Automated Contour version update 1.26.0 (#4894)

Create new Contour version

Co-authored-by: emosbaugh <[email protected]>

Author: replicated-ci-kurl

addons/contour/1.26.0/contour.yaml

@@ -228,13 +228,36 @@ spec:
                           slashes from request URL paths. \n Contour's default is
                           false."
                         type: boolean
+                      httpMaxConcurrentStreams:
+                        description: Defines the value for SETTINGS_MAX_CONCURRENT_STREAMS
+                          Envoy will advertise in the SETTINGS frame in HTTP/2 connections
+                          and the limit for concurrent streams allowed for a peer
+                          on a single HTTP/2 connection. It is recommended to not
+                          set this lower than 100 but this field can be used to bound
+                          resource usage by HTTP/2 connections and mitigate attacks
+                          like CVE-2023-44487. The default value when this is not
+                          set is unlimited.
+                        format: int32
+                        minimum: 1
+                        type: integer
                       maxRequestsPerConnection:
                         description: Defines the maximum requests for downstream connections.
                           If not specified, there is no limit. see https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#envoy-v3-api-msg-config-core-v3-httpprotocoloptions
                           for more information.
                         format: int32
                         minimum: 1
                         type: integer
+                      maxRequestsPerIOCycle:
+                        description: Defines the limit on number of HTTP requests
+                          that Envoy will process from a single connection in a single
+                          I/O cycle. Requests over this limit are processed in subsequent
+                          I/O cycles. Can be used as a mitigation for CVE-2023-44487
+                          when abusive traffic is detected. Configures the http.max_requests_per_io_cycle
+                          Envoy runtime setting. The default value when this is not
+                          set is no limit.
+                        format: int32
+                        minimum: 1
+                        type: integer
                       per-connection-buffer-limit-bytes:
                         description: Defines the soft limit on size of the listener’s
                           new connection read and write buffers in bytes. If unspecified,
@@ -3658,6 +3681,18 @@ spec:
                               duplicate slashes from request URL paths. \n Contour's
                               default is false."
                             type: boolean
+                          httpMaxConcurrentStreams:
+                            description: Defines the value for SETTINGS_MAX_CONCURRENT_STREAMS
+                              Envoy will advertise in the SETTINGS frame in HTTP/2
+                              connections and the limit for concurrent streams allowed
+                              for a peer on a single HTTP/2 connection. It is recommended
+                              to not set this lower than 100 but this field can be
+                              used to bound resource usage by HTTP/2 connections and
+                              mitigate attacks like CVE-2023-44487. The default value
+                              when this is not set is unlimited.
+                            format: int32
+                            minimum: 1
+                            type: integer
                           maxRequestsPerConnection:
                             description: Defines the maximum requests for downstream
                               connections. If not specified, there is no limit. see
@@ -3666,6 +3701,18 @@ spec:
                             format: int32
                             minimum: 1
                             type: integer
+                          maxRequestsPerIOCycle:
+                            description: Defines the limit on number of HTTP requests
+                              that Envoy will process from a single connection in
+                              a single I/O cycle. Requests over this limit are processed
+                              in subsequent I/O cycles. Can be used as a mitigation
+                              for CVE-2023-44487 when abusive traffic is detected.
+                              Configures the http.max_requests_per_io_cycle Envoy
+                              runtime setting. The default value when this is not
+                              set is no limit.
+                            format: int32
+                            minimum: 1
+                            type: integer
                           per-connection-buffer-limit-bytes:
                             description: Defines the soft limit on size of the listener’s
                               new connection read and write buffers in bytes. If unspecified,