feat: add admission control to BackendTrafficPolicy - #8872
Merged
Conversation
Signed-off-by: Adam Buran <aburan28@gmail.com>
Signed-off-by: Adam Buran <aburan28@gmail.com>
Signed-off-by: Adam Buran <aburan28@gmail.com>
- Change SamplingWindow from *metav1.Duration to *gwapiv1.Duration to satisfy kube-api-linter (nodurations rule) - Add parseSamplingWindow converter in gateway API translator to convert gwapiv1.Duration to metav1.Duration for the IR - Fix unused-parameter lint errors in patchRoute and patchResources by renaming unused params to _ - Regenerate deepcopy, CRD manifests, helm test outputs, and API docs Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Adam Buran <aburan28@gmail.com>
Signed-off-by: Adam Buran <aburan28@gmail.com>
Signed-off-by: Adam Buran <aburan28@gmail.com>
Signed-off-by: Adam Buran <aburan28@gmail.com>
Signed-off-by: Adam Buran <aburan28@gmail.com>
Signed-off-by: Adam Buran <aburan28@gmail.com>
Signed-off-by: Adam Buran <aburan28@gmail.com>
Signed-off-by: Adam Buran <aburan28@gmail.com>
Signed-off-by: Adam Buran <aburan28@gmail.com>
Signed-off-by: Adam Buran <aburan28@gmail.com>
Signed-off-by: Adam Buran <aburan28@gmail.com>
Fix merge conflicts from rebase onto upstream/main, fix missing imports in admission control tests, and ensure EvaluationCriteria is always set in the admission control config. Signed-off-by: Adam Buran <aburan28@gmail.com>
- Remove Enabled field (presence of admissionControl implies enabled) - Switch SuccessRateThreshold, Aggression, MaxRejectionProbability from float64 to uint32 to avoid floats in the API layer - Register envoy.filters.http.admission_control in the EnvoyFilter enum - Fix example manifest (srThreshold -> successRateThreshold, integer values) - Regenerate CRDs, deepcopy, docs, and xds translator testdata Signed-off-by: Adam Buran <aburan28@gmail.com>
Remove stale lbPolicy field from cluster output after main merge. Signed-off-by: Adam Buran <aburan28@gmail.com>
Regenerates test/helm/gateway-crds-helm/*.out.yaml and site/content/en/latest/api/extension_types.md to match the current admission control API (int32 percentages, enabled field removed) and pick up envoy.filters.http.admission_control in the filter order enum. Signed-off-by: Adam Buran <aburan28@gmail.com>
…-control Signed-off-by: Adam Buran <aburan28@gmail.com>
…igo lint Signed-off-by: Adam Buran <aburan28@gmail.com>
…map, add gatewayapi testdata - Revert the HCM HTTP filter ordering shifts in newOrderedHTTPFilter; the admission_control filter is registered as an upstream cluster filter, so it does not need a slot in the downstream HCM ordering. - Move the gRPC status-code lookup map to a package-level var so it is not rebuilt on every translation cycle. - Add backendtrafficpolicy-admission-control gatewayapi testdata covering both gateway-targeted (gRPC success criteria, all knobs set) and route-targeted (HTTP success criteria, minimal config) policies. Signed-off-by: Adam Buran <adam.buran@gmail.com> Signed-off-by: Adam Buran <aburan28@gmail.com>
Signed-off-by: Adam Buran <aburan28@gmail.com>
Signed-off-by: Adam Buran <aburan28@gmail.com>
Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>
✅ Deploy Preview for cerulean-figolla-1f9435 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
jukie
changed the title
Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>
jukie
marked this pull request as ready for review
April 27, 2026 22:17
zhaohuabing
reviewed
Apr 28, 2026
zhaohuabing
reviewed
Apr 28, 2026
zhaohuabing
reviewed
Apr 28, 2026
zhaohuabing
reviewed
Apr 28, 2026
zhaohuabing
reviewed
Apr 28, 2026
Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com>
arkodg
previously approved these changes
Apr 29, 2026
zhaohuabing
previously approved these changes
Apr 29, 2026
Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>
Contributor
Author
|
/retest |
zhaohuabing
approved these changes
Apr 30, 2026
arko-oai
approved these changes
Apr 30, 2026
arkodg
approved these changes
Apr 30, 2026
skos-ninja
pushed a commit
to skos-ninja/envoy-gateway
that referenced
this pull request
May 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
This carries forward #7529 from @aburan28
This PR adds support for Envoy's Admission Control filter to Envoy Gateway by exposing it through
BackendTrafficPolicy.Admission control probabilistically rejects requests based on the historical success rate of upstream requests within a configurable sliding time window. This provides client-side load shedding for overloaded or degraded backends and complements circuit breaking and retry policies.
Changes include
AdmissionControlwith configurablesamplingWindow,successRateThreshold,aggression,rpsThreshold,maxRejectionProbability, and success criteria for HTTP and gRPC.admissionControlfield.envoy.filters.http.admission_controlas an upstream HTTP filter on generated clusters.envoy.filters.http.admission_controlas a known Envoy filter.Release Notes: Yes