review fixes

guydc · guydc · commit 1ed599a87dfd · 2026-06-30T18:17:06.000-05:00
Signed-off-by: Guy Daich &lt;guy.daich@sap.com&gt;
diff --git a/api/v1alpha1/envoyproxy_healthchecklogging_types.go b/api/v1alpha1/envoyproxy_healthchecklogging_types.go
@@ -56,7 +56,6 @@ const (
 )
 
 // ProxyHealthCheckLogSinkType is the type of a ProxyHealthCheckLog sink.
-// +kubebuilder:validation:Enum=File
 type ProxyHealthCheckLogSinkType string
 
 const (
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -14656,12 +14656,9 @@ spec:
                               - path
                               type: object
                             type:
-                              allOf:
-                              - enum:
-                                - File
-                              - enum:
-                                - File
                               description: Type defines the type of sink.
+                              enum:
+                              - File
                               type: string
                           required:
                           - type
diff --git a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
@@ -14655,12 +14655,9 @@ spec:
                               - path
                               type: object
                             type:
-                              allOf:
-                              - enum:
-                                - File
-                              - enum:
-                                - File
                               description: Type defines the type of sink.
+                              enum:
+                              - File
                               type: string
                           required:
                           - type
diff --git a/internal/ir/xds.go b/internal/ir/xds.go
@@ -3249,6 +3249,8 @@ type ActiveHealthCheck struct {
 	// Overrides defines the configuration of the overriding health check settings for all endpoints
 	// in the backend cluster.
 	Overrides *HealthCheckOverrides `json:"overrides,omitempty" yaml:"overrides,omitempty"`
+	// EventLog configures health check event logging for this cluster.
+	EventLog *ProxyHealthCheckLog `json:"eventLog,omitempty" yaml:"eventLog,omitempty"`
 }
 
 // Validate the fields within the HealthCheck structure.
diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go
diff --git a/internal/xds/translator/cluster.go b/internal/xds/translator/cluster.go
@@ -461,7 +461,14 @@ func buildXdsCluster(args *xdsClusterArgs) (*buildClusterResult, error) {
 	}
 
 	if args.healthCheck != nil && args.healthCheck.Active != nil {
-		cluster.HealthChecks = buildXdsHealthCheck(args.healthCheck.Active, args.routeHostname, args.healthCheckLog)
+		if args.healthCheckLog != nil && args.healthCheck.Active.EventLog == nil {
+			args.healthCheck.Active.EventLog = args.healthCheckLog
+		}
+		hcs, err := buildXdsHealthCheck(args.healthCheck.Active, args.routeHostname)
+		if err != nil {
+			return nil, err
+		}
+		cluster.HealthChecks = hcs
 	}
 
 	if args.healthCheck != nil && args.healthCheck.Passive != nil {
@@ -581,7 +588,7 @@ func buildZoneAwareLbConfig(preferLocal *ir.PreferLocalZone) *commonv3.LocalityL
 	return lbConfig
 }
 
-func buildXdsHealthCheck(healthcheck *ir.ActiveHealthCheck, routeHostname string, healthCheckLogging *ir.ProxyHealthCheckLog) []*corev3.HealthCheck {
+func buildXdsHealthCheck(healthcheck *ir.ActiveHealthCheck, routeHostname string) ([]*corev3.HealthCheck, error) {
 	hc := &corev3.HealthCheck{
 		Timeout:  durationpb.New(healthcheck.Timeout.Duration),
 		Interval: durationpb.New(healthcheck.Interval.Duration),
@@ -633,23 +640,24 @@ func buildXdsHealthCheck(healthcheck *ir.ActiveHealthCheck, routeHostname string
 		}
 	}
 
-	if healthCheckLogging != nil {
+	if healthCheckLogging := healthcheck.EventLog; healthCheckLogging != nil {
 		hc.AlwaysLogHealthCheckFailures = healthCheckLogging.AlwaysLogHealthCheckFailures
 		hc.AlwaysLogHealthCheckSuccess = healthCheckLogging.AlwaysLogHealthCheckSuccess
 		for _, fs := range healthCheckLogging.FileSinks {
 			fileSinkAny, err := proto.ToAnyWithValidation(&hcfilev3.HealthCheckEventFileSink{
 				EventLogPath: fs.Path,
 			})
-			if err == nil {
-				hc.EventLogger = append(hc.EventLogger, &corev3.TypedExtensionConfig{
-					Name:        "envoy.health_check.event_sinks.file",
-					TypedConfig: fileSinkAny,
-				})
+			if err != nil {
+				return nil, err
 			}
+			hc.EventLogger = append(hc.EventLogger, &corev3.TypedExtensionConfig{
+				Name:        "envoy.health_check.event_sinks.file",
+				TypedConfig: fileSinkAny,
+			})
 		}
 	}
 
-	return []*corev3.HealthCheck{hc}
+	return []*corev3.HealthCheck{hc}, nil
 }
 
 func httpHealthCheckHost(healthcheck *ir.HTTPHealthChecker, routeHostname string) string {
diff --git a/internal/xds/translator/testdata/in/xds-ir/ext-proc-with-health-check-log.yaml b/internal/xds/translator/testdata/in/xds-ir/ext-proc-with-health-check-log.yaml
@@ -0,0 +1,55 @@
+http:
+- address: 0.0.0.0
+  hostnames:
+  - '*'
+  name: default/gateway-1/http
+  path:
+    escapedSlashesAction: UnescapeAndRedirect
+    mergeSlashes: true
+  port: 10080
+  routes:
+  - destination:
+      name: httproute/default/httproute-1/rule/0
+      settings:
+      - addressType: IP
+        endpoints:
+        - host: 7.7.7.7
+          port: 8080
+        protocol: HTTP
+        weight: 1
+        name: httproute/default/httproute-1/rule/0/backend/0
+    envoyExtensions:
+      extProcs:
+      - authority: grpc-backend.default:9000
+        destination:
+          name: envoyextensionpolicy/default/policy-for-http-route/extproc/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 1.2.3.4
+              port: 9000
+            protocol: GRPC
+            weight: 1
+            name: envoyextensionpolicy/default/policy-for-http-route/extproc/0/backend/0
+        name: envoyextensionpolicy/default/policy-for-http-route/extproc/0
+        traffic:
+          healthCheck:
+            active:
+              timeout: "500ms"
+              interval: "5s"
+              unhealthyThreshold: 3
+              healthyThreshold: 1
+              grpc:
+                service: envoy.service.ext_proc.v3.ExternalProcessor
+              eventLog:
+                fileSinks:
+                - path: "/dev/stdout"
+                alwaysLogHealthCheckFailures: true
+                alwaysLogHealthCheckSuccess: false
+    hostname: '*'
+    isHTTP2: false
+    name: httproute/default/httproute-1/rule/0/match/0/*
+    pathMatch:
+      distinct: false
+      name: ""
+      prefix: /
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-proc-with-health-check-log.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-proc-with-health-check-log.clusters.yaml
@@ -0,0 +1,66 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_PREFERRED
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/default/httproute-1/rule/0
+  ignoreHealthOnHostRemoval: true
+  loadBalancingPolicy:
+    policies:
+    - typedExtensionConfig:
+        name: envoy.load_balancing_policies.least_request
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+          localityLbConfig:
+            localityWeightedLbConfig: {}
+  name: httproute/default/httproute-1/rule/0
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_PREFERRED
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: envoyextensionpolicy/default/policy-for-http-route/extproc/0
+  healthChecks:
+  - alwaysLogHealthCheckFailures: true
+    eventLogger:
+    - name: envoy.health_check.event_sinks.file
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.health_check.event_sinks.file.v3.HealthCheckEventFileSink
+        eventLogPath: /dev/stdout
+    grpcHealthCheck:
+      serviceName: envoy.service.ext_proc.v3.ExternalProcessor
+    healthyThreshold: 1
+    interval: 5s
+    timeout: 0.500s
+    unhealthyThreshold: 3
+  ignoreHealthOnHostRemoval: true
+  loadBalancingPolicy:
+    policies:
+    - typedExtensionConfig:
+        name: envoy.load_balancing_policies.least_request
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
+          localityLbConfig:
+            localityWeightedLbConfig: {}
+  name: envoyextensionpolicy/default/policy-for-http-route/extproc/0
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-proc-with-health-check-log.endpoints.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-proc-with-health-check-log.endpoints.yaml
@@ -0,0 +1,24 @@
+- clusterName: httproute/default/httproute-1/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/default/httproute-1/rule/0/backend/0
+- clusterName: envoyextensionpolicy/default/policy-for-http-route/extproc/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 9000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: envoyextensionpolicy/default/policy-for-http-route/extproc/0/backend/0
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-proc-with-health-check-log.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-proc-with-health-check-log.listeners.yaml
@@ -0,0 +1,49 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - disabled: true
+          name: envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-http-route/extproc/0
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
+            grpcService:
+              envoyGrpc:
+                authority: grpc-backend.default:9000
+                clusterName: envoyextensionpolicy/default/policy-for-http-route/extproc/0
+              timeout: 10s
+            processingMode:
+              requestHeaderMode: SKIP
+              requestTrailerMode: SKIP
+              responseHeaderMode: SKIP
+              responseTrailerMode: SKIP
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        pathWithEscapedSlashesAction: UNESCAPE_AND_REDIRECT
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: default/gateway-1/http
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http-10080
+        useRemoteAddress: true
+    name: default/gateway-1/http
+  maxConnectionsToAcceptPerSocketEvent: 1
+  name: default/gateway-1/http
+  perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-proc-with-health-check-log.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-proc-with-health-check-log.routes.yaml
@@ -0,0 +1,18 @@
+- ignorePortInHostMatching: true
+  name: default/gateway-1/http
+  virtualHosts:
+  - domains:
+    - '*'
+    name: default/gateway-1/http/*
+    routes:
+    - match:
+        prefix: /
+      name: httproute/default/httproute-1/rule/0/match/0/*
+      route:
+        cluster: httproute/default/httproute-1/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.ext_proc/envoyextensionpolicy/default/policy-for-http-route/extproc/0:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
diff --git a/release-notes/current/new_features/8753-envoyproxy-health-check-event-logging.md b/release-notes/current/new_features/8753-envoyproxy-health-check-event-logging.md
@@ -0,0 +1 @@
+Added support for health check event logging in `EnvoyProxy`, allowing logging of all active health check results or specific events such as success, failure, or state transition.
diff --git a/test/e2e/tests/backend_health_check.go b/test/e2e/tests/backend_health_check.go
@@ -285,7 +285,11 @@ var BackendHealthCheckEventLogTest = suite.ConformanceTest{
 		}
 
 		// Phase 1: only the no-HC route is live — no BTP means no health check
-		// probes are running, so Loki must have zero HC events.
+		// probes are running, so there should be no new HC events while we wait.
+		// Record a baseline first: a prior run within Loki's 10-minute window may
+		// have left events in the log, so we delta against that count rather than
+		// asserting zero.
+		var hcLogBaseline int
 		t.Run("no health check events before HC route is active", func(t *testing.T) {
 			http.MakeRequestAndExpectEventuallyConsistentResponse(t, suite.RoundTripper, suite.TimeoutConfig, gwAddr, http.ExpectedResponse{
 				Request:   http.Request{Path: "/no-hc-event-log"},
@@ -294,9 +298,10 @@ var BackendHealthCheckEventLogTest = suite.ConformanceTest{
 			})
 
 			// Scope to HC events from this test's route only.
-			count, err := QueryLogCountFromLoki(t, suite.Client, lokiLabels, `health_checker_type.*http-with-hc-event-log`)
+			baseline, err := QueryLogCountFromLoki(t, suite.Client, lokiLabels, `health_checker_type.*http-with-hc-event-log`)
 			require.NoError(t, err, "loki query failed")
-			require.Equal(t, 0, count, "expected no HC events before HC-enabled route is active")
+			tlog.Logf(t, "HC event log baseline (pre-route) count=%d", baseline)
+			hcLogBaseline = baseline
 		})
 
 		// Phase 2: apply the HC-enabled route and BTP, then wait for events.
@@ -337,8 +342,8 @@ var BackendHealthCheckEventLogTest = suite.ConformanceTest{
 						tlog.Logf(t, "loki query error: %v", err)
 						return false
 					}
-					tlog.Logf(t, "loki match %q count=%d", hcLogMatch, count)
-					return count > 0
+					tlog.Logf(t, "loki match %q count=%d (baseline=%d)", hcLogMatch, count, hcLogBaseline)
+					return count > hcLogBaseline
 				},
 			)
 		})
diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml
@@ -46235,12 +46235,9 @@ spec:
                               - path
                               type: object
                             type:
-                              allOf:
-                              - enum:
-                                - File
-                              - enum:
-                                - File
                               description: Type defines the type of sink.
+                              enum:
+                              - File
                               type: string
                           required:
                           - type
diff --git a/test/helm/gateway-crds-helm/e2e.out.yaml b/test/helm/gateway-crds-helm/e2e.out.yaml
diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml

Original file line number	Diff line number	Diff line change
`@@ -56,7 +56,6 @@ const (`
`56`	`56`	`)`
`57`	`57`
`58`	`58`	`// ProxyHealthCheckLogSinkType is the type of a ProxyHealthCheckLog sink.`
`59`		`-// +kubebuilder:validation:Enum=File`
`60`	`59`	`type ProxyHealthCheckLogSinkType string`
`61`	`60`
`62`	`61`	`const (`
Original file line number	Diff line number	Diff line change
`@@ -3249,6 +3249,8 @@ type ActiveHealthCheck struct {`
`3249`	`3249`	`// Overrides defines the configuration of the overriding health check settings for all endpoints`
`3250`	`3250`	`// in the backend cluster.`
`3251`	`3251`	Overrides *HealthCheckOverrides `json:"overrides,omitempty" yaml:"overrides,omitempty"`
	`3252`	`+ // EventLog configures health check event logging for this cluster.`
	`3253`	+ EventLog *ProxyHealthCheckLog `json:"eventLog,omitempty" yaml:"eventLog,omitempty"`
`3252`	`3254`	`}`
`3253`	`3255`
`3254`	`3256`	`// Validate the fields within the HealthCheck structure.`
Original file line number	Diff line number	Diff line change
`@@ -461,7 +461,14 @@ func buildXdsCluster(args xdsClusterArgs) (buildClusterResult, error) {`
`461`	`461`	`}`
`462`	`462`
`463`	`463`	`if args.healthCheck != nil && args.healthCheck.Active != nil {`
`464`		`- cluster.HealthChecks = buildXdsHealthCheck(args.healthCheck.Active, args.routeHostname, args.healthCheckLog)`
	`464`	`+ if args.healthCheckLog != nil && args.healthCheck.Active.EventLog == nil {`
	`465`	`+ args.healthCheck.Active.EventLog = args.healthCheckLog`
	`466`	`+ }`
	`467`	`+ hcs, err := buildXdsHealthCheck(args.healthCheck.Active, args.routeHostname)`
	`468`	`+ if err != nil {`
	`469`	`+ return nil, err`
	`470`	`+ }`
	`471`	`+ cluster.HealthChecks = hcs`
`465`	`472`	`}`
`466`	`473`
`467`	`474`	`if args.healthCheck != nil && args.healthCheck.Passive != nil {`
`@@ -581,7 +588,7 @@ func buildZoneAwareLbConfig(preferLocal ir.PreferLocalZone) commonv3.LocalityL`
`581`	`588`	`return lbConfig`
`582`	`589`	`}`
`583`	`590`
`584`		`-func buildXdsHealthCheck(healthcheck ir.ActiveHealthCheck, routeHostname string, healthCheckLogging ir.ProxyHealthCheckLog) []*corev3.HealthCheck {`
	`591`	`+func buildXdsHealthCheck(healthcheck ir.ActiveHealthCheck, routeHostname string) ([]corev3.HealthCheck, error) {`
`585`	`592`	`hc := &corev3.HealthCheck{`
`586`	`593`	`Timeout: durationpb.New(healthcheck.Timeout.Duration),`
`587`	`594`	`Interval: durationpb.New(healthcheck.Interval.Duration),`
`@@ -633,23 +640,24 @@ func buildXdsHealthCheck(healthcheck *ir.ActiveHealthCheck, routeHostname string`
`633`	`640`	`}`
`634`	`641`	`}`
`635`	`642`
`636`		`- if healthCheckLogging != nil {`
	`643`	`+ if healthCheckLogging := healthcheck.EventLog; healthCheckLogging != nil {`
`637`	`644`	`hc.AlwaysLogHealthCheckFailures = healthCheckLogging.AlwaysLogHealthCheckFailures`
`638`	`645`	`hc.AlwaysLogHealthCheckSuccess = healthCheckLogging.AlwaysLogHealthCheckSuccess`
`639`	`646`	`for _, fs := range healthCheckLogging.FileSinks {`
`640`	`647`	`fileSinkAny, err := proto.ToAnyWithValidation(&hcfilev3.HealthCheckEventFileSink{`
`641`	`648`	`EventLogPath: fs.Path,`
`642`	`649`	`})`
`643`		`- if err == nil {`
`644`		`- hc.EventLogger = append(hc.EventLogger, &corev3.TypedExtensionConfig{`
`645`		`- Name: "envoy.health_check.event_sinks.file",`
`646`		`- TypedConfig: fileSinkAny,`
`647`		`- })`
	`650`	`+ if err != nil {`
	`651`	`+ return nil, err`
`648`	`652`	`}`
	`653`	`+ hc.EventLogger = append(hc.EventLogger, &corev3.TypedExtensionConfig{`
	`654`	`+ Name: "envoy.health_check.event_sinks.file",`
	`655`	`+ TypedConfig: fileSinkAny,`
	`656`	`+ })`
`649`	`657`	`}`
`650`	`658`	`}`
`651`	`659`
`652`		`- return []*corev3.HealthCheck{hc}`
	`660`	`+ return []*corev3.HealthCheck{hc}, nil`
`653`	`661`	`}`
`654`	`662`
`655`	`663`	`func httpHealthCheckHost(healthcheck *ir.HTTPHealthChecker, routeHostname string) string {`