Skip to content

envoy: fix one connection per downstream plus cleanups - #2213

Merged
Bowei Du (bowei) merged 2 commits into
agent-substrate:mainfrom
LiorLieberman:egress-pool-per-tunnel
Oct 6, 2026
Merged

Bowei Du (bowei) merged 2 commits into
agent-substrate:mainfrom
LiorLieberman:egress-pool-per-tunnel

Conversation

@LiorLieberman

Copy link
Copy Markdown
Collaborator

Fix an issue where connection pool and state was reused in a wrong way that caused wrong policy evaluation.

Also, sets a 30s TCP idle timeout on mitm_internal. A pool now belongs to a single tunnel, so any connection its tunnel leaves behind will never be used again. Without the setting, Envoy keeps that pool for its 10-minute default.

Fixes #<issue_number_goes_here>

It's a good idea to open an issue first for discussion.

  • Tests pass
  • Appropriate changes to documentation are included in the PR

# One CONNECT per connection: the filter state internal_upstream copies
# belongs to the tunnel this connection was made for, and a reused
# connection would carry it into the next tunnel.
# One pool per tunnel. A pool gives every connection it opens the

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok with this change, but as I understand, this still seems a bit fragile.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I'm working to make it more efficient

@yanavlasov

Copy link
Copy Markdown
Collaborator

Lior Lieberman (@LiorLieberman) do you have e2e tests for this change?

@LiorLieberman

Copy link
Copy Markdown
Collaborator Author

Lior Lieberman (Lior Lieberman (@LiorLieberman)) do you have e2e tests for this change?

you mean beyond TestEgressManifestsGiveEachTunnelItsOwnInnerPool ?

@bowei
Bowei Du (bowei) added this pull request to the merge queue Oct 5, 2026
Merged via the queue into agent-substrate:main with commit 793929d Oct 6, 2026
15 checks passed
@yanavlasov

Copy link
Copy Markdown
Collaborator

Lior Lieberman (Lior Lieberman (Lior Lieberman (@LiorLieberman))) do you have e2e tests for this change?

you mean beyond TestEgressManifestsGiveEachTunnelItsOwnInnerPool ?

Yes, e2e tests would be good. I can add it to my PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants