diff --git a/api/v1alpha1/timeout_types.go b/api/v1alpha1/timeout_types.go
index 66243d4b30..0cc6bcd4ea 100644
--- a/api/v1alpha1/timeout_types.go
+++ b/api/v1alpha1/timeout_types.go
@@ -81,6 +81,21 @@ type TCPClientTimeout struct {
//
// +optional
IdleTimeout *gwapiv1.Duration `json:"idleTimeout,omitempty"`
+
+ // TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
+ // (e.g. the TLS handshake) after a connection is accepted.
+ // If this expires before the transport reports connection establishment, the connection is summarily closed.
+ //
+ // +optional
+ TLSHandshakeTimeout *gwapiv1.Duration `json:"tlsHandshakeTimeout,omitempty"`
+
+ // ConnectionInspectionTimeout is the maximum time to wait for initial inspection
+ // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection.
+ // If exceeded, the connection is dropped.
+ // Default: 15 seconds.
+ //
+ // +optional
+ ConnectionInspectionTimeout *gwapiv1.Duration `json:"connectionInspectionTimeout,omitempty"`
}
type HTTPClientTimeout struct {
@@ -90,6 +105,14 @@ type HTTPClientTimeout struct {
// +optional
RequestReceivedTimeout *gwapiv1.Duration `json:"requestReceivedTimeout,omitempty"`
+ // RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive.
+ // The timer is activated when the first byte of the headers is received,
+ // and is disarmed when the last byte of the headers has been received.
+ // If not specified or set to 0, this timeout is disabled.
+ //
+ // +optional
+ RequestHeadersReceivedTimeout *gwapiv1.Duration `json:"requestHeadersReceivedTimeout,omitempty"`
+
// IdleTimeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
// Default: 1 hour.
//
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index 8cacd0bb56..3508095960 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -4461,6 +4461,11 @@ func (in *HTTPClientTimeout) DeepCopyInto(out *HTTPClientTimeout) {
*out = new(v1.Duration)
**out = **in
}
+ if in.RequestHeadersReceivedTimeout != nil {
+ in, out := &in.RequestHeadersReceivedTimeout, &out.RequestHeadersReceivedTimeout
+ *out = new(v1.Duration)
+ **out = **in
+ }
if in.IdleTimeout != nil {
in, out := &in.IdleTimeout, &out.IdleTimeout
*out = new(v1.Duration)
@@ -8497,6 +8502,16 @@ func (in *TCPClientTimeout) DeepCopyInto(out *TCPClientTimeout) {
*out = new(v1.Duration)
**out = **in
}
+ if in.TLSHandshakeTimeout != nil {
+ in, out := &in.TLSHandshakeTimeout, &out.TLSHandshakeTimeout
+ *out = new(v1.Duration)
+ **out = **in
+ }
+ if in.ConnectionInspectionTimeout != nil {
+ in, out := &in.ConnectionInspectionTimeout, &out.ConnectionInspectionTimeout
+ *out = new(v1.Duration)
+ **out = **in
+ }
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPClientTimeout.
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml
index b873c582aa..7fad46c37d 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml
@@ -1336,6 +1336,14 @@ spec:
Default: 1 hour.
pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
type: string
+ requestHeadersReceivedTimeout:
+ description: |-
+ RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive.
+ The timer is activated when the first byte of the headers is received,
+ and is disarmed when the last byte of the headers has been received.
+ If not specified or set to 0, this timeout is disabled.
+ pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+ type: string
requestReceivedTimeout:
description: |-
RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request
@@ -1352,6 +1360,14 @@ spec:
tcp:
description: Timeout settings for TCP.
properties:
+ connectionInspectionTimeout:
+ description: |-
+ ConnectionInspectionTimeout is the maximum time to wait for initial inspection
+ (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection.
+ If exceeded, the connection is dropped.
+ Default: 15 seconds.
+ pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+ type: string
idleTimeout:
description: |-
IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no
@@ -1359,6 +1375,13 @@ spec:
Default: 1 hour.
pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
type: string
+ tlsHandshakeTimeout:
+ description: |-
+ TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
+ (e.g. the TLS handshake) after a connection is accepted.
+ If this expires before the transport reports connection establishment, the connection is summarily closed.
+ pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+ type: string
type: object
type: object
tls:
diff --git a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml
index 5b73c4161a..7b86a96254 100644
--- a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml
+++ b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml
@@ -1335,6 +1335,14 @@ spec:
Default: 1 hour.
pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
type: string
+ requestHeadersReceivedTimeout:
+ description: |-
+ RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive.
+ The timer is activated when the first byte of the headers is received,
+ and is disarmed when the last byte of the headers has been received.
+ If not specified or set to 0, this timeout is disabled.
+ pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+ type: string
requestReceivedTimeout:
description: |-
RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request
@@ -1351,6 +1359,14 @@ spec:
tcp:
description: Timeout settings for TCP.
properties:
+ connectionInspectionTimeout:
+ description: |-
+ ConnectionInspectionTimeout is the maximum time to wait for initial inspection
+ (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection.
+ If exceeded, the connection is dropped.
+ Default: 15 seconds.
+ pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+ type: string
idleTimeout:
description: |-
IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no
@@ -1358,6 +1374,13 @@ spec:
Default: 1 hour.
pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
type: string
+ tlsHandshakeTimeout:
+ description: |-
+ TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
+ (e.g. the TLS handshake) after a connection is accepted.
+ If this expires before the transport reports connection establishment, the connection is summarily closed.
+ pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+ type: string
type: object
type: object
tls:
diff --git a/internal/gatewayapi/clienttrafficpolicy.go b/internal/gatewayapi/clienttrafficpolicy.go
index f6daf2a3ae..32d01bebe5 100644
--- a/internal/gatewayapi/clienttrafficpolicy.go
+++ b/internal/gatewayapi/clienttrafficpolicy.go
@@ -958,6 +958,20 @@ func buildClientTimeout(clientTimeout *egv1a1.ClientTimeout) (*ir.ClientTimeout,
}
irTCPTimeout.IdleTimeout = ir.MetaV1DurationPtr(d)
}
+ if clientTimeout.TCP.TLSHandshakeTimeout != nil {
+ d, err := time.ParseDuration(string(*clientTimeout.TCP.TLSHandshakeTimeout))
+ if err != nil {
+ return nil, fmt.Errorf("invalid TCP TLSHandshakeTimeout value %s", *clientTimeout.TCP.TLSHandshakeTimeout)
+ }
+ irTCPTimeout.TLSHandshakeTimeout = ir.MetaV1DurationPtr(d)
+ }
+ if clientTimeout.TCP.ConnectionInspectionTimeout != nil {
+ d, err := time.ParseDuration(string(*clientTimeout.TCP.ConnectionInspectionTimeout))
+ if err != nil {
+ return nil, fmt.Errorf("invalid TCP ConnectionInspectionTimeout value %s", *clientTimeout.TCP.ConnectionInspectionTimeout)
+ }
+ irTCPTimeout.ConnectionInspectionTimeout = ir.MetaV1DurationPtr(d)
+ }
irClientTimeout.TCP = irTCPTimeout
}
@@ -986,6 +1000,14 @@ func buildClientTimeout(clientTimeout *egv1a1.ClientTimeout) (*ir.ClientTimeout,
}
irHTTPTimeout.StreamIdleTimeout = ir.MetaV1DurationPtr(d)
}
+
+ if clientTimeout.HTTP.RequestHeadersReceivedTimeout != nil {
+ d, err := time.ParseDuration(string(*clientTimeout.HTTP.RequestHeadersReceivedTimeout))
+ if err != nil {
+ return nil, fmt.Errorf("invalid HTTP RequestHeadersReceivedTimeout value %s", *clientTimeout.HTTP.RequestHeadersReceivedTimeout)
+ }
+ irHTTPTimeout.RequestHeadersReceivedTimeout = ir.MetaV1DurationPtr(d)
+ }
irClientTimeout.HTTP = irHTTPTimeout
}
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml
index 11ea0bba15..f585270260 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml
@@ -11,8 +11,12 @@ clientTrafficPolicies:
name: gateway
sectionName: http-1
timeout:
+ tcp:
+ tlsHandshakeTimeout: "10s"
+ connectionInspectionTimeout: "60s"
http:
requestReceivedTimeout: "5s"
+ requestHeadersReceivedTimeout: "5s"
gateways:
- apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml
index 89c4b657b1..54a3d74b1e 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml
@@ -12,7 +12,11 @@ clientTrafficPolicies:
sectionName: http-1
timeout:
http:
+ requestHeadersReceivedTimeout: 5s
requestReceivedTimeout: 5s
+ tcp:
+ connectionInspectionTimeout: 60s
+ tlsHandshakeTimeout: 10s
status:
ancestors:
- ancestorRef:
@@ -170,7 +174,11 @@ xdsIR:
port: 10080
timeout:
http:
+ requestHeadersReceivedTimeout: 5s
requestReceivedTimeout: 5s
+ tcp:
+ connectionInspectionTimeout: 1m0s
+ tlsHandshakeTimeout: 10s
- address: 0.0.0.0
externalPort: 8080
hostnames:
diff --git a/internal/ir/xds.go b/internal/ir/xds.go
index 7c0f250e9d..5a14dbd588 100644
--- a/internal/ir/xds.go
+++ b/internal/ir/xds.go
@@ -969,6 +969,14 @@ type TCPClientTimeout struct {
// IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no
// bytes sent or received on either the upstream or downstream connection.
