Updating Envoy version to 2a33d4e (Oct 27, 2025) (#1441)

- Update the ENVOY_COMMIT and ENVOY_SHA in bazel/repositories.bzl to the latest Envoy's commit.
- Update .bazelrc to envoyproxy/envoy#41705, envoyproxy/envoy#40997
- Update .bazelversion to envoyproxy/envoy#41661
- Update ci/docker-compose.yml to envoyproxy/envoy#41646
- Modifications to python test files to accommodate bazelbuild/bazel#18128
- Adjustments to docker image creation to avoid copying symlinks from virtualenv

Signed-off-by: tomjzzhang <4367421+tomjzzhang@users.noreply.github.com>

Author: tomjzzhang

.bazelrc

@@ -77,9 +77,14 @@ build --incompatible_enforce_config_setting_visibility
 test --test_verbose_timeout_warnings
 test --experimental_ui_max_stdouterr_bytes=11712829 #default 1048576
 
+test --test_tag_filters=-runtime-cpu
+
 # Allow tags to influence execution requirements
 common --experimental_allow_tags_propagation
 
+# Python
+common --@rules_python//python/config_settings:bootstrap_impl=script
+
 # Test configuration flags                                                                  # unique
 # Enable stress tests (expensive tests that are skipped by default)                         # unique
 test:stress --//test/config:run_stress_tests=True                                           # unique
@@ -159,7 +164,7 @@ build:asan-common --config=sanitizer
 build:asan-common --define signal_trace=disabled
 build:asan-common --define ENVOY_CONFIG_ASAN=1
 build:asan-common --build_tag_filters=-no_san
-build:asan-common --test_tag_filters=-no_san
+build:asan-common --test_tag_filters=-no_san,-runtime-cpu
 # The following two lines were manually edited due to #593.                                 # unique
 # Flag undefined was dropped from both the lines to allow CI/ASAN to pass.                  # unique
 build:asan-common --copt -fsanitize=address                                                 # unique
@@ -212,7 +217,7 @@ build:tsan --copt -fsanitize=thread
 build:tsan --linkopt -fsanitize=thread
 build:tsan --copt -DTHREAD_SANITIZER=1
 build:tsan --build_tag_filters=-no_san,-no_tsan
-build:tsan --test_tag_filters=-no_san,-no_tsan
+build:tsan --test_tag_filters=-no_san,-no_tsan,-runtime-cpu
 # Needed due to https://github.com/libevent/libevent/issues/777
 build:tsan --copt -DEVENT__DISABLE_DEBUG_MODE
 # https://github.com/abseil/abseil-cpp/issues/760
@@ -224,7 +229,7 @@ build:tsan --test_env="TSAN_OPTIONS=report_atomic_races=0"
 build:msan --action_env=ENVOY_MSAN=1
 build:msan --config=sanitizer
 build:msan --build_tag_filters=-no_san
-build:msan --test_tag_filters=-no_san
+build:msan --test_tag_filters=-no_san,-runtime-cpu
 build:msan --define ENVOY_CONFIG_MSAN=1
 build:msan --copt -fsanitize=memory
 build:msan --linkopt -fsanitize=memory
@@ -285,10 +290,10 @@ build:coverage --coverage_report_generator=@envoy//tools/coverage:report_generat
 
 build:test-coverage --test_arg="-l trace"
 build:test-coverage --test_arg="--log-path /dev/null"
-build:test-coverage --test_tag_filters=-nocoverage,-fuzz_target
+build:test-coverage --test_tag_filters=-nocoverage,-fuzz_target,-runtime-cpu
 build:fuzz-coverage --config=plain-fuzzer
 build:fuzz-coverage --run_under=@envoy//bazel/coverage:fuzz_coverage_wrapper.sh
-build:fuzz-coverage --test_tag_filters=-nocoverage
+build:fuzz-coverage --test_tag_filters=-nocoverage,-runtime-cpu
 # Existing fuzz tests don't need a full WASM runtime and in generally we don't really want to
 # fuzz dependencies anyways. On the other hand, disabling WASM reduces the build time and
 # resources required to build and run the tests.

