feat: inbound only graceful draining

[keithmattix]

Trying #37873 again to get to the bottom of the flakes that caused us to need to revert. This got a lot more complex after #38333, so I may need @yanavlasov to help me out with the proper semantics

Commit Message:

Fixes https://github.com/envoyproxy/envoy/issues/35020. The inbound_only query param for the drain_listeners admin
endpoint doesn't work with the graceful query parameter. As a result,
outbound listeners will send connection: close headers to upstreams
which is undesired. This PR adds the ability for drain_manager to drain
in a single direction.

Additional Description:
Risk Level: Medium
Testing:
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]

[keithmattix]

Can someone from @envoyproxy/envoy-mobile-triage help me with these Android test failures? The smoking gun appears to be errors like these:

java.lang.UnsatisfiedLinkError: /mnt/engflow/worker/work/3/exec/bazel-out/k8-fastbuild/bin/test/java/io/envoyproxy/envoymobile/engine/testing/quic_test_server_test.runfiles/envoy_mobile/test/jni/libenvoy_jni_with_test_extensions.so: /mnt/engflow/worker/work/3/exec/bazel-out/k8-fastbuild/bin/test/java/io/envoyproxy/envoymobile/engine/testing/quic_test_server_test.runfiles/envoy_mobile/test/jni/libenvoy_jni_with_test_extensions.so: undefined symbol: __atomic_load

I tried to add a link command to the jni bazel config but no dice. I've never touched Envoy native development, so I truly have no idea what I'm doing

[abeyad]

java.lang.UnsatisfiedLinkError: /mnt/engflow/worker/work/3/exec/bazel-out/k8-fastbuild/bin/test/java/io/envoyproxy/envoymobile/engine/testing/quic_test_server_test.runfiles/envoy_mobile/test/jni/libenvoy_jni_with_test_extensions.so: /mnt/engflow/worker/work/3/exec/bazel-out/k8-fastbuild/bin/test/java/io/envoyproxy/envoymobile/engine/testing/quic_test_server_test.runfiles/envoy_mobile/test/jni/libenvoy_jni_with_test_extensions.so: undefined symbol: __atomic_load

You added the -latomic to libenvoy_jni.so, not to libenvoy_jni_with_test_extensions.so. Can you try adding it to

envoy/mobile/test/jni/BUILD

Line 110 in 87b4ae8

name = "libenvoy_jni_with_test_extensions.so",

? That said, it's unclear why you would get an std::atomic linker error with your change, as we've had std::atomic in Envoy code prior and no linker issues on Android.

[fredyw]

java.lang.UnsatisfiedLinkError: /mnt/engflow/worker/work/3/exec/bazel-out/k8-fastbuild/bin/test/java/io/envoyproxy/envoymobile/engine/testing/quic_test_server_test.runfiles/envoy_mobile/test/jni/libenvoy_jni_with_test_extensions.so: /mnt/engflow/worker/work/3/exec/bazel-out/k8-fastbuild/bin/test/java/io/envoyproxy/envoymobile/engine/testing/quic_test_server_test.runfiles/envoy_mobile/test/jni/libenvoy_jni_with_test_extensions.so: undefined symbol: __atomic_load

You added the -latomic to libenvoy_jni.so, not to libenvoy_jni_with_test_extensions.so. Can you try adding it to

envoy/mobile/test/jni/BUILD

Line 110 in 87b4ae8

name = "libenvoy_jni_with_test_extensions.so",

? That said, it's unclear why you would get an std::atomic linker error with your change, as we've had std::atomic in Envoy code prior and no linker issues on Android.

That's what I thought, too but when I tested it in 40faf7e, it didn't help, though: https://github.com/envoyproxy/envoy/actions/runs/13312980039/job/37180020453

I'm also not able to reproduce this locally.

[fredyw]

java.lang.UnsatisfiedLinkError: /mnt/engflow/worker/work/3/exec/bazel-out/k8-fastbuild/bin/test/java/io/envoyproxy/envoymobile/engine/testing/quic_test_server_test.runfiles/envoy_mobile/test/jni/libenvoy_jni_with_test_extensions.so: /mnt/engflow/worker/work/3/exec/bazel-out/k8-fastbuild/bin/test/java/io/envoyproxy/envoymobile/engine/testing/quic_test_server_test.runfiles/envoy_mobile/test/jni/libenvoy_jni_with_test_extensions.so: undefined symbol: __atomic_load

You added the -latomic to libenvoy_jni.so, not to libenvoy_jni_with_test_extensions.so. Can you try adding it to

envoy/mobile/test/jni/BUILD

Line 110 in 87b4ae8

name = "libenvoy_jni_with_test_extensions.so",

? That said, it's unclear why you would get an std::atomic linker error with your change, as we've had std::atomic in Envoy code prior and no linker issues on Android.

That's what I thought, too but when I tested it in 40faf7e, it didn't help, though: https://github.com/envoyproxy/envoy/actions/runs/13312980039/job/37180020453

I'm also not able to reproduce this locally.

Oh looks like it did help. I just need to link it with -latomic in a different shared library. Let me test it again.

[keithmattix]

Android is now passing after integrating @fredyw's changes; thanks for the assist!

This is now ready for review

[keithmattix]

/retest

[yanavlasov]

Which test was flaky?

/wait

[yanavlasov]

Leftover from testing?

[keithmattix]

Yes android doesn't run in PRs by default; I wanted to get an approval on the code first before removing so there aren't surprises on main post merge

[yanavlasov]

This looks like a struct would be a better choice? Are the timer keys dynamic?

[keithmattix]

No we only expect a max of two keys (All and InboundOnly) at any time (and we have an assertion in the code to check).

[keithmattix]

Which test was flaky?

/wait

AdminDrainInboundOnlyIdempotent (or something similar). I believe I addressed it by adding the stopped_listener flatHashSet check into a callback function that runs on the main thread which should prevent the race conditions that led to the flaky test. Here's a failed run: https://github.com/envoyproxy/envoy/actions/runs/13172376287/job/36764947882

[keithmattix]

@yanavlasov do you have any additional feedback?