diff --git a/api/v1alpha1/envoyproxy_types.go b/api/v1alpha1/envoyproxy_types.go index 5d688099a6..c35a3922fc 100644 --- a/api/v1alpha1/envoyproxy_types.go +++ b/api/v1alpha1/envoyproxy_types.go @@ -6,6 +6,7 @@ package v1alpha1 import ( + apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" gwapiv1 "sigs.k8s.io/gateway-api/apis/v1" ) @@ -67,6 +68,32 @@ type EnvoyProxySpec struct { // +optional Bootstrap *ProxyBootstrap `json:"bootstrap,omitempty"` + // Runtime defines Envoy runtime values for managed proxies, as a map of runtime key + // to value. Values are typed: numbers, booleans and strings are all preserved as + // written, which matters because Envoy resolves boolean runtime guards only from real + // booleans and numeric limits only from numbers or numeric strings. + // + // Runtime values are delivered over RTDS, so changes apply to running proxies without + // a restart and without triggering a CDS update. + // + // One use is tuning circuit breakers on clusters that Envoy Gateway does not build from + // its own configuration, such as clusters added by an extension server, which otherwise + // keep Envoy's built-in defaults: + // + // runtime: + // circuit_breakers.my-extension-cluster.default.max_requests: 16384 + // + // Runtime keys are an Envoy-level interface and are not validated by Envoy Gateway. + // Visit https://www.envoyproxy.io/docs/envoy/latest/configuration/operations/runtime + // to learn more about the available keys. + // + // Note: this has no effect when spec.bootstrap uses the Replace type with a bootstrap + // that omits the RTDS layer, since the proxy then has no layer for these values to + // land in. + // + // +optional + Runtime map[string]apiextensionsv1.JSON `json:"runtime,omitempty"` + // Concurrency defines the number of worker threads to run. If unset, it defaults to // the number of cpuset threads on the platform. // diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index 7730ebed2b..ff56cc1ca5 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -3345,6 +3345,13 @@ func (in *EnvoyProxySpec) DeepCopyInto(out *EnvoyProxySpec) { *out = new(ProxyBootstrap) (*in).DeepCopyInto(*out) } + if in.Runtime != nil { + in, out := &in.Runtime, &out.Runtime + *out = make(map[string]apiextensionsv1.JSON, len(*in)) + for key, val := range *in { + (*out)[key] = *val.DeepCopy() + } + } if in.Concurrency != nil { in, out := &in.Concurrency, &out.Concurrency *out = new(int32) diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml index 9e52118274..6945191516 100644 --- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml +++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml @@ -11299,6 +11299,27 @@ spec: RoutingType can be set to "Service" to use the Service Cluster IP for routing to the backend, or it can be set to "Endpoint" to use Endpoint routing. The default is "Endpoint". type: string + runtime: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: "Runtime defines Envoy runtime values for managed proxies, + as a map of runtime key\nto value. Values are typed: numbers, booleans + and strings are all preserved as\nwritten, which matters because + Envoy resolves boolean runtime guards only from real\nbooleans and + numeric limits only from numbers or numeric strings.\n\nRuntime + values are delivered over RTDS, so changes apply to running proxies + without\na restart and without triggering a CDS update.\n\nOne use + is tuning circuit breakers on clusters that Envoy Gateway does not + build from\nits own configuration, such as clusters added by an + extension server, which otherwise\nkeep Envoy's built-in defaults:\n\n\truntime:\n\t + \ circuit_breakers.my-extension-cluster.default.max_requests: 16384\n\nRuntime + keys are an Envoy-level interface and are not validated by Envoy + Gateway.\nVisit https://www.envoyproxy.io/docs/envoy/latest/configuration/operations/runtime\nto + learn more about the available keys.\n\nNote: this has no effect + when spec.bootstrap uses the Replace type with a bootstrap\nthat + omits the RTDS layer, since the proxy then has no layer for these + values to\nland in." + type: object shutdown: description: Shutdown defines configuration for graceful envoy shutdown process. diff --git a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml index 256ae54218..c6e072839c 100644 --- a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml +++ b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml @@ -11298,6 +11298,27 @@ spec: RoutingType can be set to "Service" to use the Service Cluster IP for routing to the backend, or it can be set to "Endpoint" to use Endpoint routing. The default is "Endpoint". type: string + runtime: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: "Runtime defines Envoy runtime values for managed proxies, + as a map of runtime key\nto value. Values are typed: numbers, booleans + and strings are all preserved as\nwritten, which matters because + Envoy resolves boolean runtime guards only from real\nbooleans and + numeric limits only from numbers or numeric strings.\n\nRuntime + values are delivered over RTDS, so changes apply to running proxies + without\na restart and without triggering a CDS update.\n\nOne use + is tuning circuit breakers on clusters that Envoy Gateway does not + build from\nits own configuration, such as clusters added by an + extension server, which otherwise\nkeep Envoy's built-in defaults:\n\n\truntime:\n\t + \ circuit_breakers.my-extension-cluster.default.max_requests: 16384\n\nRuntime + keys are an Envoy-level interface and are not validated by Envoy + Gateway.\nVisit https://www.envoyproxy.io/docs/envoy/latest/configuration/operations/runtime\nto + learn more about the available keys.\n\nNote: this has no effect + when spec.bootstrap uses the Replace type with a bootstrap\nthat + omits the RTDS layer, since the proxy then has no layer for these + values to\nland in." + type: object shutdown: description: Shutdown defines configuration for graceful envoy shutdown process. diff --git a/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml b/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml index bcf5648d02..b7258bcaf8 100644 --- a/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml +++ b/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml @@ -42,6 +42,12 @@ envoyProxyForGatewayClass: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC @@ -604,6 +610,12 @@ xds: staticLayer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtdsLayer: + name: envoy-gateway-runtime + rtdsConfig: + ads: {} + resourceApiVersion: V3 node: locality: zone: $(ENVOY_SERVICE_ZONE) diff --git a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json index b02a150723..d4c513c7ad 100644 --- a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json +++ b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json @@ -60,6 +60,16 @@ "re2.max_program_size.error_level": 4294967295, "re2.max_program_size.warn_level": 1000 } + }, + { + "name": "envoy-gateway-runtime", + "rtdsLayer": { + "name": "envoy-gateway-runtime", + "rtdsConfig": { + "ads": {}, + "resourceApiVersion": "V3" + } + } } ] }, diff --git a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml index 79bcc33d3e..0377f40149 100644 --- a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml +++ b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml @@ -39,6 +39,12 @@ xds: staticLayer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtdsLayer: + name: envoy-gateway-runtime + rtdsConfig: + ads: {} + resourceApiVersion: V3 node: locality: zone: $(ENVOY_SERVICE_ZONE) diff --git a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.bootstrap.yaml b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.bootstrap.yaml index 1a2d208c47..13fdb01008 100644 --- a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.bootstrap.yaml +++ b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.bootstrap.yaml @@ -38,6 +38,12 @@ xds: staticLayer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtdsLayer: + name: envoy-gateway-runtime + rtdsConfig: + ads: {} + resourceApiVersion: V3 node: locality: zone: $(ENVOY_SERVICE_ZONE) diff --git a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.json b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.json index 88b621ae62..9a072e5c82 100644 --- a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.json +++ b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.json @@ -60,6 +60,16 @@ "re2.max_program_size.error_level": 4294967295, "re2.max_program_size.warn_level": 1000 } + }, + { + "name": "envoy-gateway-runtime", + "rtdsLayer": { + "name": "envoy-gateway-runtime", + "rtdsConfig": { + "ads": {}, + "resourceApiVersion": "V3" + } + } } ] }, diff --git a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.yaml b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.yaml index 67d2f0e2c0..1ec237b4d8 100644 --- a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.yaml +++ b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.yaml @@ -39,6 +39,12 @@ xds: staticLayer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtdsLayer: + name: envoy-gateway-runtime + rtdsConfig: + ads: {} + resourceApiVersion: V3 node: locality: zone: $(ENVOY_SERVICE_ZONE) diff --git a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.bootstrap.yaml b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.bootstrap.yaml index 6c918178dd..725f406d42 100644 --- a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.bootstrap.yaml +++ b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.bootstrap.yaml @@ -38,6 +38,12 @@ xds: staticLayer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtdsLayer: + name: envoy-gateway-runtime + rtdsConfig: + ads: {} + resourceApiVersion: V3 node: locality: zone: $(ENVOY_SERVICE_ZONE) diff --git a/internal/cmd/egctl/testdata/translate/out/no-service-cluster-ip.all.yaml b/internal/cmd/egctl/testdata/translate/out/no-service-cluster-ip.all.yaml index 4fc1f2c406..94ebd5402d 100644 --- a/internal/cmd/egctl/testdata/translate/out/no-service-cluster-ip.all.yaml +++ b/internal/cmd/egctl/testdata/translate/out/no-service-cluster-ip.all.yaml @@ -39,6 +39,12 @@ xds: staticLayer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtdsLayer: + name: envoy-gateway-runtime + rtdsConfig: + ads: {} + resourceApiVersion: V3 node: locality: zone: $(ENVOY_SERVICE_ZONE) diff --git a/internal/gatewayapi/testdata/envoyproxy-runtime.in.yaml b/internal/gatewayapi/testdata/envoyproxy-runtime.in.yaml new file mode 100644 index 0000000000..e1cc681945 --- /dev/null +++ b/internal/gatewayapi/testdata/envoyproxy-runtime.in.yaml @@ -0,0 +1,75 @@ +envoyProxyForGatewayClass: + apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyProxy + metadata: + name: custom-proxy-config + namespace: envoy-gateway-system + spec: + runtime: + circuit_breakers.ai-gateway-extproc-uds.default.max_requests: 16384 + envoy.reloadable_features.some_feature: false + some.string.key: "a string" +gateways: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + namespace: envoy-gateway + name: gateway-1 + spec: + gatewayClassName: envoy-gateway-class + listeners: + - name: http + protocol: HTTP + port: 80 + allowedRoutes: + namespaces: + from: All +httpRoutes: + - apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + namespace: envoy-gateway + name: httproute-1 + spec: + parentRefs: + - namespace: envoy-gateway + name: gateway-1 + sectionName: http + rules: + - matches: + - path: + value: "/" + backendRefs: + - name: service-1 + port: 8080 +services: + - apiVersion: v1 + kind: Service + metadata: + namespace: envoy-gateway + name: service-1 + spec: + selector: + app: service-1 + ports: + - name: http + protocol: TCP + port: 8080 +endpointslices: + - apiVersion: discovery.k8s.io/v1 + kind: EndpointSlice + metadata: + namespace: envoy-gateway + name: service-1 + labels: + kubernetes.io/service-name: service-1 + addressType: IPv4 + ports: + - name: http + protocol: TCP + port: 8080 + endpoints: + - addresses: + - 7.7.7.7 + conditions: + ready: true diff --git a/internal/gatewayapi/testdata/envoyproxy-runtime.out.yaml b/internal/gatewayapi/testdata/envoyproxy-runtime.out.yaml new file mode 100644 index 0000000000..f8a0baaeb8 --- /dev/null +++ b/internal/gatewayapi/testdata/envoyproxy-runtime.out.yaml @@ -0,0 +1,189 @@ +gateways: +- apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + metadata: + name: gateway-1 + namespace: envoy-gateway + spec: + gatewayClassName: envoy-gateway-class + listeners: + - allowedRoutes: + namespaces: + from: All + name: http + port: 80 + protocol: HTTP + status: + listeners: + - attachedRoutes: 1 + conditions: + - lastTransitionTime: null + message: Sending translated listener configuration to the data plane + reason: Programmed + status: "True" + type: Programmed + - lastTransitionTime: null + message: Listener has been successfully translated + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Listener references have been resolved + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + name: http + supportedKinds: + - group: gateway.networking.k8s.io + kind: HTTPRoute + - group: gateway.networking.k8s.io + kind: GRPCRoute +httpRoutes: +- apiVersion: gateway.networking.k8s.io/v1 + kind: HTTPRoute + metadata: + name: httproute-1 + namespace: envoy-gateway + spec: + parentRefs: + - name: gateway-1 + namespace: envoy-gateway + sectionName: http + rules: + - backendRefs: + - name: service-1 + port: 8080 + matches: + - path: + value: / + status: + parents: + - conditions: + - lastTransitionTime: null + message: Route is accepted + reason: Accepted + status: "True" + type: Accepted + - lastTransitionTime: null + message: Resolved all the Object references for the Route + reason: ResolvedRefs + status: "True" + type: ResolvedRefs + controllerName: gateway.envoyproxy.io/gatewayclass-controller + parentRef: + name: gateway-1 + namespace: envoy-gateway + sectionName: http +infraIR: + envoy-gateway/gateway-1: + proxy: + config: + apiVersion: gateway.envoyproxy.io/v1alpha1 + kind: EnvoyProxy + metadata: + name: custom-proxy-config + namespace: envoy-gateway-system + spec: + logging: {} + runtime: + circuit_breakers.ai-gateway-extproc-uds.default.max_requests: 16384 + envoy.reloadable_features.some_feature: false + some.string.key: a string + status: {} + listeners: + - name: envoy-gateway/gateway-1/http + ports: + - containerPort: 10080 + name: http-80 + protocol: HTTP + servicePort: 80 + metadata: + labels: + gateway.envoyproxy.io/owning-gateway-name: gateway-1 + gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway + ownerReference: + kind: GatewayClass + name: envoy-gateway-class + name: envoy-gateway/gateway-1 + namespace: envoy-gateway-system +xdsIR: + envoy-gateway/gateway-1: + accessLog: + json: + - path: /dev/stdout + globalResources: + proxyServiceCluster: + metadata: + kind: Service + name: envoy-envoy-gateway-gateway-1-196ae069 + namespace: envoy-gateway-system + sectionName: "8080" + name: envoy-gateway/gateway-1 + settings: + - addressType: IP + endpoints: + - host: 7.6.5.4 + port: 8080 + zone: zone1 + metadata: + kind: Service + name: envoy-envoy-gateway-gateway-1-196ae069 + namespace: envoy-gateway-system + sectionName: "8080" + name: envoy-gateway/gateway-1 + protocol: TCP + http: + - address: 0.0.0.0 + externalPort: 80 + hostnames: + - '*' + metadata: + kind: Gateway + name: gateway-1 + namespace: envoy-gateway + sectionName: http + name: envoy-gateway/gateway-1/http + path: + escapedSlashesAction: UnescapeAndRedirect + mergeSlashes: true + port: 10080 + routes: + - destination: + metadata: + kind: HTTPRoute + name: httproute-1 + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-1/rule/0 + settings: + - addressType: IP + endpoints: + - host: 7.7.7.7 + port: 8080 + metadata: + kind: Service + name: service-1 + namespace: envoy-gateway + sectionName: "8080" + name: httproute/envoy-gateway/httproute-1/rule/0/backend/0 + protocol: HTTP + weight: 1 + hostname: '*' + isHTTP2: false + metadata: + kind: HTTPRoute + name: httproute-1 + namespace: envoy-gateway + name: httproute/envoy-gateway/httproute-1/rule/0/match/0/* + pathMatch: + distinct: false + name: "" + prefix: / + readyListener: + address: 0.0.0.0 + ipFamily: IPv4 + path: /ready + port: 19003 + runtime: + circuit_breakers.ai-gateway-extproc-uds.default.max_requests: 16384 + envoy.reloadable_features.some_feature: false + some.string.key: a string diff --git a/internal/gatewayapi/translator.go b/internal/gatewayapi/translator.go index 88ebd0177e..ab47896fc5 100644 --- a/internal/gatewayapi/translator.go +++ b/internal/gatewayapi/translator.go @@ -408,6 +408,7 @@ func (t *Translator) Translate(resources *resource.Resources) (*TranslateResult, if gateway.envoyProxy != nil { irKey := t.getIRKey(gateway.Gateway) xdsIR[irKey].FilterOrder = gateway.envoyProxy.Spec.FilterOrder + xdsIR[irKey].Runtime = gateway.envoyProxy.Spec.Runtime } } diff --git a/internal/gatewayapi/translator_test.go b/internal/gatewayapi/translator_test.go index f17ee67748..1fcafd45f0 100644 --- a/internal/gatewayapi/translator_test.go +++ b/internal/gatewayapi/translator_test.go @@ -25,6 +25,7 @@ import ( "github.com/stretchr/testify/require" corev1 "k8s.io/api/core/v1" discoveryv1 "k8s.io/api/discovery/v1" + apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime/schema" "k8s.io/apimachinery/pkg/util/intstr" @@ -1206,6 +1207,7 @@ func xdsWithoutEqual(a *ir.Xds) any { UDP []*ir.UDPListener EnvoyPatchPolicies []*ir.EnvoyPatchPolicy FilterOrder []egv1a1.FilterPosition + Runtime map[string]apiextensionsv1.JSON GlobalResources *ir.GlobalResources ExtensionServerPolicies []*ir.UnstructuredRef BackendClusters []*ir.BackendCluster @@ -1219,6 +1221,7 @@ func xdsWithoutEqual(a *ir.Xds) any { UDP: a.UDP, EnvoyPatchPolicies: a.EnvoyPatchPolicies, FilterOrder: a.FilterOrder, + Runtime: a.Runtime, GlobalResources: a.GlobalResources, ExtensionServerPolicies: a.ExtensionServerPolicies, BackendClusters: a.BackendClusters, diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom-sa.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom-sa.yaml index 5b849a91ff..b6f3ad8527 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom-sa.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom-sa.yaml @@ -81,6 +81,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml index 36e98741d2..ddb80ab75e 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/custom.yaml @@ -79,6 +79,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml index 9ce90b8344..4631e69651 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default-env.yaml @@ -78,6 +78,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml index ed6074e8c4..93a110b5e2 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/default.yaml @@ -78,6 +78,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml index 4edacfce9e..ef36d6dc12 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/disable-prometheus.yaml @@ -74,6 +74,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml index 98a3f62604..e5aed90e07 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/extension-env.yaml @@ -78,6 +78,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml index 2951970462..adc351041c 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/gateway-namespace-mode.yaml @@ -81,6 +81,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml index 0c51b351af..837475ff41 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-labels-and-annotations.yaml @@ -87,6 +87,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-prometheus-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-prometheus-annotations.yaml index 5cebd2d3d6..a0d5517b44 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-prometheus-annotations.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/override-prometheus-annotations.yaml @@ -78,6 +78,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml index 7b3f348e74..c08abaf39a 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/patch-daemonset.yaml @@ -78,6 +78,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml index 6245fdcefa..82445e10a5 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/shutdown-manager.yaml @@ -78,6 +78,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml index 987c69baa2..afbce91d24 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/volumes.yaml @@ -78,6 +78,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml index 0c6a6e0c2e..030a57ea7b 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-annotations.yaml @@ -83,6 +83,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml index f15bf08dd7..f11f2c4f14 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-extra-args.yaml @@ -78,6 +78,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml index ba1253eecf..8dd36e0072 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-image-pull-secrets.yaml @@ -78,6 +78,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml index 7f2a065700..474a62a71c 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-name.yaml @@ -78,6 +78,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml index bde9a6c213..2fd1c9d7c7 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-node-selector.yaml @@ -78,6 +78,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-priority-class-name.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-priority-class-name.yaml index 78bce29224..db5dd91458 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-priority-class-name.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-priority-class-name.yaml @@ -78,6 +78,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml index 2bf7ff45f3..f88c8d806f 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/daemonsets/with-topology-spread-constraints.yaml @@ -78,6 +78,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom-sa.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom-sa.yaml index e36bb00ccb..e8be773115 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom-sa.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom-sa.yaml @@ -85,6 +85,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml index d521db18c8..2d6cf5327c 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml @@ -84,6 +84,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml index 75fc9f555f..f6ce2f67c4 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml @@ -84,6 +84,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml index e3b13bc7fb..849c4a5747 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml @@ -83,6 +83,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml index 9aa24a30ed..0ad7aaeb75 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml @@ -82,6 +82,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml index 3ddc66df13..c121060a57 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml @@ -78,6 +78,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml index 7d73d7404c..4f5b1d1809 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/dual-stack.yaml @@ -82,6 +82,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml index 1b0aa4f2c6..97691e0f1b 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml @@ -83,6 +83,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml index ef4cf53e86..c56646271a 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/gateway-namespace-mode.yaml @@ -85,6 +85,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml index a05ec174a5..eef11fe1f4 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/ipv6.yaml @@ -82,6 +82,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml index ed8b63ba1d..b1c601e07b 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml @@ -91,6 +91,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-prometheus-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-prometheus-annotations.yaml index af789318ce..c5e1da7672 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-prometheus-annotations.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/override-prometheus-annotations.yaml @@ -84,6 +84,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml index e4c70d4016..ad2b39b9a4 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml @@ -82,6 +82,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml index 186ae46b9e..002db2880f 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml @@ -82,6 +82,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml index 376631b989..df45bc9c72 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml @@ -83,6 +83,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml index a089f617ea..e85120589a 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml @@ -87,6 +87,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml index ffdf3aca32..602b0dcef8 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-empty-memory-limits.yaml @@ -82,6 +82,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml index 2135a8e657..8405956202 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml @@ -82,6 +82,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-hpa.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-hpa.yaml index 9aa24a30ed..0ad7aaeb75 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-hpa.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-hpa.yaml @@ -82,6 +82,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml index 79cc8c0717..187bda49e0 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml @@ -82,6 +82,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml index d63738f9ad..03910720bd 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-name.yaml @@ -82,6 +82,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml index b2a0e67221..ffaf6d1a78 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml @@ -82,6 +82,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-priority-class-name.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-priority-class-name.yaml index 244b77305a..776c185ccd 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-priority-class-name.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-priority-class-name.yaml @@ -82,6 +82,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml index e9157ec5f8..e48223d1f0 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml @@ -82,6 +82,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml b/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml index c28c157884..cb96b806a0 100644 --- a/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml +++ b/internal/infrastructure/kubernetes/proxy/testdata/gateway-namespace-mode/deployment.yaml @@ -85,6 +85,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC @@ -519,6 +525,12 @@ spec: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/ir/xds.go b/internal/ir/xds.go index 6d2fecc72d..dd039a01b8 100644 --- a/internal/ir/xds.go +++ b/internal/ir/xds.go @@ -179,6 +179,8 @@ type Xds struct { EnvoyPatchPolicies []*EnvoyPatchPolicy `json:"envoyPatchPolicies,omitempty" yaml:"envoyPatchPolicies,omitempty"` // FilterOrder holds the custom order of the HTTP filters FilterOrder []egv1a1.FilterPosition `json:"filterOrder,omitempty" yaml:"filterOrder,omitempty"` + // Runtime holds Envoy runtime values delivered to the proxy over RTDS. + Runtime map[string]apiextensionsv1.JSON `json:"runtime,omitempty" yaml:"runtime,omitempty"` // GlobalResources holds the global resources used by the Envoy, for example, the envoy client certificate and the OIDC HMAC secret GlobalResources *GlobalResources `json:"globalResources,omitempty" yaml:"globalResources,omitempty"` // ExtensionServerPolicies is the intermediate representation of the ExtensionServerPolicy resource diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go index d6f990c42c..75e9f20bf9 100644 --- a/internal/ir/zz_generated.deepcopy.go +++ b/internal/ir/zz_generated.deepcopy.go @@ -5636,6 +5636,13 @@ func (in *Xds) DeepCopyInto(out *Xds) { (*in)[i].DeepCopyInto(&(*out)[i]) } } + if in.Runtime != nil { + in, out := &in.Runtime, &out.Runtime + *out = make(map[string]apiextensionsv1.JSON, len(*in)) + for key, val := range *in { + (*out)[key] = *val.DeepCopy() + } + } if in.GlobalResources != nil { in, out := &in.GlobalResources, &out.GlobalResources *out = new(GlobalResources) diff --git a/internal/xds/bootstrap/bootstrap.yaml.tpl b/internal/xds/bootstrap/bootstrap.yaml.tpl index 5bb717dc4f..2fc9b7fff8 100644 --- a/internal/xds/bootstrap/bootstrap.yaml.tpl +++ b/internal/xds/bootstrap/bootstrap.yaml.tpl @@ -53,6 +53,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/merge/default.out.yaml b/internal/xds/bootstrap/testdata/merge/default.out.yaml index 02bdc687b5..76da6422f8 100644 --- a/internal/xds/bootstrap/testdata/merge/default.out.yaml +++ b/internal/xds/bootstrap/testdata/merge/default.out.yaml @@ -34,6 +34,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 - name: runtime-0 rtds_layer: name: runtime-0 diff --git a/internal/xds/bootstrap/testdata/merge/merge-user-bootstrap.out.yaml b/internal/xds/bootstrap/testdata/merge/merge-user-bootstrap.out.yaml index 71163b790d..5651218903 100644 --- a/internal/xds/bootstrap/testdata/merge/merge-user-bootstrap.out.yaml +++ b/internal/xds/bootstrap/testdata/merge/merge-user-bootstrap.out.yaml @@ -34,6 +34,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 node: locality: zone: $(ENVOY_SERVICE_ZONE) diff --git a/internal/xds/bootstrap/testdata/merge/patch-global-config.out.yaml b/internal/xds/bootstrap/testdata/merge/patch-global-config.out.yaml index c6baee4ed8..fb87bef1e8 100644 --- a/internal/xds/bootstrap/testdata/merge/patch-global-config.out.yaml +++ b/internal/xds/bootstrap/testdata/merge/patch-global-config.out.yaml @@ -36,6 +36,12 @@ layered_runtime: envoy.something.completely.made.up: arbitrary string re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 node: locality: zone: $(ENVOY_SERVICE_ZONE) diff --git a/internal/xds/bootstrap/testdata/merge/stats_sinks.out.yaml b/internal/xds/bootstrap/testdata/merge/stats_sinks.out.yaml index 905f9ee4d0..6630115b53 100644 --- a/internal/xds/bootstrap/testdata/merge/stats_sinks.out.yaml +++ b/internal/xds/bootstrap/testdata/merge/stats_sinks.out.yaml @@ -34,6 +34,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 node: locality: zone: $(ENVOY_SERVICE_ZONE) diff --git a/internal/xds/bootstrap/testdata/render/custom-server-port.yaml b/internal/xds/bootstrap/testdata/render/custom-server-port.yaml index eb97437287..4f6e5d9f91 100644 --- a/internal/xds/bootstrap/testdata/render/custom-server-port.yaml +++ b/internal/xds/bootstrap/testdata/render/custom-server-port.yaml @@ -32,6 +32,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/render/custom-stats-matcher.yaml b/internal/xds/bootstrap/testdata/render/custom-stats-matcher.yaml index 65c9f2899b..8621fe5177 100644 --- a/internal/xds/bootstrap/testdata/render/custom-stats-matcher.yaml +++ b/internal/xds/bootstrap/testdata/render/custom-stats-matcher.yaml @@ -42,6 +42,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/render/disable-prometheus.yaml b/internal/xds/bootstrap/testdata/render/disable-prometheus.yaml index 4a7ecbbc47..9ccd0f3a92 100644 --- a/internal/xds/bootstrap/testdata/render/disable-prometheus.yaml +++ b/internal/xds/bootstrap/testdata/render/disable-prometheus.yaml @@ -32,6 +32,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/render/enable-prometheus-brotli-compression.yaml b/internal/xds/bootstrap/testdata/render/enable-prometheus-brotli-compression.yaml index f924481193..f028069768 100644 --- a/internal/xds/bootstrap/testdata/render/enable-prometheus-brotli-compression.yaml +++ b/internal/xds/bootstrap/testdata/render/enable-prometheus-brotli-compression.yaml @@ -32,6 +32,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/render/enable-prometheus-gzip-compression.yaml b/internal/xds/bootstrap/testdata/render/enable-prometheus-gzip-compression.yaml index e3b9414663..232e85e7be 100644 --- a/internal/xds/bootstrap/testdata/render/enable-prometheus-gzip-compression.yaml +++ b/internal/xds/bootstrap/testdata/render/enable-prometheus-gzip-compression.yaml @@ -32,6 +32,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/render/enable-prometheus-zstd-compression.yaml b/internal/xds/bootstrap/testdata/render/enable-prometheus-zstd-compression.yaml index 4b15fe4f2d..125706897f 100644 --- a/internal/xds/bootstrap/testdata/render/enable-prometheus-zstd-compression.yaml +++ b/internal/xds/bootstrap/testdata/render/enable-prometheus-zstd-compression.yaml @@ -32,6 +32,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/render/enable-prometheus.yaml b/internal/xds/bootstrap/testdata/render/enable-prometheus.yaml index fe56092ec4..725739f81b 100644 --- a/internal/xds/bootstrap/testdata/render/enable-prometheus.yaml +++ b/internal/xds/bootstrap/testdata/render/enable-prometheus.yaml @@ -32,6 +32,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/render/ipv6.yaml b/internal/xds/bootstrap/testdata/render/ipv6.yaml index 507084264c..84a3013a1c 100644 --- a/internal/xds/bootstrap/testdata/render/ipv6.yaml +++ b/internal/xds/bootstrap/testdata/render/ipv6.yaml @@ -32,6 +32,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/render/otel-metrics-backendref.yaml b/internal/xds/bootstrap/testdata/render/otel-metrics-backendref.yaml index c3f610b26c..7d075ebe82 100644 --- a/internal/xds/bootstrap/testdata/render/otel-metrics-backendref.yaml +++ b/internal/xds/bootstrap/testdata/render/otel-metrics-backendref.yaml @@ -32,6 +32,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/render/otel-metrics-custom-ca.yaml b/internal/xds/bootstrap/testdata/render/otel-metrics-custom-ca.yaml index dc5536b9f5..7d3536d659 100644 --- a/internal/xds/bootstrap/testdata/render/otel-metrics-custom-ca.yaml +++ b/internal/xds/bootstrap/testdata/render/otel-metrics-custom-ca.yaml @@ -32,6 +32,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/render/otel-metrics-delta-temporality.yaml b/internal/xds/bootstrap/testdata/render/otel-metrics-delta-temporality.yaml index e075f2b61b..d4bacced2e 100644 --- a/internal/xds/bootstrap/testdata/render/otel-metrics-delta-temporality.yaml +++ b/internal/xds/bootstrap/testdata/render/otel-metrics-delta-temporality.yaml @@ -32,6 +32,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/render/otel-metrics-headers.yaml b/internal/xds/bootstrap/testdata/render/otel-metrics-headers.yaml index 9b4cb47c55..23081ae79b 100644 --- a/internal/xds/bootstrap/testdata/render/otel-metrics-headers.yaml +++ b/internal/xds/bootstrap/testdata/render/otel-metrics-headers.yaml @@ -32,6 +32,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/render/otel-metrics-tls.yaml b/internal/xds/bootstrap/testdata/render/otel-metrics-tls.yaml index 47861651c0..7f4a525548 100644 --- a/internal/xds/bootstrap/testdata/render/otel-metrics-tls.yaml +++ b/internal/xds/bootstrap/testdata/render/otel-metrics-tls.yaml @@ -32,6 +32,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/render/otel-metrics.yaml b/internal/xds/bootstrap/testdata/render/otel-metrics.yaml index c3f610b26c..7d075ebe82 100644 --- a/internal/xds/bootstrap/testdata/render/otel-metrics.yaml +++ b/internal/xds/bootstrap/testdata/render/otel-metrics.yaml @@ -32,6 +32,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/render/topology-injector-disabled.yaml b/internal/xds/bootstrap/testdata/render/topology-injector-disabled.yaml index 443e0d7145..9dab7aabf8 100644 --- a/internal/xds/bootstrap/testdata/render/topology-injector-disabled.yaml +++ b/internal/xds/bootstrap/testdata/render/topology-injector-disabled.yaml @@ -30,6 +30,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/render/topology-injector-enabled.yaml b/internal/xds/bootstrap/testdata/render/topology-injector-enabled.yaml index 4a7ecbbc47..9ccd0f3a92 100644 --- a/internal/xds/bootstrap/testdata/render/topology-injector-enabled.yaml +++ b/internal/xds/bootstrap/testdata/render/topology-injector-enabled.yaml @@ -32,6 +32,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/render/with-max-heap-size-bytes.yaml b/internal/xds/bootstrap/testdata/render/with-max-heap-size-bytes.yaml index ebb96cee57..136466971b 100644 --- a/internal/xds/bootstrap/testdata/render/with-max-heap-size-bytes.yaml +++ b/internal/xds/bootstrap/testdata/render/with-max-heap-size-bytes.yaml @@ -32,6 +32,12 @@ layered_runtime: static_layer: re2.max_program_size.error_level: 4294967295 re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtds_layer: + name: envoy-gateway-runtime + rtds_config: + ads: {} + resource_api_version: V3 dynamic_resources: ads_config: api_type: DELTA_GRPC diff --git a/internal/xds/bootstrap/testdata/validate/duplicate-runtime-layer-bootstrap.yaml b/internal/xds/bootstrap/testdata/validate/duplicate-runtime-layer-bootstrap.yaml new file mode 100644 index 0000000000..8307dfce8b --- /dev/null +++ b/internal/xds/bootstrap/testdata/validate/duplicate-runtime-layer-bootstrap.yaml @@ -0,0 +1,81 @@ +admin: + accessLog: + - name: envoy.access_loggers.file + typedConfig: + '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog + path: /dev/null + address: + socketAddress: + address: 127.0.0.1 + portValue: 19000 +dynamicResources: + adsConfig: + apiType: DELTA_GRPC + grpcServices: + - envoyGrpc: + clusterName: xds_cluster + setNodeOnFirstMessageOnly: true + transportApiVersion: V3 + ldsConfig: + ads: {} + resourceApiVersion: V3 + initialFetchTimeout: 30s + cdsConfig: + ads: {} + resourceApiVersion: V3 + initialFetchTimeout: 30s +staticResources: + clusters: + - connectTimeout: 10s + loadAssignment: + clusterName: xds_cluster + endpoints: + - loadBalancingWeight: 1 + lbEndpoints: + - loadBalancingWeight: 1 + endpoint: + address: + socketAddress: + address: envoy-gateway + portValue: 18000 + name: xds_cluster + transportSocket: + name: envoy.transport_sockets.tls + typedConfig: + '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext + commonTlsContext: + tlsCertificateSdsSecretConfigs: + - name: xds_certificate + sdsConfig: + pathConfigSource: + path: /sds/xds-certificate.json + resourceApiVersion: V3 + tlsParams: + tlsMaximumProtocolVersion: TLSv1_3 + validationContextSdsSecretConfig: + name: xds_trusted_ca + sdsConfig: + pathConfigSource: + path: /sds/xds-trusted-ca.json + resourceApiVersion: V3 + type: STRICT_DNS + typedExtensionProtocolOptions: + envoy.extensions.upstreams.http.v3.HttpProtocolOptions: + '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions + explicitHttpConfig: + http2ProtocolOptions: {} +layeredRuntime: + layers: + - name: global_config + staticLayer: + re2.max_program_size.error_level: 4294967295 + re2.max_program_size.warn_level: 1000 + - name: envoy-gateway-runtime + rtdsLayer: + name: envoy-gateway-runtime + rtdsConfig: + ads: {} + resourceApiVersion: V3 + - name: envoy-gateway-runtime + staticLayer: + some.key: 1 diff --git a/internal/xds/bootstrap/validate.go b/internal/xds/bootstrap/validate.go index 9f47d16152..7977f235b6 100644 --- a/internal/xds/bootstrap/validate.go +++ b/internal/xds/bootstrap/validate.go @@ -13,6 +13,7 @@ import ( corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3" "github.com/google/go-cmp/cmp" "google.golang.org/protobuf/testing/protocmp" + "k8s.io/apimachinery/pkg/util/sets" egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1" "github.com/envoyproxy/gateway/internal/utils/proto" @@ -86,5 +87,23 @@ func Validate(boostrapConfig *egv1a1.ProxyBootstrap) error { return fmt.Errorf("xds_cluster's loadAssigntment cannot be modified") } + // Envoy fails to start on a bootstrap with two runtime layers sharing a name. Merging a + // layer that collides with one Envoy Gateway already renders would otherwise only show + // up as a proxy crashloop, so reject it here instead. + if err := validateRuntimeLayerNames(userBootstrap); err != nil { + return err + } + + return nil +} + +func validateRuntimeLayerNames(userBootstrap *bootstrapv3.Bootstrap) error { + seen := sets.New[string]() + for _, layer := range userBootstrap.GetLayeredRuntime().GetLayers() { + if seen.Has(layer.GetName()) { + return fmt.Errorf("duplicate layered_runtime layer name %q", layer.GetName()) + } + seen.Insert(layer.GetName()) + } return nil } diff --git a/internal/xds/bootstrap/validate_test.go b/internal/xds/bootstrap/validate_test.go index 9c6791fea3..7259b04f30 100644 --- a/internal/xds/bootstrap/validate_test.go +++ b/internal/xds/bootstrap/validate_test.go @@ -24,6 +24,8 @@ var ( differentDynamicResourcesUserBootstrap string //go:embed testdata/validate/different-xds-cluster-address-bootstrap.yaml differentXdsClusterAddressBootstrap string + //go:embed testdata/validate/duplicate-runtime-layer-bootstrap.yaml + duplicateRuntimeLayerBootstrap string ) func TestValidateBootstrap(t *testing.T) { @@ -60,6 +62,15 @@ func TestValidateBootstrap(t *testing.T) { }, expected: false, }, + { + // Envoy refuses to start on duplicate runtime layer names, so this has to be + // rejected here rather than surfacing as a proxy crashloop. + name: "user bootstrap with duplicate runtime layer names", + bootstrap: &egv1a1.ProxyBootstrap{ + Value: &duplicateRuntimeLayerBootstrap, + }, + expected: false, + }, } for i := range testCases { diff --git a/internal/xds/translator/runtime.go b/internal/xds/translator/runtime.go new file mode 100644 index 0000000000..e2d02068aa --- /dev/null +++ b/internal/xds/translator/runtime.go @@ -0,0 +1,83 @@ +// Copyright Envoy Gateway Authors +// SPDX-License-Identifier: Apache-2.0 +// The full text of the Apache license is available in the LICENSE file at +// the root of the repo. + +package translator + +import ( + "fmt" + "sort" + + runtimev3 "github.com/envoyproxy/go-control-plane/envoy/service/runtime/v3" + resourcev3 "github.com/envoyproxy/go-control-plane/pkg/resource/v3" + "google.golang.org/protobuf/types/known/structpb" + + "github.com/envoyproxy/gateway/internal/ir" + "github.com/envoyproxy/gateway/internal/xds/types" +) + +// RuntimeLayerName is the name of the RTDS layer that Envoy Gateway serves. It must match +// the rtds_layer name in the bootstrap, since Envoy subscribes to the Runtime resource by +// that name. +// +// The name is deliberately Envoy Gateway specific. Envoy rejects a bootstrap containing two +// runtime layers with the same name, so a generic name risks colliding with a layer a user +// already added through spec.bootstrap and leaving the proxy unable to start. +const RuntimeLayerName = "envoy-gateway-runtime" + +// processRuntime builds the RTDS Runtime resource from the runtime values in the IR. +// +// The resource is emitted unconditionally, even when no runtime values are configured. The +// bootstrap subscribes to this layer, so a proxy that never receives the resource logs an +// initial fetch timeout for the Runtime type and keeps an uninitialized layer. Always +// sending it, empty or not, keeps the subscription satisfied. +func processRuntime(tCtx *types.ResourceVersionTable, xdsIR *ir.Xds) error { + layer, err := buildRuntimeLayer(xdsIR) + if err != nil { + return err + } + + return tCtx.AddXdsResource(resourcev3.RuntimeType, &runtimev3.Runtime{ + Name: RuntimeLayerName, + Layer: layer, + }) +} + +// buildRuntimeLayer converts the IR runtime values into the Struct that Envoy loads as a +// runtime layer. Values keep the JSON type they were written with: Envoy resolves boolean +// runtime guards only from real booleans, and numeric limits from numbers or from strings +// that parse as numbers, so collapsing everything to a string would silently disable +// boolean keys. +// +// An unparsable value fails translation, which holds back the whole snapshot. That is +// deliberate: the API server only admits valid JSON here, so reaching this is close to +// impossible, and a runtime key that silently fails to apply is worse than a stalled +// update. A dropped circuit breaker limit, for instance, would leave the proxy running on +// Envoy's default with nothing to indicate it. +func buildRuntimeLayer(xdsIR *ir.Xds) (*structpb.Struct, error) { + if len(xdsIR.Runtime) == 0 { + return nil, nil + } + + // The layer is a proto map, so insertion order does not affect the resulting resource. + // The keys are sorted only so that a config with more than one bad value always reports + // the same one, rather than a different key on each translation. + keys := make([]string, 0, len(xdsIR.Runtime)) + for k := range xdsIR.Runtime { + keys = append(keys, k) + } + sort.Strings(keys) + + fields := make(map[string]*structpb.Value, len(keys)) + for _, k := range keys { + raw := xdsIR.Runtime[k] + value := &structpb.Value{} + if err := value.UnmarshalJSON(raw.Raw); err != nil { + return nil, fmt.Errorf("invalid value for runtime key %q: %w", k, err) + } + fields[k] = value + } + + return &structpb.Struct{Fields: fields}, nil +} diff --git a/internal/xds/translator/runtime_test.go b/internal/xds/translator/runtime_test.go new file mode 100644 index 0000000000..26612203a3 --- /dev/null +++ b/internal/xds/translator/runtime_test.go @@ -0,0 +1,115 @@ +// Copyright Envoy Gateway Authors +// SPDX-License-Identifier: Apache-2.0 +// The full text of the Apache license is available in the LICENSE file at +// the root of the repo. + +package translator + +import ( + "testing" + + runtimev3 "github.com/envoyproxy/go-control-plane/envoy/service/runtime/v3" + resourcev3 "github.com/envoyproxy/go-control-plane/pkg/resource/v3" + "github.com/stretchr/testify/require" + apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1" + + "github.com/envoyproxy/gateway/internal/ir" + "github.com/envoyproxy/gateway/internal/xds/types" +) + +func jsonValue(raw string) apiextensionsv1.JSON { + return apiextensionsv1.JSON{Raw: []byte(raw)} +} + +func TestProcessRuntime(t *testing.T) { + testCases := []struct { + name string + runtime map[string]apiextensionsv1.JSON + // expected holds the wanted layer contents, keyed by runtime key. A nil map means + // the Runtime resource is expected with no layer at all. + expected map[string]any + }{ + { + // The resource must be emitted even with no values configured, otherwise the + // proxy's RTDS subscription never resolves and it logs an initial fetch + // timeout for the Runtime type. + name: "no runtime values still emits the resource", + runtime: nil, + expected: nil, + }, + { + name: "integer value stays a number", + runtime: map[string]apiextensionsv1.JSON{ + "circuit_breakers.ai-gateway-extproc-uds.default.max_requests": jsonValue("16384"), + }, + expected: map[string]any{ + "circuit_breakers.ai-gateway-extproc-uds.default.max_requests": float64(16384), + }, + }, + { + // A boolean must survive as a real boolean. Envoy resolves boolean runtime + // guards from bool_value_ only, so a stringified "true" would be ignored. + name: "boolean value stays a boolean", + runtime: map[string]apiextensionsv1.JSON{ + "envoy.reloadable_features.some_feature": jsonValue("true"), + }, + expected: map[string]any{ + "envoy.reloadable_features.some_feature": true, + }, + }, + { + name: "string value stays a string", + runtime: map[string]apiextensionsv1.JSON{ + "some.string.key": jsonValue(`"hello"`), + }, + expected: map[string]any{ + "some.string.key": "hello", + }, + }, + { + name: "mixed types in one layer", + runtime: map[string]apiextensionsv1.JSON{ + "circuit_breakers.c1.default.max_requests": jsonValue("2048"), + "circuit_breakers.c1.high.max_requests": jsonValue("4096"), + "envoy.reloadable_features.flag": jsonValue("false"), + "overload.global_downstream_max_conns": jsonValue("50000"), + }, + expected: map[string]any{ + "circuit_breakers.c1.default.max_requests": float64(2048), + "circuit_breakers.c1.high.max_requests": float64(4096), + "envoy.reloadable_features.flag": false, + "overload.global_downstream_max_conns": float64(50000), + }, + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + tCtx := new(types.ResourceVersionTable) + require.NoError(t, processRuntime(tCtx, &ir.Xds{Runtime: tc.runtime})) + + resources := tCtx.XdsResources[resourcev3.RuntimeType] + require.Len(t, resources, 1, "exactly one Runtime resource must be emitted") + + rt, ok := resources[0].(*runtimev3.Runtime) + require.True(t, ok) + // The name must match the rtds_layer name in the bootstrap, otherwise Envoy + // never matches the resource to its layer. + require.Equal(t, RuntimeLayerName, rt.GetName()) + + if tc.expected == nil { + require.Nil(t, rt.GetLayer()) + return + } + require.Equal(t, tc.expected, rt.GetLayer().AsMap()) + }) + } +} + +func TestProcessRuntimeInvalidValue(t *testing.T) { + tCtx := new(types.ResourceVersionTable) + err := processRuntime(tCtx, &ir.Xds{Runtime: map[string]apiextensionsv1.JSON{ + "bad.key": jsonValue("{not json"), + }}) + require.ErrorContains(t, err, `invalid value for runtime key "bad.key"`) +} diff --git a/internal/xds/translator/testdata/in/xds-ir/runtime.yaml b/internal/xds/translator/testdata/in/xds-ir/runtime.yaml new file mode 100644 index 0000000000..44ca7d49cd --- /dev/null +++ b/internal/xds/translator/testdata/in/xds-ir/runtime.yaml @@ -0,0 +1,19 @@ +runtime: + circuit_breakers.ai-gateway-extproc-uds.default.max_requests: 16384 + envoy.reloadable_features.some_feature: false + overload.global_downstream_max_connections: 50000 +http: +- name: "first-listener" + address: "0.0.0.0" + port: 10080 + hostnames: + - "*" + routes: + - name: "first-route" + hostname: "*" + destination: + name: "first-route-dest" + settings: + - endpoints: + - host: "1.2.3.4" + port: 50000 diff --git a/internal/xds/translator/testdata/out/xds-ir/runtime.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/runtime.clusters.yaml new file mode 100644 index 0000000000..886a7d9f6c --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/runtime.clusters.yaml @@ -0,0 +1,23 @@ +- circuitBreakers: + thresholds: + - maxRetries: 1024 + commonLbConfig: {} + connectTimeout: 10s + dnsLookupFamily: V4_PREFERRED + edsClusterConfig: + edsConfig: + ads: {} + resourceApiVersion: V3 + serviceName: first-route-dest + ignoreHealthOnHostRemoval: true + loadBalancingPolicy: + policies: + - typedExtensionConfig: + name: envoy.load_balancing_policies.least_request + typedConfig: + '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest + localityLbConfig: + localityWeightedLbConfig: {} + name: first-route-dest + perConnectionBufferLimitBytes: 32768 + type: EDS diff --git a/internal/xds/translator/testdata/out/xds-ir/runtime.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/runtime.endpoints.yaml new file mode 100644 index 0000000000..0d68b430c2 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/runtime.endpoints.yaml @@ -0,0 +1,11 @@ +- clusterName: first-route-dest + endpoints: + - lbEndpoints: + - endpoint: + address: + socketAddress: + address: 1.2.3.4 + portValue: 50000 + loadBalancingWeight: 1 + loadBalancingWeight: 1 + locality: {} diff --git a/internal/xds/translator/testdata/out/xds-ir/runtime.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/runtime.listeners.yaml new file mode 100644 index 0000000000..a1233a034b --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/runtime.listeners.yaml @@ -0,0 +1,34 @@ +- address: + socketAddress: + address: 0.0.0.0 + portValue: 10080 + defaultFilterChain: + filters: + - name: envoy.filters.network.http_connection_manager + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + commonHttpProtocolOptions: + headersWithUnderscoresAction: REJECT_REQUEST + http2ProtocolOptions: + initialConnectionWindowSize: 1048576 + initialStreamWindowSize: 65536 + maxConcurrentStreams: 100 + httpFilters: + - name: envoy.filters.http.router + typedConfig: + '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + suppressEnvoyHeaders: true + normalizePath: true + rds: + configSource: + ads: {} + initialFetchTimeout: 0s + resourceApiVersion: V3 + routeConfigName: first-listener + serverHeaderTransformation: PASS_THROUGH + statPrefix: http-10080 + useRemoteAddress: true + name: first-listener + maxConnectionsToAcceptPerSocketEvent: 1 + name: first-listener + perConnectionBufferLimitBytes: 32768 diff --git a/internal/xds/translator/testdata/out/xds-ir/runtime.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/runtime.routes.yaml new file mode 100644 index 0000000000..0b5b4bee7b --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/runtime.routes.yaml @@ -0,0 +1,14 @@ +- ignorePortInHostMatching: true + name: first-listener + virtualHosts: + - domains: + - '*' + name: first-listener/* + routes: + - match: + prefix: / + name: first-route + route: + cluster: first-route-dest + upgradeConfigs: + - upgradeType: websocket diff --git a/internal/xds/translator/testdata/out/xds-ir/runtime.runtime.yaml b/internal/xds/translator/testdata/out/xds-ir/runtime.runtime.yaml new file mode 100644 index 0000000000..44263794b1 --- /dev/null +++ b/internal/xds/translator/testdata/out/xds-ir/runtime.runtime.yaml @@ -0,0 +1,5 @@ +- layer: + circuit_breakers.ai-gateway-extproc-uds.default.max_requests: 16384 + envoy.reloadable_features.some_feature: false + overload.global_downstream_max_connections: 50000 + name: envoy-gateway-runtime diff --git a/internal/xds/translator/translator.go b/internal/xds/translator/translator.go index 87f7ba4f9b..cf1be1a2c6 100644 --- a/internal/xds/translator/translator.go +++ b/internal/xds/translator/translator.go @@ -158,6 +158,10 @@ func (t *Translator) Translate(xdsIR *ir.Xds) (*types.ResourceVersionTable, erro errs = errors.Join(errs, err) } + if err := processRuntime(tCtx, xdsIR); err != nil { + errs = errors.Join(errs, err) + } + // Patch global resources that are shared across listeners and routes. // - the envoy client certificate // - the OIDC HMAC secret diff --git a/internal/xds/translator/translator_test.go b/internal/xds/translator/translator_test.go index 3780a665fa..1325bf9ffb 100644 --- a/internal/xds/translator/translator_test.go +++ b/internal/xds/translator/translator_test.go @@ -224,6 +224,17 @@ func TestTranslateXds(t *testing.T) { } require.Equal(t, requireTestDataOutFile(t, "xds-ir", inputFileName+".secrets.yaml"), requireResourcesToYAMLString(t, secrets)) } + + // A Runtime resource is always emitted, so only the cases that configure + // runtime values keep a golden file for it. + if len(x.Runtime) > 0 { + runtimeResources := tCtx.XdsResources[resourcev3.RuntimeType] + if test.OverrideTestData() { + keep.Insert(inputFileName + ".runtime.yaml") + require.NoError(t, file.Write(requireResourcesToYAMLString(t, runtimeResources), filepath.Join("testdata", "out", "xds-ir", inputFileName+".runtime.yaml"))) + } + require.Equal(t, requireTestDataOutFile(t, "xds-ir", inputFileName+".runtime.yaml"), requireResourcesToYAMLString(t, runtimeResources)) + } }) } diff --git a/release-notes/current/new_features/9670-envoyproxy-spec-runtime.md b/release-notes/current/new_features/9670-envoyproxy-spec-runtime.md new file mode 100644 index 0000000000..4bf7ade62b --- /dev/null +++ b/release-notes/current/new_features/9670-envoyproxy-spec-runtime.md @@ -0,0 +1 @@ +Added `EnvoyProxy.spec.runtime` for setting Envoy runtime values, delivered to proxies over RTDS so changes apply without a proxy restart and without triggering a cluster update. This makes runtime-gated settings reachable on clusters that Envoy Gateway does not build from its own configuration, such as clusters added by an extension server, which otherwise keep Envoy's built-in defaults and cannot be targeted by a `BackendTrafficPolicy`. A common case is raising the ext_proc circuit breaker ceiling with `circuit_breakers..default.max_requests`, since the built-in `max_requests` of 1024 limits a proxy to 1024 concurrent requests through ext_proc. diff --git a/release-notes/current/other_changes/9670-bootstrap-rtds-layer.md b/release-notes/current/other_changes/9670-bootstrap-rtds-layer.md new file mode 100644 index 0000000000..09939d5a6e --- /dev/null +++ b/release-notes/current/other_changes/9670-bootstrap-rtds-layer.md @@ -0,0 +1 @@ +The default proxy bootstrap now includes an RTDS runtime layer named `envoy-gateway-runtime`, which backs the new `EnvoyProxy.spec.runtime` field. Because the bootstrap is part of the proxy container arguments, upgrading rolls managed proxies once. A bootstrap supplied through `EnvoyProxy.spec.bootstrap` that already defines a runtime layer with that name is now rejected, since Envoy refuses to start on duplicate runtime layer names. diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index 20d3157df6..1cd27ed811 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -2336,6 +2336,7 @@ _Appears in:_ | `logging` | _[ProxyLogging](#proxylogging)_ | true | \{ level:map[default:warn] \} | Logging defines logging parameters for managed proxies. | | `telemetry` | _[ProxyTelemetry](#proxytelemetry)_ | false | | Telemetry defines telemetry parameters for managed proxies. | | `bootstrap` | _[ProxyBootstrap](#proxybootstrap)_ | false | | Bootstrap defines the Envoy Bootstrap as a YAML string.
Visit https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/bootstrap/v3/bootstrap.proto#envoy-v3-api-msg-config-bootstrap-v3-bootstrap
to learn more about the syntax.
If set, this is the Bootstrap configuration used for the managed Envoy Proxy fleet instead of the default Bootstrap configuration
set by Envoy Gateway.
Some fields within the Bootstrap that are required to communicate with the xDS Server (Envoy Gateway) and receive xDS resources
from it are not configurable and will result in the `EnvoyProxy` resource being rejected.
Backward compatibility across minor versions is not guaranteed.
We strongly recommend using `egctl x translate` to generate a `EnvoyProxy` resource with the `Bootstrap` field set to the default
Bootstrap configuration used. You can edit this configuration, and rerun `egctl x translate` to ensure there are no validation errors. | +| `runtime` | _object (keys:string, values:[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.32/#json-v1-apiextensions-k8s-io))_ | false | | Runtime defines Envoy runtime values for managed proxies, as a map of runtime key
to value. Values are typed: numbers, booleans and strings are all preserved as
written, which matters because Envoy resolves boolean runtime guards only from real
booleans and numeric limits only from numbers or numeric strings.
Runtime values are delivered over RTDS, so changes apply to running proxies without
a restart and without triggering a CDS update.
One use is tuning circuit breakers on clusters that Envoy Gateway does not build from
its own configuration, such as clusters added by an extension server, which otherwise
keep Envoy's built-in defaults:
runtime:
circuit_breakers.my-extension-cluster.default.max_requests: 16384
Runtime keys are an Envoy-level interface and are not validated by Envoy Gateway.
Visit https://www.envoyproxy.io/docs/envoy/latest/configuration/operations/runtime
to learn more about the available keys.
Note: this has no effect when spec.bootstrap uses the Replace type with a bootstrap
that omits the RTDS layer, since the proxy then has no layer for these values to
land in. | | `concurrency` | _integer_ | false | | Concurrency defines the number of worker threads to run. If unset, it defaults to
the number of cpuset threads on the platform. | | `routingType` | _[RoutingType](#routingtype)_ | false | | RoutingType can be set to "Service" to use the Service Cluster IP for routing to the backend,
or it can be set to "Endpoint" to use Endpoint routing. The default is "Endpoint". | | `extraArgs` | _string array_ | false | | ExtraArgs defines additional command line options that are provided to Envoy.
More info: https://www.envoyproxy.io/docs/envoy/latest/operations/cli#command-line-options
Note: some command line options are used internally(e.g. --log-level) so they cannot be provided here. | diff --git a/site/content/en/latest/tasks/operations/customize-envoyproxy.md b/site/content/en/latest/tasks/operations/customize-envoyproxy.md index 69d8b73646..06dd740542 100644 --- a/site/content/en/latest/tasks/operations/customize-envoyproxy.md +++ b/site/content/en/latest/tasks/operations/customize-envoyproxy.md @@ -930,6 +930,86 @@ spec: {{% /tab %}} {{< /tabpane >}} +## Customize EnvoyProxy Runtime Values + +You can set [Envoy runtime][] values via `spec.runtime` in EnvoyProxy Config. Runtime values are +delivered to proxies over RTDS, so editing them applies to running proxies without a restart. + +One use is tuning circuit breakers on clusters that Envoy Gateway does not build from its own +configuration, such as clusters added by an [extension server][]. Those clusters keep Envoy's +built-in defaults, including a `max_requests` of 1024, and cannot be targeted by a +`BackendTrafficPolicy`. Since an ext_proc filter opens one gRPC stream per request, that default +limits the proxy to 1024 concurrent requests through ext_proc, after which requests are rejected +and `cluster..upstream_rq_active_overflow` increments. + +The runtime key applies whether or not the cluster carries a `circuit_breakers` block, so it +reaches these clusters without modifying them: + +{{< tabpane text=true >}} +{{% tab header="Apply from stdin" %}} + +```shell +cat <}} + +Values keep the type they are written with. Envoy resolves boolean runtime guards only from real +booleans, and numeric limits from numbers, so quoting matters: + +```yaml +spec: + runtime: + circuit_breakers.my-cluster.default.max_requests: 16384 # number + envoy.reloadable_features.some_feature: false # boolean + some.string.key: "a string" # string +``` + +Runtime keys are an Envoy-level interface and are not validated by Envoy Gateway. Refer to the +[Envoy runtime][] documentation for the available keys. + +To confirm the values a proxy is using, query its admin interface. Envoy's configuration dump has +no runtime section, so `egctl x translate` shows only the RTDS layer in the bootstrap and not the +values themselves: + +```shell +kubectl exec -n envoy-gateway-system -- curl -s localhost:19000/runtime +``` + +Note that changing a runtime value avoids the connection and stream disruption that comes with +modifying a cluster, but it only reaches settings Envoy reads from runtime. Settings with no +runtime key, such as `connect_timeout`, are not configurable this way. + +Runtime values reach proxies through an RTDS layer in the bootstrap. If you replace the bootstrap +entirely using `spec.bootstrap` with the `Replace` type, keep that layer or `spec.runtime` will +have no effect. + ## Customize EnvoyProxy with Patches You can customize the EnvoyProxy using patches. @@ -1202,3 +1282,5 @@ After applying the config, the EnvoyProxy deployment will be configured to use t [Gateway API documentation]: https://gateway-api.sigs.k8s.io/ [EnvoyProxy]: ../../../api/extension_types#envoyproxy [egctl x translate]: ../operations/egctl#egctl-experimental-translate +[Envoy runtime]: https://www.envoyproxy.io/docs/envoy/latest/configuration/operations/runtime +[extension server]: ../extensibility/extension-server diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml index e8ae71f7e4..91793f9cf7 100644 --- a/test/helm/gateway-crds-helm/all.out.yaml +++ b/test/helm/gateway-crds-helm/all.out.yaml @@ -45142,6 +45142,27 @@ spec: RoutingType can be set to "Service" to use the Service Cluster IP for routing to the backend, or it can be set to "Endpoint" to use Endpoint routing. The default is "Endpoint". type: string + runtime: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: "Runtime defines Envoy runtime values for managed proxies, + as a map of runtime key\nto value. Values are typed: numbers, booleans + and strings are all preserved as\nwritten, which matters because + Envoy resolves boolean runtime guards only from real\nbooleans and + numeric limits only from numbers or numeric strings.\n\nRuntime + values are delivered over RTDS, so changes apply to running proxies + without\na restart and without triggering a CDS update.\n\nOne use + is tuning circuit breakers on clusters that Envoy Gateway does not + build from\nits own configuration, such as clusters added by an + extension server, which otherwise\nkeep Envoy's built-in defaults:\n\n\truntime:\n\t + \ circuit_breakers.my-extension-cluster.default.max_requests: 16384\n\nRuntime + keys are an Envoy-level interface and are not validated by Envoy + Gateway.\nVisit https://www.envoyproxy.io/docs/envoy/latest/configuration/operations/runtime\nto + learn more about the available keys.\n\nNote: this has no effect + when spec.bootstrap uses the Replace type with a bootstrap\nthat + omits the RTDS layer, since the proxy then has no layer for these + values to\nland in." + type: object shutdown: description: Shutdown defines configuration for graceful envoy shutdown process. diff --git a/test/helm/gateway-crds-helm/e2e.out.yaml b/test/helm/gateway-crds-helm/e2e.out.yaml index 8d51ce19a8..a1e1c687af 100644 --- a/test/helm/gateway-crds-helm/e2e.out.yaml +++ b/test/helm/gateway-crds-helm/e2e.out.yaml @@ -21080,6 +21080,27 @@ spec: RoutingType can be set to "Service" to use the Service Cluster IP for routing to the backend, or it can be set to "Endpoint" to use Endpoint routing. The default is "Endpoint". type: string + runtime: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: "Runtime defines Envoy runtime values for managed proxies, + as a map of runtime key\nto value. Values are typed: numbers, booleans + and strings are all preserved as\nwritten, which matters because + Envoy resolves boolean runtime guards only from real\nbooleans and + numeric limits only from numbers or numeric strings.\n\nRuntime + values are delivered over RTDS, so changes apply to running proxies + without\na restart and without triggering a CDS update.\n\nOne use + is tuning circuit breakers on clusters that Envoy Gateway does not + build from\nits own configuration, such as clusters added by an + extension server, which otherwise\nkeep Envoy's built-in defaults:\n\n\truntime:\n\t + \ circuit_breakers.my-extension-cluster.default.max_requests: 16384\n\nRuntime + keys are an Envoy-level interface and are not validated by Envoy + Gateway.\nVisit https://www.envoyproxy.io/docs/envoy/latest/configuration/operations/runtime\nto + learn more about the available keys.\n\nNote: this has no effect + when spec.bootstrap uses the Replace type with a bootstrap\nthat + omits the RTDS layer, since the proxy then has no layer for these + values to\nland in." + type: object shutdown: description: Shutdown defines configuration for graceful envoy shutdown process. diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml index a8dccebf69..23d4bd24c9 100644 --- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml +++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml @@ -21080,6 +21080,27 @@ spec: RoutingType can be set to "Service" to use the Service Cluster IP for routing to the backend, or it can be set to "Endpoint" to use Endpoint routing. The default is "Endpoint". type: string + runtime: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: "Runtime defines Envoy runtime values for managed proxies, + as a map of runtime key\nto value. Values are typed: numbers, booleans + and strings are all preserved as\nwritten, which matters because + Envoy resolves boolean runtime guards only from real\nbooleans and + numeric limits only from numbers or numeric strings.\n\nRuntime + values are delivered over RTDS, so changes apply to running proxies + without\na restart and without triggering a CDS update.\n\nOne use + is tuning circuit breakers on clusters that Envoy Gateway does not + build from\nits own configuration, such as clusters added by an + extension server, which otherwise\nkeep Envoy's built-in defaults:\n\n\truntime:\n\t + \ circuit_breakers.my-extension-cluster.default.max_requests: 16384\n\nRuntime + keys are an Envoy-level interface and are not validated by Envoy + Gateway.\nVisit https://www.envoyproxy.io/docs/envoy/latest/configuration/operations/runtime\nto + learn more about the available keys.\n\nNote: this has no effect + when spec.bootstrap uses the Replace type with a bootstrap\nthat + omits the RTDS layer, since the proxy then has no layer for these + values to\nland in." + type: object shutdown: description: Shutdown defines configuration for graceful envoy shutdown process.