From 15abac75430f47cae7f68d5c03515c098f185e27 Mon Sep 17 00:00:00 2001 From: Muhammad Waqar Date: Thu, 30 Apr 2026 14:58:12 -0400 Subject: [PATCH 1/5] api: split ClusterSettings into BackendClusterSettings for CDS-only fields Extract CDS-only fields (LoadBalancer, ProxyProtocol, TCPKeepalive, HealthCheck, CircuitBreaker, Timeout, Connection, DNS, HTTP2) into BackendClusterSettings. ClusterSettings embeds it inline and adds Retry. JSON field paths are unchanged (non-breaking). Closes #8898 Signed-off-by: Muhammad Waqar --- api/v1alpha1/shared_types.go | 23 +- api/v1alpha1/zz_generated.deepcopy.go | 106 ++- ...clustersettings_backendutilization_test.go | 8 +- site/content/en/latest/api/extension_types.md | 305 ++----- .../backendtrafficpolicy_test.go | 812 ++++++++++-------- 5 files changed, 602 insertions(+), 652 deletions(-) diff --git a/api/v1alpha1/shared_types.go b/api/v1alpha1/shared_types.go index d33f6544d3..0b80ab8584 100644 --- a/api/v1alpha1/shared_types.go +++ b/api/v1alpha1/shared_types.go @@ -642,21 +642,14 @@ type BackendCluster struct { BackendSettings *ClusterSettings `json:"backendSettings,omitempty"` } -// ClusterSettings provides the various knobs that can be set to control how traffic to a given -// backend will be configured. -// +// BackendClusterSettings contains CDS-only fields that configure the upstream Envoy Cluster. // +kubebuilder:validation:XValidation:rule="!((has(self.connection) && has(self.connection.preconnect) && has(self.connection.preconnect.predictivePercent)) && !(has(self.loadBalancer) && has(self.loadBalancer.type) && self.loadBalancer.type in ['Random', 'RoundRobin']))",message="predictivePercent in preconnect policy only works with RoundRobin or Random load balancers" -type ClusterSettings struct { +type BackendClusterSettings struct { // LoadBalancer policy to apply when routing traffic from the gateway to // the backend endpoints. Defaults to `LeastRequest`. // +optional LoadBalancer *LoadBalancer `json:"loadBalancer,omitempty"` - // Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions. - // If not set, retry will be disabled. - // +optional - Retry *Retry `json:"retry,omitempty"` - // ProxyProtocol enables the Proxy Protocol when communicating with the backend. // +optional ProxyProtocol *ProxyProtocol `json:"proxyProtocol,omitempty"` @@ -699,6 +692,18 @@ type ClusterSettings struct { HTTP2 *HTTP2Settings `json:"http2,omitempty"` } +// ClusterSettings provides the various knobs that can be set to control how traffic to a given +// backend will be configured. It embeds BackendClusterSettings (CDS-only fields) and adds +// route-level fields like Retry. +type ClusterSettings struct { + BackendClusterSettings `json:",inline"` + + // Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions. + // If not set, retry will be disabled. + // +optional + Retry *Retry `json:"retry,omitempty"` +} + // CIDR defines a CIDR Address range. // A CIDR can be an IPv4 address range such as "192.168.1.0/24" or an IPv6 address range such as "2001:0db8:11a3:09d7::/64". // +kubebuilder:validation:Pattern=`((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\/([0-9]+))|((([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\/([0-9]+))` diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index 7730ebed2b..6b42322824 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -440,6 +440,66 @@ func (in *BackendCluster) DeepCopy() *BackendCluster { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *BackendClusterSettings) DeepCopyInto(out *BackendClusterSettings) { + *out = *in + if in.LoadBalancer != nil { + in, out := &in.LoadBalancer, &out.LoadBalancer + *out = new(LoadBalancer) + (*in).DeepCopyInto(*out) + } + if in.ProxyProtocol != nil { + in, out := &in.ProxyProtocol, &out.ProxyProtocol + *out = new(ProxyProtocol) + **out = **in + } + if in.TCPKeepalive != nil { + in, out := &in.TCPKeepalive, &out.TCPKeepalive + *out = new(TCPKeepalive) + (*in).DeepCopyInto(*out) + } + if in.HealthCheck != nil { + in, out := &in.HealthCheck, &out.HealthCheck + *out = new(HealthCheck) + (*in).DeepCopyInto(*out) + } + if in.CircuitBreaker != nil { + in, out := &in.CircuitBreaker, &out.CircuitBreaker + *out = new(CircuitBreaker) + (*in).DeepCopyInto(*out) + } + if in.Timeout != nil { + in, out := &in.Timeout, &out.Timeout + *out = new(Timeout) + (*in).DeepCopyInto(*out) + } + if in.Connection != nil { + in, out := &in.Connection, &out.Connection + *out = new(BackendConnection) + (*in).DeepCopyInto(*out) + } + if in.DNS != nil { + in, out := &in.DNS, &out.DNS + *out = new(DNS) + (*in).DeepCopyInto(*out) + } + if in.HTTP2 != nil { + in, out := &in.HTTP2, &out.HTTP2 + *out = new(HTTP2Settings) + (*in).DeepCopyInto(*out) + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendClusterSettings. +func (in *BackendClusterSettings) DeepCopy() *BackendClusterSettings { + if in == nil { + return nil + } + out := new(BackendClusterSettings) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *BackendConnection) DeepCopyInto(out *BackendConnection) { *out = *in @@ -1608,56 +1668,12 @@ func (in *ClientValidationContext) DeepCopy() *ClientValidationContext { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *ClusterSettings) DeepCopyInto(out *ClusterSettings) { *out = *in - if in.LoadBalancer != nil { - in, out := &in.LoadBalancer, &out.LoadBalancer - *out = new(LoadBalancer) - (*in).DeepCopyInto(*out) - } + in.BackendClusterSettings.DeepCopyInto(&out.BackendClusterSettings) if in.Retry != nil { in, out := &in.Retry, &out.Retry *out = new(Retry) (*in).DeepCopyInto(*out) } - if in.ProxyProtocol != nil { - in, out := &in.ProxyProtocol, &out.ProxyProtocol - *out = new(ProxyProtocol) - **out = **in - } - if in.TCPKeepalive != nil { - in, out := &in.TCPKeepalive, &out.TCPKeepalive - *out = new(TCPKeepalive) - (*in).DeepCopyInto(*out) - } - if in.HealthCheck != nil { - in, out := &in.HealthCheck, &out.HealthCheck - *out = new(HealthCheck) - (*in).DeepCopyInto(*out) - } - if in.CircuitBreaker != nil { - in, out := &in.CircuitBreaker, &out.CircuitBreaker - *out = new(CircuitBreaker) - (*in).DeepCopyInto(*out) - } - if in.Timeout != nil { - in, out := &in.Timeout, &out.Timeout - *out = new(Timeout) - (*in).DeepCopyInto(*out) - } - if in.Connection != nil { - in, out := &in.Connection, &out.Connection - *out = new(BackendConnection) - (*in).DeepCopyInto(*out) - } - if in.DNS != nil { - in, out := &in.DNS, &out.DNS - *out = new(DNS) - (*in).DeepCopyInto(*out) - } - if in.HTTP2 != nil { - in, out := &in.HTTP2, &out.HTTP2 - *out = new(HTTP2Settings) - (*in).DeepCopyInto(*out) - } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterSettings. diff --git a/internal/gatewayapi/clustersettings_backendutilization_test.go b/internal/gatewayapi/clustersettings_backendutilization_test.go index 502c857f65..43e95a5145 100644 --- a/internal/gatewayapi/clustersettings_backendutilization_test.go +++ b/internal/gatewayapi/clustersettings_backendutilization_test.go @@ -26,9 +26,11 @@ func TestBuildLoadBalancer_BackendUtilization(t *testing.T) { } policy := &egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.BackendUtilizationLoadBalancerType, - BackendUtilization: backendUtilization, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.BackendUtilizationLoadBalancerType, + BackendUtilization: backendUtilization, + }, }, } diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index 20d3157df6..535eda81be 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -308,8 +308,7 @@ _Appears in:_ | `name` | _string_ | false | | Name is a user-friendly name for the rule.
If not specified, Envoy Gateway will generate a unique name for the rule. | | `action` | _[AuthorizationAction](#authorizationaction)_ | true | | Action defines the action to be taken if the rule matches. | | `operation` | _[Operation](#operation)_ | false | | Operation specifies the operation of a request, such as HTTP methods.
If not specified, all operations are matched on. | -| `principal` | _[Principal](#principal)_ | false | | Principal specifies the client identity of a request.
If there are multiple principal types, all principals must match for the rule to match.
For example, if there are two principals: one for client IP and one for JWT claim,
the rule will match only if both the client IP and the JWT claim match. | -| `cel` | _[CELExpression](#celexpression)_ | false | | CEL specifies a Common Expression Language expression to evaluate for the
request. If specified, the expression must evaluate to true for the rule to match.
The expression can use Envoy attributes exposed to the CEL runtime.
Request attributes, such as request.path, request.url_path, request.host,
request.scheme, request.method, request.headers, and request.query, are
generally available during authorization. Connection attributes, such as
source.address, source.port, destination.address, destination.port,
connection.mtls, and connection.requested_server_name, may also be used.
Dynamic metadata and filter state produced by earlier filters may also be
available through attributes such as metadata and filter_state.
Response attributes are only available after the request completes and
should not be used for authorization decisions.
For more details, see:
https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/advanced/attributes
The rule matches only when the expression evaluates to a boolean true.
Non-boolean results, false, null, and CEL evaluation errors are treated as
no match.
Examples:
`request.headers['x-tenant'] == 'team-a'`
`request.method == 'POST' && request.path.startsWith('/admin')` | +| `principal` | _[Principal](#principal)_ | true | | Principal specifies the client identity of a request.
If there are multiple principal types, all principals must match for the rule to match.
For example, if there are two principals: one for client IP and one for JWT claim,
the rule will match only if both the client IP and the JWT claim match. | #### BackOffPolicy @@ -371,6 +370,29 @@ _Appears in:_ | `backendSettings` | _[ClusterSettings](#clustersettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | +#### BackendClusterSettings + + + +BackendClusterSettings contains CDS-only fields that configure the upstream Envoy Cluster. + +_Appears in:_ +- [BackendTrafficPolicySpec](#backendtrafficpolicyspec) +- [ClusterSettings](#clustersettings) + +| Field | Type | Required | Default | Description | +| --- | --- | --- | --- | --- | +| `loadBalancer` | _[LoadBalancer](#loadbalancer)_ | false | | LoadBalancer policy to apply when routing traffic from the gateway to
the backend endpoints. Defaults to `LeastRequest`. | +| `proxyProtocol` | _[ProxyProtocol](#proxyprotocol)_ | false | | ProxyProtocol enables the Proxy Protocol when communicating with the backend. | +| `tcpKeepalive` | _[TCPKeepalive](#tcpkeepalive)_ | false | | TcpKeepalive settings associated with the upstream client connection.
Disabled by default. | +| `healthCheck` | _[HealthCheck](#healthcheck)_ | false | | HealthCheck allows gateway to perform active health checking on backends. | +| `circuitBreaker` | _[CircuitBreaker](#circuitbreaker)_ | false | | Circuit Breaker settings for the upstream connections and requests.
If not set, circuit breakers will be enabled with the default thresholds | +| `timeout` | _[Timeout](#timeout)_ | false | | Timeout settings for the backend connections. | +| `connection` | _[BackendConnection](#backendconnection)_ | false | | Connection includes backend connection settings. | +| `dns` | _[DNS](#dns)_ | false | | DNS includes dns resolution settings. | +| `http2` | _[HTTP2Settings](#http2settings)_ | false | | HTTP2 provides HTTP/2 configuration for backend connections. | + + @@ -382,6 +404,7 @@ _Appears in:_ BackendConnection allows users to configure connection-level settings of backend _Appears in:_ +- [BackendClusterSettings](#backendclustersettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClusterSettings](#clustersettings) @@ -574,7 +597,6 @@ _Appears in:_ | `targetRefs` | _LocalPolicyTargetReferenceWithSectionName array_ | true | | TargetRefs are the names of the Gateway resources this policy
is being attached to. | | `targetSelectors` | _[TargetSelector](#targetselector) array_ | true | | TargetSelectors allow targeting resources for this policy based on labels | | `loadBalancer` | _[LoadBalancer](#loadbalancer)_ | false | | LoadBalancer policy to apply when routing traffic from the gateway to
the backend endpoints. Defaults to `LeastRequest`. | -| `retry` | _[Retry](#retry)_ | false | | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
If not set, retry will be disabled. | | `proxyProtocol` | _[ProxyProtocol](#proxyprotocol)_ | false | | ProxyProtocol enables the Proxy Protocol when communicating with the backend. | | `tcpKeepalive` | _[TCPKeepalive](#tcpkeepalive)_ | false | | TcpKeepalive settings associated with the upstream client connection.
Disabled by default. | | `healthCheck` | _[HealthCheck](#healthcheck)_ | false | | HealthCheck allows gateway to perform active health checking on backends. | @@ -583,7 +605,8 @@ _Appears in:_ | `connection` | _[BackendConnection](#backendconnection)_ | false | | Connection includes backend connection settings. | | `dns` | _[DNS](#dns)_ | false | | DNS includes dns resolution settings. | | `http2` | _[HTTP2Settings](#http2settings)_ | false | | HTTP2 provides HTTP/2 configuration for backend connections. | -| `mergeType` | _[MergeType](#mergetype)_ | false | | MergeType determines how this configuration is merged with existing BackendTrafficPolicy
configurations targeting a parent resource. When set, this configuration will be merged
into the closest parent BackendTrafficPolicy in the route's attachment hierarchy (for
example, one targeting a Gateway, Gateway listener, ListenerSet, or ListenerSet listener).
Currently, this field can only be set when targeting xRoute resources.
If unset, no merging occurs, and only the most specific configuration takes effect. | +| `retry` | _[Retry](#retry)_ | false | | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
If not set, retry will be disabled. | +| `mergeType` | _[MergeType](#mergetype)_ | false | | MergeType determines how this configuration is merged with existing BackendTrafficPolicy
configurations targeting a parent resource. When set, this configuration will be merged
into a parent BackendTrafficPolicy (i.e. the one targeting a Gateway or Listener).
This field cannot be set when targeting a parent resource (Gateway).
If unset, no merging occurs, and only the most specific configuration takes effect. | | `rateLimit` | _[RateLimitSpec](#ratelimitspec)_ | false | | RateLimit allows the user to limit the number of incoming requests
to a predefined value based on attributes within the traffic flow. | | `bandwidthLimit` | _[BandwidthLimitSpec](#bandwidthlimitspec)_ | false | | BandwidthLimit allows the user to limit the bandwidth of traffic
sent to and received from the backend. | | `faultInjection` | _[FaultInjection](#faultinjection)_ | false | | FaultInjection defines the fault injection policy to be applied. This configuration can be used to
inject delays and abort requests to mimic failure scenarios such as service failures and overloads | @@ -643,7 +666,6 @@ _Appears in:_ | `errorUtilizationPenaltyPercent` | _integer_ | false | | ErrorUtilizationPenaltyPercent adjusts endpoint weights based on the error rate (eps/qps).
This is expressed as a percentage-based integer where 100 represents 1.0, 150 represents 1.5, etc.
For example:
- 100 => 1.0x
- 120 => 1.2x
- 200 => 2.0x
Must be non-negative. | | `metricNamesForComputingUtilization` | _string array_ | false | | Metric names used to compute utilization if application_utilization is not set.
For map fields in ORCA proto, use the form ".", e.g., "named_metrics.foo". | | `keepResponseHeaders` | _boolean_ | false | false | KeepResponseHeaders keeps the ORCA load report headers/trailers before sending the response to the client.
Defaults to false. | -| `outOfBand` | _[OutOfBandReporting](#outofbandreporting)_ | false | | OutOfBand enables out-of-band ORCA load reporting. When set, Envoy opens a
server-streaming gRPC connection to each endpoint's
xds.service.orca.v3.OpenRcaService/StreamCoreMetrics and pulls load
reports periodically, instead of relying on in-band ORCA metrics
carried in response headers/trailers.
The backend must implement OpenRcaService for this to take effect. | #### BandwidthLimitRequestConfig @@ -795,17 +817,6 @@ _Appears in:_ -#### CELExpression - -_Underlying type:_ _string_ - -CELExpression specifies a CEL expression. - -_Appears in:_ -- [AuthorizationRule](#authorizationrule) - - - #### CIDR _Underlying type:_ _string_ @@ -838,24 +849,6 @@ _Appears in:_ | `allowCredentials` | _boolean_ | false | | AllowCredentials indicates whether a request can include user credentials
like cookies, authentication headers, or TLS client certificates.
It specifies the value in the Access-Control-Allow-Credentials CORS response header. | -#### CSRF - - - -CSRF defines the configuration for the Cross-Site Request Forgery (CSRF) filter. -The CSRF filter checks that the Origin header in HTTP requests matches the destination, -preventing cross-origin mutating requests (POST, PUT, DELETE, PATCH) from being processed. -GET and HEAD requests are always allowed. - -_Appears in:_ -- [SecurityPolicySpec](#securitypolicyspec) - -| Field | Type | Required | Default | Description | -| --- | --- | --- | --- | --- | -| `shadowFraction` | _[Fraction](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#fraction)_ | false | | ShadowFraction represents the fraction of requests for which the CSRF policy is
evaluated in shadow (dry-run) mode. For these requests, the filter records whether
the request would have been allowed or rejected in the `csrf.request_valid` and
`csrf.request_invalid` stats, but always lets the request through. The remaining
requests are enforced, i.e. a mutating request with a missing or non-matching
Origin header is rejected with a 403.
Defaults to 0% (all requests are enforced) if not specified. Set it to 100% to
dry run the filter, watch the stats to find origins that would be rejected, then
lower it to roll enforcement out gradually. | -| `additionalOrigins` | _[Origin](#origin) array_ | false | | AdditionalOrigins specifies additional origins that are allowed to make mutating
requests, beyond the destination origin. A request whose Origin header matches one
of them is allowed. The value "*" allows any origin, which effectively disables
origin validation.
Note: Envoy's CSRF filter compares the host and port of the origin only, so the
scheme is ignored: "https://www.example.com" and "http://www.example.com" are
equivalent here, and both allow the request regardless of the scheme the client
used. | - - #### CircuitBreaker @@ -863,6 +856,7 @@ _Appears in:_ CircuitBreaker defines the Circuit Breaker configuration. _Appears in:_ +- [BackendClusterSettings](#backendclustersettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClusterSettings](#clustersettings) @@ -914,8 +908,6 @@ _Appears in:_ ClientIPDetectionSettings provides configuration for determining the original client IP address for requests. -Exactly one of XForwardedFor, CustomHeader, or DirectSourceIP must be set. - _Appears in:_ - [ClientTrafficPolicySpec](#clienttrafficpolicyspec) @@ -923,7 +915,6 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `xForwardedFor` | _[XForwardedForSettings](#xforwardedforsettings)_ | false | | XForwardedForSettings provides configuration for using X-Forwarded-For headers for determining the client IP address. | | `customHeader` | _[CustomHeaderExtensionSettings](#customheaderextensionsettings)_ | false | | CustomHeader provides configuration for determining the client IP address for a request based on
a trusted custom HTTP header. This uses the custom_header original IP detection extension.
Refer to https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/http/original_ip_detection/custom_header/v3/custom_header.proto
for more details. | -| `directSourceIP` | _[DirectSourceIPSettings](#directsourceipsettings)_ | false | | DirectSourceIP configures the geoip filter to use the downstream connection
source address (the TCP peer of the connection terminated by Envoy) as the client IP.
Use this in L4-transparent topologies where a load balancer preserves the original
client source IP at TCP level and does not populate XFF or a custom header — for
example, AWS NLB with target-type=instance + externalTrafficPolicy=Local, or
Azure Standard Load Balancer.
Mutually exclusive with XForwardedFor and CustomHeader. | #### ClientIPGeoLocation @@ -1051,7 +1042,6 @@ _Appears in:_ | `certificateHashes` | _string array_ | false | | An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will
verify that the SHA-256 of the DER-encoded presented certificate matches
one of the specified values. | | `subjectAltNames` | _[SubjectAltNames](#subjectaltnames)_ | false | | An optional list of Subject Alternative name matchers. If specified, Envoy
will verify that the Subject Alternative Name of the presented certificate
matches one of the specified matchers | | `crl` | _[CrlContext](#crlcontext)_ | false | | Crl specifies the crl configuration that can be used to validate the client initiating the TLS connection | -| `allowExpiredCertificate` | _boolean_ | false | | AllowExpiredCertificate permits client certificates that have expired
but are otherwise valid (CA chain, signature). When true, Envoy skips
the NotAfter check during client certificate validation.
Defaults to false. | #### ClientValidationModeType @@ -1076,7 +1066,8 @@ _Appears in:_ ClusterSettings provides the various knobs that can be set to control how traffic to a given -backend will be configured. +backend will be configured. It embeds BackendClusterSettings (CDS-only fields) and adds +route-level fields like Retry. _Appears in:_ - [ALSEnvoyProxyAccessLog](#alsenvoyproxyaccesslog) @@ -1094,7 +1085,6 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `loadBalancer` | _[LoadBalancer](#loadbalancer)_ | false | | LoadBalancer policy to apply when routing traffic from the gateway to
the backend endpoints. Defaults to `LeastRequest`. | -| `retry` | _[Retry](#retry)_ | false | | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
If not set, retry will be disabled. | | `proxyProtocol` | _[ProxyProtocol](#proxyprotocol)_ | false | | ProxyProtocol enables the Proxy Protocol when communicating with the backend. | | `tcpKeepalive` | _[TCPKeepalive](#tcpkeepalive)_ | false | | TcpKeepalive settings associated with the upstream client connection.
Disabled by default. | | `healthCheck` | _[HealthCheck](#healthcheck)_ | false | | HealthCheck allows gateway to perform active health checking on backends. | @@ -1103,6 +1093,7 @@ _Appears in:_ | `connection` | _[BackendConnection](#backendconnection)_ | false | | Connection includes backend connection settings. | | `dns` | _[DNS](#dns)_ | false | | DNS includes dns resolution settings. | | `http2` | _[HTTP2Settings](#http2settings)_ | false | | HTTP2 provides HTTP/2 configuration for backend connections. | +| `retry` | _[Retry](#retry)_ | false | | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
If not set, retry will be disabled. | #### ClusterTranslationConfig @@ -1434,6 +1425,7 @@ _Appears in:_ _Appears in:_ +- [BackendClusterSettings](#backendclustersettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClusterSettings](#clustersettings) @@ -1462,19 +1454,6 @@ _Appears in:_ | `IPv4AndIPv6` | IPv4AndIPv6DNSLookupFamily mean the DNS resolver will perform a lookup for both IPv4 and IPv6 families, and return all resolved
addresses. When this is used, Happy Eyeballs will be enabled for upstream connections.
| -#### DirectSourceIPSettings - - - -DirectSourceIPSettings configures client IP detection from the downstream -connection source address. It currently has no fields; its presence opts the listener -into using the TCP peer address as the client IP. - -_Appears in:_ -- [ClientIPDetectionSettings](#clientipdetectionsettings) - - - #### DynamicModule @@ -1661,7 +1640,6 @@ _Appears in:_ | `envoy.filters.http.health_check` | EnvoyFilterHealthCheck defines the Envoy HTTP health check filter.
| | `envoy.filters.http.fault` | EnvoyFilterFault defines the Envoy HTTP fault filter.
| | `envoy.filters.http.cors` | EnvoyFilterCORS defines the Envoy HTTP CORS filter.
| -| `envoy.filters.http.csrf` | EnvoyFilterCSRF defines the Envoy HTTP CSRF filter.
| | `envoy.filters.http.header_mutation` | EnvoyFilterHeaderMutation defines the Envoy HTTP header mutation filter
| | `envoy.filters.http.ext_authz` | EnvoyFilterExtAuthz defines the Envoy HTTP external authorization filter.
| | `envoy.filters.http.api_key_auth` | EnvoyFilterAPIKeyAuth defines the Envoy HTTP api key authentication filter.
| @@ -1803,63 +1781,8 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | -| `type` | _[InfrastructureProviderType](#infrastructureprovidertype)_ | true | | Type is the type of infrastructure providers to use. Supported types are "Host" or "Remote". | +| `type` | _[InfrastructureProviderType](#infrastructureprovidertype)_ | true | | Type is the type of infrastructure providers to use. Supported types are "Host". | | `host` | _[EnvoyGatewayHostInfrastructureProvider](#envoygatewayhostinfrastructureprovider)_ | false | | Host defines the configuration of the Host provider. Host provides runtime
deployment of the data plane as a child process on the host environment. | -| `remote` | _[EnvoyGatewayRemoteInfrastructureProvider](#envoygatewayremoteinfrastructureprovider)_ | false | | Remote defines the configuration of the Remote provider. Remotes defers
runtime deployment of the data plane to aW remote infrastructure manager. | - - -#### EnvoyGatewayKubernetesConfiguration - - - -EnvoyGatewayKubernetesConfiguration defines configuration for how Envoy Gateway communicates with the Kubernetes API server. - -_Appears in:_ -- [EnvoyGatewayKubernetesCustomProvider](#envoygatewaykubernetescustomprovider) -- [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) - -| Field | Type | Required | Default | Description | -| --- | --- | --- | --- | --- | -| `watch` | _[KubernetesWatchMode](#kuberneteswatchmode)_ | false | | Watch holds configuration of which input resources should be watched and reconciled. | -| `leaderElection` | _[LeaderElection](#leaderelection)_ | false | | LeaderElection specifies the configuration for leader election.
If it's not set up, leader election will be active by default, using Kubernetes' standard settings. | -| `client` | _[KubernetesClient](#kubernetesclient)_ | true | | Client holds the configuration for the Kubernetes client. | -| `cacheSyncPeriod` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | CacheSyncPeriod determines the minimum frequency at which watched resources are synced.
Note that a sync in the provider layer will not lead to a full reconciliation (including translation),
unless there are actual changes in the provider resources.
This option can be used to protect against missed events or issues in Envoy Gateway where resources
are not requeued when they should be, at the cost of increased resource consumption.
Learn more about the implications of this option: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/cache#Options
Default: 10 hours | - - -#### EnvoyGatewayKubernetesCustomProvider - - - -EnvoyGatewayKubernetesCustomProvider defines configuration for the Kubernetes provider when using a Custom provider. - -_Appears in:_ -- [EnvoyGatewayResourceProvider](#envoygatewayresourceprovider) - -| Field | Type | Required | Default | Description | -| --- | --- | --- | --- | --- | -| `watch` | _[KubernetesWatchMode](#kuberneteswatchmode)_ | false | | Watch holds configuration of which input resources should be watched and reconciled. | -| `leaderElection` | _[LeaderElection](#leaderelection)_ | false | | LeaderElection specifies the configuration for leader election.
If it's not set up, leader election will be active by default, using Kubernetes' standard settings. | -| `client` | _[KubernetesClient](#kubernetesclient)_ | true | | Client holds the configuration for the Kubernetes client. | -| `cacheSyncPeriod` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | CacheSyncPeriod determines the minimum frequency at which watched resources are synced.
Note that a sync in the provider layer will not lead to a full reconciliation (including translation),
unless there are actual changes in the provider resources.
This option can be used to protect against missed events or issues in Envoy Gateway where resources
are not requeued when they should be, at the cost of increased resource consumption.
Learn more about the implications of this option: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/cache#Options
Default: 10 hours | - - -#### EnvoyGatewayKubernetesInfrastructureConfiguration - - - -EnvoyGatewayKubernetesInfrastructureConfiguration defines configuration for the Kubernetes infrastructure provider. - -_Appears in:_ -- [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) - -| Field | Type | Required | Default | Description | -| --- | --- | --- | --- | --- | -| `rateLimitDeployment` | _[KubernetesDeploymentSpec](#kubernetesdeploymentspec)_ | false | | RateLimitDeployment defines the desired state of the Envoy ratelimit deployment resource.
If unspecified, default settings for the managed Envoy ratelimit deployment resource
are applied. | -| `rateLimitHpa` | _[KubernetesHorizontalPodAutoscalerSpec](#kuberneteshorizontalpodautoscalerspec)_ | false | | RateLimitHpa defines the Horizontal Pod Autoscaler settings for Envoy ratelimit Deployment.
If the HPA is set, Replicas field from RateLimitDeployment will be ignored. | -| `rateLimitPDB` | _[KubernetesPodDisruptionBudgetSpec](#kubernetespoddisruptionbudgetspec)_ | false | | RateLimitPDB allows to control the pod disruption budget of rate limit service. | -| `deploy` | _[KubernetesDeployMode](#kubernetesdeploymode)_ | false | | Deploy holds configuration of how output managed resources such as the Envoy Proxy data plane
should be deployed | -| `shutdownManager` | _[ShutdownManager](#shutdownmanager)_ | false | | ShutdownManager defines the configuration for the shutdown manager. | -| `proxyTopologyInjector` | _[EnvoyGatewayTopologyInjector](#envoygatewaytopologyinjector)_ | false | | TopologyInjector defines the configuration for topology injector MutatatingWebhookConfiguration | #### EnvoyGatewayKubernetesProvider @@ -1876,12 +1799,12 @@ _Appears in:_ | `rateLimitDeployment` | _[KubernetesDeploymentSpec](#kubernetesdeploymentspec)_ | false | | RateLimitDeployment defines the desired state of the Envoy ratelimit deployment resource.
