Bootstrap settings for downstream reverse connection socket interface (proto)

This extension has the qualified name envoy.bootstrap.reverse_tunnel.downstream_socket_interface

Note

This extension is work-in-progress. Functionality is incomplete and it is not intended for production use.

This extension has an unknown security posture and should only be used in deployments where both the downstream and upstream are trusted.

Tip

This extension extends and can be used with the following extension category:

This extension must be configured with one of the following type URLs:

extensions.bootstrap.reverse_tunnel.downstream_socket_interface.v3.DownstreamReverseConnectionSocketInterface

[extensions.bootstrap.reverse_tunnel.downstream_socket_interface.v3.DownstreamReverseConnectionSocketInterface proto]

Configuration for the downstream reverse connection socket interface. This interface initiates reverse connections to upstream Envoys and provides them as socket connections for downstream requests.

{
  "stat_prefix": ...,
  "enable_detailed_stats": ...,
  "http_handshake": {...},
  "access_log": [],
  "max_reconnect_backoff": {...},
  "maintain_interval": {...}
}
stat_prefix

(string) Stat prefix to be used for downstream reverse connection socket interface stats.

enable_detailed_stats

(bool) Enable detailed per-host and per-cluster statistics. When enabled, emits hidden statistics for individual hosts and clusters. Defaults to false.

http_handshake

(extensions.bootstrap.reverse_tunnel.downstream_socket_interface.v3.DownstreamReverseConnectionSocketInterface.HttpHandshakeConfig) Optional HTTP handshake configuration. When unset, the initiator envoy uses the defaults provided by HttpHandshakeConfig.

access_log

(repeated config.accesslog.v3.AccessLog) Access log configuration for reverse tunnel initiator lifecycle events. Logs are emitted on handshake success, handshake failure, and connection close. Reverse tunnel metadata (node_id, cluster_id, tenant_id, upstream cluster, etc.) is available via %DYNAMIC_METADATA(envoy.reverse_tunnel.initiator:*)% substitutions.

max_reconnect_backoff

(Duration) Upper bound on the per-host reconnect backoff. The initiator retries a failed handshake on a deterministic exponential schedule (1s, 2s, 4s, …) with small upward jitter; this value caps that schedule.

maintain_interval

(Duration) How often the initiator re-checks each host and dials any missing reverse tunnels. Defaults to 10s. The re-check is jittered upward so agents that start together do not redial in lockstep. The minimum value is 100ms.

extensions.bootstrap.reverse_tunnel.downstream_socket_interface.v3.DownstreamReverseConnectionSocketInterface.HttpHandshakeConfig

[extensions.bootstrap.reverse_tunnel.downstream_socket_interface.v3.DownstreamReverseConnectionSocketInterface.HttpHandshakeConfig proto]

HTTP handshake settings for initiator envoy initiated reverse tunnels.

{
  "request_path": ...,
  "additional_headers": [],
  "use_http_upgrade": ...,
  "formatters": []
}
request_path

(string) Request path used when issuing the HTTP reverse-connection handshake. Defaults to “/reverse_connections/request”.

additional_headers

(repeated config.core.v3.HeaderValueOption) Additional headers to include in the HTTP handshake request.

use_http_upgrade

(bool) Perform the handshake as an HTTP/1.1 Upgrade exchange (Upgrade: reverse-tunnel, success on 101) so HTTP proxies can route the handshake and splice the tunnel afterward. The responder must set this flag to the same value. Defaults to false.

formatters

(repeated config.core.v3.TypedExtensionConfig) Formatter extensions usable in additional_headers substitution. See the formatter extensions documentation for details. When set, additional_headers values are evaluated as substitution format strings; when empty, the values are sent literally.