code: cleanup includes - use "include what you use" model

.github/workflows/build-envoy-images-release.yaml

@@ -79,7 +79,7 @@ jobs:
             ARCHIVE_IMAGE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder:test-main-archive-latest
             COPY_CACHE_EXT=.new
             BAZEL_BUILD_OPTS="--jobs=HOST_CPUS*.75"
-            BAZEL_TEST_OPTS=--test_timeout=300 --local_test_jobs=1 --flaky_test_attempts=3
+            BAZEL_TEST_OPTS=--test_timeout=600 --local_test_jobs=1 --flaky_test_attempts=3
           push: true
           tags: quay.io/${{ github.repository_owner }}/cilium-envoy-builder:test-main-archive-latest
 
@@ -104,7 +104,7 @@ jobs:
             BUILDER_BASE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder:test-${{ env.BUILDER_DOCKER_HASH }}
             ARCHIVE_IMAGE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder:test-main-archive-latest
             BAZEL_BUILD_OPTS=--remote_upload_local_results=false
-            BAZEL_TEST_OPTS=--test_timeout=300 --local_test_jobs=1 --flaky_test_attempts=3
+            BAZEL_TEST_OPTS=--test_timeout=600 --local_test_jobs=1 --flaky_test_attempts=3
           cache-to: type=local,dest=/tmp/buildx-cache,mode=max
           push: true
           tags: quay.io/${{ github.repository_owner }}/cilium-envoy:latest-testlogs

.github/workflows/ci-tests.yaml

@@ -18,23 +18,23 @@ jobs:
     name: Run unit tests for proxylib
     runs-on: ubuntu-latest
     steps:
-    - name: Install Go
-      uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
-      with:
-        # renovate: datasource=golang-version depName=go
-        go-version: 1.23.4
-    - name: Checkout code
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        persist-credentials: false
-    - name: Check module vendoring
-      run: |
-        go mod tidy
-        go mod vendor
-        test -z "$(git status --porcelain)" || (echo "please run 'go mod tidy && go mod vendor', and submit your changes"; exit 1)
-    - name: Run unit tests
-      run: |
-        make -C proxylib test
+      - name: Install Go
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
+        with:
+          # renovate: datasource=golang-version depName=go
+          go-version: 1.23.4
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - name: Check module vendoring
+        run: |
+          go mod tidy
+          go mod vendor
+          test -z "$(git status --porcelain)" || (echo "please run 'go mod tidy && go mod vendor', and submit your changes"; exit 1)
+      - name: Run unit tests
+        run: |
+          make -C proxylib test
 
   tests:
     timeout-minutes: 360
@@ -104,6 +104,6 @@ jobs:
             BUILDER_BASE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder-dev:test-${{ env.BUILDER_DOCKER_HASH }}
             ARCHIVE_IMAGE=quay.io/${{ github.repository_owner }}/cilium-envoy-builder:test-main-archive-latest
             BAZEL_BUILD_OPTS=--remote_upload_local_results=false
-            BAZEL_TEST_OPTS=--test_timeout=300 --local_test_jobs=1 --flaky_test_attempts=3
+            BAZEL_TEST_OPTS=--test_timeout=600 --local_test_jobs=1 --flaky_test_attempts=3
           cache-from: type=local,src=/tmp/buildx-cache
           push: false

Makefile

@@ -30,7 +30,7 @@ ifdef BAZEL_REMOTE_CACHE
   BAZEL_BUILD_OPTS += --remote_cache=$(BAZEL_REMOTE_CACHE)
 endif
 
-BAZEL_TEST_OPTS ?= --jobs=HOST_RAM*.0003 --test_timeout=300 --local_test_jobs=1 --flaky_test_attempts=3
+BAZEL_TEST_OPTS ?= --jobs=HOST_RAM*.0003 --test_timeout=600 --local_test_jobs=1 --flaky_test_attempts=3
 BAZEL_TEST_OPTS += --test_output=errors
 
 BUILDARCH := $(subst aarch64,arm64,$(subst x86_64,amd64,$(shell uname -m)))

cilium/accesslog.cc

@@ -1,13 +1,32 @@
 #include "accesslog.h"
 
-#include <errno.h>
 #include <stdlib.h>
 #include <sys/socket.h>
 #include <sys/un.h>
 #include <unistd.h>
 
