refactor/perf: use LuaPerRoute instead of FilterConfig by rudrakhp · Pull Request #8355 · envoyproxy/gateway

rudrakhp · 2026-02-26T12:14:15Z

What type of PR is this?
refactor/perf: use LuaPerRoute instead of FilterConfig

What this PR does / why we need it:

Helps reduce listener drain due to Lua policy churn as they are applied at routes now. Lua E2E and tests are already in place.

Fixes #7839

Release Notes: Yes

netlify · 2026-02-26T12:14:20Z

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name	Link
🔨 Latest commit	`12dc49d`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69ad0c1d61deaf00088d38a5

codecov · 2026-02-26T12:24:12Z

Codecov Report

❌ Patch coverage is 81.25000% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.17%. Comparing base (b0638d5) to head (12dc49d).
⚠️ Report is 61 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/xds/translator/lua.go	81.25%	1 Missing and 2 partials ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8355   +/-   ##
=======================================
  Coverage   74.17%   74.17%           
=======================================
  Files         242      242           
  Lines       37563    37575   +12     
=======================================
+ Hits        27863    27872    +9     
- Misses       7763     7764    +1     
- Partials     1937     1939    +2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

zhaohuabing · 2026-03-02T02:18:54Z

        httpFilters:
        - disabled: true
-          name: envoy.filters.http.lua/envoyextensionpolicy/default/policy-for-http-route/lua/0
+          name: envoy.filters.http.lua/0


Can we keep the naming? Changing Lua filter names from policy-derived names to positional names breaks the existing identity contract.

The new name would break EEP/Extension Manager

The numbered name making them difficult to be used in EEP/Extension Manager

It's not aligned with other filter names generated by policies

@zhaohuabing the reason for keeping the name policy/route agnostic is so that listener filter chain drain will not happen that frequently. I was not aware the extension naming was a contract we expose for others to use. If that's the case, we will have to live with listener filter chain updates ig.

Yeah, I get the rational. But this is a breaking change and the likelihood of chain drain due to filter name change is much lower than the lua script change, so I'd prefer keeping the original name

zhaohuabing

LGTM. Thanks!

zirain · 2026-03-06T09:21:13Z

            defaultSourceCode:
-              inlineString: function envoy_on_request(request_handle) request_handle:logInfo('Goodbye.')
-                end
+              inlineString: ""


is this required? if so, let's make a change to upstream make it optional.

It doesn't make sense to make it optional IMO, also the filter is disabled so its a no-op anyways?

kkk777-7 · 2026-03-06T13:35:41Z

/retest

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

rudrakhp · 2026-03-08T12:50:04Z

/retest

perf: use LuaPerRoute instead of FilterConfig Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> (cherry picked from commit f31ac4e)

perf: use LuaPerRoute instead of FilterConfig Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> (cherry picked from commit f31ac4e) Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* fix: handle network errors in rate limit e2e tests (#8446) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> (cherry picked from commit b0638d5) Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * refactor/perf: use LuaPerRoute instead of FilterConfig (#8355) perf: use LuaPerRoute instead of FilterConfig Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> (cherry picked from commit f31ac4e) Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: per-endpoint hostname override blocked by auto-generated wildcad host (#8565) * fix: per-endpoint hostname override blocked by auto-generated wildcard host Signed-off-by: zirain <zirain2009@gmail.com> * add UT Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> (cherry picked from commit 595010a) Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix bug with grpcroute mirror filter (#8541) * fix bug with grpcroute mirror filter Signed-off-by: Adam Buran <aburan@roblox.com> * add indexers test Signed-off-by: Adam Buran <aburan@roblox.com> * add release note Signed-off-by: Adam Buran <aburan@roblox.com> --------- Signed-off-by: Adam Buran <aburan@roblox.com> Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com> Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com> (cherry picked from commit e633c08) Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: normalize CRLF line endings in htpasswd basic auth secrets (#8557) Fixes #8554 Signed-off-by: stekole <stefan@sandnetworks.com> Signed-off-by: stekole <30674956+stekole@users.noreply.github.com> (cherry picked from commit 9cac348) Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: avoid metric increments on no-op delete reconcile paths (#8480) * fix: avoid metric increments on no-op delete reconcile paths Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> * Update internal/infrastructure/kubernetes/infra_resource_test.go Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com> * Update internal/infrastructure/kubernetes/infra_resource_test.go Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com> --------- Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com> Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com> (cherry picked from commit 7a2a4ec) Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix(telemetry): support BackendTLSPolicy for telemetry backends (#8545) * fix(telemetry): support BackendTLSPolicy for telemetry backends processBackendRefs does not look up BackendTLSPolicy for telemetry backends (access logs, tracing, metrics), so TLS can only be configured via Backend.spec.tls. Replace inline processServerValidationTLSSettings with applyBackendTLSSetting so telemetry backends get the full Backend + BackendTLSPolicy + EnvoyProxy TLS merge. Workaround: envoyproxy/ai-gateway#1964 Signed-off-by: Adrian Cole <adrian@tetrate.io> (cherry picked from commit ac18feb) Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: restore failure-path metric recording for delete and HPA reconcile (#8656) Fixes #8651 Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> (cherry picked from commit 2a5bfd0) Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: status for mirror backend (#8675) Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> (cherry picked from commit fa81778) Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: client certificate secret never delivered when it is exclusively referenced by a SecurityPolicy extAuth Backend (#8654) * fix: client certificate secret never delivered when it is exclusively referenced by a SecurityPolicy extAuth Backend Signed-off-by: zirain <zirain2009@gmail.com> * fix lint Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> (cherry picked from commit c7e21fa) Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: client certificate secret never delivered when it is exclusively referenced by a SecurityPolicy jwt/oidc Backend (#8711) Signed-off-by: zirain <zirain2009@gmail.com> (cherry picked from commit 95c3a79) Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: helm secrets rbac for gateway namespace with watch list of namespaces (#8706) * fix: helm secrets rbac for gateway namespace with watch list of namespaces Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * add release notes Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * review update Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> --------- Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com> (cherry picked from commit c48a346) Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * add release notes Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix lint Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix lint Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> --------- Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Adam Buran <aburan@roblox.com> Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com> Signed-off-by: stekole <stefan@sandnetworks.com> Signed-off-by: stekole <30674956+stekole@users.noreply.github.com> Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> Signed-off-by: Isaac Wilson <isaac.wilson514@gmail.com> Signed-off-by: Adrian Cole <adrian@tetrate.io> Signed-off-by: kkk777-7 <kota.kimura0725@gmail.com> Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Co-authored-by: zirain <zirain2009@gmail.com> Co-authored-by: aburanrbx <aburan@roblox.com> Co-authored-by: Arko Dasgupta <arkodg@users.noreply.github.com> Co-authored-by: stekole <30674956+stekole@users.noreply.github.com> Co-authored-by: Felipe Sabadini <fsabadini@hotmail.com> Co-authored-by: Isaac Wilson <isaac.wilson514@gmail.com> Co-authored-by: Adrian Cole <64215+codefromthecrypt@users.noreply.github.com> Co-authored-by: Kota Kimura <86363983+kkk777-7@users.noreply.github.com>

rudrakhp force-pushed the lua_per_route branch from 2d12273 to b012d0b Compare February 26, 2026 12:28

rudrakhp marked this pull request as ready for review February 26, 2026 13:27

rudrakhp requested a review from a team as a code owner February 26, 2026 13:27

rudrakhp requested a review from zhaohuabing February 26, 2026 13:28

zhaohuabing reviewed Mar 2, 2026

View reviewed changes

rudrakhp force-pushed the lua_per_route branch 2 times, most recently from 418c61f to db46c16 Compare March 2, 2026 12:07

rudrakhp requested a review from zhaohuabing March 2, 2026 12:08

zhaohuabing previously approved these changes Mar 3, 2026

View reviewed changes

rudrakhp requested review from a team March 3, 2026 05:11

rudrakhp added this to the v1.8.0-rc.1 Release milestone Mar 3, 2026

rudrakhp force-pushed the lua_per_route branch from db46c16 to 435f6a7 Compare March 6, 2026 09:01

rudrakhp dismissed zhaohuabing’s stale review via ebade0a March 6, 2026 09:06

rudrakhp force-pushed the lua_per_route branch from 435f6a7 to ebade0a Compare March 6, 2026 09:06

zirain reviewed Mar 6, 2026

View reviewed changes

kkk777-7 approved these changes Mar 6, 2026

View reviewed changes

rudrakhp force-pushed the lua_per_route branch 2 times, most recently from ea960a5 to 210f68b Compare March 7, 2026 06:40

arkodg approved these changes Mar 7, 2026

View reviewed changes

arkodg requested review from zhaohuabing and zirain March 7, 2026 21:40

zirain approved these changes Mar 8, 2026

View reviewed changes

perf: use LuaPerRoute instead of FilterConfig

12dc49d

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

rudrakhp force-pushed the lua_per_route branch from 210f68b to 12dc49d Compare March 8, 2026 05:41

rudrakhp merged commit f31ac4e into envoyproxy:main Mar 8, 2026
221 of 243 checks passed

arkodg added the cherrypick/release-v1.7.2 label Mar 24, 2026

zhaohuabing mentioned this pull request Mar 26, 2026

[xds] stabilize listener-level Lua XDS filters to avoid listener drain #8598

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

refactor/perf: use LuaPerRoute instead of FilterConfig#8355

refactor/perf: use LuaPerRoute instead of FilterConfig#8355
rudrakhp merged 1 commit intoenvoyproxy:mainfrom
rudrakhp:lua_per_route

rudrakhp commented Feb 26, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Feb 26, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Feb 26, 2026 •

edited

Loading

Uh oh!

zhaohuabing Mar 2, 2026

Uh oh!

rudrakhp Mar 2, 2026

Uh oh!

zhaohuabing Mar 2, 2026

Uh oh!

zhaohuabing left a comment

Uh oh!

zirain Mar 6, 2026

Uh oh!

rudrakhp Mar 6, 2026

Uh oh!

kkk777-7 commented Mar 6, 2026

Uh oh!

rudrakhp commented Mar 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

rudrakhp commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Uh oh!

codecov Bot commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

zhaohuabing Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

rudrakhp Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

zhaohuabing left a comment

Choose a reason for hiding this comment

Uh oh!

zirain Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

rudrakhp Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

kkk777-7 commented Mar 6, 2026

Uh oh!

rudrakhp commented Mar 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

rudrakhp commented Feb 26, 2026 •

edited

Loading

netlify Bot commented Feb 26, 2026 •

edited

Loading

codecov Bot commented Feb 26, 2026 •

edited

Loading