From 4b660bf6c411fab3b8e9eff5597d1c5e165d7ecb Mon Sep 17 00:00:00 2001 From: Istio Automation Date: Tue, 20 Jan 2026 22:47:30 -0800 Subject: [PATCH 01/13] Automator: update envoy@ in istio/proxy@master (#6777) --- WORKSPACE | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/WORKSPACE b/WORKSPACE index cd6966b5355..7e28f210fab 100644 --- a/WORKSPACE +++ b/WORKSPACE @@ -23,9 +23,9 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed. # # Commit date: 2026-01-20 -ENVOY_SHA = "9c7136b8f8c559075fb7c76bcc7e0113b356a78a" +ENVOY_SHA = "f9cfbfed9a99b797c01354b3d95fc41697bafd91" -ENVOY_SHA256 = "d83c1f66ec79a7b9d1ddabe1a36456d2915101c80b597cde0ec02f3fa0d4b49b" +ENVOY_SHA256 = "7f4b378b6c1ddce367da7bc1cf66ada8c92e8425a0a8d436d74f810db6f528c1" ENVOY_ORG = "envoyproxy" From 4b53953dedb2c47c553cdb88323f0551c4e723c1 Mon Sep 17 00:00:00 2001 From: Istio Automation Date: Wed, 21 Jan 2026 20:37:28 -0800 Subject: [PATCH 02/13] Automator: update envoy@ in istio/proxy@master (#6778) --- WORKSPACE | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/WORKSPACE b/WORKSPACE index 7e28f210fab..61b09c6850f 100644 --- a/WORKSPACE +++ b/WORKSPACE @@ -22,10 +22,10 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") # 1. Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz` # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed. # -# Commit date: 2026-01-20 -ENVOY_SHA = "f9cfbfed9a99b797c01354b3d95fc41697bafd91" +# Commit date: 2026-01-21 +ENVOY_SHA = "187c09cb6eb7b783a7edcf7e1d92f83dcc994e16" -ENVOY_SHA256 = "7f4b378b6c1ddce367da7bc1cf66ada8c92e8425a0a8d436d74f810db6f528c1" +ENVOY_SHA256 = "5244a24de6d167ec648c14ca2a395733d4b44166e8b7c758b52e28d5421e492a" ENVOY_ORG = "envoyproxy" From 3c61fa105082456aeba068989a62f4c6274f6601 Mon Sep 17 00:00:00 2001 From: Keith Mattix II Date: Thu, 22 Jan 2026 19:56:29 -0600 Subject: [PATCH 03/13] Don't do workload discovery for cross-network traffic (#6767) * Get the implementation compiling * Add tests for cross-network peer metadata Signed-off-by: Keith Mattix II * clang-tidy Signed-off-by: Keith Mattix II * One more tidy Signed-off-by: Keith Mattix II * Switch to debug for logging Signed-off-by: Keith Mattix II --------- Signed-off-by: Keith Mattix II --- .../filters/http/peer_metadata/filter.cc | 35 ++++++++++- .../filters/http/peer_metadata/filter.h | 1 + .../filters/http/peer_metadata/filter_test.cc | 63 +++++++++++++++++++ 3 files changed, 96 insertions(+), 3 deletions(-) diff --git a/source/extensions/filters/http/peer_metadata/filter.cc b/source/extensions/filters/http/peer_metadata/filter.cc index cf7a47e91ee..e4645c65ffe 100644 --- a/source/extensions/filters/http/peer_metadata/filter.cc +++ b/source/extensions/filters/http/peer_metadata/filter.cc @@ -35,23 +35,38 @@ class XDSMethod : public DiscoveryMethod { public: XDSMethod(bool downstream, Server::Configuration::ServerFactoryContext& factory_context) : downstream_(downstream), - metadata_provider_(Extensions::Common::WorkloadDiscovery::GetProvider(factory_context)) {} + metadata_provider_(Extensions::Common::WorkloadDiscovery::GetProvider(factory_context)), + local_info_(factory_context.localInfo()) {} absl::optional derivePeerInfo(const StreamInfo::StreamInfo&, Http::HeaderMap&, Context&) const override; private: const bool downstream_; Extensions::Common::WorkloadDiscovery::WorkloadMetadataProviderSharedPtr metadata_provider_; + const LocalInfo::LocalInfo& local_info_; }; absl::optional XDSMethod::derivePeerInfo(const StreamInfo::StreamInfo& info, - Http::HeaderMap&, Context&) const { + Http::HeaderMap& headers, Context&) const { if (!metadata_provider_) { return {}; } Network::Address::InstanceConstSharedPtr peer_address; if (downstream_) { - peer_address = info.downstreamAddressProvider().remoteAddress(); + const auto origin_network_header = headers.get(Headers::get().ExchangeMetadataOriginNetwork); + const auto& local_metadata = local_info_.node().metadata(); + const auto& it = local_metadata.fields().find("NETWORK"); + // We might not have a local network configured in the single cluster case, so default to empty. + auto local_network = it != local_metadata.fields().end() ? it->second.string_value() : ""; + if (!origin_network_header.empty() && + origin_network_header[0]->value().getStringView() != local_network) { + ENVOY_LOG_MISC(debug, + "Origin network header present: {}; skipping downstream workload discovery", + origin_network_header[0]->value().getStringView()); + peer_address = {}; + } else { + peer_address = info.downstreamAddressProvider().remoteAddress(); + } } else { if (info.upstreamInfo().has_value()) { auto upstream_host = info.upstreamInfo().value().get().upstreamHost(); @@ -64,6 +79,20 @@ absl::optional XDSMethod::derivePeerInfo(const StreamInfo::StreamInfo& case Network::Address::Type::EnvoyInternal: if (upstream_host->metadata()) { const auto& filter_metadata = upstream_host->metadata()->filter_metadata(); + const auto& istio_it = filter_metadata.find("istio"); + if (istio_it != filter_metadata.end()) { + const auto& double_hbone_it = istio_it->second.fields().find("double_hbone"); + // This is an E/W gateway endpoint, so we should explicitly not use workload discovery + if (double_hbone_it != istio_it->second.fields().end()) { + ENVOY_LOG_MISC( + debug, + "Skipping upstream workload discovery for an endpoint on a remote network"); + peer_address = nullptr; + break; + } + } else { + ENVOY_LOG_MISC(debug, "No istio metadata found on upstream host."); + } const auto& it = filter_metadata.find("envoy.filters.listener.original_dst"); if (it != filter_metadata.end()) { const auto& destination_it = it->second.fields().find("local"); diff --git a/source/extensions/filters/http/peer_metadata/filter.h b/source/extensions/filters/http/peer_metadata/filter.h index 94da2a86c83..f57ac950868 100644 --- a/source/extensions/filters/http/peer_metadata/filter.h +++ b/source/extensions/filters/http/peer_metadata/filter.h @@ -32,6 +32,7 @@ using ::Envoy::Extensions::Filters::Common::Expr::CelStateType; struct HeaderValues { const Http::LowerCaseString ExchangeMetadataHeader{"x-envoy-peer-metadata"}; const Http::LowerCaseString ExchangeMetadataHeaderId{"x-envoy-peer-metadata-id"}; + const Http::LowerCaseString ExchangeMetadataOriginNetwork{"x-istio-origin-network"}; }; using Headers = ConstSingleton; diff --git a/source/extensions/filters/http/peer_metadata/filter_test.cc b/source/extensions/filters/http/peer_metadata/filter_test.cc index b355ed7f51c..0eb27cc6505 100644 --- a/source/extensions/filters/http/peer_metadata/filter_test.cc +++ b/source/extensions/filters/http/peer_metadata/filter_test.cc @@ -150,6 +150,30 @@ TEST_F(PeerMetadataTest, DownstreamXDS) { checkShared(false); } +TEST_F(PeerMetadataTest, DownstreamXDSCrossNetwork) { + request_headers_.setReference(Headers::get().ExchangeMetadataOriginNetwork, "remote-network"); + const WorkloadMetadataObject pod("pod-foo-1234", "my-cluster", "default", "foo", "foo-service", + "v1alpha3", "", "", Istio::Common::WorkloadType::Pod, ""); + EXPECT_CALL(*metadata_provider_, GetMetadata(_)) + .WillRepeatedly(Invoke([&](const Network::Address::InstanceConstSharedPtr& address) + -> std::optional { + if (absl::StartsWith(address->asStringView(), "127.0.0.1")) { + return {pod}; + } + return {}; + })); + initialize(R"EOF( + downstream_discovery: + - workload_discovery: {} + )EOF"); + EXPECT_EQ(1, request_headers_.size()); // We don't remove the header because we terminate the + // tunnel that delivered it + EXPECT_EQ(0, response_headers_.size()); + checkNoPeer(true); // No downstream peer because it's a cross-network request + checkNoPeer(false); + checkShared(false); +} + TEST_F(PeerMetadataTest, UpstreamXDS) { const WorkloadMetadataObject pod("pod-foo-1234", "my-cluster", "foo", "foo", "foo-service", "v1alpha3", "", "", Istio::Common::WorkloadType::Pod, ""); @@ -207,6 +231,45 @@ TEST_F(PeerMetadataTest, UpstreamXDSInternal) { checkPeerNamespace(false, "foo"); } +TEST_F(PeerMetadataTest, UpstreamXDSInternalCrossNetwork) { + Network::Address::InstanceConstSharedPtr upstream_address = + std::make_shared("internal_address", "endpoint_id"); + std::shared_ptr> upstream_host( + new NiceMock()); + EXPECT_CALL(*upstream_host, address()).WillRepeatedly(Return(upstream_address)); + stream_info_.upstreamInfo()->setUpstreamHost(upstream_host); + auto host_metadata = std::make_shared(); + ON_CALL(*upstream_host, metadata()).WillByDefault(testing::Return(host_metadata)); + TestUtility::loadFromYaml(R"EOF( + filter_metadata: + envoy.filters.listener.original_dst: + local: 127.0.0.100:80 + istio: + double_hbone: + hbone_target_address: 10.0.0.1 + )EOF", + *host_metadata); + + const WorkloadMetadataObject pod("pod-foo-1234", "my-cluster", "foo", "foo", "foo-service", + "v1alpha3", "", "", Istio::Common::WorkloadType::Pod, ""); + EXPECT_CALL(*metadata_provider_, GetMetadata(_)) + .WillRepeatedly(Invoke([&](const Network::Address::InstanceConstSharedPtr& address) + -> std::optional { + if (absl::StartsWith(address->asStringView(), "127.0.0.100")) { + return {pod}; + } + return {}; + })); + initialize(R"EOF( + upstream_discovery: + - workload_discovery: {} + )EOF"); + EXPECT_EQ(0, request_headers_.size()); + EXPECT_EQ(0, response_headers_.size()); + checkNoPeer(true); + checkNoPeer(false); // Shouldn't be any upstream filter state since it's a cross-network endpoint +} + TEST_F(PeerMetadataTest, DownstreamMXEmpty) { initialize(R"EOF( downstream_discovery: From 7a8f5b5b55dc6d4f2de3e1f1d8e0f589797b38a8 Mon Sep 17 00:00:00 2001 From: Istio Automation Date: Thu, 22 Jan 2026 20:36:29 -0800 Subject: [PATCH 04/13] Automator: update envoy@ in istio/proxy@master (#6782) --- WORKSPACE | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/WORKSPACE b/WORKSPACE index 61b09c6850f..c5784dc2d3a 100644 --- a/WORKSPACE +++ b/WORKSPACE @@ -22,10 +22,10 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") # 1. Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz` # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed. # -# Commit date: 2026-01-21 -ENVOY_SHA = "187c09cb6eb7b783a7edcf7e1d92f83dcc994e16" +# Commit date: 2026-01-23 +ENVOY_SHA = "e16ab1e0d312dd455002500cf0b7d2f4d7c171e3" -ENVOY_SHA256 = "5244a24de6d167ec648c14ca2a395733d4b44166e8b7c758b52e28d5421e492a" +ENVOY_SHA256 = "3fc0850911c131d165967a9f7e34e863d01b3a0aaf5e9479d4738d2fbcd01a85" ENVOY_ORG = "envoyproxy" From 3e5e253302a0b58b3ae01a57be8344e8861297c5 Mon Sep 17 00:00:00 2001 From: Istio Automation Date: Fri, 23 Jan 2026 21:03:30 -0800 Subject: [PATCH 05/13] Automator: update envoy@ in istio/proxy@master (#6784) --- WORKSPACE | 6 +++--- envoy.bazelrc | 1 - 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/WORKSPACE b/WORKSPACE index c5784dc2d3a..0826ac878e5 100644 --- a/WORKSPACE +++ b/WORKSPACE @@ -22,10 +22,10 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") # 1. Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz` # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed. # -# Commit date: 2026-01-23 -ENVOY_SHA = "e16ab1e0d312dd455002500cf0b7d2f4d7c171e3" +# Commit date: 2026-01-24 +ENVOY_SHA = "6aa6dac0a0ea4b4f90f2ce7487807edb733e4ff6" -ENVOY_SHA256 = "3fc0850911c131d165967a9f7e34e863d01b3a0aaf5e9479d4738d2fbcd01a85" +ENVOY_SHA256 = "e5e07bfaaabce1acbd7a48574c4d4cdf01f74591ab70505d4902f4c1737da3c7" ENVOY_ORG = "envoyproxy" diff --git a/envoy.bazelrc b/envoy.bazelrc index 5af2c3c3a66..ab664f185fe 100644 --- a/envoy.bazelrc +++ b/envoy.bazelrc @@ -209,7 +209,6 @@ build:compile-time-options --define=log_debug_assert_in_release=enabled build:compile-time-options --define=path_normalization_by_default=true build:compile-time-options --define=deprecated_features=disabled build:compile-time-options --define=tcmalloc=gperftools -build:compile-time-options --define=zlib=ng build:compile-time-options --define=uhv=enabled # gRPC has a lot of deprecated-enum-enum-conversion warnings with C++20 build:compile-time-options --copt=-Wno-error=deprecated-enum-enum-conversion From 4b3b8e7ff846c0b2a52ba2e2281f6a0a845687d7 Mon Sep 17 00:00:00 2001 From: Istio Automation Date: Sat, 24 Jan 2026 18:20:31 -0800 Subject: [PATCH 06/13] Automator: update go-control-plane in istio/proxy@master (#6786) --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index d9c6cc373eb..f211e106beb 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,7 @@ go 1.24.0 require ( github.com/cncf/xds/go v0.0.0-20251110193048-8bfbf64dc13e github.com/envoyproxy/go-control-plane v0.14.1-0.20260103185439-d6ff64e48402 - github.com/envoyproxy/go-control-plane/envoy v1.36.1-0.20260117034604-3a80eae751cf + github.com/envoyproxy/go-control-plane/envoy v1.36.1-0.20260124093652-ddecef433399 github.com/golang/protobuf v1.5.4 github.com/google/go-cmp v0.7.0 github.com/prometheus/client_model v0.6.2 diff --git a/go.sum b/go.sum index f6278bd8c8e..53f55698d1d 100644 --- a/go.sum +++ b/go.sum @@ -7,8 +7,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/envoyproxy/go-control-plane v0.14.1-0.20260103185439-d6ff64e48402 h1:Jm3kw/Enxm3pcwPwKpjNanZSVq6N/XyA0pkcLI9BVpk= github.com/envoyproxy/go-control-plane v0.14.1-0.20260103185439-d6ff64e48402/go.mod h1:iuP4OVLgz85ISHlL+dS0cf6wg5cCz/KmuySk+g+F3uY= -github.com/envoyproxy/go-control-plane/envoy v1.36.1-0.20260117034604-3a80eae751cf h1:xZp0i/4HHESpsaPxpTy1am8g0JUFjw7JMR58ECOD7Qo= -github.com/envoyproxy/go-control-plane/envoy v1.36.1-0.20260117034604-3a80eae751cf/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A= +github.com/envoyproxy/go-control-plane/envoy v1.36.1-0.20260124093652-ddecef433399 h1:cTrEVtd48YOyrc24AcZHJGAxg8uvaYjqWlq1/QTp++U= +github.com/envoyproxy/go-control-plane/envoy v1.36.1-0.20260124093652-ddecef433399/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A= github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI= github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4= github.com/envoyproxy/protoc-gen-validate v1.3.0 h1:TvGH1wof4H33rezVKWSpqKz5NXWg5VPuZ0uONDT6eb4= From 0d33070e103b09ea10053804193e744bc9274ffa Mon Sep 17 00:00:00 2001 From: Istio Automation Date: Sat, 24 Jan 2026 20:42:31 -0800 Subject: [PATCH 07/13] Automator: update envoy@ in istio/proxy@master (#6787) --- WORKSPACE | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/WORKSPACE b/WORKSPACE index 0826ac878e5..6ffbc818074 100644 --- a/WORKSPACE +++ b/WORKSPACE @@ -23,9 +23,9 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed. # # Commit