From b49e117b40c8bb89b1acea3c608644736f99ec10 Mon Sep 17 00:00:00 2001 From: kabbohus Date: Tue, 23 Jun 2026 14:58:58 +0200 Subject: [PATCH 01/12] Extend timeout API to include new settings Signed-off-by: kabbohus --- api/v1alpha1/timeout_types.go | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/api/v1alpha1/timeout_types.go b/api/v1alpha1/timeout_types.go index 66243d4b30..d42ece0537 100644 --- a/api/v1alpha1/timeout_types.go +++ b/api/v1alpha1/timeout_types.go @@ -71,6 +71,14 @@ type ClientTimeout struct { // // +optional HTTP *HTTPClientTimeout `json:"http,omitempty"` + + // ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. + // If the timeout is reached, the accepted socket is closed without a connection being created. + // Specify 0 to disable the timeout. + // Default: 15 seconds. + // + // +optional + ListenerFiltersTimeout *gwapiv1.Duration `json:"listenerFiltersTimeout,omitempty"` } // TCPClientTimeout only provides timeout configuration on the listener whose protocol is TCP or TLS. @@ -81,6 +89,13 @@ type TCPClientTimeout struct { // // +optional IdleTimeout *gwapiv1.Duration `json:"idleTimeout,omitempty"` + + // TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. + // If this expires before the transport reports connection establishment, the connection is summarily closed. + // Default: 5 seconds. + // + // +optional + TransportSocketConnectTimeout *gwapiv1.Duration `json:"transportSocketConnectTimeout,omitempty"` } type HTTPClientTimeout struct { @@ -101,4 +116,13 @@ type HTTPClientTimeout struct { // // +optional StreamIdleTimeout *gwapiv1.Duration `json:"streamIdleTimeout,omitempty"` + + // RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + // The timer is activated when the first byte of the headers is received, + // and is disarmed when the last byte of the headers has been received. + // Specify 0 to disable the timeout. + // Default: 10 seconds. + // + // +optional + RequestHeadersTimeout *gwapiv1.Duration `json:"requestHeadersTimeout,omitempty"` } From 4dba375feb6558c7c99c1ade4f01b3b670f93a48 Mon Sep 17 00:00:00 2001 From: kabbohus Date: Tue, 23 Jun 2026 21:11:41 +0200 Subject: [PATCH 02/12] make generate gen-check Signed-off-by: kabbohus --- api/v1alpha1/zz_generated.deepcopy.go | 15 ++++++++++++ ...y.envoyproxy.io_clienttrafficpolicies.yaml | 24 +++++++++++++++++++ ...y.envoyproxy.io_clienttrafficpolicies.yaml | 24 +++++++++++++++++++ site/content/en/latest/api/extension_types.md | 3 +++ test/helm/gateway-crds-helm/all.out.yaml | 24 +++++++++++++++++++ test/helm/gateway-crds-helm/e2e.out.yaml | 24 +++++++++++++++++++ .../envoy-gateway-crds.out.yaml | 24 +++++++++++++++++++ 7 files changed, 138 insertions(+) diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index 7730ebed2b..f59986d820 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -1391,6 +1391,11 @@ func (in *ClientTimeout) DeepCopyInto(out *ClientTimeout) { *out = new(HTTPClientTimeout) (*in).DeepCopyInto(*out) } + if in.ListenerFiltersTimeout != nil { + in, out := &in.ListenerFiltersTimeout, &out.ListenerFiltersTimeout + *out = new(v1.Duration) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClientTimeout. @@ -4471,6 +4476,11 @@ func (in *HTTPClientTimeout) DeepCopyInto(out *HTTPClientTimeout) { *out = new(v1.Duration) **out = **in } + if in.RequestHeadersTimeout != nil { + in, out := &in.RequestHeadersTimeout, &out.RequestHeadersTimeout + *out = new(v1.Duration) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPClientTimeout. @@ -8517,6 +8527,11 @@ func (in *TCPClientTimeout) DeepCopyInto(out *TCPClientTimeout) { *out = new(v1.Duration) **out = **in } + if in.TransportSocketConnectTimeout != nil { + in, out := &in.TransportSocketConnectTimeout, &out.TransportSocketConnectTimeout + *out = new(v1.Duration) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPClientTimeout. diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index b873c582aa..984d1cb9ce 100644 --- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1336,6 +1336,15 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + requestHeadersTimeout: + description: |- + RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + The timer is activated when the first byte of the headers is received, + and is disarmed when the last byte of the headers has been received. + Specify 0 to disable the timeout. + Default: 10 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string requestReceivedTimeout: description: |- RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request @@ -1349,6 +1358,14 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object + listenerFiltersTimeout: + description: |- + ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. + If the timeout is reached, the accepted socket is closed without a connection being created. + Specify 0 to disable the timeout. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string tcp: description: Timeout settings for TCP. properties: @@ -1359,6 +1376,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + transportSocketConnectTimeout: + description: |- + TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index 5b73c4161a..16e4e08e3f 100644 --- a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1335,6 +1335,15 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + requestHeadersTimeout: + description: |- + RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + The timer is activated when the first byte of the headers is received, + and is disarmed when the last byte of the headers has been received. + Specify 0 to disable the timeout. + Default: 10 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string requestReceivedTimeout: description: |- RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request @@ -1348,6 +1357,14 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object + listenerFiltersTimeout: + description: |- + ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. + If the timeout is reached, the accepted socket is closed without a connection being created. + Specify 0 to disable the timeout. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string tcp: description: Timeout settings for TCP. properties: @@ -1358,6 +1375,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + transportSocketConnectTimeout: + description: |- + TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index 20d3157df6..ab7c8368b7 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -980,6 +980,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `tcp` | _[TCPClientTimeout](#tcpclienttimeout)_ | false | | Timeout settings for TCP. | | `http` | _[HTTPClientTimeout](#httpclienttimeout)_ | false | | Timeout settings for HTTP. | +| `listenerFiltersTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation.
If the timeout is reached, the accepted socket is closed without a connection being created.
Specify 0 to disable the timeout.
Default: 15 seconds. | #### ClientTrafficPolicy @@ -3091,6 +3092,7 @@ _Appears in:_ | `requestReceivedTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request
initiation and stops when either the last byte of the request is sent upstream or when the response begins. | | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
Default: 1 hour. | | `streamIdleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | The stream idle timeout defines the amount of time a stream can exist without any upstream or downstream activity.
Default: 5 minutes. | +| `requestHeadersTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestHeadersTimeout is the duration envoy waits for the request headers to arrive.
The timer is activated when the first byte of the headers is received,
and is disarmed when the last byte of the headers has been received.
Specify 0 to disable the timeout.
Default: 10 seconds. | #### HTTPCookieMatch @@ -6321,6 +6323,7 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no
bytes sent or received on either the upstream or downstream connection.
Default: 1 hour. | +| `transportSocketConnectTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations.
If this expires before the transport reports connection establishment, the connection is summarily closed.
Default: 5 seconds. | #### TCPKeepalive diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml index e8ae71f7e4..68799396a7 100644 --- a/test/helm/gateway-crds-helm/all.out.yaml +++ b/test/helm/gateway-crds-helm/all.out.yaml @@ -29742,6 +29742,15 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + requestHeadersTimeout: + description: |- + RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + The timer is activated when the first byte of the headers is received, + and is disarmed when the last byte of the headers has been received. + Specify 0 to disable the timeout. + Default: 10 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string requestReceivedTimeout: description: |- RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request @@ -29755,6 +29764,14 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object + listenerFiltersTimeout: + description: |- + ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. + If the timeout is reached, the accepted socket is closed without a connection being created. + Specify 0 to disable the timeout. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string tcp: description: Timeout settings for TCP. properties: @@ -29765,6 +29782,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + transportSocketConnectTimeout: + description: |- + TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/test/helm/gateway-crds-helm/e2e.out.yaml b/test/helm/gateway-crds-helm/e2e.out.yaml index 8d51ce19a8..8531c5cd6b 100644 --- a/test/helm/gateway-crds-helm/e2e.out.yaml +++ b/test/helm/gateway-crds-helm/e2e.out.yaml @@ -5680,6 +5680,15 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + requestHeadersTimeout: + description: |- + RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + The timer is activated when the first byte of the headers is received, + and is disarmed when the last byte of the headers has been received. + Specify 0 to disable the timeout. + Default: 10 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string requestReceivedTimeout: description: |- RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request @@ -5693,6 +5702,14 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object + listenerFiltersTimeout: + description: |- + ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. + If the timeout is reached, the accepted socket is closed without a connection being created. + Specify 0 to disable the timeout. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string tcp: description: Timeout settings for TCP. properties: @@ -5703,6 +5720,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + transportSocketConnectTimeout: + description: |- + TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml index a8dccebf69..4ca494c364 100644 --- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml +++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml @@ -5680,6 +5680,15 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + requestHeadersTimeout: + description: |- + RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + The timer is activated when the first byte of the headers is received, + and is disarmed when the last byte of the headers has been received. + Specify 0 to disable the timeout. + Default: 10 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string requestReceivedTimeout: description: |- RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request @@ -5693,6 +5702,14 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object + listenerFiltersTimeout: + description: |- + ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. + If the timeout is reached, the accepted socket is closed without a connection being created. + Specify 0 to disable the timeout. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string tcp: description: Timeout settings for TCP. properties: @@ -5703,6 +5720,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + transportSocketConnectTimeout: + description: |- + TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: From fe28a15400cdf75aa9b205bca049984e7c8a4971 Mon Sep 17 00:00:00 2001 From: kabbohus Date: Mon, 20 Jul 2026 09:07:11 +0200 Subject: [PATCH 03/12] Make naming less envoy specific Signed-off-by: kabbohus --- api/v1alpha1/timeout_types.go | 31 ++++++++-------- api/v1alpha1/zz_generated.deepcopy.go | 18 +++++----- ...y.envoyproxy.io_clienttrafficpolicies.yaml | 35 ++++++++++--------- ...y.envoyproxy.io_clienttrafficpolicies.yaml | 35 ++++++++++--------- site/content/en/latest/api/extension_types.md | 6 ++-- test/helm/gateway-crds-helm/all.out.yaml | 35 ++++++++++--------- test/helm/gateway-crds-helm/e2e.out.yaml | 35 ++++++++++--------- .../envoy-gateway-crds.out.yaml | 35 ++++++++++--------- 8 files changed, 118 insertions(+), 112 deletions(-) diff --git a/api/v1alpha1/timeout_types.go b/api/v1alpha1/timeout_types.go index d42ece0537..5f30611a1a 100644 --- a/api/v1alpha1/timeout_types.go +++ b/api/v1alpha1/timeout_types.go @@ -72,13 +72,13 @@ type ClientTimeout struct { // +optional HTTP *HTTPClientTimeout `json:"http,omitempty"` - // ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. - // If the timeout is reached, the accepted socket is closed without a connection being created. - // Specify 0 to disable the timeout. + // ConnectionInspectionTimeout is the maximum time to wait for initial inspection + // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + // If exceeded, the connection is dropped. // Default: 15 seconds. // // +optional - ListenerFiltersTimeout *gwapiv1.Duration `json:"listenerFiltersTimeout,omitempty"` + ConnectionInspectionTimeout *gwapiv1.Duration `json:"connectionInspectionTimeout,omitempty"` } // TCPClientTimeout only provides timeout configuration on the listener whose protocol is TCP or TLS. @@ -90,12 +90,13 @@ type TCPClientTimeout struct { // +optional IdleTimeout *gwapiv1.Duration `json:"idleTimeout,omitempty"` - // TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. + // HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + // (e.g. the TLS handshake) after a connection is accepted. // If this expires before the transport reports connection establishment, the connection is summarily closed. // Default: 5 seconds. // // +optional - TransportSocketConnectTimeout *gwapiv1.Duration `json:"transportSocketConnectTimeout,omitempty"` + HandshakeTimeout *gwapiv1.Duration `json:"handshakeTimeout,omitempty"` } type HTTPClientTimeout struct { @@ -105,6 +106,15 @@ type HTTPClientTimeout struct { // +optional RequestReceivedTimeout *gwapiv1.Duration `json:"requestReceivedTimeout,omitempty"` + // RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. + // The timer is activated when the first byte of the headers is received, + // and is disarmed when the last byte of the headers has been received. + // Specify 0 to disable the timeout. + // Default: 10 seconds. + // + // +optional + RequestHeadersReceivedTimeout *gwapiv1.Duration `json:"requestHeadersReceivedTimeout,omitempty"` + // IdleTimeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection. // Default: 1 hour. // @@ -116,13 +126,4 @@ type HTTPClientTimeout struct { // // +optional StreamIdleTimeout *gwapiv1.Duration `json:"streamIdleTimeout,omitempty"` - - // RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. - // The timer is activated when the first byte of the headers is received, - // and is disarmed when the last byte of the headers has been received. - // Specify 0 to disable the timeout. - // Default: 10 seconds. - // - // +optional - RequestHeadersTimeout *gwapiv1.Duration `json:"requestHeadersTimeout,omitempty"` } diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index f59986d820..a0db743292 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -1391,8 +1391,8 @@ func (in *ClientTimeout) DeepCopyInto(out *ClientTimeout) { *out = new(HTTPClientTimeout) (*in).DeepCopyInto(*out) } - if in.ListenerFiltersTimeout != nil { - in, out := &in.ListenerFiltersTimeout, &out.ListenerFiltersTimeout + if in.ConnectionInspectionTimeout != nil { + in, out := &in.ConnectionInspectionTimeout, &out.ConnectionInspectionTimeout *out = new(v1.Duration) **out = **in } @@ -4466,6 +4466,11 @@ func (in *HTTPClientTimeout) DeepCopyInto(out *HTTPClientTimeout) { *out = new(v1.Duration) **out = **in } + if in.RequestHeadersReceivedTimeout != nil { + in, out := &in.RequestHeadersReceivedTimeout, &out.RequestHeadersReceivedTimeout + *out = new(v1.Duration) + **out = **in + } if in.IdleTimeout != nil { in, out := &in.IdleTimeout, &out.IdleTimeout *out = new(v1.Duration) @@ -4476,11 +4481,6 @@ func (in *HTTPClientTimeout) DeepCopyInto(out *HTTPClientTimeout) { *out = new(v1.Duration) **out = **in } - if in.RequestHeadersTimeout != nil { - in, out := &in.RequestHeadersTimeout, &out.RequestHeadersTimeout - *out = new(v1.Duration) - **out = **in - } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPClientTimeout. @@ -8527,8 +8527,8 @@ func (in *TCPClientTimeout) DeepCopyInto(out *TCPClientTimeout) { *out = new(v1.Duration) **out = **in } - if in.TransportSocketConnectTimeout != nil { - in, out := &in.TransportSocketConnectTimeout, &out.TransportSocketConnectTimeout + if in.HandshakeTimeout != nil { + in, out := &in.HandshakeTimeout, &out.HandshakeTimeout *out = new(v1.Duration) **out = **in } diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index 984d1cb9ce..9d1e134036 100644 --- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1327,6 +1327,14 @@ spec: timeout: description: Timeout settings for the client connections. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string http: description: Timeout settings for HTTP. properties: @@ -1336,9 +1344,9 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - requestHeadersTimeout: + requestHeadersReceivedTimeout: description: |- - RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. Specify 0 to disable the timeout. @@ -1358,17 +1366,17 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object - listenerFiltersTimeout: - description: |- - ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. - If the timeout is reached, the accepted socket is closed without a connection being created. - Specify 0 to disable the timeout. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string tcp: description: Timeout settings for TCP. properties: + handshakeTimeout: + description: |- + HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -1376,13 +1384,6 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - transportSocketConnectTimeout: - description: |- - TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. - If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string type: object type: object tls: diff --git a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index 16e4e08e3f..38b572ebdc 100644 --- a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1326,6 +1326,14 @@ spec: timeout: description: Timeout settings for the client connections. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string http: description: Timeout settings for HTTP. properties: @@ -1335,9 +1343,9 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - requestHeadersTimeout: + requestHeadersReceivedTimeout: description: |- - RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. Specify 0 to disable the timeout. @@ -1357,17 +1365,17 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object - listenerFiltersTimeout: - description: |- - ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. - If the timeout is reached, the accepted socket is closed without a connection being created. - Specify 0 to disable the timeout. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string tcp: description: Timeout settings for TCP. properties: + handshakeTimeout: + description: |- + HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -1375,13 +1383,6 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - transportSocketConnectTimeout: - description: |- - TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. - If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string type: object type: object tls: diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index ab7c8368b7..d7d218d841 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -980,7 +980,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `tcp` | _[TCPClientTimeout](#tcpclienttimeout)_ | false | | Timeout settings for TCP. | | `http` | _[HTTPClientTimeout](#httpclienttimeout)_ | false | | Timeout settings for HTTP. | -| `listenerFiltersTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation.
If the timeout is reached, the accepted socket is closed without a connection being created.
Specify 0 to disable the timeout.
Default: 15 seconds. | +| `connectionInspectionTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ConnectionInspectionTimeout is the maximum time to wait for initial inspection
(TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection.
If exceeded, the connection is dropped.
Default: 15 seconds. | #### ClientTrafficPolicy @@ -3090,9 +3090,9 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `requestReceivedTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request
initiation and stops when either the last byte of the request is sent upstream or when the response begins. | +| `requestHeadersReceivedTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive.
The timer is activated when the first byte of the headers is received,
and is disarmed when the last byte of the headers has been received.
Specify 0 to disable the timeout.
Default: 10 seconds. | | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
Default: 1 hour. | | `streamIdleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | The stream idle timeout defines the amount of time a stream can exist without any upstream or downstream activity.
Default: 5 minutes. | -| `requestHeadersTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestHeadersTimeout is the duration envoy waits for the request headers to arrive.
The timer is activated when the first byte of the headers is received,
and is disarmed when the last byte of the headers has been received.
Specify 0 to disable the timeout.
Default: 10 seconds. | #### HTTPCookieMatch @@ -6323,7 +6323,7 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no
bytes sent or received on either the upstream or downstream connection.
Default: 1 hour. | -| `transportSocketConnectTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations.
If this expires before the transport reports connection establishment, the connection is summarily closed.
Default: 5 seconds. | +| `handshakeTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
(e.g. the TLS handshake) after a connection is accepted.
If this expires before the transport reports connection establishment, the connection is summarily closed.
