倉庫指標
- Star
- (27,997 star)
- PR 合併指標
- (平均合併 8天) (30 天內合併 378 個 PR)
描述
Background: The envoy as ingressgateway is multi-tenancy, and it's possible that partial of the dependencies are never ready.
- In istio envoy proxy is now widely used as gateway to terminate SSL connection with lots of unique TLS certificates from everywhere.
- The wasm-plugin of particular filter chains are broken.
Current Implementation: On-Demand Filter Chain: https://github.com/envoyproxy/envoy/pull/12310 Design Doc: https://docs.google.com/document/d/1MzmNFpgGQA2USCaZFBoVhB9CgJgq5qUsBO8ED_WIgXo/edit
Description: The current logic is that workers can not have listeners work until all dependencies (like network filter chains) ready to make listeners active. But it is common that warming-up listeners have most filter chains ready while waiting a long time for one or two remaining unready certs or filter chains to make the listener active.
One possible optimization here is that we put warming-up listeners with partial ready filter chains into work and use fake filter chains as placeholders for those unready ones. Then we gradually update/replace those fake filter chains (placeholders) with newly ready filter chains.
When a new connection is arriving, if the filter chain matched is ready, just start the connection. Otherwise if a filter chain is not ready(is a fake placeholder), we use some strategies to process the coming connection.
- Reject this connection for now. Request rebuilding this filter chain.
- Use the old(drained) active listener's filter chain to start connection.
Here is a diagram illustrating the outline of this task:
