Sync with release-1.1 (istio#11704)

* Fix routing when DNS is resolved (istio#11522)

The DNSDomain variable needs to be enhanced to include more
then one DNS entry.  Change DNSDomain to DNSDomains as a meta
and add the dnsConfig in the meta.  As now DNSDomain is a slice
of strings instead of a string, the variable needs consolidation.

* adjust galley dashboard time range (istio#11627)

* Add update permissions to deployments/finalizers for galley clusterrole (istio#11586) (istio#11631)

(cherry picked from commit f9b6866)

* [release-1.1] Update fluentd adapter to be more robust (istio#11623)

* Update fluentd adapter to be more robust

* Minor touchup of bad merge

* Lint fixes

* Fix kubernetesenv workload attributes for multicluster with one control plane (istio#11581)

* remove myself from pilot OWNERS (istio#11632)

* remove me (istio#11636)

Signed-off-by: Kuat Yessenov <kuat@google.com>

* add debug logs for citadel authenticate fail (istio#11633)

* move apply plugin below buildscript (istio#11625)

The Cloud Foundry open source licensing scanner has a plugin that
identifies dependencies from gradle scripts, but it requires the
buildscript and plugins block be before anything else in the file.
This change does not affect the build, but makes our lives a smidge
easier.

Co-authored-by: Teal Stannard <tstannard@pivotal.io>

* check key.pem (istio#11599)

* Sample ServiceEntries for apt-get, pip, and git tools showing how to grant access to mesh. (istio#11508)

* Samples for accessing apt-get repo, Github, and pip repo

* A Readme explaining the samples

* Link to future doc on default external comm capability

* Incorporate documentation feedback from venilnoronha

* Add support for metadata constraints in RBAC (istio#11459)

* Add support for metadata constraints in RBAC

This adds support for mapping RBAC constraints with keys in the a[b]
format to Envoy's filter metadata matcher.

Signed-off-by: Venil Noronha <veniln@vmware.com>

* Use SplitN instead of Split for completeness

This updates the metadata matcher definition to use strings.SplitN
instead of strings.Split in order to capture the whole binary key in two
parts.

Signed-off-by: Venil Noronha <veniln@vmware.com>

* Accomodate [list] and plain value type constraints

This adds logic to accomodate filter metadata matching over both [list]
and value type constraints.

Signed-off-by: Venil Noronha <veniln@vmware.com>

* Add extra experimental. prefix test for matching

This adds an extra experimental. prefix test while creating metadata
matchers based on Envoy filters.

Signed-off-by: Venil Noronha <veniln@vmware.com>

* Update comments

This updates code comments.

Signed-off-by: Venil Noronha <veniln@vmware.com>

* add POST to ratings service to demonstrate security policies on HTTP Methods (istio#10778)

* add POST to ratings service

* put a space between if and opening parenthesis

* add comments

* remove extra line-break

* Enable remote clusters to check/report to local Mixer (istio#11585)

* Print error message if istio-sidecar-injector invalid, allow toJson as synonym for toJSON (istio#11570)

* Fix racetest in fluentd test (istio#11647)

* Bump the number of connection that can be re-use in Citadel (istio#11641)

* Bump the number of connection that can be re-use in Citadel

* A small fix

* First cut of xDS APi structural testing using the new integration tests (istio#11406)

* Fixes for k8s ingress (istio#11343)

* Fix ingress in pilot, writeback and multiple namespaces

* Fix tests, format

* Fix test - the generated service should be left in the namespace of ingress

* Additional test fixes, match the new 1.1 semantics

* Again make fmt and lint not matching

* Break up the helloworld sample into versions (istio#11650)

* Break up the helloworld sample into versions

* Moved to default namespace

* Seperated gateway file and added labels

* Update the doc

* Cleanup section updated too

* Fix build break due to istio#11406. (istio#11677)

https://k8s-gubernator.appspot.com/build/istio-prow/pr-logs/pull/istio_istio/11645/istio-integ-local-tests/5215

* make stackdriver e2e test cluster wide (istio#11674)

* Add handling for independent encoding in Report batches to Mixer (istio#11640)

* Add handling for independent encoding in Report batches to Mixer

* fix lll

* Address review

* protect protobag done

* exit circleci test early if setup fails (istio#11572)

* wip: exit circleci test early if setup fails

Many of the circleci tests will attempt to run the e2e/integration
tests even after the test setup fails. This leads to misleading test
failures that suggest the problem is with the feature test and not the
test setup itself.

Example test runs where the setup failed and the test was run but
immediately errored out because a dependency was missing:

https://circleci.com/gh/istio/istio/316588
https://circleci.com/gh/istio/istio/317262
https://circleci.com/gh/istio/istio/318281
https://circleci.com/gh/istio/istio/316031
https://circleci.com/gh/istio/istio/315952
https://circleci.com/gh/istio/istio/315871
https://circleci.com/gh/istio/istio/315813

ref: https://circleci.com/docs/2.0/configuration-reference/#the-when-attribute
```
By default, CircleCI will execute job steps one at a time, in the
order that they are defined in config.yml, until a step fails (returns
a non-zero exit code). After a command fails, no further job steps
will be executed.

Adding the when attribute to a job step allows you to override this
default behaviour, and selectively run or skip steps depending on the
status of the job.

The default value of on_success means that the step will run only if
all of the previous steps have been successful (returned exit code 0).

A value of always means that the step will run regardless of the exit
status of previous steps. This is useful if you have a task that you
want to run regardless of whether the previous steps are successful or
not. For example, you might have a job step that needs to upload logs
or code-coverage data somewhere.
```

* re-add `when: always` to codecov job

* Implementation of isolation for EDS (istio#11672)

* Implementation of isolation for EDS

* Provide nil proxy for older calls

* Always call loadAssignmentsForClusterIsolated

* Revert "Always call loadAssignmentsForClusterIsolated"

This reverts commit db2c997.

* Env variable to disable

* Lint

* Environment Variable controlled Graceful Termination with low defaults. (istio#11630)

* Feature flag graceful shutdown

Turn graceful shutdown off by default for 1.1 with a feature flag that allows users to opt-in.

Signed-off-by: Liam White <liam@tetrate.io>

* Address pr comments

Signed-off-by: Liam White <liam@tetrate.io>

* Clean up missed feature flag var

Signed-off-by: Liam White <liam@tetrate.io>

* Add turn off test case, todo comments and fix agent tests

Signed-off-by: Liam White <liam@tetrate.io>

* fix lint

Signed-off-by: Liam White <liam@tetrate.io>

* PR review comments

Signed-off-by: Liam White <liam@tetrate.io>

* Move TerminationDuration function and tests to Pilot features

Signed-off-by: Liam White <liam@tetrate.io>

* Update Proxy SHA to latest (release-1.1). (istio#11687)

Signed-off-by: Piotr Sikora <piotrsikora@google.com>

* Add empty check for proxy's locality (istio#11681)

Make sure empty proxy locality will fall back to using proxy service's instance locality.

* Increase sleep value to account for Galley default aggregation of 1 sec with MCP (istio#11685)

* cache ServiceAccounts and remove it drom Environment (istio#11442)

* cache ServiceAccounts and remove it drom Environment

* use allServices var

* fix ut

* Adding Envoy bootstrap template for a custom Pilot implementation. (istio#11395)

* Adding Envoy bootstrap template for a custom Pilot implementation.

New template connects to Pilot using Google gRPC Envoy client, which
allows to perform authz by passing additional credentials. Placed into
install/gcp due to being GCP installation specific.

To enable this template, introducing {{ .discovery_address }} variable,
which passes --discoveryAddress flag value "as is", without splitting it into
address/port_value parts as currently done for the {{ .pilot_grpc_address }} variable.

* Removing static interception listener from gcp_envoy_bootstrap.json
as it is generated by the Pilot.

pkg/features/pilot/pilot.go

@@ -120,4 +120,4 @@ var (
 
 	// DefaultPortHTTPProxy is used as for HTTP PROXY mode. Can be overridden by ProxyHttpPort in mesh config.
 	DefaultPortHTTPProxy = 15002
-)
+)