Add tooling to automatically sync proto versions (#2021)

* Add script to sync protobuf versions

* Updates to protobuf files

* Update generated code

* Fix release locks

gen.sh

@@ -16,6 +16,9 @@
 
 set -eu
 
+# Sync API versions
+scripts/sync.sh
+
 # Generate all protos
 buf generate \
   --path networking \

networking/v1alpha3/destination_rule.proto

@@ -194,6 +194,9 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // +genclient
 // +k8s:deepcopy-gen=true
 // -->
+// <!-- istio code generation tags
+// +istio.io/sync-start
+// -->
 message DestinationRule {
   // The name of a service from the service registry. Service
   // names are looked up from the platform's service registry (e.g.,
@@ -615,13 +618,13 @@ message ConnectionPoolSettings {
     // cluster at a given time. Defaults to 2^32-1.
     int32 max_retries = 4;
 
-    // The idle timeout for upstream connection pool connections. The idle timeout 
+    // The idle timeout for upstream connection pool connections. The idle timeout
     // is defined as the period in which there are no active requests.
-    // If not set, the default is 1 hour. When the idle timeout is reached, 
-    // the connection will be closed. If the connection is an HTTP/2 
-    // connection a drain sequence will occur prior to closing the connection. 
-    // Note that request based timeouts mean that HTTP/2 PINGs will not 
-    // keep the connection alive. Applies to both HTTP1.1 and HTTP2 connections. 
+    // If not set, the default is 1 hour. When the idle timeout is reached,
+    // the connection will be closed. If the connection is an HTTP/2
+    // connection a drain sequence will occur prior to closing the connection.
+    // Note that request based timeouts mean that HTTP/2 PINGs will not
+    // keep the connection alive. Applies to both HTTP1.1 and HTTP2 connections.
     google.protobuf.Duration idle_timeout = 5;
 
     // Policy for upgrading http1.1 connections to http2.

networking/v1alpha3/gateway.proto

@@ -372,6 +372,9 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // +genclient
 // +k8s:deepcopy-gen=true
 // -->
+// <!-- istio code generation tags
+// +istio.io/sync-start
+// -->
 message Gateway {
   // A list of server specifications.
   repeated Server servers = 1 [(google.api.field_behavior) = REQUIRED];
@@ -675,8 +678,8 @@ message ServerTLSSettings {
   // holds the TLS certs including the CA certificates. Applicable
   // only on Kubernetes. The secret (of type `generic`) should
   // contain the following keys and values: `key:
-  // <privateKey>` and `cert: <serverCert>`. For mutual TLS, 
-  // `cacert: <CACertificate>` can be provided in the same secret or 
+  // <privateKey>` and `cert: <serverCert>`. For mutual TLS,
+  // `cacert: <CACertificate>` can be provided in the same secret or
   // a separate secret named `<secret>-cacert`.
   // Secret of type tls for server certificates along with
   // ca.crt key for CA certificates is also supported.

networking/v1alpha3/service_entry.proto

@@ -805,6 +805,9 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // +genclient
 // +k8s:deepcopy-gen=true
 // -->
+// <!-- istio code generation tags
+// +istio.io/sync-start
+// -->
 message ServiceEntry {
   // The hosts associated with the ServiceEntry. Could be a DNS
   // name with wildcard prefix.

networking/v1alpha3/sidecar.proto

@@ -427,6 +427,9 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // +genclient
 // +k8s:deepcopy-gen=true
 // -->
+// <!-- istio code generation tags
+// +istio.io/sync-start
+// -->
 message Sidecar {
   // Criteria used to select the specific set of pods/VMs on which this
   // `Sidecar` configuration should be applied. If omitted, the `Sidecar`
@@ -607,7 +610,7 @@ message OutboundTrafficPolicy {
   // Envoy's dynamic forward proxy can handle only HTTP and TLS
   // connections.
   // $hide_from_docs
-  istio.networking.v1alpha3.Destination egress_proxy = 2;
+  Destination egress_proxy = 2;
 }
 
 

networking/v1alpha3/virtual_service.proto

@@ -202,6 +202,9 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // +genclient
 // +k8s:deepcopy-gen=true
 // -->
+// <!-- istio code generation tags
+// +istio.io/sync-start
+// -->
 message VirtualService {
   // The destination hosts to which traffic is being sent. Could
   // be a DNS name with wildcard prefix or an IP address.  Depending on the
@@ -284,9 +287,6 @@ message VirtualService {
   // The value "." is reserved and defines an export to the same namespace that
   // the virtual service is declared in. Similarly the value "*" is reserved and
   // defines an export to all namespaces.
-  //
-  // NOTE: in the current release, the `exportTo` value is restricted to
-  // "." or "*" (i.e., the current namespace or all namespaces).
   repeated string export_to = 6;
 }
 
@@ -515,7 +515,7 @@ message VirtualService {
 //     protocol: HTTP
 //   resolution: DNS
 // ---
-// apiVersion: networking.istio.io/v1alpha3
+// apiVersion: networking.istio.io/v1beta1
 // kind: VirtualService
 // metadata:
 //   name: my-wiki-rule

networking/v1alpha3/workload_entry.proto

@@ -257,6 +257,9 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // +genclient
 // +k8s:deepcopy-gen=true
 // -->
+// <!-- istio code generation tags
+// +istio.io/sync-start
+// -->
 message WorkloadEntry {
   // Address associated with the network endpoint without the
   // port.  Domain names can be used if and only if the resolution is set

networking/v1beta1/destination_rule.proto

@@ -194,6 +194,9 @@ option go_package = "istio.io/api/networking/v1beta1";
 // +genclient
 // +k8s:deepcopy-gen=true
 // -->
+// <!-- istio code generation tags
+// +istio.io/sync-from:networking/v1alpha3/destination_rule.proto
+// -->
 message DestinationRule {
   // The name of a service from the service registry. Service
   // names are looked up from the platform's service registry (e.g.,

networking/v1beta1/gateway.proto

@@ -372,6 +372,9 @@ option go_package = "istio.io/api/networking/v1beta1";
 // +genclient
 // +k8s:deepcopy-gen=true
 // -->
+// <!-- istio code generation tags
+// +istio.io/sync-from:networking/v1alpha3/gateway.proto
+// -->
 message Gateway {
   // A list of server specifications.
   repeated Server servers = 1 [(google.api.field_behavior) = REQUIRED];
@@ -546,17 +549,16 @@ message Server {
   // HTTP services, it can also be used for TCP services using TLS with SNI.
   // A host is specified as a `dnsName` with an optional `namespace/` prefix.
   // The `dnsName` should be specified using FQDN format, optionally including
-  // a wildcard character in the left-most component (e.g.,
-  // `prod/*.example.com`). Set the `dnsName` to `*` to select all
-  // `VirtualService` hosts from the specified namespace (e.g.,`prod/*`).
+  // a wildcard character in the left-most component (e.g., `prod/*.example.com`).
+  // Set the `dnsName` to `*` to select all `VirtualService` hosts from the
+  // specified namespace (e.g.,`prod/*`).
   //
   // The `namespace` can be set to `*` or `.`, representing any or the current
   // namespace, respectively. For example, `*/foo.example.com` selects the
   // service from any available namespace while `./foo.example.com` only selects
-  // the service from the namespace of the sidecar. The default, if no
-  // `namespace/` is specified, is `*/`, that is, select services from any
-  // namespace. Any associated `DestinationRule` in the selected namespace will
-  // also be used.
+  // the service from the namespace of the sidecar. The default, if no `namespace/`
+  // is specified, is `*/`, that is, select services from any namespace.
+  // Any associated `DestinationRule` in the selected namespace will also be used.
   //
   // A `VirtualService` must be bound to the gateway and must have one or
   // more hosts that match the hosts specified in a server. The match

networking/v1beta1/service_entry.proto

@@ -805,6 +805,9 @@ option go_package = "istio.io/api/networking/v1beta1";
 // +genclient
 // +k8s:deepcopy-gen=true
 // -->
+// <!-- istio code generation tags
+// +istio.io/sync-from:networking/v1alpha3/service_entry.proto
+// -->
 message ServiceEntry {
   // The hosts associated with the ServiceEntry. Could be a DNS
   // name with wildcard prefix.

networking/v1beta1/sidecar.proto

@@ -427,6 +427,9 @@ option go_package = "istio.io/api/networking/v1beta1";
 // +genclient
 // +k8s:deepcopy-gen=true
 // -->
+// <!-- istio code generation tags
+// +istio.io/sync-from:networking/v1alpha3/sidecar.proto
+// -->
 message Sidecar {
   // Criteria used to select the specific set of pods/VMs on which this
   // `Sidecar` configuration should be applied. If omitted, the `Sidecar`
@@ -607,7 +610,7 @@ message OutboundTrafficPolicy {
   // Envoy's dynamic forward proxy can handle only HTTP and TLS
   // connections.
   // $hide_from_docs
-  istio.networking.v1beta1.Destination egress_proxy = 2;
+  Destination egress_proxy = 2;
 }