Istio: The ability to configure the upstream version of envoy in istio/proxy

[clarketm]

Describe the feature request

The ability to configure the upstream version of envoy in the istio/proxy WORKSPACE dynamically (e.g. configurable from a CI/CD system). Ideally, attributes such as url (i.e.repo) and sha could be specified via environment variables or another, related bazel-specific means. Additionally, if the http archive source is private, then auth configuration (e.g. .netrc) should be configurable as well.

As a reference implementation, I took a stab at this https://github.com/istio/proxy/pull/2496 but my effort was subsequently reverted due to limitations in the approach; one major limitation being the absence of a means to authenticate.

Describe alternatives you've considered

1. Continue to hard-code the value and handle auth ad hoc.
2. Configure and build from a local source path.
3. Use --override_repository (xref: https://github.com/istio/proxy/pull/2496#issuecomment-548842080) but not sure how this will work regarding auth with private repos/archives.

[clarketm]

@lizan - Do you have any bandwidth to help with this. Is there any way to take what you do locally to build proxy w/envoy from a private repo/url and make it configurable from an external environment or user (e.g. CI)?

For example, how do you use --override_repository with a .netrc file in your local development to pull from a private source location?

[lizan]

@clarketm --override_repository allows you to point envoy (or any other repository in bazel terms) to a specific local directory, without patching WORKSPACE. Regarding auth with private repos/archives, it should be done prior to invoke bazel, for example: git clone https://github.com/private/envoy /tmp/envoy && bazel build --override_repository=envoy=/tmp/envoy //src/envoy will work, and you are able to configure git to do authenticate (by default git https uses .netrc, you can also use ssh too).

[clarketm]

@lizan

@clarketm --override_repository allows you to point envoy (or an...

Okay I see. So the idea is to clone the private repository/source locally on the filesystem upfront, then use --override_repository to direct bazel to the local path where the source was downloaded. I can give that a try and send out a PR shortly, Thanks!