dev: v42 (#2501)

* Update dev to v42
* Update Rust to 1.73.0
  * Address new clippy & check warnings
* Update debian from bullseye to bookworm
* Update K3d to v5.6.0
  * Update CI from k3s 1.26 to 1.28
* Fix `just linkerd-install` to specify k8s context
* Update markdownlint-cli2 to 0.10.0
* Update Dockerfile to use a debian base image for easier debugging
* Update proc-macro2 to fix rust-nightly build failures

.devcontainer/devcontainer.json

@@ -1,6 +1,6 @@
 {
 	"name": "linkerd2-proxy",
-	"image": "ghcr.io/linkerd/dev:v40",
+	"image": "ghcr.io/linkerd/dev:v42",
 	"customizations": {
 		"vscode": {
 			"extensions": [

.github/workflows/actions.yml

@@ -11,16 +11,16 @@ permissions:
 
 jobs:
   actionlint:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v40
+      - uses: linkerd/dev/actions/setup-tools@v42
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
       - run: just action-lint
 
   devcontainer-versions:
     runs-on: ubuntu-latest
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v40
+      - uses: linkerd/dev/actions/setup-tools@v42
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
       - run: just action-dev-check

.github/workflows/beta.yml

@@ -22,7 +22,7 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v40-rust
+    container: ghcr.io/linkerd/dev:v42-rust
     timeout-minutes: 20
     continue-on-error: true
     steps:

.github/workflows/check-all.yml

@@ -22,7 +22,7 @@ jobs:
   check-all:
     timeout-minutes: 20
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v40-rust
+    container: ghcr.io/linkerd/dev:v42-rust
     steps:
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033

.github/workflows/check-each.yml

@@ -26,7 +26,7 @@ jobs:
   list-changed-crates:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    container: docker://ghcr.io/linkerd/dev:v40-rust
+    container: docker://ghcr.io/linkerd/dev:v42-rust
     steps:
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
@@ -47,7 +47,7 @@ jobs:
     needs: list-changed-crates
     timeout-minutes: 20
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v40-rust
+    container: ghcr.io/linkerd/dev:v42-rust
     strategy:
       matrix:
         crate: ${{ fromJson(needs.list-changed-crates.outputs.crates) }}

.github/workflows/coverage.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     container:
-      image: docker://ghcr.io/linkerd/dev:v40-rust
+      image: docker://ghcr.io/linkerd/dev:v42-rust
       options: --security-opt seccomp=unconfined # 🤷
     steps:
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608

.github/workflows/deps.yml

@@ -46,7 +46,7 @@ jobs:
   deprecated:
     timeout-minutes: 20
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v40-rust
+    container: ghcr.io/linkerd/dev:v42-rust
     steps:
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033

.github/workflows/fuzzers.yml

@@ -27,7 +27,7 @@ jobs:
   list-changed:
     timeout-minutes: 3
     runs-on: ubuntu-latest
-    container: docker://rust:1.69.0-bullseye
+    container: docker://rust:1.73.0
     steps:
       - run: apt update && apt install -y jo
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
@@ -48,7 +48,7 @@ jobs:
     needs: [list-changed]
     timeout-minutes: 40
     runs-on: ubuntu-latest
-    container: docker://rust:1.69.0-bullseye
+    container: docker://rust:1.73.0
     strategy:
       matrix:
         dir: ${{ fromJson(needs.list-changed.outputs.dirs) }}

.github/workflows/integration.yml

@@ -26,7 +26,7 @@ jobs:
   test:
     timeout-minutes: 20
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v40-rust
+    container: ghcr.io/linkerd/dev:v42-rust
     steps:
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033

.github/workflows/k8s.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v40
+      - uses: linkerd/dev/actions/setup-tools@v42
 
       - name: Install linkerd CLI (edge)
         id: linkerd

.github/workflows/lint.yml

@@ -21,7 +21,7 @@ jobs:
   clippy:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v40-rust
+    container: ghcr.io/linkerd/dev:v42-rust
     steps:
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
@@ -31,7 +31,7 @@ jobs:
   fmt:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v40-rust
+    container: ghcr.io/linkerd/dev:v42-rust
     steps:
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
@@ -40,7 +40,7 @@ jobs:
   docs:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v40-rust
+    container: ghcr.io/linkerd/dev:v42-rust
     steps:
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033

.github/workflows/nightly.yml

@@ -22,7 +22,7 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v40-rust
+    container: ghcr.io/linkerd/dev:v42-rust
     timeout-minutes: 20
     continue-on-error: true
     steps:

.github/workflows/release.yml

@@ -59,7 +59,7 @@ jobs:
     continue-on-error: ${{ !needs.meta.outputs.publish }}
     runs-on: ubuntu-latest
     timeout-minutes: 40
-    container: docker://ghcr.io/linkerd/dev:v40-rust-musl
+    container: docker://ghcr.io/linkerd/dev:v42-rust-musl
     env:
       LINKERD2_PROXY_VENDOR: ${{ github.repository_owner }}
       LINKERD2_PROXY_VERSION: ${{ needs.meta.outputs.version }}

