feat: configure overload manager (#3082)

* feat: support overload manager Signed-off-by: Shahar Harari <shahar.harari@sap.com> * add a test case to increase coverage Signed-off-by: Shahar Harari <shahar.harari@sap.com> --------- Signed-off-by: Shahar Harari <shahar.harari@sap.com>
envoyproxy · Apr 5, 2024 · 07f8a47 · 07f8a47
1 parent 11f56fd
commit 07f8a47
Show file tree

Hide file tree

Showing 35 changed files with 864 additions and 43 deletions.
diff --git a/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml b/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml
@@ -130,6 +130,13 @@ envoyProxy:
                       path_config_source:
                         path: "/sds/xds-trusted-ca.json"
                       resource_api_version: V3
+        overload_manager:
+          refresh_interval: 0.25s
+          resource_monitors:
+          - name: "envoy.resource_monitors.global_downstream_max_connections"
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
+              max_active_downstream_connections: 50000
     logging: {}
   status: {}
 gatewayClass:
@@ -508,6 +515,13 @@ xds:
               envoy.restart_features.use_eds_cache_for_ads: true
               re2.max_program_size.error_level: 4294967295
               re2.max_program_size.warn_level: 1000
+        overloadManager:
+          refreshInterval: 0.250s
+          resourceMonitors:
+          - name: envoy.resource_monitors.global_downstream_max_connections
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
+              maxActiveDownstreamConnections: "50000"
         staticResources:
           clusters:
           - connectTimeout: 0.250s

diff --git a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json
@@ -56,6 +56,18 @@
                 }
               ]
             },
+            "overloadManager": {
+              "refreshInterval": "0.250s",
+              "resourceMonitors": [
+                {
+                  "name": "envoy.resource_monitors.global_downstream_max_connections",
+                  "typedConfig": {
+                    "@type": "type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig",
+                    "maxActiveDownstreamConnections": "50000"
+                  }
+                }
+              ]
+            },
             "staticResources": {
               "clusters": [
                 {

diff --git a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml
@@ -34,6 +34,13 @@ xds:
               envoy.restart_features.use_eds_cache_for_ads: true
               re2.max_program_size.error_level: 4294967295
               re2.max_program_size.warn_level: 1000
+        overloadManager:
+          refreshInterval: 0.250s
+          resourceMonitors:
+          - name: envoy.resource_monitors.global_downstream_max_connections
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
+              maxActiveDownstreamConnections: "50000"
         staticResources:
           clusters:
           - connectTimeout: 0.250s

diff --git a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.bootstrap.yaml b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.bootstrap.yaml
@@ -33,6 +33,13 @@ xds:
             envoy.restart_features.use_eds_cache_for_ads: true
             re2.max_program_size.error_level: 4294967295
             re2.max_program_size.warn_level: 1000
+      overloadManager:
+        refreshInterval: 0.250s
+        resourceMonitors:
+        - name: envoy.resource_monitors.global_downstream_max_connections
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
+            maxActiveDownstreamConnections: "50000"
       staticResources:
         clusters:
         - connectTimeout: 0.250s

diff --git a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.json b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.json
@@ -56,6 +56,18 @@
                 }
               ]
             },
+            "overloadManager": {
+              "refreshInterval": "0.250s",
+              "resourceMonitors": [
+                {
+                  "name": "envoy.resource_monitors.global_downstream_max_connections",
+                  "typedConfig": {
+                    "@type": "type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig",
+                    "maxActiveDownstreamConnections": "50000"
+                  }
+                }
+              ]
+            },
             "staticResources": {
               "clusters": [
                 {

diff --git a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.yaml b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.yaml
@@ -34,6 +34,13 @@ xds:
               envoy.restart_features.use_eds_cache_for_ads: true
               re2.max_program_size.error_level: 4294967295
               re2.max_program_size.warn_level: 1000
+        overloadManager:
+          refreshInterval: 0.250s
+          resourceMonitors:
+          - name: envoy.resource_monitors.global_downstream_max_connections
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
+              maxActiveDownstreamConnections: "50000"
         staticResources:
           clusters:
           - connectTimeout: 0.250s

diff --git a/...rnal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.bootstrap.yaml b/...rnal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.bootstrap.yaml
@@ -33,6 +33,13 @@ xds:
             envoy.restart_features.use_eds_cache_for_ads: true
             re2.max_program_size.error_level: 4294967295
             re2.max_program_size.warn_level: 1000
+      overloadManager:
+        refreshInterval: 0.250s
+        resourceMonitors:
+        - name: envoy.resource_monitors.global_downstream_max_connections
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
+            maxActiveDownstreamConnections: "50000"
       staticResources:
         clusters:
         - connectTimeout: 0.250s

diff --git a/internal/infrastructure/kubernetes/proxy/resource.go b/internal/infrastructure/kubernetes/proxy/resource.go
@@ -143,8 +143,14 @@ func expectedProxyContainers(infra *ir.ProxyInfra,
 		infra.Config.Spec.Telemetry != nil {
 		proxyMetrics = infra.Config.Spec.Telemetry.Metrics
 	}
+
+	maxHeapSizeBytes := caclulateMaxHeapSizeBytes(deploymentConfig.Container.Resources)
+
 	// Get the default Bootstrap
-	bootstrapConfigurations, err := bootstrap.GetRenderedBootstrapConfig(proxyMetrics)
+	bootstrapConfigurations, err := bootstrap.GetRenderedBootstrapConfig(&bootstrap.RenderBootsrapConfigOptions{
+		ProxyMetrics:     proxyMetrics,
+		MaxHeapSizeBytes: maxHeapSizeBytes,
+	})
 	if err != nil {
 		return nil, err
 	}
@@ -389,3 +395,18 @@ func expectedContainerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev
 		return env
 	}
 }
+
+// caclulateMaxHeapSizeBytes calculates the maximum heap size in bytes as 80% of Envoy container memory limits.
+// In case no limits are defined '0' is returned, which means no heap size limit is set.
+func caclulateMaxHeapSizeBytes(envoyResourceRequirements *corev1.ResourceRequirements) uint64 {
+	if envoyResourceRequirements == nil || envoyResourceRequirements.Limits == nil {
+		return 0
+	}
+
+	if memLimit, ok := envoyResourceRequirements.Limits[corev1.ResourceMemory]; ok {
+		memLimitBytes := memLimit.Value()
+		return uint64(float64(memLimitBytes) * 0.8)
+	}
+
+	return 0
+}
diff --git a/internal/infrastructure/kubernetes/proxy/resource_provider_test.go b/internal/infrastructure/kubernetes/proxy/resource_provider_test.go
@@ -497,6 +497,19 @@ func TestDeployment(t *testing.T) {
 			infra:     newTestInfra(),
 			extraArgs: []string{"--key1 val1", "--key2 val2"},
 		},
+		{
+			caseName: "with-empty-memory-limits",
+			infra:    newTestInfra(),
+			deploy: &egv1a1.KubernetesDeploymentSpec{
+				Container: &egv1a1.KubernetesContainerSpec{
+					Resources: &corev1.ResourceRequirements{
+						Limits: corev1.ResourceList{
+							corev1.ResourceCPU: resource.MustParse("400m"),
+						},
+					},
+				},
+			},
+		},
 	}
 	for _, tc := range cases {
 		t.Run(tc.caseName, func(t *testing.T) {

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
@@ -168,6 +168,28 @@ spec:
                         path_config_source:
                           path: "/sds/xds-trusted-ca.json"
                         resource_api_version: V3
+          overload_manager:
+            refresh_interval: 0.25s
+            resource_monitors:
+            - name: "envoy.resource_monitors.global_downstream_max_connections"
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
+                max_active_downstream_connections: 50000
+            - name: "envoy.resource_monitors.fixed_heap"
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.resource_monitors.fixed_heap.v3.FixedHeapConfig
+                max_heap_size_bytes: 1717986918
+            actions:
+            - name: "envoy.overload_actions.shrink_heap"
+              triggers:
+              - name: "envoy.resource_monitors.fixed_heap"
+                threshold:
+                  value: 0.95
+            - name: "envoy.overload_actions.stop_accepting_requests"
+              triggers:
+              - name: "envoy.resource_monitors.fixed_heap"
+                threshold:
+                  value: 0.98
         - --log-level warn
         - --cpuset-threads
         command:

diff --git a/...rnal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml b/...rnal/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
@@ -168,6 +168,28 @@ spec:
                         path_config_source:
                           path: "/sds/xds-trusted-ca.json"
                         resource_api_version: V3
+          overload_manager:
+            refresh_interval: 0.25s
+            resource_monitors:
+            - name: "envoy.resource_monitors.global_downstream_max_connections"
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
+                max_active_downstream_connections: 50000
+            - name: "envoy.resource_monitors.fixed_heap"
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.resource_monitors.fixed_heap.v3.FixedHeapConfig
+                max_heap_size_bytes: 1717986918
+            actions:
+            - name: "envoy.overload_actions.shrink_heap"
+              triggers:
+              - name: "envoy.resource_monitors.fixed_heap"
+                threshold:
+                  value: 0.95
+            - name: "envoy.overload_actions.stop_accepting_requests"
+              triggers:
+              - name: "envoy.resource_monitors.fixed_heap"
+                threshold:
+                  value: 0.98
         - --log-level warn
         - --cpuset-threads
         command:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
@@ -166,6 +166,28 @@ spec:
                         path_config_source:
                           path: "/sds/xds-trusted-ca.json"
                         resource_api_version: V3
+          overload_manager:
+            refresh_interval: 0.25s
+            resource_monitors:
+            - name: "envoy.resource_monitors.global_downstream_max_connections"
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
+                max_active_downstream_connections: 50000
+            - name: "envoy.resource_monitors.fixed_heap"
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.resource_monitors.fixed_heap.v3.FixedHeapConfig
+                max_heap_size_bytes: 1717986918
+            actions:
+            - name: "envoy.overload_actions.shrink_heap"
+              triggers:
+              - name: "envoy.resource_monitors.fixed_heap"
+                threshold:
+                  value: 0.95
+            - name: "envoy.overload_actions.stop_accepting_requests"
+              triggers:
+              - name: "envoy.resource_monitors.fixed_heap"
+                threshold:
+                  value: 0.98
         - --log-level warn
         - --cpuset-threads
         command:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
@@ -165,6 +165,13 @@ spec:
                         path_config_source:
                           path: "/sds/xds-trusted-ca.json"
                         resource_api_version: V3
+          overload_manager:
+            refresh_interval: 0.25s
+            resource_monitors:
+            - name: "envoy.resource_monitors.global_downstream_max_connections"
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
+                max_active_downstream_connections: 50000
         - --log-level warn
         - --cpuset-threads
         command:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
@@ -139,6 +139,13 @@ spec:
                         path_config_source:
                           path: "/sds/xds-trusted-ca.json"
                         resource_api_version: V3
+          overload_manager:
+            refresh_interval: 0.25s
+            resource_monitors:
+            - name: "envoy.resource_monitors.global_downstream_max_connections"
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
+                max_active_downstream_connections: 50000
         - --log-level warn
         - --cpuset-threads
         command:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
@@ -166,6 +166,28 @@ spec:
                         path_config_source:
                           path: "/sds/xds-trusted-ca.json"
                         resource_api_version: V3
+          overload_manager:
+            refresh_interval: 0.25s
+            resource_monitors:
+            - name: "envoy.resource_monitors.global_downstream_max_connections"
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
+                max_active_downstream_connections: 50000
+            - name: "envoy.resource_monitors.fixed_heap"
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.resource_monitors.fixed_heap.v3.FixedHeapConfig
+                max_heap_size_bytes: 1717986918
+            actions:
+            - name: "envoy.overload_actions.shrink_heap"
+              triggers:
+              - name: "envoy.resource_monitors.fixed_heap"
+                threshold:
+                  value: 0.95
+            - name: "envoy.overload_actions.stop_accepting_requests"
+              triggers:
+              - name: "envoy.resource_monitors.fixed_heap"
+                threshold:
+                  value: 0.98
         - --log-level warn
         - --cpuset-threads
         command:

diff --git a/...infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml b/...infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
@@ -176,6 +176,13 @@ spec:
                         path_config_source:
                           path: "/sds/xds-trusted-ca.json"
                         resource_api_version: V3
+          overload_manager:
+            refresh_interval: 0.25s
+            resource_monitors:
+            - name: "envoy.resource_monitors.global_downstream_max_connections"
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
+                max_active_downstream_connections: 50000
         - --log-level warn
         - --cpuset-threads
         command:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
@@ -165,6 +165,13 @@ spec:
                         path_config_source:
                           path: "/sds/xds-trusted-ca.json"
                         resource_api_version: V3
+          overload_manager:
+            refresh_interval: 0.25s
+            resource_monitors:
+            - name: "envoy.resource_monitors.global_downstream_max_connections"
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
+                max_active_downstream_connections: 50000
         - --log-level warn
         - --cpuset-threads
         command:

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
@@ -165,6 +165,13 @@ spec:
                         path_config_source:
                           path: "/sds/xds-trusted-ca.json"
                         resource_api_version: V3
+          overload_manager:
+            refresh_interval: 0.25s
+            resource_monitors:
+            - name: "envoy.resource_monitors.global_downstream_max_connections"
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
+                max_active_downstream_connections: 50000
         - --log-level warn
         - --cpuset-threads
         - --drain-time-s 30

diff --git a/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml b/internal/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
@@ -166,6 +166,28 @@ spec:
                         path_config_source:
                           path: "/sds/xds-trusted-ca.json"
                         resource_api_version: V3
+          overload_manager:
+            refresh_interval: 0.25s
+            resource_monitors:
+            - name: "envoy.resource_monitors.global_downstream_max_connections"
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
+                max_active_downstream_connections: 50000
+            - name: "envoy.resource_monitors.fixed_heap"
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.resource_monitors.fixed_heap.v3.FixedHeapConfig
+                max_heap_size_bytes: 1717986918
+            actions:
+            - name: "envoy.overload_actions.shrink_heap"
+              triggers:
+              - name: "envoy.resource_monitors.fixed_heap"
+                threshold:
+                  value: 0.95
+            - name: "envoy.overload_actions.stop_accepting_requests"
+              triggers:
+              - name: "envoy.resource_monitors.fixed_heap"
+                threshold:
+                  value: 0.98
         - --log-level warn
         - --cpuset-threads
         command: