feat: envoyproxy health check event logging - #9381
Conversation
❌ Deploy Preview for cerulean-figolla-1f9435 failed.
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #9381 +/- ##
==========================================
+ Coverage 75.68% 75.71% +0.03%
==========================================
Files 254 254
Lines 42110 42174 +64
==========================================
+ Hits 31870 31933 +63
+ Misses 8093 8092 -1
- Partials 2147 2149 +2 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Adds support for configuring Envoy health check event logging via the EnvoyProxy API. Health check events (probe outcomes) can be written as JSON to a file sink (defaults to /dev/stdout). The new `healthCheckLog` field under `spec.telemetry` of EnvoyProxy controls which probe outcomes are logged (Failure, FailureTransition, Success, SuccessTransition) and where the events are written. Internally, the event log config is carried on ir.ActiveHealthCheck.EventLog so it flows naturally through TrafficFeatures into every cluster that has active health checks configured, including filter-created clusters (ext-proc, extauth, etc.) without any extra threading. Closes envoyproxy#8753 Signed-off-by: Guy Daich <guy.daich@sap.com>
54564b6 to
ebd31ed
Compare
There was a problem hiding this comment.
Pull request overview
Adds Envoy health check event logging support to Envoy Gateway, exposing a new spec.telemetry.healthCheckLog field on the EnvoyProxy API and threading that configuration through IR into xDS HealthCheck.event_logger so that clusters with active health checks can emit JSON probe outcome events to a file sink (default /dev/stdout).
Changes:
- Introduces
ProxyTelemetry.healthCheckLogAPI types, CRD schema/CEL validations, and CEL validation tests. - Translates
healthCheckLoginto IR (ir.ActiveHealthCheck.EventLog) and renders corresponding Envoy xDS health checkeventLoggerconfiguration. - Adds docs, release notes, golden testdata updates, and e2e coverage (including ext-proc and backend HC logging assertions).
No concrete defects were identified in the reviewed diffs; remaining risk is primarily around correctness of the Envoy “matches → alwaysLog* booleans” semantic mapping and operational/log-volume effects in real deployments.
Reviewed changes
Copilot reviewed 38 out of 50 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml | Updates expected CRD schema output to include telemetry.healthCheckLog. |
| test/helm/gateway-crds-helm/e2e.out.yaml | Updates expected e2e CRD schema output to include telemetry.healthCheckLog. |
| test/helm/gateway-crds-helm/all.out.yaml | Updates expected “all” CRD schema output to include telemetry.healthCheckLog. |
| test/e2e/tests/ext_proc.go | Adds e2e assertion that ext-proc cluster health check events appear in logs (via Loki). |
| test/e2e/tests/backend_health_check.go | Adds e2e test validating health check event logging behavior via Loki. |
| test/e2e/testdata/ext-proc-envoyextensionpolicy.yaml | Enables active gRPC health checks for ext-proc backend to generate events. |
| test/e2e/testdata/backend-health-check-event-log.yaml | Adds route manifest used as a baseline phase for event-log test. |
| test/e2e/testdata/backend-health-check-event-log-hc.yaml | Adds HC-enabled route + failing BTP to reliably generate HC log events. |
| test/config/gatewayclass.yaml | Enables telemetry.healthCheckLog: {} in test GatewayClass config. |
| test/cel-validation/envoyproxy_test.go | Adds CEL validation coverage for ProxyHealthCheckLog constraints. |
| site/content/en/latest/tasks/observability/proxy-health-check-log.md | Adds user documentation for configuring and verifying HC event logs. |
| site/content/en/latest/api/extension_types.md | Adds generated API docs for new health check logging types/fields. |
| release-notes/current/new_features/9381-envoyproxy-health-check-event-logging.md | Adds release note fragment for the new feature. |
| internal/xds/translator/testdata/out/xds-ir/health-check-event-log.routes.yaml | Adds golden output for routes in HC event log translator scenario. |
| internal/xds/translator/testdata/out/xds-ir/health-check-event-log.listeners.yaml | Adds golden output for listeners in HC event log translator scenario. |
| internal/xds/translator/testdata/out/xds-ir/health-check-event-log.endpoints.yaml | Adds golden output for endpoints in HC event log translator scenario. |
| internal/xds/translator/testdata/out/xds-ir/health-check-event-log.clusters.yaml | Adds golden output demonstrating xDS health check eventLogger rendering. |
| internal/xds/translator/testdata/out/xds-ir/ext-proc-with-health-check-log.routes.yaml | Adds golden output for ext-proc route scenario with HC logging. |
| internal/xds/translator/testdata/out/xds-ir/ext-proc-with-health-check-log.listeners.yaml | Adds golden output for ext-proc listener scenario with HC logging. |
| internal/xds/translator/testdata/out/xds-ir/ext-proc-with-health-check-log.endpoints.yaml | Adds golden output for ext-proc endpoints scenario with HC logging. |
| internal/xds/translator/testdata/out/xds-ir/ext-proc-with-health-check-log.clusters.yaml | Adds golden output for ext-proc cluster health check logging config. |
| internal/xds/translator/testdata/in/xds-ir/health-check-event-log.yaml | Adds IR input fixture for HC event log translation. |
| internal/xds/translator/testdata/in/xds-ir/ext-proc-with-health-check-log.yaml | Adds IR input fixture for ext-proc HC log translation. |
| internal/xds/translator/cluster.go | Implements xDS health check eventLogger rendering from IR event log config. |
| internal/ir/zz_generated.deepcopy.go | Adds deepcopy support for new IR event log types. |