.github/workflows/shellcheck.yml

@@ -15,6 +15,6 @@ jobs:
     timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v40
+      - uses: linkerd/dev/actions/setup-tools@v42
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
       - run: just sh-lint

.github/workflows/test.yml

@@ -24,7 +24,7 @@ jobs:
   meshtls:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v40-rust
+    container: ghcr.io/linkerd/dev:v42-rust
     steps:
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
@@ -43,7 +43,7 @@ jobs:
   unit:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v40-rust
+    container: ghcr.io/linkerd/dev:v42-rust
     steps:
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033

.github/workflows/toolchain.yml

@@ -14,7 +14,7 @@ permissions:
 jobs:
   devcontainer:
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v40-rust
+    container: ghcr.io/linkerd/dev:v42-rust
     steps:
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
@@ -37,7 +37,7 @@ jobs:
   workflows:
     runs-on: ubuntu-latest
     steps:
-      - uses: linkerd/dev/actions/setup-tools@v40
+      - uses: linkerd/dev/actions/setup-tools@v42
       - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
       - shell: bash
         run: |

Cargo.lock

@@ -2214,9 +2214,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.52"
+version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d0e1ae9e836cc3beddd63db0df682593d7e2d3d891ae8c9083d2113e1744224"
+checksum = "134c189feb4956b20f6f547d2cf727d4c0fe06722b20a0eec87ed445a97f92da"
 dependencies = [
  "unicode-ident",
 ]

Dockerfile

@@ -3,11 +3,12 @@
 # This is intended **DEVELOPMENT ONLY**, i.e. so that proxy developers can
 # easily test the proxy in the context of the larger `linkerd2` project.
 
-ARG RUST_IMAGE=ghcr.io/linkerd/dev:v40-rust
+ARG RUST_IMAGE=ghcr.io/linkerd/dev:v42-rust
 
 # Use an arbitrary ~recent edge release image to get the proxy
 # identity-initializing and linkerd-await wrappers.
-ARG RUNTIME_IMAGE=ghcr.io/linkerd/proxy:edge-22.12.1
+# Currently pinned to a build off of edge-23.11.1 + dev:v42
+ARG LINKERD2_IMAGE=ghcr.io/olix0r/l2-proxy:git-04283611
 
 # Build the proxy.
 FROM --platform=$BUILDPLATFORM $RUST_IMAGE as build
@@ -38,9 +39,12 @@ RUN --mount=type=cache,id=cargo,target=/usr/local/cargo/registry \
     mkdir -p /out && \
     mv $(just --evaluate profile="$PROFILE" _target_bin) /out/linkerd2-proxy
 
-## Install the proxy binary into the base runtime image.
-FROM $RUNTIME_IMAGE as runtime
+FROM $LINKERD2_IMAGE as linkerd2
+
+# Install the proxy binary into a base image that we can at least get a shell to
+# debug on.
+FROM docker.io/library/debian:bookworm-slim as runtime
 WORKDIR /linkerd
+COPY --from=linkerd2 /usr/lib/linkerd/* /usr/lib/linkerd/
 COPY --from=build /out/linkerd2-proxy /usr/lib/linkerd/linkerd2-proxy
-ENV LINKERD2_PROXY_LOG=warn,linkerd=info,trust_dns=error
-# Inherits the ENTRYPOINT from the runtime image.
+ENTRYPOINT ["/usr/lib/linkerd/linkerd2-proxy-identity"]

justfile

@@ -57,7 +57,6 @@ _features := if features == "all" {
         "--no-default-features --features=" + features
     } else { "" }
 
-# For dev:v40
 export CXX := 'clang++-14'
 
 #
@@ -214,6 +213,7 @@ _init-image := 'ghcr.io/linkerd/proxy-init'
 _init-tag := 'v2.2.0'
 
 _kubectl := 'just-k3d kubectl'
+_linkerd := 'linkerd --context=k3d-$(just-k3d --evaluate K3D_CLUSTER_NAME)'
 
 _tag-set:
     #!/usr/bin/env bash
@@ -241,15 +241,15 @@ k3d-load-linkerd: _tag-set _k3d-ready
 
 # Install crds on the test cluster.
 _linkerd-crds-install: _k3d-ready
-    linkerd install --crds \
+    {{ _linkerd }} install --crds \
         | {{ _kubectl }} apply -f -
     {{ _kubectl }} wait crd --for condition=established \
         --selector='linkerd.io/control-plane-ns' \
         --timeout=1m
 