If unspecified, default settings for the managed Envoy ratelimit deployment resource
are applied. | | `rateLimitHpa` | _[KubernetesHorizontalPodAutoscalerSpec](#kuberneteshorizontalpodautoscalerspec)_ | false | | RateLimitHpa defines the Horizontal Pod Autoscaler settings for Envoy ratelimit Deployment.
If the HPA is set, Replicas field from RateLimitDeployment will be ignored. | | `rateLimitPDB` | _[KubernetesPodDisruptionBudgetSpec](#kubernetespoddisruptionbudgetspec)_ | false | | RateLimitPDB allows to control the pod disruption budget of rate limit service. | -| `deploy` | _[KubernetesDeployMode](#kubernetesdeploymode)_ | false | | Deploy holds configuration of how output managed resources such as the Envoy Proxy data plane
should be deployed | -| `shutdownManager` | _[ShutdownManager](#shutdownmanager)_ | false | | ShutdownManager defines the configuration for the shutdown manager. | -| `proxyTopologyInjector` | _[EnvoyGatewayTopologyInjector](#envoygatewaytopologyinjector)_ | false | | TopologyInjector defines the configuration for topology injector MutatatingWebhookConfiguration | | `watch` | _[KubernetesWatchMode](#kuberneteswatchmode)_ | false | | Watch holds configuration of which input resources should be watched and reconciled. | +| `deploy` | _[KubernetesDeployMode](#kubernetesdeploymode)_ | false | | Deploy holds configuration of how output managed resources such as the Envoy Proxy data plane
should be deployed | | `leaderElection` | _[LeaderElection](#leaderelection)_ | false | | LeaderElection specifies the configuration for leader election.
If it's not set up, leader election will be active by default, using Kubernetes' standard settings. | +| `shutdownManager` | _[ShutdownManager](#shutdownmanager)_ | false | | ShutdownManager defines the configuration for the shutdown manager. | | `client` | _[KubernetesClient](#kubernetesclient)_ | true | | Client holds the configuration for the Kubernetes client. | +| `proxyTopologyInjector` | _[EnvoyGatewayTopologyInjector](#envoygatewaytopologyinjector)_ | false | | TopologyInjector defines the configuration for topology injector MutatatingWebhookConfiguration | | `cacheSyncPeriod` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | CacheSyncPeriod determines the minimum frequency at which watched resources are synced.
Note that a sync in the provider layer will not lead to a full reconciliation (including translation),
unless there are actual changes in the provider resources.
This option can be used to protect against missed events or issues in Envoy Gateway where resources
are not requeued when they should be, at the cost of increased resource consumption.
Learn more about the implications of this option: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/cache#Options
Default: 10 hours | @@ -2018,20 +1941,6 @@ _Appears in:_ | `custom` | _[EnvoyGatewayCustomProvider](#envoygatewaycustomprovider)_ | false | | Custom defines the configuration for the Custom provider. This provider
allows you to define a specific resource provider and an infrastructure
provider. | -#### EnvoyGatewayRemoteInfrastructureProvider - - - -EnvoyGatewayRemoteInfrastructureProvider defines configuration for the Remote Infrastructure provider. - -_Appears in:_ -- [EnvoyGatewayInfrastructureProvider](#envoygatewayinfrastructureprovider) - -| Field | Type | Required | Default | Description | -| --- | --- | --- | --- | --- | -| `service` | _[ExtensionService](#extensionservice)_ | true | | Service defines the configuration of the remote infrastructure service that the Envoy
Gateway Control Plane will call through the infrastructure manager. | - - #### EnvoyGatewayResourceProvider @@ -2043,9 +1952,8 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | -| `type` | _[ResourceProviderType](#resourceprovidertype)_ | true | | Type is the type of resource provider to use. Supported types are "File" or "Kubernetes". | +| `type` | _[ResourceProviderType](#resourceprovidertype)_ | true | | Type is the type of resource provider to use. Supported types are "File". | | `file` | _[EnvoyGatewayFileResourceProvider](#envoygatewayfileresourceprovider)_ | false | | File defines the configuration of the File provider. File provides runtime
configuration defined by one or more files. | -| `kubernetes` | _[EnvoyGatewayKubernetesCustomProvider](#envoygatewaykubernetescustomprovider)_ | false | | Kubernetes defines the configuration of the Kubernetes provider. This provider retrieves Envoy configuration
from a Kubernetes API. | #### EnvoyGatewaySpec @@ -2098,7 +2006,6 @@ _Appears in:_ EnvoyGatewayTopologyInjector defines the configuration for topology injector MutatatingWebhookConfiguration _Appears in:_ -- [EnvoyGatewayKubernetesInfrastructureConfiguration](#envoygatewaykubernetesinfrastructureconfiguration) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) | Field | Type | Required | Default | Description | @@ -2282,7 +2189,7 @@ _Appears in:_ | `envoyDeployment` | _[KubernetesDeploymentSpec](#kubernetesdeploymentspec)_ | false | | EnvoyDeployment defines the desired state of the Envoy deployment resource.
If unspecified, default settings for the managed Envoy deployment resource
are applied. | | `envoyDaemonSet` | _[KubernetesDaemonSetSpec](#kubernetesdaemonsetspec)_ | false | | EnvoyDaemonSet defines the desired state of the Envoy daemonset resource.
Disabled by default, a deployment resource is used instead to provision the Envoy Proxy fleet | | `envoyService` | _[KubernetesServiceSpec](#kubernetesservicespec)_ | false | | EnvoyService defines the desired state of the Envoy service resource.
If unspecified, default settings for the managed Envoy service resource
are applied. | -| `envoyHpa` | _[KubernetesHorizontalPodAutoscalerSpec](#kuberneteshorizontalpodautoscalerspec)_ | false | | EnvoyHpa defines the Horizontal Pod Autoscaler settings for Envoy Proxy Deployment.
If the HPA is set, the Replicas field from EnvoyDeployment will be ignored, and the
number of replicas is solely managed by the HPA. Use MinReplicas to control the
lower bound of the replica count instead. | +| `envoyHpa` | _[KubernetesHorizontalPodAutoscalerSpec](#kuberneteshorizontalpodautoscalerspec)_ | false | | EnvoyHpa defines the Horizontal Pod Autoscaler settings for Envoy Proxy Deployment. | | `useListenerPortAsContainerPort` | _boolean_ | false | | UseListenerPortAsContainerPort disables the port shifting feature in the Envoy Proxy.
When set to false (default value), if the service port is a privileged port (1-1023), add a constant to the value converting it into an ephemeral port.
This allows the container to bind to the port without needing a CAP_NET_BIND_SERVICE capability. | | `envoyPDB` | _[KubernetesPodDisruptionBudgetSpec](#kubernetespoddisruptionbudgetspec)_ | false | | EnvoyPDB allows to control the pod disruption budget of an Envoy Proxy. | | `envoyServiceAccount` | _[KubernetesServiceAccountSpec](#kubernetesserviceaccountspec)_ | true | | EnvoyServiceAccount defines the desired state of the Envoy service account resource. | @@ -2299,7 +2206,7 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | -| `type` | _[EnvoyProxyProviderType](#envoyproxyprovidertype)_ | true | | Type is the type of resource provider to use. A resource provider provides
infrastructure resources for running the data plane, e.g. Envoy proxy, and
optional auxiliary control planes. Supported types are "Kubernetes" and "Host". | +| `type` | _[EnvoyProxyProviderType](#envoyproxyprovidertype)_ | true | | Type is the type of resource provider to use. A resource provider provides
infrastructure resources for running the data plane, e.g. Envoy proxy, and
optional auxiliary control planes. Supported types are "Kubernetes"and "Host". | | `kubernetes` | _[EnvoyProxyKubernetesProvider](#envoyproxykubernetesprovider)_ | false | | Kubernetes defines the desired state of the Kubernetes resource provider.
Kubernetes provides infrastructure resources for running the data plane,
e.g. Envoy proxy. If unspecified and type is "Kubernetes", default settings
for managed Kubernetes resources are applied. | | `host` | _[EnvoyProxyHostProvider](#envoyproxyhostprovider)_ | false | | Host provides runtime deployment of the data plane as a child process on the
host environment.
If unspecified and type is "Host", default settings for the custom provider
are applied. | @@ -2339,8 +2246,7 @@ _Appears in:_ | `concurrency` | _integer_ | false | | Concurrency defines the number of worker threads to run. If unset, it defaults to
the number of cpuset threads on the platform. | | `routingType` | _[RoutingType](#routingtype)_ | false | | RoutingType can be set to "Service" to use the Service Cluster IP for routing to the backend,
or it can be set to "Endpoint" to use Endpoint routing. The default is "Endpoint". | | `extraArgs` | _string array_ | false | | ExtraArgs defines additional command line options that are provided to Envoy.
More info: https://www.envoyproxy.io/docs/envoy/latest/operations/cli#command-line-options
Note: some command line options are used internally(e.g. --log-level) so they cannot be provided here. | -| `mergeGateways` | _boolean_ | false | | MergeGateways defines if Gateway resources should be merged onto the same Envoy Proxy Infrastructure.
Setting this field to true would merge all Gateway Listeners under the parent Gateway Class.
This means that the port, protocol and hostname tuple must be unique for every listener.
If a duplicate listener is detected, the newer listener (based on timestamp) will be rejected and its status will be updated with a "Accepted=False" condition.
Mutually exclusive with MergeBackends. | -| `mergeBackends` | _[MergeBackendsConfig](#mergebackendsconfig)_ | false | | MergeBackends configures cluster deduplication: routes that reference the same backend
share a single Envoy cluster instead of Envoy Gateway generating one cluster per route
rule. This reduces xDS size, active health-check traffic, and stats cardinality, and
improves upstream connection pooling.
Disabled when unset; specifying this field at all (even without further configuration)
enables it. Mutually exclusive with MergeGateways. | +| `mergeGateways` | _boolean_ | false | | MergeGateways defines if Gateway resources should be merged onto the same Envoy Proxy Infrastructure.
Setting this field to true would merge all Gateway Listeners under the parent Gateway Class.
This means that the port, protocol and hostname tuple must be unique for every listener.
If a duplicate listener is detected, the newer listener (based on timestamp) will be rejected and its status will be updated with a "Accepted=False" condition. | | `shutdown` | _[ShutdownConfig](#shutdownconfig)_ | false | | Shutdown defines configuration for graceful envoy shutdown process. | | `filterOrder` | _[FilterPosition](#filterposition) array_ | false | | FilterOrder defines the order of filters in the Envoy proxy's HTTP filter chain.
The FilterPosition in the list will be applied in the order they are defined.
If unspecified, the default filter order is applied.
Default filter order is:
- envoy.filters.http.custom_response
- envoy.filters.http.health_check
- envoy.filters.http.fault
- envoy.filters.http.cors
- envoy.filters.http.header_mutation
- envoy.filters.http.ext_authz
- envoy.filters.http.api_key_auth
- envoy.filters.http.basic_auth
- envoy.filters.http.oauth2
- envoy.filters.http.jwt_authn
- envoy.filters.http.stateful_session
- envoy.filters.http.buffer
- envoy.filters.http.lua
- envoy.filters.http.ext_proc
- envoy.filters.http.wasm
- envoy.filters.http.dynamic_modules
- envoy.filters.http.geoip
- envoy.filters.http.rbac
- envoy.filters.http.local_ratelimit
- envoy.filters.http.ratelimit
- envoy.filters.http.bandwidth_limit
- envoy.filters.http.grpc_web
- envoy.filters.http.grpc_stats
- envoy.filters.http.credential_injector
- envoy.filters.http.compressor
- envoy.filters.http.dynamic_forward_proxy
- envoy.filters.http.router
Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain. | | `backendTLS` | _[BackendTLSConfig](#backendtlsconfig)_ | false | | BackendTLS is the TLS configuration for the Envoy proxy to use when connecting to backends.
These settings are applied on backends for which TLS policies are specified. | @@ -2423,9 +2329,7 @@ _Appears in:_ | `messageTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | MessageTimeout is the timeout for a response to be returned from the external processor
Default: 200ms | | `failOpen` | _boolean_ | false | false | FailOpen is a switch used to control the behavior when failing to call the external processor.
If FailOpen is set to true, the system bypasses the ExtProc extension and
allows the traffic to pass through. If it is set to false or
not set (defaulting to false), the system blocks the traffic and returns
an HTTP 5xx error.
If set to true, the ExtProc extension will also be bypassed if the configuration is invalid. | | `processingMode` | _[ExtProcProcessingMode](#extprocprocessingmode)_ | false | | ProcessingMode defines how request and response body is processed
Default: header and body are not sent to the external processor | -| `shadowMode` | _boolean_ | false | | ShadowMode sets if envoy gateway should treat this external processor as "send and go".
When enabled, Envoy forwards request/response data to the external processor but does
not wait for or apply any response from it. This maps to Envoy's `observability_mode`
on the ext_proc filter.
Defaults to false. | | `metadata` | _[ExtProcMetadata](#extprocmetadata)_ | false | | Refer to Kubernetes API documentation for fields of `metadata`. | -| `statusOnError` | _integer_ | false | | Sets the HTTP status that is returned to the client when the external processor returns an error
or cannot be reached. Defaults to 500 Internal Server Error.
Only 4xx and 5xx status codes are supported. | #### ExtProcBodyProcessingMode @@ -2541,7 +2445,6 @@ _Appears in:_ ExtensionService defines the configuration for connecting to a registered extension service. _Appears in:_ -- [EnvoyGatewayRemoteInfrastructureProvider](#envoygatewayremoteinfrastructureprovider) - [ExtensionManager](#extensionmanager) | Field | Type | Required | Default | Description | @@ -3033,6 +2936,7 @@ _Appears in:_ HTTP2Settings provides HTTP/2 configuration for listeners and backends. _Appears in:_ +- [BackendClusterSettings](#backendclustersettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClientTrafficPolicySpec](#clienttrafficpolicyspec) - [ClusterSettings](#clustersettings) @@ -3141,7 +3045,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `contentType` | _string_ | false | | Content Type of the direct response. This will be set in the Content-Type header. | | `body` | _[CustomResponseBody](#customresponsebody)_ | false | | Body of the direct response.
Supports Envoy command operators for dynamic content (see https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators). | -| `statusCode` | _integer_ | false | | Status Code of the HTTP response
If unset, defaults to 200.
Note: when this filter is referenced from a GRPCRoute, a 2xx status code
(including the default 200) is rejected; a non-2xx status code must be set. | +| `statusCode` | _integer_ | false | | Status Code of the HTTP response
If unset, defaults to 200. | | `header` | _[HTTPHeaderFilter](#httpheaderfilter)_ | false | | Header defines the headers of the direct response. | @@ -3200,7 +3104,6 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `type` | _[HTTPHostnameModifierType](#httphostnamemodifiertype)_ | true | | | | `header` | _string_ | false | | Header is the name of the header whose value would be used to rewrite the Host header | -| `pathRegex` | _[HostnamePathRegexRewrite](#hostnamepathregexrewrite)_ | false | | PathRegex defines a regex match and substitution applied to the request path to compute
the rewritten Host header.
For example, with:
pathRegex:
pattern: "^/tenant/([a-z0-9-]+)/.*"
substitution: "\\1.example.internal"
a request to "http://foo.bar.com/tenant/tenant1/api/v1" has its upstream Host header rewritten
to "tenant1.example.internal" (the request path "/tenant/tenant1/api/v1" is preserved). | #### HTTPHostnameModifierType @@ -3216,7 +3119,6 @@ _Appears in:_ | ----- | ----------- | | `Header` | HeaderHTTPHostnameModifier indicates that the Host header value would be replaced with the value of the header specified in header.
https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-host-rewrite-header
| | `Backend` | BackendHTTPHostnameModifier indicates that the Host header value would be replaced by the DNS name of the backend if it exists.
https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-auto-host-rewrite
| -| `PathRegex` | PathRegexHTTPHostnameModifier indicates that the Host header value would be rewritten by applying a regex
match and substitution to the request path.
https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-host-rewrite-path-regex
| #### HTTPPathModifier @@ -3277,7 +3179,7 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `urlRewrite` | _[HTTPURLRewriteFilter](#httpurlrewritefilter)_ | false | | | -| `directResponse` | _[HTTPDirectResponseFilter](#httpdirectresponsefilter)_ | false | | DirectResponse returns a fixed response for matching requests.
When this filter is referenced from a GRPCRoute, only a non-2xx status code
is supported. gRPC signals success with a grpc-status trailer and a response
message, which a direct response cannot produce, so a 2xx status code (which
maps to the gRPC OK status) yields an invalid response for gRPC clients. Use a
non-2xx status code to deny or block gRPC requests (e.g. 403 maps to
PERMISSION_DENIED, 404 to UNIMPLEMENTED, 429/503 to UNAVAILABLE). | +| `directResponse` | _[HTTPDirectResponseFilter](#httpdirectresponsefilter)_ | false | | | | `credentialInjection` | _[HTTPCredentialInjectionFilter](#httpcredentialinjectionfilter)_ | false | | | | `matches` | _[HTTPRouteMatchFilter](#httproutematchfilter) array_ | false | | Matches defines additional matching criteria for the HTTPRoute rule.
As with HTTPRouteRule.Matches, the rule is matched if any one match applies.
When both HTTPRouteRule.Matches and HTTPRouteFilter.Matches are set, the
effective matching is the logical AND of the two sets. | @@ -3442,7 +3344,6 @@ _Appears in:_ | `requestID` | _[RequestIDAction](#requestidaction)_ | false | | RequestID configures Envoy's behavior for handling the `X-Request-ID` header.
When omitted default behavior is `Generate` which builds the `X-Request-ID` for every request
and ignores pre-existing values from the edge.
(An "edge request" refers to a request from an external client to the Envoy entrypoint.) | | `earlyRequestHeaders` | _[HTTPHeaderFilter](#httpheaderfilter)_ | false | | EarlyRequestHeaders defines settings for early request header modification, before envoy performs
routing, tracing and built-in header manipulation. | | `lateResponseHeaders` | _[HTTPHeaderFilter](#httpheaderfilter)_ | false | | LateResponseHeaders defines settings for global response header modification. | -| `host` | _[HostSettings](#hostsettings)_ | false | | Host enables managing how the Host/Authority header set by clients can be normalized. | #### HealthCheck @@ -3453,6 +3354,7 @@ HealthCheck configuration to decide which endpoints are healthy and can be used for routing. _Appears in:_ +- [BackendClusterSettings](#backendclustersettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClusterSettings](#clustersettings) @@ -3491,36 +3393,6 @@ _Appears in:_ | `path` | _string_ | true | | Path specifies the HTTP path to match on for health check requests. | -#### HostSettings - - - -HostSettings provides settings that manage how the incoming Host/Authority header -set by clients is normalized. - -_Appears in:_ -- [HeaderSettings](#headersettings) - -| Field | Type | Required | Default | Description | -| --- | --- | --- | --- | --- | -| `stripTrailingHostDot` | _boolean_ | false | | StripTrailingHostDot determines if the trailing dot of the host should be removed
from the Host/Authority header before any processing of the request.
This affects the upstream host header as well. Without this option, incoming requests
with host "example.com." will not match routes with domains set to "example.com".
When the host includes a port (for example "example.com.:443"), only the trailing dot
from the host section is stripped, leaving the port as-is ("example.com:443").
Defaults to false. | - - -#### HostnamePathRegexRewrite - - - -HostnamePathRegexRewrite defines a hostname rewrite computed from the request path using regex. - -_Appears in:_ -- [HTTPHostnameModifier](#httphostnamemodifier) - -| Field | Type | Required | Default | Description | -| --- | --- | --- | --- | --- | -| `pattern` | _string_ | true | | Pattern matches a regular expression against the value of the HTTP Path. The regex string must
adhere to the syntax documented in https://github.com/google/re2/wiki/Syntax. | -| `substitution` | _string_ | true | | Substitution is an expression that replaces the matched portion. The expression may include numbered
capture groups that adhere to syntax documented in https://github.com/google/re2/wiki/Syntax.
The resulting value is used as the upstream Host header and should be constrained to a valid
DNS hostname by using explicit regex capture groups in Pattern.
The NUL, CR, and LF characters are not allowed: they are invalid in an HTTP header value and are
rejected by the Envoy proto (well_known_regex HTTP_HEADER_VALUE), which would otherwise cause the
generated configuration to be rejected by the data plane. | - - #### IPEndpoint @@ -3598,7 +3470,6 @@ _Appears in:_ | Value | Description | | ----- | ----------- | | `Host` | InfrastructureProviderTypeHost defines the "Host" provider.
| -| `Remote` | InfrastructureProviderTypeRemote defines the "Remote" provider.
| #### InjectedCredential @@ -3672,8 +3543,7 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | -| `optional` | _boolean_ | false | | Optional determines whether a missing JWT is acceptable, defaulting to false if not specified.
Note: Even if optional is set to true, JWT authentication will still fail if an invalid JWT
is presented. See FailOpen if this is necessary for your use case. | -| `failOpen` | _boolean_ | false | | FailOpen lets a request pass JWT authentication even when its JWT is
missing or invalid, rather than being rejected. This helps when a header
that clients use to carry a JWT may also legitimately hold a non-JWT value
that the backend relies on.
A valid JWT is still verified and its claims forwarded as usual; only the
rejection of requests with a missing or invalid JWT is relaxed. Because this
does not enforce authentication on its own, pair it with an Authorization
policy when access needs to be restricted.
This is broader than Optional (which tolerates a missing JWT but still
rejects an invalid one) and takes precedence over it. | +| `optional` | _boolean_ | true | | Optional determines whether a missing JWT is acceptable, defaulting to false if not specified.
Note: Even if optional is set to true, JWT authentication will still fail if an invalid JWT is presented. | | `providers` | _[JWTProvider](#jwtprovider) array_ | true | | Providers defines the JSON Web Token (JWT) authentication provider type.
When multiple JWT providers are specified, the JWT is considered valid if
any of the providers successfully validate the JWT. For additional details,
see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/jwt_authn_filter.html. | @@ -3798,8 +3668,6 @@ _Appears in:_ _Appears in:_ -- [EnvoyGatewayKubernetesConfiguration](#envoygatewaykubernetesconfiguration) -- [EnvoyGatewayKubernetesCustomProvider](#envoygatewaykubernetescustomprovider) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) | Field | Type | Required | Default | Description | @@ -3868,7 +3736,6 @@ KubernetesDeployMode holds configuration for how to deploy managed resources suc data plane fleet. _Appears in:_ -- [EnvoyGatewayKubernetesInfrastructureConfiguration](#envoygatewaykubernetesinfrastructureconfiguration) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) | Field | Type | Required | Default | Description | @@ -3898,7 +3765,6 @@ _Appears in:_ KubernetesDeploymentSpec defines the desired state of the Kubernetes deployment resource. _Appears in:_ -- [EnvoyGatewayKubernetesInfrastructureConfiguration](#envoygatewaykubernetesinfrastructureconfiguration) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) - [EnvoyProxyKubernetesProvider](#envoyproxykubernetesprovider) @@ -3923,7 +3789,6 @@ Envoy Gateway will revert back to this value every time reconciliation occurs. See k8s.io.autoscaling.v2.HorizontalPodAutoScalerSpec. _Appears in:_ -- [EnvoyGatewayKubernetesInfrastructureConfiguration](#envoygatewaykubernetesinfrastructureconfiguration) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) - [EnvoyProxyKubernetesProvider](#envoyproxykubernetesprovider) @@ -3965,7 +3830,6 @@ _Appears in:_ KubernetesPodDisruptionBudgetSpec defines Kubernetes PodDisruptionBudget settings of Envoy Proxy Deployment. _Appears in:_ -- [EnvoyGatewayKubernetesInfrastructureConfiguration](#envoygatewaykubernetesinfrastructureconfiguration) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) - [EnvoyProxyKubernetesProvider](#envoyproxykubernetesprovider) @@ -4045,8 +3909,6 @@ _Appears in:_ KubernetesWatchMode holds the configuration for which input resources to watch and reconcile. _Appears in:_ -- [EnvoyGatewayKubernetesConfiguration](#envoygatewaykubernetesconfiguration) -- [EnvoyGatewayKubernetesCustomProvider](#envoygatewaykubernetescustomprovider) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) | Field | Type | Required | Default | Description | @@ -4074,8 +3936,6 @@ _Appears in:_ LeaderElection defines the desired leader election settings. _Appears in:_ -- [EnvoyGatewayKubernetesConfiguration](#envoygatewaykubernetesconfiguration) -- [EnvoyGatewayKubernetesCustomProvider](#envoygatewaykubernetescustomprovider) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) | Field | Type | Required | Default | Description | @@ -4121,6 +3981,7 @@ _Appears in:_ LoadBalancer defines the load balancer policy to be applied. _Appears in:_ +- [BackendClusterSettings](#backendclustersettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClusterSettings](#clustersettings) @@ -4260,8 +4121,6 @@ _Appears in:_ | `info` | LogLevelInfo defines the "Info" logging level.
| | `warn` | LogLevelWarn defines the "Warn" logging level.
| | `error` | LogLevelError defines the "Error" logging level.
| -| `off` | LogLevelOff disables logging.
| -| `critical` | LogLevelCritical defines the "critical" logging level.
| #### Lua @@ -4313,19 +4172,6 @@ _Appears in:_ | `ValueRef` | LuaValueTypeValueRef defines the "ValueRef" Lua type.
| -#### MergeBackendsConfig - - - -MergeBackendsConfig configures backend cluster deduplication (MergeBackends). Its mere -presence on EnvoyProxySpec enables it; a backendRef is only merged into a shared cluster when -safe to do so, otherwise it falls back to a dedicated per-route cluster. - -_Appears in:_ -- [EnvoyProxySpec](#envoyproxyspec) - - - #### MergeType _Underlying type:_ _string_ @@ -4399,7 +4245,6 @@ _Appears in:_ | `denyRedirect` | _[OIDCDenyRedirect](#oidcdenyredirect)_ | false | | Any request that matches any of the provided matchers (with either tokens that are expired or missing tokens) will not be redirected to the OIDC Provider.
This behavior can be useful for AJAX or machine requests. | | `logoutPath` | _string_ | true | | The path to log a user out, clearing their credential cookies.
If not specified, uses a default logout path "/logout" | | `forwardAccessToken` | _boolean_ | false | | ForwardAccessToken indicates whether the Envoy should forward the access token
via the Authorization header Bearer scheme to the upstream.
If not specified, defaults to false. | -| `forwardIDToken` | _[OIDCTokenForwarding](#oidctokenforwarding)_ | false | | ForwardIDToken configures forwarding of the OIDC ID token to the upstream.
If the configured header is "Authorization", EG forwards the ID token using
the "Bearer " prefix. For any other header, EG forwards the raw token value.
If not specified, the ID token will not be forwarded.
Note: when passThroughAuthHeader is enabled, this header must not be the same
as a header a JWT provider extracts from (the "Authorization" header by
default). The forwarded ID token header is owned by Envoy, and Envoy rejects
an OAuth2 configuration whose pass-through matcher keys on it. | | `defaultTokenTTL` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | DefaultTokenTTL is the default lifetime of the id token and access token.
Please note that Envoy will always use the expiry time from the response
of the authorization server if it is provided. This field is only used when
the expiry time is not provided by the authorization.
If not specified, defaults to 0. In this case, the "expires_in" field in
the authorization response must be set by the authorization server, or the
OAuth flow will fail. | | `refreshToken` | _boolean_ | false | true | RefreshToken indicates whether the Envoy should automatically refresh the
id token and access token when they expire.
When set to true, the Envoy will use the refresh token to get a new id token
and access token when they expire.
If not specified, defaults to true. | | `defaultRefreshTokenTTL` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | DefaultRefreshTokenTTL is the default lifetime of the refresh token.
This field is only used when the exp (expiration time) claim is omitted in
the refresh token or the refresh token is not JWT.
If not specified, defaults to 604800s (one week).
Note: this field is only applicable when the "refreshToken" field is set to true. | @@ -4506,7 +4351,7 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | -| `header` | _string_ | true | | Header is the upstream request header that will carry the ID token.
It must be a valid HTTP header name. Pseudo-headers (names starting with ":")
and the "Host" header are not allowed. | +| `header` | _string_ | true | | Header is the upstream request header that will carry the ID token. | #### OTelSampler @@ -4614,12 +4459,9 @@ For example, the following are valid origins: - http://foo.example.com:8080 - http://*.example.com:8080 - https://* -- moz-extension://example.com -- foo://*.example.com:8080 _Appears in:_ - [CORS](#cors) -- [CSRF](#csrf) @@ -4639,23 +4481,6 @@ _Appears in:_ | `value` | _string_ | true | | Value specifies the string value that the match must have. | -#### OutOfBandReporting - - - -OutOfBandReporting configures out-of-band ORCA load reporting for the -BackendUtilization load balancer. - -_Appears in:_ -- [BackendUtilization](#backendutilization) - -| Field | Type | Required | Default | Description | -| --- | --- | --- | --- | --- | -| `reportingPeriod` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ReportingPeriod is how often Envoy requests load reports from the server.
