Automator: update proxy@master in istio/istio@master

[istio-testing]

Generated by Automator - 2023-10-31T15:27:58+00:00

[ericvn]

/retest

[zirain]

/retest

[zirain]

@kyessenov related to authn changes?

[ericvn]

Failures in TestRequestAuthentication

[zirain]

2023-10-25T09:08:26.002995Z     warn    ads     ADS:LDS: ACK ERROR httpbin-67f8fbcd48-r72j7.default-5 Internal:Error adding/updating listener(s) virtualInbound: Provider 'origins-0' in jwt_authn config has invalid local jwks: Jwks RSA [n] or [e] field is missing or has a parse error

{
              "name": "envoy.filters.http.jwt_authn",
              "typed_config": {
               "@type": "type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication",
               "providers": {
                "origins-0": {
                 "issuer": "test-issuer-1@istio.io",
                 "local_jwks": {
                  "inline_string": "{\"keys\":[ {\"e\":\"AQAB\",\"kid\":\"abc\",\"kty\":\"RSA\",\"n\":\"RXJyb3ItSXN0aW9kRmFpbGVkVG9GZXRjaEp3a3NVcmktaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2lzdGlvL2lzdGlvL21hc3Rlci90ZXN0cy9jb21tb24vand0L2p3a3Mtbm90LWV4aXN0Lmpzb24\"}]}"
                 },
                 "payload_in_metadata": "test-issuer-1@istio.io"
                }
               },
               "rules": [
                {
                 "match": {
                  "prefix": "/"
                 },
                 "requires": {
                  "requires_any": {
                   "requirements": [
                    {
                     "provider_name": "origins-0"
                    },
                    {
                     "allow_missing": {}
                    }
                   ]
                  }
                 }
                }
               ],
               "bypass_cors_preflight": true
              }
             },

[zirain]

seems related to envoyproxy/envoy#30001

[kyessenov]

Yeah, there was a feature in Envoy that probably affected Istio.

[kyessenov]

@aryan16 Are you familiar with how we generated the test JWKs? Why are they suddenly malformed?

[zirain]

@aryan16 Are you familiar with how we generated the test JWKs? Why are they suddenly malformed?

Verification has become more stringent.

[zirain]

/rebase

[zirain]

this should be OK tomorrow, let's what will happen.

[ericvn]

This job will never see any updates until the envoy updates in the main branch are fixed. The pipeline job is broken. For example see https://prow.istio.io/view/gs/istio-prow/logs/update-proxy_proxy_periodic/1718687415981314048, and I talked about it here: https://istio.slack.com/archives/CNWHGSBHA/p1698515622875269.

[zirain]

I think this's the root cause:

git ls-remote https://github.com/envoyproxy/envoy main
a699868c39fc1da067e9a442e391f1cd2694f175	refs/heads/main
3127d5fa97c5b30ed6017ef291379a8cb9fdebb5	refs/heads/release/create/main
8ec3b846a95d1567d97aa24e386bc5ed2d0c2afe	refs/heads/release/sync/main

[zirain]

xhref: istio/proxy#5104