-
Notifications
You must be signed in to change notification settings - Fork 388
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(translator): implement connection limit #2952
Merged
Merged
Changes from 14 commits
Commits
Show all changes
21 commits
Select commit
Hold shift + click to select a range
2dca063
implement connection limit
guydc e812453
fix lint
guydc bfdc022
Merge branch 'main' into impl-connection-limit
guydc ffae688
fix lint 2
guydc 5191c18
fix ir, coverage
guydc a1e6bec
fix lint 3
guydc f40b55e
open more connection in e2e
guydc 965de99
fix error type
guydc 1862acc
add additional connections
guydc 24dd151
make limit value required
guydc eda6cfb
Merge branch 'main' into impl-connection-limit
guydc a57d66a
add error-flow unit test
guydc 97580f9
fix lint 4
guydc 55e8421
assert policy accepted in test
guydc aae2e55
Merge branch 'main' into impl-connection-limit
guydc 21d982a
Merge branch 'main' into impl-connection-limit
guydc 248c9de
Merge branch 'main' into impl-connection-limit
guydc 9a059db
Merge branch 'main' into impl-connection-limit
guydc dd991fc
Merge branch 'main' into impl-connection-limit
guydc bda9c13
rename limit => connectionLimit
guydc efbcc23
Merge branch 'main' into impl-connection-limit
zirain File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
50 changes: 50 additions & 0 deletions
50
internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit-error.in.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| clientTrafficPolicies: | ||
| - apiVersion: gateway.envoyproxy.io/v1alpha1 | ||
| kind: ClientTrafficPolicy | ||
| metadata: | ||
| namespace: envoy-gateway | ||
| name: target-gateway-1 | ||
| spec: | ||
| tcpKeepalive: {} | ||
| targetRef: | ||
| group: gateway.networking.k8s.io | ||
| kind: Gateway | ||
| name: gateway-1 | ||
| namespace: envoy-gateway | ||
| - apiVersion: gateway.envoyproxy.io/v1alpha1 | ||
| kind: ClientTrafficPolicy | ||
| metadata: | ||
| namespace: envoy-gateway | ||
| name: target-gateway-1-section-http-1 | ||
| spec: | ||
| connection: | ||
| limit: | ||
| value: 3 | ||
| closeDelay: 10mib | ||
| targetRef: | ||
| group: gateway.networking.k8s.io | ||
| kind: Gateway | ||
| name: gateway-1 | ||
| sectionName: http-1 | ||
| namespace: envoy-gateway | ||
| gateways: | ||
| - apiVersion: gateway.networking.k8s.io/v1 | ||
| kind: Gateway | ||
| metadata: | ||
| namespace: envoy-gateway | ||
| name: gateway-1 | ||
| spec: | ||
| gatewayClassName: envoy-gateway-class | ||
| listeners: | ||
| - name: http-1 | ||
| protocol: HTTP | ||
| port: 80 | ||
| allowedRoutes: | ||
| namespaces: | ||
| from: Same | ||
| - name: http-2 | ||
| protocol: HTTP | ||
| port: 8080 | ||
| allowedRoutes: | ||
| namespaces: | ||
| from: Same |
184 changes: 184 additions & 0 deletions
184
internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit-error.out.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,184 @@ | ||
| clientTrafficPolicies: | ||
| - apiVersion: gateway.envoyproxy.io/v1alpha1 | ||
| kind: ClientTrafficPolicy | ||
| metadata: | ||
| creationTimestamp: null | ||
| name: target-gateway-1-section-http-1 | ||
| namespace: envoy-gateway | ||
| spec: | ||
| connection: | ||
| limit: | ||
| closeDelay: 10mib | ||
| value: 3 | ||
| targetRef: | ||
| group: gateway.networking.k8s.io | ||
| kind: Gateway | ||
| name: gateway-1 | ||
| namespace: envoy-gateway | ||
| sectionName: http-1 | ||
| status: | ||
| ancestors: | ||
| - ancestorRef: | ||
| group: gateway.networking.k8s.io | ||
| kind: Gateway | ||
| name: gateway-1 | ||
| namespace: envoy-gateway | ||
| sectionName: http-1 | ||
| conditions: | ||
| - lastTransitionTime: null | ||
| message: Invalid CloseDelay value 10mib | ||
| reason: Invalid | ||
| status: "False" | ||
| type: Accepted | ||
| controllerName: gateway.envoyproxy.io/gatewayclass-controller | ||
| - apiVersion: gateway.envoyproxy.io/v1alpha1 | ||
| kind: ClientTrafficPolicy | ||
| metadata: | ||
| creationTimestamp: null | ||
| name: target-gateway-1 | ||
| namespace: envoy-gateway | ||
| spec: | ||
| targetRef: | ||
| group: gateway.networking.k8s.io | ||
| kind: Gateway | ||
| name: gateway-1 | ||
| namespace: envoy-gateway | ||
| tcpKeepalive: {} | ||
| status: | ||
| ancestors: | ||
| - ancestorRef: | ||
| group: gateway.networking.k8s.io | ||
| kind: Gateway | ||
| name: gateway-1 | ||
| namespace: envoy-gateway | ||
| conditions: | ||
| - lastTransitionTime: null | ||
| message: There are existing ClientTrafficPolicies that are overriding these | ||
| sections [http-1] | ||
| reason: Overridden | ||
| status: "True" | ||
| type: Overridden | ||
| - lastTransitionTime: null | ||
| message: Policy has been accepted. | ||
| reason: Accepted | ||
| status: "True" | ||
| type: Accepted | ||
| controllerName: gateway.envoyproxy.io/gatewayclass-controller | ||
| gateways: | ||
| - apiVersion: gateway.networking.k8s.io/v1 | ||
| kind: Gateway | ||
| metadata: | ||
| creationTimestamp: null | ||
| name: gateway-1 | ||
| namespace: envoy-gateway | ||
| spec: | ||
| gatewayClassName: envoy-gateway-class | ||
| listeners: | ||
| - allowedRoutes: | ||
| namespaces: | ||
| from: Same | ||
| name: http-1 | ||
| port: 80 | ||
| protocol: HTTP | ||
| - allowedRoutes: | ||
| namespaces: | ||
| from: Same | ||
| name: http-2 | ||
| port: 8080 | ||
| protocol: HTTP | ||
| status: | ||
| listeners: | ||
| - attachedRoutes: 0 | ||
| conditions: | ||
| - lastTransitionTime: null | ||
| message: Sending translated listener configuration to the data plane | ||
| reason: Programmed | ||
| status: "True" | ||
| type: Programmed | ||
| - lastTransitionTime: null | ||
| message: Listener has been successfully translated | ||
| reason: Accepted | ||
| status: "True" | ||
| type: Accepted | ||
| - lastTransitionTime: null | ||
| message: Listener references have been resolved | ||
| reason: ResolvedRefs | ||
| status: "True" | ||
| type: ResolvedRefs | ||
| name: http-1 | ||
| supportedKinds: | ||
| - group: gateway.networking.k8s.io | ||
| kind: HTTPRoute | ||
| - group: gateway.networking.k8s.io | ||
| kind: GRPCRoute | ||
| - attachedRoutes: 0 | ||
| conditions: | ||
| - lastTransitionTime: null | ||
| message: Sending translated listener configuration to the data plane | ||
| reason: Programmed | ||
| status: "True" | ||
| type: Programmed | ||
| - lastTransitionTime: null | ||
| message: Listener has been successfully translated | ||
| reason: Accepted | ||
| status: "True" | ||
| type: Accepted | ||
| - lastTransitionTime: null | ||
| message: Listener references have been resolved | ||
| reason: ResolvedRefs | ||
| status: "True" | ||
| type: ResolvedRefs | ||
| name: http-2 | ||
| supportedKinds: | ||
| - group: gateway.networking.k8s.io | ||
| kind: HTTPRoute | ||
| - group: gateway.networking.k8s.io | ||
| kind: GRPCRoute | ||
| infraIR: | ||
| envoy-gateway/gateway-1: | ||
| proxy: | ||
| listeners: | ||
| - address: null | ||
| name: envoy-gateway/gateway-1/http-1 | ||
| ports: | ||
| - containerPort: 10080 | ||
| name: http-1 | ||
| protocol: HTTP | ||
| servicePort: 80 | ||
| - address: null | ||
| name: envoy-gateway/gateway-1/http-2 | ||
| ports: | ||
| - containerPort: 8080 | ||
| name: http-2 | ||
| protocol: HTTP | ||
| servicePort: 8080 | ||
| metadata: | ||
| labels: | ||
| gateway.envoyproxy.io/owning-gateway-name: gateway-1 | ||
| gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway | ||
| name: envoy-gateway/gateway-1 | ||
| xdsIR: | ||
| envoy-gateway/gateway-1: | ||
| accessLog: | ||
| text: | ||
| - path: /dev/stdout | ||
| http: | ||
| - address: 0.0.0.0 | ||
| hostnames: | ||
| - '*' | ||
| isHTTP2: false | ||
| name: envoy-gateway/gateway-1/http-1 | ||
| path: | ||
| escapedSlashesAction: UnescapeAndRedirect | ||
| mergeSlashes: true | ||
| port: 10080 | ||
| - address: 0.0.0.0 | ||
| hostnames: | ||
| - '*' | ||
| isHTTP2: false | ||
| name: envoy-gateway/gateway-1/http-2 | ||
| path: | ||
| escapedSlashesAction: UnescapeAndRedirect | ||
| mergeSlashes: true | ||
| port: 8080 | ||
| tcpKeepalive: {} |
50 changes: 50 additions & 0 deletions
50
internal/gatewayapi/testdata/clienttrafficpolicy-connection-limit.in.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| clientTrafficPolicies: | ||
| - apiVersion: gateway.envoyproxy.io/v1alpha1 | ||
| kind: ClientTrafficPolicy | ||
| metadata: | ||
| namespace: envoy-gateway | ||
| name: target-gateway-1 | ||
| spec: | ||
| connection: {} | ||
| targetRef: | ||
| group: gateway.networking.k8s.io | ||
| kind: Gateway | ||
| name: gateway-1 | ||
| namespace: envoy-gateway | ||
| - apiVersion: gateway.envoyproxy.io/v1alpha1 | ||
| kind: ClientTrafficPolicy | ||
| metadata: | ||
| namespace: envoy-gateway | ||
| name: target-gateway-1-section-http-1 | ||
| spec: | ||
| connection: | ||
| limit: | ||
| value: 3 | ||
| closeDelay: 10s | ||
| targetRef: | ||
| group: gateway.networking.k8s.io | ||
| kind: Gateway | ||
| name: gateway-1 | ||
| sectionName: http-1 | ||
| namespace: envoy-gateway | ||
| gateways: | ||
| - apiVersion: gateway.networking.k8s.io/v1 | ||
| kind: Gateway | ||
| metadata: | ||
| namespace: envoy-gateway | ||
| name: gateway-1 | ||
| spec: | ||
| gatewayClassName: envoy-gateway-class | ||
| listeners: | ||
| - name: http-1 | ||
| protocol: HTTP | ||
| port: 80 | ||
| allowedRoutes: | ||
| namespaces: | ||
| from: Same | ||
| - name: http-2 | ||
| protocol: HTTP | ||
| port: 8080 | ||
| allowedRoutes: | ||
| namespaces: | ||
| from: Same |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
is there a default envoy uses here ?
there maybe a valid use case here where the user wants to use the default here (not set it) and set CloseDelay instead (where the default isn't good enough)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No default is mentioned in the docs. It looks like the filter constructor requires a value to be provided: https://github.com/envoyproxy/envoy/blob/e4bd0e6f70749a50dd122d5d7006e8913bb9e84c/source/extensions/filters/network/connection_limit/connection_limit.cc#L17C24-L17C53 by the filter config. So, I think that it's legitimate to require a value if the user decides to opt-in for this feature.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do you think EG should set a default here ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'd vote to leave it to users to decide what this value should be.
It might be difficult to choose a default value for max connections because it depends on things we don't know before deploying EG in production: the scale of clients, the spec of the machine the EG is running on, etc.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
+1 to huabing's position. When we support instance (overload manager) and/or listener connection limits with defaults (e.g. 50k), we can validate that this limit is not higher than those limits, which will create an effective "range" for users to choose from.