date: 2026-01-24 -ENVOY_SHA = "6aa6dac0a0ea4b4f90f2ce7487807edb733e4ff6" +ENVOY_SHA = "7d9d208119a6ec5fa985a6e3d77f82ccecd90b0d" -ENVOY_SHA256 = "e5e07bfaaabce1acbd7a48574c4d4cdf01f74591ab70505d4902f4c1737da3c7" +ENVOY_SHA256 = "30ec8aaa2a4415e4e3375b4f2e73fec8841a22695a2e06dacb22d576ac88b309" ENVOY_ORG = "envoyproxy" From cf53116c462740e9322a30fadcfab400c8173318 Mon Sep 17 00:00:00 2001 From: Istio Automation Date: Sun, 25 Jan 2026 20:53:25 -0800 Subject: [PATCH 08/13] Automator: update envoy@ in istio/proxy@master (#6788) --- WORKSPACE | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/WORKSPACE b/WORKSPACE index 6ffbc818074..7b4ea23989d 100644 --- a/WORKSPACE +++ b/WORKSPACE @@ -22,10 +22,10 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") # 1. Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz` # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed. # -# Commit date: 2026-01-24 -ENVOY_SHA = "7d9d208119a6ec5fa985a6e3d77f82ccecd90b0d" +# Commit date: 2026-01-25 +ENVOY_SHA = "2d3d05dff994eae57b628a765d9cc4958bd1b77e" -ENVOY_SHA256 = "30ec8aaa2a4415e4e3375b4f2e73fec8841a22695a2e06dacb22d576ac88b309" +ENVOY_SHA256 = "4736449a64d33049e8e4c81fd97b1206014cc2ca837f2e2c61111df6c3438d73" ENVOY_ORG = "envoyproxy" From 4c3823dba785e05c0002a419964a1431f40e87ff Mon Sep 17 00:00:00 2001 From: Ian Rudie Date: Mon, 26 Jan 2026 20:55:40 -0500 Subject: [PATCH 09/13] update x-network header key (#6790) Signed-off-by: Ian Rudie --- source/extensions/filters/http/peer_metadata/filter.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source/extensions/filters/http/peer_metadata/filter.h b/source/extensions/filters/http/peer_metadata/filter.h index f57ac950868..cf0d68803c4 100644 --- a/source/extensions/filters/http/peer_metadata/filter.h +++ b/source/extensions/filters/http/peer_metadata/filter.h @@ -32,7 +32,7 @@ using ::Envoy::Extensions::Filters::Common::Expr::CelStateType; struct HeaderValues { const Http::LowerCaseString ExchangeMetadataHeader{"x-envoy-peer-metadata"}; const Http::LowerCaseString ExchangeMetadataHeaderId{"x-envoy-peer-metadata-id"}; - const Http::LowerCaseString ExchangeMetadataOriginNetwork{"x-istio-origin-network"}; + const Http::LowerCaseString ExchangeMetadataOriginNetwork{"x-forwarded-network"}; }; using Headers = ConstSingleton; From 9f478b1d01158ac20dda909714239da886da4b1e Mon Sep 17 00:00:00 2001 From: Istio Automation Date: Mon, 26 Jan 2026 20:55:41 -0800 Subject: [PATCH 10/13] Automator: update envoy@ in istio/proxy@master (#6794) --- WORKSPACE | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/WORKSPACE b/WORKSPACE index 7b4ea23989d..67f58670866 100644 --- a/WORKSPACE +++ b/WORKSPACE @@ -22,10 +22,10 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive") # 1. Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz` # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed. # -# Commit date: 2026-01-25 -ENVOY_SHA = "2d3d05dff994eae57b628a765d9cc4958bd1b77e" +# Commit date: 2026-01-27 +ENVOY_SHA = "450b21f19863373396d3c586437d3cb49c88486c" -ENVOY_SHA256 = "4736449a64d33049e8e4c81fd97b1206014cc2ca837f2e2c61111df6c3438d73" +ENVOY_SHA256 = "9365d37689c24c1de63f21c4fa6cae148fcc9e9721b69e72da64d2d5a4c2cae2" ENVOY_ORG = "envoyproxy" From 06f723fbd7e7ca5f93bd1cdef546174df9993215 Mon Sep 17 00:00:00 2001 From: Mikhail Krinkin Date: Tue, 27 Jan 2026 11:24:14 +0000 Subject: [PATCH 11/13] Merge upstream/master and resolve merge conflicts Signed-off-by: Mikhail Krinkin --- .../extensions/filters/http/peer_metadata/filter_test.cc | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/source/extensions/filters/http/peer_metadata/filter_test.cc b/source/extensions/filters/http/peer_metadata/filter_test.cc index ada3e39ae76..04ce543d47c 100644 --- a/source/extensions/filters/http/peer_metadata/filter_test.cc +++ b/source/extensions/filters/http/peer_metadata/filter_test.cc @@ -177,8 +177,8 @@ TEST_F(PeerMetadataTest, DownstreamXDSCrossNetwork) { TEST_F(PeerMetadataTest, UpstreamXDS) { const WorkloadMetadataObject pod("pod-foo-1234", "my-cluster", "foo", "foo", "foo-service", - "v1alpha3", "", "", Istio::Common::WorkloadType::Pod, "", "", - ""); + "v1alpha3", "", "", Istio::Common::WorkloadType::Pod, "", "", "", + "", ""); EXPECT_CALL(*metadata_provider_, GetMetadata(_)) .WillRepeatedly(Invoke([&](const Network::Address::InstanceConstSharedPtr& address) -> std::optional { @@ -254,7 +254,8 @@ TEST_F(PeerMetadataTest, UpstreamXDSInternalCrossNetwork) { *host_metadata); const WorkloadMetadataObject pod("pod-foo-1234", "my-cluster", "foo", "foo", "foo-service", - "v1alpha3", "", "", Istio::Common::WorkloadType::Pod, ""); + "v1alpha3", "", "", Istio::Common::WorkloadType::Pod, "", "", + ""); EXPECT_CALL(*metadata_provider_, GetMetadata(_)) .WillRepeatedly(Invoke([&](const Network::Address::InstanceConstSharedPtr& address) -> std::optional { From 421be48ecd1952070d15009af18a55f332d3ff25 Mon Sep 17 00:00:00 2001 From: Mikhail Krinkin Date: Tue, 27 Jan 2026 11:47:01 +0000 Subject: [PATCH 12/13] Missed one Signed-off-by: Mikhail Krinkin --- source/extensions/filters/http/peer_metadata/filter_test.cc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/source/extensions/filters/http/peer_metadata/filter_test.cc b/source/extensions/filters/http/peer_metadata/filter_test.cc index 04ce543d47c..9391178e9ad 100644 --- a/source/extensions/filters/http/peer_metadata/filter_test.cc +++ b/source/extensions/filters/http/peer_metadata/filter_test.cc @@ -154,7 +154,8 @@ TEST_F(PeerMetadataTest, DownstreamXDS) { TEST_F(PeerMetadataTest, DownstreamXDSCrossNetwork) { request_headers_.setReference(Headers::get().ExchangeMetadataOriginNetwork, "remote-network"); const WorkloadMetadataObject pod("pod-foo-1234", "my-cluster", "default", "foo", "foo-service", - "v1alpha3", "", "", Istio::Common::WorkloadType::Pod, ""); + "v1alpha3", "", "", Istio::Common::WorkloadType::Pod, "", "", + ""); EXPECT_CALL(*metadata_provider_, GetMetadata(_)) .WillRepeatedly(Invoke([&](const Network::Address::InstanceConstSharedPtr& address) -> std::optional { From cbcb7ff983e305ef770cfc01ef1eb6f879f3e02a Mon Sep 17 00:00:00 2001 From: Mikhail Krinkin Date: Tue, 27 Jan 2026 11:54:44 +0000 Subject: [PATCH 13/13] Fixed a wrong one Signed-off-by: Mikhail Krinkin --- source/extensions/filters/http/peer_metadata/filter_test.cc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/source/extensions/filters/http/peer_metadata/filter_test.cc b/source/extensions/filters/http/peer_metadata/filter_test.cc index 9391178e9ad..6c0dd8b3b89 100644 --- a/source/extensions/filters/http/peer_metadata/filter_test.cc +++ b/source/extensions/filters/http/peer_metadata/filter_test.cc @@ -178,8 +178,8 @@ TEST_F(PeerMetadataTest, DownstreamXDSCrossNetwork) { TEST_F(PeerMetadataTest, UpstreamXDS) { const WorkloadMetadataObject pod("pod-foo-1234", "my-cluster", "foo", "foo", "foo-service", - "v1alpha3", "", "", Istio::Common::WorkloadType::Pod, "", "", "", - "", ""); + "v1alpha3", "", "", Istio::Common::WorkloadType::Pod, "", "", + ""); EXPECT_CALL(*metadata_provider_, GetMetadata(_)) .WillRepeatedly(Invoke([&](const Network::Address::InstanceConstSharedPtr& address) -> std::optional {