feat: Add support for configuring maxConnectionsToAcceptPerSocketEvent in ClientTrafficPolicy

api/v1alpha1/connection_types.go

@@ -36,6 +36,13 @@ type ClientConnection struct {
 	// +optional
 	// +notImplementedHide
 	SocketBufferLimit *resource.Quantity `json:"socketBufferLimit,omitempty"`
+
+	// MaxAcceptPerSocketEvent provides configuration for the maximum number of connections to accept from the kernel
+	// per socket event. If there are more than MaxAcceptPerSocketEvent connections
+	// pending accept, connections over this threshold will be accepted in later event loop iterations.
+	// Default: 1
+	// +optional
+	MaxAcceptPerSocketEvent *uint32 `json:"maxAcceptPerSocketEvent,omitempty"`
 }
 
 // BackendConnection allows users to configure connection-level settings of backend

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml

@@ -153,6 +153,14 @@ spec:
                     required:
                     - value
                     type: object
+                  maxAcceptPerSocketEvent:
+                    description: |-
+                      MaxAcceptPerSocketEvent provides configuration for the maximum number of connections to accept from the kernel
+                      per socket event. If there are more than MaxAcceptPerSocketEvent connections
+                      pending accept, connections over this threshold will be accepted in later event loop iterations.
+                      Default: 1
+                    format: int32
+                    type: integer
                   socketBufferLimit:
                     allOf:
                     - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$

charts/gateway-helm/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml

@@ -152,6 +152,14 @@ spec:
                     required:
                     - value
                     type: object
+                  maxAcceptPerSocketEvent:
+                    description: |-
+                      MaxAcceptPerSocketEvent provides configuration for the maximum number of connections to accept from the kernel
+                      per socket event. If there are more than MaxAcceptPerSocketEvent connections
+                      pending accept, connections over this threshold will be accepted in later event loop iterations.
+                      Default: 1
+                    format: int32
+                    type: integer
                   socketBufferLimit:
                     allOf:
                     - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$

internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml

@@ -1090,6 +1090,7 @@ xds:
                   statPrefix: http-10080
                   useRemoteAddress: true
               name: default/eg/http
+            maxConnectionsToAcceptPerSocketEvent: 1
             name: default/eg/http
             perConnectionBufferLimitBytes: 32768
       - activeState:
@@ -1201,6 +1202,7 @@ xds:
                   statPrefix: http-8080
                   useRemoteAddress: true
               name: default/eg/grpc
+            maxConnectionsToAcceptPerSocketEvent: 1
             name: default/eg/grpc
             perConnectionBufferLimitBytes: 32768
       - activeState:
@@ -1284,6 +1286,7 @@ xds:
                   cluster: tcproute/default/backend/rule/-1
                   statPrefix: tcp-1234
               name: tcproute/default/backend
+            maxConnectionsToAcceptPerSocketEvent: 1
             name: default/eg/tcp
             perConnectionBufferLimitBytes: 32768
       - activeState:
@@ -1374,6 +1377,7 @@ xds:
             - name: envoy.filters.listener.tls_inspector
               typedConfig:
                 '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+            maxConnectionsToAcceptPerSocketEvent: 1
             name: default/eg/tls-passthrough
             perConnectionBufferLimitBytes: 32768
       - activeState:

internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json

@@ -912,6 +912,7 @@
                     ],
                     "name": "default/eg/http"
                   },
+                  "maxConnectionsToAcceptPerSocketEvent": 1,
                   "name": "default/eg/http",
                   "perConnectionBufferLimitBytes": 32768
                 }
@@ -1063,6 +1064,7 @@
                     ],
                     "name": "default/eg/grpc"
                   },
+                  "maxConnectionsToAcceptPerSocketEvent": 1,
                   "name": "default/eg/grpc",
                   "perConnectionBufferLimitBytes": 32768
                 }
@@ -1174,6 +1176,7 @@
                       "name": "tcproute/default/backend"
                     }
                   ],
+                  "maxConnectionsToAcceptPerSocketEvent": 1,
                   "name": "default/eg/tcp",
                   "perConnectionBufferLimitBytes": 32768
                 }
@@ -1298,6 +1301,7 @@
                       }
                     }
                   ],
+                  "maxConnectionsToAcceptPerSocketEvent": 1,
                   "name": "default/eg/tls-passthrough",
                   "perConnectionBufferLimitBytes": 32768
                 }

internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml

@@ -543,6 +543,7 @@ xds:
                   statPrefix: http-10080
                   useRemoteAddress: true
               name: default/eg/http
+            maxConnectionsToAcceptPerSocketEvent: 1
             name: default/eg/http
             perConnectionBufferLimitBytes: 32768
       - activeState:
@@ -654,6 +655,7 @@ xds:
                   statPrefix: http-8080
                   useRemoteAddress: true
               name: default/eg/grpc
+            maxConnectionsToAcceptPerSocketEvent: 1
             name: default/eg/grpc
             perConnectionBufferLimitBytes: 32768
       - activeState:
@@ -737,6 +739,7 @@ xds:
                   cluster: tcproute/default/backend/rule/-1
                   statPrefix: tcp-1234
               name: tcproute/default/backend
+            maxConnectionsToAcceptPerSocketEvent: 1
             name: default/eg/tcp
             perConnectionBufferLimitBytes: 32768
       - activeState:
@@ -827,6 +830,7 @@ xds:
             - name: envoy.filters.listener.tls_inspector
               typedConfig:
                 '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+            maxConnectionsToAcceptPerSocketEvent: 1
             name: default/eg/tls-passthrough
             perConnectionBufferLimitBytes: 32768
       - activeState:

internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.listener.yaml

@@ -142,6 +142,7 @@ xds:
                 statPrefix: http-10080
                 useRemoteAddress: true
             name: default/eg/http
+          maxConnectionsToAcceptPerSocketEvent: 1
           name: default/eg/http
           perConnectionBufferLimitBytes: 32768
     - activeState:
@@ -253,6 +254,7 @@ xds:
                 statPrefix: http-8080
                 useRemoteAddress: true
             name: default/eg/grpc
+          maxConnectionsToAcceptPerSocketEvent: 1
           name: default/eg/grpc
           perConnectionBufferLimitBytes: 32768
     - activeState:
@@ -336,6 +338,7 @@ xds:
                 cluster: tcproute/default/backend/rule/-1
                 statPrefix: tcp-1234
             name: tcproute/default/backend
+          maxConnectionsToAcceptPerSocketEvent: 1
           name: default/eg/tcp
           perConnectionBufferLimitBytes: 32768
     - activeState:
@@ -426,6 +429,7 @@ xds:
           - name: envoy.filters.listener.tls_inspector
             typedConfig:
               '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+          maxConnectionsToAcceptPerSocketEvent: 1
           name: default/eg/tls-passthrough
           perConnectionBufferLimitBytes: 32768
     - activeState:

internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.json

@@ -661,6 +661,7 @@
                     ],
                     "name": "envoy-gateway-system/eg/http"
                   },
+                  "maxConnectionsToAcceptPerSocketEvent": 1,
                   "name": "envoy-gateway-system/eg/http",
                   "perConnectionBufferLimitBytes": 32768
                 }

internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.yaml

@@ -401,6 +401,7 @@ xds:
                   statPrefix: http-10080
                   useRemoteAddress: true
               name: envoy-gateway-system/eg/http
+            maxConnectionsToAcceptPerSocketEvent: 1
             name: envoy-gateway-system/eg/http
             perConnectionBufferLimitBytes: 32768
     - '@type': type.googleapis.com/envoy.admin.v3.RoutesConfigDump

internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.listener.yaml

@@ -162,5 +162,6 @@ xds:
                 statPrefix: http-10080
                 useRemoteAddress: true
             name: envoy-gateway-system/eg/http
+          maxConnectionsToAcceptPerSocketEvent: 1
           name: envoy-gateway-system/eg/http
           perConnectionBufferLimitBytes: 32768

internal/cmd/egctl/testdata/translate/out/no-service-cluster-ip.all.yaml

@@ -344,6 +344,7 @@ xds:
                   statPrefix: http-10080
                   useRemoteAddress: true
               name: envoy-gateway-system/eg/http
+            maxConnectionsToAcceptPerSocketEvent: 1
             name: envoy-gateway-system/eg/http
             perConnectionBufferLimitBytes: 32768
     - '@type': type.googleapis.com/envoy.admin.v3.RoutesConfigDump

internal/ir/xds.go

@@ -2936,6 +2936,8 @@ type ClientConnection struct {
 	ConnectionLimit *ConnectionLimit `json:"limit,omitempty" yaml:"limit,omitempty"`
 	// BufferLimitBytes is the maximum number of bytes that can be buffered for a connection.
 	BufferLimitBytes *uint32 `json:"bufferLimit,omitempty" yaml:"bufferLimit,omitempty"`
+	// MaxAcceptPerSocketEvent is the maximum number of connections to accept from the kernel per socket event.
+	MaxAcceptPerSocketEvent *uint32 `json:"maxAcceptPerSocketEvent,omitempty" yaml:"maxAcceptPerSocketEvent,omitempty"`
 }
 
 // ConnectionLimit contains settings for downstream connection limits

internal/xds/translator/listener.go

@@ -52,7 +52,8 @@ const (
 	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#envoy-v3-api-field-config-core-v3-http2protocoloptions-initial-connection-window-size
 	http2InitialConnectionWindowSize = 1048576 // 1 MiB
 	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/connection_limit/v3/connection_limit.proto
-	networkConnectionLimit = "envoy.filters.network.connection_limit"
+	networkConnectionLimit      = "envoy.filters.network.connection_limit"
+	maxConnAcceptPerSocketEvent = 1
 )
 
 func http1ProtocolOptions(opts *ir.HTTP1Settings) *corev3.Http1ProtocolOptions {
@@ -197,11 +198,13 @@ func buildXdsTCPListener(
 		return nil, err
 	}
 	bufferLimitBytes := buildPerConnectionBufferLimitBytes(connection)
+	maxAcceptPerSocketEvent := buildMaxAcceptPerSocketEvent(connection)
 	listener := &listenerv3.Listener{
-		Name:                          name,
-		AccessLog:                     al,
-		SocketOptions:                 socketOptions,
-		PerConnectionBufferLimitBytes: bufferLimitBytes,
+		Name:                                 name,
+		AccessLog:                            al,
+		SocketOptions:                        socketOptions,
+		PerConnectionBufferLimitBytes:        bufferLimitBytes,
+		MaxConnectionsToAcceptPerSocketEvent: maxAcceptPerSocketEvent,
 		Address: &corev3.Address{
 			Address: &corev3.Address_SocketAddress{
 				SocketAddress: &corev3.SocketAddress{
@@ -230,6 +233,13 @@ func buildPerConnectionBufferLimitBytes(connection *ir.ClientConnection) *wrappe
 	return wrapperspb.UInt32(tcpListenerPerConnectionBufferLimitBytes)
 }
 
+func buildMaxAcceptPerSocketEvent(connection *ir.ClientConnection) *wrapperspb.UInt32Value {
+	if connection != nil && connection.MaxAcceptPerSocketEvent != nil {
+		return wrapperspb.UInt32(*connection.MaxAcceptPerSocketEvent)
+	}
+	return wrapperspb.UInt32(maxConnAcceptPerSocketEvent)
+}
+
 // buildXdsQuicListener creates a xds Listener resource for quic
 func buildXdsQuicListener(name, address string, port uint32, ipFamily *egv1a1.IPFamily, accesslog *ir.AccessLog) (*listenerv3.Listener, error) {
 	log, err := buildXdsAccessLog(accesslog, ir.ProxyAccessLogTypeListener)

internal/xds/translator/testdata/in/xds-ir/max-conn-per-socket-event.yaml

@@ -0,0 +1,36 @@
+http:
+  - name: "first-listener"
+    address: "::"
+    port: 10080
+    hostnames:
+      - "*"
+    path:
+      mergeSlashes: true
+      escapedSlashesAction: UnescapeAndRedirect
+    routes:
+      - name: "first-route"
+        hostname: "*"
+        destination:
+          name: "first-route-dest"
+          settings:
+            - endpoints:
+                - host: "1.2.3.4"
+                  port: 50000
+              name: "first-route-dest/backend/0"
+    connection:
+      maxAcceptPerSocketEvent: 2
+tcp:
+  - name: "second-listener"
+    address: "::"
+    connection:
+      maxAcceptPerSocketEvent: 3
+    port: 10081
+    routes:
+      - name: "tcp-route-dest"
+        destination:
+          name: "tcp-route-dest"
+          settings:
+            - endpoints:
+                - host: "1.2.3.4"
+                  port: 50000
+              name: "tcp-route-dest/backend/0"

internal/xds/translator/testdata/out/extension-xds-ir/extensionpolicy-tcp-udp-http.listeners.yaml

@@ -37,6 +37,7 @@
         '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
         cluster: tcp-route-dest
         statPrefix: tcp-10080
+  maxConnectionsToAcceptPerSocketEvent: 1
   name: envoy-gateway/gateway-1/http1
   perConnectionBufferLimitBytes: 32768
   statPrefix: envoy-gateway/gateway-1/http1

internal/xds/translator/testdata/out/extension-xds-ir/http-route-extension-filter.listeners.yaml

@@ -30,6 +30,7 @@
         statPrefix: http-10080
         useRemoteAddress: true
     name: extension-listener
+  maxConnectionsToAcceptPerSocketEvent: 1
   name: extension-listener
   perConnectionBufferLimitBytes: 32768
   statPrefix: mock-extension-inserted-prefix

internal/xds/translator/testdata/out/extension-xds-ir/http-route-extension-listener-error.listeners.yaml

@@ -30,5 +30,6 @@
         statPrefix: http-10080
         useRemoteAddress: true
     name: extension-post-xdslistener-hook-error
+  maxConnectionsToAcceptPerSocketEvent: 1
   name: extension-post-xdslistener-hook-error
   perConnectionBufferLimitBytes: 32768

internal/xds/translator/testdata/out/extension-xds-ir/http-route-extension-route-error.listeners.yaml

@@ -30,5 +30,6 @@
         statPrefix: http-10080
         useRemoteAddress: true
     name: first-listener
+  maxConnectionsToAcceptPerSocketEvent: 1
   name: first-listener
   perConnectionBufferLimitBytes: 32768

internal/xds/translator/testdata/out/extension-xds-ir/http-route-extension-translate-error.listeners.yaml

@@ -30,5 +30,6 @@
         statPrefix: http-10080
         useRemoteAddress: true
     name: extension-post-xdstranslate-hook-error
+  maxConnectionsToAcceptPerSocketEvent: 1
   name: extension-post-xdstranslate-hook-error
   perConnectionBufferLimitBytes: 32768

internal/xds/translator/testdata/out/extension-xds-ir/http-route-extension-virtualhost-error.listeners.yaml

@@ -30,5 +30,6 @@
         statPrefix: http-10080
         useRemoteAddress: true
     name: extension-post-xdsvirtualhost-hook-error
+  maxConnectionsToAcceptPerSocketEvent: 1
   name: extension-post-xdsvirtualhost-hook-error
   perConnectionBufferLimitBytes: 32768

internal/xds/translator/testdata/out/extension-xds-ir/http-route.listeners.yaml

@@ -30,5 +30,6 @@
         statPrefix: http-10080
         useRemoteAddress: true
     name: first-listener
+  maxConnectionsToAcceptPerSocketEvent: 1
   name: first-listener
   perConnectionBufferLimitBytes: 32768

internal/xds/translator/testdata/out/extension-xds-ir/listener-policy.listeners.yaml

@@ -30,6 +30,7 @@
         statPrefix: http-10081
         useRemoteAddress: true
     name: policyextension-listener
+  maxConnectionsToAcceptPerSocketEvent: 1
   name: policyextension-listener
   perConnectionBufferLimitBytes: 32768
   statPrefix: from-the-policy

internal/xds/translator/testdata/out/extension-xds-ir/multiple-listeners-same-port-error.listeners.yaml

@@ -97,5 +97,6 @@
   - name: envoy.filters.listener.tls_inspector
     typedConfig:
       '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  maxConnectionsToAcceptPerSocketEvent: 1
   name: first-listener-error
   perConnectionBufferLimitBytes: 32768

internal/xds/translator/testdata/out/xds-ir/accesslog-cel.listeners.yaml

@@ -179,5 +179,6 @@
         statPrefix: http-10080
         useRemoteAddress: true
     name: first-listener
+  maxConnectionsToAcceptPerSocketEvent: 1
   name: first-listener
   perConnectionBufferLimitBytes: 32768

internal/xds/translator/testdata/out/xds-ir/accesslog-endpoint-stats.listeners.yaml

@@ -140,5 +140,6 @@
         statPrefix: http-10080
         useRemoteAddress: true
     name: first-listener
+  maxConnectionsToAcceptPerSocketEvent: 1
   name: first-listener
   perConnectionBufferLimitBytes: 32768