chore: strict validation metrics and benchmarking#14026
Merged
Conversation
chandler-solo
added
the
work in progress
gateway-bot
added
do-not-merge/release-note-invalid
|
This pull request has been marked as stale because of no activity in the last 30 days. It will be closed in the next 5 days unless it is tagged "no stalebot" or other activity occurs. |
github-actions
Bot
added
the
stale
chandler-solo
force-pushed
the
chandler/14009guess
branch
from
June 15, 2026 16:01
9ce74f3 to
3887cd9
Compare
Signed-off-by: David L. Chandler <[email protected]>
Signed-off-by: David L. Chandler <[email protected]>
Signed-off-by: David L. Chandler <[email protected]>
Changed: - Added cached validator wrapper with LRU caching and validation metrics in pkg/validator/cache.go and pkg/validator/metrics.go. - Wrapped the default setup validator with the cache in setup.go. - Added in-process generated matcher validation and kept Envoy matcher-only validation as fallback in validate.go. - Added caller labels for backend, route, traffic policy, and backend config policy validation. - Added load-test validation metric scraping/logging around incremental route readiness. - Added unit coverage for validator caching and matcher validation. Signed-off-by: David L. Chandler <[email protected]>
Signed-off-by: David L. Chandler <[email protected]>
Signed-off-by: David L. Chandler <[email protected]>
chandler-solo
force-pushed
the
chandler/14009guess
branch
from
June 15, 2026 19:22
04cee5d to
2cca9fa
Compare
gateway-bot
added
kind/feature
Signed-off-by: David L. Chandler <[email protected]>
Signed-off-by: David L. Chandler <[email protected]>
Signed-off-by: David L. Chandler <[email protected]>
chandler-solo
marked this pull request as ready for review
June 15, 2026 21:43
chandler-solo
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds instrumentation and benchmarking around strict validation to attribute Envoy validation work by caller/result and to improve performance by short-circuiting common generated matcher checks before invoking Envoy validation. It also extends the e2e load-test framework to collect and report these validation metrics, and introduces a controller rollout startup benchmark.
Changes:
- Added validator metrics (calls, cache hits/misses, results, duration) labeled by validation caller and result.
- Added generated-matcher prechecks for strict route validation, with fallback to matcher-only Envoy validation when needed.
- Extended load-testing to restart the controller after baseline setup, collect validation metrics deltas, and added a standalone startup benchmark suite/test plus CI wiring.
Reviewed changes
Copilot reviewed 16 out of 16 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| test/e2e/tests/startup_benchmark_test.go | Adds a dedicated e2e test entrypoint for the startup benchmark. |
| test/e2e/tests/kgateway_tests.go | Registers the startup benchmark suite in the main e2e runner. |
| test/e2e/features/loadtesting/types.go | Extends load-test result schema to include restart/translation timing and validation metrics snapshots/deltas. |
| test/e2e/features/loadtesting/startup_suite.go | Implements controller rollout restart/startup measurement and diagnostics collection. |
| test/e2e/features/loadtesting/README.md | Documents the new startup benchmark and validation-mode load-test runs. |
| test/e2e/features/loadtesting/loadtest_manager.go | Adds Prometheus scraping/parsing to collect kgateway validation metrics. |
| test/e2e/features/loadtesting/attachedroutes_suite.go | Restarts controller post-baseline, captures validation metrics before/after incremental route, and logs deltas. |
| pkg/validator/metrics.go | Introduces Prometheus metrics for validation calls/cache/results/duration with caller/result labels. |
| pkg/validator/cache.go | Records validation metrics for cache hits/misses and outcomes/durations. |
| pkg/kgateway/translator/irtranslator/validate.go | Adds strict-mode generated matcher prechecks and sets validation caller contexts for route validation. |
| pkg/kgateway/translator/irtranslator/route_test.go | Adds unit tests covering matcher prechecks (skip Envoy matcher-only when safe; reject invalid generated regex early). |
| pkg/kgateway/translator/irtranslator/backend.go | Tags backend validation calls with a caller label. |
| pkg/kgateway/extensions2/plugins/trafficpolicy/validate.go | Tags traffic policy validation calls with a caller label. |
| pkg/kgateway/extensions2/plugins/backendconfigpolicy/validate.go | Tags backend config policy validation calls with a caller label. |
| Makefile | Adds load-test knobs for validation mode and go test args/timeouts. |
| .github/actions/kube-gateway-api-load-tests/action.yaml | Runs load tests in both standard and strict validation modes in CI. |
Comment on lines
+107
to
+111
| func (m ValidationMetrics) Delta(base ValidationMetrics) ValidationMetrics { | ||
| out := ValidationMetrics{ | ||
| Calls: m.Calls - base.Calls, | ||
| CacheHits: m.CacheHits - base.CacheHits, | ||
| CacheMisses: m.CacheMisses - base.CacheMisses, |
Signed-off-by: David L. Chandler <[email protected]>
parts of it if necessary. with caching this complexity is not worth the cost, I'm pretty sure. Signed-off-by: David L. Chandler <[email protected]>
chandler-solo
changed the title
under load Signed-off-by: David L. Chandler <[email protected]>
chandler-solo
changed the title
chandler-solo
removed
the
work in progress
Signed-off-by: David L. Chandler <[email protected]>
github-actions
Bot
removed
the
stale
…' into chandler/14009guess
andy-fong
approved these changes
Jun 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR builds on the strict-validation cache work from #14253.
It adds kgateway validation metrics so Envoy validation work can be attributed by caller (
route_full,route_matcher,backend,traffic_policy,backend_config_policy) and result. The exported metrics include validation calls, cache hits/misses, valid/invalid-xDS results, invocation errors, and validation duration.It also extends the load-test framework to collect validation metrics, run attached-route load tests in both standard and strict validation modes, and add a startup benchmark suite for controller rollout timing.
Change Type
/kind feature
/kind cleanup
Changelog
Additional Notes