+#include <chrono>
+#include <cstdint>
+#include <map>
+#include <memory>
+#include <string>
+
+#include "envoy/common/time.h"
+#include "envoy/http/header_map.h"
+#include "envoy/http/protocol.h"
+#include "envoy/network/address.h"
+#include "envoy/stream_info/stream_info.h"
+
 #include "source/common/common/lock_guard.h"
-#include "source/common/common/utility.h"
+#include "source/common/common/logger.h"
+#include "source/common/common/thread.h"
+#include "source/common/protobuf/protobuf.h" // IWYU pragma: keep
+#include "source/common/protobuf/utility.h"
+
+#include "absl/strings/numbers.h"
+#include "absl/strings/string_view.h"
+#include "cilium/api/accesslog.pb.h"
+#include "cilium/uds_client.h"
 
 namespace Envoy {
 namespace Cilium {

cilium/accesslog.h

@@ -1,13 +1,21 @@
 #pragma once
 
+#include <cstdint>
 #include <map>
+#include <memory>
 #include <string>
 
+#include "envoy/common/time.h"
 #include "envoy/http/header_map.h"
-#include "envoy/network/connection.h"
-#include "envoy/router/router.h"
+#include "envoy/network/address.h"
+#include "envoy/stream_info/filter_state.h"
 #include "envoy/stream_info/stream_info.h"
 
+#include "source/common/common/thread.h"
+#include "source/common/protobuf/protobuf.h" // IWYU pragma: keep
+
+#include "absl/base/thread_annotations.h"
+#include "absl/strings/string_view.h"
 #include "cilium/api/accesslog.pb.h"
 #include "cilium/uds_client.h"
 

cilium/bpf.cc

@@ -1,7 +1,14 @@
 #include "cilium/bpf.h"
 
 #include <errno.h>
+#include <unistd.h>
 
+#include <cstdint>
+#include <fstream>
+#include <sstream>
+#include <string>
+
+#include "source/common/common/logger.h"
 #include "source/common/common/utility.h"
 
 #include "cilium/privileged_service_client.h"

cilium/bpf.h

@@ -1,15 +1,9 @@
 #pragma once
 
-#include <string.h>
 #include <unistd.h>
 
 #include <cstdint>
-#include <fstream>
-#include <iostream>
-#include <map>
-#include <sstream>
 #include <string>
-#include <vector>
 
 #include "source/common/common/logger.h"
 

cilium/bpf_metadata.cc

@@ -1,25 +1,48 @@
 #include "cilium/bpf_metadata.h"
 
+#include <asm-generic/socket.h>
+#include <fmt/format.h>
 #include <netinet/in.h>
 #include <netinet/tcp.h>
+#include <sys/socket.h>
 
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
 #include <string>
+#include <utility>
+#include <vector>
 
 #include "envoy/api/io_error.h"
+#include "envoy/common/exception.h"
+#include "envoy/network/address.h"
+#include "envoy/network/filter.h"
 #include "envoy/network/listen_socket.h"
+#include "envoy/network/listener_filter_buffer.h"
 #include "envoy/registry/registry.h"
+#include "envoy/server/factory_context.h"
+#include "envoy/server/filter_config.h"
 #include "envoy/singleton/manager.h"
+#include "envoy/stream_info/filter_state.h"
 
-#include "source/common/common/assert.h"
-#include "source/common/common/fmt.h"
+#include "source/common/common/logger.h"
 #include "source/common/common/utility.h"
 #include "source/common/network/address_impl.h"
-#include "source/common/network/socket_option_factory.h"
 #include "source/common/network/upstream_socket_options_filter_state.h"
-
-#include "cilium/api/bpf_metadata.pb.validate.h"
+#include "source/common/network/utility.h"
+#include "source/common/protobuf/protobuf.h" // IWYU pragma: keep
+#include "source/common/protobuf/utility.h"
+
+#include "absl/strings/string_view.h"
+#include "cilium/api/bpf_metadata.pb.h"
+#include "cilium/api/bpf_metadata.pb.validate.h" // IWYU pragma: keep
+#include "cilium/conntrack.h"
+#include "cilium/host_map.h"
+#include "cilium/ipcache.h"
+#include "cilium/network_policy.h"
+#include "cilium/policy_id.h"
 #include "cilium/socket_option.h"
-#include "network_policy.h"
 
 namespace Envoy {
 namespace Server {
@@ -534,7 +557,7 @@ Network::FilterStatus Instance::onAccept(Network::ListenerFilterCallbacks& cb) {
 
   // Set socket options for linger and keepalive (5 minutes).
   struct ::linger lin {
-    true, 10
+    true, 10,
   };
   int keepalive = true;
   int secs = 5 * 60; // Five minutes

cilium/bpf_metadata.h

@@ -1,9 +1,16 @@
 #pragma once
 
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <string>
+
 #include "envoy/api/io_error.h"
-#include "envoy/json/json_object.h"
+#include "envoy/network/address.h"
 #include "envoy/network/filter.h"
-#include "envoy/server/filter_config.h"
+#include "envoy/network/listener_filter_buffer.h"
+#include "envoy/server/factory_context.h"
 
 #include "source/common/common/logger.h"
 

cilium/conntrack.cc

@@ -1,17 +1,27 @@
 #include "conntrack.h"
 
 #include <arpa/inet.h>
+#include <netinet/in.h>
 #include <string.h>
 
 #include <cstdint>
+#include <memory>
+#include <string>
+#include <utility>
 
 #include "envoy/common/platform.h"
+#include "envoy/network/address.h"
 
+#include "source/common/common/logger.h"
 #include "source/common/common/thread.h"
 #include "source/common/common/utility.h"
-#include "source/common/network/address_impl.h"
 
+#include "absl/container/flat_hash_map.h"
+#include "absl/container/flat_hash_set.h"
+#include "absl/numeric/int128.h"
+#include "cilium/bpf.h"
 #include "linux/bpf.h"
+#include "linux/type_mapper.h"
 
 namespace Envoy {
 namespace Cilium {

cilium/conntrack.h

@@ -1,5 +1,7 @@
 #pragma once
 
+#include <cstddef>
+#include <cstdint>
 #include <functional>
 #include <memory>
 #include <string>
@@ -12,7 +14,7 @@
 
 #include "absl/container/flat_hash_map.h"
 #include "absl/container/flat_hash_set.h"
-#include "bpf.h"
+#include "cilium/bpf.h"
 
 namespace std {
 template <> class hash<const string> {

cilium/grpc_subscription.cc

@@ -1,15 +1,38 @@
 #include "cilium/grpc_subscription.h"
 
+#include <fmt/format.h>
+
+#include <chrono>
+#include <memory>
+#include <string>
+#include <utility>
+#include <vector>
+
 #include "envoy/annotations/resource.pb.h"
+#include "envoy/common/exception.h"
+#include "envoy/common/random_generator.h"
 #include "envoy/config/core/v3/config_source.pb.h"
+#include "envoy/config/custom_config_validators.h"
 #include "envoy/config/subscription.h"
-
-#include "source/common/config/type_to_endpoint.h"
+#include "envoy/config/subscription_factory.h"
+#include "envoy/event/dispatcher.h"
+#include "envoy/local_info/local_info.h"
+#include "envoy/stats/scope.h"
+#include "envoy/upstream/cluster_manager.h"
+
+#include "source/common/common/assert.h"
+#include "source/common/common/backoff_strategy.h"
 #include "source/common/config/utility.h"
 #include "source/common/grpc/common.h"
-#include "source/common/protobuf/protobuf.h"
+#include "source/common/protobuf/protobuf.h" // IWYU pragma: keep
 #include "source/extensions/config_subscription/grpc/grpc_mux_context.h"
-#include "source/extensions/config_subscription/grpc/grpc_mux_impl.h"
+#include "source/extensions/config_subscription/grpc/grpc_subscription_impl.h"
+
+#include "absl/container/flat_hash_map.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/match.h"
+#include "absl/strings/string_view.h"
+#include "absl/types/optional.h"
 
 namespace Envoy {
 namespace Cilium {

cilium/grpc_subscription.h

@@ -1,13 +1,18 @@
 #pragma once
 
-#include "envoy/config/grpc_mux.h"
+#include <chrono>
+#include <memory>
+#include <string>
+
+#include "envoy/common/random_generator.h"
+#include "envoy/config/core/v3/config_source.pb.h"
 #include "envoy/config/subscription.h"
-#include "envoy/config/xds_resources_delegate.h"
 #include "envoy/event/dispatcher.h"
-#include "envoy/grpc/async_client.h"
 #include "envoy/local_info/local_info.h"
+#include "envoy/stats/scope.h"
 #include "envoy/upstream/cluster_manager.h"
 
+#include "source/extensions/config_subscription/grpc/grpc_mux_context.h"
 #include "source/extensions/config_subscription/grpc/grpc_mux_impl.h"
 #include "source/extensions/config_subscription/grpc/grpc_subscription_impl.h"
 

cilium/health_check_sink.cc

@@ -1,9 +1,24 @@
 #include "cilium/health_check_sink.h"
 
+#include <map>
+#include <memory>
+#include <string>
+
+#include "envoy/common/time.h"
+#include "envoy/data/core/v3/health_check_event.pb.h"
 #include "envoy/registry/registry.h"
+#include "envoy/server/health_checker_config.h"
+#include "envoy/upstream/health_check_event_sink.h"
 
+#include "source/common/common/lock_guard.h"
+#include "source/common/common/logger.h"
+#include "source/common/common/thread.h"
+#include "source/common/protobuf/protobuf.h" // IWYU pragma: keep
 #include "source/common/protobuf/utility.h"
 
+#include "cilium/api/health_check_sink.pb.h"
+#include "cilium/uds_client.h"
+
 namespace Envoy {
 namespace Cilium {