Default: 5 seconds. | #### TCPKeepalive diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml index 68799396a7..c409a43aa5 100644 --- a/test/helm/gateway-crds-helm/all.out.yaml +++ b/test/helm/gateway-crds-helm/all.out.yaml @@ -29733,6 +29733,14 @@ spec: timeout: description: Timeout settings for the client connections. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string http: description: Timeout settings for HTTP. properties: @@ -29742,9 +29750,9 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - requestHeadersTimeout: + requestHeadersReceivedTimeout: description: |- - RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. Specify 0 to disable the timeout. @@ -29764,17 +29772,17 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object - listenerFiltersTimeout: - description: |- - ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. - If the timeout is reached, the accepted socket is closed without a connection being created. - Specify 0 to disable the timeout. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string tcp: description: Timeout settings for TCP. properties: + handshakeTimeout: + description: |- + HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -29782,13 +29790,6 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - transportSocketConnectTimeout: - description: |- - TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. - If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string type: object type: object tls: diff --git a/test/helm/gateway-crds-helm/e2e.out.yaml b/test/helm/gateway-crds-helm/e2e.out.yaml index 8531c5cd6b..ff1c8ae3d8 100644 --- a/test/helm/gateway-crds-helm/e2e.out.yaml +++ b/test/helm/gateway-crds-helm/e2e.out.yaml @@ -5671,6 +5671,14 @@ spec: timeout: description: Timeout settings for the client connections. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string http: description: Timeout settings for HTTP. properties: @@ -5680,9 +5688,9 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - requestHeadersTimeout: + requestHeadersReceivedTimeout: description: |- - RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. Specify 0 to disable the timeout. @@ -5702,17 +5710,17 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object - listenerFiltersTimeout: - description: |- - ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. - If the timeout is reached, the accepted socket is closed without a connection being created. - Specify 0 to disable the timeout. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string tcp: description: Timeout settings for TCP. properties: + handshakeTimeout: + description: |- + HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -5720,13 +5728,6 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - transportSocketConnectTimeout: - description: |- - TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. - If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string type: object type: object tls: diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml index 4ca494c364..af75f119d4 100644 --- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml +++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml @@ -5671,6 +5671,14 @@ spec: timeout: description: Timeout settings for the client connections. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string http: description: Timeout settings for HTTP. properties: @@ -5680,9 +5688,9 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - requestHeadersTimeout: + requestHeadersReceivedTimeout: description: |- - RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. Specify 0 to disable the timeout. @@ -5702,17 +5710,17 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object - listenerFiltersTimeout: - description: |- - ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. - If the timeout is reached, the accepted socket is closed without a connection being created. - Specify 0 to disable the timeout. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string tcp: description: Timeout settings for TCP. properties: + handshakeTimeout: + description: |- + HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -5720,13 +5728,6 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - transportSocketConnectTimeout: - description: |- - TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. - If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string type: object type: object tls: From 6ae7737af5e611a4aa47db2f212fb8c883d01c4b Mon Sep 17 00:00:00 2001 From: kabbohus Date: Mon, 27 Jul 2026 09:25:08 +0200 Subject: [PATCH 04/12] Move ConnectionInspectionTimeout into TCP timeout section Signed-off-by: kabbohus --- api/v1alpha1/timeout_types.go | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/api/v1alpha1/timeout_types.go b/api/v1alpha1/timeout_types.go index 5f30611a1a..e967aee7a0 100644 --- a/api/v1alpha1/timeout_types.go +++ b/api/v1alpha1/timeout_types.go @@ -71,14 +71,6 @@ type ClientTimeout struct { // // +optional HTTP *HTTPClientTimeout `json:"http,omitempty"` - - // ConnectionInspectionTimeout is the maximum time to wait for initial inspection - // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. - // If exceeded, the connection is dropped. - // Default: 15 seconds. - // - // +optional - ConnectionInspectionTimeout *gwapiv1.Duration `json:"connectionInspectionTimeout,omitempty"` } // TCPClientTimeout only provides timeout configuration on the listener whose protocol is TCP or TLS. @@ -97,6 +89,14 @@ type TCPClientTimeout struct { // // +optional HandshakeTimeout *gwapiv1.Duration `json:"handshakeTimeout,omitempty"` + + // ConnectionInspectionTimeout is the maximum time to wait for initial inspection + // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + // If exceeded, the connection is dropped. + // Default: 15 seconds. + // + // +optional + ConnectionInspectionTimeout *gwapiv1.Duration `json:"connectionInspectionTimeout,omitempty"` } type HTTPClientTimeout struct { From da9302b79904f4000fddfa0b6119992ef597b546 Mon Sep 17 00:00:00 2001 From: kabbohus Date: Thu, 30 Jul 2026 10:26:43 +0200 Subject: [PATCH 05/12] Implement translation for timeouts Signed-off-by: kabbohus --- internal/gatewayapi/clienttrafficpolicy.go | 22 +++++++++++++++++++++ internal/ir/xds.go | 12 +++++++++++ internal/xds/translator/listener.go | 23 ++++++++++++++++++++-- internal/xds/translator/translator.go | 2 ++ 4 files changed, 57 insertions(+), 2 deletions(-) diff --git a/internal/gatewayapi/clienttrafficpolicy.go b/internal/gatewayapi/clienttrafficpolicy.go index 404d398594..ec2b08bd9d 100644 --- a/internal/gatewayapi/clienttrafficpolicy.go +++ b/internal/gatewayapi/clienttrafficpolicy.go @@ -946,6 +946,20 @@ func buildClientTimeout(clientTimeout *egv1a1.ClientTimeout) (*ir.ClientTimeout, } irTCPTimeout.IdleTimeout = ir.MetaV1DurationPtr(d) } + if clientTimeout.TCP.HandshakeTimeout != nil { + d, err := time.ParseDuration(string(*clientTimeout.TCP.HandshakeTimeout)) + if err != nil { + return nil, fmt.Errorf("invalid TCP HandshakeTimeout value %s", *clientTimeout.TCP.HandshakeTimeout) + } + irTCPTimeout.HandshakeTimeout = ir.MetaV1DurationPtr(d) + } + if clientTimeout.TCP.ConnectionInspectionTimeout != nil { + d, err := time.ParseDuration(string(*clientTimeout.TCP.ConnectionInspectionTimeout)) + if err != nil { + return nil, fmt.Errorf("invalid TCP ConnectionInspectionTimeout value %s", *clientTimeout.TCP.ConnectionInspectionTimeout) + } + irTCPTimeout.ConnectionInspectionTimeout = ir.MetaV1DurationPtr(d) + } irClientTimeout.TCP = irTCPTimeout } @@ -974,6 +988,14 @@ func buildClientTimeout(clientTimeout *egv1a1.ClientTimeout) (*ir.ClientTimeout, } irHTTPTimeout.StreamIdleTimeout = ir.MetaV1DurationPtr(d) } + + if clientTimeout.HTTP.RequestHeadersReceivedTimeout != nil { + d, err := time.ParseDuration(string(*clientTimeout.HTTP.RequestHeadersReceivedTimeout)) + if err != nil { + return nil, fmt.Errorf("invalid HTTP RequestHeadersReceivedTimeout value %s", *clientTimeout.HTTP.RequestHeadersReceivedTimeout) + } + irHTTPTimeout.RequestHeadersReceivedTimeout = ir.MetaV1DurationPtr(d) + } irClientTimeout.HTTP = irHTTPTimeout } diff --git a/internal/ir/xds.go b/internal/ir/xds.go index 6d2fecc72d..d9025ffe16 100644 --- a/internal/ir/xds.go +++ b/internal/ir/xds.go @@ -970,6 +970,14 @@ type TCPClientTimeout struct { // IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no // bytes sent or received on either the upstream or downstream connection. IdleTimeout *metav1.Duration `json:"idleTimeout,omitempty" yaml:"idleTimeout,omitempty"` + // HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + // (e.g. the TLS handshake) after a connection is accepted. + // If this expires before the transport reports connection establishment, the connection is summarily closed. + HandshakeTimeout *metav1.Duration `json:"handshakeTimeout,omitempty" yaml:"handshakeTimeout,omitempty"` + // ConnectionInspectionTimeout is the maximum time to wait for initial inspection + // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + // If exceeded, the connection is dropped. + ConnectionInspectionTimeout *metav1.Duration `json:"connectionInspectionTimeout,omitempty" yaml:"connectionInspectionTimeout,omitempty"` } // HTTPClientTimeout set the configuration for client HTTP. @@ -978,6 +986,10 @@ type HTTPClientTimeout struct { // The duration envoy waits for the complete request reception. This timer starts upon request // initiation and stops when either the last byte of the request is sent upstream or when the response begins. RequestReceivedTimeout *metav1.Duration `json:"requestReceivedTimeout,omitempty" yaml:"requestReceivedTimeout,omitempty"` + // RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. + // The timer is activated when the first byte of the headers is received, + // and is disarmed when the last byte of the headers has been received. + RequestHeadersReceivedTimeout *metav1.Duration `json:"requestHeadersReceivedTimeout,omitempty" yaml:"requestHeadersReceivedTimeout,omitempty"` // IdleTimeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection. IdleTimeout *metav1.Duration `json:"idleTimeout,omitempty" yaml:"idleTimeout,omitempty"` // The stream idle timeout for connections managed by the connection manager. diff --git a/internal/xds/translator/listener.go b/internal/xds/translator/listener.go index fbe7bda278..7d4d347406 100644 --- a/internal/xds/translator/listener.go +++ b/internal/xds/translator/listener.go @@ -214,6 +214,7 @@ func (t *Translator) buildXdsTCPListener( listenerDetails *ir.CoreListenerDetails, keepalive *ir.TCPKeepalive, connection *ir.ClientConnection, + timeout *ir.ClientTimeout, accesslog *ir.AccessLog, ) (*listenerv3.Listener, error) { socketOptions := buildTCPSocketOptions(keepalive) @@ -249,6 +250,10 @@ func (t *Translator) buildXdsTCPListener( socketAddress.Ipv4Compat = true } + if timeout != nil && timeout.TCP != nil && timeout.TCP.ConnectionInspectionTimeout != nil { + listener.ListenerFiltersTimeout = durationpb.New(timeout.TCP.ConnectionInspectionTimeout.Duration) + } + return listener, nil } @@ -440,6 +445,10 @@ func (t *Translator) addHCMToXDSListener( mgr.RequestTimeout = durationpb.New(irListener.Timeout.HTTP.RequestReceivedTimeout.Duration) } + if irListener.Timeout.HTTP.RequestHeadersReceivedTimeout != nil { + mgr.RequestHeadersTimeout = durationpb.New(irListener.Timeout.HTTP.RequestHeadersReceivedTimeout.Duration) + } + if irListener.Timeout.HTTP.IdleTimeout != nil { mgr.CommonHttpProtocolOptions.IdleTimeout = durationpb.New(irListener.Timeout.HTTP.IdleTimeout.Duration) } @@ -508,6 +517,10 @@ func (t *Translator) addHCMToXDSListener( Filters: filters, } + if irListener.Timeout != nil && irListener.Timeout.TCP != nil && irListener.Timeout.TCP.HandshakeTimeout != nil { + filterChain.TransportSocketConnectTimeout = durationpb.New(irListener.Timeout.TCP.HandshakeTimeout.Duration) + } + if irListener.TLS != nil { var tSocket *corev3.TransportSocket @@ -805,10 +818,16 @@ func buildTCPFilterChain( return nil, err } - return &listenerv3.FilterChain{ + filterChain := &listenerv3.FilterChain{ Filters: filters, Name: tlsListenerFilterChainName(irRoute), - }, nil + } + + if timeout != nil && timeout.TCP != nil && timeout.TCP.HandshakeTimeout != nil { + filterChain.TransportSocketConnectTimeout = durationpb.New(timeout.TCP.HandshakeTimeout.Duration) + } + + return filterChain, nil } func buildConnectionLimitFilter(statPrefix string, connection *ir.ClientConnection) *connection_limitv3.ConnectionLimit { diff --git a/internal/xds/translator/translator.go b/internal/xds/translator/translator.go index 87f7ba4f9b..4569473e4c 100644 --- a/internal/xds/translator/translator.go +++ b/internal/xds/translator/translator.go @@ -391,6 +391,7 @@ func (t *Translator) processHTTPListenerXdsTranslation( &httpListener.CoreListenerDetails, httpListener.TCPKeepalive, httpListener.Connection, + httpListener.Timeout, accessLog, ); err != nil { errs = errors.Join(errs, err) @@ -846,6 +847,7 @@ func (t *Translator) processTCPListenerXdsTranslation( &tcpListener.CoreListenerDetails, tcpListener.TCPKeepalive, tcpListener.Connection, + tcpListener.Timeout, accesslog, ); err != nil { // skip this listener if failed to build xds listener From 67db6a7ee26e700feb8671610efdbead16e8c68f Mon Sep 17 00:00:00 2001 From: kabbohus Date: Thu, 30 Jul 2026 10:27:04 +0200 Subject: [PATCH 06/12] Align default values in api definition with Envoy Proxy and regenerate Signed-off-by: kabbohus --- api/v1alpha1/timeout_types.go | 8 +++----- api/v1alpha1/zz_generated.deepcopy.go | 10 +++++----- ...y.envoyproxy.io_clienttrafficpolicies.yaml | 20 +++++++++---------- ...y.envoyproxy.io_clienttrafficpolicies.yaml | 20 +++++++++---------- internal/ir/zz_generated.deepcopy.go | 15 ++++++++++++++ site/content/en/latest/api/extension_types.md | 6 +++--- test/helm/gateway-crds-helm/all.out.yaml | 20 +++++++++---------- test/helm/gateway-crds-helm/e2e.out.yaml | 20 +++++++++---------- .../envoy-gateway-crds.out.yaml | 20 +++++++++---------- 9 files changed, 71 insertions(+), 68 deletions(-) diff --git a/api/v1alpha1/timeout_types.go b/api/v1alpha1/timeout_types.go index e967aee7a0..f23de6f8af 100644 --- a/api/v1alpha1/timeout_types.go +++ b/api/v1alpha1/timeout_types.go @@ -85,10 +85,9 @@ type TCPClientTimeout struct { // HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation // (e.g. the TLS handshake) after a connection is accepted. // If this expires before the transport reports connection establishment, the connection is summarily closed. - // Default: 5 seconds. // // +optional - HandshakeTimeout *gwapiv1.Duration `json:"handshakeTimeout,omitempty"` + HandshakeTimeout *gwapiv1.Duration `json:"handshakeTimeout,omitempty"` // ConnectionInspectionTimeout is the maximum time to wait for initial inspection // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. @@ -96,7 +95,7 @@ type TCPClientTimeout struct { // Default: 15 seconds. // // +optional - ConnectionInspectionTimeout *gwapiv1.Duration `json:"connectionInspectionTimeout,omitempty"` + ConnectionInspectionTimeout *gwapiv1.Duration `json:"connectionInspectionTimeout,omitempty"` } type HTTPClientTimeout struct { @@ -109,8 +108,7 @@ type HTTPClientTimeout struct { // RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. // The timer is activated when the first byte of the headers is received, // and is disarmed when the last byte of the headers has been received. - // Specify 0 to disable the timeout. - // Default: 10 seconds. + // If not specified or set to 0, this timeout is disabled. // // +optional RequestHeadersReceivedTimeout *gwapiv1.Duration `json:"requestHeadersReceivedTimeout,omitempty"` diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index a0db743292..cae9d4289e 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -1391,11 +1391,6 @@ func (in *ClientTimeout) DeepCopyInto(out *ClientTimeout) { *out = new(HTTPClientTimeout) (*in).DeepCopyInto(*out) } - if in.ConnectionInspectionTimeout != nil { - in, out := &in.ConnectionInspectionTimeout, &out.ConnectionInspectionTimeout - *out = new(v1.Duration) - **out = **in - } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClientTimeout. @@ -8532,6 +8527,11 @@ func (in *TCPClientTimeout) DeepCopyInto(out *TCPClientTimeout) { *out = new(v1.Duration) **out = **in } + if in.ConnectionInspectionTimeout != nil { + in, out := &in.ConnectionInspectionTimeout, &out.ConnectionInspectionTimeout + *out = new(v1.Duration) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPClientTimeout. diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index 9d1e134036..a197c8abb5 100644 --- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1327,14 +1327,6 @@ spec: timeout: description: Timeout settings for the client connections. properties: - connectionInspectionTimeout: - description: |- - ConnectionInspectionTimeout is the maximum time to wait for initial inspection - (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. - If exceeded, the connection is dropped. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string http: description: Timeout settings for HTTP. properties: @@ -1349,8 +1341,7 @@ spec: RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. - Specify 0 to disable the timeout. - Default: 10 seconds. + If not specified or set to 0, this timeout is disabled. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string requestReceivedTimeout: @@ -1369,12 +1360,19 @@ spec: tcp: description: Timeout settings for TCP. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string handshakeTimeout: description: |- HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation (e.g. the TLS handshake) after a connection is accepted. If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string idleTimeout: diff --git a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index 38b572ebdc..e61979c97b 100644 --- a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1326,14 +1326,6 @@ spec: timeout: description: Timeout settings for the client connections. properties: - connectionInspectionTimeout: - description: |- - ConnectionInspectionTimeout is the maximum time to wait for initial inspection - (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. - If exceeded, the connection is dropped. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string http: description: Timeout settings for HTTP. properties: @@ -1348,8 +1340,7 @@ spec: RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. - Specify 0 to disable the timeout. - Default: 10 seconds. + If not specified or set to 0, this timeout is disabled. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string requestReceivedTimeout: @@ -1368,12 +1359,19 @@ spec: tcp: description: Timeout settings for TCP. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string handshakeTimeout: description: |- HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation (e.g. the TLS handshake) after a connection is accepted. If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string idleTimeout: diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go index d6f990c42c..e1e5d5dd92 100644 --- a/internal/ir/zz_generated.deepcopy.go +++ b/internal/ir/zz_generated.deepcopy.go @@ -2269,6 +2269,11 @@ func (in *HTTPClientTimeout) DeepCopyInto(out *HTTPClientTimeout) { *out = new(metav1.Duration) **out = **in } + if in.RequestHeadersReceivedTimeout != nil { + in, out := &in.RequestHeadersReceivedTimeout, &out.RequestHeadersReceivedTimeout + *out = new(metav1.Duration) + **out = **in + } if in.IdleTimeout != nil { in, out := &in.IdleTimeout, &out.IdleTimeout *out = new(metav1.Duration) @@ -4683,6 +4688,16 @@ func (in *TCPClientTimeout) DeepCopyInto(out *TCPClientTimeout) { *out = new(metav1.Duration) **out = **in } + if in.HandshakeTimeout != nil { + in, out := &in.HandshakeTimeout, &out.HandshakeTimeout + *out = new(metav1.Duration) + **out = **in + } + if in.ConnectionInspectionTimeout != nil { + in, out := &in.ConnectionInspectionTimeout, &out.ConnectionInspectionTimeout + *out = new(metav1.Duration) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPClientTimeout. diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index d7d218d841..64859419da 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -980,7 +980,6 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `tcp` | _[TCPClientTimeout](#tcpclienttimeout)_ | false | | Timeout settings for TCP. | | `http` | _[HTTPClientTimeout](#httpclienttimeout)_ | false | | Timeout settings for HTTP. | -| `connectionInspectionTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ConnectionInspectionTimeout is the maximum time to wait for initial inspection
(TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection.
If exceeded, the connection is dropped.
Default: 15 seconds. | #### ClientTrafficPolicy @@ -3090,7 +3089,7 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `requestReceivedTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request
initiation and stops when either the last byte of the request is sent upstream or when the response begins. | -| `requestHeadersReceivedTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive.
The timer is activated when the first byte of the headers is received,
and is disarmed when the last byte of the headers has been received.
Specify 0 to disable the timeout.
Default: 10 seconds. | +| `requestHeadersReceivedTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive.
The timer is activated when the first byte of the headers is received,
and is disarmed when the last byte of the headers has been received.
If not specified or set to 0, this timeout is disabled. | | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
Default: 1 hour. | | `streamIdleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | The stream idle timeout defines the amount of time a stream can exist without any upstream or downstream activity.
Default: 5 minutes. | @@ -6323,7 +6322,8 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no
bytes sent or received on either the upstream or downstream connection.
Default: 1 hour. | -| `handshakeTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
(e.g. the TLS handshake) after a connection is accepted.
If this expires before the transport reports connection establishment, the connection is summarily closed.
Default: 5 seconds. | +| `handshakeTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
(e.g. the TLS handshake) after a connection is accepted.
If this expires before the transport reports connection establishment, the connection is summarily closed. | +| `connectionInspectionTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ConnectionInspectionTimeout is the maximum time to wait for initial inspection
(TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection.
If exceeded, the connection is dropped.
Default: 15 seconds. | #### TCPKeepalive diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml index c409a43aa5..d18e1897b0 100644 --- a/test/helm/gateway-crds-helm/all.out.yaml +++ b/test/helm/gateway-crds-helm/all.out.yaml @@ -29733,14 +29733,6 @@ spec: timeout: description: Timeout settings for the client connections. properties: - connectionInspectionTimeout: - description: |- - ConnectionInspectionTimeout is the maximum time to wait for initial inspection - (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. - If exceeded, the connection is dropped. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string http: description: Timeout settings for HTTP. properties: @@ -29755,8 +29747,7 @@ spec: RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. - Specify 0 to disable the timeout. - Default: 10 seconds. + If not specified or set to 0, this timeout is disabled. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string requestReceivedTimeout: @@ -29775,12 +29766,19 @@ spec: tcp: description: Timeout settings for TCP. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string handshakeTimeout: description: |- HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation (e.g. the TLS handshake) after a connection is accepted. If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string idleTimeout: diff --git a/test/helm/gateway-crds-helm/e2e.out.yaml b/test/helm/gateway-crds-helm/e2e.out.yaml index ff1c8ae3d8..fb5eaac32f 100644 --- a/test/helm/gateway-crds-helm/e2e.out.yaml +++ b/test/helm/gateway-crds-helm/e2e.out.yaml @@ -5671,14 +5671,6 @@ spec: timeout: description: Timeout settings for the client connections. properties: - connectionInspectionTimeout: - description: |- - ConnectionInspectionTimeout is the maximum time to wait for initial inspection - (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. - If exceeded, the connection is dropped. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string http: description: Timeout settings for HTTP. properties: @@ -5693,8 +5685,7 @@ spec: RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. - Specify 0 to disable the timeout. - Default: 10 seconds. + If not specified or set to 0, this timeout is disabled. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string requestReceivedTimeout: @@ -5713,12 +5704,19 @@ spec: tcp: description: Timeout settings for TCP. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string handshakeTimeout: description: |- HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation (e.g. the TLS handshake) after a connection is accepted. If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string idleTimeout: diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml index af75f119d4..aeebb16ef9 100644 --- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml +++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml @@ -5671,14 +5671,6 @@ spec: timeout: description: Timeout settings for the client connections. properties: - connectionInspectionTimeout: - description: |- - ConnectionInspectionTimeout is the maximum time to wait for initial inspection - (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. - If exceeded, the connection is dropped. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string http: description: Timeout settings for HTTP. properties: @@ -5693,8 +5685,7 @@ spec: RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. - Specify 0 to disable the timeout. - Default: 10 seconds. + If not specified or set to 0, this timeout is disabled. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string requestReceivedTimeout: @@ -5713,12 +5704,19 @@ spec: tcp: description: Timeout settings for TCP. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string handshakeTimeout: description: |- HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation (e.g. the TLS handshake) after a connection is accepted. If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string idleTimeout: From b4affa431fdff7a8a16453266eb9f4a8ef68e6f2 Mon Sep 17 00:00:00 2001 From: kabbohus Date: Thu, 30 Jul 2026 11:55:36 +0200 Subject: [PATCH 07/12] Add changelog entry Signed-off-by: kabbohus --- .../new_features/9315-support-more-client-timeout-settings.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 release-notes/current/new_features/9315-support-more-client-timeout-settings.md diff --git a/release-notes/current/new_features/9315-support-more-client-timeout-settings.md b/release-notes/current/new_features/9315-support-more-client-timeout-settings.md new file mode 100644 index 0000000000..4ed4254732 --- /dev/null +++ b/release-notes/current/new_features/9315-support-more-client-timeout-settings.md @@ -0,0 +1 @@ +Add support for more client timeout settings. The settings are [`ConnectionInspectionTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener.proto#envoy-v3-api-field-config-listener-v3-listener-listener-filters-timeout), [`RequestHeadersReceivedTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-request-headers-timeout) and [`HandshakeTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener_components.proto.html#envoy-v3-api-field-config-listener-v3-filterchain-transport-socket-connect-timeout) From 9f5c45ab826beebf32fad28ae4ef26d9f38643f5 Mon Sep 17 00:00:00 2001 From: kabbohus Date: Thu, 30 Jul 2026 12:40:54 +0200 Subject: [PATCH 08/12] Test whether translation works for timeouts Signed-off-by: kabbohus --- .../testdata/clienttrafficpolicy-timeout.in.yaml | 4 ++++ .../testdata/clienttrafficpolicy-timeout.out.yaml | 8 ++++++++ 2 files changed, 12 insertions(+) diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml index 11ea0bba15..2f6bf90b98 100644 --- a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml +++ b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml @@ -11,8 +11,12 @@ clientTrafficPolicies: name: gateway sectionName: http-1 timeout: + tcp: + handshakeTimeout: "10s" + connectionInspectionTimeout: "60s" http: requestReceivedTimeout: "5s" + requestHeadersReceivedTimeout: "5s" gateways: - apiVersion: gateway.networking.k8s.io/v1 kind: Gateway diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml index 89c4b657b1..cb1e476cdb 100644 --- a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml +++ b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml @@ -12,7 +12,11 @@ clientTrafficPolicies: sectionName: http-1 timeout: http: + requestHeadersReceivedTimeout: 5s requestReceivedTimeout: 5s + tcp: + connectionInspectionTimeout: 60s + handshakeTimeout: 10s status: ancestors: - ancestorRef: @@ -170,7 +174,11 @@ xdsIR: port: 10080 timeout: http: + requestHeadersReceivedTimeout: 5s requestReceivedTimeout: 5s + tcp: + connectionInspectionTimeout: 1m0s + handshakeTimeout: 10s - address: 0.0.0.0 externalPort: 8080 hostnames: From 2c56122e8e819334b34afc50f73bfc699ff23f71 Mon Sep 17 00:00:00 2001 From: kabbohus Date: Mon, 3 Aug 2026 09:37:24 +0200 Subject: [PATCH 09/12] Rename HandshakeTimeout to TLSHandshakeTimeout Signed-off-by: kabbohus --- api/v1alpha1/timeout_types.go | 4 ++-- api/v1alpha1/zz_generated.deepcopy.go | 4 ++-- ...ateway.envoyproxy.io_clienttrafficpolicies.yaml | 14 +++++++------- ...ateway.envoyproxy.io_clienttrafficpolicies.yaml | 14 +++++++------- internal/gatewayapi/clienttrafficpolicy.go | 8 ++++---- .../testdata/clienttrafficpolicy-timeout.in.yaml | 2 +- .../testdata/clienttrafficpolicy-timeout.out.yaml | 4 ++-- internal/ir/xds.go | 4 ++-- internal/ir/zz_generated.deepcopy.go | 4 ++-- internal/xds/translator/listener.go | 8 ++++---- .../9315-support-more-client-timeout-settings.md | 2 +- site/content/en/latest/api/extension_types.md | 2 +- test/helm/gateway-crds-helm/all.out.yaml | 14 +++++++------- test/helm/gateway-crds-helm/e2e.out.yaml | 14 +++++++------- .../gateway-crds-helm/envoy-gateway-crds.out.yaml | 14 +++++++------- 15 files changed, 56 insertions(+), 56 deletions(-) diff --git a/api/v1alpha1/timeout_types.go b/api/v1alpha1/timeout_types.go index f23de6f8af..0cc6bcd4ea 100644 --- a/api/v1alpha1/timeout_types.go +++ b/api/v1alpha1/timeout_types.go @@ -82,12 +82,12 @@ type TCPClientTimeout struct { // +optional IdleTimeout *gwapiv1.Duration `json:"idleTimeout,omitempty"` - // HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + // TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation // (e.g. the TLS handshake) after a connection is accepted. // If this expires before the transport reports connection establishment, the connection is summarily closed. // // +optional - HandshakeTimeout *gwapiv1.Duration `json:"handshakeTimeout,omitempty"` + TLSHandshakeTimeout *gwapiv1.Duration `json:"tlsHandshakeTimeout,omitempty"` // ConnectionInspectionTimeout is the maximum time to wait for initial inspection // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index cae9d4289e..45d90c8b42 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -8522,8 +8522,8 @@ func (in *TCPClientTimeout) DeepCopyInto(out *TCPClientTimeout) { *out = new(v1.Duration) **out = **in } - if in.HandshakeTimeout != nil { - in, out := &in.HandshakeTimeout, &out.HandshakeTimeout + if in.TLSHandshakeTimeout != nil { + in, out := &in.TLSHandshakeTimeout, &out.TLSHandshakeTimeout *out = new(v1.Duration) **out = **in } diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index a197c8abb5..7fad46c37d 100644 --- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1368,13 +1368,6 @@ spec: Default: 15 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - handshakeTimeout: - description: |- - HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation - (e.g. the TLS handshake) after a connection is accepted. - If this expires before the transport reports connection establishment, the connection is summarily closed. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -1382,6 +1375,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + tlsHandshakeTimeout: + description: |- + TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index e61979c97b..7b86a96254 100644 --- a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1367,13 +1367,6 @@ spec: Default: 15 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - handshakeTimeout: - description: |- - HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation - (e.g. the TLS handshake) after a connection is accepted. - If this expires before the transport reports connection establishment, the connection is summarily closed. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -1381,6 +1374,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + tlsHandshakeTimeout: + description: |- + TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/internal/gatewayapi/clienttrafficpolicy.go b/internal/gatewayapi/clienttrafficpolicy.go index ec2b08bd9d..560cd025b6 100644 --- a/internal/gatewayapi/clienttrafficpolicy.go +++ b/internal/gatewayapi/clienttrafficpolicy.go @@ -946,12 +946,12 @@ func buildClientTimeout(clientTimeout *egv1a1.ClientTimeout) (*ir.ClientTimeout, } irTCPTimeout.IdleTimeout = ir.MetaV1DurationPtr(d) } - if clientTimeout.TCP.HandshakeTimeout != nil { - d, err := time.ParseDuration(string(*clientTimeout.TCP.HandshakeTimeout)) + if clientTimeout.TCP.TLSHandshakeTimeout != nil { + d, err := time.ParseDuration(string(*clientTimeout.TCP.TLSHandshakeTimeout)) if err != nil { - return nil, fmt.Errorf("invalid TCP HandshakeTimeout value %s", *clientTimeout.TCP.HandshakeTimeout) + return nil, fmt.Errorf("invalid TCP TLSHandshakeTimeout value %s", *clientTimeout.TCP.TLSHandshakeTimeout) } - irTCPTimeout.HandshakeTimeout = ir.MetaV1DurationPtr(d) + irTCPTimeout.TLSHandshakeTimeout = ir.MetaV1DurationPtr(d) } if clientTimeout.TCP.ConnectionInspectionTimeout != nil { d, err := time.ParseDuration(string(*clientTimeout.TCP.ConnectionInspectionTimeout)) diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml index 2f6bf90b98..f585270260 100644 --- a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml +++ b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml @@ -12,7 +12,7 @@ clientTrafficPolicies: sectionName: http-1 timeout: tcp: - handshakeTimeout: "10s" + tlsHandshakeTimeout: "10s" connectionInspectionTimeout: "60s" http: requestReceivedTimeout: "5s" diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml index cb1e476cdb..54a3d74b1e 100644 --- a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml +++ b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml @@ -16,7 +16,7 @@ clientTrafficPolicies: requestReceivedTimeout: 5s tcp: connectionInspectionTimeout: 60s - handshakeTimeout: 10s + tlsHandshakeTimeout: 10s status: ancestors: - ancestorRef: @@ -178,7 +178,7 @@ xdsIR: requestReceivedTimeout: 5s tcp: connectionInspectionTimeout: 1m0s - handshakeTimeout: 10s + tlsHandshakeTimeout: 10s - address: 0.0.0.0 externalPort: 8080 hostnames: diff --git a/internal/ir/xds.go b/internal/ir/xds.go index d9025ffe16..d7ef46e217 100644 --- a/internal/ir/xds.go +++ b/internal/ir/xds.go @@ -970,10 +970,10 @@ type TCPClientTimeout struct { // IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no // bytes sent or received on either the upstream or downstream connection. IdleTimeout *metav1.Duration `json:"idleTimeout,omitempty" yaml:"idleTimeout,omitempty"` - // HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + // TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation // (e.g. the TLS handshake) after a connection is accepted. // If this expires before the transport reports connection establishment, the connection is summarily closed. - HandshakeTimeout *metav1.Duration `json:"handshakeTimeout,omitempty" yaml:"handshakeTimeout,omitempty"` + TLSHandshakeTimeout *metav1.Duration `json:"tlsHandshakeTimeout,omitempty" yaml:"handshakeTimeout,omitempty"` // ConnectionInspectionTimeout is the maximum time to wait for initial inspection // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. // If exceeded, the connection is dropped. diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go index e1e5d5dd92..a04452c8fe 100644 --- a/internal/ir/zz_generated.deepcopy.go +++ b/internal/ir/zz_generated.deepcopy.go @@ -4688,8 +4688,8 @@ func (in *TCPClientTimeout) DeepCopyInto(out *TCPClientTimeout) { *out = new(metav1.Duration) **out = **in } - if in.HandshakeTimeout != nil { - in, out := &in.HandshakeTimeout, &out.HandshakeTimeout + if in.TLSHandshakeTimeout != nil { + in, out := &in.TLSHandshakeTimeout, &out.TLSHandshakeTimeout *out = new(metav1.Duration) **out = **in } diff --git a/internal/xds/translator/listener.go b/internal/xds/translator/listener.go index 7d4d347406..943e3c6d86 100644 --- a/internal/xds/translator/listener.go +++ b/internal/xds/translator/listener.go @@ -517,8 +517,8 @@ func (t *Translator) addHCMToXDSListener( Filters: filters, } - if irListener.Timeout != nil && irListener.Timeout.TCP != nil && irListener.Timeout.TCP.HandshakeTimeout != nil { - filterChain.TransportSocketConnectTimeout = durationpb.New(irListener.Timeout.TCP.HandshakeTimeout.Duration) + if irListener.Timeout != nil && irListener.Timeout.TCP != nil && irListener.Timeout.TCP.TLSHandshakeTimeout != nil { + filterChain.TransportSocketConnectTimeout = durationpb.New(irListener.Timeout.TCP.TLSHandshakeTimeout.Duration) } if irListener.TLS != nil { @@ -823,8 +823,8 @@ func buildTCPFilterChain( Name: tlsListenerFilterChainName(irRoute), } - if timeout != nil && timeout.TCP != nil && timeout.TCP.HandshakeTimeout != nil { - filterChain.TransportSocketConnectTimeout = durationpb.New(timeout.TCP.HandshakeTimeout.Duration) + if timeout != nil && timeout.TCP != nil && timeout.TCP.TLSHandshakeTimeout != nil { + filterChain.TransportSocketConnectTimeout = durationpb.New(timeout.TCP.TLSHandshakeTimeout.Duration) } return filterChain, nil diff --git a/release-notes/current/new_features/9315-support-more-client-timeout-settings.md b/release-notes/current/new_features/9315-support-more-client-timeout-settings.md index 4ed4254732..8d75c60ab2 100644 --- a/release-notes/current/new_features/9315-support-more-client-timeout-settings.md +++ b/release-notes/current/new_features/9315-support-more-client-timeout-settings.md @@ -1 +1 @@ -Add support for more client timeout settings. The settings are [`ConnectionInspectionTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener.proto#envoy-v3-api-field-config-listener-v3-listener-listener-filters-timeout), [`RequestHeadersReceivedTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-request-headers-timeout) and [`HandshakeTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener_components.proto.html#envoy-v3-api-field-config-listener-v3-filterchain-transport-socket-connect-timeout) +Add support for more client timeout settings. The settings are [`ConnectionInspectionTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener.proto#envoy-v3-api-field-config-listener-v3-listener-listener-filters-timeout), [`RequestHeadersReceivedTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-request-headers-timeout) and [`TLSHandshakeTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener_components.proto.html#envoy-v3-api-field-config-listener-v3-filterchain-transport-socket-connect-timeout) diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index 64859419da..ae40b5b408 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -6322,7 +6322,7 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no
bytes sent or received on either the upstream or downstream connection.
Default: 1 hour. | -| `handshakeTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
(e.g. the TLS handshake) after a connection is accepted.
If this expires before the transport reports connection establishment, the connection is summarily closed. | +| `tlsHandshakeTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
(e.g. the TLS handshake) after a connection is accepted.
If this expires before the transport reports connection establishment, the connection is summarily closed. | | `connectionInspectionTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ConnectionInspectionTimeout is the maximum time to wait for initial inspection
(TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection.
If exceeded, the connection is dropped.
Default: 15 seconds. | diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml index d18e1897b0..856e9ab273 100644 --- a/test/helm/gateway-crds-helm/all.out.yaml +++ b/test/helm/gateway-crds-helm/all.out.yaml @@ -29774,13 +29774,6 @@ spec: Default: 15 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - handshakeTimeout: - description: |- - HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation - (e.g. the TLS handshake) after a connection is accepted. - If this expires before the transport reports connection establishment, the connection is summarily closed. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -29788,6 +29781,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + tlsHandshakeTimeout: + description: |- + TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/test/helm/gateway-crds-helm/e2e.out.yaml b/test/helm/gateway-crds-helm/e2e.out.yaml index fb5eaac32f..bc99609a5d 100644 --- a/test/helm/gateway-crds-helm/e2e.out.yaml +++ b/test/helm/gateway-crds-helm/e2e.out.yaml @@ -5712,13 +5712,6 @@ spec: Default: 15 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - handshakeTimeout: - description: |- - HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation - (e.g. the TLS handshake) after a connection is accepted. - If this expires before the transport reports connection establishment, the connection is summarily closed. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -5726,6 +5719,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + tlsHandshakeTimeout: + description: |- + TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml index aeebb16ef9..b7238ea22d 100644 --- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml +++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml @@ -5712,13 +5712,6 @@ spec: Default: 15 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - handshakeTimeout: - description: |- - HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation - (e.g. the TLS handshake) after a connection is accepted. - If this expires before the transport reports connection establishment, the connection is summarily closed. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -5726,6 +5719,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + tlsHandshakeTimeout: + description: |- + TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: From 9096966265f434073b58fb09458f25a82ba2367a Mon Sep 17 00:00:00 2001 From: kabbohus Date: Mon, 3 Aug 2026 13:56:07 +0200 Subject: [PATCH 10/12] Accept suggestion Co-authored-by: Huabing (Robin) Zhao Signed-off-by: kabbohus --- internal/ir/xds.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/ir/xds.go b/internal/ir/xds.go index d7ef46e217..47f2f124a3 100644 --- a/internal/ir/xds.go +++ b/internal/ir/xds.go @@ -973,7 +973,7 @@ type TCPClientTimeout struct { // TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation // (e.g. the TLS handshake) after a connection is accepted. // If this expires before the transport reports connection establishment, the connection is summarily closed. - TLSHandshakeTimeout *metav1.Duration `json:"tlsHandshakeTimeout,omitempty" yaml:"handshakeTimeout,omitempty"` + TLSHandshakeTimeout *metav1.Duration `json:"tlsHandshakeTimeout,omitempty" yaml:"tlsHandshakeTimeout,omitempty"` // ConnectionInspectionTimeout is the maximum time to wait for initial inspection // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. // If exceeded, the connection is dropped. From 07f5fc2a989997ba0d77e47f5d07d2401eb6aefa Mon Sep 17 00:00:00 2001 From: kabbohus Date: Mon, 3 Aug 2026 18:32:14 +0200 Subject: [PATCH 11/12] Mention that connection inspection timeout is per socket Signed-off-by: kabbohus --- api/v1alpha1/timeout_types.go | 2 +- .../generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml | 2 +- .../generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml | 2 +- site/content/en/latest/api/extension_types.md | 2 +- test/helm/gateway-crds-helm/all.out.yaml | 2 +- test/helm/gateway-crds-helm/e2e.out.yaml | 2 +- test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/api/v1alpha1/timeout_types.go b/api/v1alpha1/timeout_types.go index 0cc6bcd4ea..f1c664e38d 100644 --- a/api/v1alpha1/timeout_types.go +++ b/api/v1alpha1/timeout_types.go @@ -90,7 +90,7 @@ type TCPClientTimeout struct { TLSHandshakeTimeout *gwapiv1.Duration `json:"tlsHandshakeTimeout,omitempty"` // ConnectionInspectionTimeout is the maximum time to wait for initial inspection - // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection on the listener socket. // If exceeded, the connection is dropped. // Default: 15 seconds. // diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index 7fad46c37d..cb9970a8d0 100644 --- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1363,7 +1363,7 @@ spec: connectionInspectionTimeout: description: |- ConnectionInspectionTimeout is the maximum time to wait for initial inspection - (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection on the listener socket. If exceeded, the connection is dropped. Default: 15 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ diff --git a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index 7b86a96254..cbcd1090cc 100644 --- a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1362,7 +1362,7 @@ spec: connectionInspectionTimeout: description: |- ConnectionInspectionTimeout is the maximum time to wait for initial inspection - (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection on the listener socket. If exceeded, the connection is dropped. Default: 15 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index ae40b5b408..5115c98ca5 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -6323,7 +6323,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no
bytes sent or received on either the upstream or downstream connection.
Default: 1 hour. | | `tlsHandshakeTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
(e.g. the TLS handshake) after a connection is accepted.
If this expires before the transport reports connection establishment, the connection is summarily closed. | -| `connectionInspectionTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ConnectionInspectionTimeout is the maximum time to wait for initial inspection
(TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection.
If exceeded, the connection is dropped.
Default: 15 seconds. | +| `connectionInspectionTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ConnectionInspectionTimeout is the maximum time to wait for initial inspection
(TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection on the listener socket.
If exceeded, the connection is dropped.
Default: 15 seconds. | #### TCPKeepalive diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml index 856e9ab273..5cefe156f4 100644 --- a/test/helm/gateway-crds-helm/all.out.yaml +++ b/test/helm/gateway-crds-helm/all.out.yaml @@ -29769,7 +29769,7 @@ spec: connectionInspectionTimeout: description: |- ConnectionInspectionTimeout is the maximum time to wait for initial inspection - (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection on the listener socket. If exceeded, the connection is dropped. Default: 15 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ diff --git a/test/helm/gateway-crds-helm/e2e.out.yaml b/test/helm/gateway-crds-helm/e2e.out.yaml index bc99609a5d..25daff866b 100644 --- a/test/helm/gateway-crds-helm/e2e.out.yaml +++ b/test/helm/gateway-crds-helm/e2e.out.yaml @@ -5707,7 +5707,7 @@ spec: connectionInspectionTimeout: description: |- ConnectionInspectionTimeout is the maximum time to wait for initial inspection - (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection on the listener socket. If exceeded, the connection is dropped. Default: 15 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml index b7238ea22d..9fa651b4d8 100644 --- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml +++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml @@ -5707,7 +5707,7 @@ spec: connectionInspectionTimeout: description: |- ConnectionInspectionTimeout is the maximum time to wait for initial inspection - (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection on the listener socket. If exceeded, the connection is dropped. Default: 15 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ From 1c9779fb3bb5724591050ac9a1208e234f9ce557 Mon Sep 17 00:00:00 2001 From: kabbohus Date: Tue, 4 Aug 2026 12:06:34 +0200 Subject: [PATCH 12/12] Add xds translation tests for the new timeout fields Signed-off-by: kabbohus --- .../client-listener-scoped-timeout.yaml | 44 ++++++++++++ .../testdata/in/xds-ir/client-timeout.yaml | 24 +++++++ ...te-with-tls-and-tls-handshake-timeout.yaml | 69 +++++++++++++++++++ ...ient-listener-scoped-timeout.clusters.yaml | 46 +++++++++++++ ...ent-listener-scoped-timeout.endpoints.yaml | 24 +++++++ ...ent-listener-scoped-timeout.listeners.yaml | 39 +++++++++++ ...client-listener-scoped-timeout.routes.yaml | 25 +++++++ .../out/xds-ir/client-timeout.clusters.yaml | 23 +++++++ .../out/xds-ir/client-timeout.endpoints.yaml | 12 ++++ .../out/xds-ir/client-timeout.listeners.yaml | 1 + .../out/xds-ir/client-timeout.routes.yaml | 11 +++ ...ls-and-tls-handshake-timeout.clusters.yaml | 55 +++++++++++++++ ...s-and-tls-handshake-timeout.endpoints.yaml | 41 +++++++++++ ...s-and-tls-handshake-timeout.listeners.yaml | 37 ++++++++++ ...-tls-and-tls-handshake-timeout.routes.yaml | 29 ++++++++ ...tls-and-tls-handshake-timeout.secrets.yaml | 4 ++ 16 files changed, 484 insertions(+) create mode 100644 internal/xds/translator/testdata/in/xds-ir/client-listener-scoped-timeout.yaml create mode 100644 internal/xds/translator/testdata/in/xds-ir/httproute-with-tls-and-tls-handshake-timeout.yaml create mode 100644 internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.clusters.yaml create mode 100644 internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.endpoints.yaml create mode 100644 internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.listeners.yaml create mode 100644 internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.routes.yaml create mode 100644 internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.clusters.yaml create mode 100644 internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.endpoints.yaml create mode 100644 internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.listeners.yaml create mode 100644 internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.routes.yaml create mode 100644 internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.secrets.yaml diff --git a/internal/xds/translator/testdata/in/xds-ir/client-listener-scoped-timeout.yaml b/internal/xds/translator/testdata/in/xds-ir/client-listener-scoped-timeout.yaml new file mode 100644 index 0000000000..cebeb4c46d --- /dev/null +++ b/internal/xds/translator/testdata/in/xds-ir/client-listener-scoped-timeout.yaml @@ -0,0 +1,44 @@ +http: + - name: "first-listener" + address: "::" + port: 10080 + hostnames: + - "*" + path: + mergeSlashes: true + escapedSlashesAction: UnescapeAndRedirect + routes: + - name: "first-route" + hostname: "*" + destination: + name: "first-route-dest" + settings: + - endpoints: + - host: "1.2.3.4" + port: 50000 + name: "first-route-dest/backend/0" + timeout: + tcp: + connectionInspectionTimeout: "15s" + http: + requestReceivedTimeout: "5s" + idleTimeout: "10s" + - name: "second-listener" + address: "::" + port: 10080 + hostnames: + - "*" + routes: + - name: "second-route" + hostname: "*" + destination: + name: "second-route-dest" + settings: + - endpoints: + - host: "1.2.3.4" + port: 50000 + name: "second-route-dest/backend/0" + timeout: + tcp: + connectionInspectionTimeout: "10s" + idleTimeout: "1200s" diff --git a/internal/xds/translator/testdata/in/xds-ir/client-timeout.yaml b/internal/xds/translator/testdata/in/xds-ir/client-timeout.yaml index 41dec4d635..aa60c07b02 100644 --- a/internal/xds/translator/testdata/in/xds-ir/client-timeout.yaml +++ b/internal/xds/translator/testdata/in/xds-ir/client-timeout.yaml @@ -20,6 +20,30 @@ http: timeout: http: requestReceivedTimeout: "5s" + requestHeadersReceivedTimeout: "15s" + idleTimeout: "10s" + - name: "third-listener" + address: "::" + port: 10080 + hostnames: + - "*" + path: + mergeSlashes: true + escapedSlashesAction: UnescapeAndRedirect + routes: + - name: "third-route" + hostname: "*" + destination: + name: "third-route-dest" + settings: + - endpoints: + - host: "1.2.3.4" + port: 50000 + name: "third-route-dest/backend/0" + timeout: + http: + requestReceivedTimeout: "10s" + requestHeadersReceivedTimeout: "30s" idleTimeout: "10s" tcp: - name: "second-listener" diff --git a/internal/xds/translator/testdata/in/xds-ir/httproute-with-tls-and-tls-handshake-timeout.yaml b/internal/xds/translator/testdata/in/xds-ir/httproute-with-tls-and-tls-handshake-timeout.yaml new file mode 100644 index 0000000000..1d1dfa5c78 --- /dev/null +++ b/internal/xds/translator/testdata/in/xds-ir/httproute-with-tls-and-tls-handshake-timeout.yaml @@ -0,0 +1,69 @@ +http: +- address: 0.0.0.0 + externalPort: 80 + hostnames: + - '*' + metadata: + kind: Gateway + name: gateway-1 + namespace: envoy-gateway + sectionName: http + name: envoy-gateway/gateway-1/http + path: + escapedSlashesAction: UnescapeAndRedirect + mergeSlashes: true + port: 10080 + timeout: + tcp: + tlsHandshakeTimeout: "5s" + routes: + - destination: + metadata: + kind: HTTPRoute + name: httproute-1 + namespace: default + name: httproute/default/httproute-1/rule/0 + settings: + - addressType: IP + endpoints: + - host: 1.1.1.1 + port: 3001 + metadata: + kind: Backend + name: backend-1 + namespace: default + name: httproute/default/httproute-1/rule/0/backend/0 + protocol: HTTP + tls: + alpnProtocols: null + caCertificate: + name: system_ca_certificates + sni: example.com + subjectAltNames: + - uri: spiffe://cluster.local/ns/istio-demo/sa/echo-v1 + - hostname: subdomain.secondexample.com + useSystemTrustStore: true + weight: 1 + - addressType: IP + endpoints: + - host: 7.7.7.7 + port: 8080 + metadata: + kind: Service + name: service-1 + namespace: default + sectionName: "8080" + name: httproute/default/httproute-1/rule/0/backend/1 + protocol: HTTP + weight: 1 + hostname: '*' + isHTTP2: false + metadata: + kind: HTTPRoute + name: httproute-1 + namespace: default + name: httproute/default/httproute-1/rule/0/match/0/* + pathMatch: + distinct: false + name: "" + prefix: / diff --git a/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.clusters.yaml new file mode 100644 index 0000000000..2597993e4b --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.clusters.yaml @@ -0,0 +1,46 @@ +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: first-route-dest + ignoreHealthOnHostRemoval: true + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + name: first-route-dest + perConnectionBufferLimitBytes: 32768 + type: EDS +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: second-route-dest + ignoreHealthOnHostRemoval: true + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + name: second-route-dest + perConnectionBufferLimitBytes: 32768 + type: EDS diff --git a/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.endpoints.yaml new file mode 100644 index 0000000000..de95bf555b --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.endpoints.yaml @@ -0,0 +1,24 @@ +- clusterName: first-route-dest + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 1.2.3.4 + portValue: 50000 + loadBalancingWeight: 1 + loadBalancingWeight: 1 + locality: + region: first-route-dest/backend/0 +- clusterName: second-route-dest + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 1.2.3.4 + portValue: 50000 + loadBalancingWeight: 1 + loadBalancingWeight: 1 + locality: + region: second-route-dest/backend/0 diff --git a/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.listeners.yaml new file mode 100644 index 0000000000..bb855d11b7 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.listeners.yaml @@ -0,0 +1,39 @@ +- address: + socketAddress: + address: '::' + portValue: 10080 + defaultFilterChain: + filters: + - name: envoy.filters.network.http_connection_manager + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + commonHttpProtocolOptions: + headersWithUnderscoresAction: REJECT_REQUEST + idleTimeout: 10s + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + maxConcurrentStreams: 100 + httpFilters: + - name: envoy.filters.http.router + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + suppressEnvoyHeaders: true + mergeSlashes: true + normalizePath: true + pathWithEscapedSlashesAction: UNESCAPE_AND_REDIRECT + rds: + configSource: + ads: {} + initialFetchTimeout: 0s + resourceApiVersion: V3 + routeConfigName: first-listener + requestTimeout: 5s + serverHeaderTransformation: PASS_THROUGH + statPrefix: http-10080 + useRemoteAddress: true + name: first-listener + listenerFiltersTimeout: 15s + maxConnectionsToAcceptPerSocketEvent: 1 + name: first-listener + perConnectionBufferLimitBytes: 32768 diff --git a/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.routes.yaml new file mode 100644 index 0000000000..1dcebeacae --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/client-listener-scoped-timeout.routes.yaml @@ -0,0 +1,25 @@ +- ignorePortInHostMatching: true + name: first-listener + virtualHosts: + - domains: + - '*' + name: first-listener/* + routes: + - match: + prefix: / + name: first-route + route: + cluster: first-route-dest + upgradeConfigs: + - upgradeType: websocket + - domains: + - '*' + name: second-listener/* + routes: + - match: + prefix: / + name: second-route + route: + cluster: second-route-dest + upgradeConfigs: + - upgradeType: websocket diff --git a/internal/xds/translator/testdata/out/xds-ir/client-timeout.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/client-timeout.clusters.yaml index 2597993e4b..5eae9bf48b 100644 --- a/internal/xds/translator/testdata/out/xds-ir/client-timeout.clusters.yaml +++ b/internal/xds/translator/testdata/out/xds-ir/client-timeout.clusters.yaml @@ -21,6 +21,29 @@ name: first-route-dest perConnectionBufferLimitBytes: 32768 type: EDS +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: third-route-dest + ignoreHealthOnHostRemoval: true + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + name: third-route-dest + perConnectionBufferLimitBytes: 32768 + type: EDS - circuitBreakers: thresholds: - maxRetries: 1024 diff --git a/internal/xds/translator/testdata/out/xds-ir/client-timeout.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/client-timeout.endpoints.yaml index de95bf555b..4fd71e06bc 100644 --- a/internal/xds/translator/testdata/out/xds-ir/client-timeout.endpoints.yaml +++ b/internal/xds/translator/testdata/out/xds-ir/client-timeout.endpoints.yaml @@ -10,6 +10,18 @@ loadBalancingWeight: 1 locality: region: first-route-dest/backend/0 +- clusterName: third-route-dest + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 1.2.3.4 + portValue: 50000 + loadBalancingWeight: 1 + loadBalancingWeight: 1 + locality: + region: third-route-dest/backend/0 - clusterName: second-route-dest endpoints: - lbEndpoints: diff --git a/internal/xds/translator/testdata/out/xds-ir/client-timeout.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/client-timeout.listeners.yaml index 68152145e6..a9cad7b76e 100644 --- a/internal/xds/translator/testdata/out/xds-ir/client-timeout.listeners.yaml +++ b/internal/xds/translator/testdata/out/xds-ir/client-timeout.listeners.yaml @@ -28,6 +28,7 @@ initialFetchTimeout: 0s resourceApiVersion: V3 routeConfigName: first-listener + requestHeadersTimeout: 15s requestTimeout: 5s serverHeaderTransformation: PASS_THROUGH statPrefix: http-10080 diff --git a/internal/xds/translator/testdata/out/xds-ir/client-timeout.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/client-timeout.routes.yaml index 0b5b4bee7b..1e8d71a7af 100644 --- a/internal/xds/translator/testdata/out/xds-ir/client-timeout.routes.yaml +++ b/internal/xds/translator/testdata/out/xds-ir/client-timeout.routes.yaml @@ -12,3 +12,14 @@ cluster: first-route-dest upgradeConfigs: - upgradeType: websocket + - domains: + - '*' + name: third-listener/* + routes: + - match: + prefix: / + name: third-route + route: + cluster: third-route-dest + upgradeConfigs: + - upgradeType: websocket diff --git a/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.clusters.yaml new file mode 100644 index 0000000000..01323ebea6 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.clusters.yaml @@ -0,0 +1,55 @@ +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: httproute/default/httproute-1/rule/0 + ignoreHealthOnHostRemoval: true + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + metadata: + filterMetadata: + envoy-gateway: + resources: + - kind: HTTPRoute + name: httproute-1 + namespace: default + name: httproute/default/httproute-1/rule/0 + perConnectionBufferLimitBytes: 32768 + transportSocketMatches: + - match: + name: httproute/default/httproute-1/rule/0/tls/0 + name: httproute/default/httproute-1/rule/0/tls/0 + transportSocket: + name: envoy.transport_sockets.tls + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: + combinedValidationContext: + defaultValidationContext: + matchTypedSubjectAltNames: + - matcher: + exact: spiffe://cluster.local/ns/istio-demo/sa/echo-v1 + sanType: URI + - matcher: + exact: subdomain.secondexample.com + sanType: DNS + validationContextSdsSecretConfig: + name: system_ca_certificates + sdsConfig: + ads: {} + initialFetchTimeout: 0s + resourceApiVersion: V3 + sni: example.com + type: EDS diff --git a/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.endpoints.yaml new file mode 100644 index 0000000000..73cc915bf5 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.endpoints.yaml @@ -0,0 +1,41 @@ +- clusterName: httproute/default/httproute-1/rule/0 + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 1.1.1.1 + portValue: 3001 + loadBalancingWeight: 1 + metadata: + filterMetadata: + envoy.transport_socket_match: + name: httproute/default/httproute-1/rule/0/tls/0 + loadBalancingWeight: 1 + locality: + region: httproute/default/httproute-1/rule/0/backend/0 + metadata: + filterMetadata: + envoy-gateway: + resources: + - kind: Backend + name: backend-1 + namespace: default + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 7.7.7.7 + portValue: 8080 + loadBalancingWeight: 1 + loadBalancingWeight: 1 + locality: + region: httproute/default/httproute-1/rule/0/backend/1 + metadata: + filterMetadata: + envoy-gateway: + resources: + - kind: Service + name: service-1 + namespace: default + sectionName: "8080" diff --git a/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.listeners.yaml new file mode 100644 index 0000000000..769bb42e06 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.listeners.yaml @@ -0,0 +1,37 @@ +- address: + socketAddress: + address: 0.0.0.0 + portValue: 10080 + defaultFilterChain: + filters: + - name: envoy.filters.network.http_connection_manager + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + commonHttpProtocolOptions: + headersWithUnderscoresAction: REJECT_REQUEST + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + maxConcurrentStreams: 100 + httpFilters: + - name: envoy.filters.http.router + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + suppressEnvoyHeaders: true + mergeSlashes: true + normalizePath: true + pathWithEscapedSlashesAction: UNESCAPE_AND_REDIRECT + rds: + configSource: + ads: {} + initialFetchTimeout: 0s + resourceApiVersion: V3 + routeConfigName: envoy-gateway/gateway-1/http + serverHeaderTransformation: PASS_THROUGH + statPrefix: http-10080 + useRemoteAddress: true + name: envoy-gateway/gateway-1/http + transportSocketConnectTimeout: 5s + maxConnectionsToAcceptPerSocketEvent: 1 + name: envoy-gateway/gateway-1/http + perConnectionBufferLimitBytes: 32768 diff --git a/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.routes.yaml new file mode 100644 index 0000000000..fd6fc1cacd --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.routes.yaml @@ -0,0 +1,29 @@ +- ignorePortInHostMatching: true + name: envoy-gateway/gateway-1/http + virtualHosts: + - domains: + - '*' + metadata: + filterMetadata: + envoy-gateway: + resources: + - kind: Gateway + name: gateway-1 + namespace: envoy-gateway + sectionName: http + name: envoy-gateway/gateway-1/http/* + routes: + - match: + prefix: / + metadata: + filterMetadata: + envoy-gateway: + resources: + - kind: HTTPRoute + name: httproute-1 + namespace: default + name: httproute/default/httproute-1/rule/0/match/0/* + route: + cluster: httproute/default/httproute-1/rule/0 + upgradeConfigs: + - upgradeType: websocket diff --git a/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.secrets.yaml b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.secrets.yaml new file mode 100644 index 0000000000..b522884fef --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/httproute-with-tls-and-tls-handshake-timeout.secrets.yaml @@ -0,0 +1,4 @@ +- name: system_ca_certificates + validationContext: + trustedCa: + filename: /etc/ssl/certs/ca-certificates.crt