Skip to content

Fix istio proxy build after moving Envoy to hermteic toolchain #6726

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
istio-testing merged 13 commits into from
Jan 8, 2026
Merged

Fix istio proxy build after moving Envoy to hermteic toolchain #6726

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
93f83d0
Fix istio proxy build after moving Envoy to hermteic toolchain
krinkinmu Dec 5, 2025
740a17f
Switch to --config=clang from --config=clang-local
krinkinmu Dec 9, 2025
48b1877
Override default sysroot to use one with glibc 2.28
krinkinmu Dec 12, 2025
702b2e4
Fix WOKSPACE formatting
krinkinmu Dec 12, 2025
cadcf77
Explicitly specify sysroot path in the llvm_toolchain rule
krinkinmu Dec 15, 2025
292f757
Fix formatting
krinkinmu Dec 15, 2025
b6576b9
Bump up Envoy version to include liburing fix
krinkinmu Dec 15, 2025
76f8560
Just use plain envoy_toolchain() without custom overrides
krinkinmu Jan 6, 2026
8c064bf
Temporarily add a few debugging flags for remote builds
krinkinmu Jan 7, 2026
88a84c0
Tweak bazel parameters to reduce memory footprint and increase heap size
krinkinmu Jan 7, 2026
af91a8e
Return back the 3gb limit
krinkinmu Jan 7, 2026
88d3d84
Set heap to 4gb and remove memory optimization flags
krinkinmu Jan 7, 2026
99fd632
Reduce bazel memory consumption on CI by discarding unused caches
krinkinmu Jan 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions .bazelrc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,13 +14,17 @@ build:remote --remote_timeout=7200
# ========================================

# Enable libc++ and C++20 by default.
build:linux --config=clang-local
build:linux --config=clang

# put /usr/local/bin before /usr/bin to avoid picking up wrong python3.6 when building envoy.tls.key_providers.cryptomb
build:linux --action_env=PATH=/usr/lib/llvm/bin:/usr/local/bin:/bin:/usr/bin
build:linux --action_env=PATH=/usr/local/bin:/bin:/usr/bin

# Need for CI image to pickup docker-credential-gcloud, PATH is fixed in rbe-toolchain-* configs.
build:remote-ci --action_env=PATH=/usr/local/google-cloud-sdk/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/llvm/bin
# These flags reduce bazel memory consumption at the cost of slower incremental builds
# CI builds are not incremental, since we build with a clean state, so the performance impact is not
# relevant for CI
build:remote-ci --discard_analysis_cache --nokeep_state_after_build --notrack_incremental_state

# Enable path normalization by default.
# See: https://github.com/envoyproxy/envoy/pull/6519
Expand Down Expand Up @@ -50,9 +54,6 @@ build:debug -c dbg
build --cxxopt -Wformat
build --cxxopt -Wformat-security

build:clang --host_action_env=CC=
build:clang --host_action_env=CXX=

# CI sanitizer configuration
#
build:clang-asan-ci --config=asan
Expand Down
15 changes: 11 additions & 4 deletions WORKSPACE
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,10 +22,10 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
# 1. Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz`
# 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed.
#
# Commit date: 2025-12-02
ENVOY_SHA = "44b00e0264cfcdbbc593998a407b3f957ec28c77"
# Commit date: 2025-12-12
ENVOY_SHA = "8af856ea730c1738cd9e4b8db7d439bdbb121bd1"

ENVOY_SHA256 = "1c8bc33cf9b758604042212d69d8bc37f41991facc43ed139d070b6b94aeddb0"
ENVOY_SHA256 = "3c178d4d8178455264080e9ded92881cfb2c521d2e2acff33ddfb0827a0471f9"

ENVOY_ORG = "envoyproxy"

Expand Down Expand Up @@ -64,7 +64,10 @@ envoy_bazel_dependencies()

load("@envoy//bazel:repositories_extra.bzl", "envoy_dependencies_extra")

envoy_dependencies_extra(ignore_root_user_error = True)
envoy_dependencies_extra(
glibc_version = "2.28",
ignore_root_user_error = True,
)

load("@envoy//bazel:python_dependencies.bzl", "envoy_python_dependencies")

Expand All @@ -85,3 +88,7 @@ envoy_repo()
load("@envoy//bazel:toolchains.bzl", "envoy_toolchains")

envoy_toolchains()

load("@llvm_toolchain//:toolchains.bzl", "llvm_register_toolchains")

llvm_register_toolchains()
16 changes: 4 additions & 12 deletions envoy.bazelrc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
# The number 3G is chosen heuristically to both support large VM and small VM with RBE.
# Startup options cannot be selected via config.
# TODO: Adding just to test android
startup --host_jvm_args=-Xmx3g
startup --host_jvm_args=-Xmx4g
startup --host_jvm_args="-DBAZEL_TRACK_SOURCE_DIRECTORIES=1"


Expand Down Expand Up @@ -45,12 +45,6 @@ build --incompatible_merge_fixed_and_default_shell_env
# A workaround for slow ICU download.
build --http_timeout_scaling=6.0

# Pass CC, CXX and LLVM_CONFIG variables from the environment.
# We assume they have stable values, so this won't cause action cache misses.
build --action_env=CC --host_action_env=CC
build --action_env=CXX --host_action_env=CXX
build --action_env=LLVM_CONFIG --host_action_env=LLVM_CONFIG

# Allow stamped caches to bust when local filesystem changes.
# Requires setting `BAZEL_VOLATILE_DIRTY` in the env.
build --action_env=BAZEL_VOLATILE_DIRTY --host_action_env=BAZEL_VOLATILE_DIRTY
Expand Down Expand Up @@ -99,7 +93,6 @@ build:linux --cxxopt=-fsized-deallocation --host_cxxopt=-fsized-deallocation
build:linux --conlyopt=-fexceptions
build:linux --fission=dbg,opt
build:linux --features=per_object_debug_info
build:linux --action_env=BAZEL_LINKOPTS=-lm:-fuse-ld=gold

# macOS
build:macos --action_env=PATH=/opt/homebrew/bin:/opt/local/bin:/usr/local/bin:/usr/bin:/bin
Expand All @@ -114,15 +107,14 @@ build:macos --cxxopt=-Wno-nullability-completeness

# Common flags for Clang (shared between all clang variants)
common:clang-common --linkopt=-fuse-ld=lld
common:clang-common --action_env=BAZEL_COMPILER=clang
common:clang-common --action_env=LDFLAGS="-fuse-ld=lld"
common:clang-common --action_env=CC=clang --host_action_env=CC=clang
common:clang-common --action_env=CXX=clang++ --host_action_env=CXX=clang++
common:clang-common --@toolchains_llvm//toolchain/config:compiler-rt=false
common:clang-common --@toolchains_llvm//toolchain/config:libunwind=false

# Clang with libc++ (default)
common:clang --config=clang-common
common:clang --config=libc++
common:clang --host_platform=@clang_platform
common:clang --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1

# Clang installed to non-standard location (ie not /opt/llvm/)
common:clang-local --config=clang-common
Expand Down