diff --git a/api/v1alpha1/timeout_types.go b/api/v1alpha1/timeout_types.go index 66243d4b30..f1c664e38d 100644 --- a/api/v1alpha1/timeout_types.go +++ b/api/v1alpha1/timeout_types.go @@ -81,6 +81,21 @@ type TCPClientTimeout struct { // // +optional IdleTimeout *gwapiv1.Duration `json:"idleTimeout,omitempty"` + + // TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + // (e.g. the TLS handshake) after a connection is accepted. + // If this expires before the transport reports connection establishment, the connection is summarily closed. + // + // +optional + TLSHandshakeTimeout *gwapiv1.Duration `json:"tlsHandshakeTimeout,omitempty"` + + // ConnectionInspectionTimeout is the maximum time to wait for initial inspection + // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection on the listener socket. + // If exceeded, the connection is dropped. + // Default: 15 seconds. + // + // +optional + ConnectionInspectionTimeout *gwapiv1.Duration `json:"connectionInspectionTimeout,omitempty"` } type HTTPClientTimeout struct { @@ -90,6 +105,14 @@ type HTTPClientTimeout struct { // +optional RequestReceivedTimeout *gwapiv1.Duration `json:"requestReceivedTimeout,omitempty"` + // RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. + // The timer is activated when the first byte of the headers is received, + // and is disarmed when the last byte of the headers has been received. + // If not specified or set to 0, this timeout is disabled. + // + // +optional + RequestHeadersReceivedTimeout *gwapiv1.Duration `json:"requestHeadersReceivedTimeout,omitempty"` + // IdleTimeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection. // Default: 1 hour. // diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index 7730ebed2b..45d90c8b42 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -4461,6 +4461,11 @@ func (in *HTTPClientTimeout) DeepCopyInto(out *HTTPClientTimeout) { *out = new(v1.Duration) **out = **in } + if in.RequestHeadersReceivedTimeout != nil { + in, out := &in.RequestHeadersReceivedTimeout, &out.RequestHeadersReceivedTimeout + *out = new(v1.Duration) + **out = **in + } if in.IdleTimeout != nil { in, out := &in.IdleTimeout, &out.IdleTimeout *out = new(v1.Duration) @@ -8517,6 +8522,16 @@ func (in *TCPClientTimeout) DeepCopyInto(out *TCPClientTimeout) { *out = new(v1.Duration) **out = **in } + if in.TLSHandshakeTimeout != nil { + in, out := &in.TLSHandshakeTimeout, &out.TLSHandshakeTimeout + *out = new(v1.Duration) + **out = **in + } + if in.ConnectionInspectionTimeout != nil { + in, out := &in.ConnectionInspectionTimeout, &out.ConnectionInspectionTimeout + *out = new(v1.Duration) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPClientTimeout. diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index b873c582aa..cb9970a8d0 100644 --- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1336,6 +1336,14 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + requestHeadersReceivedTimeout: + description: |- + RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. + The timer is activated when the first byte of the headers is received, + and is disarmed when the last byte of the headers has been received. + If not specified or set to 0, this timeout is disabled. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string requestReceivedTimeout: description: |- RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request @@ -1352,6 +1360,14 @@ spec: tcp: description: Timeout settings for TCP. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection on the listener socket. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -1359,6 +1375,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + tlsHandshakeTimeout: + description: |- + TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index 5b73c4161a..cbcd1090cc 100644 --- a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1335,6 +1335,14 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + requestHeadersReceivedTimeout: + description: |- + RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. + The timer is activated when the first byte of the headers is received, + and is disarmed when the last byte of the headers has been received. + If not specified or set to 0, this timeout is disabled. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string requestReceivedTimeout: description: |- RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request @@ -1351,6 +1359,14 @@ spec: tcp: description: Timeout settings for TCP. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection on the listener socket. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -1358,6 +1374,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + tlsHandshakeTimeout: + description: |- + TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/internal/gatewayapi/clienttrafficpolicy.go b/internal/gatewayapi/clienttrafficpolicy.go index 404d398594..560cd025b6 100644 --- a/internal/gatewayapi/clienttrafficpolicy.go +++ b/internal/gatewayapi/clienttrafficpolicy.go @@ -946,6 +946,20 @@ func buildClientTimeout(clientTimeout *egv1a1.ClientTimeout) (*ir.ClientTimeout, } irTCPTimeout.IdleTimeout = ir.MetaV1DurationPtr(d) } + if clientTimeout.TCP.TLSHandshakeTimeout != nil { + d, err := time.ParseDuration(string(*clientTimeout.TCP.TLSHandshakeTimeout)) + if err != nil { + return nil, fmt.Errorf("invalid TCP TLSHandshakeTimeout value %s", *clientTimeout.TCP.TLSHandshakeTimeout) + } + irTCPTimeout.TLSHandshakeTimeout = ir.MetaV1DurationPtr(d) + } + if clientTimeout.TCP.ConnectionInspectionTimeout != nil { + d, err := time.ParseDuration(string(*clientTimeout.TCP.ConnectionInspectionTimeout)) + if err != nil { + return nil, fmt.Errorf("invalid TCP ConnectionInspectionTimeout value %s", *clientTimeout.TCP.ConnectionInspectionTimeout) + } + irTCPTimeout.ConnectionInspectionTimeout = ir.MetaV1DurationPtr(d) + } irClientTimeout.TCP = irTCPTimeout } @@ -974,6 +988,14 @@ func buildClientTimeout(clientTimeout *egv1a1.ClientTimeout) (*ir.ClientTimeout, } irHTTPTimeout.StreamIdleTimeout = ir.MetaV1DurationPtr(d) } + + if clientTimeout.HTTP.RequestHeadersReceivedTimeout != nil { + d, err := time.ParseDuration(string(*clientTimeout.HTTP.RequestHeadersReceivedTimeout)) + if err != nil { + return nil, fmt.Errorf("invalid HTTP RequestHeadersReceivedTimeout value %s", *clientTimeout.HTTP.RequestHeadersReceivedTimeout) + } + irHTTPTimeout.RequestHeadersReceivedTimeout = ir.MetaV1DurationPtr(d) + } irClientTimeout.HTTP = irHTTPTimeout } diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml index 11ea0bba15..f585270260 100644 --- a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml +++ b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml @@ -11,8 +11,12 @@ clientTrafficPolicies: name: gateway sectionName: http-1 timeout: + tcp: + tlsHandshakeTimeout: "10s" + connectionInspectionTimeout: "60s" http: requestReceivedTimeout: "5s" + requestHeadersReceivedTimeout: "5s" gateways: - apiVersion: gateway.networking.k8s.io/v1 kind: Gateway diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml index 89c4b657b1..54a3d74b1e 100644 --- a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml +++ b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml @@ -12,7 +12,11 @@ clientTrafficPolicies: sectionName: http-1 timeout: http: + requestHeadersReceivedTimeout: 5s requestReceivedTimeout: 5s + tcp: + connectionInspectionTimeout: 60s + tlsHandshakeTimeout: 10s status: ancestors: - ancestorRef: @@ -170,7 +174,11 @@ xdsIR: port: 10080 timeout: http: + requestHeadersReceivedTimeout: 5s requestReceivedTimeout: 5s + tcp: + connectionInspectionTimeout: 1m0s + tlsHandshakeTimeout: 10s - address: 0.0.0.0 externalPort: 8080 hostnames: diff --git a/internal/ir/xds.go b/internal/ir/xds.go index 6d2fecc72d..47f2f124a3 100644 --- a/internal/ir/xds.go +++ b/internal/ir/xds.go @@ -970,6 +970,14 @@ type TCPClientTimeout struct { // IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no // bytes sent or received on either the upstream or downstream connection. IdleTimeout *metav1.Duration `json:"idleTimeout,omitempty" yaml:"idleTimeout,omitempty"` + // TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + // (e.g. the TLS handshake) after a connection is accepted. + // If this expires before the transport reports connection establishment, the connection is summarily closed. + TLSHandshakeTimeout *metav1.Duration `json:"tlsHandshakeTimeout,omitempty" yaml:"tlsHandshakeTimeout,omitempty"` + // ConnectionInspectionTimeout is the maximum time to wait for initial inspection + // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + // If exceeded, the connection is dropped. + ConnectionInspectionTimeout *metav1.Duration `json:"connectionInspectionTimeout,omitempty" yaml:"connectionInspectionTimeout,omitempty"` } // HTTPClientTimeout set the configuration for client HTTP. @@ -978,6 +986,10 @@ type HTTPClientTimeout struct { // The duration envoy waits for the complete request reception. This timer starts upon request // initiation and stops when either the last byte of the request is sent upstream or when the response begins. RequestReceivedTimeout *metav1.Duration `json:"requestReceivedTimeout,omitempty" yaml:"requestReceivedTimeout,omitempty"` + // RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. + // The timer is activated when the first byte of the headers is received, + // and is disarmed when the last byte of the headers has been received. + RequestHeadersReceivedTimeout *metav1.Duration `json:"requestHeadersReceivedTimeout,omitempty" yaml:"requestHeadersReceivedTimeout,omitempty"` // IdleTimeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection. IdleTimeout *metav1.Duration `json:"idleTimeout,omitempty" yaml:"idleTimeout,omitempty"` // The stream idle timeout for connections managed by the connection manager. diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go index d6f990c42c..a04452c8fe 100644 --- a/internal/ir/zz_generated.deepcopy.go +++ b/internal/ir/zz_generated.deepcopy.go @@ -2269,6 +2269,11 @@ func (in *HTTPClientTimeout) DeepCopyInto(out *HTTPClientTimeout) { *out = new(metav1.Duration) **out = **in } + if in.RequestHeadersReceivedTimeout != nil { + in, out := &in.RequestHeadersReceivedTimeout, &out.RequestHeadersReceivedTimeout + *out = new(metav1.Duration) + **out = **in + } if in.IdleTimeout != nil { in, out := &in.IdleTimeout, &out.IdleTimeout *out = new(metav1.Duration) @@ -4683,6 +4688,16 @@ func (in *TCPClientTimeout) DeepCopyInto(out *TCPClientTimeout) { *out = new(metav1.Duration) **out = **in } + if in.TLSHandshakeTimeout != nil { + in, out := &in.TLSHandshakeTimeout, &out.TLSHandshakeTimeout + *out = new(metav1.Duration) + **out = **in + } + if in.ConnectionInspectionTimeout != nil { + in, out := &in.ConnectionInspectionTimeout, &out.ConnectionInspectionTimeout + *out = new(metav1.Duration) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPClientTimeout. diff --git a/internal/xds/translator/listener.go b/internal/xds/translator/listener.go index fbe7bda278..943e3c6d86 100644 --- a/internal/xds/translator/listener.go +++ b/internal/xds/translator/listener.go @@ -214,6 +214,7 @@ func (t *Translator) buildXdsTCPListener( listenerDetails *ir.CoreListenerDetails, keepalive *ir.TCPKeepalive, connection *ir.ClientConnection, + timeout *ir.ClientTimeout, accesslog *ir.AccessLog, ) (*listenerv3.Listener, error) { socketOptions := buildTCPSocketOptions(keepalive) @@ -249,6 +250,10 @@ func (t *Translator) buildXdsTCPListener( socketAddress.Ipv4Compat = true } + if timeout != nil && timeout.TCP != nil && timeout.TCP.ConnectionInspectionTimeout != nil { + listener.ListenerFiltersTimeout = durationpb.New(timeout.TCP.ConnectionInspectionTimeout.Duration) + } + return listener, nil } @@ -440,6 +445,10 @@ func (t *Translator) addHCMToXDSListener( mgr.RequestTimeout = durationpb.New(irListener.Timeout.HTTP.RequestReceivedTimeout.Duration) } + if irListener.Timeout.HTTP.RequestHeadersReceivedTimeout != nil { + mgr.RequestHeadersTimeout = durationpb.New(irListener.Timeout.HTTP.RequestHeadersReceivedTimeout.Duration) + } + if irListener.Timeout.HTTP.IdleTimeout != nil { mgr.CommonHttpProtocolOptions.IdleTimeout = durationpb.New(irListener.Timeout.HTTP.IdleTimeout.Duration) } @@ -508,6 +517,10 @@ func (t *Translator) addHCMToXDSListener( Filters: filters, } + if irListener.Timeout != nil && irListener.Timeout.TCP != nil && irListener.Timeout.TCP.TLSHandshakeTimeout != nil { + filterChain.TransportSocketConnectTimeout = durationpb.New(irListener.Timeout.TCP.TLSHandshakeTimeout.Duration) + } + if irListener.TLS != nil { var tSocket *corev3.TransportSocket @@ -805,10 +818,16 @@ func buildTCPFilterChain( return nil, err } - return &listenerv3.FilterChain{ + filterChain := &listenerv3.FilterChain{ Filters: filters, Name: tlsListenerFilterChainName(irRoute), - }, nil + } + + if timeout != nil && timeout.TCP != nil && timeout.TCP.TLSHandshakeTimeout != nil { + filterChain.TransportSocketConnectTimeout = durationpb.New(timeout.TCP.TLSHandshakeTimeout.Duration) + } + + return filterChain, nil } func buildConnectionLimitFilter(statPrefix string, connection *ir.ClientConnection) *connection_limitv3.ConnectionLimit { diff --git a/internal/xds/translator/testdata/in/xds-ir/client-listener-scoped-timeout.yaml b/internal/xds/translator/testdata/in/xds-ir/client-listener-scoped-timeout.yaml new file mode 100644 index 0000000000..cebeb4c46d --- /dev/null +++ b/internal/xds/translator/testdata/in/xds-ir/client-listener-scoped-timeout.yaml @@ -0,0 +1,44 @@ +http: + - name: "first-listener" + address: "::" + port: 10080 + hostnames: + - "*" + path: + mergeSlashes: true + escapedSlashesAction: UnescapeAndRedirect + routes: + - name: "first-route" + hostname: "*" + destination: + name: "first-route-dest" + settings: + - endpoints: + - host: "1.2.3.4" + port: 50000 + name: "first-route-dest/backend/0" + timeout: + tcp: + connectionInspectionTimeout: "15s" + http: + requestReceivedTimeout: "5s" + idleTimeout: "10s" + - name: "second-listener" + address: "::" + port: 10080 + hostnames: + - "*" + routes: + - name: "second-route" + hostname: "*" + destination: + name: "second-route-dest" + settings: + - endpoints: + - host: "1.2.3.4" + port: 50000 + name: "second-route-dest/backend/0" + timeout: + tcp: + connectionInspectionTimeout: "10s" + idleTimeout: "1200s" diff --git a/internal/xds/translator/testdata/in/xds-ir/client-timeout.yaml b/internal/xds/translator/testdata/in/xds-ir/client-timeout.yaml index 41dec4d635..aa60c07b02 100644 --- a/internal/xds/translator/testdata/in/xds-ir/client-timeout.yaml +++ b/internal/xds/translator/testdata/in/xds-ir/client-timeout.yaml @@ -20,6 +20,30 @@ http: timeout: http: requestReceivedTimeout: "5s" + requestHeadersReceivedTimeout: "15s" + idleTimeout: "10s" + - name: "third-listener" + address: "::" + port: 10080 + hostnames: + - "*" + path: + mergeSlashes: true + escapedSlashesAction: UnescapeAndRedirect + routes: + - name: "third-route" + hostname: "*" + destination: + name: "third-route-dest" + settings: + - endpoints: + - host: "1.2.3.4" + port: 50000 + name: "third-route-dest/backend/0" + timeout: + http: + requestReceivedTimeout: "10s" + requestHeadersReceivedTimeout: "30s" idleTimeout: "10s" tcp: - name: "second-listener" diff --git a/internal/xds/translator/testdata/in/xds-ir/httproute-with-tls-and-tls-handshake-timeout.yaml b/internal/xds/translator/testdata/in/xds-ir/httproute-with-tls-and-tls-handshake-timeout.yaml new file mode 100644 index 0000000000..1d1dfa5c78 --- /dev/null +++ b/internal/xds/translator/testdata/in/xds-ir/httproute-with-tls-and-tls-handshake-timeout.yaml @@ -0,0 +1,69 @@ +http: +- address: 0.0.0.0 + externalPort: 80 + hostnames: + - '*' + metadata: + kind: Gateway + name: gateway-1 + namespace: envoy-gateway + sectionName: http + name: envoy-gateway/gateway-1/http + path: + escapedSlashesAction: UnescapeAndRedirect + mergeSlashes: true + port: 10080 + timeout: + tcp: + tlsHandshakeTimeout: "5s" + routes: + - destination: + metadata: + kind: HTTPRoute + name: httproute-1 + namespace: default + name: httproute/default/httproute-1/rule/0 + settings: + - addressType: IP + endpoints: + - host: 1.1.1.1 + port: 3001 + metadata: + kind: Backend + name: backend-1 + namespace: default + name: httproute/default/httproute-1/rule/0/backend/0 + protocol: HTTP + tls: + alpnProtocols: null + caCertificate: + name: system_ca_certificates + sni: example.com + subjectAltNames: + - uri: spiffe://cluster.local/ns/istio-demo/sa/echo-v1 + - hostname: subdomain.secondexample.com + useSystemTrustStore: true + weight: 1 + - addressType: IP + endpoints: + - host: 7.7.7.7 + port: 8080 + metadata: + kind: Service + name: service-1 + namespace: default + sectionName: "8080" + name: httproute/default/httproute-1/rule/0/backend/1 + protocol: HTTP + weight: 1 + hostname: '*' + isHTTP2: false + metadata: + kind: HTTPRoute + name: httproute-1 + namespace: default + name: httproute/default/httproute-1/rule/0/match/0/* + pathMatch: + distinct: false + name: "" + prefix: / diff --git a/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.clusters.yaml new file mode 100644 index 0000000000..2597993e4b --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.clusters.yaml @@ -0,0 +1,46 @@ +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: first-route-dest + ignoreHealthOnHostRemoval: true + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + name: first-route-dest + perConnectionBufferLimitBytes: 32768 + type: EDS +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: second-route-dest + ignoreHealthOnHostRemoval: true + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + name: second-route-dest + perConnectionBufferLimitBytes: 32768 + type: EDS diff --git a/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.endpoints.yaml new file mode 100644 index 0000000000..de95bf555b --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.endpoints.yaml @@ -0,0 +1,24 @@ +- clusterName: first-route-dest + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 1.2.3.4 + portValue: 50000 + loadBalancingWeight: 1 + loadBalancingWeight: 1 + locality: + region: first-route-dest/backend/0 +- clusterName: second-route-dest + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 1.2.3.4 + portValue: 50000 + loadBalancingWeight: 1 + loadBalancingWeight: 1 + locality: + region: second-route-dest/backend/0 diff --git a/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.listeners.yaml new file mode 100644 index 0000000000..bb855d11b7 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.listeners.yaml @@ -0,0 +1,39 @@ +- address: + socketAddress: + address: '::' + portValue: 10080 + defaultFilterChain: + filters: + - name: envoy.filters.network.http_connection_manager + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + commonHttpProtocolOptions: + headersWithUnderscoresAction: REJECT_REQUEST + idleTimeout: 10s + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + maxConcurrentStreams: 100 + httpFilters: + - name: envoy.filters.http.router + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + suppressEnvoyHeaders: true + mergeSlashes: true + normalizePath: true + pathWithEscapedSlashesAction: UNESCAPE_AND_REDIRECT + rds: + configSource: + ads: {} + initialFetchTimeout: 0s + resourceApiVersion: V3 + routeConfigName: first-listener + requestTimeout: 5s + serverHeaderTransformation: PASS_THROUGH + statPrefix: http-10080 + useRemoteAddress: true + name: first-listener + listenerFiltersTimeout: 15s + maxConnectionsToAcceptPerSocketEvent: 1 + name: first-listener + perConnectionBufferLimitBytes: 32768 diff --git a/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.routes.yaml new file mode 100644 index 0000000000..1dcebeacae --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.routes.yaml @@ -0,0 +1,25 @@ +- ignorePortInHostMatching: true + name: first-listener + virtualHosts: + - domains: + - '*' + name: first-listener/* + routes: + - match: + prefix: / + name: first-route + route: + cluster: first-route-dest + upgradeConfigs: + - upgradeType: websocket + - domains: + - '*' + name: second-listener/* + routes: + - match: + prefix: / + name: second-route + route: + cluster: second-route-dest + upgradeConfigs: + - upgradeType: websocket diff --git a/internal/xds/translator/testdata/out/xds-ir/client-timeout.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/client-timeout.clusters.yaml index 2597993e4b..5eae9bf48b 100644 --- a/internal/xds/translator/testdata/out/xds-ir/client-timeout.clusters.yaml +++ b/internal/xds/translator/testdata/out/xds-ir/client-timeout.clusters.yaml @@ -21,6 +21,29 @@ name: first-route-dest perConnectionBufferLimitBytes: 32768 type: EDS +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: third-route-dest + ignoreHealthOnHostRemoval: true + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + name: third-route-dest + perConnectionBufferLimitBytes: 32768 + type: EDS - circuitBreakers: thresholds: - maxRetries: 1024 diff --git a/internal/xds/translator/testdata/out/xds-ir/client-timeout.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/client-timeout.endpoints.yaml index de95bf555b..4fd71e06bc 100644 --- a/internal/xds/translator/testdata/out/xds-ir/client-timeout.endpoints.yaml +++ b/internal/xds/translator/testdata/out/xds-ir/client-timeout.endpoints.yaml @@ -10,6 +10,18 @@ loadBalancingWeight: 1 locality: region: first-route-dest/backend/0 +- clusterName: third-route-dest + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 1.2.3.4 + portValue: 50000 + loadBalancingWeight: 1 + loadBalancingWeight: 1 + locality: + region: third-route-dest/backend/0 - clusterName: second-route-dest endpoints: - lbEndpoints: diff --git a/internal/xds/translator/testdata/out/xds-ir/client-timeout.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/client-timeout.listeners.yaml index 68152145e6..a9cad7b76e 100644 --- a/internal/xds/translator/testdata/out/xds-ir/client-timeout.listeners.yaml +++ b/internal/xds/translator/testdata/out/xds-ir/client-timeout.listeners.yaml @@ -28,6 +28,7 @@ initialFetchTimeout: 0s resourceApiVersion: V3 routeConfigName: first-listener + requestHeadersTimeout: 15s requestTimeout: 5s serverHeaderTransformation: PASS_THROUGH statPrefix: http-10080 diff --git a/internal/xds/translator/testdata/out/xds-ir/client-timeout.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/client-timeout.routes.yaml index 0b5b4bee7b..1e8d71a7af 100644 --- a/internal/xds/translator/testdata/out/xds-ir/client-timeout.routes.yaml +++ b/internal/xds/translator/testdata/out/xds-ir/client-timeout.routes.yaml @@ -12,3 +12,14 @@ cluster: first-route-dest upgradeConfigs: - upgradeType: websocket + - domains: + - '*' + name: third-listener/* + routes: + - match: + prefix: / + name: third-route + route: + cluster: third-route-dest + upgradeConfigs: + - upgradeType: websocket diff --git a/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.clusters.yaml new file mode 100644 index 0000000000..01323ebea6 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.clusters.yaml @@ -0,0 +1,55 @@ +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: httproute/default/httproute-1/rule/0 + ignoreHealthOnHostRemoval: true + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + metadata: + filterMetadata: + envoy-gateway: + resources: + - kind: HTTPRoute + name: httproute-1 + namespace: default + name: httproute/default/httproute-1/rule/0 + perConnectionBufferLimitBytes: 32768 + transportSocketMatches: + - match: + name: httproute/default/httproute-1/rule/0/tls/0 + name: httproute/default/httproute-1/rule/0/tls/0 + transportSocket: + name: envoy.transport_sockets.tls + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: + combinedValidationContext: + defaultValidationContext: + matchTypedSubjectAltNames: + - matcher: + exact: spiffe://cluster.local/ns/istio-demo/sa/echo-v1 + sanType: URI + - matcher: + exact: subdomain.secondexample.com + sanType: DNS + validationContextSdsSecretConfig: + name: system_ca_certificates + sdsConfig: + ads: {} + initialFetchTimeout: 0s + resourceApiVersion: V3 + sni: example.com + type: EDS diff --git a/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.endpoints.yaml new file mode 100644 index 0000000000..73cc915bf5 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.endpoints.yaml @@ -0,0 +1,41 @@ +- clusterName: httproute/default/httproute-1/rule/0 + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 1.1.1.1 + portValue: 3001 + loadBalancingWeight: 1 + metadata: + filterMetadata: + envoy.transport_socket_match: + name: httproute/default/httproute-1/rule/0/tls/0 + loadBalancingWeight: 1 + locality: + region: httproute/default/httproute-1/rule/0/backend/0 + metadata: + filterMetadata: + envoy-gateway: + resources: + - kind: Backend + name: backend-1 + namespace: default + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 7.7.7.7 + portValue: 8080 + loadBalancingWeight: 1 + loadBalancingWeight: 1 + locality: + region: httproute/default/httproute-1/rule/0/backend/1 + metadata: + filterMetadata: + envoy-gateway: + resources: + - kind: Service + name: service-1 + namespace: default + sectionName: "8080" diff --git a/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.listeners.yaml new file mode 100644 index 0000000000..769bb42e06 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.listeners.yaml @@ -0,0 +1,37 @@ +- address: + socketAddress: + address: 