Must be greater than 0. Defaults to 10s. | -| `port` | _integer_ | false | | Port overrides the port used for the OutOfBand reporting connection, e.g. to
reach a separate reporting sidecar. Defaults to the endpoint's port. | -| `authority` | _string_ | false | | Authority overrides the :authority header on the OutOfBand gRPC stream.
If unset, Envoy uses the endpoint hostname, then the dialed address, then
the cluster name. | - - #### PassiveHealthCheck @@ -4826,7 +4651,7 @@ _Appears in:_ | `clientCIDRs` | _[CIDR](#cidr) array_ | false | | ClientCIDRs are the IP CIDR ranges of the client.
Valid examples are "192.168.1.0/24" or "2001:db8::/64"
If multiple CIDR ranges are specified, one of the CIDR ranges must match
the client IP for the rule to match.
The client IP is inferred from the X-Forwarded-For header, a custom header,
or the proxy protocol.
You can use the `ClientIPDetection` or the `ProxyProtocol` field in
the `ClientTrafficPolicy` to configure how the client IP is detected.
For TCPRoute targets (raw TCP connections), HTTP headers such as
X-Forwarded-For are not available. The client IP is obtained from the
TCP connection's peer address. If intermediaries (load balancers, NAT)
terminate or proxy TCP, the original client IP will only be available
if the intermediary preserves the source address (for example by
enabling the PROXY protocol or avoiding SNAT). Ensure your L4 proxy is
configured to preserve the source IP to enable correct client-IP
matching for TCPRoute targets. | | `jwt` | _[JWTPrincipal](#jwtprincipal)_ | false | | JWT authorize the request based on the JWT claims and scopes.
Note: in order to use JWT claims for authorization, you must configure the
JWT authentication in the same `SecurityPolicy`. | | `headers` | _[AuthorizationHeaderMatch](#authorizationheadermatch) array_ | false | | Headers authorize the request based on user identity extracted from custom headers.
If multiple headers are specified, all headers must match for the rule to match. | -| `clientIPGeoLocations` | _[ClientIPGeoLocation](#clientipgeolocation) array_ | false | | ClientIPGeoLocations authorizes the request based on geolocation metadata derived from the client IP.
This field is supported for HTTPRoute and GRPCRoute authorization.
It is not supported for TCPRoute targets.
If multiple entries are specified, one of the ClientIPGeoLocation entries must match for the rule to match.
The client IP is inferred from the X-Forwarded-For header, a custom header, or the
direct downstream connection source address (the TCP peer of the connection terminated by Envoy).
You can use the `ClientIPDetection` field in the `ClientTrafficPolicy` to configure the client IP detection. | +| `clientIPGeoLocations` | _[ClientIPGeoLocation](#clientipgeolocation) array_ | false | | ClientIPGeoLocations authorizes the request based on geolocation metadata derived from the client IP.
This field is supported for HTTPRoute and GRPCRoute authorization.
It is not supported for TCPRoute targets.
If multiple entries are specified, one of the ClientIPGeoLocation entries must match for the rule to match.
The client IP is inferred from the X-Forwarded-For header or a custom header.
You can use the `ClientIPDetection` field in the `ClientTrafficPolicy` to configure the client IP detection. | #### ProcessingModeOptions @@ -5123,6 +4948,7 @@ ProxyProtocol defines the configuration related to the proxy protocol when communicating with the backend. _Appears in:_ +- [BackendClusterSettings](#backendclustersettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClusterSettings](#clustersettings) @@ -5192,8 +5018,6 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `samplingFraction` | _[Fraction](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#fraction)_ | false | | SamplingFraction represents the fraction of requests that should be
selected for tracing if no prior sampling decision has been made. | -| `clientSamplingFraction` | _[Fraction](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#fraction)_ | false | | ClientSamplingFraction represents the fraction of requests that should be
selected for tracing when requested by the client.
If unspecified, client-forced tracing is disabled by default and users must
set this field to opt in. | -| `overallSamplingFraction` | _[Fraction](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#fraction)_ | false | | OverallSamplingFraction represents the fraction of requests that should be
selected for tracing after all other sampling checks have been applied. | | `customTags` | _object (keys:string, values:[CustomTag](#customtag))_ | false | | CustomTags defines the custom tags to add to each span.
If provider is kubernetes, pod name and namespace are added by default.
Deprecated: Use Tags instead. | | `tags` | _object (keys:string, values:string)_ | false | | Tags defines the custom tags to add to each span.
Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) may be used in the value.
The [format string documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#config-access-log-format-strings) provides more information.
If provider is kubernetes, pod name and namespace are added by default.
Same keys take precedence over CustomTags. | | `spanName` | _[TracingSpanName](#tracingspanname)_ | false | | SpanName defines the name of the span which will be used for tracing.
Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) may be used in the value.
The [format string documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#config-access-log-format-strings) provides more information.
If not set, the span name is provider specific.
e.g. Datadog use `ingress` as the default client span name,
and `router egress` as the server span name. | @@ -5401,8 +5225,7 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | -| `url` | _string_ | false | | URL of the Redis Database.
This can reference a single Redis host or a comma delimited list for Sentinel and Cluster deployments of Redis.
Mutually exclusive with URLRef. | -| `urlRef` | _[RedisURLSource](#redisurlsource)_ | false | | URLRef sources the Redis URL from a Kubernetes Secret key. Use this for GitOps
flows where the Redis endpoint is provisioned by an external controller.
The referenced Secret must exist in the namespace of the Envoy Gateway rate limit
deployment. Mutually exclusive with URL. | +| `url` | _string_ | true | | URL of the Redis Database.
This can reference a single Redis host or a comma delimited list for Sentinel and Cluster deployments of Redis. | | `tls` | _[RedisTLSSettings](#redistlssettings)_ | false | | TLS defines TLS configuration for connecting to redis database. | @@ -5600,20 +5423,6 @@ _Appears in:_ | `certificateRef` | _[SecretObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#secretobjectreference)_ | false | | CertificateRef defines the client certificate reference for TLS connections.
Currently only a Kubernetes Secret of type TLS is supported. | -#### RedisURLSource - - - -RedisURLSource specifies where to source the Redis URL from. - -_Appears in:_ -- [RateLimitRedisSettings](#ratelimitredissettings) - -| Field | Type | Required | Default | Description | -| --- | --- | --- | --- | --- | -| `secretKeyRef` | _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#secretkeyselector-v1-core)_ | true | | SecretKeyRef references the Secret and key that hold the Redis URL.
The Secret must be in the same namespace as the Envoy Gateway rate limit deployment.
The reference is always required: optional must not be set to true, otherwise
the rate limit pod could start with an unset REDIS_URL instead of waiting for
the externally provisioned Secret. | - - #### RemoteDynamicModuleSource @@ -5762,7 +5571,6 @@ _Appears in:_ | Value | Description | | ----- | ----------- | | `File` | ResourceProviderTypeFile defines the "File" provider.
| -| `Kubernetes` | ResourceProviderTypeKubernetes defines the "Kubernetes" provider.
| #### ResponseOverride @@ -5916,8 +5724,6 @@ _Appears in:_ | Value | Description | | ----- | ----------- | | `XDSNameSchemeV2` | XDSNameSchemeV2 indicates that the xds name scheme v2 is used.
* The listener name will be generated using the protocol and port of the listener.
| -| `EndpointSliceIndex` | EndpointSliceIndex indicates that field indexes are used to look up EndpointSlices by backend.
It is enabled by default to reduce CPU usage for EndpointSlice lookups in large clusters.
If the additional controller memory usage for the indexes becomes a concern,
consider disabling this flag.
| -| `PerResourceSystemCASecret` | PerResourceSystemCASecret restores the pre-1.x behavior of emitting one SDS secret per
BackendTLSPolicy or Backend resource that uses WellKnownCACertificates: System, instead
of sharing a single system_ca_certificates secret across all of them.
Disabled by default (i.e. the shared secret is used). Enable this flag to opt out during
upgrades — Envoy must warm the new system_ca_certificates secret before clusters can use
it, which may cause a brief disruption to new connections on first enable.
| #### RuntimeFlags @@ -5994,7 +5800,7 @@ Gateway. SecurityPolicySpec defines the desired state of SecurityPolicy. -NOTE: SecurityPolicy can target Gateway, ListenerSet, HTTPRoute, GRPCRoute, and TCPRoute. +NOTE: SecurityPolicy can target Gateway, HTTPRoute, GRPCRoute, and TCPRoute. When a SecurityPolicy targets a TCPRoute, only client-IP CIDR based authorization (Authorization rules that use Principal.ClientCIDRs) is applied. Other authentication/authorization features such as JWT, API Key, Basic Auth, @@ -6009,10 +5815,9 @@ _Appears in:_ | `targetRef` | _[LocalPolicyTargetReferenceWithSectionName](#localpolicytargetreferencewithsectionname)_ | true | | TargetRef is the name of the resource this policy is being attached to.
This policy and the TargetRef MUST be in the same namespace for this
Policy to have effect
Deprecated: use targetRefs/targetSelectors instead | | `targetRefs` | _LocalPolicyTargetReferenceWithSectionName array_ | true | | TargetRefs are the names of the Gateway resources this policy
is being attached to. | | `targetSelectors` | _[TargetSelector](#targetselector) array_ | true | | TargetSelectors allow targeting resources for this policy based on labels | -| `mergeType` | _[MergeType](#mergetype)_ | false | | MergeType determines how this configuration is merged with existing SecurityPolicy
configurations targeting a parent resource. When set, this configuration will be merged
into the closest parent SecurityPolicy in the route's attachment hierarchy (for
example, one targeting a Gateway, Gateway listener, ListenerSet, or ListenerSet
listener).
Currently, this field can only be set when targeting xRoute resources.
If unset, no merging occurs, and only the most specific configuration takes effect. | +| `mergeType` | _[MergeType](#mergetype)_ | false | | MergeType determines how this configuration is merged with existing SecurityPolicy
configurations targeting a parent resource. When set, this configuration will be merged
into a parent SecurityPolicy (i.e. the one targeting a Gateway or Listener).
This field cannot be set when targeting a parent resource (Gateway).
If unset, no merging occurs, and only the most specific configuration takes effect. | | `apiKeyAuth` | _[APIKeyAuth](#apikeyauth)_ | false | | APIKeyAuth defines the configuration for the API Key Authentication. | | `cors` | _[CORS](#cors)_ | false | | CORS defines the configuration for Cross-Origin Resource Sharing (CORS). | -| `csrf` | _[CSRF](#csrf)_ | false | | CSRF defines the configuration for Cross-Site Request Forgery (CSRF) protection.
When enabled, the CSRF filter checks that the Origin header matches the destination
or one of the additional allowed origins on mutating requests (POST, PUT, DELETE, PATCH). | | `basicAuth` | _[BasicAuth](#basicauth)_ | false | | BasicAuth defines the configuration for the HTTP Basic Authentication. | | `jwt` | _[JWT](#jwt)_ | false | | JWT defines the configuration for JSON Web Token (JWT) authentication. | | `oidc` | _[OIDC](#oidc)_ | false | | OIDC defines the configuration for the OpenID Connect (OIDC) authentication. | @@ -6104,7 +5909,6 @@ _Appears in:_ ShutdownManager defines the configuration for the shutdown manager. _Appears in:_ -- [EnvoyGatewayKubernetesInfrastructureConfiguration](#envoygatewaykubernetesinfrastructureconfiguration) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) | Field | Type | Required | Default | Description | @@ -6330,6 +6134,7 @@ _Appears in:_ TCPKeepalive define the TCP Keepalive configuration. _Appears in:_ +- [BackendClusterSettings](#backendclustersettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClientTrafficPolicySpec](#clienttrafficpolicyspec) - [ClusterSettings](#clustersettings) @@ -6473,6 +6278,7 @@ _Appears in:_ Timeout defines configuration for timeouts related to connections. _Appears in:_ +- [BackendClusterSettings](#backendclustersettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClusterSettings](#clustersettings) @@ -6509,8 +6315,6 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `samplingFraction` | _[Fraction](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#fraction)_ | false | | SamplingFraction represents the fraction of requests that should be
selected for tracing if no prior sampling decision has been made. | -| `clientSamplingFraction` | _[Fraction](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#fraction)_ | false | | ClientSamplingFraction represents the fraction of requests that should be
selected for tracing when requested by the client.
If unspecified, client-forced tracing is disabled by default and users must
set this field to opt in. | -| `overallSamplingFraction` | _[Fraction](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#fraction)_ | false | | OverallSamplingFraction represents the fraction of requests that should be
selected for tracing after all other sampling checks have been applied. | | `customTags` | _object (keys:string, values:[CustomTag](#customtag))_ | false | | CustomTags defines the custom tags to add to each span.
If provider is kubernetes, pod name and namespace are added by default.
Deprecated: Use Tags instead. | | `tags` | _object (keys:string, values:string)_ | false | | Tags defines the custom tags to add to each span.
Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) may be used in the value.
The [format string documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#config-access-log-format-strings) provides more information.
If provider is kubernetes, pod name and namespace are added by default.
Same keys take precedence over CustomTags. | | `spanName` | _[TracingSpanName](#tracingspanname)_ | false | | SpanName defines the name of the span which will be used for tracing.
Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) may be used in the value.
The [format string documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#config-access-log-format-strings) provides more information.
If not set, the span name is provider specific.
e.g. Datadog use `ingress` as the default client span name,
and `router egress` as the server span name. | @@ -6759,7 +6563,6 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `maxConnectionAge` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | MaxConnectionAge is the maximum age of an active connection before Envoy Gateway will initiate a graceful close.
If unspecified, Envoy Gateway randomly selects a value between 10h and 12h to stagger reconnects across replicas. | | `maxConnectionAgeGrace` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | MaxConnectionAgeGrace is the grace period granted after reaching MaxConnectionAge before the connection is forcibly closed.
The default grace period is 2m. | -| `maxReceiveMessageSize` | _[Quantity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#quantity-resource-api)_ | false | | MaxReceiveMessageSize defines the maximum size of a single xDS message that the xDS gRPC
server will accept from an Envoy proxy.
Envoy's requests grow with the number of resources it holds: on every stream (re)connect,
the first delta xDS request for each resource type echoes back the name and version of
every resource the proxy currently has. At a large enough scale this exceeds the 4MiB
default, and the stream fails immediately with "received message larger than max", leaving
the proxy stuck on its last known-good configuration.
Note this limit applies only to what Envoy Gateway receives; the configuration it sends to
Envoy is not bounded by it.
If unspecified, defaults to 32MiB. | #### XDSTranslatorHook diff --git a/test/cel-validation/backendtrafficpolicy_test.go b/test/cel-validation/backendtrafficpolicy_test.go index 422396efff..30289690e6 100644 --- a/test/cel-validation/backendtrafficpolicy_test.go +++ b/test/cel-validation/backendtrafficpolicy_test.go @@ -508,10 +508,12 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.ConsistentHashLoadBalancerType, - ConsistentHash: &egv1a1.ConsistentHash{ - Type: "SourceIP", + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.ConsistentHashLoadBalancerType, + ConsistentHash: &egv1a1.ConsistentHash{ + Type: "SourceIP", + }, }, }, }, @@ -533,8 +535,10 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.ConsistentHashLoadBalancerType, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.ConsistentHashLoadBalancerType, + }, }, }, } @@ -558,12 +562,14 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.ConsistentHashLoadBalancerType, - ConsistentHash: &egv1a1.ConsistentHash{ - Type: "Header", - Header: &egv1a1.Header{ - Name: "name", + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.ConsistentHashLoadBalancerType, + ConsistentHash: &egv1a1.ConsistentHash{ + Type: "Header", + Header: &egv1a1.Header{ + Name: "name", + }, }, }, }, @@ -586,10 +592,12 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.ConsistentHashLoadBalancerType, - ConsistentHash: &egv1a1.ConsistentHash{ - Type: "Header", + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.ConsistentHashLoadBalancerType, + ConsistentHash: &egv1a1.ConsistentHash{ + Type: "Header", + }, }, }, }, @@ -614,12 +622,14 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.ConsistentHashLoadBalancerType, - ConsistentHash: &egv1a1.ConsistentHash{ - Type: "Cookie", - Cookie: &egv1a1.Cookie{ - Name: "name", + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.ConsistentHashLoadBalancerType, + ConsistentHash: &egv1a1.ConsistentHash{ + Type: "Cookie", + Cookie: &egv1a1.Cookie{ + Name: "name", + }, }, }, }, @@ -642,10 +652,12 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.ConsistentHashLoadBalancerType, - ConsistentHash: &egv1a1.ConsistentHash{ - Type: "Cookie", + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.ConsistentHashLoadBalancerType, + ConsistentHash: &egv1a1.ConsistentHash{ + Type: "Cookie", + }, }, }, }, @@ -670,12 +682,14 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.ConsistentHashLoadBalancerType, - ConsistentHash: &egv1a1.ConsistentHash{ - Type: "SourceIP", + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.ConsistentHashLoadBalancerType, + ConsistentHash: &egv1a1.ConsistentHash{ + Type: "SourceIP", + }, + ZoneAware: &egv1a1.ZoneAware{}, }, - ZoneAware: &egv1a1.ZoneAware{}, }, }, } @@ -696,13 +710,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.ConsistentHashLoadBalancerType, - ConsistentHash: &egv1a1.ConsistentHash{ - Type: "SourceIP", - }, - ZoneAware: &egv1a1.ZoneAware{ - PreferLocal: &egv1a1.PreferLocalZone{}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.ConsistentHashLoadBalancerType, + ConsistentHash: &egv1a1.ConsistentHash{ + Type: "SourceIP", + }, + ZoneAware: &egv1a1.ZoneAware{ + PreferLocal: &egv1a1.PreferLocalZone{}, + }, }, }, }, @@ -727,16 +743,18 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.ConsistentHashLoadBalancerType, - ConsistentHash: &egv1a1.ConsistentHash{ - Type: "SourceIP", - }, - ZoneAware: &egv1a1.ZoneAware{ - WeightedZones: []egv1a1.WeightedZoneConfig{{ - Zone: "us-east-1a", - Weight: uint32(70), - }}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.ConsistentHashLoadBalancerType, + ConsistentHash: &egv1a1.ConsistentHash{ + Type: "SourceIP", + }, + ZoneAware: &egv1a1.ZoneAware{ + WeightedZones: []egv1a1.WeightedZoneConfig{{ + Zone: "us-east-1a", + Weight: uint32(70), + }}, + }, }, }, }, @@ -758,8 +776,10 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.LeastRequestLoadBalancerType, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.LeastRequestLoadBalancerType, + }, }, }, } @@ -780,9 +800,11 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.LeastRequestLoadBalancerType, - ZoneAware: &egv1a1.ZoneAware{}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.LeastRequestLoadBalancerType, + ZoneAware: &egv1a1.ZoneAware{}, + }, }, }, } @@ -803,14 +825,16 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.LeastRequestLoadBalancerType, - ZoneAware: &egv1a1.ZoneAware{ - PreferLocal: &egv1a1.PreferLocalZone{}, - WeightedZones: []egv1a1.WeightedZoneConfig{{ - Zone: "zone1", - Weight: uint32(10), - }}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.LeastRequestLoadBalancerType, + ZoneAware: &egv1a1.ZoneAware{ + PreferLocal: &egv1a1.PreferLocalZone{}, + WeightedZones: []egv1a1.WeightedZoneConfig{{ + Zone: "zone1", + Weight: uint32(10), + }}, + }, }, }, }, @@ -835,12 +859,14 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.RoundRobinLoadBalancerType, - ZoneAware: &egv1a1.ZoneAware{ - WeightedZones: []egv1a1.WeightedZoneConfig{ - {Zone: "us-east-1a", Weight: 70}, - {Zone: "us-east-1a", Weight: 30}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.RoundRobinLoadBalancerType, + ZoneAware: &egv1a1.ZoneAware{ + WeightedZones: []egv1a1.WeightedZoneConfig{ + {Zone: "us-east-1a", Weight: 70}, + {Zone: "us-east-1a", Weight: 30}, + }, }, }, }, @@ -865,10 +891,12 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.LeastRequestLoadBalancerType, - SlowStart: &egv1a1.SlowStart{ - Window: new(gwapiv1.Duration("10ms")), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.LeastRequestLoadBalancerType, + SlowStart: &egv1a1.SlowStart{ + Window: new(gwapiv1.Duration("10ms")), + }, }, }, }, @@ -890,10 +918,12 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.RoundRobinLoadBalancerType, - SlowStart: &egv1a1.SlowStart{ - Window: new(gwapiv1.Duration("10ms")), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.RoundRobinLoadBalancerType, + SlowStart: &egv1a1.SlowStart{ + Window: new(gwapiv1.Duration("10ms")), + }, }, }, }, @@ -915,10 +945,12 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.RandomLoadBalancerType, - SlowStart: &egv1a1.SlowStart{ - Window: new(gwapiv1.Duration("10ms")), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.RandomLoadBalancerType, + SlowStart: &egv1a1.SlowStart{ + Window: new(gwapiv1.Duration("10ms")), + }, }, }, }, @@ -943,10 +975,12 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.ConsistentHashLoadBalancerType, - SlowStart: &egv1a1.SlowStart{ - Window: new(gwapiv1.Duration("10ms")), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.ConsistentHashLoadBalancerType, + SlowStart: &egv1a1.SlowStart{ + Window: new(gwapiv1.Duration("10ms")), + }, }, }, }, @@ -971,14 +1005,16 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.BackendUtilizationLoadBalancerType, - BackendUtilization: &egv1a1.BackendUtilization{ - BlackoutPeriod: new(gwapiv1.Duration("10s")), - WeightUpdatePeriod: new(gwapiv1.Duration("10s")), - WeightExpirationPeriod: new(gwapiv1.Duration("10s")), - ErrorUtilizationPenaltyPercent: new(uint32(50)), - MetricNamesForComputingUtilization: []string{"metric1", "metric2"}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.BackendUtilizationLoadBalancerType, + BackendUtilization: &egv1a1.BackendUtilization{ + BlackoutPeriod: new(gwapiv1.Duration("10s")), + WeightUpdatePeriod: new(gwapiv1.Duration("10s")), + WeightExpirationPeriod: new(gwapiv1.Duration("10s")), + ErrorUtilizationPenaltyPercent: new(uint32(50)), + MetricNamesForComputingUtilization: []string{"metric1", "metric2"}, + }, }, }, }, @@ -1169,8 +1205,10 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.BackendUtilizationLoadBalancerType, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.BackendUtilizationLoadBalancerType, + }, }, }, } @@ -1194,10 +1232,12 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.BackendUtilizationLoadBalancerType, - BackendUtilization: &egv1a1.BackendUtilization{}, - SlowStart: &egv1a1.SlowStart{Window: new(gwapiv1.Duration("10ms"))}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.BackendUtilizationLoadBalancerType, + BackendUtilization: &egv1a1.BackendUtilization{}, + SlowStart: &egv1a1.SlowStart{Window: new(gwapiv1.Duration("10ms"))}, + }, }, }, } @@ -1218,10 +1258,12 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.BackendUtilizationLoadBalancerType, - BackendUtilization: &egv1a1.BackendUtilization{}, - ZoneAware: &egv1a1.ZoneAware{PreferLocal: &egv1a1.PreferLocalZone{}}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.BackendUtilizationLoadBalancerType, + BackendUtilization: &egv1a1.BackendUtilization{}, + ZoneAware: &egv1a1.ZoneAware{PreferLocal: &egv1a1.PreferLocalZone{}}, + }, }, }, } @@ -1245,13 +1287,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.BackendUtilizationLoadBalancerType, - BackendUtilization: &egv1a1.BackendUtilization{}, - ZoneAware: &egv1a1.ZoneAware{ - WeightedZones: []egv1a1.WeightedZoneConfig{ - {Zone: "us-east-1a", Weight: 80}, - {Zone: "us-east-1b", Weight: 20}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.BackendUtilizationLoadBalancerType, + BackendUtilization: &egv1a1.BackendUtilization{}, + ZoneAware: &egv1a1.ZoneAware{ + WeightedZones: []egv1a1.WeightedZoneConfig{ + {Zone: "us-east-1a", Weight: 80}, + {Zone: "us-east-1b", Weight: 20}, + }, }, }, }, @@ -1274,9 +1318,11 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.BackendUtilizationLoadBalancerType, - BackendUtilization: &egv1a1.BackendUtilization{ErrorUtilizationPenaltyPercent: new(uint32(0))}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.BackendUtilizationLoadBalancerType, + BackendUtilization: &egv1a1.BackendUtilization{ErrorUtilizationPenaltyPercent: new(uint32(0))}, + }, }, }, } @@ -1297,12 +1343,14 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.DynamicModuleLoadBalancerType, - DynamicModule: &egv1a1.DynamicModuleLBPolicy{ - Name: "my-module", - LBPolicyName: "round-robin-v2", - Config: &apiextensionsv1.JSON{Raw: []byte(`{"key":"value"}`)}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.DynamicModuleLoadBalancerType, + DynamicModule: &egv1a1.DynamicModuleLBPolicy{ + Name: "my-module", + LBPolicyName: "round-robin-v2", + Config: &apiextensionsv1.JSON{Raw: []byte(`{"key":"value"}`)}, + }, }, }, }, @@ -1324,11 +1372,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.DynamicModuleLoadBalancerType, - DynamicModule: &egv1a1.DynamicModuleLBPolicy{ - Name: "my-module", - LBPolicyName: "round-robin-v2", + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.DynamicModuleLoadBalancerType, + DynamicModule: &egv1a1.DynamicModuleLBPolicy{ + Name: "my-module", + LBPolicyName: "round-robin-v2", + }, }, }, }, @@ -1350,8 +1400,10 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.DynamicModuleLoadBalancerType, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.DynamicModuleLoadBalancerType, + }, }, }, } @@ -1375,11 +1427,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.RoundRobinLoadBalancerType, - DynamicModule: &egv1a1.DynamicModuleLBPolicy{ - Name: "my-module", - LBPolicyName: "round-robin-v2", + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.RoundRobinLoadBalancerType, + DynamicModule: &egv1a1.DynamicModuleLBPolicy{ + Name: "my-module", + LBPolicyName: "round-robin-v2", + }, }, }, }, @@ -1404,13 +1458,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.DynamicModuleLoadBalancerType, - DynamicModule: &egv1a1.DynamicModuleLBPolicy{ - Name: "my-module", - LBPolicyName: "round-robin-v2", + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.DynamicModuleLoadBalancerType, + DynamicModule: &egv1a1.DynamicModuleLBPolicy{ + Name: "my-module", + LBPolicyName: "round-robin-v2", + }, + SlowStart: &egv1a1.SlowStart{Window: new(gwapiv1.Duration("10ms"))}, }, - SlowStart: &egv1a1.SlowStart{Window: new(gwapiv1.Duration("10ms"))}, }, }, } @@ -1434,13 +1490,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.DynamicModuleLoadBalancerType, - DynamicModule: &egv1a1.DynamicModuleLBPolicy{ - Name: "my-module", - LBPolicyName: "round-robin-v2", + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.DynamicModuleLoadBalancerType, + DynamicModule: &egv1a1.DynamicModuleLBPolicy{ + Name: "my-module", + LBPolicyName: "round-robin-v2", + }, + ZoneAware: &egv1a1.ZoneAware{PreferLocal: &egv1a1.PreferLocalZone{}}, }, - ZoneAware: &egv1a1.ZoneAware{PreferLocal: &egv1a1.PreferLocalZone{}}, }, }, } @@ -1464,16 +1522,18 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.DynamicModuleLoadBalancerType, - DynamicModule: &egv1a1.DynamicModuleLBPolicy{ - Name: "my-module", - LBPolicyName: "round-robin-v2", - }, - EndpointOverride: &egv1a1.EndpointOverride{ - ExtractFrom: []egv1a1.EndpointOverrideExtractFrom{ - { - Header: new("x-custom-host"), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.DynamicModuleLoadBalancerType, + DynamicModule: &egv1a1.DynamicModuleLBPolicy{ + Name: "my-module", + LBPolicyName: "round-robin-v2", + }, + EndpointOverride: &egv1a1.EndpointOverride{ + ExtractFrom: []egv1a1.EndpointOverrideExtractFrom{ + { + Header: new("x-custom-host"), + }, }, }, }, @@ -1691,11 +1751,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - CircuitBreaker: &egv1a1.CircuitBreaker{ - MaxConnections: valMax, - MaxPendingRequests: valMin, - MaxParallelRequests: nil, - MaxParallelRetries: nil, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + CircuitBreaker: &egv1a1.CircuitBreaker{ + MaxConnections: valMax, + MaxPendingRequests: valMin, + MaxParallelRequests: nil, + MaxParallelRetries: nil, + }, }, }, } @@ -1718,12 +1780,14 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - CircuitBreaker: &egv1a1.CircuitBreaker{ - MaxConnections: valOverMax, - MaxPendingRequests: valUnderMin, - MaxParallelRequests: valOverMax, - MaxRequestsPerConnection: valUnderMin, - MaxParallelRetries: valOverMax, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + CircuitBreaker: &egv1a1.CircuitBreaker{ + MaxConnections: valOverMax, + MaxPendingRequests: valUnderMin, + MaxParallelRequests: valOverMax, + MaxRequestsPerConnection: valUnderMin, + MaxParallelRetries: valOverMax, + }, }, }, } @@ -1750,11 +1814,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - Active: &egv1a1.ActiveHealthCheck{ - Type: egv1a1.ActiveHealthCheckerTypeHTTP, - HTTP: &egv1a1.HTTPActiveHealthChecker{ - Path: "", + BackendClusterSettings: egv1a1.BackendClusterSettings{ + HealthCheck: &egv1a1.HealthCheck{ + Active: &egv1a1.ActiveHealthCheck{ + Type: egv1a1.ActiveHealthCheckerTypeHTTP, + HTTP: &egv1a1.HTTPActiveHealthChecker{ + Path: "", + }, }, }, }, @@ -1779,12 +1845,14 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - Active: &egv1a1.ActiveHealthCheck{ - UnhealthyThreshold: new(uint32(0)), - Type: egv1a1.ActiveHealthCheckerTypeHTTP, - HTTP: &egv1a1.HTTPActiveHealthChecker{ - Path: "/healthz", + BackendClusterSettings: egv1a1.BackendClusterSettings{ + HealthCheck: &egv1a1.HealthCheck{ + Active: &egv1a1.ActiveHealthCheck{ + UnhealthyThreshold: new(uint32(0)), + Type: egv1a1.ActiveHealthCheckerTypeHTTP, + HTTP: &egv1a1.HTTPActiveHealthChecker{ + Path: "/healthz", + }, }, }, }, @@ -1809,12 +1877,14 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - Active: &egv1a1.ActiveHealthCheck{ - HealthyThreshold: new(uint32(0)), - Type: egv1a1.ActiveHealthCheckerTypeHTTP, - HTTP: &egv1a1.HTTPActiveHealthChecker{ - Path: "/healthz", + BackendClusterSettings: egv1a1.BackendClusterSettings{ + HealthCheck: &egv1a1.HealthCheck{ + Active: &egv1a1.ActiveHealthCheck{ + HealthyThreshold: new(uint32(0)), + Type: egv1a1.ActiveHealthCheckerTypeHTTP, + HTTP: &egv1a1.HTTPActiveHealthChecker{ + Path: "/healthz", + }, }, }, }, @@ -1839,10 +1909,12 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - Active: &egv1a1.ActiveHealthCheck{ - Type: egv1a1.ActiveHealthCheckerTypeHTTP, - TCP: &egv1a1.TCPActiveHealthChecker{}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + HealthCheck: &egv1a1.HealthCheck{ + Active: &egv1a1.ActiveHealthCheck{ + Type: egv1a1.ActiveHealthCheckerTypeHTTP, + TCP: &egv1a1.TCPActiveHealthChecker{}, + }, }, }, }, @@ -1869,10 +1941,12 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - Active: &egv1a1.ActiveHealthCheck{ - Type: egv1a1.ActiveHealthCheckerTypeHTTP, - GRPC: &egv1a1.GRPCActiveHealthChecker{}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + HealthCheck: &egv1a1.HealthCheck{ + Active: &egv1a1.ActiveHealthCheck{ + Type: egv1a1.ActiveHealthCheckerTypeHTTP, + GRPC: &egv1a1.GRPCActiveHealthChecker{}, + }, }, }, }, @@ -1898,12 +1972,14 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - Active: &egv1a1.ActiveHealthCheck{ - Type: egv1a1.ActiveHealthCheckerTypeHTTP, - HTTP: &egv1a1.HTTPActiveHealthChecker{ - Path: "/healthz", - ExpectedStatuses: []egv1a1.HTTPStatus{99, 200}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + HealthCheck: &egv1a1.HealthCheck{ + Active: &egv1a1.ActiveHealthCheck{ + Type: egv1a1.ActiveHealthCheckerTypeHTTP, + HTTP: &egv1a1.HTTPActiveHealthChecker{ + Path: "/healthz", + ExpectedStatuses: []egv1a1.HTTPStatus{99, 200}, + }, }, }, }, @@ -1928,12 +2004,14 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - Active: &egv1a1.ActiveHealthCheck{ - Type: egv1a1.ActiveHealthCheckerTypeHTTP, - HTTP: &egv1a1.HTTPActiveHealthChecker{ - Path: "/healthz", - ExpectedStatuses: []egv1a1.HTTPStatus{100, 200, 201}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + HealthCheck: &egv1a1.HealthCheck{ + Active: &egv1a1.ActiveHealthCheck{ + Type: egv1a1.ActiveHealthCheckerTypeHTTP, + HTTP: &egv1a1.HTTPActiveHealthChecker{ + Path: "/healthz", + ExpectedStatuses: []egv1a1.HTTPStatus{100, 200, 201}, + }, }, }, }, @@ -1956,12 +2034,14 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - Active: &egv1a1.ActiveHealthCheck{ - Type: egv1a1.ActiveHealthCheckerTypeHTTP, - HTTP: &egv1a1.HTTPActiveHealthChecker{ - Path: "/healthz", - ExpectedStatuses: []egv1a1.HTTPStatus{200, 300, 601}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + HealthCheck: &egv1a1.HealthCheck{ + Active: &egv1a1.ActiveHealthCheck{ + Type: egv1a1.ActiveHealthCheckerTypeHTTP, + HTTP: &egv1a1.HTTPActiveHealthChecker{ + Path: "/healthz", + ExpectedStatuses: []egv1a1.HTTPStatus{200, 300, 601}, + }, }, }, }, @@ -1986,14 +2066,16 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - Active: &egv1a1.ActiveHealthCheck{ - Type: egv1a1.ActiveHealthCheckerTypeHTTP, - HTTP: &egv1a1.HTTPActiveHealthChecker{ - Path: "/healthz", - ExpectedResponse: &egv1a1.ActiveHealthCheckPayload{ - Type: egv1a1.ActiveHealthCheckPayloadTypeText, - Binary: []byte{'f', 'o', 'o'}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + HealthCheck: &egv1a1.HealthCheck{ + Active: &egv1a1.ActiveHealthCheck{ + Type: egv1a1.ActiveHealthCheckerTypeHTTP, + HTTP: &egv1a1.HTTPActiveHealthChecker{ + Path: "/healthz", + ExpectedResponse: &egv1a1.ActiveHealthCheckPayload{ + Type: egv1a1.ActiveHealthCheckPayloadTypeText, + Binary: []byte{'f', 'o', 'o'}, + }, }, }, }, @@ -2022,14 +2104,16 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - Active: &egv1a1.ActiveHealthCheck{ - Type: egv1a1.ActiveHealthCheckerTypeHTTP, - HTTP: &egv1a1.HTTPActiveHealthChecker{ - Path: "/healthz", - ExpectedResponse: &egv1a1.ActiveHealthCheckPayload{ - Type: egv1a1.ActiveHealthCheckPayloadTypeBinary, - Text: new("foo"), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + HealthCheck: &egv1a1.HealthCheck{ + Active: &egv1a1.ActiveHealthCheck{ + Type: egv1a1.ActiveHealthCheckerTypeHTTP, + HTTP: &egv1a1.HTTPActiveHealthChecker{ + Path: "/healthz", + ExpectedResponse: &egv1a1.ActiveHealthCheckPayload{ + Type: egv1a1.ActiveHealthCheckPayloadTypeBinary, + Text: new("foo"), + }, }, }, }, @@ -2058,17 +2142,19 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - Active: &egv1a1.ActiveHealthCheck{ - Type: egv1a1.ActiveHealthCheckerTypeTCP, - TCP: &egv1a1.TCPActiveHealthChecker{ - Send: &egv1a1.ActiveHealthCheckPayload{ - Type: egv1a1.ActiveHealthCheckPayloadTypeText, - Binary: []byte{'f', 'o', 'o'}, - }, - Receive: &egv1a1.ActiveHealthCheckPayload{ - Type: egv1a1.ActiveHealthCheckPayloadTypeText, - Text: new("foo"), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + HealthCheck: &egv1a1.HealthCheck{ + Active: &egv1a1.ActiveHealthCheck{ + Type: egv1a1.ActiveHealthCheckerTypeTCP, + TCP: &egv1a1.TCPActiveHealthChecker{ + Send: &egv1a1.ActiveHealthCheckPayload{ + Type: egv1a1.ActiveHealthCheckPayloadTypeText, + Binary: []byte{'f', 'o', 'o'}, + }, + Receive: &egv1a1.ActiveHealthCheckPayload{ + Type: egv1a1.ActiveHealthCheckPayloadTypeText, + Text: new("foo"), + }, }, }, }, @@ -2097,17 +2183,19 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - Active: &egv1a1.ActiveHealthCheck{ - Type: egv1a1.ActiveHealthCheckerTypeTCP, - TCP: &egv1a1.TCPActiveHealthChecker{ - Send: &egv1a1.ActiveHealthCheckPayload{ - Type: egv1a1.ActiveHealthCheckPayloadTypeText, - Text: new("foo"), - }, - Receive: &egv1a1.ActiveHealthCheckPayload{ - Type: egv1a1.ActiveHealthCheckPayloadTypeText, - Binary: []byte{'f', 'o', 'o'}, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + HealthCheck: &egv1a1.HealthCheck{ + Active: &egv1a1.ActiveHealthCheck{ + Type: egv1a1.ActiveHealthCheckerTypeTCP, + TCP: &egv1a1.TCPActiveHealthChecker{ + Send: &egv1a1.ActiveHealthCheckPayload{ + Type: egv1a1.ActiveHealthCheckPayloadTypeText, + Text: new("foo"), + }, + Receive: &egv1a1.ActiveHealthCheckPayload{ + Type: egv1a1.ActiveHealthCheckPayloadTypeText, + Binary: []byte{'f', 'o', 'o'}, + }, }, }, }, @@ -2137,13 +2225,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - Timeout: &egv1a1.Timeout{ - TCP: &egv1a1.TCPTimeout{ - ConnectTimeout: &d, - }, - HTTP: &egv1a1.HTTPTimeout{ - ConnectionIdleTimeout: &d, - MaxConnectionDuration: &d, + BackendClusterSettings: egv1a1.BackendClusterSettings{ + Timeout: &egv1a1.Timeout{ + TCP: &egv1a1.TCPTimeout{ + ConnectTimeout: &d, + }, + HTTP: &egv1a1.HTTPTimeout{ + ConnectionIdleTimeout: &d, + MaxConnectionDuration: &d, + }, }, }, }, @@ -2409,8 +2499,10 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - Connection: &egv1a1.BackendConnection{ - BufferLimit: new(resource.MustParse("1Mi")), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + Connection: &egv1a1.BackendConnection{ + BufferLimit: new(resource.MustParse("1Mi")), + }, }, }, } @@ -2430,8 +2522,10 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - Connection: &egv1a1.BackendConnection{ - BufferLimit: new(resource.MustParse("12345678")), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + Connection: &egv1a1.BackendConnection{ + BufferLimit: new(resource.MustParse("12345678")), + }, }, }, } @@ -2452,8 +2546,10 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - Connection: &egv1a1.BackendConnection{ - BufferLimit: new(resource.MustParse("1m")), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + Connection: &egv1a1.BackendConnection{ + BufferLimit: new(resource.MustParse("1m")), + }, }, }, } @@ -2476,13 +2572,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - Connection: &egv1a1.BackendConnection{ - Preconnect: &egv1a1.PreconnectPolicy{ - PerEndpointPercent: new(uint32(100)), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + Connection: &egv1a1.BackendConnection{ + Preconnect: &egv1a1.PreconnectPolicy{ + PerEndpointPercent: new(uint32(100)), + }, + }, + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.LeastRequestLoadBalancerType, }, - }, - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.LeastRequestLoadBalancerType, }, }, } @@ -2503,9 +2601,11 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - Connection: &egv1a1.BackendConnection{ - Preconnect: &egv1a1.PreconnectPolicy{ - PerEndpointPercent: new(uint32(100)), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + Connection: &egv1a1.BackendConnection{ + Preconnect: &egv1a1.PreconnectPolicy{ + PerEndpointPercent: new(uint32(100)), + }, }, }, }, @@ -2527,14 +2627,16 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - Connection: &egv1a1.BackendConnection{ - Preconnect: &egv1a1.PreconnectPolicy{ - PredictivePercent: new(uint32(110)), - PerEndpointPercent: new(uint32(133)), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + Connection: &egv1a1.BackendConnection{ + Preconnect: &egv1a1.PreconnectPolicy{ + PredictivePercent: new(uint32(110)), + PerEndpointPercent: new(uint32(133)), + }, + }, + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.RoundRobinLoadBalancerType, }, - }, - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.RoundRobinLoadBalancerType, }, }, } @@ -2555,14 +2657,16 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - Connection: &egv1a1.BackendConnection{ - Preconnect: &egv1a1.PreconnectPolicy{ - PredictivePercent: new(uint32(133)), - PerEndpointPercent: new(uint32(150)), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + Connection: &egv1a1.BackendConnection{ + Preconnect: &egv1a1.PreconnectPolicy{ + PredictivePercent: new(uint32(133)), + PerEndpointPercent: new(uint32(150)), + }, + }, + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.LeastRequestLoadBalancerType, }, - }, - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.LeastRequestLoadBalancerType, }, }, } @@ -2586,13 +2690,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - Connection: &egv1a1.BackendConnection{ - Preconnect: &egv1a1.PreconnectPolicy{ - PerEndpointPercent: new(uint32(305)), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + Connection: &egv1a1.BackendConnection{ + Preconnect: &egv1a1.PreconnectPolicy{ + PerEndpointPercent: new(uint32(305)), + }, + }, + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.RandomLoadBalancerType, }, - }, - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.RandomLoadBalancerType, }, }, } @@ -3301,8 +3407,10 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - PanicThreshold: new(uint32(80)), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + HealthCheck: &egv1a1.HealthCheck{ + PanicThreshold: new(uint32(80)), + }, }, }, } @@ -3323,8 +3431,10 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - PanicThreshold: new(uint32(200)), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + HealthCheck: &egv1a1.HealthCheck{ + PanicThreshold: new(uint32(200)), + }, }, }, } @@ -3519,12 +3629,14 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.RoundRobinLoadBalancerType, - EndpointOverride: &egv1a1.EndpointOverride{ - ExtractFrom: []egv1a1.EndpointOverrideExtractFrom{ - { - Header: new("x-custom-host"), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.RoundRobinLoadBalancerType, + EndpointOverride: &egv1a1.EndpointOverride{ + ExtractFrom: []egv1a1.EndpointOverrideExtractFrom{ + { + Header: new("x-custom-host"), + }, }, }, }, @@ -3627,12 +3739,14 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.RoundRobinLoadBalancerType, - EndpointOverride: &egv1a1.EndpointOverride{ - ExtractFrom: []egv1a1.EndpointOverrideExtractFrom{ - { - Header: new("x-custom-host"), + BackendClusterSettings: egv1a1.BackendClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.RoundRobinLoadBalancerType, + EndpointOverride: &egv1a1.EndpointOverride{ + ExtractFrom: []egv1a1.EndpointOverrideExtractFrom{ + { + Header: new("x-custom-host"), + }, }, }, }, @@ -3949,15 +4063,17 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - Active: &egv1a1.ActiveHealthCheck{ - Type: egv1a1.ActiveHealthCheckerTypeHTTP, - HTTP: &egv1a1.HTTPActiveHealthChecker{ - Path: "/healthz", - Method: new("post"), - RequestBody: &egv1a1.ActiveHealthCheckPayload{ - Type: egv1a1.ActiveHealthCheckPayloadTypeText, - Text: new("ping"), + BackendSettings: egv1a1.BackendSettings{ + HealthCheck: &egv1a1.HealthCheck{ + Active: &egv1a1.ActiveHealthCheck{ + Type: egv1a1.ActiveHealthCheckerTypeHTTP, + HTTP: &egv1a1.HTTPActiveHealthChecker{ + Path: "/healthz", + Method: new("post"), + RequestBody: &egv1a1.ActiveHealthCheckPayload{ + Type: egv1a1.ActiveHealthCheckPayloadTypeText, + Text: new("ping"), + }, }, }, }, @@ -3981,14 +4097,16 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - Active: &egv1a1.ActiveHealthCheck{ - Type: egv1a1.ActiveHealthCheckerTypeHTTP, - HTTP: &egv1a1.HTTPActiveHealthChecker{ - Path: "/healthz", - RequestBody: &egv1a1.ActiveHealthCheckPayload{ - Type: egv1a1.ActiveHealthCheckPayloadTypeText, - Text: new("ping"), + BackendSettings: egv1a1.BackendSettings{ + HealthCheck: &egv1a1.HealthCheck{ + Active: &egv1a1.ActiveHealthCheck{ + Type: egv1a1.ActiveHealthCheckerTypeHTTP, + HTTP: &egv1a1.HTTPActiveHealthChecker{ + Path: "/healthz", + RequestBody: &egv1a1.ActiveHealthCheckPayload{ + Type: egv1a1.ActiveHealthCheckPayloadTypeText, + Text: new("ping"), + }, }, }, }, @@ -4012,15 +4130,17 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - Active: &egv1a1.ActiveHealthCheck{ - Type: egv1a1.ActiveHealthCheckerTypeHTTP, - HTTP: &egv1a1.HTTPActiveHealthChecker{ - Path: "/healthz", - Method: new("get"), - RequestBody: &egv1a1.ActiveHealthCheckPayload{ - Type: egv1a1.ActiveHealthCheckPayloadTypeText, - Text: new("ping"), + BackendSettings: egv1a1.BackendSettings{ + HealthCheck: &egv1a1.HealthCheck{ + Active: &egv1a1.ActiveHealthCheck{ + Type: egv1a1.ActiveHealthCheckerTypeHTTP, + HTTP: &egv1a1.HTTPActiveHealthChecker{ + Path: "/healthz", + Method: new("get"), + RequestBody: &egv1a1.ActiveHealthCheckPayload{ + Type: egv1a1.ActiveHealthCheckPayloadTypeText, + Text: new("ping"), + }, }, }, }, @@ -4044,15 +4164,17 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - Active: &egv1a1.ActiveHealthCheck{ - Type: egv1a1.ActiveHealthCheckerTypeHTTP, - HTTP: &egv1a1.HTTPActiveHealthChecker{ - Path: "/healthz", - Method: new(""), - RequestBody: &egv1a1.ActiveHealthCheckPayload{ - Type: egv1a1.ActiveHealthCheckPayloadTypeText, - Text: new("ping"), + BackendSettings: egv1a1.BackendSettings{ + HealthCheck: &egv1a1.HealthCheck{ + Active: &egv1a1.ActiveHealthCheck{ + Type: egv1a1.ActiveHealthCheckerTypeHTTP, + HTTP: &egv1a1.HTTPActiveHealthChecker{ + Path: "/healthz", + Method: new(""), + RequestBody: &egv1a1.ActiveHealthCheckPayload{ + Type: egv1a1.ActiveHealthCheckPayloadTypeText, + Text: new("ping"), + }, }, }, }, @@ -4076,14 +4198,16 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - HealthCheck: &egv1a1.HealthCheck{ - Active: &egv1a1.ActiveHealthCheck{ - Type: egv1a1.ActiveHealthCheckerTypeHTTP, - HTTP: &egv1a1.HTTPActiveHealthChecker{ - Path: "/healthz", - ExpectedResponse: &egv1a1.ActiveHealthCheckPayload{ - Type: egv1a1.ActiveHealthCheckPayloadTypeText, - Text: new("ok"), + BackendSettings: egv1a1.BackendSettings{ + HealthCheck: &egv1a1.HealthCheck{ + Active: &egv1a1.ActiveHealthCheck{ + Type: egv1a1.ActiveHealthCheckerTypeHTTP, + HTTP: &egv1a1.HTTPActiveHealthChecker{ + Path: "/healthz", + ExpectedResponse: &egv1a1.ActiveHealthCheckPayload{ + Type: egv1a1.ActiveHealthCheckPayloadTypeText, + Text: new("ok"), + }, }, }, }, From f831d431dba6e34c81c9a4d6eead72a58f220c06 Mon Sep 17 00:00:00 2001 From: Muhammad Waqar Date: Wed, 10 Jun 2026 10:22:16 -0400 Subject: [PATCH 2/5] api: rename BackendClusterSettings to BackendSettings Address reviewer feedback to use a shorter, clearer name. Signed-off-by: Muhammad Waqar --- api/v1alpha1/shared_types.go | 8 +- api/v1alpha1/zz_generated.deepcopy.go | 122 +++++++++--------- ...clustersettings_backendutilization_test.go | 2 +- site/content/en/latest/api/extension_types.md | 66 +++++----- .../backendtrafficpolicy_test.go | 114 ++++++++-------- 5 files changed, 156 insertions(+), 156 deletions(-) diff --git a/api/v1alpha1/shared_types.go b/api/v1alpha1/shared_types.go index 0b80ab8584..f1fe7646cf 100644 --- a/api/v1alpha1/shared_types.go +++ b/api/v1alpha1/shared_types.go @@ -642,9 +642,9 @@ type BackendCluster struct { BackendSettings *ClusterSettings `json:"backendSettings,omitempty"` } -// BackendClusterSettings contains CDS-only fields that configure the upstream Envoy Cluster. +// BackendSettings contains CDS-only fields that configure the upstream Envoy Cluster. // +kubebuilder:validation:XValidation:rule="!((has(self.connection) && has(self.connection.preconnect) && has(self.connection.preconnect.predictivePercent)) && !(has(self.loadBalancer) && has(self.loadBalancer.type) && self.loadBalancer.type in ['Random', 'RoundRobin']))",message="predictivePercent in preconnect policy only works with RoundRobin or Random load balancers" -type BackendClusterSettings struct { +type BackendSettings struct { // LoadBalancer policy to apply when routing traffic from the gateway to // the backend endpoints. Defaults to `LeastRequest`. // +optional @@ -693,10 +693,10 @@ type BackendClusterSettings struct { } // ClusterSettings provides the various knobs that can be set to control how traffic to a given -// backend will be configured. It embeds BackendClusterSettings (CDS-only fields) and adds +// backend will be configured. It embeds BackendSettings (CDS-only fields) and adds // route-level fields like Retry. type ClusterSettings struct { - BackendClusterSettings `json:",inline"` + BackendSettings `json:",inline"` // Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions. // If not set, retry will be disabled. diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index 6b42322824..6fd32eb24a 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -440,66 +440,6 @@ func (in *BackendCluster) DeepCopy() *BackendCluster { return out } -// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. -func (in *BackendClusterSettings) DeepCopyInto(out *BackendClusterSettings) { - *out = *in - if in.LoadBalancer != nil { - in, out := &in.LoadBalancer, &out.LoadBalancer - *out = new(LoadBalancer) - (*in).DeepCopyInto(*out) - } - if in.ProxyProtocol != nil { - in, out := &in.ProxyProtocol, &out.ProxyProtocol - *out = new(ProxyProtocol) - **out = **in - } - if in.TCPKeepalive != nil { - in, out := &in.TCPKeepalive, &out.TCPKeepalive - *out = new(TCPKeepalive) - (*in).DeepCopyInto(*out) - } - if in.HealthCheck != nil { - in, out := &in.HealthCheck, &out.HealthCheck - *out = new(HealthCheck) - (*in).DeepCopyInto(*out) - } - if in.CircuitBreaker != nil { - in, out := &in.CircuitBreaker, &out.CircuitBreaker - *out = new(CircuitBreaker) - (*in).DeepCopyInto(*out) - } - if in.Timeout != nil { - in, out := &in.Timeout, &out.Timeout - *out = new(Timeout) - (*in).DeepCopyInto(*out) - } - if in.Connection != nil { - in, out := &in.Connection, &out.Connection - *out = new(BackendConnection) - (*in).DeepCopyInto(*out) - } - if in.DNS != nil { - in, out := &in.DNS, &out.DNS - *out = new(DNS) - (*in).DeepCopyInto(*out) - } - if in.HTTP2 != nil { - in, out := &in.HTTP2, &out.HTTP2 - *out = new(HTTP2Settings) - (*in).DeepCopyInto(*out) - } -} - -// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendClusterSettings. -func (in *BackendClusterSettings) DeepCopy() *BackendClusterSettings { - if in == nil { - return nil - } - out := new(BackendClusterSettings) - in.DeepCopyInto(out) - return out -} - // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *BackendConnection) DeepCopyInto(out *BackendConnection) { *out = *in @@ -648,6 +588,66 @@ func (in *BackendRef) DeepCopy() *BackendRef { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *BackendSettings) DeepCopyInto(out *BackendSettings) { + *out = *in + if in.LoadBalancer != nil { + in, out := &in.LoadBalancer, &out.LoadBalancer + *out = new(LoadBalancer) + (*in).DeepCopyInto(*out) + } + if in.ProxyProtocol != nil { + in, out := &in.ProxyProtocol, &out.ProxyProtocol + *out = new(ProxyProtocol) + **out = **in + } + if in.TCPKeepalive != nil { + in, out := &in.TCPKeepalive, &out.TCPKeepalive + *out = new(TCPKeepalive) + (*in).DeepCopyInto(*out) + } + if in.HealthCheck != nil { + in, out := &in.HealthCheck, &out.HealthCheck + *out = new(HealthCheck) + (*in).DeepCopyInto(*out) + } + if in.CircuitBreaker != nil { + in, out := &in.CircuitBreaker, &out.CircuitBreaker + *out = new(CircuitBreaker) + (*in).DeepCopyInto(*out) + } + if in.Timeout != nil { + in, out := &in.Timeout, &out.Timeout + *out = new(Timeout) + (*in).DeepCopyInto(*out) + } + if in.Connection != nil { + in, out := &in.Connection, &out.Connection + *out = new(BackendConnection) + (*in).DeepCopyInto(*out) + } + if in.DNS != nil { + in, out := &in.DNS, &out.DNS + *out = new(DNS) + (*in).DeepCopyInto(*out) + } + if in.HTTP2 != nil { + in, out := &in.HTTP2, &out.HTTP2 + *out = new(HTTP2Settings) + (*in).DeepCopyInto(*out) + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendSettings. +func (in *BackendSettings) DeepCopy() *BackendSettings { + if in == nil { + return nil + } + out := new(BackendSettings) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *BackendSpec) DeepCopyInto(out *BackendSpec) { *out = *in @@ -1668,7 +1668,7 @@ func (in *ClientValidationContext) DeepCopy() *ClientValidationContext { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *ClusterSettings) DeepCopyInto(out *ClusterSettings) { *out = *in - in.BackendClusterSettings.DeepCopyInto(&out.BackendClusterSettings) + in.BackendSettings.DeepCopyInto(&out.BackendSettings) if in.Retry != nil { in, out := &in.Retry, &out.Retry *out = new(Retry) diff --git a/internal/gatewayapi/clustersettings_backendutilization_test.go b/internal/gatewayapi/clustersettings_backendutilization_test.go index 43e95a5145..e45ee3dc94 100644 --- a/internal/gatewayapi/clustersettings_backendutilization_test.go +++ b/internal/gatewayapi/clustersettings_backendutilization_test.go @@ -26,7 +26,7 @@ func TestBuildLoadBalancer_BackendUtilization(t *testing.T) { } policy := &egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.BackendUtilizationLoadBalancerType, BackendUtilization: backendUtilization, diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index 535eda81be..bce23fc26d 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -370,29 +370,6 @@ _Appears in:_ | `backendSettings` | _[ClusterSettings](#clustersettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | -#### BackendClusterSettings - - - -BackendClusterSettings contains CDS-only fields that configure the upstream Envoy Cluster. - -_Appears in:_ -- [BackendTrafficPolicySpec](#backendtrafficpolicyspec) -- [ClusterSettings](#clustersettings) - -| Field | Type | Required | Default | Description | -| --- | --- | --- | --- | --- | -| `loadBalancer` | _[LoadBalancer](#loadbalancer)_ | false | | LoadBalancer policy to apply when routing traffic from the gateway to
the backend endpoints. Defaults to `LeastRequest`. | -| `proxyProtocol` | _[ProxyProtocol](#proxyprotocol)_ | false | | ProxyProtocol enables the Proxy Protocol when communicating with the backend. | -| `tcpKeepalive` | _[TCPKeepalive](#tcpkeepalive)_ | false | | TcpKeepalive settings associated with the upstream client connection.
Disabled by default. | -| `healthCheck` | _[HealthCheck](#healthcheck)_ | false | | HealthCheck allows gateway to perform active health checking on backends. | -| `circuitBreaker` | _[CircuitBreaker](#circuitbreaker)_ | false | | Circuit Breaker settings for the upstream connections and requests.
If not set, circuit breakers will be enabled with the default thresholds | -| `timeout` | _[Timeout](#timeout)_ | false | | Timeout settings for the backend connections. | -| `connection` | _[BackendConnection](#backendconnection)_ | false | | Connection includes backend connection settings. | -| `dns` | _[DNS](#dns)_ | false | | DNS includes dns resolution settings. | -| `http2` | _[HTTP2Settings](#http2settings)_ | false | | HTTP2 provides HTTP/2 configuration for backend connections. | - - @@ -404,7 +381,7 @@ _Appears in:_ BackendConnection allows users to configure connection-level settings of backend _Appears in:_ -- [BackendClusterSettings](#backendclustersettings) +- [BackendSettings](#backendsettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClusterSettings](#clustersettings) @@ -477,6 +454,29 @@ _Appears in:_ | `fallback` | _boolean_ | false | | Fallback indicates whether the backend is designated as a fallback.
Multiple fallback backends can be configured.
It is highly recommended to configure active or passive health checks to ensure that failover can be detected
when the active backends become unhealthy and to automatically readjust once the primary backends are healthy again.
The overprovisioning factor is set to 1.4, meaning the fallback backends will only start receiving traffic when
the health of the active backends falls below 72%. | +#### BackendSettings + + + +BackendSettings contains CDS-only fields that configure the upstream Envoy Cluster. + +_Appears in:_ +- [BackendTrafficPolicySpec](#backendtrafficpolicyspec) +- [ClusterSettings](#clustersettings) + +| Field | Type | Required | Default | Description | +| --- | --- | --- | --- | --- | +| `loadBalancer` | _[LoadBalancer](#loadbalancer)_ | false | | LoadBalancer policy to apply when routing traffic from the gateway to
the backend endpoints. Defaults to `LeastRequest`. | +| `proxyProtocol` | _[ProxyProtocol](#proxyprotocol)_ | false | | ProxyProtocol enables the Proxy Protocol when communicating with the backend. | +| `tcpKeepalive` | _[TCPKeepalive](#tcpkeepalive)_ | false | | TcpKeepalive settings associated with the upstream client connection.
Disabled by default. | +| `healthCheck` | _[HealthCheck](#healthcheck)_ | false | | HealthCheck allows gateway to perform active health checking on backends. | +| `circuitBreaker` | _[CircuitBreaker](#circuitbreaker)_ | false | | Circuit Breaker settings for the upstream connections and requests.
If not set, circuit breakers will be enabled with the default thresholds | +| `timeout` | _[Timeout](#timeout)_ | false | | Timeout settings for the backend connections. | +| `connection` | _[BackendConnection](#backendconnection)_ | false | | Connection includes backend connection settings. | +| `dns` | _[DNS](#dns)_ | false | | DNS includes dns resolution settings. | +| `http2` | _[HTTP2Settings](#http2settings)_ | false | | HTTP2 provides HTTP/2 configuration for backend connections. | + + #### BackendSpec @@ -856,7 +856,7 @@ _Appears in:_ CircuitBreaker defines the Circuit Breaker configuration. _Appears in:_ -- [BackendClusterSettings](#backendclustersettings) +- [BackendSettings](#backendsettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClusterSettings](#clustersettings) @@ -1066,7 +1066,7 @@ _Appears in:_ ClusterSettings provides the various knobs that can be set to control how traffic to a given -backend will be configured. It embeds BackendClusterSettings (CDS-only fields) and adds +backend will be configured. It embeds BackendSettings (CDS-only fields) and adds route-level fields like Retry. _Appears in:_ @@ -1425,7 +1425,7 @@ _Appears in:_ _Appears in:_ -- [BackendClusterSettings](#backendclustersettings) +- [BackendSettings](#backendsettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClusterSettings](#clustersettings) @@ -2936,7 +2936,7 @@ _Appears in:_ HTTP2Settings provides HTTP/2 configuration for listeners and backends. _Appears in:_ -- [BackendClusterSettings](#backendclustersettings) +- [BackendSettings](#backendsettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClientTrafficPolicySpec](#clienttrafficpolicyspec) - [ClusterSettings](#clustersettings) @@ -3354,7 +3354,7 @@ HealthCheck configuration to decide which endpoints are healthy and can be used for routing. _Appears in:_ -- [BackendClusterSettings](#backendclustersettings) +- [BackendSettings](#backendsettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClusterSettings](#clustersettings) @@ -3981,7 +3981,7 @@ _Appears in:_ LoadBalancer defines the load balancer policy to be applied. _Appears in:_ -- [BackendClusterSettings](#backendclustersettings) +- [BackendSettings](#backendsettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClusterSettings](#clustersettings) @@ -4948,7 +4948,7 @@ ProxyProtocol defines the configuration related to the proxy protocol when communicating with the backend. _Appears in:_ -- [BackendClusterSettings](#backendclustersettings) +- [BackendSettings](#backendsettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClusterSettings](#clustersettings) @@ -6134,7 +6134,7 @@ _Appears in:_ TCPKeepalive define the TCP Keepalive configuration. _Appears in:_ -- [BackendClusterSettings](#backendclustersettings) +- [BackendSettings](#backendsettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClientTrafficPolicySpec](#clienttrafficpolicyspec) - [ClusterSettings](#clustersettings) @@ -6278,7 +6278,7 @@ _Appears in:_ Timeout defines configuration for timeouts related to connections. _Appears in:_ -- [BackendClusterSettings](#backendclustersettings) +- [BackendSettings](#backendsettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) - [ClusterSettings](#clustersettings) diff --git a/test/cel-validation/backendtrafficpolicy_test.go b/test/cel-validation/backendtrafficpolicy_test.go index 30289690e6..c28d64358b 100644 --- a/test/cel-validation/backendtrafficpolicy_test.go +++ b/test/cel-validation/backendtrafficpolicy_test.go @@ -508,7 +508,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, ConsistentHash: &egv1a1.ConsistentHash{ @@ -535,7 +535,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, }, @@ -562,7 +562,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, ConsistentHash: &egv1a1.ConsistentHash{ @@ -592,7 +592,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, ConsistentHash: &egv1a1.ConsistentHash{ @@ -622,7 +622,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, ConsistentHash: &egv1a1.ConsistentHash{ @@ -652,7 +652,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, ConsistentHash: &egv1a1.ConsistentHash{ @@ -682,7 +682,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, ConsistentHash: &egv1a1.ConsistentHash{ @@ -710,7 +710,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, ConsistentHash: &egv1a1.ConsistentHash{ @@ -743,7 +743,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, ConsistentHash: &egv1a1.ConsistentHash{ @@ -776,7 +776,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.LeastRequestLoadBalancerType, }, @@ -800,7 +800,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.LeastRequestLoadBalancerType, ZoneAware: &egv1a1.ZoneAware{}, @@ -825,7 +825,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.LeastRequestLoadBalancerType, ZoneAware: &egv1a1.ZoneAware{ @@ -859,7 +859,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.RoundRobinLoadBalancerType, ZoneAware: &egv1a1.ZoneAware{ @@ -891,7 +891,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.LeastRequestLoadBalancerType, SlowStart: &egv1a1.SlowStart{ @@ -918,7 +918,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.RoundRobinLoadBalancerType, SlowStart: &egv1a1.SlowStart{ @@ -945,7 +945,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.RandomLoadBalancerType, SlowStart: &egv1a1.SlowStart{ @@ -975,7 +975,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, SlowStart: &egv1a1.SlowStart{ @@ -1005,7 +1005,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.BackendUtilizationLoadBalancerType, BackendUtilization: &egv1a1.BackendUtilization{ @@ -1205,7 +1205,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.BackendUtilizationLoadBalancerType, }, @@ -1232,7 +1232,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.BackendUtilizationLoadBalancerType, BackendUtilization: &egv1a1.BackendUtilization{}, @@ -1258,7 +1258,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.BackendUtilizationLoadBalancerType, BackendUtilization: &egv1a1.BackendUtilization{}, @@ -1287,7 +1287,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.BackendUtilizationLoadBalancerType, BackendUtilization: &egv1a1.BackendUtilization{}, @@ -1318,7 +1318,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.BackendUtilizationLoadBalancerType, BackendUtilization: &egv1a1.BackendUtilization{ErrorUtilizationPenaltyPercent: new(uint32(0))}, @@ -1343,7 +1343,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.DynamicModuleLoadBalancerType, DynamicModule: &egv1a1.DynamicModuleLBPolicy{ @@ -1372,7 +1372,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.DynamicModuleLoadBalancerType, DynamicModule: &egv1a1.DynamicModuleLBPolicy{ @@ -1400,7 +1400,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.DynamicModuleLoadBalancerType, }, @@ -1427,7 +1427,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.RoundRobinLoadBalancerType, DynamicModule: &egv1a1.DynamicModuleLBPolicy{ @@ -1458,7 +1458,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.DynamicModuleLoadBalancerType, DynamicModule: &egv1a1.DynamicModuleLBPolicy{ @@ -1490,7 +1490,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.DynamicModuleLoadBalancerType, DynamicModule: &egv1a1.DynamicModuleLBPolicy{ @@ -1522,7 +1522,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.DynamicModuleLoadBalancerType, DynamicModule: &egv1a1.DynamicModuleLBPolicy{ @@ -1751,7 +1751,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ CircuitBreaker: &egv1a1.CircuitBreaker{ MaxConnections: valMax, MaxPendingRequests: valMin, @@ -1780,7 +1780,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ CircuitBreaker: &egv1a1.CircuitBreaker{ MaxConnections: valOverMax, MaxPendingRequests: valUnderMin, @@ -1814,7 +1814,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -1845,7 +1845,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ UnhealthyThreshold: new(uint32(0)), @@ -1877,7 +1877,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ HealthyThreshold: new(uint32(0)), @@ -1909,7 +1909,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -1941,7 +1941,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -1972,7 +1972,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -2004,7 +2004,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -2034,7 +2034,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -2066,7 +2066,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -2104,7 +2104,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -2142,7 +2142,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeTCP, @@ -2183,7 +2183,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeTCP, @@ -2225,7 +2225,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ Timeout: &egv1a1.Timeout{ TCP: &egv1a1.TCPTimeout{ ConnectTimeout: &d, @@ -2499,7 +2499,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ Connection: &egv1a1.BackendConnection{ BufferLimit: new(resource.MustParse("1Mi")), }, @@ -2522,7 +2522,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ Connection: &egv1a1.BackendConnection{ BufferLimit: new(resource.MustParse("12345678")), }, @@ -2546,7 +2546,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ Connection: &egv1a1.BackendConnection{ BufferLimit: new(resource.MustParse("1m")), }, @@ -2572,7 +2572,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ Connection: &egv1a1.BackendConnection{ Preconnect: &egv1a1.PreconnectPolicy{ PerEndpointPercent: new(uint32(100)), @@ -2601,7 +2601,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ Connection: &egv1a1.BackendConnection{ Preconnect: &egv1a1.PreconnectPolicy{ PerEndpointPercent: new(uint32(100)), @@ -2627,7 +2627,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ Connection: &egv1a1.BackendConnection{ Preconnect: &egv1a1.PreconnectPolicy{ PredictivePercent: new(uint32(110)), @@ -2657,7 +2657,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ Connection: &egv1a1.BackendConnection{ Preconnect: &egv1a1.PreconnectPolicy{ PredictivePercent: new(uint32(133)), @@ -2690,7 +2690,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ Connection: &egv1a1.BackendConnection{ Preconnect: &egv1a1.PreconnectPolicy{ PerEndpointPercent: new(uint32(305)), @@ -3407,7 +3407,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ HealthCheck: &egv1a1.HealthCheck{ PanicThreshold: new(uint32(80)), }, @@ -3431,7 +3431,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ HealthCheck: &egv1a1.HealthCheck{ PanicThreshold: new(uint32(200)), }, @@ -3629,7 +3629,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.RoundRobinLoadBalancerType, EndpointOverride: &egv1a1.EndpointOverride{ @@ -3739,7 +3739,7 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, ClusterSettings: egv1a1.ClusterSettings{ - BackendClusterSettings: egv1a1.BackendClusterSettings{ + BackendSettings: egv1a1.BackendSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.RoundRobinLoadBalancerType, EndpointOverride: &egv1a1.EndpointOverride{ From f14c59310bd40e969f0eb33a599823ffd479c13e Mon Sep 17 00:00:00 2001 From: Muhammad Waqar Date: Fri, 19 Jun 2026 10:40:35 -0400 Subject: [PATCH 3/5] api: rename BackendSettings to ClusterSettings and ClusterSettings to BackendSettings Swap type names per reviewer feedback: the CDS-only struct becomes ClusterSettings and the wrapper (with Retry) becomes BackendSettings. Also rename clustersettings.go to backendsettings.go. Signed-off-by: Muhammad Waqar --- api/v1alpha1/backendtrafficpolicy_types.go | 2 +- api/v1alpha1/shared_types.go | 14 +- api/v1alpha1/zz_generated.deepcopy.go | 98 +++---- ...{clustersettings.go => backendsettings.go} | 20 +- ...ackendsettings_backendutilization_test.go} | 4 +- internal/gatewayapi/backendtrafficpolicy.go | 20 +- internal/gatewayapi/securitypolicy.go | 2 +- site/content/en/latest/api/extension_types.md | 54 ++-- .../backendtrafficpolicy_test.go | 248 +++++++++--------- test/cel-validation/securitypolicy_test.go | 4 +- 10 files changed, 233 insertions(+), 233 deletions(-) rename internal/gatewayapi/{clustersettings.go => backendsettings.go} (97%) rename internal/gatewayapi/{clustersettings_backendutilization_test.go => backendsettings_backendutilization_test.go} (95%) diff --git a/api/v1alpha1/backendtrafficpolicy_types.go b/api/v1alpha1/backendtrafficpolicy_types.go index 6c7167548a..5069bfc5ee 100644 --- a/api/v1alpha1/backendtrafficpolicy_types.go +++ b/api/v1alpha1/backendtrafficpolicy_types.go @@ -49,7 +49,7 @@ type BackendTrafficPolicy struct { // +kubebuilder:validation:XValidation:rule="!has(self.admissionControl) || ((!has(self.targetRef) || self.targetRef.kind in ['Gateway', 'ListenerSet', 'HTTPRoute', 'GRPCRoute']) && (!has(self.targetRefs) || self.targetRefs.all(ref, ref.kind in ['Gateway', 'ListenerSet', 'HTTPRoute', 'GRPCRoute'])) && (!has(self.targetSelectors) || self.targetSelectors.all(sel, sel.kind in ['Gateway', 'ListenerSet', 'HTTPRoute', 'GRPCRoute'])))", message="admissionControl can only be used with HTTPRoute, GRPCRoute, Gateway, or ListenerSet targets" type BackendTrafficPolicySpec struct { PolicyTargetReferences `json:",inline"` - ClusterSettings `json:",inline"` + BackendSettings `json:",inline"` // MergeType determines how this configuration is merged with existing BackendTrafficPolicy // configurations targeting a parent resource. When set, this configuration will be merged diff --git a/api/v1alpha1/shared_types.go b/api/v1alpha1/shared_types.go index f1fe7646cf..61fcbc69d6 100644 --- a/api/v1alpha1/shared_types.go +++ b/api/v1alpha1/shared_types.go @@ -639,12 +639,12 @@ type BackendCluster struct { // to the backend. // // +optional - BackendSettings *ClusterSettings `json:"backendSettings,omitempty"` + BackendSettings *BackendSettings `json:"backendSettings,omitempty"` } -// BackendSettings contains CDS-only fields that configure the upstream Envoy Cluster. +// ClusterSettings contains CDS-only fields that configure the upstream Envoy Cluster. // +kubebuilder:validation:XValidation:rule="!((has(self.connection) && has(self.connection.preconnect) && has(self.connection.preconnect.predictivePercent)) && !(has(self.loadBalancer) && has(self.loadBalancer.type) && self.loadBalancer.type in ['Random', 'RoundRobin']))",message="predictivePercent in preconnect policy only works with RoundRobin or Random load balancers" -type BackendSettings struct { +type ClusterSettings struct { // LoadBalancer policy to apply when routing traffic from the gateway to // the backend endpoints. Defaults to `LeastRequest`. // +optional @@ -692,11 +692,11 @@ type BackendSettings struct { HTTP2 *HTTP2Settings `json:"http2,omitempty"` } -// ClusterSettings provides the various knobs that can be set to control how traffic to a given -// backend will be configured. It embeds BackendSettings (CDS-only fields) and adds +// BackendSettings provides the various knobs that can be set to control how traffic to a given +// backend will be configured. It embeds ClusterSettings (CDS-only fields) and adds // route-level fields like Retry. -type ClusterSettings struct { - BackendSettings `json:",inline"` +type BackendSettings struct { + ClusterSettings `json:",inline"` // Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions. // If not set, retry will be disabled. diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index 6fd32eb24a..aa46a452f8 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -425,7 +425,7 @@ func (in *BackendCluster) DeepCopyInto(out *BackendCluster) { } if in.BackendSettings != nil { in, out := &in.BackendSettings, &out.BackendSettings - *out = new(ClusterSettings) + *out = new(BackendSettings) (*in).DeepCopyInto(*out) } } @@ -591,49 +591,10 @@ func (in *BackendRef) DeepCopy() *BackendRef { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *BackendSettings) DeepCopyInto(out *BackendSettings) { *out = *in - if in.LoadBalancer != nil { - in, out := &in.LoadBalancer, &out.LoadBalancer - *out = new(LoadBalancer) - (*in).DeepCopyInto(*out) - } - if in.ProxyProtocol != nil { - in, out := &in.ProxyProtocol, &out.ProxyProtocol - *out = new(ProxyProtocol) - **out = **in - } - if in.TCPKeepalive != nil { - in, out := &in.TCPKeepalive, &out.TCPKeepalive - *out = new(TCPKeepalive) - (*in).DeepCopyInto(*out) - } - if in.HealthCheck != nil { - in, out := &in.HealthCheck, &out.HealthCheck - *out = new(HealthCheck) - (*in).DeepCopyInto(*out) - } - if in.CircuitBreaker != nil { - in, out := &in.CircuitBreaker, &out.CircuitBreaker - *out = new(CircuitBreaker) - (*in).DeepCopyInto(*out) - } - if in.Timeout != nil { - in, out := &in.Timeout, &out.Timeout - *out = new(Timeout) - (*in).DeepCopyInto(*out) - } - if in.Connection != nil { - in, out := &in.Connection, &out.Connection - *out = new(BackendConnection) - (*in).DeepCopyInto(*out) - } - if in.DNS != nil { - in, out := &in.DNS, &out.DNS - *out = new(DNS) - (*in).DeepCopyInto(*out) - } - if in.HTTP2 != nil { - in, out := &in.HTTP2, &out.HTTP2 - *out = new(HTTP2Settings) + in.ClusterSettings.DeepCopyInto(&out.ClusterSettings) + if in.Retry != nil { + in, out := &in.Retry, &out.Retry + *out = new(Retry) (*in).DeepCopyInto(*out) } } @@ -866,7 +827,7 @@ func (in *BackendTrafficPolicyList) DeepCopyObject() runtime.Object { func (in *BackendTrafficPolicySpec) DeepCopyInto(out *BackendTrafficPolicySpec) { *out = *in in.PolicyTargetReferences.DeepCopyInto(&out.PolicyTargetReferences) - in.ClusterSettings.DeepCopyInto(&out.ClusterSettings) + in.BackendSettings.DeepCopyInto(&out.BackendSettings) if in.MergeType != nil { in, out := &in.MergeType, &out.MergeType *out = new(MergeType) @@ -1668,10 +1629,49 @@ func (in *ClientValidationContext) DeepCopy() *ClientValidationContext { // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *ClusterSettings) DeepCopyInto(out *ClusterSettings) { *out = *in - in.BackendSettings.DeepCopyInto(&out.BackendSettings) - if in.Retry != nil { - in, out := &in.Retry, &out.Retry - *out = new(Retry) + if in.LoadBalancer != nil { + in, out := &in.LoadBalancer, &out.LoadBalancer + *out = new(LoadBalancer) + (*in).DeepCopyInto(*out) + } + if in.ProxyProtocol != nil { + in, out := &in.ProxyProtocol, &out.ProxyProtocol + *out = new(ProxyProtocol) + **out = **in + } + if in.TCPKeepalive != nil { + in, out := &in.TCPKeepalive, &out.TCPKeepalive + *out = new(TCPKeepalive) + (*in).DeepCopyInto(*out) + } + if in.HealthCheck != nil { + in, out := &in.HealthCheck, &out.HealthCheck + *out = new(HealthCheck) + (*in).DeepCopyInto(*out) + } + if in.CircuitBreaker != nil { + in, out := &in.CircuitBreaker, &out.CircuitBreaker + *out = new(CircuitBreaker) + (*in).DeepCopyInto(*out) + } + if in.Timeout != nil { + in, out := &in.Timeout, &out.Timeout + *out = new(Timeout) + (*in).DeepCopyInto(*out) + } + if in.Connection != nil { + in, out := &in.Connection, &out.Connection + *out = new(BackendConnection) + (*in).DeepCopyInto(*out) + } + if in.DNS != nil { + in, out := &in.DNS, &out.DNS + *out = new(DNS) + (*in).DeepCopyInto(*out) + } + if in.HTTP2 != nil { + in, out := &in.HTTP2, &out.HTTP2 + *out = new(HTTP2Settings) (*in).DeepCopyInto(*out) } } diff --git a/internal/gatewayapi/clustersettings.go b/internal/gatewayapi/backendsettings.go similarity index 97% rename from internal/gatewayapi/clustersettings.go rename to internal/gatewayapi/backendsettings.go index d442c2414d..5536014150 100644 --- a/internal/gatewayapi/clustersettings.go +++ b/internal/gatewayapi/backendsettings.go @@ -25,13 +25,13 @@ import ( "github.com/envoyproxy/gateway/internal/xds/utils/fractionalpercent" ) -func translateTrafficFeatures(policy *egv1a1.ClusterSettings) (*ir.TrafficFeatures, error) { +func translateTrafficFeatures(policy *egv1a1.BackendSettings) (*ir.TrafficFeatures, error) { if policy == nil { return nil, nil } ret := &ir.TrafficFeatures{} - if timeout, err := buildClusterSettingsTimeout(policy); err != nil { + if timeout, err := buildBackendSettingsTimeout(policy); err != nil { return nil, err } else { ret.Timeout = timeout @@ -89,7 +89,7 @@ func translateTrafficFeatures(policy *egv1a1.ClusterSettings) (*ir.TrafficFeatur return ret, nil } -func buildClusterSettingsTimeout(policy *egv1a1.ClusterSettings) (*ir.Timeout, error) { +func buildBackendSettingsTimeout(policy *egv1a1.BackendSettings) (*ir.Timeout, error) { if policy.Timeout == nil { return nil, nil } @@ -174,7 +174,7 @@ func buildClusterSettingsTimeout(policy *egv1a1.ClusterSettings) (*ir.Timeout, e return to, errs } -func buildBackendConnection(policy *egv1a1.ClusterSettings) (*ir.BackendConnection, error) { +func buildBackendConnection(policy *egv1a1.BackendSettings) (*ir.BackendConnection, error) { if policy.Connection == nil { return nil, nil } @@ -213,7 +213,7 @@ func buildBackendConnection(policy *egv1a1.ClusterSettings) (*ir.BackendConnecti return bcIR, nil } -func buildTCPKeepAlive(policy *egv1a1.ClusterSettings) (*ir.TCPKeepalive, error) { +func buildTCPKeepAlive(policy *egv1a1.BackendSettings) (*ir.TCPKeepalive, error) { if policy.TCPKeepalive == nil { return nil, nil } @@ -243,7 +243,7 @@ func buildTCPKeepAlive(policy *egv1a1.ClusterSettings) (*ir.TCPKeepalive, error) return ka, nil } -func buildCircuitBreaker(policy *egv1a1.ClusterSettings) (*ir.CircuitBreaker, error) { +func buildCircuitBreaker(policy *egv1a1.BackendSettings) (*ir.CircuitBreaker, error) { if policy.CircuitBreaker == nil { return nil, nil } @@ -312,7 +312,7 @@ func buildCircuitBreaker(policy *egv1a1.ClusterSettings) (*ir.CircuitBreaker, er return cb, nil } -func buildLoadBalancer(policy *egv1a1.ClusterSettings) (*ir.LoadBalancer, error) { +func buildLoadBalancer(policy *egv1a1.BackendSettings) (*ir.LoadBalancer, error) { if policy.LoadBalancer == nil { return nil, nil } @@ -512,7 +512,7 @@ func buildEndpointOverride(policy egv1a1.EndpointOverride) *ir.EndpointOverride return endpointOverride } -func buildProxyProtocol(policy *egv1a1.ClusterSettings) *ir.ProxyProtocol { +func buildProxyProtocol(policy *egv1a1.BackendSettings) *ir.ProxyProtocol { if policy.ProxyProtocol == nil { return nil } @@ -531,7 +531,7 @@ func buildProxyProtocol(policy *egv1a1.ClusterSettings) *ir.ProxyProtocol { return pp } -func buildHealthCheck(policy *egv1a1.ClusterSettings) *ir.HealthCheck { +func buildHealthCheck(policy *egv1a1.BackendSettings) *ir.HealthCheck { if policy.HealthCheck == nil { return nil } @@ -712,7 +712,7 @@ func translateActiveHealthCheckPayload(p *egv1a1.ActiveHealthCheckPayload) *ir.H return irPayload } -func translateDNS(policy *egv1a1.ClusterSettings, policyName string) *ir.DNS { +func translateDNS(policy *egv1a1.BackendSettings, policyName string) *ir.DNS { if policy.DNS == nil { return nil } diff --git a/internal/gatewayapi/clustersettings_backendutilization_test.go b/internal/gatewayapi/backendsettings_backendutilization_test.go similarity index 95% rename from internal/gatewayapi/clustersettings_backendutilization_test.go rename to internal/gatewayapi/backendsettings_backendutilization_test.go index e45ee3dc94..6ce3b4005b 100644 --- a/internal/gatewayapi/clustersettings_backendutilization_test.go +++ b/internal/gatewayapi/backendsettings_backendutilization_test.go @@ -25,8 +25,8 @@ func TestBuildLoadBalancer_BackendUtilization(t *testing.T) { MetricNamesForComputingUtilization: []string{"named_metrics.foo", "cpu_utilization"}, } - policy := &egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + policy := &egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.BackendUtilizationLoadBalancerType, BackendUtilization: backendUtilization, diff --git a/internal/gatewayapi/backendtrafficpolicy.go b/internal/gatewayapi/backendtrafficpolicy.go index 4f2378c5ce..a7d4a5fa83 100644 --- a/internal/gatewayapi/backendtrafficpolicy.go +++ b/internal/gatewayapi/backendtrafficpolicy.go @@ -1432,7 +1432,7 @@ func (t *Translator) applyTrafficFeatureToRoute(route RouteContext, } } - if localTo, err := buildClusterSettingsTimeout(&policy.Spec.ClusterSettings); err == nil { + if localTo, err := buildBackendSettingsTimeout(&policy.Spec.BackendSettings); err == nil { r.Traffic.Timeout = localTo } @@ -1505,13 +1505,13 @@ func (t *Translator) buildTrafficFeatures(policy *egv1a1.BackendTrafficPolicy, o errs = errors.Join(errs, err) } } - if lb, err = buildLoadBalancer(&policy.Spec.ClusterSettings); err != nil { + if lb, err = buildLoadBalancer(&policy.Spec.BackendSettings); err != nil { err = perr.WithMessage(err, "LoadBalancer") errs = errors.Join(errs, err) } - pp = buildProxyProtocol(&policy.Spec.ClusterSettings) - hc = buildHealthCheck(&policy.Spec.ClusterSettings) - if cb, err = buildCircuitBreaker(&policy.Spec.ClusterSettings); err != nil { + pp = buildProxyProtocol(&policy.Spec.BackendSettings) + hc = buildHealthCheck(&policy.Spec.BackendSettings) + if cb, err = buildCircuitBreaker(&policy.Spec.BackendSettings); err != nil { err = perr.WithMessage(err, "CircuitBreaker") errs = errors.Join(errs, err) } @@ -1521,7 +1521,7 @@ func (t *Translator) buildTrafficFeatures(policy *egv1a1.BackendTrafficPolicy, o if policy.Spec.AdmissionControl != nil { ac = t.buildAdmissionControl(policy) } - if ka, err = buildTCPKeepAlive(&policy.Spec.ClusterSettings); err != nil { + if ka, err = buildTCPKeepAlive(&policy.Spec.BackendSettings); err != nil { err = perr.WithMessage(err, "TCPKeepalive") errs = errors.Join(errs, err) } @@ -1531,12 +1531,12 @@ func (t *Translator) buildTrafficFeatures(policy *egv1a1.BackendTrafficPolicy, o errs = errors.Join(errs, err) } - if to, err = buildClusterSettingsTimeout(&policy.Spec.ClusterSettings); err != nil { + if to, err = buildBackendSettingsTimeout(&policy.Spec.BackendSettings); err != nil { err = perr.WithMessage(err, "Timeout") errs = errors.Join(errs, err) } - if bc, err = buildBackendConnection(&policy.Spec.ClusterSettings); err != nil { + if bc, err = buildBackendConnection(&policy.Spec.BackendSettings); err != nil { err = perr.WithMessage(err, "BackendConnection") errs = errors.Join(errs, err) } @@ -1569,7 +1569,7 @@ func (t *Translator) buildTrafficFeatures(policy *egv1a1.BackendTrafficPolicy, o errs = errors.Join(errs, err) } - ds = translateDNS(&policy.Spec.ClusterSettings, utils.NamespacedName(policy).String()) + ds = translateDNS(&policy.Spec.BackendSettings, utils.NamespacedName(policy).String()) return &ir.TrafficFeatures{ RateLimit: rl, @@ -1748,7 +1748,7 @@ func (t *Translator) translateBackendTrafficPolicyForListeners( } r.Traffic = tf.DeepCopy() - if localTo, err := buildClusterSettingsTimeout(&policy.Spec.ClusterSettings); err == nil { + if localTo, err := buildBackendSettingsTimeout(&policy.Spec.BackendSettings); err == nil { r.Traffic.Timeout = localTo } diff --git a/internal/gatewayapi/securitypolicy.go b/internal/gatewayapi/securitypolicy.go index 2bf4f0fc59..597214f791 100644 --- a/internal/gatewayapi/securitypolicy.go +++ b/internal/gatewayapi/securitypolicy.go @@ -2668,7 +2668,7 @@ func (t *Translator) buildExtAuth( http = policy.Spec.ExtAuth.HTTP grpc = policy.Spec.ExtAuth.GRPC backendRefs []egv1a1.BackendRef - backendSettings *egv1a1.ClusterSettings + backendSettings *egv1a1.BackendSettings protocol ir.AppProtocol rd *ir.RouteDestination authority string diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index bce23fc26d..5e27855dab 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -63,7 +63,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ | false | | BackendRef references a Kubernetes object that represents the
backend server to which the authorization request will be sent.
Deprecated: Use BackendRefs instead. | | `backendRefs` | _[BackendRef](#backendref) array_ | false | | BackendRefs references a Kubernetes object that represents the
backend server to which the authorization request will be sent. | -| `backendSettings` | _[ClusterSettings](#clustersettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | +| `backendSettings` | _[BackendSettings](#backendsettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | | `logName` | _string_ | false | | LogName defines the friendly name of the access log to be returned in
StreamAccessLogsMessage.Identifier. This allows the access log server
to differentiate between different access logs coming from the same Envoy. | | `type` | _[ALSEnvoyProxyAccessLogType](#alsenvoyproxyaccesslogtype)_ | true | | Type defines the type of accesslog. Supported types are "HTTP" and "TCP". | | `http` | _[ALSEnvoyProxyHTTPAccessLogConfig](#alsenvoyproxyhttpaccesslogconfig)_ | false | | HTTP defines additional configuration specific to HTTP access logs. | @@ -367,7 +367,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ | false | | BackendRef references a Kubernetes object that represents the
backend server to which the authorization request will be sent.
Deprecated: Use BackendRefs instead. | | `backendRefs` | _[BackendRef](#backendref) array_ | false | | BackendRefs references a Kubernetes object that represents the
backend server to which the authorization request will be sent. | -| `backendSettings` | _[ClusterSettings](#clustersettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | +| `backendSettings` | _[BackendSettings](#backendsettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | @@ -458,11 +458,22 @@ _Appears in:_ -BackendSettings contains CDS-only fields that configure the upstream Envoy Cluster. +BackendSettings provides the various knobs that can be set to control how traffic to a given +backend will be configured. It embeds ClusterSettings (CDS-only fields) and adds +route-level fields like Retry. _Appears in:_ +- [ALSEnvoyProxyAccessLog](#alsenvoyproxyaccesslog) +- [BackendCluster](#backendcluster) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) -- [ClusterSettings](#clustersettings) +- [ExtProc](#extproc) +- [GRPCExtAuthService](#grpcextauthservice) +- [HTTPExtAuthService](#httpextauthservice) +- [OIDCProvider](#oidcprovider) +- [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog) +- [ProxyOpenTelemetrySink](#proxyopentelemetrysink) +- [RemoteJWKS](#remotejwks) +- [TracingProvider](#tracingprovider) | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | @@ -475,6 +486,7 @@ _Appears in:_ | `connection` | _[BackendConnection](#backendconnection)_ | false | | Connection includes backend connection settings. | | `dns` | _[DNS](#dns)_ | false | | DNS includes dns resolution settings. | | `http2` | _[HTTP2Settings](#http2settings)_ | false | | HTTP2 provides HTTP/2 configuration for backend connections. | +| `retry` | _[Retry](#retry)_ | false | | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
If not set, retry will be disabled. | #### BackendSpec @@ -1065,22 +1077,11 @@ _Appears in:_ -ClusterSettings provides the various knobs that can be set to control how traffic to a given -backend will be configured. It embeds BackendSettings (CDS-only fields) and adds -route-level fields like Retry. +ClusterSettings contains CDS-only fields that configure the upstream Envoy Cluster. _Appears in:_ -- [ALSEnvoyProxyAccessLog](#alsenvoyproxyaccesslog) -- [BackendCluster](#backendcluster) +- [BackendSettings](#backendsettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) -- [ExtProc](#extproc) -- [GRPCExtAuthService](#grpcextauthservice) -- [HTTPExtAuthService](#httpextauthservice) -- [OIDCProvider](#oidcprovider) -- [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog) -- [ProxyOpenTelemetrySink](#proxyopentelemetrysink) -- [RemoteJWKS](#remotejwks) -- [TracingProvider](#tracingprovider) | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | @@ -1093,7 +1094,6 @@ _Appears in:_ | `connection` | _[BackendConnection](#backendconnection)_ | false | | Connection includes backend connection settings. | | `dns` | _[DNS](#dns)_ | false | | DNS includes dns resolution settings. | | `http2` | _[HTTP2Settings](#http2settings)_ | false | | HTTP2 provides HTTP/2 configuration for backend connections. | -| `retry` | _[Retry](#retry)_ | false | | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
If not set, retry will be disabled. | #### ClusterTranslationConfig @@ -2325,7 +2325,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ | false | | BackendRef references a Kubernetes object that represents the
backend server to which the authorization request will be sent.
Deprecated: Use BackendRefs instead. | | `backendRefs` | _[BackendRef](#backendref) array_ | false | | BackendRefs references a Kubernetes object that represents the
backend server to which the authorization request will be sent. | -| `backendSettings` | _[ClusterSettings](#clustersettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | +| `backendSettings` | _[BackendSettings](#backendsettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | | `messageTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | MessageTimeout is the timeout for a response to be returned from the external processor
Default: 200ms | | `failOpen` | _boolean_ | false | false | FailOpen is a switch used to control the behavior when failing to call the external processor.
If FailOpen is set to true, the system bypasses the ExtProc extension and
allows the traffic to pass through. If it is set to false or
not set (defaulting to false), the system blocks the traffic and returns
an HTTP 5xx error.
If set to true, the ExtProc extension will also be bypassed if the configuration is invalid. | | `processingMode` | _[ExtProcProcessingMode](#extprocprocessingmode)_ | false | | ProcessingMode defines how request and response body is processed
Default: header and body are not sent to the external processor | @@ -2648,7 +2648,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ | false | | BackendRef references a Kubernetes object that represents the
backend server to which the authorization request will be sent.
Deprecated: Use BackendRefs instead. | | `backendRefs` | _[BackendRef](#backendref) array_ | false | | BackendRefs references a Kubernetes object that represents the
backend server to which the authorization request will be sent. | -| `backendSettings` | _[ClusterSettings](#clustersettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | +| `backendSettings` | _[BackendSettings](#backendsettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | #### GRPCSettings @@ -3062,7 +3062,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ | false | | BackendRef references a Kubernetes object that represents the
backend server to which the authorization request will be sent.
Deprecated: Use BackendRefs instead. | | `backendRefs` | _[BackendRef](#backendref) array_ | false | | BackendRefs references a Kubernetes object that represents the
backend server to which the authorization request will be sent. | -| `backendSettings` | _[ClusterSettings](#clustersettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | +| `backendSettings` | _[BackendSettings](#backendsettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | | `path` | _string_ | false | | Path is the path of the HTTP External Authorization service.
If path is specified, the authorization request will be sent to that path,
or else the authorization request will use the path of the original request.
Please note that the original request path will be appended to the path specified here.
For example, if the original request path is "/hello", and the path specified here is "/auth",
then the path of the authorization request will be "/auth/hello". If the path is not specified,
the path of the authorization request will be "/hello".
Only one of Path or PathOverride can be set. | | `pathOverride` | _string_ | false | | PathOverride replaces the original request path in the authorization request.
If set, the path will be overridden to this value during authorization.
For example, if the original request path is "/hello", and PathOverride is set to "/auth",
then the path of the authorization request will be "/auth".
Only one of Path or PathOverride can be set. | | `headersToBackend` | _string array_ | false | | HeadersToBackend are the authorization response headers that will be added
to the original client request before sending it to the backend server.
Note that coexisting headers will be overridden.
If not specified, no authorization response headers will be added to the
original client request. | @@ -4333,7 +4333,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ | false | | BackendRef references a Kubernetes object that represents the
backend server to which the authorization request will be sent.
Deprecated: Use BackendRefs instead. | | `backendRefs` | _[BackendRef](#backendref) array_ | false | | BackendRefs references a Kubernetes object that represents the
backend server to which the authorization request will be sent. | -| `backendSettings` | _[ClusterSettings](#clustersettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | +| `backendSettings` | _[BackendSettings](#backendsettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | | `issuer` | _string_ | true | | The OIDC Provider's [issuer identifier](https://openid.net/specs/openid-connect-discovery-1_0.html#IssuerDiscovery).
Issuer MUST be a URI RFC 3986 [RFC3986] with a scheme component that MUST
be https, a host component, and optionally, port and path components and
no query or fragment components. | | `authorizationEndpoint` | _string_ | false | | The OIDC Provider's [authorization endpoint](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint).
If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). | | `tokenEndpoint` | _string_ | false | | The OIDC Provider's [token endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint).
If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). | @@ -4403,7 +4403,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ | false | | BackendRef references a Kubernetes object that represents the
backend server to which the authorization request will be sent.
Deprecated: Use BackendRefs instead. | | `backendRefs` | _[BackendRef](#backendref) array_ | false | | BackendRefs references a Kubernetes object that represents the
backend server to which the authorization request will be sent. | -| `backendSettings` | _[ClusterSettings](#clustersettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | +| `backendSettings` | _[BackendSettings](#backendsettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | | `host` | _string_ | false | | Host define the extension service hostname.
Deprecated: Use BackendRefs instead. | | `port` | _integer_ | false | 4317 | Port defines the port the extension service is exposed on.
Deprecated: Use BackendRefs instead. | | `resources` | _object (keys:string, values:string)_ | false | | Resources is a set of labels that describe the source of a log entry, including envoy node info.
It's recommended to follow [semantic conventions](https://opentelemetry.io/docs/reference/specification/resource/semantic_conventions/).
Deprecated: Use ResourceAttributes instead. | @@ -4916,7 +4916,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ | false | | BackendRef references a Kubernetes object that represents the
backend server to which the authorization request will be sent.
Deprecated: Use BackendRefs instead. | | `backendRefs` | _[BackendRef](#backendref) array_ | false | | BackendRefs references a Kubernetes object that represents the
backend server to which the authorization request will be sent. | -| `backendSettings` | _[ClusterSettings](#clustersettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | +| `backendSettings` | _[BackendSettings](#backendsettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | | `host` | _string_ | false | | Host define the service hostname.
Deprecated: Use BackendRefs instead. | | `port` | _integer_ | false | 4317 | Port defines the port the service is exposed on.
Deprecated: Use BackendRefs instead. | | `reportCountersAsDeltas` | _boolean_ | false | | ReportCountersAsDeltas configures the OpenTelemetry sink to report
counters as delta temporality instead of cumulative. | @@ -5458,7 +5458,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ | false | | BackendRef references a Kubernetes object that represents the
backend server to which the authorization request will be sent.
Deprecated: Use BackendRefs instead. | | `backendRefs` | _[BackendRef](#backendref) array_ | false | | BackendRefs references a Kubernetes object that represents the
backend server to which the authorization request will be sent. | -| `backendSettings` | _[ClusterSettings](#clustersettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | +| `backendSettings` | _[BackendSettings](#backendsettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | | `uri` | _string_ | true | | URI is the HTTPS URI to fetch the JWKS. Envoy's system trust bundle is used to validate the server certificate.
If a custom trust bundle is needed, it can be specified in a BackendTLSConfig resource and target the BackendRefs. | | `cacheDuration` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | 300s | | | `failedRefetchDuration` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | FailedRefetchDuration is the duration Envoy waits before re-fetching the JWKS
after a failed fetch.
This does not control retries within a single fetch attempt (see BackendSettings.Retry),
only the interval between fetch attempts after a failure.
If not specified, Envoy's default of 1 second is used. | @@ -5628,8 +5628,8 @@ _Appears in:_ Retry defines the retry strategy to be applied. _Appears in:_ +- [BackendSettings](#backendsettings) - [BackendTrafficPolicySpec](#backendtrafficpolicyspec) -- [ClusterSettings](#clustersettings) | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | @@ -6333,7 +6333,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ | false | | BackendRef references a Kubernetes object that represents the
backend server to which the authorization request will be sent.
Deprecated: Use BackendRefs instead. | | `backendRefs` | _[BackendRef](#backendref) array_ | false | | BackendRefs references a Kubernetes object that represents the
backend server to which the authorization request will be sent. | -| `backendSettings` | _[ClusterSettings](#clustersettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | +| `backendSettings` | _[BackendSettings](#backendsettings)_ | false | | BackendSettings holds configuration for managing the connection
to the backend. | | `type` | _[TracingProviderType](#tracingprovidertype)_ | true | OpenTelemetry | Type defines the tracing provider type. | | `host` | _string_ | false | | Host define the provider service hostname.
Deprecated: Use BackendRefs instead. | | `port` | _integer_ | false | 4317 | Port defines the port the provider service is exposed on.
Deprecated: Use BackendRefs instead. | diff --git a/test/cel-validation/backendtrafficpolicy_test.go b/test/cel-validation/backendtrafficpolicy_test.go index c28d64358b..3e27854824 100644 --- a/test/cel-validation/backendtrafficpolicy_test.go +++ b/test/cel-validation/backendtrafficpolicy_test.go @@ -507,8 +507,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, ConsistentHash: &egv1a1.ConsistentHash{ @@ -534,8 +534,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, }, @@ -561,8 +561,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, ConsistentHash: &egv1a1.ConsistentHash{ @@ -591,8 +591,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, ConsistentHash: &egv1a1.ConsistentHash{ @@ -621,8 +621,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, ConsistentHash: &egv1a1.ConsistentHash{ @@ -651,8 +651,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, ConsistentHash: &egv1a1.ConsistentHash{ @@ -681,8 +681,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, ConsistentHash: &egv1a1.ConsistentHash{ @@ -709,8 +709,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, ConsistentHash: &egv1a1.ConsistentHash{ @@ -742,8 +742,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, ConsistentHash: &egv1a1.ConsistentHash{ @@ -775,8 +775,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.LeastRequestLoadBalancerType, }, @@ -799,8 +799,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.LeastRequestLoadBalancerType, ZoneAware: &egv1a1.ZoneAware{}, @@ -824,8 +824,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.LeastRequestLoadBalancerType, ZoneAware: &egv1a1.ZoneAware{ @@ -858,8 +858,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.RoundRobinLoadBalancerType, ZoneAware: &egv1a1.ZoneAware{ @@ -890,8 +890,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.LeastRequestLoadBalancerType, SlowStart: &egv1a1.SlowStart{ @@ -917,8 +917,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.RoundRobinLoadBalancerType, SlowStart: &egv1a1.SlowStart{ @@ -944,8 +944,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.RandomLoadBalancerType, SlowStart: &egv1a1.SlowStart{ @@ -974,8 +974,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.ConsistentHashLoadBalancerType, SlowStart: &egv1a1.SlowStart{ @@ -1004,8 +1004,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.BackendUtilizationLoadBalancerType, BackendUtilization: &egv1a1.BackendUtilization{ @@ -1204,8 +1204,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.BackendUtilizationLoadBalancerType, }, @@ -1231,8 +1231,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.BackendUtilizationLoadBalancerType, BackendUtilization: &egv1a1.BackendUtilization{}, @@ -1257,8 +1257,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.BackendUtilizationLoadBalancerType, BackendUtilization: &egv1a1.BackendUtilization{}, @@ -1286,8 +1286,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.BackendUtilizationLoadBalancerType, BackendUtilization: &egv1a1.BackendUtilization{}, @@ -1317,8 +1317,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.BackendUtilizationLoadBalancerType, BackendUtilization: &egv1a1.BackendUtilization{ErrorUtilizationPenaltyPercent: new(uint32(0))}, @@ -1342,8 +1342,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.DynamicModuleLoadBalancerType, DynamicModule: &egv1a1.DynamicModuleLBPolicy{ @@ -1371,8 +1371,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.DynamicModuleLoadBalancerType, DynamicModule: &egv1a1.DynamicModuleLBPolicy{ @@ -1399,8 +1399,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.DynamicModuleLoadBalancerType, }, @@ -1426,8 +1426,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.RoundRobinLoadBalancerType, DynamicModule: &egv1a1.DynamicModuleLBPolicy{ @@ -1457,8 +1457,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.DynamicModuleLoadBalancerType, DynamicModule: &egv1a1.DynamicModuleLBPolicy{ @@ -1489,8 +1489,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.DynamicModuleLoadBalancerType, DynamicModule: &egv1a1.DynamicModuleLBPolicy{ @@ -1521,8 +1521,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.DynamicModuleLoadBalancerType, DynamicModule: &egv1a1.DynamicModuleLBPolicy{ @@ -1750,8 +1750,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ CircuitBreaker: &egv1a1.CircuitBreaker{ MaxConnections: valMax, MaxPendingRequests: valMin, @@ -1779,8 +1779,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ CircuitBreaker: &egv1a1.CircuitBreaker{ MaxConnections: valOverMax, MaxPendingRequests: valUnderMin, @@ -1813,8 +1813,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -1844,8 +1844,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ UnhealthyThreshold: new(uint32(0)), @@ -1876,8 +1876,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ HealthyThreshold: new(uint32(0)), @@ -1908,8 +1908,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -1940,8 +1940,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -1971,8 +1971,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -2003,8 +2003,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -2033,8 +2033,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -2065,8 +2065,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -2103,8 +2103,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -2141,8 +2141,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeTCP, @@ -2182,8 +2182,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeTCP, @@ -2224,8 +2224,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ Timeout: &egv1a1.Timeout{ TCP: &egv1a1.TCPTimeout{ ConnectTimeout: &d, @@ -2498,8 +2498,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ Connection: &egv1a1.BackendConnection{ BufferLimit: new(resource.MustParse("1Mi")), }, @@ -2521,8 +2521,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ Connection: &egv1a1.BackendConnection{ BufferLimit: new(resource.MustParse("12345678")), }, @@ -2545,8 +2545,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ Connection: &egv1a1.BackendConnection{ BufferLimit: new(resource.MustParse("1m")), }, @@ -2571,8 +2571,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ Connection: &egv1a1.BackendConnection{ Preconnect: &egv1a1.PreconnectPolicy{ PerEndpointPercent: new(uint32(100)), @@ -2600,8 +2600,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ Connection: &egv1a1.BackendConnection{ Preconnect: &egv1a1.PreconnectPolicy{ PerEndpointPercent: new(uint32(100)), @@ -2626,8 +2626,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ Connection: &egv1a1.BackendConnection{ Preconnect: &egv1a1.PreconnectPolicy{ PredictivePercent: new(uint32(110)), @@ -2656,8 +2656,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ Connection: &egv1a1.BackendConnection{ Preconnect: &egv1a1.PreconnectPolicy{ PredictivePercent: new(uint32(133)), @@ -2689,8 +2689,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ Connection: &egv1a1.BackendConnection{ Preconnect: &egv1a1.PreconnectPolicy{ PerEndpointPercent: new(uint32(305)), @@ -3406,8 +3406,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ PanicThreshold: new(uint32(80)), }, @@ -3430,8 +3430,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ PanicThreshold: new(uint32(200)), }, @@ -3628,8 +3628,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.RoundRobinLoadBalancerType, EndpointOverride: &egv1a1.EndpointOverride{ @@ -3738,8 +3738,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ LoadBalancer: &egv1a1.LoadBalancer{ Type: egv1a1.RoundRobinLoadBalancerType, EndpointOverride: &egv1a1.EndpointOverride{ @@ -4062,8 +4062,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -4096,8 +4096,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -4129,8 +4129,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -4163,8 +4163,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, @@ -4197,8 +4197,8 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - BackendSettings: egv1a1.BackendSettings{ + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ HealthCheck: &egv1a1.HealthCheck{ Active: &egv1a1.ActiveHealthCheck{ Type: egv1a1.ActiveHealthCheckerTypeHTTP, diff --git a/test/cel-validation/securitypolicy_test.go b/test/cel-validation/securitypolicy_test.go index c6117a8c15..d4921e0155 100644 --- a/test/cel-validation/securitypolicy_test.go +++ b/test/cel-validation/securitypolicy_test.go @@ -1779,7 +1779,7 @@ func TestSecurityPolicyTarget(t *testing.T) { OIDC: &egv1a1.OIDC{ Provider: egv1a1.OIDCProvider{ BackendCluster: egv1a1.BackendCluster{ - BackendSettings: &egv1a1.ClusterSettings{ + BackendSettings: &egv1a1.BackendSettings{ Retry: &egv1a1.Retry{ NumRetries: new(int32(3)), PerRetry: &egv1a1.PerRetryPolicy{ @@ -1827,7 +1827,7 @@ func TestSecurityPolicyTarget(t *testing.T) { OIDC: &egv1a1.OIDC{ Provider: egv1a1.OIDCProvider{ BackendCluster: egv1a1.BackendCluster{ - BackendSettings: &egv1a1.ClusterSettings{ + BackendSettings: &egv1a1.BackendSettings{ Retry: &egv1a1.Retry{ NumRetries: new(int32(3)), PerRetry: &egv1a1.PerRetryPolicy{ From 33bb06cfa5433c23ba10e9a969faa3f5e30d7c3d Mon Sep 17 00:00:00 2001 From: Muhammad Waqar Date: Wed, 5 Aug 2026 11:11:12 -0400 Subject: [PATCH 4/5] gatewayapi,test: fix BackendTrafficPolicySpec.ClusterSettings literals after rebase Rebasing onto main picked up test cases that construct BackendTrafficPolicySpec with a direct ClusterSettings field, which this branch's split moved one level deeper under the new BackendSettings field. git's auto-merge didn't flag these as conflicts since the surrounding lines didn't textually overlap. Signed-off-by: Muhammad Waqar --- .../gatewayapi/backendtrafficpolicy_test.go | 72 +++++++++++------ .../backendtrafficpolicy_test.go | 78 +++++++++++-------- 2 files changed, 95 insertions(+), 55 deletions(-) diff --git a/internal/gatewayapi/backendtrafficpolicy_test.go b/internal/gatewayapi/backendtrafficpolicy_test.go index e6242aa5b4..a110008ddd 100644 --- a/internal/gatewayapi/backendtrafficpolicy_test.go +++ b/internal/gatewayapi/backendtrafficpolicy_test.go @@ -1647,7 +1647,9 @@ func TestBTPRoutingTypeIndex(t *testing.T) { SectionName: new(gwapiv1.SectionName("http")), }, }, - ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}}, + }, }, }, { @@ -2341,8 +2343,10 @@ func TestBTPLoadBalancerIndexIsConsistentHash(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType}, + }, }, }, }, @@ -2367,8 +2371,10 @@ func TestBTPLoadBalancerIndexIsConsistentHash(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{Type: roundRobinType}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{Type: roundRobinType}, + }, }, }, }, @@ -2394,8 +2400,10 @@ func TestBTPLoadBalancerIndexIsConsistentHash(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType}, + }, }, }, }, @@ -2418,8 +2426,10 @@ func TestBTPLoadBalancerIndexIsConsistentHash(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType}, + }, }, }, }, @@ -2462,8 +2472,10 @@ func TestBTPLoadBalancerIndexIsConsistentHash(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{Type: roundRobinType}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{Type: roundRobinType}, + }, }, }, }, @@ -2481,8 +2493,10 @@ func TestBTPLoadBalancerIndexIsConsistentHash(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType}, + }, }, }, }, @@ -2523,8 +2537,10 @@ func TestBTPLoadBalancerIndexIsConsistentHash(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType}, + }, }, }, }, @@ -2571,7 +2587,7 @@ func TestBtpSpecHasClusterScopedFields(t *testing.T) { }, { name: "ClusterSettings field set", - spec: &egv1a1.BackendTrafficPolicySpec{ClusterSettings: *circuitBreakerSet}, + spec: &egv1a1.BackendTrafficPolicySpec{BackendSettings: egv1a1.BackendSettings{ClusterSettings: *circuitBreakerSet}}, want: true, }, { @@ -2608,7 +2624,9 @@ func TestBuildBTPClusterSettingsIndexCrossNamespace(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: circuitBreaker}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: circuitBreaker}, + }, }, }, } @@ -2807,7 +2825,9 @@ func TestBTPClusterSettingsIndex(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}}, + }, }, }, { @@ -2848,7 +2868,9 @@ func TestBTPClusterSettingsIndex(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}}, + }, }, }, { @@ -2906,7 +2928,9 @@ func TestBTPClusterSettingsIndex(t *testing.T) { SectionName: &ruleName, }, }, - ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}}, + }, }, }, }, @@ -2946,7 +2970,9 @@ func TestBTPClusterSettingsIndex(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}}, + }, }, }, }, @@ -2986,7 +3012,9 @@ func TestBTPClusterSettingsIndex(t *testing.T) { SectionName: new(gwapiv1.SectionName("http")), }, }, - ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}}, + }, }, }, }, diff --git a/test/cel-validation/backendtrafficpolicy_test.go b/test/cel-validation/backendtrafficpolicy_test.go index 3e27854824..cd734185d6 100644 --- a/test/cel-validation/backendtrafficpolicy_test.go +++ b/test/cel-validation/backendtrafficpolicy_test.go @@ -1035,14 +1035,16 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.BackendUtilizationLoadBalancerType, - BackendUtilization: &egv1a1.BackendUtilization{ - OutOfBand: &egv1a1.OutOfBandReporting{ - ReportingPeriod: new(gwapiv1.Duration("5s")), - Port: new(int32(9001)), - Authority: new("orca.local"), + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.BackendUtilizationLoadBalancerType, + BackendUtilization: &egv1a1.BackendUtilization{ + OutOfBand: &egv1a1.OutOfBandReporting{ + ReportingPeriod: new(gwapiv1.Duration("5s")), + Port: new(int32(9001)), + Authority: new("orca.local"), + }, }, }, }, @@ -1064,11 +1066,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.BackendUtilizationLoadBalancerType, - BackendUtilization: &egv1a1.BackendUtilization{ - OutOfBand: &egv1a1.OutOfBandReporting{Port: new(int32(0))}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.BackendUtilizationLoadBalancerType, + BackendUtilization: &egv1a1.BackendUtilization{ + OutOfBand: &egv1a1.OutOfBandReporting{Port: new(int32(0))}, + }, }, }, }, @@ -1092,11 +1096,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.BackendUtilizationLoadBalancerType, - BackendUtilization: &egv1a1.BackendUtilization{ - OutOfBand: &egv1a1.OutOfBandReporting{Port: new(int32(70000))}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.BackendUtilizationLoadBalancerType, + BackendUtilization: &egv1a1.BackendUtilization{ + OutOfBand: &egv1a1.OutOfBandReporting{Port: new(int32(70000))}, + }, }, }, }, @@ -1120,11 +1126,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.BackendUtilizationLoadBalancerType, - BackendUtilization: &egv1a1.BackendUtilization{ - OutOfBand: &egv1a1.OutOfBandReporting{ReportingPeriod: new(gwapiv1.Duration("0s"))}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.BackendUtilizationLoadBalancerType, + BackendUtilization: &egv1a1.BackendUtilization{ + OutOfBand: &egv1a1.OutOfBandReporting{ReportingPeriod: new(gwapiv1.Duration("0s"))}, + }, }, }, }, @@ -1148,11 +1156,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.BackendUtilizationLoadBalancerType, - BackendUtilization: &egv1a1.BackendUtilization{ - OutOfBand: &egv1a1.OutOfBandReporting{Authority: new("")}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.BackendUtilizationLoadBalancerType, + BackendUtilization: &egv1a1.BackendUtilization{ + OutOfBand: &egv1a1.OutOfBandReporting{Authority: new("")}, + }, }, }, }, @@ -1176,11 +1186,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) { }, }, }, - ClusterSettings: egv1a1.ClusterSettings{ - LoadBalancer: &egv1a1.LoadBalancer{ - Type: egv1a1.BackendUtilizationLoadBalancerType, - BackendUtilization: &egv1a1.BackendUtilization{ - OutOfBand: &egv1a1.OutOfBandReporting{Authority: new("foo\nbar")}, + BackendSettings: egv1a1.BackendSettings{ + ClusterSettings: egv1a1.ClusterSettings{ + LoadBalancer: &egv1a1.LoadBalancer{ + Type: egv1a1.BackendUtilizationLoadBalancerType, + BackendUtilization: &egv1a1.BackendUtilization{ + OutOfBand: &egv1a1.OutOfBandReporting{Authority: new("foo\nbar")}, + }, }, }, }, From e3a33518e5ffdab1e5651b1a536a6cc9d7ac8cef Mon Sep 17 00:00:00 2001 From: Muhammad Waqar Date: Wed, 5 Aug 2026 11:16:50 -0400 Subject: [PATCH 5/5] docs: regenerate extension_types.md after rebase The rebase's conflict resolution took a stale snapshot of this generated file; regenerate it properly from the current API types. Signed-off-by: Muhammad Waqar --- site/content/en/latest/api/extension_types.md | 266 ++++++++++++++++-- 1 file changed, 248 insertions(+), 18 deletions(-) diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index 5e27855dab..16085f41fa 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -308,7 +308,8 @@ _Appears in:_ | `name` | _string_ | false | | Name is a user-friendly name for the rule.
If not specified, Envoy Gateway will generate a unique name for the rule. | | `action` | _[AuthorizationAction](#authorizationaction)_ | true | | Action defines the action to be taken if the rule matches. | | `operation` | _[Operation](#operation)_ | false | | Operation specifies the operation of a request, such as HTTP methods.
If not specified, all operations are matched on. | -| `principal` | _[Principal](#principal)_ | true | | Principal specifies the client identity of a request.
If there are multiple principal types, all principals must match for the rule to match.
For example, if there are two principals: one for client IP and one for JWT claim,
the rule will match only if both the client IP and the JWT claim match. | +| `principal` | _[Principal](#principal)_ | false | | Principal specifies the client identity of a request.
If there are multiple principal types, all principals must match for the rule to match.
For example, if there are two principals: one for client IP and one for JWT claim,
the rule will match only if both the client IP and the JWT claim match. | +| `cel` | _[CELExpression](#celexpression)_ | false | | CEL specifies a Common Expression Language expression to evaluate for the
request. If specified, the expression must evaluate to true for the rule to match.
The expression can use Envoy attributes exposed to the CEL runtime.
Request attributes, such as request.path, request.url_path, request.host,
request.scheme, request.method, request.headers, and request.query, are
generally available during authorization. Connection attributes, such as
source.address, source.port, destination.address, destination.port,
connection.mtls, and connection.requested_server_name, may also be used.
Dynamic metadata and filter state produced by earlier filters may also be
available through attributes such as metadata and filter_state.
Response attributes are only available after the request completes and
should not be used for authorization decisions.
For more details, see:
https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/advanced/attributes
The rule matches only when the expression evaluates to a boolean true.
Non-boolean results, false, null, and CEL evaluation errors are treated as
no match.
Examples:
`request.headers['x-tenant'] == 'team-a'`
`request.method == 'POST' && request.path.startsWith('/admin')` | #### BackOffPolicy @@ -618,7 +619,7 @@ _Appears in:_ | `dns` | _[DNS](#dns)_ | false | | DNS includes dns resolution settings. | | `http2` | _[HTTP2Settings](#http2settings)_ | false | | HTTP2 provides HTTP/2 configuration for backend connections. | | `retry` | _[Retry](#retry)_ | false | | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
If not set, retry will be disabled. | -| `mergeType` | _[MergeType](#mergetype)_ | false | | MergeType determines how this configuration is merged with existing BackendTrafficPolicy
configurations targeting a parent resource. When set, this configuration will be merged
into a parent BackendTrafficPolicy (i.e. the one targeting a Gateway or Listener).
This field cannot be set when targeting a parent resource (Gateway).
If unset, no merging occurs, and only the most specific configuration takes effect. | +| `mergeType` | _[MergeType](#mergetype)_ | false | | MergeType determines how this configuration is merged with existing BackendTrafficPolicy
configurations targeting a parent resource. When set, this configuration will be merged
into the closest parent BackendTrafficPolicy in the route's attachment hierarchy (for
example, one targeting a Gateway, Gateway listener, ListenerSet, or ListenerSet listener).
Currently, this field can only be set when targeting xRoute resources.
If unset, no merging occurs, and only the most specific configuration takes effect. | | `rateLimit` | _[RateLimitSpec](#ratelimitspec)_ | false | | RateLimit allows the user to limit the number of incoming requests
to a predefined value based on attributes within the traffic flow. | | `bandwidthLimit` | _[BandwidthLimitSpec](#bandwidthlimitspec)_ | false | | BandwidthLimit allows the user to limit the bandwidth of traffic
sent to and received from the backend. | | `faultInjection` | _[FaultInjection](#faultinjection)_ | false | | FaultInjection defines the fault injection policy to be applied. This configuration can be used to
inject delays and abort requests to mimic failure scenarios such as service failures and overloads | @@ -678,6 +679,7 @@ _Appears in:_ | `errorUtilizationPenaltyPercent` | _integer_ | false | | ErrorUtilizationPenaltyPercent adjusts endpoint weights based on the error rate (eps/qps).
This is expressed as a percentage-based integer where 100 represents 1.0, 150 represents 1.5, etc.
For example:
- 100 => 1.0x
- 120 => 1.2x
- 200 => 2.0x
Must be non-negative. | | `metricNamesForComputingUtilization` | _string array_ | false | | Metric names used to compute utilization if application_utilization is not set.
For map fields in ORCA proto, use the form ".", e.g., "named_metrics.foo". | | `keepResponseHeaders` | _boolean_ | false | false | KeepResponseHeaders keeps the ORCA load report headers/trailers before sending the response to the client.
Defaults to false. | +| `outOfBand` | _[OutOfBandReporting](#outofbandreporting)_ | false | | OutOfBand enables out-of-band ORCA load reporting. When set, Envoy opens a
server-streaming gRPC connection to each endpoint's
xds.service.orca.v3.OpenRcaService/StreamCoreMetrics and pulls load
reports periodically, instead of relying on in-band ORCA metrics
carried in response headers/trailers.
The backend must implement OpenRcaService for this to take effect. | #### BandwidthLimitRequestConfig @@ -829,6 +831,17 @@ _Appears in:_ +#### CELExpression + +_Underlying type:_ _string_ + +CELExpression specifies a CEL expression. + +_Appears in:_ +- [AuthorizationRule](#authorizationrule) + + + #### CIDR _Underlying type:_ _string_ @@ -861,6 +874,24 @@ _Appears in:_ | `allowCredentials` | _boolean_ | false | | AllowCredentials indicates whether a request can include user credentials
like cookies, authentication headers, or TLS client certificates.
It specifies the value in the Access-Control-Allow-Credentials CORS response header. | +#### CSRF + + + +CSRF defines the configuration for the Cross-Site Request Forgery (CSRF) filter. +The CSRF filter checks that the Origin header in HTTP requests matches the destination, +preventing cross-origin mutating requests (POST, PUT, DELETE, PATCH) from being processed. +GET and HEAD requests are always allowed. + +_Appears in:_ +- [SecurityPolicySpec](#securitypolicyspec) + +| Field | Type | Required | Default | Description | +| --- | --- | --- | --- | --- | +| `shadowFraction` | _[Fraction](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#fraction)_ | false | | ShadowFraction represents the fraction of requests for which the CSRF policy is
evaluated in shadow (dry-run) mode. For these requests, the filter records whether
the request would have been allowed or rejected in the `csrf.request_valid` and
`csrf.request_invalid` stats, but always lets the request through. The remaining
requests are enforced, i.e. a mutating request with a missing or non-matching
Origin header is rejected with a 403.
Defaults to 0% (all requests are enforced) if not specified. Set it to 100% to
dry run the filter, watch the stats to find origins that would be rejected, then
lower it to roll enforcement out gradually. | +| `additionalOrigins` | _[Origin](#origin) array_ | false | | AdditionalOrigins specifies additional origins that are allowed to make mutating
requests, beyond the destination origin. A request whose Origin header matches one
of them is allowed. The value "*" allows any origin, which effectively disables
origin validation.
Note: Envoy's CSRF filter compares the host and port of the origin only, so the
scheme is ignored: "https://www.example.com" and "http://www.example.com" are
equivalent here, and both allow the request regardless of the scheme the client
used. | + + #### CircuitBreaker @@ -920,6 +951,8 @@ _Appears in:_ ClientIPDetectionSettings provides configuration for determining the original client IP address for requests. +Exactly one of XForwardedFor, CustomHeader, or DirectSourceIP must be set. + _Appears in:_ - [ClientTrafficPolicySpec](#clienttrafficpolicyspec) @@ -927,6 +960,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `xForwardedFor` | _[XForwardedForSettings](#xforwardedforsettings)_ | false | | XForwardedForSettings provides configuration for using X-Forwarded-For headers for determining the client IP address. | | `customHeader` | _[CustomHeaderExtensionSettings](#customheaderextensionsettings)_ | false | | CustomHeader provides configuration for determining the client IP address for a request based on
a trusted custom HTTP header. This uses the custom_header original IP detection extension.
Refer to https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/http/original_ip_detection/custom_header/v3/custom_header.proto
for more details. | +| `directSourceIP` | _[DirectSourceIPSettings](#directsourceipsettings)_ | false | | DirectSourceIP configures the geoip filter to use the downstream connection
source address (the TCP peer of the connection terminated by Envoy) as the client IP.
Use this in L4-transparent topologies where a load balancer preserves the original
client source IP at TCP level and does not populate XFF or a custom header — for
example, AWS NLB with target-type=instance + externalTrafficPolicy=Local, or
Azure Standard Load Balancer.
Mutually exclusive with XForwardedFor and CustomHeader. | #### ClientIPGeoLocation @@ -1054,6 +1088,7 @@ _Appears in:_ | `certificateHashes` | _string array_ | false | | An optional list of hex-encoded SHA-256 hashes. If specified, Envoy will
verify that the SHA-256 of the DER-encoded presented certificate matches
one of the specified values. | | `subjectAltNames` | _[SubjectAltNames](#subjectaltnames)_ | false | | An optional list of Subject Alternative name matchers. If specified, Envoy
will verify that the Subject Alternative Name of the presented certificate
matches one of the specified matchers | | `crl` | _[CrlContext](#crlcontext)_ | false | | Crl specifies the crl configuration that can be used to validate the client initiating the TLS connection | +| `allowExpiredCertificate` | _boolean_ | false | | AllowExpiredCertificate permits client certificates that have expired
but are otherwise valid (CA chain, signature). When true, Envoy skips
the NotAfter check during client certificate validation.
Defaults to false. | #### ClientValidationModeType @@ -1454,6 +1489,19 @@ _Appears in:_ | `IPv4AndIPv6` | IPv4AndIPv6DNSLookupFamily mean the DNS resolver will perform a lookup for both IPv4 and IPv6 families, and return all resolved
addresses. When this is used, Happy Eyeballs will be enabled for upstream connections.
| +#### DirectSourceIPSettings + + + +DirectSourceIPSettings configures client IP detection from the downstream +connection source address. It currently has no fields; its presence opts the listener +into using the TCP peer address as the client IP. + +_Appears in:_ +- [ClientIPDetectionSettings](#clientipdetectionsettings) + + + #### DynamicModule @@ -1640,6 +1688,7 @@ _Appears in:_ | `envoy.filters.http.health_check` | EnvoyFilterHealthCheck defines the Envoy HTTP health check filter.
| | `envoy.filters.http.fault` | EnvoyFilterFault defines the Envoy HTTP fault filter.
| | `envoy.filters.http.cors` | EnvoyFilterCORS defines the Envoy HTTP CORS filter.
| +| `envoy.filters.http.csrf` | EnvoyFilterCSRF defines the Envoy HTTP CSRF filter.
| | `envoy.filters.http.header_mutation` | EnvoyFilterHeaderMutation defines the Envoy HTTP header mutation filter
| | `envoy.filters.http.ext_authz` | EnvoyFilterExtAuthz defines the Envoy HTTP external authorization filter.
| | `envoy.filters.http.api_key_auth` | EnvoyFilterAPIKeyAuth defines the Envoy HTTP api key authentication filter.
| @@ -1781,8 +1830,63 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | -| `type` | _[InfrastructureProviderType](#infrastructureprovidertype)_ | true | | Type is the type of infrastructure providers to use. Supported types are "Host". | +| `type` | _[InfrastructureProviderType](#infrastructureprovidertype)_ | true | | Type is the type of infrastructure providers to use. Supported types are "Host" or "Remote". | | `host` | _[EnvoyGatewayHostInfrastructureProvider](#envoygatewayhostinfrastructureprovider)_ | false | | Host defines the configuration of the Host provider. Host provides runtime
deployment of the data plane as a child process on the host environment. | +| `remote` | _[EnvoyGatewayRemoteInfrastructureProvider](#envoygatewayremoteinfrastructureprovider)_ | false | | Remote defines the configuration of the Remote provider. Remotes defers
runtime deployment of the data plane to aW remote infrastructure manager. | + + +#### EnvoyGatewayKubernetesConfiguration + + + +EnvoyGatewayKubernetesConfiguration defines configuration for how Envoy Gateway communicates with the Kubernetes API server. + +_Appears in:_ +- [EnvoyGatewayKubernetesCustomProvider](#envoygatewaykubernetescustomprovider) +- [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) + +| Field | Type | Required | Default | Description | +| --- | --- | --- | --- | --- | +| `watch` | _[KubernetesWatchMode](#kuberneteswatchmode)_ | false | | Watch holds configuration of which input resources should be watched and reconciled. | +| `leaderElection` | _[LeaderElection](#leaderelection)_ | false | | LeaderElection specifies the configuration for leader election.
If it's not set up, leader election will be active by default, using Kubernetes' standard settings. | +| `client` | _[KubernetesClient](#kubernetesclient)_ | true | | Client holds the configuration for the Kubernetes client. | +| `cacheSyncPeriod` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | CacheSyncPeriod determines the minimum frequency at which watched resources are synced.
Note that a sync in the provider layer will not lead to a full reconciliation (including translation),
unless there are actual changes in the provider resources.
This option can be used to protect against missed events or issues in Envoy Gateway where resources
are not requeued when they should be, at the cost of increased resource consumption.
Learn more about the implications of this option: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/cache#Options
Default: 10 hours | + + +#### EnvoyGatewayKubernetesCustomProvider + + + +EnvoyGatewayKubernetesCustomProvider defines configuration for the Kubernetes provider when using a Custom provider. + +_Appears in:_ +- [EnvoyGatewayResourceProvider](#envoygatewayresourceprovider) + +| Field | Type | Required | Default | Description | +| --- | --- | --- | --- | --- | +| `watch` | _[KubernetesWatchMode](#kuberneteswatchmode)_ | false | | Watch holds configuration of which input resources should be watched and reconciled. | +| `leaderElection` | _[LeaderElection](#leaderelection)_ | false | | LeaderElection specifies the configuration for leader election.
If it's not set up, leader election will be active by default, using Kubernetes' standard settings. | +| `client` | _[KubernetesClient](#kubernetesclient)_ | true | | Client holds the configuration for the Kubernetes client. | +| `cacheSyncPeriod` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | CacheSyncPeriod determines the minimum frequency at which watched resources are synced.
Note that a sync in the provider layer will not lead to a full reconciliation (including translation),
unless there are actual changes in the provider resources.
This option can be used to protect against missed events or issues in Envoy Gateway where resources
are not requeued when they should be, at the cost of increased resource consumption.
Learn more about the implications of this option: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/cache#Options
Default: 10 hours | + + +#### EnvoyGatewayKubernetesInfrastructureConfiguration + + + +EnvoyGatewayKubernetesInfrastructureConfiguration defines configuration for the Kubernetes infrastructure provider. + +_Appears in:_ +- [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) + +| Field | Type | Required | Default | Description | +| --- | --- | --- | --- | --- | +| `rateLimitDeployment` | _[KubernetesDeploymentSpec](#kubernetesdeploymentspec)_ | false | | RateLimitDeployment defines the desired state of the Envoy ratelimit deployment resource.
If unspecified, default settings for the managed Envoy ratelimit deployment resource
are applied. | +| `rateLimitHpa` | _[KubernetesHorizontalPodAutoscalerSpec](#kuberneteshorizontalpodautoscalerspec)_ | false | | RateLimitHpa defines the Horizontal Pod Autoscaler settings for Envoy ratelimit Deployment.
If the HPA is set, Replicas field from RateLimitDeployment will be ignored. | +| `rateLimitPDB` | _[KubernetesPodDisruptionBudgetSpec](#kubernetespoddisruptionbudgetspec)_ | false | | RateLimitPDB allows to control the pod disruption budget of rate limit service. | +| `deploy` | _[KubernetesDeployMode](#kubernetesdeploymode)_ | false | | Deploy holds configuration of how output managed resources such as the Envoy Proxy data plane
should be deployed | +| `shutdownManager` | _[ShutdownManager](#shutdownmanager)_ | false | | ShutdownManager defines the configuration for the shutdown manager. | +| `proxyTopologyInjector` | _[EnvoyGatewayTopologyInjector](#envoygatewaytopologyinjector)_ | false | | TopologyInjector defines the configuration for topology injector MutatatingWebhookConfiguration | #### EnvoyGatewayKubernetesProvider @@ -1799,12 +1903,12 @@ _Appears in:_ | `rateLimitDeployment` | _[KubernetesDeploymentSpec](#kubernetesdeploymentspec)_ | false | | RateLimitDeployment defines the desired state of the Envoy ratelimit deployment resource.
If unspecified, default settings for the managed Envoy ratelimit deployment resource
are applied. | | `rateLimitHpa` | _[KubernetesHorizontalPodAutoscalerSpec](#kuberneteshorizontalpodautoscalerspec)_ | false | | RateLimitHpa defines the Horizontal Pod Autoscaler settings for Envoy ratelimit Deployment.
If the HPA is set, Replicas field from RateLimitDeployment will be ignored. | | `rateLimitPDB` | _[KubernetesPodDisruptionBudgetSpec](#kubernetespoddisruptionbudgetspec)_ | false | | RateLimitPDB allows to control the pod disruption budget of rate limit service. | -| `watch` | _[KubernetesWatchMode](#kuberneteswatchmode)_ | false | | Watch holds configuration of which input resources should be watched and reconciled. | | `deploy` | _[KubernetesDeployMode](#kubernetesdeploymode)_ | false | | Deploy holds configuration of how output managed resources such as the Envoy Proxy data plane
should be deployed | -| `leaderElection` | _[LeaderElection](#leaderelection)_ | false | | LeaderElection specifies the configuration for leader election.
If it's not set up, leader election will be active by default, using Kubernetes' standard settings. | | `shutdownManager` | _[ShutdownManager](#shutdownmanager)_ | false | | ShutdownManager defines the configuration for the shutdown manager. | -| `client` | _[KubernetesClient](#kubernetesclient)_ | true | | Client holds the configuration for the Kubernetes client. | | `proxyTopologyInjector` | _[EnvoyGatewayTopologyInjector](#envoygatewaytopologyinjector)_ | false | | TopologyInjector defines the configuration for topology injector MutatatingWebhookConfiguration | +| `watch` | _[KubernetesWatchMode](#kuberneteswatchmode)_ | false | | Watch holds configuration of which input resources should be watched and reconciled. | +| `leaderElection` | _[LeaderElection](#leaderelection)_ | false | | LeaderElection specifies the configuration for leader election.
If it's not set up, leader election will be active by default, using Kubernetes' standard settings. | +| `client` | _[KubernetesClient](#kubernetesclient)_ | true | | Client holds the configuration for the Kubernetes client. | | `cacheSyncPeriod` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | CacheSyncPeriod determines the minimum frequency at which watched resources are synced.
Note that a sync in the provider layer will not lead to a full reconciliation (including translation),
unless there are actual changes in the provider resources.
This option can be used to protect against missed events or issues in Envoy Gateway where resources
are not requeued when they should be, at the cost of increased resource consumption.
Learn more about the implications of this option: https://pkg.go.dev/sigs.k8s.io/controller-runtime/pkg/cache#Options
Default: 10 hours | @@ -1941,6 +2045,20 @@ _Appears in:_ | `custom` | _[EnvoyGatewayCustomProvider](#envoygatewaycustomprovider)_ | false | | Custom defines the configuration for the Custom provider. This provider
allows you to define a specific resource provider and an infrastructure
provider. | +#### EnvoyGatewayRemoteInfrastructureProvider + + + +EnvoyGatewayRemoteInfrastructureProvider defines configuration for the Remote Infrastructure provider. + +_Appears in:_ +- [EnvoyGatewayInfrastructureProvider](#envoygatewayinfrastructureprovider) + +| Field | Type | Required | Default | Description | +| --- | --- | --- | --- | --- | +| `service` | _[ExtensionService](#extensionservice)_ | true | | Service defines the configuration of the remote infrastructure service that the Envoy
Gateway Control Plane will call through the infrastructure manager. | + + #### EnvoyGatewayResourceProvider @@ -1952,8 +2070,9 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | -| `type` | _[ResourceProviderType](#resourceprovidertype)_ | true | | Type is the type of resource provider to use. Supported types are "File". | +| `type` | _[ResourceProviderType](#resourceprovidertype)_ | true | | Type is the type of resource provider to use. Supported types are "File" or "Kubernetes". | | `file` | _[EnvoyGatewayFileResourceProvider](#envoygatewayfileresourceprovider)_ | false | | File defines the configuration of the File provider. File provides runtime
configuration defined by one or more files. | +| `kubernetes` | _[EnvoyGatewayKubernetesCustomProvider](#envoygatewaykubernetescustomprovider)_ | false | | Kubernetes defines the configuration of the Kubernetes provider. This provider retrieves Envoy configuration
from a Kubernetes API. | #### EnvoyGatewaySpec @@ -2006,6 +2125,7 @@ _Appears in:_ EnvoyGatewayTopologyInjector defines the configuration for topology injector MutatatingWebhookConfiguration _Appears in:_ +- [EnvoyGatewayKubernetesInfrastructureConfiguration](#envoygatewaykubernetesinfrastructureconfiguration) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) | Field | Type | Required | Default | Description | @@ -2189,7 +2309,7 @@ _Appears in:_ | `envoyDeployment` | _[KubernetesDeploymentSpec](#kubernetesdeploymentspec)_ | false | | EnvoyDeployment defines the desired state of the Envoy deployment resource.
If unspecified, default settings for the managed Envoy deployment resource
are applied. | | `envoyDaemonSet` | _[KubernetesDaemonSetSpec](#kubernetesdaemonsetspec)_ | false | | EnvoyDaemonSet defines the desired state of the Envoy daemonset resource.
Disabled by default, a deployment resource is used instead to provision the Envoy Proxy fleet | | `envoyService` | _[KubernetesServiceSpec](#kubernetesservicespec)_ | false | | EnvoyService defines the desired state of the Envoy service resource.
If unspecified, default settings for the managed Envoy service resource
are applied. | -| `envoyHpa` | _[KubernetesHorizontalPodAutoscalerSpec](#kuberneteshorizontalpodautoscalerspec)_ | false | | EnvoyHpa defines the Horizontal Pod Autoscaler settings for Envoy Proxy Deployment. | +| `envoyHpa` | _[KubernetesHorizontalPodAutoscalerSpec](#kuberneteshorizontalpodautoscalerspec)_ | false | | EnvoyHpa defines the Horizontal Pod Autoscaler settings for Envoy Proxy Deployment.
If the HPA is set, the Replicas field from EnvoyDeployment will be ignored, and the
number of replicas is solely managed by the HPA. Use MinReplicas to control the
lower bound of the replica count instead. | | `useListenerPortAsContainerPort` | _boolean_ | false | | UseListenerPortAsContainerPort disables the port shifting feature in the Envoy Proxy.
When set to false (default value), if the service port is a privileged port (1-1023), add a constant to the value converting it into an ephemeral port.
This allows the container to bind to the port without needing a CAP_NET_BIND_SERVICE capability. | | `envoyPDB` | _[KubernetesPodDisruptionBudgetSpec](#kubernetespoddisruptionbudgetspec)_ | false | | EnvoyPDB allows to control the pod disruption budget of an Envoy Proxy. | | `envoyServiceAccount` | _[KubernetesServiceAccountSpec](#kubernetesserviceaccountspec)_ | true | | EnvoyServiceAccount defines the desired state of the Envoy service account resource. | @@ -2206,7 +2326,7 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | -| `type` | _[EnvoyProxyProviderType](#envoyproxyprovidertype)_ | true | | Type is the type of resource provider to use. A resource provider provides
infrastructure resources for running the data plane, e.g. Envoy proxy, and
optional auxiliary control planes. Supported types are "Kubernetes"and "Host". | +| `type` | _[EnvoyProxyProviderType](#envoyproxyprovidertype)_ | true | | Type is the type of resource provider to use. A resource provider provides
infrastructure resources for running the data plane, e.g. Envoy proxy, and
optional auxiliary control planes. Supported types are "Kubernetes" and "Host". | | `kubernetes` | _[EnvoyProxyKubernetesProvider](#envoyproxykubernetesprovider)_ | false | | Kubernetes defines the desired state of the Kubernetes resource provider.
Kubernetes provides infrastructure resources for running the data plane,
e.g. Envoy proxy. If unspecified and type is "Kubernetes", default settings
for managed Kubernetes resources are applied. | | `host` | _[EnvoyProxyHostProvider](#envoyproxyhostprovider)_ | false | | Host provides runtime deployment of the data plane as a child process on the
host environment.
If unspecified and type is "Host", default settings for the custom provider
are applied. | @@ -2246,7 +2366,8 @@ _Appears in:_ | `concurrency` | _integer_ | false | | Concurrency defines the number of worker threads to run. If unset, it defaults to
the number of cpuset threads on the platform. | | `routingType` | _[RoutingType](#routingtype)_ | false | | RoutingType can be set to "Service" to use the Service Cluster IP for routing to the backend,
or it can be set to "Endpoint" to use Endpoint routing. The default is "Endpoint". | | `extraArgs` | _string array_ | false | | ExtraArgs defines additional command line options that are provided to Envoy.
More info: https://www.envoyproxy.io/docs/envoy/latest/operations/cli#command-line-options
Note: some command line options are used internally(e.g. --log-level) so they cannot be provided here. | -| `mergeGateways` | _boolean_ | false | | MergeGateways defines if Gateway resources should be merged onto the same Envoy Proxy Infrastructure.
Setting this field to true would merge all Gateway Listeners under the parent Gateway Class.
This means that the port, protocol and hostname tuple must be unique for every listener.
If a duplicate listener is detected, the newer listener (based on timestamp) will be rejected and its status will be updated with a "Accepted=False" condition. | +| `mergeGateways` | _boolean_ | false | | MergeGateways defines if Gateway resources should be merged onto the same Envoy Proxy Infrastructure.
Setting this field to true would merge all Gateway Listeners under the parent Gateway Class.
This means that the port, protocol and hostname tuple must be unique for every listener.
If a duplicate listener is detected, the newer listener (based on timestamp) will be rejected and its status will be updated with a "Accepted=False" condition.
Mutually exclusive with MergeBackends. | +| `mergeBackends` | _[MergeBackendsConfig](#mergebackendsconfig)_ | false | | MergeBackends configures cluster deduplication: routes that reference the same backend
share a single Envoy cluster instead of Envoy Gateway generating one cluster per route
rule. This reduces xDS size, active health-check traffic, and stats cardinality, and
improves upstream connection pooling.
Disabled when unset; specifying this field at all (even without further configuration)
enables it. Mutually exclusive with MergeGateways. | | `shutdown` | _[ShutdownConfig](#shutdownconfig)_ | false | | Shutdown defines configuration for graceful envoy shutdown process. | | `filterOrder` | _[FilterPosition](#filterposition) array_ | false | | FilterOrder defines the order of filters in the Envoy proxy's HTTP filter chain.
The FilterPosition in the list will be applied in the order they are defined.
If unspecified, the default filter order is applied.
Default filter order is:
- envoy.filters.http.custom_response
- envoy.filters.http.health_check
- envoy.filters.http.fault
- envoy.filters.http.cors
- envoy.filters.http.header_mutation
- envoy.filters.http.ext_authz
- envoy.filters.http.api_key_auth
- envoy.filters.http.basic_auth
- envoy.filters.http.oauth2
- envoy.filters.http.jwt_authn
- envoy.filters.http.stateful_session
- envoy.filters.http.buffer
- envoy.filters.http.lua
- envoy.filters.http.ext_proc
- envoy.filters.http.wasm
- envoy.filters.http.dynamic_modules
- envoy.filters.http.geoip
- envoy.filters.http.rbac
- envoy.filters.http.local_ratelimit
- envoy.filters.http.ratelimit
- envoy.filters.http.bandwidth_limit
- envoy.filters.http.grpc_web
- envoy.filters.http.grpc_stats
- envoy.filters.http.credential_injector
- envoy.filters.http.compressor
- envoy.filters.http.dynamic_forward_proxy
- envoy.filters.http.router
Note: "envoy.filters.http.router" cannot be reordered, it's always the last filter in the chain. | | `backendTLS` | _[BackendTLSConfig](#backendtlsconfig)_ | false | | BackendTLS is the TLS configuration for the Envoy proxy to use when connecting to backends.
These settings are applied on backends for which TLS policies are specified. | @@ -2329,7 +2450,9 @@ _Appears in:_ | `messageTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | MessageTimeout is the timeout for a response to be returned from the external processor
Default: 200ms | | `failOpen` | _boolean_ | false | false | FailOpen is a switch used to control the behavior when failing to call the external processor.
If FailOpen is set to true, the system bypasses the ExtProc extension and
allows the traffic to pass through. If it is set to false or
not set (defaulting to false), the system blocks the traffic and returns
an HTTP 5xx error.
If set to true, the ExtProc extension will also be bypassed if the configuration is invalid. | | `processingMode` | _[ExtProcProcessingMode](#extprocprocessingmode)_ | false | | ProcessingMode defines how request and response body is processed
Default: header and body are not sent to the external processor | +| `shadowMode` | _boolean_ | false | | ShadowMode sets if envoy gateway should treat this external processor as "send and go".
When enabled, Envoy forwards request/response data to the external processor but does
not wait for or apply any response from it. This maps to Envoy's `observability_mode`
on the ext_proc filter.
Defaults to false. | | `metadata` | _[ExtProcMetadata](#extprocmetadata)_ | false | | Refer to Kubernetes API documentation for fields of `metadata`. | +| `statusOnError` | _integer_ | false | | Sets the HTTP status that is returned to the client when the external processor returns an error
or cannot be reached. Defaults to 500 Internal Server Error.
Only 4xx and 5xx status codes are supported. | #### ExtProcBodyProcessingMode @@ -2445,6 +2568,7 @@ _Appears in:_ ExtensionService defines the configuration for connecting to a registered extension service. _Appears in:_ +- [EnvoyGatewayRemoteInfrastructureProvider](#envoygatewayremoteinfrastructureprovider) - [ExtensionManager](#extensionmanager) | Field | Type | Required | Default | Description | @@ -3045,7 +3169,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `contentType` | _string_ | false | | Content Type of the direct response. This will be set in the Content-Type header. | | `body` | _[CustomResponseBody](#customresponsebody)_ | false | | Body of the direct response.
Supports Envoy command operators for dynamic content (see https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators). | -| `statusCode` | _integer_ | false | | Status Code of the HTTP response
If unset, defaults to 200. | +| `statusCode` | _integer_ | false | | Status Code of the HTTP response
If unset, defaults to 200.
Note: when this filter is referenced from a GRPCRoute, a 2xx status code
(including the default 200) is rejected; a non-2xx status code must be set. | | `header` | _[HTTPHeaderFilter](#httpheaderfilter)_ | false | | Header defines the headers of the direct response. | @@ -3104,6 +3228,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `type` | _[HTTPHostnameModifierType](#httphostnamemodifiertype)_ | true | | | | `header` | _string_ | false | | Header is the name of the header whose value would be used to rewrite the Host header | +| `pathRegex` | _[HostnamePathRegexRewrite](#hostnamepathregexrewrite)_ | false | | PathRegex defines a regex match and substitution applied to the request path to compute
the rewritten Host header.
For example, with:
pathRegex:
pattern: "^/tenant/([a-z0-9-]+)/.*"
substitution: "\\1.example.internal"
a request to "http://foo.bar.com/tenant/tenant1/api/v1" has its upstream Host header rewritten
to "tenant1.example.internal" (the request path "/tenant/tenant1/api/v1" is preserved). | #### HTTPHostnameModifierType @@ -3119,6 +3244,7 @@ _Appears in:_ | ----- | ----------- | | `Header` | HeaderHTTPHostnameModifier indicates that the Host header value would be replaced with the value of the header specified in header.
https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-host-rewrite-header
| | `Backend` | BackendHTTPHostnameModifier indicates that the Host header value would be replaced by the DNS name of the backend if it exists.
https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-auto-host-rewrite
| +| `PathRegex` | PathRegexHTTPHostnameModifier indicates that the Host header value would be rewritten by applying a regex
match and substitution to the request path.
https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-host-rewrite-path-regex
| #### HTTPPathModifier @@ -3179,7 +3305,7 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `urlRewrite` | _[HTTPURLRewriteFilter](#httpurlrewritefilter)_ | false | | | -| `directResponse` | _[HTTPDirectResponseFilter](#httpdirectresponsefilter)_ | false | | | +| `directResponse` | _[HTTPDirectResponseFilter](#httpdirectresponsefilter)_ | false | | DirectResponse returns a fixed response for matching requests.
When this filter is referenced from a GRPCRoute, only a non-2xx status code
is supported. gRPC signals success with a grpc-status trailer and a response
message, which a direct response cannot produce, so a 2xx status code (which
maps to the gRPC OK status) yields an invalid response for gRPC clients. Use a
non-2xx status code to deny or block gRPC requests (e.g. 403 maps to
PERMISSION_DENIED, 404 to UNIMPLEMENTED, 429/503 to UNAVAILABLE). | | `credentialInjection` | _[HTTPCredentialInjectionFilter](#httpcredentialinjectionfilter)_ | false | | | | `matches` | _[HTTPRouteMatchFilter](#httproutematchfilter) array_ | false | | Matches defines additional matching criteria for the HTTPRoute rule.
As with HTTPRouteRule.Matches, the rule is matched if any one match applies.
When both HTTPRouteRule.Matches and HTTPRouteFilter.Matches are set, the
effective matching is the logical AND of the two sets. | @@ -3344,6 +3470,7 @@ _Appears in:_ | `requestID` | _[RequestIDAction](#requestidaction)_ | false | | RequestID configures Envoy's behavior for handling the `X-Request-ID` header.
When omitted default behavior is `Generate` which builds the `X-Request-ID` for every request
and ignores pre-existing values from the edge.
(An "edge request" refers to a request from an external client to the Envoy entrypoint.) | | `earlyRequestHeaders` | _[HTTPHeaderFilter](#httpheaderfilter)_ | false | | EarlyRequestHeaders defines settings for early request header modification, before envoy performs
routing, tracing and built-in header manipulation. | | `lateResponseHeaders` | _[HTTPHeaderFilter](#httpheaderfilter)_ | false | | LateResponseHeaders defines settings for global response header modification. | +| `host` | _[HostSettings](#hostsettings)_ | false | | Host enables managing how the Host/Authority header set by clients can be normalized. | #### HealthCheck @@ -3393,6 +3520,36 @@ _Appears in:_ | `path` | _string_ | true | | Path specifies the HTTP path to match on for health check requests. | +#### HostSettings + + + +HostSettings provides settings that manage how the incoming Host/Authority header +set by clients is normalized. + +_Appears in:_ +- [HeaderSettings](#headersettings) + +| Field | Type | Required | Default | Description | +| --- | --- | --- | --- | --- | +| `stripTrailingHostDot` | _boolean_ | false | | StripTrailingHostDot determines if the trailing dot of the host should be removed
from the Host/Authority header before any processing of the request.
This affects the upstream host header as well. Without this option, incoming requests
with host "example.com." will not match routes with domains set to "example.com".
When the host includes a port (for example "example.com.:443"), only the trailing dot
from the host section is stripped, leaving the port as-is ("example.com:443").
Defaults to false. | + + +#### HostnamePathRegexRewrite + + + +HostnamePathRegexRewrite defines a hostname rewrite computed from the request path using regex. + +_Appears in:_ +- [HTTPHostnameModifier](#httphostnamemodifier) + +| Field | Type | Required | Default | Description | +| --- | --- | --- | --- | --- | +| `pattern` | _string_ | true | | Pattern matches a regular expression against the value of the HTTP Path. The regex string must
adhere to the syntax documented in https://github.com/google/re2/wiki/Syntax. | +| `substitution` | _string_ | true | | Substitution is an expression that replaces the matched portion. The expression may include numbered
capture groups that adhere to syntax documented in https://github.com/google/re2/wiki/Syntax.
The resulting value is used as the upstream Host header and should be constrained to a valid
DNS hostname by using explicit regex capture groups in Pattern.
The NUL, CR, and LF characters are not allowed: they are invalid in an HTTP header value and are
rejected by the Envoy proto (well_known_regex HTTP_HEADER_VALUE), which would otherwise cause the
generated configuration to be rejected by the data plane. | + + #### IPEndpoint @@ -3470,6 +3627,7 @@ _Appears in:_ | Value | Description | | ----- | ----------- | | `Host` | InfrastructureProviderTypeHost defines the "Host" provider.
| +| `Remote` | InfrastructureProviderTypeRemote defines the "Remote" provider.
| #### InjectedCredential @@ -3543,7 +3701,8 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | -| `optional` | _boolean_ | true | | Optional determines whether a missing JWT is acceptable, defaulting to false if not specified.
Note: Even if optional is set to true, JWT authentication will still fail if an invalid JWT is presented. | +| `optional` | _boolean_ | false | | Optional determines whether a missing JWT is acceptable, defaulting to false if not specified.
Note: Even if optional is set to true, JWT authentication will still fail if an invalid JWT
is presented. See FailOpen if this is necessary for your use case. | +| `failOpen` | _boolean_ | false | | FailOpen lets a request pass JWT authentication even when its JWT is
missing or invalid, rather than being rejected. This helps when a header
that clients use to carry a JWT may also legitimately hold a non-JWT value
that the backend relies on.
A valid JWT is still verified and its claims forwarded as usual; only the
rejection of requests with a missing or invalid JWT is relaxed. Because this
does not enforce authentication on its own, pair it with an Authorization
policy when access needs to be restricted.
This is broader than Optional (which tolerates a missing JWT but still
rejects an invalid one) and takes precedence over it. | | `providers` | _[JWTProvider](#jwtprovider) array_ | true | | Providers defines the JSON Web Token (JWT) authentication provider type.
When multiple JWT providers are specified, the JWT is considered valid if
any of the providers successfully validate the JWT. For additional details,
see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/jwt_authn_filter.html. | @@ -3668,6 +3827,8 @@ _Appears in:_ _Appears in:_ +- [EnvoyGatewayKubernetesConfiguration](#envoygatewaykubernetesconfiguration) +- [EnvoyGatewayKubernetesCustomProvider](#envoygatewaykubernetescustomprovider) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) | Field | Type | Required | Default | Description | @@ -3736,6 +3897,7 @@ KubernetesDeployMode holds configuration for how to deploy managed resources suc data plane fleet. _Appears in:_ +- [EnvoyGatewayKubernetesInfrastructureConfiguration](#envoygatewaykubernetesinfrastructureconfiguration) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) | Field | Type | Required | Default | Description | @@ -3765,6 +3927,7 @@ _Appears in:_ KubernetesDeploymentSpec defines the desired state of the Kubernetes deployment resource. _Appears in:_ +- [EnvoyGatewayKubernetesInfrastructureConfiguration](#envoygatewaykubernetesinfrastructureconfiguration) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) - [EnvoyProxyKubernetesProvider](#envoyproxykubernetesprovider) @@ -3789,6 +3952,7 @@ Envoy Gateway will revert back to this value every time reconciliation occurs. See k8s.io.autoscaling.v2.HorizontalPodAutoScalerSpec. _Appears in:_ +- [EnvoyGatewayKubernetesInfrastructureConfiguration](#envoygatewaykubernetesinfrastructureconfiguration) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) - [EnvoyProxyKubernetesProvider](#envoyproxykubernetesprovider) @@ -3830,6 +3994,7 @@ _Appears in:_ KubernetesPodDisruptionBudgetSpec defines Kubernetes PodDisruptionBudget settings of Envoy Proxy Deployment. _Appears in:_ +- [EnvoyGatewayKubernetesInfrastructureConfiguration](#envoygatewaykubernetesinfrastructureconfiguration) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) - [EnvoyProxyKubernetesProvider](#envoyproxykubernetesprovider) @@ -3909,6 +4074,8 @@ _Appears in:_ KubernetesWatchMode holds the configuration for which input resources to watch and reconcile. _Appears in:_ +- [EnvoyGatewayKubernetesConfiguration](#envoygatewaykubernetesconfiguration) +- [EnvoyGatewayKubernetesCustomProvider](#envoygatewaykubernetescustomprovider) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) | Field | Type | Required | Default | Description | @@ -3936,6 +4103,8 @@ _Appears in:_ LeaderElection defines the desired leader election settings. _Appears in:_ +- [EnvoyGatewayKubernetesConfiguration](#envoygatewaykubernetesconfiguration) +- [EnvoyGatewayKubernetesCustomProvider](#envoygatewaykubernetescustomprovider) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) | Field | Type | Required | Default | Description | @@ -4121,6 +4290,8 @@ _Appears in:_ | `info` | LogLevelInfo defines the "Info" logging level.
| | `warn` | LogLevelWarn defines the "Warn" logging level.
| | `error` | LogLevelError defines the "Error" logging level.
| +| `off` | LogLevelOff disables logging.
| +| `critical` | LogLevelCritical defines the "critical" logging level.
| #### Lua @@ -4172,6 +4343,19 @@ _Appears in:_ | `ValueRef` | LuaValueTypeValueRef defines the "ValueRef" Lua type.
| +#### MergeBackendsConfig + + + +MergeBackendsConfig configures backend cluster deduplication (MergeBackends). Its mere +presence on EnvoyProxySpec enables it; a backendRef is only merged into a shared cluster when +safe to do so, otherwise it falls back to a dedicated per-route cluster. + +_Appears in:_ +- [EnvoyProxySpec](#envoyproxyspec) + + + #### MergeType _Underlying type:_ _string_ @@ -4245,6 +4429,7 @@ _Appears in:_ | `denyRedirect` | _[OIDCDenyRedirect](#oidcdenyredirect)_ | false | | Any request that matches any of the provided matchers (with either tokens that are expired or missing tokens) will not be redirected to the OIDC Provider.
This behavior can be useful for AJAX or machine requests. | | `logoutPath` | _string_ | true | | The path to log a user out, clearing their credential cookies.
If not specified, uses a default logout path "/logout" | | `forwardAccessToken` | _boolean_ | false | | ForwardAccessToken indicates whether the Envoy should forward the access token
via the Authorization header Bearer scheme to the upstream.
If not specified, defaults to false. | +| `forwardIDToken` | _[OIDCTokenForwarding](#oidctokenforwarding)_ | false | | ForwardIDToken configures forwarding of the OIDC ID token to the upstream.
If the configured header is "Authorization", EG forwards the ID token using
the "Bearer " prefix. For any other header, EG forwards the raw token value.
If not specified, the ID token will not be forwarded.
Note: when passThroughAuthHeader is enabled, this header must not be the same
as a header a JWT provider extracts from (the "Authorization" header by
default). The forwarded ID token header is owned by Envoy, and Envoy rejects
an OAuth2 configuration whose pass-through matcher keys on it. | | `defaultTokenTTL` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | DefaultTokenTTL is the default lifetime of the id token and access token.
Please note that Envoy will always use the expiry time from the response
of the authorization server if it is provided. This field is only used when
the expiry time is not provided by the authorization.
If not specified, defaults to 0. In this case, the "expires_in" field in
the authorization response must be set by the authorization server, or the
OAuth flow will fail. | | `refreshToken` | _boolean_ | false | true | RefreshToken indicates whether the Envoy should automatically refresh the
id token and access token when they expire.
When set to true, the Envoy will use the refresh token to get a new id token
and access token when they expire.
If not specified, defaults to true. | | `defaultRefreshTokenTTL` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | DefaultRefreshTokenTTL is the default lifetime of the refresh token.
This field is only used when the exp (expiration time) claim is omitted in
the refresh token or the refresh token is not JWT.
If not specified, defaults to 604800s (one week).
Note: this field is only applicable when the "refreshToken" field is set to true. | @@ -4351,7 +4536,7 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | -| `header` | _string_ | true | | Header is the upstream request header that will carry the ID token. | +| `header` | _string_ | true | | Header is the upstream request header that will carry the ID token.
It must be a valid HTTP header name. Pseudo-headers (names starting with ":")
and the "Host" header are not allowed. | #### OTelSampler @@ -4459,9 +4644,12 @@ For example, the following are valid origins: - http://foo.example.com:8080 - http://*.example.com:8080 - https://* +- moz-extension://example.com +- foo://*.example.com:8080 _Appears in:_ - [CORS](#cors) +- [CSRF](#csrf) @@ -4481,6 +4669,23 @@ _Appears in:_ | `value` | _string_ | true | | Value specifies the string value that the match must have. | +#### OutOfBandReporting + + + +OutOfBandReporting configures out-of-band ORCA load reporting for the +BackendUtilization load balancer. + +_Appears in:_ +- [BackendUtilization](#backendutilization) + +| Field | Type | Required | Default | Description | +| --- | --- | --- | --- | --- | +| `reportingPeriod` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ReportingPeriod is how often Envoy requests load reports from the server.
Must be greater than 0. Defaults to 10s. | +| `port` | _integer_ | false | | Port overrides the port used for the OutOfBand reporting connection, e.g. to
reach a separate reporting sidecar. Defaults to the endpoint's port. | +| `authority` | _string_ | false | | Authority overrides the :authority header on the OutOfBand gRPC stream.
If unset, Envoy uses the endpoint hostname, then the dialed address, then
the cluster name. | + + #### PassiveHealthCheck @@ -4651,7 +4856,7 @@ _Appears in:_ | `clientCIDRs` | _[CIDR](#cidr) array_ | false | | ClientCIDRs are the IP CIDR ranges of the client.
Valid examples are "192.168.1.0/24" or "2001:db8::/64"
If multiple CIDR ranges are specified, one of the CIDR ranges must match
the client IP for the rule to match.
The client IP is inferred from the X-Forwarded-For header, a custom header,
or the proxy protocol.
You can use the `ClientIPDetection` or the `ProxyProtocol` field in
the `ClientTrafficPolicy` to configure how the client IP is detected.
For TCPRoute targets (raw TCP connections), HTTP headers such as
X-Forwarded-For are not available. The client IP is obtained from the
TCP connection's peer address. If intermediaries (load balancers, NAT)
terminate or proxy TCP, the original client IP will only be available
if the intermediary preserves the source address (for example by
enabling the PROXY protocol or avoiding SNAT). Ensure your L4 proxy is
configured to preserve the source IP to enable correct client-IP
matching for TCPRoute targets. | | `jwt` | _[JWTPrincipal](#jwtprincipal)_ | false | | JWT authorize the request based on the JWT claims and scopes.
Note: in order to use JWT claims for authorization, you must configure the
JWT authentication in the same `SecurityPolicy`. | | `headers` | _[AuthorizationHeaderMatch](#authorizationheadermatch) array_ | false | | Headers authorize the request based on user identity extracted from custom headers.
If multiple headers are specified, all headers must match for the rule to match. | -| `clientIPGeoLocations` | _[ClientIPGeoLocation](#clientipgeolocation) array_ | false | | ClientIPGeoLocations authorizes the request based on geolocation metadata derived from the client IP.
This field is supported for HTTPRoute and GRPCRoute authorization.
It is not supported for TCPRoute targets.
If multiple entries are specified, one of the ClientIPGeoLocation entries must match for the rule to match.
The client IP is inferred from the X-Forwarded-For header or a custom header.
You can use the `ClientIPDetection` field in the `ClientTrafficPolicy` to configure the client IP detection. | +| `clientIPGeoLocations` | _[ClientIPGeoLocation](#clientipgeolocation) array_ | false | | ClientIPGeoLocations authorizes the request based on geolocation metadata derived from the client IP.
This field is supported for HTTPRoute and GRPCRoute authorization.
It is not supported for TCPRoute targets.
If multiple entries are specified, one of the ClientIPGeoLocation entries must match for the rule to match.
The client IP is inferred from the X-Forwarded-For header, a custom header, or the
direct downstream connection source address (the TCP peer of the connection terminated by Envoy).
You can use the `ClientIPDetection` field in the `ClientTrafficPolicy` to configure the client IP detection. | #### ProcessingModeOptions @@ -5018,6 +5223,8 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `samplingFraction` | _[Fraction](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#fraction)_ | false | | SamplingFraction represents the fraction of requests that should be
selected for tracing if no prior sampling decision has been made. | +| `clientSamplingFraction` | _[Fraction](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#fraction)_ | false | | ClientSamplingFraction represents the fraction of requests that should be
selected for tracing when requested by the client.
If unspecified, client-forced tracing is disabled by default and users must
set this field to opt in. | +| `overallSamplingFraction` | _[Fraction](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#fraction)_ | false | | OverallSamplingFraction represents the fraction of requests that should be
selected for tracing after all other sampling checks have been applied. | | `customTags` | _object (keys:string, values:[CustomTag](#customtag))_ | false | | CustomTags defines the custom tags to add to each span.
If provider is kubernetes, pod name and namespace are added by default.
Deprecated: Use Tags instead. | | `tags` | _object (keys:string, values:string)_ | false | | Tags defines the custom tags to add to each span.
Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) may be used in the value.
The [format string documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#config-access-log-format-strings) provides more information.
If provider is kubernetes, pod name and namespace are added by default.
Same keys take precedence over CustomTags. | | `spanName` | _[TracingSpanName](#tracingspanname)_ | false | | SpanName defines the name of the span which will be used for tracing.
Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) may be used in the value.
The [format string documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#config-access-log-format-strings) provides more information.
If not set, the span name is provider specific.
e.g. Datadog use `ingress` as the default client span name,
and `router egress` as the server span name. | @@ -5225,7 +5432,8 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | -| `url` | _string_ | true | | URL of the Redis Database.
This can reference a single Redis host or a comma delimited list for Sentinel and Cluster deployments of Redis. | +| `url` | _string_ | false | | URL of the Redis Database.
This can reference a single Redis host or a comma delimited list for Sentinel and Cluster deployments of Redis.
Mutually exclusive with URLRef. | +| `urlRef` | _[RedisURLSource](#redisurlsource)_ | false | | URLRef sources the Redis URL from a Kubernetes Secret key. Use this for GitOps
flows where the Redis endpoint is provisioned by an external controller.
The referenced Secret must exist in the namespace of the Envoy Gateway rate limit
deployment. Mutually exclusive with URL. | | `tls` | _[RedisTLSSettings](#redistlssettings)_ | false | | TLS defines TLS configuration for connecting to redis database. | @@ -5423,6 +5631,20 @@ _Appears in:_ | `certificateRef` | _[SecretObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#secretobjectreference)_ | false | | CertificateRef defines the client certificate reference for TLS connections.
Currently only a Kubernetes Secret of type TLS is supported. | +#### RedisURLSource + + + +RedisURLSource specifies where to source the Redis URL from. + +_Appears in:_ +- [RateLimitRedisSettings](#ratelimitredissettings) + +| Field | Type | Required | Default | Description | +| --- | --- | --- | --- | --- | +| `secretKeyRef` | _[SecretKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#secretkeyselector-v1-core)_ | true | | SecretKeyRef references the Secret and key that hold the Redis URL.
The Secret must be in the same namespace as the Envoy Gateway rate limit deployment.
The reference is always required: optional must not be set to true, otherwise
the rate limit pod could start with an unset REDIS_URL instead of waiting for
the externally provisioned Secret. | + + #### RemoteDynamicModuleSource @@ -5571,6 +5793,7 @@ _Appears in:_ | Value | Description | | ----- | ----------- | | `File` | ResourceProviderTypeFile defines the "File" provider.
| +| `Kubernetes` | ResourceProviderTypeKubernetes defines the "Kubernetes" provider.
| #### ResponseOverride @@ -5724,6 +5947,8 @@ _Appears in:_ | Value | Description | | ----- | ----------- | | `XDSNameSchemeV2` | XDSNameSchemeV2 indicates that the xds name scheme v2 is used.
* The listener name will be generated using the protocol and port of the listener.
| +| `EndpointSliceIndex` | EndpointSliceIndex indicates that field indexes are used to look up EndpointSlices by backend.
It is enabled by default to reduce CPU usage for EndpointSlice lookups in large clusters.
If the additional controller memory usage for the indexes becomes a concern,
consider disabling this flag.
| +| `PerResourceSystemCASecret` | PerResourceSystemCASecret restores the pre-1.x behavior of emitting one SDS secret per
BackendTLSPolicy or Backend resource that uses WellKnownCACertificates: System, instead
of sharing a single system_ca_certificates secret across all of them.
Disabled by default (i.e. the shared secret is used). Enable this flag to opt out during
upgrades — Envoy must warm the new system_ca_certificates secret before clusters can use
it, which may cause a brief disruption to new connections on first enable.
| #### RuntimeFlags @@ -5800,7 +6025,7 @@ Gateway. SecurityPolicySpec defines the desired state of SecurityPolicy. -NOTE: SecurityPolicy can target Gateway, HTTPRoute, GRPCRoute, and TCPRoute. +NOTE: SecurityPolicy can target Gateway, ListenerSet, HTTPRoute, GRPCRoute, and TCPRoute. When a SecurityPolicy targets a TCPRoute, only client-IP CIDR based authorization (Authorization rules that use Principal.ClientCIDRs) is applied. Other authentication/authorization features such as JWT, API Key, Basic Auth, @@ -5815,9 +6040,10 @@ _Appears in:_ | `targetRef` | _[LocalPolicyTargetReferenceWithSectionName](#localpolicytargetreferencewithsectionname)_ | true | | TargetRef is the name of the resource this policy is being attached to.
This policy and the TargetRef MUST be in the same namespace for this
Policy to have effect
Deprecated: use targetRefs/targetSelectors instead | | `targetRefs` | _LocalPolicyTargetReferenceWithSectionName array_ | true | | TargetRefs are the names of the Gateway resources this policy
is being attached to. | | `targetSelectors` | _[TargetSelector](#targetselector) array_ | true | | TargetSelectors allow targeting resources for this policy based on labels | -| `mergeType` | _[MergeType](#mergetype)_ | false | | MergeType determines how this configuration is merged with existing SecurityPolicy
configurations targeting a parent resource. When set, this configuration will be merged
into a parent SecurityPolicy (i.e. the one targeting a Gateway or Listener).
This field cannot be set when targeting a parent resource (Gateway).
If unset, no merging occurs, and only the most specific configuration takes effect. | +| `mergeType` | _[MergeType](#mergetype)_ | false | | MergeType determines how this configuration is merged with existing SecurityPolicy
configurations targeting a parent resource. When set, this configuration will be merged
into the closest parent SecurityPolicy in the route's attachment hierarchy (for
example, one targeting a Gateway, Gateway listener, ListenerSet, or ListenerSet
listener).
Currently, this field can only be set when targeting xRoute resources.
If unset, no merging occurs, and only the most specific configuration takes effect. | | `apiKeyAuth` | _[APIKeyAuth](#apikeyauth)_ | false | | APIKeyAuth defines the configuration for the API Key Authentication. | | `cors` | _[CORS](#cors)_ | false | | CORS defines the configuration for Cross-Origin Resource Sharing (CORS). | +| `csrf` | _[CSRF](#csrf)_ | false | | CSRF defines the configuration for Cross-Site Request Forgery (CSRF) protection.
When enabled, the CSRF filter checks that the Origin header matches the destination
or one of the additional allowed origins on mutating requests (POST, PUT, DELETE, PATCH). | | `basicAuth` | _[BasicAuth](#basicauth)_ | false | | BasicAuth defines the configuration for the HTTP Basic Authentication. | | `jwt` | _[JWT](#jwt)_ | false | | JWT defines the configuration for JSON Web Token (JWT) authentication. | | `oidc` | _[OIDC](#oidc)_ | false | | OIDC defines the configuration for the OpenID Connect (OIDC) authentication. | @@ -5909,6 +6135,7 @@ _Appears in:_ ShutdownManager defines the configuration for the shutdown manager. _Appears in:_ +- [EnvoyGatewayKubernetesInfrastructureConfiguration](#envoygatewaykubernetesinfrastructureconfiguration) - [EnvoyGatewayKubernetesProvider](#envoygatewaykubernetesprovider) | Field | Type | Required | Default | Description | @@ -6315,6 +6542,8 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `samplingFraction` | _[Fraction](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#fraction)_ | false | | SamplingFraction represents the fraction of requests that should be
selected for tracing if no prior sampling decision has been made. | +| `clientSamplingFraction` | _[Fraction](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#fraction)_ | false | | ClientSamplingFraction represents the fraction of requests that should be
selected for tracing when requested by the client.
If unspecified, client-forced tracing is disabled by default and users must
set this field to opt in. | +| `overallSamplingFraction` | _[Fraction](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#fraction)_ | false | | OverallSamplingFraction represents the fraction of requests that should be
selected for tracing after all other sampling checks have been applied. | | `customTags` | _object (keys:string, values:[CustomTag](#customtag))_ | false | | CustomTags defines the custom tags to add to each span.
If provider is kubernetes, pod name and namespace are added by default.
Deprecated: Use Tags instead. | | `tags` | _object (keys:string, values:string)_ | false | | Tags defines the custom tags to add to each span.
Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) may be used in the value.
The [format string documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#config-access-log-format-strings) provides more information.
If provider is kubernetes, pod name and namespace are added by default.
Same keys take precedence over CustomTags. | | `spanName` | _[TracingSpanName](#tracingspanname)_ | false | | SpanName defines the name of the span which will be used for tracing.
Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) may be used in the value.
The [format string documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#config-access-log-format-strings) provides more information.
If not set, the span name is provider specific.
e.g. Datadog use `ingress` as the default client span name,
and `router egress` as the server span name. | @@ -6563,6 +6792,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `maxConnectionAge` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | MaxConnectionAge is the maximum age of an active connection before Envoy Gateway will initiate a graceful close.
If unspecified, Envoy Gateway randomly selects a value between 10h and 12h to stagger reconnects across replicas. | | `maxConnectionAgeGrace` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | MaxConnectionAgeGrace is the grace period granted after reaching MaxConnectionAge before the connection is forcibly closed.
The default grace period is 2m. | +| `maxReceiveMessageSize` | _[Quantity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#quantity-resource-api)_ | false | | MaxReceiveMessageSize defines the maximum size of a single xDS message that the xDS gRPC
server will accept from an Envoy proxy.
Envoy's requests grow with the number of resources it holds: on every stream (re)connect,
the first delta xDS request for each resource type echoes back the name and version of
every resource the proxy currently has. At a large enough scale this exceeds the 4MiB
default, and the stream fails immediately with "received message larger than max", leaving
the proxy stuck on its last known-good configuration.
Note this limit applies only to what Envoy Gateway receives; the configuration it sends to
Envoy is not bounded by it.
If unspecified, defaults to 32MiB. | #### XDSTranslatorHook