fix: MaxStreamDuration should worked for non-route cluster by zirain · Pull Request #9028 · envoyproxy/gateway

zirain · 2026-05-19T00:56:59Z

This seems to be missed in #7194

netlify · 2026-05-19T00:57:05Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`901599b`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a191a4c68306c0008a2cf6a
😎 Deploy Preview	https://deploy-preview-9028--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

codecov · 2026-05-19T01:07:54Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.78%. Comparing base (560a262) to head (901599b).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9028      +/-   ##
==========================================
- Coverage   74.78%   74.78%   -0.01%     
==========================================
  Files         252      252              
  Lines       40600    40612      +12     
==========================================
+ Hits        30364    30370       +6     
- Misses       8163     8168       +5     
- Partials     2073     2074       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

zhaohuabing · 2026-05-28T01:50:00Z

Question on the semantics here: this change makes the same BackendTrafficPolicy timeout.http.maxStreamDuration value land in both the route action and the upstream cluster common HTTP protocol options.

Should route-scoped backend traffic rely on the route-level RouteAction.max_stream_duration instead, and leave the cluster-level commonHttpProtocolOptions.max_stream_duration unset for those generated route clusters? The route field seems to map more directly to a BackendTrafficPolicy targeting an HTTPRoute/rule, while the cluster field is backend/upstream scoped and introduces a second timer with the same value but slightly different scope.

I can see cluster-level max_stream_duration being useful for internal/non-route upstream clusters such as ALS, OTel, OIDC/JWKS, ext-auth, etc., where there is no route action to carry the timeout. Is the intent here to enforce the same value at both route and upstream-cluster level for normal routed traffic, or should this be limited to cases that do not already have a route-level max stream duration?

zirain · 2026-05-28T01:57:25Z

this's more like downstream vs upstream depends on where you specify it.
IIUC, for backendSettings it should result as part of cluster.

zhaohuabing

IMO this should only apply to non-route/internal clusters, where there is no RouteAction available to carry the timeout. For clusters generated from HTTPRoute/GRPCRoute backend traffic, we should rely on the route-level RouteAction.max_stream_duration instead. Otherwise we end up configuring two timers with the same value but different scopes: one scoped to the matched route, and one scoped to the upstream cluster.

zirain · 2026-05-28T09:11:23Z

IMO this should only apply to non-route/internal clusters, where there is no RouteAction available to carry the timeout. For clusters generated from HTTPRoute/GRPCRoute backend traffic, we should rely on the route-level RouteAction.max_stream_duration instead. Otherwise we end up configuring two timers with the same value but different scopes: one scoped to the matched route, and one scoped to the upstream cluster.

When using a BTP target to HTTPRoute, the value is same on RouteAction.max_stream_duration and the cluster.

zhaohuabing · 2026-05-28T09:18:10Z

On second thought, the cluster-level max_stream_duration is effectively a no-op when both the route-level and cluster-level are set as the same value, so this is non-blocking.

It would still be good to add a comment around the cluster-level max_stream_duration to explain what EG is doing here, and clarify that the cluster-level setting has no effect since the same value is configured at both levels.

zhaohuabing

Non-blocking: I’d prefer not to configure the cluster-level max_stream_duration for route-generated clusters, since the route-level max_stream_duration better reflects user intent.

If that’s not possible, then it would still be good to add a comment around the cluster-level max_stream_duration to explain what EG is doing here, and clarify that the cluster-level setting has no effect because the same value is configured at both levels.

zirain · 2026-05-28T16:08:33Z

Updated to work for non-route cluster only.

zhaohuabing · 2026-05-29T03:56:12Z

several non-route cluster callsites are not flagged. nonRouteCluster: true is only set in accesslog.go, tracing.go, and oidc.go (token
endpoint). These other constructors also build non-route clusters and accept a traffic parameter, so MaxStreamDuration will still be silently dropped:

createExtServiceXDSCluster (internal/xds/translator/utils.go:156) — used by ExtAuth, ExtProc, JWT, and the OIDC provider backend (extauth.go:268,277,
extproc.go:185, jwt.go:326, oidc.go:422).
addClusterFromURL (internal/xds/translator/utils.go:190) — used by JWT JWKS URI (jwt.go:335) and DynamicModule remote (dynamicmodule.go:182)

zhaohuabing · 2026-05-29T03:58:29Z

 	unstructuredRefs  []*unstructured.Unstructured
 	extensionMgr      *extensionTypes.Manager
 	logger            logging.Logger
+	nonRouteCluster   bool


Non-blocking nit: Can we flip the flag name to isRoute? It sounds more natural.

Signed-off-by: zirain <[email protected]>

zirain · 2026-05-29T04:56:09Z

        - host: "1.2.3.4"
          port: 50000
        name: "direct-route-dest/backend/0"
+    traffic:


this's a route cluster, which result only maxConnectionDuration to be setted.

arkodg

LGTM thanks

zhaohuabing

LGTM. Thanks!

* fix: restore last transition time in merge status conditions (#8962) * fix: restore last transition time in merge status conditions Signed-off-by: Rudrakh Panigrahi <[email protected]> * add release note Signed-off-by: Rudrakh Panigrahi <[email protected]> --------- Signed-off-by: Rudrakh Panigrahi <[email protected]> (cherry picked from commit 9430ab9) Signed-off-by: jukie <[email protected]> * fix: applyBackendTLSSetting panic (#8998) * fix: applyBackendTLSSetting panic Signed-off-by: zirain <[email protected]> (cherry picked from commit b754b68) Signed-off-by: jukie <[email protected]> * fix(xds): hot-reload xDS server cert in GatewayNamespaceMode (#8959) * fix(xds): hot-reload xDS server cert in GatewayNamespaceMode Signed-off-by: nguyenptk <[email protected]> * extract loadServerTLSConfig helper and add tests Signed-off-by: nguyenptk <[email protected]> --------- Signed-off-by: nguyenptk <[email protected]> Signed-off-by: Nguyên (Harry) <[email protected]> (cherry picked from commit 35c5a12) Signed-off-by: jukie <[email protected]> * fix(helm): correct typo in HPA maxReplicas required message (#9032) Signed-off-by: benjaminch <[email protected]> (cherry picked from commit 8da6dc7) Signed-off-by: jukie <[email protected]> * fix: allow IANA cipher names (#9073) allow IANA cipher names Signed-off-by: Huabing Zhao <[email protected]> (cherry picked from commit ea41d6f) Signed-off-by: jukie <[email protected]> * fix(gatewayapi): prefer sectioned BackendTLSPolicy over wildcard for same target (#9068) * add passing testcase showing wildcard overriding sectioned backendTLSPolicy Signed-off-by: AlecDiraimondo <[email protected]> * fix(gatewayapi): prefer sectioned BackendTLSPolicy over wildcard for same target When two BackendTLSPolicies target the same backend — one with sectionName set, one without — the wildcard wins whenever it sorts earlier, since policies are iterated in creationTimestamp order with no specificity preference. The sectioned policy is silently dropped: never selected by the translator, no status written. Make getBackendTLSPolicy prefer policies with an explicit sectionName match before falling back to wildcard matches. Matches the specificity ordering SecurityPolicy already implements. Refs #9035 Signed-off-by: AlecDiraimondo <[email protected]> * update release notes Signed-off-by: AlecDiraimondo <[email protected]> * fixes from review: dedup helper, return early if backendTarget has no section specified Signed-off-by: AlecDiraimondo <[email protected]> Co-authored-by: Rudrakh Panigrahi <[email protected]> --------- Signed-off-by: AlecDiraimondo <[email protected]> Signed-off-by: Alec Diraimondo <[email protected]> Co-authored-by: Rudrakh Panigrahi <[email protected]> (cherry picked from commit 07ec95c) Signed-off-by: jukie <[email protected]> * fix: encode TLS secrets with canonical PEM formatting (#8744) * exclude non-ready https Signed-off-by: Karol Szwaj <[email protected]> * prevent BoringSSL errors Signed-off-by: Karol Szwaj <[email protected]> * Add trailing newline to testdata PEMs Signed-off-by: Karol Szwaj <[email protected]> * add release notes Signed-off-by: Karol Szwaj <[email protected]> * use shallow copy instead of DeepCopy Signed-off-by: Karol Szwaj <[email protected]> * use maps.Clone for the data and split the PRs Signed-off-by: Karol Szwaj <[email protected]> --------- Signed-off-by: Karol Szwaj <[email protected]> (cherry picked from commit 560a262) Signed-off-by: jukie <[email protected]> * fix: MaxStreamDuration should worked for non-route cluster (#9028) * fix: MaxStreamDuration should worked on commonHttpProtocolOptions Signed-off-by: zirain <[email protected]> * should only worked for non-route cluster Signed-off-by: zirain <[email protected]> * fix Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]> (cherry picked from commit 0edf51a) Signed-off-by: jukie <[email protected]> * fix(egctl): skip missing CRDs in `x status` bulk modes (#9099) `egctl x status all` (and `xroute`/`xpolicy`) aborted with an error when a Gateway API CRD was not installed in the cluster (e.g. TCPRoute). Missing CRDs are now skipped, and reported on stderr when `-v` is set. Explicit single-resource invocations still error loudly so users get a clear signal when a kind they asked for is unavailable. Signed-off-by: Jeremiah Snapp <[email protected]> (cherry picked from commit 3ab110e) Signed-off-by: jukie <[email protected]> * fix(gatewayapi): reject unsupported BackendRef URLRewrite path rewrites (#9131) gatewayapi: reject BackendRef URLRewrite path modifiers Signed-off-by: Aditya7880900936 <[email protected]> (cherry picked from commit acaf4cd) Signed-off-by: jukie <[email protected]> * fix: force HTTP1 for Service/ServiceImport with websocket appProtocol (#9138) force HTTP1 for Service/ServiceImport with websocket appProtocol Signed-off-by: Huabing Zhao <[email protected]> (cherry picked from commit b1aa5d9) Signed-off-by: jukie <[email protected]> * fix: move validation admission policy outside of crds directory (#9024) * move validation admission policy outside of crds directory Signed-off-by: Huabing Zhao <[email protected]> * fix upgrade Signed-off-by: Huabing Zhao <[email protected]> * add release note Signed-off-by: Huabing Zhao <[email protected]> * fix Signed-off-by: Huabing Zhao <[email protected]> * update docs Signed-off-by: Huabing Zhao <[email protected]> * address comment Signed-off-by: Huabing Zhao <[email protected]> * address comment Signed-off-by: Huabing Zhao <[email protected]> * address comments Signed-off-by: Huabing Zhao <[email protected]> * update relese note Signed-off-by: Huabing Zhao <[email protected]> * address comments Signed-off-by: Huabing Zhao <[email protected]> * fix gen Signed-off-by: Huabing Zhao <[email protected]> * use a more general name for this option Signed-off-by: Huabing Zhao <[email protected]> * update docs Signed-off-by: Huabing Zhao <[email protected]> * rename Signed-off-by: Huabing Zhao <[email protected]> * update test Signed-off-by: Huabing Zhao <[email protected]> * update release note Signed-off-by: Huabing Zhao <[email protected]> * fix gen Signed-off-by: Huabing Zhao <[email protected]> * rename supportingResources to safeUpgradePolicy Signed-off-by: Huabing Zhao <[email protected]> * update Signed-off-by: Huabing Zhao <[email protected]> --------- Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: zirain <[email protected]> (cherry picked from commit 35ad8f2) Signed-off-by: jukie <[email protected]> * fix: alway include the controller namespace in the watched namespaces (#9100) * always include the controller namespace in the k8s provider Signed-off-by: Huabing Zhao <[email protected]> * update docs Signed-off-by: Huabing Zhao <[email protected]> (cherry picked from commit 84be503d855e968b7b6999d476a6897e98d4e330) * address comment Signed-off-by: Huabing Zhao <[email protected]> * address comments Signed-off-by: Huabing Zhao <[email protected]> * address comments Signed-off-by: Huabing Zhao <[email protected]> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> * minor changes Signed-off-by: Huabing Zhao <[email protected]> * fix test Signed-off-by: Huabing Zhao <[email protected]> * fix lint Signed-off-by: Huabing Zhao <[email protected]> * fix test Signed-off-by: Huabing Zhao <[email protected]> * fix test Signed-off-by: Huabing Zhao <[email protected]> * fix test Signed-off-by: Huabing Zhao <[email protected]> --------- Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]> (cherry picked from commit 5266322) Signed-off-by: jukie <[email protected]> * test(helm): regenerate safe-upgrade-policy-disabled golden for release/v1.8 The safe-upgrade-policy-disabled test case added in #9024 shipped a golden rendered against main's chart templates, which include features not present on release/v1.8 (automountServiceAccountToken, expanded HPA RBAC verbs, serviceaccount securityContext, ArgoCD/Flux hook comment). Regenerate the golden against the release branch templates and restore the release-pinned ratelimit image tag (ff287602). Signed-off-by: jukie <[email protected]> * regen Signed-off-by: jukie <[email protected]> * chore: bump golang to 1.26.4 (#9147) Signed-off-by: zirain <[email protected]> Signed-off-by: jukie <[email protected]> --------- Signed-off-by: Rudrakh Panigrahi <[email protected]> Signed-off-by: jukie <[email protected]> Signed-off-by: zirain <[email protected]> Signed-off-by: nguyenptk <[email protected]> Signed-off-by: Nguyên (Harry) <[email protected]> Signed-off-by: benjaminch <[email protected]> Signed-off-by: Huabing Zhao <[email protected]> Signed-off-by: AlecDiraimondo <[email protected]> Signed-off-by: Alec Diraimondo <[email protected]> Signed-off-by: Karol Szwaj <[email protected]> Signed-off-by: Jeremiah Snapp <[email protected]> Signed-off-by: Aditya7880900936 <[email protected]> Signed-off-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: Rudrakh Panigrahi <[email protected]> Co-authored-by: zirain <[email protected]> Co-authored-by: Nguyên (Harry) <[email protected]> Co-authored-by: BenjaminCh <[email protected]> Co-authored-by: Huabing (Robin) Zhao <[email protected]> Co-authored-by: Alec Diraimondo <[email protected]> Co-authored-by: Karol Szwaj <[email protected]> Co-authored-by: Jeremiah Snapp <[email protected]> Co-authored-by: Aditya Sanskar Srivastav <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]>

…y#9028) * fix: MaxStreamDuration should worked on commonHttpProtocolOptions Signed-off-by: zirain <[email protected]> * should only worked for non-route cluster Signed-off-by: zirain <[email protected]> * fix Signed-off-by: zirain <[email protected]> --------- Signed-off-by: zirain <[email protected]>

zirain requested a review from a team as a code owner May 19, 2026 00:57

zirain added the cherrypick/release-v1.8.1 label May 19, 2026

zirain force-pushed the fix/maxStreamDuration branch from 8aaa59d to 70fa97c Compare May 28, 2026 02:00

zhaohuabing requested changes May 28, 2026

View reviewed changes

zhaohuabing approved these changes May 28, 2026

View reviewed changes

zhaohuabing previously approved these changes May 28, 2026

View reviewed changes

zirain changed the title ~~fix: MaxStreamDuration should worked on commonHttpProtocolOptions~~ fix: MaxStreamDuration should worked for non-route cluster May 28, 2026

zirain dismissed zhaohuabing’s stale review via 4ed5d66 May 28, 2026 16:07

zhaohuabing reviewed May 29, 2026

View reviewed changes

Comment thread internal/xds/translator/cluster.go

zhaohuabing reviewed May 29, 2026

View reviewed changes

zirain added 3 commits May 29, 2026 12:45

fix: MaxStreamDuration should worked on commonHttpProtocolOptions

8022915

Signed-off-by: zirain <[email protected]>

should only worked for non-route cluster

8fdc10c

Signed-off-by: zirain <[email protected]>

fix

901599b

Signed-off-by: zirain <[email protected]>

zirain force-pushed the fix/maxStreamDuration branch from 4ed5d66 to 901599b Compare May 29, 2026 04:47

zirain commented May 29, 2026

View reviewed changes

arkodg approved these changes May 29, 2026

View reviewed changes

zhaohuabing approved these changes May 29, 2026

View reviewed changes

zhaohuabing merged commit 0edf51a into envoyproxy:main May 29, 2026
85 of 91 checks passed

zirain deleted the fix/maxStreamDuration branch June 1, 2026 02:32

Uh oh!

Conversation

zirain commented May 19, 2026

Uh oh!

netlify Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

codecov Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

zhaohuabing commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zirain commented May 28, 2026

Uh oh!

zhaohuabing left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zirain commented May 28, 2026

Uh oh!

zhaohuabing commented May 28, 2026

Uh oh!

zhaohuabing left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zirain commented May 28, 2026

Uh oh!

Uh oh!

zhaohuabing commented May 29, 2026

Uh oh!

zhaohuabing May 29, 2026

Choose a reason for hiding this comment

Uh oh!

zirain May 29, 2026

Choose a reason for hiding this comment

Uh oh!

arkodg left a comment

Choose a reason for hiding this comment

Uh oh!

zhaohuabing left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify Bot commented May 19, 2026 •

edited

Loading

codecov Bot commented May 19, 2026 •

edited

Loading

zhaohuabing commented May 28, 2026 •

edited

Loading

zhaohuabing left a comment •

edited

Loading

zhaohuabing left a comment •

edited

Loading