| internal/ir/xds.go | Adds IR structs for health check event logging and wires into ActiveHealthCheck. |
| internal/gatewayapi/testdata/securitypolicy-with-extauth-with-hc-log.out.yaml | Adds/updates gatewayapi golden output showing HC log config propagated into IR. |
| internal/gatewayapi/testdata/securitypolicy-with-extauth-with-hc-log.in.yaml | Adds/updates gatewayapi input fixture enabling HC logging via EnvoyProxy telemetry. |
| internal/gatewayapi/testdata/health-check-log-gw-override.out.yaml | Adds golden coverage for gateway-level override interactions with HC logging. |
| internal/gatewayapi/testdata/health-check-log-gw-override.in.yaml | Adds input fixture for gateway override scenario. |
| internal/gatewayapi/testdata/health-check-log-disabled.out.yaml | Adds golden coverage for disabled/default HC logging scenarios. |
| internal/gatewayapi/testdata/health-check-log-disabled.in.yaml | Adds input fixture for disabled scenario. |
| internal/gatewayapi/testdata/health-check-log-defaults.out.yaml | Adds golden coverage for default HC logging behavior. |
| internal/gatewayapi/testdata/health-check-log-defaults.in.yaml | Adds input fixture for defaults scenario. |
| internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-hc-log.out.yaml | Adds golden coverage for ext-proc cluster HC logging propagation. |
| internal/gatewayapi/testdata/envoyextensionpolicy-with-extproc-with-hc-log.in.yaml | Adds input fixture for ext-proc HC logging propagation. |
| internal/gatewayapi/securitypolicy.go | Threads gateway telemetry into backend traffic feature translation for policy-created clusters. |
| internal/gatewayapi/listener.go | Adds translateHealthCheckLog helper and updates traffic translation signature usage. |
| internal/gatewayapi/listener_test.go | Adds unit tests for translateHealthCheckLog mapping behavior. |
| internal/gatewayapi/envoyextensionpolicy.go | Threads gateway telemetry into ext-proc backend settings translation. |
| internal/gatewayapi/contexts.go | Adds GatewayContext.Telemetry() helper for safe telemetry access. |
| internal/gatewayapi/clustersettings.go | Propagates telemetry HC log config into IR active health check event log. |
| internal/gatewayapi/backendtrafficpolicy.go | Threads gateway telemetry into BackendTrafficPolicy translation (including route-targeted path). |
| internal/gatewayapi/backendtrafficpolicy_test.go | Updates tests for new buildTrafficFeatures signature. |
| examples/grpc-ext-proc/main.go | Adds gRPC health service implementation to support GRPC health checking. |
| charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml | Updates generated CRD with new healthCheckLog schema. |
| charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml | Updates Helm template CRD with new healthCheckLog schema. |
| api/v1alpha1/zz_generated.deepcopy.go | Adds deepcopy support for new API types. |
| api/v1alpha1/envoyproxy_types.go | Adds ProxyTelemetry.HealthCheckLog field to EnvoyProxy API. |
| api/v1alpha1/envoyproxy_healthchecklogging_types.go | Introduces API types/enums/validations for health check event logging. |
Files not reviewed (2)
- api/v1alpha1/zz_generated.deepcopy.go: Generated file
- internal/ir/zz_generated.deepcopy.go: Generated file
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cdc7b9198e
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Signed-off-by: Guy Daich <guy.daich@sap.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c8b5ecba6a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Signed-off-by: Guy Daich <guy.daich@sap.com>
Signed-off-by: Guy Daich <guy.daich@sap.com>
Signed-off-by: Guy Daich <guy.daich@sap.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8862378600
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Signed-off-by: Guy Daich <guy.daich@sap.com>
|
/retest |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5e329d9259
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dfecabeb30
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Signed-off-by: Guy Daich <guy.daich@sap.com>
Signed-off-by: Guy Daich <guy.daich@sap.com>
Signed-off-by: Guy Daich <guy.daich@sap.com>
Signed-off-by: Guy Daich <guy.daich@sap.com>
…icsfor empty list Signed-off-by: Guy Daich <guy.daich@sap.com>
Signed-off-by: Guy Daich <guy.daich@sap.com>
Adds support for configuring Envoy health check event logging via the EnvoyProxy API. Health check events (probe outcomes) can be written as JSON to a file sink (defaults to /dev/stdout).
The new
healthCheckLogfield underspec.telemetryof EnvoyProxy controls where logs are printed to and which probe outcomes are logged:Internally, the event log config is carried on ir.ActiveHealthCheck.EventLog so it flows naturally through TrafficFeatures into every cluster that has active health checks configured, including filter-created clusters (ext-proc, extauth, etc.) without any extra threading.
Closes #8753
What this PR does / why we need it:
Which issue(s) this PR fixes:
Fixes #
PR Checklist
git commit -s). See DCO: Sign your work./api), the API was discussed and agreed before the implementation. The API change can be in a separate PR, or in the same PR, but the API must be agreed before implementation. N/A if this PR does not contain API changes.make generate gen-check,make lint, and the unit-test/coverage build pass. (Flaky e2e failures are not considered breakages, butgen-check,lint, and coverage MUST pass.)release-notes/current/<section>/<pr-number>-<slug>.md(seerelease-notes/current/README.mdfor sections and naming). N/A if this PR does not contain non-trivial changes.make gen-checkand committed the result if API/helm charts/modules changed.release-notes/current/breaking_changes/.