 # Install linkerd on the test cluster using test images.
 linkerd-install *args='': _tag-set k3d-load-linkerd _linkerd-crds-install && _linkerd-ready
-    linkerd install \
+    {{ _linkerd }} install \
             --set='imagePullPolicy=Never' \
             --set='controllerImage={{ _controller-image }}' \
             --set='linkerdVersion={{ linkerd-tag }}' \
@@ -264,14 +264,14 @@ linkerd-install *args='': _tag-set k3d-load-linkerd _linkerd-crds-install && _li
         | {{ _kubectl }} apply -f -
 
 linkerd-uninstall:
-    linkerd uninstall \
+    {{ _linkerd }} uninstall \
         | {{ _kubectl }} delete -f -
 
 linkerd-check-contol-plane-proxy:
     #!/usr/bin/env bash
     set -euo pipefail
     check=$(mktemp --tmpdir check-XXXX.json)
-    linkerd check -o json > "$check"
+    {{ _linkerd }} check -o json > "$check"
     result=$(jq -r \
         '.categories[] | select(.categoryName == "linkerd-control-plane-proxy") | .checks[] | select(.description == "control plane proxies are healthy") | .result' \
         "$check")

linkerd/app/inbound/src/http/server.rs

@@ -1,9 +1,6 @@
 use super::set_identity_header::NewSetIdentityHeader;
 use crate::{policy, Inbound};
-pub use linkerd_app_core::proxy::http::{
-    normalize_uri, strip_header, uri, BoxBody, BoxResponse, DetectHttp, Request, Response, Retain,
-    Version,
-};
+pub use linkerd_app_core::proxy::http::{normalize_uri, Version};
 use linkerd_app_core::{
     config::{ProxyConfig, ServerConfig},
     errors, http_tracing, io,

linkerd/app/inbound/src/policy/http/tests.rs

@@ -38,8 +38,9 @@ macro_rules! new_svc {
             connection: $conn,
             metrics: HttpAuthzMetrics::default(),
             inner: |(permit, _): (HttpRoutePermit, ())| {
+                let f = $rsp;
                 svc::mk(move |req: ::http::Request<hyper::Body>| {
-                    futures::future::ready($rsp(permit.clone(), req))
+                    futures::future::ready((f)(permit.clone(), req))
                 })
             },
         };

linkerd/app/inbound/src/policy/store.rs

@@ -1,9 +1,7 @@
 use super::{api, AllowPolicy, DefaultPolicy, GetPolicy};
 use linkerd_app_core::{proxy::http, transport::OrigDstAddr, Error};
 use linkerd_idle_cache::IdleCache;
-pub use linkerd_proxy_server_policy::{
-    authz::Suffix, Authentication, Authorization, Protocol, ServerPolicy,
-};
+pub use linkerd_proxy_server_policy::{Protocol, ServerPolicy};
 use rangemap::RangeInclusiveSet;
 use std::{
     collections::HashSet,

linkerd/app/integration/src/lib.rs

@@ -2,6 +2,7 @@
 
 #![warn(rust_2018_idioms, clippy::disallowed_methods, clippy::disallowed_types)]
 #![forbid(unsafe_code)]
+#![recursion_limit = "256"]
 
 mod test_env;
 
@@ -37,7 +38,6 @@ use socket2::Socket;
 pub use std::collections::HashMap;
 use std::fmt;
 pub use std::future::Future;
-use std::io;
 pub use std::net::SocketAddr;
 use std::pin::Pin;
 pub use std::sync::Arc;
@@ -48,7 +48,6 @@ use tokio::net::TcpListener;
 pub use tokio::sync::oneshot;
 pub use tonic as grpc;
 pub use tower::Service;
-pub use tracing::*;
 
 /// Environment variable for overriding the test patience.
 pub const ENV_TEST_PATIENCE_MS: &str = "RUST_TEST_PATIENCE_MS";

linkerd/app/integration/src/metrics.rs

@@ -253,7 +253,7 @@ impl Labels {
     /// the values from `other` overwrite the values in `self`.
     pub fn and(&self, other: Labels) -> Labels {
         let mut new_labels = self.0.clone();
-        new_labels.extend(other.0.into_iter());
+        new_labels.extend(other.0);
         Labels(new_labels)
     }
 

linkerd/app/outbound/src/protocol.rs

@@ -1,5 +1,4 @@
 use crate::{http, Outbound};
-pub use linkerd_app_core::proxy::api_resolve::ConcreteAddr;
 use linkerd_app_core::{detect, io, svc, Error, Infallible};
 use std::{fmt::Debug, hash::Hash};
 

linkerd/app/src/lib.rs

@@ -232,7 +232,6 @@ impl Config {
         // Build a task that initializes and runs the proxy stacks.
         let start_proxy = {
             let identity_ready = identity.ready();
-            let inbound_addr = inbound_addr;
             let profiles = dst.profiles;
             let resolve = dst.resolve;