From 7417ab44127b5c4b2ba76db5a96993c5f25d02b8 Mon Sep 17 00:00:00 2001 From: kabbohus Date: Tue, 23 Jun 2026 14:58:58 +0200 Subject: [PATCH 01/10] Extend timeout API to include new settings Signed-off-by: kabbohus --- api/v1alpha1/timeout_types.go | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/api/v1alpha1/timeout_types.go b/api/v1alpha1/timeout_types.go index 66243d4b30..d42ece0537 100644 --- a/api/v1alpha1/timeout_types.go +++ b/api/v1alpha1/timeout_types.go @@ -71,6 +71,14 @@ type ClientTimeout struct { // // +optional HTTP *HTTPClientTimeout `json:"http,omitempty"` + + // ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. + // If the timeout is reached, the accepted socket is closed without a connection being created. + // Specify 0 to disable the timeout. + // Default: 15 seconds. + // + // +optional + ListenerFiltersTimeout *gwapiv1.Duration `json:"listenerFiltersTimeout,omitempty"` } // TCPClientTimeout only provides timeout configuration on the listener whose protocol is TCP or TLS. @@ -81,6 +89,13 @@ type TCPClientTimeout struct { // // +optional IdleTimeout *gwapiv1.Duration `json:"idleTimeout,omitempty"` + + // TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. + // If this expires before the transport reports connection establishment, the connection is summarily closed. + // Default: 5 seconds. + // + // +optional + TransportSocketConnectTimeout *gwapiv1.Duration `json:"transportSocketConnectTimeout,omitempty"` } type HTTPClientTimeout struct { @@ -101,4 +116,13 @@ type HTTPClientTimeout struct { // // +optional StreamIdleTimeout *gwapiv1.Duration `json:"streamIdleTimeout,omitempty"` + + // RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + // The timer is activated when the first byte of the headers is received, + // and is disarmed when the last byte of the headers has been received. + // Specify 0 to disable the timeout. + // Default: 10 seconds. + // + // +optional + RequestHeadersTimeout *gwapiv1.Duration `json:"requestHeadersTimeout,omitempty"` } From 6cb9bc3cb22822c3943752b8ac4650afdbd1f935 Mon Sep 17 00:00:00 2001 From: kabbohus Date: Tue, 23 Jun 2026 21:11:41 +0200 Subject: [PATCH 02/10] make generate gen-check Signed-off-by: kabbohus --- api/v1alpha1/zz_generated.deepcopy.go | 15 ++++++++++++ ...y.envoyproxy.io_clienttrafficpolicies.yaml | 24 +++++++++++++++++++ ...y.envoyproxy.io_clienttrafficpolicies.yaml | 24 +++++++++++++++++++ site/content/en/latest/api/extension_types.md | 3 +++ test/helm/gateway-crds-helm/all.out.yaml | 24 +++++++++++++++++++ test/helm/gateway-crds-helm/e2e.out.yaml | 24 +++++++++++++++++++ .../envoy-gateway-crds.out.yaml | 24 +++++++++++++++++++ 7 files changed, 138 insertions(+) diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index f235298d88..dad7664a2f 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -1347,6 +1347,11 @@ func (in *ClientTimeout) DeepCopyInto(out *ClientTimeout) { *out = new(HTTPClientTimeout) (*in).DeepCopyInto(*out) } + if in.ListenerFiltersTimeout != nil { + in, out := &in.ListenerFiltersTimeout, &out.ListenerFiltersTimeout + *out = new(v1.Duration) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClientTimeout. @@ -4314,6 +4319,11 @@ func (in *HTTPClientTimeout) DeepCopyInto(out *HTTPClientTimeout) { *out = new(v1.Duration) **out = **in } + if in.RequestHeadersTimeout != nil { + in, out := &in.RequestHeadersTimeout, &out.RequestHeadersTimeout + *out = new(v1.Duration) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPClientTimeout. @@ -8230,6 +8240,11 @@ func (in *TCPClientTimeout) DeepCopyInto(out *TCPClientTimeout) { *out = new(v1.Duration) **out = **in } + if in.TransportSocketConnectTimeout != nil { + in, out := &in.TransportSocketConnectTimeout, &out.TransportSocketConnectTimeout + *out = new(v1.Duration) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPClientTimeout. diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index 375a5feffe..db350b3278 100644 --- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1307,6 +1307,15 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + requestHeadersTimeout: + description: |- + RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + The timer is activated when the first byte of the headers is received, + and is disarmed when the last byte of the headers has been received. + Specify 0 to disable the timeout. + Default: 10 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string requestReceivedTimeout: description: |- RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request @@ -1320,6 +1329,14 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object + listenerFiltersTimeout: + description: |- + ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. + If the timeout is reached, the accepted socket is closed without a connection being created. + Specify 0 to disable the timeout. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string tcp: description: Timeout settings for TCP. properties: @@ -1330,6 +1347,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + transportSocketConnectTimeout: + description: |- + TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index 76aa7fcfd6..56217d4ce7 100644 --- a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1306,6 +1306,15 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + requestHeadersTimeout: + description: |- + RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + The timer is activated when the first byte of the headers is received, + and is disarmed when the last byte of the headers has been received. + Specify 0 to disable the timeout. + Default: 10 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string requestReceivedTimeout: description: |- RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request @@ -1319,6 +1328,14 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object + listenerFiltersTimeout: + description: |- + ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. + If the timeout is reached, the accepted socket is closed without a connection being created. + Specify 0 to disable the timeout. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string tcp: description: Timeout settings for TCP. properties: @@ -1329,6 +1346,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + transportSocketConnectTimeout: + description: |- + TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index 767d8a3af4..8c75a31589 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -946,6 +946,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `tcp` | _[TCPClientTimeout](#tcpclienttimeout)_ | false | | Timeout settings for TCP. | | `http` | _[HTTPClientTimeout](#httpclienttimeout)_ | false | | Timeout settings for HTTP. | +| `listenerFiltersTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation.
If the timeout is reached, the accepted socket is closed without a connection being created.
Specify 0 to disable the timeout.
Default: 15 seconds. | #### ClientTrafficPolicy @@ -2967,6 +2968,7 @@ _Appears in:_ | `requestReceivedTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request
initiation and stops when either the last byte of the request is sent upstream or when the response begins. | | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
Default: 1 hour. | | `streamIdleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | The stream idle timeout defines the amount of time a stream can exist without any upstream or downstream activity.
Default: 5 minutes. | +| `requestHeadersTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestHeadersTimeout is the duration envoy waits for the request headers to arrive.
The timer is activated when the first byte of the headers is received,
and is disarmed when the last byte of the headers has been received.
Specify 0 to disable the timeout.
Default: 10 seconds. | #### HTTPCookieMatch @@ -6094,6 +6096,7 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no
bytes sent or received on either the upstream or downstream connection.
Default: 1 hour. | +| `transportSocketConnectTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations.
If this expires before the transport reports connection establishment, the connection is summarily closed.
