Skip to content

ext_proc: allow immediate response from upstream filter#41231

Merged
tyxia merged 6 commits intoenvoyproxy:mainfrom
mathetake:upreamexttprocimmed
Oct 7, 2025
Merged

ext_proc: allow immediate response from upstream filter#41231
tyxia merged 6 commits intoenvoyproxy:mainfrom
mathetake:upreamexttprocimmed

Conversation

@mathetake
Copy link
Copy Markdown
Member

Commit Message: ext_proc: allow immediate response from upstream filter

Additional Description:
This is from the discussion here: #33273 (comment)
Previously, sending local replies from an upstream ext_proc filter was prohibited just because of the implementation choice. This prevented users from returning errors from there, which results in clients indefinitely waiting for the response until timeout without any feedback. In short, ext_proc was previously unable to fail.

Closes envoyproxy/ai-gateway#840

Risk Level: low (previously considered invalid code paths)
Testing: done
Docs Changes: n/a
Release Notes: n/a
Platform Specific Features: n/a

Signed-off-by: Takeshi Yoneda <t.y.mathetake@gmail.com>
@repokitteh-read-only
Copy link
Copy Markdown

As a reminder, PRs marked as draft will not be automatically assigned reviewers,
or be handled by maintainer-oncall triage.

Please mark your PR as ready when you want it to be reviewed!

🐱

Caused by: #41231 was opened by mathetake.

see: more, trace.

@mathetake
Copy link
Copy Markdown
Member Author

@yanjunxiang-google PTAL

@yanjunxiang-google
Copy link
Copy Markdown
Contributor

Thanks for working on this. Please add an integration test to verify the functionality works end-to-end.

@tyxia
Copy link
Copy Markdown
Member

tyxia commented Sep 27, 2025

/wait

Can you have a e2e integration test for this? Also could you also test and document how it will play with hedging / retries https://github.com/envoyproxy/envoy/blob/main/source/docs/upstream_filters.md

Also, per comment here

// Local replies will not be seen by upstream HTTP filters.
local reply is not seen by upstream http filter , e2e test here will help demonstrate how it works

@tyxia tyxia self-assigned this Sep 27, 2025
@mathetake
Copy link
Copy Markdown
Member Author

@yanjunxiang-google added an integration test which works as expected (I also manually verified it's failing without the change in this PR juuust in case)

config_option.downstream_filter = false;

initializeConfig(config_option);
// Add ext_proc as upstream filter.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now there are two tests are creating ext_proc filter in upstream:

config_helper_.addConfigModifier([this](envoy::config::bootstrap::v3::Bootstrap& bootstrap) {
. Probably making this as function and call it at both places?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

548aadb done. JFYI the similar code exists in observability_integration(?) but not exactly the same so decided to limit the sharing in this file.

Signed-off-by: Takeshi Yoneda <t.y.mathetake@gmail.com>
@yanavlasov
Copy link
Copy Markdown
Contributor

Will wait for @yanjunxiang-google LGTM.

/wait-any

@yanjunxiang-google
Copy link
Copy Markdown
Contributor

LGTM

@tyxia
Copy link
Copy Markdown
Member

tyxia commented Oct 7, 2025

@mathetake Don't want to block this PR, but have addressed this requirement: test and document how it will play with hedging / retries

This is required here and i think it will make upstream filter more robust in the long term. At least, i think we should have a todo or warning comment

Signed-off-by: Takeshi Yoneda <t.y.mathetake@gmail.com>
@mathetake
Copy link
Copy Markdown
Member Author

@tyxia added a commit to address you concern.

HttpIntegrationTest::initialize();
auto response = sendDownstreamRequest(absl::nullopt);
auto response = sendDownstreamRequest([](Http::RequestHeaderMap& headers) {
// Setting this header to ensure that Envoy does not retry the request
Copy link
Copy Markdown
Member

@tyxia tyxia Oct 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this comment accurate?

Setting x-envoy-retry-on header ----> should the comment be: ensure that Envoy does retry the request in case of a 5xx immediate response from the upstream

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ah i mean yes and no lol. "Setting this header (which causes Envoy to retry usually but this case is ext_proc is the one sending immediate response so) to ensure Envoy won't result in retry" is the accurate comment

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

0805acd here

Signed-off-by: Takeshi Yoneda <t.y.mathetake@gmail.com>
Copy link
Copy Markdown
Member

@tyxia tyxia left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! Thanks for working on this

@tyxia tyxia enabled auto-merge (squash) October 7, 2025 16:21
@tyxia tyxia merged commit c628f8a into envoyproxy:main Oct 7, 2025
24 checks passed
@mathetake mathetake deleted the upreamexttprocimmed branch October 7, 2025 16:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Errors from extproc not returned to user causing user timeouts

4 participants