Regenerate manifests and CRDs after adding max-connections-to-accept param

kimiyasharifi · kimiyasharifi · commit 4ebb5179abd4 · 2025-11-16T07:11:40.000Z
diff --git a/apis/projectcontour/v1alpha1/contourconfig.go b/apis/projectcontour/v1alpha1/contourconfig.go
@@ -445,13 +445,13 @@ type EnvoyListenerConfig struct {
 	// +kubebuilder:validation:Minimum=1
 	// +optional
 	MaxConnectionsPerListener *uint32 `json:"maxConnectionsPerListener,omitempty"`
-        
-        // MaxConnectionsToAcceptPerSocketEvent defines the maximum number of
+
+	// MaxConnectionsToAcceptPerSocketEvent defines the maximum number of
 	// connections Envoy will accept per socket event.
 	//
 	// +kubebuilder:validation:Minimum=1
 	// +optional
-        MaxConnectionsToAcceptPerSocketEvent *uint32 `json:"maxConnectionsToAcceptPerSocketEvent,omitempty"`
+	MaxConnectionsToAcceptPerSocketEvent *uint32 `json:"maxConnectionsToAcceptPerSocketEvent,omitempty"`
 }
 
 // SocketOptions defines configurable socket options for Envoy listeners.
diff --git a/apis/projectcontour/v1alpha1/zz_generated.deepcopy.go b/apis/projectcontour/v1alpha1/zz_generated.deepcopy.go
diff --git a/cmd/contour/serve.go b/cmd/contour/serve.go
@@ -447,29 +447,29 @@ func (s *Server) doServe() error {
 	}
 
 	listenerConfig := xdscache_v3.ListenerConfig{
-		UseProxyProto:                 *contourConfiguration.Envoy.Listener.UseProxyProto,
-		HTTPAccessLog:                 contourConfiguration.Envoy.HTTPListener.AccessLog,
-		HTTPSAccessLog:                contourConfiguration.Envoy.HTTPSListener.AccessLog,
-		AccessLogType:                 contourConfiguration.Envoy.Logging.AccessLogFormat,
-		AccessLogJSONFields:           contourConfiguration.Envoy.Logging.AccessLogJSONFields,
-		AccessLogLevel:                contourConfiguration.Envoy.Logging.AccessLogLevel,
-		AccessLogFormatString:         contourConfiguration.Envoy.Logging.AccessLogFormatString,
-		AccessLogFormatterExtensions:  contourConfiguration.Envoy.Logging.AccessLogFormatterExtensions(),
-		MinimumTLSVersion:             annotation.TLSVersion(contourConfiguration.Envoy.Listener.TLS.MinimumProtocolVersion, "1.2"),
-		MaximumTLSVersion:             annotation.TLSVersion(contourConfiguration.Envoy.Listener.TLS.MaximumProtocolVersion, "1.3"),
-		CipherSuites:                  contourConfiguration.Envoy.Listener.TLS.SanitizedCipherSuites(),
-		Timeouts:                      timeouts,
-		DefaultHTTPVersions:           parseDefaultHTTPVersions(contourConfiguration.Envoy.DefaultHTTPVersions),
-		AllowChunkedLength:            !*contourConfiguration.Envoy.Listener.DisableAllowChunkedLength,
-		MergeSlashes:                  !*contourConfiguration.Envoy.Listener.DisableMergeSlashes,
-		ServerHeaderTransformation:    contourConfiguration.Envoy.Listener.ServerHeaderTransformation,
-		XffNumTrustedHops:             *contourConfiguration.Envoy.Network.XffNumTrustedHops,
-		ConnectionBalancer:            contourConfiguration.Envoy.Listener.ConnectionBalancer,
-		MaxRequestsPerConnection:      contourConfiguration.Envoy.Listener.MaxRequestsPerConnection,
-		HTTP2MaxConcurrentStreams:     contourConfiguration.Envoy.Listener.HTTP2MaxConcurrentStreams,
-		PerConnectionBufferLimitBytes: contourConfiguration.Envoy.Listener.PerConnectionBufferLimitBytes,
-		SocketOptions:                 contourConfiguration.Envoy.Listener.SocketOptions,
-                MaxConnectionsToAcceptPerSocketEvent: contourConfiguration.Envoy.Listener.MaxConnectionsToAcceptPerSocketEvent,
+		UseProxyProto:                        *contourConfiguration.Envoy.Listener.UseProxyProto,
+		HTTPAccessLog:                        contourConfiguration.Envoy.HTTPListener.AccessLog,
+		HTTPSAccessLog:                       contourConfiguration.Envoy.HTTPSListener.AccessLog,
+		AccessLogType:                        contourConfiguration.Envoy.Logging.AccessLogFormat,
+		AccessLogJSONFields:                  contourConfiguration.Envoy.Logging.AccessLogJSONFields,
+		AccessLogLevel:                       contourConfiguration.Envoy.Logging.AccessLogLevel,
+		AccessLogFormatString:                contourConfiguration.Envoy.Logging.AccessLogFormatString,
+		AccessLogFormatterExtensions:         contourConfiguration.Envoy.Logging.AccessLogFormatterExtensions(),
+		MinimumTLSVersion:                    annotation.TLSVersion(contourConfiguration.Envoy.Listener.TLS.MinimumProtocolVersion, "1.2"),
+		MaximumTLSVersion:                    annotation.TLSVersion(contourConfiguration.Envoy.Listener.TLS.MaximumProtocolVersion, "1.3"),
+		CipherSuites:                         contourConfiguration.Envoy.Listener.TLS.SanitizedCipherSuites(),
+		Timeouts:                             timeouts,
+		DefaultHTTPVersions:                  parseDefaultHTTPVersions(contourConfiguration.Envoy.DefaultHTTPVersions),
+		AllowChunkedLength:                   !*contourConfiguration.Envoy.Listener.DisableAllowChunkedLength,
+		MergeSlashes:                         !*contourConfiguration.Envoy.Listener.DisableMergeSlashes,
+		ServerHeaderTransformation:           contourConfiguration.Envoy.Listener.ServerHeaderTransformation,
+		XffNumTrustedHops:                    *contourConfiguration.Envoy.Network.XffNumTrustedHops,
+		ConnectionBalancer:                   contourConfiguration.Envoy.Listener.ConnectionBalancer,
+		MaxRequestsPerConnection:             contourConfiguration.Envoy.Listener.MaxRequestsPerConnection,
+		HTTP2MaxConcurrentStreams:            contourConfiguration.Envoy.Listener.HTTP2MaxConcurrentStreams,
+		PerConnectionBufferLimitBytes:        contourConfiguration.Envoy.Listener.PerConnectionBufferLimitBytes,
+		SocketOptions:                        contourConfiguration.Envoy.Listener.SocketOptions,
+		MaxConnectionsToAcceptPerSocketEvent: contourConfiguration.Envoy.Listener.MaxConnectionsToAcceptPerSocketEvent,
 	}
 
 	if listenerConfig.TracingConfig, err = s.setupTracingService(contourConfiguration.Tracing); err != nil {
diff --git a/cmd/contour/servecontext.go b/cmd/contour/servecontext.go
@@ -526,17 +526,17 @@ func (ctx *serveContext) convertToContourConfigurationSpec() contour_v1alpha1.Co
 		},
 		Envoy: &contour_v1alpha1.EnvoyConfig{
 			Listener: &contour_v1alpha1.EnvoyListenerConfig{
-				UseProxyProto:                 &ctx.useProxyProto,
-				DisableAllowChunkedLength:     &ctx.Config.DisableAllowChunkedLength,
-				DisableMergeSlashes:           &ctx.Config.DisableMergeSlashes,
-				ServerHeaderTransformation:    serverHeaderTransformation,
-				ConnectionBalancer:            ctx.Config.Listener.ConnectionBalancer,
-				PerConnectionBufferLimitBytes: ctx.Config.Listener.PerConnectionBufferLimitBytes,
-				MaxRequestsPerConnection:      ctx.Config.Listener.MaxRequestsPerConnection,
-				MaxRequestsPerIOCycle:         ctx.Config.Listener.MaxRequestsPerIOCycle,
-				HTTP2MaxConcurrentStreams:     ctx.Config.Listener.HTTP2MaxConcurrentStreams,
-				MaxConnectionsPerListener:     ctx.Config.Listener.MaxConnectionsPerListener,
-                                MaxConnectionsToAcceptPerSocketEvent: ctx.Config.Listener.MaxConnectionsToAcceptPerSocketEvent,
+				UseProxyProto:                        &ctx.useProxyProto,
+				DisableAllowChunkedLength:            &ctx.Config.DisableAllowChunkedLength,
+				DisableMergeSlashes:                  &ctx.Config.DisableMergeSlashes,
+				ServerHeaderTransformation:           serverHeaderTransformation,
+				ConnectionBalancer:                   ctx.Config.Listener.ConnectionBalancer,
+				PerConnectionBufferLimitBytes:        ctx.Config.Listener.PerConnectionBufferLimitBytes,
+				MaxRequestsPerConnection:             ctx.Config.Listener.MaxRequestsPerConnection,
+				MaxRequestsPerIOCycle:                ctx.Config.Listener.MaxRequestsPerIOCycle,
+				HTTP2MaxConcurrentStreams:            ctx.Config.Listener.HTTP2MaxConcurrentStreams,
+				MaxConnectionsPerListener:            ctx.Config.Listener.MaxConnectionsPerListener,
+				MaxConnectionsToAcceptPerSocketEvent: ctx.Config.Listener.MaxConnectionsToAcceptPerSocketEvent,
 				TLS: &contour_v1alpha1.EnvoyTLS{
 					MinimumProtocolVersion: ctx.Config.TLS.MinimumProtocolVersion,
 					MaximumProtocolVersion: ctx.Config.TLS.MaximumProtocolVersion,
diff --git a/design/external-authorization-design.md b/design/external-authorization-design.md
@@ -34,7 +34,7 @@ This document describes a design for performing request authorization for virtua
 A new `ExtensionService` CRD adds a way to represent and track an authorization service.
 This CRD is relatively generic, so that it can be reused for Envoy rate limiting and logging services.
 The core of the `ExtensionService` CRD is subset of the `projectcontour.v1.HTTPProxy` `Service` specification.
-Re-using the `Service` type allows the operator to specify configuration in familiar and consistent terms, especially TLS configuration.
+Reusing the `Service` type allows the operator to specify configuration in familiar and consistent terms, especially TLS configuration.
 
 Note that only the Envoy [GRPC authorization protocol][2] will be supported.
 The GRPC protocol is a superset of the HTTP protocol and requires less configuration.
diff --git a/examples/contour/01-crds.yaml b/examples/contour/01-crds.yaml
@@ -326,6 +326,13 @@ spec:
                         format: int32
                         minimum: 1
                         type: integer
+                      maxConnectionsToAcceptPerSocketEvent:
+                        description: |-
+                          MaxConnectionsToAcceptPerSocketEvent defines the maximum number of
+                          connections Envoy will accept per socket event.
+                        format: int32
+                        minimum: 1
+                        type: integer
                       maxRequestsPerConnection:
                         description: |-
                           Defines the maximum requests for downstream connections. If not specified, there is no limit.
@@ -4220,6 +4227,13 @@ spec:
                             format: int32
                             minimum: 1
                             type: integer
+                          maxConnectionsToAcceptPerSocketEvent:
+                            description: |-
+                              MaxConnectionsToAcceptPerSocketEvent defines the maximum number of
+                              connections Envoy will accept per socket event.
+                            format: int32
+                            minimum: 1
+                            type: integer
                           maxRequestsPerConnection:
                             description: |-
                               Defines the maximum requests for downstream connections. If not specified, there is no limit.
diff --git a/examples/render/contour-deployment.yaml b/examples/render/contour-deployment.yaml
@@ -546,6 +546,13 @@ spec:
                         format: int32
                         minimum: 1
                         type: integer
+                      maxConnectionsToAcceptPerSocketEvent:
+                        description: |-
+                          MaxConnectionsToAcceptPerSocketEvent defines the maximum number of
+                          connections Envoy will accept per socket event.
+                        format: int32
+                        minimum: 1
+                        type: integer
                       maxRequestsPerConnection:
                         description: |-
                           Defines the maximum requests for downstream connections. If not specified, there is no limit.
@@ -4440,6 +4447,13 @@ spec:
                             format: int32
                             minimum: 1
                             type: integer
+                          maxConnectionsToAcceptPerSocketEvent:
+                            description: |-
+                              MaxConnectionsToAcceptPerSocketEvent defines the maximum number of
+                              connections Envoy will accept per socket event.
+                            format: int32
+                            minimum: 1
+                            type: integer
                           maxRequestsPerConnection:
                             description: |-
                               Defines the maximum requests for downstream connections. If not specified, there is no limit.
diff --git a/examples/render/contour-gateway-provisioner.yaml b/examples/render/contour-gateway-provisioner.yaml
@@ -337,6 +337,13 @@ spec:
                         format: int32
                         minimum: 1
                         type: integer
+                      maxConnectionsToAcceptPerSocketEvent:
+                        description: |-
+                          MaxConnectionsToAcceptPerSocketEvent defines the maximum number of
+                          connections Envoy will accept per socket event.
+                        format: int32
+                        minimum: 1
+                        type: integer
                       maxRequestsPerConnection:
                         description: |-
                           Defines the maximum requests for downstream connections. If not specified, there is no limit.
@@ -4231,6 +4238,13 @@ spec:
                             format: int32
                             minimum: 1
                             type: integer
+                          maxConnectionsToAcceptPerSocketEvent:
+                            description: |-
+                              MaxConnectionsToAcceptPerSocketEvent defines the maximum number of
+                              connections Envoy will accept per socket event.
+                            format: int32
+                            minimum: 1
+                            type: integer
                           maxRequestsPerConnection:
                             description: |-
                               Defines the maximum requests for downstream connections. If not specified, there is no limit.
diff --git a/examples/render/contour-gateway.yaml b/examples/render/contour-gateway.yaml
@@ -362,6 +362,13 @@ spec:
                         format: int32
                         minimum: 1
                         type: integer
+                      maxConnectionsToAcceptPerSocketEvent:
+                        description: |-
+                          MaxConnectionsToAcceptPerSocketEvent defines the maximum number of
+                          connections Envoy will accept per socket event.
+                        format: int32
+                        minimum: 1
+                        type: integer
                       maxRequestsPerConnection:
                         description: |-
                           Defines the maximum requests for downstream connections. If not specified, there is no limit.
@@ -4256,6 +4263,13 @@ spec:
                             format: int32
                             minimum: 1
                             type: integer
+                          maxConnectionsToAcceptPerSocketEvent:
+                            description: |-
+                              MaxConnectionsToAcceptPerSocketEvent defines the maximum number of
+                              connections Envoy will accept per socket event.
+                            format: int32
+                            minimum: 1
+                            type: integer
                           maxRequestsPerConnection:
                             description: |-
                               Defines the maximum requests for downstream connections. If not specified, there is no limit.
diff --git a/examples/render/contour.yaml b/examples/render/contour.yaml
@@ -546,6 +546,13 @@ spec:
                         format: int32
                         minimum: 1
                         type: integer
+                      maxConnectionsToAcceptPerSocketEvent:
+                        description: |-
+                          MaxConnectionsToAcceptPerSocketEvent defines the maximum number of
+                          connections Envoy will accept per socket event.
+                        format: int32
+                        minimum: 1
+                        type: integer
                       maxRequestsPerConnection:
                         description: |-
                           Defines the maximum requests for downstream connections. If not specified, there is no limit.
@@ -4440,6 +4447,13 @@ spec:
                             format: int32
                             minimum: 1
                             type: integer
+                          maxConnectionsToAcceptPerSocketEvent:
+                            description: |-
+                              MaxConnectionsToAcceptPerSocketEvent defines the maximum number of
+                              connections Envoy will accept per socket event.
+                            format: int32
+                            minimum: 1
+                            type: integer
                           maxRequestsPerConnection:
                             description: |-
                               Defines the maximum requests for downstream connections. If not specified, there is no limit.
diff --git a/internal/dag/httpproxy_processor.go b/internal/dag/httpproxy_processor.go
@@ -1434,7 +1434,7 @@ func (p *HTTPProxyProcessor) computeVirtualHostAuthorization(auth *contour_v1.Au
 			if len(auth.HTTPServerSettings.AllowedAuthorizationHeaders) > 0 {
 				if err := ExternalAuthAllowedHeadersValid(auth.HTTPServerSettings.AllowedAuthorizationHeaders); err != nil {
 					validCond.AddErrorf(contour_v1.ConditionTypeAuthError, "AuthBadAllowedHeader",
-						err.Error())
+						"allowed authorization headers validation failed: %v", err)
 
 					return nil
 				}
@@ -1445,7 +1445,7 @@ func (p *HTTPProxyProcessor) computeVirtualHostAuthorization(auth *contour_v1.Au
 			if len(auth.HTTPServerSettings.AllowedUpstreamHeaders) > 0 {
 				if err := ExternalAuthAllowedHeadersValid(auth.HTTPServerSettings.AllowedUpstreamHeaders); err != nil {
 					validCond.AddErrorf(contour_v1.ConditionTypeAuthError, "AuthBadAllowedHeader",
-						err.Error())
+						"allowed upstream headers validation failed: %v", err)
 
 					return nil
 				}
diff --git a/internal/xdscache/v3/listener.go b/internal/xdscache/v3/listener.go
@@ -23,6 +23,7 @@ import (
 	envoy_transport_socket_tls_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
 	resource "github.com/envoyproxy/go-control-plane/pkg/resource/v3"
 	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/wrapperspb"
 	"k8s.io/apimachinery/pkg/types"
 
 	contour_v1 "github.com/projectcontour/contour/apis/projectcontour/v1"
@@ -35,7 +36,6 @@ import (
 	"github.com/projectcontour/contour/internal/sorter"
 	"github.com/projectcontour/contour/internal/timeout"
 	"github.com/projectcontour/contour/pkg/config"
-        "google.golang.org/protobuf/types/known/wrapperspb"
 )
 
 // nolint:revive
@@ -152,9 +152,9 @@ type ListenerConfig struct {
 
 	// SocketOptions configures socket options HTTP and HTTPS listeners.
 	SocketOptions *contour_v1alpha1.SocketOptions
-  
-        // MaxConnectionsToAcceptPerSocketEvent defines how many new connections to accept per socket event loop iteration.
-        MaxConnectionsToAcceptPerSocketEvent *uint32
+
+	// MaxConnectionsToAcceptPerSocketEvent defines how many new connections to accept per socket event loop iteration.
+	MaxConnectionsToAcceptPerSocketEvent *uint32
 }
 
 type ExtensionServiceConfig struct {
@@ -614,13 +614,13 @@ func (c *ListenerCache) OnChange(root *dag.DAG) {
 			}
 		}
 	}
-       
-        // 2. max_connections_to_accept_per_socket_event
-        if cfg.MaxConnectionsToAcceptPerSocketEvent != nil {
-	    for _, listener := range listeners {
-		listener.MaxConnectionsToAcceptPerSocketEvent = wrapperspb.UInt32(*cfg.MaxConnectionsToAcceptPerSocketEvent)
-	    }
-        }
+
+	// 2. max_connections_to_accept_per_socket_event
+	if cfg.MaxConnectionsToAcceptPerSocketEvent != nil {
+		for _, listener := range listeners {
+			listener.MaxConnectionsToAcceptPerSocketEvent = wrapperspb.UInt32(*cfg.MaxConnectionsToAcceptPerSocketEvent)
+		}
+	}
 
 	c.Update(listeners)
 }
diff --git a/pkg/config/parameters.go b/pkg/config/parameters.go
diff --git a/site/content/docs/main/config/api-reference.html b/site/content/docs/main/config/api-reference.html
