config

Documentation

Overview

Package config provides Envoy configuration helpers for xDS resources. It contains utility functions for building common Envoy configuration patterns such as ADS config sources, protocol options, and SPIRE cluster configurations.

Index

• Constants
• func Http1ProtocolOptions() *httpv3.HttpProtocolOptions
• func Http2ProtocolOptions() *httpv3.HttpProtocolOptions
• func SDSConfigSourceFromCluster(clusterName string) *corev3.ConfigSource
• func TypedConfig(config proto.Message) *anypb.Any
• func UseDownstreamProtocolOptions() *httpv3.HttpProtocolOptions
• func XDSConfigSourceADS() *corev3.ConfigSource

Constants

const (
	// UpstreamHTTPProtocolOptionsKey is the Envoy extension key for HTTP protocol options
	// applied to upstream (outbound) connections.
	UpstreamHTTPProtocolOptionsKey = "envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
)

const UpstreamIdleTimeout = 30 * time.Second

UpstreamIdleTimeout bounds how long an idle upstream connection (and its pool) survives. Service clusters use connection_pool_per_downstream_connection for per-source mTLS, so when a downstream connection closes its dedicated pool is orphaned — it can never be selected again, and the only thing that reclaims its upstream connection is this idle timeout. Envoy's default is 1 HOUR: under non-keepalive downstream traffic that plateaus at rate×3600 leaked mTLS connections per proxy (observed: ~41k active upstream conns and 3.2 GiB heap within minutes on talos-main). 30s caps the orphan window; for live downstream connections an idle upstream is simply re-established on the next request.

Functions

func Http1ProtocolOptions

func Http1ProtocolOptions() *httpv3.HttpProtocolOptions

Http1ProtocolOptions creates HTTP/1.1 protocol options for upstream clusters. This is used to configure Envoy to communicate with services that only support HTTP/1.1.

func Http2ProtocolOptions

func Http2ProtocolOptions() *httpv3.HttpProtocolOptions

Http2ProtocolOptions creates HTTP/2 protocol options for upstream clusters. This is used to configure Envoy to communicate with services that support HTTP/2.

func SDSConfigSourceFromCluster

func SDSConfigSourceFromCluster(clusterName string) *corev3.ConfigSource

SDSConfigSourceFromCluster creates a ConfigSource that fetches secrets over a gRPC SDS stream to a named (static, bootstrap-defined) cluster. The edge proxy uses it to point its transport sockets at the SPIRE Agent's native Envoy SDS API (served on the Workload API socket), so Envoy fetches its own SVID and trust bundle straight from SPIRE — no agent-side SPIRE bridge. The node proxy keeps the ADS source (XDSConfigSourceADS) because it multiplexes many workload identities the agent delivers as snapshot secrets.

func TypedConfig

func TypedConfig(config proto.Message) *anypb.Any

TypedConfig wraps a protobuf message as a Google Any type. This is used to package Envoy extension configurations for transport in xDS messages.

func UseDownstreamProtocolOptions

func UseDownstreamProtocolOptions() *httpv3.HttpProtocolOptions

UseDownstreamProtocolOptions creates HTTP protocol options that make the upstream connection MIRROR the downstream protocol (Envoy's USE_DOWNSTREAM_PROTOCOL semantics): an HTTP/1.1 downstream dials HTTP/1.1 upstream, an HTTP/2 (incl. h2c) downstream dials h2c upstream.

This is required for the redirect-all capture passthrough (proposal 022): non-mesh traffic sniffed as cleartext HTTP by http_inspector transits the cap_http HCM and is forwarded to the ORIGINAL_DST passthrough cluster. Without these options the passthrough defaults to HTTP/1.1 upstream, so an h2c gRPC client to a non-mesh h2-only server (e.g. an OTLP otel-collector on :4317) gets "reset reason: protocol error" — the HCM dialed HTTP/1.1 to an h2-only upstream (issue #568). Mirroring the downstream protocol keeps both cleartext HTTP/1.1 and h2c non-mesh egress working through the passthrough.

Both Http1 and Http2 option messages are populated so Envoy has the concrete codec config for whichever protocol the downstream turns out to be.

func XDSConfigSourceADS

func XDSConfigSourceADS() *corev3.ConfigSource

XDSConfigSourceADS creates a ConfigSource that uses ADS (Aggregated Discovery Service) for dynamic configuration updates.