api: make ConnectionLimit.Value optional by felipesabadini · Pull Request #8478 · envoyproxy/gateway

felipesabadini · 2026-03-10T15:59:23Z

What type of PR is this?

api: make ConnectionLimit.Value optional

What this PR does / why we need it:

Makes ConnectionLimit.Value an optional pointer field (*int64) so users
can configure MaxConnectionDuration, MaxRequestsPerConnection, or
MaxStreamDuration without being forced to set a max connections value.

When Value is absent, the connection_limit network filter is not added,
but HCM-level settings (maxConnectionDuration, etc.) still apply.

Which issue(s) this PR fixes:

Fixes #8468

Release Notes: Yes

Signed-off-by: Felipe Sabadini Facina <[email protected]>

netlify · 2026-03-10T15:59:30Z

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name	Link
🔨 Latest commit	`e9b5d44`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69b074ad112e1900089cd5f4

codecov · 2026-03-10T18:03:42Z

Codecov Report

❌ Patch coverage is 77.77778% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.12%. Comparing base (a470576) to head (e9b5d44).
⚠️ Report is 7 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/xds/translator/listener.go	71.42%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8478      +/-   ##
==========================================
- Coverage   74.13%   74.12%   -0.01%     
==========================================
  Files         242      242              
  Lines       37579    37581       +2     
==========================================
- Hits        27859    27858       -1     
- Misses       7778     7780       +2     
- Partials     1942     1943       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

jukie · 2026-03-10T18:28:27Z

/retest

jukie · 2026-03-10T18:35:55Z

api/v1alpha1/connection_types.go

-	Value int64 `json:"value"`
+	// +optional
+	Value *int64 `json:"value,omitempty"`

 	// CloseDelay defines the delay to use before closing connections that are rejected
 	// once the limit value is reached.
 	// Default: none.
 	//
 	// +optional
 	CloseDelay *gwapiv1.Duration `json:"closeDelay,omitempty"`


Could you add a CEL rule so that CloseDelay can't be configured with an empty Value.

Added a CEL validation rule so that closeDelay requires value to be set: !has(self.closeDelay) || has(self.value). Also updated the Helm snapshots and test coverage accordingly.

Signed-off-by: Felipe Sabadini Facina <[email protected]>

jukie · 2026-03-10T22:55:48Z

internal/xds/translator/testdata/in/xds-ir/listener-connection-limit.yaml

+  port: 10086
+  connection:
+    limit:
+      maxConnectionDuration: 600s


Unrelated to your change, but this highlights that this field isn't working for TCP listeners. CC @envoyproxy/gateway-maintainers we should fix this separately

jukie · 2026-03-10T23:00:25Z

/retest

* api: make ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <[email protected]> * release-notes: add entry for ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <[email protected]> * fix: add CEL rule to require value when closeDelay is set Signed-off-by: Felipe Sabadini Facina <[email protected]> --------- Signed-off-by: Felipe Sabadini Facina <[email protected]>

* api: make ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <[email protected]> * release-notes: add entry for ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <[email protected]> * fix: add CEL rule to require value when closeDelay is set Signed-off-by: Felipe Sabadini Facina <[email protected]> --------- Signed-off-by: Felipe Sabadini Facina <[email protected]> Signed-off-by: Karol Szwaj <[email protected]>

* api: make ConnectionLimit.Value optional (#8478) * api: make ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <[email protected]> * release-notes: add entry for ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <[email protected]> * fix: add CEL rule to require value when closeDelay is set Signed-off-by: Felipe Sabadini Facina <[email protected]> --------- Signed-off-by: Felipe Sabadini Facina <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix up release notes Signed-off-by: Karol Szwaj <[email protected]> * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner (#8387) * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner Signed-off-by: y-rabie <[email protected]> * polish Signed-off-by: Huabing (Robin) Zhao <[email protected]> * add e2e test Signed-off-by: Huabing (Robin) Zhao <[email protected]> * release note Signed-off-by: Huabing (Robin) Zhao <[email protected]> * truncate policy status & add tests Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: y-rabie <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: y-rabie <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix: active health check respect endpoint hostname (#8452) revert unrelated changes Signed-off-by: zirain <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix: exclude unmanaged route parents from xPolicy status ancestors (#8321) * add test for mixed managed and unmanaged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix the policy status when the targeting routes have managed and unmanged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix test Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix: add ownerReferences to ratelimit ConfigMap and HPA (#8358) Signed-off-by: Tejasriram Parvathaneni <[email protected]> Co-authored-by: Karol Szwaj <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix: computeHosts doesn't work when listener and route both wildcard (#8186) * fix: computeHosts doesn't work when listener and route both wildcard Signed-off-by: zirain <[email protected]> * remove skipped tests Signed-off-by: zirain <[email protected]> * Update internal/gatewayapi/helpers.go Co-authored-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix: fixed local object reference resolution from parent in merged BackendTrafficPolicies (#8210) Signed-off-by: Rudrakh Panigrahi <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix: XListenerSet allows route from same namespace (#8226) Previously, using allowedRoutes/Same for an XListenerSet with an xRoute in the same namespace would return an error. Now it properly allows xRoutes from the same namespace. Signed-off-by: Kris Hicks <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix: API key auth (#8267) * add test for multiple keys Signed-off-by: Huabing (Robin) Zhao <[email protected]> * revert secret transform Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> * fix gen-check Signed-off-by: Karol Szwaj <[email protected]> * add release notes Signed-off-by: Karol Szwaj <[email protected]> * add release notes for envoy proxy image Signed-off-by: Karol Szwaj <[email protected]> --------- Signed-off-by: Felipe Sabadini Facina <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> Signed-off-by: y-rabie <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: zirain <[email protected]> Signed-off-by: Tejasriram Parvathaneni <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]> Signed-off-by: Kris Hicks <[email protected]> Co-authored-by: Felipe Sabadini Facina <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: y-rabie <[email protected]> Co-authored-by: zirain <[email protected]> Co-authored-by: Tejasriram Parvathaneni <[email protected]> Co-authored-by: Rudrakh Panigrahi <[email protected]> Co-authored-by: Kris Hicks <[email protected]>

* api: make ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <[email protected]> * release-notes: add entry for ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <[email protected]> * fix: add CEL rule to require value when closeDelay is set Signed-off-by: Felipe Sabadini Facina <[email protected]> --------- Signed-off-by: Felipe Sabadini Facina <[email protected]>

* api: make ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <[email protected]> * release-notes: add entry for ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <[email protected]> * fix: add CEL rule to require value when closeDelay is set Signed-off-by: Felipe Sabadini Facina <[email protected]> --------- Signed-off-by: Felipe Sabadini Facina <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]>

* fix: fixed local object reference resolution from parent in merged BackendTrafficPolicies (#8210) Signed-off-by: Rudrakh Panigrahi <[email protected]> * fix: exclude unmanaged route parents from xPolicy status ancestors (#8321) * add test for mixed managed and unmanaged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix the policy status when the targeting routes have managed and unmanged Gateway parents Signed-off-by: Huabing (Robin) Zhao <[email protected]> * fix test Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]> * fix: computeHosts doesn't work when listener and route both wildcard (#8186) * fix: computeHosts doesn't work when listener and route both wildcard Signed-off-by: zirain <[email protected]> * remove skipped tests Signed-off-by: zirain <[email protected]> * Update internal/gatewayapi/helpers.go Co-authored-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]> * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner (#8387) * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner Signed-off-by: y-rabie <[email protected]> * polish Signed-off-by: Huabing (Robin) Zhao <[email protected]> * add e2e test Signed-off-by: Huabing (Robin) Zhao <[email protected]> * release note Signed-off-by: Huabing (Robin) Zhao <[email protected]> * truncate policy status & add tests Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> * update Signed-off-by: Huabing (Robin) Zhao <[email protected]> --------- Signed-off-by: y-rabie <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: y-rabie <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]> * fix: add ownerReferences to ratelimit ConfigMap and HPA (#8358) Signed-off-by: Tejasriram Parvathaneni <[email protected]> Co-authored-by: Karol Szwaj <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]> * api: make ConnectionLimit.Value optional (#8478) * api: make ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <[email protected]> * release-notes: add entry for ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <[email protected]> * fix: add CEL rule to require value when closeDelay is set Signed-off-by: Felipe Sabadini Facina <[email protected]> --------- Signed-off-by: Felipe Sabadini Facina <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]> * fix test race (#8180) * fix test race Signed-off-by: zirain <[email protected]> * use io.Discard Signed-off-by: zirain <[email protected]> * use sync.WaitGroup Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> Signed-off-by: Isaac Wilson <[email protected]> Co-authored-by: Isaac Wilson <[email protected]> Signed-off-by: Rudrakh Panigrahi <[email protected]> * fix gen check Signed-off-by: Rudrakh Panigrahi <[email protected]> --------- Signed-off-by: Rudrakh Panigrahi <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Signed-off-by: zirain <[email protected]> Signed-off-by: y-rabie <[email protected]> Signed-off-by: Tejasriram Parvathaneni <[email protected]> Signed-off-by: Felipe Sabadini Facina <[email protected]> Signed-off-by: Isaac Wilson <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: zirain <[email protected]> Co-authored-by: y-rabie <[email protected]> Co-authored-by: Teja079 <[email protected]> Co-authored-by: Karol Szwaj <[email protected]> Co-authored-by: Felipe Sabadini <[email protected]> Co-authored-by: Isaac Wilson <[email protected]>

felipesabadini added 2 commits March 10, 2026 12:54

api: make ConnectionLimit.Value optional

de71041

Signed-off-by: Felipe Sabadini Facina <[email protected]>

release-notes: add entry for ConnectionLimit.Value optional

dd59fb0

Signed-off-by: Felipe Sabadini Facina <[email protected]>

felipesabadini requested a review from a team as a code owner March 10, 2026 15:59

jukie reviewed Mar 10, 2026

View reviewed changes

fix: add CEL rule to require value when closeDelay is set

e9b5d44

Signed-off-by: Felipe Sabadini Facina <[email protected]>

jukie reviewed Mar 10, 2026

View reviewed changes

jukie approved these changes Mar 10, 2026

View reviewed changes

jukie requested a review from a team March 10, 2026 23:00

zirain approved these changes Mar 10, 2026

View reviewed changes

jukie merged commit 2c9af84 into envoyproxy:main Mar 11, 2026
80 of 85 checks passed

jukie added cherrypick/release-v1.7.1 cherrypick/release-v1.6.5 labels Mar 11, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

api: make ConnectionLimit.Value optional#8478

api: make ConnectionLimit.Value optional#8478
jukie merged 3 commits intoenvoyproxy:mainfrom
felipesabadini:fix/connection-limit-optional-value

felipesabadini commented Mar 10, 2026

Uh oh!

netlify bot commented Mar 10, 2026 •

edited

Loading

Uh oh!

codecov bot commented Mar 10, 2026 •

edited

Loading

Uh oh!

jukie commented Mar 10, 2026

Uh oh!

jukie Mar 10, 2026

Uh oh!

felipesabadini Mar 10, 2026

Uh oh!

jukie Mar 10, 2026

Uh oh!

jukie commented Mar 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

felipesabadini commented Mar 10, 2026

Uh oh!

netlify bot commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Uh oh!

codecov bot commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jukie commented Mar 10, 2026

Uh oh!

jukie Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

felipesabadini Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

jukie Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

jukie commented Mar 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify bot commented Mar 10, 2026 •

edited

Loading

codecov bot commented Mar 10, 2026 •

edited

Loading