ci: Switch ARM to RBE (envoyproxy#38860)

Fix envoyproxy#38800 

Mostly resolve envoyproxy#38674

Signed-off-by: Ryan Northey <[email protected]>

Author: phlax

.bazelrc

@@ -224,6 +224,7 @@ build:libc++ --action_env=BAZEL_LINKOPTS=-lm:-pthread
 build:libc++ --define force_libcpp=enabled
 build:clang-libc++ --config=libc++
 build:clang-libc++ --action_env=ARFLAGS=r
+build:arm64-clang-libc++ --config=clang-libc++
 
 build:libc++20 --config=libc++
 # gRPC has a lot of deprecated-enum-enum-conversion warning. Remove once it is addressed
@@ -294,6 +295,16 @@ build:rbe-toolchain-clang-libc++ --action_env=CXXFLAGS=-stdlib=libc++
 build:rbe-toolchain-clang-libc++ --action_env=LDFLAGS=-stdlib=libc++
 build:rbe-toolchain-clang-libc++ --define force_libcpp=enabled
 
+build:rbe-toolchain-arm64-clang-libc++ --config=rbe-toolchain
+build:rbe-toolchain-arm64-clang-libc++ --platforms=@envoy//bazel/rbe/toolchains:rbe_linux_arm64_clang_libcxx_platform
+build:rbe-toolchain-arm64-clang-libc++ --host_platform=@envoy//bazel/rbe/toolchains:rbe_linux_arm64_clang_libcxx_platform
+build:rbe-toolchain-arm64-clang-libc++ --crosstool_top=@envoy//bazel/rbe/toolchains/configs/linux/clang_libcxx/cc:toolchain
+build:rbe-toolchain-arm64-clang-libc++ --extra_toolchains=@envoy//bazel/rbe/toolchains/configs/linux/clang_libcxx/config:cc-toolchain-arm64
+build:rbe-toolchain-arm64-clang-libc++ --action_env=CC=clang --action_env=CXX=clang++
+build:rbe-toolchain-arm64-clang-libc++ --action_env=CXXFLAGS=-stdlib=libc++
+build:rbe-toolchain-arm64-clang-libc++ --action_env=LDFLAGS=-stdlib=libc++
+build:rbe-toolchain-arm64-clang-libc++ --define force_libcpp=enabled
+
 build:rbe-toolchain-asan --config=clang-asan
 build:rbe-toolchain-asan --linkopt -fuse-ld=lld
 build:rbe-toolchain-asan --action_env=ENVOY_UBSAN_VPTR=1
@@ -338,6 +349,9 @@ build:remote-clang --config=rbe-toolchain-clang
 build:remote-clang-libc++ --config=remote
 build:remote-clang-libc++ --config=rbe-toolchain-clang-libc++
 
+build:remote-arm64-clang-libc++ --config=remote
+build:remote-arm64-clang-libc++ --config=rbe-toolchain-arm64-clang-libc++
+
 build:remote-gcc --config=remote
 build:remote-gcc --config=gcc
 build:remote-gcc --config=rbe-toolchain-gcc

.github/workflows/_precheck_publish.yml

@@ -68,10 +68,8 @@ jobs:
           name: Release (arm64)
           target-suffix: arm64
           arch: arm64
-          bazel-extra: >-
-            --config=remote-cache-envoy-engflow
-          rbe: false
-          runs-on: envoy-arm64-large
+          rbe: true
+          runs-on: ${{ vars.ENVOY_ARM_VM || 'ubuntu-24.04-arm' }}
           timeout-minutes: 180
         - target: docs
           name: Docs

.github/workflows/_publish_build.yml

@@ -74,9 +74,9 @@ jobs:
           name: Release (arm64)
           arch: arm64
           bazel-extra: >-
-            --config=remote-cache-envoy-engflow
-          rbe: false
-          runs-on: envoy-arm64-medium
+            --config=remote-envoy-engflow
+          rbe: true
+          runs-on: ${{ vars.ENVOY_ARM_VM || 'ubuntu-24.04-arm' }}
 
   distribution:
     permissions:
@@ -120,7 +120,7 @@ jobs:
           name: Package debs (arm64)
           arch: arm64
           cache-build-image-key-suffix: -arm64
-          runs-on: github-arm64-2c-8gb
+          runs-on: ${{ vars.ENVOY_ARM_VM || 'ubuntu-24.04-arm' }}
 
   docker:
     permissions:

.github/workflows/_publish_verify.yml

@@ -142,4 +142,4 @@ jobs:
           arch: arm64
           bazel-extra: >-
             --config=remote-cache-envoy-engflow
-          runs-on: github-arm64-2c-8gb
+          runs-on: ${{ vars.ENVOY_ARM_VM || 'ubuntu-24.04-arm' }}

.github/workflows/_request_cache.yml

@@ -47,7 +47,7 @@ jobs:
         - target: docker-arm64
           arch: arm64
           cache-suffix: -arm64
-          runs-on: github-arm64-2c-8gb
+          runs-on: ${{ vars.ENVOY_ARM_VM || 'ubuntu-24.04-arm' }}
 
   bazel:
     permissions:
@@ -77,9 +77,9 @@ jobs:
             --config=remote-envoy-engflow
         - name: Bazel (arm64/cache)
           arch: arm64
-          runs-on: github-arm64-2c-8gb
+          runs-on: ${{ vars.ENVOY_ARM_VM || 'ubuntu-24.04-arm' }}
           bazel-extra: >-
-             --config=clang-libc++
+             --config=remote-arm64-clang-libc++
              --config=common-envoy-engflow
              --config=cache-envoy-engflow
           targets: >-

bazel/BUILD

@@ -769,6 +769,14 @@ config_setting(
     define_values = {"engflow_rbe": "true"},
 )
 
+selects.config_setting_group(
+    name = "engflow_rbe_x86_64",
+    match_all = [
+        ":engflow_rbe",
+        ":linux_x86_64",
+    ],
+)
+
 selects.config_setting_group(
     name = "apple",
     match_any = [

bazel/envoy_binary.bzl

@@ -30,7 +30,7 @@ def envoy_cc_binary(
         features = [],
         linkstatic = True):
     exec_properties = exec_properties | select({
-        repository + "//bazel:engflow_rbe": {"Pool": rbe_pool} if rbe_pool else {},
+        repository + "//bazel:engflow_rbe_x86_64": {"Pool": rbe_pool} if rbe_pool else {},
         "//conditions:default": {},
     })
     linker_inputs = envoy_exported_symbols_input()

bazel/envoy_library.bzl

@@ -104,7 +104,7 @@ def envoy_cc_library(
     if tcmalloc_dep:
         deps += tcmalloc_external_deps(repository)
     exec_properties = exec_properties | select({
-        repository + "//bazel:engflow_rbe": {"Pool": rbe_pool} if rbe_pool else {},
+        repository + "//bazel:engflow_rbe_x86_64": {"Pool": rbe_pool} if rbe_pool else {},
         "//conditions:default": {},
     })
 

bazel/envoy_test.bzl

@@ -88,7 +88,7 @@ def envoy_cc_fuzz_test(
         tags = [],
         **kwargs):
     exec_properties = exec_properties | select({
-        repository + "//bazel:engflow_rbe": {"Pool": rbe_pool} if rbe_pool else {},
+        repository + "//bazel:engflow_rbe_x86_64": {"Pool": rbe_pool} if rbe_pool else {},
         "//conditions:default": {},
     })
     if not (corpus.startswith("//") or corpus.startswith(":") or corpus.startswith("@")):
@@ -175,7 +175,7 @@ def envoy_cc_test(
         exec_properties = {}):
     coverage_tags = tags + ([] if coverage else ["nocoverage"])
     exec_properties = exec_properties | select({
-        repository + "//bazel:engflow_rbe": {"Pool": rbe_pool} if rbe_pool else {},
+        repository + "//bazel:engflow_rbe_x86_64": {"Pool": rbe_pool} if rbe_pool else {},
         "//conditions:default": {},
     })
     native.cc_test(
@@ -222,7 +222,7 @@ def envoy_cc_test_library(
         alwayslink = 1,
         **kargs):
     exec_properties = exec_properties | select({
-        repository + "//bazel:engflow_rbe": {"Pool": rbe_pool} if rbe_pool else {},
+        repository + "//bazel:engflow_rbe_x86_64": {"Pool": rbe_pool} if rbe_pool else {},
         "//conditions:default": {},
     })
     disable_pch = kargs.pop("disable_pch", True)
@@ -292,7 +292,7 @@ def envoy_benchmark_test(
         repository = "",
         **kargs):
     exec_properties = exec_properties | select({
-        repository + "//bazel:engflow_rbe": {"Pool": rbe_pool} if rbe_pool else {},
+        repository + "//bazel:engflow_rbe_x86_64": {"Pool": rbe_pool} if rbe_pool else {},
         "//conditions:default": {},
     })
     native.sh_test(

bazel/rbe/toolchains/BUILD

@@ -22,6 +22,16 @@ platform(
     parents = ["//bazel/rbe/toolchains/configs/linux/clang_libcxx/config:platform"],
 )
 
+platform(
+    name = "rbe_linux_arm64_clang_libcxx_platform",
+    exec_properties = create_rbe_exec_properties_dict(
+        docker_add_capabilities = "SYS_PTRACE,NET_RAW,NET_ADMIN",
+        docker_network = "standard",
+        docker_privileged = True,
+    ),
+    parents = ["//bazel/rbe/toolchains/configs/linux/clang_libcxx/config:platform-arm64"],
+)
+
 platform(
     name = "rbe_linux_gcc_platform",
     exec_properties = create_rbe_exec_properties_dict(

bazel/rbe/toolchains/configs/linux/clang_libcxx/cc/BUILD

@@ -1,4 +1,5 @@
 load("@rules_cc//cc:defs.bzl", "cc_toolchain", "cc_toolchain_suite")
+load(":aarch64_cc_toolchain_config.bzl", aarch64_cc_toolchain_config = "cc_toolchain_config")
 load(":armeabi_cc_toolchain_config.bzl", "armeabi_cc_toolchain_config")
 load(":cc_toolchain_config.bzl", "cc_toolchain_config")
 
@@ -44,6 +45,14 @@ filegroup(
     ) + [":builtin_include_directory_paths"],
 )
 
+filegroup(
+    name = "compiler_deps_aarch64",
+    srcs = glob(
+        ["extra_tools/**"],
+        allow_empty = True,
+    ) + [":builtin_include_directory_paths_aarch64"],
+)
+
 # This is the entry point for --crosstool_top.  Toolchains are found
 # by lopping off the name of --crosstool_top and searching for
 # the "${CPU}" entry in the toolchains attribute.
@@ -54,6 +63,8 @@ cc_toolchain_suite(
         "k8": ":cc-compiler-k8",
         "armeabi-v7a|compiler": ":cc-compiler-armeabi-v7a",
         "armeabi-v7a": ":cc-compiler-armeabi-v7a",
+        "aarch64|clang": ":cc-compiler-aarch64",
+        "aarch64": ":cc-compiler-aarch64",
     },
 )
 
@@ -172,3 +183,102 @@ cc_toolchain(
 )
 
 armeabi_cc_toolchain_config(name = "stub_armeabi-v7a")
+
+aarch64_cc_toolchain_config(
+    name = "arm64-local",
+    abi_libc_version = "arm64-local",
+    abi_version = "arm64-local",
+    compile_flags = [
+        "-fstack-protector",
+        "-Wall",
+        "-Wthread-safety",
+        "-Wself-assign",
+        "-Wunused-but-set-parameter",
+        "-Wno-free-nonheap-object",
+        "-fcolor-diagnostics",
+        "-fno-omit-frame-pointer",
+    ],
+    compiler = "clang",
+    coverage_compile_flags = [
+        "-fprofile-instr-generate",
+        "-fcoverage-mapping",
+    ],
+    coverage_link_flags = ["-fprofile-instr-generate"],
+    cpu = "aarch64",
+    cxx_builtin_include_directories = [
+        "/opt/llvm/lib/clang/14.0.0/include",
+        "/usr/local/include",
+        "/usr/include/aarch64-linux-gnu",
+        "/usr/include",
+        "/opt/llvm/lib/clang/14.0.0/share",
+        # "/opt/llvm/include/aarch64-unknown-linux-gnu/c++/v1",
+        "/opt/llvm/include/c++/v1",
+    ],
+
+    cxx_flags = ["-stdlib=libc++"],
+    dbg_compile_flags = ["-g"],
+    host_system_name = "local",
+    link_flags = [
+        "-fuse-ld=/opt/llvm/bin/ld.lld",
+        "-Wl,-no-as-needed",
+        "-Wl,-z,relro,-z,now",
+        "-B/opt/llvm/bin",
+        "-lm",
+        "-pthread",
+        "-fuse-ld=lld",
+    ],
+    link_libs = [
+        "-l:libc++.a",
+        "-l:libc++abi.a",
+    ],
+    opt_compile_flags = [
+        "-g0",
+        "-O2",
+        "-D_FORTIFY_SOURCE=1",
+        "-DNDEBUG",
+        "-ffunction-sections",
+        "-fdata-sections",
+    ],
+    opt_link_flags = ["-Wl,--gc-sections"],
+    supports_start_end_lib = True,
+    target_libc = "local",
+    target_system_name = "local",
+    tool_paths = {
+        "ar": "/usr/bin/ar",
+        "ld": "/usr/bin/ld",
+        "llvm-cov": "/opt/llvm/bin/llvm-cov",
+        "llvm-profdata": "/opt/llvm/bin/llvm-profdata",
+        "cpp": "/usr/bin/cpp",
+        "gcc": "/opt/llvm/bin/clang-14",
+        "dwp": "/usr/bin/dwp",
+        "gcov": "/opt/llvm/bin/llvm-profdata",
+        "nm": "/usr/bin/nm",
+        "objcopy": "/usr/bin/objcopy",
+        "objdump": "/usr/bin/objdump",
+        "strip": "/usr/bin/strip",
+    },
+    toolchain_identifier = "local",
+    unfiltered_compile_flags = [
+        "-no-canonical-prefixes",
+        "-Wno-builtin-macro-redefined",
+        "-D__DATE__=\"redacted\"",
+        "-D__TIMESTAMP__=\"redacted\"",
+        "-D__TIME__=\"redacted\"",
+    ],
+)
+
+cc_toolchain(
+    name = "cc-compiler-aarch64",
+    all_files = ":compiler_deps_aarch64",
+    ar_files = ":compiler_deps_aarch64",
+    as_files = ":compiler_deps_aarch64",
+    compiler_files = ":compiler_deps_aarch64",
+    dwp_files = ":empty",
+    linker_files = ":compiler_deps_aarch64",
+    module_map = ":arm64.module.modulemap",
+    objcopy_files = ":empty",
+    strip_files = ":empty",
+    supports_param_files = 1,
+    toolchain_config = ":arm64-local",
+    toolchain_identifier = "arm64-local",
+)