
+  controller: higress.io/higress-controller