Set stream limits for HTTP2 protocol

Signed-off-by: Akshay Gupta <[email protected]>
projectcontour · Oct 11, 2023 · 14819d3 · 14819d3
1 parent d09bba1
commit 14819d3
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 2 deletions.
diff --git a/internal/envoy/v3/listener.go b/internal/envoy/v3/listener.go
@@ -486,6 +486,12 @@ func (b *httpConnectionManagerBuilder) Get() *envoy_listener_v3.Filter {
 			AcceptHttp_10:      true,
 			AllowChunkedLength: b.allowChunkedLength,
 		},
+		Http2ProtocolOptions: &envoy_core_v3.Http2ProtocolOptions{
+			MaxConcurrentStreams:        wrapperspb.UInt32(100),
+			HpackTableSize:              wrapperspb.UInt32(4096),
+			InitialStreamWindowSize:     wrapperspb.UInt32(65535),
+			InitialConnectionWindowSize: wrapperspb.UInt32(65535),
+		},
 
 		UseRemoteAddress:  wrapperspb.Bool(true),
 		XffNumTrustedHops: b.numTrustedHops,

diff --git a/internal/envoy/v3/runtime.go b/internal/envoy/v3/runtime.go
@@ -36,8 +36,13 @@ func RuntimeLayers() []*envoy_service_runtime_v3.Runtime {
 func baseRuntimeLayer() *structpb.Struct {
 	return &structpb.Struct{
 		Fields: map[string]*structpb.Value{
-			"re2.max_program_size.error_level": {Kind: &structpb.Value_NumberValue{NumberValue: maxRegexProgramSizeError}},
-			"re2.max_program_size.warn_level":  {Kind: &structpb.Value_NumberValue{NumberValue: maxRegexProgramSizeWarn}},
+			"re2.max_program_size.error_level":                              structpb.NewNumberValue(maxRegexProgramSizeError),
+			"re2.max_program_size.warn_level":                               structpb.NewNumberValue(maxRegexProgramSizeWarn),
+			"overload.premature_reset_total_stream_count":                   structpb.NewNumberValue(50),
+			"overload.premature_reset_min_stream_lifetime_seconds":          structpb.NewNumberValue(1),
+			"http.max_requests_per_io_cycle":                                structpb.NewNumberValue(10),
+			"envoy.resource_limits.listener.ingress_https.connection_limit": structpb.NewNumberValue(10000),
+			"envoy.resource_limits.listener.ingress_http.connection_limit":  structpb.NewNumberValue(10000),
 		},
 	}
 }