envoyproxy / envoyproxy/gateway

Filter Chain Metadata

Open
#7,867 3 comments 0 reactions 0 assignees View on GitHub
area/translator stale
Dominant language
Go
Stars
3k
Forks
864
Avg merge
2d 2h
Merged PRs (30d)
140

Description

*Description*:

Envoy Gateway supports injection of Gateway API resource metadata into xds metadata for observability and configuration analysis purposes.

Currently, the following are supported:
- Route metadata (from xRoute)
- VHost metadata (from Gateway)
- LocalityLBEndpoints metadata (from Service, Backend, ... )

Envoy supports filter-chain level metadata as well. Recently, the metadata access log operator was extended to support filter chain metadata: https://github.com/envoyproxy/envoy/pull/42685

This metadata can be useful for access log enrichment in several cases:
- Non-HTTP xRoute (TCP, TLS, ... ) map to filter chains
- HTTPS route listener logs: e.g. when a TLS connection fails (TLS parameter mismatch, client certificate validation failure, ... ), an HTTP access log is not emitted. However, a listener access log can still provide metadata based on filter chain metadata (assuming SNI matching succeeded).

Proposal:
- Create filter chain metadata based on
* Gateway and Listener
* Non-HTTP xRoute

Notes:
- Typically, the amount of filter chains is smaller than the amount of routes, backends, etc. So, XDS should not be inflated significantly.
- Filter chains can be added/removed/update independently of the listener, so adding metadata should not create undesired listener draining.

[optional *Relevant Links*:]
>Any extra documentation required to understand the issue.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.