Default: 5 seconds. | #### TCPKeepalive diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml index 357bc518cc..c8ae1290c0 100644 --- a/test/helm/gateway-crds-helm/all.out.yaml +++ b/test/helm/gateway-crds-helm/all.out.yaml @@ -27589,6 +27589,15 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + requestHeadersTimeout: + description: |- + RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + The timer is activated when the first byte of the headers is received, + and is disarmed when the last byte of the headers has been received. + Specify 0 to disable the timeout. + Default: 10 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string requestReceivedTimeout: description: |- RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request @@ -27602,6 +27611,14 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object + listenerFiltersTimeout: + description: |- + ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. + If the timeout is reached, the accepted socket is closed without a connection being created. + Specify 0 to disable the timeout. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string tcp: description: Timeout settings for TCP. properties: @@ -27612,6 +27629,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + transportSocketConnectTimeout: + description: |- + TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/test/helm/gateway-crds-helm/e2e.out.yaml b/test/helm/gateway-crds-helm/e2e.out.yaml index 413f4840c4..a9e9bbf03f 100644 --- a/test/helm/gateway-crds-helm/e2e.out.yaml +++ b/test/helm/gateway-crds-helm/e2e.out.yaml @@ -5562,6 +5562,15 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + requestHeadersTimeout: + description: |- + RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + The timer is activated when the first byte of the headers is received, + and is disarmed when the last byte of the headers has been received. + Specify 0 to disable the timeout. + Default: 10 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string requestReceivedTimeout: description: |- RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request @@ -5575,6 +5584,14 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object + listenerFiltersTimeout: + description: |- + ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. + If the timeout is reached, the accepted socket is closed without a connection being created. + Specify 0 to disable the timeout. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string tcp: description: Timeout settings for TCP. properties: @@ -5585,6 +5602,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + transportSocketConnectTimeout: + description: |- + TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml index a173638a1e..7a503f58ab 100644 --- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml +++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml @@ -5562,6 +5562,15 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + requestHeadersTimeout: + description: |- + RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + The timer is activated when the first byte of the headers is received, + and is disarmed when the last byte of the headers has been received. + Specify 0 to disable the timeout. + Default: 10 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string requestReceivedTimeout: description: |- RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request @@ -5575,6 +5584,14 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object + listenerFiltersTimeout: + description: |- + ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. + If the timeout is reached, the accepted socket is closed without a connection being created. + Specify 0 to disable the timeout. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string tcp: description: Timeout settings for TCP. properties: @@ -5585,6 +5602,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + transportSocketConnectTimeout: + description: |- + TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: From 96aec061fbb68893f32d605cdf0c3864b79203c3 Mon Sep 17 00:00:00 2001 From: kabbohus Date: Mon, 20 Jul 2026 09:07:11 +0200 Subject: [PATCH 03/10] Make naming less envoy specific Signed-off-by: kabbohus --- api/v1alpha1/timeout_types.go | 31 ++++++++-------- api/v1alpha1/zz_generated.deepcopy.go | 18 +++++----- ...y.envoyproxy.io_clienttrafficpolicies.yaml | 35 ++++++++++--------- ...y.envoyproxy.io_clienttrafficpolicies.yaml | 35 ++++++++++--------- .../jwt-allow-missing-or-failed.clusters.yaml | 10 ++++-- site/content/en/latest/api/extension_types.md | 6 ++-- test/helm/gateway-crds-helm/all.out.yaml | 35 ++++++++++--------- test/helm/gateway-crds-helm/e2e.out.yaml | 35 ++++++++++--------- .../envoy-gateway-crds.out.yaml | 35 ++++++++++--------- 9 files changed, 125 insertions(+), 115 deletions(-) diff --git a/api/v1alpha1/timeout_types.go b/api/v1alpha1/timeout_types.go index d42ece0537..5f30611a1a 100644 --- a/api/v1alpha1/timeout_types.go +++ b/api/v1alpha1/timeout_types.go @@ -72,13 +72,13 @@ type ClientTimeout struct { // +optional HTTP *HTTPClientTimeout `json:"http,omitempty"` - // ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. - // If the timeout is reached, the accepted socket is closed without a connection being created. - // Specify 0 to disable the timeout. + // ConnectionInspectionTimeout is the maximum time to wait for initial inspection + // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + // If exceeded, the connection is dropped. // Default: 15 seconds. // // +optional - ListenerFiltersTimeout *gwapiv1.Duration `json:"listenerFiltersTimeout,omitempty"` + ConnectionInspectionTimeout *gwapiv1.Duration `json:"connectionInspectionTimeout,omitempty"` } // TCPClientTimeout only provides timeout configuration on the listener whose protocol is TCP or TLS. @@ -90,12 +90,13 @@ type TCPClientTimeout struct { // +optional IdleTimeout *gwapiv1.Duration `json:"idleTimeout,omitempty"` - // TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. + // HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + // (e.g. the TLS handshake) after a connection is accepted. // If this expires before the transport reports connection establishment, the connection is summarily closed. // Default: 5 seconds. // // +optional - TransportSocketConnectTimeout *gwapiv1.Duration `json:"transportSocketConnectTimeout,omitempty"` + HandshakeTimeout *gwapiv1.Duration `json:"handshakeTimeout,omitempty"` } type HTTPClientTimeout struct { @@ -105,6 +106,15 @@ type HTTPClientTimeout struct { // +optional RequestReceivedTimeout *gwapiv1.Duration `json:"requestReceivedTimeout,omitempty"` + // RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. + // The timer is activated when the first byte of the headers is received, + // and is disarmed when the last byte of the headers has been received. + // Specify 0 to disable the timeout. + // Default: 10 seconds. + // + // +optional + RequestHeadersReceivedTimeout *gwapiv1.Duration `json:"requestHeadersReceivedTimeout,omitempty"` + // IdleTimeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection. // Default: 1 hour. // @@ -116,13 +126,4 @@ type HTTPClientTimeout struct { // // +optional StreamIdleTimeout *gwapiv1.Duration `json:"streamIdleTimeout,omitempty"` - - // RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. - // The timer is activated when the first byte of the headers is received, - // and is disarmed when the last byte of the headers has been received. - // Specify 0 to disable the timeout. - // Default: 10 seconds. - // - // +optional - RequestHeadersTimeout *gwapiv1.Duration `json:"requestHeadersTimeout,omitempty"` } diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index 8ea090efdf..264d70125f 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -1361,8 +1361,8 @@ func (in *ClientTimeout) DeepCopyInto(out *ClientTimeout) { *out = new(HTTPClientTimeout) (*in).DeepCopyInto(*out) } - if in.ListenerFiltersTimeout != nil { - in, out := &in.ListenerFiltersTimeout, &out.ListenerFiltersTimeout + if in.ConnectionInspectionTimeout != nil { + in, out := &in.ConnectionInspectionTimeout, &out.ConnectionInspectionTimeout *out = new(v1.Duration) **out = **in } @@ -4353,6 +4353,11 @@ func (in *HTTPClientTimeout) DeepCopyInto(out *HTTPClientTimeout) { *out = new(v1.Duration) **out = **in } + if in.RequestHeadersReceivedTimeout != nil { + in, out := &in.RequestHeadersReceivedTimeout, &out.RequestHeadersReceivedTimeout + *out = new(v1.Duration) + **out = **in + } if in.IdleTimeout != nil { in, out := &in.IdleTimeout, &out.IdleTimeout *out = new(v1.Duration) @@ -4363,11 +4368,6 @@ func (in *HTTPClientTimeout) DeepCopyInto(out *HTTPClientTimeout) { *out = new(v1.Duration) **out = **in } - if in.RequestHeadersTimeout != nil { - in, out := &in.RequestHeadersTimeout, &out.RequestHeadersTimeout - *out = new(v1.Duration) - **out = **in - } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPClientTimeout. @@ -8339,8 +8339,8 @@ func (in *TCPClientTimeout) DeepCopyInto(out *TCPClientTimeout) { *out = new(v1.Duration) **out = **in } - if in.TransportSocketConnectTimeout != nil { - in, out := &in.TransportSocketConnectTimeout, &out.TransportSocketConnectTimeout + if in.HandshakeTimeout != nil { + in, out := &in.HandshakeTimeout, &out.HandshakeTimeout *out = new(v1.Duration) **out = **in } diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index 984d1cb9ce..9d1e134036 100644 --- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1327,6 +1327,14 @@ spec: timeout: description: Timeout settings for the client connections. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string http: description: Timeout settings for HTTP. properties: @@ -1336,9 +1344,9 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - requestHeadersTimeout: + requestHeadersReceivedTimeout: description: |- - RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. Specify 0 to disable the timeout. @@ -1358,17 +1366,17 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object - listenerFiltersTimeout: - description: |- - ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. - If the timeout is reached, the accepted socket is closed without a connection being created. - Specify 0 to disable the timeout. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string tcp: description: Timeout settings for TCP. properties: + handshakeTimeout: + description: |- + HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -1376,13 +1384,6 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - transportSocketConnectTimeout: - description: |- - TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. - If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string type: object type: object tls: diff --git a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index 16e4e08e3f..38b572ebdc 100644 --- a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1326,6 +1326,14 @@ spec: timeout: description: Timeout settings for the client connections. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string http: description: Timeout settings for HTTP. properties: @@ -1335,9 +1343,9 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - requestHeadersTimeout: + requestHeadersReceivedTimeout: description: |- - RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. Specify 0 to disable the timeout. @@ -1357,17 +1365,17 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object - listenerFiltersTimeout: - description: |- - ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. - If the timeout is reached, the accepted socket is closed without a connection being created. - Specify 0 to disable the timeout. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string tcp: description: Timeout settings for TCP. properties: + handshakeTimeout: + description: |- + HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -1375,13 +1383,6 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - transportSocketConnectTimeout: - description: |- - TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. - If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string type: object type: object tls: diff --git a/internal/xds/translator/testdata/out/xds-ir/jwt-allow-missing-or-failed.clusters.yaml b/internal/xds/translator/testdata/out/xds-ir/jwt-allow-missing-or-failed.clusters.yaml index 7bba0835f2..585647f1b8 100644 --- a/internal/xds/translator/testdata/out/xds-ir/jwt-allow-missing-or-failed.clusters.yaml +++ b/internal/xds/translator/testdata/out/xds-ir/jwt-allow-missing-or-failed.clusters.yaml @@ -47,10 +47,16 @@ - circuitBreakers: thresholds: - maxRetries: 1024 + clusterType: + name: envoy.cluster.dns + typedConfig: + '@type': type.googleapis.com/envoy.extensions.clusters.dns.v3.DnsCluster + dnsLookupFamily: V4_PREFERRED + dnsRefreshRate: 30s + respectDnsTtl: true commonLbConfig: {} connectTimeout: 10s dnsLookupFamily: V4_PREFERRED - dnsRefreshRate: 30s ignoreHealthOnHostRemoval: true loadAssignment: clusterName: localhost_443 @@ -75,7 +81,6 @@ localityWeightedLbConfig: {} name: localhost_443 perConnectionBufferLimitBytes: 32768 - respectDnsTtl: true transportSocket: name: envoy.transport_sockets.tls typedConfig: @@ -85,4 +90,3 @@ trustedCa: filename: /etc/ssl/certs/ca-certificates.crt sni: localhost - type: STRICT_DNS diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index 052bd58e9d..596a6dbfc9 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -961,7 +961,7 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `tcp` | _[TCPClientTimeout](#tcpclienttimeout)_ | false | | Timeout settings for TCP. | | `http` | _[HTTPClientTimeout](#httpclienttimeout)_ | false | | Timeout settings for HTTP. | -| `listenerFiltersTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation.
If the timeout is reached, the accepted socket is closed without a connection being created.
Specify 0 to disable the timeout.
Default: 15 seconds. | +| `connectionInspectionTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ConnectionInspectionTimeout is the maximum time to wait for initial inspection
(TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection.
If exceeded, the connection is dropped.
Default: 15 seconds. | #### ClientTrafficPolicy @@ -2997,9 +2997,9 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `requestReceivedTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request
initiation and stops when either the last byte of the request is sent upstream or when the response begins. | +| `requestHeadersReceivedTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive.
The timer is activated when the first byte of the headers is received,
and is disarmed when the last byte of the headers has been received.
Specify 0 to disable the timeout.
Default: 10 seconds. | | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
Default: 1 hour. | | `streamIdleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | The stream idle timeout defines the amount of time a stream can exist without any upstream or downstream activity.
Default: 5 minutes. | -| `requestHeadersTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestHeadersTimeout is the duration envoy waits for the request headers to arrive.
The timer is activated when the first byte of the headers is received,
and is disarmed when the last byte of the headers has been received.
Specify 0 to disable the timeout.
Default: 10 seconds. | #### HTTPCookieMatch @@ -6164,7 +6164,7 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no
bytes sent or received on either the upstream or downstream connection.
Default: 1 hour. | -| `transportSocketConnectTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations.
If this expires before the transport reports connection establishment, the connection is summarily closed.
Default: 5 seconds. | +| `handshakeTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
(e.g. the TLS handshake) after a connection is accepted.
If this expires before the transport reports connection establishment, the connection is summarily closed.
Default: 5 seconds. | #### TCPKeepalive diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml index d84e9c3ff6..0a6fa93af0 100644 --- a/test/helm/gateway-crds-helm/all.out.yaml +++ b/test/helm/gateway-crds-helm/all.out.yaml @@ -29686,6 +29686,14 @@ spec: timeout: description: Timeout settings for the client connections. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string http: description: Timeout settings for HTTP. properties: @@ -29695,9 +29703,9 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - requestHeadersTimeout: + requestHeadersReceivedTimeout: description: |- - RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. Specify 0 to disable the timeout. @@ -29717,17 +29725,17 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object - listenerFiltersTimeout: - description: |- - ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. - If the timeout is reached, the accepted socket is closed without a connection being created. - Specify 0 to disable the timeout. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string tcp: description: Timeout settings for TCP. properties: + handshakeTimeout: + description: |- + HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -29735,13 +29743,6 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - transportSocketConnectTimeout: - description: |- - TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. - If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string type: object type: object tls: diff --git a/test/helm/gateway-crds-helm/e2e.out.yaml b/test/helm/gateway-crds-helm/e2e.out.yaml index 5b9e301ef8..3b3cee2244 100644 --- a/test/helm/gateway-crds-helm/e2e.out.yaml +++ b/test/helm/gateway-crds-helm/e2e.out.yaml @@ -5624,6 +5624,14 @@ spec: timeout: description: Timeout settings for the client connections. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string http: description: Timeout settings for HTTP. properties: @@ -5633,9 +5641,9 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - requestHeadersTimeout: + requestHeadersReceivedTimeout: description: |- - RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. Specify 0 to disable the timeout. @@ -5655,17 +5663,17 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object - listenerFiltersTimeout: - description: |- - ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. - If the timeout is reached, the accepted socket is closed without a connection being created. - Specify 0 to disable the timeout. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string tcp: description: Timeout settings for TCP. properties: + handshakeTimeout: + description: |- + HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -5673,13 +5681,6 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - transportSocketConnectTimeout: - description: |- - TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. - If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string type: object type: object tls: diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml index 63a4386aa6..d5df8021d0 100644 --- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml +++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml @@ -5624,6 +5624,14 @@ spec: timeout: description: Timeout settings for the client connections. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string http: description: Timeout settings for HTTP. properties: @@ -5633,9 +5641,9 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - requestHeadersTimeout: + requestHeadersReceivedTimeout: description: |- - RequestHeadersTimeout is the duration envoy waits for the request headers to arrive. + RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. Specify 0 to disable the timeout. @@ -5655,17 +5663,17 @@ spec: pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string type: object - listenerFiltersTimeout: - description: |- - ListenerFiltersTimeout is the duration envoy waits for all listener filters to complete operation. - If the timeout is reached, the accepted socket is closed without a connection being created. - Specify 0 to disable the timeout. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string tcp: description: Timeout settings for TCP. properties: + handshakeTimeout: + description: |- + HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + Default: 5 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -5673,13 +5681,6 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - transportSocketConnectTimeout: - description: |- - TransportSocketConnectTimeout is the duration envoy waits for incoming connections to complete any transport socket negotiations. - If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string type: object type: object tls: From 041b9b91572436503492ab023d087582e4a2d26a Mon Sep 17 00:00:00 2001 From: kabbohus Date: Mon, 27 Jul 2026 09:25:08 +0200 Subject: [PATCH 04/10] Move ConnectionInspectionTimeout into TCP timeout section Signed-off-by: kabbohus --- api/v1alpha1/timeout_types.go | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/api/v1alpha1/timeout_types.go b/api/v1alpha1/timeout_types.go index 5f30611a1a..e967aee7a0 100644 --- a/api/v1alpha1/timeout_types.go +++ b/api/v1alpha1/timeout_types.go @@ -71,14 +71,6 @@ type ClientTimeout struct { // // +optional HTTP *HTTPClientTimeout `json:"http,omitempty"` - - // ConnectionInspectionTimeout is the maximum time to wait for initial inspection - // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. - // If exceeded, the connection is dropped. - // Default: 15 seconds. - // - // +optional - ConnectionInspectionTimeout *gwapiv1.Duration `json:"connectionInspectionTimeout,omitempty"` } // TCPClientTimeout only provides timeout configuration on the listener whose protocol is TCP or TLS. @@ -97,6 +89,14 @@ type TCPClientTimeout struct { // // +optional HandshakeTimeout *gwapiv1.Duration `json:"handshakeTimeout,omitempty"` + + // ConnectionInspectionTimeout is the maximum time to wait for initial inspection + // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + // If exceeded, the connection is dropped. + // Default: 15 seconds. + // + // +optional + ConnectionInspectionTimeout *gwapiv1.Duration `json:"connectionInspectionTimeout,omitempty"` } type HTTPClientTimeout struct { From 67f6266ced21afa4de12d97f337209f9a7493cf3 Mon Sep 17 00:00:00 2001 From: kabbohus Date: Thu, 30 Jul 2026 10:26:43 +0200 Subject: [PATCH 05/10] Implement translation for timeouts Signed-off-by: kabbohus --- internal/gatewayapi/clienttrafficpolicy.go | 22 +++++++++++++++++++++ internal/ir/xds.go | 12 +++++++++++ internal/xds/translator/listener.go | 23 ++++++++++++++++++++-- internal/xds/translator/translator.go | 2 ++ 4 files changed, 57 insertions(+), 2 deletions(-) diff --git a/internal/gatewayapi/clienttrafficpolicy.go b/internal/gatewayapi/clienttrafficpolicy.go index ba65a15158..210d574511 100644 --- a/internal/gatewayapi/clienttrafficpolicy.go +++ b/internal/gatewayapi/clienttrafficpolicy.go @@ -854,6 +854,20 @@ func buildClientTimeout(clientTimeout *egv1a1.ClientTimeout) (*ir.ClientTimeout, } irTCPTimeout.IdleTimeout = ir.MetaV1DurationPtr(d) } + if clientTimeout.TCP.HandshakeTimeout != nil { + d, err := time.ParseDuration(string(*clientTimeout.TCP.HandshakeTimeout)) + if err != nil { + return nil, fmt.Errorf("invalid TCP HandshakeTimeout value %s", *clientTimeout.TCP.HandshakeTimeout) + } + irTCPTimeout.HandshakeTimeout = ir.MetaV1DurationPtr(d) + } + if clientTimeout.TCP.ConnectionInspectionTimeout != nil { + d, err := time.ParseDuration(string(*clientTimeout.TCP.ConnectionInspectionTimeout)) + if err != nil { + return nil, fmt.Errorf("invalid TCP ConnectionInspectionTimeout value %s", *clientTimeout.TCP.ConnectionInspectionTimeout) + } + irTCPTimeout.ConnectionInspectionTimeout = ir.MetaV1DurationPtr(d) + } irClientTimeout.TCP = irTCPTimeout } @@ -882,6 +896,14 @@ func buildClientTimeout(clientTimeout *egv1a1.ClientTimeout) (*ir.ClientTimeout, } irHTTPTimeout.StreamIdleTimeout = ir.MetaV1DurationPtr(d) } + + if clientTimeout.HTTP.RequestHeadersReceivedTimeout != nil { + d, err := time.ParseDuration(string(*clientTimeout.HTTP.RequestHeadersReceivedTimeout)) + if err != nil { + return nil, fmt.Errorf("invalid HTTP RequestHeadersReceivedTimeout value %s", *clientTimeout.HTTP.RequestHeadersReceivedTimeout) + } + irHTTPTimeout.RequestHeadersReceivedTimeout = ir.MetaV1DurationPtr(d) + } irClientTimeout.HTTP = irHTTPTimeout } diff --git a/internal/ir/xds.go b/internal/ir/xds.go index 6a6b670373..fbfd1b9304 100644 --- a/internal/ir/xds.go +++ b/internal/ir/xds.go @@ -877,6 +877,14 @@ type TCPClientTimeout struct { // IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no // bytes sent or received on either the upstream or downstream connection. IdleTimeout *metav1.Duration `json:"idleTimeout,omitempty" yaml:"idleTimeout,omitempty"` + // HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + // (e.g. the TLS handshake) after a connection is accepted. + // If this expires before the transport reports connection establishment, the connection is summarily closed. + HandshakeTimeout *metav1.Duration `json:"handshakeTimeout,omitempty" yaml:"handshakeTimeout,omitempty"` + // ConnectionInspectionTimeout is the maximum time to wait for initial inspection + // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + // If exceeded, the connection is dropped. + ConnectionInspectionTimeout *metav1.Duration `json:"connectionInspectionTimeout,omitempty" yaml:"connectionInspectionTimeout,omitempty"` } // HTTPClientTimeout set the configuration for client HTTP. @@ -885,6 +893,10 @@ type HTTPClientTimeout struct { // The duration envoy waits for the complete request reception. This timer starts upon request // initiation and stops when either the last byte of the request is sent upstream or when the response begins. RequestReceivedTimeout *metav1.Duration `json:"requestReceivedTimeout,omitempty" yaml:"requestReceivedTimeout,omitempty"` + // RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. + // The timer is activated when the first byte of the headers is received, + // and is disarmed when the last byte of the headers has been received. + RequestHeadersReceivedTimeout *metav1.Duration `json:"requestHeadersReceivedTimeout,omitempty" yaml:"requestHeadersReceivedTimeout,omitempty"` // IdleTimeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection. IdleTimeout *metav1.Duration `json:"idleTimeout,omitempty" yaml:"idleTimeout,omitempty"` // The stream idle timeout for connections managed by the connection manager. diff --git a/internal/xds/translator/listener.go b/internal/xds/translator/listener.go index f3a042f61a..e3a1ca982b 100644 --- a/internal/xds/translator/listener.go +++ b/internal/xds/translator/listener.go @@ -214,6 +214,7 @@ func (t *Translator) buildXdsTCPListener( listenerDetails *ir.CoreListenerDetails, keepalive *ir.TCPKeepalive, connection *ir.ClientConnection, + timeout *ir.ClientTimeout, accesslog *ir.AccessLog, ) (*listenerv3.Listener, error) { socketOptions := buildTCPSocketOptions(keepalive) @@ -249,6 +250,10 @@ func (t *Translator) buildXdsTCPListener( socketAddress.Ipv4Compat = true } + if timeout != nil && timeout.TCP != nil && timeout.TCP.ConnectionInspectionTimeout != nil { + listener.ListenerFiltersTimeout = durationpb.New(timeout.TCP.ConnectionInspectionTimeout.Duration) + } + return listener, nil } @@ -440,6 +445,10 @@ func (t *Translator) addHCMToXDSListener( mgr.RequestTimeout = durationpb.New(irListener.Timeout.HTTP.RequestReceivedTimeout.Duration) } + if irListener.Timeout.HTTP.RequestHeadersReceivedTimeout != nil { + mgr.RequestHeadersTimeout = durationpb.New(irListener.Timeout.HTTP.RequestHeadersReceivedTimeout.Duration) + } + if irListener.Timeout.HTTP.IdleTimeout != nil { mgr.CommonHttpProtocolOptions.IdleTimeout = durationpb.New(irListener.Timeout.HTTP.IdleTimeout.Duration) } @@ -508,6 +517,10 @@ func (t *Translator) addHCMToXDSListener( Filters: filters, } + if irListener.Timeout != nil && irListener.Timeout.TCP != nil && irListener.Timeout.TCP.HandshakeTimeout != nil { + filterChain.TransportSocketConnectTimeout = durationpb.New(irListener.Timeout.TCP.HandshakeTimeout.Duration) + } + if irListener.TLS != nil { var tSocket *corev3.TransportSocket @@ -805,10 +818,16 @@ func buildTCPFilterChain( return nil, err } - return &listenerv3.FilterChain{ + filterChain := &listenerv3.FilterChain{ Filters: filters, Name: tlsListenerFilterChainName(irRoute), - }, nil + } + + if timeout != nil && timeout.TCP != nil && timeout.TCP.HandshakeTimeout != nil { + filterChain.TransportSocketConnectTimeout = durationpb.New(timeout.TCP.HandshakeTimeout.Duration) + } + + return filterChain, nil } func buildConnectionLimitFilter(statPrefix string, connection *ir.ClientConnection) *connection_limitv3.ConnectionLimit { diff --git a/internal/xds/translator/translator.go b/internal/xds/translator/translator.go index ec4272e49d..05f3f8b81e 100644 --- a/internal/xds/translator/translator.go +++ b/internal/xds/translator/translator.go @@ -344,6 +344,7 @@ func (t *Translator) processHTTPListenerXdsTranslation( &httpListener.CoreListenerDetails, httpListener.TCPKeepalive, httpListener.Connection, + httpListener.Timeout, accessLog, ); err != nil { errs = errors.Join(errs, err) @@ -773,6 +774,7 @@ func (t *Translator) processTCPListenerXdsTranslation( &tcpListener.CoreListenerDetails, tcpListener.TCPKeepalive, tcpListener.Connection, + tcpListener.Timeout, accesslog, ); err != nil { // skip this listener if failed to build xds listener From 66191aff0457c56006603152b403bdd9ebc9f38b Mon Sep 17 00:00:00 2001 From: kabbohus Date: Thu, 30 Jul 2026 10:27:04 +0200 Subject: [PATCH 06/10] Align default values in api definition with Envoy Proxy and regenerate Signed-off-by: kabbohus --- api/v1alpha1/timeout_types.go | 8 +++----- api/v1alpha1/zz_generated.deepcopy.go | 10 +++++----- ...y.envoyproxy.io_clienttrafficpolicies.yaml | 20 +++++++++---------- ...y.envoyproxy.io_clienttrafficpolicies.yaml | 20 +++++++++---------- internal/ir/zz_generated.deepcopy.go | 15 ++++++++++++++ site/content/en/latest/api/extension_types.md | 6 +++--- test/helm/gateway-crds-helm/all.out.yaml | 20 +++++++++---------- test/helm/gateway-crds-helm/e2e.out.yaml | 20 +++++++++---------- .../envoy-gateway-crds.out.yaml | 20 +++++++++---------- 9 files changed, 71 insertions(+), 68 deletions(-) diff --git a/api/v1alpha1/timeout_types.go b/api/v1alpha1/timeout_types.go index e967aee7a0..f23de6f8af 100644 --- a/api/v1alpha1/timeout_types.go +++ b/api/v1alpha1/timeout_types.go @@ -85,10 +85,9 @@ type TCPClientTimeout struct { // HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation // (e.g. the TLS handshake) after a connection is accepted. // If this expires before the transport reports connection establishment, the connection is summarily closed. - // Default: 5 seconds. // // +optional - HandshakeTimeout *gwapiv1.Duration `json:"handshakeTimeout,omitempty"` + HandshakeTimeout *gwapiv1.Duration `json:"handshakeTimeout,omitempty"` // ConnectionInspectionTimeout is the maximum time to wait for initial inspection // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. @@ -96,7 +95,7 @@ type TCPClientTimeout struct { // Default: 15 seconds. // // +optional - ConnectionInspectionTimeout *gwapiv1.Duration `json:"connectionInspectionTimeout,omitempty"` + ConnectionInspectionTimeout *gwapiv1.Duration `json:"connectionInspectionTimeout,omitempty"` } type HTTPClientTimeout struct { @@ -109,8 +108,7 @@ type HTTPClientTimeout struct { // RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. // The timer is activated when the first byte of the headers is received, // and is disarmed when the last byte of the headers has been received. - // Specify 0 to disable the timeout. - // Default: 10 seconds. + // If not specified or set to 0, this timeout is disabled. // // +optional RequestHeadersReceivedTimeout *gwapiv1.Duration `json:"requestHeadersReceivedTimeout,omitempty"` diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index 264d70125f..1c061b84e9 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -1361,11 +1361,6 @@ func (in *ClientTimeout) DeepCopyInto(out *ClientTimeout) { *out = new(HTTPClientTimeout) (*in).DeepCopyInto(*out) } - if in.ConnectionInspectionTimeout != nil { - in, out := &in.ConnectionInspectionTimeout, &out.ConnectionInspectionTimeout - *out = new(v1.Duration) - **out = **in - } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClientTimeout. @@ -8344,6 +8339,11 @@ func (in *TCPClientTimeout) DeepCopyInto(out *TCPClientTimeout) { *out = new(v1.Duration) **out = **in } + if in.ConnectionInspectionTimeout != nil { + in, out := &in.ConnectionInspectionTimeout, &out.ConnectionInspectionTimeout + *out = new(v1.Duration) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPClientTimeout. diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index 9d1e134036..a197c8abb5 100644 --- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1327,14 +1327,6 @@ spec: timeout: description: Timeout settings for the client connections. properties: - connectionInspectionTimeout: - description: |- - ConnectionInspectionTimeout is the maximum time to wait for initial inspection - (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. - If exceeded, the connection is dropped. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string http: description: Timeout settings for HTTP. properties: @@ -1349,8 +1341,7 @@ spec: RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. - Specify 0 to disable the timeout. - Default: 10 seconds. + If not specified or set to 0, this timeout is disabled. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string requestReceivedTimeout: @@ -1369,12 +1360,19 @@ spec: tcp: description: Timeout settings for TCP. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string handshakeTimeout: description: |- HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation (e.g. the TLS handshake) after a connection is accepted. If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string idleTimeout: diff --git a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index 38b572ebdc..e61979c97b 100644 --- a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1326,14 +1326,6 @@ spec: timeout: description: Timeout settings for the client connections. properties: - connectionInspectionTimeout: - description: |- - ConnectionInspectionTimeout is the maximum time to wait for initial inspection - (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. - If exceeded, the connection is dropped. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string http: description: Timeout settings for HTTP. properties: @@ -1348,8 +1340,7 @@ spec: RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. - Specify 0 to disable the timeout. - Default: 10 seconds. + If not specified or set to 0, this timeout is disabled. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string requestReceivedTimeout: @@ -1368,12 +1359,19 @@ spec: tcp: description: Timeout settings for TCP. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string handshakeTimeout: description: |- HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation (e.g. the TLS handshake) after a connection is accepted. If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string idleTimeout: diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go index fd9e5ce9fe..3076a45886 100644 --- a/internal/ir/zz_generated.deepcopy.go +++ b/internal/ir/zz_generated.deepcopy.go @@ -2178,6 +2178,11 @@ func (in *HTTPClientTimeout) DeepCopyInto(out *HTTPClientTimeout) { *out = new(metav1.Duration) **out = **in } + if in.RequestHeadersReceivedTimeout != nil { + in, out := &in.RequestHeadersReceivedTimeout, &out.RequestHeadersReceivedTimeout + *out = new(metav1.Duration) + **out = **in + } if in.IdleTimeout != nil { in, out := &in.IdleTimeout, &out.IdleTimeout *out = new(metav1.Duration) @@ -4525,6 +4530,16 @@ func (in *TCPClientTimeout) DeepCopyInto(out *TCPClientTimeout) { *out = new(metav1.Duration) **out = **in } + if in.HandshakeTimeout != nil { + in, out := &in.HandshakeTimeout, &out.HandshakeTimeout + *out = new(metav1.Duration) + **out = **in + } + if in.ConnectionInspectionTimeout != nil { + in, out := &in.ConnectionInspectionTimeout, &out.ConnectionInspectionTimeout + *out = new(metav1.Duration) + **out = **in + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPClientTimeout. diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index 11a97c3313..7c01367fc0 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -961,7 +961,6 @@ _Appears in:_ | --- | --- | --- | --- | --- | | `tcp` | _[TCPClientTimeout](#tcpclienttimeout)_ | false | | Timeout settings for TCP. | | `http` | _[HTTPClientTimeout](#httpclienttimeout)_ | false | | Timeout settings for HTTP. | -| `connectionInspectionTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ConnectionInspectionTimeout is the maximum time to wait for initial inspection
(TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection.
If exceeded, the connection is dropped.
Default: 15 seconds. | #### ClientTrafficPolicy @@ -2997,7 +2996,7 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `requestReceivedTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestReceivedTimeout is the duration envoy waits for the complete request reception. This timer starts upon request
initiation and stops when either the last byte of the request is sent upstream or when the response begins. | -| `requestHeadersReceivedTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive.
The timer is activated when the first byte of the headers is received,
and is disarmed when the last byte of the headers has been received.
Specify 0 to disable the timeout.
Default: 10 seconds. | +| `requestHeadersReceivedTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive.
The timer is activated when the first byte of the headers is received,
and is disarmed when the last byte of the headers has been received.
If not specified or set to 0, this timeout is disabled. | | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
Default: 1 hour. | | `streamIdleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | The stream idle timeout defines the amount of time a stream can exist without any upstream or downstream activity.
Default: 5 minutes. | @@ -6166,7 +6165,8 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no
bytes sent or received on either the upstream or downstream connection.
Default: 1 hour. | -| `handshakeTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
(e.g. the TLS handshake) after a connection is accepted.
If this expires before the transport reports connection establishment, the connection is summarily closed.
Default: 5 seconds. | +| `handshakeTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
(e.g. the TLS handshake) after a connection is accepted.
If this expires before the transport reports connection establishment, the connection is summarily closed. | +| `connectionInspectionTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ConnectionInspectionTimeout is the maximum time to wait for initial inspection
(TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection.
If exceeded, the connection is dropped.
Default: 15 seconds. | #### TCPKeepalive diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml index be5cfa4547..9efdad1f19 100644 --- a/test/helm/gateway-crds-helm/all.out.yaml +++ b/test/helm/gateway-crds-helm/all.out.yaml @@ -29686,14 +29686,6 @@ spec: timeout: description: Timeout settings for the client connections. properties: - connectionInspectionTimeout: - description: |- - ConnectionInspectionTimeout is the maximum time to wait for initial inspection - (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. - If exceeded, the connection is dropped. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string http: description: Timeout settings for HTTP. properties: @@ -29708,8 +29700,7 @@ spec: RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. - Specify 0 to disable the timeout. - Default: 10 seconds. + If not specified or set to 0, this timeout is disabled. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string requestReceivedTimeout: @@ -29728,12 +29719,19 @@ spec: tcp: description: Timeout settings for TCP. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string handshakeTimeout: description: |- HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation (e.g. the TLS handshake) after a connection is accepted. If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string idleTimeout: diff --git a/test/helm/gateway-crds-helm/e2e.out.yaml b/test/helm/gateway-crds-helm/e2e.out.yaml index 979d2f3ec5..bd94914d55 100644 --- a/test/helm/gateway-crds-helm/e2e.out.yaml +++ b/test/helm/gateway-crds-helm/e2e.out.yaml @@ -5624,14 +5624,6 @@ spec: timeout: description: Timeout settings for the client connections. properties: - connectionInspectionTimeout: - description: |- - ConnectionInspectionTimeout is the maximum time to wait for initial inspection - (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. - If exceeded, the connection is dropped. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string http: description: Timeout settings for HTTP. properties: @@ -5646,8 +5638,7 @@ spec: RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. - Specify 0 to disable the timeout. - Default: 10 seconds. + If not specified or set to 0, this timeout is disabled. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string requestReceivedTimeout: @@ -5666,12 +5657,19 @@ spec: tcp: description: Timeout settings for TCP. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string handshakeTimeout: description: |- HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation (e.g. the TLS handshake) after a connection is accepted. If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string idleTimeout: diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml index e6e4e2c893..06b52e9052 100644 --- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml +++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml @@ -5624,14 +5624,6 @@ spec: timeout: description: Timeout settings for the client connections. properties: - connectionInspectionTimeout: - description: |- - ConnectionInspectionTimeout is the maximum time to wait for initial inspection - (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. - If exceeded, the connection is dropped. - Default: 15 seconds. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string http: description: Timeout settings for HTTP. properties: @@ -5646,8 +5638,7 @@ spec: RequestHeadersReceivedTimeout is the duration envoy waits for the request headers to arrive. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. - Specify 0 to disable the timeout. - Default: 10 seconds. + If not specified or set to 0, this timeout is disabled. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string requestReceivedTimeout: @@ -5666,12 +5657,19 @@ spec: tcp: description: Timeout settings for TCP. properties: + connectionInspectionTimeout: + description: |- + ConnectionInspectionTimeout is the maximum time to wait for initial inspection + (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. + If exceeded, the connection is dropped. + Default: 15 seconds. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string handshakeTimeout: description: |- HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation (e.g. the TLS handshake) after a connection is accepted. If this expires before the transport reports connection establishment, the connection is summarily closed. - Default: 5 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string idleTimeout: From f8799b414b1cea33d88161682e2e9c68534a8ebb Mon Sep 17 00:00:00 2001 From: kabbohus Date: Thu, 30 Jul 2026 11:55:36 +0200 Subject: [PATCH 07/10] Add changelog entry Signed-off-by: kabbohus --- .../new_features/9315-support-more-client-timeout-settings.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 release-notes/current/new_features/9315-support-more-client-timeout-settings.md diff --git a/release-notes/current/new_features/9315-support-more-client-timeout-settings.md b/release-notes/current/new_features/9315-support-more-client-timeout-settings.md new file mode 100644 index 0000000000..4ed4254732 --- /dev/null +++ b/release-notes/current/new_features/9315-support-more-client-timeout-settings.md @@ -0,0 +1 @@ +Add support for more client timeout settings. The settings are [`ConnectionInspectionTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener.proto#envoy-v3-api-field-config-listener-v3-listener-listener-filters-timeout), [`RequestHeadersReceivedTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-request-headers-timeout) and [`HandshakeTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener_components.proto.html#envoy-v3-api-field-config-listener-v3-filterchain-transport-socket-connect-timeout) From 376aaade824fad748b7f75c5c2a593a039c2aa12 Mon Sep 17 00:00:00 2001 From: kabbohus Date: Thu, 30 Jul 2026 12:40:54 +0200 Subject: [PATCH 08/10] Test whether translation works for timeouts Signed-off-by: kabbohus --- .../testdata/clienttrafficpolicy-timeout.in.yaml | 4 ++++ .../testdata/clienttrafficpolicy-timeout.out.yaml | 8 ++++++++ 2 files changed, 12 insertions(+) diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml index 11ea0bba15..2f6bf90b98 100644 --- a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml +++ b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml @@ -11,8 +11,12 @@ clientTrafficPolicies: name: gateway sectionName: http-1 timeout: + tcp: + handshakeTimeout: "10s" + connectionInspectionTimeout: "60s" http: requestReceivedTimeout: "5s" + requestHeadersReceivedTimeout: "5s" gateways: - apiVersion: gateway.networking.k8s.io/v1 kind: Gateway diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml index 89c4b657b1..cb1e476cdb 100644 --- a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml +++ b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml @@ -12,7 +12,11 @@ clientTrafficPolicies: sectionName: http-1 timeout: http: + requestHeadersReceivedTimeout: 5s requestReceivedTimeout: 5s + tcp: + connectionInspectionTimeout: 60s + handshakeTimeout: 10s status: ancestors: - ancestorRef: @@ -170,7 +174,11 @@ xdsIR: port: 10080 timeout: http: + requestHeadersReceivedTimeout: 5s requestReceivedTimeout: 5s + tcp: + connectionInspectionTimeout: 1m0s + handshakeTimeout: 10s - address: 0.0.0.0 externalPort: 8080 hostnames: From d0f259d7e3cb13d58a4da136e29e0298babe5788 Mon Sep 17 00:00:00 2001 From: kabbohus Date: Mon, 3 Aug 2026 09:37:24 +0200 Subject: [PATCH 09/10] Rename HandshakeTimeout to TLSHandshakeTimeout Signed-off-by: kabbohus --- api/v1alpha1/timeout_types.go | 4 ++-- api/v1alpha1/zz_generated.deepcopy.go | 4 ++-- ...ateway.envoyproxy.io_clienttrafficpolicies.yaml | 14 +++++++------- ...ateway.envoyproxy.io_clienttrafficpolicies.yaml | 14 +++++++------- internal/gatewayapi/clienttrafficpolicy.go | 8 ++++---- .../testdata/clienttrafficpolicy-timeout.in.yaml | 2 +- .../testdata/clienttrafficpolicy-timeout.out.yaml | 4 ++-- internal/ir/xds.go | 4 ++-- internal/ir/zz_generated.deepcopy.go | 4 ++-- internal/xds/translator/listener.go | 8 ++++---- .../9315-support-more-client-timeout-settings.md | 2 +- site/content/en/latest/api/extension_types.md | 2 +- test/helm/gateway-crds-helm/all.out.yaml | 14 +++++++------- test/helm/gateway-crds-helm/e2e.out.yaml | 14 +++++++------- .../gateway-crds-helm/envoy-gateway-crds.out.yaml | 14 +++++++------- 15 files changed, 56 insertions(+), 56 deletions(-) diff --git a/api/v1alpha1/timeout_types.go b/api/v1alpha1/timeout_types.go index f23de6f8af..0cc6bcd4ea 100644 --- a/api/v1alpha1/timeout_types.go +++ b/api/v1alpha1/timeout_types.go @@ -82,12 +82,12 @@ type TCPClientTimeout struct { // +optional IdleTimeout *gwapiv1.Duration `json:"idleTimeout,omitempty"` - // HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + // TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation // (e.g. the TLS handshake) after a connection is accepted. // If this expires before the transport reports connection establishment, the connection is summarily closed. // // +optional - HandshakeTimeout *gwapiv1.Duration `json:"handshakeTimeout,omitempty"` + TLSHandshakeTimeout *gwapiv1.Duration `json:"tlsHandshakeTimeout,omitempty"` // ConnectionInspectionTimeout is the maximum time to wait for initial inspection // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index 29548d231b..e6ab34d59d 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -8472,8 +8472,8 @@ func (in *TCPClientTimeout) DeepCopyInto(out *TCPClientTimeout) { *out = new(v1.Duration) **out = **in } - if in.HandshakeTimeout != nil { - in, out := &in.HandshakeTimeout, &out.HandshakeTimeout + if in.TLSHandshakeTimeout != nil { + in, out := &in.TLSHandshakeTimeout, &out.TLSHandshakeTimeout *out = new(v1.Duration) **out = **in } diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index a197c8abb5..7fad46c37d 100644 --- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1368,13 +1368,6 @@ spec: Default: 15 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - handshakeTimeout: - description: |- - HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation - (e.g. the TLS handshake) after a connection is accepted. - If this expires before the transport reports connection establishment, the connection is summarily closed. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -1382,6 +1375,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + tlsHandshakeTimeout: + description: |- + TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml index e61979c97b..7b86a96254 100644 --- a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml +++ b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml @@ -1367,13 +1367,6 @@ spec: Default: 15 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - handshakeTimeout: - description: |- - HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation - (e.g. the TLS handshake) after a connection is accepted. - If this expires before the transport reports connection establishment, the connection is summarily closed. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -1381,6 +1374,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + tlsHandshakeTimeout: + description: |- + TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/internal/gatewayapi/clienttrafficpolicy.go b/internal/gatewayapi/clienttrafficpolicy.go index 15c984f679..32d01bebe5 100644 --- a/internal/gatewayapi/clienttrafficpolicy.go +++ b/internal/gatewayapi/clienttrafficpolicy.go @@ -958,12 +958,12 @@ func buildClientTimeout(clientTimeout *egv1a1.ClientTimeout) (*ir.ClientTimeout, } irTCPTimeout.IdleTimeout = ir.MetaV1DurationPtr(d) } - if clientTimeout.TCP.HandshakeTimeout != nil { - d, err := time.ParseDuration(string(*clientTimeout.TCP.HandshakeTimeout)) + if clientTimeout.TCP.TLSHandshakeTimeout != nil { + d, err := time.ParseDuration(string(*clientTimeout.TCP.TLSHandshakeTimeout)) if err != nil { - return nil, fmt.Errorf("invalid TCP HandshakeTimeout value %s", *clientTimeout.TCP.HandshakeTimeout) + return nil, fmt.Errorf("invalid TCP TLSHandshakeTimeout value %s", *clientTimeout.TCP.TLSHandshakeTimeout) } - irTCPTimeout.HandshakeTimeout = ir.MetaV1DurationPtr(d) + irTCPTimeout.TLSHandshakeTimeout = ir.MetaV1DurationPtr(d) } if clientTimeout.TCP.ConnectionInspectionTimeout != nil { d, err := time.ParseDuration(string(*clientTimeout.TCP.ConnectionInspectionTimeout)) diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml index 2f6bf90b98..f585270260 100644 --- a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml +++ b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.in.yaml @@ -12,7 +12,7 @@ clientTrafficPolicies: sectionName: http-1 timeout: tcp: - handshakeTimeout: "10s" + tlsHandshakeTimeout: "10s" connectionInspectionTimeout: "60s" http: requestReceivedTimeout: "5s" diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml index cb1e476cdb..54a3d74b1e 100644 --- a/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml +++ b/internal/gatewayapi/testdata/clienttrafficpolicy-timeout.out.yaml @@ -16,7 +16,7 @@ clientTrafficPolicies: requestReceivedTimeout: 5s tcp: connectionInspectionTimeout: 60s - handshakeTimeout: 10s + tlsHandshakeTimeout: 10s status: ancestors: - ancestorRef: @@ -178,7 +178,7 @@ xdsIR: requestReceivedTimeout: 5s tcp: connectionInspectionTimeout: 1m0s - handshakeTimeout: 10s + tlsHandshakeTimeout: 10s - address: 0.0.0.0 externalPort: 8080 hostnames: diff --git a/internal/ir/xds.go b/internal/ir/xds.go index 1cb1febeb9..466382356b 100644 --- a/internal/ir/xds.go +++ b/internal/ir/xds.go @@ -969,10 +969,10 @@ type TCPClientTimeout struct { // IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no // bytes sent or received on either the upstream or downstream connection. IdleTimeout *metav1.Duration `json:"idleTimeout,omitempty" yaml:"idleTimeout,omitempty"` - // HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + // TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation // (e.g. the TLS handshake) after a connection is accepted. // If this expires before the transport reports connection establishment, the connection is summarily closed. - HandshakeTimeout *metav1.Duration `json:"handshakeTimeout,omitempty" yaml:"handshakeTimeout,omitempty"` + TLSHandshakeTimeout *metav1.Duration `json:"tlsHandshakeTimeout,omitempty" yaml:"handshakeTimeout,omitempty"` // ConnectionInspectionTimeout is the maximum time to wait for initial inspection // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. // If exceeded, the connection is dropped. diff --git a/internal/ir/zz_generated.deepcopy.go b/internal/ir/zz_generated.deepcopy.go index bec1db4844..c15678345e 100644 --- a/internal/ir/zz_generated.deepcopy.go +++ b/internal/ir/zz_generated.deepcopy.go @@ -4601,8 +4601,8 @@ func (in *TCPClientTimeout) DeepCopyInto(out *TCPClientTimeout) { *out = new(metav1.Duration) **out = **in } - if in.HandshakeTimeout != nil { - in, out := &in.HandshakeTimeout, &out.HandshakeTimeout + if in.TLSHandshakeTimeout != nil { + in, out := &in.TLSHandshakeTimeout, &out.TLSHandshakeTimeout *out = new(metav1.Duration) **out = **in } diff --git a/internal/xds/translator/listener.go b/internal/xds/translator/listener.go index ff32aaca82..050c3089e9 100644 --- a/internal/xds/translator/listener.go +++ b/internal/xds/translator/listener.go @@ -517,8 +517,8 @@ func (t *Translator) addHCMToXDSListener( Filters: filters, } - if irListener.Timeout != nil && irListener.Timeout.TCP != nil && irListener.Timeout.TCP.HandshakeTimeout != nil { - filterChain.TransportSocketConnectTimeout = durationpb.New(irListener.Timeout.TCP.HandshakeTimeout.Duration) + if irListener.Timeout != nil && irListener.Timeout.TCP != nil && irListener.Timeout.TCP.TLSHandshakeTimeout != nil { + filterChain.TransportSocketConnectTimeout = durationpb.New(irListener.Timeout.TCP.TLSHandshakeTimeout.Duration) } if irListener.TLS != nil { @@ -823,8 +823,8 @@ func buildTCPFilterChain( Name: tlsListenerFilterChainName(irRoute), } - if timeout != nil && timeout.TCP != nil && timeout.TCP.HandshakeTimeout != nil { - filterChain.TransportSocketConnectTimeout = durationpb.New(timeout.TCP.HandshakeTimeout.Duration) + if timeout != nil && timeout.TCP != nil && timeout.TCP.TLSHandshakeTimeout != nil { + filterChain.TransportSocketConnectTimeout = durationpb.New(timeout.TCP.TLSHandshakeTimeout.Duration) } return filterChain, nil diff --git a/release-notes/current/new_features/9315-support-more-client-timeout-settings.md b/release-notes/current/new_features/9315-support-more-client-timeout-settings.md index 4ed4254732..8d75c60ab2 100644 --- a/release-notes/current/new_features/9315-support-more-client-timeout-settings.md +++ b/release-notes/current/new_features/9315-support-more-client-timeout-settings.md @@ -1 +1 @@ -Add support for more client timeout settings. The settings are [`ConnectionInspectionTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener.proto#envoy-v3-api-field-config-listener-v3-listener-listener-filters-timeout), [`RequestHeadersReceivedTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-request-headers-timeout) and [`HandshakeTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener_components.proto.html#envoy-v3-api-field-config-listener-v3-filterchain-transport-socket-connect-timeout) +Add support for more client timeout settings. The settings are [`ConnectionInspectionTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener.proto#envoy-v3-api-field-config-listener-v3-listener-listener-filters-timeout), [`RequestHeadersReceivedTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-request-headers-timeout) and [`TLSHandshakeTimeout`](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener_components.proto.html#envoy-v3-api-field-config-listener-v3-filterchain-transport-socket-connect-timeout) diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index c63aeefa5b..d938fa5778 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -6280,7 +6280,7 @@ _Appears in:_ | Field | Type | Required | Default | Description | | --- | --- | --- | --- | --- | | `idleTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no
bytes sent or received on either the upstream or downstream connection.
Default: 1 hour. | -| `handshakeTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
(e.g. the TLS handshake) after a connection is accepted.
If this expires before the transport reports connection establishment, the connection is summarily closed. | +| `tlsHandshakeTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation
(e.g. the TLS handshake) after a connection is accepted.
If this expires before the transport reports connection establishment, the connection is summarily closed. | | `connectionInspectionTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ | false | | ConnectionInspectionTimeout is the maximum time to wait for initial inspection
(TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection.
If exceeded, the connection is dropped.
Default: 15 seconds. | diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml index c72712dcba..6dbe9f1516 100644 --- a/test/helm/gateway-crds-helm/all.out.yaml +++ b/test/helm/gateway-crds-helm/all.out.yaml @@ -29767,13 +29767,6 @@ spec: Default: 15 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - handshakeTimeout: - description: |- - HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation - (e.g. the TLS handshake) after a connection is accepted. - If this expires before the transport reports connection establishment, the connection is summarily closed. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -29781,6 +29774,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + tlsHandshakeTimeout: + description: |- + TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/test/helm/gateway-crds-helm/e2e.out.yaml b/test/helm/gateway-crds-helm/e2e.out.yaml index 4ae2eb1e36..b70450d0c4 100644 --- a/test/helm/gateway-crds-helm/e2e.out.yaml +++ b/test/helm/gateway-crds-helm/e2e.out.yaml @@ -5705,13 +5705,6 @@ spec: Default: 15 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - handshakeTimeout: - description: |- - HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation - (e.g. the TLS handshake) after a connection is accepted. - If this expires before the transport reports connection establishment, the connection is summarily closed. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -5719,6 +5712,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + tlsHandshakeTimeout: + description: |- + TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml index 1286b882fa..4b6fedbbeb 100644 --- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml +++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml @@ -5705,13 +5705,6 @@ spec: Default: 15 seconds. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string - handshakeTimeout: - description: |- - HandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation - (e.g. the TLS handshake) after a connection is accepted. - If this expires before the transport reports connection establishment, the connection is summarily closed. - pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ - type: string idleTimeout: description: |- IdleTimeout for a TCP connection. Idle time is defined as a period in which there are no @@ -5719,6 +5712,13 @@ spec: Default: 1 hour. pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ type: string + tlsHandshakeTimeout: + description: |- + TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation + (e.g. the TLS handshake) after a connection is accepted. + If this expires before the transport reports connection establishment, the connection is summarily closed. + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string type: object type: object tls: From 0ac22100b53c4a9fc46e5c2f13e073da69457367 Mon Sep 17 00:00:00 2001 From: kabbohus Date: Mon, 3 Aug 2026 13:56:07 +0200 Subject: [PATCH 10/10] Accept suggestion Co-authored-by: Huabing (Robin) Zhao Signed-off-by: kabbohus --- internal/ir/xds.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/ir/xds.go b/internal/ir/xds.go index fecd05d0e4..5a14dbd588 100644 --- a/internal/ir/xds.go +++ b/internal/ir/xds.go @@ -972,7 +972,7 @@ type TCPClientTimeout struct { // TLSHandshakeTimeout for a TCP connection. The maximum time to complete transport level connection negotiation // (e.g. the TLS handshake) after a connection is accepted. // If this expires before the transport reports connection establishment, the connection is summarily closed. - TLSHandshakeTimeout *metav1.Duration `json:"tlsHandshakeTimeout,omitempty" yaml:"handshakeTimeout,omitempty"` + TLSHandshakeTimeout *metav1.Duration `json:"tlsHandshakeTimeout,omitempty" yaml:"tlsHandshakeTimeout,omitempty"` // ConnectionInspectionTimeout is the maximum time to wait for initial inspection // (TLS / SNI and protocol detection, or HTTP protocol parsing) of an incoming connection. // If exceeded, the connection is dropped.