.. _envoy_v3_api_file_envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto: HTTP connection manager ======================= This documentation is for the Envoy v3 API. As of Envoy v1.18 the v2 API has been removed and is no longer supported. If you are upgrading from v2 API config you may wish to view the v2 API documentation: :ref:`config/filter/network/http_connection_manager/v2/http_connection_manager.proto ` .. _extension_envoy.filters.network.http_connection_manager: This extension may be referenced by the qualified name ``envoy.filters.network.http_connection_manager`` .. note:: This extension is intended to be robust against untrusted downstream traffic. It assumes that the upstream is trusted. .. tip:: This extension extends and can be used with the following extension category: - :ref:`envoy.filters.network ` HTTP connection manager :ref:`configuration overview `. .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager: extensions.filters.network.http_connection_manager.v3.HttpConnectionManager --------------------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.HttpConnectionManager proto] ` .. code-block:: json { "codec_type": "...", "stat_prefix": "...", "rds": "{...}", "route_config": "{...}", "scoped_routes": "{...}", "http_filters": [], "add_user_agent": "{...}", "tracing": "{...}", "common_http_protocol_options": "{...}", "http_protocol_options": "{...}", "http2_protocol_options": "{...}", "server_name": "...", "server_header_transformation": "...", "scheme_header_transformation": "{...}", "max_request_headers_kb": "{...}", "stream_idle_timeout": "{...}", "request_timeout": "{...}", "request_headers_timeout": "{...}", "drain_timeout": "{...}", "delayed_close_timeout": "{...}", "access_log": [], "use_remote_address": "{...}", "xff_num_trusted_hops": "...", "original_ip_detection_extensions": [], "internal_address_config": "{...}", "skip_xff_append": "...", "via": "...", "generate_request_id": "{...}", "preserve_external_request_id": "...", "always_set_request_id_in_response": "...", "forward_client_cert_details": "...", "set_current_client_cert_details": "{...}", "proxy_100_continue": "...", "upgrade_configs": [], "normalize_path": "{...}", "merge_slashes": "...", "path_with_escaped_slashes_action": "...", "request_id_extension": "{...}", "local_reply_config": "{...}", "strip_matching_host_port": "...", "strip_any_host_port": "...", "stream_error_on_invalid_http_message": "{...}", "strip_trailing_host_dot": "...", "proxy_status_config": "{...}" } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.codec_type: codec_type (:ref:`extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.CodecType `) Supplies the type of codec that the connection manager should use. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.stat_prefix: stat_prefix (`string `_, *REQUIRED*) The human readable prefix to use when emitting statistics for the connection manager. See the :ref:`statistics documentation ` for more information. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.rds: rds (:ref:`extensions.filters.network.http_connection_manager.v3.Rds `) The connection manager’s route table will be dynamically loaded via the RDS API. Precisely one of :ref:`rds `, :ref:`route_config `, :ref:`scoped_routes ` must be set. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.route_config: route_config (:ref:`config.route.v3.RouteConfiguration `) The route table for the connection manager is static and is specified in this property. Precisely one of :ref:`rds `, :ref:`route_config `, :ref:`scoped_routes ` must be set. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.scoped_routes: scoped_routes (:ref:`extensions.filters.network.http_connection_manager.v3.ScopedRoutes `) A route table will be dynamically assigned to each request based on request attributes (e.g., the value of a header). The "routing scopes" (i.e., route tables) and "scope keys" are specified in this message. Precisely one of :ref:`rds `, :ref:`route_config `, :ref:`scoped_routes ` must be set. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.http_filters: http_filters (**repeated** :ref:`extensions.filters.network.http_connection_manager.v3.HttpFilter `) A list of individual HTTP filters that make up the filter chain for requests made to the connection manager. :ref:`Order matters ` as the filters are processed sequentially as request events happen. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.add_user_agent: add_user_agent (`BoolValue `_) Whether the connection manager manipulates the :ref:`config_http_conn_man_headers_user-agent` and :ref:`config_http_conn_man_headers_downstream-service-cluster` headers. See the linked documentation for more information. Defaults to false. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.tracing: tracing (:ref:`extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing `) Presence of the object defines whether the connection manager emits :ref:`tracing ` data to the :ref:`configured tracing provider `. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.common_http_protocol_options: common_http_protocol_options (:ref:`config.core.v3.HttpProtocolOptions `) Additional settings for HTTP requests handled by the connection manager. These will be applicable to both HTTP1 and HTTP2 requests. .. attention:: This field should be configured in the presence of untrusted *downstreams*. Example configuration for untrusted environments: .. code-block:: yaml common_http_protocol_options: headers_with_underscores_action: REJECT_REQUEST idle_timeout: 900s .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.http_protocol_options: http_protocol_options (:ref:`config.core.v3.Http1ProtocolOptions `) Additional HTTP/1 settings that are passed to the HTTP/1 codec. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.http2_protocol_options: http2_protocol_options (:ref:`config.core.v3.Http2ProtocolOptions `) Additional HTTP/2 settings that are passed directly to the HTTP/2 codec. .. attention:: This field should be configured in the presence of untrusted *downstreams*. Example configuration for untrusted environments: .. code-block:: yaml http2_protocol_options: initial_connection_window_size: 1048576.0 initial_stream_window_size: 65536.0 max_concurrent_streams: 100.0 .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.server_name: server_name (`string `_) An optional override that the connection manager will write to the server header in responses. If not set, the default is *envoy*. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.server_header_transformation: server_header_transformation (:ref:`extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ServerHeaderTransformation `) Defines the action to be applied to the Server header on the response path. By default, Envoy will overwrite the header with the value specified in server_name. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.scheme_header_transformation: scheme_header_transformation (:ref:`config.core.v3.SchemeHeaderTransformation `) Allows for explicit transformation of the :scheme header on the request path. If not set, Envoy's default :ref:`scheme ` handling applies. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.max_request_headers_kb: max_request_headers_kb (`UInt32Value `_) The maximum request headers size for incoming connections. If unconfigured, the default max request headers allowed is 60 KiB. Requests that exceed this limit will receive a 431 response. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.stream_idle_timeout: stream_idle_timeout (`Duration `_) The stream idle timeout for connections managed by the connection manager. If not specified, this defaults to 5 minutes. The default value was selected so as not to interfere with any smaller configured timeouts that may have existed in configurations prior to the introduction of this feature, while introducing robustness to TCP connections that terminate without a FIN. This idle timeout applies to new streams and is overridable by the :ref:`route-level idle_timeout `. Even on a stream in which the override applies, prior to receipt of the initial request headers, the :ref:`stream_idle_timeout ` applies. Each time an encode/decode event for headers or data is processed for the stream, the timer will be reset. If the timeout fires, the stream is terminated with a 408 Request Timeout error code if no upstream response header has been received, otherwise a stream reset occurs. This timeout also specifies the amount of time that Envoy will wait for the peer to open enough window to write any remaining stream data once the entirety of stream data (local end stream is true) has been buffered pending available window. In other words, this timeout defends against a peer that does not release enough window to completely write the stream, even though all data has been proxied within available flow control windows. If the timeout is hit in this case, the :ref:`tx_flush_timeout ` counter will be incremented. Note that :ref:`max_stream_duration ` does not apply to this corner case. If the :ref:`overload action ` "envoy.overload_actions.reduce_timeouts" is configured, this timeout is scaled according to the value for :ref:`HTTP_DOWNSTREAM_STREAM_IDLE `. Note that it is possible to idle timeout even if the wire traffic for a stream is non-idle, due to the granularity of events presented to the connection manager. For example, while receiving very large request headers, it may be the case that there is traffic regularly arriving on the wire while the connection manage is only able to observe the end-of-headers event, hence the stream may still idle timeout. A value of 0 will completely disable the connection manager stream idle timeout, although per-route idle timeout overrides will continue to apply. .. attention:: This field should be configured in the presence of untrusted *downstreams*. Example configuration for untrusted environments: .. code-block:: yaml stream_idle_timeout: 300s .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.request_timeout: request_timeout (`Duration `_) The amount of time that Envoy will wait for the entire request to be received. The timer is activated when the request is initiated, and is disarmed when the last byte of the request is sent upstream (i.e. all decoding filters have processed the request), OR when the response is initiated. If not specified or set to 0, this timeout is disabled. .. attention:: This field should be configured in the presence of untrusted *downstreams*. This timeout is not compatible with streaming requests. Example configuration for untrusted environments: .. code-block:: yaml request_timeout: 300s .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.request_headers_timeout: request_headers_timeout (`Duration `_) The amount of time that Envoy will wait for the request headers to be received. The timer is activated when the first byte of the headers is received, and is disarmed when the last byte of the headers has been received. If not specified or set to 0, this timeout is disabled. .. attention:: This field should be configured in the presence of untrusted *downstreams*. Example configuration for untrusted environments: .. code-block:: yaml request_headers_timeout: 10s .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.drain_timeout: drain_timeout (`Duration `_) The time that Envoy will wait between sending an HTTP/2 “shutdown notification” (GOAWAY frame with max stream ID) and a final GOAWAY frame. This is used so that Envoy provides a grace period for new streams that race with the final GOAWAY frame. During this grace period, Envoy will continue to accept new streams. After the grace period, a final GOAWAY frame is sent and Envoy will start refusing new streams. Draining occurs both when a connection hits the idle timeout or during general server draining. The default grace period is 5000 milliseconds (5 seconds) if this option is not specified. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.delayed_close_timeout: delayed_close_timeout (`Duration `_) The delayed close timeout is for downstream connections managed by the HTTP connection manager. It is defined as a grace period after connection close processing has been locally initiated during which Envoy will wait for the peer to close (i.e., a TCP FIN/RST is received by Envoy from the downstream connection) prior to Envoy closing the socket associated with that connection. NOTE: This timeout is enforced even when the socket associated with the downstream connection is pending a flush of the write buffer. However, any progress made writing data to the socket will restart the timer associated with this timeout. This means that the total grace period for a socket in this state will be +. Delaying Envoy's connection close and giving the peer the opportunity to initiate the close sequence mitigates a race condition that exists when downstream clients do not drain/process data in a connection's receive buffer after a remote close has been detected via a socket write(). This race leads to such clients failing to process the response code sent by Envoy, which could result in erroneous downstream processing. If the timeout triggers, Envoy will close the connection's socket. The default timeout is 1000 ms if this option is not specified. .. NOTE:: To be useful in avoiding the race condition described above, this timeout must be set to *at least* +<100ms to account for a reasonable "worst" case processing time for a full iteration of Envoy's event loop>. .. WARNING:: A value of 0 will completely disable delayed close processing. When disabled, the downstream connection's socket will be closed immediately after the write flush is completed or will never close if the write flush does not complete. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.access_log: access_log (**repeated** :ref:`config.accesslog.v3.AccessLog `) Configuration for :ref:`HTTP access logs ` emitted by the connection manager. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.use_remote_address: use_remote_address (`BoolValue `_) If set to true, the connection manager will use the real remote address of the client connection when determining internal versus external origin and manipulating various headers. If set to false or absent, the connection manager will use the :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header. See the documentation for :ref:`config_http_conn_man_headers_x-forwarded-for`, :ref:`config_http_conn_man_headers_x-envoy-internal`, and :ref:`config_http_conn_man_headers_x-envoy-external-address` for more information. .. attention:: This field should be configured in the presence of untrusted *downstreams*. Example configuration for untrusted environments: .. code-block:: yaml use_remote_address: true .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.xff_num_trusted_hops: xff_num_trusted_hops (`uint32 `_) The number of additional ingress proxy hops from the right side of the :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header to trust when determining the origin client's IP address. The default is zero if this option is not specified. See the documentation for :ref:`config_http_conn_man_headers_x-forwarded-for` for more information. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.original_ip_detection_extensions: original_ip_detection_extensions (**repeated** :ref:`config.core.v3.TypedExtensionConfig `) The configuration for the original IP detection extensions. When configured the extensions will be called along with the request headers and information about the downstream connection, such as the directly connected address. Each extension will then use these parameters to decide the request's effective remote address. If an extension fails to detect the original IP address and isn't configured to reject the request, the HCM will try the remaining extensions until one succeeds or rejects the request. If the request isn't rejected nor any extension succeeds, the HCM will fallback to using the remote address. .. WARNING:: Extensions cannot be used in conjunction with :ref:`use_remote_address ` nor :ref:`xff_num_trusted_hops `. .. _extension_category_envoy.http.original_ip_detection: .. tip:: This extension category has the following known extensions: - :ref:`envoy.http.original_ip_detection.custom_header ` - :ref:`envoy.http.original_ip_detection.xff ` .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.internal_address_config: internal_address_config (:ref:`extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.InternalAddressConfig `) Configures what network addresses are considered internal for stats and header sanitation purposes. If unspecified, only RFC1918 IP addresses will be considered internal. See the documentation for :ref:`config_http_conn_man_headers_x-envoy-internal` for more information about internal/external addresses. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.skip_xff_append: skip_xff_append (`bool `_) If set, Envoy will not append the remote address to the :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header. This may be used in conjunction with HTTP filters that explicitly manipulate XFF after the HTTP connection manager has mutated the request headers. While :ref:`use_remote_address ` will also suppress XFF addition, it has consequences for logging and other Envoy uses of the remote address, so *skip_xff_append* should be used when only an elision of XFF addition is intended. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.via: via (`string `_) Via header value to append to request and response headers. If this is empty, no via header will be appended. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.generate_request_id: generate_request_id (`BoolValue `_) Whether the connection manager will generate the :ref:`x-request-id ` header if it does not exist. This defaults to true. Generating a random UUID4 is expensive so in high throughput scenarios where this feature is not desired it can be disabled. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.preserve_external_request_id: preserve_external_request_id (`bool `_) Whether the connection manager will keep the :ref:`x-request-id ` header if passed for a request that is edge (Edge request is the request from external clients to front Envoy) and not reset it, which is the current Envoy behaviour. This defaults to false. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.always_set_request_id_in_response: always_set_request_id_in_response (`bool `_) If set, Envoy will always set :ref:`x-request-id ` header in response. If this is false or not set, the request ID is returned in responses only if tracing is forced using :ref:`x-envoy-force-trace ` header. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.forward_client_cert_details: forward_client_cert_details (:ref:`extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertDetails `) How to handle the :ref:`config_http_conn_man_headers_x-forwarded-client-cert` (XFCC) HTTP header. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.set_current_client_cert_details: set_current_client_cert_details (:ref:`extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.SetCurrentClientCertDetails `) This field is valid only when :ref:`forward_client_cert_details ` is APPEND_FORWARD or SANITIZE_SET and the client connection is mTLS. It specifies the fields in the client certificate to be forwarded. Note that in the :ref:`config_http_conn_man_headers_x-forwarded-client-cert` header, *Hash* is always set, and *By* is always set when the client certificate presents the URI type Subject Alternative Name value. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.proxy_100_continue: proxy_100_continue (`bool `_) If proxy_100_continue is true, Envoy will proxy incoming "Expect: 100-continue" headers upstream, and forward "100 Continue" responses downstream. If this is false or not set, Envoy will instead strip the "Expect: 100-continue" header, and send a "100 Continue" response itself. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.upgrade_configs: upgrade_configs (**repeated** :ref:`extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.UpgradeConfig `) .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.normalize_path: normalize_path (`BoolValue `_) Should paths be normalized according to RFC 3986 before any processing of requests by HTTP filters or routing? This affects the upstream *:path* header as well. For paths that fail this check, Envoy will respond with 400 to paths that are malformed. This defaults to false currently but will default true in the future. When not specified, this value may be overridden by the runtime variable :ref:`http_connection_manager.normalize_path`. See `Normalization and Comparison `_ for details of normalization. Note that Envoy does not perform `case normalization `_ .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.merge_slashes: merge_slashes (`bool `_) Determines if adjacent slashes in the path are merged into one before any processing of requests by HTTP filters or routing. This affects the upstream *:path* header as well. Without setting this option, incoming requests with path `//dir///file` will not match against route with `prefix` match set to `/dir`. Defaults to `false`. Note that slash merging is not part of `HTTP spec `_ and is provided for convenience. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.path_with_escaped_slashes_action: path_with_escaped_slashes_action (:ref:`extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathWithEscapedSlashesAction `) Action to take when request URL path contains escaped slash sequences (%2F, %2f, %5C and %5c). The default value can be overridden by the :ref:`http_connection_manager.path_with_escaped_slashes_action` runtime variable. The :ref:`http_connection_manager.path_with_escaped_slashes_action_sampling` runtime variable can be used to apply the action to a portion of all requests. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.request_id_extension: request_id_extension (:ref:`extensions.filters.network.http_connection_manager.v3.RequestIDExtension `) The configuration of the request ID extension. This includes operations such as generation, validation, and associated tracing operations. If empty, the :ref:`UuidRequestIdConfig ` default extension is used with default parameters. See the documentation for that extension for details on what it does. Customizing the configuration for the default extension can be achieved by configuring it explicitly here. For example, to disable trace reason packing, the following configuration can be used: .. validated-code-block:: yaml :type-name: envoy.extensions.filters.network.http_connection_manager.v3.RequestIDExtension typed_config: "@type": type.googleapis.com/envoy.extensions.request_id.uuid.v3.UuidRequestIdConfig pack_trace_reason: false .. _extension_category_envoy.request_id: .. tip:: This extension category has the following known extensions: - :ref:`envoy.request_id.uuid ` .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.local_reply_config: local_reply_config (:ref:`extensions.filters.network.http_connection_manager.v3.LocalReplyConfig `) The configuration to customize local reply returned by Envoy. It can customize status code, body text and response content type. If not specified, status code and text body are hard coded in Envoy, the response content type is plain text. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.strip_matching_host_port: strip_matching_host_port (`bool `_) Determines if the port part should be removed from host/authority header before any processing of request by HTTP filters or routing. The port would be removed only if it is equal to the :ref:`listener's` local port. This affects the upstream host header unless the method is CONNECT in which case if no filter adds a port the original port will be restored before headers are sent upstream. Without setting this option, incoming requests with host `example:443` will not match against route with :ref:`domains` match set to `example`. Defaults to `false`. Note that port removal is not part of `HTTP spec `_ and is provided for convenience. Only one of `strip_matching_host_port` or `strip_any_host_port` can be set. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.strip_any_host_port: strip_any_host_port (`bool `_) Determines if the port part should be removed from host/authority header before any processing of request by HTTP filters or routing. This affects the upstream host header unless the method is CONNECT in which case if no filter adds a port the original port will be restored before headers are sent upstream. Without setting this option, incoming requests with host `example:443` will not match against route with :ref:`domains` match set to `example`. Defaults to `false`. Note that port removal is not part of `HTTP spec `_ and is provided for convenience. Only one of `strip_matching_host_port` or `strip_any_host_port` can be set. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.stream_error_on_invalid_http_message: stream_error_on_invalid_http_message (`BoolValue `_) Governs Envoy's behavior when receiving invalid HTTP from downstream. If this option is false (default), Envoy will err on the conservative side handling HTTP errors, terminating both HTTP/1.1 and HTTP/2 connections when receiving an invalid request. If this option is set to true, Envoy will be more permissive, only resetting the invalid stream in the case of HTTP/2 and leaving the connection open where possible (if the entire request is read for HTTP/1.1) In general this should be true for deployments receiving trusted traffic (L2 Envoys, company-internal mesh) and false when receiving untrusted traffic (edge deployments). If different behaviors for invalid_http_message for HTTP/1 and HTTP/2 are desired, one should use the new HTTP/1 option :ref:`override_stream_error_on_invalid_http_message ` or the new HTTP/2 option :ref:`override_stream_error_on_invalid_http_message ` *not* the deprecated but similarly named :ref:`stream_error_on_invalid_http_messaging ` .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.strip_trailing_host_dot: strip_trailing_host_dot (`bool `_) Determines if trailing dot of the host should be removed from host/authority header before any processing of request by HTTP filters or routing. This affects the upstream host header. Without setting this option, incoming requests with host `example.com.` will not match against route with :ref:`domains` match set to `example.com`. Defaults to `false`. When the incoming request contains a host/authority header that includes a port number, setting this option will strip a trailing dot, if present, from the host section, leaving the port as is (e.g. host value `example.com.:443` will be updated to `example.com:443`). .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.proxy_status_config: proxy_status_config (:ref:`extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ProxyStatusConfig `) Proxy-Status HTTP response header configuration. If this config is set, the Proxy-Status HTTP response header field is populated. By default, it is not. .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing: extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing ----------------------------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing proto] ` .. code-block:: json { "client_sampling": "{...}", "random_sampling": "{...}", "overall_sampling": "{...}", "verbose": "...", "max_path_tag_length": "{...}", "custom_tags": [], "provider": "{...}" } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.client_sampling: client_sampling (:ref:`type.v3.Percent `) Target percentage of requests managed by this HTTP connection manager that will be force traced if the :ref:`x-client-trace-id ` header is set. This field is a direct analog for the runtime variable 'tracing.client_sampling' in the :ref:`HTTP Connection Manager `. Default: 100% .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.random_sampling: random_sampling (:ref:`type.v3.Percent `) Target percentage of requests managed by this HTTP connection manager that will be randomly selected for trace generation, if not requested by the client or not forced. This field is a direct analog for the runtime variable 'tracing.random_sampling' in the :ref:`HTTP Connection Manager `. Default: 100% .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.overall_sampling: overall_sampling (:ref:`type.v3.Percent `) Target percentage of requests managed by this HTTP connection manager that will be traced after all other sampling checks have been applied (client-directed, force tracing, random sampling). This field functions as an upper limit on the total configured sampling rate. For instance, setting client_sampling to 100% but overall_sampling to 1% will result in only 1% of client requests with the appropriate headers to be force traced. This field is a direct analog for the runtime variable 'tracing.global_enabled' in the :ref:`HTTP Connection Manager `. Default: 100% .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.verbose: verbose (`bool `_) Whether to annotate spans with additional data. If true, spans will include logs for stream events. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.max_path_tag_length: max_path_tag_length (`UInt32Value `_) Maximum length of the request path to extract and include in the HttpUrl tag. Used to truncate lengthy request paths to meet the needs of a tracing backend. Default: 256 .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.custom_tags: custom_tags (**repeated** :ref:`type.tracing.v3.CustomTag `) A list of custom tags with unique tag name to create tags for the active span. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.provider: provider (:ref:`config.trace.v3.Tracing.Http `) Configuration for an external tracing provider. If not specified, no tracing will be performed. .. attention:: Please be aware that *envoy.tracers.opencensus* provider can only be configured once in Envoy lifetime. Any attempts to reconfigure it or to use different configurations for different HCM filters will be rejected. Such a constraint is inherent to OpenCensus itself. It cannot be overcome without changes on OpenCensus side. .. _envoy_v3_api_enum_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.OperationName: Enum extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.OperationName ------------------------------------------------------------------------------------------------------ :repo:`[extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.OperationName proto] ` .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.OperationName.INGRESS: INGRESS *(DEFAULT)* ⁣The HTTP listener is used for ingress/incoming requests. .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.OperationName.EGRESS: EGRESS ⁣The HTTP listener is used for egress/outgoing requests. .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.InternalAddressConfig: extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.InternalAddressConfig ------------------------------------------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.InternalAddressConfig proto] ` .. code-block:: json { "unix_sockets": "...", "cidr_ranges": [] } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.InternalAddressConfig.unix_sockets: unix_sockets (`bool `_) Whether unix socket addresses should be considered internal. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.InternalAddressConfig.cidr_ranges: cidr_ranges (**repeated** :ref:`config.core.v3.CidrRange `) List of CIDR ranges that are treated as internal. If unset, then RFC1918 / RFC4193 IP addresses will be considered internal. .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.SetCurrentClientCertDetails: extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.SetCurrentClientCertDetails ------------------------------------------------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.SetCurrentClientCertDetails proto] ` .. code-block:: json { "subject": "{...}", "cert": "...", "chain": "...", "dns": "...", "uri": "..." } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.SetCurrentClientCertDetails.subject: subject (`BoolValue `_) Whether to forward the subject of the client cert. Defaults to false. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.SetCurrentClientCertDetails.cert: cert (`bool `_) Whether to forward the entire client cert in URL encoded PEM format. This will appear in the XFCC header comma separated from other values with the value Cert="PEM". Defaults to false. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.SetCurrentClientCertDetails.chain: chain (`bool `_) Whether to forward the entire client cert chain (including the leaf cert) in URL encoded PEM format. This will appear in the XFCC header comma separated from other values with the value Chain="PEM". Defaults to false. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.SetCurrentClientCertDetails.dns: dns (`bool `_) Whether to forward the DNS type Subject Alternative Names of the client cert. Defaults to false. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.SetCurrentClientCertDetails.uri: uri (`bool `_) Whether to forward the URI type Subject Alternative Name of the client cert. Defaults to false. .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.UpgradeConfig: extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.UpgradeConfig ----------------------------------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.UpgradeConfig proto] ` The configuration for HTTP upgrades. For each upgrade type desired, an UpgradeConfig must be added. .. warning:: The current implementation of upgrade headers does not handle multi-valued upgrade headers. Support for multi-valued headers may be added in the future if needed. .. warning:: The current implementation of upgrade headers does not work with HTTP/2 upstreams. .. code-block:: json { "upgrade_type": "...", "filters": [], "enabled": "{...}" } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.UpgradeConfig.upgrade_type: upgrade_type (`string `_) The case-insensitive name of this upgrade, e.g. "websocket". For each upgrade type present in upgrade_configs, requests with Upgrade: [upgrade_type] will be proxied upstream. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.UpgradeConfig.filters: filters (**repeated** :ref:`extensions.filters.network.http_connection_manager.v3.HttpFilter `) If present, this represents the filter chain which will be created for this type of upgrade. If no filters are present, the filter chain for HTTP connections will be used for this upgrade type. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.UpgradeConfig.enabled: enabled (`BoolValue `_) Determines if upgrades are enabled or disabled by default. Defaults to true. This can be overridden on a per-route basis with :ref:`cluster ` as documented in the :ref:`upgrade documentation `. .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ProxyStatusConfig: extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ProxyStatusConfig --------------------------------------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ProxyStatusConfig proto] ` Configures the manner in which the Proxy-Status HTTP response header is populated. See the [Proxy-Status RFC](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-proxy-status-08). The Proxy-Status header is a string of the form: "; error=; details=
" .. code-block:: json { "remove_details": "...", "remove_connection_termination_details": "...", "remove_response_flags": "...", "set_recommended_response_code": "...", "use_node_id": "...", "literal_proxy_name": "..." } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ProxyStatusConfig.remove_details: remove_details (`bool `_) If true, the details field of the Proxy-Status header is not populated with stream_info.response_code_details. This value defaults to `false`, i.e. the `details` field is populated by default. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ProxyStatusConfig.remove_connection_termination_details: remove_connection_termination_details (`bool `_) If true, the details field of the Proxy-Status header will not contain connection termination details. This value defaults to `false`, i.e. the `details` field will contain connection termination details by default. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ProxyStatusConfig.remove_response_flags: remove_response_flags (`bool `_) If true, the details field of the Proxy-Status header will not contain an enumeration of the Envoy ResponseFlags. This value defaults to `false`, i.e. the `details` field will contain a list of ResponseFlags by default. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ProxyStatusConfig.set_recommended_response_code: set_recommended_response_code (`bool `_) If true, overwrites the existing Status header with the response code recommended by the Proxy-Status spec. This value defaults to `false`, i.e. the HTTP response code is not overwritten. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ProxyStatusConfig.use_node_id: use_node_id (`bool `_) If `use_node_id` is set, Proxy-Status headers will use the Envoy's node ID as the name of the proxy. The name of the proxy as it appears at the start of the Proxy-Status header. If neither of these values are set, this value defaults to `server_name`, which itself defaults to "envoy". Only one of :ref:`use_node_id `, :ref:`literal_proxy_name ` may be set. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ProxyStatusConfig.literal_proxy_name: literal_proxy_name (`string `_) If `literal_proxy_name` is set, Proxy-Status headers will use this value as the name of the proxy. The name of the proxy as it appears at the start of the Proxy-Status header. If neither of these values are set, this value defaults to `server_name`, which itself defaults to "envoy". Only one of :ref:`use_node_id `, :ref:`literal_proxy_name ` may be set. .. _envoy_v3_api_enum_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.CodecType: Enum extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.CodecType ------------------------------------------------------------------------------------------ :repo:`[extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.CodecType proto] ` .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.CodecType.AUTO: AUTO *(DEFAULT)* ⁣For every new connection, the connection manager will determine which codec to use. This mode supports both ALPN for TLS listeners as well as protocol inference for plaintext listeners. If ALPN data is available, it is preferred, otherwise protocol inference is used. In almost all cases, this is the right option to choose for this setting. .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.CodecType.HTTP1: HTTP1 ⁣The connection manager will assume that the client is speaking HTTP/1.1. .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.CodecType.HTTP2: HTTP2 ⁣The connection manager will assume that the client is speaking HTTP/2 (Envoy does not require HTTP/2 to take place over TLS or to use ALPN. Prior knowledge is allowed). .. _envoy_v3_api_enum_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ServerHeaderTransformation: Enum extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ServerHeaderTransformation ----------------------------------------------------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ServerHeaderTransformation proto] ` .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ServerHeaderTransformation.OVERWRITE: OVERWRITE *(DEFAULT)* ⁣Overwrite any Server header with the contents of server_name. .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ServerHeaderTransformation.APPEND_IF_ABSENT: APPEND_IF_ABSENT ⁣If no Server header is present, append Server server_name If a Server header is present, pass it through. .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ServerHeaderTransformation.PASS_THROUGH: PASS_THROUGH ⁣Pass through the value of the server header, and do not append a header if none is present. .. _envoy_v3_api_enum_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertDetails: Enum extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertDetails --------------------------------------------------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertDetails proto] ` How to handle the :ref:`config_http_conn_man_headers_x-forwarded-client-cert` (XFCC) HTTP header. .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertDetails.SANITIZE: SANITIZE *(DEFAULT)* ⁣Do not send the XFCC header to the next hop. This is the default value. .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertDetails.FORWARD_ONLY: FORWARD_ONLY ⁣When the client connection is mTLS (Mutual TLS), forward the XFCC header in the request. .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertDetails.APPEND_FORWARD: APPEND_FORWARD ⁣When the client connection is mTLS, append the client certificate information to the request’s XFCC header and forward it. .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertDetails.SANITIZE_SET: SANITIZE_SET ⁣When the client connection is mTLS, reset the XFCC header with the client certificate information and send it to the next hop. .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertDetails.ALWAYS_FORWARD_ONLY: ALWAYS_FORWARD_ONLY ⁣Always forward the XFCC header in the request, regardless of whether the client connection is mTLS. .. _envoy_v3_api_enum_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathWithEscapedSlashesAction: Enum extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathWithEscapedSlashesAction ------------------------------------------------------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathWithEscapedSlashesAction proto] ` Determines the action for request that contain %2F, %2f, %5C or %5c sequences in the URI path. This operation occurs before URL normalization and the merge slashes transformations if they were enabled. .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathWithEscapedSlashesAction.IMPLEMENTATION_SPECIFIC_DEFAULT: IMPLEMENTATION_SPECIFIC_DEFAULT *(DEFAULT)* ⁣Default behavior specific to implementation (i.e. Envoy) of this configuration option. Envoy, by default, takes the KEEP_UNCHANGED action. NOTE: the implementation may change the default behavior at-will. .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathWithEscapedSlashesAction.KEEP_UNCHANGED: KEEP_UNCHANGED ⁣Keep escaped slashes. .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathWithEscapedSlashesAction.REJECT_REQUEST: REJECT_REQUEST ⁣Reject client request with the 400 status. gRPC requests will be rejected with the INTERNAL (13) error code. The "httpN.downstream_rq_failed_path_normalization" counter is incremented for each rejected request. .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathWithEscapedSlashesAction.UNESCAPE_AND_REDIRECT: UNESCAPE_AND_REDIRECT ⁣Unescape %2F and %5C sequences and redirect request to the new path if these sequences were present. Redirect occurs after path normalization and merge slashes transformations if they were configured. NOTE: gRPC requests will be rejected with the INTERNAL (13) error code. This option minimizes possibility of path confusion exploits by forcing request with unescaped slashes to traverse all parties: downstream client, intermediate proxies, Envoy and upstream server. The "httpN.downstream_rq_redirected_with_normalized_path" counter is incremented for each redirected request. .. _envoy_v3_api_enum_value_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.PathWithEscapedSlashesAction.UNESCAPE_AND_FORWARD: UNESCAPE_AND_FORWARD ⁣Unescape %2F and %5C sequences. Note: this option should not be enabled if intermediaries perform path based access control as it may lead to path confusion vulnerabilities. .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.LocalReplyConfig: extensions.filters.network.http_connection_manager.v3.LocalReplyConfig ---------------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.LocalReplyConfig proto] ` The configuration to customize local reply returned by Envoy. .. code-block:: json { "mappers": [], "body_format": "{...}" } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.LocalReplyConfig.mappers: mappers (**repeated** :ref:`extensions.filters.network.http_connection_manager.v3.ResponseMapper `) Configuration of list of mappers which allows to filter and change local response. The mappers will be checked by the specified order until one is matched. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.LocalReplyConfig.body_format: body_format (:ref:`config.core.v3.SubstitutionFormatString `) The configuration to form response body from the :ref:`command operators ` and to specify response content type as one of: plain/text or application/json. Example one: "plain/text" ``body_format``. .. validated-code-block:: yaml :type-name: envoy.config.core.v3.SubstitutionFormatString text_format: "%LOCAL_REPLY_BODY%:%RESPONSE_CODE%:path=%REQ(:path)%\n" The following response body in "plain/text" format will be generated for a request with local reply body of "upstream connection error", response_code=503 and path=/foo. .. code-block:: text upstream connect error:503:path=/foo Example two: "application/json" ``body_format``. .. validated-code-block:: yaml :type-name: envoy.config.core.v3.SubstitutionFormatString json_format: status: "%RESPONSE_CODE%" message: "%LOCAL_REPLY_BODY%" path: "%REQ(:path)%" The following response body in "application/json" format would be generated for a request with local reply body of "upstream connection error", response_code=503 and path=/foo. .. code-block:: json { "status": 503, "message": "upstream connection error", "path": "/foo" } .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.ResponseMapper: extensions.filters.network.http_connection_manager.v3.ResponseMapper -------------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.ResponseMapper proto] ` The configuration to filter and change local response. .. code-block:: json { "filter": "{...}", "status_code": "{...}", "body": "{...}", "body_format_override": "{...}", "headers_to_add": [] } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ResponseMapper.filter: filter (:ref:`config.accesslog.v3.AccessLogFilter `, *REQUIRED*) Filter to determine if this mapper should apply. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ResponseMapper.status_code: status_code (`UInt32Value `_) The new response status code if specified. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ResponseMapper.body: body (:ref:`config.core.v3.DataSource `) The new local reply body text if specified. It will be used in the `%LOCAL_REPLY_BODY%` command operator in the `body_format`. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ResponseMapper.body_format_override: body_format_override (:ref:`config.core.v3.SubstitutionFormatString `) A per mapper `body_format` to override the :ref:`body_format `. It will be used when this mapper is matched. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ResponseMapper.headers_to_add: headers_to_add (**repeated** :ref:`config.core.v3.HeaderValueOption `) HTTP headers to add to a local reply. This allows the response mapper to append, to add or to override headers of any local reply before it is sent to a downstream client. .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.Rds: extensions.filters.network.http_connection_manager.v3.Rds --------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.Rds proto] ` .. code-block:: json { "config_source": "{...}", "route_config_name": "..." } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.Rds.config_source: config_source (:ref:`config.core.v3.ConfigSource `, *REQUIRED*) Configuration source specifier for RDS. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.Rds.route_config_name: route_config_name (`string `_) The name of the route configuration. This name will be passed to the RDS API. This allows an Envoy configuration with multiple HTTP listeners (and associated HTTP connection manager filters) to use different route configurations. .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.ScopedRouteConfigurationsList: extensions.filters.network.http_connection_manager.v3.ScopedRouteConfigurationsList ----------------------------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.ScopedRouteConfigurationsList proto] ` This message is used to work around the limitations with 'oneof' and repeated fields. .. code-block:: json { "scoped_route_configurations": [] } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ScopedRouteConfigurationsList.scoped_route_configurations: scoped_route_configurations (**repeated** :ref:`config.route.v3.ScopedRouteConfiguration `, *REQUIRED*) .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.ScopedRoutes: extensions.filters.network.http_connection_manager.v3.ScopedRoutes ------------------------------------------------------------------ :repo:`[extensions.filters.network.http_connection_manager.v3.ScopedRoutes proto] ` .. code-block:: json { "name": "...", "scope_key_builder": "{...}", "rds_config_source": "{...}", "scoped_route_configurations_list": "{...}", "scoped_rds": "{...}" } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ScopedRoutes.name: name (`string `_, *REQUIRED*) The name assigned to the scoped routing configuration. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ScopedRoutes.scope_key_builder: scope_key_builder (:ref:`extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder `, *REQUIRED*) The algorithm to use for constructing a scope key for each request. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ScopedRoutes.rds_config_source: rds_config_source (:ref:`config.core.v3.ConfigSource `) Configuration source specifier for RDS. This config source is used to subscribe to RouteConfiguration resources specified in ScopedRouteConfiguration messages. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ScopedRoutes.scoped_route_configurations_list: scoped_route_configurations_list (:ref:`extensions.filters.network.http_connection_manager.v3.ScopedRouteConfigurationsList `) The set of routing scopes corresponding to the HCM. A scope is assigned to a request by matching a key constructed from the request's attributes according to the algorithm specified by the :ref:`ScopeKeyBuilder` in this message. Precisely one of :ref:`scoped_route_configurations_list `, :ref:`scoped_rds ` must be set. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ScopedRoutes.scoped_rds: scoped_rds (:ref:`extensions.filters.network.http_connection_manager.v3.ScopedRds `) The set of routing scopes associated with the HCM will be dynamically loaded via the SRDS API. A scope is assigned to a request by matching a key constructed from the request's attributes according to the algorithm specified by the :ref:`ScopeKeyBuilder` in this message. Precisely one of :ref:`scoped_route_configurations_list `, :ref:`scoped_rds ` must be set. .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder: extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder ---------------------------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder proto] ` Specifies the mechanism for constructing "scope keys" based on HTTP request attributes. These keys are matched against a set of :ref:`Key` objects assembled from :ref:`ScopedRouteConfiguration` messages distributed via SRDS (the Scoped Route Discovery Service) or assigned statically via :ref:`scoped_route_configurations_list`. Upon receiving a request's headers, the Router will build a key using the algorithm specified by this message. This key will be used to look up the routing table (i.e., the :ref:`RouteConfiguration`) to use for the request. .. code-block:: json { "fragments": [] } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.fragments: fragments (**repeated** :ref:`extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder `, *REQUIRED*) The final(built) scope key consists of the ordered union of these fragments, which are compared in order with the fragments of a :ref:`ScopedRouteConfiguration`. A missing fragment during comparison will make the key invalid, i.e., the computed key doesn't match any key. .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder: extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder -------------------------------------------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder proto] ` Specifies the mechanism for constructing key fragments which are composed into scope keys. .. code-block:: json { "header_value_extractor": "{...}" } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.header_value_extractor: header_value_extractor (:ref:`extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor `, *REQUIRED*) Specifies how a header field's value should be extracted. .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor: extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor ----------------------------------------------------------------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor proto] ` Specifies how the value of a header should be extracted. The following example maps the structure of a header to the fields in this message. .. code:: <0> <1> <-- index X-Header: a=b;c=d | || | | || \----> | || | |\----> | | | \----> | \----> Each 'a=b' key-value pair constitutes an 'element' of the header field. .. code-block:: json { "name": "...", "element_separator": "...", "index": "...", "element": "{...}" } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.name: name (`string `_, *REQUIRED*) The name of the header field to extract the value from. .. note:: If the header appears multiple times only the first value is used. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.element_separator: element_separator (`string `_) The element separator (e.g., ';' separates 'a;b;c;d'). Default: empty string. This causes the entirety of the header field to be extracted. If this field is set to an empty string and 'index' is used in the oneof below, 'index' must be set to 0. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.index: index (`uint32 `_) Specifies the zero based index of the element to extract. Note Envoy concatenates multiple values of the same header key into a comma separated string, the splitting always happens after the concatenation. Only one of :ref:`index `, :ref:`element ` may be set. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.element: element (:ref:`extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.KvElement `) Specifies the key value pair to extract the value from. Only one of :ref:`index `, :ref:`element ` may be set. .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.KvElement: extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.KvElement --------------------------------------------------------------------------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.KvElement proto] ` Specifies a header field's key value pair to match on. .. code-block:: json { "separator": "...", "key": "..." } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.KvElement.separator: separator (`string `_, *REQUIRED*) The separator between key and value (e.g., '=' separates 'k=v;...'). If an element is an empty string, the element is ignored. If an element contains no separator, the whole element is parsed as key and the fragment value is an empty string. If there are multiple values for a matched key, the first value is returned. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ScopedRoutes.ScopeKeyBuilder.FragmentBuilder.HeaderValueExtractor.KvElement.key: key (`string `_, *REQUIRED*) The key to match on. .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.ScopedRds: extensions.filters.network.http_connection_manager.v3.ScopedRds --------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.ScopedRds proto] ` .. code-block:: json { "scoped_rds_config_source": "{...}" } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.ScopedRds.scoped_rds_config_source: scoped_rds_config_source (:ref:`config.core.v3.ConfigSource `, *REQUIRED*) Configuration source specifier for scoped RDS. .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.HttpFilter: extensions.filters.network.http_connection_manager.v3.HttpFilter ---------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.HttpFilter proto] ` .. code-block:: json { "name": "...", "typed_config": "{...}", "config_discovery": "{...}", "is_optional": "..." } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpFilter.name: name (`string `_, *REQUIRED*) The name of the filter configuration. It also serves as a resource name in ExtensionConfigDS. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpFilter.typed_config: typed_config (`Any `_) Filter specific configuration which depends on the filter being instantiated. See the supported filters for further documentation. To support configuring a :ref:`match tree `, use an :ref:`ExtensionWithMatcher ` with the desired HTTP filter. .. _extension_category_envoy.filters.http: .. tip:: This extension category has the following known extensions: - :ref:`envoy.filters.http.adaptive_concurrency ` - :ref:`envoy.filters.http.admission_control ` - :ref:`envoy.filters.http.alternate_protocols_cache ` - :ref:`envoy.filters.http.aws_lambda ` - :ref:`envoy.filters.http.aws_request_signing ` - :ref:`envoy.filters.http.bandwidth_limit ` - :ref:`envoy.filters.http.buffer ` - :ref:`envoy.filters.http.cache ` - :ref:`envoy.filters.http.cdn_loop ` - :ref:`envoy.filters.http.composite ` - :ref:`envoy.filters.http.compressor ` - :ref:`envoy.filters.http.cors ` - :ref:`envoy.filters.http.csrf ` - :ref:`envoy.filters.http.decompressor ` - :ref:`envoy.filters.http.dynamic_forward_proxy ` - :ref:`envoy.filters.http.dynamo ` - :ref:`envoy.filters.http.ext_authz ` - :ref:`envoy.filters.http.ext_proc ` - :ref:`envoy.filters.http.fault ` - :ref:`envoy.filters.http.gcp_authn ` - :ref:`envoy.filters.http.grpc_http1_bridge ` - :ref:`envoy.filters.http.grpc_http1_reverse_bridge ` - :ref:`envoy.filters.http.grpc_json_transcoder ` - :ref:`envoy.filters.http.grpc_stats ` - :ref:`envoy.filters.http.grpc_web ` - :ref:`envoy.filters.http.header_to_metadata ` - :ref:`envoy.filters.http.health_check ` - :ref:`envoy.filters.http.ip_tagging ` - :ref:`envoy.filters.http.jwt_authn ` - :ref:`envoy.filters.http.kill_request ` - :ref:`envoy.filters.http.local_ratelimit ` - :ref:`envoy.filters.http.lua ` - :ref:`envoy.filters.http.oauth2 ` - :ref:`envoy.filters.http.on_demand ` - :ref:`envoy.filters.http.original_src ` - :ref:`envoy.filters.http.ratelimit ` - :ref:`envoy.filters.http.rbac ` - :ref:`envoy.filters.http.router ` - :ref:`envoy.filters.http.set_metadata ` - :ref:`envoy.filters.http.stateful_session ` - :ref:`envoy.filters.http.tap ` - :ref:`envoy.filters.http.wasm ` The following extensions are available in :ref:`contrib ` images only: - :ref:`envoy.filters.http.language ` - :ref:`envoy.filters.http.squash ` - :ref:`envoy.filters.http.sxg ` Only one of :ref:`typed_config `, :ref:`config_discovery ` may be set. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpFilter.config_discovery: config_discovery (:ref:`config.core.v3.ExtensionConfigSource `) Configuration source specifier for an extension configuration discovery service. In case of a failure and without the default configuration, the HTTP listener responds with code 500. Extension configs delivered through this mechanism are not expected to require warming (see https://github.com/envoyproxy/envoy/issues/12061). To support configuring a :ref:`match tree `, use an :ref:`ExtensionWithMatcher ` with the desired HTTP filter. This works for both the default filter configuration as well as for filters provided via the API. Only one of :ref:`typed_config `, :ref:`config_discovery ` may be set. .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpFilter.is_optional: is_optional (`bool `_) If true, clients that do not support this filter may ignore the filter but otherwise accept the config. Otherwise, clients that do not support this filter must reject the config. This is also same with typed per filter config. .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.RequestIDExtension: extensions.filters.network.http_connection_manager.v3.RequestIDExtension ------------------------------------------------------------------------ :repo:`[extensions.filters.network.http_connection_manager.v3.RequestIDExtension proto] ` .. code-block:: json { "typed_config": "{...}" } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.RequestIDExtension.typed_config: typed_config (`Any `_) Request ID extension specific configuration. .. _envoy_v3_api_msg_extensions.filters.network.http_connection_manager.v3.EnvoyMobileHttpConnectionManager: extensions.filters.network.http_connection_manager.v3.EnvoyMobileHttpConnectionManager -------------------------------------------------------------------------------------- :repo:`[extensions.filters.network.http_connection_manager.v3.EnvoyMobileHttpConnectionManager proto] ` HTTP connection manager for use in Envoy mobile. .. _extension_envoy.filters.network.envoy_mobile_http_connection_manager: This extension may be referenced by the qualified name ``envoy.filters.network.envoy_mobile_http_connection_manager`` .. note:: This extension is intended to be robust against untrusted downstream traffic. It assumes that the upstream is trusted. .. tip:: This extension extends and can be used with the following extension category: - :ref:`envoy.filters.network ` .. code-block:: json { "config": "{...}" } .. _envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.EnvoyMobileHttpConnectionManager.config: config (:ref:`extensions.filters.network.http_connection_manager.v3.HttpConnectionManager `) The configuration for the underlying HttpConnectionManager which will be instantiated for Envoy mobile.