feat(translator): implement connection limit #2952
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -9,20 +9,19 @@ import gwapiv1 "sigs.k8s.io/gateway-api/apis/v1" | |
|
|
||
| // Connection allows users to configure connection-level settings | ||
| type Connection struct { | ||
| // ConnectionLimit defines limits related to connections | ||
| // | ||
| // +optional | ||
| ConnectionLimit *ConnectionLimit `json:"connectionLimit,omitempty"` | ||
| } | ||
|
|
||
| type ConnectionLimit struct { | ||
| // Value of the maximum concurrent connections limit. | ||
| // When the limit is reached, incoming connections will be closed after the CloseDelay duration. | ||
| // Default: unlimited. | ||
| // | ||
| // +kubebuilder:validation:Minimum=0 | ||
| Value int64 `json:"value,omitempty"` | ||
|
There was a problem hiding this comment. is there a default envoy uses here ? There was a problem hiding this comment. No default is mentioned in the docs. It looks like the filter constructor requires a value to be provided: https://github.com/envoyproxy/envoy/blob/e4bd0e6f70749a50dd122d5d7006e8913bb9e84c/source/extensions/filters/network/connection_limit/connection_limit.cc#L17C24-L17C53 by the filter config. So, I think that it's legitimate to require a value if the user decides to opt-in for this feature. There was a problem hiding this comment. Do you think EG should set a default here ? There was a problem hiding this comment. I'd vote to leave it to users to decide what this value should be. It might be difficult to choose a default value for max connections because it depends on things we don't know before deploying EG in production: the scale of clients, the spec of the machine the EG is running on, etc. There was a problem hiding this comment. +1 to huabing's position. When we support instance (overload manager) and/or listener connection limits with defaults (e.g. 50k), we can validate that this limit is not higher than those limits, which will create an effective "range" for users to choose from. |
||
|
|
||
| // CloseDelay defines the delay to use before closing connections that are rejected | ||
| // once the limit value is reached. | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| clientTrafficPolicies: | ||
| - apiVersion: gateway.envoyproxy.io/v1alpha1 | ||
| kind: ClientTrafficPolicy | ||
| metadata: | ||
| namespace: envoy-gateway | ||
| name: target-gateway-1 | ||
| spec: | ||
| tcpKeepalive: {} | ||
| targetRef: | ||
| group: gateway.networking.k8s.io | ||
| kind: Gateway | ||
| name: gateway-1 | ||
| namespace: envoy-gateway | ||
| - apiVersion: gateway.envoyproxy.io/v1alpha1 | ||
| kind: ClientTrafficPolicy | ||
| metadata: | ||
| namespace: envoy-gateway | ||
| name: target-gateway-1-section-http-1 | ||
| spec: | ||
| connection: | ||
| connectionLimit: | ||
| value: 3 | ||
| closeDelay: 10mib | ||
| targetRef: | ||
| group: gateway.networking.k8s.io | ||
| kind: Gateway | ||
| name: gateway-1 | ||
| sectionName: http-1 | ||
| namespace: envoy-gateway | ||
| gateways: | ||
| - apiVersion: gateway.networking.k8s.io/v1 | ||
| kind: Gateway | ||
| metadata: | ||
| namespace: envoy-gateway | ||
| name: gateway-1 | ||
| spec: | ||
| gatewayClassName: envoy-gateway-class | ||
| listeners: | ||
| - name: http-1 | ||
| protocol: HTTP | ||
| port: 80 | ||
| allowedRoutes: | ||
| namespaces: | ||
| from: Same | ||
| - name: http-2 | ||
| protocol: HTTP | ||
| port: 8080 | ||
| allowedRoutes: | ||
| namespaces: | ||
| from: Same |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,184 @@ | ||
| clientTrafficPolicies: | ||
| - apiVersion: gateway.envoyproxy.io/v1alpha1 | ||
| kind: ClientTrafficPolicy | ||
| metadata: | ||
| creationTimestamp: null | ||
| name: target-gateway-1-section-http-1 | ||
| namespace: envoy-gateway | ||
| spec: | ||
| connection: | ||
| connectionLimit: | ||
| closeDelay: 10mib | ||
| value: 3 | ||
| targetRef: | ||
| group: gateway.networking.k8s.io | ||
| kind: Gateway | ||
| name: gateway-1 | ||
| namespace: envoy-gateway | ||
| sectionName: http-1 | ||
| status: | ||
| ancestors: | ||
| - ancestorRef: | ||
| group: gateway.networking.k8s.io | ||
| kind: Gateway | ||
| name: gateway-1 | ||
| namespace: envoy-gateway | ||
| sectionName: http-1 | ||
| conditions: | ||
| - lastTransitionTime: null | ||
| message: Invalid CloseDelay value 10mib | ||
| reason: Invalid | ||
| status: "False" | ||
| type: Accepted | ||
| controllerName: gateway.envoyproxy.io/gatewayclass-controller | ||
| - apiVersion: gateway.envoyproxy.io/v1alpha1 | ||
| kind: ClientTrafficPolicy | ||
| metadata: | ||
| creationTimestamp: null | ||
| name: target-gateway-1 | ||
| namespace: envoy-gateway | ||
| spec: | ||
| targetRef: | ||
| group: gateway.networking.k8s.io | ||
| kind: Gateway | ||
| name: gateway-1 | ||
| namespace: envoy-gateway | ||
| tcpKeepalive: {} | ||
| status: | ||
| ancestors: | ||
| - ancestorRef: | ||
| group: gateway.networking.k8s.io | ||
| kind: Gateway | ||
| name: gateway-1 | ||
| namespace: envoy-gateway | ||
| conditions: | ||
| - lastTransitionTime: null | ||
| message: There are existing ClientTrafficPolicies that are overriding these | ||
| sections [http-1] | ||
| reason: Overridden | ||
| status: "True" | ||
| type: Overridden | ||
| - lastTransitionTime: null | ||
| message: Policy has been accepted. | ||
| reason: Accepted | ||
| status: "True" | ||
| type: Accepted | ||
| controllerName: gateway.envoyproxy.io/gatewayclass-controller | ||
| gateways: | ||
| - apiVersion: gateway.networking.k8s.io/v1 | ||
| kind: Gateway | ||
| metadata: | ||
| creationTimestamp: null | ||
| name: gateway-1 | ||
| namespace: envoy-gateway | ||
| spec: | ||
| gatewayClassName: envoy-gateway-class | ||
| listeners: | ||
| - allowedRoutes: | ||
| namespaces: | ||
| from: Same | ||
| name: http-1 | ||
| port: 80 | ||
| protocol: HTTP | ||
| - allowedRoutes: | ||
| namespaces: | ||
| from: Same | ||
| name: http-2 | ||
| port: 8080 | ||
| protocol: HTTP | ||
| status: | ||
| listeners: | ||
| - attachedRoutes: 0 | ||
| conditions: | ||
| - lastTransitionTime: null | ||
| message: Sending translated listener configuration to the data plane | ||
| reason: Programmed | ||
| status: "True" | ||
| type: Programmed | ||
| - lastTransitionTime: null | ||
| message: Listener has been successfully translated | ||
| reason: Accepted | ||
| status: "True" | ||
| type: Accepted | ||
| - lastTransitionTime: null | ||
| message: Listener references have been resolved | ||
| reason: ResolvedRefs | ||
| status: "True" | ||
| type: ResolvedRefs | ||
| name: http-1 | ||
| supportedKinds: | ||
| - group: gateway.networking.k8s.io | ||
| kind: HTTPRoute | ||
| - group: gateway.networking.k8s.io | ||
| kind: GRPCRoute | ||
| - attachedRoutes: 0 | ||
| conditions: | ||
| - lastTransitionTime: null | ||
| message: Sending translated listener configuration to the data plane | ||
| reason: Programmed | ||
| status: "True" | ||
| type: Programmed | ||
| - lastTransitionTime: null | ||
| message: Listener has been successfully translated | ||
| reason: Accepted | ||
| status: "True" | ||
| type: Accepted | ||
| - lastTransitionTime: null | ||
| message: Listener references have been resolved | ||
| reason: ResolvedRefs | ||
| status: "True" | ||
| type: ResolvedRefs | ||
| name: http-2 | ||
| supportedKinds: | ||
| - group: gateway.networking.k8s.io | ||
| kind: HTTPRoute | ||
| - group: gateway.networking.k8s.io | ||
| kind: GRPCRoute | ||
| infraIR: | ||
| envoy-gateway/gateway-1: | ||
| proxy: | ||
| listeners: | ||
| - address: null | ||
| name: envoy-gateway/gateway-1/http-1 | ||
| ports: | ||
| - containerPort: 10080 | ||
| name: http-1 | ||
| protocol: HTTP | ||
| servicePort: 80 | ||
| - address: null | ||
| name: envoy-gateway/gateway-1/http-2 | ||
| ports: | ||
| - containerPort: 8080 | ||
| name: http-2 | ||
| protocol: HTTP | ||
| servicePort: 8080 | ||
| metadata: | ||
| labels: | ||
| gateway.envoyproxy.io/owning-gateway-name: gateway-1 | ||
| gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway | ||
| name: envoy-gateway/gateway-1 | ||
| xdsIR: | ||
| envoy-gateway/gateway-1: | ||
| accessLog: | ||
| text: | ||
| - path: /dev/stdout | ||
| http: | ||
| - address: 0.0.0.0 | ||
| hostnames: | ||
| - '*' | ||
| isHTTP2: false | ||
| name: envoy-gateway/gateway-1/http-1 | ||
| path: | ||
| escapedSlashesAction: UnescapeAndRedirect | ||
| mergeSlashes: true | ||
| port: 10080 | ||
| - address: 0.0.0.0 | ||
| hostnames: | ||
| - '*' | ||
| isHTTP2: false | ||
| name: envoy-gateway/gateway-1/http-2 | ||
| path: | ||
| escapedSlashesAction: UnescapeAndRedirect | ||
| mergeSlashes: true | ||
| port: 8080 | ||
| tcpKeepalive: {} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| clientTrafficPolicies: | ||
| - apiVersion: gateway.envoyproxy.io/v1alpha1 | ||
| kind: ClientTrafficPolicy | ||
| metadata: | ||
| namespace: envoy-gateway | ||
| name: target-gateway-1 | ||
| spec: | ||
| connection: {} | ||
| targetRef: | ||
| group: gateway.networking.k8s.io | ||
| kind: Gateway | ||
| name: gateway-1 | ||
| namespace: envoy-gateway | ||
| - apiVersion: gateway.envoyproxy.io/v1alpha1 | ||
| kind: ClientTrafficPolicy | ||
| metadata: | ||
| namespace: envoy-gateway | ||
| name: target-gateway-1-section-http-1 | ||
| spec: | ||
| connection: | ||
| connectionLimit: | ||
| value: 3 | ||
| closeDelay: 10s | ||
| targetRef: | ||
| group: gateway.networking.k8s.io | ||
| kind: Gateway | ||
| name: gateway-1 | ||
| sectionName: http-1 | ||
| namespace: envoy-gateway | ||
| gateways: | ||
| - apiVersion: gateway.networking.k8s.io/v1 | ||
| kind: Gateway | ||
| metadata: | ||
| namespace: envoy-gateway | ||
| name: gateway-1 | ||
| spec: | ||
| gatewayClassName: envoy-gateway-class | ||
| listeners: | ||
| - name: http-1 | ||
| protocol: HTTP | ||
| port: 80 | ||
| allowedRoutes: | ||
| namespaces: | ||
| from: Same | ||
| - name: http-2 | ||
| protocol: HTTP | ||
| port: 8080 | ||
| allowedRoutes: | ||
| namespaces: | ||
| from: Same |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
will this be a little odd?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
its to tackle the issue outlined in #2805