feat: add admission control functionality by aburan28 · Pull Request #7529 · envoyproxy/gateway

aburan28 · 2025-11-15T18:17:41Z

What type of PR is this?

feature

What this PR does / why we need it

This PR adds support for Envoy's Admission Control filter to Envoy Gateway by exposing it through BackendTrafficPolicy.

Admission control probabilistically rejects requests based on the historical success rate of upstream requests within a configurable sliding time window. This provides client-side load shedding for overloaded or degraded backends and complements circuit breaking and retry policies.

Changes include

API types: adds AdmissionControl with configurable samplingWindow, successRateThreshold, aggression, rpsThreshold, maxRejectionProbability, and success criteria for HTTP and gRPC.
BackendTrafficPolicy API: adds the optional admissionControl field.
Gateway API translation: translates admission-control policy config into XDS IR traffic features.
XDS translation: configures Envoy's envoy.filters.http.admission_control as an upstream HTTP filter on generated clusters.
EnvoyFilter registration: registers envoy.filters.http.admission_control as a known Envoy filter.
Generated artifacts: updates CRDs, deepcopy methods, Helm golden output, and API docs.
Tests and examples: adds xDS translator coverage, Gateway API testdata, and a Kubernetes example manifest.

Which issue(s) this PR fixes

None linked.

Release Notes

Added admission control support to BackendTrafficPolicy, enabling client-side load shedding based on historical upstream success rates using Envoy's admission control filter.

codecov · 2025-11-15T18:26:45Z

Codecov Report

❌ Patch coverage is 93.61702% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.47%. Comparing base (cab6837) to head (80c8975).
⚠️ Report is 9 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/gatewayapi/backendtrafficpolicy.go	93.33%	1 Missing and 1 partial ⚠️
internal/xds/translator/admission_control.go	96.42%	1 Missing and 1 partial ⚠️
internal/xds/translator/cluster.go	71.42%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7529      +/-   ##
==========================================
+ Coverage   74.39%   74.47%   +0.07%     
==========================================
  Files         246      247       +1     
  Lines       39221    39314      +93     
==========================================
+ Hits        29180    29280     +100     
+ Misses       8017     8009       -8     
- Partials     2024     2025       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

arkodg · 2025-11-25T01:40:09Z

hey @aburan28 you've also raised #7016 for adding adaptive concurrency control support, these are similar options to throttle clients based on server characteristics ( latency, load), would help if you can outline your use case first, so we can prioritize one or the other, and document the reasons for adding support for it

github-actions · 2025-12-30T20:02:31Z

This pull request has been automatically marked as stale because it has not had activity in the last 30 days. Please feel free to give a status update now, ping for review, when it's ready. Thank you for your contributions!

netlify · 2026-02-13T19:54:34Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`80c8975`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69eba361782afa000800d351
😎 Deploy Preview	https://deploy-preview-7529--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

aburan28 · 2026-02-22T18:16:36Z

hey @aburan28 you've also raised #7016 for adding adaptive concurrency control support, these are similar options to throttle clients based on server characteristics ( latency, load), would help if you can outline your use case first, so we can prioritize one or the other, and document the reasons for adding support for it

IMO, Admission Control and Adaptive Concurrency are complementary, not competing strategies. They address different failure signals and protect backends in different ways. I believe it is useful to include both within Envoy Gateway.

Admission control does have a simpler operational overhead compared to adaptive concurrency. It deals with error rates which users can reason about easily. So for now my focus is on admission control although I do have a PR for adaptive concurrency open as well.

Use cases I have are really to emulate a dynamic circuit breaker that is based off of success/error rate and to protect backends from overload.

arkodg · 2026-02-22T21:56:10Z

hey @aburan28 you've also raised #7016 for adding adaptive concurrency control support, these are similar options to throttle clients based on server characteristics ( latency, load), would help if you can outline your use case first, so we can prioritize one or the other, and document the reasons for adding support for it

IMO, Admission Control and Adaptive Concurrency are complementary, not competing strategies. They address different failure signals and protect backends in different ways. I believe it is useful to include both within Envoy Gateway.

Admission control does have a simpler operational overhead compared to adaptive concurrency. It deals with error rates which users can reason about easily. So for now my focus is on admission control although I do have a PR for adaptive concurrency open as well.

Use cases I have are really to emulate a dynamic circuit breaker that is based off of success/error rate and to protect backends from overload.

sure +1 for Admission Control to solve the dynamic circuit breaker issue

going forward lets start with a GH issue, an API PR and then an implementation PR

for this feature, lets use this PR

arkodg · 2026-03-07T22:01:41Z

hey @aburan28 can you resolve the mere conflicts

arkodg · 2026-03-08T04:26:12Z

make gen-check is still failing - can you run make manifests && make generate and commit those changes

- Remove Enabled field (presence of admissionControl implies enabled) - Switch SuccessRateThreshold, Aggression, MaxRejectionProbability from float64 to uint32 to avoid floats in the API layer - Register envoy.filters.http.admission_control in the EnvoyFilter enum - Fix example manifest (srThreshold -> successRateThreshold, integer values) - Regenerate CRDs, deepcopy, docs, and xds translator testdata Signed-off-by: Adam Buran <aburan28@gmail.com>

Remove stale lbPolicy field from cluster output after main merge. Signed-off-by: Adam Buran <aburan28@gmail.com>

Regenerates test/helm/gateway-crds-helm/*.out.yaml and site/content/en/latest/api/extension_types.md to match the current admission control API (int32 percentages, enabled field removed) and pick up envoy.filters.http.admission_control in the filter order enum. Signed-off-by: Adam Buran <aburan28@gmail.com>

…-control Signed-off-by: Adam Buran <aburan28@gmail.com>

…igo lint Signed-off-by: Adam Buran <aburan28@gmail.com>

jukie · 2026-04-17T14:08:09Z

Please add a testdata example under internal/gatewayapi/

…map, add gatewayapi testdata - Revert the HCM HTTP filter ordering shifts in newOrderedHTTPFilter; the admission_control filter is registered as an upstream cluster filter, so it does not need a slot in the downstream HCM ordering. - Move the gRPC status-code lookup map to a package-level var so it is not rebuilt on every translation cycle. - Add backendtrafficpolicy-admission-control gatewayapi testdata covering both gateway-targeted (gRPC success criteria, all knobs set) and route-targeted (HTTP success criteria, minimal config) policies. Signed-off-by: Adam Buran <adam.buran@gmail.com> Signed-off-by: Adam Buran <aburan28@gmail.com>

jukie · 2026-04-17T16:00:45Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a98b9e2213

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Signed-off-by: Adam Buran <aburan28@gmail.com>

jukie · 2026-04-23T04:40:01Z

@codex review

chatgpt-codex-connector · 2026-04-23T04:49:35Z

Codex Review: Didn't find any major issues. Chef's kiss.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

jukie · 2026-04-23T04:54:36Z

Thanks for working on this @aburan28. A few nits to fix but besides that LGTM.

Signed-off-by: Adam Buran <aburan28@gmail.com>

jukie · 2026-04-24T17:07:34Z

LGTM thanks!

jukie · 2026-04-25T02:18:47Z

@aburan28 can you fix the conflicts from main and add a release note?

aburan28 marked this pull request as ready for review November 15, 2025 18:18

aburan28 requested a review from a team as a code owner November 15, 2025 18:18

zhaohuabing reviewed Nov 24, 2025

View reviewed changes

Comment thread api/v1alpha1/admission_control.go Outdated

github-actions Bot added the stale label Dec 30, 2025

github-actions Bot removed the stale label Feb 13, 2026

aburan28 force-pushed the adam--add-admission-control branch from 674710b to 9e8be42 Compare February 13, 2026 22:34

aburan28 closed this Feb 14, 2026

aburan28 reopened this Feb 14, 2026

arkodg added this to the v1.8.0-rc.1 Release milestone Feb 22, 2026

arkodg requested review from a team February 22, 2026 21:50

arkodg reviewed Feb 23, 2026

View reviewed changes

Comment thread api/v1alpha1/admission_control.go

arkodg reviewed Feb 23, 2026

View reviewed changes

Comment thread api/v1alpha1/admission_control.go

arkodg reviewed Feb 23, 2026

View reviewed changes

Comment thread api/v1alpha1/admission_control.go Outdated

aburan28 force-pushed the adam--add-admission-control branch from b26aea7 to aeb7925 Compare February 28, 2026 23:36

arkodg reviewed Mar 2, 2026

View reviewed changes

Comment thread api/v1alpha1/admission_control.go Outdated

arkodg reviewed Mar 2, 2026

View reviewed changes

Comment thread api/v1alpha1/admission_control.go Outdated

arkodg requested review from a team and zhaohuabing March 7, 2026 22:03

arkodg previously approved these changes Mar 15, 2026

View reviewed changes

arkodg self-requested a review March 15, 2026 02:47

aburan28 added 5 commits April 10, 2026 14:36

Merge branch 'main' into adam--add-admission-control

6545ecc

test: regenerate admission-control testdata

97fc2da

Remove stale lbPolicy field from cluster output after main merge. Signed-off-by: Adam Buran <aburan28@gmail.com>

Merge remote-tracking branch 'upstream/main' into adam--add-admission…

2a8a41a

…-control Signed-off-by: Adam Buran <aburan28@gmail.com>

aburan28 force-pushed the adam--add-admission-control branch from 3bd62c4 to 2a8a41a Compare April 17, 2026 03:27

fix(admission-control): use new() instead of ptr.To to satisfy forbid…

a65fc3d

…igo lint Signed-off-by: Adam Buran <aburan28@gmail.com>

jukie reviewed Apr 17, 2026

View reviewed changes

Comment thread internal/xds/translator/httpfilters.go Outdated

jukie reviewed Apr 17, 2026

View reviewed changes

Comment thread internal/xds/translator/admission_control.go Outdated

chatgpt-codex-connector Bot reviewed Apr 17, 2026

View reviewed changes

Comment thread api/v1alpha1/backendtrafficpolicy_types.go

Comment thread examples/kubernetes/admission-control.yaml Outdated

Remove namespace from admission control targetRef

7b7bfdb

Signed-off-by: Adam Buran <aburan28@gmail.com>

jukie requested changes Apr 23, 2026

View reviewed changes

Comment thread internal/xds/translator/admission_control.go Outdated

Comment thread internal/gatewayapi/backendtrafficpolicy.go Outdated

Comment thread internal/ir/xds.go

Comment thread internal/ir/xds.go

jukie changed the title ~~add admission control functionality~~ feat: add admission control functionality Apr 23, 2026

Address admission control review feedback

16fc1f4

Signed-off-by: Adam Buran <aburan28@gmail.com>

jukie approved these changes Apr 24, 2026

View reviewed changes

jukie requested review from a team and arkodg April 24, 2026 17:07

Merge branch 'main' into adam--add-admission-control

80c8975

arkodg approved these changes Apr 26, 2026

View reviewed changes

jukie mentioned this pull request Apr 27, 2026

feat: add admission control to BackendTrafficPolicy #8872

Merged

zhaohuabing closed this Apr 28, 2026

Uh oh!

Conversation

aburan28 commented Nov 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

What this PR does / why we need it

Changes include

Which issue(s) this PR fixes

Release Notes

Uh oh!

codecov Bot commented Nov 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

arkodg commented Nov 25, 2025

Uh oh!

github-actions Bot commented Dec 30, 2025

Uh oh!

netlify Bot commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

aburan28 commented Feb 22, 2026

Uh oh!

arkodg commented Feb 22, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

arkodg commented Mar 7, 2026

Uh oh!

arkodg commented Mar 8, 2026

Uh oh!

Uh oh!

jukie commented Apr 17, 2026

Uh oh!

Uh oh!

jukie commented Apr 17, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jukie commented Apr 23, 2026

Uh oh!

chatgpt-codex-connector Bot commented Apr 23, 2026

Uh oh!

jukie commented Apr 23, 2026

Uh oh!

jukie commented Apr 24, 2026

Uh oh!

jukie commented Apr 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

aburan28 commented Nov 15, 2025 •

edited

Loading

codecov Bot commented Nov 15, 2025 •

edited

Loading

netlify Bot commented Feb 13, 2026 •

edited

Loading