feat(translator): active healthcheck logs

[guydc]

API

Adds support for configuring Envoy health check event logging via the EnvoyProxy API as well as BTP/ClusterSettings HC. Health check events (probe outcomes) can be written as JSON to a file sink (defaults to /dev/stdout).

• New ProxyHealthCheckLog type with matches (event filter) and sinks (file sink)
• healthCheckLog field added to ProxyTelemetry (EnvoyProxy.spec.telemetry)
• healthCheckLog field added to ActiveHealthCheck for per-backend configuration
• Enum values: Failure, FailureSeriesStart, Success, HealthyTransition
  • Failure - any HC failure
  • FailureSeriesStart - the first failure after previous success
  • Success - any HC success
  • HealthyTransition - the first success after previous failures AND the transition to healthy state (crossing health threshold)
• Failure and success types must be paired - it's impossible to enable success/failure without enabling some mode (all, just transition) for the other, this is an envoy API limitation,

Translation

EnvoyProxy :

• processHealthCheckLog() sets ir.Xds.HealthCheckLog from EnvoyProxy.spec.telemetry
• Threaded via ExtraArgs through HTTP/TCP/UDP listener → route cluster translation

BTP/ClusterSettings:

• ActiveHealthCheck.healthCheckLog in BTP/EEP/SecurityPolicy backendSettings
• buildHealthCheck() sets ir.ActiveHealthCheck.BackendHealthCheckLog
• Covers ext-proc, ext-auth, tracing backends via their own backendSettings
• Takes precedence over gateway-level healthCheckLog for that specific cluster

Closes #8753, #9381

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

---

PR Checklist

• Authorship & ownership: Coding agents / AI assistants are welcome, but I have reviewed every change, understand how and why it works, can explain and maintain it, and take full responsibility for this PR. I have not submitted generated output I do not understand.
• DCO: All commits are signed off (git commit -s). See DCO: Sign your work.
• API agreed first: If this PR contains API changes (changes under /api), the API was discussed and agreed before the implementation. The API change can be in a separate PR, or in the same PR, but the API must be agreed before implementation. N/A if this PR does not contain API changes.
• Required checks pass: make generate gen-check, make lint, and the unit-test/coverage build pass. (Flaky e2e failures are not considered breakages, but gen-check, lint, and coverage MUST pass.)
• Tests added/updated: New/changed code is covered by appropriate tests. N/A if this PR does not contain code changes.
• Docs: User-facing changes update the docs, either in this PR or a follow-up PR. N/A if this PR does not contain user-facing changes.
• Release notes: For any non-trivial change, added a release-note fragment under release-notes/current/<section>/<pr-number>-<slug>.md (see release-notes/current/README.md for sections and naming). N/A if this PR does not contain non-trivial changes.
• Generated files committed: Ran make gen-check and committed the result if API/helm charts/modules changed.
• Scope & compatibility: The PR is reasonably scoped (no unrelated changes) and preserves backward compatibility, or any breaking change is called out above and documented in release-notes/current/breaking_changes/.
• Codex review: Requested a Codex review and addressed all of its comments.
• Copilot review: Requested a Copilot review and addressed all of its comments.

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	36503ea
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a73f9dd7384650007babcc4
😎 Deploy Preview	https://deploy-preview-9651--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[guydc]

@codex

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 95849ddd4b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[codecov]

Codecov Report

❌ Patch coverage is 91.20879% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.18%. Comparing base (3afe13e) to head (36503ea).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/gatewayapi/listener.go	87.50%	3 Missing and 1 partial ⚠️
internal/xds/translator/cluster.go	84.00%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9651      +/-   ##
==========================================
- Coverage   76.18%   76.18%   -0.01%     
==========================================
  Files         261      261              
  Lines       43528    43589      +61     
==========================================
+ Hits        33162    33208      +46     
- Misses       8165     8173       +8     
- Partials     2201     2208       +7     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[guydc]

cc @arkodg , @zirain - sorry, created another PR, the merge got messy.

[zhaohuabing]

/retest