0.0.0.0 + portValue: 10080 + defaultFilterChain: + filters: + - name: envoy.filters.network.http_connection_manager + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + commonHttpProtocolOptions: + headersWithUnderscoresAction: REJECT_REQUEST + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + maxConcurrentStreams: 100 + httpFilters: + - name: envoy.filters.http.router + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + suppressEnvoyHeaders: true + mergeSlashes: true + normalizePath: true + pathWithEscapedSlashesAction: UNESCAPE_AND_REDIRECT + rds: + configSource: + ads: {} + initialFetchTimeout: 0s + resourceApiVersion: V3 + routeConfigName: envoy-gateway/gateway-1/http + serverHeaderTransformation: PASS_THROUGH + statPrefix: http-10080 + useRemoteAddress: true + name: envoy-gateway/gateway-1/http + transportSocketConnectTimeout: 5s + maxConnectionsToAcceptPerSocketEvent: 1 + name: envoy-gateway/gateway-1/http + perConnectionBufferLimitBytes: 32768 diff --git a/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.routes.yaml new file mode 100644 index 0000000000..fd6fc1cacd --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.routes.yaml @@ -0,0 +1,29 @@ +- ignorePortInHostMatching: true + name: envoy-gateway/gateway-1/http + virtualHosts: + - domains: + - '*' + metadata: + filterMetadata: + envoy-gateway: + resources: + - kind: Gateway + name: gateway-1 + namespace: envoy-gateway + sectionName: http + name: envoy-gateway/gateway-1/http/* + routes: + - match: + prefix: / + metadata: + filterMetadata: + envoy-gateway: + resources: + - kind: HTTPRoute + name: httproute-1 + namespace: default + name: httproute/default/httproute-1/rule/0/match/0/* + route: + cluster: httproute/default/httproute-1/rule/0 + upgradeConfigs: + - upgradeType: websocket diff --git a/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.secrets.yaml b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.secrets.yaml new file mode 100644 index 0000000000..b522884fef --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.secrets.yaml @@ -0,0 +1,4 @@ +- name: system_ca_certificates + validationContext: + trustedCa: + filename: /etc/ssl/certs/ca-certificates.crt diff --git a/internal/xds/translator/translator.go b/internal/xds/translator/translator.go index 87f7ba4f9b..4569473e4c 100644 --- a/internal/xds/translator/translator.go +++ b/internal/xds/translator/translator.go @@ -391,6 +391,7 @@ func (t *Translator) processHTTPListenerXdsTranslation( &httpListener.CoreListenerDetails, httpListener.TCPKeepalive, httpListener.Connection, + httpListener.Timeout, accessLog, ); err != nil { errs = errors.Join(errs, err) @@ -846,6 +847,7 @@ func (t *Translator) processTCPListenerXdsTranslation( &tcpListener.CoreListenerDetails, tcpListener.TCPKeepalive, tcpListener.Connection, + tcpListener.Timeout, accesslog, ); err != nil { // skip this listener if failed to build xds listener diff --git a/release-notes/current/new_features/9315-support-more-client-timeout-settings.md b/release-notes/current/new_features/9315-support-more-client-timeout-settings.md new file mode 100644 index 0000000000..8d75c60ab2 --- /dev/null +++ b/release-notes/current/new_features/9315-support-more-client-timeout-settings.md @@ -0,0 +1 @@ +Add support for more client timeout settings. The settings are [`ConnectionInspectionTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener.proto#envoy-v3-api-field-config-listener-v3-listener-listener-filters-timeout), [`RequestHeadersReceivedTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-request-headers-timeout) and [`TLSHandshakeTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener_components.proto.html#envoy-v3-api-field-config-listener-v3-filterchain-transport-socket-connect-timeout) diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index 20d3157df6..5115c98ca5 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -3089,6 +3089,7 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `requestReceivedTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request
initiation and stops when either the last byte of the request is sent upstream or when the response begins. | +| `requestHeadersReceivedTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive.
The timer is activated when the first byte of the headers is received,
and is disarmed when the last byte of the headers has been received.
If not specified or set to 0, this timeout is disabled. | | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
Default: 1 hour. | | `streamIdleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | The stream idle timeout defines the amount of time a stream can exist without any upstream or downstream activity.
Default: 5 minutes. | @@ -6321,6 +6322,8 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no
bytes sent or received on either the upstream or downstream connection.
Default: 1 hour. | +| `tlsHandshakeTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
(e.g. the TLS handshake) after a connection is accepted.
If this expires before the transport reports connection establishment, the connection is summarily closed. | +| `connectionInspectionTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ConnectionInspectionTimeout is the maximum time to wait for initial inspection
(TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection on the listener socket.
If exceeded, the connection is dropped.
Default: 15 seconds. | #### TCPKeepalive diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml index e8ae71f7e4..5cefe156f4 100644 --- a/test/helm/gateway-crds-helm/all.out.yaml +++ b/test/helm/gateway-crds-helm/all.out.yaml @@ -29742,6 +29742,14 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + requestHeadersReceivedTimeout: + description: |- + RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. + The timer is activated when the first byte of the headers is received, + and is disarmed when the last byte of the headers has been received. + If not specified or set to 0, this timeout is disabled. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string requestReceivedTimeout: description: |- RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request @@ -29758,6 +29766,14 @@ spec: tcp: description: Timeout settings for TCP. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection on the listener socket. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -29765,6 +29781,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + tlsHandshakeTimeout: + description: |- + TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/test/helm/gateway-crds-helm/e2e.out.yaml b/test/helm/gateway-crds-helm/e2e.out.yaml index 8d51ce19a8..25daff866b 100644 --- a/test/helm/gateway-crds-helm/e2e.out.yaml +++ b/test/helm/gateway-crds-helm/e2e.out.yaml @@ -5680,6 +5680,14 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + requestHeadersReceivedTimeout: + description: |- + RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. + The timer is activated when the first byte of the headers is received, + and is disarmed when the last byte of the headers has been received. + If not specified or set to 0, this timeout is disabled. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string requestReceivedTimeout: description: |- RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request @@ -5696,6 +5704,14 @@ spec: tcp: description: Timeout settings for TCP. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection on the listener socket. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -5703,6 +5719,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + tlsHandshakeTimeout: + description: |- + TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml index a8dccebf69..9fa651b4d8 100644 --- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml +++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml @@ -5680,6 +5680,14 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + requestHeadersReceivedTimeout: + description: |- + RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. + The timer is activated when the first byte of the headers is received, + and is disarmed when the last byte of the headers has been received. + If not specified or set to 0, this timeout is disabled. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string requestReceivedTimeout: description: |- RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request @@ -5696,6 +5704,14 @@ spec: tcp: description: Timeout settings for TCP. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection on the listener socket. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -5703,6 +5719,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + tlsHandshakeTimeout: + description: |- + TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: