feat: add admission control to BackendTrafficPolicy by jukie · Pull Request #8872 · envoyproxy/gateway

jukie · 2026-04-27T22:13:10Z

What this PR does / why we need it:

This carries forward #7529 from @aburan28

This PR adds support for Envoy's Admission Control filter to Envoy Gateway by exposing it through BackendTrafficPolicy.

Admission control probabilistically rejects requests based on the historical success rate of upstream requests within a configurable sliding time window. This provides client-side load shedding for overloaded or degraded backends and complements circuit breaking and retry policies.

Changes include

API types: adds AdmissionControl with configurable samplingWindow, successRateThreshold, aggression, rpsThreshold, maxRejectionProbability, and success criteria for HTTP and gRPC.
BackendTrafficPolicy API: adds the optional admissionControl field.
Gateway API translation: translates admission-control policy config into XDS IR traffic features.
XDS translation: configures Envoy's envoy.filters.http.admission_control as an upstream HTTP filter on generated clusters.
EnvoyFilter registration: registers envoy.filters.http.admission_control as a known Envoy filter.
Generated artifacts: updates CRDs, deepcopy methods, Helm golden output, and API docs.
Tests and examples: adds xDS translator coverage, Gateway API testdata, and a Kubernetes example manifest.

Release Notes: Yes

Signed-off-by: Adam Buran <aburan28@gmail.com>

- Change SamplingWindow from *metav1.Duration to *gwapiv1.Duration to satisfy kube-api-linter (nodurations rule) - Add parseSamplingWindow converter in gateway API translator to convert gwapiv1.Duration to metav1.Duration for the IR - Fix unused-parameter lint errors in patchRoute and patchResources by renaming unused params to _ - Regenerate deepcopy, CRD manifests, helm test outputs, and API docs Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Adam Buran <aburan28@gmail.com>

Signed-off-by: Adam Buran <aburan28@gmail.com>

Fix merge conflicts from rebase onto upstream/main, fix missing imports in admission control tests, and ensure EvaluationCriteria is always set in the admission control config. Signed-off-by: Adam Buran <aburan28@gmail.com>

- Remove Enabled field (presence of admissionControl implies enabled) - Switch SuccessRateThreshold, Aggression, MaxRejectionProbability from float64 to uint32 to avoid floats in the API layer - Register envoy.filters.http.admission_control in the EnvoyFilter enum - Fix example manifest (srThreshold -> successRateThreshold, integer values) - Regenerate CRDs, deepcopy, docs, and xds translator testdata Signed-off-by: Adam Buran <aburan28@gmail.com>

Remove stale lbPolicy field from cluster output after main merge. Signed-off-by: Adam Buran <aburan28@gmail.com>

Regenerates test/helm/gateway-crds-helm/*.out.yaml and site/content/en/latest/api/extension_types.md to match the current admission control API (int32 percentages, enabled field removed) and pick up envoy.filters.http.admission_control in the filter order enum. Signed-off-by: Adam Buran <aburan28@gmail.com>

…-control Signed-off-by: Adam Buran <aburan28@gmail.com>

…igo lint Signed-off-by: Adam Buran <aburan28@gmail.com>

…map, add gatewayapi testdata - Revert the HCM HTTP filter ordering shifts in newOrderedHTTPFilter; the admission_control filter is registered as an upstream cluster filter, so it does not need a slot in the downstream HCM ordering. - Move the gRPC status-code lookup map to a package-level var so it is not rebuilt on every translation cycle. - Add backendtrafficpolicy-admission-control gatewayapi testdata covering both gateway-targeted (gRPC success criteria, all knobs set) and route-targeted (HTTP success criteria, minimal config) policies. Signed-off-by: Adam Buran <adam.buran@gmail.com> Signed-off-by: Adam Buran <aburan28@gmail.com>

Signed-off-by: Adam Buran <aburan28@gmail.com>

Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>

netlify · 2026-04-27T22:13:15Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`d9e91ff`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69efe4562163490008b0cda3
😎 Deploy Preview	https://deploy-preview-8872--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d59ae24657

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codecov · 2026-04-27T22:26:06Z

Codecov Report

❌ Patch coverage is 93.61702% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.39%. Comparing base (8570285) to head (d9e91ff).

Files with missing lines	Patch %	Lines
internal/gatewayapi/backendtrafficpolicy.go	93.33%	1 Missing and 1 partial ⚠️
internal/xds/translator/admission_control.go	96.42%	1 Missing and 1 partial ⚠️
internal/xds/translator/cluster.go	71.42%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8872      +/-   ##
==========================================
+ Coverage   74.36%   74.39%   +0.02%     
==========================================
  Files         246      247       +1     
  Lines       39292    39385      +93     
==========================================
+ Hits        29221    29300      +79     
- Misses       8041     8049       +8     
- Partials     2030     2036       +6

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>

jukie · 2026-04-27T22:34:05Z

@codex

chatgpt-codex-connector · 2026-04-27T22:45:09Z

Codex Review: Didn't find any major issues. You're on a roll.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

zhaohuabing · 2026-04-28T04:20:08Z

+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// AdmissionControl defines the admission control policy to be applied.


Non-blocking nit: the comments could be made clearer to make them easier for users to understand.

Suggested change

// AdmissionControl defines the admission control policy to be applied.

// AdmissionControl configures health-based load shedding for upstream backends.

//

// Envoy tracks recent upstream responses over a sliding sampling window. When the

// observed success rate drops below the configured threshold, Envoy

// probabilistically rejects new requests before forwarding them upstream. This can

// reduce pressure on degraded backends and give them time to recover.

//

// All fields are optional. When omitted, Envoy's admission control defaults are used.

zhaohuabing · 2026-04-28T04:28:34Z

+	//
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	RPSThreshold *uint32 `json:"rpsThreshold,omitempty"`


Nit: A more explicit name like minTrafficThreshold is easier to understand for a user-facing API.

zhaohuabing · 2026-04-28T04:33:20Z

+	//
+	// +optional
+	SuccessCriteria *AdmissionControlSuccessCriteria `json:"successCriteria,omitempty"`
+}


This API is flat, and some of the field names inherited from the Envoy config aren’t very intuitive, which makes it a bit harder to read. How about(the names are not final, just for discussion):

admissionControl: samplingWindow: 30s minRequestRate: 10 successRateThreshold: 90 rejection: maxRejectionPercent: 80 rampFactor: 2 successCriteria: http: statusCodes: - 200 - 201 - 204 grpc: statusCodes: - OK - UNAVAILABLE

Do we have any existing fields you feel would be closer to the aggression Envoy description? I didn't see any How about rejectionSensitivity?

This would add a nested layer for just two fields so I'd prefer just keeping flat here but I'm willing to change it.

zhaohuabing · 2026-04-28T04:57:09Z

+	// Defaults to 30s if not specified.
+	//
+	// +optional
+	SamplingWindow *gwapiv1.Duration `json:"samplingWindow,omitempty"`


Raised by codex: samplingWindow accepts values like 0s and 500ms, and the translator forwards them to Envoy. Envoy truncates the configured window to whole seconds and later divides request count by that second count in admission-control RPS calculation, so these accepted values can produce a zero-second denominator after traffic is recorded. Add validation requiring at least 1s, with CEL coverage for 0s and a sub-second value.

zhaohuabing · 2026-04-28T05:00:09Z

 	EnvoyFilterFault EnvoyFilter = "envoy.filters.http.fault"

+	// EnvoyFilterAdmissionControl defines the Envoy HTTP admission control filter.
+	EnvoyFilterAdmissionControl EnvoyFilter = "envoy.filters.http.admission_control"


The AdmissionControl filter should not be exposed here. It's used as an upstream filter, and it can't be reordered like other HCM filters.

aburan28 and others added 26 commits March 30, 2026 14:50

add admission control functionality

ae64948

Signed-off-by: Adam Buran <aburan28@gmail.com>

add admission control functionality crds

fead370

Signed-off-by: Adam Buran <aburan28@gmail.com>

fix the lint errors

ed7451d

Signed-off-by: Adam Buran <aburan28@gmail.com>

incorporate some feedback

0fca7f5

Signed-off-by: Adam Buran <aburan28@gmail.com>

update helm template test outputs after merge with upstream/main

ce38d07

Signed-off-by: Adam Buran <aburan28@gmail.com>

use envoy defaults

eef4e1a

Signed-off-by: Adam Buran <aburan28@gmail.com>

use envoy defaults

24f177b

Signed-off-by: Adam Buran <aburan28@gmail.com>

add out files

37b648f

Signed-off-by: Adam Buran <aburan28@gmail.com>

add testdata gen

a75dfac

Signed-off-by: Adam Buran <aburan28@gmail.com>

regenerate crds

4988451

Signed-off-by: Adam Buran <aburan28@gmail.com>

setup admission control as http upstream filter

3f7d253

Signed-off-by: Adam Buran <aburan28@gmail.com>

change to aggression

3696a2c

Signed-off-by: Adam Buran <aburan28@gmail.com>

change to aggression

566c3a9

Signed-off-by: Adam Buran <aburan28@gmail.com>

fix: resolve rebase conflicts and regenerate testdata

a16039d

Fix merge conflicts from rebase onto upstream/main, fix missing imports in admission control tests, and ensure EvaluationCriteria is always set in the admission control config. Signed-off-by: Adam Buran <aburan28@gmail.com>

Merge branch 'main' into adam--add-admission-control

6545ecc

test: regenerate admission-control testdata

97fc2da

Remove stale lbPolicy field from cluster output after main merge. Signed-off-by: Adam Buran <aburan28@gmail.com>

Merge remote-tracking branch 'upstream/main' into adam--add-admission…

2a8a41a

…-control Signed-off-by: Adam Buran <aburan28@gmail.com>

fix(admission-control): use new() instead of ptr.To to satisfy forbid…

a65fc3d

…igo lint Signed-off-by: Adam Buran <aburan28@gmail.com>

Remove namespace from admission control targetRef

7b7bfdb

Signed-off-by: Adam Buran <aburan28@gmail.com>

Address admission control review feedback

16fc1f4

Signed-off-by: Adam Buran <aburan28@gmail.com>

Merge branch 'main' into adam--add-admission-control

80c8975

Merge branch main into adam--add-admission-control

42a3dd0

Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>

jukie changed the title ~~Admission control~~ feat: add admission control to BackendTrafficPolicy Apr 27, 2026

Release note

d59ae24

Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>

jukie marked this pull request as ready for review April 27, 2026 22:17

jukie requested a review from a team as a code owner April 27, 2026 22:17

jukie added this to the v1.8.0-rc.1 Release milestone Apr 27, 2026

chatgpt-codex-connector Bot reviewed Apr 27, 2026

View reviewed changes

Comment thread api/v1alpha1/backendtrafficpolicy_types.go

CEL filtering for route types

d9e91ff

Signed-off-by: jukie <10012479+jukie@users.noreply.github.com>

arkodg approved these changes Apr 27, 2026

View reviewed changes

arkodg requested review from a team April 27, 2026 23:42

zhaohuabing reviewed Apr 28, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add admission control to BackendTrafficPolicy#8872

feat: add admission control to BackendTrafficPolicy#8872
jukie wants to merge 28 commits intoenvoyproxy:mainfrom
jukie:admission-control

jukie commented Apr 27, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Apr 27, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

codecov Bot commented Apr 27, 2026 •

edited

Loading

Uh oh!

jukie commented Apr 27, 2026

Uh oh!

chatgpt-codex-connector Bot commented Apr 27, 2026

Uh oh!

zhaohuabing Apr 28, 2026

Uh oh!

zhaohuabing Apr 28, 2026 •

edited

Loading

Uh oh!

zhaohuabing Apr 28, 2026 •

edited

Loading

Uh oh!

jukie Apr 28, 2026

Uh oh!

zhaohuabing Apr 28, 2026

Uh oh!

zhaohuabing Apr 28, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

-// AdmissionControl defines the admission control policy to be applied.
+// AdmissionControl configures health-based load shedding for upstream backends.
+//
+// Envoy tracks recent upstream responses over a sliding sampling window. When the
+// observed success rate drops below the configured threshold, Envoy
+// probabilistically rejects new requests before forwarding them upstream. This can
+// reduce pressure on degraded backends and give them time to recover.
+//
+// All fields are optional. When omitted, Envoy's admission control defaults are used.

Conversation

jukie commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes include

Uh oh!

netlify Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

codecov Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jukie commented Apr 27, 2026

Uh oh!

chatgpt-codex-connector Bot commented Apr 27, 2026

Uh oh!

zhaohuabing Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jukie Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jukie commented Apr 27, 2026 •

edited

Loading

netlify Bot commented Apr 27, 2026 •

edited

Loading

codecov Bot commented Apr 27, 2026 •

edited

Loading

zhaohuabing Apr 28, 2026 •

edited

Loading

zhaohuabing Apr 28, 2026 •

edited

Loading

zhaohuabing Apr 28, 2026 •

edited

Loading