IdleTimeout *metav1.Duration `json:"idleTimeout,omitempty" yaml:"idleTimeout,omitempty"`
+ // TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
+ // (e.g. the TLS handshake) after a connection is accepted.
+ // If this expires before the transport reports connection establishment, the connection is summarily closed.
+ TLSHandshakeTimeout *metav1.Duration `json:"tlsHandshakeTimeout,omitempty" yaml:"tlsHandshakeTimeout,omitempty"`
+ // ConnectionInspectionTimeout is the maximum time to wait for initial inspection
+ // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection.
+ // If exceeded, the connection is dropped.
+ ConnectionInspectionTimeout *metav1.Duration `json:"connectionInspectionTimeout,omitempty" yaml:"connectionInspectionTimeout,omitempty"`
}
// HTTPClientTimeout set the configuration for client HTTP.
@@ -977,6 +985,10 @@ type HTTPClientTimeout struct {
// The duration envoy waits for the complete request reception. This timer starts upon request
// initiation and stops when either the last byte of the request is sent upstream or when the response begins.
RequestReceivedTimeout *metav1.Duration `json:"requestReceivedTimeout,omitempty" yaml:"requestReceivedTimeout,omitempty"`
+ // RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive.
+ // The timer is activated when the first byte of the headers is received,
+ // and is disarmed when the last byte of the headers has been received.
+ RequestHeadersReceivedTimeout *metav1.Duration `json:"requestHeadersReceivedTimeout,omitempty" yaml:"requestHeadersReceivedTimeout,omitempty"`
// IdleTimeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
IdleTimeout *metav1.Duration `json:"idleTimeout,omitempty" yaml:"idleTimeout,omitempty"`
// The stream idle timeout for connections managed by the connection manager.
diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go
index ca7a0b5d2a..209c7bb916 100644
--- a/internal/ir/zz_generated.deepcopy.go
+++ b/internal/ir/zz_generated.deepcopy.go
@@ -2264,6 +2264,11 @@ func (in *HTTPClientTimeout) DeepCopyInto(out *HTTPClientTimeout) {
*out = new(metav1.Duration)
**out = **in
}
+ if in.RequestHeadersReceivedTimeout != nil {
+ in, out := &in.RequestHeadersReceivedTimeout, &out.RequestHeadersReceivedTimeout
+ *out = new(metav1.Duration)
+ **out = **in
+ }
if in.IdleTimeout != nil {
in, out := &in.IdleTimeout, &out.IdleTimeout
*out = new(metav1.Duration)
@@ -4632,6 +4637,16 @@ func (in *TCPClientTimeout) DeepCopyInto(out *TCPClientTimeout) {
*out = new(metav1.Duration)
**out = **in
}
+ if in.TLSHandshakeTimeout != nil {
+ in, out := &in.TLSHandshakeTimeout, &out.TLSHandshakeTimeout
+ *out = new(metav1.Duration)
+ **out = **in
+ }
+ if in.ConnectionInspectionTimeout != nil {
+ in, out := &in.ConnectionInspectionTimeout, &out.ConnectionInspectionTimeout
+ *out = new(metav1.Duration)
+ **out = **in
+ }
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPClientTimeout.
diff --git a/internal/xds/translator/listener.go b/internal/xds/translator/listener.go
index fbe7bda278..943e3c6d86 100644
--- a/internal/xds/translator/listener.go
+++ b/internal/xds/translator/listener.go
@@ -214,6 +214,7 @@ func (t *Translator) buildXdsTCPListener(
listenerDetails *ir.CoreListenerDetails,
keepalive *ir.TCPKeepalive,
connection *ir.ClientConnection,
+ timeout *ir.ClientTimeout,
accesslog *ir.AccessLog,
) (*listenerv3.Listener, error) {
socketOptions := buildTCPSocketOptions(keepalive)
@@ -249,6 +250,10 @@ func (t *Translator) buildXdsTCPListener(
socketAddress.Ipv4Compat = true
}
+ if timeout != nil && timeout.TCP != nil && timeout.TCP.ConnectionInspectionTimeout != nil {
+ listener.ListenerFiltersTimeout = durationpb.New(timeout.TCP.ConnectionInspectionTimeout.Duration)
+ }
+
return listener, nil
}
@@ -440,6 +445,10 @@ func (t *Translator) addHCMToXDSListener(
mgr.RequestTimeout = durationpb.New(irListener.Timeout.HTTP.RequestReceivedTimeout.Duration)
}
+ if irListener.Timeout.HTTP.RequestHeadersReceivedTimeout != nil {
+ mgr.RequestHeadersTimeout = durationpb.New(irListener.Timeout.HTTP.RequestHeadersReceivedTimeout.Duration)
+ }
+
if irListener.Timeout.HTTP.IdleTimeout != nil {
mgr.CommonHttpProtocolOptions.IdleTimeout = durationpb.New(irListener.Timeout.HTTP.IdleTimeout.Duration)
}
@@ -508,6 +517,10 @@ func (t *Translator) addHCMToXDSListener(
Filters: filters,
}
+ if irListener.Timeout != nil && irListener.Timeout.TCP != nil && irListener.Timeout.TCP.TLSHandshakeTimeout != nil {
+ filterChain.TransportSocketConnectTimeout = durationpb.New(irListener.Timeout.TCP.TLSHandshakeTimeout.Duration)
+ }
+
if irListener.TLS != nil {
var tSocket *corev3.TransportSocket
@@ -805,10 +818,16 @@ func buildTCPFilterChain(
return nil, err
}
- return &listenerv3.FilterChain{
+ filterChain := &listenerv3.FilterChain{
Filters: filters,
Name: tlsListenerFilterChainName(irRoute),
- }, nil
+ }
+
+ if timeout != nil && timeout.TCP != nil && timeout.TCP.TLSHandshakeTimeout != nil {
+ filterChain.TransportSocketConnectTimeout = durationpb.New(timeout.TCP.TLSHandshakeTimeout.Duration)
+ }
+
+ return filterChain, nil
}
func buildConnectionLimitFilter(statPrefix string, connection *ir.ClientConnection) *connection_limitv3.ConnectionLimit {
diff --git a/internal/xds/translator/translator.go b/internal/xds/translator/translator.go
index 87f7ba4f9b..4569473e4c 100644
--- a/internal/xds/translator/translator.go
+++ b/internal/xds/translator/translator.go
@@ -391,6 +391,7 @@ func (t *Translator) processHTTPListenerXdsTranslation(
&httpListener.CoreListenerDetails,
httpListener.TCPKeepalive,
httpListener.Connection,
+ httpListener.Timeout,
accessLog,
); err != nil {
errs = errors.Join(errs, err)
@@ -846,6 +847,7 @@ func (t *Translator) processTCPListenerXdsTranslation(
&tcpListener.CoreListenerDetails,
tcpListener.TCPKeepalive,
tcpListener.Connection,
+ tcpListener.Timeout,
accesslog,
); err != nil {
// skip this listener if failed to build xds listener
diff --git a/release-notes/current/new_features/9315-support-more-client-timeout-settings.md b/release-notes/current/new_features/9315-support-more-client-timeout-settings.md
new file mode 100644
index 0000000000..8d75c60ab2
--- /dev/null
+++ b/release-notes/current/new_features/9315-support-more-client-timeout-settings.md
@@ -0,0 +1 @@
+Add support for more client timeout settings. The settings are [`ConnectionInspectionTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener.proto#envoy-v3-api-field-config-listener-v3-listener-listener-filters-timeout), [`RequestHeadersReceivedTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-request-headers-timeout) and [`TLSHandshakeTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener_components.proto.html#envoy-v3-api-field-config-listener-v3-filterchain-transport-socket-connect-timeout)
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index bf46bbe6df..f94ae5d8eb 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -3088,6 +3088,7 @@ _Appears in:_
| Field | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `requestReceivedTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request
initiation and stops when either the last byte of the request is sent upstream or when the response begins. |
+| `requestHeadersReceivedTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive.
The timer is activated when the first byte of the headers is received,
and is disarmed when the last byte of the headers has been received.
If not specified or set to 0, this timeout is disabled. |
| `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
Default: 1 hour. |
| `streamIdleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | The stream idle timeout defines the amount of time a stream can exist without any upstream or downstream activity.
Default: 5 minutes. |
@@ -6300,6 +6301,8 @@ _Appears in:_
| Field | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no
bytes sent or received on either the upstream or downstream connection.
Default: 1 hour. |
+| `tlsHandshakeTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
(e.g. the TLS handshake) after a connection is accepted.
If this expires before the transport reports connection establishment, the connection is summarily closed. |
+| `connectionInspectionTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ConnectionInspectionTimeout is the maximum time to wait for initial inspection
(TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection.
If exceeded, the connection is dropped.
Default: 15 seconds. |
#### TCPKeepalive
diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml
index f73490508a..402c6fe1f7 100644
--- a/test/helm/gateway-crds-helm/all.out.yaml
+++ b/test/helm/gateway-crds-helm/all.out.yaml
@@ -29735,6 +29735,14 @@ spec:
Default: 1 hour.
pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
type: string
+ requestHeadersReceivedTimeout:
+ description: |-
+ RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive.
+ The timer is activated when the first byte of the headers is received,
+ and is disarmed when the last byte of the headers has been received.
+ If not specified or set to 0, this timeout is disabled.
+ pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+ type: string
requestReceivedTimeout:
description: |-
RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request
@@ -29751,6 +29759,14 @@ spec:
tcp:
description: Timeout settings for TCP.
properties:
+ connectionInspectionTimeout:
+ description: |-
+ ConnectionInspectionTimeout is the maximum time to wait for initial inspection
+ (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection.
+ If exceeded, the connection is dropped.
+ Default: 15 seconds.
+ pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+ type: string
idleTimeout:
description: |-
IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no
@@ -29758,6 +29774,13 @@ spec:
Default: 1 hour.
pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
type: string
+ tlsHandshakeTimeout:
+ description: |-
+ TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
+ (e.g. the TLS handshake) after a connection is accepted.
+ If this expires before the transport reports connection establishment, the connection is summarily closed.
+ pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+ type: string
type: object
type: object
tls:
diff --git a/test/helm/gateway-crds-helm/e2e.out.yaml b/test/helm/gateway-crds-helm/e2e.out.yaml
index 265020d4e5..e81c646b6a 100644
--- a/test/helm/gateway-crds-helm/e2e.out.yaml
+++ b/test/helm/gateway-crds-helm/e2e.out.yaml
@@ -5673,6 +5673,14 @@ spec:
Default: 1 hour.
pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
type: string
+ requestHeadersReceivedTimeout:
+ description: |-
+ RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive.
+ The timer is activated when the first byte of the headers is received,
+ and is disarmed when the last byte of the headers has been received.
+ If not specified or set to 0, this timeout is disabled.
+ pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+ type: string
requestReceivedTimeout:
description: |-
RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request
@@ -5689,6 +5697,14 @@ spec:
tcp:
description: Timeout settings for TCP.
properties:
+ connectionInspectionTimeout:
+ description: |-
+ ConnectionInspectionTimeout is the maximum time to wait for initial inspection
+ (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection.
+ If exceeded, the connection is dropped.
+ Default: 15 seconds.
+ pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+ type: string
idleTimeout:
description: |-
IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no
@@ -5696,6 +5712,13 @@ spec:
Default: 1 hour.
pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
type: string
+ tlsHandshakeTimeout:
+ description: |-
+ TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
+ (e.g. the TLS handshake) after a connection is accepted.
+ If this expires before the transport reports connection establishment, the connection is summarily closed.
+ pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+ type: string
type: object
type: object
tls:
diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
index 4a49f5c891..84ee90be7e 100644
--- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
+++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
@@ -5673,6 +5673,14 @@ spec:
Default: 1 hour.
pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
type: string
+ requestHeadersReceivedTimeout:
+ description: |-
+ RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive.
+ The timer is activated when the first byte of the headers is received,
+ and is disarmed when the last byte of the headers has been received.
+ If not specified or set to 0, this timeout is disabled.
+ pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+ type: string
requestReceivedTimeout:
description: |-
RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request
@@ -5689,6 +5697,14 @@ spec:
tcp:
description: Timeout settings for TCP.
properties:
+ connectionInspectionTimeout:
+ description: |-
+ ConnectionInspectionTimeout is the maximum time to wait for initial inspection
+ (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection.
+ If exceeded, the connection is dropped.
+ Default: 15 seconds.
+ pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+ type: string
idleTimeout:
description: |-
IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no
@@ -5696,6 +5712,13 @@ spec:
Default: 1 hour.
pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
type: string
+ tlsHandshakeTimeout:
+ description: |-
+ TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
+ (e.g. the TLS handshake) after a connection is accepted.
+ If this expires before the transport reports connection establishment, the connection is summarily closed.
+ pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
+ type: string
type: object
type: object
tls: