Found new managed modules references by app-token-modules[bot] · Pull Request #1325 · bufbuild/modules

app-token-modules · 2026-10-14T12:13:40Z

No description provided.

github-actions · 2026-10-14T12:14:16Z

+    },
+    {
+      "name": "v1.40.0",
+      "digest": "4e9945ad5f8ebf9edf2a98ba2149b631047a678d5c4fe12813db6816a193d3dcde59704d7fa4112cc93cc0ae20a2cc8bb8d2d2bdf06c1b28bb4b625d1aaf075a"


[Posted at 2026-10-14T12:14:15Z]

Intermediate transition

$ casdiff v1.39.4 \ v1.40.0 \ --format=markdown

109 files changed: 1 removed, 0 renamed, 24 added, 84 changed content.

109 files changed: 1 removed, 0 renamed, 24 added, 84 changed content.

Files removed:

- shake256:c4bb6fae7c4d5c4770a3292ade560d26a775c87b94788ebc78e9fb52cda3c3ea993d23e1b90be3a6bb796aba1e9cbfe96598c4deb2e945cfa29f56af596c0bc5 contrib/envoy/extensions/network/connection_balance/dlb/v3alpha/dlb.proto

Files added:

+ shake256:ad6bd157563e3d6423d240f65e9cd854d643ace1006edf4aad7929d9c6aac05b5f0ed5f380842f3086c217380f79276edfa969ac3e5e502d88fdcb42c6dd82fa contrib/envoy/extensions/filters/http/client_cert/v3alpha/client_cert.proto + shake256:15c949253033d1f64fae17d8ffc0d53511fa6b0eabe3a45986b017594f32590c1c2b8945d0c74af543d3aec676a11ffd8788d469b18380c1d93e1d84c997f21f contrib/envoy/extensions/load_balancing_policies/per_worker_subset/v3alpha/per_worker_subset.proto + shake256:dbe663dfcfd0c76b1ce3e25e5e3fb44cad6c8c9b3dc91e1e3ef7e16f5f68eb1c107fc7929ff0ba385704a3fe2ef50cb130235493463ca91094813e831de30d89 envoy/data/ai/v3/request_info.proto + shake256:ebd2cbaece394e9f426b8b40c0e8394f607926395b48af0f7c4729e83d401d6b05cb4170a2b27af730704e17dcf018e6148f1404634c444a9f0b45527fb53c02 envoy/data/ai/v3/token_usage.proto + shake256:46355b26af4e644f11953163f73f60b008af9016214806e263636b9cfe9355a7e4476f3892ff5cbe7ff4f63de4a39c78f0fe36831be74da87fb6470585105b37 envoy/extensions/config/validators/dynamic_modules/v3/dynamic_modules.proto + shake256:96159f447b11ba1cb7714a394691f6b296ecb1dd5a152290d8f63d5a95a169debb3bb7a426a8b2c2d5048c64df212c9dd65840cee0c0f0f9e83d162f22fba15d envoy/extensions/filters/common/jwks/v3/jwks.proto + shake256:43739fbb908ba7e84eff67712f401ddc33bf468287f93d582247803a5c006a315be85476393c5207f05ab70d4d2c9ae6559ab2c37859b74bf6eae0c4bfc735e5 envoy/extensions/filters/common/jwks/v3/jwt_handshake.proto + shake256:b5477dfb0d32381ab02e26eb2ff4a9a1f99e01599f1cfe39d72f195a8f3570afad60ace573dfd0fb68b0719a4c872ec072e6d849f9fa783435e6927cdb2f95e0 envoy/extensions/filters/http/aws_eventstream_parser/v3/aws_eventstream_parser.proto + shake256:ac67a15e46d5a95c672d5692e0ab1aabfc758982b3c2122bbf2c5c7fcede980963690512051adbf9f8ea10cf31833b322b59f91da46520fa94699b1329312f51 envoy/extensions/filters/http/body_size_limit/v3/body_size_limit.proto + shake256:ed2b6a76c3a187e8fd6cae370d0e0a787eec1d4dd807e2e13c170dc2635fd149848cc080915dbe5ffe528aea043cd97efebff4cc691f99bfb3c1aa81b3da3066 envoy/extensions/health_checkers/udp/v3/udp.proto + shake256:1cb3ae86b15ae10d4d2c3c77435928b9045e591d89911b9e9ba6036a0d4168903ceff104d31f4227306495990f38fbb599b8eab0fcd14ac9f9ddbca40e4cb452 envoy/extensions/http/ai_filters/request_info/v3/request_info.proto + shake256:efb8ed39a57b9e43f6bccdb2ba69ac487f4ca21e429d3ee18923735b02fa24373c7ddfa0c54c36121a32f857009e7224623e4397901f2ba732bec021a5f85f63 envoy/extensions/http/ai_filters/schema_validation/v3/schema_validation.proto + shake256:abb4aa6b05d3254ac7b504949e4a35869e6e7b4f179bf99a3c9c99c02d3abd09271999d73606cd35b752dacef15d7ff9c238e4c34ae29e768e322dddfd2b6c30 envoy/extensions/http/ai_filters/transcoder/v3/transcoder.proto + shake256:3fce8ee954a7306c1e9a2c1677cd9d2f41d394195e46eb905de6a15cef7af99f8ba98a17183c1a9292e67a06e4333031c7f8259f77584dd2a34fd371a88a565e envoy/extensions/http/early_header_mutation/dynamic_modules/v3/dynamic_modules.proto + shake256:15603a2e7434422fedf63e85f2c2476e8990b38abaa85ca316216a0177dcaf3ab60481c0d312615bb7e24f0d333e508e42f2e387df060bc247aa0afc00f01857 envoy/extensions/http/header_formatters/dynamic_modules/v3/dynamic_modules.proto + shake256:a981530941912b70abd63742ea0233867d9f8d8b82cff5c37abebbbdb10b21dd3991551fa21eeea1156d73c6cb8e4fc8db3186a620798942cfe59c043b93f986 envoy/extensions/internal_redirect/filter_state/v3/filter_state_config.proto + shake256:9d8dd4e7df146f83d4a9605fe559bbeff256984607cafc46f468c1b226deaf8c93d0dccc4020b3dc6d10c7eac2c409130d2283da044e87b9fcfef706b58507f6 envoy/extensions/queue_policy/fifo/v3/fifo.proto + shake256:697ee83d1cbe18b6c803d53ccc7161b52abd0362079be6744fc2fa5d5bc8c6db3d06c76d009d3da91a1d3a8025a9811d30282a8dfaf50fc23b6cfd5e104ae7ec envoy/extensions/rate_limit_descriptors/jwt_claim/v3/jwt_claim.proto + shake256:57a0131334ad804039fabd14a613f7da33d577319612e3d1fe920f1ffe46bbedfdd8ff7b1c57394e1393e8a6b4acc5508a570cafdddf72067303154f09487f45 envoy/extensions/router/cluster_specifiers/dynamic_modules/v3/dynamic_modules.proto + shake256:c5fd77fd6b35a56306fbd1f9ba9381a940f3d5ed2c6046e2f4ebd4ee5bc2403a39616e299ea51a73a3dfd46d329b89cff851e849b31c41db1161b9a755348b93 envoy/extensions/router/cluster_specifiers/priority_group/v3/priority_group.proto + shake256:7218e21f8ca32a4ffd9ba9412c292991f1e79673548070eceb807f2d5fb7c07ad2d88f23cce6dc9cc2859751d1401fc9df818185b9e1b7d8a1b4c98156d54b6f envoy/extensions/router/route_specifiers/dynamic_modules/v3/dynamic_modules.proto + shake256:7a1088075988f4f4955218bbe749da201b1092c5e2f38d3d595d2196f4b36052bf68adb90da1ece5aadd3a17e75b8c5dd3d6396918248bb65d37e1eb4cbfd604 envoy/extensions/transport_sockets/tls/handshakers/dynamic_modules/v3/dynamic_modules.proto + shake256:f91b5c852f8deb71d90543d4713082f71f5ebb19b3d8101deea71513ccecd4b19012049f8f8ca3f4c643e326a44ac0853e872bbe54e31d9289ab563b8a32ce4c envoy/extensions/watchdog/backtrace_action/v3/backtrace_action.proto + shake256:c30825cda00b1ad243a8c464c586bc2cf4dcaaa39da6603372e44ace30b5ecc2e4851c3d1254a7411ca4e2cf9bc5842d7cb3dac42477895f561d3e061e9c5ab4 envoy/type/ai/v3/llm_protocol.proto

Files changed content:

contrib/envoy/extensions/filters/http/sxg/v3alpha/sxg.proto:

--- shake256:75bebf5cdb07a03584c0367cb291bf599154285a0c28bc56d4190b90fd0ff0734d57a3ef0a8bf88005abd9202cceb47df0c13a0dcbc9af3665513e4e4c96aada contrib/envoy/extensions/filters/http/sxg/v3alpha/sxg.proto +++ shake256:e46c4c2c153ea77879a711607b75b949303727fd9c3227897c112a4eab5572a68e0c1c7f3b281d842de83110bcb2c8450f0041d1ba54889992744ec913d42c6a contrib/envoy/extensions/filters/http/sxg/v3alpha/sxg.proto @@ -37,7 +37,8 @@ // Javascript, 1 day (so, with backdated expiry, 2 days, or 172800 seconds) is more appropriate. google.protobuf.Duration duration = 3; - // The SXG response payload is Merkle Integrity Content Encoding (MICE) encoded (specification is [here](https://datatracker.ietf.org/doc/html/draft-thomson-http-mice-03)) + // The SXG response payload is `Merkle Integrity Content Encoding (MICE) encoded + // <https://datatracker.ietf.org/doc/html/draft-thomson-http-mice-03>`_. // This value indicates the record size in the encoded payload. The default value is 4096. uint64 mi_record_size = 4; @@ -45,7 +46,8 @@ // be served from the same domain as the SXG document, this should be a relative URI. string cbor_url = 5 [(validate.rules).string = {min_len: 1 prefix: "/"}]; - // URL to retrieve validity data for signature, a CBOR map. See specification [here](https://tools.ietf.org/html/draft-yasskin-httpbis-origin-signed-exchanges-impl-00#section-3.6) + // URL to retrieve validity data for signature, a CBOR map. See specification + // `here <https://tools.ietf.org/html/draft-yasskin-httpbis-origin-signed-exchanges-impl-00#section-3.6>`_ string validity_url = 6 [(validate.rules).string = {min_len: 1 prefix: "/"}]; // Header that will be set if it is determined that the client can accept SXG (typically ``accept: application/signed-exchange;v=b3``)

envoy/admin/v3/memory.proto:

--- shake256:4cea80b96515e73ed166ffb074490e388706151c316a6281d580cad1b94c25c2f2fad927bd57061193640a791bfdb17936a60bca6e44a7332685a143f7eb2f12 envoy/admin/v3/memory.proto +++ shake256:3b5d20207b95fb25ba7b567fd93e7799aaed33eab2da87ba1bb54febb0a8d657f3b5dcd09032adf1e7ff846fde53cef6deac8eb166a424dd9bead7069d4f53ba envoy/admin/v3/memory.proto @@ -15,7 +15,7 @@ // Proto representation of the internal memory consumption of an Envoy instance. These represent // values extracted from an internal TCMalloc instance. For more information, see the section of the -// docs entitled ["Generic Tcmalloc Status"](https://gperftools.github.io/gperftools/tcmalloc.html). +// docs entitled `"Generic Tcmalloc Status" <https://gperftools.github.io/gperftools/tcmalloc.html>`_. // [#next-free-field: 7] message Memory { option (udpa.annotations.versioning).previous_message_type = "envoy.admin.v2alpha.Memory";

envoy/admin/v3/mutex_stats.proto:

--- shake256:7d878df1ba81097b3bd150127d366a41db794cd7243a03e0b233c563044e15b5d0f74565d5f9408efff46de7dfb7c3b0a5842cb02882758acbc15323fcb46ceb envoy/admin/v3/mutex_stats.proto +++ shake256:e492a9f4579ddc0ad028b42e50c646fbca0fbd68d1bfcf621c04ec1cd1ba30bd7b0f0e8f24d6e7e6179d328ceccfd82cfeee61fb4bc91f4f6aec79a605fa4d40 envoy/admin/v3/mutex_stats.proto @@ -15,11 +15,11 @@ // Proto representation of the statistics collected upon absl::Mutex contention, if Envoy is run // under :option:`--enable-mutex-tracing`. For more information, see the ``absl::Mutex`` -// [docs](https://abseil.io/about/design/mutex#extra-features). +// `docs <https://abseil.io/about/design/mutex#extra-features>`__. // // *NB*: The wait cycles below are measured by ``absl::base_internal::CycleClock``, and may not // correspond to core clock frequency. For more information, see the ``CycleClock`` -// [docs](https://github.com/abseil/abseil-cpp/blob/master/absl/base/internal/cycleclock.h). +// `docs <https://github.com/abseil/abseil-cpp/blob/master/absl/base/internal/cycleclock.h>`__. message MutexStats { option (udpa.annotations.versioning).previous_message_type = "envoy.admin.v2alpha.MutexStats";

envoy/config/bootstrap/v3/bootstrap.proto:

--- shake256:c924c48805142874035bca256676bbe44f3cc4b100cb95399e38b7a66941264250981e2c44b4f94fcc10ad054dc5301909f0cdd5cc8e1620e7ab5c27fad12585 envoy/config/bootstrap/v3/bootstrap.proto +++ shake256:24dc50c4d6a191e16a5900c34cddb4d7d0409709c5b8a717da9b9eff7451365435e0b56da197dd084f4411d0460f7365bc255d0e622da1c6274e80a7e1de8126 envoy/config/bootstrap/v3/bootstrap.proto @@ -431,7 +431,8 @@ GrpcAsyncClientManagerConfig grpc_async_client_manager_config = 40; // Optional configuration for memory allocation manager. - // Memory releasing is only supported for `tcmalloc allocator <https://github.com/google/tcmalloc>`_. + // Memory releasing is supported with `tcmalloc <https://github.com/google/tcmalloc>`_ and + // `gperftools <https://github.com/gperftools/gperftools>`_. MemoryAllocatorManager memory_allocator_manager = 41; // When enabled, Envoy pins each worker thread to a distinct CPU from the process affinity mask, @@ -790,13 +791,14 @@ // [#next-free-field: 6] message MemoryAllocatorManager { - // Configures tcmalloc to perform background release of free memory in amount of bytes per ``memory_release_interval`` interval. - // If equals to ``0``, no memory release will occur. Defaults to ``0``. + // Configures tcmalloc to perform background release of free memory in amount of bytes per + // ``memory_release_interval`` interval. If equals to ``0``, no memory release will occur. + // Defaults to ``0``. uint64 bytes_to_release = 1; - // Interval in milliseconds for memory releasing. If specified, during every - // interval Envoy will try to release ``bytes_to_release`` of free memory back to operating system for reuse. - // Defaults to ``1000`` milliseconds. + // Interval in milliseconds for memory releasing. If specified, during every interval Envoy will + // try to release ``bytes_to_release`` of free memory back to operating system for reuse. If set + // to ``0``, no memory release will occur. Defaults to ``1000`` milliseconds. google.protobuf.Duration memory_release_interval = 2; // Sets the soft memory limit for tcmalloc. When the total memory used by tcmalloc exceeds this

envoy/config/cluster/v3/cluster.proto:

--- shake256:0e352afb4c3b6c449be91cfe0715f0daa54a7ae8c65ee7babb294f50f5dc8df268cc44d1e516198c3f635bf47a0349565bdd5e3b95ecff34c67e65f3c22fce0e envoy/config/cluster/v3/cluster.proto +++ shake256:37da7ed59f40a587cafd0726db8a894ff61a65bf604e2473b134eb33acec205c57602232ef3fd8e566ca031ee4decf0cc056d96d895ee992f7d77c154c747892 envoy/config/cluster/v3/cluster.proto @@ -13,6 +13,8 @@ import "envoy/config/core/v3/protocol.proto"; import "envoy/config/core/v3/resolver.proto"; import "envoy/config/endpoint/v3/endpoint.proto"; +import "envoy/config/metrics/v3/stats.proto"; +import "envoy/type/matcher/v3/metadata.proto"; import "envoy/type/metadata/v3/metadata.proto"; import "envoy/type/v3/percent.proto"; @@ -46,7 +48,7 @@ } // Configuration for a single upstream cluster. -// [#next-free-field: 61] +// [#next-free-field: 63] message Cluster { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.Cluster"; @@ -753,6 +755,18 @@ // harm latency more than the preconnecting helps. google.protobuf.DoubleValue predictive_preconnect_ratio = 2 [(validate.rules).double = {lte: 3.0 gte: 1.0}]; + + // Restricts anticipatory connections to hosts whose endpoint metadata matches this matcher. + // Non-matching hosts are never preconnected, and instead get connections only on demand, as they + // serve real requests. If unset, all healthy hosts are eligible. + type.matcher.v3.MetadataMatcher preconnect_enabled_metadata = 3; + } + + // Queueing policies for the cluster. + message QueuingPolicies { + // Queue policy for cluster pending requests. If unset, Envoy uses the FIFO queue policy. + // [#extension-category: envoy.queue_policy] + core.v3.TypedExtensionConfig pending_rq_policy = 1; } reserved 12, 15, 7, 11, 35; @@ -866,6 +880,12 @@ // :ref:`Router Filter Header <config_http_filters_router_x-envoy-upstream-alt-stat-name>`. string alt_stat_name = 28 [(udpa.annotations.field_migrate).rename = "observability_name"]; + // Optional stats matcher that can be used to configure which stats are instantiated for this + // cluster. If configured, this overrides the bootstrap :ref:`stats_config + // <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.stats_config>` stats matcher configuration + // for this cluster. + metrics.v3.StatsMatcher stats_matcher = 61; + oneof cluster_discovery_type { // The :ref:`service discovery type <arch_overview_service_discovery_types>` // to use for resolving the cluster. @@ -914,7 +934,7 @@ // configuration for the cluster. If no // configuration is specified no health checking will be done and all cluster // members will be considered healthy at all times. - repeated core.v3.HealthCheck health_checks = 8; + repeated core.v3.HealthCheck health_checks = 8 [(validate.rules).repeated = {max_items: 8}]; // Optional maximum requests for a single upstream connection. This parameter // is respected by both the HTTP/1.1 and HTTP/2 connection pool @@ -1303,6 +1323,9 @@ // If ``connection_pool_per_downstream_connection`` is true, the cluster will use a separate // connection pool for every downstream connection bool connection_pool_per_downstream_connection = 51; + + // Queueing policies for the cluster (e.g. the queue policy for cluster pending requests). + QueuingPolicies queuing_policies = 62; } // Extensible load balancing policy configuration.

envoy/config/core/v3/address.proto:

--- shake256:f1c646aaa5ac13d22d3932210e1be33fc0af578674c8730aafe1dc375b5d44b2f20feae205bc597d7170bfabdca39a802fd0ad7094547267d86489739cd0fb0f envoy/config/core/v3/address.proto +++ shake256:dc3026fe73281be8f49653a477fd117922659cc75d2387f07dcebb4e9e79962ed2cfe12a779fcce4f341ed114c04964d6f6512a4168dab457bba08a44d1127b9 envoy/config/core/v3/address.proto @@ -103,7 +103,7 @@ // network namespace. // // .. note:: - // Setting this parameter requires Envoy to run with the ``CAP_NET_ADMIN`` capability. + // Setting this parameter requires Envoy to run with the ``CAP_SYS_ADMIN`` capability. // // .. attention:: // Network namespaces are only configurable on Linux. Otherwise, this field has no effect. @@ -144,7 +144,7 @@ SocketOptionsOverride socket_options = 2; } -// [#next-free-field: 7] +// [#next-free-field: 8] message BindConfig { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.BindConfig"; @@ -180,6 +180,24 @@ // <envoy_v3_api_msg_config.upstream.local_address_selector.v3.DefaultLocalAddressSelector>`). // [#extension-category: envoy.upstream.local_address_selector] TypedExtensionConfig local_address_selector = 6; + + // If set to true, the :ref:`network_namespace_filepath + // <envoy_v3_api_field_config.core.v3.SocketAddress.network_namespace_filepath>` of every source + // address in this bind config is validated when the configuration is loaded, and the + // configuration is rejected if a referenced network namespace cannot be opened. + // + // By default no such validation is performed: a network namespace that does not exist when the + // configuration is loaded may be created later, before connections are actually established, so + // eager validation would wrongly reject such configurations. If a namespace is unavailable when + // a connection is created, the connection attempt fails gracefully. + // + // Listener addresses do not need an equivalent option: a listener creates and binds its socket + // in the configured network namespace when the listener configuration is loaded, so an + // unavailable namespace always rejects the listener configuration. + // + // .. attention:: + // Network namespaces are only configurable on Linux. Otherwise, this field has no effect. + bool validate_network_namespaces = 7; } // Addresses specify either a logical or physical address and port, which are

envoy/config/core/v3/base.proto:

--- shake256:7c1daeba42d5b6f8bebe7b0a73688653a9833dece0690015566641da0894361405e5cc995807357a411231ca03efb7d8b45f7266bb2e70a65979707ec5895ada envoy/config/core/v3/base.proto +++ shake256:40fbed94190d48e57183cbfad8be7c2ad62220cf3832469320a5fd8452899f084db63ef0da48859d0c2a69aabe2cf7e9b41782d855e66f74c814cbd87c5f38a1 envoy/config/core/v3/base.proto @@ -486,6 +486,11 @@ // Is the header value allowed to be empty? If false (default), custom headers with empty values are dropped, // otherwise they are added. + // + // .. note:: + // In any context other than the router filter, we always act as if keep_empty_value is true, + // regardless of the setting of this field. + // bool keep_empty_value = 4; }

envoy/config/core/v3/config_source.proto:

--- shake256:f3cb7e88d65a8b2d19c1255815c37f61b708887327f5b3a58fe5b6bf8c0c1607d12b7bcabf156947db5c9108c041599af9f6a25ac22d0225326cc1c4418a343d envoy/config/core/v3/config_source.proto +++ shake256:08a48e484d19ccab2d4169ce5191e666f0eb3cf37656ea19c22e94a1c4764d7928df1ff4f530f2ef7aacfbe26d40234c1f4ba8ff38d9166f683a9af6c5656af1 envoy/config/core/v3/config_source.proto @@ -157,9 +157,10 @@ // Local filesystem path configuration source. message PathConfigSource { - // Path on the filesystem to source and watch for configuration updates. - // When sourcing configuration for a :ref:`secret <envoy_v3_api_msg_extensions.transport_sockets.tls.v3.Secret>`, - // the certificate and key files are also watched for updates. + // Path on the filesystem from which to source configuration updates. + // When sourcing configuration for a + // :ref:`secret <envoy_v3_api_msg_extensions.transport_sockets.tls.v3.Secret>`, file-based secret + // data supported for SDS rotation is also monitored for updates. // // .. note:: // @@ -167,12 +168,14 @@ // // .. note:: // - // If ``watched_directory`` is *not* configured, Envoy will watch the file path for *moves*. - // This is because in general only moves are atomic. The same method of swapping files as is - // demonstrated in the :ref:`runtime documentation <config_runtime_symbolic_link_swap>` can be - // used here also. If ``watched_directory`` is configured, no watch will be placed directly on - // this path. Instead, the configured ``watched_directory`` will be used to trigger reloads of - // this path. This is required in certain deployment scenarios. See below for more information. + // If neither ``poll_interval`` nor ``watched_directory`` is configured, Envoy will watch the + // file path for *moves*. This is because in general only moves are atomic. The same method of + // swapping files as is demonstrated in the + // :ref:`runtime documentation <config_runtime_symbolic_link_swap>` can be used here also. + // One of ``poll_interval`` and ``watched_directory`` can also be configured; the configuration + // is rejected if both are set. With ``poll_interval``, the same path is reloaded periodically. + // With ``watched_directory``, no watch is placed directly on this path; events in the + // configured directory trigger this path to be reloaded. string path = 1 [(validate.rules).string = {min_len: 1}]; // If configured, this directory will be watched for *moves*. When an entry in this directory is @@ -188,7 +191,24 @@ // // The above configuration will ensure that Envoy watches the owning directory for moves which is // required due to how Kubernetes manages ConfigMap symbolic links during atomic updates. + // + // This field cannot be used together with ``poll_interval``. WatchedDirectory watched_directory = 2; + + // If configured, the ``path`` will be polled at this interval instead of watched for filesystem + // events on either the file or ``watched_directory``. This is useful when the underlying + // filesystem does not reliably provide change notifications, or when a custom deployment model + // does not generate the move or modification events handled by watching the path or directory. + // The file is read on every poll, but an update is delivered only when its parsed contents + // change. + // + // When this configuration source provides a + // :ref:`Secret <envoy_v3_api_msg_extensions.transport_sockets.tls.v3.Secret>`, the same secret + // files that are watched in event-based mode are polled at this interval. The last successfully + // loaded configuration or secret remains active when a poll fails. + // + // This field cannot be used together with ``watched_directory`` and must be at least 1ms. + google.protobuf.Duration poll_interval = 3 [(validate.rules).duration = {gte {nanos: 1000000}}]; } // Configuration for :ref:`listeners <config_listeners>`, :ref:`clusters

envoy/config/core/v3/health_check.proto:

--- shake256:6a4880727a18c76c27422fb04451cb0c08cb6acc712b2ba3b3a68c81cb00feb401d2d4f8d666cbaaa787331838d3b8b8a9cf3a0ec609f9cb00c9f97574edae2a envoy/config/core/v3/health_check.proto +++ shake256:cda524b2a1908462490b81541b602147412724271fcf51e250dd525866ff0365cf20a893d6b4aa94b32843764f574e93cfa05b1e1ff823a6c5270d3446a195ba envoy/config/core/v3/health_check.proto @@ -63,7 +63,7 @@ [(validate.rules).repeated = {items {enum {defined_only: true}}}]; } -// [#next-free-field: 27] +// [#next-free-field: 28] message HealthCheck { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.HealthCheck"; @@ -83,7 +83,7 @@ } } - // [#next-free-field: 15] + // [#next-free-field: 16] message HttpHealthCheck { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.HealthCheck.HttpHealthCheck"; @@ -152,9 +152,24 @@ // non-200 response will result in the host being marked unhealthy. repeated type.v3.Int64Range retriable_statuses = 12; - // Use specified application protocol for health checks. + // Use specified application protocol for health checks. With :ref:`use_alpn_protocol + // <envoy_v3_api_field_config.core.v3.HealthCheck.HttpHealthCheck.use_alpn_protocol>` this is + // the codec used when ALPN settles on neither ``h2`` nor ``http/1.1``. type.v3.CodecClientType codec_client_type = 10 [(validate.rules).enum = {defined_only: true}]; + // Select the codec from the protocol negotiated by ALPN on the health check connection: HTTP/2 + // when ``h2`` is negotiated, HTTP/1.1 when ``http/1.1`` is negotiated, and otherwise + // ``codec_client_type``, including when nothing is negotiated. With ``codec_client_type`` at + // its default this is the same mapping as the cluster's :ref:`auto_config + // <envoy_v3_api_field_extensions.upstreams.http.v3.HttpProtocolOptions.auto_config>`. Like + // ``auto_config``, it requires a transport socket that supports ALPN such as TLS and is + // rejected on a cluster whose transport sockets do not, unless the + // ``config.do_not_validate_alpn_support`` runtime key is set, as for ``auto_config``. It + // cannot be combined with ``codec_client_type`` ``HTTP3``. See :ref:`tls_options + // <envoy_v3_api_field_config.core.v3.HealthCheck.tls_options>` for what the connection + // advertises. + bool use_alpn_protocol = 15; + // An optional service name parameter which is used to validate the identity of // the health checked cluster using a :ref:`StringMatcher // <envoy_v3_api_msg_type.matcher.v3.StringMatcher>`. See the :ref:`architecture overview @@ -260,12 +275,21 @@ // Specifies the ALPN protocols for health check connections. This is useful if the // corresponding upstream is using ALPN-based :ref:`FilterChainMatch // <envoy_v3_api_msg_config.listener.v3.FilterChainMatch>` along with different protocols for health checks - // versus data connections. If empty, no ALPN protocols will be set on health check connections. + // versus data connections. If empty, health check connections advertise the ALPN protocols of + // the cluster's TLS context, if any. With :ref:`use_alpn_protocol + // <envoy_v3_api_field_config.core.v3.HealthCheck.HttpHealthCheck.use_alpn_protocol>`, + // the negotiated protocol selects the health check codec. repeated string alpn_protocols = 1; } reserved 10; + // Optional name for this health checker. When set, per-checker stats are emitted under + // ``health_check.name.<name>.<stat>`` instead of ``health_check.<stat>``. + // + // This is required if multiple health checks are configured on a cluster. + string name = 27; + // The time to wait for a health check response. If the timeout is reached the // health check attempt will be considered a failure. google.protobuf.Duration timeout = 1 [(validate.rules).duration = {

envoy/config/core/v3/proxy_protocol.proto:

--- shake256:ffd5b6efba152ae8c135ff89f8c569e21f584379f1047a3dba7e53bbcd62880dc8e0ab883ae66bd8dc69d665a58affa6a2c29dd376fc21da66b09a0194d50b59 envoy/config/core/v3/proxy_protocol.proto +++ shake256:0a7f86f42952f99273f528aed03accb6581d2034c07e9e6729bb66c4f493df1610e8ea25c8f2162cc9d9c765b8e2b0f6866a453c5b53ac0191f434acbc8b91ff envoy/config/core/v3/proxy_protocol.proto @@ -109,6 +109,7 @@ } message PerHostConfig { - // Enables per-host configuration for Proxy Protocol. + // Enables per-host configuration for Proxy Protocol. Only the static ``value`` of each + // ``TlvEntry`` is applied to host-level TLVs. The ``format_string`` field is not evaluated here. repeated TlvEntry added_tlvs = 1; }

envoy/config/core/v3/substitution_format_string.proto:

--- shake256:2ecc944e590837c4b221e72959420b145d0ef24fb8ac4534355cdb0bd6bd6c333093baf209e5d4c933a386cdec5e48e5f7c07859d329b518f937a371e92eb0bb envoy/config/core/v3/substitution_format_string.proto +++ shake256:e7b2aa046c34262556a5d6bafe6de68e303abc33b1bedb53514c3aef61660502bc60baf30d1014820e8f735de65efb7fc2af55feedf2062cee2255e1c7f9f325 envoy/config/core/v3/substitution_format_string.proto @@ -105,13 +105,11 @@ // // * for ``text_format``, the output of the empty operator is changed from ``-`` to an // empty string, so that empty values are omitted entirely. - // * for ``json_format`` the keys with null values are omitted in the output structure. - // - // .. note:: - // This option does not work perfectly with ``json_format`` as keys with ``null`` values - // will still be included in the output. See https://github.com/envoyproxy/envoy/issues/37941 - // for more details. + // * for ``json_format``, the keys with null values are omitted in the output structure. Nested + // objects whose values are all omitted are removed as well, while empty arrays are preserved. + // The root object is always emitted, so a fully empty structure is rendered as ``{}``. // + // Defaults to false. bool omit_empty_values = 3; // Specify a ``content_type`` field.

envoy/config/listener/v3/listener.proto:

--- shake256:8fcdd4fadff652872bc3cd0330cb7811e0b00b481f61ddb37957da05fdba17857f46ab83d350fe11cb88f17b8f7cf656bed0178f212496368adae23c6f6eede3 envoy/config/listener/v3/listener.proto +++ shake256:ba2b9f6a0eeead34c75bac35812ae40ec1d1784969ea691c12517bb3be61bd5b9d32dd332aa48c4b3b0507224d5fd9f4ce0dc31810942d0ee424803878155286 envoy/config/listener/v3/listener.proto @@ -11,6 +11,7 @@ import "envoy/config/listener/v3/api_listener.proto"; import "envoy/config/listener/v3/listener_components.proto"; import "envoy/config/listener/v3/udp_listener_config.proto"; +import "envoy/config/metrics/v3/stats.proto"; import "google/protobuf/duration.proto"; import "google/protobuf/wrappers.proto"; @@ -61,7 +62,7 @@ repeated xds.core.v3.CollectionEntry entries = 1; } -// [#next-free-field: 39] +// [#next-free-field: 40] message Listener { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.Listener"; @@ -137,9 +138,7 @@ // The listener will use the connection balancer according to ``type_url``. If ``type_url`` is invalid, // Envoy will not attempt to balance active connections between worker threads. - // The ``envoy.network.connection_balance`` extension category is currently empty - // because the only registered member (``envoy.network.connection_balance.dlb``) - // is disabled. See https://github.com/envoyproxy/envoy/issues/45491. + // The ``envoy.network.connection_balance`` extension category is currently empty. core.v3.TypedExtensionConfig extend_balance = 2; // If specified, the listener will steer new connections to worker threads using a kernel @@ -197,6 +196,12 @@ // ``listener.<stat_prefix>.``. string stat_prefix = 28; + // Optional stats matcher that can be used to configure which stats are instantiated for this + // listener. If configured, this overrides the bootstrap :ref:`stats_config + // <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.stats_config>` stats matcher configuration + // for this listener. + metrics.v3.StatsMatcher stats_matcher = 39; + // A list of filter chains to consider for this listener. The // :ref:`FilterChain <envoy_v3_api_msg_config.listener.v3.FilterChain>` with the most specific // :ref:`FilterChainMatch <envoy_v3_api_msg_config.listener.v3.FilterChainMatch>` criteria is used on a @@ -257,8 +262,11 @@ // The following pre-defined metadata could be used by Envoy to manipulate the listener behavior: // // * ``envoy.stats_matcher``: this metadata could be used to customize the stats emitted by the - // listener. See :ref:`well-known metadata <well_known_metadata_envoy_stats_matcher>` for more - // details. + // listener. See :ref:`well-known metadata + // <well_known_metadata_envoy_stats_matcher>` for more details. + // If :ref:`stats_matcher + // <envoy_v3_api_field_config.listener.v3.Listener.stats_matcher>` is configured, this metadata + // is ignored. The ``stats_matcher`` field should be preferred. // core.v3.Metadata metadata = 6;

envoy/config/listener/v3/quic_config.proto:

--- shake256:270a2e5b4b151c02c49ec87874d7fa8a2e2dddef86063a6fea58695044f1972043a9392d7d450a75981dccc38b43da984d68aa9a2c4530afdd9c538c095c8fd9 envoy/config/listener/v3/quic_config.proto +++ shake256:141946962e83db22b0607a516569e39151a7c8fcf202a0f5a535380b4bb16a4e6f8d4052c4fc81b98bb659b97a3ea188f5a8742d0489948e915b8cc8e6c643d6 envoy/config/listener/v3/quic_config.proto @@ -10,8 +10,6 @@ import "google/protobuf/duration.proto"; import "google/protobuf/wrappers.proto"; -import "xds/annotations/v3/status.proto"; - import "udpa/annotations/status.proto"; import "udpa/annotations/versioning.proto"; import "validate/validate.proto"; @@ -76,8 +74,7 @@ // The current QUICHE implementation will advertise only one of the preferred IPv4 and IPv6 addresses based on the address family the client initially connects with. // If not specified, Envoy will not advertise any server's preferred address. // [#extension-category: envoy.quic.server_preferred_address] - core.v3.TypedExtensionConfig server_preferred_address_config = 9 - [(xds.annotations.v3.field_status).work_in_progress = true]; + core.v3.TypedExtensionConfig server_preferred_address_config = 9; // Configure the server to send transport parameter `disable_active_migration <https://www.rfc-editor.org/rfc/rfc9000#section-18.2-4.30.1>`_. // Defaults to false (do not send this transport parameter).

envoy/config/metrics/v3/stats.proto:

--- shake256:600bf979d68f259c4c3c7c9f75d0d61641735068b506e4fdb0de466226904a3dac12f57cca2907bdaab8f08d6584608222caa9d9d192c40e9de726b0e7bfb4ea envoy/config/metrics/v3/stats.proto +++ shake256:cad99b38900a55cba98761d6c0e7bb4fdad8d2a3b0bd804c2cfbd7cae55f6f601638cf2aab40d2b5e92ca5bcda90b1f4c8f85192bdd893688f75351a66600dd2 envoy/config/metrics/v3/stats.proto @@ -362,6 +362,14 @@ // envoy.test_counter:1|c // envoy.test_timer:5|ms string prefix = 3; + + // If true, histogram samples are scaled to milliseconds according to the histogram's unit + // before being reported as timers: samples of histograms recording microseconds are divided by + // 1000 and reported as a fractional millisecond value, while histograms recording milliseconds + // or without a declared unit are reported unchanged. By default every sample is reported + // unchanged with an ``ms`` suffix regardless of the histogram's unit, so histograms recording + // microseconds are reported a factor of 1000 off. + bool scale_histogram_units_to_milliseconds = 4; } // Stats configuration proto schema for built-in ``envoy.stat_sinks.dog_statsd`` sink. @@ -369,6 +377,7 @@ // compatible tags. Tags are configurable via :ref:`StatsConfig // <envoy_v3_api_msg_config.metrics.v3.StatsConfig>`. // [#extension: envoy.stat_sinks.dog_statsd] +// [#next-free-field: 6] message DogStatsdSink { option (udpa.annotations.versioning).previous_message_type = "envoy.config.metrics.v2.DogStatsdSink"; @@ -394,6 +403,12 @@ // // Note that this value may not be respected if smaller than a single metric. google.protobuf.UInt64Value max_bytes_per_datagram = 4 [(validate.rules).uint64 = {gt: 0}]; + + // If true, histogram samples are scaled to milliseconds according to the histogram's unit + // before being reported as timers. See :ref:`StatsdSink's scale_histogram_units_to_milliseconds + // field <envoy_v3_api_field_config.metrics.v3.StatsdSink.scale_histogram_units_to_milliseconds>` + // for more details. + bool scale_histogram_units_to_milliseconds = 5; } // Stats configuration proto schema for built-in ``envoy.stat_sinks.hystrix`` sink.

envoy/config/overload/v3/overload.proto:

--- shake256:d1956a9d7a0955671ca719b81eebec0a508392f9cc438726deaa4e215fa1f2c27888edaba38e6b570578bb2112da42aa13351b3f7443efe95a2fcc4f0f2932ae envoy/config/overload/v3/overload.proto +++ shake256:b1483b097f119a5da9c7882192543cee4c57eb7a7f4caee285711bea09f6924a210d40c3dc2cfa4aba940d8b2bf2650e9b557b1fea96771edf54e5374387cfe8 envoy/config/overload/v3/overload.proto @@ -157,8 +157,10 @@ option (udpa.annotations.versioning).previous_message_type = "envoy.config.overload.v2alpha.OverloadAction"; - // The name of the overload action. This is just a well-known string that - // listeners can use for registering callbacks. + // The action name. Most actions use a well-known string for listener callback registration. + // ``ScaleTimersOverloadActionConfig`` actions may use unique custom names for independently + // triggered ``reduce_timeouts`` instances. Custom names must not use the reserved + // ``envoy.overload_actions.`` prefix. No action name may duplicate a ``LoadShedPoint`` name. // Valid known overload actions include: // - envoy.overload_actions.stop_accepting_requests // - envoy.overload_actions.disable_http_keepalive @@ -178,7 +180,10 @@ // in this list. repeated Trigger triggers = 2 [(validate.rules).repeated = {min_items: 1}]; - // Configuration for the action being instantiated if applicable. + // Optional implementation configuration. Well-known names identify the action directly; for a + // custom name, this configuration's type identifies it. Currently only + // ``ScaleTimersOverloadActionConfig`` supports custom names, identifying a ``reduce_timeouts`` + // instance. google.protobuf.Any typed_config = 3; }

envoy/config/route/v3/route.proto:

--- shake256:9e8d88f559a8724f64cdb259bb06d5d79dcc40430a2c190ceb6be8ad2bc989409748fc5f4d6d1b6f2dfd1deeb4804b13568d2a664d74554b431480d5a275535b envoy/config/route/v3/route.proto +++ shake256:698dbbd10b0ac4fc88e4935f5677ad37d0abc91eea4bf05e3c35035033cf235d968216abe5b582a7b0c5181ad56a743cfce17ec291b852384f2d3f3ec4c630af envoy/config/route/v3/route.proto @@ -4,6 +4,7 @@ import "envoy/config/core/v3/base.proto"; import "envoy/config/core/v3/config_source.proto"; +import "envoy/config/core/v3/extension.proto"; import "envoy/config/route/v3/route_components.proto"; import "google/protobuf/any.proto"; @@ -23,7 +24,7 @@ // * Routing :ref:`architecture overview <arch_overview_http_routing>` // * HTTP :ref:`router filter <config_http_filters_router>` -// [#next-free-field: 19] +// [#next-free-field: 20] message RouteConfiguration { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.RouteConfiguration"; @@ -138,7 +139,8 @@ // Normally, virtual host matching is done using the :authority (or // Host: in HTTP < 2) HTTP header. Setting this will instead, use a // different HTTP header for this purpose. - string vhost_header = 18; + string vhost_header = 18 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false}]; // Ignore path-parameters in path-matching. // Before RFC3986, URI were like(RFC1808): <scheme>://<net_loc>/<path>;<params>?<query>#<fragment> @@ -162,6 +164,34 @@ // For instance, if the metadata is intended for the Router filter, // the filter name should be specified as ``envoy.filters.http.router``. core.v3.Metadata metadata = 17; + + // After the route matching has resolved a route for incoming request, the route specifiers + // are applied to the route to customize or monitor it and the output of the specifiers will be + // used as the final route by Envoy for the request. The specifiers here will not modify/affect + // the request attributes (e.g., headers, path) directly. + // + // Specifiers are executed in order, and the output of each is the input of the next. The route + // that comes out of the last one is the route Envoy uses for the request. + // + // Specifiers are configured at three levels. Specifiers in three levels will run in this order: + // + // 1. The ``route_specifiers`` of resolved + // :ref:`route <envoy_v3_api_msg_config.route.v3.Route>` + // 2. The ``route_specifiers`` of resolved + // :ref:`virtual host <envoy_v3_api_msg_config.route.v3.VirtualHost>` + // 3. The ``route_specifiers`` of + // :ref:`route configuration <envoy_v3_api_msg_config.route.v3.RouteConfiguration>`. + // + // .. note:: + // If the route matching resolves no route, the route specifiers at the route configuration + // and the virtual host levels will still be applied to null. This allows route specifiers to + // optionally generate a valid route even when no route is resolved for the request. + // Similarly, if the route matching resolves a valid route, the route specifiers may drop it + // and return no route. Then Envoy will treat it as route not found and result in 404 response. + // + // See :ref:`route specifiers <config_http_conn_man_route_specifiers>` for more details. + // [#extension-category: envoy.router.route_specifiers] + repeated core.v3.TypedExtensionConfig route_specifiers = 19; } message Vhds {

envoy/config/route/v3/route_components.proto:

--- shake256:4c06a04c3d3885fa814d499cad8097eac67e1844f2c8e3985c24aa21b99d55851bd7d9e273c18536101f3b7df3064ad87027d77328a36793f75acbdfef4596b7 envoy/config/route/v3/route_components.proto +++ shake256:2c94a38b712b0bc8464609832cff79b02595cb280c341eeffc6042d89a9c623376cdfd615ecb833fd3ce82f83857f1a4073016dc8b55d6b56a5090683ddfd91c envoy/config/route/v3/route_components.proto @@ -45,7 +45,7 @@ // host header. This allows a single listener to service multiple top level domain path trees. Once // a virtual host is selected based on the domain, the routes are processed in order to see which // upstream cluster to route to or whether to perform a redirect. -// [#next-free-field: 26] +// [#next-free-field: 27] message VirtualHost { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.VirtualHost"; @@ -258,6 +258,27 @@ // For instance, if the metadata is intended for the Router filter, // the filter name should be specified as ``envoy.filters.http.router``. core.v3.Metadata metadata = 24; + + // After the route matching has resolved a route for incoming request, the route specifiers + // are applied to the route to customize or monitor it and the output of the specifiers will be + // used as the final route by Envoy for the request. The specifiers here will not modify/affect + // the request attributes (e.g., headers, path) directly. + // + // Specifiers are executed in order, and the output of each is the input of the next. The + // specifiers here will run after the ``route_specifiers`` of the resolved + // :ref:`route <envoy_v3_api_field_config.route.v3.Route.route_specifiers>` + // and before the ``route_specifiers`` of + // :ref:`route configuration <envoy_v3_api_field_config.route.v3.RouteConfiguration.route_specifiers>`. + // + // .. note:: + // If the route matching resolves no route, the route specifiers at the route configuration + // and the virtual host levels will still be applied to null. This allows route specifiers to + // optionally generate a valid route even when no route is resolved for the request. + // Similarly, if the route matching resolves a valid route, the route specifiers may drop it + // and return no route. Then Envoy will treat it as route not found and result in 404 response. + // + // See :ref:`route specifiers <config_http_conn_man_route_specifiers>` for more details. + repeated core.v3.TypedExtensionConfig route_specifiers = 26; } // A filter-defined action type. @@ -281,7 +302,7 @@ // // Envoy supports routing on HTTP method via :ref:`header matching // <envoy_v3_api_msg_config.route.v3.HeaderMatcher>`. -// [#next-free-field: 21] +// [#next-free-field: 22] message Route { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.Route"; @@ -420,6 +441,28 @@ // Only one of :ref:`per_request_buffer_limit_bytes <envoy_v3_api_field_config.route.v3.Route.per_request_buffer_limit_bytes>` // and ``request_body_buffer_limit`` may be set. google.protobuf.UInt64Value request_body_buffer_limit = 20; + + // After the route matching has resolved this route for incoming request, the route specifiers + // are applied to the route to customize or monitor it and the output of the specifiers will be + // used as the final route by Envoy for the request. The specifiers here will not modify/affect + // the request attributes (e.g., headers, path) directly. + // + // Specifiers are executed in order, and the output of each is the input of the next. The + // specifiers here will run first, before the ``route_specifiers`` of + // :ref:`virtual host <envoy_v3_api_field_config.route.v3.VirtualHost.route_specifiers>` and + // :ref:`route configuration <envoy_v3_api_field_config.route.v3.RouteConfiguration.route_specifiers>`, + // so the route that comes out of the last specifier here is the input of the specifiers of + // these two levels. + // + // .. note:: + // If the route matching resolves no route, the route specifiers at the route configuration + // and the virtual host levels will still be applied to null. This allows route specifiers to + // optionally generate a valid route even when no route is resolved for the request. + // Similarly, if the route matching resolves a valid route, the route specifiers may drop it + // and return no route. Then Envoy will treat it as route not found and result in 404 response. + // + // See :ref:`route specifiers <config_http_conn_man_route_specifiers>` for more details. + repeated core.v3.TypedExtensionConfig route_specifiers = 21; } // Compared to the :ref:`cluster <envoy_v3_api_field_config.route.v3.RouteAction.cluster>` field that specifies a @@ -831,8 +874,6 @@ // Configures :ref:`internal redirect <arch_overview_internal_redirects>` behavior. // [#next-major-version: remove this definition - it's defined in the InternalRedirectPolicy message.] enum InternalRedirectAction { - option deprecated = true; - PASS_THROUGH_INTERNAL_REDIRECT = 0; HANDLE_INTERNAL_REDIRECT = 1; } @@ -1799,7 +1840,11 @@ // .. note:: // This currently works when the route cluster specifier support the dynamic refresh, // e.g. :ref:`matcher cluster specifier - // <envoy_v3_api_msg_extensions.router.cluster_specifiers.matcher.v3.MatcherClusterSpecifier>`. + // <envoy_v3_api_msg_extensions.router.cluster_specifiers.matcher.v3.MatcherClusterSpecifier>`, + // :ref:`priority group cluster specifier + // <envoy_v3_api_msg_extensions.router.cluster_specifiers.priority_group.v3.PriorityGroupClusterSpecifier>` + // and :ref:`dynamic modules cluster specifier + // <envoy_v3_api_msg_extensions.router.cluster_specifiers.dynamic_modules.v3.DynamicModuleClusterSpecifier>`. bool refresh_cluster_on_retry = 14; }

envoy/config/trace/v3/opentelemetry.proto:

--- shake256:8e0324e178d7561d08e816cdd67afb981b2b68228a878957657bde04fa66fc6b065368cc37be30bbd2171e5d1fa4cdab19a7d0b73d579bb43329373316ee2bda envoy/config/trace/v3/opentelemetry.proto +++ shake256:17cc86cb088fc468511d70720b7210abb576ff0ffbe5a4ac3cd60c8cd27344464cc70c7ab2d1c95035a5c13dc56391bb802407f9605387fc04e7d808d6423c22 envoy/config/trace/v3/opentelemetry.proto @@ -21,18 +21,18 @@ // Configuration for the OpenTelemetry tracer. // [#extension: envoy.tracers.opentelemetry] -// [#next-free-field: 9] +// [#next-free-field: 11] message OpenTelemetryConfig { // The upstream gRPC cluster that will receive OTLP traces. // Note that the tracer drops traces if the server does not read data fast enough. // This field can be left empty to disable reporting traces to the gRPC service. - // Only one of ``grpc_service``, ``http_service`` may be used. + // Only one of ``grpc_service``, ``http_service``, ``exporter`` may be used. core.v3.GrpcService grpc_service = 1 [(udpa.annotations.field_migrate).oneof_promotion = "otlp_exporter"]; // The upstream HTTP cluster that will receive OTLP traces. // This field can be left empty to disable reporting traces to the HTTP service. - // Only one of ``grpc_service``, ``http_service`` may be used. + // Only one of ``grpc_service``, ``http_service``, ``exporter`` may be used. // // .. note:: // @@ -42,6 +42,14 @@ core.v3.HttpService http_service = 3 [(udpa.annotations.field_migrate).oneof_promotion = "otlp_exporter"]; + // Specifies the custom exporter to be used by the OpenTelemetry tracer. + // Only one of ``grpc_service``, ``http_service``, ``exporter`` may be used. + // + // [#extension-category: envoy.tracers.opentelemetry.exporters] + // [#not-implemented-hide:] + core.v3.TypedExtensionConfig exporter = 10 + [(udpa.annotations.field_migrate).oneof_promotion = "otlp_exporter"]; + // The name for the service. This will be populated in the ResourceSpan Resource attributes. // If it is not provided, it will default to "unknown_service:envoy". string service_name = 2; @@ -76,4 +84,8 @@ // Specifies whether to set the ``service.name`` resource attribute. // If not specified, the default is to set this attribute. google.protobuf.BoolValue set_service_name_resource_attribute = 8; + + // Specifies whether to set the instrumentation scope name ("envoy") and version on emitted traces. + // If not specified, the default is to set the instrumentation scope name and version. + google.protobuf.BoolValue set_instrumentation_scope = 9; }

envoy/data/core/v3/health_check_event.proto:

--- shake256:52a273d10476cf55e56112ff343c5c91a644f232ec677a9437ae0a54e392455580bbff0912e2cef39f1692af08740f309cea6019f29dcc61a6b54f2c7048ccd7 envoy/data/core/v3/health_check_event.proto +++ shake256:1732513f22bc9d5956267a7d4a149f2c9b3471c8b8da67733e786b32684e80344e44bbbc1a9873bb5ee979cbbdaed2a8d2d4082c7161e552d710eed81e2e7b5b envoy/data/core/v3/health_check_event.proto @@ -34,6 +34,7 @@ REDIS = 3; THRIFT = 4; DYNAMIC_MODULE = 5; + UDP = 6; } // [#next-free-field: 13]

envoy/extensions/access_loggers/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:6a79c855b6c0be08965931e01925e38b0dd6b550fbf8a89822f2c358fb26fbfda4c2ca08eade15ac926c325d8ccdab9604f26a6e74fcf63928b179f7a5c35443 envoy/extensions/access_loggers/dynamic_modules/v3/dynamic_modules.proto +++ shake256:b801c7532eafc67c8c9fcdb522b395770893de74f2433033bd97d013256be1182c75b86afee07c81abc0c6c35dfc8115ac25e0222c1a07db170dd5f06da6e7a3 envoy/extensions/access_loggers/dynamic_modules/v3/dynamic_modules.proto @@ -53,7 +53,8 @@ // The ``logger_config`` can be used to configure file paths, service endpoints, batching // parameters, format strings, etc. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/access_loggers/open_telemetry/v3/logs_service.proto:

--- shake256:22d4d7d08052b89328069887d994556ba290264f6b8eb10b59f7d924da761c06d89ee28b81b3e7892a0418ecc51ccdd04ad41e97451731cea47ad6e3532c6e5b envoy/extensions/access_loggers/open_telemetry/v3/logs_service.proto +++ shake256:8491c4d20717a14b78e5865417c9f035c5c6371b960584af09789287d65d19d29599727d0a67e6b172df026afee9a7718a0befea90fcb38e24c106a3a3837346 envoy/extensions/access_loggers/open_telemetry/v3/logs_service.proto @@ -29,7 +29,7 @@ // populate `opentelemetry.proto.collector.v1.logs.ExportLogsServiceRequest.resource_logs <https://github.com/open-telemetry/opentelemetry-proto/blob/main/opentelemetry/proto/collector/logs/v1/logs_service.proto>`_. // In addition, the request start time is set in the dedicated field. // [#extension: envoy.access_loggers.open_telemetry] -// [#next-free-field: 15] +// [#next-free-field: 16] message OpenTelemetryAccessLogConfig { // [#comment:TODO(itamarkam): add 'filter_state_objects_to_log' to logs.] // Deprecated. Use ``grpc_service`` or ``http_service`` instead. @@ -54,13 +54,29 @@ // If specified, Envoy will not generate built-in resource labels // like ``log_name``, ``zone_name``, ``cluster_name``, ``node_name``. + // + // Built-in labels have the lowest precedence and can be overridden by matching keys in + // :ref:`resource_detectors <envoy_v3_api_field_extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig.resource_detectors>` + // or :ref:`resource_attributes <envoy_v3_api_field_extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig.resource_attributes>`. bool disable_builtin_labels = 5; // OpenTelemetry `Resource <https://github.com/open-telemetry/opentelemetry-proto/blob/main/opentelemetry/proto/logs/v1/logs.proto#L51>`_ // attributes are filled with Envoy node info. // Example: ``resource_attributes { values { key: "region" value { string_value: "cn-north-7" } } }``. + // + // Attributes configured here take highest precedence (``resource_attributes`` > ``resource_detectors`` > built-in labels) + // and will override any matching keys. opentelemetry.proto.common.v1.KeyValueList resource_attributes = 4; + // An ordered list of resource detectors to detect OpenTelemetry resource information such as + // attributes and schema URL. + // + // Attributes detected here override built-in labels with matching keys, but are overridden by + // :ref:`resource_attributes <envoy_v3_api_field_extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig.resource_attributes>` + // (precedence: ``resource_attributes`` > ``resource_detectors`` > built-in labels). + // [#extension-category: envoy.tracers.opentelemetry.resource_detectors] + repeated config.core.v3.TypedExtensionConfig resource_detectors = 15; + // OpenTelemetry `LogResource <https://github.com/open-telemetry/opentelemetry-proto/blob/main/opentelemetry/proto/logs/v1/logs.proto>`_ // fields, following `Envoy access logging formatting <https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage>`_. //

envoy/extensions/bootstrap/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:6fce554d394bed9723dc38e8dbad13f7ed0b955cff4ef9af3492024133d2241b8097a22109e5bae906b63bf468a58f7cf3b5fbad9a7ba6d9deafb339dae8d9be envoy/extensions/bootstrap/dynamic_modules/v3/dynamic_modules.proto +++ shake256:bcca4a38dfc74d193604e0758a536a6a3d5ae2b277355ea283da3468f47183524ccb3b0655df290586bc3e325a8584a610ea5fbe554d59cfd6bb2dd5465b20f3 envoy/extensions/bootstrap/dynamic_modules/v3/dynamic_modules.proto @@ -54,7 +54,8 @@ // one for metric initialization, ``extension_name`` is used to choose the implementation. The // ``extension_config`` can be used to configure the specific behavior of each implementation. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/v3/downstream_reverse_connection_socket_interface.proto:

--- shake256:4d6c09554d3b68490a77d8095e475fa647624f37a2ac97f4f3c2f03ad3942a1fc96dfe8f459a87fd472a60ed07c386f0e235ae32be18ba8e34bc0c005e46829d envoy/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/v3/downstream_reverse_connection_socket_interface.proto +++ shake256:06777c0a6d9c75d1495b8fc59a5a4b0be7a8de43bcecde66c564eaf5f3746d866e4fe4f4ad9e3182ddea2ef478b2932723f7dde312dc0a6a634f655b87b3da09 envoy/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/v3/downstream_reverse_connection_socket_interface.proto @@ -23,9 +23,10 @@ // Configuration for the downstream reverse connection socket interface. // This interface initiates reverse connections to upstream Envoys and provides // them as socket connections for downstream requests. -// [#next-free-field: 6] +// [#next-free-field: 7] message DownstreamReverseConnectionSocketInterface { // HTTP handshake settings for initiator envoy initiated reverse tunnels. + // [#next-free-field: 6] message HttpHandshakeConfig { // Request path used when issuing the HTTP reverse-connection handshake. Defaults to // "/reverse_connections/request". @@ -45,6 +46,14 @@ // as substitution format strings; when empty, the values are sent literally. // [#extension-category: envoy.formatter] repeated config.core.v3.TypedExtensionConfig formatters = 4; + + // Maximum time to receive the handshake response after the connection opens. If not specified, + // defaults to ``15s``. On expiry the attempt is closed, recorded with failure reason + // ``timeout``, and normal backoff applies. + google.protobuf.Duration handshake_timeout = 5 [(validate.rules).duration = { + lte {seconds: 300} + gt {} + }]; } // Stat prefix to be used for downstream reverse connection socket interface stats. @@ -60,9 +69,10 @@ HttpHandshakeConfig http_handshake = 3; // Access log configuration for reverse tunnel initiator lifecycle events. - // Logs are emitted on handshake success, handshake failure, and connection close. - // Reverse tunnel metadata (``node_id``, ``cluster_id``, ``tenant_id``, upstream cluster, etc.) - // is available via ``%DYNAMIC_METADATA(envoy.reverse_tunnel.initiator:*)%`` substitutions. + // Logs are emitted on handshake success, handshake failure, connection draining, and + // connection close. Reverse tunnel metadata (``node_id``, ``cluster_id``, ``tenant_id``, + // upstream cluster, ``connection_key``, ``connection_id``, etc.) is available via + // ``%DYNAMIC_METADATA(envoy.reverse_tunnel.initiator:*)%`` substitutions. repeated config.accesslog.v3.AccessLog access_log = 4; // Upper bound on the per-host reconnect backoff. The initiator retries a failed handshake on a @@ -70,4 +80,10 @@ // that schedule. google.protobuf.Duration max_reconnect_backoff = 5 [(validate.rules).duration = {gte {seconds: 1}}]; + + // How often the initiator re-checks each host and dials any missing reverse tunnels. + // Defaults to 10s. The re-check is jittered upward so agents that start together do not + // redial in lockstep. The minimum value is 100ms. + google.protobuf.Duration maintain_interval = 6 + [(validate.rules).duration = {gte {nanos: 100000000}}]; }

envoy/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/v3/upstream_reverse_connection_socket_interface.proto:

--- shake256:1469c987be8ca76f78498d29ce240aa40904695fcceb0d9b3d865044339f0f2973b168107285746c82050f8f222944419c5428553fd33e6d0d2e12dcec634b4b envoy/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/v3/upstream_reverse_connection_socket_interface.proto +++ shake256:d390dda96435e41cc43e4e950e0e287a2ba7a29c9377b73ce64e81bd9fe2098725eb8af751addc9845d89067141a36c34af023b4c7390d96c577c3506dd8102c envoy/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/v3/upstream_reverse_connection_socket_interface.proto @@ -20,7 +20,7 @@ // [#extension: envoy.bootstrap.reverse_tunnel.upstream_socket_interface] // Configuration for the upstream reverse connection socket interface. -// [#next-free-field: 7] +// [#next-free-field: 8] message UpstreamReverseConnectionSocketInterface { // Stat prefix for upstream reverse connection socket interface stats. string stat_prefix = 1; @@ -49,4 +49,13 @@ // Access logs emitted for reverse tunnel lifecycle events. Entries are generated for tunnel setup, // socket handoff, tunnel close, and post-handoff HTTP/2 keepalive timeout observations. repeated config.accesslog.v3.AccessLog access_log = 6; + + // Maximum number of concurrently accepted reverse connections per node (and per tenant + // when tenant isolation is enabled). The cap is only consulted for reverse tunnel network + // filters that opt in via ``enable_connection_limit``; filters that leave it disabled ignore it. + // The cap is enforced per worker thread, so the effective ceiling is roughly this value + // multiplied by the number of workers; it is also only approximate when rebalancing is enabled. + // Defaults to 0; combined with ``enable_connection_limit: true`` a value of 0 rejects all + // connections, so set a non-zero value whenever a filter enables the limit. + uint32 max_connections_per_node = 7; }

envoy/extensions/clusters/composite/v3/cluster.proto:

--- shake256:f4b676ef5840cc1e1d8e3fe0c4082b16c423ac1a7b25f9e58f1a3f43733cf51bb7902519dc780939132ae3287dc5c00b99d6894a6da03ad841517d12e072d5e9 envoy/extensions/clusters/composite/v3/cluster.proto +++ shake256:752daf76478d21aeef455c959b30d42551c1529a3c4b5790334fba28cec557c5595762f42088b438a472742078cedeb8b332f5fd732cac86f5de237ee754e61d envoy/extensions/clusters/composite/v3/cluster.proto @@ -18,7 +18,9 @@ // cluster selection, allowing different retry attempts to automatically target // different upstream clusters. Unlike the standard aggregate cluster which uses // health-based selection, the composite cluster uses the retry attempt count to -// deterministically select which sub-cluster to route to. +// deterministically select which sub-cluster to route to. If the selected sub-cluster has no +// host available, the following sub-clusters in the list are tried in order within the same +// attempt. // // When retry attempts exceed the number of configured clusters, requests will fail with no // host available. @@ -50,6 +52,8 @@ // List of clusters to use for request routing. The first cluster is used for the // initial request (attempt 1), the second cluster for the first retry (attempt 2), // and so on. Must contain at least one cluster. When retry attempts exceed the number - // of configured clusters, requests will fail with no host available. + // of configured clusters, requests will fail with no host available. When the cluster + // selected for an attempt has no host available, the following clusters in this list are + // tried in order for that attempt. repeated ClusterEntry clusters = 1 [(validate.rules).repeated = {min_items: 1}]; }

envoy/extensions/clusters/mcp_multicluster/v3/cluster.proto:

--- shake256:cf351b8d71d7f45e7cc327ecafde019c884ed6a3ddc31953e89d1dc2fdbb1ee4ad86df0465599f4a3c6a032b0006094f07ffebf800794b2f9c5186a2c603283b envoy/extensions/clusters/mcp_multicluster/v3/cluster.proto +++ shake256:e4e8ec2ca3180e520c0f89af150fbaebc08714966fa37cba4e42400c25258de81a6f4d9a979b285a010620246df74d8450251968717201c5d0f1b22170f5883e envoy/extensions/clusters/mcp_multicluster/v3/cluster.proto @@ -2,6 +2,8 @@ package envoy.extensions.clusters.mcp_multicluster.v3; +import "envoy/type/matcher/v3/string.proto"; + import "google/protobuf/duration.proto"; import "xds/annotations/v3/status.proto"; @@ -67,6 +69,40 @@ string host_rewrite_literal = 4; } + // Specifies which downstream request headers are allowed to be forwarded to an MCP + // backend. Modeled after + // :ref:`ext_proc's HeaderForwardingRules <envoy_v3_api_msg_extensions.filters.http.ext_proc.v3.ExternalProcessor>`, + // but MCP-local and secure-by-default: unlike ext_proc, an unset/empty policy + // forwards nothing rather than everything, because MCP requires audience-bound + // tokens and prohibits implicit token passthrough between a client and a backend it + // did not authenticate to. + // + // Evaluation order per header: + // + // 1. If the header matches ``disallowed_headers``, it is never forwarded — this + // takes precedence over everything below, including ``forward_all``. + // 2. Otherwise, if ``forward_all`` is true, the header is forwarded. + // 3. Otherwise, if the header matches ``allowed_headers``, it is forwarded. + // 4. Otherwise, the header is not forwarded. + // + // This does not cover header *mutation* or credential injection, which remain a + // separate concern from this policy. + message HeaderForwarding { + // If true, forward all downstream request headers to this backend (subject to + // ``disallowed_headers`` above), matching the legacy forward-everything behavior. + // Defaults to false. Users relying on the legacy behavior must set this explicitly. + bool forward_all = 1; + + // If set, specifically allow any header in this list to be forwarded. Ignored for a + // header that also matches ``disallowed_headers``, and redundant (but harmless) for + // any header covered by ``forward_all``. + type.matcher.v3.ListStringMatcher allowed_headers = 2; + + // If set, specifically disallow any header in this list from being forwarded. This + // takes precedence over both ``forward_all`` and ``allowed_headers``. + type.matcher.v3.ListStringMatcher disallowed_headers = 3; + } + // Specification of the MCP server. message McpBackend { // Unique name for this backend. Used for: @@ -78,6 +114,15 @@ // Backend target specification. McpCluster mcp_cluster = 2; + + // Controls which downstream request headers are forwarded to this backend. + // If not set, no downstream-controlled headers are forwarded beyond those the + // router itself must synthesize (e.g. ``content-type``, ``accept``, the session + // header) — in particular, a client's ``authorization`` header is NOT forwarded + // by default. Router-owned, framing, session, and hop-by-hop headers are never + // affected by this policy; they are handled separately and can never be forwarded + // via this mechanism. + HeaderForwarding header_forwarding = 3; } // A list of remote MCP servers.

envoy/extensions/common/ratelimit/v3/ratelimit.proto:

--- shake256:4771d57c4812b0bd79a53d87a3ee09c02be588cd5294b234b897890b456c12ce11ac31f77bb70794d61f646b95ec19ffe3d17054cb672d838c2868152b3e06ac envoy/extensions/common/ratelimit/v3/ratelimit.proto +++ shake256:16ea57deb3c9206e9f72502ffca313607e245493ab1ef2a6cfc6977b4177f3ba84d30185d1513f4b7c06601af58d411e889ed95daabb2e9ebde62d82491d1594 envoy/extensions/common/ratelimit/v3/ratelimit.proto @@ -118,6 +118,10 @@ // The unit of time. type.v3.RateLimitUnit unit = 2 [(validate.rules).enum = {defined_only: true}]; + + // The number of units in the rate limit period. For example, a value of ``30`` with a unit + // of ``SECOND`` specifies a 30-second rate limit period. If not specified, defaults to ``1``. + google.protobuf.UInt32Value unit_multiplier = 3 [(validate.rules).uint32 = {gt: 0}]; } // Descriptor entries.

envoy/extensions/filters/http/adaptive_concurrency/v3/adaptive_concurrency.proto:

--- shake256:e6df3bb2bfd67f962c667bf9357058f6525731e037937de2db16a88222ed331f2ae53bfc0878a878ad30517f3e80381bed41198d30ac3963f243dae9672a72c3 envoy/extensions/filters/http/adaptive_concurrency/v3/adaptive_concurrency.proto +++ shake256:b4d3dec94b64da00d30d0c3a2a001941240da6a0ace1e1fbddcf2f70c155b38827a2e41e09055582d268cffc009dae06def4f39929167c31777e5cfe778d5363 envoy/extensions/filters/http/adaptive_concurrency/v3/adaptive_concurrency.proto @@ -44,6 +44,13 @@ required: true gt {} }]; + + // The allowed lower-bound on the calculated concurrency limit. If unset, this defaults to + // :ref:`min_concurrency + // <envoy_v3_api_field_extensions.filters.http.adaptive_concurrency.v3.GradientControllerConfig.MinimumRTTCalculationParams.min_concurrency>` + // to preserve the existing behavior where the same value controls both the minimum calculated + // limit and the limit used while measuring minRTT. + google.protobuf.UInt32Value min_concurrency_limit = 4 [(validate.rules).uint32 = {gt: 0}]; } // Parameters controlling the periodic minRTT recalculation.

envoy/extensions/filters/http/ai_protocol_manager/v3/ai_protocol_manager.proto:

--- shake256:c43598da8f84e03829c2d36480e6261e4a58501e51d5610a15e5d768ca28c783d22aab37042d8c88a2b45a06e8f253c42d93d5cf8b306819c5c29ccda7e774fb envoy/extensions/filters/http/ai_protocol_manager/v3/ai_protocol_manager.proto +++ shake256:f535bb9e68b1fc31fd34345beef2ac4f6b1ccd8ee0207a12fb673394c16cd6e9c7ae13a75f14f9f0b1bfd2664c1942318c8189fc4dcf1fea76de4ba64afe7c4e envoy/extensions/filters/http/ai_protocol_manager/v3/ai_protocol_manager.proto @@ -2,9 +2,15 @@ package envoy.extensions.filters.http.ai_protocol_manager.v3; +import "envoy/config/core/v3/extension.proto"; +import "envoy/type/ai/v3/llm_protocol.proto"; + +import "google/protobuf/wrappers.proto"; + import "xds/annotations/v3/status.proto"; import "udpa/annotations/status.proto"; +import "validate/validate.proto"; option java_package = "io.envoyproxy.envoy.extensions.filters.http.ai_protocol_manager.v3"; option java_outer_classname = "AiProtocolManagerProto"; @@ -19,5 +25,239 @@ // [#extension: envoy.filters.http.ai_protocol_manager] // Configuration for the AI Protocol Manager filter. +// +// The filter manages AI endpoint traffic on both directions of a stream. On +// the request path it holds a declared AI endpoint's payload and parses it, +// which is what lets routing, admission and policy act on a payload the proxy +// understands rather than on opaque bytes. On the response path it can +// extract normalized LLM token usage into dynamic metadata. +// +// Request and response processing are independently enabled by the presence +// of ``request_handling`` and ``response_handling``. Which routes are AI +// endpoints — and which :ref:`wire API <envoy_v3_api_enum_type.ai.v3.LLMProtocol>` +// each speaks — is declared with the :ref:`per-route configuration +// <envoy_v3_api_msg_extensions.filters.http.ai_protocol_manager.v3.AiProtocolManagerPerRoute>`. message AiProtocolManager { + // Request-side AI protocol processing. When unset, the decode path is a + // pure passthrough — including on routes carrying per-route configuration. + RequestHandling request_handling = 1; + + // Response-side AI protocol processing. When unset, the encode path is a + // pure passthrough. + ResponseHandling response_handling = 2; + + // AI filters, in order. They run over a declared AI endpoint's parsed request payload + // before it continues down the HTTP filter chain, and require ``request_handling``. + // [#extension-category: envoy.http.ai_filters] + repeated config.core.v3.TypedExtensionConfig filters = 3; +} + +// Request-side processing configuration. A route that carries a +// :ref:`per-route request declaration +// <envoy_v3_api_field_extensions.filters.http.ai_protocol_manager.v3.AiProtocolManagerPerRoute.request>` +// has its payload held, offloaded, and parsed strictly: a body that is not +// well-formed JSON is rejected with a 400 rather than forwarded for the +// upstream to interpret differently. +message RequestHandling { + // How the request body is written out once the :ref:`AI filters + // <envoy_v3_api_field_extensions.filters.http.ai_protocol_manager.v3.AiProtocolManager.filters>` + // finish. + enum BodyReserialization { + // Re-serialize the parsed document, so the edits AI filters make to it reach the upstream. + ALWAYS = 0; + + // Forward the received body byte for byte. Edits AI filters make to the parsed document are + // not sent, so use this only with AI filters that read the request, such as request info. + DISABLE = 1; + } + + // Attempt best-effort JSON parsing on routes without a per-route + // configuration. + // + // Defaults to ``false``: unconfigured routes are not buffered or parsed. + // When ``true``, such routes are parsed too, but never failed over it — a + // route that declared no AI wire contract has nothing to hold its payload + // to, so a body that fails to parse is forwarded unchanged. + // + // Only requests that can be held to end of stream are taken: the request must + // carry a JSON content type (``application/json`` or a ``+json`` suffix) and + // must not be gRPC or Connect streaming, an upgrade, or a CONNECT. Holding a + // full-duplex request would stall it, since the client may not finish the + // request until it sees a response the held upstream cannot produce. + bool parse_unconfigured_routes = 1; + + // Request-path parsing limits. Defaults apply when unset. + RequestParsingLimits limits = 2; + + // Whether the parsed request is re-serialized once the AI filters finish. Defaults to ``ALWAYS``. + // Requests that run no AI filters are forwarded as received either way. + BodyReserialization reserialize_body = 3 [(validate.rules).enum = {defined_only: true}]; +} + +// Per-stream limits for request payload parsing. +message RequestParsingLimits { + // Maximum size, in bytes, of a decoded string value kept inline in the + // parsed document; a larger value stays in the external buffer and is + // referenced by offset. Object keys are always inline. + // + // This is the deployment-wide default, applied when a declared API's payload + // schema does not pin its own threshold. Defaults to 1KiB, which keeps + // ordinary metadata (model names, roles, tool names) inline while + // conversation content goes to the buffer. + // + // Keep it above the longest ``model`` name in use. Values over the threshold + // are offloaded, and the :ref:`schema validation AI filter + // <envoy_v3_api_msg_extensions.http.ai_filters.schema_validation.v3.SchemaValidation>` + // requires ``model`` inline, so it rejects an offloaded one with a 400. + google.protobuf.UInt32Value inline_string_threshold_bytes = 1 + [(validate.rules).uint32 = {lte: 1048576 gte: 64}]; +} + +// Response-side processing configuration. Individual response features are +// enabled by the presence of their corresponding messages. +message ResponseHandling { + // Extract canonical token usage from eligible AI responses. When unset, + // token usage extraction is disabled. + TokenUsageExtraction token_usage = 1; +} + +// Configuration for canonical response token-usage extraction. +// +// Eligible 2xx SSE and JSON responses are observed as they stream through; +// the filter never stops iteration or modifies the response, and no +// extraction failure can affect it. The result is published at a clean end +// of stream under one namespace as typed dynamic metadata: the authoritative +// record is :ref:`envoy.data.ai.v3.TokenUsage +// <envoy_v3_api_msg_data.ai.v3.TokenUsage>`, consumable through typed +// metadata readers such as ext_proc typed forwarding. No untyped ``Struct`` +// mirror is emitted. +// [#next-free-field: 6] +message TokenUsageExtraction { + // Stream signals emitted upon publishing token usage metadata. + enum UsageSignal { + USAGE_SIGNAL_UNSPECIFIED = 0; + + // Synthesize empty response trailers at end of stream if none exist. + // This wakes downstream trailer-driven consumers (such as ext_proc with + // ``response_trailer_mode: SEND``) with metadata context without transferring + // response body bytes. + SYNTHESIZE_TRAILERS = 1; + } + + // Also inspect responses on routes without per-route configuration. + // + // Defaults to ``false``: only routes carrying an + // :ref:`AiProtocolManagerPerRoute + // <envoy_v3_api_msg_extensions.filters.http.ai_protocol_manager.v3.AiProtocolManagerPerRoute>` + // configuration are inspected, so enabling token usage on a mixed listener + // does not silently parse unrelated JSON/SSE responses. Enable this for + // response-only installations whose routes cannot be declared — for + // example an upstream installation on a dynamic-forward-proxy cluster. + bool include_unconfigured_routes = 1; + + // Fallback wire API used when the route does not identify a response API. + // + // ``LLM_PROTOCOL_UNSPECIFIED`` means auto-detect from the response shape + // (only strongly shaped, value-validated markers lock a stream). This is a + // fallback, not an override of per-route response configuration; see the + // :ref:`per-route configuration + // <envoy_v3_api_msg_extensions.filters.http.ai_protocol_manager.v3.AiProtocolManagerPerRoute>` + // for the full precedence. + type.ai.v3.LLMProtocol default_llm_protocol = 2 [(validate.rules).enum = {defined_only: true}]; + + // Namespace for the emitted typed dynamic metadata. + // Defaults to ``envoy.ai.token_usage``. + string metadata_namespace = 3; + + // Extraction resource limits. Defaults apply when unset. + TokenUsageExtractionLimits limits = 4; + + // Optional signal to emit at end of stream after publishing token usage. + UsageSignal usage_signal = 5 [(validate.rules).enum = {defined_only: true}]; +} + +// Per-stream memory and work limits for token-usage extraction. The response +// itself always streams through unaffected; on any limit only extraction +// state is dropped and the published record is flagged. +message TokenUsageExtractionLimits { + // Maximum size of one SSE event inspected for token usage. This is a hard + // bound on retained extraction state, regardless of how large individual + // data frames are: a pending event over the cap is discarded through its + // real terminating blank line, and a complete event over the cap is + // skipped without parsing. + // + // Defaults to 1MiB: OpenAI Responses API streams carry usage on terminal + // lifecycle events that embed the complete response object, so ordinary + // long generations produce usage-bearing events far larger than typical + // SSE deltas. Lower this in constrained deployments at the cost of losing + // usage from long generations. + google.protobuf.UInt32Value max_sse_event_size = 1 + [(validate.rules).uint32 = {lte: 10485760 gte: 1}]; + + // Maximum JSON response body inspected for token usage. A larger body — + // including one whose ``content-length`` already exceeds the cap — is not + // inspected. Defaults to 4MiB. + google.protobuf.UInt32Value max_json_body_size = 2 + [(validate.rules).uint32 = {lte: 10485760 gte: 1}]; + + // Maximum number of SSE payloads parsed as JSON for one response, counting + // malformed payloads; events skipped by name (keepalives, content deltas) + // do not count. ``max_sse_event_size`` bounds one event; this bounds the + // parse work a long-lived stream can extract from the worker. On + // exhaustion the accumulated usage is kept and published as partial, and + // extraction goes inert. + // + // Defaults to 65536 — far above ordinary streams. Raise it for extremely + // long generations whose every chunk must be parsed (OpenAI Chat + // Completions streams, whose chunks are unnamed and cannot be skipped by + // classification). + google.protobuf.UInt32Value max_parsed_sse_events = 3 [(validate.rules).uint32 = {gte: 1}]; +} + +// Per-route configuration. Its presence declares the route an AI endpoint. +// +// Request and response wire protocols are declared separately because +// protocol translation can make the client-facing request API differ from +// the provider's response API. For response token-usage extraction the +// effective wire API is resolved in precedence order: per-route +// ``response.llm_protocol``, then per-route ``request.llm_protocol``, then +// :ref:`default_llm_protocol +// <envoy_v3_api_field_extensions.filters.http.ai_protocol_manager.v3.TokenUsageExtraction.default_llm_protocol>`, +// then auto-detection. +message AiProtocolManagerPerRoute { + // Request-side route configuration. Its presence hands the request payload + // to the filter to hold and validate (when :ref:`request_handling + // <envoy_v3_api_field_extensions.filters.http.ai_protocol_manager.v3.AiProtocolManager.request_handling>` + // is enabled). + RequestPerRoute request = 1; + + // Optional response-side route configuration. When absent, response + // processing inherits ``request.llm_protocol`` when available, then the + // global fallback. + ResponsePerRoute response = 2; +} + +// Per-route request-side behavior. +message RequestPerRoute { + // The wire API a request payload on this route follows. + // ``LLM_PROTOCOL_UNSPECIFIED`` declares the endpoint without naming its + // API. The ``envoy.ai.llm_protocol.request`` filter state object, when it + // names one, takes precedence. + // + // The :ref:`schema validation AI filter + // <envoy_v3_api_msg_extensions.http.ai_filters.schema_validation.v3.SchemaValidation>` + // holds a payload to its API's schema. + // + // [#comment: Normalization is not implemented yet; a normalization knob + // will be added here once the transformation and its output contract + // exist.] + type.ai.v3.LLMProtocol llm_protocol = 1 [(validate.rules).enum = {defined_only: true}]; +} + +// Per-route response-side behavior. +message ResponsePerRoute { + // The wire API the response on this route follows. This can differ from + // ``request.llm_protocol`` when the gateway performs protocol translation. + // ``LLM_PROTOCOL_UNSPECIFIED`` falls through the precedence chain above. + type.ai.v3.LLMProtocol llm_protocol = 1 [(validate.rules).enum = {defined_only: true}]; }

envoy/extensions/filters/http/basic_auth/v3/basic_auth.proto:

--- shake256:00902c0bf637b39660032f85e0e6c05335ad948d4705c4207d3d67478603a21b6cefc06cfd79d03cda098eb753617d1cbe4f898827cd3deac3a75fdb25d2d422 envoy/extensions/filters/http/basic_auth/v3/basic_auth.proto +++ shake256:2a751a2d745240b338992e26dd84d5ec71e6f0a9f017eeec3b215c667fd485f3d2a2fb57e86ac8e898e9a14c4eebc9a5830e88f48fb8f324abbe8e332d0dc291 envoy/extensions/filters/http/basic_auth/v3/basic_auth.proto @@ -29,7 +29,7 @@ // user1:{SHA}hashed_user1_password // user2:{SHA}hashed_user2_password // -// [#next-free-field: 6] +// [#next-free-field: 7] message BasicAuth { // Username-password pairs used to verify user credentials in the "Authorization" header. // The value needs to be the htpasswd format. @@ -71,6 +71,16 @@ // other authentication methods (e.g. JWT) and using a downstream RBAC filter to enforce // OR semantics. bool emit_dynamic_metadata = 5; + + // The realm to use in the ``WWW-Authenticate`` response header when authentication fails. + // The value is placed verbatim into ``WWW-Authenticate: Basic realm="<value>"``. + // + // If not specified, Envoy falls back to using the full request URI + // (scheme + authority + path, truncated to 256 characters), which differs per path and + // prevents browsers from reusing cached credentials across paths on the same origin. + // Set a fixed realm to enable correct credential caching. The realm pattern dose not + // allow DEL, 32 C0 control chars including CRLF injection chars. + string realm = 6 [(validate.rules).string = {pattern: "^[^\\x00-\\x1f\\x7f]*$"}]; } // Extra settings that may be added to per-route configuration for @@ -79,4 +89,11 @@ // Username-password pairs for this route. config.core.v3.DataSource users = 1 [(validate.rules).message = {required: true}, (udpa.annotations.sensitive) = true]; + + // Per-route realm override for the ``WWW-Authenticate`` response header. If set, takes + // precedence over the filter-level ``BasicAuth.realm``. Same escaping semantics apply. + // If neither this nor the filter-level realm is set, the full request URI is used. + // Set a fixed realm to enable correct credential caching. The realm pattern dose not + // allow DEL, 32 C0 control chars including CRLF injection chars. + string realm = 2 [(validate.rules).string = {pattern: "^[^\\x00-\\x1f\\x7f]*$"}]; }

envoy/extensions/filters/http/compressor/v3/compressor.proto:

--- shake256:88198818f68c7bb6aaec8fcfb16a43209feb9eb510006e5a05ec4e9098101e6dfd5015112d0e231861cc39e12a46b630d9a103c42157953340980d9da3cf656a envoy/extensions/filters/http/compressor/v3/compressor.proto +++ shake256:755c91ec00e03c5ffcefc462558504d3ec1300866a9a88ba3eb946f1fb6cbc143a56f8178c9fd1c1e050e26d5ed657bc377ec773014421d23ce72da797bf446e envoy/extensions/filters/http/compressor/v3/compressor.proto @@ -4,6 +4,7 @@ import "envoy/config/core/v3/base.proto"; import "envoy/config/core/v3/extension.proto"; +import "envoy/type/matcher/v3/string.proto"; import "google/protobuf/wrappers.proto"; @@ -38,6 +39,8 @@ // direction this common config is applied to), in bytes, that will trigger compression. Defaults to 30. google.protobuf.UInt32Value min_content_length = 2; + // Using ``content_type`` is deprecated. Use ``content_type_matcher`` instead. + // // Set of strings that allows specifying which mime-types yield compression; e.g., // ``application/json``, ``text/html``, etc. // @@ -53,7 +56,17 @@ // * ``text/plain`` // * ``text/xml`` // - repeated string content_type = 3; + repeated string content_type = 3 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Allows specifying which content types yield compression using + // envoy.type.matcher.v3.StringMatcher. + // + // When this field is specified, the default content type list is not used. + // If both ``content_type`` and ``content_type_matcher`` are specified, + // ``content_type_matcher`` takes precedence and the deprecated ``content_type`` + // field is ignored. + repeated type.matcher.v3.StringMatcher content_type_matcher = 4; } // Configuration for filter behavior on the request direction.

envoy/extensions/filters/http/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:9abbc21d8abf790f661403eabb964d0e639ff04c4411c5bd7580483cda9296b56bf525831af47395d1f4c96e9b729e95eae77a062d01ef016d6816b31ba21173 envoy/extensions/filters/http/dynamic_modules/v3/dynamic_modules.proto +++ shake256:2dfca9444a089923c1a755c1fbdf192b8730abd6138ddd0ce38e192688c5a33a56680706f776874432cd966a343b5c129d0af379860d2c721a95d8ff1cac8c24 envoy/extensions/filters/http/dynamic_modules/v3/dynamic_modules.proto @@ -53,7 +53,8 @@ // ``filter_config`` can be used to configure the logging level or the header manipulation // behavior. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the plugin. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the plugin. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly without // the wrapper. // @@ -120,7 +121,8 @@ // manipulation. The ``filter_config`` can be used to configure the logging level or the header // manipulation behavior. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the plugin. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the plugin. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly without // the wrapper. //

envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto:

--- shake256:e715b7dc0ebb2593a30543e81b64a9684b22679d355cd23de58fa40040bf5dfe7eaae1c982f55fc94db512ce7d621d6aa17c925de7dc64f749f0a3f7eee65e92 envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto +++ shake256:47d9b45b6609bf2cdbc4b7ecce176c32b686cf33d8f787a557afe7c8e4f8e174d61e9732d6ea408f6d479d66078d2cdc96274677822dfd3009061569569e8f8e envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto @@ -30,7 +30,7 @@ // External Authorization :ref:`configuration overview <config_http_filters_ext_authz>`. // [#extension: envoy.filters.http.ext_authz] -// [#next-free-field: 33] +// [#next-free-field: 35] message ExtAuthz { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.http.ext_authz.v3.ExtAuthz"; @@ -101,6 +101,24 @@ // also use decoder_header_mutation_rules to restrict sensitive request header mutations. bool clear_route_cache = 6; + // A list of the request header names the routes match on. When this list is not empty and + // ``clear_route_cache`` is ``true``, an ``OK`` response clears the route cache only when it sets, + // appends, or removes one of these headers, or mutates a query parameter, rather than on any request + // mutation. This avoids re-resolving the route when the response only touches headers that no route + // matches on. + // + // If not specified, the route cache is cleared whenever an ``OK`` response sets, appends, or removes + // any request header, or mutates a query parameter. + // + // .. attention:: + // + // List every request header the routes match on. A route that matches on a header omitted here is + // not re-resolved when the authorization service mutates that header, which can route the request + // as if the mutation had not happened. + repeated string clear_route_cache_headers = 34 [(validate.rules).repeated = { + items {string {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}} + }]; + // Sets the HTTP status that is returned to the client when the authorization server returns an error // or cannot be reached. // @@ -397,6 +415,13 @@ // // Defaults to ``false``. bool shadow_mode = 32; + + // Whether to emit client-side spans for external authorization requests (e.g. gRPC or HTTP calls). + // When set to false, client-side egress spans will not be emitted/exported to trace collectors, + // but trace context (e.g. ``traceparent``) will still be propagated to the authorization server. + // + // If unset, defaults to ``true``. + google.protobuf.BoolValue emit_client_span = 33; } // Serialized form of the shadow-mode authorization decision written to FilterState @@ -624,7 +649,7 @@ } // Extra settings for the check request. -// [#next-free-field: 6] +// [#next-free-field: 7] message CheckSettings { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.http.ext_authz.v2.CheckSettings"; @@ -673,4 +698,7 @@ // Override with an HTTP service configuration. HttpService http_service = 5; } + + // Overrides the filter-level ``emit_client_span`` setting for this route. + google.protobuf.BoolValue emit_client_span = 6; }

envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto:

--- shake256:4ae5cb378355dc0289d4c97e1839b88232b4f650638b2ce8cab571040aa158bc84866ace6e79becba7cc0ea1198c2463240cdeefc38903ef7d98320f2f7f4c81 envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto +++ shake256:471e9f4568cee8c55789a48dd9d2977b05ddd06e1032aaf87760f50366e6c6eddd404c65d00f36b5ddb28751a8e3ed5b3ae28e79c976bfc515d8cd83cb98ced4 envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto @@ -98,7 +98,7 @@ // <arch_overview_advanced_filter_state_sharing>` object in a namespace matching the filter // name. // -// [#next-free-field: 27] +// [#next-free-field: 28] message ExternalProcessor { // Describes the route cache action to be taken when an external processor response // is received in response to request headers. @@ -386,6 +386,13 @@ // request smuggling. Thus, please use your own discretion when enabling this feature. // bool allow_content_length_header = 26; + + // Whether to emit client-side spans for external processing requests. + // When set to false, client-side egress spans will not be emitted/exported to trace collectors, + // but trace context (e.g. ``traceparent``) will still be propagated to the external processor. + // + // If unset, defaults to ``true``. + google.protobuf.BoolValue emit_client_span = 27; } // ExtProcHttpService is used for HTTP communication between the filter and the external processing service. @@ -416,7 +423,7 @@ // Describes which typed or untyped filter dynamic metadata namespaces to accept from // the external processing server. Set to empty or leave unset to disallow writing - // any received dynamic metadata. Receiving of typed metadata is not supported. + // any received dynamic metadata. MetadataNamespaces receiving_namespaces = 2; // Describes which cluster metadata namespaces to forward to @@ -467,7 +474,7 @@ } // Overrides that may be set on a per-route basis -// [#next-free-field: 10] +// [#next-free-field: 11] message ExtProcOverrides { // Set a different processing mode for this route than the default. ProcessingMode processing_mode = 1; @@ -514,4 +521,7 @@ // :ref:`processing_request_modifier <envoy_v3_api_field_extensions.filters.http.ext_proc.v3.ExternalProcessor.processing_request_modifier>`. config.core.v3.TypedExtensionConfig processing_request_modifier = 9 [(xds.annotations.v3.field_status).work_in_progress = true]; + + // Overrides the filter-level ``emit_client_span`` setting for this route. + google.protobuf.BoolValue emit_client_span = 10; }

envoy/extensions/filters/http/fault/v3/fault.proto:

--- shake256:943b936172d2c0860b92a0afa56913a1be1352d1271f46602903adbce38a51c7f651d973e5005f2e7baadee6391622726288c0f4b9481db3c1d6d01a6771b30a envoy/extensions/filters/http/fault/v3/fault.proto +++ shake256:96b60daf5dde95307b1ceae6ed9607f561179e136ae561122cefaf4ba42624e69f81e59ed7c0c1dfaa68fe4de4795c896f652bac6c73eccce166a0e3ba5d20a8 envoy/extensions/filters/http/fault/v3/fault.proto @@ -23,7 +23,7 @@ // Fault Injection :ref:`configuration overview <config_http_filters_fault_injection>`. // [#extension: envoy.filters.http.fault] -// [#next-free-field: 6] +// [#next-free-field: 7] message FaultAbort { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.http.fault.v2.FaultAbort"; @@ -54,6 +54,10 @@ // The percentage of requests/operations/connections that will be aborted with the error code // provided. type.v3.FractionalPercent percentage = 3; + + // The response body to be returned when aborting the request. + // If not specified, defaults to "fault filter abort". + string response_body = 6; } // [#next-free-field: 17]

envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.proto:

--- shake256:52635c541d6b7bcefc27115fef5270031bb2bc9ec24b2d93efd90e906cea870ba5b0040ea8fed4f7b6a9813369b6f22a385b05eba4b33f6beaa34d54c3358ac2 envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.proto +++ shake256:5dca22c6f661b75adf9bca0a6f5e200474aeb1b977cf6e03fb18ac8c1273940f67b3fcb3e3fdee91f7e46f820fa56f51b43c601b05f4c6947aee912b5c0b3d01 envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.proto @@ -23,7 +23,7 @@ // [#extension: envoy.filters.http.gcp_authn] // Filter configuration. -// [#next-free-field: 7] +// [#next-free-field: 9] message GcpAuthnFilterConfig { // The HTTP URI to fetch tokens from GCE Metadata Server(https://cloud.google.com/compute/docs/metadata/overview). // The URL format is "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=[AUDIENCE]" @@ -45,9 +45,14 @@ // Request header location to extract the token. By default (i.e. if this field is not specified), the token // is extracted to the Authorization HTTP header, in the format "Authorization: Bearer <token>". + // If ``token_metadata_key`` is set, this field takes no effect. // Not supported by all data planes. TokenHeader token_header = 4; + // Optional dynamic metadata key to save the token. The metadata uses the filter config name as the namespace. + // Takes precedence over ``token_header``. + string token_metadata_key = 7; + // Cluster to send traffic to the GCE metadata server. Not supported // by all data planes; a data plane may instead have its own mechanism // for contacting the metadata server. @@ -59,12 +64,28 @@ lt {seconds: 4294967296} gte {} }]; + + // Defines the authentication service. This field overrides the cluster's typed_filter_metadata definition. + Audience audience = 8; } // Audience is the URL of the receiving service that performs token authentication. // It will be provided to the filter through cluster's typed_filter_metadata. +// [#next-free-field: 6] message Audience { message AccessToken { + // Optional custom OAuth scopes for the access token request. + // If empty, the filter will not request scopes explicitly, so the metadata server's default + // scopes will be used. + // When populated, the filter appends "?scopes=<comma-separated-scopes>" to the + // metadata server token request. Note that the metadata server replaces default + // scopes with the provided list rather than appending; to preserve general GCP API + // access, callers should explicitly include "https://www.googleapis.com/auth/cloud-platform". + // Validation rules require each scope to be non-empty and disallow whitespace or commas, + // as commas are used as the delimiter for the metadata server and OAuth 2.0 scopes + // cannot contain whitespace (RFC 6749 Section 3.3). + repeated string scopes = 1 + [(validate.rules).repeated = {items {string {min_len: 1 pattern: "^[^\\s,]+$"}}}]; } message BoundJwt { @@ -73,6 +94,33 @@ } message BoundAccessToken { + // Optional custom OAuth scopes for the bound access token request. + // If empty, the filter will not request scopes explicitly, so the metadata server's default + // scopes will be used. + // When populated, the filter appends "&scopes=<comma-separated-scopes>" to the + // metadata server token request. Note that the metadata server replaces default + // scopes with the provided list rather than appending; to preserve general GCP API + // access, callers should explicitly include "https://www.googleapis.com/auth/cloud-platform". + // Validation rules require each scope to be non-empty and disallow whitespace or commas, + // as commas are used as the delimiter for the metadata server and OAuth 2.0 scopes + // cannot contain whitespace (RFC 6749 Section 3.3). + repeated string scopes = 1 + [(validate.rules).repeated = {items {string {min_len: 1 pattern: "^[^\\s,]+$"}}}]; + } + + // Default lifetime is 1h. + message IAMAccessToken { + // A template string for the account email or unique ID for which the credentials are requested, + // e.g. ``my-sa-%DYNAMIC_METADATA(my_filter:tenant_project)%@my-project.iam.gserviceaccount.com``. + string account = 1 [(validate.rules).string = {min_len: 1}]; + + // A template string for the authorization header value, + // e.g. ``Bearer %DYNAMIC_METADATA(gcp_authn:token)%``. + string authorization = 2 [(validate.rules).string = {min_len: 1}]; + + // Optional custom scopes for the token request. + // Default scope is https://www.googleapis.com/auth/cloud-platform. + repeated string scopes = 3; } // The audience URL, used for fetching unbound JWT token. @@ -89,6 +137,11 @@ // If defined, the filter will fetch bound Access Token instead of unbound. // It takes precedence over ``bound_jwt``, ``access_token`` and ``url``. BoundAccessToken bound_access_token = 4; + + // If defined, the filter will fetch an access token for a service account. + // It takes precedence over ``bound_access_token``, ``bound_jwt``, ``access_token``, and ``url``. + // Requires inlined audience definition in the filter configuration. + IAMAccessToken iam_access_token = 5; } // Token Cache configuration. @@ -99,13 +152,25 @@ } message TokenHeader { - // The HTTP header's name. - string name = 1 - [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}]; + // Configuration options for preserving an existing token header. + message PreserveExisting { + } + + // The HTTP header's name. Defaults to ``Authorization`` if not specified. + string name = 1 [ + (validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false ignore_empty: true} + ]; // The header's prefix. The format is "value_prefix<token>" // For example, for "Authorization: Bearer <token>", value_prefix="Bearer " with a space at the // end. string value_prefix = 2 [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE strict: false}]; + + // If set, the filter checks if the target header is already present (by header key existence, + // even if the header value is empty). If present, it skips token fetching and preserves the + // existing header intact (``value_prefix`` has no effect on the preserved header). If absent, + // a new token is fetched and written using ``name`` and ``value_prefix``. + // If not set, the default behavior is to unconditionally overwrite the header. + PreserveExisting preserve_existing = 3; }

envoy/extensions/filters/http/grpc_field_extraction/v3/config.proto:

--- shake256:47e47d602ed52567c8ea6649f1dadf18ed958b2ddff78b2376dfc19922a4f01817bae6250660ccf2b85c8fa98ef6db326105d33905c600727e4e7e9084855dda envoy/extensions/filters/http/grpc_field_extraction/v3/config.proto +++ shake256:c6eb550a79d59fd94336007ea8e7939f348ba56ff6946a93a697059168c7987cd7fc11a992edb294d13e1cf4a3bfa171580eacff93010e8776eed75d141d4765 envoy/extensions/filters/http/grpc_field_extraction/v3/config.proto @@ -68,6 +68,23 @@ // // 2. if the field value is empty, an empty ``Value`` will be set. // +// **IMPORTANT**: All extracted values are stored as ``ListValue``, even for singular (non-repeated) fields. +// Filters consuming this metadata (e.g., :ref:`ratelimit <envoy_v3_api_msg_extensions.filters.http.ratelimit.v3.RateLimit>`) +// must use :ref:`MetadataKey <envoy_v3_api_msg_type.metadata.v3.MetadataKey>` with an ``index`` segment to access the value. +// +// Example: to access a singular ``string tenant_id`` field extracted to ``envoy.filters.http.grpc_field_extraction``: +// +// .. code-block:: yaml +// +// metadata_key: +// key: envoy.filters.http.grpc_field_extraction +// path: +// - key: tenant_id +// - index: 0 # Required: unwrap the ListValue containing the singular value +// +// Omitting the ``index`` segment will cause the consumer to receive the ``ListValue`` itself rather than +// its element, which typically results in empty or incorrect metadata descriptor values. +// // Performance // ----------- // @@ -139,6 +156,37 @@ // "baz":[ // ] // } +// +// Normalizing the metadata key +// ---------------------------- +// +// By default the dynamic metadata key is the field path. ``metadata_key`` overrides it, which +// allows different gRPC methods to write the same logical value under a common key. +// +// .. code-block:: json +// +// { +// "descriptor_set":{}, +// "extractions_by_method":{ +// "pkg.svc.Method":{ +// "request_field_extractions":{ +// "nested.bar":{ +// "metadata_key":"bar" +// } +// } +// } +// } +// } +// +// writes +// +// .. code-block:: json +// +// { +// "bar":[ +// "val_bar1", "val_bar2" +// ] +// } message GrpcFieldExtractionConfig { // The proto descriptor set binary for the gRPC services. @@ -187,4 +235,14 @@ // Unimplemented. Uses "envoy.filters.http.grpc_field_extraction" for now. string dynamic_metadata = 1; } + + // The key that the extracted value is written to within the dynamic metadata. + // If empty, the field path (the key of ``request_field_extractions``) is used. + // + // This is useful for normalizing the metadata written by different gRPC methods whose + // request messages name the same logical field differently. + // + // Within a single gRPC method, two field extractions must not resolve to the same + // metadata key, otherwise the configuration is rejected. + string metadata_key = 2; }

envoy/extensions/filters/http/header_mutation/v3/header_mutation.proto:

--- shake256:bc32e26f241c733ed2ad7058be7245b29174a9b3a5e7e2fbaeea928da4ce0739672bb423ea15485dd903bb5f14fd126edac775dafd9a5d279b78a4c9756a1344 envoy/extensions/filters/http/header_mutation/v3/header_mutation.proto +++ shake256:defe095f840705fde06764b61993b1b63a99635418cd6eff220e8d8334a5aa736951e6b6e6965e598965b41437f2bbbe49719722399ac062e4d4fb82b9cea4cf envoy/extensions/filters/http/header_mutation/v3/header_mutation.proto @@ -4,6 +4,7 @@ import "envoy/config/common/mutation_rules/v3/mutation_rules.proto"; import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/extension.proto"; import "udpa/annotations/status.proto"; @@ -17,7 +18,7 @@ // Mutate HTTP headers and trailers in requests and responses. // [#extension: envoy.filters.http.header_mutation] -// [#next-free-field: 6] +// [#next-free-field: 7] message Mutations { // The request mutations are applied before the request is forwarded to the upstream cluster. repeated config.common.mutation_rules.v3.HeaderMutation request_mutations = 1; @@ -34,6 +35,15 @@ // The request trailer mutations are applied before the request is sent to the upstream cluster. repeated config.common.mutation_rules.v3.HeaderMutation request_trailers_mutations = 5; + + // Specifies a collection of Formatter plugins that can be used in substitution formatters + // in this message. + // If not specified, only the built-in command operators are available. + // Configured plugins take precedence over the built-in command operators. + // The plugins apply only to this message and are not inherited from other configuration levels. + // See the formatters extensions documentation for details. + // [#extension-category: envoy.formatter] + repeated config.core.v3.TypedExtensionConfig formatters = 6; } // Per route configuration for the header mutation filter.

envoy/extensions/filters/http/jwt_authn/v3/config.proto:

--- shake256:96cd7a468fdd66eab12305b1dc75a394fd726d1427fa3b2d02c073c76053a955cc574c57418fb1866696f3f738df2f650f173653972c91b5b97d372d22286eb8 envoy/extensions/filters/http/jwt_authn/v3/config.proto +++ shake256:480fe0447ce1c8c566a733d914442215bbf5edd7e6af6918efac4e807fe990abec31bb5e72d3c5decbdeb2f91056fc31f8d1a24700adb5a70bd750470c381948 envoy/extensions/filters/http/jwt_authn/v3/config.proto @@ -358,11 +358,12 @@ // Add JWT claim to HTTP Header // Specify the claim name you want to copy in which HTTP header. For examples, following config: - // The claim must be of type; string, int, double, bool. Array type claims are not supported + // Claims of type string, int, double and bool are copied verbatim. Claims of type array or + // object are serialized to JSON and copied base64-encoded. // // .. literalinclude:: /_configs/repo/jwt_authn.yaml // :language: yaml - // :lines: 44-48 + // :lines: 44-51 // :linenos: // :lineno-start: 44 // :caption: :download:`jwt_authn.yaml </_configs/repo/jwt_authn.yaml>` @@ -904,13 +905,58 @@ // This message specifies a combination of header name and claim name. message JwtClaimToHeader { + // Specifies a segment in a path for retrieving a claim from the JWT payload. + message PathSegment { + // The key to retrieve the value with in the enclosing JSON object. The key is matched in + // full, so it may itself contain dots. + string key = 1 [(validate.rules).string = {min_len: 1}]; + } + // The HTTP header name to copy the claim to. - // The header name will be sanitized and replaced. + // The header name is sanitized from the request for every provider configured on the filter + // (including on paths that bypass JWT verification) and then replaced with the claim value when + // verification succeeds. string header_name = 1 [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}]; - // The field name for the JWT Claim : it can be a nested claim of type (eg. "claim.nested.key", "sub") - // String separated with "." in case of nested claims. The nested claim name must use dot "." to separate - // the JSON name path. - string claim_name = 2 [(validate.rules).string = {min_len: 1}]; + // The name of the claim to copy, split on "." to address nested claims: ``sub`` selects the + // top-level ``sub`` claim, and ``nested.claim.key`` selects ``key`` inside ``claim`` inside + // ``nested``. + // + // Because the name is always split, a claim whose own name contains a dot -- a URL-namespaced + // claim such as ``http://example.org/parent_token`` -- is not addressable this way. Use + // :ref:`claim_path + // <envoy_v3_api_field_extensions.filters.http.jwt_authn.v3.JwtClaimToHeader.claim_path>` for + // those. + // + // Exactly one of ``claim_name`` and ``claim_path`` must be set. + string claim_name = 2; + + // The path to the claim to copy, given as an explicit list of segments. Each segment is matched + // in full against a key of the enclosing JSON object, so claim names containing dots are + // addressable. For the payload ``{"a.b": {"c.d": "x.y.z"}}``, the value ``x.y.z`` is selected + // by: + // + // .. code-block:: yaml + // + // claim_to_headers: + // - header_name: x-jwt-claim + // claim_path: + // - key: a.b + // - key: c.d + // + // and a URL-namespaced top-level claim by: + // + // .. code-block:: yaml + // + // claim_to_headers: + // - header_name: x-jwt-claim + // claim_path: + // - key: http://example.org/parent_token + // + // Exactly one of ``claim_name`` and ``claim_path`` must be set. + // + // [#comment: A ``min_items`` PGV rule cannot express this: a repeated field has no presence, so + // ``min_items: 1`` would make ``claim_path`` mandatory and reject every ``claim_name`` config.] + repeated PathSegment claim_path = 3; }

envoy/extensions/filters/http/local_ratelimit/v3/local_rate_limit.proto:

--- shake256:19ec3cf38907ae52aaec3e7ca8b03c11606425d9da90edc01a6922decf1e8c7962fa4b68dd625d9002863d5465c09eae29b724c4a4bffb7f3a718c936cc59614 envoy/extensions/filters/http/local_ratelimit/v3/local_rate_limit.proto +++ shake256:671c0c38410ba087095fcc257e77261d170bdca8d0ed3c3f9150e302792944f3ce16544a52738be37a92cb3b9dd5d33c40f05fa967695ae0d3b790b8479865ed envoy/extensions/filters/http/local_ratelimit/v3/local_rate_limit.proto @@ -23,7 +23,7 @@ // Local Rate limit :ref:`configuration overview <config_http_filters_local_rate_limit>`. // [#extension: envoy.filters.http.local_ratelimit] -// [#next-free-field: 19] +// [#next-free-field: 20] message LocalRateLimit { // The human readable prefix to use when emitting stats. string stat_prefix = 1 [(validate.rules).string = {min_len: 1}]; @@ -190,4 +190,13 @@ // values. // Minimum is 1. Default is 20. google.protobuf.UInt32Value max_dynamic_descriptors = 18 [(validate.rules).uint32 = {gte: 1}]; + + // Specifies whether the filter emits a ``Retry-After`` header when it enforces an HTTP 429 + // response. This option has no effect on responses with any other status code. The value is the + // number of seconds until the next token is available in the bucket that rejected the request, + // clamped to at least 1. + // If ``response_headers_to_add`` sets a ``Retry-After`` header, the filter does not overwrite it. + // + // Disabled by default. + bool enable_retry_after_header = 19; }

envoy/extensions/filters/http/lua/v3/lua.proto:

--- shake256:9a844d826893023debba55942b249a822aa24d24efc5df4df8fe21a2efb31a0ac07acb1ada1247ff21c8b1c8a7f508f25f01eff03b7f48c9417bb2ef412e5fb9 envoy/extensions/filters/http/lua/v3/lua.proto +++ shake256:d97a77149846ad07022885e6267e9a5eb5185a1ab83729a3d0dd4f2edd902d4fb00e923c90173539e72954d993c075ed1db05e5cdaf92a3e324fbd325c3edbe3 envoy/extensions/filters/http/lua/v3/lua.proto @@ -22,7 +22,7 @@ // Lua :ref:`configuration overview <config_http_filters_lua>`. // [#extension: envoy.filters.http.lua] -// [#next-free-field: 6] +// [#next-free-field: 10] message Lua { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.http.lua.v2.Lua"; @@ -88,8 +88,78 @@ // route cache automatically. // Default is true for backward compatibility. google.protobuf.BoolValue clear_route_cache = 5; + + // Optional filter context for the Lua script, accessed the same way as the per-route + // :ref:`filter_context + // <envoy_v3_api_field_extensions.filters.http.lua.v3.LuaPerRoute.filter_context>`, via + // ``handle:filterContext()``. This is the context a request gets when it has no + // ``LuaPerRoute`` configuration, or when the one it has does not set ``filter_context``. + // + // A ``LuaPerRoute`` which does set ``filter_context`` replaces this value rather than merging + // into it, so a route which sets an empty ``filter_context`` sees an empty context rather than + // this one. Only the most specific ``LuaPerRoute`` is consulted: a ``filter_context`` on a less + // specific one, such as a virtual host when the route has its own ``LuaPerRoute``, is not + // reached, and this value is used instead. + google.protobuf.Struct filter_context = 6; + + // Additional patterns for the Lua ``package.path`` of every VM this filter creates, so that a + // script can ``require`` modules from locations the interpreter does not search on its own. + // Each entry is one Lua path pattern; the entries are joined with ``;`` in the order given and + // placed ahead of the interpreter's built-in default path, which is kept. + // + // .. code-block:: yaml + // + // package_paths: + // - /etc/envoy/lua/?.lua + // - /etc/envoy/lua/?/init.lua + // + // The patterns are in place before any configured code runs, including the run that validates + // the configuration, so a ``require`` at the top level of a script whose module cannot be found + // is rejected as a configuration error rather than failing per request. + // + // Each worker builds its own VM and runs the script again to do so, after the configuration has + // been accepted, so the files a script requires must stay readable for as long as the process + // runs and not only while the configuration is loaded. + repeated string package_paths = 7 [(validate.rules).repeated = {items {string {min_len: 1}}}]; + + // As :ref:`package_paths + // <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.package_paths>`, but for + // ``package.cpath``, i.e. modules which are loadable C libraries rather than Lua source, for + // example ``/etc/envoy/lua/?.so``. + repeated string package_cpaths = 8 [(validate.rules).repeated = {items {string {min_len: 1}}}]; + + // If set, the Lua VMs this filter builds are shared with every other Lua filter configuration + // that sets the same ``shared_vm_id`` and configures the same script, rather than each + // configuration building its own. This applies to every script this message configures: + // :ref:`default_source_code + // <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.default_source_code>`, + // :ref:`inline_code <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.inline_code>` and + // every entry of :ref:`source_codes + // <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.source_codes>`. + // + // Sharing is decided per script, not per configuration: two configurations that agree on this + // id share a VM only for the scripts whose contents match, and whose :ref:`package_paths + // <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.package_paths>` and + // :ref:`package_cpaths + // <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.package_cpaths>` match, since a + // script that resolves its ``require`` calls differently does not produce an equivalent VM. + // A :ref:`LuaPerRoute.shared_vm_id + // <envoy_v3_api_field_extensions.filters.http.lua.v3.LuaPerRoute.shared_vm_id>` participates in + // the same sharing, so a route's inline script can reuse a VM built here and the other way + // around. + // + // A VM is not only an amount of memory, it is also a set of Lua globals that outlive a request. + // Scripts sharing a VM therefore see each other's globals, exactly as separate requests through + // one configuration already do. Leave this field unset, which is the default, to keep every + // configuration's scripts in VMs of their own. + // + // A shared VM lives for as long as at least one configuration using it is alive. Once the last + // one is drained the VM is torn down, and the next configuration asking for that id and script + // builds a fresh one. + string shared_vm_id = 9; } +// [#next-free-field: 8] message LuaPerRoute { oneof override { // Disable the Lua filter for this particular vhost or route. If disabled is specified in @@ -112,9 +182,42 @@ // // function envoy_on_request(request_handle) // local filter_context = request_handle:filterContext() - // local filter_context_value = filter_context["key"] + // local filter_context_value = filter_context:get("key") // -- Do something with filter_context_value. // end // + // This replaces the filter-level :ref:`filter_context + // <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.filter_context>` rather than merging + // into it. google.protobuf.Struct filter_context = 4; + + // Additional patterns for the Lua ``package.path`` of the VM built from this route's + // :ref:`source_code + // <envoy_v3_api_field_extensions.filters.http.lua.v3.LuaPerRoute.source_code>`, with the same + // meaning as the filter-level :ref:`package_paths + // <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.package_paths>`. + // + // This route's inline source code gets its own VM, which is why it needs its own patterns: the + // filter-level ones are not visible to it. Setting these has no effect when this route selects a + // script by :ref:`name + // <envoy_v3_api_field_extensions.filters.http.lua.v3.LuaPerRoute.name>`, or configures no script + // at all, since that VM belongs to the filter and carries the filter-level patterns. + repeated string package_paths = 5 [(validate.rules).repeated = {items {string {min_len: 1}}}]; + + // As :ref:`package_paths + // <envoy_v3_api_field_extensions.filters.http.lua.v3.LuaPerRoute.package_paths>`, but for + // ``package.cpath``. + repeated string package_cpaths = 6 [(validate.rules).repeated = {items {string {min_len: 1}}}]; + + // As :ref:`Lua.shared_vm_id + // <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.shared_vm_id>`, but for the VM built + // from this route's :ref:`source_code + // <envoy_v3_api_field_extensions.filters.http.lua.v3.LuaPerRoute.source_code>`. Routes and + // filter configurations share one pool of VMs, so a route setting the same id as a filter + // configuration reuses that configuration's VM when the script matches. + // + // Setting this has no effect when this route selects a script by :ref:`name + // <envoy_v3_api_field_extensions.filters.http.lua.v3.LuaPerRoute.name>`, or configures no + // script at all, since that VM belongs to the filter and follows the filter's setting. + string shared_vm_id = 7; }

envoy/extensions/filters/http/mcp/v3/mcp.proto:

--- shake256:808766396bbbebaa9e63f415dd311ee8a26a2537a290280f8269cc4b750d25970889e47e8c2ab1fd49574f6b1589f997f4ac796c6420b56eb2966ac40e643087 envoy/extensions/filters/http/mcp/v3/mcp.proto +++ shake256:0714db48ed84ae812c9f70b086a460cbd06cc56e8a9aec3d6c10eaa7ee5c9f0e4bbf316e51070cff08aeed02624a34e96956ddee5ff25aec0613a0e3deff93cc envoy/extensions/filters/http/mcp/v3/mcp.proto @@ -21,7 +21,7 @@ // [#extension: envoy.filters.http.mcp] // This filter will inspect and get attributes from MCP traffic. -// [#next-free-field: 9] +// [#next-free-field: 12] message Mcp { // Traffic handling mode for non-MCP traffic. enum TrafficMode { @@ -35,6 +35,11 @@ // - GET requests for SSE streams (with Accept: text/event-stream) // - DELETE requests for session termination (with MCP-Session-Id header) REJECT_NO_MCP = 1; + + // Disables MCP processing entirely. The filter performs no inspection, + // attribute extraction, trace context propagation, or rejection; all + // traffic is proxied as-is. + NOOP = 2; } // Where to store parsed MCP request attributes. @@ -53,6 +58,20 @@ DYNAMIC_METADATA_AND_FILTER_STATE = 3; } + // Source used to obtain MCP request attributes. + enum AttributeSource { + // Parse attributes from the request body and ignore MCP attribute headers. + BODY = 0; + + // Use MCP attribute headers and verify that values parsed from the body agree. + VERIFY = 1; + + // Trust MCP attribute headers for ``method`` and the method-specific + // identifier carried by ``Mcp-Name`` (``params.name``, ``params.uri``, or + // ``params.taskId``), and avoid parsing the body when nothing else requires it. + HEADERS = 2; + } + message TraceContextPropagationConfig { option (xds.annotations.v3.message_status).work_in_progress = true; } @@ -111,10 +130,46 @@ // If unset (default), do not extract or inject baggage. BaggagePropagationConfig propagate_baggage = 7; - // When true, reject requests that contain duplicate JSON keys at any - // nesting level. RFC 8259 Section 4 states that names within an object SHOULD be - // unique. Defaults to false (last-key-wins / last-win). + // When true, disallow requests that contain duplicate JSON keys at any + // nesting level. RFC 8259 Section 4 states that names within an object SHOULD + // be unique. Defaults to false (last-key-wins / last-win). If traffic mode is + // REJECT_NO_MCP, reject these requests; if PASS_THROUGH, log an error status + // but don't reject the request. google.protobuf.BoolValue reject_duplicate_keys = 8; + + // Controls whether MCP request attributes are obtained from the request body + // or from MCP request headers. Header-based extraction is limited to ``method`` + // and the method-specific identifier carried by ``Mcp-Name``; other configured + // extraction rules still require body parsing. + AttributeSource attribute_source = 9 [(validate.rules).enum = {defined_only: true}]; + + // When true, stop parsing (and buffering) the request body as soon as all the + // required routing attributes for the request's method have been collected + // (for example ``method`` and ``params.name`` for ``tools/call``), even if + // optional attributes such as ``params._meta`` or the remainder of the body + // have not been parsed yet. This decouples routing from body size, so a large + // trailing payload (for example ``params.arguments``) does not need to be + // buffered at the proxy just to route the request. + // + // Early termination is intentionally skipped when it could change observable + // behavior, so it has no effect when any of the following holds: + // + // - ``reject_duplicate_keys`` is set (duplicate detection needs a full-body scan); + // - ``propagate_trace_context`` or ``propagate_baggage`` is set (both read + // ``params._meta``, which may appear after the routing attributes); + // - ``attribute_source`` is not ``BODY``. + // + // Requests whose body arrives complete in a single chunk are unaffected, since + // the whole root object is observed before iteration continues. + // + // Defaults to false. + bool early_terminate_when_routable = 10; + + // The latest MCP protocol revision supported by the filter. + // + // Requests using a known protocol revision newer than this value are rejected. + // When unset, no protocol-version restriction is applied. + google.protobuf.StringValue max_supported_protocol_version = 11; } // Parser configuration with method-specific rules. @@ -156,12 +211,25 @@ } // Per-route override configuration for MCP filter +// [#next-free-field: 7] message McpOverride { - // Optional per-route traffic mode override + // Overrides the global traffic mode for this route. Mcp.TrafficMode traffic_mode = 1 [(validate.rules).enum = {defined_only: true}]; // Optional per-route max request body size override. // When set, this overrides the global max_request_body_size for this route. // It defaults to 8KB (8192 bytes) and the maximum allowed value is 10MB (10485760 bytes). google.protobuf.UInt32Value max_request_body_size = 2 [(validate.rules).uint32 = {lte: 10485760}]; + + // Overrides the global clear_route_cache setting for this route. + bool clear_route_cache = 3; + + // Overrides the global parser config for this route. + ParserConfig parser_config = 4; + + // Overrides the global request storage mode for this route. + Mcp.RequestStorageMode request_storage_mode = 5 [(validate.rules).enum = {defined_only: true}]; + + // Overrides the global reject_duplicate_keys setting for this route. + bool reject_duplicate_keys = 6; }

envoy/extensions/filters/http/mcp_json_rest_bridge/v3/mcp_json_rest_bridge.proto:

--- shake256:5aee9cad0f35c68f9a54ca9dcf19c9875fb92140c560ba5bce1216e5e1bab0155f2684c448b641bcd675e1f9f4b1bce8ac0c3c7ec8c965a9d6968357df193e5b envoy/extensions/filters/http/mcp_json_rest_bridge/v3/mcp_json_rest_bridge.proto +++ shake256:b8cc3aad08e373430341aa271264b049929ebce00d1e2f69771e1f970604efba7396bd0cc8e5dee629c1c556c817423dfac16bbce88ab7081e40888c3f59a51e envoy/extensions/filters/http/mcp_json_rest_bridge/v3/mcp_json_rest_bridge.proto @@ -2,6 +2,7 @@ package envoy.extensions.filters.http.mcp_json_rest_bridge.v3; +import "google/protobuf/duration.proto"; import "google/protobuf/wrappers.proto"; import "xds/annotations/v3/status.proto"; @@ -19,6 +20,18 @@ // [#protodoc-title: MCP JSON REST Bridge] // [#extension: envoy.filters.http.mcp_json_rest_bridge] +// The cache scope of a cacheable MCP result, emitted as the ``cacheScope`` result field. +enum CacheScope { + // Unspecified. Treated as ``CACHE_SCOPE_PUBLIC``. + CACHE_SCOPE_UNSPECIFIED = 0; + + // The result may be stored in a shared cache and reused across clients. + CACHE_SCOPE_PUBLIC = 1; + + // The result may only be stored in a per-client cache. + CACHE_SCOPE_PRIVATE = 2; +} + // Configuration for the MCP MCP JSON REST Bridge. // // This extension translates Model Context Protocol (MCP) JSON-RPC requests into standard JSON-REST @@ -90,7 +103,7 @@ // - Body: {"data": "updated value"} // (Only the "payload" field from arguments is used as the body. Other arguments not in the // path, like 'resource_id', become query parameters.) -// [#next-free-field: 8] +// [#next-free-field: 9] message McpJsonRestBridge { // Where to store parsed MCP request attributes. enum RequestStorageMode { @@ -146,25 +159,40 @@ // When set to true, the filter will not clear the route cache after transcoding. // This allows the route to be re-selected based on the updated request path or method. bool disable_clear_route_cache = 7; + + // When set to true, the filter will take no action unless per-route config is available. + bool per_route_only = 8; } // Options for trace context extraction. message TraceContextExtractionOptions { } +// Cache configuration for a locally-generated, cacheable MCP result. +message CacheConfig { + // How long the result may be reused, emitted as the MCP ``ttlMs`` result field. + // + // If not provided: Defaults to 0, meaning clients should revalidate before reusing the result. + google.protobuf.Duration ttl = 1 [(validate.rules).duration = {gte {}}]; + + // The cache scope of the result. + // + // If not provided: Defaults to ``CACHE_SCOPE_PUBLIC``. + CacheScope cache_scope = 2 [(validate.rules).enum = {defined_only: true}]; +} + // Configuration for the server metadata. message ServerInfo { - // [#not-implemented-hide:] - // [#comment:TODO(guoyilin42): Implement supported_protocol_versions] - // Lists the MCP protocol versions supported by this MCP endpoint. - // - // - If provided: The extension enforces version negotiation according to the MCP specification: - // https://modelcontextprotocol.io/specification/2025-11-25/basic/lifecycle#version-negotiation - // - If not provided: The extension accepts any version sent by the client during negotiation and - // skips validation of the mcp-protocol-version header on subsequent requests. + // The maximum MCP protocol version supported by this MCP endpoint. // - // Example values: ["2025-11-25", "2025-06-18"] - repeated string supported_protocol_versions = 1; + // Supported values are ``2025-11-25`` and ``2026-07-28``. Versions prior + // to ``2025-11-25`` are rejected because the filter unconditionally supports features + // up to ``2025-11-25`` and does not support downgrading below that baseline. + // If not provided: Defaults to ``2025-11-25``. + // + // Example value: "2026-07-28" + google.protobuf.StringValue max_supported_protocol_version = 1 + [(validate.rules).string = {in: "2025-11-25" in: "2026-07-28"}]; // [#not-implemented-hide:] // [#comment:TODO(guoyilin42): Implement description] @@ -175,10 +203,15 @@ // // - If provided: The extension uses this version as the fallback protocol version. // - If not provided: The extension uses the fallback protocol version defined in the latest MCP - // specification. For example, the current latest 2025-11-25 specification designates "2025-03-26" + // specification. For example, the current latest 2026-07-28 specification designates "2025-03-26" // as the fallback protocol version. - // See https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#protocol-version-header + // See https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http#protocol-version-header google.protobuf.StringValue fallback_protocol_version = 3; + + // Cache configuration advertised in locally-generated ``server/discover`` responses. + // + // If not provided: the response advertises ``ttlMs: 0`` and ``cacheScope: public``. + CacheConfig server_discovery_cache_config = 4; } // Configuration for sending locally-generated responses to tools/list requests. @@ -212,8 +245,7 @@ ToolsListLocal tool_list_local = 4; } - // [#not-implemented-hide:] - // Default server info for tools without specific ones. + // Default server info for tools without specific ones. If not provided, a fallback path of '/mcp' will be used. McpServerInfo default_server_info = 5; } @@ -223,7 +255,7 @@ string title = 1; // Human-readable description of functionality. - string description = 2 [(validate.rules).string = {min_len: 1}]; + string description = 2; // A JSON Schema describing expected parameters, as a serialized JSON string, in the JSON Schema // 2020-12 dialect. This should be raw JSON, including the "properties" and "required" keys, but @@ -257,6 +289,10 @@ // When enabled, the response body is streamed directly to the client without buffering. Each // chunk is JSON escaped as it arrives and wrapped with a pre-built JSON-RPC prefix and suffix. // + // For Server-Sent Events (SSE) responses (i.e. ``text/event-stream`` content type), Envoy parses + // the stream and wraps each extracted complete event payload into a distinct text content item + // within the JSON-RPC ``content`` array on the fly. + // // Streaming flow: // // .. code-block:: text @@ -284,8 +320,46 @@ // - If specify a field: Only that specific argument becomes the HTTP JSON body. // - If empty: No body is sent. // 3. Query: Any leaf arguments not mapped to Path or Body are added as URL query parameters. -// [#next-free-field: 7] +// [#next-free-field: 8] message HttpRule { + // Represents a mapping from a request message field to an HTTP element. + // If the specified argument is missing from the tools/call request, the binding is silently + // ignored and the corresponding HTTP element (header or cookie) is not added. + message ParameterBinding { + // The target HTTP element type to bind to. + enum Type { + // Unspecified element type. + TYPE_UNSPECIFIED = 0; + + // The argument value is bound to an HTTP request header. + // Conceptually maps to an OpenAPI parameter with ``in: header``. + HEADER = 1; + + // The argument value is bound to an HTTP request cookie. + // Conceptually maps to an OpenAPI parameter with ``in: cookie``. + COOKIE = 2; + } + + // The type of the HTTP element to bind to. + Type type = 1; + + // The name of the HTTP header (e.g., "X-API-Key", "Authorization") or the + // name of the cookie (e.g.,"SESSION_ID"). Note: Envoy normalizes the header names to lowercase. + // The following headers are reserved for Envoy's internal use and cannot be overridden by + // bindings: ``content-length``, ``transfer-encoding``, ``host``, ``:authority``, ``cookie``, + // ``accept-encoding``, and any header starting with ``x-envoy-``. Attempting to bind to these + // will be ignored. + string name = 2 + [(validate.rules).string = + {min_len: 1 max_bytes: 16384 well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // Path to the field within the JSON arguments object from a tools/call + // request. Uses dot-notation for nested fields. + // E.g. if arguments object is ``{"user":{"auth_token":"foo"}}``, then + // ``argument_path`` should be "user.auth_token". + string argument_path = 3 [(validate.rules).string = {min_len: 1}]; + } + // Determines the HTTP method and the URL path template. // // Path templating uses curly braces ``{}`` to mark a section of the URL path as replaceable. @@ -319,6 +393,10 @@ // fields (e.g., "user.data" maps the value of the "data" field inside "user"). // - If omitted: There is no HTTP request body; fields not in the path become query parameters. string body = 6; + + // Bindings to extract values from the 'arguments' object of a tools/call + // request and inject them as HTTP elements. + repeated ParameterBinding bindings = 7; } // Per-route override configuration for the MCP JSON REST Bridge filter.

envoy/extensions/filters/http/mcp_router/v3/mcp_router.proto:

--- shake256:4784eabf7fac5ec895c3fb78a6229e0ba47d006a9141ac3554c3ae6b4819aa1df5928d227a32e0705d707aeeca69b5bd2ff5127c9af2148d32d6a8a052c2e951 envoy/extensions/filters/http/mcp_router/v3/mcp_router.proto +++ shake256:215924db62d3fceb150319e0f9426b9ccf5056399ed051eae3252cde40bfc9476a15ce3c50047e6132875e8ab586c86bdb31e03297186593e6da09ece69f47c8 envoy/extensions/filters/http/mcp_router/v3/mcp_router.proto @@ -2,6 +2,7 @@ package envoy.extensions.filters.http.mcp_router.v3; +import "envoy/type/matcher/v3/string.proto"; import "envoy/type/metadata/v3/metadata.proto"; import "google/protobuf/duration.proto"; @@ -98,6 +99,15 @@ // Backend target specification. McpCluster mcp_cluster = 2; + + // Controls which downstream request headers are forwarded to this backend. + // If not set, no downstream-controlled headers are forwarded beyond those the + // router itself must synthesize (e.g. ``content-type``, ``accept``, the session + // header) — in particular, a client's ``authorization`` header is NOT forwarded + // by default. Router-owned, framing, session, and hop-by-hop headers are never + // affected by this policy; they are handled separately and can never be forwarded + // via this mechanism. + HeaderForwarding header_forwarding = 3; } // Cluster-based backend configuration. @@ -117,6 +127,40 @@ string host_rewrite_literal = 4; } + // Specifies which downstream request headers are allowed to be forwarded to an MCP + // backend. Modeled after + // :ref:`ext_proc's HeaderForwardingRules <envoy_v3_api_msg_extensions.filters.http.ext_proc.v3.ExternalProcessor>`, + // but MCP-local and secure-by-default: unlike ext_proc, an unset/empty policy + // forwards nothing rather than everything, because MCP requires audience-bound + // tokens and prohibits implicit token passthrough between a client and a backend it + // did not authenticate to. + // + // Evaluation order per header: + // + // 1. If the header matches ``disallowed_headers``, it is never forwarded — this + // takes precedence over everything below, including ``forward_all``. + // 2. Otherwise, if ``forward_all`` is true, the header is forwarded. + // 3. Otherwise, if the header matches ``allowed_headers``, it is forwarded. + // 4. Otherwise, the header is not forwarded. + // + // This does not cover header *mutation* or credential injection, which remain a + // separate concern from this filter's forwarding policy. + message HeaderForwarding { + // If true, forward all downstream request headers to this backend (subject to + // ``disallowed_headers`` above), matching the legacy forward-everything behavior. + // Defaults to false. Users relying on the legacy behavior must set this explicitly. + bool forward_all = 1; + + // If set, specifically allow any header in this list to be forwarded. Ignored for a + // header that also matches ``disallowed_headers``, and redundant (but harmless) for + // any header covered by ``forward_all``. + type.matcher.v3.ListStringMatcher allowed_headers = 2; + + // If set, specifically disallow any header in this list from being forwarded. This + // takes precedence over both ``forward_all`` and ``allowed_headers``. + type.matcher.v3.ListStringMatcher disallowed_headers = 3; + } + // A list of remote MCP servers. MCP router aggregates capabilities, tools and resources from remote MCP servers // and presents itself as single MCP server to the client. All remote MCP servers are sent the same capabilities // that the client presented to Envoy.

envoy/extensions/filters/http/oauth2/v3/oauth.proto:

--- shake256:1e855d9dc76a5577eb5c8291d2277659417251743ef7779a6f5cee92f01c9d87b003e978b9f66f7cbd6e2443cb7069e04182cd6133b0f9792b1bc405463fd5e7 envoy/extensions/filters/http/oauth2/v3/oauth.proto +++ shake256:8789f8a8766b74d0084215b44531f7583fab7d7fda35d1e18d3ea5f9315b3ecb4c0e817d3acc110d0891cfe01ce4b2ab27fd18b9fe63a78beefa95a9918fad04 envoy/extensions/filters/http/oauth2/v3/oauth.proto @@ -130,7 +130,20 @@ // This field is required unless :ref:`auth_type <envoy_v3_api_field_extensions.filters.http.oauth2.v3.OAuth2Config.auth_type>` // is set to ``TLS_CLIENT_AUTH``, in which case authentication is done via the client certificate. // When ``auth_type`` is ``PRIVATE_KEY_JWT``, this field must contain the PEM-encoded private key - // used to sign the JWT client assertion. + // used to sign the JWT client assertion. The key may be supplied in either of two forms: + // + // * As a single-value generic secret holding the PEM-encoded private key. No ``kid`` header + // parameter is included in the client assertion. + // * As a multi-entry generic secret with a ``private_key`` entry holding the PEM-encoded private + // key and an optional ``key_id`` entry. When present, the ``key_id`` value is set as the + // ``kid`` header parameter of the client assertion, per + // `RFC 7515 Section 4.1.4 <https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.4>`_. + // Identity providers use it to select the correct verification key when more than one key is + // registered for the client. Distributing both in one secret means the key ID is always + // rotated together with the key it identifies. + // + // The multi-entry form is only read when ``auth_type`` is ``PRIVATE_KEY_JWT``. The other auth + // types read the single-value form only. transport_sockets.tls.v3.SdsSecretConfig token_secret = 2; // Configures how the secret token should be created. @@ -184,6 +197,20 @@ // The value is truncated to whole seconds, so it must be at least ``1s`` when set. // Default: ``60s``. google.protobuf.Duration assertion_lifetime = 2 [(validate.rules).duration = {gte {seconds: 1}}]; + + // The value to use as the ``aud`` (audience) claim in the JWT client assertion. + // + // `RFC 7523 Section 3 <https://datatracker.ietf.org/doc/html/rfc7523#section-3>`_ requires the + // ``aud`` claim to identify the authorization server, and allows the token endpoint URL to be + // used for this purpose. + // `RFC 9126 Section 2.1 <https://datatracker.ietf.org/doc/html/rfc9126#section-2.1>`_ recommends + // the authorization server's issuer identifier instead, and + // `FAPI 2.0 <https://openid.net/specs/fapi-security-profile-2_0-final.html>`_ requires it, as a + // single canonical value identifies the server regardless of which endpoint receives the + // assertion. + // + // If not set, defaults to the configured ``token_endpoint`` URI. + string assertion_audience = 3; } // Defines how an OAuth token is forwarded upstream. @@ -213,9 +240,32 @@ } } +// Splits OAuth token cookies that are too large for a browser to store. +// +// A token that fits in one cookie is written as a single cookie, as without chunking. A larger +// token is written as ``<name>_0`` to ``<name>_N-1``, plus a ``<name>_chunks`` cookie that holds +// the count ``N``. If a token needs more than +// :ref:`max_chunks <envoy_v3_api_field_extensions.filters.http.oauth2.v3.TokenCookieChunking.max_chunks>` +// cookies, the filter responds with ``503`` instead of setting cookies that the client would drop. +// +// Chunked cookies add to the request header size. A session with more than one large token may +// need a larger :ref:`max_request_headers_kb +// <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.max_request_headers_kb>`. +message TokenCookieChunking { + // The largest cookie Envoy writes for a token, counting its name, value and attributes. A token + // whose cookie would be larger is split. Defaults to ``4096``, the limit browsers enforce. + google.protobuf.UInt32Value max_cookie_size = 1 [(validate.rules).uint32 = {lte: 4096 gte: 512}]; + + // The most cookies a single token is split into. Defaults to ``8``. + // + // Envoy rejoins up to 16 chunks on requests regardless of this value, so lowering it does not + // invalidate existing sessions. + google.protobuf.UInt32Value max_chunks = 2 [(validate.rules).uint32 = {lte: 16 gte: 2}]; +} + // OAuth config // -// [#next-free-field: 34] +// [#next-free-field: 35] message OAuth2Config { enum AuthType { // The ``client_id`` and ``client_secret`` will be sent in the URL encoded request body. @@ -446,6 +496,16 @@ // Only used when :ref:`auth_type <envoy_v3_api_field_extensions.filters.http.oauth2.v3.OAuth2Config.auth_type>` // is set to ``PRIVATE_KEY_JWT``. PrivateKeyJwtConfig private_key_jwt_config = 32; + + // If set, an access, ID or refresh token cookie that is larger than + // :ref:`max_cookie_size <envoy_v3_api_field_extensions.filters.http.oauth2.v3.TokenCookieChunking.max_cookie_size>` + // is split across multiple cookies. If not set, every token is written as a single cookie, + // which a browser drops when it is larger than 4096 bytes. + // + // Envoy always rejoins chunked token cookies on requests, whether or not this is set, so it can + // be removed safely. In a rolling upgrade, set it only after every Envoy that may serve the same + // client understands chunked cookies. + TokenCookieChunking token_cookie_chunking = 34; } // Per-route OAuth2 config.

envoy/extensions/filters/http/rate_limit_quota/v3/rate_limit_quota.proto:

--- shake256:28bd12f97bccae3aa606022c3f09d1d4acade512e586542287c6e6af79242d005caaa91ff24ae517a498d38a63e34906ac899f286461d4701c824be602b0a24b envoy/extensions/filters/http/rate_limit_quota/v3/rate_limit_quota.proto +++ shake256:bf95c1ca561ecc655f47a4e5221ddef23cb62faf0ff6388cdf2b51bcf34f5ab4702411cd94f5e0a5e7889a8cf90a57e30c400bbe7e5e0b32caad87e202f67172 envoy/extensions/filters/http/rate_limit_quota/v3/rate_limit_quota.proto @@ -12,7 +12,6 @@ import "google/protobuf/wrappers.proto"; import "google/rpc/status.proto"; -import "xds/annotations/v3/status.proto"; import "xds/type/matcher/v3/matcher.proto"; import "udpa/annotations/status.proto"; @@ -23,7 +22,6 @@ option java_multiple_files = true; option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/rate_limit_quota/v3;rate_limit_quotav3"; option (udpa.annotations.file_status).package_version_status = ACTIVE; -option (xds.annotations.v3.file_status).work_in_progress = true; // [#protodoc-title: Rate Limit Quota] // Rate Limit Quota :ref:`configuration overview <config_http_filters_rate_limit_quota>`.

envoy/extensions/filters/http/ratelimit/v3/rate_limit.proto:

--- shake256:dc3c8e72fda2ad3e68389021ba3c98c2fa6f659c2fe66962bf5c4a61f374cb5d4767608acc4996f5df6fea29e7bcd82f44776c7fbf5cceeb2afbb5fec211b373 envoy/extensions/filters/http/ratelimit/v3/rate_limit.proto +++ shake256:292e42dde6932c1148c0c59b3fd91973c690820e8908070d383c1e4dc7eec495a3f07018c61c578b282c22dafeaf83f102500784cfeb90ef9ed269abb7c5e038 envoy/extensions/filters/http/ratelimit/v3/rate_limit.proto @@ -23,7 +23,7 @@ // Rate limit :ref:`configuration overview <config_http_filters_rate_limit>`. // [#extension: envoy.filters.http.ratelimit] -// [#next-free-field: 19] +// [#next-free-field: 20] message RateLimit { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.http.rate_limit.v2.RateLimit"; @@ -190,6 +190,16 @@ // The namespace where dynamic metadata from rate limit response is saved. // If not set, the default is "envoy.filters.http.ratelimit". string metadata_namespace = 18; + + // Specifies whether the filter emits a ``Retry-After`` header when it enforces an HTTP 429 + // response. This option has no effect on responses with any other status code. The value is the + // largest ``duration_until_reset`` among the over-limit descriptor statuses returned by the rate + // limit service, expressed in seconds and clamped to at least 1. The header is not emitted when no + // over-limit descriptor status is present. + // If the rate limit service returns a ``Retry-After`` header, the filter does not overwrite it. + // + // Disabled by default. + bool enable_retry_after_header = 19; } message RateLimitPerRoute {

envoy/extensions/filters/listener/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:db215158abc795f16af911490b416d119eccc3ec6d16fe9d6a094f76db6ea54c007d28d77ae1b70529f7ba12ea94df50f80c49bfdcdd5267e9de43bda3b58b47 envoy/extensions/filters/listener/dynamic_modules/v3/dynamic_modules.proto +++ shake256:bb27c6ce8e6b0e1896bf9c84bbdd8ff0bbc9232ff56dd79d741cd58c8359b9aeeab360d902e99ff96ecf5e8123fc57923d0eeb8cd1ccc9b2dfc070ac32278fdc envoy/extensions/filters/listener/dynamic_modules/v3/dynamic_modules.proto @@ -53,7 +53,8 @@ // rate limiting, ``filter_name`` is used to choose either TLS or rate limiting. The ``filter_config`` // can be used to configure the TLS inspection options or the rate limiting parameters. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/filters/network/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:a57d27a8b05774d301f856d2f82d3f94ab03fbcd8b9d188f3edd115325f9054463979c76015c671ebd4cc35c960fd035c8a5049716f71abc97bd332996de3bd2 envoy/extensions/filters/network/dynamic_modules/v3/dynamic_modules.proto +++ shake256:559ebcaa55111ab6468aa3becc83cee62b89554441a4c3f3bbc949a5c06c804af371828dde55be57224733c59abb4eb046427361d8a0edef8ce9f8ee459007b4 envoy/extensions/filters/network/dynamic_modules/v3/dynamic_modules.proto @@ -52,7 +52,8 @@ // limiting, ``filter_name`` is used to choose either echo or rate limiting. The // ``filter_config`` can be used to configure the echo behavior or the rate limiting parameters. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/filters/network/ext_authz/v3/ext_authz.proto:

--- shake256:abfd42b3e363fbe849273f3400b4557ff8c511986893e362f7a3c524a33f10bc770a0e54e3160a7e02ad187d67b3d9fd38ae158946b5b38277065a2d0bfde960 envoy/extensions/filters/network/ext_authz/v3/ext_authz.proto +++ shake256:3cf58f3f20d249c51043cd45dc319779001d676c9496a820b242ca3271fdd6df5d2672b8680db80d48c77d43da36d2137ddb8353952e83745219860a0ab131b7 envoy/extensions/filters/network/ext_authz/v3/ext_authz.proto @@ -24,8 +24,9 @@ // External Authorization filter calls out to an external service over the // gRPC Authorization API defined by // :ref:`CheckRequest <envoy_v3_api_msg_service.auth.v3.CheckRequest>`. -// A failed check will cause this filter to close the TCP connection. -// [#next-free-field: 12] +// A failed check will cause this filter to close the TCP connection, unless ``shadow_mode`` is +// enabled. +// [#next-free-field: 13] message ExtAuthz { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.network.ext_authz.v2.ExtAuthz"; @@ -100,4 +101,13 @@ // the protobuf message definition in order to perform safe parsing. // repeated string typed_metadata_context_namespaces = 11; + + // When set to ``true``, the filter operates in shadow mode. The filter still calls the external + // authorization service but never closes the connection. The authorization decision is instead + // recorded in the connection's :ref:`FilterState <arch_overview_data_sharing_between_filters>` + // under the key ``envoy.filters.network.ext_authz`` so that a subsequent filter can read and + // optionally enforce it. + // + // Defaults to ``false``. + bool shadow_mode = 12; }

envoy/extensions/filters/network/ext_proc/v3/ext_proc.proto:

--- shake256:680442ffbffbd96a2d6cfaaa1efb97f319bb1e1728c5b10028f95e4d3ca011f618bdb38435ae7ac7d8cfa919a41064b52a90b6eec609b9ed12b6692633ae49ab envoy/extensions/filters/network/ext_proc/v3/ext_proc.proto +++ shake256:cc3a720d04c0e522647d43261115f11d2b41a64d6c7a5670d69b0acf4abdfada1d10c21a120270acfc3b9adfd3b7307f8361df4bf40dd0715ebde4f1ae634e34 envoy/extensions/filters/network/ext_proc/v3/ext_proc.proto @@ -34,7 +34,7 @@ // // By using the filter's processing mode, you can selectively choose which data // directions to process (read, write or both), allowing for efficient processing. -// [#next-free-field: 7] +// [#next-free-field: 8] message NetworkExternalProcessor { // The gRPC service that will process network traffic. // This service must implement the NetworkExternalProcessor service @@ -64,6 +64,14 @@ // Options related to the sending and receiving of dynamic metadata. MetadataOptions metadata_options = 6; + + // The data plane provides a number of :ref:`attributes <arch_overview_attributes>` + // for expressive policies. Each attribute name provided in this field will be + // evaluated against the connection and filter state and populated in the + // :ref:`ProcessingRequest.attributes <envoy_v3_api_field_service.network_ext_proc.v3.ProcessingRequest.attributes>` field. + // See the :ref:`attribute documentation <arch_overview_attributes>` + // for the list of supported attributes and their types. + repeated string connection_attributes = 7; } // Options for controlling processing behavior.

envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto:

--- shake256:95ea3b89fcffe04a590089cfea147025b8e96d0000467fea10539f5824c9002a55b828d8c3b8bc2e504a2962a5b229e3bce79cad9746661a1d12a548af8965e5 envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto +++ shake256:86affc73c5bb63a417da41b833f706c43013693045ce97dddb2d58dcf8952cd6874d2697b59c83578128cfa2193c9236c5b4e1a419ae969fd1df9315fde2c205 envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto @@ -39,7 +39,7 @@ // HTTP connection manager :ref:`configuration overview <config_http_conn_man>`. // [#extension: envoy.filters.network.http_connection_manager] -// [#next-free-field: 63] +// [#next-free-field: 64] message HttpConnectionManager { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager"; @@ -283,7 +283,7 @@ repeated config.core.v3.CidrRange cidr_ranges = 2; } - // [#next-free-field: 8] + // [#next-free-field: 9] message SetCurrentClientCertDetails { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager." @@ -313,6 +313,9 @@ // false. bool uri = 5; + // Whether to forward the issuer of the client cert. Defaults to false. + bool issuer = 8; + // The format for the header. When the :ref:`forward_client_cert_details // <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.forward_client_cert_details>` // is APPEND_FORWARD and an existing XFCC header is present, the format of the existing header @@ -1128,6 +1131,11 @@ // If not configured, defaults to disabled and the standard behavior applies (using connection // TLS status or trusted downstream headers). ForwardProtoConfig forward_proto_config = 61; + + // If true, records two per stream histograms, ``downstream_rq_route_resolution_time_us`` for the + // total wall time spent resolving the route and ``downstream_rq_route_resolutions`` for the number + // of resolutions. Defaults to false, so the default stat set is unchanged. + bool record_route_resolution_stats = 63; } // Configuration options for setting the ``x-forwarded-proto`` header.

envoy/extensions/filters/network/redis_proxy/v3/redis_proxy.proto:

--- shake256:338225826a4001053668b439d7bde202bd2c7ad1c91debd6345db3d2ab25fddc7417edf2aa65a2b7874188333b4430c04e93b5f21b150f856275d7a0a6259498 envoy/extensions/filters/network/redis_proxy/v3/redis_proxy.proto +++ shake256:645d441d2b0d63f29153759dbb3bf26dd41ad19052f28a3309257d4cc452d08b5121b0a42b1f73b16b4f1438d15a4b08161887f607528676dc6b98efb045d639 envoy/extensions/filters/network/redis_proxy/v3/redis_proxy.proto @@ -28,11 +28,32 @@ // Redis Proxy :ref:`configuration overview <config_network_filters_redis_proxy>`. // [#extension: envoy.filters.network.redis_proxy] -// [#next-free-field: 12] +// [#next-free-field: 13] message RedisProxy { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.network.redis_proxy.v2.RedisProxy"; + // RESP protocol version supported on this listener. + enum ProtocolVersion { + // Default. The listener speaks RESP2 on both downstream connections and + // every routed upstream conn pool: no ``HELLO 3`` is sent upstream and a + // downstream ``HELLO 3`` is rejected with ``-NOPROTO``. (RESP3-aware + // handling such as the local ``HELLO`` reply, ``CLIENT SETINFO`` / + // ``SETNAME`` acceptance, and the RESP3 decoder is always present; this + // value only controls the negotiated wire version.) + RESP2 = 0; + + // The listener speaks RESP3 on both downstream connections and every + // routed upstream conn pool. Upstream conn pools negotiate ``HELLO 3`` + // (combined with ``AUTH`` when credentials or AWS IAM authentication are + // configured) on each new connection; ``upstream_resp3_hello_failure`` + // tracks negotiation failures. Downstream clients must perform an + // explicit ``HELLO 3`` handshake before any data command — bare ``HELLO`` + // on a fresh connection or any non-HELLO/AUTH/QUIT command before + // ``HELLO 3`` is rejected with ``-NOPROTO``. + RESP3 = 1; + } + // Redis connection pool settings. // [#next-free-field: 11] message ConnPoolSettings { @@ -389,6 +410,20 @@ // The is to support redis's feature wherein new commands can be added using redis' modules api: // https://redis.io/docs/latest/develop/reference/modules/ repeated string custom_commands = 11; + + // RESP protocol version enforced for both downstream connections and every + // routed upstream conn pool for this listener. Mismatched negotiation is + // rejected at HELLO (``HELLO N`` where ``N`` does not match returns + // ``-NOPROTO``) and, when set to ``RESP3``, at every non-HELLO/AUTH/QUIT + // command on a connection that has not yet negotiated RESP3 (so clients + // must perform an explicit ``HELLO 3`` handshake before any data command). + // + // When ``protocol_version`` is ``RESP3``, every routed upstream + // Redis-compatible backend must support ``HELLO 3`` / RESP3 (e.g. + // Redis 6.0+, where RESP3 was introduced). Misconfigured upstreams will + // fail every connection's HELLO 3 negotiation, surfaced as + // ``upstream_resp3_hello_failure`` stat increments. + ProtocolVersion protocol_version = 12 [(validate.rules).enum = {defined_only: true}]; } // RedisProtocolOptions specifies Redis upstream protocol options. This object is used in

envoy/extensions/filters/network/reverse_tunnel/v3/reverse_tunnel.proto:

--- shake256:323d69a823d3e0ff9288f728451afca371eef0ca458a73293c124822e90f70d53af71754605423710074150e30f5d2cbbaebf49117f93d7d85de1a0052885b2c envoy/extensions/filters/network/reverse_tunnel/v3/reverse_tunnel.proto +++ shake256:c0b374171742f42295d7451d3f8d046d3dac45713ce950026ca36f838fb3201c80156d6eb198e19212506adbb16d61a41ac01ffe563e88e331f84f58e7e65050 envoy/extensions/filters/network/reverse_tunnel/v3/reverse_tunnel.proto @@ -3,9 +3,11 @@ package envoy.extensions.filters.network.reverse_tunnel.v3; import "envoy/config/core/v3/base.proto"; +import "envoy/extensions/filters/common/jwks/v3/jwt_handshake.proto"; import "google/protobuf/duration.proto"; +import "envoy/annotations/deprecation.proto"; import "udpa/annotations/status.proto"; import "validate/validate.proto"; @@ -96,7 +98,7 @@ // Configuration for the reverse tunnel network filter. // This filter handles reverse tunnel connection acceptance and rejection by processing // HTTP requests where required identification values are provided via HTTP headers. -// [#next-free-field: 9] +// [#next-free-field: 12] message ReverseTunnel { // Ping interval for health checks on established reverse tunnel connections. // If not specified, defaults to ``2 seconds``. @@ -105,13 +107,10 @@ gte {nanos: 1000000} }]; - // Whether to automatically close connections after processing reverse tunnel requests. - // - // * When set to ``true``, connections are closed after acceptance or rejection. - // * When set to ``false``, connections remain open for potential reuse. - // - // Defaults to ``false``. - bool auto_close_connections = 2; + // Deprecated. The handshake connection is always detached once the acceptance response is + // flushed so tunnel bytes have a single reader. Ignored. + bool auto_close_connections = 2 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; // HTTP path to match for reverse tunnel requests. // If not specified, defaults to ``/reverse_connections/request``. @@ -145,4 +144,44 @@ // This avoids the cross-worker lock in pickLeastLoadedSocketManager. // Default: false (rebalancing enabled). bool skip_rebalancing = 8; + + // Optional JWT authentication for the handshake. When set, the bearer token carried in the + // handshake request is verified before the connection is accepted or its socket registered, so a + // forged or expired token can never produce a usable reverse tunnel. This runs on the real + // accepted socket, before registration, so it does not interfere with socket reuse. A missing or + // invalid token rejects the handshake with HTTP ``401 Unauthorized`` unless + // ``allow_missing_or_failed`` is set. + // + // On success, the verified claims are published as dynamic metadata (default namespace + // ``envoy.filters.network.reverse_tunnel.jwt``) so the :ref:`Validation + // <envoy_v3_api_msg_extensions.filters.network.reverse_tunnel.v3.Validation>` block can bind a + // claimed handshake identifier to a verified claim, e.g.:: + // + // tenant_id_format: "%DYNAMIC_METADATA(envoy.filters.network.reverse_tunnel.jwt:tenant)%" + // + // forces the ``x-envoy-reverse-tunnel-tenant-id`` header to equal the verified ``tenant`` claim. + // Without such a binding, a token minted for one tenant can open a tunnel claiming another. + // + // Token verification is synchronous. With ``remote_jwks`` the keys are fetched and refreshed in the + // background (at startup and every ``cache_duration``) and cached, never on the accept path. Before + // the first successful fetch, or while a refresh is failing with nothing cached, every token is + // rejected. ``token_header`` defaults to ``authorization`` and ``clock_skew_seconds`` to 60. + // + // See :ref:`JwtHandshakeValidator + // <envoy_v3_api_msg_extensions.filters.common.jwks.v3.JwtHandshakeValidator>`. + common.jwks.v3.JwtHandshakeValidator jwt_validator = 10; + + // Enforces the per-node concurrent connection cap (``max_connections_per_node``, configured on + // the ``UpstreamReverseConnectionSocketInterface`` bootstrap extension) for tunnels accepted by + // this filter. The cap is checked on the accepting worker but the connection is counted on the + // worker it is finally rebalanced to, so it is best-effort unless ``skip_rebalancing`` is ``true``. + // Default: false. + bool enable_connection_limit = 9; + + // Maximum time to receive a complete handshake request. If not specified, defaults to ``10s``. + // On expiry the connection is closed and ``handshake.timeout`` is incremented. + google.protobuf.Duration handshake_timeout = 11 [(validate.rules).duration = { + lte {seconds: 300} + gt {} + }]; }

envoy/extensions/filters/udp/dns_filter/v3/dns_filter.proto:

--- shake256:5fe000c8a7be0d8c110a23b7051a145c3bbc3dfb96ebc31f92a4c897bde8e7e6d2d09da8733cc1de3ac0a20f1e3157f3fedd27164de77d1584ad6bfa551a74f4 envoy/extensions/filters/udp/dns_filter/v3/dns_filter.proto +++ shake256:436b10d2ed00bc25e99d66c3078c9df7f9270226426b2518204f3d8dcf6d9c589829f8dc4a2c16b64da619eb3f33eee945fd8c1b6b4c80428048b96411ccb511 envoy/extensions/filters/udp/dns_filter/v3/dns_filter.proto @@ -26,6 +26,7 @@ // [#extension: envoy.filters.udp.dns_filter] // Configuration for the DNS filter. +// [#next-free-field: 6] message DnsFilterConfig { // This message contains the configuration for the DNS Filter operating // in a server context. This message will contain the virtual hosts and @@ -123,4 +124,8 @@ // - ``RESPONSE_CODE``: DNS response code // - ``PARSE_STATUS``: Whether the query was successfully parsed repeated config.accesslog.v3.AccessLog access_log = 4; + + // When true, virtual domain names are matched case-insensitively. The response echoes the + // client's original query-name case. Defaults to false. + bool case_insensitive = 5; }

envoy/extensions/filters/udp/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:4f7867b0773a6edbbff3f6032fb65b475a5cee759f6662696a55d74c25d4bb96c288630f05d6c12ba2806ee9a5e5fddf7ab2520840913725cfdebb6b588ee702 envoy/extensions/filters/udp/dynamic_modules/v3/dynamic_modules.proto +++ shake256:f1b8280cc604c780329caf36ad0e5fc63be76a77f28d552e14d17024ddeceebe7fde9b9744a8fe5499bf83ff26b10cb754d8e4ea5c5f5e00675ae56634d89ac2 envoy/extensions/filters/udp/dynamic_modules/v3/dynamic_modules.proto @@ -45,7 +45,8 @@ // limiting, ``filter_name`` is used to choose either echo or rate limiting. The // ``filter_config`` can be used to configure the echo behavior or the rate limiting parameters. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/filters/udp/udp_proxy/v3/udp_proxy.proto:

--- shake256:90c9a5e1b2bfe3cf7dccc8cb444c46a99c9214ab0a7b0c78c19f9f9cdb9787c35a1a85547849ae858e97f440352069bbabe91c5efeb9d8643c457a64737ac00c envoy/extensions/filters/udp/udp_proxy/v3/udp_proxy.proto +++ shake256:d471ed2f786afbbda352903ab63002898eeae4e36fde297b9037752c1f060560a835b6bdaeadbbe62f13fb821a71c4ea64f5057fb4cfadc1747c2c30207bd5af envoy/extensions/filters/udp/udp_proxy/v3/udp_proxy.proto @@ -6,6 +6,7 @@ import "envoy/config/core/v3/backoff.proto"; import "envoy/config/core/v3/base.proto"; import "envoy/config/core/v3/config_source.proto"; +import "envoy/config/core/v3/extension.proto"; import "envoy/config/core/v3/udp_socket_config.proto"; import "google/protobuf/any.proto"; @@ -73,7 +74,7 @@ // Configuration for tunneling UDP over other transports or application layers. // Tunneling is currently supported over HTTP/2. - // [#next-free-field: 12] + // [#next-free-field: 13] message UdpTunnelingConfig { // Configuration for UDP datagrams buffering. message BufferOptions { @@ -178,6 +179,12 @@ // Save the response trailers to the downstream info filter state for consumption // by the session filters. The filter state key is ``envoy.udp_proxy.propagate_response_trailers``. bool propagate_response_trailers = 11; + + // Specifies a collection of Formatter plugins that can be used in substitution formatters + // in ``headers_to_add``. + // See the formatters extensions documentation for details. + // [#extension-category: envoy.formatter] + repeated config.core.v3.TypedExtensionConfig formatters = 12; } message UdpAccessLogOptions {

envoy/extensions/formatter/cel/v3/cel.proto:

--- shake256:98b4491dad61ce1a62c98a1e229268e712489637a1dbc034c37dc031d42039921071f4396bf583fdebbc731db21196e192bd4c90f847caf51a90c8c54b84775a envoy/extensions/formatter/cel/v3/cel.proto +++ shake256:ca7f51d5d43c160f9241e19698d8e240e2f3fa8d2ce3453866a3054116903aabed25541fe153fba0a900cc544c2b2be66247ed291cf1633b7fd291650c8790d2 envoy/extensions/formatter/cel/v3/cel.proto @@ -2,6 +2,8 @@ package envoy.extensions.formatter.cel.v3; +import "envoy/config/core/v3/cel.proto"; + import "udpa/annotations/status.proto"; option java_package = "io.envoyproxy.envoy.extensions.formatter.cel.v3"; @@ -50,7 +52,10 @@ // Configuration for the CEL formatter. // // .. warning:: -// This extension is treated as built-in extension and will be enabled by default now. -// It is unnecessary to configure this extension. +// This extension is treated as a built-in extension and is enabled by default. +// It is unnecessary to configure this extension unless overriding the CEL expression runtime +// via ``cel_config``. message Cel { + // Configuration for the CEL expression runtime used by this formatter. + config.core.v3.CelExpressionConfig cel_config = 1; }

envoy/extensions/formatter/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:580964d7027f1e0437e8e4a050dc4a7c49eb248e39343e21e86ab4c74cf379e437fc54c6db301bfe3a06d00876722dcd7ffe3de041cb065ad16467f066d5eb31 envoy/extensions/formatter/dynamic_modules/v3/dynamic_modules.proto +++ shake256:5acb21e6a80670f6186504c7a0c5bff6d3b54423c829e7390e807b170c1edd8e1de482212b36b5cf9709ce80ca824185b44f11b38bfcd10400d98748e38731a7 envoy/extensions/formatter/dynamic_modules/v3/dynamic_modules.proto @@ -47,7 +47,8 @@ // ``formatter_name``, the module can decide which in-module command parser implementation to use // and fine-tune which commands it recognizes. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/health_checkers/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:d2c656b5bc8d53ba7dc07f2ace68f9344154068899d386c2ee304c3504a3fe306ed2dc21d5a63733e31fbf61cee26d3ba042836788132c533cc61c1941edb887 envoy/extensions/health_checkers/dynamic_modules/v3/dynamic_modules.proto +++ shake256:d5574d9597be5b91e315b55e6d7a324d2aeb33a071a60bbe07936e8768b4c4e733e3c49b2367304dec5f3d28c4bbcc67d46d9401362a182dcc6f90f0335c5e21 envoy/extensions/health_checkers/dynamic_modules/v3/dynamic_modules.proto @@ -50,7 +50,8 @@ // ``health_checker_name``, the module can decide which in-module health checker implementation to // use and fine-tune the behavior of the health checker. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/http/custom_response/local_response_policy/v3/local_response_policy.proto:

--- shake256:6f61959660cff32b12feab412ab5763c2ca598c7af8439e3de8ab409eee02d60f7424ae5368588ef48a6215290183bc718e582c18d46f04b3ce8e65d70dfff21 envoy/extensions/http/custom_response/local_response_policy/v3/local_response_policy.proto +++ shake256:b6009c26b7776e0bceab6afc8169b410ab78ebf50b780976d7d335b3240280d8f929bf2c6b7d18546986950a5f85b6bd76c657f087a56a0b47047f133e63d43d envoy/extensions/http/custom_response/local_response_policy/v3/local_response_policy.proto @@ -24,9 +24,12 @@ // Custom response policy to serve a locally stored response to the // downstream. +// [#next-free-field: 7] message LocalResponsePolicy { // Optional new local reply body text. It will be used - // in the ``%LOCAL_REPLY_BODY%`` command operator in the ``body_format``. + // in the ``%LOCAL_REPLY_BODY%`` command operator in the ``body_format``. If unset when + // ``body_format`` is configured for an existing local reply, the existing body will be used as + // the formatter input instead. config.core.v3.DataSource body = 1; // Optional body format to be used for this response. If ``body_format`` is not @@ -43,4 +46,19 @@ // remote body, before it is sent to a downstream client. repeated config.core.v3.HeaderValueOption response_headers_to_add = 4 [(validate.rules).repeated = {max_items: 1000}]; + + // Controls what is written to ``stream_info.response_code_details`` when this + // policy sends its local reply. + // + // If unset, details are cleared (empty string), matching legacy behavior. + // Use ``preserve_response_code_details`` to keep the existing value (e.g. + // ``csrf_origin_mismatch``), or ``response_code_details`` to set an explicit + // replacement. + oneof response_code_details_action { + // If set, keep the existing ``response_code_details`` already present on StreamInfo. + bool preserve_response_code_details = 5 [(validate.rules).bool = {const: true}]; + + // Replace ``response_code_details`` with this value. + string response_code_details = 6 [(validate.rules).string = {min_len: 1}]; + } }

envoy/extensions/http/injected_credentials/generic/v3/generic.proto:

--- shake256:678bff6a6a4338b1448420ce629ec7d093dd5ce9c1f11ac247940ca93dbc3a91ef26fc38b8673606c8f52b74e55d5a857878ef3b46e5b3e10a75112450bfbcc3 envoy/extensions/http/injected_credentials/generic/v3/generic.proto +++ shake256:34cdb621792ca31ddf9dbd9d82b80ebd8fcf1702b92790ed8f3ec8117b754eeac2fcfc326cea1adb4e55c1691749dbfd552b014e4f6b02312cce062f06286441 envoy/extensions/http/injected_credentials/generic/v3/generic.proto @@ -19,7 +19,7 @@ // Generic extension can be used to inject HTTP Basic Auth, Bearer Token, or any arbitrary credential // into the proxied requests. // The credential will be injected into the specified HTTP request header. -// Refer to [RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://www.rfc-editor.org/rfc/rfc6750) for details. +// Refer to `RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage <https://www.rfc-editor.org/rfc/rfc6750>`_ for details. // message Generic { // The SDS configuration for the credential that will be injected to the specified HTTP request header.

envoy/extensions/http/injected_credentials/oauth2/v3/oauth2.proto:

--- shake256:59d9350a541de8f92284737869e627928b411fee305ce1c0b4960a60f13f003f6dcf4463bbf658273fe8a974cb1444674c6bc399a146fc138fd5f9a4256c3d4e envoy/extensions/http/injected_credentials/oauth2/v3/oauth2.proto +++ shake256:87e31fc241a567421582a7a3c738c6e6e98b1bc47d59881d2d16274e437565af2aa4831a2248ba3c4fa6380e25a43bde5d2bdb7953140524e4ce00c724827bcf envoy/extensions/http/injected_credentials/oauth2/v3/oauth2.proto @@ -35,22 +35,32 @@ // The ``client_id`` and ``client_secret`` will be sent in the URL encoded request body. // This type should only be used when Auth server does not support Basic authentication. URL_ENCODED_BODY = 1; + + // The client will be authenticated using mutual TLS (mTLS) with a client certificate. + // The ``client_secret`` is not required and will not be sent in the request to the + // authorization server. + // The client certificate must be configured in the cluster used by ``token_endpoint`` via + // transport socket configuration. + // This implements OAuth 2.0 Mutual-TLS Client Authentication as defined in RFC 8705. + TLS_CLIENT_AUTH = 2; } // Credentials to authenticate client to the authorization server. - // Refer to [RFC 6749: The OAuth 2.0 Authorization Framework](https://www.rfc-editor.org/rfc/rfc6749#section-2.3) for details. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework <https://www.rfc-editor.org/rfc/rfc6749#section-2.3>`__ for details. message ClientCredentials { // Client ID. - // Refer to [RFC 6749: The OAuth 2.0 Authorization Framework](https://www.rfc-editor.org/rfc/rfc6749#section-2.3.1) for details. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework <https://www.rfc-editor.org/rfc/rfc6749#section-2.3.1>`__ for details. string client_id = 1 [(validate.rules).string = {min_len: 1}]; // Client secret. - // Refer to [RFC 6749: The OAuth 2.0 Authorization Framework](https://www.rfc-editor.org/rfc/rfc6749#section-2.3.1) for details. - transport_sockets.tls.v3.SdsSecretConfig client_secret = 2 - [(validate.rules).message = {required: true}]; + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework <https://www.rfc-editor.org/rfc/rfc6749#section-2.3.1>`__ for details. + // This field is required unless :ref:`auth_type + // <envoy_v3_api_field_extensions.http.injected_credentials.oauth2.v3.OAuth2.ClientCredentials.auth_type>` + // is set to ``TLS_CLIENT_AUTH``, in which case authentication is done via the client certificate. + transport_sockets.tls.v3.SdsSecretConfig client_secret = 2; // The method to use when sending credentials to the authorization server. - // Refer to [RFC 6749: The OAuth 2.0 Authorization Framework](https://www.rfc-editor.org/rfc/rfc6749#section-2.3.1) for details. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework <https://www.rfc-editor.org/rfc/rfc6749#section-2.3.1>`__ for details. AuthType auth_type = 3; } @@ -66,18 +76,18 @@ } // Endpoint on the authorization server to retrieve the access token from. - // Refer to [RFC 6749: The OAuth 2.0 Authorization Framework](https://www.rfc-editor.org/rfc/rfc6749#section-3.2) for details. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework <https://www.rfc-editor.org/rfc/rfc6749#section-3.2>`__ for details. config.core.v3.HttpUri token_endpoint = 1 [(validate.rules).message = {required: true}]; // Optional list of OAuth scopes to be claimed in the authorization request. - // Refer to [RFC 6749: The OAuth 2.0 Authorization Framework](https://www.rfc-editor.org/rfc/rfc6749#section-4.4.2) for details. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework <https://www.rfc-editor.org/rfc/rfc6749#section-4.4.2>`__ for details. repeated string scopes = 2; oneof flow_type { option (validate.required) = true; // Client Credentials Grant. - // Refer to [RFC 6749: The OAuth 2.0 Authorization Framework](https://www.rfc-editor.org/rfc/rfc6749#section-4.4) for details. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework <https://www.rfc-editor.org/rfc/rfc6749#section-4.4>`__ for details. ClientCredentials client_credentials = 3; }

envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.proto:

--- shake256:ed80461fd767155c24d6fdfaa7f620d4db8ac5868cf1a1bbfb302f4ecc1790582dc99575a1003b34d949bb8f27c6e92f4ed22e2a5007f4c92af3cf49d10611c4 envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.proto +++ shake256:861a39e8e20680fa4eee71ecb7708f708f3edc6b176590d740a0193e9a0cd81c87b7a67d0e73044a02fa8edc2977ec8c1c81d801a3fd9c7eb13a16c3c178197d envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.proto @@ -26,13 +26,20 @@ // the endpoint weights are sent by the control plane via EDS. However, // in this policy, the endpoint weights are instead determined via qps (queries // per second), eps (errors per second), and utilization metrics sent by the -// endpoint using the Open Request Cost Aggregation (ORCA) protocol. Utilization -// is determined by using the ORCA application_utilization field, if set, or -// else falling back to the cpu_utilization field. All queries count toward qps, -// regardless of result. Only failed queries count toward eps. A config -// parameter error_utilization_penalty controls the penalty to adjust endpoint -// weights using eps and qps. The weight of a given endpoint is computed as: -// ``qps / (utilization + eps/qps * error_utilization_penalty)``. +// endpoint using the Open Request Cost Aggregation (ORCA) protocol. All queries +// count toward qps, regardless of result. Only failed queries count toward eps. +// A config parameter error_utilization_penalty controls the penalty to adjust +// endpoint weights using eps and qps. The weight of a given endpoint is computed +// as: ``qps / (utilization + eps/qps * error_utilization_penalty)``. +// +// For a load report to update an endpoint's weight, it must set :ref:`rps_fractional +// <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.rps_fractional>` (used as +// qps) greater than 0, and the final utilization (resolved utilization plus any +// error penalty) must be greater than 0. Resolved utilization (see +// :ref:`metric_names_for_computing_utilization +// <envoy_v3_api_field_extensions.load_balancing_policies.client_side_weighted_round_robin.v3.ClientSideWeightedRoundRobin.metric_names_for_computing_utilization>`) +// is used as the baseline. Reports that fail to do so are ignored, and an endpoint +// with no valid weight is assigned the median weight of the endpoints that have one. // // Note that Envoy will forward the ORCA response headers/trailers from the upstream // cluster to the downstream client. This means that if the downstream client is also @@ -79,10 +86,11 @@ // Default is 1.0. google.protobuf.FloatValue error_utilization_penalty = 6 [(validate.rules).float = {gte: 0.0}]; - // By default, endpoint weight is computed based on the :ref:`application_utilization <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.application_utilization>` field reported by the endpoint. - // If that field is not set, then utilization will instead be computed by taking the max of the values of the metrics specified here. + // Specifies the metrics used to compute the endpoint utilization from which weight is derived. // For map fields in the ORCA proto, the string will be of the form ``<map_field_name>.<map_key>``. For example, the string ``named_metrics.foo`` will mean to look for the key ``foo`` in the ORCA :ref:`named_metrics <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.named_metrics>` field. - // If none of the specified metrics are present in the load report, then :ref:`cpu_utilization <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.cpu_utilization>` is used instead. + // Utilization is the max of the values of the metrics specified here, when that max is greater than 0. + // Otherwise :ref:`application_utilization <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.application_utilization>` is used if greater than 0, with :ref:`cpu_utilization <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.cpu_utilization>` as the final fallback. + // Disabling the runtime flag ``envoy.reloadable_features.orca_weight_manager_use_named_metrics_first`` restores the legacy order, preferring ``application_utilization`` over these metrics. repeated string metric_names_for_computing_utilization = 7; // Configuration for slow start mode.

envoy/extensions/load_balancing_policies/load_aware_locality/v3/load_aware_locality.proto:

--- shake256:e54c12aff3d669e5d5b5a9237812c9398e708f353c174da18d25bd76df3b4c6aaa82dda151ad927ee8949e77056c0be405b0e554cef74fc5571da76abce3a122 envoy/extensions/load_balancing_policies/load_aware_locality/v3/load_aware_locality.proto +++ shake256:51c73a45a7d0303da413710d7aede53de6c2a518d534240ed63be5e0d1697645076f435852dfa46052a8def20d02cf325e199712660391c7776b7691f8a34175 envoy/extensions/load_balancing_policies/load_aware_locality/v3/load_aware_locality.proto @@ -3,6 +3,7 @@ package envoy.extensions.load_balancing_policies.load_aware_locality.v3; import "envoy/config/cluster/v3/cluster.proto"; +import "envoy/extensions/load_balancing_policies/common/v3/common.proto"; import "google/protobuf/duration.proto"; import "google/protobuf/wrappers.proto"; @@ -21,7 +22,7 @@ // Configuration for the load_aware_locality LB policy which uses ORCA utilization data // to route traffic between localities based on available headroom. -// [#next-free-field: 10] +// [#next-free-field: 11] message LoadAwareLocality { // The child LB policy to create for endpoint-picking within each locality. config.cluster.v3.LoadBalancingPolicy endpoint_picking_policy = 1 @@ -32,17 +33,20 @@ google.protobuf.Duration weight_update_period = 2 [(validate.rules).duration = {gte {nanos: 100000000}}]; - // By default, endpoint utilization is computed based on the - // :ref:`application_utilization <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.application_utilization>` - // field reported by the endpoint. If that field is not set, then utilization - // will instead be computed by taking the max of the values of the metrics - // specified here. For map fields in the ORCA proto, the string will be of - // the form ``<map_field_name>.<map_key>``. For example, the string + // Specifies the metrics used to compute endpoint utilization. For map + // fields in the ORCA proto, the string will be of the form + // ``<map_field_name>.<map_key>``. For example, the string // ``named_metrics.foo`` will mean to look for the key ``foo`` in the ORCA // :ref:`named_metrics <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.named_metrics>` - // field. If none of the specified metrics are present in the load report, - // then :ref:`cpu_utilization <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.cpu_utilization>` - // is used instead. + // field. Utilization is the max of the values of the metrics specified + // here, when that max is greater than 0. Otherwise + // :ref:`application_utilization <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.application_utilization>` + // is used if greater than 0, with + // :ref:`cpu_utilization <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.cpu_utilization>` + // as the final fallback. Disabling the runtime flag + // ``envoy.reloadable_features.orca_weight_manager_use_named_metrics_first`` + // restores the legacy order, preferring ``application_utilization`` over + // these metrics. repeated string metric_names_for_computing_utilization = 3; // When the local locality's utilization is at most this threshold above the @@ -92,4 +96,9 @@ // server may not provide reports as frequently as the client requests. // Used only when enable_oob_load_report is true. Default is 10 seconds. google.protobuf.Duration oob_reporting_period = 9; + + // Optional overrides for the OOB reporting connection (alternative port, + // ``:authority``, transport socket selection). Honored only when + // ``enable_oob_load_report`` is true. + common.v3.OrcaOobReportingConfig oob_reporting_config = 10; }

envoy/extensions/matching/http/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:67a0605b9de1b29cc5afa547fce19ac7c867bd77508de0cf62a744eab3ab004ece5a946677baf90b5e56f9ed74a8d18eece9be46a4a3badb68badab7eee71e15 envoy/extensions/matching/http/dynamic_modules/v3/dynamic_modules.proto +++ shake256:82884d480870e7153f8bfb1cd95ac73ee60488fef1ddba0730411cc230cf26550f5c2ff2cf3e78284fcc2ea0bbfa911d064477252122d27b2c230b20afd38837 envoy/extensions/matching/http/dynamic_modules/v3/dynamic_modules.proto @@ -2,7 +2,12 @@ package envoy.extensions.matching.http.dynamic_modules.v3; +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + import "udpa/annotations/status.proto"; +import "validate/validate.proto"; option java_package = "io.envoyproxy.envoy.extensions.matching.http.dynamic_modules.v3"; option java_outer_classname = "DynamicModulesProto"; @@ -22,3 +27,36 @@ // <envoy_v3_api_msg_extensions.matching.input_matchers.dynamic_modules.v3.DynamicModuleMatcher>`. message HttpDynamicModuleMatchInput { } + +// Configuration for the dynamic modules data input. This input loads a shared object file +// via ``dlopen`` and invokes it during match evaluation to extract a value from the HTTP +// request and response. The extracted value is a string that an exact match map can dispatch on, +// so a module can select one of many matches with a single evaluation. +// +// Unlike :ref:`HttpDynamicModuleMatchInput +// <envoy_v3_api_msg_extensions.matching.http.dynamic_modules.v3.HttpDynamicModuleMatchInput>`, the +// module produces the value directly rather than pairing with the dynamic modules input matcher. +// [#extension: envoy.matching.inputs.dynamic_module_string_data_input] +message DynamicModuleDataInput { + // Specifies the shared-object level configuration. This field is required. Remote module sources + // are not supported for data inputs, so the module must be available locally or by name. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1 + [(validate.rules).message = {required: true}]; + + // The name for this data input configuration. If not specified, defaults to an empty string. + // + // This can be used to distinguish between different data input implementations inside a dynamic + // module. When Envoy receives this configuration, it passes the ``input_name`` to the dynamic + // module's data input config init function together with the ``input_config``. That way a module + // can decide which in-module implementation to use based on the name at load time. + string input_name = 2; + + // The configuration for the data input chosen by ``input_name``. If not specified, an empty + // configuration is passed to the module. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly without + // the wrapper. + google.protobuf.Any input_config = 3; +}

envoy/extensions/matching/input_matchers/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:134ea10cdb70aa7d229fc2cd26d1abe6cac8b9193e435419fe0c568bdd167e48789358082414f687ab6318c073d22c82ae1f09b5ca665c182045ba2370fead69 envoy/extensions/matching/input_matchers/dynamic_modules/v3/dynamic_modules.proto +++ shake256:27ff670b92e98a70aad2c1a5141da88e37caa55a8152a66c3c32c0a483ce10ce24afc2b8a89149cf34fb3cde1e85460c0da591f6da8035e02de051d429298a41 envoy/extensions/matching/input_matchers/dynamic_modules/v3/dynamic_modules.proto @@ -26,6 +26,16 @@ // matching beyond what built-in matchers provide, such as JWT/OAuth token analysis, custom // routing decisions, or integration with external data sources. message DynamicModuleMatcher { + // The policy applied when the module cannot evaluate a match, for example after a panic in the + // module's match hook. + enum OnError { + // Treat an evaluation that could not complete as no match. This is the default. + NO_MATCH = 0; + + // Treat an evaluation that could not complete as a match. + MATCH = 1; + } + // Specifies the shared-object level configuration. This field is required. envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1 [(validate.rules).message = {required: true}]; @@ -47,8 +57,19 @@ // ``matcher_name``, the module can decide which in-module matcher implementation to use and // fine-tune the behavior of the matcher. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. google.protobuf.Any matcher_config = 3; + + // The result applied for an evaluation that the module could not complete, for example when the + // module's match hook panics. A panic is caught at the ABI boundary and cannot report a match + // result, so the matcher applies this policy for that single evaluation. If not specified, + // defaults to ``NO_MATCH``. + // + // ``NO_MATCH`` is safe for allow-on-match trees where a missed match denies the request. + // ``MATCH`` is safe for deny-on-match trees where a missed match would let a request bypass the + // rule. + OnError on_error = 4; }

envoy/extensions/quic/connection_id_generator/quic_lb/v3/quic_lb.proto:

--- shake256:8a58afa18cfd1cbde48136072f331fe02420900d28cff068cca484cb2dff09f3b12409f8ba400ddd9452a4b355431eb52a493c17b870ddf9bd539c0ebd29de0e envoy/extensions/quic/connection_id_generator/quic_lb/v3/quic_lb.proto +++ shake256:72e84ba56fb274e08743442b26c1c033122e8c3721eec53b45d4a9f1e84a9bc7137041480a46c801003c458b2314b8b7f908f326362e26a9503d8928b0bdde51 envoy/extensions/quic/connection_id_generator/quic_lb/v3/quic_lb.proto @@ -5,8 +5,6 @@ import "envoy/config/core/v3/base.proto"; import "envoy/extensions/transport_sockets/tls/v3/secret.proto"; -import "xds/annotations/v3/status.proto"; - import "udpa/annotations/status.proto"; import "validate/validate.proto"; @@ -27,13 +25,8 @@ // // See https://datatracker.ietf.org/doc/html/draft-ietf-quic-load-balancers for details. // -// .. warning:: -// -// This is still a work in progress. Interoperability testing has not yet been performed. // [#next-free-field: 7] message Config { - option (xds.annotations.v3.message_status).work_in_progress = true; - // Must be at least 1 octet. // The length of server_id and nonce_length_bytes must be 18 or less. // See https://datatracker.ietf.org/doc/html/draft-ietf-quic-load-balancers#name-server-id-allocation.

envoy/extensions/stat_sinks/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:207659b40f09a1eb343e4bee976790b87765f57e9af73739ad595610306d4c1793aef067838761e69533a5243c174e5175fdbd9ddf07e2bc432aa3b3df014d60 envoy/extensions/stat_sinks/dynamic_modules/v3/dynamic_modules.proto +++ shake256:aed559c90776a842f40524ddcc51368ae77724cfe51c655c10f86868020d01ad1576d110513a45eb0c53cc30b84fa43b0ae590846bae684a288d9667a882975d envoy/extensions/stat_sinks/dynamic_modules/v3/dynamic_modules.proto @@ -41,7 +41,8 @@ // The configuration for the sink chosen by ``sink_name``. If not specified, an empty // configuration is passed to the module. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/stat_sinks/graphite_statsd/v3/graphite_statsd.proto:

--- shake256:baaef5b0dcd805f206a977806ecf55cd8785134085fa515bd3ddb848d3986d502fb8144bb0f6f06a11595c5444ff42da361497a4b70eeb21f1a8e0095b183c3b envoy/extensions/stat_sinks/graphite_statsd/v3/graphite_statsd.proto +++ shake256:fb0347fc4ce6ceccc92eb0a4b1d11c85e083d0e53bf589723455727ad13b3051f4be549925782b798fb30a98a7fcbf1e57ab882b3a41fcab6217cc8a2c454e77 envoy/extensions/stat_sinks/graphite_statsd/v3/graphite_statsd.proto @@ -22,6 +22,7 @@ // <envoy_v3_api_msg_config.metrics.v3.StatsConfig>`. // [#extension: envoy.stat_sinks.graphite_statsd] +// [#next-free-field: 6] message GraphiteStatsdSink { oneof statsd_specifier { option (validate.required) = true; @@ -42,4 +43,10 @@ // // Note that this value may not be respected if smaller than a single metric. google.protobuf.UInt64Value max_bytes_per_datagram = 4 [(validate.rules).uint64 = {gt: 0}]; + + // If true, histogram samples are scaled to milliseconds according to the histogram's unit + // before being reported as timers. See :ref:`StatsdSink's scale_histogram_units_to_milliseconds + // field <envoy_v3_api_field_config.metrics.v3.StatsdSink.scale_histogram_units_to_milliseconds>` + // for more details. + bool scale_histogram_units_to_milliseconds = 5; }

envoy/extensions/tracers/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:389b3dcebe44e1c0ea1edbf8cb24b13c0737d253ea00ba19d5ceb4072e8f586f3cecaa60ef2cacaf0d084374ebda39c73bf0e6f5d99106058cb1e33e7e665f72 envoy/extensions/tracers/dynamic_modules/v3/dynamic_modules.proto +++ shake256:a3abcb3f73ba7ca43e6ea5dc856cf78f13aaf8be73249a42afd62e7d8af953403982600344f0f505cbb732bfe729f93170a3b6073e143c2430503482475682c4 envoy/extensions/tracers/dynamic_modules/v3/dynamic_modules.proto @@ -49,7 +49,8 @@ // ``tracer_name``, the module can decide which in-module tracer implementation to use and // fine-tune the behavior of the tracer. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/transport_sockets/quic/v3/quic_transport.proto:

--- shake256:a73ea65dd0a92900ce187d3404a8d0a85c928a68ef98fdaa42597900c5e2239d25e2d3331439c2ca817927acd69df65d5e6d72724f5f53a03dd230c20425b45a envoy/extensions/transport_sockets/quic/v3/quic_transport.proto +++ shake256:56737f595d21329007d97f5069ed35f24a53dc82a7dfbb32dd52117602f757c96d56767883beadd4b70987f95215e7c8a946c12f8a9b901e4c1e27f9a27e3afc envoy/extensions/transport_sockets/quic/v3/quic_transport.proto @@ -24,12 +24,25 @@ tls.v3.DownstreamTlsContext downstream_tls_context = 1 [(validate.rules).message = {required: true}]; - // If false, QUIC will tell TLS to reject any early data and to stop issuing 0-RTT credentials with resumption session tickets. This will prevent clients from sending 0-RTT requests. - // Default to true. + // If false, QUIC will tell TLS to reject any early data and to stop issuing 0-RTT credentials + // with resumption session tickets. This will prevent clients from sending 0-RTT requests. + // Defaults to true, except when a client certificate validation context is configured, in which + // case it defaults to false. Early data requires resumption, so it cannot be enabled unless + // :ref:`enable_resumption + // <envoy_v3_api_field_extensions.transport_sockets.quic.v3.QuicDownstreamTransport.enable_resumption>` + // is also true. google.protobuf.BoolValue enable_early_data = 2; // If false, TLS session tickets are not issued and accepted by QUIC. - // Default to true. + // Defaults to true, except when a client certificate validation context is configured, in which + // case it defaults to false. QUIC does not re-validate the client certificate when a session is + // resumed. A resumed connection reuses the certificate verdict of the original handshake until the + // ticket expires, so certificate revocation or expiry and validation context changes are not + // rechecked. Setting this to true on a filter chain that validates a client certificate opts into + // that trade-off in exchange for cheaper handshakes. Resumption also requires + // :ref:`disable_stateless_session_resumption + // <envoy_v3_api_field_extensions.transport_sockets.tls.v3.DownstreamTlsContext.disable_stateless_session_resumption>` + // to be false, because that field controls the underlying TLS session tickets. google.protobuf.BoolValue enable_resumption = 3; }

envoy/extensions/transport_sockets/tls/v3/common.proto:

--- shake256:e1e0d5919ceef76ce7a6329062704ac251f7b9285d3493b1612cd9fa2191d8cb23cb5e78569b409aa3706a3adb7bedf2e6e406f19fcac2a0f7a0c734e2babb07 envoy/extensions/transport_sockets/tls/v3/common.proto +++ shake256:6538be34cd3980ea8e64d2efe72aeaa2b47a6bfc684f66feed463866af9c4a3bba9264a5b053f3f00b72b8795c6152cd444d283810de4f10e91ea04d64986211 envoy/extensions/transport_sockets/tls/v3/common.proto @@ -242,7 +242,7 @@ bool fallback = 4; } -// [#next-free-field: 9] +// [#next-free-field: 10] message TlsCertificate { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.auth.TlsCertificate"; @@ -309,6 +309,26 @@ // [#not-implemented-hide:] repeated config.core.v3.DataSource signed_certificate_timestamp = 5; + + // Optional per-certificate TLS parameters. When set on a server certificate, any specified + // fields override the corresponding context-level + // :ref:`tls_params <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CommonTlsContext.tls_params>` + // for that certificate during the TLS handshake; unset fields continue to use the context-level + // values. This allows different cipher suites, ECDH curves, protocol versions, signature + // algorithms, or compliance policies per certificate. + // + // These parameters do not affect certificate selection, which continues to be based only on SNI, + // the client's ECDSA capability, and OCSP capability. They are applied after a certificate has + // been selected. For a multi-certificate configuration this means each certificate's parameters + // must be compatible with the clients that select it: if the selected certificate's parameters + // leave nothing in common with the client, the handshake fails and no other certificate is tried. + // + // Note: because these are overrides rather than constraints, a certificate-level + // ``tls_minimum_protocol_version`` can lower the floor set by the context-level + // ``tls_params``, weakening the listener's overall TLS security policy. + // Setting this on a client certificate is not supported and is ignored. + // This field has no effect on QUIC/HTTP3 downstream connections. + TlsParameters tls_params = 9; } message TlsSessionTicketKeys {

envoy/extensions/transport_sockets/tls/v3/tls.proto:

--- shake256:d6ce09b7e5d772dc134ba451fb8c99e1c8e0dc921a49c34ec5d93088e8e050258f4db162d2491a5e0e5d2061d78ab985f7503b06d6eb94bf12f9e5fe8d18a1c5 envoy/extensions/transport_sockets/tls/v3/tls.proto +++ shake256:64496efc016e5617ea8758fef8f3e284150617932c6bf8eb9a9a701a375f32c028d7c16c7aa7bedc704e09ae922f2e34d7b4f017624b85e85e62b8c6a1199d79 envoy/extensions/transport_sockets/tls/v3/tls.proto @@ -270,7 +270,8 @@ // TLS protocol versions, cipher suites etc. TlsParameters tls_params = 1; - // Only a single TLS certificate is supported in client contexts. In server contexts, + // Only a single TLS certificate is supported in client contexts unless + // ``custom_tls_certificate_selector`` is explicitly defined with ``max_session_keys`` set to 0. In server contexts, // :ref:`Multiple TLS certificates <arch_overview_ssl_cert_select>` can be associated with the // same context to allow both RSA and ECDSA certificates and support SNI-based selection. // @@ -362,6 +363,7 @@ // Custom TLS handshaker. If empty, defaults to native TLS handshaking // behavior. + // [#extension-category: envoy.tls_handshakers] config.core.v3.TypedExtensionConfig custom_handshaker = 13; // TLS key log configuration

envoy/extensions/upstreams/http/v3/http_protocol_options.proto:

--- shake256:316dc86defec70a70aa1e5901c99751f3fdea7250983b5f790f4fafa96ab9f2658f2eeea685f9c5110e3db69d67560bcab9adcebad108e0d5d06871587e881e9 envoy/extensions/upstreams/http/v3/http_protocol_options.proto +++ shake256:e5c42b5f36a8128ff99b253ec122dba8700caff3e217f16edb1adf4f5d9b012016e1bc9e5fb486e37734b414b2d7ae1ceb535e5b16f4d085429356f7eed34220 envoy/extensions/upstreams/http/v3/http_protocol_options.proto @@ -73,9 +73,6 @@ config.core.v3.Http2ProtocolOptions http2_protocol_options = 2; - // .. warning:: - // QUIC upstream support is currently not ready for internet use. - // Please see :ref:`here <arch_overview_http3>` for details. config.core.v3.Http3ProtocolOptions http3_protocol_options = 3; } } @@ -90,9 +87,6 @@ config.core.v3.Http2ProtocolOptions http2_protocol_options = 2; - // .. warning:: - // QUIC upstream support is currently not ready for internet use. - // Please see :ref:`here <arch_overview_http3>` for details. config.core.v3.Http3ProtocolOptions http3_protocol_options = 3; } @@ -111,14 +105,10 @@ config.core.v3.Http2ProtocolOptions http2_protocol_options = 2; // Unlike HTTP/1 and HTTP/2, HTTP/3 will not be configured unless it is - // present, and (soon) only if there is an indication of server side + // present, and only if there is an indication of server side // support. // See :ref:`here <arch_overview_http3_upstream>` for more information on // when HTTP/3 will be used, and when Envoy will fail over to TCP. - // - // .. warning:: - // QUIC upstream support is currently not ready for internet use. - // Please see :ref:`here <arch_overview_http3>` for details. config.core.v3.Http3ProtocolOptions http3_protocol_options = 3; // The presence of alternate protocols cache options causes the use of the

envoy/extensions/wasm/v3/wasm.proto:

--- shake256:4383b785c7cf3c88d63153c5d841c7a5125c1a883789f36dd07b11434ad73ce8da5af9292b4a078e98101fb11769d14ba8a55b088f0fec67540d9a55364fde80 envoy/extensions/wasm/v3/wasm.proto +++ shake256:327d9c50181bfabbf3a0c88ffb11199d08a3478dcd2d65daef92d5c6d03e5abcb61632b8dd7cc0dda670a88d444b8785c80c2114f293d43e0f95d17337ef8cb9 envoy/extensions/wasm/v3/wasm.proto @@ -71,7 +71,7 @@ } // Configuration for a Wasm VM. -// [#next-free-field: 8] +// [#next-free-field: 9] message VmConfig { // An ID which will be used along with a hash of the wasm code (or the name of the registered Null // VM plugin) to determine which VM will be used for the plugin. All plugins which use the same @@ -137,6 +137,12 @@ // .. warning:: // Envoy rejects the configuration if there's conflict of key space. EnvironmentVariables environment_variables = 7; + + // Configuration for restricting Proxy-Wasm capabilities available to modules. + // + // The restrictions are applied when the VM is created and are shared by every plugin running in + // that VM, so they are a property of the VM rather than of an individual plugin. + CapabilityRestrictionConfig capability_restriction_config = 8; } message EnvironmentVariables { @@ -192,7 +198,14 @@ ReloadConfig reload_config = 8; // Configuration for restricting Proxy-Wasm capabilities available to modules. - CapabilityRestrictionConfig capability_restriction_config = 6; + // + // This field is deprecated in favor of the :ref:`vm_config.capability_restriction_config + // <envoy_v3_api_field_extensions.wasm.v3.VmConfig.capability_restriction_config>` field, because + // the restrictions are applied to the Wasm VM and are therefore shared by every plugin running in + // it. If this field is set and ``vm_config.capability_restriction_config`` is not, this field is + // used to populate it. + CapabilityRestrictionConfig capability_restriction_config = 6 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; // Whether or not to allow plugin onRequestHeaders and onResponseHeaders callbacks to return // FilterHeadersStatus::StopIteration.

envoy/service/auth/v3/external_auth.proto:

--- shake256:820d7943bb9e5754b8275f131b6ecab54f6ab7a3eb9d4276c04973ec75434b8a57cdbb329cbfd83549b7ab4e826c3255eb63b88fef390fb0011e62ed8f736032 envoy/service/auth/v3/external_auth.proto +++ shake256:27d6937632ebcee64c3c8cfc15890eb8d3193e5fb1c7b419fcb1aa9bf8c0317b947cecc50ca3a205201df37f27856023c6f4be2fb49e4975f953d3c22bf03dc5 envoy/service/auth/v3/external_auth.proto @@ -52,6 +52,8 @@ // This field allows the authorization service to send HTTP response headers // to the downstream client. Note that the :ref:`append field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.append>` defaults to // false when used in this message. + // The :ref:`keep_empty_value field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.keep_empty_value>` + // is not supported. repeated config.core.v3.HeaderValueOption headers = 2; // This field allows the authorization service to send a response body data @@ -72,6 +74,8 @@ // the filter will append the correspondent header value to the matched request header. // By leaving ``append`` as false, the filter will either add a new header, or override an existing // one if there is a match. + // The :ref:`keep_empty_value field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.keep_empty_value>` + // is not supported. repeated config.core.v3.HeaderValueOption headers = 2; // HTTP entity headers to remove from the original request before dispatching @@ -101,6 +105,8 @@ // This field allows the authorization service to send HTTP response headers // to the downstream client on success. Note that the :ref:`append field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.append>` // defaults to false when used in this message. + // The :ref:`keep_empty_value field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.keep_empty_value>` + // is not supported. repeated config.core.v3.HeaderValueOption response_headers_to_add = 6; // This field allows the authorization service to set (and overwrite) query

envoy/service/ext_proc/v3/external_processor.proto:

--- shake256:8d3a41874a7414428779106a5a908cbc94a63c3ed00301b07b5591947ca5653e8bd49e2ca3e51a2c45e6d6dc8a4db1dc74541850e1c980ec61997568ea6bba85 envoy/service/ext_proc/v3/external_processor.proto +++ shake256:0b4d2556efa7056770dbe60b694e853e411f160b2725e48cbe4c30b254185359096f0fb43375845c9bfa21c1db9f5234f20a0c1ec85deea8fcdbde493693942e envoy/service/ext_proc/v3/external_processor.proto @@ -6,6 +6,7 @@ import "envoy/extensions/filters/http/ext_proc/v3/processing_mode.proto"; import "envoy/type/v3/http_status.proto"; +import "google/protobuf/any.proto"; import "google/protobuf/duration.proto"; import "google/protobuf/struct.proto"; @@ -79,8 +80,66 @@ // This represents the different types of messages that the data plane can send // to an external processing server. -// [#next-free-field: 12] +// [#next-free-field: 14] message ProcessingRequest { + // Initial flow control window sizes for ``FULL_DUPLEX_STREAMED`` and + // ``GRPC`` body send modes. + // + // A sender starts with this amount of flow control window. Whenever + // it sends body data, it must decrement its flow control window by + // the number of bytes that it has sent. When its flow control + // window is less than or equal to the amount of body data it wishes + // to send, it may not send until it receives a window update causing + // its flow control window to be large enough. + // + // However, note that in ``GRPC`` body send mode, whenever the flow + // control window is greater than zero, a sender may send a single + // message, even if the size of that message exceeds the available flow + // control window. At that point, the flow control window will be negative + // and the sender must not send the next message until it becomes positive. + // + // Note that the initial size for the to-sidestream windows are set by + // the sender, not the receiver. This is because each sidestream may be + // routed to a different ext_proc server instance, but there is no + // connection-level handshake to set a default for that server + // instance, so the only alternative here would be to have the + // ext_proc server instance set this on a per-stream basis, which + // would require an additional round-trip and therefore hurt latency. + // This unfortunately means that the ext_proc server instance has a + // bit less control: as soon as it receives these initial values, it can + // immediately send a window update that reduces the window, but it + // must be prepared to handle any data that the sender has already sent. + // The initial sizes for the to-sidestream windows are generally + // expected to be in the range of 32K to 64K. + // + // [#not-implemented-hide:] + message FlowControlInit { + // Downstream-to-sidestream initial window size. + int64 initial_window_downstream_to_sidestream = 1; + + // Sidestream-to-upstream initial window size. + int64 initial_window_sidestream_to_upstream = 2; + + // Upstream-to-sidestream initial window size. + int64 initial_window_upstream_to_sidestream = 3; + + // Sidestream-to-downstream initial window size. + int64 initial_window_sidestream_to_downstream = 4; + } + + // Flow control window update. Values may be positive or negative. The + // sender must immediately add these values to its flow control window, + // which governs how much data can be sent. + // + // [#not-implemented-hide:] + message ClientWindowUpdate { + // Window update for sidestream-to-upstream. + int64 window_increment_sidestream_to_upstream = 1; + + // Window update for sidestream-to-downstream. + int64 window_increment_sidestream_to_downstream = 2; + } + reserved 1; reserved "async_mode"; @@ -89,8 +148,6 @@ // ones are set for a particular HTTP request/response depend on the // processing mode. oneof request { - option (validate.required) = true; - // Information about the HTTP request headers, as well as peer info and additional // properties. Unless ``observability_mode`` is ``true``, the server must send back a // ``HeaderResponse`` message, an ``ImmediateResponse`` message, or close the stream. @@ -148,6 +205,32 @@ // Specify the filter protocol configurations to be sent to the server. // ``protocol_config`` is only encoded in the first ``ProcessingRequest`` message from the client to the server. ProtocolConfiguration protocol_config = 11; + + // Flow control initialization for ``FULL_DUPLEX_STREAMED`` and + // ``GRPC`` body send modes. + // + // Must be set in the initial message on the stream. Not used in + // subsequent messages. + // + // [#not-implemented-hide:] + FlowControlInit flow_control_init = 12; + + // Flow control updates for ``FULL_DUPLEX_STREAMED`` and ``GRPC`` body + // send modes. + // + // This message may be included in a request message that also + // populates one of the fields in the ``request`` oneof above, or it + // may be sent in a request message that does not set the + // ``request`` oneof. + // + // In ``FULL_DUPLEX_STREAMED`` body send mode, for backward + // compatibility with data planes that do not yet support flow control, + // the data plane must not send a message containing only this field + // (i.e., not setting the ``request`` oneof) unless the ext_proc server + // has sent a window update, thus indicating that it supports flow control. + // + // [#not-implemented-hide:] + ClientWindowUpdate client_window_update = 13; } // This represents the different types of messages the server may send back to the data plane @@ -159,12 +242,23 @@ // the server must send back exactly one ``ProcessingResponse`` message. // * If it is set to ``FULL_DUPLEX_STREAMED``, the server must follow the API defined // for this mode to send the ``ProcessingResponse`` messages. -// [#next-free-field: 13] +// [#next-free-field: 17] message ProcessingResponse { + // Flow control window update. Values may be positive or negative. The + // sender must immediately add these values to its flow control window, + // which governs how much data can be sent. + // + // [#not-implemented-hide:] + message ServerWindowUpdate { + // Window update for downstream-to-sidestream. + int64 window_increment_downstream_to_sidestream = 1; + + // Window update for upstream-to-sidestream. + int64 window_increment_upstream_to_sidestream = 2; + } + // The response type that is sent by the server. oneof response { - option (validate.required) = true; - // The server must send back this message in response to a message with the // ``request_headers`` field set. HeadersResponse request_headers = 1; @@ -220,31 +314,139 @@ // field name(s) of the struct. google.protobuf.Struct dynamic_metadata = 8; + // Optional typed metadata that will be emitted as dynamic metadata to be consumed by + // following filters. This metadata will be placed in the namespace(s) specified by the + // keys of the map. + // + // Typed dynamic metadata should be preferred over untyped dynamic metadata (``dynamic_metadata``) + // because it is more efficient and more type-safe. + map<string, google.protobuf.Any> typed_dynamic_metadata = 13; + // Override how parts of the HTTP request and response are processed for the duration of this // particular request/response only. Servers may use this to intelligently control how requests // are processed based on the headers and other metadata that they see. // - // This field is only applicable when servers are responding to the header requests. If it is set - // in the response to the body or trailer requests, it will be ignored by the data plane. + // If set in a response to body or trailer requests, it will be ignored by the data plane. // It is also ignored by the data plane when the ext_proc filter config // :ref:`allow_mode_override <envoy_v3_api_field_extensions.filters.http.ext_proc.v3.ExternalProcessor.allow_mode_override>` // is set to ``false``, or // :ref:`send_body_without_waiting_for_header_response <envoy_v3_api_field_extensions.filters.http.ext_proc.v3.ExternalProcessor.send_body_without_waiting_for_header_response>` // is set to ``true``. + // + // ``mode_override`` can be sent in the following scenarios: + // + // 1. Included in a header response: + // The server can set this field when responding to request or response headers, i.e., + // alongside a ``request_headers`` or ``response_headers`` response. + // + // 2. Standalone ``mode_override`` response: + // After receiving a ``ProcessingRequest`` for request headers, the server can send a + // standalone ``mode_override`` response (i.e., a ``ProcessingResponse`` with only + // ``mode_override`` populated and no ``response`` case set) before sending the + // ``request_headers`` response. Subsequent messages will adhere to this new mode. + // + // .. note:: + // Processing mode changes in a standalone ``mode_override`` have the following constraints: + // + // * For request path: Only supports transitioning the request body processing mode from + // ``NONE`` or ``STREAMED`` to ``FULL_DUPLEX_STREAMED``. Additionally, the request + // trailer mode must be set to ``SEND``, which is required by ``FULL_DUPLEX_STREAMED`` + // mode. Responses that do not meet these constraints are treated as spurious and rejected. + // * For Response path: There are no restrictions on processing mode changes. + // envoy.extensions.filters.http.ext_proc.v3.ProcessingMode mode_override = 9; // [#not-implemented-hide:] - // Used only in ``FULL_DUPLEX_STREAMED`` and ``GRPC`` body send modes. - // Instructs the data plane to stop sending body data and to send a - // half-close on the ext_proc stream. The ext_proc server should then echo - // back all subsequent body contents as-is until it sees the client's - // half-close, at which point the ext_proc server can terminate the stream - // with an OK status. This provides a safe way for the ext_proc server - // to indicate that it does not need to see the rest of the stream; - // without this, the ext_proc server could not terminate the stream - // early, because it would wind up dropping any body contents that the - // client had already sent before it saw the ext_proc stream termination. - bool request_drain = 12; + // Deprecated and not implemented. This field has been replaced with + // the request_drain_requests and request_drain_responses fields. + bool request_drain = 12 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // [#not-implemented-hide:] + // Initiates a drain of request body data. Used only in + // ``FULL_DUPLEX_STREAMED`` and ``GRPC`` body send modes. + // + // The expected sequence for a drain is as follows: + // + // 1. The ext_proc server sends a message to the data plane with this + // field set to true. + // 2. The data plane pauses reading from the downstream client, applying + // any necessary flow control push-back. + // 3. The data plane sends a + // :ref:`request_body <envoy_v3_api_field_service.ext_proc.v3.ProcessingRequest.request_body>` + // with the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.HttpBody.drain_complete>` + // field set to true. + // 4. The ext_proc server continues processing all subsequent request body + // chunks until it sees the body chunk with the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.HttpBody.drain_complete>` + // field set to true. When sending back its response to that last body + // chunk, the ext_proc server will set the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.StreamedBodyResponse.drain_complete>` + // field to true to let the data plane know that it has finished draining. + // 5. When the data plane sees the response with the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.StreamedBodyResponse.drain_complete>` + // field set to true, it will resume reading from the downstream + // client, passing all data directly to the upstream server, + // without going through the ext_proc sidestream. + // + // This procedure provides a safe way for the ext_proc server to indicate + // that it does not need to see the rest of the request body. + // + // Note that if the data plane is sending request body data and the + // ext_proc server wants to terminate the stream with an OK status, it + // must perform this drain before doing so. + // + // Note that the data plane may have either sent a body chunk with + // :ref:`end_of_stream <envoy_v3_api_field_service.ext_proc.v3.StreamedBodyResponse.end_of_stream>` + // set to true or may have sent trailers before it received the drain + // request from the ext_proc server. In these cases, the data plane will + // ignore the drain request, and the ext_proc will consider the drain + // complete when it sees the end-of-stream or trailers. + bool request_drain_requests = 15; + + // [#not-implemented-hide:] + // Initiates a drain of response body data. Used only in + // ``FULL_DUPLEX_STREAMED`` and ``GRPC`` body send modes. + // + // The expected sequence for a drain is as follows: + // + // 1. The ext_proc server sends a message to the data plane with this + // field set to true. + // 2. The data plane pauses reading from the upstream server, applying + // any necessary flow control push-back. + // 3. The data plane sends a + // :ref:`response_body <envoy_v3_api_field_service.ext_proc.v3.ProcessingRequest.response_body>` + // with the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.HttpBody.drain_complete>` + // field set to true. + // 4. The ext_proc server continues processing all subsequent response body + // chunks until it sees the body chunk with the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.HttpBody.drain_complete>` + // field set to true. When sending back its response to that last body + // chunk, the ext_proc server will set the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.StreamedBodyResponse.drain_complete>` + // field to true to let the data plane know that it has finished draining. + // 5. When the data plane sees the response with the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.StreamedBodyResponse.drain_complete>` + // field set to true, it will resume reading from the upstream + // server, passing all data directly to the downstream client, + // without going through the ext_proc sidestream. + // + // This procedure provides a safe way for the ext_proc server to indicate + // that it does not need to see the rest of the response body. + // + // Note that if the data plane is sending response body data and the + // ext_proc server wants to terminate the stream with an OK status, it + // must perform this drain before doing so. + // + // Note that the data plane may have either sent a body chunk with + // :ref:`end_of_stream <envoy_v3_api_field_service.ext_proc.v3.StreamedBodyResponse.end_of_stream>` + // set to true or may have sent trailers before it received the drain + // request from the ext_proc server. In these cases, the data plane will + // ignore the drain request, and the ext_proc will consider the drain + // complete when it sees the end-of-stream or trailers. + bool request_drain_responses = 16; // When the ext_proc server receives a request message and needs more time to process it, it // sends back a ``ProcessingResponse`` message with a new timeout value. When the data plane @@ -259,6 +461,29 @@ // Such a message can be sent at most once in a particular data plane ext_proc filter processing // state. To enable this API, ``max_message_timeout`` must be set to a value >= 1ms. google.protobuf.Duration override_message_timeout = 10; + + // Flow control updates for ``FULL_DUPLEX_STREAMED`` and ``GRPC`` body + // send modes. + // + // This message may be included in a response message that also + // populates one of the fields in the ``response`` oneof above, or it + // may be sent in a response message that does not set the + // ``response`` oneof. + // + // In ``FULL_DUPLEX_STREAMED`` body send mode, for backward + // compatibility with data planes that do not yet support flow control, + // the ext_proc server must not set this field unless the data plane + // sent initial window sizes in its initial message on the stream. + // Conversely, if the data plane did send initial window sizes in its + // initial message on the stream, the ext_proc server must send a + // window update immediately to let the data plane know that it also + // supports flow control. If the ext_proc server is sending a message + // immediately anyway (e.g., for a header or body chunk), it can include + // this field in that same message; otherwise, the ext_proc server must + // send a message containing only this field. + // + // [#not-implemented-hide:] + ServerWindowUpdate server_window_update = 14; } // The following are messages that are sent to the server. @@ -283,6 +508,7 @@ // This message is sent to the external server when the HTTP request and response bodies are // received. +// [#next-free-field: 6] message HttpBody { // The contents of the body in the HTTP request/response. Note that in streaming mode multiple // ``HttpBody`` messages may be sent. @@ -295,16 +521,31 @@ // will be sent for the current request/response. bool end_of_stream = 2; - // This field is used in ``GRPC`` body send mode when ``end_of_stream`` is ``true`` and ``body`` - // is empty. Those values would normally indicate an empty message on the stream with the - // end-of-stream bit set. However, if the half-close happens after the last message on the stream - // was already sent, then this field will be ``true`` to indicate an end-of-stream with *no* - // message (as opposed to an empty message). + // This field is used only in ``GRPC`` body send mode. It is not used in any other body send + // mode. + // + // This field is used only when ``end_of_stream`` is true and ``body`` is empty. + // Normally, in ``GRPC`` body send mode, an empty ``body`` field indicates an empty message on + // the gRPC stream. However, it is possible that the gRPC client sends a half-close without + // actually sending a message on the stream, so we need a way to differentiate between + // an empty message being sent and no message being sent. If this field is true, then it + // indicates that no message has been sent; if it is false, then it indicates that an empty + // message has been sent. + // [#not-implemented-hide:] bool end_of_stream_without_message = 3; // This field is used in ``GRPC`` body send mode to indicate whether the message is compressed. // This will never be set to ``true`` by gRPC but may be set to ``true`` by a proxy like Envoy. bool grpc_message_compressed = 4; + + // [#not-implemented-hide:] + // In ``FULL_DUPLEX_STREAMED`` or ``GRPC`` body send modes, if the + // data plane has seen the + // :ref:`request_drain_requests <envoy_v3_api_field_service.ext_proc.v3.ProcessingResponse.request_drain_requests>` + // or :ref:`request_drain_responses <envoy_v3_api_field_service.ext_proc.v3.ProcessingResponse.request_drain_responses>` + // field, it will populate this field to indicate that it has finished + // sending data to the ext_proc server. + bool drain_complete = 5; } // This message is sent to the external server when the HTTP request and @@ -457,6 +698,10 @@ // ``:authority``, ``:scheme``, or ``host`` headers will be ignored. // The header value is encoded in the // :ref:`raw_value <envoy_v3_api_field_config.core.v3.HeaderValue.raw_value>` field. + // Note that the :ref:`append field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.append>` + // defaults to false when used in this message. + // The :ref:`keep_empty_value field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.keep_empty_value>` + // is not supported. repeated config.core.v3.HeaderValueOption set_headers = 1; // Remove these HTTP headers. Attempts to remove system headers -- @@ -465,6 +710,7 @@ } // The body response message corresponding to ``FULL_DUPLEX_STREAMED`` or ``GRPC`` body modes. +// [#next-free-field: 6] message StreamedBodyResponse { // In ``FULL_DUPLEX_STREAMED`` body send mode, contains the body response chunk that will be // passed to the upstream/downstream by the data plane. In ``GRPC`` body send mode, contains @@ -480,16 +726,35 @@ // messages sent by the client application. bool end_of_stream = 2; - // This field is used in ``GRPC`` body send mode when ``end_of_stream`` is ``true`` and ``body`` - // is empty. Those values would normally indicate an empty message on the stream with the - // end-of-stream bit set. However, if the half-close happens after the last message on the stream - // was already sent, then this field will be ``true`` to indicate an end-of-stream with *no* - // message (as opposed to an empty message). + // This field is used only in ``GRPC`` body send mode. It is not used in any other body send + // mode. + // + // This field is used only when ``end_of_stream`` is true and ``body`` is empty. + // Normally, in ``GRPC`` body send mode, an empty ``body`` field indicates an empty message on + // the gRPC stream. However, it is possible that the gRPC client sends a half-close without + // actually sending a message on the stream, so we need a way to differentiate between + // an empty message being sent and no message being sent. If this field is true, then it + // indicates that no message has been sent; if it is false, then it indicates that an empty + // message has been sent. + // [#not-implemented-hide:] bool end_of_stream_without_message = 3; // This field is used in ``GRPC`` body send mode to indicate whether the message is compressed. // This will never be set to ``true`` by gRPC but may be set to ``true`` by a proxy like Envoy. bool grpc_message_compressed = 4; + + // [#not-implemented-hide:] + // In ``FULL_DUPLEX_STREAMED`` or ``GRPC`` body send modes, if the + // ext_proc server has seen the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.HttpBody.drain_complete>` + // field, it will populate this field to indicate that it has finished + // sending data back to the data plane. + // + // If the data plane receives a message with this field set to true + // before it has sent a drain-complete message to the ext_proc server, + // the data plane will treat that as if the ext_proc stream has failed + // with a non-OK status. + bool drain_complete = 5; } // This message specifies the body mutation the server sends to the data plane.

envoy/service/network_ext_proc/v3/network_external_processor.proto:

--- shake256:e870bf82f1725fad89f9cdbcf6aac0209c0b792523eec0f54ed0c2a277d22c66caaa75a8ccd5ea834b867a991c040594d285be61249fe6d5afc29fc21836673e envoy/service/network_ext_proc/v3/network_external_processor.proto +++ shake256:fc006a5c791b34aefd34bf03e9240479d6721e4e11f9cc9ad368961393267df1818ecf44ea6e68e54183caf179f764cc33bbf28c4c797a6f63f59069d9b748e6 envoy/service/network_ext_proc/v3/network_external_processor.proto @@ -71,7 +71,7 @@ // ProcessingRequest contains data sent from Envoy to the external processing server. // Each request contains either read data (from client) or write data (to client) -// along with optional metadata. +// along with optional metadata and attributes. message ProcessingRequest { // ReadData contains the network data intercepted in the request path (client to server). // This is sent to the external processor when data arrives from the downstream client. @@ -90,6 +90,11 @@ // The metadata is not automatically propagated from request to response. // The external processor must include any needed metadata in its response. config.core.v3.Metadata metadata = 3; + + // The values of properties selected by the ``connection_attributes`` + // list in the configuration. Each entry in the list is populated + // from the standard :ref:`attributes <arch_overview_attributes>` supported in the data plane. + map<string, google.protobuf.Struct> attributes = 4; } // ProcessingResponse contains the response from the external processing server to Envoy.

envoy/service/rate_limit_quota/v3/rlqs.proto:

--- shake256:4134d14b8efd20d58f826e9849d6e53b2d3ac7242560d367b7abc6d2a7ee155135e112da7a9bd738e5ebb22180c4bdbad8071c9c9574e945897bf6a608c7260d envoy/service/rate_limit_quota/v3/rlqs.proto +++ shake256:d914c01bdc3068df7d0d999fbf63b779c0c184906ef0cd922fbc421276263c34bb565b0dd7a4e1b12eb9ca1875088a525f91f4f81aa61aa907ba72b91ad097bd envoy/service/rate_limit_quota/v3/rlqs.proto @@ -6,8 +6,6 @@ import "google/protobuf/duration.proto"; -import "xds/annotations/v3/status.proto"; - import "udpa/annotations/status.proto"; import "validate/validate.proto"; @@ -16,7 +14,6 @@ option java_multiple_files = true; option go_package = "github.com/envoyproxy/go-control-plane/envoy/service/rate_limit_quota/v3;rate_limit_quotav3"; option (udpa.annotations.file_status).package_version_status = ACTIVE; -option (xds.annotations.v3.file_status).work_in_progress = true; // [#protodoc-title: Rate Limit Quota Service (RLQS)]

envoy/service/ratelimit/v3/rls.proto:

--- shake256:4d2cdb7b5a97447afa3a31c9430712528fdee48f57628e528e1f9a033d8af309b25ab63085729223f6fc1a5e0514cadbe7574e858edb7e3fb8ce813e579931c6 envoy/service/ratelimit/v3/rls.proto +++ shake256:311a3681f3f3d77ddfc1eb3c82e620bfaf0023946cbebbb6ca684fd9fa164ff24f838a06c58949b09af0fd404700a81e69f0852dc4353c6ac27b3500d5894fc7 envoy/service/ratelimit/v3/rls.proto @@ -8,6 +8,7 @@ import "google/protobuf/duration.proto"; import "google/protobuf/struct.proto"; import "google/protobuf/timestamp.proto"; +import "google/protobuf/wrappers.proto"; import "udpa/annotations/status.proto"; import "udpa/annotations/versioning.proto"; @@ -112,6 +113,10 @@ // The unit of time. Unit unit = 2; + + // The number of units in the rate limit period. For example, a value of ``10`` with a unit + // of ``MINUTE`` specifies a 10-minute rate limit period. If not specified, defaults to ``1``. + google.protobuf.UInt32Value unit_multiplier = 4 [(validate.rules).uint32 = {gt: 0}]; } // Cacheable quota for responses.

envoy/type/metadata/v3/metadata.proto:

--- shake256:35ee01ad69132a5e671569227885b005ffee1364d7c60a3ebbf8c630872d444446d0bd4c964168d2d81d91806800ebdcfaa0b18a79dd436725295d0d9842fcaa envoy/type/metadata/v3/metadata.proto +++ shake256:374b75100366b366afa9c14d5a1ef45ed82771f5e1b4d532b9345288365e1dcd5457f78e446ae5dd9aae91ce9e3c434c4e10ed242595aae859891f0941318035 envoy/type/metadata/v3/metadata.proto @@ -41,7 +41,8 @@ option (udpa.annotations.versioning).previous_message_type = "envoy.type.metadata.v2.MetadataKey"; // Specifies a segment in a path for retrieving values from Metadata. - // Currently, only key-based segments (field names) are supported. + // Supports both key-based segments (field names in a Struct) and index-based + // segments (element access in a ListValue). message PathSegment { option (udpa.annotations.versioning).previous_message_type = "envoy.type.metadata.v2.MetadataKey.PathSegment"; @@ -51,6 +52,9 @@ // If specified, use this key to retrieve the value in a Struct. string key = 1 [(validate.rules).string = {min_len: 1}]; + + // If specified, use this index to retrieve a value from a ListValue. + uint32 index = 2; } } @@ -60,12 +64,12 @@ // The path used to retrieve a specific Value from the Struct. // This can be either a prefix or a full path, depending on the use case. - // For example, ``[prop, xyz]`` would retrieve a struct or ``[prop, foo]`` would retrieve a string - // in the example above. + // For example, ``[{key: prop}, {key: xyz}]`` would retrieve a struct or ``[{key: prop}, {key: foo}]`` + // would retrieve a string in the example above. // - // .. note:: - // Since only key-type segments are supported, a path cannot specify a list - // unless the list is the last segment. + // Path segments support both struct field access (via ``key``) and list element access (via ``index``). + // For example, to access the first element of a list at ``envoy.filters.http.grpc_field_extraction.tenant_id``, + // use ``path: [{key: tenant_id}, {index: 0}]``. repeated PathSegment path = 2 [(validate.rules).repeated = {min_items: 1}]; }

envoy/type/tracing/v3/custom_tag.proto:

--- shake256:5d1365c2a15eac67472851d97a23e17d24470ae21d04f87d9daf23a968cf1c85e76bae0aacfbee7e22d0fc57e8d0ab2185c3c3bb797087a5755ec577410483f0 envoy/type/tracing/v3/custom_tag.proto +++ shake256:a3a4044bc25774a45116435a3c732620914ef09f490941d06b6762044aff4c0624177cf96018234ffc8ade813db3ae8a4e83749b72bef469f56903f473fa084d envoy/type/tracing/v3/custom_tag.proto @@ -17,10 +17,44 @@ // [#protodoc-title: Custom Tag] // Describes custom tags for the active span. -// [#next-free-field: 7] +// [#next-free-field: 8] message CustomTag { option (udpa.annotations.versioning).previous_message_type = "envoy.type.tracing.v2.CustomTag"; + // Specifies how the resolved tag value should be typed on tracers that support + // typed span attributes (e.g. OpenTelemetry). The integer and floating-point + // cases are declared explicitly so the emitted attribute type is deterministic + // rather than inferred from the value. + enum ValueType { + // The value type is not set. Behaves like ``STRING``; the distinct default + // value lets consumers tell an unset ``value_type`` apart from an explicit + // ``STRING``. + UNSPECIFIED = 0; + + // Emit the tag value as a string. + STRING = 1; + + // Coerce the resolved tag value to a signed 64-bit integer. Tracers that + // support typed span attributes emit it as a native integer attribute (for + // OpenTelemetry, an OTLP ``int_value``). If the value does not parse as an + // integer, or the tracer has no typed-attribute support, it falls back to a + // string tag. + INT = 2; + + // Coerce the resolved tag value to a double. Tracers that support typed span + // attributes emit it as a native floating-point attribute (for OpenTelemetry, + // an OTLP ``double_value``). If the value does not parse as a double, or the + // tracer has no typed-attribute support, it falls back to a string tag. + DOUBLE = 3; + + // Coerce the resolved tag value to a boolean. Tracers that support typed span + // attributes emit it as a native boolean attribute (for OpenTelemetry, an OTLP + // ``bool_value``). Accepts the usual boolean spellings (``true``/``false``, + // ``1``/``0``, etc.). If the value does not parse as a boolean, or the tracer + // has no typed-attribute support, it falls back to a string tag. + BOOL = 4; + } + // Literal type custom tag with static value for the tag value. message Literal { option (udpa.annotations.versioning).previous_message_type = @@ -106,4 +140,11 @@ // unknown specifier values are replaced with the empty string instead of ``-``. string value = 6; } + + // The value's type. When unset (``UNSPECIFIED``) or ``STRING`` the tag keeps the + // preexisting string behavior. When set to ``INT``, ``DOUBLE`` or ``BOOL``, tracers + // that support typed span attributes (e.g. OpenTelemetry) emit the tag as an + // integer, floating-point or boolean attribute instead of a string. Applies to + // every custom tag type. + ValueType value_type = 7 [(validate.rules).enum = {defined_only: true}]; }

envoy/type/v3/http.proto:

--- shake256:406e55d1c3c28926cdcec7950f4e1ddac8f71fe9524f26df66e5f04e865b7fe37ec881c2c2ea96ee5928856a4f07ffc8b05e95a9987b99edc58ca8bf01668c04 envoy/type/v3/http.proto +++ shake256:accdf2d18598af1d1796c3b86c759c3fce8f3a076c354569191f9fb2aff09da01e4ae863006994714383af109df867d87a7a2edfe275996e56a8935da1a77283 envoy/type/v3/http.proto @@ -14,11 +14,6 @@ enum CodecClientType { HTTP1 = 0; - HTTP2 = 1; - - // [#not-implemented-hide:] QUIC implementation is not production ready yet. Use this enum with - // caution to prevent accidental execution of QUIC code. I.e. `!= HTTP2` is no longer sufficient - // to distinguish HTTP1 and HTTP2 traffic. HTTP3 = 2; }

github-actions · 2026-10-14T12:14:18Z

@@ -22,7 +22,7 @@
    },
    {
      "module_name": "envoyproxy/envoy",
-      "latest_reference": "v1.39.4"
+      "latest_reference": "v1.40.0"


[Posted at 2026-10-14T12:14:18Z]

Overall transition

$ casdiff v1.39.4 \ v1.40.0 \ --format=markdown

109 files changed: 1 removed, 0 renamed, 24 added, 84 changed content.

Files removed:

- shake256:c4bb6fae7c4d5c4770a3292ade560d26a775c87b94788ebc78e9fb52cda3c3ea993d23e1b90be3a6bb796aba1e9cbfe96598c4deb2e945cfa29f56af596c0bc5 contrib/envoy/extensions/network/connection_balance/dlb/v3alpha/dlb.proto

Files added:

+ shake256:ad6bd157563e3d6423d240f65e9cd854d643ace1006edf4aad7929d9c6aac05b5f0ed5f380842f3086c217380f79276edfa969ac3e5e502d88fdcb42c6dd82fa contrib/envoy/extensions/filters/http/client_cert/v3alpha/client_cert.proto + shake256:15c949253033d1f64fae17d8ffc0d53511fa6b0eabe3a45986b017594f32590c1c2b8945d0c74af543d3aec676a11ffd8788d469b18380c1d93e1d84c997f21f contrib/envoy/extensions/load_balancing_policies/per_worker_subset/v3alpha/per_worker_subset.proto + shake256:dbe663dfcfd0c76b1ce3e25e5e3fb44cad6c8c9b3dc91e1e3ef7e16f5f68eb1c107fc7929ff0ba385704a3fe2ef50cb130235493463ca91094813e831de30d89 envoy/data/ai/v3/request_info.proto + shake256:ebd2cbaece394e9f426b8b40c0e8394f607926395b48af0f7c4729e83d401d6b05cb4170a2b27af730704e17dcf018e6148f1404634c444a9f0b45527fb53c02 envoy/data/ai/v3/token_usage.proto + shake256:46355b26af4e644f11953163f73f60b008af9016214806e263636b9cfe9355a7e4476f3892ff5cbe7ff4f63de4a39c78f0fe36831be74da87fb6470585105b37 envoy/extensions/config/validators/dynamic_modules/v3/dynamic_modules.proto + shake256:96159f447b11ba1cb7714a394691f6b296ecb1dd5a152290d8f63d5a95a169debb3bb7a426a8b2c2d5048c64df212c9dd65840cee0c0f0f9e83d162f22fba15d envoy/extensions/filters/common/jwks/v3/jwks.proto + shake256:43739fbb908ba7e84eff67712f401ddc33bf468287f93d582247803a5c006a315be85476393c5207f05ab70d4d2c9ae6559ab2c37859b74bf6eae0c4bfc735e5 envoy/extensions/filters/common/jwks/v3/jwt_handshake.proto + shake256:b5477dfb0d32381ab02e26eb2ff4a9a1f99e01599f1cfe39d72f195a8f3570afad60ace573dfd0fb68b0719a4c872ec072e6d849f9fa783435e6927cdb2f95e0 envoy/extensions/filters/http/aws_eventstream_parser/v3/aws_eventstream_parser.proto + shake256:ac67a15e46d5a95c672d5692e0ab1aabfc758982b3c2122bbf2c5c7fcede980963690512051adbf9f8ea10cf31833b322b59f91da46520fa94699b1329312f51 envoy/extensions/filters/http/body_size_limit/v3/body_size_limit.proto + shake256:ed2b6a76c3a187e8fd6cae370d0e0a787eec1d4dd807e2e13c170dc2635fd149848cc080915dbe5ffe528aea043cd97efebff4cc691f99bfb3c1aa81b3da3066 envoy/extensions/health_checkers/udp/v3/udp.proto + shake256:1cb3ae86b15ae10d4d2c3c77435928b9045e591d89911b9e9ba6036a0d4168903ceff104d31f4227306495990f38fbb599b8eab0fcd14ac9f9ddbca40e4cb452 envoy/extensions/http/ai_filters/request_info/v3/request_info.proto + shake256:efb8ed39a57b9e43f6bccdb2ba69ac487f4ca21e429d3ee18923735b02fa24373c7ddfa0c54c36121a32f857009e7224623e4397901f2ba732bec021a5f85f63 envoy/extensions/http/ai_filters/schema_validation/v3/schema_validation.proto + shake256:abb4aa6b05d3254ac7b504949e4a35869e6e7b4f179bf99a3c9c99c02d3abd09271999d73606cd35b752dacef15d7ff9c238e4c34ae29e768e322dddfd2b6c30 envoy/extensions/http/ai_filters/transcoder/v3/transcoder.proto + shake256:3fce8ee954a7306c1e9a2c1677cd9d2f41d394195e46eb905de6a15cef7af99f8ba98a17183c1a9292e67a06e4333031c7f8259f77584dd2a34fd371a88a565e envoy/extensions/http/early_header_mutation/dynamic_modules/v3/dynamic_modules.proto + shake256:15603a2e7434422fedf63e85f2c2476e8990b38abaa85ca316216a0177dcaf3ab60481c0d312615bb7e24f0d333e508e42f2e387df060bc247aa0afc00f01857 envoy/extensions/http/header_formatters/dynamic_modules/v3/dynamic_modules.proto + shake256:a981530941912b70abd63742ea0233867d9f8d8b82cff5c37abebbbdb10b21dd3991551fa21eeea1156d73c6cb8e4fc8db3186a620798942cfe59c043b93f986 envoy/extensions/internal_redirect/filter_state/v3/filter_state_config.proto + shake256:9d8dd4e7df146f83d4a9605fe559bbeff256984607cafc46f468c1b226deaf8c93d0dccc4020b3dc6d10c7eac2c409130d2283da044e87b9fcfef706b58507f6 envoy/extensions/queue_policy/fifo/v3/fifo.proto + shake256:697ee83d1cbe18b6c803d53ccc7161b52abd0362079be6744fc2fa5d5bc8c6db3d06c76d009d3da91a1d3a8025a9811d30282a8dfaf50fc23b6cfd5e104ae7ec envoy/extensions/rate_limit_descriptors/jwt_claim/v3/jwt_claim.proto + shake256:57a0131334ad804039fabd14a613f7da33d577319612e3d1fe920f1ffe46bbedfdd8ff7b1c57394e1393e8a6b4acc5508a570cafdddf72067303154f09487f45 envoy/extensions/router/cluster_specifiers/dynamic_modules/v3/dynamic_modules.proto + shake256:c5fd77fd6b35a56306fbd1f9ba9381a940f3d5ed2c6046e2f4ebd4ee5bc2403a39616e299ea51a73a3dfd46d329b89cff851e849b31c41db1161b9a755348b93 envoy/extensions/router/cluster_specifiers/priority_group/v3/priority_group.proto + shake256:7218e21f8ca32a4ffd9ba9412c292991f1e79673548070eceb807f2d5fb7c07ad2d88f23cce6dc9cc2859751d1401fc9df818185b9e1b7d8a1b4c98156d54b6f envoy/extensions/router/route_specifiers/dynamic_modules/v3/dynamic_modules.proto + shake256:7a1088075988f4f4955218bbe749da201b1092c5e2f38d3d595d2196f4b36052bf68adb90da1ece5aadd3a17e75b8c5dd3d6396918248bb65d37e1eb4cbfd604 envoy/extensions/transport_sockets/tls/handshakers/dynamic_modules/v3/dynamic_modules.proto + shake256:f91b5c852f8deb71d90543d4713082f71f5ebb19b3d8101deea71513ccecd4b19012049f8f8ca3f4c643e326a44ac0853e872bbe54e31d9289ab563b8a32ce4c envoy/extensions/watchdog/backtrace_action/v3/backtrace_action.proto + shake256:c30825cda00b1ad243a8c464c586bc2cf4dcaaa39da6603372e44ace30b5ecc2e4851c3d1254a7411ca4e2cf9bc5842d7cb3dac42477895f561d3e061e9c5ab4 envoy/type/ai/v3/llm_protocol.proto

Files changed content:

contrib/envoy/extensions/filters/http/sxg/v3alpha/sxg.proto:

--- shake256:75bebf5cdb07a03584c0367cb291bf599154285a0c28bc56d4190b90fd0ff0734d57a3ef0a8bf88005abd9202cceb47df0c13a0dcbc9af3665513e4e4c96aada contrib/envoy/extensions/filters/http/sxg/v3alpha/sxg.proto +++ shake256:e46c4c2c153ea77879a711607b75b949303727fd9c3227897c112a4eab5572a68e0c1c7f3b281d842de83110bcb2c8450f0041d1ba54889992744ec913d42c6a contrib/envoy/extensions/filters/http/sxg/v3alpha/sxg.proto @@ -37,7 +37,8 @@ // Javascript, 1 day (so, with backdated expiry, 2 days, or 172800 seconds) is more appropriate. google.protobuf.Duration duration = 3; - // The SXG response payload is Merkle Integrity Content Encoding (MICE) encoded (specification is [here](https://datatracker.ietf.org/doc/html/draft-thomson-http-mice-03)) + // The SXG response payload is `Merkle Integrity Content Encoding (MICE) encoded + // <https://datatracker.ietf.org/doc/html/draft-thomson-http-mice-03>`_. // This value indicates the record size in the encoded payload. The default value is 4096. uint64 mi_record_size = 4; @@ -45,7 +46,8 @@ // be served from the same domain as the SXG document, this should be a relative URI. string cbor_url = 5 [(validate.rules).string = {min_len: 1 prefix: "/"}]; - // URL to retrieve validity data for signature, a CBOR map. See specification [here](https://tools.ietf.org/html/draft-yasskin-httpbis-origin-signed-exchanges-impl-00#section-3.6) + // URL to retrieve validity data for signature, a CBOR map. See specification + // `here <https://tools.ietf.org/html/draft-yasskin-httpbis-origin-signed-exchanges-impl-00#section-3.6>`_ string validity_url = 6 [(validate.rules).string = {min_len: 1 prefix: "/"}]; // Header that will be set if it is determined that the client can accept SXG (typically ``accept: application/signed-exchange;v=b3``)

envoy/admin/v3/memory.proto:

--- shake256:4cea80b96515e73ed166ffb074490e388706151c316a6281d580cad1b94c25c2f2fad927bd57061193640a791bfdb17936a60bca6e44a7332685a143f7eb2f12 envoy/admin/v3/memory.proto +++ shake256:3b5d20207b95fb25ba7b567fd93e7799aaed33eab2da87ba1bb54febb0a8d657f3b5dcd09032adf1e7ff846fde53cef6deac8eb166a424dd9bead7069d4f53ba envoy/admin/v3/memory.proto @@ -15,7 +15,7 @@ // Proto representation of the internal memory consumption of an Envoy instance. These represent // values extracted from an internal TCMalloc instance. For more information, see the section of the -// docs entitled ["Generic Tcmalloc Status"](https://gperftools.github.io/gperftools/tcmalloc.html). +// docs entitled `"Generic Tcmalloc Status" <https://gperftools.github.io/gperftools/tcmalloc.html>`_. // [#next-free-field: 7] message Memory { option (udpa.annotations.versioning).previous_message_type = "envoy.admin.v2alpha.Memory";

envoy/admin/v3/mutex_stats.proto:

--- shake256:7d878df1ba81097b3bd150127d366a41db794cd7243a03e0b233c563044e15b5d0f74565d5f9408efff46de7dfb7c3b0a5842cb02882758acbc15323fcb46ceb envoy/admin/v3/mutex_stats.proto +++ shake256:e492a9f4579ddc0ad028b42e50c646fbca0fbd68d1bfcf621c04ec1cd1ba30bd7b0f0e8f24d6e7e6179d328ceccfd82cfeee61fb4bc91f4f6aec79a605fa4d40 envoy/admin/v3/mutex_stats.proto @@ -15,11 +15,11 @@ // Proto representation of the statistics collected upon absl::Mutex contention, if Envoy is run // under :option:`--enable-mutex-tracing`. For more information, see the ``absl::Mutex`` -// [docs](https://abseil.io/about/design/mutex#extra-features). +// `docs <https://abseil.io/about/design/mutex#extra-features>`__. // // *NB*: The wait cycles below are measured by ``absl::base_internal::CycleClock``, and may not // correspond to core clock frequency. For more information, see the ``CycleClock`` -// [docs](https://github.com/abseil/abseil-cpp/blob/master/absl/base/internal/cycleclock.h). +// `docs <https://github.com/abseil/abseil-cpp/blob/master/absl/base/internal/cycleclock.h>`__. message MutexStats { option (udpa.annotations.versioning).previous_message_type = "envoy.admin.v2alpha.MutexStats";

envoy/config/bootstrap/v3/bootstrap.proto:

--- shake256:c924c48805142874035bca256676bbe44f3cc4b100cb95399e38b7a66941264250981e2c44b4f94fcc10ad054dc5301909f0cdd5cc8e1620e7ab5c27fad12585 envoy/config/bootstrap/v3/bootstrap.proto +++ shake256:24dc50c4d6a191e16a5900c34cddb4d7d0409709c5b8a717da9b9eff7451365435e0b56da197dd084f4411d0460f7365bc255d0e622da1c6274e80a7e1de8126 envoy/config/bootstrap/v3/bootstrap.proto @@ -431,7 +431,8 @@ GrpcAsyncClientManagerConfig grpc_async_client_manager_config = 40; // Optional configuration for memory allocation manager. - // Memory releasing is only supported for `tcmalloc allocator <https://github.com/google/tcmalloc>`_. + // Memory releasing is supported with `tcmalloc <https://github.com/google/tcmalloc>`_ and + // `gperftools <https://github.com/gperftools/gperftools>`_. MemoryAllocatorManager memory_allocator_manager = 41; // When enabled, Envoy pins each worker thread to a distinct CPU from the process affinity mask, @@ -790,13 +791,14 @@ // [#next-free-field: 6] message MemoryAllocatorManager { - // Configures tcmalloc to perform background release of free memory in amount of bytes per ``memory_release_interval`` interval. - // If equals to ``0``, no memory release will occur. Defaults to ``0``. + // Configures tcmalloc to perform background release of free memory in amount of bytes per + // ``memory_release_interval`` interval. If equals to ``0``, no memory release will occur. + // Defaults to ``0``. uint64 bytes_to_release = 1; - // Interval in milliseconds for memory releasing. If specified, during every - // interval Envoy will try to release ``bytes_to_release`` of free memory back to operating system for reuse. - // Defaults to ``1000`` milliseconds. + // Interval in milliseconds for memory releasing. If specified, during every interval Envoy will + // try to release ``bytes_to_release`` of free memory back to operating system for reuse. If set + // to ``0``, no memory release will occur. Defaults to ``1000`` milliseconds. google.protobuf.Duration memory_release_interval = 2; // Sets the soft memory limit for tcmalloc. When the total memory used by tcmalloc exceeds this

envoy/config/cluster/v3/cluster.proto:

--- shake256:0e352afb4c3b6c449be91cfe0715f0daa54a7ae8c65ee7babb294f50f5dc8df268cc44d1e516198c3f635bf47a0349565bdd5e3b95ecff34c67e65f3c22fce0e envoy/config/cluster/v3/cluster.proto +++ shake256:37da7ed59f40a587cafd0726db8a894ff61a65bf604e2473b134eb33acec205c57602232ef3fd8e566ca031ee4decf0cc056d96d895ee992f7d77c154c747892 envoy/config/cluster/v3/cluster.proto @@ -13,6 +13,8 @@ import "envoy/config/core/v3/protocol.proto"; import "envoy/config/core/v3/resolver.proto"; import "envoy/config/endpoint/v3/endpoint.proto"; +import "envoy/config/metrics/v3/stats.proto"; +import "envoy/type/matcher/v3/metadata.proto"; import "envoy/type/metadata/v3/metadata.proto"; import "envoy/type/v3/percent.proto"; @@ -46,7 +48,7 @@ } // Configuration for a single upstream cluster. -// [#next-free-field: 61] +// [#next-free-field: 63] message Cluster { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.Cluster"; @@ -753,6 +755,18 @@ // harm latency more than the preconnecting helps. google.protobuf.DoubleValue predictive_preconnect_ratio = 2 [(validate.rules).double = {lte: 3.0 gte: 1.0}]; + + // Restricts anticipatory connections to hosts whose endpoint metadata matches this matcher. + // Non-matching hosts are never preconnected, and instead get connections only on demand, as they + // serve real requests. If unset, all healthy hosts are eligible. + type.matcher.v3.MetadataMatcher preconnect_enabled_metadata = 3; + } + + // Queueing policies for the cluster. + message QueuingPolicies { + // Queue policy for cluster pending requests. If unset, Envoy uses the FIFO queue policy. + // [#extension-category: envoy.queue_policy] + core.v3.TypedExtensionConfig pending_rq_policy = 1; } reserved 12, 15, 7, 11, 35; @@ -866,6 +880,12 @@ // :ref:`Router Filter Header <config_http_filters_router_x-envoy-upstream-alt-stat-name>`. string alt_stat_name = 28 [(udpa.annotations.field_migrate).rename = "observability_name"]; + // Optional stats matcher that can be used to configure which stats are instantiated for this + // cluster. If configured, this overrides the bootstrap :ref:`stats_config + // <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.stats_config>` stats matcher configuration + // for this cluster. + metrics.v3.StatsMatcher stats_matcher = 61; + oneof cluster_discovery_type { // The :ref:`service discovery type <arch_overview_service_discovery_types>` // to use for resolving the cluster. @@ -914,7 +934,7 @@ // configuration for the cluster. If no // configuration is specified no health checking will be done and all cluster // members will be considered healthy at all times. - repeated core.v3.HealthCheck health_checks = 8; + repeated core.v3.HealthCheck health_checks = 8 [(validate.rules).repeated = {max_items: 8}]; // Optional maximum requests for a single upstream connection. This parameter // is respected by both the HTTP/1.1 and HTTP/2 connection pool @@ -1303,6 +1323,9 @@ // If ``connection_pool_per_downstream_connection`` is true, the cluster will use a separate // connection pool for every downstream connection bool connection_pool_per_downstream_connection = 51; + + // Queueing policies for the cluster (e.g. the queue policy for cluster pending requests). + QueuingPolicies queuing_policies = 62; } // Extensible load balancing policy configuration.

envoy/config/core/v3/address.proto:

--- shake256:f1c646aaa5ac13d22d3932210e1be33fc0af578674c8730aafe1dc375b5d44b2f20feae205bc597d7170bfabdca39a802fd0ad7094547267d86489739cd0fb0f envoy/config/core/v3/address.proto +++ shake256:dc3026fe73281be8f49653a477fd117922659cc75d2387f07dcebb4e9e79962ed2cfe12a779fcce4f341ed114c04964d6f6512a4168dab457bba08a44d1127b9 envoy/config/core/v3/address.proto @@ -103,7 +103,7 @@ // network namespace. // // .. note:: - // Setting this parameter requires Envoy to run with the ``CAP_NET_ADMIN`` capability. + // Setting this parameter requires Envoy to run with the ``CAP_SYS_ADMIN`` capability. // // .. attention:: // Network namespaces are only configurable on Linux. Otherwise, this field has no effect. @@ -144,7 +144,7 @@ SocketOptionsOverride socket_options = 2; } -// [#next-free-field: 7] +// [#next-free-field: 8] message BindConfig { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.BindConfig"; @@ -180,6 +180,24 @@ // <envoy_v3_api_msg_config.upstream.local_address_selector.v3.DefaultLocalAddressSelector>`). // [#extension-category: envoy.upstream.local_address_selector] TypedExtensionConfig local_address_selector = 6; + + // If set to true, the :ref:`network_namespace_filepath + // <envoy_v3_api_field_config.core.v3.SocketAddress.network_namespace_filepath>` of every source + // address in this bind config is validated when the configuration is loaded, and the + // configuration is rejected if a referenced network namespace cannot be opened. + // + // By default no such validation is performed: a network namespace that does not exist when the + // configuration is loaded may be created later, before connections are actually established, so + // eager validation would wrongly reject such configurations. If a namespace is unavailable when + // a connection is created, the connection attempt fails gracefully. + // + // Listener addresses do not need an equivalent option: a listener creates and binds its socket + // in the configured network namespace when the listener configuration is loaded, so an + // unavailable namespace always rejects the listener configuration. + // + // .. attention:: + // Network namespaces are only configurable on Linux. Otherwise, this field has no effect. + bool validate_network_namespaces = 7; } // Addresses specify either a logical or physical address and port, which are

envoy/config/core/v3/base.proto:

--- shake256:7c1daeba42d5b6f8bebe7b0a73688653a9833dece0690015566641da0894361405e5cc995807357a411231ca03efb7d8b45f7266bb2e70a65979707ec5895ada envoy/config/core/v3/base.proto +++ shake256:40fbed94190d48e57183cbfad8be7c2ad62220cf3832469320a5fd8452899f084db63ef0da48859d0c2a69aabe2cf7e9b41782d855e66f74c814cbd87c5f38a1 envoy/config/core/v3/base.proto @@ -486,6 +486,11 @@ // Is the header value allowed to be empty? If false (default), custom headers with empty values are dropped, // otherwise they are added. + // + // .. note:: + // In any context other than the router filter, we always act as if keep_empty_value is true, + // regardless of the setting of this field. + // bool keep_empty_value = 4; }

envoy/config/core/v3/config_source.proto:

--- shake256:f3cb7e88d65a8b2d19c1255815c37f61b708887327f5b3a58fe5b6bf8c0c1607d12b7bcabf156947db5c9108c041599af9f6a25ac22d0225326cc1c4418a343d envoy/config/core/v3/config_source.proto +++ shake256:08a48e484d19ccab2d4169ce5191e666f0eb3cf37656ea19c22e94a1c4764d7928df1ff4f530f2ef7aacfbe26d40234c1f4ba8ff38d9166f683a9af6c5656af1 envoy/config/core/v3/config_source.proto @@ -157,9 +157,10 @@ // Local filesystem path configuration source. message PathConfigSource { - // Path on the filesystem to source and watch for configuration updates. - // When sourcing configuration for a :ref:`secret <envoy_v3_api_msg_extensions.transport_sockets.tls.v3.Secret>`, - // the certificate and key files are also watched for updates. + // Path on the filesystem from which to source configuration updates. + // When sourcing configuration for a + // :ref:`secret <envoy_v3_api_msg_extensions.transport_sockets.tls.v3.Secret>`, file-based secret + // data supported for SDS rotation is also monitored for updates. // // .. note:: // @@ -167,12 +168,14 @@ // // .. note:: // - // If ``watched_directory`` is *not* configured, Envoy will watch the file path for *moves*. - // This is because in general only moves are atomic. The same method of swapping files as is - // demonstrated in the :ref:`runtime documentation <config_runtime_symbolic_link_swap>` can be - // used here also. If ``watched_directory`` is configured, no watch will be placed directly on - // this path. Instead, the configured ``watched_directory`` will be used to trigger reloads of - // this path. This is required in certain deployment scenarios. See below for more information. + // If neither ``poll_interval`` nor ``watched_directory`` is configured, Envoy will watch the + // file path for *moves*. This is because in general only moves are atomic. The same method of + // swapping files as is demonstrated in the + // :ref:`runtime documentation <config_runtime_symbolic_link_swap>` can be used here also. + // One of ``poll_interval`` and ``watched_directory`` can also be configured; the configuration + // is rejected if both are set. With ``poll_interval``, the same path is reloaded periodically. + // With ``watched_directory``, no watch is placed directly on this path; events in the + // configured directory trigger this path to be reloaded. string path = 1 [(validate.rules).string = {min_len: 1}]; // If configured, this directory will be watched for *moves*. When an entry in this directory is @@ -188,7 +191,24 @@ // // The above configuration will ensure that Envoy watches the owning directory for moves which is // required due to how Kubernetes manages ConfigMap symbolic links during atomic updates. + // + // This field cannot be used together with ``poll_interval``. WatchedDirectory watched_directory = 2; + + // If configured, the ``path`` will be polled at this interval instead of watched for filesystem + // events on either the file or ``watched_directory``. This is useful when the underlying + // filesystem does not reliably provide change notifications, or when a custom deployment model + // does not generate the move or modification events handled by watching the path or directory. + // The file is read on every poll, but an update is delivered only when its parsed contents + // change. + // + // When this configuration source provides a + // :ref:`Secret <envoy_v3_api_msg_extensions.transport_sockets.tls.v3.Secret>`, the same secret + // files that are watched in event-based mode are polled at this interval. The last successfully + // loaded configuration or secret remains active when a poll fails. + // + // This field cannot be used together with ``watched_directory`` and must be at least 1ms. + google.protobuf.Duration poll_interval = 3 [(validate.rules).duration = {gte {nanos: 1000000}}]; } // Configuration for :ref:`listeners <config_listeners>`, :ref:`clusters

envoy/config/core/v3/health_check.proto:

--- shake256:6a4880727a18c76c27422fb04451cb0c08cb6acc712b2ba3b3a68c81cb00feb401d2d4f8d666cbaaa787331838d3b8b8a9cf3a0ec609f9cb00c9f97574edae2a envoy/config/core/v3/health_check.proto +++ shake256:cda524b2a1908462490b81541b602147412724271fcf51e250dd525866ff0365cf20a893d6b4aa94b32843764f574e93cfa05b1e1ff823a6c5270d3446a195ba envoy/config/core/v3/health_check.proto @@ -63,7 +63,7 @@ [(validate.rules).repeated = {items {enum {defined_only: true}}}]; } -// [#next-free-field: 27] +// [#next-free-field: 28] message HealthCheck { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.HealthCheck"; @@ -83,7 +83,7 @@ } } - // [#next-free-field: 15] + // [#next-free-field: 16] message HttpHealthCheck { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.core.HealthCheck.HttpHealthCheck"; @@ -152,9 +152,24 @@ // non-200 response will result in the host being marked unhealthy. repeated type.v3.Int64Range retriable_statuses = 12; - // Use specified application protocol for health checks. + // Use specified application protocol for health checks. With :ref:`use_alpn_protocol + // <envoy_v3_api_field_config.core.v3.HealthCheck.HttpHealthCheck.use_alpn_protocol>` this is + // the codec used when ALPN settles on neither ``h2`` nor ``http/1.1``. type.v3.CodecClientType codec_client_type = 10 [(validate.rules).enum = {defined_only: true}]; + // Select the codec from the protocol negotiated by ALPN on the health check connection: HTTP/2 + // when ``h2`` is negotiated, HTTP/1.1 when ``http/1.1`` is negotiated, and otherwise + // ``codec_client_type``, including when nothing is negotiated. With ``codec_client_type`` at + // its default this is the same mapping as the cluster's :ref:`auto_config + // <envoy_v3_api_field_extensions.upstreams.http.v3.HttpProtocolOptions.auto_config>`. Like + // ``auto_config``, it requires a transport socket that supports ALPN such as TLS and is + // rejected on a cluster whose transport sockets do not, unless the + // ``config.do_not_validate_alpn_support`` runtime key is set, as for ``auto_config``. It + // cannot be combined with ``codec_client_type`` ``HTTP3``. See :ref:`tls_options + // <envoy_v3_api_field_config.core.v3.HealthCheck.tls_options>` for what the connection + // advertises. + bool use_alpn_protocol = 15; + // An optional service name parameter which is used to validate the identity of // the health checked cluster using a :ref:`StringMatcher // <envoy_v3_api_msg_type.matcher.v3.StringMatcher>`. See the :ref:`architecture overview @@ -260,12 +275,21 @@ // Specifies the ALPN protocols for health check connections. This is useful if the // corresponding upstream is using ALPN-based :ref:`FilterChainMatch // <envoy_v3_api_msg_config.listener.v3.FilterChainMatch>` along with different protocols for health checks - // versus data connections. If empty, no ALPN protocols will be set on health check connections. + // versus data connections. If empty, health check connections advertise the ALPN protocols of + // the cluster's TLS context, if any. With :ref:`use_alpn_protocol + // <envoy_v3_api_field_config.core.v3.HealthCheck.HttpHealthCheck.use_alpn_protocol>`, + // the negotiated protocol selects the health check codec. repeated string alpn_protocols = 1; } reserved 10; + // Optional name for this health checker. When set, per-checker stats are emitted under + // ``health_check.name.<name>.<stat>`` instead of ``health_check.<stat>``. + // + // This is required if multiple health checks are configured on a cluster. + string name = 27; + // The time to wait for a health check response. If the timeout is reached the // health check attempt will be considered a failure. google.protobuf.Duration timeout = 1 [(validate.rules).duration = {

envoy/config/core/v3/proxy_protocol.proto:

--- shake256:ffd5b6efba152ae8c135ff89f8c569e21f584379f1047a3dba7e53bbcd62880dc8e0ab883ae66bd8dc69d665a58affa6a2c29dd376fc21da66b09a0194d50b59 envoy/config/core/v3/proxy_protocol.proto +++ shake256:0a7f86f42952f99273f528aed03accb6581d2034c07e9e6729bb66c4f493df1610e8ea25c8f2162cc9d9c765b8e2b0f6866a453c5b53ac0191f434acbc8b91ff envoy/config/core/v3/proxy_protocol.proto @@ -109,6 +109,7 @@ } message PerHostConfig { - // Enables per-host configuration for Proxy Protocol. + // Enables per-host configuration for Proxy Protocol. Only the static ``value`` of each + // ``TlvEntry`` is applied to host-level TLVs. The ``format_string`` field is not evaluated here. repeated TlvEntry added_tlvs = 1; }

envoy/config/core/v3/substitution_format_string.proto:

--- shake256:2ecc944e590837c4b221e72959420b145d0ef24fb8ac4534355cdb0bd6bd6c333093baf209e5d4c933a386cdec5e48e5f7c07859d329b518f937a371e92eb0bb envoy/config/core/v3/substitution_format_string.proto +++ shake256:e7b2aa046c34262556a5d6bafe6de68e303abc33b1bedb53514c3aef61660502bc60baf30d1014820e8f735de65efb7fc2af55feedf2062cee2255e1c7f9f325 envoy/config/core/v3/substitution_format_string.proto @@ -105,13 +105,11 @@ // // * for ``text_format``, the output of the empty operator is changed from ``-`` to an // empty string, so that empty values are omitted entirely. - // * for ``json_format`` the keys with null values are omitted in the output structure. - // - // .. note:: - // This option does not work perfectly with ``json_format`` as keys with ``null`` values - // will still be included in the output. See https://github.com/envoyproxy/envoy/issues/37941 - // for more details. + // * for ``json_format``, the keys with null values are omitted in the output structure. Nested + // objects whose values are all omitted are removed as well, while empty arrays are preserved. + // The root object is always emitted, so a fully empty structure is rendered as ``{}``. // + // Defaults to false. bool omit_empty_values = 3; // Specify a ``content_type`` field.

envoy/config/listener/v3/listener.proto:

--- shake256:8fcdd4fadff652872bc3cd0330cb7811e0b00b481f61ddb37957da05fdba17857f46ab83d350fe11cb88f17b8f7cf656bed0178f212496368adae23c6f6eede3 envoy/config/listener/v3/listener.proto +++ shake256:ba2b9f6a0eeead34c75bac35812ae40ec1d1784969ea691c12517bb3be61bd5b9d32dd332aa48c4b3b0507224d5fd9f4ce0dc31810942d0ee424803878155286 envoy/config/listener/v3/listener.proto @@ -11,6 +11,7 @@ import "envoy/config/listener/v3/api_listener.proto"; import "envoy/config/listener/v3/listener_components.proto"; import "envoy/config/listener/v3/udp_listener_config.proto"; +import "envoy/config/metrics/v3/stats.proto"; import "google/protobuf/duration.proto"; import "google/protobuf/wrappers.proto"; @@ -61,7 +62,7 @@ repeated xds.core.v3.CollectionEntry entries = 1; } -// [#next-free-field: 39] +// [#next-free-field: 40] message Listener { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.Listener"; @@ -137,9 +138,7 @@ // The listener will use the connection balancer according to ``type_url``. If ``type_url`` is invalid, // Envoy will not attempt to balance active connections between worker threads. - // The ``envoy.network.connection_balance`` extension category is currently empty - // because the only registered member (``envoy.network.connection_balance.dlb``) - // is disabled. See https://github.com/envoyproxy/envoy/issues/45491. + // The ``envoy.network.connection_balance`` extension category is currently empty. core.v3.TypedExtensionConfig extend_balance = 2; // If specified, the listener will steer new connections to worker threads using a kernel @@ -197,6 +196,12 @@ // ``listener.<stat_prefix>.``. string stat_prefix = 28; + // Optional stats matcher that can be used to configure which stats are instantiated for this + // listener. If configured, this overrides the bootstrap :ref:`stats_config + // <envoy_v3_api_field_config.bootstrap.v3.Bootstrap.stats_config>` stats matcher configuration + // for this listener. + metrics.v3.StatsMatcher stats_matcher = 39; + // A list of filter chains to consider for this listener. The // :ref:`FilterChain <envoy_v3_api_msg_config.listener.v3.FilterChain>` with the most specific // :ref:`FilterChainMatch <envoy_v3_api_msg_config.listener.v3.FilterChainMatch>` criteria is used on a @@ -257,8 +262,11 @@ // The following pre-defined metadata could be used by Envoy to manipulate the listener behavior: // // * ``envoy.stats_matcher``: this metadata could be used to customize the stats emitted by the - // listener. See :ref:`well-known metadata <well_known_metadata_envoy_stats_matcher>` for more - // details. + // listener. See :ref:`well-known metadata + // <well_known_metadata_envoy_stats_matcher>` for more details. + // If :ref:`stats_matcher + // <envoy_v3_api_field_config.listener.v3.Listener.stats_matcher>` is configured, this metadata + // is ignored. The ``stats_matcher`` field should be preferred. // core.v3.Metadata metadata = 6;

envoy/config/listener/v3/quic_config.proto:

--- shake256:270a2e5b4b151c02c49ec87874d7fa8a2e2dddef86063a6fea58695044f1972043a9392d7d450a75981dccc38b43da984d68aa9a2c4530afdd9c538c095c8fd9 envoy/config/listener/v3/quic_config.proto +++ shake256:141946962e83db22b0607a516569e39151a7c8fcf202a0f5a535380b4bb16a4e6f8d4052c4fc81b98bb659b97a3ea188f5a8742d0489948e915b8cc8e6c643d6 envoy/config/listener/v3/quic_config.proto @@ -10,8 +10,6 @@ import "google/protobuf/duration.proto"; import "google/protobuf/wrappers.proto"; -import "xds/annotations/v3/status.proto"; - import "udpa/annotations/status.proto"; import "udpa/annotations/versioning.proto"; import "validate/validate.proto"; @@ -76,8 +74,7 @@ // The current QUICHE implementation will advertise only one of the preferred IPv4 and IPv6 addresses based on the address family the client initially connects with. // If not specified, Envoy will not advertise any server's preferred address. // [#extension-category: envoy.quic.server_preferred_address] - core.v3.TypedExtensionConfig server_preferred_address_config = 9 - [(xds.annotations.v3.field_status).work_in_progress = true]; + core.v3.TypedExtensionConfig server_preferred_address_config = 9; // Configure the server to send transport parameter `disable_active_migration <https://www.rfc-editor.org/rfc/rfc9000#section-18.2-4.30.1>`_. // Defaults to false (do not send this transport parameter).

envoy/config/metrics/v3/stats.proto:

--- shake256:600bf979d68f259c4c3c7c9f75d0d61641735068b506e4fdb0de466226904a3dac12f57cca2907bdaab8f08d6584608222caa9d9d192c40e9de726b0e7bfb4ea envoy/config/metrics/v3/stats.proto +++ shake256:cad99b38900a55cba98761d6c0e7bb4fdad8d2a3b0bd804c2cfbd7cae55f6f601638cf2aab40d2b5e92ca5bcda90b1f4c8f85192bdd893688f75351a66600dd2 envoy/config/metrics/v3/stats.proto @@ -362,6 +362,14 @@ // envoy.test_counter:1|c // envoy.test_timer:5|ms string prefix = 3; + + // If true, histogram samples are scaled to milliseconds according to the histogram's unit + // before being reported as timers: samples of histograms recording microseconds are divided by + // 1000 and reported as a fractional millisecond value, while histograms recording milliseconds + // or without a declared unit are reported unchanged. By default every sample is reported + // unchanged with an ``ms`` suffix regardless of the histogram's unit, so histograms recording + // microseconds are reported a factor of 1000 off. + bool scale_histogram_units_to_milliseconds = 4; } // Stats configuration proto schema for built-in ``envoy.stat_sinks.dog_statsd`` sink. @@ -369,6 +377,7 @@ // compatible tags. Tags are configurable via :ref:`StatsConfig // <envoy_v3_api_msg_config.metrics.v3.StatsConfig>`. // [#extension: envoy.stat_sinks.dog_statsd] +// [#next-free-field: 6] message DogStatsdSink { option (udpa.annotations.versioning).previous_message_type = "envoy.config.metrics.v2.DogStatsdSink"; @@ -394,6 +403,12 @@ // // Note that this value may not be respected if smaller than a single metric. google.protobuf.UInt64Value max_bytes_per_datagram = 4 [(validate.rules).uint64 = {gt: 0}]; + + // If true, histogram samples are scaled to milliseconds according to the histogram's unit + // before being reported as timers. See :ref:`StatsdSink's scale_histogram_units_to_milliseconds + // field <envoy_v3_api_field_config.metrics.v3.StatsdSink.scale_histogram_units_to_milliseconds>` + // for more details. + bool scale_histogram_units_to_milliseconds = 5; } // Stats configuration proto schema for built-in ``envoy.stat_sinks.hystrix`` sink.

envoy/config/overload/v3/overload.proto:

--- shake256:d1956a9d7a0955671ca719b81eebec0a508392f9cc438726deaa4e215fa1f2c27888edaba38e6b570578bb2112da42aa13351b3f7443efe95a2fcc4f0f2932ae envoy/config/overload/v3/overload.proto +++ shake256:b1483b097f119a5da9c7882192543cee4c57eb7a7f4caee285711bea09f6924a210d40c3dc2cfa4aba940d8b2bf2650e9b557b1fea96771edf54e5374387cfe8 envoy/config/overload/v3/overload.proto @@ -157,8 +157,10 @@ option (udpa.annotations.versioning).previous_message_type = "envoy.config.overload.v2alpha.OverloadAction"; - // The name of the overload action. This is just a well-known string that - // listeners can use for registering callbacks. + // The action name. Most actions use a well-known string for listener callback registration. + // ``ScaleTimersOverloadActionConfig`` actions may use unique custom names for independently + // triggered ``reduce_timeouts`` instances. Custom names must not use the reserved + // ``envoy.overload_actions.`` prefix. No action name may duplicate a ``LoadShedPoint`` name. // Valid known overload actions include: // - envoy.overload_actions.stop_accepting_requests // - envoy.overload_actions.disable_http_keepalive @@ -178,7 +180,10 @@ // in this list. repeated Trigger triggers = 2 [(validate.rules).repeated = {min_items: 1}]; - // Configuration for the action being instantiated if applicable. + // Optional implementation configuration. Well-known names identify the action directly; for a + // custom name, this configuration's type identifies it. Currently only + // ``ScaleTimersOverloadActionConfig`` supports custom names, identifying a ``reduce_timeouts`` + // instance. google.protobuf.Any typed_config = 3; }

envoy/config/route/v3/route.proto:

--- shake256:9e8d88f559a8724f64cdb259bb06d5d79dcc40430a2c190ceb6be8ad2bc989409748fc5f4d6d1b6f2dfd1deeb4804b13568d2a664d74554b431480d5a275535b envoy/config/route/v3/route.proto +++ shake256:698dbbd10b0ac4fc88e4935f5677ad37d0abc91eea4bf05e3c35035033cf235d968216abe5b582a7b0c5181ad56a743cfce17ec291b852384f2d3f3ec4c630af envoy/config/route/v3/route.proto @@ -4,6 +4,7 @@ import "envoy/config/core/v3/base.proto"; import "envoy/config/core/v3/config_source.proto"; +import "envoy/config/core/v3/extension.proto"; import "envoy/config/route/v3/route_components.proto"; import "google/protobuf/any.proto"; @@ -23,7 +24,7 @@ // * Routing :ref:`architecture overview <arch_overview_http_routing>` // * HTTP :ref:`router filter <config_http_filters_router>` -// [#next-free-field: 19] +// [#next-free-field: 20] message RouteConfiguration { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.RouteConfiguration"; @@ -138,7 +139,8 @@ // Normally, virtual host matching is done using the :authority (or // Host: in HTTP < 2) HTTP header. Setting this will instead, use a // different HTTP header for this purpose. - string vhost_header = 18; + string vhost_header = 18 + [(validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false}]; // Ignore path-parameters in path-matching. // Before RFC3986, URI were like(RFC1808): <scheme>://<net_loc>/<path>;<params>?<query>#<fragment> @@ -162,6 +164,34 @@ // For instance, if the metadata is intended for the Router filter, // the filter name should be specified as ``envoy.filters.http.router``. core.v3.Metadata metadata = 17; + + // After the route matching has resolved a route for incoming request, the route specifiers + // are applied to the route to customize or monitor it and the output of the specifiers will be + // used as the final route by Envoy for the request. The specifiers here will not modify/affect + // the request attributes (e.g., headers, path) directly. + // + // Specifiers are executed in order, and the output of each is the input of the next. The route + // that comes out of the last one is the route Envoy uses for the request. + // + // Specifiers are configured at three levels. Specifiers in three levels will run in this order: + // + // 1. The ``route_specifiers`` of resolved + // :ref:`route <envoy_v3_api_msg_config.route.v3.Route>` + // 2. The ``route_specifiers`` of resolved + // :ref:`virtual host <envoy_v3_api_msg_config.route.v3.VirtualHost>` + // 3. The ``route_specifiers`` of + // :ref:`route configuration <envoy_v3_api_msg_config.route.v3.RouteConfiguration>`. + // + // .. note:: + // If the route matching resolves no route, the route specifiers at the route configuration + // and the virtual host levels will still be applied to null. This allows route specifiers to + // optionally generate a valid route even when no route is resolved for the request. + // Similarly, if the route matching resolves a valid route, the route specifiers may drop it + // and return no route. Then Envoy will treat it as route not found and result in 404 response. + // + // See :ref:`route specifiers <config_http_conn_man_route_specifiers>` for more details. + // [#extension-category: envoy.router.route_specifiers] + repeated core.v3.TypedExtensionConfig route_specifiers = 19; } message Vhds {

envoy/config/route/v3/route_components.proto:

--- shake256:4c06a04c3d3885fa814d499cad8097eac67e1844f2c8e3985c24aa21b99d55851bd7d9e273c18536101f3b7df3064ad87027d77328a36793f75acbdfef4596b7 envoy/config/route/v3/route_components.proto +++ shake256:2c94a38b712b0bc8464609832cff79b02595cb280c341eeffc6042d89a9c623376cdfd615ecb833fd3ce82f83857f1a4073016dc8b55d6b56a5090683ddfd91c envoy/config/route/v3/route_components.proto @@ -45,7 +45,7 @@ // host header. This allows a single listener to service multiple top level domain path trees. Once // a virtual host is selected based on the domain, the routes are processed in order to see which // upstream cluster to route to or whether to perform a redirect. -// [#next-free-field: 26] +// [#next-free-field: 27] message VirtualHost { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.VirtualHost"; @@ -258,6 +258,27 @@ // For instance, if the metadata is intended for the Router filter, // the filter name should be specified as ``envoy.filters.http.router``. core.v3.Metadata metadata = 24; + + // After the route matching has resolved a route for incoming request, the route specifiers + // are applied to the route to customize or monitor it and the output of the specifiers will be + // used as the final route by Envoy for the request. The specifiers here will not modify/affect + // the request attributes (e.g., headers, path) directly. + // + // Specifiers are executed in order, and the output of each is the input of the next. The + // specifiers here will run after the ``route_specifiers`` of the resolved + // :ref:`route <envoy_v3_api_field_config.route.v3.Route.route_specifiers>` + // and before the ``route_specifiers`` of + // :ref:`route configuration <envoy_v3_api_field_config.route.v3.RouteConfiguration.route_specifiers>`. + // + // .. note:: + // If the route matching resolves no route, the route specifiers at the route configuration + // and the virtual host levels will still be applied to null. This allows route specifiers to + // optionally generate a valid route even when no route is resolved for the request. + // Similarly, if the route matching resolves a valid route, the route specifiers may drop it + // and return no route. Then Envoy will treat it as route not found and result in 404 response. + // + // See :ref:`route specifiers <config_http_conn_man_route_specifiers>` for more details. + repeated core.v3.TypedExtensionConfig route_specifiers = 26; } // A filter-defined action type. @@ -281,7 +302,7 @@ // // Envoy supports routing on HTTP method via :ref:`header matching // <envoy_v3_api_msg_config.route.v3.HeaderMatcher>`. -// [#next-free-field: 21] +// [#next-free-field: 22] message Route { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.Route"; @@ -420,6 +441,28 @@ // Only one of :ref:`per_request_buffer_limit_bytes <envoy_v3_api_field_config.route.v3.Route.per_request_buffer_limit_bytes>` // and ``request_body_buffer_limit`` may be set. google.protobuf.UInt64Value request_body_buffer_limit = 20; + + // After the route matching has resolved this route for incoming request, the route specifiers + // are applied to the route to customize or monitor it and the output of the specifiers will be + // used as the final route by Envoy for the request. The specifiers here will not modify/affect + // the request attributes (e.g., headers, path) directly. + // + // Specifiers are executed in order, and the output of each is the input of the next. The + // specifiers here will run first, before the ``route_specifiers`` of + // :ref:`virtual host <envoy_v3_api_field_config.route.v3.VirtualHost.route_specifiers>` and + // :ref:`route configuration <envoy_v3_api_field_config.route.v3.RouteConfiguration.route_specifiers>`, + // so the route that comes out of the last specifier here is the input of the specifiers of + // these two levels. + // + // .. note:: + // If the route matching resolves no route, the route specifiers at the route configuration + // and the virtual host levels will still be applied to null. This allows route specifiers to + // optionally generate a valid route even when no route is resolved for the request. + // Similarly, if the route matching resolves a valid route, the route specifiers may drop it + // and return no route. Then Envoy will treat it as route not found and result in 404 response. + // + // See :ref:`route specifiers <config_http_conn_man_route_specifiers>` for more details. + repeated core.v3.TypedExtensionConfig route_specifiers = 21; } // Compared to the :ref:`cluster <envoy_v3_api_field_config.route.v3.RouteAction.cluster>` field that specifies a @@ -831,8 +874,6 @@ // Configures :ref:`internal redirect <arch_overview_internal_redirects>` behavior. // [#next-major-version: remove this definition - it's defined in the InternalRedirectPolicy message.] enum InternalRedirectAction { - option deprecated = true; - PASS_THROUGH_INTERNAL_REDIRECT = 0; HANDLE_INTERNAL_REDIRECT = 1; } @@ -1799,7 +1840,11 @@ // .. note:: // This currently works when the route cluster specifier support the dynamic refresh, // e.g. :ref:`matcher cluster specifier - // <envoy_v3_api_msg_extensions.router.cluster_specifiers.matcher.v3.MatcherClusterSpecifier>`. + // <envoy_v3_api_msg_extensions.router.cluster_specifiers.matcher.v3.MatcherClusterSpecifier>`, + // :ref:`priority group cluster specifier + // <envoy_v3_api_msg_extensions.router.cluster_specifiers.priority_group.v3.PriorityGroupClusterSpecifier>` + // and :ref:`dynamic modules cluster specifier + // <envoy_v3_api_msg_extensions.router.cluster_specifiers.dynamic_modules.v3.DynamicModuleClusterSpecifier>`. bool refresh_cluster_on_retry = 14; }

envoy/config/trace/v3/opentelemetry.proto:

--- shake256:8e0324e178d7561d08e816cdd67afb981b2b68228a878957657bde04fa66fc6b065368cc37be30bbd2171e5d1fa4cdab19a7d0b73d579bb43329373316ee2bda envoy/config/trace/v3/opentelemetry.proto +++ shake256:17cc86cb088fc468511d70720b7210abb576ff0ffbe5a4ac3cd60c8cd27344464cc70c7ab2d1c95035a5c13dc56391bb802407f9605387fc04e7d808d6423c22 envoy/config/trace/v3/opentelemetry.proto @@ -21,18 +21,18 @@ // Configuration for the OpenTelemetry tracer. // [#extension: envoy.tracers.opentelemetry] -// [#next-free-field: 9] +// [#next-free-field: 11] message OpenTelemetryConfig { // The upstream gRPC cluster that will receive OTLP traces. // Note that the tracer drops traces if the server does not read data fast enough. // This field can be left empty to disable reporting traces to the gRPC service. - // Only one of ``grpc_service``, ``http_service`` may be used. + // Only one of ``grpc_service``, ``http_service``, ``exporter`` may be used. core.v3.GrpcService grpc_service = 1 [(udpa.annotations.field_migrate).oneof_promotion = "otlp_exporter"]; // The upstream HTTP cluster that will receive OTLP traces. // This field can be left empty to disable reporting traces to the HTTP service. - // Only one of ``grpc_service``, ``http_service`` may be used. + // Only one of ``grpc_service``, ``http_service``, ``exporter`` may be used. // // .. note:: // @@ -42,6 +42,14 @@ core.v3.HttpService http_service = 3 [(udpa.annotations.field_migrate).oneof_promotion = "otlp_exporter"]; + // Specifies the custom exporter to be used by the OpenTelemetry tracer. + // Only one of ``grpc_service``, ``http_service``, ``exporter`` may be used. + // + // [#extension-category: envoy.tracers.opentelemetry.exporters] + // [#not-implemented-hide:] + core.v3.TypedExtensionConfig exporter = 10 + [(udpa.annotations.field_migrate).oneof_promotion = "otlp_exporter"]; + // The name for the service. This will be populated in the ResourceSpan Resource attributes. // If it is not provided, it will default to "unknown_service:envoy". string service_name = 2; @@ -76,4 +84,8 @@ // Specifies whether to set the ``service.name`` resource attribute. // If not specified, the default is to set this attribute. google.protobuf.BoolValue set_service_name_resource_attribute = 8; + + // Specifies whether to set the instrumentation scope name ("envoy") and version on emitted traces. + // If not specified, the default is to set the instrumentation scope name and version. + google.protobuf.BoolValue set_instrumentation_scope = 9; }

envoy/data/core/v3/health_check_event.proto:

--- shake256:52a273d10476cf55e56112ff343c5c91a644f232ec677a9437ae0a54e392455580bbff0912e2cef39f1692af08740f309cea6019f29dcc61a6b54f2c7048ccd7 envoy/data/core/v3/health_check_event.proto +++ shake256:1732513f22bc9d5956267a7d4a149f2c9b3471c8b8da67733e786b32684e80344e44bbbc1a9873bb5ee979cbbdaed2a8d2d4082c7161e552d710eed81e2e7b5b envoy/data/core/v3/health_check_event.proto @@ -34,6 +34,7 @@ REDIS = 3; THRIFT = 4; DYNAMIC_MODULE = 5; + UDP = 6; } // [#next-free-field: 13]

envoy/extensions/access_loggers/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:6a79c855b6c0be08965931e01925e38b0dd6b550fbf8a89822f2c358fb26fbfda4c2ca08eade15ac926c325d8ccdab9604f26a6e74fcf63928b179f7a5c35443 envoy/extensions/access_loggers/dynamic_modules/v3/dynamic_modules.proto +++ shake256:b801c7532eafc67c8c9fcdb522b395770893de74f2433033bd97d013256be1182c75b86afee07c81abc0c6c35dfc8115ac25e0222c1a07db170dd5f06da6e7a3 envoy/extensions/access_loggers/dynamic_modules/v3/dynamic_modules.proto @@ -53,7 +53,8 @@ // The ``logger_config`` can be used to configure file paths, service endpoints, batching // parameters, format strings, etc. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/access_loggers/open_telemetry/v3/logs_service.proto:

--- shake256:22d4d7d08052b89328069887d994556ba290264f6b8eb10b59f7d924da761c06d89ee28b81b3e7892a0418ecc51ccdd04ad41e97451731cea47ad6e3532c6e5b envoy/extensions/access_loggers/open_telemetry/v3/logs_service.proto +++ shake256:8491c4d20717a14b78e5865417c9f035c5c6371b960584af09789287d65d19d29599727d0a67e6b172df026afee9a7718a0befea90fcb38e24c106a3a3837346 envoy/extensions/access_loggers/open_telemetry/v3/logs_service.proto @@ -29,7 +29,7 @@ // populate `opentelemetry.proto.collector.v1.logs.ExportLogsServiceRequest.resource_logs <https://github.com/open-telemetry/opentelemetry-proto/blob/main/opentelemetry/proto/collector/logs/v1/logs_service.proto>`_. // In addition, the request start time is set in the dedicated field. // [#extension: envoy.access_loggers.open_telemetry] -// [#next-free-field: 15] +// [#next-free-field: 16] message OpenTelemetryAccessLogConfig { // [#comment:TODO(itamarkam): add 'filter_state_objects_to_log' to logs.] // Deprecated. Use ``grpc_service`` or ``http_service`` instead. @@ -54,13 +54,29 @@ // If specified, Envoy will not generate built-in resource labels // like ``log_name``, ``zone_name``, ``cluster_name``, ``node_name``. + // + // Built-in labels have the lowest precedence and can be overridden by matching keys in + // :ref:`resource_detectors <envoy_v3_api_field_extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig.resource_detectors>` + // or :ref:`resource_attributes <envoy_v3_api_field_extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig.resource_attributes>`. bool disable_builtin_labels = 5; // OpenTelemetry `Resource <https://github.com/open-telemetry/opentelemetry-proto/blob/main/opentelemetry/proto/logs/v1/logs.proto#L51>`_ // attributes are filled with Envoy node info. // Example: ``resource_attributes { values { key: "region" value { string_value: "cn-north-7" } } }``. + // + // Attributes configured here take highest precedence (``resource_attributes`` > ``resource_detectors`` > built-in labels) + // and will override any matching keys. opentelemetry.proto.common.v1.KeyValueList resource_attributes = 4; + // An ordered list of resource detectors to detect OpenTelemetry resource information such as + // attributes and schema URL. + // + // Attributes detected here override built-in labels with matching keys, but are overridden by + // :ref:`resource_attributes <envoy_v3_api_field_extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig.resource_attributes>` + // (precedence: ``resource_attributes`` > ``resource_detectors`` > built-in labels). + // [#extension-category: envoy.tracers.opentelemetry.resource_detectors] + repeated config.core.v3.TypedExtensionConfig resource_detectors = 15; + // OpenTelemetry `LogResource <https://github.com/open-telemetry/opentelemetry-proto/blob/main/opentelemetry/proto/logs/v1/logs.proto>`_ // fields, following `Envoy access logging formatting <https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage>`_. //

envoy/extensions/bootstrap/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:6fce554d394bed9723dc38e8dbad13f7ed0b955cff4ef9af3492024133d2241b8097a22109e5bae906b63bf468a58f7cf3b5fbad9a7ba6d9deafb339dae8d9be envoy/extensions/bootstrap/dynamic_modules/v3/dynamic_modules.proto +++ shake256:bcca4a38dfc74d193604e0758a536a6a3d5ae2b277355ea283da3468f47183524ccb3b0655df290586bc3e325a8584a610ea5fbe554d59cfd6bb2dd5465b20f3 envoy/extensions/bootstrap/dynamic_modules/v3/dynamic_modules.proto @@ -54,7 +54,8 @@ // one for metric initialization, ``extension_name`` is used to choose the implementation. The // ``extension_config`` can be used to configure the specific behavior of each implementation. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/v3/downstream_reverse_connection_socket_interface.proto:

--- shake256:4d6c09554d3b68490a77d8095e475fa647624f37a2ac97f4f3c2f03ad3942a1fc96dfe8f459a87fd472a60ed07c386f0e235ae32be18ba8e34bc0c005e46829d envoy/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/v3/downstream_reverse_connection_socket_interface.proto +++ shake256:06777c0a6d9c75d1495b8fc59a5a4b0be7a8de43bcecde66c564eaf5f3746d866e4fe4f4ad9e3182ddea2ef478b2932723f7dde312dc0a6a634f655b87b3da09 envoy/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/v3/downstream_reverse_connection_socket_interface.proto @@ -23,9 +23,10 @@ // Configuration for the downstream reverse connection socket interface. // This interface initiates reverse connections to upstream Envoys and provides // them as socket connections for downstream requests. -// [#next-free-field: 6] +// [#next-free-field: 7] message DownstreamReverseConnectionSocketInterface { // HTTP handshake settings for initiator envoy initiated reverse tunnels. + // [#next-free-field: 6] message HttpHandshakeConfig { // Request path used when issuing the HTTP reverse-connection handshake. Defaults to // "/reverse_connections/request". @@ -45,6 +46,14 @@ // as substitution format strings; when empty, the values are sent literally. // [#extension-category: envoy.formatter] repeated config.core.v3.TypedExtensionConfig formatters = 4; + + // Maximum time to receive the handshake response after the connection opens. If not specified, + // defaults to ``15s``. On expiry the attempt is closed, recorded with failure reason + // ``timeout``, and normal backoff applies. + google.protobuf.Duration handshake_timeout = 5 [(validate.rules).duration = { + lte {seconds: 300} + gt {} + }]; } // Stat prefix to be used for downstream reverse connection socket interface stats. @@ -60,9 +69,10 @@ HttpHandshakeConfig http_handshake = 3; // Access log configuration for reverse tunnel initiator lifecycle events. - // Logs are emitted on handshake success, handshake failure, and connection close. - // Reverse tunnel metadata (``node_id``, ``cluster_id``, ``tenant_id``, upstream cluster, etc.) - // is available via ``%DYNAMIC_METADATA(envoy.reverse_tunnel.initiator:*)%`` substitutions. + // Logs are emitted on handshake success, handshake failure, connection draining, and + // connection close. Reverse tunnel metadata (``node_id``, ``cluster_id``, ``tenant_id``, + // upstream cluster, ``connection_key``, ``connection_id``, etc.) is available via + // ``%DYNAMIC_METADATA(envoy.reverse_tunnel.initiator:*)%`` substitutions. repeated config.accesslog.v3.AccessLog access_log = 4; // Upper bound on the per-host reconnect backoff. The initiator retries a failed handshake on a @@ -70,4 +80,10 @@ // that schedule. google.protobuf.Duration max_reconnect_backoff = 5 [(validate.rules).duration = {gte {seconds: 1}}]; + + // How often the initiator re-checks each host and dials any missing reverse tunnels. + // Defaults to 10s. The re-check is jittered upward so agents that start together do not + // redial in lockstep. The minimum value is 100ms. + google.protobuf.Duration maintain_interval = 6 + [(validate.rules).duration = {gte {nanos: 100000000}}]; }

envoy/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/v3/upstream_reverse_connection_socket_interface.proto:

--- shake256:1469c987be8ca76f78498d29ce240aa40904695fcceb0d9b3d865044339f0f2973b168107285746c82050f8f222944419c5428553fd33e6d0d2e12dcec634b4b envoy/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/v3/upstream_reverse_connection_socket_interface.proto +++ shake256:d390dda96435e41cc43e4e950e0e287a2ba7a29c9377b73ce64e81bd9fe2098725eb8af751addc9845d89067141a36c34af023b4c7390d96c577c3506dd8102c envoy/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/v3/upstream_reverse_connection_socket_interface.proto @@ -20,7 +20,7 @@ // [#extension: envoy.bootstrap.reverse_tunnel.upstream_socket_interface] // Configuration for the upstream reverse connection socket interface. -// [#next-free-field: 7] +// [#next-free-field: 8] message UpstreamReverseConnectionSocketInterface { // Stat prefix for upstream reverse connection socket interface stats. string stat_prefix = 1; @@ -49,4 +49,13 @@ // Access logs emitted for reverse tunnel lifecycle events. Entries are generated for tunnel setup, // socket handoff, tunnel close, and post-handoff HTTP/2 keepalive timeout observations. repeated config.accesslog.v3.AccessLog access_log = 6; + + // Maximum number of concurrently accepted reverse connections per node (and per tenant + // when tenant isolation is enabled). The cap is only consulted for reverse tunnel network + // filters that opt in via ``enable_connection_limit``; filters that leave it disabled ignore it. + // The cap is enforced per worker thread, so the effective ceiling is roughly this value + // multiplied by the number of workers; it is also only approximate when rebalancing is enabled. + // Defaults to 0; combined with ``enable_connection_limit: true`` a value of 0 rejects all + // connections, so set a non-zero value whenever a filter enables the limit. + uint32 max_connections_per_node = 7; }

envoy/extensions/clusters/composite/v3/cluster.proto:

--- shake256:f4b676ef5840cc1e1d8e3fe0c4082b16c423ac1a7b25f9e58f1a3f43733cf51bb7902519dc780939132ae3287dc5c00b99d6894a6da03ad841517d12e072d5e9 envoy/extensions/clusters/composite/v3/cluster.proto +++ shake256:752daf76478d21aeef455c959b30d42551c1529a3c4b5790334fba28cec557c5595762f42088b438a472742078cedeb8b332f5fd732cac86f5de237ee754e61d envoy/extensions/clusters/composite/v3/cluster.proto @@ -18,7 +18,9 @@ // cluster selection, allowing different retry attempts to automatically target // different upstream clusters. Unlike the standard aggregate cluster which uses // health-based selection, the composite cluster uses the retry attempt count to -// deterministically select which sub-cluster to route to. +// deterministically select which sub-cluster to route to. If the selected sub-cluster has no +// host available, the following sub-clusters in the list are tried in order within the same +// attempt. // // When retry attempts exceed the number of configured clusters, requests will fail with no // host available. @@ -50,6 +52,8 @@ // List of clusters to use for request routing. The first cluster is used for the // initial request (attempt 1), the second cluster for the first retry (attempt 2), // and so on. Must contain at least one cluster. When retry attempts exceed the number - // of configured clusters, requests will fail with no host available. + // of configured clusters, requests will fail with no host available. When the cluster + // selected for an attempt has no host available, the following clusters in this list are + // tried in order for that attempt. repeated ClusterEntry clusters = 1 [(validate.rules).repeated = {min_items: 1}]; }

envoy/extensions/clusters/mcp_multicluster/v3/cluster.proto:

--- shake256:cf351b8d71d7f45e7cc327ecafde019c884ed6a3ddc31953e89d1dc2fdbb1ee4ad86df0465599f4a3c6a032b0006094f07ffebf800794b2f9c5186a2c603283b envoy/extensions/clusters/mcp_multicluster/v3/cluster.proto +++ shake256:e4e8ec2ca3180e520c0f89af150fbaebc08714966fa37cba4e42400c25258de81a6f4d9a979b285a010620246df74d8450251968717201c5d0f1b22170f5883e envoy/extensions/clusters/mcp_multicluster/v3/cluster.proto @@ -2,6 +2,8 @@ package envoy.extensions.clusters.mcp_multicluster.v3; +import "envoy/type/matcher/v3/string.proto"; + import "google/protobuf/duration.proto"; import "xds/annotations/v3/status.proto"; @@ -67,6 +69,40 @@ string host_rewrite_literal = 4; } + // Specifies which downstream request headers are allowed to be forwarded to an MCP + // backend. Modeled after + // :ref:`ext_proc's HeaderForwardingRules <envoy_v3_api_msg_extensions.filters.http.ext_proc.v3.ExternalProcessor>`, + // but MCP-local and secure-by-default: unlike ext_proc, an unset/empty policy + // forwards nothing rather than everything, because MCP requires audience-bound + // tokens and prohibits implicit token passthrough between a client and a backend it + // did not authenticate to. + // + // Evaluation order per header: + // + // 1. If the header matches ``disallowed_headers``, it is never forwarded — this + // takes precedence over everything below, including ``forward_all``. + // 2. Otherwise, if ``forward_all`` is true, the header is forwarded. + // 3. Otherwise, if the header matches ``allowed_headers``, it is forwarded. + // 4. Otherwise, the header is not forwarded. + // + // This does not cover header *mutation* or credential injection, which remain a + // separate concern from this policy. + message HeaderForwarding { + // If true, forward all downstream request headers to this backend (subject to + // ``disallowed_headers`` above), matching the legacy forward-everything behavior. + // Defaults to false. Users relying on the legacy behavior must set this explicitly. + bool forward_all = 1; + + // If set, specifically allow any header in this list to be forwarded. Ignored for a + // header that also matches ``disallowed_headers``, and redundant (but harmless) for + // any header covered by ``forward_all``. + type.matcher.v3.ListStringMatcher allowed_headers = 2; + + // If set, specifically disallow any header in this list from being forwarded. This + // takes precedence over both ``forward_all`` and ``allowed_headers``. + type.matcher.v3.ListStringMatcher disallowed_headers = 3; + } + // Specification of the MCP server. message McpBackend { // Unique name for this backend. Used for: @@ -78,6 +114,15 @@ // Backend target specification. McpCluster mcp_cluster = 2; + + // Controls which downstream request headers are forwarded to this backend. + // If not set, no downstream-controlled headers are forwarded beyond those the + // router itself must synthesize (e.g. ``content-type``, ``accept``, the session + // header) — in particular, a client's ``authorization`` header is NOT forwarded + // by default. Router-owned, framing, session, and hop-by-hop headers are never + // affected by this policy; they are handled separately and can never be forwarded + // via this mechanism. + HeaderForwarding header_forwarding = 3; } // A list of remote MCP servers.

envoy/extensions/common/ratelimit/v3/ratelimit.proto:

--- shake256:4771d57c4812b0bd79a53d87a3ee09c02be588cd5294b234b897890b456c12ce11ac31f77bb70794d61f646b95ec19ffe3d17054cb672d838c2868152b3e06ac envoy/extensions/common/ratelimit/v3/ratelimit.proto +++ shake256:16ea57deb3c9206e9f72502ffca313607e245493ab1ef2a6cfc6977b4177f3ba84d30185d1513f4b7c06601af58d411e889ed95daabb2e9ebde62d82491d1594 envoy/extensions/common/ratelimit/v3/ratelimit.proto @@ -118,6 +118,10 @@ // The unit of time. type.v3.RateLimitUnit unit = 2 [(validate.rules).enum = {defined_only: true}]; + + // The number of units in the rate limit period. For example, a value of ``30`` with a unit + // of ``SECOND`` specifies a 30-second rate limit period. If not specified, defaults to ``1``. + google.protobuf.UInt32Value unit_multiplier = 3 [(validate.rules).uint32 = {gt: 0}]; } // Descriptor entries.

envoy/extensions/filters/http/adaptive_concurrency/v3/adaptive_concurrency.proto:

--- shake256:e6df3bb2bfd67f962c667bf9357058f6525731e037937de2db16a88222ed331f2ae53bfc0878a878ad30517f3e80381bed41198d30ac3963f243dae9672a72c3 envoy/extensions/filters/http/adaptive_concurrency/v3/adaptive_concurrency.proto +++ shake256:b4d3dec94b64da00d30d0c3a2a001941240da6a0ace1e1fbddcf2f70c155b38827a2e41e09055582d268cffc009dae06def4f39929167c31777e5cfe778d5363 envoy/extensions/filters/http/adaptive_concurrency/v3/adaptive_concurrency.proto @@ -44,6 +44,13 @@ required: true gt {} }]; + + // The allowed lower-bound on the calculated concurrency limit. If unset, this defaults to + // :ref:`min_concurrency + // <envoy_v3_api_field_extensions.filters.http.adaptive_concurrency.v3.GradientControllerConfig.MinimumRTTCalculationParams.min_concurrency>` + // to preserve the existing behavior where the same value controls both the minimum calculated + // limit and the limit used while measuring minRTT. + google.protobuf.UInt32Value min_concurrency_limit = 4 [(validate.rules).uint32 = {gt: 0}]; } // Parameters controlling the periodic minRTT recalculation.

envoy/extensions/filters/http/ai_protocol_manager/v3/ai_protocol_manager.proto:

--- shake256:c43598da8f84e03829c2d36480e6261e4a58501e51d5610a15e5d768ca28c783d22aab37042d8c88a2b45a06e8f253c42d93d5cf8b306819c5c29ccda7e774fb envoy/extensions/filters/http/ai_protocol_manager/v3/ai_protocol_manager.proto +++ shake256:f535bb9e68b1fc31fd34345beef2ac4f6b1ccd8ee0207a12fb673394c16cd6e9c7ae13a75f14f9f0b1bfd2664c1942318c8189fc4dcf1fea76de4ba64afe7c4e envoy/extensions/filters/http/ai_protocol_manager/v3/ai_protocol_manager.proto @@ -2,9 +2,15 @@ package envoy.extensions.filters.http.ai_protocol_manager.v3; +import "envoy/config/core/v3/extension.proto"; +import "envoy/type/ai/v3/llm_protocol.proto"; + +import "google/protobuf/wrappers.proto"; + import "xds/annotations/v3/status.proto"; import "udpa/annotations/status.proto"; +import "validate/validate.proto"; option java_package = "io.envoyproxy.envoy.extensions.filters.http.ai_protocol_manager.v3"; option java_outer_classname = "AiProtocolManagerProto"; @@ -19,5 +25,239 @@ // [#extension: envoy.filters.http.ai_protocol_manager] // Configuration for the AI Protocol Manager filter. +// +// The filter manages AI endpoint traffic on both directions of a stream. On +// the request path it holds a declared AI endpoint's payload and parses it, +// which is what lets routing, admission and policy act on a payload the proxy +// understands rather than on opaque bytes. On the response path it can +// extract normalized LLM token usage into dynamic metadata. +// +// Request and response processing are independently enabled by the presence +// of ``request_handling`` and ``response_handling``. Which routes are AI +// endpoints — and which :ref:`wire API <envoy_v3_api_enum_type.ai.v3.LLMProtocol>` +// each speaks — is declared with the :ref:`per-route configuration +// <envoy_v3_api_msg_extensions.filters.http.ai_protocol_manager.v3.AiProtocolManagerPerRoute>`. message AiProtocolManager { + // Request-side AI protocol processing. When unset, the decode path is a + // pure passthrough — including on routes carrying per-route configuration. + RequestHandling request_handling = 1; + + // Response-side AI protocol processing. When unset, the encode path is a + // pure passthrough. + ResponseHandling response_handling = 2; + + // AI filters, in order. They run over a declared AI endpoint's parsed request payload + // before it continues down the HTTP filter chain, and require ``request_handling``. + // [#extension-category: envoy.http.ai_filters] + repeated config.core.v3.TypedExtensionConfig filters = 3; +} + +// Request-side processing configuration. A route that carries a +// :ref:`per-route request declaration +// <envoy_v3_api_field_extensions.filters.http.ai_protocol_manager.v3.AiProtocolManagerPerRoute.request>` +// has its payload held, offloaded, and parsed strictly: a body that is not +// well-formed JSON is rejected with a 400 rather than forwarded for the +// upstream to interpret differently. +message RequestHandling { + // How the request body is written out once the :ref:`AI filters + // <envoy_v3_api_field_extensions.filters.http.ai_protocol_manager.v3.AiProtocolManager.filters>` + // finish. + enum BodyReserialization { + // Re-serialize the parsed document, so the edits AI filters make to it reach the upstream. + ALWAYS = 0; + + // Forward the received body byte for byte. Edits AI filters make to the parsed document are + // not sent, so use this only with AI filters that read the request, such as request info. + DISABLE = 1; + } + + // Attempt best-effort JSON parsing on routes without a per-route + // configuration. + // + // Defaults to ``false``: unconfigured routes are not buffered or parsed. + // When ``true``, such routes are parsed too, but never failed over it — a + // route that declared no AI wire contract has nothing to hold its payload + // to, so a body that fails to parse is forwarded unchanged. + // + // Only requests that can be held to end of stream are taken: the request must + // carry a JSON content type (``application/json`` or a ``+json`` suffix) and + // must not be gRPC or Connect streaming, an upgrade, or a CONNECT. Holding a + // full-duplex request would stall it, since the client may not finish the + // request until it sees a response the held upstream cannot produce. + bool parse_unconfigured_routes = 1; + + // Request-path parsing limits. Defaults apply when unset. + RequestParsingLimits limits = 2; + + // Whether the parsed request is re-serialized once the AI filters finish. Defaults to ``ALWAYS``. + // Requests that run no AI filters are forwarded as received either way. + BodyReserialization reserialize_body = 3 [(validate.rules).enum = {defined_only: true}]; +} + +// Per-stream limits for request payload parsing. +message RequestParsingLimits { + // Maximum size, in bytes, of a decoded string value kept inline in the + // parsed document; a larger value stays in the external buffer and is + // referenced by offset. Object keys are always inline. + // + // This is the deployment-wide default, applied when a declared API's payload + // schema does not pin its own threshold. Defaults to 1KiB, which keeps + // ordinary metadata (model names, roles, tool names) inline while + // conversation content goes to the buffer. + // + // Keep it above the longest ``model`` name in use. Values over the threshold + // are offloaded, and the :ref:`schema validation AI filter + // <envoy_v3_api_msg_extensions.http.ai_filters.schema_validation.v3.SchemaValidation>` + // requires ``model`` inline, so it rejects an offloaded one with a 400. + google.protobuf.UInt32Value inline_string_threshold_bytes = 1 + [(validate.rules).uint32 = {lte: 1048576 gte: 64}]; +} + +// Response-side processing configuration. Individual response features are +// enabled by the presence of their corresponding messages. +message ResponseHandling { + // Extract canonical token usage from eligible AI responses. When unset, + // token usage extraction is disabled. + TokenUsageExtraction token_usage = 1; +} + +// Configuration for canonical response token-usage extraction. +// +// Eligible 2xx SSE and JSON responses are observed as they stream through; +// the filter never stops iteration or modifies the response, and no +// extraction failure can affect it. The result is published at a clean end +// of stream under one namespace as typed dynamic metadata: the authoritative +// record is :ref:`envoy.data.ai.v3.TokenUsage +// <envoy_v3_api_msg_data.ai.v3.TokenUsage>`, consumable through typed +// metadata readers such as ext_proc typed forwarding. No untyped ``Struct`` +// mirror is emitted. +// [#next-free-field: 6] +message TokenUsageExtraction { + // Stream signals emitted upon publishing token usage metadata. + enum UsageSignal { + USAGE_SIGNAL_UNSPECIFIED = 0; + + // Synthesize empty response trailers at end of stream if none exist. + // This wakes downstream trailer-driven consumers (such as ext_proc with + // ``response_trailer_mode: SEND``) with metadata context without transferring + // response body bytes. + SYNTHESIZE_TRAILERS = 1; + } + + // Also inspect responses on routes without per-route configuration. + // + // Defaults to ``false``: only routes carrying an + // :ref:`AiProtocolManagerPerRoute + // <envoy_v3_api_msg_extensions.filters.http.ai_protocol_manager.v3.AiProtocolManagerPerRoute>` + // configuration are inspected, so enabling token usage on a mixed listener + // does not silently parse unrelated JSON/SSE responses. Enable this for + // response-only installations whose routes cannot be declared — for + // example an upstream installation on a dynamic-forward-proxy cluster. + bool include_unconfigured_routes = 1; + + // Fallback wire API used when the route does not identify a response API. + // + // ``LLM_PROTOCOL_UNSPECIFIED`` means auto-detect from the response shape + // (only strongly shaped, value-validated markers lock a stream). This is a + // fallback, not an override of per-route response configuration; see the + // :ref:`per-route configuration + // <envoy_v3_api_msg_extensions.filters.http.ai_protocol_manager.v3.AiProtocolManagerPerRoute>` + // for the full precedence. + type.ai.v3.LLMProtocol default_llm_protocol = 2 [(validate.rules).enum = {defined_only: true}]; + + // Namespace for the emitted typed dynamic metadata. + // Defaults to ``envoy.ai.token_usage``. + string metadata_namespace = 3; + + // Extraction resource limits. Defaults apply when unset. + TokenUsageExtractionLimits limits = 4; + + // Optional signal to emit at end of stream after publishing token usage. + UsageSignal usage_signal = 5 [(validate.rules).enum = {defined_only: true}]; +} + +// Per-stream memory and work limits for token-usage extraction. The response +// itself always streams through unaffected; on any limit only extraction +// state is dropped and the published record is flagged. +message TokenUsageExtractionLimits { + // Maximum size of one SSE event inspected for token usage. This is a hard + // bound on retained extraction state, regardless of how large individual + // data frames are: a pending event over the cap is discarded through its + // real terminating blank line, and a complete event over the cap is + // skipped without parsing. + // + // Defaults to 1MiB: OpenAI Responses API streams carry usage on terminal + // lifecycle events that embed the complete response object, so ordinary + // long generations produce usage-bearing events far larger than typical + // SSE deltas. Lower this in constrained deployments at the cost of losing + // usage from long generations. + google.protobuf.UInt32Value max_sse_event_size = 1 + [(validate.rules).uint32 = {lte: 10485760 gte: 1}]; + + // Maximum JSON response body inspected for token usage. A larger body — + // including one whose ``content-length`` already exceeds the cap — is not + // inspected. Defaults to 4MiB. + google.protobuf.UInt32Value max_json_body_size = 2 + [(validate.rules).uint32 = {lte: 10485760 gte: 1}]; + + // Maximum number of SSE payloads parsed as JSON for one response, counting + // malformed payloads; events skipped by name (keepalives, content deltas) + // do not count. ``max_sse_event_size`` bounds one event; this bounds the + // parse work a long-lived stream can extract from the worker. On + // exhaustion the accumulated usage is kept and published as partial, and + // extraction goes inert. + // + // Defaults to 65536 — far above ordinary streams. Raise it for extremely + // long generations whose every chunk must be parsed (OpenAI Chat + // Completions streams, whose chunks are unnamed and cannot be skipped by + // classification). + google.protobuf.UInt32Value max_parsed_sse_events = 3 [(validate.rules).uint32 = {gte: 1}]; +} + +// Per-route configuration. Its presence declares the route an AI endpoint. +// +// Request and response wire protocols are declared separately because +// protocol translation can make the client-facing request API differ from +// the provider's response API. For response token-usage extraction the +// effective wire API is resolved in precedence order: per-route +// ``response.llm_protocol``, then per-route ``request.llm_protocol``, then +// :ref:`default_llm_protocol +// <envoy_v3_api_field_extensions.filters.http.ai_protocol_manager.v3.TokenUsageExtraction.default_llm_protocol>`, +// then auto-detection. +message AiProtocolManagerPerRoute { + // Request-side route configuration. Its presence hands the request payload + // to the filter to hold and validate (when :ref:`request_handling + // <envoy_v3_api_field_extensions.filters.http.ai_protocol_manager.v3.AiProtocolManager.request_handling>` + // is enabled). + RequestPerRoute request = 1; + + // Optional response-side route configuration. When absent, response + // processing inherits ``request.llm_protocol`` when available, then the + // global fallback. + ResponsePerRoute response = 2; +} + +// Per-route request-side behavior. +message RequestPerRoute { + // The wire API a request payload on this route follows. + // ``LLM_PROTOCOL_UNSPECIFIED`` declares the endpoint without naming its + // API. The ``envoy.ai.llm_protocol.request`` filter state object, when it + // names one, takes precedence. + // + // The :ref:`schema validation AI filter + // <envoy_v3_api_msg_extensions.http.ai_filters.schema_validation.v3.SchemaValidation>` + // holds a payload to its API's schema. + // + // [#comment: Normalization is not implemented yet; a normalization knob + // will be added here once the transformation and its output contract + // exist.] + type.ai.v3.LLMProtocol llm_protocol = 1 [(validate.rules).enum = {defined_only: true}]; +} + +// Per-route response-side behavior. +message ResponsePerRoute { + // The wire API the response on this route follows. This can differ from + // ``request.llm_protocol`` when the gateway performs protocol translation. + // ``LLM_PROTOCOL_UNSPECIFIED`` falls through the precedence chain above. + type.ai.v3.LLMProtocol llm_protocol = 1 [(validate.rules).enum = {defined_only: true}]; }

envoy/extensions/filters/http/basic_auth/v3/basic_auth.proto:

--- shake256:00902c0bf637b39660032f85e0e6c05335ad948d4705c4207d3d67478603a21b6cefc06cfd79d03cda098eb753617d1cbe4f898827cd3deac3a75fdb25d2d422 envoy/extensions/filters/http/basic_auth/v3/basic_auth.proto +++ shake256:2a751a2d745240b338992e26dd84d5ec71e6f0a9f017eeec3b215c667fd485f3d2a2fb57e86ac8e898e9a14c4eebc9a5830e88f48fb8f324abbe8e332d0dc291 envoy/extensions/filters/http/basic_auth/v3/basic_auth.proto @@ -29,7 +29,7 @@ // user1:{SHA}hashed_user1_password // user2:{SHA}hashed_user2_password // -// [#next-free-field: 6] +// [#next-free-field: 7] message BasicAuth { // Username-password pairs used to verify user credentials in the "Authorization" header. // The value needs to be the htpasswd format. @@ -71,6 +71,16 @@ // other authentication methods (e.g. JWT) and using a downstream RBAC filter to enforce // OR semantics. bool emit_dynamic_metadata = 5; + + // The realm to use in the ``WWW-Authenticate`` response header when authentication fails. + // The value is placed verbatim into ``WWW-Authenticate: Basic realm="<value>"``. + // + // If not specified, Envoy falls back to using the full request URI + // (scheme + authority + path, truncated to 256 characters), which differs per path and + // prevents browsers from reusing cached credentials across paths on the same origin. + // Set a fixed realm to enable correct credential caching. The realm pattern dose not + // allow DEL, 32 C0 control chars including CRLF injection chars. + string realm = 6 [(validate.rules).string = {pattern: "^[^\\x00-\\x1f\\x7f]*$"}]; } // Extra settings that may be added to per-route configuration for @@ -79,4 +89,11 @@ // Username-password pairs for this route. config.core.v3.DataSource users = 1 [(validate.rules).message = {required: true}, (udpa.annotations.sensitive) = true]; + + // Per-route realm override for the ``WWW-Authenticate`` response header. If set, takes + // precedence over the filter-level ``BasicAuth.realm``. Same escaping semantics apply. + // If neither this nor the filter-level realm is set, the full request URI is used. + // Set a fixed realm to enable correct credential caching. The realm pattern dose not + // allow DEL, 32 C0 control chars including CRLF injection chars. + string realm = 2 [(validate.rules).string = {pattern: "^[^\\x00-\\x1f\\x7f]*$"}]; }

envoy/extensions/filters/http/compressor/v3/compressor.proto:

--- shake256:88198818f68c7bb6aaec8fcfb16a43209feb9eb510006e5a05ec4e9098101e6dfd5015112d0e231861cc39e12a46b630d9a103c42157953340980d9da3cf656a envoy/extensions/filters/http/compressor/v3/compressor.proto +++ shake256:755c91ec00e03c5ffcefc462558504d3ec1300866a9a88ba3eb946f1fb6cbc143a56f8178c9fd1c1e050e26d5ed657bc377ec773014421d23ce72da797bf446e envoy/extensions/filters/http/compressor/v3/compressor.proto @@ -4,6 +4,7 @@ import "envoy/config/core/v3/base.proto"; import "envoy/config/core/v3/extension.proto"; +import "envoy/type/matcher/v3/string.proto"; import "google/protobuf/wrappers.proto"; @@ -38,6 +39,8 @@ // direction this common config is applied to), in bytes, that will trigger compression. Defaults to 30. google.protobuf.UInt32Value min_content_length = 2; + // Using ``content_type`` is deprecated. Use ``content_type_matcher`` instead. + // // Set of strings that allows specifying which mime-types yield compression; e.g., // ``application/json``, ``text/html``, etc. // @@ -53,7 +56,17 @@ // * ``text/plain`` // * ``text/xml`` // - repeated string content_type = 3; + repeated string content_type = 3 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // Allows specifying which content types yield compression using + // envoy.type.matcher.v3.StringMatcher. + // + // When this field is specified, the default content type list is not used. + // If both ``content_type`` and ``content_type_matcher`` are specified, + // ``content_type_matcher`` takes precedence and the deprecated ``content_type`` + // field is ignored. + repeated type.matcher.v3.StringMatcher content_type_matcher = 4; } // Configuration for filter behavior on the request direction.

envoy/extensions/filters/http/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:9abbc21d8abf790f661403eabb964d0e639ff04c4411c5bd7580483cda9296b56bf525831af47395d1f4c96e9b729e95eae77a062d01ef016d6816b31ba21173 envoy/extensions/filters/http/dynamic_modules/v3/dynamic_modules.proto +++ shake256:2dfca9444a089923c1a755c1fbdf192b8730abd6138ddd0ce38e192688c5a33a56680706f776874432cd966a343b5c129d0af379860d2c721a95d8ff1cac8c24 envoy/extensions/filters/http/dynamic_modules/v3/dynamic_modules.proto @@ -53,7 +53,8 @@ // ``filter_config`` can be used to configure the logging level or the header manipulation // behavior. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the plugin. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the plugin. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly without // the wrapper. // @@ -120,7 +121,8 @@ // manipulation. The ``filter_config`` can be used to configure the logging level or the header // manipulation behavior. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the plugin. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the plugin. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly without // the wrapper. //

envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto:

--- shake256:e715b7dc0ebb2593a30543e81b64a9684b22679d355cd23de58fa40040bf5dfe7eaae1c982f55fc94db512ce7d621d6aa17c925de7dc64f749f0a3f7eee65e92 envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto +++ shake256:47d9b45b6609bf2cdbc4b7ecce176c32b686cf33d8f787a557afe7c8e4f8e174d61e9732d6ea408f6d479d66078d2cdc96274677822dfd3009061569569e8f8e envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto @@ -30,7 +30,7 @@ // External Authorization :ref:`configuration overview <config_http_filters_ext_authz>`. // [#extension: envoy.filters.http.ext_authz] -// [#next-free-field: 33] +// [#next-free-field: 35] message ExtAuthz { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.http.ext_authz.v3.ExtAuthz"; @@ -101,6 +101,24 @@ // also use decoder_header_mutation_rules to restrict sensitive request header mutations. bool clear_route_cache = 6; + // A list of the request header names the routes match on. When this list is not empty and + // ``clear_route_cache`` is ``true``, an ``OK`` response clears the route cache only when it sets, + // appends, or removes one of these headers, or mutates a query parameter, rather than on any request + // mutation. This avoids re-resolving the route when the response only touches headers that no route + // matches on. + // + // If not specified, the route cache is cleared whenever an ``OK`` response sets, appends, or removes + // any request header, or mutates a query parameter. + // + // .. attention:: + // + // List every request header the routes match on. A route that matches on a header omitted here is + // not re-resolved when the authorization service mutates that header, which can route the request + // as if the mutation had not happened. + repeated string clear_route_cache_headers = 34 [(validate.rules).repeated = { + items {string {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}} + }]; + // Sets the HTTP status that is returned to the client when the authorization server returns an error // or cannot be reached. // @@ -397,6 +415,13 @@ // // Defaults to ``false``. bool shadow_mode = 32; + + // Whether to emit client-side spans for external authorization requests (e.g. gRPC or HTTP calls). + // When set to false, client-side egress spans will not be emitted/exported to trace collectors, + // but trace context (e.g. ``traceparent``) will still be propagated to the authorization server. + // + // If unset, defaults to ``true``. + google.protobuf.BoolValue emit_client_span = 33; } // Serialized form of the shadow-mode authorization decision written to FilterState @@ -624,7 +649,7 @@ } // Extra settings for the check request. -// [#next-free-field: 6] +// [#next-free-field: 7] message CheckSettings { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.http.ext_authz.v2.CheckSettings"; @@ -673,4 +698,7 @@ // Override with an HTTP service configuration. HttpService http_service = 5; } + + // Overrides the filter-level ``emit_client_span`` setting for this route. + google.protobuf.BoolValue emit_client_span = 6; }

envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto:

--- shake256:4ae5cb378355dc0289d4c97e1839b88232b4f650638b2ce8cab571040aa158bc84866ace6e79becba7cc0ea1198c2463240cdeefc38903ef7d98320f2f7f4c81 envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto +++ shake256:471e9f4568cee8c55789a48dd9d2977b05ddd06e1032aaf87760f50366e6c6eddd404c65d00f36b5ddb28751a8e3ed5b3ae28e79c976bfc515d8cd83cb98ced4 envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto @@ -98,7 +98,7 @@ // <arch_overview_advanced_filter_state_sharing>` object in a namespace matching the filter // name. // -// [#next-free-field: 27] +// [#next-free-field: 28] message ExternalProcessor { // Describes the route cache action to be taken when an external processor response // is received in response to request headers. @@ -386,6 +386,13 @@ // request smuggling. Thus, please use your own discretion when enabling this feature. // bool allow_content_length_header = 26; + + // Whether to emit client-side spans for external processing requests. + // When set to false, client-side egress spans will not be emitted/exported to trace collectors, + // but trace context (e.g. ``traceparent``) will still be propagated to the external processor. + // + // If unset, defaults to ``true``. + google.protobuf.BoolValue emit_client_span = 27; } // ExtProcHttpService is used for HTTP communication between the filter and the external processing service. @@ -416,7 +423,7 @@ // Describes which typed or untyped filter dynamic metadata namespaces to accept from // the external processing server. Set to empty or leave unset to disallow writing - // any received dynamic metadata. Receiving of typed metadata is not supported. + // any received dynamic metadata. MetadataNamespaces receiving_namespaces = 2; // Describes which cluster metadata namespaces to forward to @@ -467,7 +474,7 @@ } // Overrides that may be set on a per-route basis -// [#next-free-field: 10] +// [#next-free-field: 11] message ExtProcOverrides { // Set a different processing mode for this route than the default. ProcessingMode processing_mode = 1; @@ -514,4 +521,7 @@ // :ref:`processing_request_modifier <envoy_v3_api_field_extensions.filters.http.ext_proc.v3.ExternalProcessor.processing_request_modifier>`. config.core.v3.TypedExtensionConfig processing_request_modifier = 9 [(xds.annotations.v3.field_status).work_in_progress = true]; + + // Overrides the filter-level ``emit_client_span`` setting for this route. + google.protobuf.BoolValue emit_client_span = 10; }

envoy/extensions/filters/http/fault/v3/fault.proto:

--- shake256:943b936172d2c0860b92a0afa56913a1be1352d1271f46602903adbce38a51c7f651d973e5005f2e7baadee6391622726288c0f4b9481db3c1d6d01a6771b30a envoy/extensions/filters/http/fault/v3/fault.proto +++ shake256:96b60daf5dde95307b1ceae6ed9607f561179e136ae561122cefaf4ba42624e69f81e59ed7c0c1dfaa68fe4de4795c896f652bac6c73eccce166a0e3ba5d20a8 envoy/extensions/filters/http/fault/v3/fault.proto @@ -23,7 +23,7 @@ // Fault Injection :ref:`configuration overview <config_http_filters_fault_injection>`. // [#extension: envoy.filters.http.fault] -// [#next-free-field: 6] +// [#next-free-field: 7] message FaultAbort { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.http.fault.v2.FaultAbort"; @@ -54,6 +54,10 @@ // The percentage of requests/operations/connections that will be aborted with the error code // provided. type.v3.FractionalPercent percentage = 3; + + // The response body to be returned when aborting the request. + // If not specified, defaults to "fault filter abort". + string response_body = 6; } // [#next-free-field: 17]

envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.proto:

--- shake256:52635c541d6b7bcefc27115fef5270031bb2bc9ec24b2d93efd90e906cea870ba5b0040ea8fed4f7b6a9813369b6f22a385b05eba4b33f6beaa34d54c3358ac2 envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.proto +++ shake256:5dca22c6f661b75adf9bca0a6f5e200474aeb1b977cf6e03fb18ac8c1273940f67b3fcb3e3fdee91f7e46f820fa56f51b43c601b05f4c6947aee912b5c0b3d01 envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.proto @@ -23,7 +23,7 @@ // [#extension: envoy.filters.http.gcp_authn] // Filter configuration. -// [#next-free-field: 7] +// [#next-free-field: 9] message GcpAuthnFilterConfig { // The HTTP URI to fetch tokens from GCE Metadata Server(https://cloud.google.com/compute/docs/metadata/overview). // The URL format is "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=[AUDIENCE]" @@ -45,9 +45,14 @@ // Request header location to extract the token. By default (i.e. if this field is not specified), the token // is extracted to the Authorization HTTP header, in the format "Authorization: Bearer <token>". + // If ``token_metadata_key`` is set, this field takes no effect. // Not supported by all data planes. TokenHeader token_header = 4; + // Optional dynamic metadata key to save the token. The metadata uses the filter config name as the namespace. + // Takes precedence over ``token_header``. + string token_metadata_key = 7; + // Cluster to send traffic to the GCE metadata server. Not supported // by all data planes; a data plane may instead have its own mechanism // for contacting the metadata server. @@ -59,12 +64,28 @@ lt {seconds: 4294967296} gte {} }]; + + // Defines the authentication service. This field overrides the cluster's typed_filter_metadata definition. + Audience audience = 8; } // Audience is the URL of the receiving service that performs token authentication. // It will be provided to the filter through cluster's typed_filter_metadata. +// [#next-free-field: 6] message Audience { message AccessToken { + // Optional custom OAuth scopes for the access token request. + // If empty, the filter will not request scopes explicitly, so the metadata server's default + // scopes will be used. + // When populated, the filter appends "?scopes=<comma-separated-scopes>" to the + // metadata server token request. Note that the metadata server replaces default + // scopes with the provided list rather than appending; to preserve general GCP API + // access, callers should explicitly include "https://www.googleapis.com/auth/cloud-platform". + // Validation rules require each scope to be non-empty and disallow whitespace or commas, + // as commas are used as the delimiter for the metadata server and OAuth 2.0 scopes + // cannot contain whitespace (RFC 6749 Section 3.3). + repeated string scopes = 1 + [(validate.rules).repeated = {items {string {min_len: 1 pattern: "^[^\\s,]+$"}}}]; } message BoundJwt { @@ -73,6 +94,33 @@ } message BoundAccessToken { + // Optional custom OAuth scopes for the bound access token request. + // If empty, the filter will not request scopes explicitly, so the metadata server's default + // scopes will be used. + // When populated, the filter appends "&scopes=<comma-separated-scopes>" to the + // metadata server token request. Note that the metadata server replaces default + // scopes with the provided list rather than appending; to preserve general GCP API + // access, callers should explicitly include "https://www.googleapis.com/auth/cloud-platform". + // Validation rules require each scope to be non-empty and disallow whitespace or commas, + // as commas are used as the delimiter for the metadata server and OAuth 2.0 scopes + // cannot contain whitespace (RFC 6749 Section 3.3). + repeated string scopes = 1 + [(validate.rules).repeated = {items {string {min_len: 1 pattern: "^[^\\s,]+$"}}}]; + } + + // Default lifetime is 1h. + message IAMAccessToken { + // A template string for the account email or unique ID for which the credentials are requested, + // e.g. ``my-sa-%DYNAMIC_METADATA(my_filter:tenant_project)%@my-project.iam.gserviceaccount.com``. + string account = 1 [(validate.rules).string = {min_len: 1}]; + + // A template string for the authorization header value, + // e.g. ``Bearer %DYNAMIC_METADATA(gcp_authn:token)%``. + string authorization = 2 [(validate.rules).string = {min_len: 1}]; + + // Optional custom scopes for the token request. + // Default scope is https://www.googleapis.com/auth/cloud-platform. + repeated string scopes = 3; } // The audience URL, used for fetching unbound JWT token. @@ -89,6 +137,11 @@ // If defined, the filter will fetch bound Access Token instead of unbound. // It takes precedence over ``bound_jwt``, ``access_token`` and ``url``. BoundAccessToken bound_access_token = 4; + + // If defined, the filter will fetch an access token for a service account. + // It takes precedence over ``bound_access_token``, ``bound_jwt``, ``access_token``, and ``url``. + // Requires inlined audience definition in the filter configuration. + IAMAccessToken iam_access_token = 5; } // Token Cache configuration. @@ -99,13 +152,25 @@ } message TokenHeader { - // The HTTP header's name. - string name = 1 - [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}]; + // Configuration options for preserving an existing token header. + message PreserveExisting { + } + + // The HTTP header's name. Defaults to ``Authorization`` if not specified. + string name = 1 [ + (validate.rules).string = {well_known_regex: HTTP_HEADER_NAME strict: false ignore_empty: true} + ]; // The header's prefix. The format is "value_prefix<token>" // For example, for "Authorization: Bearer <token>", value_prefix="Bearer " with a space at the // end. string value_prefix = 2 [(validate.rules).string = {well_known_regex: HTTP_HEADER_VALUE strict: false}]; + + // If set, the filter checks if the target header is already present (by header key existence, + // even if the header value is empty). If present, it skips token fetching and preserves the + // existing header intact (``value_prefix`` has no effect on the preserved header). If absent, + // a new token is fetched and written using ``name`` and ``value_prefix``. + // If not set, the default behavior is to unconditionally overwrite the header. + PreserveExisting preserve_existing = 3; }

envoy/extensions/filters/http/grpc_field_extraction/v3/config.proto:

--- shake256:47e47d602ed52567c8ea6649f1dadf18ed958b2ddff78b2376dfc19922a4f01817bae6250660ccf2b85c8fa98ef6db326105d33905c600727e4e7e9084855dda envoy/extensions/filters/http/grpc_field_extraction/v3/config.proto +++ shake256:c6eb550a79d59fd94336007ea8e7939f348ba56ff6946a93a697059168c7987cd7fc11a992edb294d13e1cf4a3bfa171580eacff93010e8776eed75d141d4765 envoy/extensions/filters/http/grpc_field_extraction/v3/config.proto @@ -68,6 +68,23 @@ // // 2. if the field value is empty, an empty ``Value`` will be set. // +// **IMPORTANT**: All extracted values are stored as ``ListValue``, even for singular (non-repeated) fields. +// Filters consuming this metadata (e.g., :ref:`ratelimit <envoy_v3_api_msg_extensions.filters.http.ratelimit.v3.RateLimit>`) +// must use :ref:`MetadataKey <envoy_v3_api_msg_type.metadata.v3.MetadataKey>` with an ``index`` segment to access the value. +// +// Example: to access a singular ``string tenant_id`` field extracted to ``envoy.filters.http.grpc_field_extraction``: +// +// .. code-block:: yaml +// +// metadata_key: +// key: envoy.filters.http.grpc_field_extraction +// path: +// - key: tenant_id +// - index: 0 # Required: unwrap the ListValue containing the singular value +// +// Omitting the ``index`` segment will cause the consumer to receive the ``ListValue`` itself rather than +// its element, which typically results in empty or incorrect metadata descriptor values. +// // Performance // ----------- // @@ -139,6 +156,37 @@ // "baz":[ // ] // } +// +// Normalizing the metadata key +// ---------------------------- +// +// By default the dynamic metadata key is the field path. ``metadata_key`` overrides it, which +// allows different gRPC methods to write the same logical value under a common key. +// +// .. code-block:: json +// +// { +// "descriptor_set":{}, +// "extractions_by_method":{ +// "pkg.svc.Method":{ +// "request_field_extractions":{ +// "nested.bar":{ +// "metadata_key":"bar" +// } +// } +// } +// } +// } +// +// writes +// +// .. code-block:: json +// +// { +// "bar":[ +// "val_bar1", "val_bar2" +// ] +// } message GrpcFieldExtractionConfig { // The proto descriptor set binary for the gRPC services. @@ -187,4 +235,14 @@ // Unimplemented. Uses "envoy.filters.http.grpc_field_extraction" for now. string dynamic_metadata = 1; } + + // The key that the extracted value is written to within the dynamic metadata. + // If empty, the field path (the key of ``request_field_extractions``) is used. + // + // This is useful for normalizing the metadata written by different gRPC methods whose + // request messages name the same logical field differently. + // + // Within a single gRPC method, two field extractions must not resolve to the same + // metadata key, otherwise the configuration is rejected. + string metadata_key = 2; }

envoy/extensions/filters/http/header_mutation/v3/header_mutation.proto:

--- shake256:bc32e26f241c733ed2ad7058be7245b29174a9b3a5e7e2fbaeea928da4ce0739672bb423ea15485dd903bb5f14fd126edac775dafd9a5d279b78a4c9756a1344 envoy/extensions/filters/http/header_mutation/v3/header_mutation.proto +++ shake256:defe095f840705fde06764b61993b1b63a99635418cd6eff220e8d8334a5aa736951e6b6e6965e598965b41437f2bbbe49719722399ac062e4d4fb82b9cea4cf envoy/extensions/filters/http/header_mutation/v3/header_mutation.proto @@ -4,6 +4,7 @@ import "envoy/config/common/mutation_rules/v3/mutation_rules.proto"; import "envoy/config/core/v3/base.proto"; +import "envoy/config/core/v3/extension.proto"; import "udpa/annotations/status.proto"; @@ -17,7 +18,7 @@ // Mutate HTTP headers and trailers in requests and responses. // [#extension: envoy.filters.http.header_mutation] -// [#next-free-field: 6] +// [#next-free-field: 7] message Mutations { // The request mutations are applied before the request is forwarded to the upstream cluster. repeated config.common.mutation_rules.v3.HeaderMutation request_mutations = 1; @@ -34,6 +35,15 @@ // The request trailer mutations are applied before the request is sent to the upstream cluster. repeated config.common.mutation_rules.v3.HeaderMutation request_trailers_mutations = 5; + + // Specifies a collection of Formatter plugins that can be used in substitution formatters + // in this message. + // If not specified, only the built-in command operators are available. + // Configured plugins take precedence over the built-in command operators. + // The plugins apply only to this message and are not inherited from other configuration levels. + // See the formatters extensions documentation for details. + // [#extension-category: envoy.formatter] + repeated config.core.v3.TypedExtensionConfig formatters = 6; } // Per route configuration for the header mutation filter.

envoy/extensions/filters/http/jwt_authn/v3/config.proto:

--- shake256:96cd7a468fdd66eab12305b1dc75a394fd726d1427fa3b2d02c073c76053a955cc574c57418fb1866696f3f738df2f650f173653972c91b5b97d372d22286eb8 envoy/extensions/filters/http/jwt_authn/v3/config.proto +++ shake256:480fe0447ce1c8c566a733d914442215bbf5edd7e6af6918efac4e807fe990abec31bb5e72d3c5decbdeb2f91056fc31f8d1a24700adb5a70bd750470c381948 envoy/extensions/filters/http/jwt_authn/v3/config.proto @@ -358,11 +358,12 @@ // Add JWT claim to HTTP Header // Specify the claim name you want to copy in which HTTP header. For examples, following config: - // The claim must be of type; string, int, double, bool. Array type claims are not supported + // Claims of type string, int, double and bool are copied verbatim. Claims of type array or + // object are serialized to JSON and copied base64-encoded. // // .. literalinclude:: /_configs/repo/jwt_authn.yaml // :language: yaml - // :lines: 44-48 + // :lines: 44-51 // :linenos: // :lineno-start: 44 // :caption: :download:`jwt_authn.yaml </_configs/repo/jwt_authn.yaml>` @@ -904,13 +905,58 @@ // This message specifies a combination of header name and claim name. message JwtClaimToHeader { + // Specifies a segment in a path for retrieving a claim from the JWT payload. + message PathSegment { + // The key to retrieve the value with in the enclosing JSON object. The key is matched in + // full, so it may itself contain dots. + string key = 1 [(validate.rules).string = {min_len: 1}]; + } + // The HTTP header name to copy the claim to. - // The header name will be sanitized and replaced. + // The header name is sanitized from the request for every provider configured on the filter + // (including on paths that bypass JWT verification) and then replaced with the claim value when + // verification succeeds. string header_name = 1 [(validate.rules).string = {min_len: 1 well_known_regex: HTTP_HEADER_NAME strict: false}]; - // The field name for the JWT Claim : it can be a nested claim of type (eg. "claim.nested.key", "sub") - // String separated with "." in case of nested claims. The nested claim name must use dot "." to separate - // the JSON name path. - string claim_name = 2 [(validate.rules).string = {min_len: 1}]; + // The name of the claim to copy, split on "." to address nested claims: ``sub`` selects the + // top-level ``sub`` claim, and ``nested.claim.key`` selects ``key`` inside ``claim`` inside + // ``nested``. + // + // Because the name is always split, a claim whose own name contains a dot -- a URL-namespaced + // claim such as ``http://example.org/parent_token`` -- is not addressable this way. Use + // :ref:`claim_path + // <envoy_v3_api_field_extensions.filters.http.jwt_authn.v3.JwtClaimToHeader.claim_path>` for + // those. + // + // Exactly one of ``claim_name`` and ``claim_path`` must be set. + string claim_name = 2; + + // The path to the claim to copy, given as an explicit list of segments. Each segment is matched + // in full against a key of the enclosing JSON object, so claim names containing dots are + // addressable. For the payload ``{"a.b": {"c.d": "x.y.z"}}``, the value ``x.y.z`` is selected + // by: + // + // .. code-block:: yaml + // + // claim_to_headers: + // - header_name: x-jwt-claim + // claim_path: + // - key: a.b + // - key: c.d + // + // and a URL-namespaced top-level claim by: + // + // .. code-block:: yaml + // + // claim_to_headers: + // - header_name: x-jwt-claim + // claim_path: + // - key: http://example.org/parent_token + // + // Exactly one of ``claim_name`` and ``claim_path`` must be set. + // + // [#comment: A ``min_items`` PGV rule cannot express this: a repeated field has no presence, so + // ``min_items: 1`` would make ``claim_path`` mandatory and reject every ``claim_name`` config.] + repeated PathSegment claim_path = 3; }

envoy/extensions/filters/http/local_ratelimit/v3/local_rate_limit.proto:

--- shake256:19ec3cf38907ae52aaec3e7ca8b03c11606425d9da90edc01a6922decf1e8c7962fa4b68dd625d9002863d5465c09eae29b724c4a4bffb7f3a718c936cc59614 envoy/extensions/filters/http/local_ratelimit/v3/local_rate_limit.proto +++ shake256:671c0c38410ba087095fcc257e77261d170bdca8d0ed3c3f9150e302792944f3ce16544a52738be37a92cb3b9dd5d33c40f05fa967695ae0d3b790b8479865ed envoy/extensions/filters/http/local_ratelimit/v3/local_rate_limit.proto @@ -23,7 +23,7 @@ // Local Rate limit :ref:`configuration overview <config_http_filters_local_rate_limit>`. // [#extension: envoy.filters.http.local_ratelimit] -// [#next-free-field: 19] +// [#next-free-field: 20] message LocalRateLimit { // The human readable prefix to use when emitting stats. string stat_prefix = 1 [(validate.rules).string = {min_len: 1}]; @@ -190,4 +190,13 @@ // values. // Minimum is 1. Default is 20. google.protobuf.UInt32Value max_dynamic_descriptors = 18 [(validate.rules).uint32 = {gte: 1}]; + + // Specifies whether the filter emits a ``Retry-After`` header when it enforces an HTTP 429 + // response. This option has no effect on responses with any other status code. The value is the + // number of seconds until the next token is available in the bucket that rejected the request, + // clamped to at least 1. + // If ``response_headers_to_add`` sets a ``Retry-After`` header, the filter does not overwrite it. + // + // Disabled by default. + bool enable_retry_after_header = 19; }

envoy/extensions/filters/http/lua/v3/lua.proto:

--- shake256:9a844d826893023debba55942b249a822aa24d24efc5df4df8fe21a2efb31a0ac07acb1ada1247ff21c8b1c8a7f508f25f01eff03b7f48c9417bb2ef412e5fb9 envoy/extensions/filters/http/lua/v3/lua.proto +++ shake256:d97a77149846ad07022885e6267e9a5eb5185a1ab83729a3d0dd4f2edd902d4fb00e923c90173539e72954d993c075ed1db05e5cdaf92a3e324fbd325c3edbe3 envoy/extensions/filters/http/lua/v3/lua.proto @@ -22,7 +22,7 @@ // Lua :ref:`configuration overview <config_http_filters_lua>`. // [#extension: envoy.filters.http.lua] -// [#next-free-field: 6] +// [#next-free-field: 10] message Lua { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.http.lua.v2.Lua"; @@ -88,8 +88,78 @@ // route cache automatically. // Default is true for backward compatibility. google.protobuf.BoolValue clear_route_cache = 5; + + // Optional filter context for the Lua script, accessed the same way as the per-route + // :ref:`filter_context + // <envoy_v3_api_field_extensions.filters.http.lua.v3.LuaPerRoute.filter_context>`, via + // ``handle:filterContext()``. This is the context a request gets when it has no + // ``LuaPerRoute`` configuration, or when the one it has does not set ``filter_context``. + // + // A ``LuaPerRoute`` which does set ``filter_context`` replaces this value rather than merging + // into it, so a route which sets an empty ``filter_context`` sees an empty context rather than + // this one. Only the most specific ``LuaPerRoute`` is consulted: a ``filter_context`` on a less + // specific one, such as a virtual host when the route has its own ``LuaPerRoute``, is not + // reached, and this value is used instead. + google.protobuf.Struct filter_context = 6; + + // Additional patterns for the Lua ``package.path`` of every VM this filter creates, so that a + // script can ``require`` modules from locations the interpreter does not search on its own. + // Each entry is one Lua path pattern; the entries are joined with ``;`` in the order given and + // placed ahead of the interpreter's built-in default path, which is kept. + // + // .. code-block:: yaml + // + // package_paths: + // - /etc/envoy/lua/?.lua + // - /etc/envoy/lua/?/init.lua + // + // The patterns are in place before any configured code runs, including the run that validates + // the configuration, so a ``require`` at the top level of a script whose module cannot be found + // is rejected as a configuration error rather than failing per request. + // + // Each worker builds its own VM and runs the script again to do so, after the configuration has + // been accepted, so the files a script requires must stay readable for as long as the process + // runs and not only while the configuration is loaded. + repeated string package_paths = 7 [(validate.rules).repeated = {items {string {min_len: 1}}}]; + + // As :ref:`package_paths + // <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.package_paths>`, but for + // ``package.cpath``, i.e. modules which are loadable C libraries rather than Lua source, for + // example ``/etc/envoy/lua/?.so``. + repeated string package_cpaths = 8 [(validate.rules).repeated = {items {string {min_len: 1}}}]; + + // If set, the Lua VMs this filter builds are shared with every other Lua filter configuration + // that sets the same ``shared_vm_id`` and configures the same script, rather than each + // configuration building its own. This applies to every script this message configures: + // :ref:`default_source_code + // <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.default_source_code>`, + // :ref:`inline_code <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.inline_code>` and + // every entry of :ref:`source_codes + // <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.source_codes>`. + // + // Sharing is decided per script, not per configuration: two configurations that agree on this + // id share a VM only for the scripts whose contents match, and whose :ref:`package_paths + // <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.package_paths>` and + // :ref:`package_cpaths + // <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.package_cpaths>` match, since a + // script that resolves its ``require`` calls differently does not produce an equivalent VM. + // A :ref:`LuaPerRoute.shared_vm_id + // <envoy_v3_api_field_extensions.filters.http.lua.v3.LuaPerRoute.shared_vm_id>` participates in + // the same sharing, so a route's inline script can reuse a VM built here and the other way + // around. + // + // A VM is not only an amount of memory, it is also a set of Lua globals that outlive a request. + // Scripts sharing a VM therefore see each other's globals, exactly as separate requests through + // one configuration already do. Leave this field unset, which is the default, to keep every + // configuration's scripts in VMs of their own. + // + // A shared VM lives for as long as at least one configuration using it is alive. Once the last + // one is drained the VM is torn down, and the next configuration asking for that id and script + // builds a fresh one. + string shared_vm_id = 9; } +// [#next-free-field: 8] message LuaPerRoute { oneof override { // Disable the Lua filter for this particular vhost or route. If disabled is specified in @@ -112,9 +182,42 @@ // // function envoy_on_request(request_handle) // local filter_context = request_handle:filterContext() - // local filter_context_value = filter_context["key"] + // local filter_context_value = filter_context:get("key") // -- Do something with filter_context_value. // end // + // This replaces the filter-level :ref:`filter_context + // <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.filter_context>` rather than merging + // into it. google.protobuf.Struct filter_context = 4; + + // Additional patterns for the Lua ``package.path`` of the VM built from this route's + // :ref:`source_code + // <envoy_v3_api_field_extensions.filters.http.lua.v3.LuaPerRoute.source_code>`, with the same + // meaning as the filter-level :ref:`package_paths + // <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.package_paths>`. + // + // This route's inline source code gets its own VM, which is why it needs its own patterns: the + // filter-level ones are not visible to it. Setting these has no effect when this route selects a + // script by :ref:`name + // <envoy_v3_api_field_extensions.filters.http.lua.v3.LuaPerRoute.name>`, or configures no script + // at all, since that VM belongs to the filter and carries the filter-level patterns. + repeated string package_paths = 5 [(validate.rules).repeated = {items {string {min_len: 1}}}]; + + // As :ref:`package_paths + // <envoy_v3_api_field_extensions.filters.http.lua.v3.LuaPerRoute.package_paths>`, but for + // ``package.cpath``. + repeated string package_cpaths = 6 [(validate.rules).repeated = {items {string {min_len: 1}}}]; + + // As :ref:`Lua.shared_vm_id + // <envoy_v3_api_field_extensions.filters.http.lua.v3.Lua.shared_vm_id>`, but for the VM built + // from this route's :ref:`source_code + // <envoy_v3_api_field_extensions.filters.http.lua.v3.LuaPerRoute.source_code>`. Routes and + // filter configurations share one pool of VMs, so a route setting the same id as a filter + // configuration reuses that configuration's VM when the script matches. + // + // Setting this has no effect when this route selects a script by :ref:`name + // <envoy_v3_api_field_extensions.filters.http.lua.v3.LuaPerRoute.name>`, or configures no + // script at all, since that VM belongs to the filter and follows the filter's setting. + string shared_vm_id = 7; }

envoy/extensions/filters/http/mcp/v3/mcp.proto:

--- shake256:808766396bbbebaa9e63f415dd311ee8a26a2537a290280f8269cc4b750d25970889e47e8c2ab1fd49574f6b1589f997f4ac796c6420b56eb2966ac40e643087 envoy/extensions/filters/http/mcp/v3/mcp.proto +++ shake256:0714db48ed84ae812c9f70b086a460cbd06cc56e8a9aec3d6c10eaa7ee5c9f0e4bbf316e51070cff08aeed02624a34e96956ddee5ff25aec0613a0e3deff93cc envoy/extensions/filters/http/mcp/v3/mcp.proto @@ -21,7 +21,7 @@ // [#extension: envoy.filters.http.mcp] // This filter will inspect and get attributes from MCP traffic. -// [#next-free-field: 9] +// [#next-free-field: 12] message Mcp { // Traffic handling mode for non-MCP traffic. enum TrafficMode { @@ -35,6 +35,11 @@ // - GET requests for SSE streams (with Accept: text/event-stream) // - DELETE requests for session termination (with MCP-Session-Id header) REJECT_NO_MCP = 1; + + // Disables MCP processing entirely. The filter performs no inspection, + // attribute extraction, trace context propagation, or rejection; all + // traffic is proxied as-is. + NOOP = 2; } // Where to store parsed MCP request attributes. @@ -53,6 +58,20 @@ DYNAMIC_METADATA_AND_FILTER_STATE = 3; } + // Source used to obtain MCP request attributes. + enum AttributeSource { + // Parse attributes from the request body and ignore MCP attribute headers. + BODY = 0; + + // Use MCP attribute headers and verify that values parsed from the body agree. + VERIFY = 1; + + // Trust MCP attribute headers for ``method`` and the method-specific + // identifier carried by ``Mcp-Name`` (``params.name``, ``params.uri``, or + // ``params.taskId``), and avoid parsing the body when nothing else requires it. + HEADERS = 2; + } + message TraceContextPropagationConfig { option (xds.annotations.v3.message_status).work_in_progress = true; } @@ -111,10 +130,46 @@ // If unset (default), do not extract or inject baggage. BaggagePropagationConfig propagate_baggage = 7; - // When true, reject requests that contain duplicate JSON keys at any - // nesting level. RFC 8259 Section 4 states that names within an object SHOULD be - // unique. Defaults to false (last-key-wins / last-win). + // When true, disallow requests that contain duplicate JSON keys at any + // nesting level. RFC 8259 Section 4 states that names within an object SHOULD + // be unique. Defaults to false (last-key-wins / last-win). If traffic mode is + // REJECT_NO_MCP, reject these requests; if PASS_THROUGH, log an error status + // but don't reject the request. google.protobuf.BoolValue reject_duplicate_keys = 8; + + // Controls whether MCP request attributes are obtained from the request body + // or from MCP request headers. Header-based extraction is limited to ``method`` + // and the method-specific identifier carried by ``Mcp-Name``; other configured + // extraction rules still require body parsing. + AttributeSource attribute_source = 9 [(validate.rules).enum = {defined_only: true}]; + + // When true, stop parsing (and buffering) the request body as soon as all the + // required routing attributes for the request's method have been collected + // (for example ``method`` and ``params.name`` for ``tools/call``), even if + // optional attributes such as ``params._meta`` or the remainder of the body + // have not been parsed yet. This decouples routing from body size, so a large + // trailing payload (for example ``params.arguments``) does not need to be + // buffered at the proxy just to route the request. + // + // Early termination is intentionally skipped when it could change observable + // behavior, so it has no effect when any of the following holds: + // + // - ``reject_duplicate_keys`` is set (duplicate detection needs a full-body scan); + // - ``propagate_trace_context`` or ``propagate_baggage`` is set (both read + // ``params._meta``, which may appear after the routing attributes); + // - ``attribute_source`` is not ``BODY``. + // + // Requests whose body arrives complete in a single chunk are unaffected, since + // the whole root object is observed before iteration continues. + // + // Defaults to false. + bool early_terminate_when_routable = 10; + + // The latest MCP protocol revision supported by the filter. + // + // Requests using a known protocol revision newer than this value are rejected. + // When unset, no protocol-version restriction is applied. + google.protobuf.StringValue max_supported_protocol_version = 11; } // Parser configuration with method-specific rules. @@ -156,12 +211,25 @@ } // Per-route override configuration for MCP filter +// [#next-free-field: 7] message McpOverride { - // Optional per-route traffic mode override + // Overrides the global traffic mode for this route. Mcp.TrafficMode traffic_mode = 1 [(validate.rules).enum = {defined_only: true}]; // Optional per-route max request body size override. // When set, this overrides the global max_request_body_size for this route. // It defaults to 8KB (8192 bytes) and the maximum allowed value is 10MB (10485760 bytes). google.protobuf.UInt32Value max_request_body_size = 2 [(validate.rules).uint32 = {lte: 10485760}]; + + // Overrides the global clear_route_cache setting for this route. + bool clear_route_cache = 3; + + // Overrides the global parser config for this route. + ParserConfig parser_config = 4; + + // Overrides the global request storage mode for this route. + Mcp.RequestStorageMode request_storage_mode = 5 [(validate.rules).enum = {defined_only: true}]; + + // Overrides the global reject_duplicate_keys setting for this route. + bool reject_duplicate_keys = 6; }

envoy/extensions/filters/http/mcp_json_rest_bridge/v3/mcp_json_rest_bridge.proto:

--- shake256:5aee9cad0f35c68f9a54ca9dcf19c9875fb92140c560ba5bce1216e5e1bab0155f2684c448b641bcd675e1f9f4b1bce8ac0c3c7ec8c965a9d6968357df193e5b envoy/extensions/filters/http/mcp_json_rest_bridge/v3/mcp_json_rest_bridge.proto +++ shake256:b8cc3aad08e373430341aa271264b049929ebce00d1e2f69771e1f970604efba7396bd0cc8e5dee629c1c556c817423dfac16bbce88ab7081e40888c3f59a51e envoy/extensions/filters/http/mcp_json_rest_bridge/v3/mcp_json_rest_bridge.proto @@ -2,6 +2,7 @@ package envoy.extensions.filters.http.mcp_json_rest_bridge.v3; +import "google/protobuf/duration.proto"; import "google/protobuf/wrappers.proto"; import "xds/annotations/v3/status.proto"; @@ -19,6 +20,18 @@ // [#protodoc-title: MCP JSON REST Bridge] // [#extension: envoy.filters.http.mcp_json_rest_bridge] +// The cache scope of a cacheable MCP result, emitted as the ``cacheScope`` result field. +enum CacheScope { + // Unspecified. Treated as ``CACHE_SCOPE_PUBLIC``. + CACHE_SCOPE_UNSPECIFIED = 0; + + // The result may be stored in a shared cache and reused across clients. + CACHE_SCOPE_PUBLIC = 1; + + // The result may only be stored in a per-client cache. + CACHE_SCOPE_PRIVATE = 2; +} + // Configuration for the MCP MCP JSON REST Bridge. // // This extension translates Model Context Protocol (MCP) JSON-RPC requests into standard JSON-REST @@ -90,7 +103,7 @@ // - Body: {"data": "updated value"} // (Only the "payload" field from arguments is used as the body. Other arguments not in the // path, like 'resource_id', become query parameters.) -// [#next-free-field: 8] +// [#next-free-field: 9] message McpJsonRestBridge { // Where to store parsed MCP request attributes. enum RequestStorageMode { @@ -146,25 +159,40 @@ // When set to true, the filter will not clear the route cache after transcoding. // This allows the route to be re-selected based on the updated request path or method. bool disable_clear_route_cache = 7; + + // When set to true, the filter will take no action unless per-route config is available. + bool per_route_only = 8; } // Options for trace context extraction. message TraceContextExtractionOptions { } +// Cache configuration for a locally-generated, cacheable MCP result. +message CacheConfig { + // How long the result may be reused, emitted as the MCP ``ttlMs`` result field. + // + // If not provided: Defaults to 0, meaning clients should revalidate before reusing the result. + google.protobuf.Duration ttl = 1 [(validate.rules).duration = {gte {}}]; + + // The cache scope of the result. + // + // If not provided: Defaults to ``CACHE_SCOPE_PUBLIC``. + CacheScope cache_scope = 2 [(validate.rules).enum = {defined_only: true}]; +} + // Configuration for the server metadata. message ServerInfo { - // [#not-implemented-hide:] - // [#comment:TODO(guoyilin42): Implement supported_protocol_versions] - // Lists the MCP protocol versions supported by this MCP endpoint. - // - // - If provided: The extension enforces version negotiation according to the MCP specification: - // https://modelcontextprotocol.io/specification/2025-11-25/basic/lifecycle#version-negotiation - // - If not provided: The extension accepts any version sent by the client during negotiation and - // skips validation of the mcp-protocol-version header on subsequent requests. + // The maximum MCP protocol version supported by this MCP endpoint. // - // Example values: ["2025-11-25", "2025-06-18"] - repeated string supported_protocol_versions = 1; + // Supported values are ``2025-11-25`` and ``2026-07-28``. Versions prior + // to ``2025-11-25`` are rejected because the filter unconditionally supports features + // up to ``2025-11-25`` and does not support downgrading below that baseline. + // If not provided: Defaults to ``2025-11-25``. + // + // Example value: "2026-07-28" + google.protobuf.StringValue max_supported_protocol_version = 1 + [(validate.rules).string = {in: "2025-11-25" in: "2026-07-28"}]; // [#not-implemented-hide:] // [#comment:TODO(guoyilin42): Implement description] @@ -175,10 +203,15 @@ // // - If provided: The extension uses this version as the fallback protocol version. // - If not provided: The extension uses the fallback protocol version defined in the latest MCP - // specification. For example, the current latest 2025-11-25 specification designates "2025-03-26" + // specification. For example, the current latest 2026-07-28 specification designates "2025-03-26" // as the fallback protocol version. - // See https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#protocol-version-header + // See https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http#protocol-version-header google.protobuf.StringValue fallback_protocol_version = 3; + + // Cache configuration advertised in locally-generated ``server/discover`` responses. + // + // If not provided: the response advertises ``ttlMs: 0`` and ``cacheScope: public``. + CacheConfig server_discovery_cache_config = 4; } // Configuration for sending locally-generated responses to tools/list requests. @@ -212,8 +245,7 @@ ToolsListLocal tool_list_local = 4; } - // [#not-implemented-hide:] - // Default server info for tools without specific ones. + // Default server info for tools without specific ones. If not provided, a fallback path of '/mcp' will be used. McpServerInfo default_server_info = 5; } @@ -223,7 +255,7 @@ string title = 1; // Human-readable description of functionality. - string description = 2 [(validate.rules).string = {min_len: 1}]; + string description = 2; // A JSON Schema describing expected parameters, as a serialized JSON string, in the JSON Schema // 2020-12 dialect. This should be raw JSON, including the "properties" and "required" keys, but @@ -257,6 +289,10 @@ // When enabled, the response body is streamed directly to the client without buffering. Each // chunk is JSON escaped as it arrives and wrapped with a pre-built JSON-RPC prefix and suffix. // + // For Server-Sent Events (SSE) responses (i.e. ``text/event-stream`` content type), Envoy parses + // the stream and wraps each extracted complete event payload into a distinct text content item + // within the JSON-RPC ``content`` array on the fly. + // // Streaming flow: // // .. code-block:: text @@ -284,8 +320,46 @@ // - If specify a field: Only that specific argument becomes the HTTP JSON body. // - If empty: No body is sent. // 3. Query: Any leaf arguments not mapped to Path or Body are added as URL query parameters. -// [#next-free-field: 7] +// [#next-free-field: 8] message HttpRule { + // Represents a mapping from a request message field to an HTTP element. + // If the specified argument is missing from the tools/call request, the binding is silently + // ignored and the corresponding HTTP element (header or cookie) is not added. + message ParameterBinding { + // The target HTTP element type to bind to. + enum Type { + // Unspecified element type. + TYPE_UNSPECIFIED = 0; + + // The argument value is bound to an HTTP request header. + // Conceptually maps to an OpenAPI parameter with ``in: header``. + HEADER = 1; + + // The argument value is bound to an HTTP request cookie. + // Conceptually maps to an OpenAPI parameter with ``in: cookie``. + COOKIE = 2; + } + + // The type of the HTTP element to bind to. + Type type = 1; + + // The name of the HTTP header (e.g., "X-API-Key", "Authorization") or the + // name of the cookie (e.g.,"SESSION_ID"). Note: Envoy normalizes the header names to lowercase. + // The following headers are reserved for Envoy's internal use and cannot be overridden by + // bindings: ``content-length``, ``transfer-encoding``, ``host``, ``:authority``, ``cookie``, + // ``accept-encoding``, and any header starting with ``x-envoy-``. Attempting to bind to these + // will be ignored. + string name = 2 + [(validate.rules).string = + {min_len: 1 max_bytes: 16384 well_known_regex: HTTP_HEADER_NAME strict: false}]; + + // Path to the field within the JSON arguments object from a tools/call + // request. Uses dot-notation for nested fields. + // E.g. if arguments object is ``{"user":{"auth_token":"foo"}}``, then + // ``argument_path`` should be "user.auth_token". + string argument_path = 3 [(validate.rules).string = {min_len: 1}]; + } + // Determines the HTTP method and the URL path template. // // Path templating uses curly braces ``{}`` to mark a section of the URL path as replaceable. @@ -319,6 +393,10 @@ // fields (e.g., "user.data" maps the value of the "data" field inside "user"). // - If omitted: There is no HTTP request body; fields not in the path become query parameters. string body = 6; + + // Bindings to extract values from the 'arguments' object of a tools/call + // request and inject them as HTTP elements. + repeated ParameterBinding bindings = 7; } // Per-route override configuration for the MCP JSON REST Bridge filter.

envoy/extensions/filters/http/mcp_router/v3/mcp_router.proto:

--- shake256:4784eabf7fac5ec895c3fb78a6229e0ba47d006a9141ac3554c3ae6b4819aa1df5928d227a32e0705d707aeeca69b5bd2ff5127c9af2148d32d6a8a052c2e951 envoy/extensions/filters/http/mcp_router/v3/mcp_router.proto +++ shake256:215924db62d3fceb150319e0f9426b9ccf5056399ed051eae3252cde40bfc9476a15ce3c50047e6132875e8ab586c86bdb31e03297186593e6da09ece69f47c8 envoy/extensions/filters/http/mcp_router/v3/mcp_router.proto @@ -2,6 +2,7 @@ package envoy.extensions.filters.http.mcp_router.v3; +import "envoy/type/matcher/v3/string.proto"; import "envoy/type/metadata/v3/metadata.proto"; import "google/protobuf/duration.proto"; @@ -98,6 +99,15 @@ // Backend target specification. McpCluster mcp_cluster = 2; + + // Controls which downstream request headers are forwarded to this backend. + // If not set, no downstream-controlled headers are forwarded beyond those the + // router itself must synthesize (e.g. ``content-type``, ``accept``, the session + // header) — in particular, a client's ``authorization`` header is NOT forwarded + // by default. Router-owned, framing, session, and hop-by-hop headers are never + // affected by this policy; they are handled separately and can never be forwarded + // via this mechanism. + HeaderForwarding header_forwarding = 3; } // Cluster-based backend configuration. @@ -117,6 +127,40 @@ string host_rewrite_literal = 4; } + // Specifies which downstream request headers are allowed to be forwarded to an MCP + // backend. Modeled after + // :ref:`ext_proc's HeaderForwardingRules <envoy_v3_api_msg_extensions.filters.http.ext_proc.v3.ExternalProcessor>`, + // but MCP-local and secure-by-default: unlike ext_proc, an unset/empty policy + // forwards nothing rather than everything, because MCP requires audience-bound + // tokens and prohibits implicit token passthrough between a client and a backend it + // did not authenticate to. + // + // Evaluation order per header: + // + // 1. If the header matches ``disallowed_headers``, it is never forwarded — this + // takes precedence over everything below, including ``forward_all``. + // 2. Otherwise, if ``forward_all`` is true, the header is forwarded. + // 3. Otherwise, if the header matches ``allowed_headers``, it is forwarded. + // 4. Otherwise, the header is not forwarded. + // + // This does not cover header *mutation* or credential injection, which remain a + // separate concern from this filter's forwarding policy. + message HeaderForwarding { + // If true, forward all downstream request headers to this backend (subject to + // ``disallowed_headers`` above), matching the legacy forward-everything behavior. + // Defaults to false. Users relying on the legacy behavior must set this explicitly. + bool forward_all = 1; + + // If set, specifically allow any header in this list to be forwarded. Ignored for a + // header that also matches ``disallowed_headers``, and redundant (but harmless) for + // any header covered by ``forward_all``. + type.matcher.v3.ListStringMatcher allowed_headers = 2; + + // If set, specifically disallow any header in this list from being forwarded. This + // takes precedence over both ``forward_all`` and ``allowed_headers``. + type.matcher.v3.ListStringMatcher disallowed_headers = 3; + } + // A list of remote MCP servers. MCP router aggregates capabilities, tools and resources from remote MCP servers // and presents itself as single MCP server to the client. All remote MCP servers are sent the same capabilities // that the client presented to Envoy.

envoy/extensions/filters/http/oauth2/v3/oauth.proto:

--- shake256:1e855d9dc76a5577eb5c8291d2277659417251743ef7779a6f5cee92f01c9d87b003e978b9f66f7cbd6e2443cb7069e04182cd6133b0f9792b1bc405463fd5e7 envoy/extensions/filters/http/oauth2/v3/oauth.proto +++ shake256:8789f8a8766b74d0084215b44531f7583fab7d7fda35d1e18d3ea5f9315b3ecb4c0e817d3acc110d0891cfe01ce4b2ab27fd18b9fe63a78beefa95a9918fad04 envoy/extensions/filters/http/oauth2/v3/oauth.proto @@ -130,7 +130,20 @@ // This field is required unless :ref:`auth_type <envoy_v3_api_field_extensions.filters.http.oauth2.v3.OAuth2Config.auth_type>` // is set to ``TLS_CLIENT_AUTH``, in which case authentication is done via the client certificate. // When ``auth_type`` is ``PRIVATE_KEY_JWT``, this field must contain the PEM-encoded private key - // used to sign the JWT client assertion. + // used to sign the JWT client assertion. The key may be supplied in either of two forms: + // + // * As a single-value generic secret holding the PEM-encoded private key. No ``kid`` header + // parameter is included in the client assertion. + // * As a multi-entry generic secret with a ``private_key`` entry holding the PEM-encoded private + // key and an optional ``key_id`` entry. When present, the ``key_id`` value is set as the + // ``kid`` header parameter of the client assertion, per + // `RFC 7515 Section 4.1.4 <https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.4>`_. + // Identity providers use it to select the correct verification key when more than one key is + // registered for the client. Distributing both in one secret means the key ID is always + // rotated together with the key it identifies. + // + // The multi-entry form is only read when ``auth_type`` is ``PRIVATE_KEY_JWT``. The other auth + // types read the single-value form only. transport_sockets.tls.v3.SdsSecretConfig token_secret = 2; // Configures how the secret token should be created. @@ -184,6 +197,20 @@ // The value is truncated to whole seconds, so it must be at least ``1s`` when set. // Default: ``60s``. google.protobuf.Duration assertion_lifetime = 2 [(validate.rules).duration = {gte {seconds: 1}}]; + + // The value to use as the ``aud`` (audience) claim in the JWT client assertion. + // + // `RFC 7523 Section 3 <https://datatracker.ietf.org/doc/html/rfc7523#section-3>`_ requires the + // ``aud`` claim to identify the authorization server, and allows the token endpoint URL to be + // used for this purpose. + // `RFC 9126 Section 2.1 <https://datatracker.ietf.org/doc/html/rfc9126#section-2.1>`_ recommends + // the authorization server's issuer identifier instead, and + // `FAPI 2.0 <https://openid.net/specs/fapi-security-profile-2_0-final.html>`_ requires it, as a + // single canonical value identifies the server regardless of which endpoint receives the + // assertion. + // + // If not set, defaults to the configured ``token_endpoint`` URI. + string assertion_audience = 3; } // Defines how an OAuth token is forwarded upstream. @@ -213,9 +240,32 @@ } } +// Splits OAuth token cookies that are too large for a browser to store. +// +// A token that fits in one cookie is written as a single cookie, as without chunking. A larger +// token is written as ``<name>_0`` to ``<name>_N-1``, plus a ``<name>_chunks`` cookie that holds +// the count ``N``. If a token needs more than +// :ref:`max_chunks <envoy_v3_api_field_extensions.filters.http.oauth2.v3.TokenCookieChunking.max_chunks>` +// cookies, the filter responds with ``503`` instead of setting cookies that the client would drop. +// +// Chunked cookies add to the request header size. A session with more than one large token may +// need a larger :ref:`max_request_headers_kb +// <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.max_request_headers_kb>`. +message TokenCookieChunking { + // The largest cookie Envoy writes for a token, counting its name, value and attributes. A token + // whose cookie would be larger is split. Defaults to ``4096``, the limit browsers enforce. + google.protobuf.UInt32Value max_cookie_size = 1 [(validate.rules).uint32 = {lte: 4096 gte: 512}]; + + // The most cookies a single token is split into. Defaults to ``8``. + // + // Envoy rejoins up to 16 chunks on requests regardless of this value, so lowering it does not + // invalidate existing sessions. + google.protobuf.UInt32Value max_chunks = 2 [(validate.rules).uint32 = {lte: 16 gte: 2}]; +} + // OAuth config // -// [#next-free-field: 34] +// [#next-free-field: 35] message OAuth2Config { enum AuthType { // The ``client_id`` and ``client_secret`` will be sent in the URL encoded request body. @@ -446,6 +496,16 @@ // Only used when :ref:`auth_type <envoy_v3_api_field_extensions.filters.http.oauth2.v3.OAuth2Config.auth_type>` // is set to ``PRIVATE_KEY_JWT``. PrivateKeyJwtConfig private_key_jwt_config = 32; + + // If set, an access, ID or refresh token cookie that is larger than + // :ref:`max_cookie_size <envoy_v3_api_field_extensions.filters.http.oauth2.v3.TokenCookieChunking.max_cookie_size>` + // is split across multiple cookies. If not set, every token is written as a single cookie, + // which a browser drops when it is larger than 4096 bytes. + // + // Envoy always rejoins chunked token cookies on requests, whether or not this is set, so it can + // be removed safely. In a rolling upgrade, set it only after every Envoy that may serve the same + // client understands chunked cookies. + TokenCookieChunking token_cookie_chunking = 34; } // Per-route OAuth2 config.

envoy/extensions/filters/http/rate_limit_quota/v3/rate_limit_quota.proto:

--- shake256:28bd12f97bccae3aa606022c3f09d1d4acade512e586542287c6e6af79242d005caaa91ff24ae517a498d38a63e34906ac899f286461d4701c824be602b0a24b envoy/extensions/filters/http/rate_limit_quota/v3/rate_limit_quota.proto +++ shake256:bf95c1ca561ecc655f47a4e5221ddef23cb62faf0ff6388cdf2b51bcf34f5ab4702411cd94f5e0a5e7889a8cf90a57e30c400bbe7e5e0b32caad87e202f67172 envoy/extensions/filters/http/rate_limit_quota/v3/rate_limit_quota.proto @@ -12,7 +12,6 @@ import "google/protobuf/wrappers.proto"; import "google/rpc/status.proto"; -import "xds/annotations/v3/status.proto"; import "xds/type/matcher/v3/matcher.proto"; import "udpa/annotations/status.proto"; @@ -23,7 +22,6 @@ option java_multiple_files = true; option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/rate_limit_quota/v3;rate_limit_quotav3"; option (udpa.annotations.file_status).package_version_status = ACTIVE; -option (xds.annotations.v3.file_status).work_in_progress = true; // [#protodoc-title: Rate Limit Quota] // Rate Limit Quota :ref:`configuration overview <config_http_filters_rate_limit_quota>`.

envoy/extensions/filters/http/ratelimit/v3/rate_limit.proto:

--- shake256:dc3c8e72fda2ad3e68389021ba3c98c2fa6f659c2fe66962bf5c4a61f374cb5d4767608acc4996f5df6fea29e7bcd82f44776c7fbf5cceeb2afbb5fec211b373 envoy/extensions/filters/http/ratelimit/v3/rate_limit.proto +++ shake256:292e42dde6932c1148c0c59b3fd91973c690820e8908070d383c1e4dc7eec495a3f07018c61c578b282c22dafeaf83f102500784cfeb90ef9ed269abb7c5e038 envoy/extensions/filters/http/ratelimit/v3/rate_limit.proto @@ -23,7 +23,7 @@ // Rate limit :ref:`configuration overview <config_http_filters_rate_limit>`. // [#extension: envoy.filters.http.ratelimit] -// [#next-free-field: 19] +// [#next-free-field: 20] message RateLimit { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.http.rate_limit.v2.RateLimit"; @@ -190,6 +190,16 @@ // The namespace where dynamic metadata from rate limit response is saved. // If not set, the default is "envoy.filters.http.ratelimit". string metadata_namespace = 18; + + // Specifies whether the filter emits a ``Retry-After`` header when it enforces an HTTP 429 + // response. This option has no effect on responses with any other status code. The value is the + // largest ``duration_until_reset`` among the over-limit descriptor statuses returned by the rate + // limit service, expressed in seconds and clamped to at least 1. The header is not emitted when no + // over-limit descriptor status is present. + // If the rate limit service returns a ``Retry-After`` header, the filter does not overwrite it. + // + // Disabled by default. + bool enable_retry_after_header = 19; } message RateLimitPerRoute {

envoy/extensions/filters/listener/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:db215158abc795f16af911490b416d119eccc3ec6d16fe9d6a094f76db6ea54c007d28d77ae1b70529f7ba12ea94df50f80c49bfdcdd5267e9de43bda3b58b47 envoy/extensions/filters/listener/dynamic_modules/v3/dynamic_modules.proto +++ shake256:bb27c6ce8e6b0e1896bf9c84bbdd8ff0bbc9232ff56dd79d741cd58c8359b9aeeab360d902e99ff96ecf5e8123fc57923d0eeb8cd1ccc9b2dfc070ac32278fdc envoy/extensions/filters/listener/dynamic_modules/v3/dynamic_modules.proto @@ -53,7 +53,8 @@ // rate limiting, ``filter_name`` is used to choose either TLS or rate limiting. The ``filter_config`` // can be used to configure the TLS inspection options or the rate limiting parameters. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/filters/network/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:a57d27a8b05774d301f856d2f82d3f94ab03fbcd8b9d188f3edd115325f9054463979c76015c671ebd4cc35c960fd035c8a5049716f71abc97bd332996de3bd2 envoy/extensions/filters/network/dynamic_modules/v3/dynamic_modules.proto +++ shake256:559ebcaa55111ab6468aa3becc83cee62b89554441a4c3f3bbc949a5c06c804af371828dde55be57224733c59abb4eb046427361d8a0edef8ce9f8ee459007b4 envoy/extensions/filters/network/dynamic_modules/v3/dynamic_modules.proto @@ -52,7 +52,8 @@ // limiting, ``filter_name`` is used to choose either echo or rate limiting. The // ``filter_config`` can be used to configure the echo behavior or the rate limiting parameters. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/filters/network/ext_authz/v3/ext_authz.proto:

--- shake256:abfd42b3e363fbe849273f3400b4557ff8c511986893e362f7a3c524a33f10bc770a0e54e3160a7e02ad187d67b3d9fd38ae158946b5b38277065a2d0bfde960 envoy/extensions/filters/network/ext_authz/v3/ext_authz.proto +++ shake256:3cf58f3f20d249c51043cd45dc319779001d676c9496a820b242ca3271fdd6df5d2672b8680db80d48c77d43da36d2137ddb8353952e83745219860a0ab131b7 envoy/extensions/filters/network/ext_authz/v3/ext_authz.proto @@ -24,8 +24,9 @@ // External Authorization filter calls out to an external service over the // gRPC Authorization API defined by // :ref:`CheckRequest <envoy_v3_api_msg_service.auth.v3.CheckRequest>`. -// A failed check will cause this filter to close the TCP connection. -// [#next-free-field: 12] +// A failed check will cause this filter to close the TCP connection, unless ``shadow_mode`` is +// enabled. +// [#next-free-field: 13] message ExtAuthz { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.network.ext_authz.v2.ExtAuthz"; @@ -100,4 +101,13 @@ // the protobuf message definition in order to perform safe parsing. // repeated string typed_metadata_context_namespaces = 11; + + // When set to ``true``, the filter operates in shadow mode. The filter still calls the external + // authorization service but never closes the connection. The authorization decision is instead + // recorded in the connection's :ref:`FilterState <arch_overview_data_sharing_between_filters>` + // under the key ``envoy.filters.network.ext_authz`` so that a subsequent filter can read and + // optionally enforce it. + // + // Defaults to ``false``. + bool shadow_mode = 12; }

envoy/extensions/filters/network/ext_proc/v3/ext_proc.proto:

--- shake256:680442ffbffbd96a2d6cfaaa1efb97f319bb1e1728c5b10028f95e4d3ca011f618bdb38435ae7ac7d8cfa919a41064b52a90b6eec609b9ed12b6692633ae49ab envoy/extensions/filters/network/ext_proc/v3/ext_proc.proto +++ shake256:cc3a720d04c0e522647d43261115f11d2b41a64d6c7a5670d69b0acf4abdfada1d10c21a120270acfc3b9adfd3b7307f8361df4bf40dd0715ebde4f1ae634e34 envoy/extensions/filters/network/ext_proc/v3/ext_proc.proto @@ -34,7 +34,7 @@ // // By using the filter's processing mode, you can selectively choose which data // directions to process (read, write or both), allowing for efficient processing. -// [#next-free-field: 7] +// [#next-free-field: 8] message NetworkExternalProcessor { // The gRPC service that will process network traffic. // This service must implement the NetworkExternalProcessor service @@ -64,6 +64,14 @@ // Options related to the sending and receiving of dynamic metadata. MetadataOptions metadata_options = 6; + + // The data plane provides a number of :ref:`attributes <arch_overview_attributes>` + // for expressive policies. Each attribute name provided in this field will be + // evaluated against the connection and filter state and populated in the + // :ref:`ProcessingRequest.attributes <envoy_v3_api_field_service.network_ext_proc.v3.ProcessingRequest.attributes>` field. + // See the :ref:`attribute documentation <arch_overview_attributes>` + // for the list of supported attributes and their types. + repeated string connection_attributes = 7; } // Options for controlling processing behavior.

envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto:

--- shake256:95ea3b89fcffe04a590089cfea147025b8e96d0000467fea10539f5824c9002a55b828d8c3b8bc2e504a2962a5b229e3bce79cad9746661a1d12a548af8965e5 envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto +++ shake256:86affc73c5bb63a417da41b833f706c43013693045ce97dddb2d58dcf8952cd6874d2697b59c83578128cfa2193c9236c5b4e1a419ae969fd1df9315fde2c205 envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto @@ -39,7 +39,7 @@ // HTTP connection manager :ref:`configuration overview <config_http_conn_man>`. // [#extension: envoy.filters.network.http_connection_manager] -// [#next-free-field: 63] +// [#next-free-field: 64] message HttpConnectionManager { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager"; @@ -283,7 +283,7 @@ repeated config.core.v3.CidrRange cidr_ranges = 2; } - // [#next-free-field: 8] + // [#next-free-field: 9] message SetCurrentClientCertDetails { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager." @@ -313,6 +313,9 @@ // false. bool uri = 5; + // Whether to forward the issuer of the client cert. Defaults to false. + bool issuer = 8; + // The format for the header. When the :ref:`forward_client_cert_details // <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.forward_client_cert_details>` // is APPEND_FORWARD and an existing XFCC header is present, the format of the existing header @@ -1128,6 +1131,11 @@ // If not configured, defaults to disabled and the standard behavior applies (using connection // TLS status or trusted downstream headers). ForwardProtoConfig forward_proto_config = 61; + + // If true, records two per stream histograms, ``downstream_rq_route_resolution_time_us`` for the + // total wall time spent resolving the route and ``downstream_rq_route_resolutions`` for the number + // of resolutions. Defaults to false, so the default stat set is unchanged. + bool record_route_resolution_stats = 63; } // Configuration options for setting the ``x-forwarded-proto`` header.

envoy/extensions/filters/network/redis_proxy/v3/redis_proxy.proto:

--- shake256:338225826a4001053668b439d7bde202bd2c7ad1c91debd6345db3d2ab25fddc7417edf2aa65a2b7874188333b4430c04e93b5f21b150f856275d7a0a6259498 envoy/extensions/filters/network/redis_proxy/v3/redis_proxy.proto +++ shake256:645d441d2b0d63f29153759dbb3bf26dd41ad19052f28a3309257d4cc452d08b5121b0a42b1f73b16b4f1438d15a4b08161887f607528676dc6b98efb045d639 envoy/extensions/filters/network/redis_proxy/v3/redis_proxy.proto @@ -28,11 +28,32 @@ // Redis Proxy :ref:`configuration overview <config_network_filters_redis_proxy>`. // [#extension: envoy.filters.network.redis_proxy] -// [#next-free-field: 12] +// [#next-free-field: 13] message RedisProxy { option (udpa.annotations.versioning).previous_message_type = "envoy.config.filter.network.redis_proxy.v2.RedisProxy"; + // RESP protocol version supported on this listener. + enum ProtocolVersion { + // Default. The listener speaks RESP2 on both downstream connections and + // every routed upstream conn pool: no ``HELLO 3`` is sent upstream and a + // downstream ``HELLO 3`` is rejected with ``-NOPROTO``. (RESP3-aware + // handling such as the local ``HELLO`` reply, ``CLIENT SETINFO`` / + // ``SETNAME`` acceptance, and the RESP3 decoder is always present; this + // value only controls the negotiated wire version.) + RESP2 = 0; + + // The listener speaks RESP3 on both downstream connections and every + // routed upstream conn pool. Upstream conn pools negotiate ``HELLO 3`` + // (combined with ``AUTH`` when credentials or AWS IAM authentication are + // configured) on each new connection; ``upstream_resp3_hello_failure`` + // tracks negotiation failures. Downstream clients must perform an + // explicit ``HELLO 3`` handshake before any data command — bare ``HELLO`` + // on a fresh connection or any non-HELLO/AUTH/QUIT command before + // ``HELLO 3`` is rejected with ``-NOPROTO``. + RESP3 = 1; + } + // Redis connection pool settings. // [#next-free-field: 11] message ConnPoolSettings { @@ -389,6 +410,20 @@ // The is to support redis's feature wherein new commands can be added using redis' modules api: // https://redis.io/docs/latest/develop/reference/modules/ repeated string custom_commands = 11; + + // RESP protocol version enforced for both downstream connections and every + // routed upstream conn pool for this listener. Mismatched negotiation is + // rejected at HELLO (``HELLO N`` where ``N`` does not match returns + // ``-NOPROTO``) and, when set to ``RESP3``, at every non-HELLO/AUTH/QUIT + // command on a connection that has not yet negotiated RESP3 (so clients + // must perform an explicit ``HELLO 3`` handshake before any data command). + // + // When ``protocol_version`` is ``RESP3``, every routed upstream + // Redis-compatible backend must support ``HELLO 3`` / RESP3 (e.g. + // Redis 6.0+, where RESP3 was introduced). Misconfigured upstreams will + // fail every connection's HELLO 3 negotiation, surfaced as + // ``upstream_resp3_hello_failure`` stat increments. + ProtocolVersion protocol_version = 12 [(validate.rules).enum = {defined_only: true}]; } // RedisProtocolOptions specifies Redis upstream protocol options. This object is used in

envoy/extensions/filters/network/reverse_tunnel/v3/reverse_tunnel.proto:

--- shake256:323d69a823d3e0ff9288f728451afca371eef0ca458a73293c124822e90f70d53af71754605423710074150e30f5d2cbbaebf49117f93d7d85de1a0052885b2c envoy/extensions/filters/network/reverse_tunnel/v3/reverse_tunnel.proto +++ shake256:c0b374171742f42295d7451d3f8d046d3dac45713ce950026ca36f838fb3201c80156d6eb198e19212506adbb16d61a41ac01ffe563e88e331f84f58e7e65050 envoy/extensions/filters/network/reverse_tunnel/v3/reverse_tunnel.proto @@ -3,9 +3,11 @@ package envoy.extensions.filters.network.reverse_tunnel.v3; import "envoy/config/core/v3/base.proto"; +import "envoy/extensions/filters/common/jwks/v3/jwt_handshake.proto"; import "google/protobuf/duration.proto"; +import "envoy/annotations/deprecation.proto"; import "udpa/annotations/status.proto"; import "validate/validate.proto"; @@ -96,7 +98,7 @@ // Configuration for the reverse tunnel network filter. // This filter handles reverse tunnel connection acceptance and rejection by processing // HTTP requests where required identification values are provided via HTTP headers. -// [#next-free-field: 9] +// [#next-free-field: 12] message ReverseTunnel { // Ping interval for health checks on established reverse tunnel connections. // If not specified, defaults to ``2 seconds``. @@ -105,13 +107,10 @@ gte {nanos: 1000000} }]; - // Whether to automatically close connections after processing reverse tunnel requests. - // - // * When set to ``true``, connections are closed after acceptance or rejection. - // * When set to ``false``, connections remain open for potential reuse. - // - // Defaults to ``false``. - bool auto_close_connections = 2; + // Deprecated. The handshake connection is always detached once the acceptance response is + // flushed so tunnel bytes have a single reader. Ignored. + bool auto_close_connections = 2 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; // HTTP path to match for reverse tunnel requests. // If not specified, defaults to ``/reverse_connections/request``. @@ -145,4 +144,44 @@ // This avoids the cross-worker lock in pickLeastLoadedSocketManager. // Default: false (rebalancing enabled). bool skip_rebalancing = 8; + + // Optional JWT authentication for the handshake. When set, the bearer token carried in the + // handshake request is verified before the connection is accepted or its socket registered, so a + // forged or expired token can never produce a usable reverse tunnel. This runs on the real + // accepted socket, before registration, so it does not interfere with socket reuse. A missing or + // invalid token rejects the handshake with HTTP ``401 Unauthorized`` unless + // ``allow_missing_or_failed`` is set. + // + // On success, the verified claims are published as dynamic metadata (default namespace + // ``envoy.filters.network.reverse_tunnel.jwt``) so the :ref:`Validation + // <envoy_v3_api_msg_extensions.filters.network.reverse_tunnel.v3.Validation>` block can bind a + // claimed handshake identifier to a verified claim, e.g.:: + // + // tenant_id_format: "%DYNAMIC_METADATA(envoy.filters.network.reverse_tunnel.jwt:tenant)%" + // + // forces the ``x-envoy-reverse-tunnel-tenant-id`` header to equal the verified ``tenant`` claim. + // Without such a binding, a token minted for one tenant can open a tunnel claiming another. + // + // Token verification is synchronous. With ``remote_jwks`` the keys are fetched and refreshed in the + // background (at startup and every ``cache_duration``) and cached, never on the accept path. Before + // the first successful fetch, or while a refresh is failing with nothing cached, every token is + // rejected. ``token_header`` defaults to ``authorization`` and ``clock_skew_seconds`` to 60. + // + // See :ref:`JwtHandshakeValidator + // <envoy_v3_api_msg_extensions.filters.common.jwks.v3.JwtHandshakeValidator>`. + common.jwks.v3.JwtHandshakeValidator jwt_validator = 10; + + // Enforces the per-node concurrent connection cap (``max_connections_per_node``, configured on + // the ``UpstreamReverseConnectionSocketInterface`` bootstrap extension) for tunnels accepted by + // this filter. The cap is checked on the accepting worker but the connection is counted on the + // worker it is finally rebalanced to, so it is best-effort unless ``skip_rebalancing`` is ``true``. + // Default: false. + bool enable_connection_limit = 9; + + // Maximum time to receive a complete handshake request. If not specified, defaults to ``10s``. + // On expiry the connection is closed and ``handshake.timeout`` is incremented. + google.protobuf.Duration handshake_timeout = 11 [(validate.rules).duration = { + lte {seconds: 300} + gt {} + }]; }

envoy/extensions/filters/udp/dns_filter/v3/dns_filter.proto:

--- shake256:5fe000c8a7be0d8c110a23b7051a145c3bbc3dfb96ebc31f92a4c897bde8e7e6d2d09da8733cc1de3ac0a20f1e3157f3fedd27164de77d1584ad6bfa551a74f4 envoy/extensions/filters/udp/dns_filter/v3/dns_filter.proto +++ shake256:436b10d2ed00bc25e99d66c3078c9df7f9270226426b2518204f3d8dcf6d9c589829f8dc4a2c16b64da619eb3f33eee945fd8c1b6b4c80428048b96411ccb511 envoy/extensions/filters/udp/dns_filter/v3/dns_filter.proto @@ -26,6 +26,7 @@ // [#extension: envoy.filters.udp.dns_filter] // Configuration for the DNS filter. +// [#next-free-field: 6] message DnsFilterConfig { // This message contains the configuration for the DNS Filter operating // in a server context. This message will contain the virtual hosts and @@ -123,4 +124,8 @@ // - ``RESPONSE_CODE``: DNS response code // - ``PARSE_STATUS``: Whether the query was successfully parsed repeated config.accesslog.v3.AccessLog access_log = 4; + + // When true, virtual domain names are matched case-insensitively. The response echoes the + // client's original query-name case. Defaults to false. + bool case_insensitive = 5; }

envoy/extensions/filters/udp/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:4f7867b0773a6edbbff3f6032fb65b475a5cee759f6662696a55d74c25d4bb96c288630f05d6c12ba2806ee9a5e5fddf7ab2520840913725cfdebb6b588ee702 envoy/extensions/filters/udp/dynamic_modules/v3/dynamic_modules.proto +++ shake256:f1b8280cc604c780329caf36ad0e5fc63be76a77f28d552e14d17024ddeceebe7fde9b9744a8fe5499bf83ff26b10cb754d8e4ea5c5f5e00675ae56634d89ac2 envoy/extensions/filters/udp/dynamic_modules/v3/dynamic_modules.proto @@ -45,7 +45,8 @@ // limiting, ``filter_name`` is used to choose either echo or rate limiting. The // ``filter_config`` can be used to configure the echo behavior or the rate limiting parameters. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/filters/udp/udp_proxy/v3/udp_proxy.proto:

--- shake256:90c9a5e1b2bfe3cf7dccc8cb444c46a99c9214ab0a7b0c78c19f9f9cdb9787c35a1a85547849ae858e97f440352069bbabe91c5efeb9d8643c457a64737ac00c envoy/extensions/filters/udp/udp_proxy/v3/udp_proxy.proto +++ shake256:d471ed2f786afbbda352903ab63002898eeae4e36fde297b9037752c1f060560a835b6bdaeadbbe62f13fb821a71c4ea64f5057fb4cfadc1747c2c30207bd5af envoy/extensions/filters/udp/udp_proxy/v3/udp_proxy.proto @@ -6,6 +6,7 @@ import "envoy/config/core/v3/backoff.proto"; import "envoy/config/core/v3/base.proto"; import "envoy/config/core/v3/config_source.proto"; +import "envoy/config/core/v3/extension.proto"; import "envoy/config/core/v3/udp_socket_config.proto"; import "google/protobuf/any.proto"; @@ -73,7 +74,7 @@ // Configuration for tunneling UDP over other transports or application layers. // Tunneling is currently supported over HTTP/2. - // [#next-free-field: 12] + // [#next-free-field: 13] message UdpTunnelingConfig { // Configuration for UDP datagrams buffering. message BufferOptions { @@ -178,6 +179,12 @@ // Save the response trailers to the downstream info filter state for consumption // by the session filters. The filter state key is ``envoy.udp_proxy.propagate_response_trailers``. bool propagate_response_trailers = 11; + + // Specifies a collection of Formatter plugins that can be used in substitution formatters + // in ``headers_to_add``. + // See the formatters extensions documentation for details. + // [#extension-category: envoy.formatter] + repeated config.core.v3.TypedExtensionConfig formatters = 12; } message UdpAccessLogOptions {

envoy/extensions/formatter/cel/v3/cel.proto:

--- shake256:98b4491dad61ce1a62c98a1e229268e712489637a1dbc034c37dc031d42039921071f4396bf583fdebbc731db21196e192bd4c90f847caf51a90c8c54b84775a envoy/extensions/formatter/cel/v3/cel.proto +++ shake256:ca7f51d5d43c160f9241e19698d8e240e2f3fa8d2ce3453866a3054116903aabed25541fe153fba0a900cc544c2b2be66247ed291cf1633b7fd291650c8790d2 envoy/extensions/formatter/cel/v3/cel.proto @@ -2,6 +2,8 @@ package envoy.extensions.formatter.cel.v3; +import "envoy/config/core/v3/cel.proto"; + import "udpa/annotations/status.proto"; option java_package = "io.envoyproxy.envoy.extensions.formatter.cel.v3"; @@ -50,7 +52,10 @@ // Configuration for the CEL formatter. // // .. warning:: -// This extension is treated as built-in extension and will be enabled by default now. -// It is unnecessary to configure this extension. +// This extension is treated as a built-in extension and is enabled by default. +// It is unnecessary to configure this extension unless overriding the CEL expression runtime +// via ``cel_config``. message Cel { + // Configuration for the CEL expression runtime used by this formatter. + config.core.v3.CelExpressionConfig cel_config = 1; }

envoy/extensions/formatter/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:580964d7027f1e0437e8e4a050dc4a7c49eb248e39343e21e86ab4c74cf379e437fc54c6db301bfe3a06d00876722dcd7ffe3de041cb065ad16467f066d5eb31 envoy/extensions/formatter/dynamic_modules/v3/dynamic_modules.proto +++ shake256:5acb21e6a80670f6186504c7a0c5bff6d3b54423c829e7390e807b170c1edd8e1de482212b36b5cf9709ce80ca824185b44f11b38bfcd10400d98748e38731a7 envoy/extensions/formatter/dynamic_modules/v3/dynamic_modules.proto @@ -47,7 +47,8 @@ // ``formatter_name``, the module can decide which in-module command parser implementation to use // and fine-tune which commands it recognizes. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/health_checkers/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:d2c656b5bc8d53ba7dc07f2ace68f9344154068899d386c2ee304c3504a3fe306ed2dc21d5a63733e31fbf61cee26d3ba042836788132c533cc61c1941edb887 envoy/extensions/health_checkers/dynamic_modules/v3/dynamic_modules.proto +++ shake256:d5574d9597be5b91e315b55e6d7a324d2aeb33a071a60bbe07936e8768b4c4e733e3c49b2367304dec5f3d28c4bbcc67d46d9401362a182dcc6f90f0335c5e21 envoy/extensions/health_checkers/dynamic_modules/v3/dynamic_modules.proto @@ -50,7 +50,8 @@ // ``health_checker_name``, the module can decide which in-module health checker implementation to // use and fine-tune the behavior of the health checker. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/http/custom_response/local_response_policy/v3/local_response_policy.proto:

--- shake256:6f61959660cff32b12feab412ab5763c2ca598c7af8439e3de8ab409eee02d60f7424ae5368588ef48a6215290183bc718e582c18d46f04b3ce8e65d70dfff21 envoy/extensions/http/custom_response/local_response_policy/v3/local_response_policy.proto +++ shake256:b6009c26b7776e0bceab6afc8169b410ab78ebf50b780976d7d335b3240280d8f929bf2c6b7d18546986950a5f85b6bd76c657f087a56a0b47047f133e63d43d envoy/extensions/http/custom_response/local_response_policy/v3/local_response_policy.proto @@ -24,9 +24,12 @@ // Custom response policy to serve a locally stored response to the // downstream. +// [#next-free-field: 7] message LocalResponsePolicy { // Optional new local reply body text. It will be used - // in the ``%LOCAL_REPLY_BODY%`` command operator in the ``body_format``. + // in the ``%LOCAL_REPLY_BODY%`` command operator in the ``body_format``. If unset when + // ``body_format`` is configured for an existing local reply, the existing body will be used as + // the formatter input instead. config.core.v3.DataSource body = 1; // Optional body format to be used for this response. If ``body_format`` is not @@ -43,4 +46,19 @@ // remote body, before it is sent to a downstream client. repeated config.core.v3.HeaderValueOption response_headers_to_add = 4 [(validate.rules).repeated = {max_items: 1000}]; + + // Controls what is written to ``stream_info.response_code_details`` when this + // policy sends its local reply. + // + // If unset, details are cleared (empty string), matching legacy behavior. + // Use ``preserve_response_code_details`` to keep the existing value (e.g. + // ``csrf_origin_mismatch``), or ``response_code_details`` to set an explicit + // replacement. + oneof response_code_details_action { + // If set, keep the existing ``response_code_details`` already present on StreamInfo. + bool preserve_response_code_details = 5 [(validate.rules).bool = {const: true}]; + + // Replace ``response_code_details`` with this value. + string response_code_details = 6 [(validate.rules).string = {min_len: 1}]; + } }

envoy/extensions/http/injected_credentials/generic/v3/generic.proto:

--- shake256:678bff6a6a4338b1448420ce629ec7d093dd5ce9c1f11ac247940ca93dbc3a91ef26fc38b8673606c8f52b74e55d5a857878ef3b46e5b3e10a75112450bfbcc3 envoy/extensions/http/injected_credentials/generic/v3/generic.proto +++ shake256:34cdb621792ca31ddf9dbd9d82b80ebd8fcf1702b92790ed8f3ec8117b754eeac2fcfc326cea1adb4e55c1691749dbfd552b014e4f6b02312cce062f06286441 envoy/extensions/http/injected_credentials/generic/v3/generic.proto @@ -19,7 +19,7 @@ // Generic extension can be used to inject HTTP Basic Auth, Bearer Token, or any arbitrary credential // into the proxied requests. // The credential will be injected into the specified HTTP request header. -// Refer to [RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://www.rfc-editor.org/rfc/rfc6750) for details. +// Refer to `RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage <https://www.rfc-editor.org/rfc/rfc6750>`_ for details. // message Generic { // The SDS configuration for the credential that will be injected to the specified HTTP request header.

envoy/extensions/http/injected_credentials/oauth2/v3/oauth2.proto:

--- shake256:59d9350a541de8f92284737869e627928b411fee305ce1c0b4960a60f13f003f6dcf4463bbf658273fe8a974cb1444674c6bc399a146fc138fd5f9a4256c3d4e envoy/extensions/http/injected_credentials/oauth2/v3/oauth2.proto +++ shake256:87e31fc241a567421582a7a3c738c6e6e98b1bc47d59881d2d16274e437565af2aa4831a2248ba3c4fa6380e25a43bde5d2bdb7953140524e4ce00c724827bcf envoy/extensions/http/injected_credentials/oauth2/v3/oauth2.proto @@ -35,22 +35,32 @@ // The ``client_id`` and ``client_secret`` will be sent in the URL encoded request body. // This type should only be used when Auth server does not support Basic authentication. URL_ENCODED_BODY = 1; + + // The client will be authenticated using mutual TLS (mTLS) with a client certificate. + // The ``client_secret`` is not required and will not be sent in the request to the + // authorization server. + // The client certificate must be configured in the cluster used by ``token_endpoint`` via + // transport socket configuration. + // This implements OAuth 2.0 Mutual-TLS Client Authentication as defined in RFC 8705. + TLS_CLIENT_AUTH = 2; } // Credentials to authenticate client to the authorization server. - // Refer to [RFC 6749: The OAuth 2.0 Authorization Framework](https://www.rfc-editor.org/rfc/rfc6749#section-2.3) for details. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework <https://www.rfc-editor.org/rfc/rfc6749#section-2.3>`__ for details. message ClientCredentials { // Client ID. - // Refer to [RFC 6749: The OAuth 2.0 Authorization Framework](https://www.rfc-editor.org/rfc/rfc6749#section-2.3.1) for details. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework <https://www.rfc-editor.org/rfc/rfc6749#section-2.3.1>`__ for details. string client_id = 1 [(validate.rules).string = {min_len: 1}]; // Client secret. - // Refer to [RFC 6749: The OAuth 2.0 Authorization Framework](https://www.rfc-editor.org/rfc/rfc6749#section-2.3.1) for details. - transport_sockets.tls.v3.SdsSecretConfig client_secret = 2 - [(validate.rules).message = {required: true}]; + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework <https://www.rfc-editor.org/rfc/rfc6749#section-2.3.1>`__ for details. + // This field is required unless :ref:`auth_type + // <envoy_v3_api_field_extensions.http.injected_credentials.oauth2.v3.OAuth2.ClientCredentials.auth_type>` + // is set to ``TLS_CLIENT_AUTH``, in which case authentication is done via the client certificate. + transport_sockets.tls.v3.SdsSecretConfig client_secret = 2; // The method to use when sending credentials to the authorization server. - // Refer to [RFC 6749: The OAuth 2.0 Authorization Framework](https://www.rfc-editor.org/rfc/rfc6749#section-2.3.1) for details. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework <https://www.rfc-editor.org/rfc/rfc6749#section-2.3.1>`__ for details. AuthType auth_type = 3; } @@ -66,18 +76,18 @@ } // Endpoint on the authorization server to retrieve the access token from. - // Refer to [RFC 6749: The OAuth 2.0 Authorization Framework](https://www.rfc-editor.org/rfc/rfc6749#section-3.2) for details. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework <https://www.rfc-editor.org/rfc/rfc6749#section-3.2>`__ for details. config.core.v3.HttpUri token_endpoint = 1 [(validate.rules).message = {required: true}]; // Optional list of OAuth scopes to be claimed in the authorization request. - // Refer to [RFC 6749: The OAuth 2.0 Authorization Framework](https://www.rfc-editor.org/rfc/rfc6749#section-4.4.2) for details. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework <https://www.rfc-editor.org/rfc/rfc6749#section-4.4.2>`__ for details. repeated string scopes = 2; oneof flow_type { option (validate.required) = true; // Client Credentials Grant. - // Refer to [RFC 6749: The OAuth 2.0 Authorization Framework](https://www.rfc-editor.org/rfc/rfc6749#section-4.4) for details. + // Refer to `RFC 6749: The OAuth 2.0 Authorization Framework <https://www.rfc-editor.org/rfc/rfc6749#section-4.4>`__ for details. ClientCredentials client_credentials = 3; }

envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.proto:

--- shake256:ed80461fd767155c24d6fdfaa7f620d4db8ac5868cf1a1bbfb302f4ecc1790582dc99575a1003b34d949bb8f27c6e92f4ed22e2a5007f4c92af3cf49d10611c4 envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.proto +++ shake256:861a39e8e20680fa4eee71ecb7708f708f3edc6b176590d740a0193e9a0cd81c87b7a67d0e73044a02fa8edc2977ec8c1c81d801a3fd9c7eb13a16c3c178197d envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.proto @@ -26,13 +26,20 @@ // the endpoint weights are sent by the control plane via EDS. However, // in this policy, the endpoint weights are instead determined via qps (queries // per second), eps (errors per second), and utilization metrics sent by the -// endpoint using the Open Request Cost Aggregation (ORCA) protocol. Utilization -// is determined by using the ORCA application_utilization field, if set, or -// else falling back to the cpu_utilization field. All queries count toward qps, -// regardless of result. Only failed queries count toward eps. A config -// parameter error_utilization_penalty controls the penalty to adjust endpoint -// weights using eps and qps. The weight of a given endpoint is computed as: -// ``qps / (utilization + eps/qps * error_utilization_penalty)``. +// endpoint using the Open Request Cost Aggregation (ORCA) protocol. All queries +// count toward qps, regardless of result. Only failed queries count toward eps. +// A config parameter error_utilization_penalty controls the penalty to adjust +// endpoint weights using eps and qps. The weight of a given endpoint is computed +// as: ``qps / (utilization + eps/qps * error_utilization_penalty)``. +// +// For a load report to update an endpoint's weight, it must set :ref:`rps_fractional +// <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.rps_fractional>` (used as +// qps) greater than 0, and the final utilization (resolved utilization plus any +// error penalty) must be greater than 0. Resolved utilization (see +// :ref:`metric_names_for_computing_utilization +// <envoy_v3_api_field_extensions.load_balancing_policies.client_side_weighted_round_robin.v3.ClientSideWeightedRoundRobin.metric_names_for_computing_utilization>`) +// is used as the baseline. Reports that fail to do so are ignored, and an endpoint +// with no valid weight is assigned the median weight of the endpoints that have one. // // Note that Envoy will forward the ORCA response headers/trailers from the upstream // cluster to the downstream client. This means that if the downstream client is also @@ -79,10 +86,11 @@ // Default is 1.0. google.protobuf.FloatValue error_utilization_penalty = 6 [(validate.rules).float = {gte: 0.0}]; - // By default, endpoint weight is computed based on the :ref:`application_utilization <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.application_utilization>` field reported by the endpoint. - // If that field is not set, then utilization will instead be computed by taking the max of the values of the metrics specified here. + // Specifies the metrics used to compute the endpoint utilization from which weight is derived. // For map fields in the ORCA proto, the string will be of the form ``<map_field_name>.<map_key>``. For example, the string ``named_metrics.foo`` will mean to look for the key ``foo`` in the ORCA :ref:`named_metrics <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.named_metrics>` field. - // If none of the specified metrics are present in the load report, then :ref:`cpu_utilization <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.cpu_utilization>` is used instead. + // Utilization is the max of the values of the metrics specified here, when that max is greater than 0. + // Otherwise :ref:`application_utilization <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.application_utilization>` is used if greater than 0, with :ref:`cpu_utilization <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.cpu_utilization>` as the final fallback. + // Disabling the runtime flag ``envoy.reloadable_features.orca_weight_manager_use_named_metrics_first`` restores the legacy order, preferring ``application_utilization`` over these metrics. repeated string metric_names_for_computing_utilization = 7; // Configuration for slow start mode.

envoy/extensions/load_balancing_policies/load_aware_locality/v3/load_aware_locality.proto:

--- shake256:e54c12aff3d669e5d5b5a9237812c9398e708f353c174da18d25bd76df3b4c6aaa82dda151ad927ee8949e77056c0be405b0e554cef74fc5571da76abce3a122 envoy/extensions/load_balancing_policies/load_aware_locality/v3/load_aware_locality.proto +++ shake256:51c73a45a7d0303da413710d7aede53de6c2a518d534240ed63be5e0d1697645076f435852dfa46052a8def20d02cf325e199712660391c7776b7691f8a34175 envoy/extensions/load_balancing_policies/load_aware_locality/v3/load_aware_locality.proto @@ -3,6 +3,7 @@ package envoy.extensions.load_balancing_policies.load_aware_locality.v3; import "envoy/config/cluster/v3/cluster.proto"; +import "envoy/extensions/load_balancing_policies/common/v3/common.proto"; import "google/protobuf/duration.proto"; import "google/protobuf/wrappers.proto"; @@ -21,7 +22,7 @@ // Configuration for the load_aware_locality LB policy which uses ORCA utilization data // to route traffic between localities based on available headroom. -// [#next-free-field: 10] +// [#next-free-field: 11] message LoadAwareLocality { // The child LB policy to create for endpoint-picking within each locality. config.cluster.v3.LoadBalancingPolicy endpoint_picking_policy = 1 @@ -32,17 +33,20 @@ google.protobuf.Duration weight_update_period = 2 [(validate.rules).duration = {gte {nanos: 100000000}}]; - // By default, endpoint utilization is computed based on the - // :ref:`application_utilization <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.application_utilization>` - // field reported by the endpoint. If that field is not set, then utilization - // will instead be computed by taking the max of the values of the metrics - // specified here. For map fields in the ORCA proto, the string will be of - // the form ``<map_field_name>.<map_key>``. For example, the string + // Specifies the metrics used to compute endpoint utilization. For map + // fields in the ORCA proto, the string will be of the form + // ``<map_field_name>.<map_key>``. For example, the string // ``named_metrics.foo`` will mean to look for the key ``foo`` in the ORCA // :ref:`named_metrics <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.named_metrics>` - // field. If none of the specified metrics are present in the load report, - // then :ref:`cpu_utilization <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.cpu_utilization>` - // is used instead. + // field. Utilization is the max of the values of the metrics specified + // here, when that max is greater than 0. Otherwise + // :ref:`application_utilization <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.application_utilization>` + // is used if greater than 0, with + // :ref:`cpu_utilization <envoy_v3_api_field_.xds.data.orca.v3.OrcaLoadReport.cpu_utilization>` + // as the final fallback. Disabling the runtime flag + // ``envoy.reloadable_features.orca_weight_manager_use_named_metrics_first`` + // restores the legacy order, preferring ``application_utilization`` over + // these metrics. repeated string metric_names_for_computing_utilization = 3; // When the local locality's utilization is at most this threshold above the @@ -92,4 +96,9 @@ // server may not provide reports as frequently as the client requests. // Used only when enable_oob_load_report is true. Default is 10 seconds. google.protobuf.Duration oob_reporting_period = 9; + + // Optional overrides for the OOB reporting connection (alternative port, + // ``:authority``, transport socket selection). Honored only when + // ``enable_oob_load_report`` is true. + common.v3.OrcaOobReportingConfig oob_reporting_config = 10; }

envoy/extensions/matching/http/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:67a0605b9de1b29cc5afa547fce19ac7c867bd77508de0cf62a744eab3ab004ece5a946677baf90b5e56f9ed74a8d18eece9be46a4a3badb68badab7eee71e15 envoy/extensions/matching/http/dynamic_modules/v3/dynamic_modules.proto +++ shake256:82884d480870e7153f8bfb1cd95ac73ee60488fef1ddba0730411cc230cf26550f5c2ff2cf3e78284fcc2ea0bbfa911d064477252122d27b2c230b20afd38837 envoy/extensions/matching/http/dynamic_modules/v3/dynamic_modules.proto @@ -2,7 +2,12 @@ package envoy.extensions.matching.http.dynamic_modules.v3; +import "envoy/extensions/dynamic_modules/v3/dynamic_modules.proto"; + +import "google/protobuf/any.proto"; + import "udpa/annotations/status.proto"; +import "validate/validate.proto"; option java_package = "io.envoyproxy.envoy.extensions.matching.http.dynamic_modules.v3"; option java_outer_classname = "DynamicModulesProto"; @@ -22,3 +27,36 @@ // <envoy_v3_api_msg_extensions.matching.input_matchers.dynamic_modules.v3.DynamicModuleMatcher>`. message HttpDynamicModuleMatchInput { } + +// Configuration for the dynamic modules data input. This input loads a shared object file +// via ``dlopen`` and invokes it during match evaluation to extract a value from the HTTP +// request and response. The extracted value is a string that an exact match map can dispatch on, +// so a module can select one of many matches with a single evaluation. +// +// Unlike :ref:`HttpDynamicModuleMatchInput +// <envoy_v3_api_msg_extensions.matching.http.dynamic_modules.v3.HttpDynamicModuleMatchInput>`, the +// module produces the value directly rather than pairing with the dynamic modules input matcher. +// [#extension: envoy.matching.inputs.dynamic_module_string_data_input] +message DynamicModuleDataInput { + // Specifies the shared-object level configuration. This field is required. Remote module sources + // are not supported for data inputs, so the module must be available locally or by name. + envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1 + [(validate.rules).message = {required: true}]; + + // The name for this data input configuration. If not specified, defaults to an empty string. + // + // This can be used to distinguish between different data input implementations inside a dynamic + // module. When Envoy receives this configuration, it passes the ``input_name`` to the dynamic + // module's data input config init function together with the ``input_config``. That way a module + // can decide which in-module implementation to use based on the name at load time. + string input_name = 2; + + // The configuration for the data input chosen by ``input_name``. If not specified, an empty + // configuration is passed to the module. + // + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. + // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly without + // the wrapper. + google.protobuf.Any input_config = 3; +}

envoy/extensions/matching/input_matchers/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:134ea10cdb70aa7d229fc2cd26d1abe6cac8b9193e435419fe0c568bdd167e48789358082414f687ab6318c073d22c82ae1f09b5ca665c182045ba2370fead69 envoy/extensions/matching/input_matchers/dynamic_modules/v3/dynamic_modules.proto +++ shake256:27ff670b92e98a70aad2c1a5141da88e37caa55a8152a66c3c32c0a483ce10ce24afc2b8a89149cf34fb3cde1e85460c0da591f6da8035e02de051d429298a41 envoy/extensions/matching/input_matchers/dynamic_modules/v3/dynamic_modules.proto @@ -26,6 +26,16 @@ // matching beyond what built-in matchers provide, such as JWT/OAuth token analysis, custom // routing decisions, or integration with external data sources. message DynamicModuleMatcher { + // The policy applied when the module cannot evaluate a match, for example after a panic in the + // module's match hook. + enum OnError { + // Treat an evaluation that could not complete as no match. This is the default. + NO_MATCH = 0; + + // Treat an evaluation that could not complete as a match. + MATCH = 1; + } + // Specifies the shared-object level configuration. This field is required. envoy.extensions.dynamic_modules.v3.DynamicModuleConfig dynamic_module_config = 1 [(validate.rules).message = {required: true}]; @@ -47,8 +57,19 @@ // ``matcher_name``, the module can decide which in-module matcher implementation to use and // fine-tune the behavior of the matcher. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. google.protobuf.Any matcher_config = 3; + + // The result applied for an evaluation that the module could not complete, for example when the + // module's match hook panics. A panic is caught at the ABI boundary and cannot report a match + // result, so the matcher applies this policy for that single evaluation. If not specified, + // defaults to ``NO_MATCH``. + // + // ``NO_MATCH`` is safe for allow-on-match trees where a missed match denies the request. + // ``MATCH`` is safe for deny-on-match trees where a missed match would let a request bypass the + // rule. + OnError on_error = 4; }

envoy/extensions/quic/connection_id_generator/quic_lb/v3/quic_lb.proto:

--- shake256:8a58afa18cfd1cbde48136072f331fe02420900d28cff068cca484cb2dff09f3b12409f8ba400ddd9452a4b355431eb52a493c17b870ddf9bd539c0ebd29de0e envoy/extensions/quic/connection_id_generator/quic_lb/v3/quic_lb.proto +++ shake256:72e84ba56fb274e08743442b26c1c033122e8c3721eec53b45d4a9f1e84a9bc7137041480a46c801003c458b2314b8b7f908f326362e26a9503d8928b0bdde51 envoy/extensions/quic/connection_id_generator/quic_lb/v3/quic_lb.proto @@ -5,8 +5,6 @@ import "envoy/config/core/v3/base.proto"; import "envoy/extensions/transport_sockets/tls/v3/secret.proto"; -import "xds/annotations/v3/status.proto"; - import "udpa/annotations/status.proto"; import "validate/validate.proto"; @@ -27,13 +25,8 @@ // // See https://datatracker.ietf.org/doc/html/draft-ietf-quic-load-balancers for details. // -// .. warning:: -// -// This is still a work in progress. Interoperability testing has not yet been performed. // [#next-free-field: 7] message Config { - option (xds.annotations.v3.message_status).work_in_progress = true; - // Must be at least 1 octet. // The length of server_id and nonce_length_bytes must be 18 or less. // See https://datatracker.ietf.org/doc/html/draft-ietf-quic-load-balancers#name-server-id-allocation.

envoy/extensions/stat_sinks/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:207659b40f09a1eb343e4bee976790b87765f57e9af73739ad595610306d4c1793aef067838761e69533a5243c174e5175fdbd9ddf07e2bc432aa3b3df014d60 envoy/extensions/stat_sinks/dynamic_modules/v3/dynamic_modules.proto +++ shake256:aed559c90776a842f40524ddcc51368ae77724cfe51c655c10f86868020d01ad1576d110513a45eb0c53cc30b84fa43b0ae590846bae684a288d9667a882975d envoy/extensions/stat_sinks/dynamic_modules/v3/dynamic_modules.proto @@ -41,7 +41,8 @@ // The configuration for the sink chosen by ``sink_name``. If not specified, an empty // configuration is passed to the module. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/stat_sinks/graphite_statsd/v3/graphite_statsd.proto:

--- shake256:baaef5b0dcd805f206a977806ecf55cd8785134085fa515bd3ddb848d3986d502fb8144bb0f6f06a11595c5444ff42da361497a4b70eeb21f1a8e0095b183c3b envoy/extensions/stat_sinks/graphite_statsd/v3/graphite_statsd.proto +++ shake256:fb0347fc4ce6ceccc92eb0a4b1d11c85e083d0e53bf589723455727ad13b3051f4be549925782b798fb30a98a7fcbf1e57ab882b3a41fcab6217cc8a2c454e77 envoy/extensions/stat_sinks/graphite_statsd/v3/graphite_statsd.proto @@ -22,6 +22,7 @@ // <envoy_v3_api_msg_config.metrics.v3.StatsConfig>`. // [#extension: envoy.stat_sinks.graphite_statsd] +// [#next-free-field: 6] message GraphiteStatsdSink { oneof statsd_specifier { option (validate.required) = true; @@ -42,4 +43,10 @@ // // Note that this value may not be respected if smaller than a single metric. google.protobuf.UInt64Value max_bytes_per_datagram = 4 [(validate.rules).uint64 = {gt: 0}]; + + // If true, histogram samples are scaled to milliseconds according to the histogram's unit + // before being reported as timers. See :ref:`StatsdSink's scale_histogram_units_to_milliseconds + // field <envoy_v3_api_field_config.metrics.v3.StatsdSink.scale_histogram_units_to_milliseconds>` + // for more details. + bool scale_histogram_units_to_milliseconds = 5; }

envoy/extensions/tracers/dynamic_modules/v3/dynamic_modules.proto:

--- shake256:389b3dcebe44e1c0ea1edbf8cb24b13c0737d253ea00ba19d5ceb4072e8f586f3cecaa60ef2cacaf0d084374ebda39c73bf0e6f5d99106058cb1e33e7e665f72 envoy/extensions/tracers/dynamic_modules/v3/dynamic_modules.proto +++ shake256:a3abcb3f73ba7ca43e6ea5dc856cf78f13aaf8be73249a42afd62e7d8af953403982600344f0f505cbb732bfe729f93170a3b6073e143c2430503482475682c4 envoy/extensions/tracers/dynamic_modules/v3/dynamic_modules.proto @@ -49,7 +49,8 @@ // ``tracer_name``, the module can decide which in-module tracer implementation to use and // fine-tune the behavior of the tracer. // - // ``google.protobuf.Struct`` is serialized as JSON before passing it to the module. + // ``google.protobuf.Struct`` and the ``value`` field of ``xds.type.v3.TypedStruct`` are + // serialized as JSON before passing them to the module. // ``google.protobuf.BytesValue`` and ``google.protobuf.StringValue`` are passed directly // without the wrapper. //

envoy/extensions/transport_sockets/quic/v3/quic_transport.proto:

--- shake256:a73ea65dd0a92900ce187d3404a8d0a85c928a68ef98fdaa42597900c5e2239d25e2d3331439c2ca817927acd69df65d5e6d72724f5f53a03dd230c20425b45a envoy/extensions/transport_sockets/quic/v3/quic_transport.proto +++ shake256:56737f595d21329007d97f5069ed35f24a53dc82a7dfbb32dd52117602f757c96d56767883beadd4b70987f95215e7c8a946c12f8a9b901e4c1e27f9a27e3afc envoy/extensions/transport_sockets/quic/v3/quic_transport.proto @@ -24,12 +24,25 @@ tls.v3.DownstreamTlsContext downstream_tls_context = 1 [(validate.rules).message = {required: true}]; - // If false, QUIC will tell TLS to reject any early data and to stop issuing 0-RTT credentials with resumption session tickets. This will prevent clients from sending 0-RTT requests. - // Default to true. + // If false, QUIC will tell TLS to reject any early data and to stop issuing 0-RTT credentials + // with resumption session tickets. This will prevent clients from sending 0-RTT requests. + // Defaults to true, except when a client certificate validation context is configured, in which + // case it defaults to false. Early data requires resumption, so it cannot be enabled unless + // :ref:`enable_resumption + // <envoy_v3_api_field_extensions.transport_sockets.quic.v3.QuicDownstreamTransport.enable_resumption>` + // is also true. google.protobuf.BoolValue enable_early_data = 2; // If false, TLS session tickets are not issued and accepted by QUIC. - // Default to true. + // Defaults to true, except when a client certificate validation context is configured, in which + // case it defaults to false. QUIC does not re-validate the client certificate when a session is + // resumed. A resumed connection reuses the certificate verdict of the original handshake until the + // ticket expires, so certificate revocation or expiry and validation context changes are not + // rechecked. Setting this to true on a filter chain that validates a client certificate opts into + // that trade-off in exchange for cheaper handshakes. Resumption also requires + // :ref:`disable_stateless_session_resumption + // <envoy_v3_api_field_extensions.transport_sockets.tls.v3.DownstreamTlsContext.disable_stateless_session_resumption>` + // to be false, because that field controls the underlying TLS session tickets. google.protobuf.BoolValue enable_resumption = 3; }

envoy/extensions/transport_sockets/tls/v3/common.proto:

--- shake256:e1e0d5919ceef76ce7a6329062704ac251f7b9285d3493b1612cd9fa2191d8cb23cb5e78569b409aa3706a3adb7bedf2e6e406f19fcac2a0f7a0c734e2babb07 envoy/extensions/transport_sockets/tls/v3/common.proto +++ shake256:6538be34cd3980ea8e64d2efe72aeaa2b47a6bfc684f66feed463866af9c4a3bba9264a5b053f3f00b72b8795c6152cd444d283810de4f10e91ea04d64986211 envoy/extensions/transport_sockets/tls/v3/common.proto @@ -242,7 +242,7 @@ bool fallback = 4; } -// [#next-free-field: 9] +// [#next-free-field: 10] message TlsCertificate { option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.auth.TlsCertificate"; @@ -309,6 +309,26 @@ // [#not-implemented-hide:] repeated config.core.v3.DataSource signed_certificate_timestamp = 5; + + // Optional per-certificate TLS parameters. When set on a server certificate, any specified + // fields override the corresponding context-level + // :ref:`tls_params <envoy_v3_api_field_extensions.transport_sockets.tls.v3.CommonTlsContext.tls_params>` + // for that certificate during the TLS handshake; unset fields continue to use the context-level + // values. This allows different cipher suites, ECDH curves, protocol versions, signature + // algorithms, or compliance policies per certificate. + // + // These parameters do not affect certificate selection, which continues to be based only on SNI, + // the client's ECDSA capability, and OCSP capability. They are applied after a certificate has + // been selected. For a multi-certificate configuration this means each certificate's parameters + // must be compatible with the clients that select it: if the selected certificate's parameters + // leave nothing in common with the client, the handshake fails and no other certificate is tried. + // + // Note: because these are overrides rather than constraints, a certificate-level + // ``tls_minimum_protocol_version`` can lower the floor set by the context-level + // ``tls_params``, weakening the listener's overall TLS security policy. + // Setting this on a client certificate is not supported and is ignored. + // This field has no effect on QUIC/HTTP3 downstream connections. + TlsParameters tls_params = 9; } message TlsSessionTicketKeys {

envoy/extensions/transport_sockets/tls/v3/tls.proto:

--- shake256:d6ce09b7e5d772dc134ba451fb8c99e1c8e0dc921a49c34ec5d93088e8e050258f4db162d2491a5e0e5d2061d78ab985f7503b06d6eb94bf12f9e5fe8d18a1c5 envoy/extensions/transport_sockets/tls/v3/tls.proto +++ shake256:64496efc016e5617ea8758fef8f3e284150617932c6bf8eb9a9a701a375f32c028d7c16c7aa7bedc704e09ae922f2e34d7b4f017624b85e85e62b8c6a1199d79 envoy/extensions/transport_sockets/tls/v3/tls.proto @@ -270,7 +270,8 @@ // TLS protocol versions, cipher suites etc. TlsParameters tls_params = 1; - // Only a single TLS certificate is supported in client contexts. In server contexts, + // Only a single TLS certificate is supported in client contexts unless + // ``custom_tls_certificate_selector`` is explicitly defined with ``max_session_keys`` set to 0. In server contexts, // :ref:`Multiple TLS certificates <arch_overview_ssl_cert_select>` can be associated with the // same context to allow both RSA and ECDSA certificates and support SNI-based selection. // @@ -362,6 +363,7 @@ // Custom TLS handshaker. If empty, defaults to native TLS handshaking // behavior. + // [#extension-category: envoy.tls_handshakers] config.core.v3.TypedExtensionConfig custom_handshaker = 13; // TLS key log configuration

envoy/extensions/upstreams/http/v3/http_protocol_options.proto:

--- shake256:316dc86defec70a70aa1e5901c99751f3fdea7250983b5f790f4fafa96ab9f2658f2eeea685f9c5110e3db69d67560bcab9adcebad108e0d5d06871587e881e9 envoy/extensions/upstreams/http/v3/http_protocol_options.proto +++ shake256:e5c42b5f36a8128ff99b253ec122dba8700caff3e217f16edb1adf4f5d9b012016e1bc9e5fb486e37734b414b2d7ae1ceb535e5b16f4d085429356f7eed34220 envoy/extensions/upstreams/http/v3/http_protocol_options.proto @@ -73,9 +73,6 @@ config.core.v3.Http2ProtocolOptions http2_protocol_options = 2; - // .. warning:: - // QUIC upstream support is currently not ready for internet use. - // Please see :ref:`here <arch_overview_http3>` for details. config.core.v3.Http3ProtocolOptions http3_protocol_options = 3; } } @@ -90,9 +87,6 @@ config.core.v3.Http2ProtocolOptions http2_protocol_options = 2; - // .. warning:: - // QUIC upstream support is currently not ready for internet use. - // Please see :ref:`here <arch_overview_http3>` for details. config.core.v3.Http3ProtocolOptions http3_protocol_options = 3; } @@ -111,14 +105,10 @@ config.core.v3.Http2ProtocolOptions http2_protocol_options = 2; // Unlike HTTP/1 and HTTP/2, HTTP/3 will not be configured unless it is - // present, and (soon) only if there is an indication of server side + // present, and only if there is an indication of server side // support. // See :ref:`here <arch_overview_http3_upstream>` for more information on // when HTTP/3 will be used, and when Envoy will fail over to TCP. - // - // .. warning:: - // QUIC upstream support is currently not ready for internet use. - // Please see :ref:`here <arch_overview_http3>` for details. config.core.v3.Http3ProtocolOptions http3_protocol_options = 3; // The presence of alternate protocols cache options causes the use of the

envoy/extensions/wasm/v3/wasm.proto:

--- shake256:4383b785c7cf3c88d63153c5d841c7a5125c1a883789f36dd07b11434ad73ce8da5af9292b4a078e98101fb11769d14ba8a55b088f0fec67540d9a55364fde80 envoy/extensions/wasm/v3/wasm.proto +++ shake256:327d9c50181bfabbf3a0c88ffb11199d08a3478dcd2d65daef92d5c6d03e5abcb61632b8dd7cc0dda670a88d444b8785c80c2114f293d43e0f95d17337ef8cb9 envoy/extensions/wasm/v3/wasm.proto @@ -71,7 +71,7 @@ } // Configuration for a Wasm VM. -// [#next-free-field: 8] +// [#next-free-field: 9] message VmConfig { // An ID which will be used along with a hash of the wasm code (or the name of the registered Null // VM plugin) to determine which VM will be used for the plugin. All plugins which use the same @@ -137,6 +137,12 @@ // .. warning:: // Envoy rejects the configuration if there's conflict of key space. EnvironmentVariables environment_variables = 7; + + // Configuration for restricting Proxy-Wasm capabilities available to modules. + // + // The restrictions are applied when the VM is created and are shared by every plugin running in + // that VM, so they are a property of the VM rather than of an individual plugin. + CapabilityRestrictionConfig capability_restriction_config = 8; } message EnvironmentVariables { @@ -192,7 +198,14 @@ ReloadConfig reload_config = 8; // Configuration for restricting Proxy-Wasm capabilities available to modules. - CapabilityRestrictionConfig capability_restriction_config = 6; + // + // This field is deprecated in favor of the :ref:`vm_config.capability_restriction_config + // <envoy_v3_api_field_extensions.wasm.v3.VmConfig.capability_restriction_config>` field, because + // the restrictions are applied to the Wasm VM and are therefore shared by every plugin running in + // it. If this field is set and ``vm_config.capability_restriction_config`` is not, this field is + // used to populate it. + CapabilityRestrictionConfig capability_restriction_config = 6 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; // Whether or not to allow plugin onRequestHeaders and onResponseHeaders callbacks to return // FilterHeadersStatus::StopIteration.

envoy/service/auth/v3/external_auth.proto:

--- shake256:820d7943bb9e5754b8275f131b6ecab54f6ab7a3eb9d4276c04973ec75434b8a57cdbb329cbfd83549b7ab4e826c3255eb63b88fef390fb0011e62ed8f736032 envoy/service/auth/v3/external_auth.proto +++ shake256:27d6937632ebcee64c3c8cfc15890eb8d3193e5fb1c7b419fcb1aa9bf8c0317b947cecc50ca3a205201df37f27856023c6f4be2fb49e4975f953d3c22bf03dc5 envoy/service/auth/v3/external_auth.proto @@ -52,6 +52,8 @@ // This field allows the authorization service to send HTTP response headers // to the downstream client. Note that the :ref:`append field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.append>` defaults to // false when used in this message. + // The :ref:`keep_empty_value field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.keep_empty_value>` + // is not supported. repeated config.core.v3.HeaderValueOption headers = 2; // This field allows the authorization service to send a response body data @@ -72,6 +74,8 @@ // the filter will append the correspondent header value to the matched request header. // By leaving ``append`` as false, the filter will either add a new header, or override an existing // one if there is a match. + // The :ref:`keep_empty_value field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.keep_empty_value>` + // is not supported. repeated config.core.v3.HeaderValueOption headers = 2; // HTTP entity headers to remove from the original request before dispatching @@ -101,6 +105,8 @@ // This field allows the authorization service to send HTTP response headers // to the downstream client on success. Note that the :ref:`append field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.append>` // defaults to false when used in this message. + // The :ref:`keep_empty_value field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.keep_empty_value>` + // is not supported. repeated config.core.v3.HeaderValueOption response_headers_to_add = 6; // This field allows the authorization service to set (and overwrite) query

envoy/service/ext_proc/v3/external_processor.proto:

--- shake256:8d3a41874a7414428779106a5a908cbc94a63c3ed00301b07b5591947ca5653e8bd49e2ca3e51a2c45e6d6dc8a4db1dc74541850e1c980ec61997568ea6bba85 envoy/service/ext_proc/v3/external_processor.proto +++ shake256:0b4d2556efa7056770dbe60b694e853e411f160b2725e48cbe4c30b254185359096f0fb43375845c9bfa21c1db9f5234f20a0c1ec85deea8fcdbde493693942e envoy/service/ext_proc/v3/external_processor.proto @@ -6,6 +6,7 @@ import "envoy/extensions/filters/http/ext_proc/v3/processing_mode.proto"; import "envoy/type/v3/http_status.proto"; +import "google/protobuf/any.proto"; import "google/protobuf/duration.proto"; import "google/protobuf/struct.proto"; @@ -79,8 +80,66 @@ // This represents the different types of messages that the data plane can send // to an external processing server. -// [#next-free-field: 12] +// [#next-free-field: 14] message ProcessingRequest { + // Initial flow control window sizes for ``FULL_DUPLEX_STREAMED`` and + // ``GRPC`` body send modes. + // + // A sender starts with this amount of flow control window. Whenever + // it sends body data, it must decrement its flow control window by + // the number of bytes that it has sent. When its flow control + // window is less than or equal to the amount of body data it wishes + // to send, it may not send until it receives a window update causing + // its flow control window to be large enough. + // + // However, note that in ``GRPC`` body send mode, whenever the flow + // control window is greater than zero, a sender may send a single + // message, even if the size of that message exceeds the available flow + // control window. At that point, the flow control window will be negative + // and the sender must not send the next message until it becomes positive. + // + // Note that the initial size for the to-sidestream windows are set by + // the sender, not the receiver. This is because each sidestream may be + // routed to a different ext_proc server instance, but there is no + // connection-level handshake to set a default for that server + // instance, so the only alternative here would be to have the + // ext_proc server instance set this on a per-stream basis, which + // would require an additional round-trip and therefore hurt latency. + // This unfortunately means that the ext_proc server instance has a + // bit less control: as soon as it receives these initial values, it can + // immediately send a window update that reduces the window, but it + // must be prepared to handle any data that the sender has already sent. + // The initial sizes for the to-sidestream windows are generally + // expected to be in the range of 32K to 64K. + // + // [#not-implemented-hide:] + message FlowControlInit { + // Downstream-to-sidestream initial window size. + int64 initial_window_downstream_to_sidestream = 1; + + // Sidestream-to-upstream initial window size. + int64 initial_window_sidestream_to_upstream = 2; + + // Upstream-to-sidestream initial window size. + int64 initial_window_upstream_to_sidestream = 3; + + // Sidestream-to-downstream initial window size. + int64 initial_window_sidestream_to_downstream = 4; + } + + // Flow control window update. Values may be positive or negative. The + // sender must immediately add these values to its flow control window, + // which governs how much data can be sent. + // + // [#not-implemented-hide:] + message ClientWindowUpdate { + // Window update for sidestream-to-upstream. + int64 window_increment_sidestream_to_upstream = 1; + + // Window update for sidestream-to-downstream. + int64 window_increment_sidestream_to_downstream = 2; + } + reserved 1; reserved "async_mode"; @@ -89,8 +148,6 @@ // ones are set for a particular HTTP request/response depend on the // processing mode. oneof request { - option (validate.required) = true; - // Information about the HTTP request headers, as well as peer info and additional // properties. Unless ``observability_mode`` is ``true``, the server must send back a // ``HeaderResponse`` message, an ``ImmediateResponse`` message, or close the stream. @@ -148,6 +205,32 @@ // Specify the filter protocol configurations to be sent to the server. // ``protocol_config`` is only encoded in the first ``ProcessingRequest`` message from the client to the server. ProtocolConfiguration protocol_config = 11; + + // Flow control initialization for ``FULL_DUPLEX_STREAMED`` and + // ``GRPC`` body send modes. + // + // Must be set in the initial message on the stream. Not used in + // subsequent messages. + // + // [#not-implemented-hide:] + FlowControlInit flow_control_init = 12; + + // Flow control updates for ``FULL_DUPLEX_STREAMED`` and ``GRPC`` body + // send modes. + // + // This message may be included in a request message that also + // populates one of the fields in the ``request`` oneof above, or it + // may be sent in a request message that does not set the + // ``request`` oneof. + // + // In ``FULL_DUPLEX_STREAMED`` body send mode, for backward + // compatibility with data planes that do not yet support flow control, + // the data plane must not send a message containing only this field + // (i.e., not setting the ``request`` oneof) unless the ext_proc server + // has sent a window update, thus indicating that it supports flow control. + // + // [#not-implemented-hide:] + ClientWindowUpdate client_window_update = 13; } // This represents the different types of messages the server may send back to the data plane @@ -159,12 +242,23 @@ // the server must send back exactly one ``ProcessingResponse`` message. // * If it is set to ``FULL_DUPLEX_STREAMED``, the server must follow the API defined // for this mode to send the ``ProcessingResponse`` messages. -// [#next-free-field: 13] +// [#next-free-field: 17] message ProcessingResponse { + // Flow control window update. Values may be positive or negative. The + // sender must immediately add these values to its flow control window, + // which governs how much data can be sent. + // + // [#not-implemented-hide:] + message ServerWindowUpdate { + // Window update for downstream-to-sidestream. + int64 window_increment_downstream_to_sidestream = 1; + + // Window update for upstream-to-sidestream. + int64 window_increment_upstream_to_sidestream = 2; + } + // The response type that is sent by the server. oneof response { - option (validate.required) = true; - // The server must send back this message in response to a message with the // ``request_headers`` field set. HeadersResponse request_headers = 1; @@ -220,31 +314,139 @@ // field name(s) of the struct. google.protobuf.Struct dynamic_metadata = 8; + // Optional typed metadata that will be emitted as dynamic metadata to be consumed by + // following filters. This metadata will be placed in the namespace(s) specified by the + // keys of the map. + // + // Typed dynamic metadata should be preferred over untyped dynamic metadata (``dynamic_metadata``) + // because it is more efficient and more type-safe. + map<string, google.protobuf.Any> typed_dynamic_metadata = 13; + // Override how parts of the HTTP request and response are processed for the duration of this // particular request/response only. Servers may use this to intelligently control how requests // are processed based on the headers and other metadata that they see. // - // This field is only applicable when servers are responding to the header requests. If it is set - // in the response to the body or trailer requests, it will be ignored by the data plane. + // If set in a response to body or trailer requests, it will be ignored by the data plane. // It is also ignored by the data plane when the ext_proc filter config // :ref:`allow_mode_override <envoy_v3_api_field_extensions.filters.http.ext_proc.v3.ExternalProcessor.allow_mode_override>` // is set to ``false``, or // :ref:`send_body_without_waiting_for_header_response <envoy_v3_api_field_extensions.filters.http.ext_proc.v3.ExternalProcessor.send_body_without_waiting_for_header_response>` // is set to ``true``. + // + // ``mode_override`` can be sent in the following scenarios: + // + // 1. Included in a header response: + // The server can set this field when responding to request or response headers, i.e., + // alongside a ``request_headers`` or ``response_headers`` response. + // + // 2. Standalone ``mode_override`` response: + // After receiving a ``ProcessingRequest`` for request headers, the server can send a + // standalone ``mode_override`` response (i.e., a ``ProcessingResponse`` with only + // ``mode_override`` populated and no ``response`` case set) before sending the + // ``request_headers`` response. Subsequent messages will adhere to this new mode. + // + // .. note:: + // Processing mode changes in a standalone ``mode_override`` have the following constraints: + // + // * For request path: Only supports transitioning the request body processing mode from + // ``NONE`` or ``STREAMED`` to ``FULL_DUPLEX_STREAMED``. Additionally, the request + // trailer mode must be set to ``SEND``, which is required by ``FULL_DUPLEX_STREAMED`` + // mode. Responses that do not meet these constraints are treated as spurious and rejected. + // * For Response path: There are no restrictions on processing mode changes. + // envoy.extensions.filters.http.ext_proc.v3.ProcessingMode mode_override = 9; // [#not-implemented-hide:] - // Used only in ``FULL_DUPLEX_STREAMED`` and ``GRPC`` body send modes. - // Instructs the data plane to stop sending body data and to send a - // half-close on the ext_proc stream. The ext_proc server should then echo - // back all subsequent body contents as-is until it sees the client's - // half-close, at which point the ext_proc server can terminate the stream - // with an OK status. This provides a safe way for the ext_proc server - // to indicate that it does not need to see the rest of the stream; - // without this, the ext_proc server could not terminate the stream - // early, because it would wind up dropping any body contents that the - // client had already sent before it saw the ext_proc stream termination. - bool request_drain = 12; + // Deprecated and not implemented. This field has been replaced with + // the request_drain_requests and request_drain_responses fields. + bool request_drain = 12 + [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"]; + + // [#not-implemented-hide:] + // Initiates a drain of request body data. Used only in + // ``FULL_DUPLEX_STREAMED`` and ``GRPC`` body send modes. + // + // The expected sequence for a drain is as follows: + // + // 1. The ext_proc server sends a message to the data plane with this + // field set to true. + // 2. The data plane pauses reading from the downstream client, applying + // any necessary flow control push-back. + // 3. The data plane sends a + // :ref:`request_body <envoy_v3_api_field_service.ext_proc.v3.ProcessingRequest.request_body>` + // with the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.HttpBody.drain_complete>` + // field set to true. + // 4. The ext_proc server continues processing all subsequent request body + // chunks until it sees the body chunk with the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.HttpBody.drain_complete>` + // field set to true. When sending back its response to that last body + // chunk, the ext_proc server will set the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.StreamedBodyResponse.drain_complete>` + // field to true to let the data plane know that it has finished draining. + // 5. When the data plane sees the response with the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.StreamedBodyResponse.drain_complete>` + // field set to true, it will resume reading from the downstream + // client, passing all data directly to the upstream server, + // without going through the ext_proc sidestream. + // + // This procedure provides a safe way for the ext_proc server to indicate + // that it does not need to see the rest of the request body. + // + // Note that if the data plane is sending request body data and the + // ext_proc server wants to terminate the stream with an OK status, it + // must perform this drain before doing so. + // + // Note that the data plane may have either sent a body chunk with + // :ref:`end_of_stream <envoy_v3_api_field_service.ext_proc.v3.StreamedBodyResponse.end_of_stream>` + // set to true or may have sent trailers before it received the drain + // request from the ext_proc server. In these cases, the data plane will + // ignore the drain request, and the ext_proc will consider the drain + // complete when it sees the end-of-stream or trailers. + bool request_drain_requests = 15; + + // [#not-implemented-hide:] + // Initiates a drain of response body data. Used only in + // ``FULL_DUPLEX_STREAMED`` and ``GRPC`` body send modes. + // + // The expected sequence for a drain is as follows: + // + // 1. The ext_proc server sends a message to the data plane with this + // field set to true. + // 2. The data plane pauses reading from the upstream server, applying + // any necessary flow control push-back. + // 3. The data plane sends a + // :ref:`response_body <envoy_v3_api_field_service.ext_proc.v3.ProcessingRequest.response_body>` + // with the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.HttpBody.drain_complete>` + // field set to true. + // 4. The ext_proc server continues processing all subsequent response body + // chunks until it sees the body chunk with the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.HttpBody.drain_complete>` + // field set to true. When sending back its response to that last body + // chunk, the ext_proc server will set the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.StreamedBodyResponse.drain_complete>` + // field to true to let the data plane know that it has finished draining. + // 5. When the data plane sees the response with the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.StreamedBodyResponse.drain_complete>` + // field set to true, it will resume reading from the upstream + // server, passing all data directly to the downstream client, + // without going through the ext_proc sidestream. + // + // This procedure provides a safe way for the ext_proc server to indicate + // that it does not need to see the rest of the response body. + // + // Note that if the data plane is sending response body data and the + // ext_proc server wants to terminate the stream with an OK status, it + // must perform this drain before doing so. + // + // Note that the data plane may have either sent a body chunk with + // :ref:`end_of_stream <envoy_v3_api_field_service.ext_proc.v3.StreamedBodyResponse.end_of_stream>` + // set to true or may have sent trailers before it received the drain + // request from the ext_proc server. In these cases, the data plane will + // ignore the drain request, and the ext_proc will consider the drain + // complete when it sees the end-of-stream or trailers. + bool request_drain_responses = 16; // When the ext_proc server receives a request message and needs more time to process it, it // sends back a ``ProcessingResponse`` message with a new timeout value. When the data plane @@ -259,6 +461,29 @@ // Such a message can be sent at most once in a particular data plane ext_proc filter processing // state. To enable this API, ``max_message_timeout`` must be set to a value >= 1ms. google.protobuf.Duration override_message_timeout = 10; + + // Flow control updates for ``FULL_DUPLEX_STREAMED`` and ``GRPC`` body + // send modes. + // + // This message may be included in a response message that also + // populates one of the fields in the ``response`` oneof above, or it + // may be sent in a response message that does not set the + // ``response`` oneof. + // + // In ``FULL_DUPLEX_STREAMED`` body send mode, for backward + // compatibility with data planes that do not yet support flow control, + // the ext_proc server must not set this field unless the data plane + // sent initial window sizes in its initial message on the stream. + // Conversely, if the data plane did send initial window sizes in its + // initial message on the stream, the ext_proc server must send a + // window update immediately to let the data plane know that it also + // supports flow control. If the ext_proc server is sending a message + // immediately anyway (e.g., for a header or body chunk), it can include + // this field in that same message; otherwise, the ext_proc server must + // send a message containing only this field. + // + // [#not-implemented-hide:] + ServerWindowUpdate server_window_update = 14; } // The following are messages that are sent to the server. @@ -283,6 +508,7 @@ // This message is sent to the external server when the HTTP request and response bodies are // received. +// [#next-free-field: 6] message HttpBody { // The contents of the body in the HTTP request/response. Note that in streaming mode multiple // ``HttpBody`` messages may be sent. @@ -295,16 +521,31 @@ // will be sent for the current request/response. bool end_of_stream = 2; - // This field is used in ``GRPC`` body send mode when ``end_of_stream`` is ``true`` and ``body`` - // is empty. Those values would normally indicate an empty message on the stream with the - // end-of-stream bit set. However, if the half-close happens after the last message on the stream - // was already sent, then this field will be ``true`` to indicate an end-of-stream with *no* - // message (as opposed to an empty message). + // This field is used only in ``GRPC`` body send mode. It is not used in any other body send + // mode. + // + // This field is used only when ``end_of_stream`` is true and ``body`` is empty. + // Normally, in ``GRPC`` body send mode, an empty ``body`` field indicates an empty message on + // the gRPC stream. However, it is possible that the gRPC client sends a half-close without + // actually sending a message on the stream, so we need a way to differentiate between + // an empty message being sent and no message being sent. If this field is true, then it + // indicates that no message has been sent; if it is false, then it indicates that an empty + // message has been sent. + // [#not-implemented-hide:] bool end_of_stream_without_message = 3; // This field is used in ``GRPC`` body send mode to indicate whether the message is compressed. // This will never be set to ``true`` by gRPC but may be set to ``true`` by a proxy like Envoy. bool grpc_message_compressed = 4; + + // [#not-implemented-hide:] + // In ``FULL_DUPLEX_STREAMED`` or ``GRPC`` body send modes, if the + // data plane has seen the + // :ref:`request_drain_requests <envoy_v3_api_field_service.ext_proc.v3.ProcessingResponse.request_drain_requests>` + // or :ref:`request_drain_responses <envoy_v3_api_field_service.ext_proc.v3.ProcessingResponse.request_drain_responses>` + // field, it will populate this field to indicate that it has finished + // sending data to the ext_proc server. + bool drain_complete = 5; } // This message is sent to the external server when the HTTP request and @@ -457,6 +698,10 @@ // ``:authority``, ``:scheme``, or ``host`` headers will be ignored. // The header value is encoded in the // :ref:`raw_value <envoy_v3_api_field_config.core.v3.HeaderValue.raw_value>` field. + // Note that the :ref:`append field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.append>` + // defaults to false when used in this message. + // The :ref:`keep_empty_value field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.keep_empty_value>` + // is not supported. repeated config.core.v3.HeaderValueOption set_headers = 1; // Remove these HTTP headers. Attempts to remove system headers -- @@ -465,6 +710,7 @@ } // The body response message corresponding to ``FULL_DUPLEX_STREAMED`` or ``GRPC`` body modes. +// [#next-free-field: 6] message StreamedBodyResponse { // In ``FULL_DUPLEX_STREAMED`` body send mode, contains the body response chunk that will be // passed to the upstream/downstream by the data plane. In ``GRPC`` body send mode, contains @@ -480,16 +726,35 @@ // messages sent by the client application. bool end_of_stream = 2; - // This field is used in ``GRPC`` body send mode when ``end_of_stream`` is ``true`` and ``body`` - // is empty. Those values would normally indicate an empty message on the stream with the - // end-of-stream bit set. However, if the half-close happens after the last message on the stream - // was already sent, then this field will be ``true`` to indicate an end-of-stream with *no* - // message (as opposed to an empty message). + // This field is used only in ``GRPC`` body send mode. It is not used in any other body send + // mode. + // + // This field is used only when ``end_of_stream`` is true and ``body`` is empty. + // Normally, in ``GRPC`` body send mode, an empty ``body`` field indicates an empty message on + // the gRPC stream. However, it is possible that the gRPC client sends a half-close without + // actually sending a message on the stream, so we need a way to differentiate between + // an empty message being sent and no message being sent. If this field is true, then it + // indicates that no message has been sent; if it is false, then it indicates that an empty + // message has been sent. + // [#not-implemented-hide:] bool end_of_stream_without_message = 3; // This field is used in ``GRPC`` body send mode to indicate whether the message is compressed. // This will never be set to ``true`` by gRPC but may be set to ``true`` by a proxy like Envoy. bool grpc_message_compressed = 4; + + // [#not-implemented-hide:] + // In ``FULL_DUPLEX_STREAMED`` or ``GRPC`` body send modes, if the + // ext_proc server has seen the + // :ref:`drain_complete <envoy_v3_api_field_service.ext_proc.v3.HttpBody.drain_complete>` + // field, it will populate this field to indicate that it has finished + // sending data back to the data plane. + // + // If the data plane receives a message with this field set to true + // before it has sent a drain-complete message to the ext_proc server, + // the data plane will treat that as if the ext_proc stream has failed + // with a non-OK status. + bool drain_complete = 5; } // This message specifies the body mutation the server sends to the data plane.

envoy/service/network_ext_proc/v3/network_external_processor.proto:

--- shake256:e870bf82f1725fad89f9cdbcf6aac0209c0b792523eec0f54ed0c2a277d22c66caaa75a8ccd5ea834b867a991c040594d285be61249fe6d5afc29fc21836673e envoy/service/network_ext_proc/v3/network_external_processor.proto +++ shake256:fc006a5c791b34aefd34bf03e9240479d6721e4e11f9cc9ad368961393267df1818ecf44ea6e68e54183caf179f764cc33bbf28c4c797a6f63f59069d9b748e6 envoy/service/network_ext_proc/v3/network_external_processor.proto @@ -71,7 +71,7 @@ // ProcessingRequest contains data sent from Envoy to the external processing server. // Each request contains either read data (from client) or write data (to client) -// along with optional metadata. +// along with optional metadata and attributes. message ProcessingRequest { // ReadData contains the network data intercepted in the request path (client to server). // This is sent to the external processor when data arrives from the downstream client. @@ -90,6 +90,11 @@ // The metadata is not automatically propagated from request to response. // The external processor must include any needed metadata in its response. config.core.v3.Metadata metadata = 3; + + // The values of properties selected by the ``connection_attributes`` + // list in the configuration. Each entry in the list is populated + // from the standard :ref:`attributes <arch_overview_attributes>` supported in the data plane. + map<string, google.protobuf.Struct> attributes = 4; } // ProcessingResponse contains the response from the external processing server to Envoy.

envoy/service/rate_limit_quota/v3/rlqs.proto:

--- shake256:4134d14b8efd20d58f826e9849d6e53b2d3ac7242560d367b7abc6d2a7ee155135e112da7a9bd738e5ebb22180c4bdbad8071c9c9574e945897bf6a608c7260d envoy/service/rate_limit_quota/v3/rlqs.proto +++ shake256:d914c01bdc3068df7d0d999fbf63b779c0c184906ef0cd922fbc421276263c34bb565b0dd7a4e1b12eb9ca1875088a525f91f4f81aa61aa907ba72b91ad097bd envoy/service/rate_limit_quota/v3/rlqs.proto @@ -6,8 +6,6 @@ import "google/protobuf/duration.proto"; -import "xds/annotations/v3/status.proto"; - import "udpa/annotations/status.proto"; import "validate/validate.proto"; @@ -16,7 +14,6 @@ option java_multiple_files = true; option go_package = "github.com/envoyproxy/go-control-plane/envoy/service/rate_limit_quota/v3;rate_limit_quotav3"; option (udpa.annotations.file_status).package_version_status = ACTIVE; -option (xds.annotations.v3.file_status).work_in_progress = true; // [#protodoc-title: Rate Limit Quota Service (RLQS)]

envoy/service/ratelimit/v3/rls.proto:

--- shake256:4d2cdb7b5a97447afa3a31c9430712528fdee48f57628e528e1f9a033d8af309b25ab63085729223f6fc1a5e0514cadbe7574e858edb7e3fb8ce813e579931c6 envoy/service/ratelimit/v3/rls.proto +++ shake256:311a3681f3f3d77ddfc1eb3c82e620bfaf0023946cbebbb6ca684fd9fa164ff24f838a06c58949b09af0fd404700a81e69f0852dc4353c6ac27b3500d5894fc7 envoy/service/ratelimit/v3/rls.proto @@ -8,6 +8,7 @@ import "google/protobuf/duration.proto"; import "google/protobuf/struct.proto"; import "google/protobuf/timestamp.proto"; +import "google/protobuf/wrappers.proto"; import "udpa/annotations/status.proto"; import "udpa/annotations/versioning.proto"; @@ -112,6 +113,10 @@ // The unit of time. Unit unit = 2; + + // The number of units in the rate limit period. For example, a value of ``10`` with a unit + // of ``MINUTE`` specifies a 10-minute rate limit period. If not specified, defaults to ``1``. + google.protobuf.UInt32Value unit_multiplier = 4 [(validate.rules).uint32 = {gt: 0}]; } // Cacheable quota for responses.

envoy/type/metadata/v3/metadata.proto:

--- shake256:35ee01ad69132a5e671569227885b005ffee1364d7c60a3ebbf8c630872d444446d0bd4c964168d2d81d91806800ebdcfaa0b18a79dd436725295d0d9842fcaa envoy/type/metadata/v3/metadata.proto +++ shake256:374b75100366b366afa9c14d5a1ef45ed82771f5e1b4d532b9345288365e1dcd5457f78e446ae5dd9aae91ce9e3c434c4e10ed242595aae859891f0941318035 envoy/type/metadata/v3/metadata.proto @@ -41,7 +41,8 @@ option (udpa.annotations.versioning).previous_message_type = "envoy.type.metadata.v2.MetadataKey"; // Specifies a segment in a path for retrieving values from Metadata. - // Currently, only key-based segments (field names) are supported. + // Supports both key-based segments (field names in a Struct) and index-based + // segments (element access in a ListValue). message PathSegment { option (udpa.annotations.versioning).previous_message_type = "envoy.type.metadata.v2.MetadataKey.PathSegment"; @@ -51,6 +52,9 @@ // If specified, use this key to retrieve the value in a Struct. string key = 1 [(validate.rules).string = {min_len: 1}]; + + // If specified, use this index to retrieve a value from a ListValue. + uint32 index = 2; } } @@ -60,12 +64,12 @@ // The path used to retrieve a specific Value from the Struct. // This can be either a prefix or a full path, depending on the use case. - // For example, ``[prop, xyz]`` would retrieve a struct or ``[prop, foo]`` would retrieve a string - // in the example above. + // For example, ``[{key: prop}, {key: xyz}]`` would retrieve a struct or ``[{key: prop}, {key: foo}]`` + // would retrieve a string in the example above. // - // .. note:: - // Since only key-type segments are supported, a path cannot specify a list - // unless the list is the last segment. + // Path segments support both struct field access (via ``key``) and list element access (via ``index``). + // For example, to access the first element of a list at ``envoy.filters.http.grpc_field_extraction.tenant_id``, + // use ``path: [{key: tenant_id}, {index: 0}]``. repeated PathSegment path = 2 [(validate.rules).repeated = {min_items: 1}]; }

envoy/type/tracing/v3/custom_tag.proto:

--- shake256:5d1365c2a15eac67472851d97a23e17d24470ae21d04f87d9daf23a968cf1c85e76bae0aacfbee7e22d0fc57e8d0ab2185c3c3bb797087a5755ec577410483f0 envoy/type/tracing/v3/custom_tag.proto +++ shake256:a3a4044bc25774a45116435a3c732620914ef09f490941d06b6762044aff4c0624177cf96018234ffc8ade813db3ae8a4e83749b72bef469f56903f473fa084d envoy/type/tracing/v3/custom_tag.proto @@ -17,10 +17,44 @@ // [#protodoc-title: Custom Tag] // Describes custom tags for the active span. -// [#next-free-field: 7] +// [#next-free-field: 8] message CustomTag { option (udpa.annotations.versioning).previous_message_type = "envoy.type.tracing.v2.CustomTag"; + // Specifies how the resolved tag value should be typed on tracers that support + // typed span attributes (e.g. OpenTelemetry). The integer and floating-point + // cases are declared explicitly so the emitted attribute type is deterministic + // rather than inferred from the value. + enum ValueType { + // The value type is not set. Behaves like ``STRING``; the distinct default + // value lets consumers tell an unset ``value_type`` apart from an explicit + // ``STRING``. + UNSPECIFIED = 0; + + // Emit the tag value as a string. + STRING = 1; + + // Coerce the resolved tag value to a signed 64-bit integer. Tracers that + // support typed span attributes emit it as a native integer attribute (for + // OpenTelemetry, an OTLP ``int_value``). If the value does not parse as an + // integer, or the tracer has no typed-attribute support, it falls back to a + // string tag. + INT = 2; + + // Coerce the resolved tag value to a double. Tracers that support typed span + // attributes emit it as a native floating-point attribute (for OpenTelemetry, + // an OTLP ``double_value``). If the value does not parse as a double, or the + // tracer has no typed-attribute support, it falls back to a string tag. + DOUBLE = 3; + + // Coerce the resolved tag value to a boolean. Tracers that support typed span + // attributes emit it as a native boolean attribute (for OpenTelemetry, an OTLP + // ``bool_value``). Accepts the usual boolean spellings (``true``/``false``, + // ``1``/``0``, etc.). If the value does not parse as a boolean, or the tracer + // has no typed-attribute support, it falls back to a string tag. + BOOL = 4; + } + // Literal type custom tag with static value for the tag value. message Literal { option (udpa.annotations.versioning).previous_message_type = @@ -106,4 +140,11 @@ // unknown specifier values are replaced with the empty string instead of ``-``. string value = 6; } + + // The value's type. When unset (``UNSPECIFIED``) or ``STRING`` the tag keeps the + // preexisting string behavior. When set to ``INT``, ``DOUBLE`` or ``BOOL``, tracers + // that support typed span attributes (e.g. OpenTelemetry) emit the tag as an + // integer, floating-point or boolean attribute instead of a string. Applies to + // every custom tag type. + ValueType value_type = 7 [(validate.rules).enum = {defined_only: true}]; }

envoy/type/v3/http.proto:

--- shake256:406e55d1c3c28926cdcec7950f4e1ddac8f71fe9524f26df66e5f04e865b7fe37ec881c2c2ea96ee5928856a4f07ffc8b05e95a9987b99edc58ca8bf01668c04 envoy/type/v3/http.proto +++ shake256:accdf2d18598af1d1796c3b86c759c3fce8f3a076c354569191f9fb2aff09da01e4ae863006994714383af109df867d87a7a2edfe275996e56a8935da1a77283 envoy/type/v3/http.proto @@ -14,11 +14,6 @@ enum CodecClientType { HTTP1 = 0; - HTTP2 = 1; - - // [#not-implemented-hide:] QUIC implementation is not production ready yet. Use this enum with - // caution to prevent accidental execution of QUIC code. I.e. `!= HTTP2` is no longer sufficient - // to distinguish HTTP1 and HTTP2 traffic. HTTP3 = 2; }

Detected new managed modules references

8253462

app-token-modules Bot requested a review from a team October 14, 2026 12:13

github-actions Bot reviewed Oct 14, 2026

View reviewed changes

pkwarren approved these changes Oct 14, 2026

View reviewed changes

pkwarren merged commit a13d80b into main Oct 14, 2026
6 checks passed

pkwarren deleted the fetch-modules branch October 14, 2026 12:53

Navigation Menu

Repository navigation

Found new managed modules references - #1325

Found new managed modules references#1325
pkwarren merged 1 commit into
mainfrom
fetch-modules

app-token-modules Bot commented Oct 14, 2026

Uh oh!

github-actions Bot Oct 14, 2026

Uh oh!

github-actions Bot Oct 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

app-token-modules Bot commented Oct 14, 2026

Uh oh!

github-actions Bot Oct 14, 2026

Choose a reason for hiding this comment

Files removed:

Files added:

Files changed content:

contrib/envoy/extensions/filters/http/sxg/v3alpha/sxg.proto:

envoy/admin/v3/memory.proto:

envoy/admin/v3/mutex_stats.proto:

envoy/config/bootstrap/v3/bootstrap.proto:

envoy/config/cluster/v3/cluster.proto:

envoy/config/core/v3/address.proto:

envoy/config/core/v3/base.proto:

envoy/config/core/v3/config_source.proto:

envoy/config/core/v3/health_check.proto:

envoy/config/core/v3/proxy_protocol.proto:

envoy/config/core/v3/substitution_format_string.proto:

envoy/config/listener/v3/listener.proto:

envoy/config/listener/v3/quic_config.proto:

envoy/config/metrics/v3/stats.proto:

envoy/config/overload/v3/overload.proto:

envoy/config/route/v3/route.proto:

envoy/config/route/v3/route_components.proto:

envoy/config/trace/v3/opentelemetry.proto:

envoy/data/core/v3/health_check_event.proto:

envoy/extensions/access_loggers/dynamic_modules/v3/dynamic_modules.proto:

envoy/extensions/access_loggers/open_telemetry/v3/logs_service.proto:

envoy/extensions/bootstrap/dynamic_modules/v3/dynamic_modules.proto:

envoy/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/v3/downstream_reverse_connection_socket_interface.proto:

envoy/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/v3/upstream_reverse_connection_socket_interface.proto:

envoy/extensions/clusters/composite/v3/cluster.proto:

envoy/extensions/clusters/mcp_multicluster/v3/cluster.proto:

envoy/extensions/common/ratelimit/v3/ratelimit.proto:

envoy/extensions/filters/http/adaptive_concurrency/v3/adaptive_concurrency.proto:

envoy/extensions/filters/http/ai_protocol_manager/v3/ai_protocol_manager.proto:

envoy/extensions/filters/http/basic_auth/v3/basic_auth.proto:

envoy/extensions/filters/http/compressor/v3/compressor.proto:

envoy/extensions/filters/http/dynamic_modules/v3/dynamic_modules.proto:

envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto:

envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto:

envoy/extensions/filters/http/fault/v3/fault.proto:

envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.proto:

envoy/extensions/filters/http/grpc_field_extraction/v3/config.proto:

envoy/extensions/filters/http/header_mutation/v3/header_mutation.proto:

envoy/extensions/filters/http/jwt_authn/v3/config.proto:

envoy/extensions/filters/http/local_ratelimit/v3/local_rate_limit.proto:

envoy/extensions/filters/http/lua/v3/lua.proto:

envoy/extensions/filters/http/mcp/v3/mcp.proto:

envoy/extensions/filters/http/mcp_json_rest_bridge/v3/mcp_json_rest_bridge.proto:

envoy/extensions/filters/http/mcp_router/v3/mcp_router.proto:

envoy/extensions/filters/http/oauth2/v3/oauth.proto:

envoy/extensions/filters/http/rate_limit_quota/v3/rate_limit_quota.proto:

envoy/extensions/filters/http/ratelimit/v3/rate_limit.proto:

envoy/extensions/filters/listener/dynamic_modules/v3/dynamic_modules.proto:

envoy/extensions/filters/network/dynamic_modules/v3/dynamic_modules.proto:

envoy/extensions/filters/network/ext_authz/v3/ext_authz.proto:

envoy/extensions/filters/network/ext_proc/v3/ext_proc.proto:

envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto:

envoy/extensions/filters/network/redis_proxy/v3/redis_proxy.proto:

envoy/extensions/filters/network/reverse_tunnel/v3/reverse_tunnel.proto:

envoy/extensions/filters/udp/dns_filter/v3/dns_filter.proto:

envoy/extensions/filters/udp/dynamic_modules/v3/dynamic_modules.proto:

envoy/extensions/filters/udp/udp_proxy/v3/udp_proxy.proto:

envoy/extensions/formatter/cel/v3/cel.proto:

envoy/extensions/formatter/dynamic_modules/v3/dynamic_modules.proto:

envoy/extensions/health_checkers/dynamic_modules/v3/dynamic_modules.proto:

envoy/extensions/http/custom_response/local_response_policy/v3/local_response_policy.proto:

envoy/extensions/http/injected_credentials/generic/v3/generic.proto:

envoy/extensions/http/injected_credentials/oauth2/v3/oauth2.proto:

envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.proto:

envoy/extensions/load_balancing_policies/load_aware_locality/v3/load_aware_locality.proto:

envoy/extensions/matching/http/dynamic_modules/v3/dynamic_modules.proto:

envoy/extensions/matching/input_matchers/dynamic_modules/v3/dynamic_modules.proto:

envoy/extensions/quic/connection_id_generator/quic_lb/v3/quic_lb.proto:

envoy/extensions/stat_sinks/dynamic_modules/v3/dynamic_modules.proto:

envoy/extensions/stat_sinks/graphite_statsd/v3/graphite_statsd.proto:

envoy/extensions/tracers/dynamic_modules/v3/dynamic_modules.proto:

envoy/extensions/transport_sockets/quic/v3/quic_transport.proto:

`contrib/envoy/extensions/filters/http/sxg/v3alpha/sxg.proto`:

`envoy/admin/v3/memory.proto`:

`envoy/admin/v3/mutex_stats.proto`:

`envoy/config/bootstrap/v3/bootstrap.proto`:

`envoy/config/cluster/v3/cluster.proto`:

`envoy/config/core/v3/address.proto`:

`envoy/config/core/v3/base.proto`:

`envoy/config/core/v3/config_source.proto`:

`envoy/config/core/v3/health_check.proto`:

`envoy/config/core/v3/proxy_protocol.proto`:

`envoy/config/core/v3/substitution_format_string.proto`:

`envoy/config/listener/v3/listener.proto`:

`envoy/config/listener/v3/quic_config.proto`:

`envoy/config/metrics/v3/stats.proto`:

`envoy/config/overload/v3/overload.proto`:

`envoy/config/route/v3/route.proto`:

`envoy/config/route/v3/route_components.proto`:

`envoy/config/trace/v3/opentelemetry.proto`:

`envoy/data/core/v3/health_check_event.proto`:

`envoy/extensions/access_loggers/dynamic_modules/v3/dynamic_modules.proto`:

`envoy/extensions/access_loggers/open_telemetry/v3/logs_service.proto`:

`envoy/extensions/bootstrap/dynamic_modules/v3/dynamic_modules.proto`:

`envoy/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/v3/downstream_reverse_connection_socket_interface.proto`:

`envoy/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/v3/upstream_reverse_connection_socket_interface.proto`:

`envoy/extensions/clusters/composite/v3/cluster.proto`:

`envoy/extensions/clusters/mcp_multicluster/v3/cluster.proto`:

`envoy/extensions/common/ratelimit/v3/ratelimit.proto`:

`envoy/extensions/filters/http/adaptive_concurrency/v3/adaptive_concurrency.proto`:

`envoy/extensions/filters/http/ai_protocol_manager/v3/ai_protocol_manager.proto`:

`envoy/extensions/filters/http/basic_auth/v3/basic_auth.proto`:

`envoy/extensions/filters/http/compressor/v3/compressor.proto`:

`envoy/extensions/filters/http/dynamic_modules/v3/dynamic_modules.proto`:

`envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto`:

`envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto`:

`envoy/extensions/filters/http/fault/v3/fault.proto`:

`envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.proto`:

`envoy/extensions/filters/http/grpc_field_extraction/v3/config.proto`:

`envoy/extensions/filters/http/header_mutation/v3/header_mutation.proto`:

`envoy/extensions/filters/http/jwt_authn/v3/config.proto`:

`envoy/extensions/filters/http/local_ratelimit/v3/local_rate_limit.proto`:

`envoy/extensions/filters/http/lua/v3/lua.proto`:

`envoy/extensions/filters/http/mcp/v3/mcp.proto`:

`envoy/extensions/filters/http/mcp_json_rest_bridge/v3/mcp_json_rest_bridge.proto`:

`envoy/extensions/filters/http/mcp_router/v3/mcp_router.proto`:

`envoy/extensions/filters/http/oauth2/v3/oauth.proto`:

`envoy/extensions/filters/http/rate_limit_quota/v3/rate_limit_quota.proto`:

`envoy/extensions/filters/http/ratelimit/v3/rate_limit.proto`:

`envoy/extensions/filters/listener/dynamic_modules/v3/dynamic_modules.proto`:

`envoy/extensions/filters/network/dynamic_modules/v3/dynamic_modules.proto`:

`envoy/extensions/filters/network/ext_authz/v3/ext_authz.proto`:

`envoy/extensions/filters/network/ext_proc/v3/ext_proc.proto`:

`envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto`:

`envoy/extensions/filters/network/redis_proxy/v3/redis_proxy.proto`:

`envoy/extensions/filters/network/reverse_tunnel/v3/reverse_tunnel.proto`:

`envoy/extensions/filters/udp/dns_filter/v3/dns_filter.proto`:

`envoy/extensions/filters/udp/dynamic_modules/v3/dynamic_modules.proto`:

`envoy/extensions/filters/udp/udp_proxy/v3/udp_proxy.proto`:

`envoy/extensions/formatter/cel/v3/cel.proto`:

`envoy/extensions/formatter/dynamic_modules/v3/dynamic_modules.proto`:

`envoy/extensions/health_checkers/dynamic_modules/v3/dynamic_modules.proto`:

`envoy/extensions/http/custom_response/local_response_policy/v3/local_response_policy.proto`:

`envoy/extensions/http/injected_credentials/generic/v3/generic.proto`:

`envoy/extensions/http/injected_credentials/oauth2/v3/oauth2.proto`:

`envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.proto`:

`envoy/extensions/load_balancing_policies/load_aware_locality/v3/load_aware_locality.proto`:

`envoy/extensions/matching/http/dynamic_modules/v3/dynamic_modules.proto`:

`envoy/extensions/matching/input_matchers/dynamic_modules/v3/dynamic_modules.proto`:

`envoy/extensions/quic/connection_id_generator/quic_lb/v3/quic_lb.proto`:

`envoy/extensions/stat_sinks/dynamic_modules/v3/dynamic_modules.proto`:

`envoy/extensions/stat_sinks/graphite_statsd/v3/graphite_statsd.proto`:

`envoy/extensions/tracers/dynamic_modules/v3/dynamic_modules.proto`:

`envoy/extensions/transport_sockets/quic/v3/quic_transport.proto`:

`envoy/extensions/transport_sockets/tls/v3/common.proto`:

`envoy/extensions/transport_sockets/tls/v3/tls.proto`:

`envoy/extensions/upstreams/http/v3/http_protocol_options.proto`:

`envoy/extensions/wasm/v3/wasm.proto`:

`envoy/service/auth/v3/external_auth.proto`:

`envoy/service/ext_proc/v3/external_processor.proto`:

`envoy/service/network_ext_proc/v3/network_external_processor.proto`:

`envoy/service/rate_limit_quota/v3/rlqs.proto`: