Add security schema for nacos mcp (#2847)

Signed-off-by: Xijun Dai <daixijun1990@gmail.com>

.github/workflows/build-and-push-wasm-plugin-image.yaml

@@ -0,0 +1,153 @@
+name: Build and Push Wasm Plugin Image
+
+on:
+  push:
+    tags:
+      - "wasm-*-*-v*.*.*" # 匹配 wasm-{go|rust}-{pluginName}-vX.Y.Z 格式的标签
+  workflow_dispatch:
+    inputs:
+      plugin_type:
+        description: "Type of the plugin"
+        required: true
+        type: choice
+        options:
+          - go
+          - rust
+      plugin_name:
+        description: "Name of the plugin"
+        required: true
+        type: string
+      version:
+        description: "Version of the plugin (optional, without leading v)"
+        required: false
+        type: string
+
+jobs:
+  build-and-push-wasm-plugin-image:
+    runs-on: ubuntu-latest
+    environment:
+      name: image-registry-msg
+    env:
+      IMAGE_REGISTRY_SERVICE: ${{ vars.IMAGE_REGISTRY || 'higress-registry.cn-hangzhou.cr.aliyuncs.com' }}
+      IMAGE_REPOSITORY: ${{ vars.PLUGIN_IMAGE_REPOSITORY || 'plugins' }}
+      RUST_VERSION: 1.82
+      GO_VERSION: 1.24.0
+      ORAS_VERSION: 1.0.0
+    steps:
+      - name: Set plugin_type, plugin_name and version from inputs or ref_name
+        id: set_vars
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            plugin_type="${{ github.event.inputs.plugin_type }}"
+            plugin_name="${{ github.event.inputs.plugin_name }}"
+            version="${{ github.event.inputs.version }}"
+          else
+            ref_name=${{ github.ref_name }}
+            plugin_type=${ref_name#*-} # 删除插件类型前面的字段(wasm-)
+            plugin_type=${plugin_type%%-*} # 删除插件类型后面的字段(-{plugin_name}-vX.Y.Z)
+            plugin_name=${ref_name#*-*-} # 删除插件名前面的字段(wasm-go-)
+            plugin_name=${plugin_name%-*} # 删除插件名后面的字段(-vX.Y.Z)
+            version=$(echo "$ref_name" | awk -F'v' '{print $2}')
+          fi
+          if [[ "$plugin_type" == "rust" ]]; then
+            builder_image="higress-registry.cn-hangzhou.cr.aliyuncs.com/plugins/wasm-rust-builder:rust${{ env.RUST_VERSION }}-oras${{ env.ORAS_VERSION }}"
+          else
+            builder_image="higress-registry.cn-hangzhou.cr.aliyuncs.com/plugins/wasm-go-builder:go${{ env.GO_VERSION }}-oras${{ env.ORAS_VERSION }}"
+          fi
+          echo "PLUGIN_TYPE=$plugin_type" >> $GITHUB_ENV
+          echo "PLUGIN_NAME=$plugin_name" >> $GITHUB_ENV
+          echo "VERSION=$version" >> $GITHUB_ENV
+          echo "BUILDER_IMAGE=$builder_image" >> $GITHUB_ENV
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: File Check
+        run: |
+          workspace=${{ github.workspace }}/plugins/wasm-${PLUGIN_TYPE}/extensions/${PLUGIN_NAME}
+          push_command="./plugin.tar.gz:application/vnd.oci.image.layer.v1.tar+gzip"
+
+          # 查找spec.yaml
+          if [ -f "${workspace}/spec.yaml" ]; then
+            echo "spec.yaml exists"
+            push_command="./spec.yaml:application/vnd.module.wasm.spec.v1+yaml $push_command "
+          fi
+
+          # 查找README.md
+          if [ -f "${workspace}/README.md" ];then
+              echo "README.md exists"
+              push_command="./README.md:application/vnd.module.wasm.doc.v1+markdown $push_command "
+          fi
+
+          # 查找README_{lang}.md
+          for file in ${workspace}/README_*.md; do
+            if [ -f "$file" ]; then
+              file_name=$(basename $file)
+              echo "$file_name exists"
+              lang=$(basename $file | sed 's/README_//; s/.md//')
+              push_command="./$file_name:application/vnd.module.wasm.doc.v1.$lang+markdown $push_command "
+            fi
+          done
+
+          echo "PUSH_COMMAND=\"$push_command\"" >> $GITHUB_ENV
+
+      - name: Run a wasm-builder
+        env:
+          PLUGIN_NAME: ${{ env.PLUGIN_NAME }}
+          BUILDER_IMAGE: ${{ env.BUILDER_IMAGE }}
+        run: |
+          docker run -itd --name builder -v ${{ github.workspace }}:/workspace -e PLUGIN_NAME=${{ env.PLUGIN_NAME }} --rm ${{ env.BUILDER_IMAGE }} /bin/bash
+
+      - name: Build Image and Push
+        run: |
+          push_command=${{ env.PUSH_COMMAND }}
+          push_command=${push_command#\"}
+          push_command=${push_command%\"} # 删除PUSH_COMMAND中的双引号，确保oras push正常解析
+
+          target_image="${{ env.IMAGE_REGISTRY_SERVICE }}/${{ env.IMAGE_REPOSITORY}}/${{ env.PLUGIN_NAME }}:${{ env.VERSION }}"
+          target_image_latest="${{ env.IMAGE_REGISTRY_SERVICE }}/${{ env.IMAGE_REPOSITORY}}/${{ env.PLUGIN_NAME }}:latest"
+          echo "TargetImage=${target_image}"
+          echo "TargetImageLatest=${target_image_latest}"
+
+          cd ${{ github.workspace }}/plugins/wasm-${PLUGIN_TYPE}/extensions/${PLUGIN_NAME}
+          if [ -f ./.buildrc ]; then
+            echo 'Found .buildrc file, sourcing it...'
+            . ./.buildrc
+          else
+            echo '.buildrc file not found'
+          fi
+          echo "EXTRA_TAGS=${EXTRA_TAGS}"
+          if [ "${PLUGIN_TYPE}" == "go" ]; then
+          command="
+          set -e
+          cd /workspace/plugins/wasm-go/extensions/${PLUGIN_NAME}
+          go mod tidy
+          GOOS=wasip1 GOARCH=wasm go build -buildmode=c-shared -o plugin.wasm .
+          tar czvf plugin.tar.gz plugin.wasm
+          echo ${{ secrets.REGISTRY_PASSWORD }} | oras login -u ${{ secrets.REGISTRY_USERNAME }} --password-stdin ${{ env.IMAGE_REGISTRY_SERVICE }}
+          oras push ${target_image} ${push_command}
+          oras push ${target_image_latest} ${push_command}
+          "
+          elif [ "${PLUGIN_TYPE}" == "rust" ]; then
+          command="
+          set -e
+          cd /workspace/plugins/wasm-rust/extensions/${PLUGIN_NAME}
+          if [ -f ./.prebuild ]; then
+            echo 'Found .prebuild file, sourcing it...'
+            . ./.prebuild
+          fi
+          rustup target add wasm32-wasip1
+          cargo build --target wasm32-wasip1 --release
+          cp target/wasm32-wasip1/release/*.wasm plugin.wasm
+          tar czvf plugin.tar.gz plugin.wasm
+          echo ${{ secrets.REGISTRY_PASSWORD }} | oras login -u ${{ secrets.REGISTRY_USERNAME }} --password-stdin ${{ env.IMAGE_REGISTRY_SERVICE }}
+          oras push ${target_image} ${push_command}
+          oras push ${target_image_latest} ${push_command}
+          "
+          else
+
+          command="
+          echo "unkown type ${PLUGIN_TYPE}"
+          "
+          fi
+          docker exec builder bash -c "$command"

.github/workflows/build-and-test-plugin.yaml

@@ -2,24 +2,29 @@ name: "Build and Test Plugins"
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
     paths:
-      - 'plugins/**'
-      - 'test/**'
+      - "plugins/**"
+      - "test/**"
+      - "helm/**"
+      - "Makefile.core.mk"
   pull_request:
-    branches: [ "*" ]
+    branches: ["*"]
     paths:
-      - 'plugins/**'
-      - 'test/**'
+      - "plugins/**"
+      - "test/**"
+      - "helm/**"
+      - "Makefile.core.mk"
+  workflow_dispatch: ~
 
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
         with:
-          go-version: 1.19
+          go-version: 1.24
     # There are too many lint errors in current code bases
     # uncomment when we decide what lint should be addressed or ignored.
     # - run: make lint
@@ -29,9 +34,9 @@ jobs:
     strategy:
       matrix:
         # TODO(Xunzhuo): Enable C WASM Filters in CI
-        wasmPluginType: [ GO ]
+        wasmPluginType: [GO, RUST]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Free Up GitHub Actions Ubuntu Runner Disk Space 🔧
         uses: jlumbroso/free-disk-space@main
@@ -41,15 +46,20 @@ jobs:
           dotnet: true
           haskell: true
           large-packages: true
-          swap-storage: true      
+          swap-storage: true
 
       - name: "Setup Go"
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: 1.19
+          go-version: 1.24
 
+      - name: Setup Rust
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+        if: matrix.wasmPluginType == 'RUST'
       - name: Setup Golang Caches
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |-
             ~/.cache/go-build
@@ -58,14 +68,6 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-go
 
-      - name: Setup Submodule Caches
-        uses: actions/cache@v3
-        with:
-          path: |-
-            .git/modules
-          key: ${{ runner.os }}-submodules-cache-${{ github.run_id }}
-          restore-keys: ${{ runner.os }}-submodules-cache
-
       - run: git stash # restore patch
 
       - name: "Run Ingress WasmPlugins Tests"
@@ -78,6 +80,6 @@ jobs:
 
   publish:
     runs-on: ubuntu-latest
-    needs: [ higress-wasmplugin-test ]
+    needs: [higress-wasmplugin-test]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4

.github/workflows/build-and-test.yaml

@@ -10,10 +10,10 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-go@v3
+    - uses: actions/checkout@v4
+    - uses: actions/setup-go@v5
       with:
-        go-version: 1.19
+        go-version: 1.22
     # There are too many lint errors in current code bases
     # uncomment when we decide what lint should be addressed or ignored.
     # - run: make lint
@@ -21,10 +21,15 @@ jobs:
   coverage-test:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
+
+    - name: "Setup Go"
+      uses: actions/setup-go@v5
+      with:
+        go-version: 1.22
 
     - name: Setup Golang Caches
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: |-
           ~/.cache/go-build
@@ -32,21 +37,15 @@ jobs:
         key: ${{ runner.os }}-go-${{ github.run_id }}
         restore-keys: ${{ runner.os }}-go
 
-    - name: Setup Submodule Caches
-      uses: actions/cache@v3
-      with:
-        path: |-
-            .git/modules
-        key: ${{ runner.os }}-submodules-cache-${{ github.run_id }}
-        restore-keys: ${{ runner.os }}-submodules-cache
-    
     - run: git stash # restore patch
 
     # test
     - name: Run Coverage Tests
-      run: GOPROXY="https://proxy.golang.org,direct" make go.test.coverage
+      run: |-
+        go version
+        GOPROXY="https://proxy.golang.org,direct" make go.test.coverage
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@v4
       with:
         fail_ci_if_error: false
         files: ./coverage.xml
@@ -58,17 +57,17 @@ jobs:
     needs: [lint,coverage-test]
     steps:
       - name: "Checkout ${{ github.ref }}"
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 2
 
       - name: "Setup Go"
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: 1.19
+          go-version: 1.22
 
       - name: Setup Golang Caches
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |-
             ~/.cache/go-build
@@ -76,21 +75,13 @@ jobs:
           key: ${{ runner.os }}-go-${{ github.run_id }}
           restore-keys: ${{ runner.os }}-go
 
-      - name: Setup Submodule Caches
-        uses: actions/cache@v3
-        with:
-          path: |-
-            .git/modules
-          key: ${{ runner.os }}-submodules-cache-${{ github.run_id }}
-          restore-keys: ${{ runner.os }}-submodules-cache
-
       - run: git stash # restore patch
 
       - name: "Build Higress Binary"
         run: GOPROXY="https://proxy.golang.org,direct" make build
 
       - name: Upload Higress Binary
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: higress
           path: out/
@@ -105,30 +96,31 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
+
+    - name: Free Up GitHub Actions Ubuntu Runner Disk Space 🔧
+      uses: jlumbroso/free-disk-space@main
+      with:
+        tool-cache: false
+        android: true
+        dotnet: true
+        haskell: true
+        large-packages: true
+        swap-storage: true
       
     - name: "Setup Go"
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v5
       with:
-        go-version: 1.19
+        go-version: 1.22
 
     - name: Setup Golang Caches
-      uses: actions/cache@v3
+      uses: actions/cache@v4
       with:
         path: |-
           ~/.cache/go-build
           ~/go/pkg/mod
         key: ${{ runner.os }}-go-${{ github.run_id }}
-        restore-keys: |
-          ${{ runner.os }}-go
-      
-    - name: Setup Submodule Caches
-      uses: actions/cache@v3
-      with:
-        path: |-
-            .git/modules
-        key: ${{ runner.os }}-submodules-cache-${{ github.run_id }}
-        restore-keys: ${{ runner.os }}-submodules-cache
+        restore-keys: ${{ runner.os }}-go
           
     - run: git stash # restore patch
 
@@ -139,4 +131,4 @@ jobs:
     runs-on: ubuntu-latest
     needs: [higress-conformance-test,gateway-conformance-test]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4

.github/workflows/build-image-and-push.yaml

@@ -1,237 +1,258 @@
-name: Build Docker Images and Push to Image Registry
-
-on:
-  push:
-    tags:
-    - "v*.*.*"
-  workflow_dispatch: ~
-
-jobs:
-  build-controller-image:
-    runs-on: ubuntu-latest
-    environment:
-      name: image-registry-controller
-    env:
-      CONTROLLER_IMAGE_REGISTRY: ${{ vars.IMAGE_REGISTRY || 'higress-registry.cn-hangzhou.cr.aliyuncs.com' }}
-      CONTROLLER_IMAGE_NAME: ${{ vars.CONTROLLER_IMAGE_NAME || 'higress/higress' }}
-    steps:
-      - name: "Checkout ${{ github.ref }}"
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 1
-
-      - name: Free Up GitHub Actions Ubuntu Runner Disk Space 🔧
-        uses: jlumbroso/free-disk-space@main
-        with:
-          tool-cache: false
-          android: true
-          dotnet: true
-          haskell: true
-          large-packages: true
-          swap-storage: true
-
-      - name: "Setup Go"
-        uses: actions/setup-go@v3
-        with:
-          go-version: 1.19
-
-      - name: Setup Golang Caches
-        uses: actions/cache@v3
-        with:
-          path: |-
-            ~/.cache/go-build
-            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ github.run_id }}
-          restore-keys: ${{ runner.os }}-go
-
-      - name: Setup Submodule Caches
-        uses: actions/cache@v3
-        with:
-          path: |-
-            envoy
-            istio
-            .git/modules
-          key: ${{ runner.os }}-submodules-new-${{ github.run_id }}
-          restore-keys: ${{ runner.os }}-submodules-new
-
-      - name: Calculate Docker metadata
-        id: docker-meta
-        uses: docker/metadata-action@v4
-        with:
-          images: |
-            ${{ env.CONTROLLER_IMAGE_REGISTRY }}/${{ env.CONTROLLER_IMAGE_NAME }}
-          tags: |
-            type=sha
-            type=ref,event=tag
-            type=semver,pattern={{version}}
-            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
-
-      - name: Login to Docker Registry
-        uses: docker/login-action@v2
-        with:
-          registry: ${{ env.CONTROLLER_IMAGE_REGISTRY }}
-          username: ${{ secrets.REGISTRY_USERNAME }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
-
-      - name: Build Docker Image and Push
-        run: |
-          GOPROXY="https://proxy.golang.org,direct" make docker-buildx-push
-          BUILT_IMAGE="higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/higress"
-          readarray -t IMAGES <<< "${{ steps.docker-meta.outputs.tags }}"
-          for image in ${IMAGES[@]}; do
-            echo "Image: $image"
-            docker buildx imagetools create $BUILT_IMAGE:$GITHUB_SHA --tag $image
-          done
-
-  build-pilot-image:
-    runs-on: ubuntu-latest
-    environment:
-      name: image-registry-pilot
-    env:
-      PILOT_IMAGE_REGISTRY: ${{ vars.IMAGE_REGISTRY || 'higress-registry.cn-hangzhou.cr.aliyuncs.com' }}
-      PILOT_IMAGE_NAME: ${{ vars.PILOT_IMAGE_NAME || 'higress/pilot' }}
-    steps:
-      - name: "Checkout ${{ github.ref }}"
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 1
-
-      - name: Free Up GitHub Actions Ubuntu Runner Disk Space 🔧
-        uses: jlumbroso/free-disk-space@main
-        with:
-          tool-cache: false
-          android: true
-          dotnet: true
-          haskell: true
-          large-packages: true
-          swap-storage: true
-
-      - name: "Setup Go"
-        uses: actions/setup-go@v3
-        with:
-          go-version: 1.19
-
-      - name: Setup Golang Caches
-        uses: actions/cache@v3
-        with:
-          path: |-
-            ~/.cache/go-build
-            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ github.run_id }}
-          restore-keys: ${{ runner.os }}-go
-
-      - name: Setup Submodule Caches
-        uses: actions/cache@v3
-        with:
-          path: |-
-            envoy
-            istio
-            .git/modules
-          key: ${{ runner.os }}-submodules-${{ github.run_id }}
-          restore-keys: ${{ runner.os }}-submodules-new
-
-      - name: Calculate Docker metadata
-        id: docker-meta
-        uses: docker/metadata-action@v4
-        with:
-          images: |
-            ${{ env.PILOT_IMAGE_REGISTRY }}/${{ env.PILOT_IMAGE_NAME }}
-          tags: |
-            type=sha
-            type=ref,event=tag
-            type=semver,pattern={{version}}
-            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
-
-      - name: Login to Docker Registry
-        uses: docker/login-action@v2
-        with:
-          registry: ${{ env.PILOT_IMAGE_REGISTRY }}
-          username: ${{ secrets.REGISTRY_USERNAME }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
-
-      - name: Build Pilot-Discovery Image and Push
-        run: |
-          GOPROXY="https://proxy.golang.org,direct" make build-istio
-          BUILT_IMAGE="higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/pilot"
-          readarray -t IMAGES <<< "${{ steps.docker-meta.outputs.tags }}"
-          for image in ${IMAGES[@]}; do
-            echo "Image: $image"
-            docker buildx imagetools create $BUILT_IMAGE:$GITHUB_SHA --tag $image
-          done
-
-
-  build-gateway-image:
-    runs-on: ubuntu-latest
-    environment:
-      name: image-registry-pilot
-    env:
-      GATEWAY_IMAGE_REGISTRY: ${{ vars.IMAGE_REGISTRY || 'higress-registry.cn-hangzhou.cr.aliyuncs.com' }}
-      GATEWAY_IMAGE_NAME: ${{ vars.GATEWAY_IMAGE_NAME || 'higress/gateway' }}
-    steps:
-      - name: "Checkout ${{ github.ref }}"
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 1
-
-      - name: Free Up GitHub Actions Ubuntu Runner Disk Space 🔧
-        uses: jlumbroso/free-disk-space@main
-        with:
-          tool-cache: false
-          android: true
-          dotnet: true
-          haskell: true
-          large-packages: true
-          swap-storage: true
-
-      - name: "Setup Go"
-        uses: actions/setup-go@v3
-        with:
-          go-version: 1.19
-
-      - name: Setup Golang Caches
-        uses: actions/cache@v3
-        with:
-          path: |-
-            ~/.cache/go-build
-            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ github.run_id }}
-          restore-keys: ${{ runner.os }}-go
-
-      - name: Setup Submodule Caches
-        uses: actions/cache@v3
-        with:
-          path: |-
-            envoy
-            istio
-            .git/modules
-          key: ${{ runner.os }}-submodules-${{ github.run_id }}
-          restore-keys: ${{ runner.os }}-submodules-new
-
-      - name: Calculate Docker metadata
-        id: docker-meta
-        uses: docker/metadata-action@v4
-        with:
-          images: |
-            ${{ env.GATEWAY_IMAGE_REGISTRY }}/${{ env.GATEWAY_IMAGE_NAME }}
-          tags: |
-            type=sha
-            type=ref,event=tag
-            type=semver,pattern={{version}}
-            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
-
-      - name: Login to Docker Registry
-        uses: docker/login-action@v2
-        with:
-          registry: ${{ env.GATEWAY_IMAGE_REGISTRY }}
-          username: ${{ secrets.REGISTRY_USERNAME }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}            
-          
-      - name: Build Gateway Image and Push
-        run: |
-          GOPROXY="https://proxy.golang.org,direct" make build-gateway
-          BUILT_IMAGE="higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/proxyv2"
-          readarray -t IMAGES <<< "${{ steps.docker-meta.outputs.tags }}"
-          for image in ${IMAGES[@]}; do
-            echo "Image: $image"
-            docker buildx imagetools create $BUILT_IMAGE:$GITHUB_SHA --tag $image
-          done
+name: Build Docker Images and Push to Image Registry
+
+on:
+  push:
+    tags:
+    - "v*.*.*"
+  workflow_dispatch: ~
+
+jobs:
+  build-controller-image:
+    runs-on: ubuntu-latest
+    environment:
+      name: image-registry-controller
+    env:
+      CONTROLLER_IMAGE_REGISTRY: ${{ vars.IMAGE_REGISTRY || 'higress-registry.cn-hangzhou.cr.aliyuncs.com' }}
+      CONTROLLER_IMAGE_NAME: ${{ vars.CONTROLLER_IMAGE_NAME || 'higress/higress' }}
+    steps:
+      - name: "Checkout ${{ github.ref }}"
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Free Up GitHub Actions Ubuntu Runner Disk Space 🔧
+        uses: jlumbroso/free-disk-space@main
+        with:
+          tool-cache: false
+          android: true
+          dotnet: true
+          haskell: true
+          large-packages: true
+          swap-storage: true
+
+      - name: "Setup Go"
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.22
+
+      - name: Setup Golang Caches
+        uses: actions/cache@v4
+        with:
+          path: |-
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ github.run_id }}
+          restore-keys: ${{ runner.os }}-go
+
+      - name: Calculate Docker metadata
+        id: docker-meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ env.CONTROLLER_IMAGE_REGISTRY }}/${{ env.CONTROLLER_IMAGE_NAME }}
+          tags: |
+            type=sha
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
+
+      - name: Login to Docker Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.CONTROLLER_IMAGE_REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Build Docker Image and Push
+        run: |
+          BUILT_IMAGE=""
+          readarray -t IMAGES <<< "${{ steps.docker-meta.outputs.tags }}"
+          for image in ${IMAGES[@]}; do
+            echo "Image: $image"
+            if [ "$BUILT_IMAGE" == "" ]; then
+              GOPROXY="https://proxy.golang.org,direct" IMG_URL="$image" make docker-buildx-push
+              BUILT_IMAGE="$image"
+            else
+              docker buildx imagetools create $BUILT_IMAGE --tag $image
+            fi
+          done
+
+  build-pilot-image:
+    runs-on: ubuntu-latest
+    environment:
+      name: image-registry-pilot
+    env:
+      PILOT_IMAGE_REGISTRY: ${{ vars.IMAGE_REGISTRY || 'higress-registry.cn-hangzhou.cr.aliyuncs.com' }}
+      PILOT_IMAGE_NAME: ${{ vars.PILOT_IMAGE_NAME || 'higress/pilot' }}
+    steps:
+      - name: "Checkout ${{ github.ref }}"
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Free Up GitHub Actions Ubuntu Runner Disk Space 🔧
+        uses: jlumbroso/free-disk-space@main
+        with:
+          tool-cache: false
+          android: true
+          dotnet: true
+          haskell: true
+          large-packages: true
+          swap-storage: true
+
+      - name: "Setup Go"
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.22
+
+      - name: Setup Golang Caches
+        uses: actions/cache@v4
+        with:
+          path: |-
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ github.run_id }}
+          restore-keys: ${{ runner.os }}-go
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Cache Docker layers
+        uses: actions/cache@v4
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-
+
+      - name: Calculate Docker metadata
+        id: docker-meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ env.PILOT_IMAGE_REGISTRY }}/${{ env.PILOT_IMAGE_NAME }}
+          tags: |
+            type=sha
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
+
+      - name: Login to Docker Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.PILOT_IMAGE_REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Build Pilot-Discovery Image and Push
+        run: |
+          BUILT_IMAGE=""
+          readarray -t IMAGES <<< "${{ steps.docker-meta.outputs.tags }}"
+          for image in ${IMAGES[@]}; do
+            echo "Image: $image"
+            if [ "$BUILT_IMAGE" == "" ]; then
+              TAG=${image#*:}
+              HUB=${image%:*}
+              HUB=${HUB%/*}
+              BUILT_IMAGE="$HUB/pilot:$TAG"
+              GOPROXY="https://proxy.golang.org,direct" IMG_URL="$BUILT_IMAGE" make build-istio
+            fi
+            if [ "$BUILT_IMAGE" != "$image" ]; then
+              docker buildx imagetools create $BUILT_IMAGE --tag $image
+            fi
+          done
+
+  build-gateway-image:
+    runs-on: ubuntu-latest
+    environment:
+      name: image-registry-gateway
+    env:
+      GATEWAY_IMAGE_REGISTRY: ${{ vars.IMAGE_REGISTRY || 'higress-registry.cn-hangzhou.cr.aliyuncs.com' }}
+      GATEWAY_IMAGE_NAME: ${{ vars.GATEWAY_IMAGE_NAME || 'higress/gateway' }}
+    steps:
+      - name: "Checkout ${{ github.ref }}"
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Free Up GitHub Actions Ubuntu Runner Disk Space 🔧
+        uses: jlumbroso/free-disk-space@main
+        with:
+          tool-cache: false
+          android: true
+          dotnet: true
+          haskell: true
+          large-packages: true
+          swap-storage: true
+
+      - name: "Setup Go"
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.22
+
+      - name: Setup Golang Caches
+        uses: actions/cache@v4
+        with:
+          path: |-
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ github.run_id }}
+          restore-keys: ${{ runner.os }}-go
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          image: tonistiigi/binfmt:qemu-v7.0.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Cache Docker layers
+        uses: actions/cache@v4
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-
+
+      - name: Calculate Docker metadata
+        id: docker-meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ env.GATEWAY_IMAGE_REGISTRY }}/${{ env.GATEWAY_IMAGE_NAME }}
+          tags: |
+            type=sha
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
+
+      - name: Login to Docker Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GATEWAY_IMAGE_REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Build Gateway Image and Push
+        run: |
+          BUILT_IMAGE=""
+          readarray -t IMAGES <<< "${{ steps.docker-meta.outputs.tags }}"
+          for image in ${IMAGES[@]}; do
+            echo "Image: $image"
+            if [ "$BUILT_IMAGE" == "" ]; then
+              TAG=${image#*:}
+              HUB=${image%:*}
+              HUB=${HUB%/*}
+              BUILT_IMAGE="$HUB/proxyv2:$TAG"
+              GOPROXY="https://proxy.golang.org,direct" IMG_URL="$BUILT_IMAGE" make build-gateway
+            fi
+            if [ "$BUILT_IMAGE" != "$image" ]; then
+              docker buildx imagetools create $BUILT_IMAGE --tag $image
+            fi
+          done

.github/workflows/codeql-analysis.yaml

@@ -34,11 +34,11 @@ jobs:
     steps:
       # step 1
       - name: "Checkout repository"
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       # step 2: Initializes the CodeQL tools for scanning.
       - name: "Initialize CodeQL"
-        uses: github/codeql-action/init@v1
+        uses: github/codeql-action/init@v2
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -50,7 +50,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: "Autobuild"
-        uses: github/codeql-action/autobuild@v1
+        uses: github/codeql-action/autobuild@v2
 
       # step 4
       # ℹ️ Command-line programs to run using the OS shell.
@@ -66,4 +66,4 @@ jobs:
 
       # step 5
       - name: "Perform CodeQL Analysis"
-        uses: github/codeql-action/analyze@v1
+        uses: github/codeql-action/analyze@v2

.github/workflows/deploy-standalone-to-oss.yaml

@@ -14,22 +14,22 @@ jobs:
     steps:
       # Step 1
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       # Step 2
       - id: package
         name: Prepare Standalone Package
         run: |
           mkdir ./artifact
-          cp ./tools/get-higress.sh ./artifact
           LOCAL_RELEASE_URL="https://github.com/higress-group/higress-standalone/releases"
           VERSION=$(curl -Ls $LOCAL_RELEASE_URL | grep 'href="/higress-group/higress-standalone/releases/tag/v[0-9]*.[0-9]*.[0-9]*\"' | sed -E 's/.*\/higress-group\/higress-standalone\/releases\/tag\/(v[0-9\.]+)".*/\1/g' | head -1)
           DOWNLOAD_URL="https://github.com/higress-group/higress-standalone/archive/refs/tags/${VERSION}.tar.gz"
           curl -SsL "$DOWNLOAD_URL" -o "./artifact/higress-${VERSION}.tar.gz"
+          curl -SsL "https://raw.githubusercontent.com/higress-group/higress-standalone/refs/heads/main/src/get-higress.sh" -o "./artifact/get-higress.sh"
           echo -n "$VERSION" > ./artifact/VERSION
           echo "Version=$VERSION"
       # Step 3
       - name: Upload to OSS
-        uses: doggycool/ossutil-github-action@master
+        uses: go-choppy/ossutil-github-action@master
         with:
           ossArgs: 'cp -r -u ./artifact/ oss://higress-website-cn-hongkong/standalone/'
           accessKey: ${{ secrets.ACCESS_KEYID }}

.github/workflows/deploy-to-oss.yaml

@@ -14,12 +14,12 @@ jobs:
     steps:
       # Step 1
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       # Step 2
       - name: Download Helm Charts Index
-        uses: doggycool/ossutil-github-action@master
+        uses: go-choppy/ossutil-github-action@master
         with:
-          ossArgs: 'cp -r -u oss://higress-website-cn-hongkong/helm-charts/index.yaml ./artifact/'
+          ossArgs: 'cp oss://higress-website-cn-hongkong/helm-charts/index.yaml ./artifact/'
           accessKey: ${{ secrets.ACCESS_KEYID }}
           accessSecret: ${{ secrets.ACCESS_KEYSECRET }}
           endpoint: oss-cn-hongkong.aliyuncs.com
@@ -46,7 +46,7 @@ jobs:
             sed -i 's/higress\.io/higress\.cn/g' ./artifact/cn-index.yaml
       # Step 5
       - name: Upload to OSS
-        uses: doggycool/ossutil-github-action@master
+        uses: go-choppy/ossutil-github-action@master
         with:
           ossArgs: 'cp -r -u ./artifact/ oss://higress-website-cn-hongkong/helm-charts/'
           accessKey: ${{ secrets.ACCESS_KEYID }}

.github/workflows/generate-release-notes.yaml

@@ -0,0 +1,217 @@
+name: Generate Release Notes
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch: ~
+
+jobs:
+  generate-release-notes:
+    runs-on: ubuntu-latest
+    env:
+      DASHSCOPE_API_KEY: ${{ secrets.HIGRESS_OPENAI_API_KEY }}
+      MODEL_NAME: ${{ secrets.HIGRESS_OPENAI_API_MODEL }}
+      MODEL_SERVER: ${{ secrets.MODEL_SERVER }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.24
+
+      - name: Clone GitHub MCP Server
+        run: |
+          git clone https://github.com/github/github-mcp-server.git
+          cd github-mcp-server
+          go build -o ../github-mcp-serve ./cmd/github-mcp-server
+          cd ..
+          chmod u+x github-mcp-serve
+
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.10"
+
+      - name: Clone Higress Report Agent
+        run: |
+          git clone https://github.com/higress-group/higress-report-agent.git
+          mv github-mcp-serve higress-report-agent/
+
+      - name: Clean up old release notes
+        run: |
+          RELEASE_VERSION=$(cat ${GITHUB_WORKSPACE}/VERSION)
+          CLEAN_VERSION=${RELEASE_VERSION#v}
+          if [ -d "release-notes/${CLEAN_VERSION}" ]; then
+              echo "Removing old release notes directory: release-notes/${CLEAN_VERSION}"
+              rm -rf release-notes/${CLEAN_VERSION}
+          else
+              echo "No old release notes directory found for version ${CLEAN_VERSION}."
+          fi
+          
+      - name: Create Release Report Script
+        run: |
+          cat > generate_release_report.sh << 'EOF'
+          #!/bin/bash
+          # Script to generate release notes for Higress projects
+
+          echo "Fetching GitHub generated release notes for ${GITHUB_REPO_OWNER}/${GITHUB_REPO_NAME}..."
+          curl -L \
+              "https://github.com/${GITHUB_REPO_OWNER}/${GITHUB_REPO_NAME}/releases/tag/${RELEASE_VERSION}" \
+              -o release_page.html
+
+          echo "Extracting PR numbers from ${GITHUB_REPO_OWNER}/${GITHUB_REPO_NAME} release notes..."
+          PR_NUMS=$(cat release_page.html | grep -o "/${GITHUB_REPO_OWNER}/${GITHUB_REPO_NAME}/pull/[0-9]*" | grep -o "[0-9]*$" | sort -n | uniq | tr '\n' ',')
+          PR_NUMS=${PR_NUMS%,}
+          if [ -z "${PR_NUMS}" ]; then
+              echo "No PR numbers found in release notes for ${GITHUB_REPO_OWNER}/${GITHUB_REPO_NAME} tag=${RELEASE_VERSION}."
+              rm release_page.html
+              exit 0
+          fi
+
+          echo "Identifying important PRs..."
+          IMPORTANT_PR_NUMS=$(cat release_page.html | grep -o "<strong>.*/${GITHUB_REPO_OWNER}/${GITHUB_REPO_NAME}/pull/[0-9]*.*</strong>" | grep -o "pull/[0-9]*" | grep -o "[0-9]*" | sort -n | uniq | tr '\n' ',')
+          IMPORTANT_PR_NUMS=${IMPORTANT_PR_NUMS%,}
+
+          rm release_page.html
+
+          echo "Extracted PR numbers for ${GITHUB_REPO_OWNER}/${GITHUB_REPO_NAME}: ${PR_NUMS}"
+          echo "Important PR numbers: ${IMPORTANT_PR_NUMS}"
+
+          echo "Generating detailed release notes for ${GITHUB_REPO_OWNER}/${GITHUB_REPO_NAME}..."
+          cd higress-report-agent
+          pip install uv
+          uv sync
+          if [ -n "${IMPORTANT_PR_NUMS}" ]; then
+              uv run report_main.py --mode 2 --choice 2 --pr_nums ${PR_NUMS} --important_prs ${IMPORTANT_PR_NUMS}
+          else
+              uv run report_main.py --mode 2 --choice 2 --pr_nums ${PR_NUMS}
+          fi
+          cp report.md ../
+          cp report.EN.md ../
+          cd ..
+
+          # 去除主库版本号前缀v，以主库版本号为路径
+          CLEAN_VERSION=${MAIN_RELEASE_VERSION#v}
+
+          echo "Creating release notes directory for main version ${MAIN_RELEASE_VERSION}..."
+          mkdir -p release-notes/${CLEAN_VERSION}
+
+          echo "# ${REPORT_TITLE}" >>release-notes/${CLEAN_VERSION}/README_ZH.md
+          sed 's/# Release Notes//' report.md >>release-notes/${CLEAN_VERSION}/README_ZH.md
+          echo -e "\n" >>release-notes/${CLEAN_VERSION}/README_ZH.md
+
+          echo "# ${REPORT_TITLE}" >>release-notes/${CLEAN_VERSION}/README.md
+          sed 's/# Release Notes//' report.EN.md >>release-notes/${CLEAN_VERSION}/README.md
+          echo -e "\n" >>release-notes/${CLEAN_VERSION}/README.md
+
+          rm report.md
+          rm report.EN.md
+          echo "${REPORT_TITLE} release notes saved to release-notes/${CLEAN_VERSION}/"
+
+          EOF
+          chmod +x generate_release_report.sh
+
+      - name: Generate Release Notes for Higress
+        env:
+          GITHUB_REPO_OWNER: alibaba
+          GITHUB_REPO_NAME: higress
+          GITHUB_PERSONAL_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPORT_TITLE: Higress
+        run: |
+          export MAIN_RELEASE_VERSION=$(cat ${GITHUB_WORKSPACE}/VERSION)
+          export RELEASE_VERSION=$(cat ${GITHUB_WORKSPACE}/VERSION)
+          bash generate_release_report.sh
+
+      - name: Generate Release Notes for Higress Console
+        env:
+          GITHUB_REPO_OWNER: higress-group
+          GITHUB_REPO_NAME: higress-console
+          GITHUB_PERSONAL_ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPORT_TITLE: Higress Console
+        run: |
+          export MAIN_RELEASE_VERSION=$(cat ${GITHUB_WORKSPACE}/VERSION)
+          export RELEASE_VERSION=$(grep "^higress-console:" ${GITHUB_WORKSPACE}/DEP_VERSION | head -n1 | sed 's/higress-console: //')
+          bash generate_release_report.sh
+
+      - name: Create Update Release Notes Script
+        run: |
+          cat > update_release_note.sh << 'EOF'
+          #!/bin/bash
+          CLEAN_VERSION=${RELEASE_VERSION#v}
+
+          RELEASE_INFO=$(curl -s -L \
+              -H "Accept: application/vnd.github+json" \
+              -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+              -H "X-GitHub-Api-Version: 2022-11-28" \
+              https://api.github.com/repos/${GITHUB_REPO_OWNER}/${GITHUB_REPO_NAME}/releases/tags/${RELEASE_VERSION})
+          RELEASE_ID=$(echo $RELEASE_INFO | jq -r .id)
+
+          RELEASE_BODY=$(echo $RELEASE_INFO | jq -r .body)
+          NEW_CONTRIBUTORS=$(echo "$RELEASE_BODY" | awk '/## New Contributors/{flag=1; next} /\*\*Full Changelog\*\*/{flag=0} flag' | sed 's/\\n/\n/g')
+          FULL_CHANGELOG=$(echo "$RELEASE_BODY" | awk '/\*\*Full Changelog\*\*:/{print $0}' | sed 's/\*\*Full Changelog\*\*: //g' | sed 's/\\n/\n/g')
+
+          RELEASE_NOTES=$(cat release-notes/${CLEAN_VERSION}/README.md | sed 's/# /## /g')
+
+          if [[ -n "$NEW_CONTRIBUTORS" ]]; then
+              RELEASE_NOTES="${RELEASE_NOTES}
+
+          ## New Contributors
+
+          ${NEW_CONTRIBUTORS}"
+          fi
+          if [[ -n "$FULL_CHANGELOG" ]]; then
+              RELEASE_NOTES="${RELEASE_NOTES}
+
+          **Full Changelog**: ${FULL_CHANGELOG}"
+          fi
+
+          JSON_DATA=$(jq -n \
+              --arg body "$RELEASE_NOTES" \
+              '{body: $body}')
+
+          curl -L \
+              -X PATCH \
+              -H "Accept: application/vnd.github+json" \
+              -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+              -H "X-GitHub-Api-Version: 2022-11-28" \
+              https://api.github.com/repos/${GITHUB_REPO_OWNER}/${GITHUB_REPO_NAME}/releases/${RELEASE_ID} \
+              -d "$JSON_DATA"
+
+          EOF
+          chmod +x update_release_note.sh
+
+      - name: Update Release Notes
+        env:
+          GITHUB_REPO_OWNER: alibaba
+          GITHUB_REPO_NAME: higress
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          export RELEASE_VERSION=$(cat ${GITHUB_WORKSPACE}/VERSION)
+          bash update_release_note.sh
+
+      - name: Clean
+        run: |
+          rm generate_release_report.sh
+          rm update_release_note.sh
+          rm -rf higress-report-agent
+          rm -rf github-mcp-server
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "Add release notes"
+          branch: add-release-notes
+          title: "Add release notes"
+          body: |
+            This PR adds release notes.
+
+            - Automatically generated by GitHub Actions
+          labels: release notes, automated
+          base: main

.github/workflows/helm-docs.yaml

@@ -0,0 +1,41 @@
+name: "Helm Docs"
+
+on:
+  pull_request:
+    branches:
+      - "*"
+    paths:
+      - 'helm/**'
+      - '!helm/higress/README.zh.md'
+  workflow_dispatch: ~
+  push:
+    branches: [ main ]
+    paths:
+      - 'helm/**'
+      - '!helm/higress/README.zh.md'
+
+jobs:
+  helm:
+    name: Helm Docs
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.22.9'
+
+      - name: Run helm-docs
+        run: |
+          GOBIN=$PWD GO111MODULE=on go install github.com/norwoodj/helm-docs/cmd/helm-docs@v1.14.2
+          ./helm-docs -c ${GITHUB_WORKSPACE}/helm/higress -f ../core/values.yaml
+          DIFF=$(git diff ${GITHUB_WORKSPACE}/helm/higress/README.md)
+          if [ ! -z "$DIFF" ]; then
+            echo "Please use helm-docs in your clone, of your fork, of the project, and commit a updated README.md for the chart."
+          fi
+          git diff --exit-code
+          rm -f ./helm-docs

.github/workflows/latest-release.yaml

@@ -1,72 +0,0 @@
-name: Latest Release
-
-on:
-  push:
-    branches:
-    - "main"
-
-jobs:
-  latest-release:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-
-    - name: Build hgctl latest multiarch binaries
-      run: | 
-        GOPROXY="https://proxy.golang.org,direct" make build-hgctl-multiarch
-        tar -zcvf hgctl_latest_linux_amd64.tar.gz out/linux_amd64/
-        tar -zcvf hgctl_latest_linux_arm64.tar.gz out/linux_arm64/
-        tar -zcvf hgctl_latest_darwin_amd64.tar.gz out/darwin_amd64/
-        tar -zcvf hgctl_latest_darwin_arm64.tar.gz out/darwin_arm64/
-        zip -q -r hgctl_latest_windows_amd64.zip out/windows_amd64/
-        zip -q -r hgctl_latest_windows_arm64.zip out/windows_arm64/
-
-    # Ignore the error when we delete the latest release, it might not exist.
-
-    # GitHub APIs take sometime to make effect, we should make sure before Recreate the Latest Release and Tag,
-    # tag and release all get deleted. So we sleep sometime after deleting tag and release to wait for it taking effect.
-
-    - name: Delete the Latest Release
-      continue-on-error: true
-      run: |
-        gh release delete latest --repo $GITHUB_REPOSITORY
-        sleep 4
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        GITHUB_REPOSITORY: ${{ github.repository_owner }}/${{ github.event.repository.name }}
-
-    # Ignore the error when we delete the latest tag, it might not exist.
-    - name: Delete the Latest Tag
-      continue-on-error: true
-      run: |
-        gh api --method DELETE /repos/$GITHUB_REPOSITORY/git/refs/tags/latest
-        sleep 4
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        GITHUB_REPOSITORY: ${{ github.repository_owner }}/${{ github.event.repository.name }}
-
-    - name: Recreate the Latest Release and Tag
-      uses: softprops/action-gh-release@v1
-      with:
-        draft: false
-        prerelease: true
-        tag_name: latest
-        files: |
-          hgctl_latest_linux_amd64.tar.gz
-          hgctl_latest_linux_arm64.tar.gz
-          hgctl_latest_darwin_amd64.tar.gz
-          hgctl_latest_darwin_arm64.tar.gz
-          hgctl_latest_windows_amd64.zip
-          hgctl_latest_windows_arm64.zip
-        body: |
-          This is the "latest" release of **Higress**, which contains the most recent commits from the main branch.
-          
-          This release **might not be stable**.
-
-          It is only intended for developers wishing to try out the latest features in Higress, some of which may not be fully implemented.
-
-          Try latest version of `hgctl` with:
-
-          ``` shell
-            curl -Ls https://raw.githubusercontent.com/alibaba/higress/main/tools/hack/get-hgctl.sh | VERSION=latest bash
-          ```

.github/workflows/license-checker.yaml

@@ -10,7 +10,7 @@ jobs:
     steps:
       # step 1
       - name: Checkout
-        uses: actions/checkout@v2.4.0
+        uses: actions/checkout@v4
       # step 2
       - name: Check License Header
         uses: apache/skywalking-eyes/header@25edfc2fd8d52fb266653fb5f6c42da633d85c07
@@ -24,4 +24,4 @@ jobs:
         with:
           log: info
           config: .licenserc.yaml
-          mode: check
+          mode: check

.github/workflows/release-crd.yaml

@@ -0,0 +1,24 @@
+name: Release CRD to GitHub
+
+on:
+  push:
+    tags:
+    - "v*.*.*"
+  workflow_dispatch: ~
+
+jobs:
+  release-crd:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: generate crds
+      run: |
+        cat helm/core/crds/customresourcedefinitions.gen.yaml helm/core/crds/istio-envoyfilter.yaml > crd.yaml
+
+    - name: Upload hgctl packages to the GitHub release
+      uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631
+      if: startsWith(github.ref, 'refs/tags/')
+      with:
+        files: |
+          crd.yaml

.github/workflows/release-hgctl.yaml

@@ -12,26 +12,69 @@ jobs:
     env:
       HGCTL_VERSION: ${{github.ref_name}}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
+    - uses: actions/setup-go@v5
+      with:
+        go-version: 1.22
 
     - name: Build hgctl latest multiarch binaries
       run: |
         GOPROXY="https://proxy.golang.org,direct" make build-hgctl-multiarch
         tar -zcvf hgctl_${{ env.HGCTL_VERSION }}_linux_amd64.tar.gz out/linux_amd64/
         tar -zcvf hgctl_${{ env.HGCTL_VERSION }}_linux_arm64.tar.gz out/linux_arm64/
-        tar -zcvf hgctl_${{ env.HGCTL_VERSION }}_darwin_amd64.tar.gz out/darwin_amd64/
-        tar -zcvf hgctl_${{ env.HGCTL_VERSION }}_darwin_arm64.tar.gz out/darwin_arm64/
         zip -q -r hgctl_${{ env.HGCTL_VERSION }}_windows_amd64.zip out/windows_amd64/
         zip -q -r hgctl_${{ env.HGCTL_VERSION }}_windows_arm64.zip out/windows_arm64/
 
     - name: Upload hgctl packages to the GitHub release
-      uses: softprops/action-gh-release@v1
+      uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631
       if: startsWith(github.ref, 'refs/tags/')
       with:
         files: |
           hgctl_${{ env.HGCTL_VERSION }}_linux_amd64.tar.gz
           hgctl_${{ env.HGCTL_VERSION }}_linux_arm64.tar.gz
-          hgctl_${{ env.HGCTL_VERSION }}_darwin_amd64.tar.gz
-          hgctl_${{ env.HGCTL_VERSION }}_darwin_arm64.tar.gz
           hgctl_${{ env.HGCTL_VERSION }}_windows_amd64.zip
-          hgctl_${{ env.HGCTL_VERSION }}_windows_arm64.zip
+          hgctl_${{ env.HGCTL_VERSION }}_windows_arm64.zip
+
+  release-hgctl-macos-arm64:
+    runs-on: macos-latest
+    env:
+      HGCTL_VERSION: ${{github.ref_name}}
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-go@v5
+      with:
+        go-version: 1.22
+
+    - name: Build hgctl latest macos binaries
+      run: |
+        GOPROXY="https://proxy.golang.org,direct" make build-hgctl-macos-arm64
+        tar -zcvf hgctl_${{ env.HGCTL_VERSION }}_darwin_arm64.tar.gz out/darwin_arm64/
+
+    - name: Upload hgctl packages to the GitHub release
+      uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631
+      if: startsWith(github.ref, 'refs/tags/')
+      with:
+        files: |
+          hgctl_${{ env.HGCTL_VERSION }}_darwin_arm64.tar.gz
+
+  release-hgctl-macos-amd64:
+    runs-on: macos-14
+    env:
+      HGCTL_VERSION: ${{github.ref_name}}
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-go@v5
+      with:
+        go-version: 1.22
+
+    - name: Build hgctl latest macos binaries
+      run: |
+        GOPROXY="https://proxy.golang.org,direct" make build-hgctl-macos-amd64
+        tar -zcvf hgctl_${{ env.HGCTL_VERSION }}_darwin_amd64.tar.gz out/darwin_amd64/
+
+    - name: Upload hgctl packages to the GitHub release
+      uses: softprops/action-gh-release@da05d552573ad5aba039eaac05058a918a7bf631
+      if: startsWith(github.ref, 'refs/tags/')
+      with:
+        files: |
+          hgctl_${{ env.HGCTL_VERSION }}_darwin_amd64.tar.gz

.github/workflows/sync-crds.yaml

@@ -0,0 +1,36 @@
+name: "Sync CRDs to Helm Chart"
+
+on:
+  workflow_dispatch: ~
+  push:
+    branches: [ main ]
+    paths:
+      - 'api/kubernetes/customresourcedefinitions.gen.yaml'
+
+jobs:
+  sync-crds:
+    name: Sync CRDs
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Copy the CRD YAML File to Helm Folder
+        run: |
+          cp api/kubernetes/customresourcedefinitions.gen.yaml helm/core/crds/customresourcedefinitions.gen.yaml
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "Update CRD file in the helm folder"
+          branch: sync-crds
+          title: "Update CRD file in the helm folder"
+          body: |
+            This PR updates CRD file in the helm folder.
+
+            - Automatically copied by GitHub Actions
+          labels: crds, automated
+          base: main

.github/workflows/translate-readme.yaml

@@ -0,0 +1,131 @@
+name: "Helm Docs"
+
+on:
+  workflow_dispatch: ~
+  push:
+    branches: [ main ]
+    paths:
+      - 'helm/higress/README.md'
+
+jobs:
+  translate-readme:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y jq
+
+      - name: Compare README.md
+        id: compare_readme
+        run: |
+          cd ./helm/higress
+          
+          BASE_BRANCH=${GITHUB_BASE_REF:-main} 
+          git fetch origin $BASE_BRANCH
+          
+          if git diff --quiet origin/$BASE_BRANCH -- README.md; then
+            echo "README.md has no local changes compared to $BASE_BRANCH. Skipping translation."
+            echo "skip_translation=true" >> $GITHUB_ENV
+          else
+            echo "README.md has local changes compared to $BASE_BRANCH. Proceeding with translation."
+            echo "skip_translation=false" >> $GITHUB_ENV
+            echo "--------- diff ---------"
+            git diff origin/$BASE_BRANCH -- README.md
+            echo "------------------------"
+          fi
+
+      - name: Translate README.md to Chinese
+        if: env.skip_translation == 'false'
+        env:
+          API_URL: ${{ secrets.HIGRESS_OPENAI_API_URL }}
+          API_KEY: ${{ secrets.HIGRESS_OPENAI_API_KEY }}
+          API_MODEL: ${{ secrets.HIGRESS_OPENAI_API_MODEL }}
+        run: |
+          cat << 'EOF' > translate_readme.py
+          import os
+          import json
+          import requests
+
+          API_URL = os.environ["API_URL"]
+          API_KEY = os.environ["API_KEY"]
+          API_MODEL = os.environ["API_MODEL"]
+          README_PATH = "./helm/higress/README.md"
+          OUTPUT_PATH = "./helm/higress/README.zh.md"
+
+          def stream_translation(api_url, api_key, payload):
+              headers = {
+                  "Content-Type": "application/json",
+                  "Authorization": f"Bearer {api_key}",
+              }
+              response = requests.post(api_url, headers=headers, json=payload, stream=True)
+              response.raise_for_status()
+
+              with open(OUTPUT_PATH, "w", encoding="utf-8") as out_file:
+                  for line in response.iter_lines(decode_unicode=True):
+                      if line.strip() == "" or not line.startswith("data: "):
+                          continue
+                      data = line[6:]
+                      if data.strip() == "[DONE]":
+                          break
+                      try:
+                          chunk = json.loads(data)
+                          content = chunk["choices"][0]["delta"].get("content", "")
+                          if content:
+                              out_file.write(content)
+                      except Exception as e:
+                          print("Error parsing chunk:", e)
+
+          def main():
+              if not os.path.exists(README_PATH):
+                  print("README.md not found!")
+                  return
+
+              with open(README_PATH, "r", encoding="utf-8") as f:
+                  content = f.read()
+
+              payload = {
+                  "model": API_MODEL,
+                  "messages": [
+                      {
+                          "role": "system",
+                          "content": "You are a translation assistant that translates English Markdown text to Chinese. Preserve original Markdown formatting and line breaks."
+                      },
+                      {
+                          "role": "user",
+                          "content": content
+                      }
+                  ],
+                  "temperature": 0.3,
+                  "stream": True
+              }
+
+              print("Streaming translation started...")
+              stream_translation(API_URL, API_KEY, payload)
+              print(f"Translation completed and saved to {OUTPUT_PATH}.")
+
+          if __name__ == "__main__":
+              main()
+          EOF
+          
+          python3 translate_readme.py
+          rm -rf translate_readme.py
+
+      - name: Create Pull Request
+        if: env.skip_translation == 'false'
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: "Update helm translated README.zh.md"
+          branch: update-helm-readme-zh
+          title: "Update helm translated README.zh.md"
+          body: |
+            This PR updates the translated README.zh.md file.
+
+            - Automatically generated by GitHub Actions
+          labels: translation, automated
+          base: main

.github/workflows/translate-test.yml

@@ -0,0 +1,29 @@
+name: 'Translate GitHub content into English'
+on:
+  issues:
+    types: [opened, edited]
+  issue_comment:
+    types: [created, edited]
+  discussion:
+    types: [created, edited]
+  discussion_comment:
+    types: [created, edited]
+  pull_request_target:
+    types: [opened, edited]
+  pull_request_review_comment:
+    types: [created, edited]
+
+jobs:
+  translate:
+    permissions:
+      issues: write
+      discussions: write
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: lizheming/github-translate-action@main
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          APPEND_TRANSLATION: true

.github/workflows/wasm-plugin-unit-test.yml

@@ -0,0 +1,378 @@
+name: Wasm Plugin Unit Tests(GO)
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'plugins/wasm-go/extensions/**'
+      - '.github/workflows/wasm-plugin-unit-test.yml'
+      - 'go.mod'
+      - 'go.sum'
+  pull_request:
+    branches: [ "*" ]
+    paths:
+      - 'plugins/wasm-go/extensions/**'
+      - '.github/workflows/wasm-plugin-unit-test.yml'
+      - 'go.mod'
+      - 'go.sum'
+
+env:
+  GO111MODULE: on
+  CGO_ENABLED: 0
+  GOOS: linux
+  GOARCH: amd64
+
+jobs:
+  detect-changed-plugins:
+    name: Detect Changed Plugins
+    runs-on: ubuntu-latest
+    outputs:
+      changed-plugins: ${{ steps.detect.outputs.plugins }}
+      has-changes: ${{ steps.detect.outputs.has-changes }}
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0  # 获取完整历史用于比较
+        
+    - name: Detect changed plugins
+      id: detect
+      run: |
+        # 获取变更的文件列表
+        if [ "${{ github.event_name }}" = "pull_request" ]; then
+          # PR模式：比较目标分支和源分支
+          git fetch origin ${{ github.base_ref }}
+          CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
+        else
+          # Push模式：比较当前提交和上一个提交
+          CHANGED_FILES=$(git diff --name-only HEAD~1 HEAD)
+        fi
+        
+        echo "Changed files:"
+        echo "$CHANGED_FILES"
+        
+        # 提取变更的插件名称
+        CHANGED_PLUGINS=""
+        for file in $CHANGED_FILES; do
+          if [[ $file =~ ^plugins/wasm-go/extensions/([^/]+)/ ]]; then
+            PLUGIN_NAME="${BASH_REMATCH[1]}"
+            if [[ ! " $CHANGED_PLUGINS " =~ " $PLUGIN_NAME " ]]; then
+              # 修复：只在非空时添加空格
+              if [ -z "$CHANGED_PLUGINS" ]; then
+                CHANGED_PLUGINS="$PLUGIN_NAME"
+              else
+                CHANGED_PLUGINS="$CHANGED_PLUGINS $PLUGIN_NAME"
+              fi
+            fi
+          fi
+        done
+        
+        # 如果没有插件变更，不触发测试
+        if [ -z "$CHANGED_PLUGINS" ]; then
+          echo "No plugin changes detected, skipping tests"
+          echo "has-changes=false" >> $GITHUB_OUTPUT
+          echo "plugins=[]" >> $GITHUB_OUTPUT
+        else
+          echo "Changed plugins: $CHANGED_PLUGINS"
+          echo "has-changes=true" >> $GITHUB_OUTPUT
+          # 将空格分隔转换为 JSON 数组格式
+          PLUGINS_JSON=$(echo "$CHANGED_PLUGINS" | sed 's/ /","/g' | sed 's/^/["/' | sed 's/$/"]/')
+          echo "PLUGINS_JSON: $PLUGINS_JSON"
+          echo "plugins=$PLUGINS_JSON" >> $GITHUB_OUTPUT
+        fi
+
+  test:
+    name: Test Changed Plugins
+    runs-on: ubuntu-latest
+    needs: detect-changed-plugins
+    if: needs.detect-changed-plugins.outputs.has-changes == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        plugin: ${{ fromJSON(needs.detect-changed-plugins.outputs.changed-plugins) }}
+      
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+      
+    - name: Set up Go 1.24
+      uses: actions/setup-go@v4
+      with:
+        go-version: 1.24
+        cache: true
+        
+    - name: Install test tools
+      run: |
+        go install gotest.tools/gotestsum@latest
+        # 移除gocov工具，直接使用Codecov
+        
+    - name: Build WASM for ${{ matrix.plugin }}
+      working-directory: plugins/wasm-go/extensions/${{ matrix.plugin }}
+      run: |
+        echo "Building WASM for ${{ matrix.plugin }}..."
+        
+        # 检查是否存在main.go文件
+        
+        export GOOS=wasip1
+        export GOARCH=wasm
+        
+        # 构建WASM文件，失败时直接退出
+        if ! go build -buildmode=c-shared -o main.wasm ./; then
+          echo "❌ WASM build failed for ${{ matrix.plugin }}"
+          exit 1
+        fi
+        
+        # 验证WASM文件是否生成
+        if [ ! -f "main.wasm" ]; then
+          echo "❌ WASM file not generated for ${{ matrix.plugin }}"
+          exit 1
+        fi
+        
+        echo "✅ WASM build successful for ${{ matrix.plugin }}"
+
+        
+    - name: Set WASM_PATH environment variable
+      run: |
+        echo "WASM_PATH=$(pwd)/plugins/wasm-go/extensions/${{ matrix.plugin }}/main.wasm" >> $GITHUB_ENV
+        
+    - name: Run tests with coverage for ${{ matrix.plugin }}
+      working-directory: plugins/wasm-go/extensions/${{ matrix.plugin }}
+      run: |
+        # 检查是否存在main_test.go文件
+        if [ -f "main_test.go" ]; then
+          echo "Running tests for ${{ matrix.plugin }}..."
+          
+          # 运行测试并生成覆盖率报告
+          gotestsum --junitfile ../../../../test-results-${{ matrix.plugin }}.xml \
+                   --format standard-verbose \
+                   --jsonfile ../../../../test-output-${{ matrix.plugin }}.json \
+                   -- -coverprofile=coverage-${{ matrix.plugin }}.out -covermode=atomic -coverpkg=./... ./...
+          
+          echo "✅ Tests completed for ${{ matrix.plugin }}"
+        else
+          echo "No tests found for ${{ matrix.plugin }}, skipping..."
+          # 创建空的测试结果文件
+          echo '<?xml version="1.0" encoding="UTF-8"?><testsuites><testsuite name="no-tests" tests="0" failures="0" errors="0" time="0"></testsuite></testsuites>' > ../../../../test-results-${{ matrix.plugin }}.xml
+        fi
+        
+    - name: Upload test results for ${{ matrix.plugin }}
+      uses: actions/upload-artifact@v4
+      if: always()
+      with:
+        name: test-results-${{ matrix.plugin }}
+        path: |
+          test-results-${{ matrix.plugin }}.xml
+          test-output-${{ matrix.plugin }}.json
+        retention-days: 30
+        
+    - name: Upload coverage report for ${{ matrix.plugin }}
+      uses: actions/upload-artifact@v4
+      if: always()
+      with:
+        name: coverage-${{ matrix.plugin }}
+        path: plugins/wasm-go/extensions/${{ matrix.plugin }}/coverage-${{ matrix.plugin }}.out
+        retention-days: 30
+
+  test-summary:
+    name: Test Summary & Coverage
+    runs-on: ubuntu-latest
+    needs: [detect-changed-plugins, test]
+    if: always() && needs.detect-changed-plugins.outputs.has-changes == 'true'
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      
+    - name: Set up Go 1.24
+      uses: actions/setup-go@v4
+      with:
+        go-version: 1.24
+        cache: true
+        
+    - name: Install required tools
+      run: |
+        go install github.com/wadey/gocovmerge@latest
+        
+    - name: Download all test results
+      uses: actions/download-artifact@v4
+      with:
+        pattern: test-results-*
+        merge-multiple: true
+        path: ${{ github.workspace }}
+        
+    - name: Download all coverage files
+      uses: actions/download-artifact@v4
+      with:
+        pattern: coverage-*
+        merge-multiple: true
+        path: ${{ github.workspace }}
+        
+
+        
+    - name: Generate comprehensive test summary
+      run: |
+        echo "## 🧪 Go Plugin Test Results" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        
+        total_plugins=0
+        passed_plugins=0
+        failed_plugins=0
+        total_tests=0
+        total_failures=0
+        total_errors=0
+        
+        echo "### 📊 Test Results by Plugin" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        
+        for result_file in test-results-*.xml; do
+          if [ -f "$result_file" ]; then
+            plugin_name=$(echo "$result_file" | sed 's/test-results-\(.*\)\.xml/\1/')
+            total_plugins=$((total_plugins + 1))
+            
+            # 解析XML获取测试结果
+            if grep -q '<testsuite' "$result_file"; then
+              # 使用grep解析XML属性，更稳定可靠
+              tests=$(grep -o 'tests="[0-9]*"' "$result_file" | head -1 | grep -o '[0-9]*' || echo "0")
+              failures=$(grep -o 'failures="[0-9]*"' "$result_file" | head -1 | grep -o '[0-9]*' || echo "0")
+              errors=$(grep -o 'errors="[0-9]*"' "$result_file" | head -1 | grep -o '[0-9]*' || echo "0")
+              time=$(grep -o 'time="[0-9.]*"' "$result_file" | head -1 | grep -o '[0-9.]*' || echo "0")
+              
+              # 确保数值有效，避免bash算术运算错误
+              tests=${tests:-0}
+              failures=${failures:-0}
+              errors=${errors:-0}
+              
+              # 转换为整数进行算术运算
+              total_tests=$((total_tests + tests))
+              total_failures=$((total_failures + failures))
+              total_errors=$((total_errors + errors))
+              
+              if [ "$failures" = "0" ] && [ "$errors" = "0" ]; then
+                echo "✅ **$plugin_name**: $tests tests passed in ${time}s" >> $GITHUB_STEP_SUMMARY
+                passed_plugins=$((passed_plugins + 1))
+              else
+                echo "❌ **$plugin_name**: $tests tests, $failures failures, $errors errors in ${time}s" >> $GITHUB_STEP_SUMMARY
+                failed_plugins=$((failed_plugins + 1))
+              fi
+            else
+              echo "⚠️ **$plugin_name**: No tests found" >> $GITHUB_STEP_SUMMARY
+            fi
+          fi
+        done
+        
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "### 📈 Coverage Report" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "📊 **Coverage reports are now available on Codecov**" >> $GITHUB_STEP_SUMMARY
+        echo "🔗 **This Commit Coverage**: https://codecov.io/gh/${{ github.repository }}/commit/${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        
+        echo "### 🎯 Summary" >> $GITHUB_STEP_SUMMARY
+        echo "- **Total plugins**: $total_plugins" >> $GITHUB_STEP_SUMMARY
+        echo "- **Passed**: $passed_plugins ✅" >> $GITHUB_STEP_SUMMARY
+        echo "- **Failed**: $failed_plugins ❌" >> $GITHUB_STEP_SUMMARY
+        echo "- **Total tests**: $total_tests" >> $GITHUB_STEP_SUMMARY
+        echo "- **Total failures**: $total_failures" >> $GITHUB_STEP_SUMMARY
+        echo "- **Total errors**: $total_errors" >> $GITHUB_STEP_SUMMARY
+        
+        # 如果有失败，显示详细信息
+        if [ $total_failures -gt 0 ] || [ $total_errors -gt 0 ]; then
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### ❌ Failed Tests Details" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Failed plugins**: $failed_plugins" >> $GITHUB_STEP_SUMMARY
+          echo "**Total failures**: $total_failures" >> $GITHUB_STEP_SUMMARY
+          echo "**Total errors**: $total_errors" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "📋 **View detailed logs**: [Click here](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          
+          # 显示每个失败插件的详细信息
+          echo "#### 📊 Failed Plugin Details" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          
+          for result_file in test-results-*.xml; do
+            if [ -f "$result_file" ]; then
+              plugin_name=$(echo "$result_file" | sed 's/test-results-\(.*\)\.xml/\1/')
+              
+              # 检查是否有失败
+              failures=$(grep -o 'failures="[0-9]*"' "$result_file" | head -1 | grep -o '[0-9]*' || echo "0")
+              errors=$(grep -o 'errors="[0-9]*"' "$result_file" | head -1 | grep -o '[0-9]*' || echo "0")
+              
+              # 确保数值有效
+              failures=${failures:-0}
+              errors=${errors:-0}
+              
+              if [ "$failures" -gt 0 ] || [ "$errors" -gt 0 ]; then
+                echo "**$plugin_name**:" >> $GITHUB_STEP_SUMMARY
+                echo "- Failures: $failures" >> $GITHUB_STEP_SUMMARY
+                echo "- Errors: $errors" >> $GITHUB_STEP_SUMMARY
+                echo "- [View plugin logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})" >> $GITHUB_STEP_SUMMARY
+                echo "" >> $GITHUB_STEP_SUMMARY
+              fi
+            fi
+          done
+        fi
+        
+    # - name: Merge coverage reports
+    #   run: |
+    #     echo "Merging coverage reports..."
+    #     
+    #     # 使用绝对路径查找，更可靠
+    #     coverage_files=$(find ${{ github.workspace }} -name "coverage-*")
+    #     
+    #     if [ -n "$coverage_files" ]; then
+    #       echo "Found coverage files:"
+    #       echo "$coverage_files"
+    #       
+    #       # 使用gocovmerge顺序合并
+    #       echo "Merging Go coverage files using gocovmerge sequential method..."
+    #       
+    #       # 将文件列表转换为数组
+    #       readarray -t coverage_array <<< "$coverage_files"
+    #       file_count=${#coverage_array[@]}
+    #       
+    #       echo "Total files to merge: $file_count"
+    #       
+    #       # 复制第一个文件作为基础
+    #       cp "${coverage_array[0]}" ${{ github.workspace }}/merged_coverage.out
+    #       echo "Starting with: ${coverage_array[0]}"
+    #       
+    #       # 如果有多个文件，逐个合并其他文件到最终目标
+    #       if [ $file_count -gt 1 ]; then
+    #         echo "Multiple files, merging sequentially with gocovmerge..."
+    #         
+    #         for ((i=1; i<file_count; i++)); do
+    #           current_file="${coverage_array[i]}"
+    #           
+    #           echo "Merging file $((i+1))/$file_count: $current_file"
+    #           
+    #           # 使用gocovmerge合并到最终目标文件
+    #           gocovmerge "${{ github.workspace }}/merged_coverage.out" "$current_file" > "${{ github.workspace }}/temp_merge.out"
+    #           mv "${{ github.workspace }}/temp_merge.out" "${{ github.workspace }}/merged_coverage.out"
+    #           
+    #           echo "Successfully merged with $current_file"
+    #           done
+    #         fi
+    #         
+    #         echo "Coverage reports merged successfully using gocovmerge sequential method"
+    #         echo "Merged file size: $(wc -c < ${{ github.workspace }}/merged_coverage.out) bytes"
+    #       else
+    #         echo "No coverage files found"
+    #         # 创建空的覆盖率文件
+    #         echo "mode: atomic" > ${{ github.workspace }}/merged_coverage.out
+    #       fi
+        
+    # - name: Upload merged coverage to Codecov
+    #   uses: codecov/codecov-action@v4
+    #   if: always()
+    #   with:
+    #     file: ${{ github.workspace }}/merged_coverage.out
+    #     flags: wasm-go-plugins-tests
+    #     name: codecov-wasm-go-plugins
+    #     fail_ci_if_error: false
+    #     verbose: true

.gitignore

@@ -1,4 +1,3 @@
-external
 out
 *.out
 *.tgz
@@ -11,7 +10,10 @@ bazel-bin
 bazel-out
 bazel-testlogs
 bazel-wasm-cpp
+external/
 tools/bin/
 helm/**/charts/**.tgz
 target/
-tools/hack/cluster.conf
+tools/hack/cluster.conf
+envoy/1.20
+istio/1.12

.gitmodules

@@ -1,21 +1,35 @@
-[submodule "istio/1.12/api"]
-	path = istio/1.12/api
-	url = https://github.com/istio/api
-[submodule "istio/1.12/istio"]
-	path = istio/1.12/istio
-	url = https://github.com/istio/istio
-[submodule "istio/1.12/client-go"]
-	path = istio/1.12/client-go
-	url = https://github.com/istio/client-go
-[submodule "istio/1.12/pkg"]
-	path = istio/1.12/pkg
-	url = https://github.com/istio/pkg
-[submodule "istio/1.12/proxy"]
-	path = istio/1.12/proxy
-	url = https://github.com/istio/proxy
-[submodule "envoy/1.20/go-control-plane"]
-	path = envoy/1.20/go-control-plane
-	url = https://github.com/envoyproxy/go-control-plane
-[submodule "envoy/1.20/envoy"]
-	path = envoy/1.20/envoy
-	url = https://github.com/envoyproxy/envoy
+[submodule "istio/api"]
+	path = istio/api
+	url = https://github.com/higress-group/api
+	branch = istio-1.19
+	shallow = true
+[submodule "istio/istio"]
+	path = istio/istio
+	url = https://github.com/higress-group/istio
+	branch = istio-1.19
+	shallow = true
+[submodule "istio/client-go"]
+	path = istio/client-go
+	url = https://github.com/higress-group/client-go
+	branch = istio-1.19
+	shallow = true
+[submodule "istio/pkg"]
+	path = istio/pkg
+	url = https://github.com/higress-group/pkg
+	branch = istio-1.19
+	shallow = true
+[submodule "istio/proxy"]
+	path = istio/proxy
+	url = https://github.com/higress-group/proxy
+	branch = istio-1.19
+	shallow = true
+[submodule "envoy/go-control-plane"]
+	path = envoy/go-control-plane
+	url = https://github.com/higress-group/go-control-plane
+	branch = istio-1.19
+	shallow = true
+[submodule "envoy/envoy"]
+	path = envoy/envoy
+	url = https://github.com/higress-group/envoy
+	branch = envoy-1.27
+	shallow = true

.licenserc.yaml

@@ -7,9 +7,12 @@ header:
     - '.gitignore'
     - '*.md'
     - '*.yml'
+    - '*.yaml'
+    - '*.golden'
     - 'LICENSE'
     - 'api/**'
     - 'samples/**'
+    - 'docs/**'
     - '.github/**'
     - '.licenserc.yaml'
     - 'helm/**'
@@ -24,11 +27,14 @@ header:
     - 'plugins/**'
     - 'CODEOWNERS'
     - 'VERSION'
+    - 'DEP_VERSION'
     - 'tools/'
     - 'test/README.md'
     - 'test/README_CN.md'
-    - 'cmd/hgctl/config/testdata/config'
-    - 'pkg/cmd/hgctl/manifests'
+    - 'hgctl/cmd/hgctl/config/testdata/config'
+    - 'hgctl/pkg/manifests'
+    - 'pkg/ingress/kube/gateway/istio/testdata'
+    - 'release-notes/**'
 
   comment: on-failure
 dependency:

CODEOWNERS

@@ -2,8 +2,10 @@
 /envoy @gengleilei @johnlanni
 /istio @SpecialYang @johnlanni
 /pkg @SpecialYang @johnlanni @CH3CHO
-/plugins @johnlanni @WeixinX
-/registry @NameHaibinZhang @2456868764 @johnlanni
+/plugins @johnlanni @CH3CHO @rinfx @erasernoob
+/plugins/wasm-go/extensions/ai-proxy @rinfx @wydream @johnlanni
+/plugins/wasm-rust @007gzs @jizhuozhi
+/registry @Erica177 @2456868764 @johnlanni
 /test @Xunzhuo @2456868764 @CH3CHO
 /tools @johnlanni @Xunzhuo @2456868764
 

CONTRIBUTING_EN.md

@@ -1,6 +1,6 @@
 # Contributing to Higress
 
-It is warmly welcomed if you have interest to hack on Higress. First, we encourage this kind of willing very much. And here is a list of contributing guide for you.
+Your interest in contributing to Higress is warmly welcomed. First, we encourage this kind of willing very much. And here is a list of contributing guide for you.
 
 [[中文贡献文档](./CONTRIBUTING_CN.md)]
 

CONTRIBUTING_JP.md

@@ -0,0 +1,195 @@
+# Higress への貢献
+
+Higress のハッキングに興味がある場合は、温かく歓迎します。まず、このような意欲を非常に奨励します。そして、以下は貢献ガイドのリストです。
+
+[[中文](./CONTRIBUTING.md)] | [[English Contributing Document](./CONTRIBUTING_EN.md)]
+
+## トピック
+
+- [Higress への貢献](#higress-への貢献)
+  - [トピック](#トピック)
+  - [セキュリティ問題の報告](#セキュリティ問題の報告)
+  - [一般的な問題の報告](#一般的な問題の報告)
+  - [コードとドキュメントの貢献](#コードとドキュメントの貢献)
+    - [ワークスペースの準備](#ワークスペースの準備)
+    - [ブランチの定義](#ブランチの定義)
+    - [コミットルール](#コミットルール)
+      - [コミットメッセージ](#コミットメッセージ)
+      - [コミット内容](#コミット内容)
+    - [PR 説明](#pr-説明)
+  - [テストケースの貢献](#テストケースの貢献)
+  - [何かを手伝うための参加](#何かを手伝うための参加)
+  - [コードスタイル](#コードスタイル)
+
+## セキュリティ問題の報告
+
+セキュリティ問題は常に真剣に扱われます。通常の原則として、セキュリティ問題を広めることは推奨しません。Higress のセキュリティ問題を発見した場合は、公開で議論せず、公開の問題を開かないでください。代わりに、[higress@googlegroups.com](mailto:higress@googlegroups.com) にプライベートなメールを送信して報告することをお勧めします。
+
+## 一般的な問題の報告
+
+正直なところ、Higress のすべてのユーザーを非常に親切な貢献者と見なしています。Higress を体験した後、プロジェクトに対するフィードバックがあるかもしれません。その場合は、[NEW ISSUE](https://github.com/alibaba/higress/issues/new/choose) を通じて問題を開くことを自由に行ってください。
+
+Higress プロジェクトを分散型で協力しているため、**よく書かれた**、**詳細な**、**明確な**問題報告を高く評価します。コミュニケーションをより効率的にするために、問題が検索リストに存在するかどうかを検索することを希望します。存在する場合は、新しい問題を開くのではなく、既存の問題のコメントに詳細を追加してください。
+
+問題の詳細をできるだけ標準化するために、問題報告者のために [ISSUE TEMPLATE](./.github/ISSUE_TEMPLATE) を設定しました。テンプレートのフィールドに従って指示に従って記入してください。
+
+問題を開く場合は多くのケースがあります：
+
+* バグ報告
+* 機能要求
+* パフォーマンス問題
+* 機能提案
+* 機能設計
+* 助けが必要
+* ドキュメントが不完全
+* テストの改善
+* プロジェクトに関する質問
+* その他
+
+また、新しい問題を記入する際には、投稿から機密データを削除することを忘れないでください。機密データには、パスワード、秘密鍵、ネットワークの場所、プライベートなビジネスデータなどが含まれる可能性があります。
+
+## コードとドキュメントの貢献
+
+Higress プロジェクトをより良くするためのすべての行動が奨励されます。GitHub では、Higress のすべての改善は PR（プルリクエストの略）を通じて行うことができます。
+
+* タイプミスを見つけた場合は、修正してみてください！
+* バグを見つけた場合は、修正してみてください！
+* 冗長なコードを見つけた場合は、削除してみてください！
+* 欠落しているテストケースを見つけた場合は、追加してみてください！
+* 機能を強化できる場合は、**ためらわないでください**！
+* コードが不明瞭な場合は、コメントを追加して明確にしてください！
+* コードが醜い場合は、リファクタリングしてみてください！
+* ドキュメントの改善に役立つ場合は、さらに良いです！
+* ドキュメントが不正確な場合は、修正してください！
+* ...
+
+実際には、それらを完全にリストすることは不可能です。1つの原則を覚えておいてください：
+
+> あなたからの PR を楽しみにしています。
+
+Higress を PR で改善する準備ができたら、ここで PR ルールを確認することをお勧めします。
+
+* [ワークスペースの準備](#ワークスペースの準備)
+* [ブランチの定義](#ブランチの定義)
+* [コミットルール](#コミットルール)
+* [PR 説明](#pr-説明)
+
+### ワークスペースの準備
+
+PR を提出するために、GitHub ID に登録していることを前提とします。その後、以下の手順で準備を完了できます：
+
+1. Higress を自分のリポジトリに **FORK** します。この作業を行うには、[alibaba/higress](https://github.com/alibaba/higress) のメインページの右上にある Fork ボタンをクリックするだけです。その後、`https://github.com/<your-username>/higress` に自分のリポジトリが作成されます。ここで、`your-username` はあなたの GitHub ユーザー名です。
+
+2. 自分のリポジトリをローカルに **CLONE** します。`git clone git@github.com:<your-username>/higress.git` を使用してリポジトリをローカルマシンにクローンします。その後、新しいブランチを作成して、行いたい変更を完了できます。
+
+3. リモートを `git@github.com:alibaba/higress.git` に設定します。以下の2つのコマンドを使用します：
+
+```bash
+git remote add upstream git@github.com:alibaba/higress.git
+git remote set-url --push upstream no-pushing
+```
+
+このリモート設定を使用すると、git リモート設定を次のように確認できます：
+
+```shell
+$ git remote -v
+origin     git@github.com:<your-username>/higress.git (fetch)
+origin     git@github.com:<your-username>/higress.git (push)
+upstream   git@github.com:alibaba/higress.git (fetch)
+upstream   no-pushing (push)
+```
+
+これを追加すると、ローカルブランチを上流ブランチと簡単に同期できます。
+
+### ブランチの定義
+
+現在、プルリクエストを通じたすべての貢献は Higress の [main ブランチ](https://github.com/alibaba/higress/tree/main) に対するものであると仮定します。貢献する前に、ブランチの定義を理解することは非常に役立ちます。
+
+貢献者として、プルリクエストを通じたすべての貢献は main ブランチに対するものであることを再度覚えておいてください。Higress プロジェクトには、リリースブランチ（例：0.6.0、0.6.1）、機能ブランチ、ホットフィックスブランチなど、いくつかの他のブランチがあります。
+
+正式にバージョンをリリースする際には、リリースブランチが作成され、バージョン番号で命名されます。
+
+リリース後、リリースブランチのコミットを main ブランチにマージします。
+
+特定のバージョンにバグがある場合、後のバージョンで修正するか、特定のホットフィックスバージョンで修正するかを決定します。ホットフィックスバージョンで修正することを決定した場合、対応するリリースブランチに基づいてホットフィックスブランチをチェックアウトし、コード修正と検証を行い、main ブランチにマージします。
+
+大きな機能については、開発と検証のために機能ブランチを引き出します。
+
+### コミットルール
+
+実際には、Higress ではコミット時に2つのルールを真剣に考えています：
+
+* [コミットメッセージ](#コミットメッセージ)
+* [コミット内容](#コミット内容)
+
+#### コミットメッセージ
+
+コミットメッセージは、提出された PR の目的をレビュアーがよりよく理解するのに役立ちます。また、コードレビューの手続きを加速するのにも役立ちます。貢献者には、曖昧なメッセージではなく、**明確な**コミットメッセージを使用することを奨励します。一般的に、以下のコミットメッセージタイプを推奨します：
+
+* docs: xxxx. 例："docs: add docs about Higress cluster installation".
+* feature: xxxx. 例："feature: use higress config instead of istio config".
+* bugfix: xxxx. 例："bugfix: fix panic when input nil parameter".
+* refactor: xxxx. 例："refactor: simplify to make codes more readable".
+* test: xxx. 例："test: add unit test case for func InsertIntoArray".
+* その他の読みやすく明確な表現方法。
+
+一方で、以下のような方法でのコミットメッセージは推奨しません：
+
+* ~~バグ修正~~
+* ~~更新~~
+* ~~ドキュメント追加~~
+
+迷った場合は、[Git コミットメッセージの書き方](http://chris.beams.io/posts/git-commit/) を参照してください。
+
+#### コミット内容
+
+コミット内容は、1つのコミットに含まれるすべての内容の変更を表します。1つのコミットに、他のコミットの助けを借りずにレビュアーが完全にレビューできる内容を含めるのが最善です。言い換えれば、1つのコミットの内容は CI を通過でき、コードの混乱を避けることができます。簡単に言えば、次の3つの小さなルールを覚えておく必要があります：
+
+* コミットで非常に大きな変更を避ける；
+* 各コミットが完全でレビュー可能であること。
+* コミット時に git config（`user.name`、`user.email`）を確認して、それが GitHub ID に関連付けられていることを確認します。
+
+```bash
+git config --get user.name
+git config --get user.email
+```
+
+* pr を提出する際には、'changes/' フォルダーの下の XXX.md ファイルに現在の変更の簡単な説明を追加してください。
+
+さらに、コード変更部分では、すべての貢献者が Higress の [コードスタイル](#コードスタイル) を読むことをお勧めします。
+
+コミットメッセージやコミット内容に関係なく、コードレビューに重点を置いています。
+
+### PR 説明
+
+PR は Higress プロジェクトファイルを変更する唯一の方法です。レビュアーが目的をよりよく理解できるようにするために、PR 説明は詳細すぎることはありません。貢献者には、[PR テンプレート](./.github/PULL_REQUEST_TEMPLATE.md) に従ってプルリクエストを完了することを奨励します。
+
+### 開発前の準備
+
+```shell
+make prebuild && go mod tidy
+```
+
+## テストケースの貢献
+
+テストケースは歓迎されます。現在、Higress の機能テストケースが高優先度です。
+
+* 単体テストの場合、同じモジュールの test ディレクトリに xxxTest.go という名前のテストファイルを作成する必要があります。
+* 統合テストの場合、統合テストを test ディレクトリに配置できます。
+//TBD
+
+## 何かを手伝うための参加
+
+GitHub を Higress の協力の主要な場所として選択しました。したがって、Higress の最新の更新は常にここにあります。PR を通じた貢献は明確な助けの方法ですが、他の方法も呼びかけています。
+
+* 可能であれば、他の人の質問に返信する；
+* 他のユーザーの問題を解決するのを手伝う；
+* 他の人の PR 設計をレビューするのを手伝う；
+* 他の人の PR のコードをレビューするのを手伝う；
+* Higress について議論して、物事を明確にする；
+* GitHub 以外で Higress 技術を宣伝する；
+* Higress に関するブログを書くなど。
+
+## コードスタイル
+//TBD
+要するに、**どんな助けも貢献です。**

DEP_VERSION

@@ -0,0 +1 @@
+higress-console: v2.1.7

Makefile

@@ -32,7 +32,7 @@ export BUILD_WITH_CONTAINER ?= 0
 
 ifeq ($(BUILD_WITH_CONTAINER),1)
 
-# An export free of arugments in a Makefile places all variables in the Makefile into the
+# An export free of arguments in a Makefile places all variables in the Makefile into the
 # environment. This is needed to allow overrides from Makefile.overrides.mk.
 export
 
@@ -60,7 +60,7 @@ else
 $(shell mkdir -p out)
 $(shell $(shell pwd)/tools/hack/setup_env.sh envfile > out/.env)
 include out/.env
-# An export free of arugments in a Makefile places all variables in the Makefile into the
+# An export free of arguments in a Makefile places all variables in the Makefile into the
 # environment. This behavior may be surprising to many that use shell often, which simply
 # displays the existing environment
 export

Makefile.core.mk

@@ -1,12 +1,16 @@
 SHELL := /bin/bash -o pipefail
 
-export BASE_VERSION ?= 2022-10-27T19-02-22
+export HIGRESS_BASE_VERSION ?= 2023-07-20T20-50-43
 
 export HUB ?= higress-registry.cn-hangzhou.cr.aliyuncs.com/higress
 
+export ISTIO_BASE_REGISTRY ?= $(HUB)
+
+export BASE_VERSION ?= $(HIGRESS_BASE_VERSION)
+
 export CHARTS ?= higress-registry.cn-hangzhou.cr.aliyuncs.com/charts
 
-VERSION_PACKAGE := github.com/alibaba/higress/pkg/cmd/version
+VERSION_PACKAGE := github.com/alibaba/higress/pkg/cmd/lversion
 
 GIT_COMMIT:=$(shell git rev-parse HEAD)
 
@@ -45,6 +49,7 @@ HIGRESS_DOCKER_BUILD_TOP:=${OUT_LINUX}/docker_build
 
 HIGRESS_BINARIES:=./cmd/higress
 
+HGCTL_PROJECT_DIR=./hgctl
 HGCTL_BINARIES:=./cmd/hgctl
 
 $(OUT):
@@ -52,6 +57,7 @@ $(OUT):
 
 submodule:
 	git submodule update --init
+#	git submodule update --remote
 
 .PHONY: prebuild
 prebuild: submodule
@@ -66,34 +72,41 @@ go.test.coverage: prebuild
 
 .PHONY: build
 build: prebuild $(OUT)
-	GOPROXY=$(GOPROXY) GOOS=$(GOOS_LOCAL) GOARCH=$(GOARCH_LOCAL) LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh $(OUT)/ $(HIGRESS_BINARIES)
+	GOPROXY="$(GOPROXY)" GOOS=$(GOOS_LOCAL) GOARCH=$(GOARCH_LOCAL) LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh $(OUT)/ $(HIGRESS_BINARIES)
 
 .PHONY: build-linux
 build-linux: prebuild $(OUT)
-	GOPROXY=$(GOPROXY) GOOS=linux GOARCH=$(GOARCH_LOCAL) LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh $(OUT_LINUX)/ $(HIGRESS_BINARIES)
+	GOPROXY="$(GOPROXY)" GOOS=linux GOARCH=$(GOARCH_LOCAL) LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh $(OUT_LINUX)/ $(HIGRESS_BINARIES)
 
 $(AMD64_OUT_LINUX)/higress:
-	GOPROXY=$(GOPROXY) GOOS=linux GOARCH=amd64 LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh ./out/linux_amd64/ $(HIGRESS_BINARIES)
+	GOPROXY="$(GOPROXY)" GOOS=linux GOARCH=amd64 LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh ./out/linux_amd64/ $(HIGRESS_BINARIES)
 
 $(ARM64_OUT_LINUX)/higress:
-	GOPROXY=$(GOPROXY) GOOS=linux GOARCH=arm64 LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh ./out/linux_arm64/ $(HIGRESS_BINARIES)
+	GOPROXY="$(GOPROXY)" GOOS=linux GOARCH=arm64 LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh ./out/linux_arm64/ $(HIGRESS_BINARIES)
 
 .PHONY: build-hgctl
 build-hgctl: prebuild $(OUT)
-	GOPROXY=$(GOPROXY) GOOS=$(GOOS_LOCAL) GOARCH=$(GOARCH_LOCAL) LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh $(OUT)/ $(HGCTL_BINARIES)
+	GOPROXY=$(GOPROXY) GOOS=$(GOOS_LOCAL) GOARCH=$(GOARCH_LOCAL) LDFLAGS=$(RELEASE_LDFLAGS) PROJECT_DIR="$(HGCTL_PROJECT_DIR)" tools/hack/gobuild.sh $(OUT)/ $(HGCTL_BINARIES)
 
 .PHONY: build-linux-hgctl
 build-linux-hgctl: prebuild $(OUT)
-	GOPROXY=$(GOPROXY) GOOS=linux GOARCH=$(GOARCH_LOCAL) LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh $(OUT_LINUX)/ $(HGCTL_BINARIES)
+	GOPROXY=$(GOPROXY) GOOS=linux GOARCH=$(GOARCH_LOCAL) LDFLAGS=$(RELEASE_LDFLAGS) PROJECT_DIR="$(HGCTL_PROJECT_DIR)" tools/hack/gobuild.sh $(OUT_LINUX)/ $(HGCTL_BINARIES)
 
 .PHONY: build-hgctl-multiarch
 build-hgctl-multiarch: prebuild $(OUT)
-	GOPROXY=$(GOPROXY) GOOS=linux GOARCH=amd64 LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh ./out/linux_amd64/ $(HGCTL_BINARIES)
-	GOPROXY=$(GOPROXY) GOOS=linux GOARCH=arm64 LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh ./out/linux_arm64/ $(HGCTL_BINARIES)
-	GOPROXY=$(GOPROXY) GOOS=darwin GOARCH=amd64 LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh ./out/darwin_amd64/ $(HGCTL_BINARIES)
-	GOPROXY=$(GOPROXY) GOOS=darwin GOARCH=arm64 LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh ./out/darwin_arm64/ $(HGCTL_BINARIES)
-	GOPROXY=$(GOPROXY) GOOS=windows GOARCH=amd64 LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh ./out/windows_amd64/ $(HGCTL_BINARIES)
-	GOPROXY=$(GOPROXY) GOOS=windows GOARCH=arm64 LDFLAGS=$(RELEASE_LDFLAGS) tools/hack/gobuild.sh ./out/windows_arm64/ $(HGCTL_BINARIES)
+	GOPROXY=$(GOPROXY) GOOS=linux GOARCH=amd64 LDFLAGS=$(RELEASE_LDFLAGS) PROJECT_DIR="$(HGCTL_PROJECT_DIR)" tools/hack/gobuild.sh ../out/linux_amd64/ $(HGCTL_BINARIES)
+	GOPROXY=$(GOPROXY) GOOS=linux GOARCH=arm64 LDFLAGS=$(RELEASE_LDFLAGS) PROJECT_DIR="$(HGCTL_PROJECT_DIR)" tools/hack/gobuild.sh ../out/linux_arm64/ $(HGCTL_BINARIES)
+	GOPROXY=$(GOPROXY) GOOS=windows GOARCH=amd64 LDFLAGS=$(RELEASE_LDFLAGS) PROJECT_DIR="$(HGCTL_PROJECT_DIR)" tools/hack/gobuild.sh ../out/windows_amd64/ $(HGCTL_BINARIES)
+	GOPROXY=$(GOPROXY) GOOS=windows GOARCH=arm64 LDFLAGS=$(RELEASE_LDFLAGS) PROJECT_DIR="$(HGCTL_PROJECT_DIR)" tools/hack/gobuild.sh ../out/windows_arm64/ $(HGCTL_BINARIES)
+
+.PHONY: build-hgctl-macos-arm64
+build-hgctl-macos-arm64: prebuild $(OUT)
+	CGO_ENABLED=1 STATIC=0 GOPROXY=$(GOPROXY) GOOS=darwin GOARCH=arm64 PROJECT_DIR="$(HGCTL_PROJECT_DIR)" tools/hack/gobuild.sh ../out/darwin_arm64/ $(HGCTL_BINARIES)
+
+.PHONY: build-hgctl-macos-amd64
+build-hgctl-macos-amd64: prebuild $(OUT)
+	CGO_ENABLED=1 STATIC=0 GOPROXY=$(GOPROXY) GOOS=darwin GOARCH=amd64 PROJECT_DIR="$(HGCTL_PROJECT_DIR)" tools/hack/gobuild.sh ../out/darwin_amd64/ $(HGCTL_BINARIES)
+
 # Create targets for OUT_LINUX/binary
 # There are two use cases here:
 # * Building all docker images (generally in CI). In this case we want to build everything at once, so they share work
@@ -124,44 +137,47 @@ endif
 # for now docker is limited to Linux compiles - why ?
 include docker/docker.mk
 
+docker-build-amd64: docker.higress-amd64 ## Build and push amdd64 docker images to registry defined by $HUB and $TAG
+
 docker-build: docker.higress ## Build and push docker images to registry defined by $HUB and $TAG
 
 docker-buildx-push: clean-env docker.higress-buildx
 
-docker-build-base:
-	docker buildx build --no-cache --platform linux/amd64,linux/arm64 -t ${HUB}/base:${BASE_VERSION} -f docker/Dockerfile.base . --push
-
 export PARENT_GIT_TAG:=$(shell cat VERSION)
 export PARENT_GIT_REVISION:=$(TAG)
 
-export ENVOY_TAR_PATH:=/home/package/envoy.tar.gz
+export ENVOY_PACKAGE_URL_PATTERN?=https://github.com/higress-group/proxy/releases/download/v2.1.9/envoy-symbol-ARCH.tar.gz
 
-external/package/envoy-amd64.tar.gz:
-#	cd external/proxy; BUILD_WITH_CONTAINER=1  make test_release
-	cd external/package; wget -O envoy-amd64.tar.gz "https://github.com/alibaba/higress/releases/download/v1.3.4-rc.1/envoy-symbol-amd64.tar.gz"
+build-envoy: prebuild
+	./tools/hack/build-envoy.sh
 
-external/package/envoy-arm64.tar.gz:
-#	cd external/proxy; BUILD_WITH_CONTAINER=1  make test_release
-	cd external/package; wget -O envoy-arm64.tar.gz "https://github.com/alibaba/higress/releases/download/v1.3.4-rc.1/envoy-symbol-arm64.tar.gz"
+build-pilot: prebuild
+	TARGET_ARCH=amd64 ./tools/hack/build-istio-pilot.sh
+	TARGET_ARCH=arm64 ./tools/hack/build-istio-pilot.sh
 
-build-pilot:
-	cd external/istio; rm -rf out/linux_amd64; GOOS_LOCAL=linux TARGET_OS=linux TARGET_ARCH=amd64 BUILD_WITH_CONTAINER=1 make build-linux
-	cd external/istio; rm -rf out/linux_arm64; GOOS_LOCAL=linux TARGET_OS=linux TARGET_ARCH=arm64 BUILD_WITH_CONTAINER=1 make build-linux
+build-pilot-local: prebuild
+	TARGET_ARCH=${TARGET_ARCH} ./tools/hack/build-istio-pilot.sh
 
-build-pilot-local:
-	cd external/istio; rm -rf out/linux_${GOARCH_LOCAL}; GOOS_LOCAL=linux TARGET_OS=linux TARGET_ARCH=${GOARCH_LOCAL} BUILD_WITH_CONTAINER=1 make build-linux
+buildx-prepare:
+	docker buildx inspect multi-arch >/dev/null 2>&1 || docker buildx create --name multi-arch --platform linux/amd64,linux/arm64 --use
 
-build-gateway: prebuild external/package/envoy-amd64.tar.gz external/package/envoy-arm64.tar.gz build-pilot
-	cd external/istio; BUILD_WITH_CONTAINER=1 BUILDX_PLATFORM=true DOCKER_BUILD_VARIANTS=default DOCKER_TARGETS="docker.proxyv2" make docker
+build-gateway: prebuild buildx-prepare build-golang-filter
+	USE_REAL_USER=1 TARGET_ARCH=amd64 DOCKER_TARGETS="docker.proxyv2" ./tools/hack/build-istio-image.sh init
+	USE_REAL_USER=1 TARGET_ARCH=arm64 DOCKER_TARGETS="docker.proxyv2" ./tools/hack/build-istio-image.sh init
+	DOCKER_TARGETS="docker.proxyv2" IMG_URL="${IMG_URL}" ./tools/hack/build-istio-image.sh docker.buildx
 
-build-gateway-local: prebuild external/package/envoy-amd64.tar.gz external/package/envoy-arm64.tar.gz
-	cd external/istio; rm -rf out/linux_${GOARCH_LOCAL}; GOOS_LOCAL=linux TARGET_OS=linux BUILD_WITH_CONTAINER=1 BUILDX_PLATFORM=false DOCKER_BUILD_VARIANTS=default DOCKER_TARGETS="docker.proxyv2" make docker
+build-gateway-local: prebuild build-golang-filter
+	TARGET_ARCH=${TARGET_ARCH} DOCKER_TARGETS="docker.proxyv2" ./tools/hack/build-istio-image.sh docker
 
-build-istio: prebuild build-pilot
-	cd external/istio; BUILD_WITH_CONTAINER=1 BUILDX_PLATFORM=true DOCKER_BUILD_VARIANTS=default DOCKER_TARGETS="docker.pilot" make docker
+build-golang-filter:
+	TARGET_ARCH=amd64 ./tools/hack/build-golang-filters.sh
+	TARGET_ARCH=arm64 ./tools/hack/build-golang-filters.sh
+
+build-istio: prebuild buildx-prepare
+	DOCKER_TARGETS="docker.pilot" IMG_URL="${IMG_URL}" ./tools/hack/build-istio-image.sh docker.buildx
 
 build-istio-local: prebuild
-	cd external/istio; rm -rf out/linux_${GOARCH_LOCAL}; GOOS_LOCAL=linux TARGET_OS=linux BUILD_WITH_CONTAINER=1 BUILDX_PLATFORM=false DOCKER_BUILD_VARIANTS=default DOCKER_TARGETS="docker.pilot" make docker
+	TARGET_ARCH=${TARGET_ARCH} DOCKER_TARGETS="docker.pilot" ./tools/hack/build-istio-image.sh docker
 
 build-wasmplugins:
 	./tools/hack/build-wasm-plugins.sh
@@ -177,8 +193,9 @@ install: pre-install
 	cd helm/higress; helm dependency build
 	helm install higress helm/higress -n higress-system --create-namespace --set 'global.local=true'
 
-ENVOY_LATEST_IMAGE_TAG ?= sha-29baf85
-ISTIO_LATEST_IMAGE_TAG ?= sha-29baf85
+HIGRESS_LATEST_IMAGE_TAG ?= latest
+ENVOY_LATEST_IMAGE_TAG ?= 48da465cfd0dc5c9ac851bd2b9743780dc82dd8a
+ISTIO_LATEST_IMAGE_TAG ?= latest
 
 install-dev: pre-install
 	helm install higress helm/core -n higress-system --create-namespace --set 'controller.tag=$(TAG)' --set 'gateway.replicas=1' --set 'pilot.tag=$(ISTIO_LATEST_IMAGE_TAG)' --set 'gateway.tag=$(ENVOY_LATEST_IMAGE_TAG)' --set 'global.local=true'
@@ -211,12 +228,17 @@ clean-higress: ## Cleans all the intermediate files and folders previously gener
 	rm -rf $(DIRS_TO_CLEAN)
 
 clean-istio:
+	rm -rf external/api
+	rm -rf external/client-go
 	rm -rf external/istio
+	rm -rf external/pkg
 
 clean-gateway: clean-istio
 	rm -rf external/envoy
 	rm -rf external/proxy
+	rm -rf external/go-control-plane
 	rm -rf external/package/envoy.tar.gz
+	rm -rf external/package/*.so
 
 clean-env:
 	rm -rf out/
@@ -249,10 +271,26 @@ higress-conformance-test-clean: $(tools/kind) delete-cluster
 .PHONY: higress-wasmplugin-test-prepare
 higress-wasmplugin-test-prepare: $(tools/kind) delete-cluster create-cluster docker-build kube-load-image install-dev-wasmplugin
 
+# higress-wasmplugin-test-prepare-skip-docker-build prepares the environment for higress wasmplugin tests without build higress docker image.
+.PHONY: higress-wasmplugin-test-prepare-skip-docker-build
+higress-wasmplugin-test-prepare-skip-docker-build: $(tools/kind) delete-cluster create-cluster prebuild
+	@export TAG="$(HIGRESS_LATEST_IMAGE_TAG)" && \
+	$(MAKE) kube-load-image && \
+	$(MAKE) install-dev-wasmplugin
+
 # higress-wasmplugin-test runs ingress wasmplugin tests.
 .PHONY: higress-wasmplugin-test
 higress-wasmplugin-test: $(tools/kind) delete-cluster create-cluster docker-build kube-load-image install-dev-wasmplugin run-higress-e2e-test-wasmplugin delete-cluster
 
+# higress-wasmplugin-test-skip-docker-build runs ingress wasmplugin tests without build higress docker image
+.PHONY: higress-wasmplugin-test-skip-docker-build
+higress-wasmplugin-test-skip-docker-build: $(tools/kind) delete-cluster create-cluster prebuild
+	@export TAG="$(HIGRESS_LATEST_IMAGE_TAG)" && \
+	$(MAKE) kube-load-image && \
+	$(MAKE) install-dev-wasmplugin && \
+	$(MAKE) run-higress-e2e-test-wasmplugin && \
+	$(MAKE) delete-cluster
+
 # higress-wasmplugin-test-clean cleans the environment for higress wasmplugin tests.
 .PHONY: higress-wasmplugin-test-clean
 higress-wasmplugin-test-clean: $(tools/kind) delete-cluster
@@ -271,21 +309,41 @@ delete-cluster: $(tools/kind) ## Delete kind cluster.
 # dubbo-provider-demo和nacos-standlone-rc3的镜像已经上传到阿里云镜像库，第一次需要先拉到本地
 # docker pull registry.cn-hangzhou.aliyuncs.com/hinsteny/dubbo-provider-demo:0.0.1
 # docker pull registry.cn-hangzhou.aliyuncs.com/hinsteny/nacos-standlone-rc3:1.0.0-RC3
+# If TAG is HIGRESS_LATEST_IMAGE_TAG, means we skip building higress docker image, so we need to pull the image first.
 .PHONY: kube-load-image
 kube-load-image: $(tools/kind) ## Install the Higress image to a kind cluster using the provided $IMAGE and $TAG.
+	@if [ "$(TAG)" = "$(HIGRESS_LATEST_IMAGE_TAG)" ]; then \
+		tools/hack/docker-pull-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/higress $(TAG); \
+	fi
 	tools/hack/kind-load-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/higress $(TAG)
+	tools/hack/docker-pull-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/pilot $(ISTIO_LATEST_IMAGE_TAG)
+	tools/hack/docker-pull-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/gateway $(ENVOY_LATEST_IMAGE_TAG)
 	tools/hack/docker-pull-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/dubbo-provider-demo 0.0.3-x86
-	tools/hack/docker-pull-image.sh docker.io/alihigress/nacos-standlone-rc3 1.0.0-RC3
+	tools/hack/docker-pull-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/nacos-standlone-rc3 1.0.0-RC3
 	tools/hack/docker-pull-image.sh docker.io/hashicorp/consul 1.16.0
 	tools/hack/docker-pull-image.sh docker.io/charlie1380/eureka-registry-provider v0.3.0
 	tools/hack/docker-pull-image.sh docker.io/bitinit/eureka latest
-	tools/hack/docker-pull-image.sh docker.io/alihigress/httpbin 1.0.2
+	tools/hack/docker-pull-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/httpbin 1.0.2
+	tools/hack/docker-pull-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/echo-server 1.3.0
+	tools/hack/docker-pull-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/echo-server v1.0
+	tools/hack/docker-pull-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/echo-body 1.0.0
+	tools/hack/docker-pull-image.sh openpolicyagent/opa 0.61.0
+	tools/hack/docker-pull-image.sh curlimages/curl latest
+	tools/hack/docker-pull-image.sh registry.cn-hangzhou.aliyuncs.com/2456868764/httpbin 1.0.2
+	tools/hack/docker-pull-image.sh registry.cn-hangzhou.aliyuncs.com/hinsteny/nacos-standlone-rc3 1.0.0-RC3
 	tools/hack/kind-load-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/dubbo-provider-demo 0.0.3-x86
-	tools/hack/kind-load-image.sh docker.io/alihigress/nacos-standlone-rc3 1.0.0-RC3
+	tools/hack/kind-load-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/nacos-standlone-rc3 1.0.0-RC3
 	tools/hack/kind-load-image.sh docker.io/hashicorp/consul 1.16.0
-	tools/hack/kind-load-image.sh docker.io/alihigress/httpbin 1.0.2
+	tools/hack/kind-load-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/httpbin 1.0.2
 	tools/hack/kind-load-image.sh docker.io/charlie1380/eureka-registry-provider v0.3.0
 	tools/hack/kind-load-image.sh docker.io/bitinit/eureka latest
+	tools/hack/kind-load-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/echo-server 1.3.0
+	tools/hack/kind-load-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/echo-server v1.0
+	tools/hack/kind-load-image.sh higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/echo-body 1.0.0
+	tools/hack/kind-load-image.sh openpolicyagent/opa 0.61.0
+	tools/hack/kind-load-image.sh curlimages/curl latest
+	tools/hack/kind-load-image.sh registry.cn-hangzhou.aliyuncs.com/2456868764/httpbin 1.0.2
+	tools/hack/kind-load-image.sh registry.cn-hangzhou.aliyuncs.com/hinsteny/nacos-standlone-rc3 1.0.0-RC3
 
 # run-higress-e2e-test-setup starts to setup ingress e2e tests.
 .PHONT: run-higress-e2e-test-setup
@@ -305,7 +363,7 @@ run-higress-e2e-test:
 	kubectl wait --timeout=10m -n higress-system deployment/higress-controller --for=condition=Available
 	@echo -e "\n\033[36mWaiting higress-gateway to be ready...\033[0m\n"
 	kubectl wait --timeout=10m -n higress-system deployment/higress-gateway --for=condition=Available
-	go test -v -tags conformance ./test/e2e/e2e_test.go --ingress-class=higress --debug=true --test-area=all
+	go test -v -tags conformance ./test/e2e/e2e_test.go --ingress-class=higress --debug=true --test-area=all --execute-tests=$(TEST_SHORTNAME)
 
 # run-higress-e2e-test-run starts to run ingress e2e conformance tests.
 .PHONY: run-higress-e2e-test-run
@@ -315,7 +373,7 @@ run-higress-e2e-test-run:
 	kubectl wait --timeout=10m -n higress-system deployment/higress-controller --for=condition=Available
 	@echo -e "\n\033[36mWaiting higress-gateway to be ready...\033[0m\n"
 	kubectl wait --timeout=10m -n higress-system deployment/higress-gateway --for=condition=Available
-	go test -v -tags conformance ./test/e2e/e2e_test.go --ingress-class=higress --debug=true --test-area=run
+	go test -v -tags conformance ./test/e2e/e2e_test.go --ingress-class=higress --debug=true --test-area=run --execute-tests=$(TEST_SHORTNAME)
 
 # run-higress-e2e-test-clean starts to clean ingress e2e tests.
 .PHONY: run-higress-e2e-test-clean
@@ -345,7 +403,7 @@ run-higress-e2e-test-wasmplugin:
 	kubectl wait --timeout=10m -n higress-system deployment/higress-controller --for=condition=Available
 	@echo -e "\n\033[36mWaiting higress-gateway to be ready...\033[0m\n"
 	kubectl wait --timeout=10m -n higress-system deployment/higress-gateway --for=condition=Available
-	go test -v -tags conformance ./test/e2e/e2e_test.go -isWasmPluginTest=true -wasmPluginType=$(PLUGIN_TYPE) -wasmPluginName=$(PLUGIN_NAME) --ingress-class=higress --debug=true --test-area=all
+	go test -v -tags conformance ./test/e2e/e2e_test.go -isWasmPluginTest=true -wasmPluginType=$(PLUGIN_TYPE) -wasmPluginName=$(PLUGIN_NAME) --ingress-class=higress --debug=true --test-area=all --execute-tests=$(TEST_SHORTNAME)
 
 # run-higress-e2e-test-wasmplugin-run starts to run ingress e2e conformance tests.
 .PHONY: run-higress-e2e-test-wasmplugin-run
@@ -355,7 +413,7 @@ run-higress-e2e-test-wasmplugin-run:
 	kubectl wait --timeout=10m -n higress-system deployment/higress-controller --for=condition=Available
 	@echo -e "\n\033[36mWaiting higress-gateway to be ready...\033[0m\n"
 	kubectl wait --timeout=10m -n higress-system deployment/higress-gateway --for=condition=Available
-	go test -v -tags conformance ./test/e2e/e2e_test.go -isWasmPluginTest=true -wasmPluginType=$(PLUGIN_TYPE) -wasmPluginName=$(PLUGIN_NAME) --ingress-class=higress --debug=true --test-area=run
+	go test -v -tags conformance ./test/e2e/e2e_test.go -isWasmPluginTest=true -wasmPluginType=$(PLUGIN_TYPE) -wasmPluginName=$(PLUGIN_NAME) --ingress-class=higress --debug=true --test-area=run --execute-tests=$(TEST_SHORTNAME)
 
 # run-higress-e2e-test-wasmplugin-clean starts to clean ingress e2e tests.
 .PHONY: run-higress-e2e-test-wasmplugin-clean

Makefile.overrides.mk

@@ -25,7 +25,7 @@ GENERATE_API ?= 0
 
 ifeq ($(GENERATE_API),1)
 BUILD_WITH_CONTAINER = 1
-IMAGE_VERSION=release-1.12-2021-11-12T20-52-48
+IMAGE_VERSION=release-1.19-ef344298e65eeb2d9e2d07b87eb4e715c2def613
 endif
 
 ifeq ($(BUILD_WITH_CONTAINER),1)

README.md

@@ -1,131 +1,176 @@
+<a name="readme-top"></a>
 <h1 align="center">
     <img src="https://img.alicdn.com/imgextra/i2/O1CN01NwxLDd20nxfGBjxmZ_!!6000000006895-2-tps-960-290.png" alt="Higress" width="240" height="72.5">
   <br>
-  Cloud Native API Gateway
+  AI Gateway
 </h1>
+<h4 align="center"> AI Native API Gateway </h4>
 
+<div align="center">
+    
 [![Build Status](https://github.com/alibaba/higress/actions/workflows/build-and-test.yaml/badge.svg?branch=main)](https://github.com/alibaba/higress/actions)
 [![license](https://img.shields.io/github/license/alibaba/higress.svg)](https://www.apache.org/licenses/LICENSE-2.0.html)
+[![discord](https://img.shields.io/discord/1364956090566971515?color=5865F2&label=discord&labelColor=black&logo=discord&logoColor=white&style=flat-square)](https://discord.gg/tSbww9VDaM)
 
-[**官网**](https://higress.io/) &nbsp; |
-&nbsp; [**文档**](https://higress.io/zh-cn/docs/overview/what-is-higress) &nbsp; |
-&nbsp; [**博客**](https://higress.io/zh-cn/blog) &nbsp; |
-&nbsp; [**开发指引**](https://higress.io/zh-cn/docs/developers/developers_dev) &nbsp; |
-&nbsp; [**Higress 企业版**](https://www.aliyun.com/product/aliware/mse?spm=higress-website.topbar.0.0.0) &nbsp;
+<a href="https://trendshift.io/repositories/10918" target="_blank"><img src="https://trendshift.io/api/badge/repositories/10918" alt="alibaba%2Fhigress | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a> <a href="https://www.producthunt.com/posts/higress?embed=true&utm_source=badge-featured&utm_medium=badge&utm_souce=badge-higress" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=951287&theme=light&t=1745492822283" alt="Higress - Global&#0032;APIs&#0032;as&#0032;MCP&#0032;powered&#0032;by&#0032;AI&#0032;Gateway | Product Hunt" style="width: 250px; height: 54px;" width="250" height="54" /></a>
 
+</div>
+
+[**Official Site**](https://higress.ai/en/) &nbsp; |
+&nbsp; [**MCP Server QuickStart**](https://higress.cn/en/ai/mcp-quick-start/) &nbsp; |
+&nbsp; [**Wasm Plugin Hub**](https://higress.cn/en/plugin/) &nbsp; |
 
 <p>
-   <a href="README_EN.md"> English <a/> | 中文
+   English | <a href="README_ZH.md">中文<a/> | <a href="README_JP.md">日本語<a/>
 </p>
 
+## What is Higress?
 
-Higress 是基于阿里内部两年多的 Envoy Gateway 实践沉淀，以开源 [Istio](https://github.com/istio/istio) 与 [Envoy](https://github.com/envoyproxy/envoy) 为核心构建的云原生 API 网关。Higress 实现了安全防护网关、流量网关、微服务网关三层网关合一，可以显著降低网关的部署和运维成本。
+Higress is a cloud-native API gateway based on Istio and Envoy, which can be extended with Wasm plugins written in Go/Rust/JS. It provides dozens of ready-to-use general-purpose plugins and an out-of-the-box console (try the [demo here](http://demo.higress.io/)).
 
-![arch](https://img.alicdn.com/imgextra/i1/O1CN01iO9ph825juHbOIg75_!!6000000007563-2-tps-2483-2024.png)
+### Core Use Cases
+
+Higress's AI gateway capabilities support all [mainstream model providers](https://github.com/alibaba/higress/tree/main/plugins/wasm-go/extensions/ai-proxy/provider) both domestic and international. It also supports hosting MCP (Model Context Protocol) Servers through its plugin mechanism, enabling AI Agents to easily call various tools and services. With the [openapi-to-mcp tool](https://github.com/higress-group/openapi-to-mcpserver), you can quickly convert OpenAPI specifications into remote MCP servers for hosting. Higress provides unified management for both LLM API and MCP API. 
+
+**🌟 Try it now at [https://mcp.higress.ai/](https://mcp.higress.ai/)** to experience Higress-hosted Remote MCP Servers firsthand:
+
+![Higress MCP Server Platform](https://img.alicdn.com/imgextra/i2/O1CN01nmVa0a1aChgpyyWOX_!!6000000003294-0-tps-3430-1742.jpg)
+
+### Enterprise Adoption
+
+Higress was born within Alibaba to solve the issues of Tengine reload affecting long-connection services and insufficient load balancing capabilities for gRPC/Dubbo. Within Alibaba Cloud, Higress's AI gateway capabilities support core AI applications such as Tongyi Bailian model studio, machine learning PAI platform, and other critical AI services. Alibaba Cloud has built its cloud-native API gateway product based on Higress, providing 99.99% gateway high availability guarantee service capabilities for a large number of enterprise customers.
 
 ## Summary
+
+- [**Quick Start**](#quick-start)    
+- [**Feature Showcase**](#feature-showcase)
+- [**Use Cases**](#use-cases)
+- [**Core Advantages**](#core-advantages)
+- [**Community**](#community)
+
+## Quick Start
+
+Higress can be started with just Docker, making it convenient for individual developers to set up locally for learning or for building simple sites:
+
+```bash
+# Create a working directory
+mkdir higress; cd higress
+# Start higress, configuration files will be written to the working directory
+docker run -d --rm --name higress-ai -v ${PWD}:/data \
+        -p 8001:8001 -p 8080:8080 -p 8443:8443  \
+        higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/all-in-one:latest
+```
+
+Port descriptions:
+
+- Port 8001: Higress UI console entry
+- Port 8080: Gateway HTTP protocol entry
+- Port 8443: Gateway HTTPS protocol entry
+
+> All Higress Docker images use Higress's own image repository and are not affected by Docker Hub rate limits.
+> In addition, the submission and updates of the images are protected by a security scanning mechanism (powered by Alibaba Cloud ACR), making them very secure for use in production environments.
+> 
+> If you experience a timeout when pulling image from `higress-registry.cn-hangzhou.cr.aliyuncs.com`, you can try replacing it with the following docker registry mirror source:
+> 
+> **Southeast Asia**: `higress-registry.ap-southeast-7.cr.aliyuncs.com`
+
+For other installation methods such as Helm deployment under K8s, please refer to the official [Quick Start documentation](https://higress.io/en-us/docs/user/quickstart).
+
+## Use Cases
+
+- **MCP Server Hosting**:
+
+  Higress hosts MCP Servers through its plugin mechanism, enabling AI Agents to easily call various tools and services. With the [openapi-to-mcp tool](https://github.com/higress-group/openapi-to-mcpserver), you can quickly convert OpenAPI specifications into remote MCP servers.
+
+  ![](https://img.alicdn.com/imgextra/i1/O1CN01wv8H4g1mS4MUzC1QC_!!6000000004952-2-tps-1764-597.png)
+
+  Key benefits of hosting MCP Servers with Higress:
+  - Unified authentication and authorization mechanisms
+  - Fine-grained rate limiting to prevent abuse
+  - Comprehensive audit logs for all tool calls
+  - Rich observability for monitoring performance
+  - Simplified deployment through Higress's plugin mechanism
+  - Dynamic updates without disruption or connection drops
+
+     [Learn more...](https://higress.cn/en/ai/mcp-quick-start/?spm=36971b57.7beea2de.0.0.d85f20a94jsWGm)
+
+- **AI Gateway**:
+
+  Higress connects to all LLM model providers using a unified protocol, with AI observability, multi-model load balancing, token rate limiting, and caching capabilities:
+
+  ![](https://img.alicdn.com/imgextra/i2/O1CN01izmBNX1jbHT7lP3Yr_!!6000000004566-0-tps-1920-1080.jpg)
+
+- **Kubernetes ingress controller**:
+
+  Higress can function as a feature-rich ingress controller, which is compatible with many annotations of K8s' nginx ingress controller.
+  
+  [Gateway API](https://gateway-api.sigs.k8s.io/) support is coming soon and will support smooth migration from Ingress API to Gateway API.
+  
+- **Microservice gateway**:
+
+  Higress can function as a microservice gateway, which can discovery microservices from various service registries, such as Nacos, ZooKeeper, Consul, Eureka, etc.
+  
+  It deeply integrates with [Dubbo](https://github.com/apache/dubbo), [Nacos](https://github.com/alibaba/nacos), [Sentinel](https://github.com/alibaba/Sentinel) and other microservice technology stacks.
+  
+- **Security gateway**:
+
+  Higress can be used as a security gateway, supporting WAF and various authentication strategies, such as key-auth, hmac-auth, jwt-auth, basic-auth, oidc, etc.
+
+
+## Core Advantages
+
+- **Production Grade**
+
+  Born from Alibaba's internal product with over 2 years of production validation, supporting large-scale scenarios with hundreds of thousands of requests per second.
+
+  Completely eliminates traffic jitter caused by Nginx reload, configuration changes take effect in milliseconds and are transparent to business. Especially friendly to long-connection scenarios such as AI businesses.
+
+- **Streaming Processing**
+
+  Supports true complete streaming processing of request/response bodies, Wasm plugins can easily customize the handling of streaming protocols such as SSE (Server-Sent Events).
+
+  In high-bandwidth scenarios such as AI businesses, it can significantly reduce memory overhead.
     
-- [**功能展示**](#功能展示)
-- [**使用场景**](#使用场景)
-- [**核心优势**](#核心优势)
-- [**Quick Start**](https://higress.io/zh-cn/docs/user/quickstart)
-- [**社区**](#社区)
-
-
-## 使用场景
-
-- **Kubernetes Ingress 网关**:
-
-  Higress 可以作为 K8s 集群的 Ingress 入口网关, 并且兼容了大量 K8s Nginx Ingress 的注解，可以从 K8s Nginx Ingress 快速平滑迁移到 Higress。
+- **Easy to Extend**
   
-  支持 [Gateway API](https://gateway-api.sigs.k8s.io/) 标准，支持用户从 Ingress API 平滑迁移到 Gateway API。
+  Provides a rich official plugin library covering AI, traffic management, security protection and other common functions, meeting more than 90% of business scenario requirements.
+
+  Focuses on Wasm plugin extensions, ensuring memory safety through sandbox isolation, supporting multiple programming languages, allowing plugin versions to be upgraded independently, and achieving traffic-lossless hot updates of gateway logic.
+
+- **Secure and Easy to Use**
   
-- **微服务网关**:
+  Based on Ingress API and Gateway API standards, provides out-of-the-box UI console, WAF protection plugin, IP/Cookie CC protection plugin ready to use.
 
-  Higress 可以作为微服务网关, 能够对接多种类型的注册中心发现服务配置路由，例如 Nacos, ZooKeeper, Consul, Eureka 等。
-  
-  并且深度集成了 [Dubbo](https://github.com/apache/dubbo), [Nacos](https://github.com/alibaba/nacos), [Sentinel](https://github.com/alibaba/Sentinel) 等微服务技术栈，基于 Envoy C++ 网关内核的出色性能，相比传统 Java 类微服务网关，可以显著降低资源使用率，减少成本。
-  
-- **安全防护网关**:
+  Supports connecting to Let's Encrypt for automatic issuance and renewal of free certificates, and can be deployed outside of K8s, started with a single Docker command, convenient for individual developers to use.
 
-  Higress 可以作为安全防护网关， 提供 WAF 的能力，并且支持多种认证鉴权策略，例如 key-auth, hmac-auth, jwt-auth, basic-auth, oidc 等。  
+## Community
 
-## 核心优势
+Join our Discord community! This is where you can connect with developers and other enthusiastic users of Higress.
 
-- **生产等级**
-
-  脱胎于阿里巴巴2年多生产验证的内部产品，支持每秒请求量达数十万级的大规模场景。
-
-  彻底摆脱 reload 引起的流量抖动，配置变更毫秒级生效且业务无感。
-  
-- **平滑演进**
-
-  支持 Nacos/Zookeeper/Eureka 等多种注册中心，可以不依赖 K8s Service 进行服务发现，支持非容器架构平滑演进到云原生架构。
-
-  支持从 Nginx Ingress Controller 平滑迁移，支持平滑过渡到 Gateway API，支持业务架构平滑演进到 ServiceMesh。
-
-- **兼收并蓄**
-  
-  兼容 Nginx Ingress Annotation 80%+ 的使用场景，且提供功能更丰富的 Higress Annotation 注解。
-  
-  兼容 Ingress API/Gateway API/Istio API，可以组合多种 CRD 实现流量精细化管理。
-  
-- **便于扩展**
-  
-  提供 Wasm、Lua、进程外三种插件扩展机制，支持多语言编写插件，生效粒度支持全局级、域名级，路由级。
-
-  插件支持热更新，变更插件逻辑和配置都对流量无损。
-
-## 功能展示
-    
-- **丰富的可观测**
-
-  提供开箱即用的可观测，Grafana&Prometheus 可以使用内置的也可对接自建的
-
-  ![](./docs/images/monitor.gif)
-    
-
-- **插件扩展机制**
-
-  官方提供了多种插件，用户也可以[开发](./plugins/wasm-go)自己的插件，构建成 docker/oci 镜像后在控制台配置，可以实时变更插件逻辑，对流量完全无损。
-
-  ![](./docs/images/plugin.gif)
+[![discord](https://img.shields.io/discord/1364956090566971515?color=5865F2&label=discord&labelColor=black&logo=discord&logoColor=white&style=for-the-badge)](https://discord.gg/tSbww9VDaM)
 
 
-- **多种服务发现**
+### Thanks
 
-  默认提供 K8s Service 服务发现，通过配置可以对接 Nacos/ZooKeeper 等注册中心实现服务发现，也可以基于静态 IP 或者 DNS 来发现
+Higress would not be possible without the valuable open-source work of projects in the community. We would like to extend a special thank you to Envoy and Istio.
 
-  ![](./docs/images/service-source.gif)
-    
+### Related Repositories
 
-- **域名和证书**
+- Higress Console: https://github.com/higress-group/higress-console
+- Higress Standalone: https://github.com/higress-group/higress-standalone
 
-  可以创建管理 TLS 证书，并配置域名的 HTTP/HTTPS 行为，域名策略里支持对特定域名生效插件
+### Contributors
 
-  ![](./docs/images/domain.gif)
+<a href="https://github.com/alibaba/higress/graphs/contributors">
+  <img alt="contributors" src="https://contrib.rocks/image?repo=alibaba/higress"/>
+</a>
 
+### Star History
 
-- **丰富的路由能力**
-
-  通过上面定义的服务发现机制，发现的服务会出现在服务列表中；创建路由时，选择域名，定义路由匹配机制，再选择目标服务进行路由；路由策略里支持对特定路由生效插件
-
-  ![](./docs/images/route-service.gif)
-
-
-## 社区
-
-### 感谢
-
-如果没有 Envoy 和 Istio 的开源工作，Higress 就不可能实现，在这里向这两个项目献上最诚挚的敬意。
-
-### 交流群
-
-![image](https://img.alicdn.com/imgextra/i2/O1CN01qPd7Ix1uZPVEsWjWp_!!6000000006051-0-tps-720-405.jpg)
-
-### 技术分享
-
-微信公众号：
-
-![](https://img.alicdn.com/imgextra/i1/O1CN01WnQt0q1tcmqVDU73u_!!6000000005923-0-tps-258-258.jpg)
+[![Star History Chart](https://api.star-history.com/svg?repos=alibaba/higress&type=Date)](https://star-history.com/#alibaba/higress&Date)
 
+<p align="right" style="font-size: 14px; color: #555; margin-top: 20px;">
+    <a href="#readme-top" style="text-decoration: none; color: #007bff; font-weight: bold;">
+        ↑ Back to Top ↑
+    </a>
+</p>

README_EN.md

@@ -1,84 +0,0 @@
-<h1 align="center">
-    <img src="https://img.alicdn.com/imgextra/i2/O1CN01NwxLDd20nxfGBjxmZ_!!6000000006895-2-tps-960-290.png" alt="Higress" width="240" height="72.5">
-  <br>
-  Cloud Native API Gateway
-</h1>
-
-[![Build Status](https://github.com/alibaba/higress/actions/workflows/build-and-test.yaml/badge.svg?branch=main)](https://github.com/alibaba/higress/actions)
-[![license](https://img.shields.io/github/license/alibaba/higress.svg)](https://www.apache.org/licenses/LICENSE-2.0.html)
-
-[**Official Site**](https://higress.io/en-us/) &nbsp; |
-&nbsp; [**Docs**](https://higress.io/en-us/docs/overview/what-is-higress) &nbsp; |
-&nbsp; [**Blog**](https://higress.io/en-us/blog) &nbsp; |
-&nbsp; [**Developer**](https://higress.io/en-us/docs/developers/developers_dev) &nbsp; |
-&nbsp; [**Higress in Cloud**](https://www.alibabacloud.com/product/microservices-engine?spm=higress-website.topbar.0.0.0) &nbsp;
-
-
-<p>
-   English | <a href="README.md">中文<a/>
-</p>
-
-Higress is a cloud-native api gateway based on Alibaba's internal gateway practices. 
-
-Powered by [Istio](https://github.com/istio/istio) and [Envoy](https://github.com/envoyproxy/envoy), Higress realizes the integration of the triple gateway architecture of traffic gateway, microservice gateway and security gateway, thereby greatly reducing the costs of deployment, operation and maintenance.
-
-<h1 align="center">
-  <img src="https://img.alicdn.com/imgextra/i1/O1CN01iO9ph825juHbOIg75_!!6000000007563-2-tps-2483-2024.png" alt="Higress Architecture">
-</h1>
-
-
-## Summary
-
-- [**Use Cases**](#use-cases)
-- [**Higress Features**](#higress-features)
-- [**Quick Start**](https://higress.io/en-us/docs/user/quickstart)
-- [**Community**](#community)
-- [**Thanks**](#thanks)
-
-## Use Cases
-
-- **Kubernetes ingress controller**:
-
-  Higress can function as a feature-rich ingress controller, which is compatible with many annotations of K8s' nginx ingress controller.
-  
-  [Gateway API](https://gateway-api.sigs.k8s.io/) support is coming soon and will support smooth migration from Ingress API to Gateway API.
-  
-- **Microservice gateway**:
-
-  Higress can function as a microservice gateway, which can discovery microservices from various service registries, such as Nacos, ZooKeeper, Consul, Eureka, etc.
-  
-  It deeply integrates of [Dubbo](https://github.com/apache/dubbo), [Nacos](https://github.com/alibaba/nacos), [Sentinel](https://github.com/alibaba/Sentinel) and other microservice technology stacks.
-  
-- **Security gateway**:
-
-  Higress can be used as a security gateway, supporting WAF and various authentication strategies, such as key-auth, hmac-auth, jwt-auth, basic-auth, oidc, etc.  
-
-## Higress Features
-
-- **Easy to use**
-
-  Provide one-stop gateway solutions for traffic scheduling, service management, and security protection, support Console, K8s Ingress, and Gateway API configuration methods, and also support HTTP to Dubbo protocol conversion, and easily complete protocol mapping configuration.  
-  
-- **Easy to expand**
-
-  Provides Wasm, Lua, and out-of-process plug-in extension mechanisms, so that multi-language plug-in writing is no longer an obstacle. The granularity of plug-in effectiveness supports not only the global level, domain name level, but also fine-grained routing level
-  
-- **Dynamic hot update**
-  
-  Get rid of the traffic jitter caused by reload at the bottom, the configuration change takes effect in milliseconds and the business is not affected, the Wasm plug-in is hot updated and the traffic is not damaged
-  
-- **Smooth upgrade**
-
-  Compatible with 80%+ usage scenarios of Nginx Ingress Annotation, and provides more feature-rich annotations, easy to handle Nginx Ingress migration in one step
-  
-- **Security**
-
-  Provides JWT, OIDC, custom authentication and authentication, deeply integrates open source web application firewall.
-
-## Community
-
-[Slack](https://w1689142780-euk177225.slack.com/archives/C05GEL4TGTG): to get invited go [here](https://communityinviter.com/apps/w1689142780-euk177225/higress).
-
-### Thanks
-
-Higress would not be possible without the valuable open-source work of projects in the community. We would like to extend a special thank-you to Envoy and Istio.

README_JP.md

@@ -0,0 +1,226 @@
+<a name="readme-top"></a>
+<h1 align="center">
+    <img src="https://img.alicdn.com/imgextra/i2/O1CN01NwxLDd20nxfGBjxmZ_!!6000000006895-2-tps-960-290.png" alt="Higress" width="240" height="72.5">
+  <br>
+  AIゲートウェイ
+</h1>
+<h4 align="center"> AIネイティブAPIゲートウェイ </h4>
+
+[![Build Status](https://github.com/alibaba/higress/actions/workflows/build-and-test.yaml/badge.svg?branch=main)](https://github.com/alibaba/higress/actions)
+[![license](https://img.shields.io/github/license/alibaba/higress.svg)](https://www.apache.org/licenses/LICENSE-2.0.html)
+
+[**公式サイト**](https://higress.cn/) &nbsp; |
+&nbsp; [**ドキュメント**](https://higress.cn/docs/latest/overview/what-is-higress/) &nbsp; |
+&nbsp; [**ブログ**](https://higress.cn/blog/) &nbsp; |
+&nbsp; [**電子書籍**](https://higress.cn/docs/ebook/wasm14/) &nbsp; |
+&nbsp; [**開発ガイド**](https://higress.cn/docs/latest/dev/architecture/) &nbsp; |
+&nbsp; [**AIプラグイン**](https://higress.cn/plugin/) &nbsp;
+
+
+<p>
+   <a href="README_EN.md"> English <a/> | <a href="README.md">中文<a/> | 日本語
+</p>
+
+
+## Higressとは？
+
+Higressは、IstioとEnvoyをベースにしたクラウドネイティブAPIゲートウェイで、Go/Rust/JSなどを使用してWasmプラグインを作成できます。数十の既製の汎用プラグインと、すぐに使用できるコンソールを提供しています（デモは[こちら](http://demo.higress.io/)）。
+
+### 主な使用シナリオ
+
+HigressのAIゲートウェイ機能は、国内外のすべての[主要モデルプロバイダー](https://github.com/alibaba/higress/tree/main/plugins/wasm-go/extensions/ai-proxy/provider)をサポートし、vllm/ollamaなどに基づく自己構築DeepSeekモデルにも対応しています。また、プラグインメカニズムを通じてMCP（Model Context Protocol）サーバーをホストすることもでき、AI Agentが様々なツールやサービスを簡単に呼び出せるようにします。[openapi-to-mcpツール](https://github.com/higress-group/openapi-to-mcpserver)を使用すると、OpenAPI仕様を迅速にリモートMCPサーバーに変換してホスティングできます。HigressはLLM APIとMCP APIの統一管理を提供します。
+
+**🌟 今すぐ[https://mcp.higress.ai/](https://mcp.higress.ai/)で体験**してください。HigressがホストするリモートMCPサーバーを直接体験できます:
+
+![Higress MCP Server Platform](https://img.alicdn.com/imgextra/i2/O1CN01nmVa0a1aChgpyyWOX_!!6000000003294-0-tps-3430-1742.jpg)
+
+### 企業での採用
+
+Higressは、Tengineのリロードが長時間接続のビジネスに影響を与える問題や、gRPC/Dubboの負荷分散能力の不足を解決するために、Alibaba内部で誕生しました。Alibaba Cloud内では、HigressのAIゲートウェイ機能がTongyi Qianwen APP、Tongyi Bailian Model Studio、機械学習PAIプラットフォームなどの中核的なAIアプリケーションをサポートしています。また、国内の主要なAIGC企業（例：ZeroOne）やAI製品（例：FastGPT）にもサービスを提供しています。Alibaba Cloudは、Higressを基盤にクラウドネイティブAPIゲートウェイ製品を構築し、多くの企業顧客に99.99％のゲートウェイ高可用性保証サービスを提供しています。
+
+
+## 目次
+
+- [**クイックスタート**](#クイックスタート)    
+- [**機能紹介**](#機能紹介)
+- [**使用シナリオ**](#使用シナリオ)
+- [**主な利点**](#主な利点)
+- [**コミュニティ**](#コミュニティ)
+
+## クイックスタート
+
+HigressはDockerだけで起動でき、個人開発者がローカルで学習用にセットアップしたり、簡易サイトを構築するのに便利です。
+
+```bash
+# 作業ディレクトリを作成
+mkdir higress; cd higress
+# Higressを起動し、設定ファイルを作業ディレクトリに書き込みます
+docker run -d --rm --name higress-ai -v ${PWD}:/data \
+        -p 8001:8001 -p 8080:8080 -p 8443:8443  \
+        higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/all-in-one:latest
+```
+
+リスンポートの説明は以下の通りです：
+
+- 8001ポート：Higress UIコンソールのエントリーポイント
+- 8080ポート：ゲートウェイのHTTPプロトコルエントリーポイント
+- 8443ポート：ゲートウェイのHTTPSプロトコルエントリーポイント
+
+**HigressのすべてのDockerイメージは専用のリポジトリを使用しており、Docker Hubの国内アクセス不可の影響を受けません**
+
+K8sでのHelmデプロイなどの他のインストール方法については、公式サイトの[クイックスタートドキュメント](https://higress.cn/docs/latest/user/quickstart/)を参照してください。
+
+
+## 使用シナリオ
+
+- **AIゲートウェイ**:
+
+  Higressは、国内外のすべてのLLMモデルプロバイダーと統一されたプロトコルで接続でき、豊富なAI可観測性、多モデル負荷分散/フォールバック、AIトークンフロー制御、AIキャッシュなどの機能を備えています。
+
+  ![](https://img.alicdn.com/imgextra/i1/O1CN01fNnhCp1cV8mYPRFeS_!!6000000003605-0-tps-1080-608.jpg)
+
+- **MCP Server ホスティング**:
+
+  Higressは、EnvoyベースのAPIゲートウェイとして、プラグインメカニズムを通じてMCP Serverをホストすることができます。MCP（Model Context Protocol）は本質的にAIにより親和性の高いAPIであり、AI Agentが様々なツールやサービスを簡単に呼び出せるようにします。Higressはツール呼び出しの認証、認可、レート制限、可観測性などの統一機能を提供し、AIアプリケーションの開発とデプロイを簡素化します。
+
+  ![](https://img.alicdn.com/imgextra/i3/O1CN01K4qPUX1OliZa8KIPw_!!6000000001746-2-tps-1581-615.png)
+
+  Higressを使用してMCP Serverをホストすることで、以下のことが実現できます：
+  - 統一された認証と認可メカニズム、AIツール呼び出しのセキュリティを確保
+  - きめ細かいレート制限、乱用やリソース枯渇を防止
+  - 包括的な監査ログ、すべてのツール呼び出し行動を記録
+  - 豊富な可観測性、ツール呼び出しのパフォーマンスと健全性を監視
+  - 簡素化されたデプロイと管理、Higressのプラグインメカニズムを通じて新しいMCP Serverを迅速に追加
+  - 動的更新による無停止：Envoyの長時間接続に対する友好的なサポートとWasmプラグインの動的更新メカニズムにより、MCP Serverのロジックをリアルタイムで更新でき、トラフィックに完全に影響を与えず、接続が切断されることはありません
+
+- **Kubernetes Ingressゲートウェイ**:
+
+  HigressはK8sクラスターのIngressエントリーポイントゲートウェイとして機能し、多くのK8s Nginx Ingressの注釈に対応しています。K8s Nginx IngressからHigressへのスムーズな移行が可能です。
+  
+  [Gateway API](https://gateway-api.sigs.k8s.io/)標準をサポートし、ユーザーがIngress APIからGateway APIにスムーズに移行できるようにします。
+
+  ingress-nginxと比較して、リソースの消費が大幅に減少し、ルーティングの変更が10倍速く反映されます。
+
+  ![](https://img.alicdn.com/imgextra/i1/O1CN01bhEtb229eeMNBWmdP_!!6000000008093-2-tps-750-547.png)
+  ![](https://img.alicdn.com/imgextra/i1/O1CN01bqRets1LsBGyitj4S_!!6000000001354-2-tps-887-489.png)
+  
+- **マイクロサービスゲートウェイ**:
+
+  Higressはマイクロサービスゲートウェイとして機能し、Nacos、ZooKeeper、Consul、Eurekaなどのさまざまなサービスレジストリからサービスを発見し、ルーティングを構成できます。
+  
+  また、[Dubbo](https://github.com/apache/dubbo)、[Nacos](https://github.com/alibaba/nacos)、[Sentinel](https://github.com/alibaba/Sentinel)などのマイクロサービス技術スタックと深く統合されています。Envoy C++ゲートウェイコアの優れたパフォーマンスに基づいて、従来のJavaベースのマイクロサービスゲートウェイと比較して、リソース使用率を大幅に削減し、コストを削減できます。
+
+  ![](https://img.alicdn.com/imgextra/i4/O1CN01v4ZbCj1dBjePSMZ17_!!6000000003698-0-tps-1613-926.jpg)
+  
+- **セキュリティゲートウェイ**:
+
+  Higressはセキュリティゲートウェイとして機能し、WAF機能を提供し、key-auth、hmac-auth、jwt-auth、basic-auth、oidcなどのさまざまな認証戦略をサポートします。 
+
+## 主な利点
+
+- **プロダクションレベル**
+
+  Alibabaで2年以上のプロダクション検証を経た内部製品から派生し、毎秒数十万のリクエストを処理する大規模なシナリオをサポートします。
+
+  Nginxのリロードによるトラフィックの揺れを完全に排除し、構成変更がミリ秒単位で反映され、ビジネスに影響を与えません。AIビジネスなどの長時間接続シナリオに特に適しています。
+
+- **ストリーム処理**
+
+  リクエスト/レスポンスボディの完全なストリーム処理をサポートし、Wasmプラグインを使用してSSE（Server-Sent Events）などのストリームプロトコルのメッセージをカスタマイズして処理できます。
+
+  AIビジネスなどの大帯域幅シナリオで、メモリ使用量を大幅に削減できます。  
+    
+- **拡張性**
+
+  AI、トラフィック管理、セキュリティ保護などの一般的な機能をカバーする豊富な公式プラグインライブラリを提供し、90％以上のビジネスシナリオのニーズを満たします。
+
+  Wasmプラグイン拡張を主力とし、サンドボックス隔離を通じてメモリの安全性を確保し、複数のプログラミング言語をサポートし、プラグインバージョンの独立したアップグレードを許可し、トラフィックに影響を与えずにゲートウェイロジックをホットアップデートできます。
+
+- **安全で使いやすい**
+  
+  Ingress APIおよびGateway API標準に基づき、すぐに使用できるUIコンソールを提供し、WAF保護プラグイン、IP/Cookie CC保護プラグインをすぐに使用できます。
+
+  Let's Encryptの自動証明書発行および更新をサポートし、K8sを使用せずにデプロイでき、1行のDockerコマンドで起動でき、個人開発者にとって便利です。
+
+
+## 機能紹介
+
+### AIゲートウェイデモ展示
+
+[OpenAIから他の大規模モデルへの移行を30秒で完了
+](https://www.bilibili.com/video/BV1dT421a7w7/?spm_id_from=333.788.recommend_more_video.14)
+
+
+### Higress UIコンソール
+    
+- **豊富な可観測性**
+
+  すぐに使用できる可観測性を提供し、Grafana＆Prometheusは組み込みのものを使用することも、自分で構築したものを接続することもできます。
+
+  ![](./docs/images/monitor.gif)
+    
+
+- **プラグイン拡張メカニズム**
+
+  公式にはさまざまなプラグインが提供されており、ユーザーは[独自のプラグインを開発](./plugins/wasm-go)し、Docker/OCIイメージとして構築し、コンソールで構成して、プラグインロジックをリアルタイムで変更できます。トラフィックに影響を与えずにプラグインロジックをホットアップデートできます。
+
+  ![](./docs/images/plugin.gif)
+
+
+- **さまざまなサービス発見**
+
+  デフォルトでK8s Serviceサービス発見を提供し、構成を通じてNacos/ZooKeeperなどのレジストリに接続してサービスを発見することも、静的IPまたはDNSに基づいて発見することもできます。
+
+  ![](./docs/images/service-source.gif)
+    
+
+- **ドメインと証明書**
+
+  TLS証明書を作成および管理し、ドメインのHTTP/HTTPS動作を構成できます。ドメインポリシーでは、特定のドメインに対してプラグインを適用することができます。
+
+  ![](./docs/images/domain.gif)
+
+
+- **豊富なルーティング機能**
+
+  上記で定義されたサービス発見メカニズムを通じて、発見されたサービスはサービスリストに表示されます。ルーティングを作成する際に、ドメインを選択し、ルーティングマッチングメカニズムを定義し、ターゲットサービスを選択してルーティングを行います。ルーティングポリシーでは、特定のルーティングに対してプラグインを適用することができます。
+
+  ![](./docs/images/route-service.gif)
+
+
+## コミュニティ
+
+### 感謝
+
+EnvoyとIstioのオープンソースの取り組みがなければ、Higressは実現できませんでした。これらのプロジェクトに最も誠実な敬意を表します。
+
+### 交流グループ
+
+![image](https://img.alicdn.com/imgextra/i2/O1CN01BkopaB22ZsvamFftE_!!6000000007135-0-tps-720-405.jpg)
+
+### 技術共有
+
+WeChat公式アカウント：
+
+![](https://img.alicdn.com/imgextra/i1/O1CN01WnQt0q1tcmqVDU73u_!!6000000005923-0-tps-258-258.jpg)
+
+### 関連リポジトリ
+
+- Higressコンソール：https://github.com/higress-group/higress-console
+- Higress（スタンドアロン版）：https://github.com/higress-group/higress-standalone
+
+### 貢献者
+
+<a href="https://github.com/alibaba/higress/graphs/contributors">
+  <img alt="contributors" src="https://contrib.rocks/image?repo=alibaba/higress"/>
+</a>
+
+### スターの歴史
+
+[![スターの歴史チャート](https://api.star-history.com/svg?repos=alibaba/higress&type=Date)](https://star-history.com/#alibaba/higress&Date)
+
+<p align="right" style="font-size: 14px; color: #555; margin-top: 20px;">
+    <a href="#readme-top" style="text-decoration: none; color: #007bff; font-weight: bold;">
+        ↑ トップに戻る ↑
+    </a>
+</p>

README_ZH.md

@@ -0,0 +1,236 @@
+<a name="readme-top"></a>
+<h1 align="center">
+    <img src="https://img.alicdn.com/imgextra/i2/O1CN01NwxLDd20nxfGBjxmZ_!!6000000006895-2-tps-960-290.png" alt="Higress" width="240" height="72.5">
+  <br>
+  AI Gateway
+</h1>
+<h4 align="center"> AI Native API Gateway </h4>
+
+<div align="center">
+    
+[![Build Status](https://github.com/alibaba/higress/actions/workflows/build-and-test.yaml/badge.svg?branch=main)](https://github.com/alibaba/higress/actions)
+[![license](https://img.shields.io/github/license/alibaba/higress.svg)](https://www.apache.org/licenses/LICENSE-2.0.html)
+
+<a href="https://trendshift.io/repositories/10918" target="_blank"><img src="https://trendshift.io/api/badge/repositories/10918" alt="alibaba%2Fhigress | Trendshift" style="width: 250px; height: 55px;" width="250" height="55"/></a> <a href="https://www.producthunt.com/posts/higress?embed=true&utm_source=badge-featured&utm_medium=badge&utm_souce=badge-higress" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=951287&theme=light&t=1745492822283" alt="Higress - Global&#0032;APIs&#0032;as&#0032;MCP&#0032;powered&#0032;by&#0032;AI&#0032;Gateway | Product Hunt" style="width: 250px; height: 54px;" width="250" height="54" /></a>
+</div>
+
+[**官网**](https://higress.cn/) &nbsp; |
+&nbsp; [**文档**](https://higress.cn/docs/latest/overview/what-is-higress/) &nbsp; |
+&nbsp; [**博客**](https://higress.cn/blog/) &nbsp; |
+&nbsp; [**电子书**](https://higress.cn/docs/ebook/wasm14/) &nbsp; |
+&nbsp; [**开发指引**](https://higress.cn/docs/latest/dev/architecture/) &nbsp; |
+&nbsp; [**AI插件**](https://higress.cn/plugin/) &nbsp;
+
+
+
+<p>
+   <a href="README.md"> English <a/>| 中文 | <a href="README_JP.md"> 日本語 <a/> 
+</p>
+
+
+## Higress 是什么？
+
+Higress 是一款云原生 API 网关，内核基于 Istio 和 Envoy，可以用 Go/Rust/JS 等编写 Wasm 插件，提供了数十个现成的通用插件，以及开箱即用的控制台（demo 点[这里](http://demo.higress.io/)）
+
+### 核心使用场景
+
+Higress 的 AI 网关能力支持国内外所有[主流模型供应商](https://github.com/alibaba/higress/tree/main/plugins/wasm-go/extensions/ai-proxy/provider)和基于 vllm/ollama 等自建的 DeepSeek 模型。同时，Higress 支持通过插件方式托管 MCP (Model Context Protocol) 服务器，使 AI Agent 能够更容易地调用各种工具和服务。借助 [openapi-to-mcp 工具](https://github.com/higress-group/openapi-to-mcpserver)，您可以快速将 OpenAPI 规范转换为远程 MCP 服务器进行托管。Higress 提供了对 LLM API 和 MCP API 的统一管理。
+
+**🌟 立即体验 [https://mcp.higress.ai/](https://mcp.higress.ai/)** 基于 Higress 托管的远程 MCP 服务器:
+
+![Higress MCP 服务器平台](https://img.alicdn.com/imgextra/i2/O1CN01nmVa0a1aChgpyyWOX_!!6000000003294-0-tps-3430-1742.jpg)
+
+### 生产环境采用
+
+Higress 在阿里内部为解决 Tengine reload 对长连接业务有损，以及 gRPC/Dubbo 负载均衡能力不足而诞生。在阿里云内部，Higress 的 AI 网关能力支撑了通义千问 APP、通义百炼模型工作室、机器学习 PAI 平台等核心 AI 应用。同时服务国内头部的 AIGC 企业（如零一万物），以及 AI 产品（如 FastGPT）。阿里云基于 Higress 构建了云原生 API 网关产品，为大量企业客户提供 99.99% 的网关高可用保障服务能力。
+
+
+## Summary
+
+- [**快速开始**](#快速开始)    
+- [**功能展示**](#功能展示)
+- [**使用场景**](#使用场景)
+- [**核心优势**](#核心优势)
+- [**社区**](#社区)
+
+## 快速开始
+
+Higress 只需 Docker 即可启动，方便个人开发者在本地搭建学习，或者用于搭建简易站点:
+
+```bash
+# 创建一个工作目录
+mkdir higress; cd higress
+# 启动 higress，配置文件会写到工作目录下
+docker run -d --rm --name higress-ai -v ${PWD}:/data \
+        -p 8001:8001 -p 8080:8080 -p 8443:8443  \
+        higress-registry.cn-hangzhou.cr.aliyuncs.com/higress/all-in-one:latest
+```
+
+监听端口说明如下：
+
+- 8001 端口：Higress UI 控制台入口
+- 8080 端口：网关 HTTP 协议入口
+- 8443 端口：网关 HTTPS 协议入口
+
+**Higress 的所有 Docker 镜像都一直使用自己独享的仓库，不受 Docker Hub 境内访问受限的影响**
+
+K8s 下使用 Helm 部署等其他安装方式可以参考官网 [Quick Start 文档](https://higress.cn/docs/latest/user/quickstart/)。
+
+如果您是在云上部署，生产环境推荐使用[企业版](https://higress.io/cloud/)，开发测试可以使用下面一键部署社区版：
+
+[![Deploy on AlibabaCloud ComputeNest](https://service-info-public.oss-cn-hangzhou.aliyuncs.com/computenest.svg)](https://computenest.console.aliyun.com/service/instance/create/default?type=user&ServiceName=Higress社区版)
+
+
+## 使用场景
+
+- **AI 网关**:
+
+  Higress 能够用统一的协议对接国内外所有 LLM 模型厂商，同时具备丰富的 AI 可观测、多模型负载均衡/fallback、AI token 流控、AI 缓存等能力：
+
+  ![](https://img.alicdn.com/imgextra/i1/O1CN01fNnhCp1cV8mYPRFeS_!!6000000003605-0-tps-1080-608.jpg)
+
+- **MCP Server 托管**:
+
+  Higress 作为基于 Envoy 的 API 网关，支持通过插件方式托管 MCP Server。MCP（Model Context Protocol）本质是面向 AI 更友好的 API，使 AI Agent 能够更容易地调用各种工具和服务。Higress 可以统一处理工具调用的认证/鉴权/限流/观测等能力，简化 AI 应用的开发和部署。
+
+  ![](https://img.alicdn.com/imgextra/i3/O1CN01K4qPUX1OliZa8KIPw_!!6000000001746-2-tps-1581-615.png)
+
+  通过 Higress 托管 MCP Server，可以实现：
+  - 统一的认证和鉴权机制，确保 AI 工具调用的安全性
+  - 精细化的速率限制，防止滥用和资源耗尽
+  - 完整的审计日志，记录所有工具调用行为
+  - 丰富的可观测性，监控工具调用的性能和健康状况
+  - 简化的部署和管理，通过 Higress 插件机制快速添加新的 MCP Server
+  - 动态更新无损：得益于 Envoy 对长连接保持的友好支持，以及 Wasm 插件的动态更新机制，MCP Server 逻辑可以实时更新，且对流量完全无损，不会导致任何连接断开
+
+- **Kubernetes Ingress 网关**:
+
+  Higress 可以作为 K8s 集群的 Ingress 入口网关, 并且兼容了大量 K8s Nginx Ingress 的注解，可以从 K8s Nginx Ingress 快速平滑迁移到 Higress。
+  
+  支持 [Gateway API](https://gateway-api.sigs.k8s.io/) 标准，支持用户从 Ingress API 平滑迁移到 Gateway API。
+
+  相比 ingress-nginx，资源开销大幅下降，路由变更生效速度有十倍提升：
+
+  ![](https://img.alicdn.com/imgextra/i1/O1CN01bhEtb229eeMNBWmdP_!!6000000008093-2-tps-750-547.png)
+  ![](https://img.alicdn.com/imgextra/i1/O1CN01bqRets1LsBGyitj4S_!!6000000001354-2-tps-887-489.png)
+  
+- **微服务网关**:
+
+  Higress 可以作为微服务网关, 能够对接多种类型的注册中心发现服务配置路由，例如 Nacos, ZooKeeper, Consul, Eureka 等。
+  
+  并且深度集成了 [Dubbo](https://github.com/apache/dubbo), [Nacos](https://github.com/alibaba/nacos), [Sentinel](https://github.com/alibaba/Sentinel) 等微服务技术栈，基于 Envoy C++ 网关内核的出色性能，相比传统 Java 类微服务网关，可以显著降低资源使用率，减少成本。
+
+  ![](https://img.alicdn.com/imgextra/i4/O1CN01v4ZbCj1dBjePSMZ17_!!6000000003698-0-tps-1613-926.jpg)
+  
+- **安全防护网关**:
+
+  Higress 可以作为安全防护网关， 提供 WAF 的能力，并且支持多种认证鉴权策略，例如 key-auth, hmac-auth, jwt-auth, basic-auth, oidc 等。 
+
+## 核心优势
+
+- **生产等级**
+
+  脱胎于阿里巴巴2年多生产验证的内部产品，支持每秒请求量达数十万级的大规模场景。
+
+  彻底摆脱 Nginx reload 引起的流量抖动，配置变更毫秒级生效且业务无感。对 AI 业务等长连接场景特别友好。
+
+- **流式处理**
+
+  支持真正的完全流式处理请求/响应 Body，Wasm 插件很方便地自定义处理 SSE （Server-Sent Events）等流式协议的报文。
+
+  在 AI 业务等大带宽场景下，可以显著降低内存开销。  
+    
+- **便于扩展**
+  
+  提供丰富的官方插件库，涵盖 AI、流量管理、安全防护等常用功能，满足90%以上的业务场景需求。
+
+  主打 Wasm 插件扩展，通过沙箱隔离确保内存安全，支持多种编程语言，允许插件版本独立升级，实现流量无损热更新网关逻辑。
+
+- **安全易用**
+  
+  基于 Ingress API 和 Gateway API 标准，提供开箱即用的 UI 控制台，WAF 防护插件、IP/Cookie CC 防护插件开箱即用。
+
+  支持对接 Let's Encrypt 自动签发和续签免费证书，并且可以脱离 K8s 部署，一行 Docker 命令即可启动，方便个人开发者使用。
+
+
+## 功能展示
+
+### AI 网关 Demo 展示
+
+[从 OpenAI 到其他大模型，30 秒完成迁移
+](https://www.bilibili.com/video/BV1dT421a7w7/?spm_id_from=333.788.recommend_more_video.14)
+
+
+### Higress UI 控制台
+    
+- **丰富的可观测**
+
+  提供开箱即用的可观测，Grafana&Prometheus 可以使用内置的也可对接自建的
+
+  ![](./docs/images/monitor.gif)
+    
+
+- **插件扩展机制**
+
+  官方提供了多种插件，用户也可以[开发](./plugins/wasm-go)自己的插件，构建成 docker/oci 镜像后在控制台配置，可以实时变更插件逻辑，对流量完全无损。
+
+  ![](./docs/images/plugin.gif)
+
+
+- **多种服务发现**
+
+  默认提供 K8s Service 服务发现，通过配置可以对接 Nacos/ZooKeeper 等注册中心实现服务发现，也可以基于静态 IP 或者 DNS 来发现
+
+  ![](./docs/images/service-source.gif)
+    
+
+- **域名和证书**
+
+  可以创建管理 TLS 证书，并配置域名的 HTTP/HTTPS 行为，域名策略里支持对特定域名生效插件
+
+  ![](./docs/images/domain.gif)
+
+
+- **丰富的路由能力**
+
+  通过上面定义的服务发现机制，发现的服务会出现在服务列表中；创建路由时，选择域名，定义路由匹配机制，再选择目标服务进行路由；路由策略里支持对特定路由生效插件
+
+  ![](./docs/images/route-service.gif)
+
+
+## 社区
+
+### 感谢
+
+如果没有 Envoy 和 Istio 的开源工作，Higress 就不可能实现，在这里向这两个项目献上最诚挚的敬意。
+
+### 交流群
+
+![image](https://img.alicdn.com/imgextra/i2/O1CN01fZefEP1aPWkzG3A19_!!6000000003322-0-tps-720-405.jpg)
+
+### 技术分享
+
+微信公众号：
+
+![](https://img.alicdn.com/imgextra/i1/O1CN01WnQt0q1tcmqVDU73u_!!6000000005923-0-tps-258-258.jpg)
+
+### 关联仓库
+
+- Higress 控制台：https://github.com/higress-group/higress-console
+- Higress（独立运行版）：https://github.com/higress-group/higress-standalone
+
+### 贡献者
+
+<a href="https://github.com/alibaba/higress/graphs/contributors">
+  <img alt="contributors" src="https://contrib.rocks/image?repo=alibaba/higress"/>
+</a>
+
+### Star History
+
+[![Star History](https://api.star-history.com/svg?repos=alibaba/higress&type=Date)](https://star-history.com/#alibaba/higress&Date)
+
+<p align="right" style="font-size: 14px; color: #555; margin-top: 20px;">
+    <a href="#readme-top" style="text-decoration: none; color: #007bff; font-weight: bold;">
+        ↑ 返回顶部 ↑
+    </a>
+</p>

SECURITY.md

@@ -4,6 +4,7 @@
 
 | Version | Supported          |
 | ------- | ------------------ |
+| 2.x.x   | :white_check_mark: |
 | 1.x.x   | :white_check_mark: |
 | < 1.0.0   | :x:                |
 

VERSION

@@ -1 +1 @@
-v1.3.6
+v2.1.7

api/buf.gen.yaml

@@ -1,11 +1,17 @@
-version: v1beta1
+# buf.gen.yaml sets up the generation configuration for all of our plugins.
+# Note: buf does not allow multi roots that are within each other; as a result, the common-protos folders are
+# symlinked into the top level directory.
+version: v1
 plugins:
-- name: gogofast
+- name: go
   out: .
-  opt: plugins=grpc,paths=source_relative,Mgogoproto/gogo.proto=github.com/gogo/protobuf/gogoproto,Mgoogle/protobuf/any.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/descriptor.proto=github.com/gogo/protobuf/protoc-gen-gogo/descriptor,Mgoogle/protobuf/duration.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/struct.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/timestamp.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/wrappers.proto=github.com/gogo/protobuf/types,Mgoogle/rpc/status.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/rpc/code.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/rpc/error_details.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/api/field_behavior.proto=istio.io/gogo-genproto/googleapis/google/api
-- name: deepcopy
+  opt: paths=source_relative
+- name: go-grpc
   out: .
-  opt: paths=source_relative,Mgogoproto/gogo.proto=github.com/gogo/protobuf/gogoproto,Mgoogle/protobuf/any.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/descriptor.proto=github.com/gogo/protobuf/protoc-gen-gogo/descriptor,Mgoogle/protobuf/duration.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/struct.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/timestamp.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/wrappers.proto=github.com/gogo/protobuf/types,Mgoogle/rpc/status.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/rpc/code.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/rpc/error_details.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/api/field_behavior.proto=istio.io/gogo-genproto/googleapis/google/api
-- name: jsonshim
+  opt: paths=source_relative
+- name: golang-deepcopy
   out: .
-  opt: paths=source_relative,Mgogoproto/gogo.proto=github.com/gogo/protobuf/gogoproto,Mgoogle/protobuf/any.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/descriptor.proto=github.com/gogo/protobuf/protoc-gen-gogo/descriptor,Mgoogle/protobuf/duration.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/struct.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/timestamp.proto=github.com/gogo/protobuf/types,Mgoogle/protobuf/wrappers.proto=github.com/gogo/protobuf/types,Mgoogle/rpc/status.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/rpc/code.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/rpc/error_details.proto=istio.io/gogo-genproto/googleapis/google/rpc,Mgoogle/api/field_behavior.proto=istio.io/gogo-genproto/googleapis/google/api
+  opt: paths=source_relative
+- name: golang-jsonshim
+  out: .
+  opt: paths=source_relative

api/extensions/v1alpha1/wasm_deepcopy.gen.go

@@ -1,58 +0,0 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: extensions/v1alpha1/wasm.proto
-
-package v1alpha1
-
-import (
-	fmt "fmt"
-	proto "github.com/gogo/protobuf/proto"
-	_ "github.com/gogo/protobuf/types"
-	math "math"
-)
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-// DeepCopyInto supports using WasmPlugin within kubernetes types, where deepcopy-gen is used.
-func (in *WasmPlugin) DeepCopyInto(out *WasmPlugin) {
-	p := proto.Clone(in).(*WasmPlugin)
-	*out = *p
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WasmPlugin. Required by controller-gen.
-func (in *WasmPlugin) DeepCopy() *WasmPlugin {
-	if in == nil {
-		return nil
-	}
-	out := new(WasmPlugin)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new WasmPlugin. Required by controller-gen.
-func (in *WasmPlugin) DeepCopyInterface() interface{} {
-	return in.DeepCopy()
-}
-
-// DeepCopyInto supports using MatchRule within kubernetes types, where deepcopy-gen is used.
-func (in *MatchRule) DeepCopyInto(out *MatchRule) {
-	p := proto.Clone(in).(*MatchRule)
-	*out = *p
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MatchRule. Required by controller-gen.
-func (in *MatchRule) DeepCopy() *MatchRule {
-	if in == nil {
-		return nil
-	}
-	out := new(MatchRule)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new MatchRule. Required by controller-gen.
-func (in *MatchRule) DeepCopyInterface() interface{} {
-	return in.DeepCopy()
-}

api/extensions/v1alpha1/wasm_json.gen.go

@@ -1,45 +0,0 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: extensions/v1alpha1/wasm.proto
-
-package v1alpha1
-
-import (
-	bytes "bytes"
-	fmt "fmt"
-	github_com_gogo_protobuf_jsonpb "github.com/gogo/protobuf/jsonpb"
-	proto "github.com/gogo/protobuf/proto"
-	_ "github.com/gogo/protobuf/types"
-	math "math"
-)
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
-// MarshalJSON is a custom marshaler for WasmPlugin
-func (this *WasmPlugin) MarshalJSON() ([]byte, error) {
-	str, err := WasmMarshaler.MarshalToString(this)
-	return []byte(str), err
-}
-
-// UnmarshalJSON is a custom unmarshaler for WasmPlugin
-func (this *WasmPlugin) UnmarshalJSON(b []byte) error {
-	return WasmUnmarshaler.Unmarshal(bytes.NewReader(b), this)
-}
-
-// MarshalJSON is a custom marshaler for MatchRule
-func (this *MatchRule) MarshalJSON() ([]byte, error) {
-	str, err := WasmMarshaler.MarshalToString(this)
-	return []byte(str), err
-}
-
-// UnmarshalJSON is a custom unmarshaler for MatchRule
-func (this *MatchRule) UnmarshalJSON(b []byte) error {
-	return WasmUnmarshaler.Unmarshal(bytes.NewReader(b), this)
-}
-
-var (
-	WasmMarshaler   = &github_com_gogo_protobuf_jsonpb.Marshaler{}
-	WasmUnmarshaler = &github_com_gogo_protobuf_jsonpb.Unmarshaler{AllowUnknownFields: true}
-)

api/extensions/v1alpha1/wasmplugin.pb.go

@@ -0,0 +1,907 @@
+// Copyright Istio Authors
+//
+//   Licensed under the Apache License, Version 2.0 (the "License");
+//   you may not use this file except in compliance with the License.
+//   You may obtain a copy of the License at
+//
+//       http://www.apache.org/licenses/LICENSE-2.0
+//
+//   Unless required by applicable law or agreed to in writing, software
+//   distributed under the License is distributed on an "AS IS" BASIS,
+//   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//   See the License for the specific language governing permissions and
+//   limitations under the License.
+// Modified by Higress Authors
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.31.0
+// 	protoc        (unknown)
+// source: extensions/v1alpha1/wasmplugin.proto
+
+// $schema: higress.extensions.v1alpha1.WasmPlugin
+// $title: WasmPlugin
+// $description: Extend the functionality provided by the envoy through WebAssembly filters.
+
+package v1alpha1
+
+import (
+	_struct "github.com/golang/protobuf/ptypes/struct"
+	wrappers "github.com/golang/protobuf/ptypes/wrappers"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// The phase in the filter chain where the plugin will be injected.
+type PluginPhase int32
+
+const (
+	// Control plane decides where to insert the plugin. This will generally
+	// be at the end of the filter chain, right before the Router.
+	// Do not specify `PluginPhase` if the plugin is independent of others.
+	PluginPhase_UNSPECIFIED_PHASE PluginPhase = 0
+	// Insert plugin before Istio authentication filters.
+	PluginPhase_AUTHN PluginPhase = 1
+	// Insert plugin before Istio authorization filters and after Istio authentication filters.
+	PluginPhase_AUTHZ PluginPhase = 2
+	// Insert plugin before Istio stats filters and after Istio authorization filters.
+	PluginPhase_STATS PluginPhase = 3
+)
+
+// Enum value maps for PluginPhase.
+var (
+	PluginPhase_name = map[int32]string{
+		0: "UNSPECIFIED_PHASE",
+		1: "AUTHN",
+		2: "AUTHZ",
+		3: "STATS",
+	}
+	PluginPhase_value = map[string]int32{
+		"UNSPECIFIED_PHASE": 0,
+		"AUTHN":             1,
+		"AUTHZ":             2,
+		"STATS":             3,
+	}
+)
+
+func (x PluginPhase) Enum() *PluginPhase {
+	p := new(PluginPhase)
+	*p = x
+	return p
+}
+
+func (x PluginPhase) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (PluginPhase) Descriptor() protoreflect.EnumDescriptor {
+	return file_extensions_v1alpha1_wasmplugin_proto_enumTypes[0].Descriptor()
+}
+
+func (PluginPhase) Type() protoreflect.EnumType {
+	return &file_extensions_v1alpha1_wasmplugin_proto_enumTypes[0]
+}
+
+func (x PluginPhase) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use PluginPhase.Descriptor instead.
+func (PluginPhase) EnumDescriptor() ([]byte, []int) {
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP(), []int{0}
+}
+
+// The pull behaviour to be applied when fetching an OCI image,
+// mirroring K8s behaviour.
+//
+// <!--
+// buf:lint:ignore ENUM_VALUE_UPPER_SNAKE_CASE
+// -->
+type PullPolicy int32
+
+const (
+	// Defaults to IfNotPresent, except for OCI images with tag `latest`, for which
+	// the default will be Always.
+	PullPolicy_UNSPECIFIED_POLICY PullPolicy = 0
+	// If an existing version of the image has been pulled before, that
+	// will be used. If no version of the image is present locally, we
+	// will pull the latest version.
+	PullPolicy_IfNotPresent PullPolicy = 1
+	// We will always pull the latest version of an image when applying
+	// this plugin.
+	PullPolicy_Always PullPolicy = 2
+)
+
+// Enum value maps for PullPolicy.
+var (
+	PullPolicy_name = map[int32]string{
+		0: "UNSPECIFIED_POLICY",
+		1: "IfNotPresent",
+		2: "Always",
+	}
+	PullPolicy_value = map[string]int32{
+		"UNSPECIFIED_POLICY": 0,
+		"IfNotPresent":       1,
+		"Always":             2,
+	}
+)
+
+func (x PullPolicy) Enum() *PullPolicy {
+	p := new(PullPolicy)
+	*p = x
+	return p
+}
+
+func (x PullPolicy) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (PullPolicy) Descriptor() protoreflect.EnumDescriptor {
+	return file_extensions_v1alpha1_wasmplugin_proto_enumTypes[1].Descriptor()
+}
+
+func (PullPolicy) Type() protoreflect.EnumType {
+	return &file_extensions_v1alpha1_wasmplugin_proto_enumTypes[1]
+}
+
+func (x PullPolicy) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use PullPolicy.Descriptor instead.
+func (PullPolicy) EnumDescriptor() ([]byte, []int) {
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP(), []int{1}
+}
+
+type EnvValueSource int32
+
+const (
+	// Explicitly given key-value pairs to be injected to this VM
+	EnvValueSource_INLINE EnvValueSource = 0
+	// *Istio-proxy's* environment variables exposed to this VM.
+	EnvValueSource_HOST EnvValueSource = 1
+)
+
+// Enum value maps for EnvValueSource.
+var (
+	EnvValueSource_name = map[int32]string{
+		0: "INLINE",
+		1: "HOST",
+	}
+	EnvValueSource_value = map[string]int32{
+		"INLINE": 0,
+		"HOST":   1,
+	}
+)
+
+func (x EnvValueSource) Enum() *EnvValueSource {
+	p := new(EnvValueSource)
+	*p = x
+	return p
+}
+
+func (x EnvValueSource) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (EnvValueSource) Descriptor() protoreflect.EnumDescriptor {
+	return file_extensions_v1alpha1_wasmplugin_proto_enumTypes[2].Descriptor()
+}
+
+func (EnvValueSource) Type() protoreflect.EnumType {
+	return &file_extensions_v1alpha1_wasmplugin_proto_enumTypes[2]
+}
+
+func (x EnvValueSource) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use EnvValueSource.Descriptor instead.
+func (EnvValueSource) EnumDescriptor() ([]byte, []int) {
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP(), []int{2}
+}
+
+type FailStrategy int32
+
+const (
+	// A fatal error in the binary fetching or during the plugin execution causes
+	// all subsequent requests to fail with 5xx.
+	FailStrategy_FAIL_CLOSE FailStrategy = 0
+	// Enables the fail open behavior for the Wasm plugin fatal errors to bypass
+	// the plugin execution. A fatal error can be a failure to fetch the remote
+	// binary, an exception, or abort() on the VM. This flag is not recommended
+	// for the authentication or the authorization plugins.
+	FailStrategy_FAIL_OPEN FailStrategy = 1
+)
+
+// Enum value maps for FailStrategy.
+var (
+	FailStrategy_name = map[int32]string{
+		0: "FAIL_CLOSE",
+		1: "FAIL_OPEN",
+	}
+	FailStrategy_value = map[string]int32{
+		"FAIL_CLOSE": 0,
+		"FAIL_OPEN":  1,
+	}
+)
+
+func (x FailStrategy) Enum() *FailStrategy {
+	p := new(FailStrategy)
+	*p = x
+	return p
+}
+
+func (x FailStrategy) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (FailStrategy) Descriptor() protoreflect.EnumDescriptor {
+	return file_extensions_v1alpha1_wasmplugin_proto_enumTypes[3].Descriptor()
+}
+
+func (FailStrategy) Type() protoreflect.EnumType {
+	return &file_extensions_v1alpha1_wasmplugin_proto_enumTypes[3]
+}
+
+func (x FailStrategy) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use FailStrategy.Descriptor instead.
+func (FailStrategy) EnumDescriptor() ([]byte, []int) {
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP(), []int{3}
+}
+
+// <!-- crd generation tags
+// +cue-gen:WasmPlugin:groupName:extensions.higress.io
+// +cue-gen:WasmPlugin:version:v1alpha1
+// +cue-gen:WasmPlugin:storageVersion
+// +cue-gen:WasmPlugin:annotations:helm.sh/resource-policy=keep
+// +cue-gen:WasmPlugin:subresource:status
+// +cue-gen:WasmPlugin:scope:Namespaced
+// +cue-gen:WasmPlugin:resource:categories=higress-io,extensions-higress-io
+// +cue-gen:WasmPlugin:preserveUnknownFields:pluginConfig,defaultConfig,matchRules.[].config
+// +cue-gen:WasmPlugin:printerColumn:name=Age,type=date,JSONPath=.metadata.creationTimestamp,description="CreationTimestamp is a timestamp
+// representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations.
+// Clients may not set this value. It is represented in RFC3339 form and is in UTC.
+// Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata"
+// -->
+//
+// <!-- go code generation tags
+// +kubetype-gen
+// +kubetype-gen:groupVersion=extensions.higress.io/v1alpha1
+// +genclient
+// +k8s:deepcopy-gen=true
+// -->
+type WasmPlugin struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// URL of a Wasm module or OCI container. If no scheme is present,
+	// defaults to `oci://`, referencing an OCI image. Other valid schemes
+	// are `file://` for referencing .wasm module files present locally
+	// within the proxy container, and `http[s]://` for .wasm module files
+	// hosted remotely.
+	Url string `protobuf:"bytes,2,opt,name=url,proto3" json:"url,omitempty"`
+	// SHA256 checksum that will be used to verify Wasm module or OCI container.
+	// If the `url` field already references a SHA256 (using the `@sha256:`
+	// notation), it must match the value of this field. If an OCI image is
+	// referenced by tag and this field is set, its checksum will be verified
+	// against the contents of this field after pulling.
+	Sha256 string `protobuf:"bytes,3,opt,name=sha256,proto3" json:"sha256,omitempty"`
+	// The pull behaviour to be applied when fetching an OCI image. Only
+	// relevant when images are referenced by tag instead of SHA. Defaults
+	// to IfNotPresent, except when an OCI image is referenced in the `url`
+	// and the `latest` tag is used, in which case `Always` is the default,
+	// mirroring K8s behaviour.
+	// Setting is ignored if `url` field is referencing a Wasm module directly
+	// using `file://` or `http[s]://`
+	ImagePullPolicy PullPolicy `protobuf:"varint,4,opt,name=image_pull_policy,json=imagePullPolicy,proto3,enum=higress.extensions.v1alpha1.PullPolicy" json:"image_pull_policy,omitempty"`
+	// Credentials to use for OCI image pulling.
+	// Name of a K8s Secret in the same namespace as the `WasmPlugin` that
+	// contains a docker pull secret which is to be used to authenticate
+	// against the registry when pulling the image.
+	ImagePullSecret string `protobuf:"bytes,5,opt,name=image_pull_secret,json=imagePullSecret,proto3" json:"image_pull_secret,omitempty"`
+	// Public key that will be used to verify signatures of signed OCI images
+	// or Wasm modules. Must be supplied in PEM format.
+	VerificationKey string `protobuf:"bytes,6,opt,name=verification_key,json=verificationKey,proto3" json:"verification_key,omitempty"`
+	// The configuration that will be passed on to the plugin.
+	PluginConfig *_struct.Struct `protobuf:"bytes,7,opt,name=plugin_config,json=pluginConfig,proto3" json:"plugin_config,omitempty"`
+	// The plugin name to be used in the Envoy configuration (used to be called
+	// `rootID`). Some .wasm modules might require this value to select the Wasm
+	// plugin to execute.
+	PluginName string `protobuf:"bytes,8,opt,name=plugin_name,json=pluginName,proto3" json:"plugin_name,omitempty"`
+	// Determines where in the filter chain this `WasmPlugin` is to be injected.
+	Phase PluginPhase `protobuf:"varint,9,opt,name=phase,proto3,enum=higress.extensions.v1alpha1.PluginPhase" json:"phase,omitempty"`
+	// Determines ordering of `WasmPlugins` in the same `phase`.
+	// When multiple `WasmPlugins` are applied to the same workload in the
+	// same `phase`, they will be applied by priority, in descending order.
+	// If `priority` is not set, or two `WasmPlugins` exist with the same
+	// value, the ordering will be deterministically derived from name and
+	// namespace of the `WasmPlugins`. Defaults to `0`.
+	Priority *wrappers.Int32Value `protobuf:"bytes,10,opt,name=priority,proto3" json:"priority,omitempty"`
+	// Specifies the failure behavior for the plugin due to fatal errors.
+	FailStrategy FailStrategy `protobuf:"varint,13,opt,name=fail_strategy,json=failStrategy,proto3,enum=higress.extensions.v1alpha1.FailStrategy" json:"fail_strategy,omitempty"`
+	// Configuration for a Wasm VM.
+	// more details can be found [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/wasm/v3/wasm.proto#extensions-wasm-v3-vmconfig).
+	VmConfig *VmConfig `protobuf:"bytes,11,opt,name=vm_config,json=vmConfig,proto3" json:"vm_config,omitempty"`
+	// Extended by Higress, the default configuration takes effect globally
+	DefaultConfig *_struct.Struct `protobuf:"bytes,101,opt,name=default_config,json=defaultConfig,proto3" json:"default_config,omitempty"`
+	// Extended by Higress, matching rules take effect
+	MatchRules []*MatchRule `protobuf:"bytes,102,rep,name=match_rules,json=matchRules,proto3" json:"match_rules,omitempty"`
+	// disable the default config
+	DefaultConfigDisable *wrappers.BoolValue `protobuf:"bytes,103,opt,name=default_config_disable,json=defaultConfigDisable,proto3" json:"default_config_disable,omitempty"`
+}
+
+func (x *WasmPlugin) Reset() {
+	*x = WasmPlugin{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_extensions_v1alpha1_wasmplugin_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WasmPlugin) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WasmPlugin) ProtoMessage() {}
+
+func (x *WasmPlugin) ProtoReflect() protoreflect.Message {
+	mi := &file_extensions_v1alpha1_wasmplugin_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WasmPlugin.ProtoReflect.Descriptor instead.
+func (*WasmPlugin) Descriptor() ([]byte, []int) {
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *WasmPlugin) GetUrl() string {
+	if x != nil {
+		return x.Url
+	}
+	return ""
+}
+
+func (x *WasmPlugin) GetSha256() string {
+	if x != nil {
+		return x.Sha256
+	}
+	return ""
+}
+
+func (x *WasmPlugin) GetImagePullPolicy() PullPolicy {
+	if x != nil {
+		return x.ImagePullPolicy
+	}
+	return PullPolicy_UNSPECIFIED_POLICY
+}
+
+func (x *WasmPlugin) GetImagePullSecret() string {
+	if x != nil {
+		return x.ImagePullSecret
+	}
+	return ""
+}
+
+func (x *WasmPlugin) GetVerificationKey() string {
+	if x != nil {
+		return x.VerificationKey
+	}
+	return ""
+}
+
+func (x *WasmPlugin) GetPluginConfig() *_struct.Struct {
+	if x != nil {
+		return x.PluginConfig
+	}
+	return nil
+}
+
+func (x *WasmPlugin) GetPluginName() string {
+	if x != nil {
+		return x.PluginName
+	}
+	return ""
+}
+
+func (x *WasmPlugin) GetPhase() PluginPhase {
+	if x != nil {
+		return x.Phase
+	}
+	return PluginPhase_UNSPECIFIED_PHASE
+}
+
+func (x *WasmPlugin) GetPriority() *wrappers.Int32Value {
+	if x != nil {
+		return x.Priority
+	}
+	return nil
+}
+
+func (x *WasmPlugin) GetFailStrategy() FailStrategy {
+	if x != nil {
+		return x.FailStrategy
+	}
+	return FailStrategy_FAIL_CLOSE
+}
+
+func (x *WasmPlugin) GetVmConfig() *VmConfig {
+	if x != nil {
+		return x.VmConfig
+	}
+	return nil
+}
+
+func (x *WasmPlugin) GetDefaultConfig() *_struct.Struct {
+	if x != nil {
+		return x.DefaultConfig
+	}
+	return nil
+}
+
+func (x *WasmPlugin) GetMatchRules() []*MatchRule {
+	if x != nil {
+		return x.MatchRules
+	}
+	return nil
+}
+
+func (x *WasmPlugin) GetDefaultConfigDisable() *wrappers.BoolValue {
+	if x != nil {
+		return x.DefaultConfigDisable
+	}
+	return nil
+}
+
+// Extended by Higress
+type MatchRule struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Ingress       []string            `protobuf:"bytes,1,rep,name=ingress,proto3" json:"ingress,omitempty"`
+	Domain        []string            `protobuf:"bytes,2,rep,name=domain,proto3" json:"domain,omitempty"`
+	Config        *_struct.Struct     `protobuf:"bytes,3,opt,name=config,proto3" json:"config,omitempty"`
+	ConfigDisable *wrappers.BoolValue `protobuf:"bytes,4,opt,name=config_disable,json=configDisable,proto3" json:"config_disable,omitempty"`
+	Service       []string            `protobuf:"bytes,5,rep,name=service,proto3" json:"service,omitempty"`
+}
+
+func (x *MatchRule) Reset() {
+	*x = MatchRule{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_extensions_v1alpha1_wasmplugin_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MatchRule) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MatchRule) ProtoMessage() {}
+
+func (x *MatchRule) ProtoReflect() protoreflect.Message {
+	mi := &file_extensions_v1alpha1_wasmplugin_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MatchRule.ProtoReflect.Descriptor instead.
+func (*MatchRule) Descriptor() ([]byte, []int) {
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *MatchRule) GetIngress() []string {
+	if x != nil {
+		return x.Ingress
+	}
+	return nil
+}
+
+func (x *MatchRule) GetDomain() []string {
+	if x != nil {
+		return x.Domain
+	}
+	return nil
+}
+
+func (x *MatchRule) GetConfig() *_struct.Struct {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
+func (x *MatchRule) GetConfigDisable() *wrappers.BoolValue {
+	if x != nil {
+		return x.ConfigDisable
+	}
+	return nil
+}
+
+func (x *MatchRule) GetService() []string {
+	if x != nil {
+		return x.Service
+	}
+	return nil
+}
+
+// Configuration for a Wasm VM.
+// more details can be found [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/wasm/v3/wasm.proto#extensions-wasm-v3-vmconfig).
+type VmConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Specifies environment variables to be injected to this VM.
+	// Note that if a key does not exist, it will be ignored.
+	Env []*EnvVar `protobuf:"bytes,1,rep,name=env,proto3" json:"env,omitempty"`
+}
+
+func (x *VmConfig) Reset() {
+	*x = VmConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_extensions_v1alpha1_wasmplugin_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *VmConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VmConfig) ProtoMessage() {}
+
+func (x *VmConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_extensions_v1alpha1_wasmplugin_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VmConfig.ProtoReflect.Descriptor instead.
+func (*VmConfig) Descriptor() ([]byte, []int) {
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *VmConfig) GetEnv() []*EnvVar {
+	if x != nil {
+		return x.Env
+	}
+	return nil
+}
+
+type EnvVar struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Required
+	// Name of the environment variable. Must be a C_IDENTIFIER.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Required
+	// Source for the environment variable's value.
+	ValueFrom EnvValueSource `protobuf:"varint,3,opt,name=value_from,json=valueFrom,proto3,enum=higress.extensions.v1alpha1.EnvValueSource" json:"value_from,omitempty"`
+	// Value for the environment variable.
+	// Note that if `value_from` is `HOST`, it will be ignored.
+	// Defaults to "".
+	Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (x *EnvVar) Reset() {
+	*x = EnvVar{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_extensions_v1alpha1_wasmplugin_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EnvVar) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EnvVar) ProtoMessage() {}
+
+func (x *EnvVar) ProtoReflect() protoreflect.Message {
+	mi := &file_extensions_v1alpha1_wasmplugin_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EnvVar.ProtoReflect.Descriptor instead.
+func (*EnvVar) Descriptor() ([]byte, []int) {
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *EnvVar) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *EnvVar) GetValueFrom() EnvValueSource {
+	if x != nil {
+		return x.ValueFrom
+	}
+	return EnvValueSource_INLINE
+}
+
+func (x *EnvVar) GetValue() string {
+	if x != nil {
+		return x.Value
+	}
+	return ""
+}
+
+var File_extensions_v1alpha1_wasmplugin_proto protoreflect.FileDescriptor
+
+var file_extensions_v1alpha1_wasmplugin_proto_rawDesc = []byte{
+	0x0a, 0x24, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x77, 0x61, 0x73, 0x6d, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1b, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2e,
+	0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2f, 0x77, 0x72, 0x61, 0x70, 0x70, 0x65, 0x72, 0x73, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x1a, 0x1c, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2f, 0x73, 0x74, 0x72, 0x75, 0x63, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x22, 0xa9, 0x06, 0x0a, 0x0a, 0x57, 0x61, 0x73, 0x6d, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e,
+	0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75,
+	0x72, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x68, 0x61, 0x32, 0x35, 0x36, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x06, 0x73, 0x68, 0x61, 0x32, 0x35, 0x36, 0x12, 0x53, 0x0a, 0x11, 0x69, 0x6d,
+	0x61, 0x67, 0x65, 0x5f, 0x70, 0x75, 0x6c, 0x6c, 0x5f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x27, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2e,
+	0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x2e, 0x50, 0x75, 0x6c, 0x6c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x0f,
+	0x69, 0x6d, 0x61, 0x67, 0x65, 0x50, 0x75, 0x6c, 0x6c, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12,
+	0x2a, 0x0a, 0x11, 0x69, 0x6d, 0x61, 0x67, 0x65, 0x5f, 0x70, 0x75, 0x6c, 0x6c, 0x5f, 0x73, 0x65,
+	0x63, 0x72, 0x65, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x69, 0x6d, 0x61, 0x67,
+	0x65, 0x50, 0x75, 0x6c, 0x6c, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x29, 0x0a, 0x10, 0x76,
+	0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6b, 0x65, 0x79, 0x18,
+	0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x4b, 0x65, 0x79, 0x12, 0x3c, 0x0a, 0x0d, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e,
+	0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x0c, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x3e, 0x0a, 0x05, 0x70, 0x68, 0x61, 0x73, 0x65, 0x18, 0x09,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x28, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2e, 0x65,
+	0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x2e, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x50, 0x68, 0x61, 0x73, 0x65, 0x52, 0x05,
+	0x70, 0x68, 0x61, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x08, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x69, 0x74,
+	0x79, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x12, 0x4e,
+	0x0a, 0x0d, 0x66, 0x61, 0x69, 0x6c, 0x5f, 0x73, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x18,
+	0x0d, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x29, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2e,
+	0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x2e, 0x46, 0x61, 0x69, 0x6c, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79,
+	0x52, 0x0c, 0x66, 0x61, 0x69, 0x6c, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x12, 0x42,
+	0x0a, 0x09, 0x76, 0x6d, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x0b, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x25, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2e, 0x65, 0x78, 0x74, 0x65,
+	0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e,
+	0x56, 0x6d, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x08, 0x76, 0x6d, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x12, 0x3e, 0x0a, 0x0e, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x63, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x18, 0x65, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72,
+	0x75, 0x63, 0x74, 0x52, 0x0d, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x12, 0x47, 0x0a, 0x0b, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x5f, 0x72, 0x75, 0x6c, 0x65,
+	0x73, 0x18, 0x66, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73,
+	0x73, 0x2e, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x76, 0x31, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x52, 0x75, 0x6c, 0x65, 0x52,
+	0x0a, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x52, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x50, 0x0a, 0x16, 0x64,
+	0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x64, 0x69,
+	0x73, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x67, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f,
+	0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x14, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x22, 0xcb, 0x01,
+	0x0a, 0x09, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x69,
+	0x6e, 0x67, 0x72, 0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x69, 0x6e,
+	0x67, 0x72, 0x65, 0x73, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x2f, 0x0a,
+	0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x41,
+	0x0a, 0x0e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x52, 0x0d, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x44, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x05, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x07, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x22, 0x41, 0x0a, 0x08, 0x56,
+	0x6d, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x35, 0x0a, 0x03, 0x65, 0x6e, 0x76, 0x18, 0x01,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2e, 0x65,
+	0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x2e, 0x45, 0x6e, 0x76, 0x56, 0x61, 0x72, 0x52, 0x03, 0x65, 0x6e, 0x76, 0x22, 0x7e,
+	0x0a, 0x06, 0x45, 0x6e, 0x76, 0x56, 0x61, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x4a, 0x0a, 0x0a,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x66, 0x72, 0x6f, 0x6d, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x2b, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2e, 0x65, 0x78, 0x74, 0x65, 0x6e,
+	0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x45,
+	0x6e, 0x76, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x09, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x46, 0x72, 0x6f, 0x6d, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x2a, 0x45,
+	0x0a, 0x0b, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x50, 0x68, 0x61, 0x73, 0x65, 0x12, 0x15, 0x0a,
+	0x11, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x5f, 0x50, 0x48, 0x41,
+	0x53, 0x45, 0x10, 0x00, 0x12, 0x09, 0x0a, 0x05, 0x41, 0x55, 0x54, 0x48, 0x4e, 0x10, 0x01, 0x12,
+	0x09, 0x0a, 0x05, 0x41, 0x55, 0x54, 0x48, 0x5a, 0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x53, 0x54,
+	0x41, 0x54, 0x53, 0x10, 0x03, 0x2a, 0x42, 0x0a, 0x0a, 0x50, 0x75, 0x6c, 0x6c, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x12, 0x16, 0x0a, 0x12, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49,
+	0x45, 0x44, 0x5f, 0x50, 0x4f, 0x4c, 0x49, 0x43, 0x59, 0x10, 0x00, 0x12, 0x10, 0x0a, 0x0c, 0x49,
+	0x66, 0x4e, 0x6f, 0x74, 0x50, 0x72, 0x65, 0x73, 0x65, 0x6e, 0x74, 0x10, 0x01, 0x12, 0x0a, 0x0a,
+	0x06, 0x41, 0x6c, 0x77, 0x61, 0x79, 0x73, 0x10, 0x02, 0x2a, 0x26, 0x0a, 0x0e, 0x45, 0x6e, 0x76,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x0a, 0x0a, 0x06, 0x49,
+	0x4e, 0x4c, 0x49, 0x4e, 0x45, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x48, 0x4f, 0x53, 0x54, 0x10,
+	0x01, 0x2a, 0x2d, 0x0a, 0x0c, 0x46, 0x61, 0x69, 0x6c, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67,
+	0x79, 0x12, 0x0e, 0x0a, 0x0a, 0x46, 0x41, 0x49, 0x4c, 0x5f, 0x43, 0x4c, 0x4f, 0x53, 0x45, 0x10,
+	0x00, 0x12, 0x0d, 0x0a, 0x09, 0x46, 0x41, 0x49, 0x4c, 0x5f, 0x4f, 0x50, 0x45, 0x4e, 0x10, 0x01,
+	0x42, 0x34, 0x5a, 0x32, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x61,
+	0x6c, 0x69, 0x62, 0x61, 0x62, 0x61, 0x2f, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2f, 0x61,
+	0x70, 0x69, 0x2f, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_extensions_v1alpha1_wasmplugin_proto_rawDescOnce sync.Once
+	file_extensions_v1alpha1_wasmplugin_proto_rawDescData = file_extensions_v1alpha1_wasmplugin_proto_rawDesc
+)
+
+func file_extensions_v1alpha1_wasmplugin_proto_rawDescGZIP() []byte {
+	file_extensions_v1alpha1_wasmplugin_proto_rawDescOnce.Do(func() {
+		file_extensions_v1alpha1_wasmplugin_proto_rawDescData = protoimpl.X.CompressGZIP(file_extensions_v1alpha1_wasmplugin_proto_rawDescData)
+	})
+	return file_extensions_v1alpha1_wasmplugin_proto_rawDescData
+}
+
+var file_extensions_v1alpha1_wasmplugin_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
+var file_extensions_v1alpha1_wasmplugin_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_extensions_v1alpha1_wasmplugin_proto_goTypes = []interface{}{
+	(PluginPhase)(0),            // 0: higress.extensions.v1alpha1.PluginPhase
+	(PullPolicy)(0),             // 1: higress.extensions.v1alpha1.PullPolicy
+	(EnvValueSource)(0),         // 2: higress.extensions.v1alpha1.EnvValueSource
+	(FailStrategy)(0),           // 3: higress.extensions.v1alpha1.FailStrategy
+	(*WasmPlugin)(nil),          // 4: higress.extensions.v1alpha1.WasmPlugin
+	(*MatchRule)(nil),           // 5: higress.extensions.v1alpha1.MatchRule
+	(*VmConfig)(nil),            // 6: higress.extensions.v1alpha1.VmConfig
+	(*EnvVar)(nil),              // 7: higress.extensions.v1alpha1.EnvVar
+	(*_struct.Struct)(nil),      // 8: google.protobuf.Struct
+	(*wrappers.Int32Value)(nil), // 9: google.protobuf.Int32Value
+	(*wrappers.BoolValue)(nil),  // 10: google.protobuf.BoolValue
+}
+var file_extensions_v1alpha1_wasmplugin_proto_depIdxs = []int32{
+	1,  // 0: higress.extensions.v1alpha1.WasmPlugin.image_pull_policy:type_name -> higress.extensions.v1alpha1.PullPolicy
+	8,  // 1: higress.extensions.v1alpha1.WasmPlugin.plugin_config:type_name -> google.protobuf.Struct
+	0,  // 2: higress.extensions.v1alpha1.WasmPlugin.phase:type_name -> higress.extensions.v1alpha1.PluginPhase
+	9,  // 3: higress.extensions.v1alpha1.WasmPlugin.priority:type_name -> google.protobuf.Int32Value
+	3,  // 4: higress.extensions.v1alpha1.WasmPlugin.fail_strategy:type_name -> higress.extensions.v1alpha1.FailStrategy
+	6,  // 5: higress.extensions.v1alpha1.WasmPlugin.vm_config:type_name -> higress.extensions.v1alpha1.VmConfig
+	8,  // 6: higress.extensions.v1alpha1.WasmPlugin.default_config:type_name -> google.protobuf.Struct
+	5,  // 7: higress.extensions.v1alpha1.WasmPlugin.match_rules:type_name -> higress.extensions.v1alpha1.MatchRule
+	10, // 8: higress.extensions.v1alpha1.WasmPlugin.default_config_disable:type_name -> google.protobuf.BoolValue
+	8,  // 9: higress.extensions.v1alpha1.MatchRule.config:type_name -> google.protobuf.Struct
+	10, // 10: higress.extensions.v1alpha1.MatchRule.config_disable:type_name -> google.protobuf.BoolValue
+	7,  // 11: higress.extensions.v1alpha1.VmConfig.env:type_name -> higress.extensions.v1alpha1.EnvVar
+	2,  // 12: higress.extensions.v1alpha1.EnvVar.value_from:type_name -> higress.extensions.v1alpha1.EnvValueSource
+	13, // [13:13] is the sub-list for method output_type
+	13, // [13:13] is the sub-list for method input_type
+	13, // [13:13] is the sub-list for extension type_name
+	13, // [13:13] is the sub-list for extension extendee
+	0,  // [0:13] is the sub-list for field type_name
+}
+
+func init() { file_extensions_v1alpha1_wasmplugin_proto_init() }
+func file_extensions_v1alpha1_wasmplugin_proto_init() {
+	if File_extensions_v1alpha1_wasmplugin_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_extensions_v1alpha1_wasmplugin_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WasmPlugin); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_extensions_v1alpha1_wasmplugin_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MatchRule); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_extensions_v1alpha1_wasmplugin_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*VmConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_extensions_v1alpha1_wasmplugin_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EnvVar); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_extensions_v1alpha1_wasmplugin_proto_rawDesc,
+			NumEnums:      4,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_extensions_v1alpha1_wasmplugin_proto_goTypes,
+		DependencyIndexes: file_extensions_v1alpha1_wasmplugin_proto_depIdxs,
+		EnumInfos:         file_extensions_v1alpha1_wasmplugin_proto_enumTypes,
+		MessageInfos:      file_extensions_v1alpha1_wasmplugin_proto_msgTypes,
+	}.Build()
+	File_extensions_v1alpha1_wasmplugin_proto = out.File
+	file_extensions_v1alpha1_wasmplugin_proto_rawDesc = nil
+	file_extensions_v1alpha1_wasmplugin_proto_goTypes = nil
+	file_extensions_v1alpha1_wasmplugin_proto_depIdxs = nil
+}

api/extensions/v1alpha1/wasmplugin.proto

@@ -100,12 +100,19 @@ message WasmPlugin {
   // namespace of the `WasmPlugins`. Defaults to `0`.
   google.protobuf.Int32Value priority = 10;
 
+  // Specifies the failure behavior for the plugin due to fatal errors.
+  FailStrategy fail_strategy = 13;
+
+  // Configuration for a Wasm VM.
+  // more details can be found [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/wasm/v3/wasm.proto#extensions-wasm-v3-vmconfig).
+  VmConfig vm_config = 11;
+
   // Extended by Higress, the default configuration takes effect globally
   google.protobuf.Struct default_config = 101;
   // Extended by Higress, matching rules take effect
   repeated MatchRule match_rules = 102;
   // disable the default config
-  bool default_config_disable = 103;
+  google.protobuf.BoolValue default_config_disable = 103;
 }
 
 // Extended by Higress
@@ -113,7 +120,8 @@ message MatchRule {
   repeated string ingress = 1;
   repeated string domain = 2;
   google.protobuf.Struct config = 3;
-  bool config_disable = 4;
+  google.protobuf.BoolValue config_disable = 4;
+  repeated string service = 5;
 }
 
 // The phase in the filter chain where the plugin will be injected.
@@ -153,3 +161,46 @@ enum PullPolicy {
   // this plugin.
   Always = 2;
 }
+
+// Configuration for a Wasm VM.
+// more details can be found [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/wasm/v3/wasm.proto#extensions-wasm-v3-vmconfig).
+message VmConfig {
+  // Specifies environment variables to be injected to this VM.
+  // Note that if a key does not exist, it will be ignored.
+  repeated EnvVar env = 1;
+}
+
+message EnvVar {
+  // Required
+  // Name of the environment variable. Must be a C_IDENTIFIER.
+  string name = 1;
+
+  // Required
+  // Source for the environment variable's value.
+  EnvValueSource value_from = 3;
+
+  // Value for the environment variable.
+  // Note that if `value_from` is `HOST`, it will be ignored.
+  // Defaults to "".
+  string value = 2;
+}
+
+enum EnvValueSource {
+  // Explicitly given key-value pairs to be injected to this VM
+  INLINE = 0;
+
+  // *Istio-proxy's* environment variables exposed to this VM.
+  HOST = 1;
+}
+
+enum FailStrategy {
+  // A fatal error in the binary fetching or during the plugin execution causes
+  // all subsequent requests to fail with 5xx.
+  FAIL_CLOSE = 0;
+
+  // Enables the fail open behavior for the Wasm plugin fatal errors to bypass
+  // the plugin execution. A fatal error can be a failure to fetch the remote
+  // binary, an exception, or abort() on the VM. This flag is not recommended
+  // for the authentication or the authorization plugins.
+  FAIL_OPEN = 1;
+}

api/extensions/v1alpha1/wasmplugin_deepcopy.gen.go

@@ -0,0 +1,90 @@
+// Code generated by protoc-gen-deepcopy. DO NOT EDIT.
+package v1alpha1
+
+import (
+	proto "google.golang.org/protobuf/proto"
+)
+
+// DeepCopyInto supports using WasmPlugin within kubernetes types, where deepcopy-gen is used.
+func (in *WasmPlugin) DeepCopyInto(out *WasmPlugin) {
+	p := proto.Clone(in).(*WasmPlugin)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WasmPlugin. Required by controller-gen.
+func (in *WasmPlugin) DeepCopy() *WasmPlugin {
+	if in == nil {
+		return nil
+	}
+	out := new(WasmPlugin)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new WasmPlugin. Required by controller-gen.
+func (in *WasmPlugin) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using MatchRule within kubernetes types, where deepcopy-gen is used.
+func (in *MatchRule) DeepCopyInto(out *MatchRule) {
+	p := proto.Clone(in).(*MatchRule)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MatchRule. Required by controller-gen.
+func (in *MatchRule) DeepCopy() *MatchRule {
+	if in == nil {
+		return nil
+	}
+	out := new(MatchRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new MatchRule. Required by controller-gen.
+func (in *MatchRule) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using VmConfig within kubernetes types, where deepcopy-gen is used.
+func (in *VmConfig) DeepCopyInto(out *VmConfig) {
+	p := proto.Clone(in).(*VmConfig)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new VmConfig. Required by controller-gen.
+func (in *VmConfig) DeepCopy() *VmConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(VmConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new VmConfig. Required by controller-gen.
+func (in *VmConfig) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using EnvVar within kubernetes types, where deepcopy-gen is used.
+func (in *EnvVar) DeepCopyInto(out *EnvVar) {
+	p := proto.Clone(in).(*EnvVar)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvVar. Required by controller-gen.
+func (in *EnvVar) DeepCopy() *EnvVar {
+	if in == nil {
+		return nil
+	}
+	out := new(EnvVar)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new EnvVar. Required by controller-gen.
+func (in *EnvVar) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}

api/extensions/v1alpha1/wasmplugin_json.gen.go

@@ -0,0 +1,56 @@
+// Code generated by protoc-gen-jsonshim. DO NOT EDIT.
+package v1alpha1
+
+import (
+	bytes "bytes"
+	jsonpb "github.com/golang/protobuf/jsonpb"
+)
+
+// MarshalJSON is a custom marshaler for WasmPlugin
+func (this *WasmPlugin) MarshalJSON() ([]byte, error) {
+	str, err := WasmpluginMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for WasmPlugin
+func (this *WasmPlugin) UnmarshalJSON(b []byte) error {
+	return WasmpluginUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for MatchRule
+func (this *MatchRule) MarshalJSON() ([]byte, error) {
+	str, err := WasmpluginMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for MatchRule
+func (this *MatchRule) UnmarshalJSON(b []byte) error {
+	return WasmpluginUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for VmConfig
+func (this *VmConfig) MarshalJSON() ([]byte, error) {
+	str, err := WasmpluginMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for VmConfig
+func (this *VmConfig) UnmarshalJSON(b []byte) error {
+	return WasmpluginUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for EnvVar
+func (this *EnvVar) MarshalJSON() ([]byte, error) {
+	str, err := WasmpluginMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for EnvVar
+func (this *EnvVar) UnmarshalJSON(b []byte) error {
+	return WasmpluginUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+var (
+	WasmpluginMarshaler   = &jsonpb.Marshaler{}
+	WasmpluginUnmarshaler = &jsonpb.Unmarshaler{AllowUnknownFields: true}
+)

api/kubernetes/customresourcedefinitions.gen.yaml

@@ -37,6 +37,13 @@ spec:
                 x-kubernetes-preserve-unknown-fields: true
               defaultConfigDisable:
                 type: boolean
+              failStrategy:
+                description: Specifies the failure behavior for the plugin due to
+                  fatal errors.
+                enum:
+                - FAIL_CLOSE
+                - FAIL_OPEN
+                type: string
               imagePullPolicy:
                 description: The pull behaviour to be applied when fetching an OCI
                   image.
@@ -64,6 +71,10 @@ spec:
                       items:
                         type: string
                       type: array
+                    service:
+                      items:
+                        type: string
+                      type: array
                   type: object
                 type: array
               phase:
@@ -94,6 +105,27 @@ spec:
                 type: string
               verificationKey:
                 type: string
+              vmConfig:
+                description: Configuration for a Wasm VM.
+                properties:
+                  env:
+                    description: Specifies environment variables to be injected to
+                      this VM.
+                    items:
+                      properties:
+                        name:
+                          type: string
+                        value:
+                          description: Value for the environment variable.
+                          type: string
+                        valueFrom:
+                          enum:
+                          - INLINE
+                          - HOST
+                          type: string
+                      type: object
+                    type: array
+                type: object
             type: object
           status:
             type: object
@@ -215,9 +247,30 @@ spec:
         properties:
           spec:
             properties:
+              proxies:
+                items:
+                  properties:
+                    connectTimeout:
+                      type: integer
+                    listenerPort:
+                      type: integer
+                    name:
+                      type: string
+                    serverAddress:
+                      type: string
+                    serverPort:
+                      type: integer
+                    type:
+                      type: string
+                  type: object
+                type: array
               registries:
                 items:
                   properties:
+                    allowMcpServers:
+                      items:
+                        type: string
+                      type: array
                     authSecretName:
                       type: string
                     consulDatacenter:
@@ -231,6 +284,25 @@ spec:
                       type: string
                     domain:
                       type: string
+                    enableMCPServer:
+                      type: boolean
+                    enableScopeMcpServers:
+                      type: boolean
+                    mcpServerBaseUrl:
+                      type: string
+                    mcpServerExportDomains:
+                      items:
+                        type: string
+                      type: array
+                    metadata:
+                      additionalProperties:
+                        properties:
+                          innerMap:
+                            additionalProperties:
+                              type: string
+                            type: object
+                        type: object
+                      type: object
                     nacosAccessKey:
                       type: string
                     nacosAddressServer:
@@ -252,6 +324,12 @@ spec:
                       type: string
                     port:
                       type: integer
+                    protocol:
+                      type: string
+                    proxyName:
+                      type: string
+                    sni:
+                      type: string
                     type:
                       type: string
                     zkServicesPath:

api/networking/v1/http_2_rpc_deepcopy.gen.go

@@ -1,20 +1,10 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: networking/v1/http_2_rpc.proto
-
+// Code generated by protoc-gen-deepcopy. DO NOT EDIT.
 package v1
 
 import (
-	fmt "fmt"
-	proto "github.com/gogo/protobuf/proto"
-	_ "istio.io/gogo-genproto/googleapis/google/api"
-	math "math"
+	proto "google.golang.org/protobuf/proto"
 )
 
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
 // DeepCopyInto supports using Http2Rpc within kubernetes types, where deepcopy-gen is used.
 func (in *Http2Rpc) DeepCopyInto(out *Http2Rpc) {
 	p := proto.Clone(in).(*Http2Rpc)

api/networking/v1/http_2_rpc_json.gen.go

@@ -1,22 +1,11 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: networking/v1/http_2_rpc.proto
-
+// Code generated by protoc-gen-jsonshim. DO NOT EDIT.
 package v1
 
 import (
 	bytes "bytes"
-	fmt "fmt"
-	github_com_gogo_protobuf_jsonpb "github.com/gogo/protobuf/jsonpb"
-	proto "github.com/gogo/protobuf/proto"
-	_ "istio.io/gogo-genproto/googleapis/google/api"
-	math "math"
+	jsonpb "github.com/golang/protobuf/jsonpb"
 )
 
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
 // MarshalJSON is a custom marshaler for Http2Rpc
 func (this *Http2Rpc) MarshalJSON() ([]byte, error) {
 	str, err := Http_2RpcMarshaler.MarshalToString(this)
@@ -84,6 +73,6 @@ func (this *GrpcService) UnmarshalJSON(b []byte) error {
 }
 
 var (
-	Http_2RpcMarshaler   = &github_com_gogo_protobuf_jsonpb.Marshaler{}
-	Http_2RpcUnmarshaler = &github_com_gogo_protobuf_jsonpb.Unmarshaler{AllowUnknownFields: true}
+	Http_2RpcMarshaler   = &jsonpb.Marshaler{}
+	Http_2RpcUnmarshaler = &jsonpb.Unmarshaler{AllowUnknownFields: true}
 )

api/networking/v1/mcp_bridge.proto

@@ -15,6 +15,8 @@
 syntax = "proto3";
 
 import "google/api/field_behavior.proto";
+import "google/protobuf/wrappers.proto";
+import "google/protobuf/struct.proto";
 
 // $schema: higress.networking.v1.McpBridge
 // $title: McpBridge
@@ -44,6 +46,7 @@ option go_package = "github.com/alibaba/higress/api/networking/v1";
 // -->
 message McpBridge {
   repeated RegistryConfig registries = 1;
+  repeated ProxyConfig proxies = 2;
 }
 
 message RegistryConfig {
@@ -64,4 +67,26 @@ message RegistryConfig {
   string consulServiceTag = 15;
   int64  consulRefreshInterval = 16;
   string authSecretName = 17;
+  string protocol = 18;
+  string sni = 19;
+  repeated string mcpServerExportDomains = 20;
+  string mcpServerBaseUrl = 21;
+  google.protobuf.BoolValue enableMCPServer = 22;
+  google.protobuf.BoolValue enableScopeMcpServers = 23;
+  repeated string allowMcpServers = 24;
+  map<string, InnerMap> metadata = 25;
+  string proxyName = 26;
 }
+
+message ProxyConfig {
+  string type = 1 [(google.api.field_behavior) = REQUIRED];
+  string name = 2 [(google.api.field_behavior) = REQUIRED];
+  string serverAddress = 3 [(google.api.field_behavior) = REQUIRED];
+  uint32 serverPort = 4 [(google.api.field_behavior) = REQUIRED];
+  uint32 listenerPort = 5;
+  uint32 connectTimeout = 6;
+}
+
+message InnerMap {
+  map<string, string> inner_map = 1;
+}

api/networking/v1/mcp_bridge_deepcopy.gen.go

@@ -1,20 +1,10 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: networking/v1/mcp_bridge.proto
-
+// Code generated by protoc-gen-deepcopy. DO NOT EDIT.
 package v1
 
 import (
-	fmt "fmt"
-	proto "github.com/gogo/protobuf/proto"
-	_ "istio.io/gogo-genproto/googleapis/google/api"
-	math "math"
+	proto "google.golang.org/protobuf/proto"
 )
 
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
 // DeepCopyInto supports using McpBridge within kubernetes types, where deepcopy-gen is used.
 func (in *McpBridge) DeepCopyInto(out *McpBridge) {
 	p := proto.Clone(in).(*McpBridge)
@@ -56,3 +46,45 @@ func (in *RegistryConfig) DeepCopy() *RegistryConfig {
 func (in *RegistryConfig) DeepCopyInterface() interface{} {
 	return in.DeepCopy()
 }
+
+// DeepCopyInto supports using ProxyConfig within kubernetes types, where deepcopy-gen is used.
+func (in *ProxyConfig) DeepCopyInto(out *ProxyConfig) {
+	p := proto.Clone(in).(*ProxyConfig)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyConfig. Required by controller-gen.
+func (in *ProxyConfig) DeepCopy() *ProxyConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new ProxyConfig. Required by controller-gen.
+func (in *ProxyConfig) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
+// DeepCopyInto supports using InnerMap within kubernetes types, where deepcopy-gen is used.
+func (in *InnerMap) DeepCopyInto(out *InnerMap) {
+	p := proto.Clone(in).(*InnerMap)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InnerMap. Required by controller-gen.
+func (in *InnerMap) DeepCopy() *InnerMap {
+	if in == nil {
+		return nil
+	}
+	out := new(InnerMap)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new InnerMap. Required by controller-gen.
+func (in *InnerMap) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}

api/networking/v1/mcp_bridge_json.gen.go

@@ -1,22 +1,11 @@
-// Code generated by protoc-gen-gogo. DO NOT EDIT.
-// source: networking/v1/mcp_bridge.proto
-
+// Code generated by protoc-gen-jsonshim. DO NOT EDIT.
 package v1
 
 import (
 	bytes "bytes"
-	fmt "fmt"
-	github_com_gogo_protobuf_jsonpb "github.com/gogo/protobuf/jsonpb"
-	proto "github.com/gogo/protobuf/proto"
-	_ "istio.io/gogo-genproto/googleapis/google/api"
-	math "math"
+	jsonpb "github.com/golang/protobuf/jsonpb"
 )
 
-// Reference imports to suppress errors if they are not otherwise used.
-var _ = proto.Marshal
-var _ = fmt.Errorf
-var _ = math.Inf
-
 // MarshalJSON is a custom marshaler for McpBridge
 func (this *McpBridge) MarshalJSON() ([]byte, error) {
 	str, err := McpBridgeMarshaler.MarshalToString(this)
@@ -39,7 +28,29 @@ func (this *RegistryConfig) UnmarshalJSON(b []byte) error {
 	return McpBridgeUnmarshaler.Unmarshal(bytes.NewReader(b), this)
 }
 
+// MarshalJSON is a custom marshaler for ProxyConfig
+func (this *ProxyConfig) MarshalJSON() ([]byte, error) {
+	str, err := McpBridgeMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for ProxyConfig
+func (this *ProxyConfig) UnmarshalJSON(b []byte) error {
+	return McpBridgeUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
+// MarshalJSON is a custom marshaler for InnerMap
+func (this *InnerMap) MarshalJSON() ([]byte, error) {
+	str, err := McpBridgeMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for InnerMap
+func (this *InnerMap) UnmarshalJSON(b []byte) error {
+	return McpBridgeUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
 var (
-	McpBridgeMarshaler   = &github_com_gogo_protobuf_jsonpb.Marshaler{}
-	McpBridgeUnmarshaler = &github_com_gogo_protobuf_jsonpb.Unmarshaler{AllowUnknownFields: true}
+	McpBridgeMarshaler   = &jsonpb.Marshaler{}
+	McpBridgeUnmarshaler = &jsonpb.Unmarshaler{AllowUnknownFields: true}
 )

client/Makefile

@@ -16,6 +16,7 @@
 ########################
 # kubernetes code generators
 ########################
+applyconfiguration_gen = applyconfiguration-gen
 kubetype_gen = kubetype-gen
 deepcopy_gen = deepcopy-gen
 client_gen = client-gen
@@ -42,6 +43,8 @@ kube_api_packages = $(subst $(space),$(empty), \
 	$(kube_api_base_package)/networking/v1, \
 	$(kube_api_base_package)/extensions/v1alpha1 \
 	)
+# this is needed to properly generate ssa functions
+kube_api_applyconfiguration_packages = $(kube_api_packages),k8s.io/apimachinery/pkg/apis/meta/v1
 # base output package used by kubernetes client-gen
 kube_clientset_package = $(kube_base_output_package)/clientset
 # clientset name used by kubernetes client-gen
@@ -50,6 +53,8 @@ kube_clientset_name = versioned
 kube_listers_package = $(kube_base_output_package)/listers
 # base output package used by kubernetes informer-gen
 kube_informers_package = $(kube_base_output_package)/informers
+# base output package used by kubernetes applyconfiguration-gen
+kube_applyconfiguration_package = $(kube_base_output_package)/applyconfiguration
 
 # file header text
 kube_go_header_text = header.go.txt
@@ -73,12 +78,14 @@ rename_generated_files=\
 .PHONY: generate-k8s-client
 generate-k8s-client:
 	# generate kube api type wrappers for higress types
-	@$(kubetype_gen) --input-dirs $(kube_source_packages) --output-package $(kube_api_base_package) -h $(kube_go_header_text)
+	@KUBETYPE_GOLANG_PROTOBUF=true $(kubetype_gen) --input-dirs $(kube_source_packages) --output-package $(kube_api_base_package) -h $(kube_go_header_text)
 	@$(move_generated)
 	# generate deepcopy for kube api types
 	@$(deepcopy_gen) --input-dirs $(kube_api_packages) -O zz_generated.deepcopy  -h $(kube_go_header_text)
+	# generate ssa for kube api types
+	@$(applyconfiguration_gen) --input-dirs $(kube_api_applyconfiguration_packages) --output-package $(kube_applyconfiguration_package) -h $(kube_go_header_text)
 	# generate clientsets for kube api types
-	@$(client_gen) --clientset-name $(kube_clientset_name) --input-base "" --input  $(kube_api_packages) --output-package $(kube_clientset_package) -h $(kube_go_header_text)
+	@$(client_gen) --clientset-name $(kube_clientset_name) --input-base "" --input  $(kube_api_packages) --output-package $(kube_clientset_package) -h $(kube_go_header_text) --apply-configuration-package $(kube_applyconfiguration_package)
 	# generate listers for kube api types
 	@$(lister_gen) --input-dirs $(kube_api_packages) --output-package $(kube_listers_package) -h $(kube_go_header_text)
 	# generate informers for kube api types

client/pkg/apis/extensions/v1alpha1/types.gen.go

@@ -65,5 +65,5 @@ type WasmPluginList struct {
 	v1.TypeMeta `json:",inline"`
 	// +optional
 	v1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-	Items       []WasmPlugin `json:"items" protobuf:"bytes,2,rep,name=items"`
+	Items       []*WasmPlugin `json:"items" protobuf:"bytes,2,rep,name=items"`
 }

client/pkg/apis/extensions/v1alpha1/zz_generated.deepcopy.gen.go

@@ -58,9 +58,13 @@ func (in *WasmPluginList) DeepCopyInto(out *WasmPluginList) {
 	in.ListMeta.DeepCopyInto(&out.ListMeta)
 	if in.Items != nil {
 		in, out := &in.Items, &out.Items
-		*out = make([]WasmPlugin, len(*in))
+		*out = make([]*WasmPlugin, len(*in))
 		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(WasmPlugin)
+				(*in).DeepCopyInto(*out)
+			}
 		}
 	}
 	return

client/pkg/apis/networking/v1/types.gen.go

@@ -22,7 +22,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
-// please upgrade the proto package
+//
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
 // <!-- crd generation tags
@@ -61,10 +61,10 @@ type Http2RpcList struct {
 	metav1.TypeMeta `json:",inline"`
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-	Items           []Http2Rpc `json:"items" protobuf:"bytes,2,rep,name=items"`
+	Items           []*Http2Rpc `json:"items" protobuf:"bytes,2,rep,name=items"`
 }
 
-// please upgrade the proto package
+//
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 
 // <!-- crd generation tags
@@ -103,5 +103,5 @@ type McpBridgeList struct {
 	metav1.TypeMeta `json:",inline"`
 	// +optional
 	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
-	Items           []McpBridge `json:"items" protobuf:"bytes,2,rep,name=items"`
+	Items           []*McpBridge `json:"items" protobuf:"bytes,2,rep,name=items"`
 }

client/pkg/apis/networking/v1/zz_generated.deepcopy.gen.go

@@ -58,9 +58,13 @@ func (in *Http2RpcList) DeepCopyInto(out *Http2RpcList) {
 	in.ListMeta.DeepCopyInto(&out.ListMeta)
 	if in.Items != nil {
 		in, out := &in.Items, &out.Items
-		*out = make([]Http2Rpc, len(*in))
+		*out = make([]*Http2Rpc, len(*in))
 		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(Http2Rpc)
+				(*in).DeepCopyInto(*out)
+			}
 		}
 	}
 	return
@@ -119,9 +123,13 @@ func (in *McpBridgeList) DeepCopyInto(out *McpBridgeList) {
 	in.ListMeta.DeepCopyInto(&out.ListMeta)
 	if in.Items != nil {
 		in, out := &in.Items, &out.Items
-		*out = make([]McpBridge, len(*in))
+		*out = make([]*McpBridge, len(*in))
 		for i := range *in {
-			(*in)[i].DeepCopyInto(&(*out)[i])
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(McpBridge)
+				(*in).DeepCopyInto(*out)
+			}
 		}
 	}
 	return

client/pkg/applyconfiguration/extensions/v1alpha1/wasmplugin.go

@@ -0,0 +1,219 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	v1alpha1 "github.com/alibaba/higress/api/extensions/v1alpha1"
+	v1 "github.com/alibaba/higress/client/pkg/applyconfiguration/meta/v1"
+	metav1alpha1 "istio.io/api/meta/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+)
+
+// WasmPluginApplyConfiguration represents an declarative configuration of the WasmPlugin type for use
+// with apply.
+type WasmPluginApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *v1alpha1.WasmPlugin      `json:"spec,omitempty"`
+	Status                           *metav1alpha1.IstioStatus `json:"status,omitempty"`
+}
+
+// WasmPlugin constructs an declarative configuration of the WasmPlugin type for use with
+// apply.
+func WasmPlugin(name, namespace string) *WasmPluginApplyConfiguration {
+	b := &WasmPluginApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("WasmPlugin")
+	b.WithAPIVersion("extensions.higress.io/v1alpha1")
+	return b
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithKind(value string) *WasmPluginApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithAPIVersion(value string) *WasmPluginApplyConfiguration {
+	b.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithName(value string) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithGenerateName(value string) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithNamespace(value string) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithUID(value types.UID) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithResourceVersion(value string) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithGeneration(value int64) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithCreationTimestamp(value metav1.Time) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *WasmPluginApplyConfiguration) WithLabels(entries map[string]string) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.Labels == nil && len(entries) > 0 {
+		b.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *WasmPluginApplyConfiguration) WithAnnotations(entries map[string]string) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.Annotations == nil && len(entries) > 0 {
+		b.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *WasmPluginApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.OwnerReferences = append(b.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *WasmPluginApplyConfiguration) WithFinalizers(values ...string) *WasmPluginApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.Finalizers = append(b.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *WasmPluginApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithSpec(value v1alpha1.WasmPlugin) *WasmPluginApplyConfiguration {
+	b.Spec = &value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *WasmPluginApplyConfiguration) WithStatus(value metav1alpha1.IstioStatus) *WasmPluginApplyConfiguration {
+	b.Status = &value
+	return b
+}

client/pkg/applyconfiguration/internal/internal.go

@@ -0,0 +1,60 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package internal
+
+import (
+	"fmt"
+	"sync"
+
+	typed "sigs.k8s.io/structured-merge-diff/v4/typed"
+)
+
+func Parser() *typed.Parser {
+	parserOnce.Do(func() {
+		var err error
+		parser, err = typed.NewParser(schemaYAML)
+		if err != nil {
+			panic(fmt.Sprintf("Failed to parse schema: %v", err))
+		}
+	})
+	return parser
+}
+
+var parserOnce sync.Once
+var parser *typed.Parser
+var schemaYAML = typed.YAMLObject(`types:
+- name: __untyped_atomic_
+  scalar: untyped
+  list:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+  map:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+- name: __untyped_deduced_
+  scalar: untyped
+  list:
+    elementType:
+      namedType: __untyped_atomic_
+    elementRelationship: atomic
+  map:
+    elementType:
+      namedType: __untyped_deduced_
+    elementRelationship: separable
+`)

client/pkg/applyconfiguration/meta/v1/managedfieldsentry.go

@@ -0,0 +1,95 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// ManagedFieldsEntryApplyConfiguration represents an declarative configuration of the ManagedFieldsEntry type for use
+// with apply.
+type ManagedFieldsEntryApplyConfiguration struct {
+	Manager     *string                        `json:"manager,omitempty"`
+	Operation   *v1.ManagedFieldsOperationType `json:"operation,omitempty"`
+	APIVersion  *string                        `json:"apiVersion,omitempty"`
+	Time        *v1.Time                       `json:"time,omitempty"`
+	FieldsType  *string                        `json:"fieldsType,omitempty"`
+	FieldsV1    *v1.FieldsV1                   `json:"fieldsV1,omitempty"`
+	Subresource *string                        `json:"subresource,omitempty"`
+}
+
+// ManagedFieldsEntryApplyConfiguration constructs an declarative configuration of the ManagedFieldsEntry type for use with
+// apply.
+func ManagedFieldsEntry() *ManagedFieldsEntryApplyConfiguration {
+	return &ManagedFieldsEntryApplyConfiguration{}
+}
+
+// WithManager sets the Manager field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Manager field is set to the value of the last call.
+func (b *ManagedFieldsEntryApplyConfiguration) WithManager(value string) *ManagedFieldsEntryApplyConfiguration {
+	b.Manager = &value
+	return b
+}
+
+// WithOperation sets the Operation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Operation field is set to the value of the last call.
+func (b *ManagedFieldsEntryApplyConfiguration) WithOperation(value v1.ManagedFieldsOperationType) *ManagedFieldsEntryApplyConfiguration {
+	b.Operation = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *ManagedFieldsEntryApplyConfiguration) WithAPIVersion(value string) *ManagedFieldsEntryApplyConfiguration {
+	b.APIVersion = &value
+	return b
+}
+
+// WithTime sets the Time field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Time field is set to the value of the last call.
+func (b *ManagedFieldsEntryApplyConfiguration) WithTime(value v1.Time) *ManagedFieldsEntryApplyConfiguration {
+	b.Time = &value
+	return b
+}
+
+// WithFieldsType sets the FieldsType field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the FieldsType field is set to the value of the last call.
+func (b *ManagedFieldsEntryApplyConfiguration) WithFieldsType(value string) *ManagedFieldsEntryApplyConfiguration {
+	b.FieldsType = &value
+	return b
+}
+
+// WithFieldsV1 sets the FieldsV1 field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the FieldsV1 field is set to the value of the last call.
+func (b *ManagedFieldsEntryApplyConfiguration) WithFieldsV1(value v1.FieldsV1) *ManagedFieldsEntryApplyConfiguration {
+	b.FieldsV1 = &value
+	return b
+}
+
+// WithSubresource sets the Subresource field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Subresource field is set to the value of the last call.
+func (b *ManagedFieldsEntryApplyConfiguration) WithSubresource(value string) *ManagedFieldsEntryApplyConfiguration {
+	b.Subresource = &value
+	return b
+}

client/pkg/applyconfiguration/meta/v1/objectmeta.go

@@ -0,0 +1,169 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+)
+
+// ObjectMetaApplyConfiguration represents an declarative configuration of the ObjectMeta type for use
+// with apply.
+type ObjectMetaApplyConfiguration struct {
+	Name                       *string                            `json:"name,omitempty"`
+	GenerateName               *string                            `json:"generateName,omitempty"`
+	Namespace                  *string                            `json:"namespace,omitempty"`
+	UID                        *types.UID                         `json:"uid,omitempty"`
+	ResourceVersion            *string                            `json:"resourceVersion,omitempty"`
+	Generation                 *int64                             `json:"generation,omitempty"`
+	CreationTimestamp          *v1.Time                           `json:"creationTimestamp,omitempty"`
+	DeletionTimestamp          *v1.Time                           `json:"deletionTimestamp,omitempty"`
+	DeletionGracePeriodSeconds *int64                             `json:"deletionGracePeriodSeconds,omitempty"`
+	Labels                     map[string]string                  `json:"labels,omitempty"`
+	Annotations                map[string]string                  `json:"annotations,omitempty"`
+	OwnerReferences            []OwnerReferenceApplyConfiguration `json:"ownerReferences,omitempty"`
+	Finalizers                 []string                           `json:"finalizers,omitempty"`
+}
+
+// ObjectMetaApplyConfiguration constructs an declarative configuration of the ObjectMeta type for use with
+// apply.
+func ObjectMeta() *ObjectMetaApplyConfiguration {
+	return &ObjectMetaApplyConfiguration{}
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithName(value string) *ObjectMetaApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithGenerateName(value string) *ObjectMetaApplyConfiguration {
+	b.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithNamespace(value string) *ObjectMetaApplyConfiguration {
+	b.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithUID(value types.UID) *ObjectMetaApplyConfiguration {
+	b.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithResourceVersion(value string) *ObjectMetaApplyConfiguration {
+	b.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithGeneration(value int64) *ObjectMetaApplyConfiguration {
+	b.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithCreationTimestamp(value v1.Time) *ObjectMetaApplyConfiguration {
+	b.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithDeletionTimestamp(value v1.Time) *ObjectMetaApplyConfiguration {
+	b.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *ObjectMetaApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *ObjectMetaApplyConfiguration {
+	b.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *ObjectMetaApplyConfiguration) WithLabels(entries map[string]string) *ObjectMetaApplyConfiguration {
+	if b.Labels == nil && len(entries) > 0 {
+		b.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *ObjectMetaApplyConfiguration) WithAnnotations(entries map[string]string) *ObjectMetaApplyConfiguration {
+	if b.Annotations == nil && len(entries) > 0 {
+		b.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *ObjectMetaApplyConfiguration) WithOwnerReferences(values ...*OwnerReferenceApplyConfiguration) *ObjectMetaApplyConfiguration {
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.OwnerReferences = append(b.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *ObjectMetaApplyConfiguration) WithFinalizers(values ...string) *ObjectMetaApplyConfiguration {
+	for i := range values {
+		b.Finalizers = append(b.Finalizers, values[i])
+	}
+	return b
+}

client/pkg/applyconfiguration/meta/v1/ownerreference.go

@@ -0,0 +1,86 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	types "k8s.io/apimachinery/pkg/types"
+)
+
+// OwnerReferenceApplyConfiguration represents an declarative configuration of the OwnerReference type for use
+// with apply.
+type OwnerReferenceApplyConfiguration struct {
+	APIVersion         *string    `json:"apiVersion,omitempty"`
+	Kind               *string    `json:"kind,omitempty"`
+	Name               *string    `json:"name,omitempty"`
+	UID                *types.UID `json:"uid,omitempty"`
+	Controller         *bool      `json:"controller,omitempty"`
+	BlockOwnerDeletion *bool      `json:"blockOwnerDeletion,omitempty"`
+}
+
+// OwnerReferenceApplyConfiguration constructs an declarative configuration of the OwnerReference type for use with
+// apply.
+func OwnerReference() *OwnerReferenceApplyConfiguration {
+	return &OwnerReferenceApplyConfiguration{}
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *OwnerReferenceApplyConfiguration) WithAPIVersion(value string) *OwnerReferenceApplyConfiguration {
+	b.APIVersion = &value
+	return b
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *OwnerReferenceApplyConfiguration) WithKind(value string) *OwnerReferenceApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *OwnerReferenceApplyConfiguration) WithName(value string) *OwnerReferenceApplyConfiguration {
+	b.Name = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *OwnerReferenceApplyConfiguration) WithUID(value types.UID) *OwnerReferenceApplyConfiguration {
+	b.UID = &value
+	return b
+}
+
+// WithController sets the Controller field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Controller field is set to the value of the last call.
+func (b *OwnerReferenceApplyConfiguration) WithController(value bool) *OwnerReferenceApplyConfiguration {
+	b.Controller = &value
+	return b
+}
+
+// WithBlockOwnerDeletion sets the BlockOwnerDeletion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the BlockOwnerDeletion field is set to the value of the last call.
+func (b *OwnerReferenceApplyConfiguration) WithBlockOwnerDeletion(value bool) *OwnerReferenceApplyConfiguration {
+	b.BlockOwnerDeletion = &value
+	return b
+}

client/pkg/applyconfiguration/meta/v1/typemeta.go

@@ -0,0 +1,46 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+// TypeMetaApplyConfiguration represents an declarative configuration of the TypeMeta type for use
+// with apply.
+type TypeMetaApplyConfiguration struct {
+	Kind       *string `json:"kind,omitempty"`
+	APIVersion *string `json:"apiVersion,omitempty"`
+}
+
+// TypeMetaApplyConfiguration constructs an declarative configuration of the TypeMeta type for use with
+// apply.
+func TypeMeta() *TypeMetaApplyConfiguration {
+	return &TypeMetaApplyConfiguration{}
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *TypeMetaApplyConfiguration) WithKind(value string) *TypeMetaApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *TypeMetaApplyConfiguration) WithAPIVersion(value string) *TypeMetaApplyConfiguration {
+	b.APIVersion = &value
+	return b
+}

client/pkg/applyconfiguration/networking/v1/http2rpc.go

@@ -0,0 +1,219 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	networkingv1 "github.com/alibaba/higress/api/networking/v1"
+	v1 "github.com/alibaba/higress/client/pkg/applyconfiguration/meta/v1"
+	v1alpha1 "istio.io/api/meta/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+)
+
+// Http2RpcApplyConfiguration represents an declarative configuration of the Http2Rpc type for use
+// with apply.
+type Http2RpcApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *networkingv1.Http2Rpc `json:"spec,omitempty"`
+	Status                           *v1alpha1.IstioStatus  `json:"status,omitempty"`
+}
+
+// Http2Rpc constructs an declarative configuration of the Http2Rpc type for use with
+// apply.
+func Http2Rpc(name, namespace string) *Http2RpcApplyConfiguration {
+	b := &Http2RpcApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("Http2Rpc")
+	b.WithAPIVersion("networking.higress.io/v1")
+	return b
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithKind(value string) *Http2RpcApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithAPIVersion(value string) *Http2RpcApplyConfiguration {
+	b.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithName(value string) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithGenerateName(value string) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithNamespace(value string) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithUID(value types.UID) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithResourceVersion(value string) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithGeneration(value int64) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithCreationTimestamp(value metav1.Time) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *Http2RpcApplyConfiguration) WithLabels(entries map[string]string) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.Labels == nil && len(entries) > 0 {
+		b.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *Http2RpcApplyConfiguration) WithAnnotations(entries map[string]string) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.Annotations == nil && len(entries) > 0 {
+		b.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *Http2RpcApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.OwnerReferences = append(b.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *Http2RpcApplyConfiguration) WithFinalizers(values ...string) *Http2RpcApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.Finalizers = append(b.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *Http2RpcApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithSpec(value networkingv1.Http2Rpc) *Http2RpcApplyConfiguration {
+	b.Spec = &value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *Http2RpcApplyConfiguration) WithStatus(value v1alpha1.IstioStatus) *Http2RpcApplyConfiguration {
+	b.Status = &value
+	return b
+}

client/pkg/applyconfiguration/networking/v1/mcpbridge.go

@@ -0,0 +1,219 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package v1
+
+import (
+	networkingv1 "github.com/alibaba/higress/api/networking/v1"
+	v1 "github.com/alibaba/higress/client/pkg/applyconfiguration/meta/v1"
+	v1alpha1 "istio.io/api/meta/v1alpha1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+)
+
+// McpBridgeApplyConfiguration represents an declarative configuration of the McpBridge type for use
+// with apply.
+type McpBridgeApplyConfiguration struct {
+	v1.TypeMetaApplyConfiguration    `json:",inline"`
+	*v1.ObjectMetaApplyConfiguration `json:"metadata,omitempty"`
+	Spec                             *networkingv1.McpBridge `json:"spec,omitempty"`
+	Status                           *v1alpha1.IstioStatus   `json:"status,omitempty"`
+}
+
+// McpBridge constructs an declarative configuration of the McpBridge type for use with
+// apply.
+func McpBridge(name, namespace string) *McpBridgeApplyConfiguration {
+	b := &McpBridgeApplyConfiguration{}
+	b.WithName(name)
+	b.WithNamespace(namespace)
+	b.WithKind("McpBridge")
+	b.WithAPIVersion("networking.higress.io/v1")
+	return b
+}
+
+// WithKind sets the Kind field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Kind field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithKind(value string) *McpBridgeApplyConfiguration {
+	b.Kind = &value
+	return b
+}
+
+// WithAPIVersion sets the APIVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the APIVersion field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithAPIVersion(value string) *McpBridgeApplyConfiguration {
+	b.APIVersion = &value
+	return b
+}
+
+// WithName sets the Name field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Name field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithName(value string) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Name = &value
+	return b
+}
+
+// WithGenerateName sets the GenerateName field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the GenerateName field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithGenerateName(value string) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.GenerateName = &value
+	return b
+}
+
+// WithNamespace sets the Namespace field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Namespace field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithNamespace(value string) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Namespace = &value
+	return b
+}
+
+// WithUID sets the UID field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the UID field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithUID(value types.UID) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.UID = &value
+	return b
+}
+
+// WithResourceVersion sets the ResourceVersion field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the ResourceVersion field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithResourceVersion(value string) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.ResourceVersion = &value
+	return b
+}
+
+// WithGeneration sets the Generation field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Generation field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithGeneration(value int64) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.Generation = &value
+	return b
+}
+
+// WithCreationTimestamp sets the CreationTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the CreationTimestamp field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithCreationTimestamp(value metav1.Time) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.CreationTimestamp = &value
+	return b
+}
+
+// WithDeletionTimestamp sets the DeletionTimestamp field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionTimestamp field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithDeletionTimestamp(value metav1.Time) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.DeletionTimestamp = &value
+	return b
+}
+
+// WithDeletionGracePeriodSeconds sets the DeletionGracePeriodSeconds field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the DeletionGracePeriodSeconds field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithDeletionGracePeriodSeconds(value int64) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	b.DeletionGracePeriodSeconds = &value
+	return b
+}
+
+// WithLabels puts the entries into the Labels field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Labels field,
+// overwriting an existing map entries in Labels field with the same key.
+func (b *McpBridgeApplyConfiguration) WithLabels(entries map[string]string) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.Labels == nil && len(entries) > 0 {
+		b.Labels = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Labels[k] = v
+	}
+	return b
+}
+
+// WithAnnotations puts the entries into the Annotations field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, the entries provided by each call will be put on the Annotations field,
+// overwriting an existing map entries in Annotations field with the same key.
+func (b *McpBridgeApplyConfiguration) WithAnnotations(entries map[string]string) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	if b.Annotations == nil && len(entries) > 0 {
+		b.Annotations = make(map[string]string, len(entries))
+	}
+	for k, v := range entries {
+		b.Annotations[k] = v
+	}
+	return b
+}
+
+// WithOwnerReferences adds the given value to the OwnerReferences field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the OwnerReferences field.
+func (b *McpBridgeApplyConfiguration) WithOwnerReferences(values ...*v1.OwnerReferenceApplyConfiguration) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		if values[i] == nil {
+			panic("nil value passed to WithOwnerReferences")
+		}
+		b.OwnerReferences = append(b.OwnerReferences, *values[i])
+	}
+	return b
+}
+
+// WithFinalizers adds the given value to the Finalizers field in the declarative configuration
+// and returns the receiver, so that objects can be build by chaining "With" function invocations.
+// If called multiple times, values provided by each call will be appended to the Finalizers field.
+func (b *McpBridgeApplyConfiguration) WithFinalizers(values ...string) *McpBridgeApplyConfiguration {
+	b.ensureObjectMetaApplyConfigurationExists()
+	for i := range values {
+		b.Finalizers = append(b.Finalizers, values[i])
+	}
+	return b
+}
+
+func (b *McpBridgeApplyConfiguration) ensureObjectMetaApplyConfigurationExists() {
+	if b.ObjectMetaApplyConfiguration == nil {
+		b.ObjectMetaApplyConfiguration = &v1.ObjectMetaApplyConfiguration{}
+	}
+}
+
+// WithSpec sets the Spec field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Spec field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithSpec(value networkingv1.McpBridge) *McpBridgeApplyConfiguration {
+	b.Spec = &value
+	return b
+}
+
+// WithStatus sets the Status field in the declarative configuration to the given value
+// and returns the receiver, so that objects can be built by chaining "With" function invocations.
+// If called multiple times, the Status field is set to the value of the last call.
+func (b *McpBridgeApplyConfiguration) WithStatus(value v1alpha1.IstioStatus) *McpBridgeApplyConfiguration {
+	b.Status = &value
+	return b
+}

client/pkg/applyconfiguration/utils.go

@@ -0,0 +1,55 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by applyconfiguration-gen. DO NOT EDIT.
+
+package applyconfiguration
+
+import (
+	v1alpha1 "github.com/alibaba/higress/client/pkg/apis/extensions/v1alpha1"
+	networkingv1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
+	extensionsv1alpha1 "github.com/alibaba/higress/client/pkg/applyconfiguration/extensions/v1alpha1"
+	metav1 "github.com/alibaba/higress/client/pkg/applyconfiguration/meta/v1"
+	applyconfigurationnetworkingv1 "github.com/alibaba/higress/client/pkg/applyconfiguration/networking/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// ForKind returns an apply configuration type for the given GroupVersionKind, or nil if no
+// apply configuration type exists for the given GroupVersionKind.
+func ForKind(kind schema.GroupVersionKind) interface{} {
+	switch kind {
+	// Group=extensions.higress.io, Version=v1alpha1
+	case v1alpha1.SchemeGroupVersion.WithKind("WasmPlugin"):
+		return &extensionsv1alpha1.WasmPluginApplyConfiguration{}
+
+		// Group=meta.k8s.io, Version=v1
+	case v1.SchemeGroupVersion.WithKind("ManagedFieldsEntry"):
+		return &metav1.ManagedFieldsEntryApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("ObjectMeta"):
+		return &metav1.ObjectMetaApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("OwnerReference"):
+		return &metav1.OwnerReferenceApplyConfiguration{}
+	case v1.SchemeGroupVersion.WithKind("TypeMeta"):
+		return &metav1.TypeMetaApplyConfiguration{}
+
+		// Group=networking.higress.io, Version=v1
+	case networkingv1.SchemeGroupVersion.WithKind("Http2Rpc"):
+		return &applyconfigurationnetworkingv1.Http2RpcApplyConfiguration{}
+	case networkingv1.SchemeGroupVersion.WithKind("McpBridge"):
+		return &applyconfigurationnetworkingv1.McpBridgeApplyConfiguration{}
+
+	}
+	return nil
+}

client/pkg/clientset/versioned/clientset.gen.go

@@ -18,6 +18,7 @@ package versioned
 
 import (
 	"fmt"
+	"net/http"
 
 	extensionsv1alpha1 "github.com/alibaba/higress/client/pkg/clientset/versioned/typed/extensions/v1alpha1"
 	networkingv1 "github.com/alibaba/higress/client/pkg/clientset/versioned/typed/networking/v1"
@@ -32,8 +33,7 @@ type Interface interface {
 	NetworkingV1() networkingv1.NetworkingV1Interface
 }
 
-// Clientset contains the clients for groups. Each group has exactly one
-// version included in a Clientset.
+// Clientset contains the clients for groups.
 type Clientset struct {
 	*discovery.DiscoveryClient
 	extensionsV1alpha1 *extensionsv1alpha1.ExtensionsV1alpha1Client
@@ -61,26 +61,49 @@ func (c *Clientset) Discovery() discovery.DiscoveryInterface {
 // NewForConfig creates a new Clientset for the given config.
 // If config's RateLimiter is not set and QPS and Burst are acceptable,
 // NewForConfig will generate a rate-limiter in configShallowCopy.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*Clientset, error) {
 	configShallowCopy := *c
+
+	if configShallowCopy.UserAgent == "" {
+		configShallowCopy.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	// share the transport between all clients
+	httpClient, err := rest.HTTPClientFor(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewForConfigAndClient(&configShallowCopy, httpClient)
+}
+
+// NewForConfigAndClient creates a new Clientset for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfigAndClient will generate a rate-limiter in configShallowCopy.
+func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset, error) {
+	configShallowCopy := *c
 	if configShallowCopy.RateLimiter == nil && configShallowCopy.QPS > 0 {
 		if configShallowCopy.Burst <= 0 {
 			return nil, fmt.Errorf("burst is required to be greater than 0 when RateLimiter is not set and QPS is set to greater than 0")
 		}
 		configShallowCopy.RateLimiter = flowcontrol.NewTokenBucketRateLimiter(configShallowCopy.QPS, configShallowCopy.Burst)
 	}
+
 	var cs Clientset
 	var err error
-	cs.extensionsV1alpha1, err = extensionsv1alpha1.NewForConfig(&configShallowCopy)
+	cs.extensionsV1alpha1, err = extensionsv1alpha1.NewForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
 	}
-	cs.networkingV1, err = networkingv1.NewForConfig(&configShallowCopy)
+	cs.networkingV1, err = networkingv1.NewForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
 	}
 
-	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfig(&configShallowCopy)
+	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfigAndClient(&configShallowCopy, httpClient)
 	if err != nil {
 		return nil, err
 	}
@@ -90,12 +113,11 @@ func NewForConfig(c *rest.Config) (*Clientset, error) {
 // NewForConfigOrDie creates a new Clientset for the given config and
 // panics if there is an error in the config.
 func NewForConfigOrDie(c *rest.Config) *Clientset {
-	var cs Clientset
-	cs.extensionsV1alpha1 = extensionsv1alpha1.NewForConfigOrDie(c)
-	cs.networkingV1 = networkingv1.NewForConfigOrDie(c)
-
-	cs.DiscoveryClient = discovery.NewDiscoveryClientForConfigOrDie(c)
-	return &cs
+	cs, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return cs
 }
 
 // New creates a new Clientset for the given RESTClient.

client/pkg/clientset/versioned/fake/clientset_generated.gen.go

@@ -74,7 +74,10 @@ func (c *Clientset) Tracker() testing.ObjectTracker {
 	return c.tracker
 }
 
-var _ clientset.Interface = &Clientset{}
+var (
+	_ clientset.Interface = &Clientset{}
+	_ testing.FakeClient  = &Clientset{}
+)
 
 // ExtensionsV1alpha1 retrieves the ExtensionsV1alpha1Client
 func (c *Clientset) ExtensionsV1alpha1() extensionsv1alpha1.ExtensionsV1alpha1Interface {

client/pkg/clientset/versioned/fake/register.gen.go

@@ -28,7 +28,7 @@ import (
 
 var scheme = runtime.NewScheme()
 var codecs = serializer.NewCodecFactory(scheme)
-var parameterCodec = runtime.NewParameterCodec(scheme)
+
 var localSchemeBuilder = runtime.SchemeBuilder{
 	extensionsv1alpha1.AddToScheme,
 	networkingv1.AddToScheme,
@@ -37,14 +37,14 @@ var localSchemeBuilder = runtime.SchemeBuilder{
 // AddToScheme adds all types of this clientset into the given scheme. This allows composition
 // of clientsets, like in:
 //
-//   import (
-//     "k8s.io/client-go/kubernetes"
-//     clientsetscheme "k8s.io/client-go/kubernetes/scheme"
-//     aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
-//   )
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
 //
-//   kclientset, _ := kubernetes.NewForConfig(c)
-//   _ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
 //
 // After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
 // correctly.

client/pkg/clientset/versioned/scheme/register.gen.go

@@ -37,14 +37,14 @@ var localSchemeBuilder = runtime.SchemeBuilder{
 // AddToScheme adds all types of this clientset into the given scheme. This allows composition
 // of clientsets, like in:
 //
-//   import (
-//     "k8s.io/client-go/kubernetes"
-//     clientsetscheme "k8s.io/client-go/kubernetes/scheme"
-//     aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
-//   )
+//	import (
+//	  "k8s.io/client-go/kubernetes"
+//	  clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//	  aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//	)
 //
-//   kclientset, _ := kubernetes.NewForConfig(c)
-//   _ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//	kclientset, _ := kubernetes.NewForConfig(c)
+//	_ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
 //
 // After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
 // correctly.

client/pkg/clientset/versioned/typed/extensions/v1alpha1/extensions_client.gen.go

@@ -17,6 +17,8 @@
 package v1alpha1
 
 import (
+	"net/http"
+
 	v1alpha1 "github.com/alibaba/higress/client/pkg/apis/extensions/v1alpha1"
 	"github.com/alibaba/higress/client/pkg/clientset/versioned/scheme"
 	rest "k8s.io/client-go/rest"
@@ -37,12 +39,28 @@ func (c *ExtensionsV1alpha1Client) WasmPlugins(namespace string) WasmPluginInter
 }
 
 // NewForConfig creates a new ExtensionsV1alpha1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*ExtensionsV1alpha1Client, error) {
 	config := *c
 	if err := setConfigDefaults(&config); err != nil {
 		return nil, err
 	}
-	client, err := rest.RESTClientFor(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new ExtensionsV1alpha1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*ExtensionsV1alpha1Client, error) {
+	config := *c
+	if err := setConfigDefaults(&config); err != nil {
+		return nil, err
+	}
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
 	if err != nil {
 		return nil, err
 	}

client/pkg/clientset/versioned/typed/extensions/v1alpha1/fake/fake_wasmplugin.gen.go

@@ -18,11 +18,13 @@ package fake
 
 import (
 	"context"
+	json "encoding/json"
+	"fmt"
 
 	v1alpha1 "github.com/alibaba/higress/client/pkg/apis/extensions/v1alpha1"
+	extensionsv1alpha1 "github.com/alibaba/higress/client/pkg/applyconfiguration/extensions/v1alpha1"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	labels "k8s.io/apimachinery/pkg/labels"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
@@ -34,9 +36,9 @@ type FakeWasmPlugins struct {
 	ns   string
 }
 
-var wasmpluginsResource = schema.GroupVersionResource{Group: "extensions.higress.io", Version: "v1alpha1", Resource: "wasmplugins"}
+var wasmpluginsResource = v1alpha1.SchemeGroupVersion.WithResource("wasmplugins")
 
-var wasmpluginsKind = schema.GroupVersionKind{Group: "extensions.higress.io", Version: "v1alpha1", Kind: "WasmPlugin"}
+var wasmpluginsKind = v1alpha1.SchemeGroupVersion.WithKind("WasmPlugin")
 
 // Get takes name of the wasmPlugin, and returns the corresponding wasmPlugin object, and an error if there is any.
 func (c *FakeWasmPlugins) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha1.WasmPlugin, err error) {
@@ -115,7 +117,7 @@ func (c *FakeWasmPlugins) UpdateStatus(ctx context.Context, wasmPlugin *v1alpha1
 // Delete takes name of the wasmPlugin and deletes it. Returns an error if one occurs.
 func (c *FakeWasmPlugins) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
 	_, err := c.Fake.
-		Invokes(testing.NewDeleteAction(wasmpluginsResource, c.ns, name), &v1alpha1.WasmPlugin{})
+		Invokes(testing.NewDeleteActionWithOptions(wasmpluginsResource, c.ns, name, opts), &v1alpha1.WasmPlugin{})
 
 	return err
 }
@@ -138,3 +140,48 @@ func (c *FakeWasmPlugins) Patch(ctx context.Context, name string, pt types.Patch
 	}
 	return obj.(*v1alpha1.WasmPlugin), err
 }
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied wasmPlugin.
+func (c *FakeWasmPlugins) Apply(ctx context.Context, wasmPlugin *extensionsv1alpha1.WasmPluginApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.WasmPlugin, err error) {
+	if wasmPlugin == nil {
+		return nil, fmt.Errorf("wasmPlugin provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(wasmPlugin)
+	if err != nil {
+		return nil, err
+	}
+	name := wasmPlugin.Name
+	if name == nil {
+		return nil, fmt.Errorf("wasmPlugin.Name must be provided to Apply")
+	}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(wasmpluginsResource, c.ns, *name, types.ApplyPatchType, data), &v1alpha1.WasmPlugin{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.WasmPlugin), err
+}
+
+// ApplyStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+func (c *FakeWasmPlugins) ApplyStatus(ctx context.Context, wasmPlugin *extensionsv1alpha1.WasmPluginApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.WasmPlugin, err error) {
+	if wasmPlugin == nil {
+		return nil, fmt.Errorf("wasmPlugin provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(wasmPlugin)
+	if err != nil {
+		return nil, err
+	}
+	name := wasmPlugin.Name
+	if name == nil {
+		return nil, fmt.Errorf("wasmPlugin.Name must be provided to Apply")
+	}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(wasmpluginsResource, c.ns, *name, types.ApplyPatchType, data, "status"), &v1alpha1.WasmPlugin{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha1.WasmPlugin), err
+}

client/pkg/clientset/versioned/typed/extensions/v1alpha1/wasmplugin.gen.go

@@ -18,9 +18,12 @@ package v1alpha1
 
 import (
 	"context"
+	json "encoding/json"
+	"fmt"
 	"time"
 
 	v1alpha1 "github.com/alibaba/higress/client/pkg/apis/extensions/v1alpha1"
+	extensionsv1alpha1 "github.com/alibaba/higress/client/pkg/applyconfiguration/extensions/v1alpha1"
 	scheme "github.com/alibaba/higress/client/pkg/clientset/versioned/scheme"
 	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
@@ -45,6 +48,8 @@ type WasmPluginInterface interface {
 	List(ctx context.Context, opts v1.ListOptions) (*v1alpha1.WasmPluginList, error)
 	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
 	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha1.WasmPlugin, err error)
+	Apply(ctx context.Context, wasmPlugin *extensionsv1alpha1.WasmPluginApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.WasmPlugin, err error)
+	ApplyStatus(ctx context.Context, wasmPlugin *extensionsv1alpha1.WasmPluginApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.WasmPlugin, err error)
 	WasmPluginExpansion
 }
 
@@ -191,3 +196,59 @@ func (c *wasmPlugins) Patch(ctx context.Context, name string, pt types.PatchType
 		Into(result)
 	return
 }
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied wasmPlugin.
+func (c *wasmPlugins) Apply(ctx context.Context, wasmPlugin *extensionsv1alpha1.WasmPluginApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.WasmPlugin, err error) {
+	if wasmPlugin == nil {
+		return nil, fmt.Errorf("wasmPlugin provided to Apply must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	data, err := json.Marshal(wasmPlugin)
+	if err != nil {
+		return nil, err
+	}
+	name := wasmPlugin.Name
+	if name == nil {
+		return nil, fmt.Errorf("wasmPlugin.Name must be provided to Apply")
+	}
+	result = &v1alpha1.WasmPlugin{}
+	err = c.client.Patch(types.ApplyPatchType).
+		Namespace(c.ns).
+		Resource("wasmplugins").
+		Name(*name).
+		VersionedParams(&patchOpts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// ApplyStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+func (c *wasmPlugins) ApplyStatus(ctx context.Context, wasmPlugin *extensionsv1alpha1.WasmPluginApplyConfiguration, opts v1.ApplyOptions) (result *v1alpha1.WasmPlugin, err error) {
+	if wasmPlugin == nil {
+		return nil, fmt.Errorf("wasmPlugin provided to Apply must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	data, err := json.Marshal(wasmPlugin)
+	if err != nil {
+		return nil, err
+	}
+
+	name := wasmPlugin.Name
+	if name == nil {
+		return nil, fmt.Errorf("wasmPlugin.Name must be provided to Apply")
+	}
+
+	result = &v1alpha1.WasmPlugin{}
+	err = c.client.Patch(types.ApplyPatchType).
+		Namespace(c.ns).
+		Resource("wasmplugins").
+		Name(*name).
+		SubResource("status").
+		VersionedParams(&patchOpts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}

client/pkg/clientset/versioned/typed/networking/v1/fake/fake_http2rpc.gen.go

@@ -18,11 +18,13 @@ package fake
 
 import (
 	"context"
+	json "encoding/json"
+	"fmt"
 
-	networkingv1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	v1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
+	networkingv1 "github.com/alibaba/higress/client/pkg/applyconfiguration/networking/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	labels "k8s.io/apimachinery/pkg/labels"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
@@ -34,25 +36,25 @@ type FakeHttp2Rpcs struct {
 	ns   string
 }
 
-var http2rpcsResource = schema.GroupVersionResource{Group: "networking.higress.io", Version: "v1", Resource: "http2rpcs"}
+var http2rpcsResource = v1.SchemeGroupVersion.WithResource("http2rpcs")
 
-var http2rpcsKind = schema.GroupVersionKind{Group: "networking.higress.io", Version: "v1", Kind: "Http2Rpc"}
+var http2rpcsKind = v1.SchemeGroupVersion.WithKind("Http2Rpc")
 
 // Get takes name of the http2Rpc, and returns the corresponding http2Rpc object, and an error if there is any.
-func (c *FakeHttp2Rpcs) Get(ctx context.Context, name string, options v1.GetOptions) (result *networkingv1.Http2Rpc, err error) {
+func (c *FakeHttp2Rpcs) Get(ctx context.Context, name string, options metav1.GetOptions) (result *v1.Http2Rpc, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(http2rpcsResource, c.ns, name), &networkingv1.Http2Rpc{})
+		Invokes(testing.NewGetAction(http2rpcsResource, c.ns, name), &v1.Http2Rpc{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.Http2Rpc), err
+	return obj.(*v1.Http2Rpc), err
 }
 
 // List takes label and field selectors, and returns the list of Http2Rpcs that match those selectors.
-func (c *FakeHttp2Rpcs) List(ctx context.Context, opts v1.ListOptions) (result *networkingv1.Http2RpcList, err error) {
+func (c *FakeHttp2Rpcs) List(ctx context.Context, opts metav1.ListOptions) (result *v1.Http2RpcList, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewListAction(http2rpcsResource, http2rpcsKind, c.ns, opts), &networkingv1.Http2RpcList{})
+		Invokes(testing.NewListAction(http2rpcsResource, http2rpcsKind, c.ns, opts), &v1.Http2RpcList{})
 
 	if obj == nil {
 		return nil, err
@@ -62,8 +64,8 @@ func (c *FakeHttp2Rpcs) List(ctx context.Context, opts v1.ListOptions) (result *
 	if label == nil {
 		label = labels.Everything()
 	}
-	list := &networkingv1.Http2RpcList{ListMeta: obj.(*networkingv1.Http2RpcList).ListMeta}
-	for _, item := range obj.(*networkingv1.Http2RpcList).Items {
+	list := &v1.Http2RpcList{ListMeta: obj.(*v1.Http2RpcList).ListMeta}
+	for _, item := range obj.(*v1.Http2RpcList).Items {
 		if label.Matches(labels.Set(item.Labels)) {
 			list.Items = append(list.Items, item)
 		}
@@ -72,69 +74,114 @@ func (c *FakeHttp2Rpcs) List(ctx context.Context, opts v1.ListOptions) (result *
 }
 
 // Watch returns a watch.Interface that watches the requested http2Rpcs.
-func (c *FakeHttp2Rpcs) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+func (c *FakeHttp2Rpcs) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
 	return c.Fake.
 		InvokesWatch(testing.NewWatchAction(http2rpcsResource, c.ns, opts))
 
 }
 
 // Create takes the representation of a http2Rpc and creates it.  Returns the server's representation of the http2Rpc, and an error, if there is any.
-func (c *FakeHttp2Rpcs) Create(ctx context.Context, http2Rpc *networkingv1.Http2Rpc, opts v1.CreateOptions) (result *networkingv1.Http2Rpc, err error) {
+func (c *FakeHttp2Rpcs) Create(ctx context.Context, http2Rpc *v1.Http2Rpc, opts metav1.CreateOptions) (result *v1.Http2Rpc, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(http2rpcsResource, c.ns, http2Rpc), &networkingv1.Http2Rpc{})
+		Invokes(testing.NewCreateAction(http2rpcsResource, c.ns, http2Rpc), &v1.Http2Rpc{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.Http2Rpc), err
+	return obj.(*v1.Http2Rpc), err
 }
 
 // Update takes the representation of a http2Rpc and updates it. Returns the server's representation of the http2Rpc, and an error, if there is any.
-func (c *FakeHttp2Rpcs) Update(ctx context.Context, http2Rpc *networkingv1.Http2Rpc, opts v1.UpdateOptions) (result *networkingv1.Http2Rpc, err error) {
+func (c *FakeHttp2Rpcs) Update(ctx context.Context, http2Rpc *v1.Http2Rpc, opts metav1.UpdateOptions) (result *v1.Http2Rpc, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(http2rpcsResource, c.ns, http2Rpc), &networkingv1.Http2Rpc{})
+		Invokes(testing.NewUpdateAction(http2rpcsResource, c.ns, http2Rpc), &v1.Http2Rpc{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.Http2Rpc), err
+	return obj.(*v1.Http2Rpc), err
 }
 
 // UpdateStatus was generated because the type contains a Status member.
 // Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *FakeHttp2Rpcs) UpdateStatus(ctx context.Context, http2Rpc *networkingv1.Http2Rpc, opts v1.UpdateOptions) (*networkingv1.Http2Rpc, error) {
+func (c *FakeHttp2Rpcs) UpdateStatus(ctx context.Context, http2Rpc *v1.Http2Rpc, opts metav1.UpdateOptions) (*v1.Http2Rpc, error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewUpdateSubresourceAction(http2rpcsResource, "status", c.ns, http2Rpc), &networkingv1.Http2Rpc{})
+		Invokes(testing.NewUpdateSubresourceAction(http2rpcsResource, "status", c.ns, http2Rpc), &v1.Http2Rpc{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.Http2Rpc), err
+	return obj.(*v1.Http2Rpc), err
 }
 
 // Delete takes name of the http2Rpc and deletes it. Returns an error if one occurs.
-func (c *FakeHttp2Rpcs) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+func (c *FakeHttp2Rpcs) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
 	_, err := c.Fake.
-		Invokes(testing.NewDeleteAction(http2rpcsResource, c.ns, name), &networkingv1.Http2Rpc{})
+		Invokes(testing.NewDeleteActionWithOptions(http2rpcsResource, c.ns, name, opts), &v1.Http2Rpc{})
 
 	return err
 }
 
 // DeleteCollection deletes a collection of objects.
-func (c *FakeHttp2Rpcs) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+func (c *FakeHttp2Rpcs) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
 	action := testing.NewDeleteCollectionAction(http2rpcsResource, c.ns, listOpts)
 
-	_, err := c.Fake.Invokes(action, &networkingv1.Http2RpcList{})
+	_, err := c.Fake.Invokes(action, &v1.Http2RpcList{})
 	return err
 }
 
 // Patch applies the patch and returns the patched http2Rpc.
-func (c *FakeHttp2Rpcs) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *networkingv1.Http2Rpc, err error) {
+func (c *FakeHttp2Rpcs) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *v1.Http2Rpc, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(http2rpcsResource, c.ns, name, pt, data, subresources...), &networkingv1.Http2Rpc{})
+		Invokes(testing.NewPatchSubresourceAction(http2rpcsResource, c.ns, name, pt, data, subresources...), &v1.Http2Rpc{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.Http2Rpc), err
+	return obj.(*v1.Http2Rpc), err
+}
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied http2Rpc.
+func (c *FakeHttp2Rpcs) Apply(ctx context.Context, http2Rpc *networkingv1.Http2RpcApplyConfiguration, opts metav1.ApplyOptions) (result *v1.Http2Rpc, err error) {
+	if http2Rpc == nil {
+		return nil, fmt.Errorf("http2Rpc provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(http2Rpc)
+	if err != nil {
+		return nil, err
+	}
+	name := http2Rpc.Name
+	if name == nil {
+		return nil, fmt.Errorf("http2Rpc.Name must be provided to Apply")
+	}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(http2rpcsResource, c.ns, *name, types.ApplyPatchType, data), &v1.Http2Rpc{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1.Http2Rpc), err
+}
+
+// ApplyStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+func (c *FakeHttp2Rpcs) ApplyStatus(ctx context.Context, http2Rpc *networkingv1.Http2RpcApplyConfiguration, opts metav1.ApplyOptions) (result *v1.Http2Rpc, err error) {
+	if http2Rpc == nil {
+		return nil, fmt.Errorf("http2Rpc provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(http2Rpc)
+	if err != nil {
+		return nil, err
+	}
+	name := http2Rpc.Name
+	if name == nil {
+		return nil, fmt.Errorf("http2Rpc.Name must be provided to Apply")
+	}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(http2rpcsResource, c.ns, *name, types.ApplyPatchType, data, "status"), &v1.Http2Rpc{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1.Http2Rpc), err
 }

client/pkg/clientset/versioned/typed/networking/v1/fake/fake_mcpbridge.gen.go

@@ -18,11 +18,13 @@ package fake
 
 import (
 	"context"
+	json "encoding/json"
+	"fmt"
 
-	networkingv1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
-	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	v1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
+	networkingv1 "github.com/alibaba/higress/client/pkg/applyconfiguration/networking/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	labels "k8s.io/apimachinery/pkg/labels"
-	schema "k8s.io/apimachinery/pkg/runtime/schema"
 	types "k8s.io/apimachinery/pkg/types"
 	watch "k8s.io/apimachinery/pkg/watch"
 	testing "k8s.io/client-go/testing"
@@ -34,25 +36,25 @@ type FakeMcpBridges struct {
 	ns   string
 }
 
-var mcpbridgesResource = schema.GroupVersionResource{Group: "networking.higress.io", Version: "v1", Resource: "mcpbridges"}
+var mcpbridgesResource = v1.SchemeGroupVersion.WithResource("mcpbridges")
 
-var mcpbridgesKind = schema.GroupVersionKind{Group: "networking.higress.io", Version: "v1", Kind: "McpBridge"}
+var mcpbridgesKind = v1.SchemeGroupVersion.WithKind("McpBridge")
 
 // Get takes name of the mcpBridge, and returns the corresponding mcpBridge object, and an error if there is any.
-func (c *FakeMcpBridges) Get(ctx context.Context, name string, options v1.GetOptions) (result *networkingv1.McpBridge, err error) {
+func (c *FakeMcpBridges) Get(ctx context.Context, name string, options metav1.GetOptions) (result *v1.McpBridge, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewGetAction(mcpbridgesResource, c.ns, name), &networkingv1.McpBridge{})
+		Invokes(testing.NewGetAction(mcpbridgesResource, c.ns, name), &v1.McpBridge{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.McpBridge), err
+	return obj.(*v1.McpBridge), err
 }
 
 // List takes label and field selectors, and returns the list of McpBridges that match those selectors.
-func (c *FakeMcpBridges) List(ctx context.Context, opts v1.ListOptions) (result *networkingv1.McpBridgeList, err error) {
+func (c *FakeMcpBridges) List(ctx context.Context, opts metav1.ListOptions) (result *v1.McpBridgeList, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewListAction(mcpbridgesResource, mcpbridgesKind, c.ns, opts), &networkingv1.McpBridgeList{})
+		Invokes(testing.NewListAction(mcpbridgesResource, mcpbridgesKind, c.ns, opts), &v1.McpBridgeList{})
 
 	if obj == nil {
 		return nil, err
@@ -62,8 +64,8 @@ func (c *FakeMcpBridges) List(ctx context.Context, opts v1.ListOptions) (result
 	if label == nil {
 		label = labels.Everything()
 	}
-	list := &networkingv1.McpBridgeList{ListMeta: obj.(*networkingv1.McpBridgeList).ListMeta}
-	for _, item := range obj.(*networkingv1.McpBridgeList).Items {
+	list := &v1.McpBridgeList{ListMeta: obj.(*v1.McpBridgeList).ListMeta}
+	for _, item := range obj.(*v1.McpBridgeList).Items {
 		if label.Matches(labels.Set(item.Labels)) {
 			list.Items = append(list.Items, item)
 		}
@@ -72,69 +74,114 @@ func (c *FakeMcpBridges) List(ctx context.Context, opts v1.ListOptions) (result
 }
 
 // Watch returns a watch.Interface that watches the requested mcpBridges.
-func (c *FakeMcpBridges) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+func (c *FakeMcpBridges) Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error) {
 	return c.Fake.
 		InvokesWatch(testing.NewWatchAction(mcpbridgesResource, c.ns, opts))
 
 }
 
 // Create takes the representation of a mcpBridge and creates it.  Returns the server's representation of the mcpBridge, and an error, if there is any.
-func (c *FakeMcpBridges) Create(ctx context.Context, mcpBridge *networkingv1.McpBridge, opts v1.CreateOptions) (result *networkingv1.McpBridge, err error) {
+func (c *FakeMcpBridges) Create(ctx context.Context, mcpBridge *v1.McpBridge, opts metav1.CreateOptions) (result *v1.McpBridge, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewCreateAction(mcpbridgesResource, c.ns, mcpBridge), &networkingv1.McpBridge{})
+		Invokes(testing.NewCreateAction(mcpbridgesResource, c.ns, mcpBridge), &v1.McpBridge{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.McpBridge), err
+	return obj.(*v1.McpBridge), err
 }
 
 // Update takes the representation of a mcpBridge and updates it. Returns the server's representation of the mcpBridge, and an error, if there is any.
-func (c *FakeMcpBridges) Update(ctx context.Context, mcpBridge *networkingv1.McpBridge, opts v1.UpdateOptions) (result *networkingv1.McpBridge, err error) {
+func (c *FakeMcpBridges) Update(ctx context.Context, mcpBridge *v1.McpBridge, opts metav1.UpdateOptions) (result *v1.McpBridge, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewUpdateAction(mcpbridgesResource, c.ns, mcpBridge), &networkingv1.McpBridge{})
+		Invokes(testing.NewUpdateAction(mcpbridgesResource, c.ns, mcpBridge), &v1.McpBridge{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.McpBridge), err
+	return obj.(*v1.McpBridge), err
 }
 
 // UpdateStatus was generated because the type contains a Status member.
 // Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
-func (c *FakeMcpBridges) UpdateStatus(ctx context.Context, mcpBridge *networkingv1.McpBridge, opts v1.UpdateOptions) (*networkingv1.McpBridge, error) {
+func (c *FakeMcpBridges) UpdateStatus(ctx context.Context, mcpBridge *v1.McpBridge, opts metav1.UpdateOptions) (*v1.McpBridge, error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewUpdateSubresourceAction(mcpbridgesResource, "status", c.ns, mcpBridge), &networkingv1.McpBridge{})
+		Invokes(testing.NewUpdateSubresourceAction(mcpbridgesResource, "status", c.ns, mcpBridge), &v1.McpBridge{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.McpBridge), err
+	return obj.(*v1.McpBridge), err
 }
 
 // Delete takes name of the mcpBridge and deletes it. Returns an error if one occurs.
-func (c *FakeMcpBridges) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+func (c *FakeMcpBridges) Delete(ctx context.Context, name string, opts metav1.DeleteOptions) error {
 	_, err := c.Fake.
-		Invokes(testing.NewDeleteAction(mcpbridgesResource, c.ns, name), &networkingv1.McpBridge{})
+		Invokes(testing.NewDeleteActionWithOptions(mcpbridgesResource, c.ns, name, opts), &v1.McpBridge{})
 
 	return err
 }
 
 // DeleteCollection deletes a collection of objects.
-func (c *FakeMcpBridges) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+func (c *FakeMcpBridges) DeleteCollection(ctx context.Context, opts metav1.DeleteOptions, listOpts metav1.ListOptions) error {
 	action := testing.NewDeleteCollectionAction(mcpbridgesResource, c.ns, listOpts)
 
-	_, err := c.Fake.Invokes(action, &networkingv1.McpBridgeList{})
+	_, err := c.Fake.Invokes(action, &v1.McpBridgeList{})
 	return err
 }
 
 // Patch applies the patch and returns the patched mcpBridge.
-func (c *FakeMcpBridges) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *networkingv1.McpBridge, err error) {
+func (c *FakeMcpBridges) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *v1.McpBridge, err error) {
 	obj, err := c.Fake.
-		Invokes(testing.NewPatchSubresourceAction(mcpbridgesResource, c.ns, name, pt, data, subresources...), &networkingv1.McpBridge{})
+		Invokes(testing.NewPatchSubresourceAction(mcpbridgesResource, c.ns, name, pt, data, subresources...), &v1.McpBridge{})
 
 	if obj == nil {
 		return nil, err
 	}
-	return obj.(*networkingv1.McpBridge), err
+	return obj.(*v1.McpBridge), err
+}
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied mcpBridge.
+func (c *FakeMcpBridges) Apply(ctx context.Context, mcpBridge *networkingv1.McpBridgeApplyConfiguration, opts metav1.ApplyOptions) (result *v1.McpBridge, err error) {
+	if mcpBridge == nil {
+		return nil, fmt.Errorf("mcpBridge provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(mcpBridge)
+	if err != nil {
+		return nil, err
+	}
+	name := mcpBridge.Name
+	if name == nil {
+		return nil, fmt.Errorf("mcpBridge.Name must be provided to Apply")
+	}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(mcpbridgesResource, c.ns, *name, types.ApplyPatchType, data), &v1.McpBridge{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1.McpBridge), err
+}
+
+// ApplyStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+func (c *FakeMcpBridges) ApplyStatus(ctx context.Context, mcpBridge *networkingv1.McpBridgeApplyConfiguration, opts metav1.ApplyOptions) (result *v1.McpBridge, err error) {
+	if mcpBridge == nil {
+		return nil, fmt.Errorf("mcpBridge provided to Apply must not be nil")
+	}
+	data, err := json.Marshal(mcpBridge)
+	if err != nil {
+		return nil, err
+	}
+	name := mcpBridge.Name
+	if name == nil {
+		return nil, fmt.Errorf("mcpBridge.Name must be provided to Apply")
+	}
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(mcpbridgesResource, c.ns, *name, types.ApplyPatchType, data, "status"), &v1.McpBridge{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1.McpBridge), err
 }

client/pkg/clientset/versioned/typed/networking/v1/http2rpc.gen.go

@@ -18,9 +18,12 @@ package v1
 
 import (
 	"context"
+	json "encoding/json"
+	"fmt"
 	"time"
 
 	v1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
+	networkingv1 "github.com/alibaba/higress/client/pkg/applyconfiguration/networking/v1"
 	scheme "github.com/alibaba/higress/client/pkg/clientset/versioned/scheme"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
@@ -45,6 +48,8 @@ type Http2RpcInterface interface {
 	List(ctx context.Context, opts metav1.ListOptions) (*v1.Http2RpcList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
 	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *v1.Http2Rpc, err error)
+	Apply(ctx context.Context, http2Rpc *networkingv1.Http2RpcApplyConfiguration, opts metav1.ApplyOptions) (result *v1.Http2Rpc, err error)
+	ApplyStatus(ctx context.Context, http2Rpc *networkingv1.Http2RpcApplyConfiguration, opts metav1.ApplyOptions) (result *v1.Http2Rpc, err error)
 	Http2RpcExpansion
 }
 
@@ -191,3 +196,59 @@ func (c *http2Rpcs) Patch(ctx context.Context, name string, pt types.PatchType,
 		Into(result)
 	return
 }
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied http2Rpc.
+func (c *http2Rpcs) Apply(ctx context.Context, http2Rpc *networkingv1.Http2RpcApplyConfiguration, opts metav1.ApplyOptions) (result *v1.Http2Rpc, err error) {
+	if http2Rpc == nil {
+		return nil, fmt.Errorf("http2Rpc provided to Apply must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	data, err := json.Marshal(http2Rpc)
+	if err != nil {
+		return nil, err
+	}
+	name := http2Rpc.Name
+	if name == nil {
+		return nil, fmt.Errorf("http2Rpc.Name must be provided to Apply")
+	}
+	result = &v1.Http2Rpc{}
+	err = c.client.Patch(types.ApplyPatchType).
+		Namespace(c.ns).
+		Resource("http2rpcs").
+		Name(*name).
+		VersionedParams(&patchOpts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// ApplyStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+func (c *http2Rpcs) ApplyStatus(ctx context.Context, http2Rpc *networkingv1.Http2RpcApplyConfiguration, opts metav1.ApplyOptions) (result *v1.Http2Rpc, err error) {
+	if http2Rpc == nil {
+		return nil, fmt.Errorf("http2Rpc provided to Apply must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	data, err := json.Marshal(http2Rpc)
+	if err != nil {
+		return nil, err
+	}
+
+	name := http2Rpc.Name
+	if name == nil {
+		return nil, fmt.Errorf("http2Rpc.Name must be provided to Apply")
+	}
+
+	result = &v1.Http2Rpc{}
+	err = c.client.Patch(types.ApplyPatchType).
+		Namespace(c.ns).
+		Resource("http2rpcs").
+		Name(*name).
+		SubResource("status").
+		VersionedParams(&patchOpts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}

client/pkg/clientset/versioned/typed/networking/v1/mcpbridge.gen.go

@@ -18,9 +18,12 @@ package v1
 
 import (
 	"context"
+	json "encoding/json"
+	"fmt"
 	"time"
 
 	v1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
+	networkingv1 "github.com/alibaba/higress/client/pkg/applyconfiguration/networking/v1"
 	scheme "github.com/alibaba/higress/client/pkg/clientset/versioned/scheme"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
@@ -45,6 +48,8 @@ type McpBridgeInterface interface {
 	List(ctx context.Context, opts metav1.ListOptions) (*v1.McpBridgeList, error)
 	Watch(ctx context.Context, opts metav1.ListOptions) (watch.Interface, error)
 	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts metav1.PatchOptions, subresources ...string) (result *v1.McpBridge, err error)
+	Apply(ctx context.Context, mcpBridge *networkingv1.McpBridgeApplyConfiguration, opts metav1.ApplyOptions) (result *v1.McpBridge, err error)
+	ApplyStatus(ctx context.Context, mcpBridge *networkingv1.McpBridgeApplyConfiguration, opts metav1.ApplyOptions) (result *v1.McpBridge, err error)
 	McpBridgeExpansion
 }
 
@@ -191,3 +196,59 @@ func (c *mcpBridges) Patch(ctx context.Context, name string, pt types.PatchType,
 		Into(result)
 	return
 }
+
+// Apply takes the given apply declarative configuration, applies it and returns the applied mcpBridge.
+func (c *mcpBridges) Apply(ctx context.Context, mcpBridge *networkingv1.McpBridgeApplyConfiguration, opts metav1.ApplyOptions) (result *v1.McpBridge, err error) {
+	if mcpBridge == nil {
+		return nil, fmt.Errorf("mcpBridge provided to Apply must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	data, err := json.Marshal(mcpBridge)
+	if err != nil {
+		return nil, err
+	}
+	name := mcpBridge.Name
+	if name == nil {
+		return nil, fmt.Errorf("mcpBridge.Name must be provided to Apply")
+	}
+	result = &v1.McpBridge{}
+	err = c.client.Patch(types.ApplyPatchType).
+		Namespace(c.ns).
+		Resource("mcpbridges").
+		Name(*name).
+		VersionedParams(&patchOpts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// ApplyStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating ApplyStatus().
+func (c *mcpBridges) ApplyStatus(ctx context.Context, mcpBridge *networkingv1.McpBridgeApplyConfiguration, opts metav1.ApplyOptions) (result *v1.McpBridge, err error) {
+	if mcpBridge == nil {
+		return nil, fmt.Errorf("mcpBridge provided to Apply must not be nil")
+	}
+	patchOpts := opts.ToPatchOptions()
+	data, err := json.Marshal(mcpBridge)
+	if err != nil {
+		return nil, err
+	}
+
+	name := mcpBridge.Name
+	if name == nil {
+		return nil, fmt.Errorf("mcpBridge.Name must be provided to Apply")
+	}
+
+	result = &v1.McpBridge{}
+	err = c.client.Patch(types.ApplyPatchType).
+		Namespace(c.ns).
+		Resource("mcpbridges").
+		Name(*name).
+		SubResource("status").
+		VersionedParams(&patchOpts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}

client/pkg/clientset/versioned/typed/networking/v1/networking_client.gen.go

@@ -17,6 +17,8 @@
 package v1
 
 import (
+	"net/http"
+
 	v1 "github.com/alibaba/higress/client/pkg/apis/networking/v1"
 	"github.com/alibaba/higress/client/pkg/clientset/versioned/scheme"
 	rest "k8s.io/client-go/rest"
@@ -42,12 +44,28 @@ func (c *NetworkingV1Client) McpBridges(namespace string) McpBridgeInterface {
 }
 
 // NewForConfig creates a new NetworkingV1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
 func NewForConfig(c *rest.Config) (*NetworkingV1Client, error) {
 	config := *c
 	if err := setConfigDefaults(&config); err != nil {
 		return nil, err
 	}
-	client, err := rest.RESTClientFor(&config)
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new NetworkingV1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*NetworkingV1Client, error) {
+	config := *c
+	if err := setConfigDefaults(&config); err != nil {
+		return nil, err
+	}
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
 	if err != nil {
 		return nil, err
 	}

client/pkg/informers/externalversions/factory.gen.go

@@ -46,6 +46,11 @@ type sharedInformerFactory struct {
 	// startedInformers is used for tracking which informers have been started.
 	// This allows Start() to be called multiple times safely.
 	startedInformers map[reflect.Type]bool
+	// wg tracks how many goroutines were started.
+	wg sync.WaitGroup
+	// shuttingDown is true when Shutdown has been called. It may still be running
+	// because it needs to wait for goroutines.
+	shuttingDown bool
 }
 
 // WithCustomResyncConfig sets a custom resync period for the specified informer types.
@@ -106,20 +111,39 @@ func NewSharedInformerFactoryWithOptions(client versioned.Interface, defaultResy
 	return factory
 }
 
-// Start initializes all requested informers.
 func (f *sharedInformerFactory) Start(stopCh <-chan struct{}) {
 	f.lock.Lock()
 	defer f.lock.Unlock()
 
+	if f.shuttingDown {
+		return
+	}
+
 	for informerType, informer := range f.informers {
 		if !f.startedInformers[informerType] {
-			go informer.Run(stopCh)
+			f.wg.Add(1)
+			// We need a new variable in each loop iteration,
+			// otherwise the goroutine would use the loop variable
+			// and that keeps changing.
+			informer := informer
+			go func() {
+				defer f.wg.Done()
+				informer.Run(stopCh)
+			}()
 			f.startedInformers[informerType] = true
 		}
 	}
 }
 
-// WaitForCacheSync waits for all started informers' cache were synced.
+func (f *sharedInformerFactory) Shutdown() {
+	f.lock.Lock()
+	f.shuttingDown = true
+	f.lock.Unlock()
+
+	// Will return immediately if there is nothing to wait for.
+	f.wg.Wait()
+}
+
 func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool {
 	informers := func() map[reflect.Type]cache.SharedIndexInformer {
 		f.lock.Lock()
@@ -141,7 +165,7 @@ func (f *sharedInformerFactory) WaitForCacheSync(stopCh <-chan struct{}) map[ref
 	return res
 }
 
-// InternalInformerFor returns the SharedIndexInformer for obj using an internal
+// InformerFor returns the SharedIndexInformer for obj using an internal
 // client.
 func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer {
 	f.lock.Lock()
@@ -166,11 +190,58 @@ func (f *sharedInformerFactory) InformerFor(obj runtime.Object, newFunc internal
 
 // SharedInformerFactory provides shared informers for resources in all known
 // API group versions.
+//
+// It is typically used like this:
+//
+//	ctx, cancel := context.Background()
+//	defer cancel()
+//	factory := NewSharedInformerFactory(client, resyncPeriod)
+//	defer factory.WaitForStop()    // Returns immediately if nothing was started.
+//	genericInformer := factory.ForResource(resource)
+//	typedInformer := factory.SomeAPIGroup().V1().SomeType()
+//	factory.Start(ctx.Done())          // Start processing these informers.
+//	synced := factory.WaitForCacheSync(ctx.Done())
+//	for v, ok := range synced {
+//	    if !ok {
+//	        fmt.Fprintf(os.Stderr, "caches failed to sync: %v", v)
+//	        return
+//	    }
+//	}
+//
+//	// Creating informers can also be created after Start, but then
+//	// Start must be called again:
+//	anotherGenericInformer := factory.ForResource(resource)
+//	factory.Start(ctx.Done())
 type SharedInformerFactory interface {
 	internalinterfaces.SharedInformerFactory
-	ForResource(resource schema.GroupVersionResource) (GenericInformer, error)
+
+	// Start initializes all requested informers. They are handled in goroutines
+	// which run until the stop channel gets closed.
+	Start(stopCh <-chan struct{})
+
+	// Shutdown marks a factory as shutting down. At that point no new
+	// informers can be started anymore and Start will return without
+	// doing anything.
+	//
+	// In addition, Shutdown blocks until all goroutines have terminated. For that
+	// to happen, the close channel(s) that they were started with must be closed,
+	// either before Shutdown gets called or while it is waiting.
+	//
+	// Shutdown may be called multiple times, even concurrently. All such calls will
+	// block until all goroutines have terminated.
+	Shutdown()
+
+	// WaitForCacheSync blocks until all started informers' caches were synced
+	// or the stop channel gets closed.
 	WaitForCacheSync(stopCh <-chan struct{}) map[reflect.Type]bool
 
+	// ForResource gives generic access to a shared informer of the matching type.
+	ForResource(resource schema.GroupVersionResource) (GenericInformer, error)
+
+	// InformerFor returns the SharedIndexInformer for obj using an internal
+	// client.
+	InformerFor(obj runtime.Object, newFunc internalinterfaces.NewInformerFunc) cache.SharedIndexInformer
+
 	Extensions() extensions.Interface
 	Networking() networking.Interface
 }

client/pkg/listers/extensions/v1alpha1/wasmplugin.gen.go

@@ -24,8 +24,10 @@ import (
 )
 
 // WasmPluginLister helps list WasmPlugins.
+// All objects returned here must be treated as read-only.
 type WasmPluginLister interface {
 	// List lists all WasmPlugins in the indexer.
+	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*v1alpha1.WasmPlugin, err error)
 	// WasmPlugins returns an object that can list and get WasmPlugins.
 	WasmPlugins(namespace string) WasmPluginNamespaceLister
@@ -56,10 +58,13 @@ func (s *wasmPluginLister) WasmPlugins(namespace string) WasmPluginNamespaceList
 }
 
 // WasmPluginNamespaceLister helps list and get WasmPlugins.
+// All objects returned here must be treated as read-only.
 type WasmPluginNamespaceLister interface {
 	// List lists all WasmPlugins in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*v1alpha1.WasmPlugin, err error)
 	// Get retrieves the WasmPlugin from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
 	Get(name string) (*v1alpha1.WasmPlugin, error)
 	WasmPluginNamespaceListerExpansion
 }

client/pkg/listers/networking/v1/http2rpc.gen.go

@@ -24,8 +24,10 @@ import (
 )
 
 // Http2RpcLister helps list Http2Rpcs.
+// All objects returned here must be treated as read-only.
 type Http2RpcLister interface {
 	// List lists all Http2Rpcs in the indexer.
+	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*v1.Http2Rpc, err error)
 	// Http2Rpcs returns an object that can list and get Http2Rpcs.
 	Http2Rpcs(namespace string) Http2RpcNamespaceLister
@@ -56,10 +58,13 @@ func (s *http2RpcLister) Http2Rpcs(namespace string) Http2RpcNamespaceLister {
 }
 
 // Http2RpcNamespaceLister helps list and get Http2Rpcs.
+// All objects returned here must be treated as read-only.
 type Http2RpcNamespaceLister interface {
 	// List lists all Http2Rpcs in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*v1.Http2Rpc, err error)
 	// Get retrieves the Http2Rpc from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
 	Get(name string) (*v1.Http2Rpc, error)
 	Http2RpcNamespaceListerExpansion
 }

client/pkg/listers/networking/v1/mcpbridge.gen.go

@@ -24,8 +24,10 @@ import (
 )
 
 // McpBridgeLister helps list McpBridges.
+// All objects returned here must be treated as read-only.
 type McpBridgeLister interface {
 	// List lists all McpBridges in the indexer.
+	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*v1.McpBridge, err error)
 	// McpBridges returns an object that can list and get McpBridges.
 	McpBridges(namespace string) McpBridgeNamespaceLister
@@ -56,10 +58,13 @@ func (s *mcpBridgeLister) McpBridges(namespace string) McpBridgeNamespaceLister
 }
 
 // McpBridgeNamespaceLister helps list and get McpBridges.
+// All objects returned here must be treated as read-only.
 type McpBridgeNamespaceLister interface {
 	// List lists all McpBridges in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
 	List(selector labels.Selector) (ret []*v1.McpBridge, err error)
 	// Get retrieves the McpBridge from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
 	Get(name string) (*v1.McpBridge, error)
 	McpBridgeNamespaceListerExpansion
 }

docker/Dockerfile.higress

@@ -6,11 +6,11 @@ ARG BASE_VERSION=latest
 
 ARG HUB
 
+ARG TARGETARCH
+
 # The following section is used as base image if BASE_DISTRIBUTION=debug
 # This base image is provided by istio, see: https://github.com/istio/istio/blob/master/docker/Dockerfile.base
-FROM ${HUB}/base:${BASE_VERSION}
-
-ARG TARGETARCH
+FROM ${HUB}/base:${BASE_VERSION}-${TARGETARCH}
 
 COPY ${TARGETARCH:-amd64}/higress /usr/local/bin/higress
 

docker/docker.mk

@@ -12,12 +12,17 @@
 ## See the License for the specific language governing permissions and
 ## limitations under the License.
 
-docker.higress: BUILD_ARGS=--build-arg BASE_VERSION=${BASE_VERSION} --build-arg HUB=${HUB}
+docker.higress: BUILD_ARGS=--build-arg BASE_VERSION=${HIGRESS_BASE_VERSION} --build-arg HUB=${HUB}
 docker.higress: $(OUT_LINUX)/higress
 docker.higress: docker/Dockerfile.higress
 	$(HIGRESS_DOCKER_RULE)
 
-docker.higress-buildx: BUILD_ARGS=--build-arg BASE_VERSION=${BASE_VERSION} --build-arg HUB=${HUB}
+docker.higress-amd64: BUILD_ARGS=--build-arg BASE_VERSION=${HIGRESS_BASE_VERSION} --build-arg HUB=${HUB}
+docker.higress-amd64: $(AMD64_OUT_LINUX)/higress
+docker.higress-amd64: docker/Dockerfile.higress
+	$(HIGRESS_DOCKER_AMD64_RULE)
+
+docker.higress-buildx: BUILD_ARGS=--build-arg BASE_VERSION=${HIGRESS_BASE_VERSION} --build-arg HUB=${HUB}
 docker.higress-buildx: $(AMD64_OUT_LINUX)/higress
 docker.higress-buildx: $(ARM64_OUT_LINUX)/higress
 docker.higress-buildx: docker/Dockerfile.higress
@@ -35,6 +40,9 @@ DOCKER_ALL_VARIANTS ?= debug distroless
 INCLUDE_UNTAGGED_DEFAULT ?= false
 DEFAULT_DISTRIBUTION=debug
 
-HIGRESS_DOCKER_BUILDX_RULE ?= $(foreach VARIANT,$(DOCKER_BUILD_VARIANTS), time (mkdir -p $(HIGRESS_DOCKER_BUILD_TOP)/$@ && TARGET_ARCH=$(TARGET_ARCH) ./docker/docker-copy.sh $^ $(HIGRESS_DOCKER_BUILD_TOP)/$@ && cd $(HIGRESS_DOCKER_BUILD_TOP)/$@ $(BUILD_PRE) && docker buildx create --name higress --node higress0 --platform linux/amd64,linux/arm64 --use && docker buildx build --no-cache --platform linux/amd64,linux/arm64 $(BUILD_ARGS) --build-arg BASE_DISTRIBUTION=$(call normalize-tag,$(VARIANT)) -t $(HUB)/higress:$(TAG)$(call variant-tag,$(VARIANT)) -f Dockerfile.higress . --push  ); )
-HIGRESS_DOCKER_RULE ?= $(foreach VARIANT,$(DOCKER_BUILD_VARIANTS), time (mkdir -p $(HIGRESS_DOCKER_BUILD_TOP)/$@ && TARGET_ARCH=$(TARGET_ARCH) ./docker/docker-copy.sh $^ $(HIGRESS_DOCKER_BUILD_TOP)/$@ && cd $(HIGRESS_DOCKER_BUILD_TOP)/$@ $(BUILD_PRE) && docker build $(BUILD_ARGS) --build-arg BASE_DISTRIBUTION=$(call normalize-tag,$(VARIANT)) -t $(HUB)/higress:$(TAG)$(call variant-tag,$(VARIANT)) -f Dockerfile.higress . ); )
+IMG ?= higress
+IMG_URL ?= $(HUB)/$(IMG):$(TAG)
 
+HIGRESS_DOCKER_BUILDX_RULE ?= $(foreach VARIANT,$(DOCKER_BUILD_VARIANTS), time (mkdir -p $(HIGRESS_DOCKER_BUILD_TOP)/$@ && TARGET_ARCH=$(TARGET_ARCH) ./docker/docker-copy.sh $^ $(HIGRESS_DOCKER_BUILD_TOP)/$@ && cd $(HIGRESS_DOCKER_BUILD_TOP)/$@ $(BUILD_PRE) && docker buildx create --name higress --node higress0 --platform linux/amd64,linux/arm64 --use && docker buildx build --no-cache --platform linux/amd64,linux/arm64 $(BUILD_ARGS) --build-arg BASE_DISTRIBUTION=$(call normalize-tag,$(VARIANT)) -t $(IMG_URL)$(call variant-tag,$(VARIANT)) -f Dockerfile.higress . --push  ); )
+HIGRESS_DOCKER_RULE ?= $(foreach VARIANT,$(DOCKER_BUILD_VARIANTS), time (mkdir -p $(HIGRESS_DOCKER_BUILD_TOP)/$@ && TARGET_ARCH=$(TARGET_ARCH) ./docker/docker-copy.sh $^ $(HIGRESS_DOCKER_BUILD_TOP)/$@ && cd $(HIGRESS_DOCKER_BUILD_TOP)/$@ $(BUILD_PRE) && docker build $(BUILD_ARGS) --build-arg BASE_DISTRIBUTION=$(call normalize-tag,$(VARIANT)) -t $(IMG_URL)$(call variant-tag,$(VARIANT)) -f Dockerfile.higress . ); )
+HIGRESS_DOCKER_AMD64_RULE ?= $(foreach VARIANT,$(DOCKER_BUILD_VARIANTS), time (mkdir -p $(HIGRESS_DOCKER_BUILD_TOP)/$@ && TARGET_ARCH=amd64 ./docker/docker-copy.sh $^ $(HIGRESS_DOCKER_BUILD_TOP)/$@ && cd $(HIGRESS_DOCKER_BUILD_TOP)/$@ $(BUILD_PRE) && docker build $(BUILD_ARGS) --build-arg BASE_DISTRIBUTION=$(call normalize-tag,$(VARIANT)) --build-arg TARGETARCH=amd64 -t $(IMG_URL)$(call variant-tag,$(VARIANT)) -f Dockerfile.higress . ); )

docs/architecture.md

@@ -0,0 +1,143 @@
+# Higress 核心组件和原理
+
+Higress 是基于 Envoy 和 Istio 进行二次定制化开发构建和功能增强，同时利用 Envoy 和 Istio 一些插件机制，实现了一个轻量级的网关服务。其包括 3 个核心组件：Higress Controller（控制器）、Higress Gateway（网关）和 Higress Console（控制台）。
+下图概况了其核心工作流程：
+
+![img](./images/img_02_01.png)
+
+本章将重点介绍 Higress 的两个核心组件：Higress Controller 和 Higress Gateway。
+
+## 1 Higress Console
+
+Higress Console 是 Higress 网关的管理控制台，主要功能是管理 Higress 网关的路由配置、插件配置等。
+
+### 1.1 Higress Admin SDK
+
+Higress Admin SDK 脱胎于 Higress Console。起初，它作为 Higress Console 的一部分，为前端界面提供实际的功能支持。后来考虑到对接外部系统等需求，将配置管理的部分剥离出来，形成一个独立的逻辑组件，便于和各个系统进行对接。目前支持服务来源管理、服务管理、路由管理、域名管理、证书管理、插件管理等功能。
+Higress Admin SDK 现在只提供 Java 版本，且要求 JDK 版本不低于 17。具体如何集成请参考 Higress 官方 BLOG [如何使用 Higress Admin SDK 进行配置管理](https://higress.io/zh-cn/blog/admin-sdk-intro)。
+
+## 2 Higress Controller
+
+Higress Controller（控制器） 是 Higress 的核心组件，其功能主要是实现 Higress 网关的服务发现、动态配置管理，以及动态下发配置给数据面。Higress Controller 内部包含两个子组件：Discovery 和  Higress Core。
+
+### 2.1 Discovery 组件
+
+Discovery 组件（Istio Pilot-Discovery）是 Istio 的核心组件，负责服务发现、配置管理、证书签发、控制面和数据面之间的通讯和配置下发等。Discovery 内部结构比较复杂，本文只介绍 Discovery 配置管理和服务发现的基本原理，其核心功能的详细介绍可以参考赵化冰老师的 BLOG [Istio Pilot 组件介绍](https://www.zhaohuabing.com/post/2019-10-21-pilot-discovery-code-analysis/)。
+Discovery 将 Kubernetes Service、Gateway API 配置等转换成 Istio 配置，然后将所有 Istio 配置合并转成符合 xDS 接口规范的数据结构，通过 GRPC 下发到数据面的 Envoy。其工作原理如下图：
+
+![img](./images/img_02_02.png)
+
+#### 2.1.1 Config Controller
+
+Discovery 为了更好管理 Istio 配置来源，提供 `Config Controller` 用于管理各种配置来源，目前支持 4 种类型的 `Config Controller`：
+
+- Kubernetes：使用 Kubernetes 作为配置信息来源，该方式的直接依赖 Kubernetes 强大的 CRD 机制来存储配置信息，简单方便，是 Istio 最开始使用的配置信息存储方案, 其中包括 `Kubernetes Controller` 和 `Gateway API Controller` 两个实现。
+- MCP（Mesh Configuration Protocol）：使用 Kubernetes 存储配置数据导致了 Istio 和 Kubernetes 的耦合，限制了 Istio 在非 Kubernetes 环境下的运用。为了解决该耦合，Istio 社区提出了 MCP。
+- Memory：一个基于内存的 Config Controller 实现，主要用于测试。
+- File：一个基于文件的 Config Controller 实现，主要用于测试。
+
+1. Istio 配置
+
+Istio 配置包括：`Gateway`、`VirtualService`、`DestinationRule`、`ServiceEntry`、`EnvoyFilter`、`WasmPlugin`、`WorkloadEntry`、`WorkloadGroup` 等，可以参考 Istio 官方文档[流量管理](https://istio.io/latest/zh/docs/reference/config/networking/)了解更多配置信息。
+
+2. Gateway API 配置
+
+Gateway API 配置包括：`GatewayClass`、`Gateway`、`HttpRoute`、`TCPRoute`、`GRPCRoute` 等, 可以参考 Gateway API 官方文档 [Gateway API](https://gateway-api.sigs.k8s.io/api-types/gateway/) 了解更多配置信息。
+
+3. MCP over xDS
+
+Discovery 作为 MCP Client，任何实现了 MCP 协议的 Server 都可以通过 MCP 协议向 Discovery 下发配置信息，从而消除了 Istio 和 Kubernetes 之间的耦合, 同时使 Istio 的配置信息处理更加灵活和可扩展。
+同时 MCP 是一种基于 xDS 协议的配置管理协议，Higress Core 通过实现 MCP 协议，使 Higress Core 成为 Discovery 的 Istio 配置来源。
+
+4. Config Controller 来源配置
+
+在 `higress-system` 命名空间中，名为 `higress-config` 的 Configmap 中，`mesh` 配置项包含一个 `configSources` 属性用于配置来源。其 Configmap 部分配置项如下：
+
+```yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: higress-config
+  namespace: higress-system
+data:
+  mesh: |-
+    accessLogEncoding: TEXT
+    ...
+    configSources:
+    - address: xds://127.0.0.1:15051
+    - address: k8s://
+    ...
+  meshNetworks: "networks: {}"
+```
+
+#### 2.1.2 Service Controller
+
+`Service Controller` 用于管理各种 `Service Registry`，提供服务发现数据，目前 Istio 支持的 `Service Registry` 主要包括：
+
+- Kubernetes：对接 Kubernetes Registry，可以将 Kubernetes 中定义的 Service 和 Endpoint 采集到 Istio 中。
+- Memory：一个基于内存的 Service Controller 实现，主要用于测试。
+
+### 2.2 Higress Core 组件
+
+Higress Core 核心逻辑如下图：
+
+![img](./images/img_02_03.png)
+
+
+Higress Core 内部包含两个核心子组件: Ingress Config 和 Cert Server。
+
+#### 2.2.1 Ingress Config
+
+Ingress Config 包含 6 个控制器，各自负责不同的功能：
+
+- Ingress Controller：监听 Ingress 资源，将 Ingress 转换为 Istio 的 Gateway、VirtualService、DestinationRule 等资源。
+- Gateway Controller：监听 Gateway、VirtualService、DestinationRule 等资源。
+- McpBridge Controller：根据 McpBridge 的配置，将来自 Nacos、Eureka、Consul、Zookeeper 等外部注册中心或 DNS 的服务信息转换成 Istio ServiceEntry 资源。
+- Http2Rpc Controller：监听 Http2Rpc 资源，实现 HTTP 协议到 RPC 协议的转换。用户可以通过配置协议转换，将 RPC 服务以 HTTP 接口的形式暴露，从而使用 HTTP 请求调用 RPC 接口。
+- WasmPlugin Controller：监听 WasmPlugin 资源，将 Higress WasmPlugin 转化为 Istio WasmPlugin。Higress WasmPlugin 在 Istio WasmPlugin 的基础上进行了扩展，支持全局、路由、域名、服务级别的配置。
+- ConfigmapMgr：监听 Higress 的全局配置 `higress-config` ConfigMap，可以根据 tracing、gzip 等配置构造 EnvoyFilter。
+
+#### 2.2.2 Cert Server
+
+Cert Server 管理 Secret 资源和证书自动签发。
+
+## 3 Higress Gateway
+
+Higress Gateway 内部包含两个子组件：Pilot Agent 和 Envoy。Pilot Agent 主要负责 Envoy 的启动和配置，同时代理 Envoy xDS 请求到 Discovery。 Envoy 作为数据面，负责接收控制面的配置下发，并代理请求到业务服务。 Pilot Agent 和 Envoy 之间通讯协议是使用 xDS 协议， 通过 Unix Domain Socket（UDS）进行通信。
+Envoy 核心架构如下图：
+
+![img](./images/img_02_04.png)
+
+### 1 Envoy 核心组件
+
+- 下游（Downstream）:
+  下游是 Envoy 的客户端，它们负责发起请求并接收 Envoy 的响应。下游通常是最终用户的设备或服务，它们通过 Envoy 代理与后端服务进行通信。
+
+- 上游（Upstream）:
+  上游是 Envoy 的后端服务器，它们接收 Envoy 代理的连接和请求。上游提供服务或数据，对来自下游客户端的请求进行处理并返回响应。
+
+- 监听器（Listener）:
+  监听器是可以接受来自下游客户端连接的网络地址（如 IP 地址和端口，Unix Domain Socket 等）。Envoy 支持在单个进程中配置任意数量的监听器。监听器可以通过 `Listener Discovery Service（LDS）`来动态发现和更新。
+
+- 路由（Router）:
+  路由器是 Envoy 中连接下游和上游的桥梁。它负责决定如何将监听器接收到的请求路由到适当的集群。路由器根据配置的路由规则，如路径、HTTP 标头 等，来确定请求的目标集群，从而实现精确的流量控制和路由。路由器可以通过 `Route Discovery Service（RDS）`来动态发现和更新。
+
+- 集群（Cluster）:
+  集群是一组逻辑上相似的服务提供者的集合。集群成员的选择由负载均衡策略决定，确保请求能够均匀或按需分配到不同的服务实例。集群可以通过 `Cluster Discovery Service（CDS）`来动态发现和更新。
+
+- 端点（Endpoint）:
+  端点是上游集群中的具体服务实例，可以是 IP 地址和端口号的组合。端点可以通过 `Endpoint Discovery Service（EDS）`来动态发现和更新。
+
+- SSL/TLS:
+  Envoy 可以通过 `Secret Discovery Service (SDS)` 动态获取监听器和集群所需的 TLS 证书、私钥以及信任的根证书和撤销机制等配置信息。
+
+通过这些组件的协同工作，Envoy 能够高效地处理网络请求，提供流量管理、负载均衡、服务发现和动态路由等关键功能。
+要详细了解 Envoy 的工作原理，可以参考[Envoy 官方文档](https://www.envoyproxy.io/docs/envoy/latest/intro/intro)，最佳的方式可以通过一个请求通过 [Envoy 代理的生命周期](https://www.envoyproxy.io/docs/envoy/latest/intro/life_of_a_request)事件的过程来理解 Envoy 的工作原理。
+
+
+## 参考
+
+- [1] [Istio Pilot 组件介绍](https://www.zhaohuabing.com/post/2019-10-21-pilot-discovery-code-analysis/)
+- [2] [Istio 服务注册插件机制代码解析](https://www.zhaohuabing.com/post/2019-02-18-pilot-service-registry-code-analysis/)
+- [3] [Istio Pilot代码深度解析](https://www.zhaohuabing.com/post/2019-10-21-pilot-discovery-code-analysis/)
+- [4] [Envoy 官方文档](https://www.envoyproxy.io/docs/envoy/latest/intro/intro)

envoy/1.20/patches/envoy/20230201-wasi-stub.patch

@@ -1,101 +0,0 @@
-diff --git a/bazel/foreign_cc/proxy_wasm_cpp_host.patch b/bazel/foreign_cc/proxy_wasm_cpp_host.patch
-new file mode 100644
-index 0000000000..a586116e84
---- /dev/null
-+++ b/bazel/foreign_cc/proxy_wasm_cpp_host.patch
-@@ -0,0 +1,78 @@
-+diff --git a/include/proxy-wasm/exports.h b/include/proxy-wasm/exports.h
-+index ded6419..334cee4 100644
-+--- a/include/proxy-wasm/exports.h
-++++ b/include/proxy-wasm/exports.h
-+@@ -129,6 +129,11 @@ Word call_foreign_function(Word function_name, Word function_name_size, Word arg
-+ 
-+ // Runtime environment functions exported from envoy to wasm.
-+ 
-++Word wasi_unstable_path_open(Word fd, Word dir_flags, Word path, Word path_len, Word oflags,
-++                             int64_t fs_rights_base, int64_t fg_rights_inheriting, Word fd_flags,
-++                             Word nwritten_ptr);
-++Word wasi_unstable_fd_prestat_get(Word fd, Word buf_ptr);
-++Word wasi_unstable_fd_prestat_dir_name(Word fd, Word path_ptr, Word path_len);
-+ Word wasi_unstable_fd_write(Word fd, Word iovs, Word iovs_len, Word nwritten_ptr);
-+ Word wasi_unstable_fd_read(Word, Word, Word, Word);
-+ Word wasi_unstable_fd_seek(Word, int64_t, Word, Word);
-+@@ -166,7 +171,7 @@ Word pthread_equal(Word left, Word right);
-+ #define FOR_ALL_WASI_FUNCTIONS(_f)                                                                 \
-+   _f(fd_write) _f(fd_read) _f(fd_seek) _f(fd_close) _f(fd_fdstat_get) _f(environ_get)              \
-+       _f(environ_sizes_get) _f(args_get) _f(args_sizes_get) _f(clock_time_get) _f(random_get)      \
-+-          _f(proc_exit)
-++          _f(proc_exit) _f(path_open) _f(fd_prestat_get) _f(fd_prestat_dir_name)
-+ 
-+ // Helpers to generate a stub to pass to VM, in place of a restricted proxy-wasm capability.
-+ #define _CREATE_PROXY_WASM_STUB(_fn)                                                               \
-+diff --git a/include/proxy-wasm/wasm_vm.h b/include/proxy-wasm/wasm_vm.h
-+index c02bb6e..c13c78c 100644
-+--- a/include/proxy-wasm/wasm_vm.h
-++++ b/include/proxy-wasm/wasm_vm.h
-+@@ -110,6 +110,8 @@ using WasmCallback_WWl = Word (*)(Word, int64_t);
-+ using WasmCallback_WWlWW = Word (*)(Word, int64_t, Word, Word);
-+ using WasmCallback_WWm = Word (*)(Word, uint64_t);
-+ using WasmCallback_WWmW = Word (*)(Word, uint64_t, Word);
-++using WasmCallback_WWWWWWllWW = Word (*)(Word, Word, Word, Word, Word, int64_t, int64_t, Word,
-++                                         Word);
-+ using WasmCallback_dd = double (*)(double);
-+ 
-+ #define FOR_ALL_WASM_VM_IMPORTS(_f)                                                                \
-+@@ -127,7 +129,8 @@ using WasmCallback_dd = double (*)(double);
-+                                               _f(proxy_wasm::WasmCallback_WWlWW)                   \
-+                                                   _f(proxy_wasm::WasmCallback_WWm)                 \
-+                                                       _f(proxy_wasm::WasmCallback_WWmW)            \
-+-                                                          _f(proxy_wasm::WasmCallback_dd)
-++                                                          _f(proxy_wasm::WasmCallback_WWWWWWllWW)  \
-++                                                              _f(proxy_wasm::WasmCallback_dd)
-+ 
-+ enum class Cloneable {
-+   NotCloneable,      // VMs can not be cloned and should be created from scratch.
-+diff --git a/src/exports.cc b/src/exports.cc
-+index 0922b2d..d597914 100644
-+--- a/src/exports.cc
-++++ b/src/exports.cc
-+@@ -648,6 +648,25 @@ Word grpc_send(Word token, Word message_ptr, Word message_size, Word end_stream)
-+   return context->grpcSend(token, message.value(), end_stream);
-+ }
-+ 
-++// __wasi_errno_t path_open(__wasi_fd_t fd, __wasi_lookupflags_t dirflags, const char *path,
-++// size_t path_len, __wasi_oflags_t oflags, __wasi_rights_t fs_rights_base, __wasi_rights_t
-++// fs_rights_inheriting, __wasi_fdflags_t fdflags, __wasi_fd_t *retptr0)
-++Word wasi_unstable_path_open(Word fd, Word dir_flags, Word path, Word path_len, Word oflags,
-++                             int64_t fs_rights_base, int64_t fg_rights_inheriting, Word fd_flags,
-++                             Word nwritten_ptr) {
-++  return 44; // __WASI_ERRNO_NOENT
-++}
-++
-++// __wasi_errno_t __wasi_fd_prestat_get(__wasi_fd_t fd, __wasi_prestat_t *retptr0)
-++Word wasi_unstable_fd_prestat_get(Word fd, Word buf_ptr) {
-++  return 8; // __WASI_ERRNO_BADF
-++}
-++
-++// __wasi_errno_t __wasi_fd_prestat_dir_name(__wasi_fd_t fd, uint8_t * path, __wasi_size_t path_len)
-++Word wasi_unstable_fd_prestat_dir_name(Word fd, Word path_ptr, Word path_len) {
-++  return 52; // __WASI_ERRNO_ENOSYS
-++}
-++
-+ // Implementation of writev-like() syscall that redirects stdout/stderr to Envoy
-+ // logs.
-+ Word writevImpl(Word fd, Word iovs, Word iovs_len, Word *nwritten_ptr) {
-diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
-index bfef00ac85..806100b42d 100644
---- a/bazel/repositories.bzl
-+++ b/bazel/repositories.bzl
-@@ -943,7 +943,11 @@ def _proxy_wasm_cpp_sdk():
-     external_http_archive(name = "proxy_wasm_cpp_sdk")
- 
- def _proxy_wasm_cpp_host():
--    external_http_archive(name = "proxy_wasm_cpp_host")
-+    external_http_archive(
-+        name = "proxy_wasm_cpp_host",
-+        patches = ["@envoy//bazel/foreign_cc:proxy_wasm_cpp_host.patch"],
-+        patch_args = ["-p1"],
-+    )
- 
- def _emscripten_toolchain():
-     external_http_archive(

envoy/1.20/patches/envoy/20230408-basic-auth.patch

@@ -1,55 +0,0 @@
-diff -Naur envoy/bazel/envoy_binary.bzl envoy-new/bazel/envoy_binary.bzl
---- envoy/bazel/envoy_binary.bzl	2023-04-08 20:52:57.041729111 +0800
-+++ envoy-new/bazel/envoy_binary.bzl	2023-04-08 20:50:53.657603065 +0800
-@@ -80,7 +80,7 @@
-         "@envoy//bazel:boringssl_fips": [],
-         "@envoy//bazel:windows_x86_64": [],
-         "//conditions:default": ["-pie"],
--    }) + _envoy_select_exported_symbols(["-Wl,-E"])
-+    }) + _envoy_select_exported_symbols(["-Wl,-E"]) + envoy_select_alimesh(["-lcrypt"])
- 
- def _envoy_stamped_deps():
-     return select({
-diff -Naur envoy/bazel/repositories.bzl envoy-new/bazel/repositories.bzl
---- envoy/bazel/repositories.bzl	2023-04-08 20:52:57.085730582 +0800
-+++ envoy-new/bazel/repositories.bzl	2023-04-08 20:27:20.110335884 +0800
-@@ -272,6 +272,8 @@
-         actual = "@bazel_tools//tools/cpp/runfiles",
-     )
- 
-+    _com_github_higress_wasm_extensions()
-+
- def _boringssl():
-     external_http_archive(
-         name = "boringssl",
-@@ -1066,6 +1068,17 @@
-         actual = "@com_github_wasm_c_api//:wasmtime_lib",
-     )
- 
-+def _com_github_higress_wasm_extensions():
-+    native.local_repository(
-+        name = "com_github_higress_wasm_extensions",
-+        path = "../../wasm-cpp",
-+    )
-+
-+    native.bind(
-+        name = "basic_auth_lib",
-+        actual = "@com_github_higress_wasm_extensions//extensions/basic_auth:basic_auth_lib",
-+    )
-+    
- def _rules_fuzzing():
-     external_http_archive(
-         name = "rules_fuzzing",
-diff -Naur envoy/source/exe/BUILD envoy-new/source/exe/BUILD
---- envoy/source/exe/BUILD	2023-04-08 20:52:57.053729512 +0800
-+++ envoy-new/source/exe/BUILD	2023-04-08 19:48:37.420667254 +0800
-@@ -43,6 +43,9 @@
-         "//bazel:darwin": envoy_all_extensions(DARWIN_SKIP_TARGETS),
-         "//conditions:default": envoy_all_extensions(),
-     }),
-+    alimesh_deps = [
-+        "//external:basic_auth_lib",
-+    ],
- )
- 
- envoy_cc_library(

envoy/1.20/patches/envoy/20231008-fallback-origin-cluster.patch

@@ -1,111 +0,0 @@
-diff -Naur envoy/contrib/custom_cluster_plugins/cluster_fallback/source/filter.cc envoy-new/contrib/custom_cluster_plugins/cluster_fallback/source/filter.cc
---- envoy/contrib/custom_cluster_plugins/cluster_fallback/source/filter.cc	2023-10-08 15:01:21.960871500 +0800
-+++ envoy-new/contrib/custom_cluster_plugins/cluster_fallback/source/filter.cc	2023-09-27 17:03:41.613256338 +0800
-@@ -60,7 +60,7 @@
- 
-   for (const auto& cluster_name : first_item->second) {
-     if (hasHealthHost(cluster_name)) {
--      return base.clone(cluster_name);
-+      return base.clone(cluster_name, first_item->first);
-     }
-   }
- 
-@@ -75,7 +75,8 @@
- 
-   auto search = clusters_config_.find(route_entry.clusterName());
-   if (search == clusters_config_.end()) {
--    ENVOY_LOG(warn, "there is no fallback cluster config, the original routing cluster is returned");
-+    ENVOY_LOG(warn,
-+              "there is no fallback cluster config, the original routing cluster is returned");
-     return cluster_entry.getRouteConstSharedPtr();
-   }
- 
-@@ -87,7 +88,7 @@
- 
-   for (const auto& cluster_name : search->second) {
-     if (hasHealthHost(cluster_name)) {
--      return cluster_entry.clone(cluster_name);
-+      return cluster_entry.clone(cluster_name, search->first);
-     }
-   }
- 
-diff -Naur envoy/source/common/http/headers.h envoy-new/source/common/http/headers.h
---- envoy/source/common/http/headers.h	2023-10-08 15:01:21.968871828 +0800
-+++ envoy-new/source/common/http/headers.h	2023-09-27 18:48:50.059419606 +0800
-@@ -124,6 +124,7 @@
-     const LowerCaseString TriStartTime{"req-start-time"};
-     const LowerCaseString TriRespStartTime{"resp-start-time"};
-     const LowerCaseString EnvoyOriginalHost{"original-host"};
-+    const LowerCaseString HigressOriginalService{"x-higress-original-service"};
-   } AliExtendedValues;
- #endif
- };
-diff -Naur envoy/source/common/router/config_impl.cc envoy-new/source/common/router/config_impl.cc
---- envoy/source/common/router/config_impl.cc	2023-10-08 15:01:21.968871828 +0800
-+++ envoy-new/source/common/router/config_impl.cc	2023-09-27 18:49:18.656592237 +0800
-@@ -563,7 +563,6 @@
-         route.name());
-   }
-   // End Added
--
- }
- 
- bool RouteEntryImplBase::evaluateRuntimeMatch(const uint64_t random_value) const {
-@@ -662,6 +661,10 @@
-   }
- 
- #if defined(ALIMESH)
-+  if (!origin_cluster_name_.empty()) {
-+    headers.addCopy(Http::CustomHeaders::get().AliExtendedValues.HigressOriginalService,
-+                    origin_cluster_name_);
-+  }
-   headers.setReferenceKey(Http::CustomHeaders::get().AliExtendedValues.EnvoyOriginalHost,
-                           headers.getHostValue());
- #endif
-diff -Naur envoy/source/common/router/config_impl.h envoy-new/source/common/router/config_impl.h
---- envoy/source/common/router/config_impl.h	2023-10-08 15:01:21.968871828 +0800
-+++ envoy-new/source/common/router/config_impl.h	2023-09-27 18:59:11.196893507 +0800
-@@ -584,9 +584,13 @@
-     return internal_active_redirect_policy_;
-   }
- 
--  RouteConstSharedPtr clone(const std::string& name) const {
--    return std::make_shared<DynamicRouteEntry>(this, name);
-+  RouteConstSharedPtr clone(const std::string& name, const std::string& origin_cluster = "") const {
-+    auto entry = std::make_shared<DynamicRouteEntry>(this, name);
-+    entry->setOriginClusterName(origin_cluster);
-+    return entry;
-   }
-+
-+  void setOriginClusterName(const std::string& name) const { origin_cluster_name_ = name; }
- #endif
-   uint32_t retryShadowBufferLimit() const override { return retry_shadow_buffer_limit_; }
-   const std::vector<ShadowPolicyPtr>& shadowPolicies() const override { return shadow_policies_; }
-@@ -787,11 +791,17 @@
-       return parent_->internalActiveRedirectPolicy();
-     }
- 
--    RouteConstSharedPtr clone(const std::string& name) const {
--      return std::make_shared<Envoy::Router::RouteEntryImplBase::DynamicRouteEntry>(parent_, name);
-+    RouteConstSharedPtr clone(const std::string& name,
-+                              const std::string& origin_cluster = "") const {
-+      auto entry =
-+          std::make_shared<Envoy::Router::RouteEntryImplBase::DynamicRouteEntry>(parent_, name);
-+      entry->setOriginClusterName(origin_cluster);
-+      return entry;
-     }
- 
-     virtual RouteConstSharedPtr getRouteConstSharedPtr() const { return shared_from_this(); }
-+
-+    void setOriginClusterName(const std::string& name) { parent_->setOriginClusterName(name); }
- #endif
- 
-   private:
-@@ -1039,6 +1049,7 @@
- 
- #if defined(ALIMESH)
-   const InternalActiveRedirectPoliciesImpl internal_active_redirect_policy_;
-+  mutable std::string origin_cluster_name_;
- #endif
- };
- 

envoy/1.20/patches/envoy/20231124-rds-optimize.patch

@@ -1,315 +0,0 @@
-diff -Naur envoy/envoy/router/rds.h envoy-new/envoy/router/rds.h
---- envoy/envoy/router/rds.h	2023-11-24 10:52:39.914235488 +0800
-+++ envoy-new/envoy/router/rds.h	2023-11-24 10:47:36.293873127 +0800
-@@ -51,12 +51,6 @@
-   virtual void onConfigUpdate() PURE;
- 
-   /**
--   * Validate if the route configuration can be applied to the context of the route config provider.
--   */
--  virtual void
--  validateConfig(const envoy::config::route::v3::RouteConfiguration& config) const PURE;
--
--  /**
-    * Callback used to request an update to the route configuration from the management server.
-    * @param for_domain supplies the domain name that virtual hosts must match on
-    * @param thread_local_dispatcher thread-local dispatcher
-diff -Naur envoy/envoy/router/route_config_update_receiver.h envoy-new/envoy/router/route_config_update_receiver.h
---- envoy/envoy/router/route_config_update_receiver.h	2023-11-24 10:52:39.918235651 +0800
-+++ envoy-new/envoy/router/route_config_update_receiver.h	2023-11-24 10:47:36.293873127 +0800
-@@ -27,6 +27,7 @@
-    * @param rc supplies the RouteConfiguration.
-    * @param version_info supplies RouteConfiguration version.
-    * @return bool whether RouteConfiguration has been updated.
-+   * @throw EnvoyException if the new config can't be applied.
-    */
-   virtual bool onRdsUpdate(const envoy::config::route::v3::RouteConfiguration& rc,
-                            const std::string& version_info) PURE;
-diff -Naur envoy/source/common/router/rds_impl.cc envoy-new/source/common/router/rds_impl.cc
---- envoy/source/common/router/rds_impl.cc	2023-11-24 10:52:40.194246888 +0800
-+++ envoy-new/source/common/router/rds_impl.cc	2023-11-24 10:47:36.293873127 +0800
-@@ -122,9 +122,6 @@
-     throw EnvoyException(fmt::format("Unexpected RDS configuration (expecting {}): {}",
-                                      route_config_name_, route_config.name()));
-   }
--  if (route_config_provider_opt_.has_value()) {
--    route_config_provider_opt_.value()->validateConfig(route_config);
--  }
-   std::unique_ptr<Init::ManagerImpl> noop_init_manager;
-   std::unique_ptr<Cleanup> resume_rds;
-   if (config_update_info_->onRdsUpdate(route_config, version_info)) {
-@@ -292,12 +289,6 @@
-   }
- }
- 
--void RdsRouteConfigProviderImpl::validateConfig(
--    const envoy::config::route::v3::RouteConfiguration& config) const {
--  // TODO(lizan): consider cache the config here until onConfigUpdate.
--  ConfigImpl validation_config(config, optional_http_filters_, factory_context_, validator_, false);
--}
--
- // Schedules a VHDS request on the main thread and queues up the callback to use when the VHDS
- // response has been propagated to the worker thread that was the request origin.
- void RdsRouteConfigProviderImpl::requestVirtualHostsUpdate(
-diff -Naur envoy/source/common/router/rds_impl.h envoy-new/source/common/router/rds_impl.h
---- envoy/source/common/router/rds_impl.h	2023-11-24 10:52:40.194246888 +0800
-+++ envoy-new/source/common/router/rds_impl.h	2023-11-24 10:47:36.293873127 +0800
-@@ -81,7 +81,6 @@
-   }
-   SystemTime lastUpdated() const override { return last_updated_; }
-   void onConfigUpdate() override {}
--  void validateConfig(const envoy::config::route::v3::RouteConfiguration&) const override {}
-   void requestVirtualHostsUpdate(const std::string&, Event::Dispatcher&,
-                                  std::weak_ptr<Http::RouteConfigUpdatedCallback>) override {
-     NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
-@@ -209,7 +208,6 @@
-   void requestVirtualHostsUpdate(
-       const std::string& for_domain, Event::Dispatcher& thread_local_dispatcher,
-       std::weak_ptr<Http::RouteConfigUpdatedCallback> route_config_updated_cb) override;
--  void validateConfig(const envoy::config::route::v3::RouteConfiguration& config) const override;
- 
- private:
-   struct ThreadLocalConfig : public ThreadLocal::ThreadLocalObject {
-diff -Naur envoy/source/common/router/route_config_update_receiver_impl.cc envoy-new/source/common/router/route_config_update_receiver_impl.cc
---- envoy/source/common/router/route_config_update_receiver_impl.cc	2023-11-24 10:52:40.194246888 +0800
-+++ envoy-new/source/common/router/route_config_update_receiver_impl.cc	2023-11-24 10:47:36.297873290 +0800
-@@ -1,6 +1,7 @@
- #include "source/common/router/route_config_update_receiver_impl.h"
- 
- #include <string>
-+#include <utility>
- 
- #include "envoy/config/route/v3/route.pb.h"
- #include "envoy/service/discovery/v3/discovery.pb.h"
-@@ -14,23 +15,49 @@
- namespace Envoy {
- namespace Router {
- 
-+namespace {
-+
-+// Resets 'route_config::virtual_hosts' by merging VirtualHost contained in
-+// 'rds_vhosts' and 'vhds_vhosts'.
-+void rebuildRouteConfigVirtualHosts(
-+    const std::map<std::string, envoy::config::route::v3::VirtualHost>& rds_vhosts,
-+    const std::map<std::string, envoy::config::route::v3::VirtualHost>& vhds_vhosts,
-+    envoy::config::route::v3::RouteConfiguration& route_config) {
-+  route_config.clear_virtual_hosts();
-+  for (const auto& vhost : rds_vhosts) {
-+    route_config.mutable_virtual_hosts()->Add()->CopyFrom(vhost.second);
-+  }
-+  for (const auto& vhost : vhds_vhosts) {
-+    route_config.mutable_virtual_hosts()->Add()->CopyFrom(vhost.second);
-+  }
-+}
-+
-+} // namespace
-+
- bool RouteConfigUpdateReceiverImpl::onRdsUpdate(
-     const envoy::config::route::v3::RouteConfiguration& rc, const std::string& version_info) {
-   const uint64_t new_hash = MessageUtil::hash(rc);
-   if (new_hash == last_config_hash_) {
-     return false;
-   }
--  route_config_proto_ = std::make_unique<envoy::config::route::v3::RouteConfiguration>(rc);
--  last_config_hash_ = new_hash;
-   const uint64_t new_vhds_config_hash = rc.has_vhds() ? MessageUtil::hash(rc.vhds()) : 0ul;
-+  std::map<std::string, envoy::config::route::v3::VirtualHost> rds_virtual_hosts;
-+  for (const auto& vhost : rc.virtual_hosts()) {
-+    rds_virtual_hosts.emplace(vhost.name(), vhost);
-+  }
-+  envoy::config::route::v3::RouteConfiguration new_route_config = rc;
-+  rebuildRouteConfigVirtualHosts(rds_virtual_hosts, *vhds_virtual_hosts_, new_route_config);
-+  auto new_config = std::make_shared<ConfigImpl>(
-+      new_route_config, optional_http_filters_, factory_context_,
-+      factory_context_.messageValidationContext().dynamicValidationVisitor(), false);
-+  // If the above validation/validation doesn't raise exception, update the
-+  // other cached config entries.
-+  config_ = new_config;
-+  rds_virtual_hosts_ = std::move(rds_virtual_hosts);
-+  last_config_hash_ = new_hash;
-+  *route_config_proto_ = std::move(new_route_config);
-   vhds_configuration_changed_ = new_vhds_config_hash != last_vhds_config_hash_;
-   last_vhds_config_hash_ = new_vhds_config_hash;
--  initializeRdsVhosts(*route_config_proto_);
--
--  rebuildRouteConfig(rds_virtual_hosts_, *vhds_virtual_hosts_, *route_config_proto_);
--  config_ = std::make_shared<ConfigImpl>(
--      *route_config_proto_, optional_http_filters_, factory_context_,
--      factory_context_.messageValidationContext().dynamicValidationVisitor(), false);
- 
-   onUpdateCommon(version_info);
-   return true;
-@@ -50,8 +77,8 @@
-   auto route_config_after_this_update =
-       std::make_unique<envoy::config::route::v3::RouteConfiguration>();
-   route_config_after_this_update->CopyFrom(*route_config_proto_);
--  rebuildRouteConfig(rds_virtual_hosts_, *vhosts_after_this_update,
--                     *route_config_after_this_update);
-+  rebuildRouteConfigVirtualHosts(rds_virtual_hosts_, *vhosts_after_this_update,
-+                                 *route_config_after_this_update);
- 
-   auto new_config = std::make_shared<ConfigImpl>(
-       *route_config_after_this_update, optional_http_filters_, factory_context_,
-@@ -73,14 +100,6 @@
-   config_info_.emplace(RouteConfigProvider::ConfigInfo{*route_config_proto_, last_config_version_});
- }
- 
--void RouteConfigUpdateReceiverImpl::initializeRdsVhosts(
--    const envoy::config::route::v3::RouteConfiguration& route_configuration) {
--  rds_virtual_hosts_.clear();
--  for (const auto& vhost : route_configuration.virtual_hosts()) {
--    rds_virtual_hosts_.emplace(vhost.name(), vhost);
--  }
--}
--
- bool RouteConfigUpdateReceiverImpl::removeVhosts(
-     std::map<std::string, envoy::config::route::v3::VirtualHost>& vhosts,
-     const Protobuf::RepeatedPtrField<std::string>& removed_vhost_names) {
-@@ -110,18 +129,5 @@
-   return vhosts_added;
- }
- 
--void RouteConfigUpdateReceiverImpl::rebuildRouteConfig(
--    const std::map<std::string, envoy::config::route::v3::VirtualHost>& rds_vhosts,
--    const std::map<std::string, envoy::config::route::v3::VirtualHost>& vhds_vhosts,
--    envoy::config::route::v3::RouteConfiguration& route_config) {
--  route_config.clear_virtual_hosts();
--  for (const auto& vhost : rds_vhosts) {
--    route_config.mutable_virtual_hosts()->Add()->CopyFrom(vhost.second);
--  }
--  for (const auto& vhost : vhds_vhosts) {
--    route_config.mutable_virtual_hosts()->Add()->CopyFrom(vhost.second);
--  }
--}
--
- } // namespace Router
- } // namespace Envoy
-diff -Naur envoy/source/common/router/route_config_update_receiver_impl.h envoy-new/source/common/router/route_config_update_receiver_impl.h
---- envoy/source/common/router/route_config_update_receiver_impl.h	2023-11-24 10:52:40.194246888 +0800
-+++ envoy-new/source/common/router/route_config_update_receiver_impl.h	2023-11-24 10:47:36.297873290 +0800
-@@ -27,15 +27,10 @@
-             std::make_unique<std::map<std::string, envoy::config::route::v3::VirtualHost>>()),
-         vhds_configuration_changed_(true), optional_http_filters_(optional_http_filters) {}
- 
--  void initializeRdsVhosts(const envoy::config::route::v3::RouteConfiguration& route_configuration);
-   bool removeVhosts(std::map<std::string, envoy::config::route::v3::VirtualHost>& vhosts,
-                     const Protobuf::RepeatedPtrField<std::string>& removed_vhost_names);
-   bool updateVhosts(std::map<std::string, envoy::config::route::v3::VirtualHost>& vhosts,
-                     const VirtualHostRefVector& added_vhosts);
--  void rebuildRouteConfig(
--      const std::map<std::string, envoy::config::route::v3::VirtualHost>& rds_vhosts,
--      const std::map<std::string, envoy::config::route::v3::VirtualHost>& vhds_vhosts,
--      envoy::config::route::v3::RouteConfiguration& route_config);
-   bool onDemandFetchFailed(const envoy::service::discovery::v3::Resource& resource) const;
-   void onUpdateCommon(const std::string& version_info);
- 
-diff -Naur envoy/source/server/admin/admin.h envoy-new/source/server/admin/admin.h
---- envoy/source/server/admin/admin.h	2023-11-24 10:52:41.358294284 +0800
-+++ envoy-new/source/server/admin/admin.h	2023-11-24 10:47:36.297873290 +0800
-@@ -234,7 +234,6 @@
-     absl::optional<ConfigInfo> configInfo() const override { return {}; }
-     SystemTime lastUpdated() const override { return time_source_.systemTime(); }
-     void onConfigUpdate() override {}
--    void validateConfig(const envoy::config::route::v3::RouteConfiguration&) const override {}
-     void requestVirtualHostsUpdate(const std::string&, Event::Dispatcher&,
-                                    std::weak_ptr<Http::RouteConfigUpdatedCallback>) override {
-       NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
-diff -Naur envoy/test/common/router/rds_impl_test.cc envoy-new/test/common/router/rds_impl_test.cc
---- envoy/test/common/router/rds_impl_test.cc	2023-11-24 10:52:40.714268062 +0800
-+++ envoy-new/test/common/router/rds_impl_test.cc	2023-11-24 10:47:36.297873290 +0800
-@@ -528,34 +528,66 @@
-   rds_callbacks_->onConfigUpdate(decoded_resources.refvec_, response1.version_info());
- }
- 
--// Validate behavior when the config is delivered but it fails PGV validation.
-+// Validates behavior when the config is delivered but it fails PGV validation.
-+// The invalid config won't affect existing valid config.
- TEST_F(RdsImplTest, FailureInvalidConfig) {
-   InSequence s;
- 
-   setup();
-+  EXPECT_CALL(init_watcher_, ready());
- 
--  const std::string response1_json = R"EOF(
-+  const std::string valid_json = R"EOF(
- {
-   "version_info": "1",
-   "resources": [
-     {
-       "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
--      "name": "INVALID_NAME_FOR_route_config",
-+      "name": "foo_route_config",
-       "virtual_hosts": null
-     }
-   ]
- }
- )EOF";
-+
-   auto response1 =
--      TestUtility::parseYaml<envoy::service::discovery::v3::DiscoveryResponse>(response1_json);
-+      TestUtility::parseYaml<envoy::service::discovery::v3::DiscoveryResponse>(valid_json);
-   const auto decoded_resources =
-       TestUtility::decodeResources<envoy::config::route::v3::RouteConfiguration>(response1);
-+  EXPECT_NO_THROW(
-+      rds_callbacks_->onConfigUpdate(decoded_resources.refvec_, response1.version_info()));
-+  // Sadly the RdsRouteConfigSubscription privately inherited from
-+  // SubscriptionCallbacks, so we has to use reinterpret_cast here.
-+  RdsRouteConfigSubscription* rds_subscription =
-+      reinterpret_cast<RdsRouteConfigSubscription*>(rds_callbacks_);
-+  auto config_impl_pointer = rds_subscription->routeConfigProvider().value()->config();
-+  // Now send an invalid config update.
-+  const std::string invalid_json =
-+      R"EOF(
-+{
-+  "version_info": "1",
-+  "resources": [
-+    {
-+      "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
-+      "name": "INVALID_NAME_FOR_route_config",
-+      "virtual_hosts": null
-+    }
-+  ]
-+}
-+)EOF";
-+
-+  auto response2 =
-+      TestUtility::parseYaml<envoy::service::discovery::v3::DiscoveryResponse>(invalid_json);
-+  const auto decoded_resources_2 =
-+      TestUtility::decodeResources<envoy::config::route::v3::RouteConfiguration>(response2);
- 
--  EXPECT_CALL(init_watcher_, ready());
-   EXPECT_THROW_WITH_MESSAGE(
--      rds_callbacks_->onConfigUpdate(decoded_resources.refvec_, response1.version_info()),
-+      rds_callbacks_->onConfigUpdate(decoded_resources_2.refvec_, response2.version_info()),
-       EnvoyException,
--      "Unexpected RDS configuration (expecting foo_route_config): INVALID_NAME_FOR_route_config");
-+      "Unexpected RDS configuration (expecting foo_route_config): "
-+      "INVALID_NAME_FOR_route_config");
-+
-+  // Verify that the config is still the old value.
-+  ASSERT_EQ(config_impl_pointer, rds_subscription->routeConfigProvider().value()->config());
- }
- 
- // rds and vhds configurations change together
-diff -Naur envoy/test/mocks/router/mocks.h envoy-new/test/mocks/router/mocks.h
---- envoy/test/mocks/router/mocks.h	2023-11-24 10:52:41.370294773 +0800
-+++ envoy-new/test/mocks/router/mocks.h	2023-11-24 10:47:36.301873453 +0800
-@@ -538,7 +538,6 @@
-   MOCK_METHOD(absl::optional<ConfigInfo>, configInfo, (), (const));
-   MOCK_METHOD(SystemTime, lastUpdated, (), (const));
-   MOCK_METHOD(void, onConfigUpdate, ());
--  MOCK_METHOD(void, validateConfig, (const envoy::config::route::v3::RouteConfiguration&), (const));
-   MOCK_METHOD(void, requestVirtualHostsUpdate,
-               (const std::string&, Event::Dispatcher&,
-                std::weak_ptr<Http::RouteConfigUpdatedCallback> route_config_updated_cb));
-diff -Naur envoy/tools/spelling/spelling_dictionary.txt envoy-new/tools/spelling/spelling_dictionary.txt
---- envoy/tools/spelling/spelling_dictionary.txt	2023-11-24 10:52:41.370294773 +0800
-+++ envoy-new/tools/spelling/spelling_dictionary.txt	2023-11-24 10:48:54.969076506 +0800
-@@ -1303,6 +1303,7 @@
- ep
- suri
- transid
-+vhosts
- WAF
- TRI
- tmd

envoy/1.20/patches/envoy/20240104-enhance-srds.patch

@@ -1,483 +0,0 @@
-diff -Naur envoy/api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto envoy-new/api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto
---- envoy/api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto	2024-01-04 21:07:40.000000000 +0800
-+++ envoy-new/api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto	2024-01-04 21:09:13.000000000 +0800
-@@ -888,11 +888,31 @@
-         }
-       }
- 
-+      message HostValueExtractor {
-+        option (udpa.annotations.versioning).previous_message_type =
-+            "envoy.config.filter.network.http_connection_manager.v2.ScopedRoutes.ScopeKeyBuilder."
-+            "FragmentBuilder.HostValueExtractor";
-+
-+        // The maximum number of host superset recomputes. If not specified, defaults to 100.
-+        google.protobuf.UInt32Value max_recompute_num = 1;
-+      }
-+
-+      message LocalPortValueExtractor {
-+        option (udpa.annotations.versioning).previous_message_type =
-+            "envoy.config.filter.network.http_connection_manager.v2.ScopedRoutes.ScopeKeyBuilder."
-+            "FragmentBuilder.LocalPortValueExtractor";
-+      }
-+
-+
-       oneof type {
-         option (validate.required) = true;
- 
-         // Specifies how a header field's value should be extracted.
-         HeaderValueExtractor header_value_extractor = 1;
-+
-+        HostValueExtractor host_value_extractor = 101;
-+
-+        LocalPortValueExtractor local_port_value_extractor = 102;
-       }
-     }
- 
-diff -Naur envoy/envoy/router/scopes.h envoy-new/envoy/router/scopes.h
---- envoy/envoy/router/scopes.h	2024-01-04 21:07:38.000000000 +0800
-+++ envoy-new/envoy/router/scopes.h	2024-01-04 21:09:13.000000000 +0800
-@@ -92,7 +92,12 @@
-    * @param headers the request headers to match the scoped routing configuration against.
-    * @return ConfigConstSharedPtr the router's Config matching the request headers.
-    */
-+#if defined ALIMESH
-+  virtual ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap& headers,
-+                                              const StreamInfo::StreamInfo& info) const PURE;
-+#else
-   virtual ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap& headers) const PURE;
-+#endif
- 
-   /**
-    * Based on the incoming HTTP request headers, returns the hash value of its scope key.
-@@ -100,6 +105,12 @@
-    * @return unique_ptr of the scope key computed from header.
-    */
-   virtual ScopeKeyPtr computeScopeKey(const Http::HeaderMap&) const { return {}; }
-+
-+#if defined(ALIMESH)
-+  virtual ScopeKeyPtr computeScopeKey(const Http::HeaderMap&, const StreamInfo::StreamInfo&) const {
-+    return {};
-+  };
-+#endif
- };
- 
- using ScopedConfigConstSharedPtr = std::shared_ptr<const ScopedConfig>;
-diff -Naur envoy/source/common/http/conn_manager_impl.cc envoy-new/source/common/http/conn_manager_impl.cc
---- envoy/source/common/http/conn_manager_impl.cc	2024-01-04 21:07:41.000000000 +0800
-+++ envoy-new/source/common/http/conn_manager_impl.cc	2024-01-04 21:09:13.000000000 +0800
-@@ -577,8 +577,13 @@
-     requestVhdsUpdate(host_header, thread_local_dispatcher, std::move(route_config_updated_cb));
-     return;
-   } else if (parent_.snapped_scoped_routes_config_ != nullptr) {
-+#if defined(ALIMESH)
-+    Router::ScopeKeyPtr scope_key = parent_.snapped_scoped_routes_config_->computeScopeKey(
-+        *parent_.request_headers_, parent_.connection()->streamInfo());
-+#else
-     Router::ScopeKeyPtr scope_key =
-         parent_.snapped_scoped_routes_config_->computeScopeKey(*parent_.request_headers_);
-+#endif
-     // If scope_key is not null, the scope exists but RouteConfiguration is not initialized.
-     if (scope_key != nullptr) {
-       requestSrdsUpdate(std::move(scope_key), thread_local_dispatcher,
-@@ -1197,7 +1202,13 @@
- void ConnectionManagerImpl::ActiveStream::snapScopedRouteConfig() {
-   // NOTE: if a RDS subscription hasn't got a RouteConfiguration back, a Router::NullConfigImpl is
-   // returned, in that case we let it pass.
-+#if defined(ALIMESH)
-+  snapped_route_config_ =
-+      snapped_scoped_routes_config_->getRouteConfig(*request_headers_, connection()->streamInfo());
-+#else
-   snapped_route_config_ = snapped_scoped_routes_config_->getRouteConfig(*request_headers_);
-+
-+#endif
-   if (snapped_route_config_ == nullptr) {
-     ENVOY_STREAM_LOG(trace, "can't find SRDS scope.", *this);
-     // TODO(stevenzzzz): Consider to pass an error message to router filter, so that it can
-diff -Naur envoy/source/common/router/scoped_config_impl.cc envoy-new/source/common/router/scoped_config_impl.cc
---- envoy/source/common/router/scoped_config_impl.cc	2024-01-04 21:07:36.000000000 +0800
-+++ envoy-new/source/common/router/scoped_config_impl.cc	2024-01-04 21:09:13.000000000 +0800
-@@ -6,6 +6,160 @@
- namespace Envoy {
- namespace Router {
- 
-+#if defined(ALIMESH)
-+namespace {
-+
-+std::string maskFirstDNSLabel(absl::string_view host) {
-+  if (host == "*") {
-+    return std::string(host);
-+  }
-+  if (host.size() < 2) {
-+    return "*";
-+  }
-+  size_t start_pos = (host[0] == '*' && host[1] == '.') ? 2 : 0;
-+  size_t dot_pos = host.find('.', start_pos);
-+  if (dot_pos != absl::string_view::npos) {
-+    return absl::StrCat("*", absl::string_view(host.data() + dot_pos, host.size() - dot_pos));
-+  }
-+  return "*";
-+}
-+
-+} // namespace
-+
-+LocalPortValueExtractorImpl::LocalPortValueExtractorImpl(
-+    ScopedRoutes::ScopeKeyBuilder::FragmentBuilder&& config)
-+    : FragmentBuilderBase(std::move(config)) {
-+  ASSERT(config_.type_case() ==
-+             ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::kLocalPortValueExtractor,
-+         "local_port_value_extractor is not set.");
-+}
-+
-+std::unique_ptr<ScopeKeyFragmentBase> LocalPortValueExtractorImpl::computeFragment(
-+    const Http::HeaderMap&, const StreamInfo::StreamInfo& info, ReComputeCbPtr&) const {
-+  auto port = info.downstreamAddressProvider().localAddress()->ip()->port();
-+  return std::make_unique<StringKeyFragment>(std::to_string(long(port)));
-+}
-+
-+HostValueExtractorImpl::HostValueExtractorImpl(
-+    ScopedRoutes::ScopeKeyBuilder::FragmentBuilder&& config)
-+    : FragmentBuilderBase(std::move(config)),
-+      host_value_extractor_config_(config_.host_value_extractor()),
-+      max_recompute_num_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(
-+          host_value_extractor_config_, max_recompute_num, DefaultMaxRecomputeNum)) {
-+  ASSERT(config_.type_case() == ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::kHostValueExtractor,
-+         "host_value_extractor is not set.");
-+}
-+
-+std::unique_ptr<ScopeKeyFragmentBase>
-+HostValueExtractorImpl::reComputeHelper(const std::string& host, ReComputeCbPtr& next_recompute,
-+                                        uint32_t recompute_seq) const {
-+  if (recompute_seq == max_recompute_num_) {
-+    ENVOY_LOG_MISC(warn,
-+                   "recompute host fragment failed, maximum number of recalculations exceeded");
-+    return nullptr;
-+  }
-+  if (host == "*") {
-+    *next_recompute = nullptr;
-+    return nullptr;
-+  }
-+  auto masked_host = maskFirstDNSLabel(host);
-+  *next_recompute = [this, masked_host, recompute_seq,
-+                     next_recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
-+    return reComputeHelper(masked_host, next_recompute, recompute_seq + 1);
-+  };
-+  return std::make_unique<StringKeyFragment>(masked_host);
-+}
-+
-+std::unique_ptr<ScopeKeyFragmentBase>
-+HostValueExtractorImpl::computeFragment(const Http::HeaderMap& headers,
-+                                        const StreamInfo::StreamInfo&,
-+                                        ReComputeCbPtr& recompute) const {
-+  auto fragment = computeFragment(headers);
-+  auto host = static_cast<const Http::RequestHeaderMap&>(headers).getHostValue();
-+  *recompute = [this, host, recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
-+    return reComputeHelper(std::string(host), recompute, 0);
-+  };
-+  return fragment;
-+}
-+
-+std::unique_ptr<ScopeKeyFragmentBase>
-+HostValueExtractorImpl::computeFragment(const Http::HeaderMap& headers) const {
-+  return std::make_unique<StringKeyFragment>(
-+      static_cast<const Http::RequestHeaderMap&>(headers).getHostValue());
-+}
-+
-+std::unique_ptr<ScopeKeyFragmentBase>
-+HeaderValueExtractorImpl::computeFragment(const Http::HeaderMap& headers,
-+                                          const StreamInfo::StreamInfo&, ReComputeCbPtr&) const {
-+  return computeFragment(headers);
-+}
-+
-+ScopeKeyPtr ScopeKeyBuilderImpl::computeScopeKey(const Http::HeaderMap& headers,
-+                                                 const StreamInfo::StreamInfo& info,
-+                                                 std::function<ScopeKeyPtr()>& recompute) const {
-+  ScopeKey key;
-+  bool recomputeable = false;
-+  auto recompute_cbs = std::make_shared<std::vector<ReComputeCbPtr>>();
-+  for (const auto& builder : fragment_builders_) {
-+    // returns nullopt if a null fragment is found.
-+    ReComputeCbPtr recompute_fragment_cb = std::make_shared<ReComputeCb>();
-+    std::unique_ptr<ScopeKeyFragmentBase> fragment =
-+        builder->computeFragment(headers, info, recompute_fragment_cb);
-+    if (fragment == nullptr) {
-+      return nullptr;
-+    }
-+    if (*recompute_fragment_cb == nullptr) {
-+      auto key_fragment = static_cast<StringKeyFragment*>(fragment.get());
-+      auto copied_fragment = std::make_shared<StringKeyFragment>(*key_fragment);
-+      auto recompute_cb =
-+          std::make_shared<ReComputeCb>([copied_fragment]() -> std::unique_ptr<StringKeyFragment> {
-+            return std::make_unique<StringKeyFragment>(*copied_fragment);
-+          });
-+      recompute_cbs->push_back(recompute_cb);
-+    } else {
-+      recomputeable = true;
-+      recompute_cbs->push_back(recompute_fragment_cb);
-+    }
-+    key.addFragment(std::move(fragment));
-+  }
-+  if (recomputeable) {
-+    recompute = [&recompute, recompute_cbs]() mutable -> ScopeKeyPtr {
-+      ScopeKey new_key;
-+      for (auto& cb : *recompute_cbs) {
-+        auto new_fragment = (*cb)();
-+        if (new_fragment == nullptr) {
-+          return nullptr;
-+        }
-+        if (*cb == nullptr) {
-+          recompute = nullptr;
-+        }
-+        new_key.addFragment(std::move(new_fragment));
-+      }
-+      return std::make_unique<ScopeKey>(std::move(new_key));
-+    };
-+  }
-+  return std::make_unique<ScopeKey>(std::move(key));
-+}
-+
-+ScopeKeyPtr ScopedConfigImpl::computeScopeKey(const Http::HeaderMap& headers,
-+                                              const StreamInfo::StreamInfo& info) const {
-+  std::function<Router::ScopeKeyPtr()> recompute;
-+  ScopeKeyPtr scope_key = scope_key_builder_.computeScopeKey(headers, info, recompute);
-+  if (scope_key == nullptr) {
-+    return nullptr;
-+  }
-+  decltype(scoped_route_info_by_key_.begin()) iter;
-+  do {
-+    iter = scoped_route_info_by_key_.find(scope_key->hash());
-+    if (iter != scoped_route_info_by_key_.end()) {
-+      return scope_key;
-+    }
-+  } while (recompute != nullptr && (scope_key = recompute()));
-+  return nullptr;
-+}
-+
-+#endif
-+
- bool ScopeKey::operator!=(const ScopeKey& other) const { return !(*this == other); }
- 
- bool ScopeKey::operator==(const ScopeKey& other) const {
-@@ -95,6 +249,16 @@
-     : ScopeKeyBuilderBase(std::move(config)) {
-   for (const auto& fragment_builder : config_.fragments()) {
-     switch (fragment_builder.type_case()) {
-+#if defined(ALIMESH)
-+    case ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::kHostValueExtractor:
-+      fragment_builders_.emplace_back(std::make_unique<HostValueExtractorImpl>(
-+          ScopedRoutes::ScopeKeyBuilder::FragmentBuilder(fragment_builder)));
-+      break;
-+    case ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::kLocalPortValueExtractor:
-+      fragment_builders_.emplace_back(std::make_unique<LocalPortValueExtractorImpl>(
-+          ScopedRoutes::ScopeKeyBuilder::FragmentBuilder(fragment_builder)));
-+      break;
-+#endif
-     case ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::kHeaderValueExtractor:
-       fragment_builders_.emplace_back(std::make_unique<HeaderValueExtractorImpl>(
-           ScopedRoutes::ScopeKeyBuilder::FragmentBuilder(fragment_builder)));
-@@ -143,6 +307,22 @@
- }
- 
- Router::ConfigConstSharedPtr
-+#if defined(ALIMESH)
-+ScopedConfigImpl::getRouteConfig(const Http::HeaderMap& headers,
-+                                 const StreamInfo::StreamInfo& info) const {
-+  std::function<ScopeKeyPtr()> recompute;
-+  ScopeKeyPtr scope_key = scope_key_builder_.computeScopeKey(headers, info, recompute);
-+  if (scope_key == nullptr) {
-+    return nullptr;
-+  }
-+  decltype(scoped_route_info_by_key_.begin()) iter;
-+  do {
-+    iter = scoped_route_info_by_key_.find(scope_key->hash());
-+    if (iter != scoped_route_info_by_key_.end()) {
-+      return iter->second->routeConfig();
-+    }
-+  } while (recompute != nullptr && (scope_key = recompute()));
-+#else
- ScopedConfigImpl::getRouteConfig(const Http::HeaderMap& headers) const {
-   ScopeKeyPtr scope_key = scope_key_builder_.computeScopeKey(headers);
-   if (scope_key == nullptr) {
-@@ -152,6 +332,7 @@
-   if (iter != scoped_route_info_by_key_.end()) {
-     return iter->second->routeConfig();
-   }
-+#endif
-   return nullptr;
- }
- 
-diff -Naur envoy/source/common/router/scoped_config_impl.h envoy-new/source/common/router/scoped_config_impl.h
---- envoy/source/common/router/scoped_config_impl.h	2024-01-04 21:07:36.000000000 +0800
-+++ envoy-new/source/common/router/scoped_config_impl.h	2024-01-04 21:09:13.000000000 +0800
-@@ -22,6 +22,11 @@
- 
- using envoy::extensions::filters::network::http_connection_manager::v3::ScopedRoutes;
- 
-+#if defined(ALIMESH)
-+using ReComputeCb = std::function<std::unique_ptr<ScopeKeyFragmentBase>()>;
-+using ReComputeCbPtr = std::shared_ptr<ReComputeCb>;
-+#endif
-+
- /**
-  * Base class for fragment builders.
-  */
-@@ -36,6 +41,12 @@
-   virtual std::unique_ptr<ScopeKeyFragmentBase>
-   computeFragment(const Http::HeaderMap& headers) const PURE;
- 
-+#if defined(ALIMESH)
-+  virtual std::unique_ptr<ScopeKeyFragmentBase>
-+  computeFragment(const Http::HeaderMap& headers, const StreamInfo::StreamInfo& info,
-+                  ReComputeCbPtr& recompute) const PURE;
-+#endif
-+
- protected:
-   const ScopedRoutes::ScopeKeyBuilder::FragmentBuilder config_;
- };
-@@ -47,11 +58,54 @@
-   std::unique_ptr<ScopeKeyFragmentBase>
-   computeFragment(const Http::HeaderMap& headers) const override;
- 
-+#if defined(ALIMESH)
-+  std::unique_ptr<ScopeKeyFragmentBase> computeFragment(const Http::HeaderMap& headers,
-+                                                        const StreamInfo::StreamInfo& info,
-+                                                        ReComputeCbPtr& recompute) const override;
-+#endif
-+
- private:
-   const ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::HeaderValueExtractor&
-       header_value_extractor_config_;
- };
- 
-+#if defined(ALIMESH)
-+class HostValueExtractorImpl : public FragmentBuilderBase {
-+public:
-+  explicit HostValueExtractorImpl(ScopedRoutes::ScopeKeyBuilder::FragmentBuilder&& config);
-+
-+  std::unique_ptr<ScopeKeyFragmentBase>
-+  computeFragment(const Http::HeaderMap& headers) const override;
-+
-+  std::unique_ptr<ScopeKeyFragmentBase> computeFragment(const Http::HeaderMap& headers,
-+                                                        const StreamInfo::StreamInfo& info,
-+                                                        ReComputeCbPtr& recompute) const override;
-+
-+private:
-+  std::unique_ptr<ScopeKeyFragmentBase> reComputeHelper(const std::string& host,
-+                                                        ReComputeCbPtr& next_recompute,
-+                                                        uint32_t recompute_seq) const;
-+
-+  static constexpr uint32_t DefaultMaxRecomputeNum = 100;
-+
-+  const ScopedRoutes::ScopeKeyBuilder::FragmentBuilder::HostValueExtractor&
-+      host_value_extractor_config_;
-+  const uint32_t max_recompute_num_;
-+};
-+
-+class LocalPortValueExtractorImpl : public FragmentBuilderBase {
-+public:
-+  explicit LocalPortValueExtractorImpl(ScopedRoutes::ScopeKeyBuilder::FragmentBuilder&& config);
-+
-+  std::unique_ptr<ScopeKeyFragmentBase> computeFragment(const Http::HeaderMap&) const override {
-+    return nullptr;
-+  };
-+
-+  std::unique_ptr<ScopeKeyFragmentBase> computeFragment(const Http::HeaderMap& headers,
-+                                                        const StreamInfo::StreamInfo& info,
-+                                                        ReComputeCbPtr& recompute) const override;
-+};
-+#endif
- /**
-  * Base class for ScopeKeyBuilder implementations.
-  */
-@@ -64,6 +118,12 @@
-   // Computes scope key for given headers, returns nullptr if a key can't be computed.
-   virtual ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers) const PURE;
- 
-+#if defined(ALIMESH)
-+  virtual ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers,
-+                                      const StreamInfo::StreamInfo& info,
-+                                      std::function<ScopeKeyPtr()>& recompute) const PURE;
-+#endif
-+
- protected:
-   const ScopedRoutes::ScopeKeyBuilder config_;
- };
-@@ -74,6 +134,11 @@
- 
-   ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers) const override;
- 
-+#if defined(ALIMESH)
-+  ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers, const StreamInfo::StreamInfo& info,
-+                              std::function<ScopeKeyPtr()>& recompute) const override;
-+#endif
-+
- private:
-   std::vector<std::unique_ptr<FragmentBuilderBase>> fragment_builders_;
- };
-@@ -118,10 +183,20 @@
-   void removeRoutingScopes(const std::vector<std::string>& scope_names);
- 
-   // Envoy::Router::ScopedConfig
-+#if defined(ALIMESH)
-+  Router::ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap& headers,
-+                                              const StreamInfo::StreamInfo& info) const override;
-+#else
-   Router::ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap& headers) const override;
-+#endif
-   // The return value is not null only if the scope corresponding to the header exists.
-   ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers) const override;
- 
-+#if defined(ALIMESH)
-+  ScopeKeyPtr computeScopeKey(const Http::HeaderMap& headers,
-+                              const StreamInfo::StreamInfo& info) const override;
-+#endif
-+
- private:
-   ScopeKeyBuilderImpl scope_key_builder_;
-   // From scope name to cached ScopedRouteInfo.
-@@ -135,9 +210,16 @@
-  */
- class NullScopedConfigImpl : public ScopedConfig {
- public:
-+#if defined(ALIMESH)
-+  Router::ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap&,
-+                                              const StreamInfo::StreamInfo&) const override {
-+    return std::make_shared<const NullConfigImpl>();
-+  }
-+#else
-   Router::ConfigConstSharedPtr getRouteConfig(const Http::HeaderMap&) const override {
-     return std::make_shared<const NullConfigImpl>();
-   }
-+#endif
- };
- 
- } // namespace Router
-diff -Naur envoy/source/extensions/filters/http/on_demand/on_demand_update.cc envoy-new/source/extensions/filters/http/on_demand/on_demand_update.cc
---- envoy/source/extensions/filters/http/on_demand/on_demand_update.cc	2024-01-04 21:07:33.000000000 +0800
-+++ envoy-new/source/extensions/filters/http/on_demand/on_demand_update.cc	2024-01-04 21:09:13.000000000 +0800
-@@ -50,7 +50,11 @@
- // This is the callback which is called when an update requested in requestRouteConfigUpdate()
- // has been propagated to workers, at which point the request processing is restarted from the
- // beginning.
-+#if defined(ALIMESH)
-+void OnDemandRouteUpdate::onRouteConfigUpdateCompletion(bool) {
-+#else
- void OnDemandRouteUpdate::onRouteConfigUpdateCompletion(bool route_exists) {
-+#endif
-   filter_iteration_state_ = Http::FilterHeadersStatus::Continue;
- 
-   // Don't call continueDecoding in the middle of decodeHeaders()
-@@ -58,12 +62,14 @@
-     return;
-   }
- 
-+#if !defined(ALIMESH)
-   if (route_exists &&                  // route can be resolved after an on-demand
-                                        // VHDS update
-       !callbacks_->decodingBuffer() && // Redirects with body not yet supported.
-       callbacks_->recreateStream(/*headers=*/nullptr)) {
-     return;
-   }
-+#endif
- 
-   // route cannot be resolved after an on-demand VHDS update or
-   // recreating stream failed, continue the filter-chain

envoy/1.20/patches/envoy/20240110-fix-srds.patch

@@ -1,49 +0,0 @@
-diff -Naur envoy/source/common/router/BUILD envoy-new/source/common/router/BUILD
---- envoy/source/common/router/BUILD	2024-01-10 20:10:14.505600746 +0800
-+++ envoy-new/source/common/router/BUILD	2024-01-10 20:07:25.960379955 +0800
-@@ -212,6 +212,7 @@
-         "//envoy/router:rds_interface",
-         "//envoy/router:scopes_interface",
-         "//envoy/thread_local:thread_local_interface",
-+        "//source/common/http:header_utility_lib",
-         "@envoy_api//envoy/config/route/v3:pkg_cc_proto",
-         "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3:pkg_cc_proto",
-     ],
-diff -Naur envoy/source/common/router/scoped_config_impl.cc envoy-new/source/common/router/scoped_config_impl.cc
---- envoy/source/common/router/scoped_config_impl.cc	2024-01-10 20:10:14.529600924 +0800
-+++ envoy-new/source/common/router/scoped_config_impl.cc	2024-01-10 20:09:50.161422411 +0800
-@@ -3,6 +3,8 @@
- #include "envoy/config/route/v3/scoped_route.pb.h"
- #include "envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.pb.h"
- 
-+#include "source/common/http/header_utility.h"
-+
- namespace Envoy {
- namespace Router {
- 
-@@ -74,18 +76,20 @@
- HostValueExtractorImpl::computeFragment(const Http::HeaderMap& headers,
-                                         const StreamInfo::StreamInfo&,
-                                         ReComputeCbPtr& recompute) const {
--  auto fragment = computeFragment(headers);
-   auto host = static_cast<const Http::RequestHeaderMap&>(headers).getHostValue();
-+  auto port_start = Http::HeaderUtility::getPortStart(host);
-+  if (port_start != absl::string_view::npos) {
-+    host = host.substr(0, port_start);
-+  }
-   *recompute = [this, host, recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
-     return reComputeHelper(std::string(host), recompute, 0);
-   };
--  return fragment;
-+  return std::make_unique<StringKeyFragment>(host);
- }
- 
- std::unique_ptr<ScopeKeyFragmentBase>
--HostValueExtractorImpl::computeFragment(const Http::HeaderMap& headers) const {
--  return std::make_unique<StringKeyFragment>(
--      static_cast<const Http::RequestHeaderMap&>(headers).getHostValue());
-+HostValueExtractorImpl::computeFragment(const Http::HeaderMap&) const {
-+  return nullptr;
- }
- 
- std::unique_ptr<ScopeKeyFragmentBase>

envoy/1.20/patches/envoy/20240111-fix-srds-compute.patch

@@ -1,65 +0,0 @@
-diff -Naur envoy/source/common/router/scoped_config_impl.cc envoy-new/source/common/router/scoped_config_impl.cc
---- envoy/source/common/router/scoped_config_impl.cc	2024-01-11 16:23:55.407881263 +0800
-+++ envoy-new/source/common/router/scoped_config_impl.cc	2024-01-11 16:23:42.311786814 +0800
-@@ -53,21 +53,26 @@
- }
- 
- std::unique_ptr<ScopeKeyFragmentBase>
--HostValueExtractorImpl::reComputeHelper(const std::string& host, ReComputeCbPtr& next_recompute,
-+HostValueExtractorImpl::reComputeHelper(const std::string& host,
-+                                        ReComputeCbWeakPtr& weak_next_recompute,
-                                         uint32_t recompute_seq) const {
-   if (recompute_seq == max_recompute_num_) {
-     ENVOY_LOG_MISC(warn,
-                    "recompute host fragment failed, maximum number of recalculations exceeded");
-     return nullptr;
-   }
-+  auto next_recompute = weak_next_recompute.lock();
-+  if (!next_recompute) {
-+    return nullptr;
-+  }
-   if (host == "*") {
-     *next_recompute = nullptr;
-     return nullptr;
-   }
-   auto masked_host = maskFirstDNSLabel(host);
-   *next_recompute = [this, masked_host, recompute_seq,
--                     next_recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
--    return reComputeHelper(masked_host, next_recompute, recompute_seq + 1);
-+                     weak_next_recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
-+    return reComputeHelper(masked_host, weak_next_recompute, recompute_seq + 1);
-   };
-   return std::make_unique<StringKeyFragment>(masked_host);
- }
-@@ -81,8 +86,9 @@
-   if (port_start != absl::string_view::npos) {
-     host = host.substr(0, port_start);
-   }
--  *recompute = [this, host, recompute]() mutable -> std::unique_ptr<ScopeKeyFragmentBase> {
--    return reComputeHelper(std::string(host), recompute, 0);
-+  *recompute = [this, host, weak_recompute = ReComputeCbWeakPtr(recompute)]() mutable
-+      -> std::unique_ptr<ScopeKeyFragmentBase> {
-+    return reComputeHelper(std::string(host), weak_recompute, 0);
-   };
-   return std::make_unique<StringKeyFragment>(host);
- }
-diff -Naur envoy/source/common/router/scoped_config_impl.h envoy-new/source/common/router/scoped_config_impl.h
---- envoy/source/common/router/scoped_config_impl.h	2024-01-11 16:23:55.407881263 +0800
-+++ envoy-new/source/common/router/scoped_config_impl.h	2024-01-11 16:23:42.311786814 +0800
-@@ -25,6 +25,7 @@
- #if defined(ALIMESH)
- using ReComputeCb = std::function<std::unique_ptr<ScopeKeyFragmentBase>()>;
- using ReComputeCbPtr = std::shared_ptr<ReComputeCb>;
-+using ReComputeCbWeakPtr = std::weak_ptr<ReComputeCb>;
- #endif
- 
- /**
-@@ -83,7 +84,7 @@
- 
- private:
-   std::unique_ptr<ScopeKeyFragmentBase> reComputeHelper(const std::string& host,
--                                                        ReComputeCbPtr& next_recompute,
-+                                                        ReComputeCbWeakPtr& weak_next_recompute,
-                                                         uint32_t recompute_seq) const;
- 
-   static constexpr uint32_t DefaultMaxRecomputeNum = 100;