.bazelversion

@@ -1 +1 @@
-7.6.1
+7.6.2

bazel/repositories.bzl

@@ -1,7 +1,7 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-ENVOY_COMMIT = "2b2759be6fc6b369c66c91e38846f5ad1403d2d4"
-ENVOY_SHA = "b29ae2b21aeadd543e763ea1ccee385f042b417666e8fa7522cc0d6069a4a633"
+ENVOY_COMMIT = "2a33d4e1f2403e874a28e29e0105f6253aa1ba21"
+ENVOY_SHA = "bdafd5158e68afbbe75b034c28ae89b6484a62e48c207ca7d543f0fa296ee2a4"
 
 HDR_HISTOGRAM_C_VERSION = "0.11.8"  # June 18th, 2025
 HDR_HISTOGRAM_C_SHA = "bb95351a6a8b242dc9be1f28562761a84d4cf0a874ffc90a9b630770a6468e94"

benchmarks/dynamic_test/test_cds_churn_with_traffic.py

@@ -10,8 +10,8 @@
 from dynamic_config_envoy_proxy import (inject_dynamic_envoy_http_proxy_fixture, proxy_config)
 from benchmarks import utilities as benchmarks_utilities
 from typing import Generator
-from rules_python.python.runfiles import runfiles
-from nighthawk.api.configuration import cluster_config_manager_pb2
+from python.runfiles import runfiles
+from api.configuration import cluster_config_manager_pb2
 from test.integration import utility
 
 _BENCHMARK_DURATION = int(os.environ.get("NIGHTHAWK_BENCHMARK_DURATION", 30))

benchmarks/dynamic_test/test_eds_churn_with_traffic.py

@@ -10,8 +10,8 @@
 from dynamic_config_envoy_proxy import (inject_dynamic_envoy_http_proxy_fixture, proxy_config)
 from benchmarks import utilities as benchmarks_utilities
 from typing import Generator
-from rules_python.python.runfiles import runfiles
-from nighthawk.api.configuration import endpoints_config_manager_pb2
+from python.runfiles import runfiles
+from api.configuration import endpoints_config_manager_pb2
 from test.integration import utility
 
 _BENCHMARK_DURATION = int(os.environ.get("NIGHTHAWK_BENCHMARK_DURATION", 30))

benchmarks/envoy_proxy.py

@@ -8,7 +8,7 @@
 import os
 import pytest
 import yaml
-from rules_python.python.runfiles import runfiles
+from python.runfiles import runfiles
 
 from test.integration import integration_test_fixtures, nighthawk_test_server, utility
 

benchmarks/static_benchmarks.py

@@ -11,7 +11,7 @@
 sys.path += [os.path.dirname(__file__)]
 
 if __name__ == '__main__':
-  path = os.path.dirname(os.path.realpath(__file__))
+  path = os.path.dirname(__file__)
   r = pytest.main([
       "--rootdir=" + path, "-x", (path + '/test/'), "-p", "no:cacheprovider", "--log-level", "INFO",
       "--log-cli-level", "INFO", *sys.argv

benchmarks/utilities.py

@@ -2,7 +2,7 @@
 
 import logging
 import json
-from rules_python.python.runfiles import runfiles
+from python.runfiles import runfiles
 import os
 import shutil
 

ci/docker-compose.yml

@@ -1,6 +1,7 @@
 x-envoy-build-base: &envoy-build-base
   image: >-
     ${ENVOY_BUILD_IMAGE:-docker.io/envoyproxy/envoy-build-ubuntu:f4a881a1205e8e6db1a57162faf3df7aed88eae8@sha256:b10346fe2eee41733dbab0e02322c47a538bf3938d093a5daebad9699860b814}
+  cpus: ${ENVOY_DOCKER_CPUS:-0}
   user: root:root
   working_dir: ${ENVOY_DOCKER_SOURCE_DIR:-/source}
   stdin_open: true

ci/docker/benchmark_build.sh

@@ -21,7 +21,8 @@ TMP_DIR="$(mktemp -d ${WORKSPACE}/tmp-docker-build-context-XXXXXXXX)"
 
 echo "Preparing docker build context in ${TMP_DIR}"
 cp -r "${WORKSPACE}/ci/docker/" "${TMP_DIR}/"
-cp -rL "${BAZEL_BIN}/benchmarks" "${TMP_DIR}"
+# Exclude any venv files since they aren't necessary and docker can't handle symlinks.
+rsync -a --exclude='*.venv/' "${BAZEL_BIN}/benchmarks" "${TMP_DIR}"
 
 cd "${TMP_DIR}"
 echo "running docker build ... "