fix: bound BackendTrafficPolicy rateLimit requests to uint32 max#8798
Merged
jukie merged 6 commits intoenvoyproxy:mainfrom Apr 21, 2026
Merged
fix: bound BackendTrafficPolicy rateLimit requests to uint32 max#8798jukie merged 6 commits intoenvoyproxy:mainfrom
jukie merged 6 commits intoenvoyproxy:mainfrom
Conversation
✅ Deploy Preview for cerulean-figolla-1f9435 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
The RLS config proto (RateLimitPolicy.requests_per_unit) and Envoy's TokenBucket (max_tokens / tokens_per_fill) are uint32 on the wire. RateLimitValue.Requests was unbounded in the CRD and narrowed with an unchecked uint32(...) cast in the xDS translator, so values above 4294967295 were silently truncated modulo 2^32 (e.g. 30000000000 -> 4230196224). Add kubebuilder Minimum=1 / Maximum=4294967295 markers so such values are rejected at admission with a clear schema error, and regenerate the CRDs and helm-template snapshots. The existing uint32(...) narrowings are now safe by construction. Includes CEL validation coverage for the boundary, the above-max case (using the 30B repro value), the zero case, and the local rate-limit path. Fixes envoyproxy#8797 Refs envoyproxy/ai-gateway#2012 Signed-off-by: Hrushikesh Patil <hrushikesh.patil@nutanix.com> Made-with: Cursor
PatilHrushikesh
force-pushed
the
btp-validation
branch
from
0207b9e to
c5ee160
Compare
PatilHrushikesh
changed the title
jukie
reviewed
Apr 20, 2026
Made-with: Cursor Signed-off-by: Hrushikesh Patil <hrushikesh.patil@nutanix.com> Made-with: Cursor
PatilHrushikesh
force-pushed
the
btp-validation
branch
from
cf140e2 to
00b7ec5
Compare
Bumps one rule in backendtrafficpolicy-with-ratelimit (gatewayapi) and multiple-rules (xds/translator RLS config) to 4294967295 to confirm the uint32 boundary renders end-to-end as requests_per_unit: 4294967295 without wraparound. Addresses review feedback on envoyproxy#8798. Signed-off-by: Hrushikesh Patil <hrushikesh.patil@nutanix.com>
jukie
approved these changes
Apr 20, 2026
jukie
requested changes
Apr 20, 2026
Comment on lines
+438
to
+442
| // The value is bounded by the uint32 range because the upstream rate | ||
| // limit service config proto (RateLimitPolicy.requests_per_unit) and | ||
| // Envoy's local rate-limit TokenBucket (max_tokens / tokens_per_fill) | ||
| // are uint32 on the wire. Values above 4294967295 would otherwise be | ||
| // silently truncated modulo 2^32. |
Signed-off-by: Hrushikesh Patil <hrushikesh.patil@nutanix.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8798 +/- ##
==========================================
- Coverage 74.43% 74.40% -0.04%
==========================================
Files 245 245
Lines 38973 38973
==========================================
- Hits 29010 28997 -13
- Misses 7960 7970 +10
- Partials 2003 2006 +3 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Signed-off-by: Hrushikesh Patil <hrushi2900@gmail.com>
Signed-off-by: Hrushikesh Patil <hrushi2900@gmail.com>
jukie
approved these changes
Apr 21, 2026
zirain
approved these changes
Apr 21, 2026
kkk777-7
approved these changes
Apr 21, 2026
Member
|
LGTM, thanks! |
Contributor
|
Great, thanks! |
skos-ninja
pushed a commit
to skos-ninja/envoy-gateway
that referenced
this pull request
May 1, 2026
…oyproxy#8798) * api: bound BackendTrafficPolicy rateLimit requests to uint32 max The RLS config proto (RateLimitPolicy.requests_per_unit) and Envoy's TokenBucket (max_tokens / tokens_per_fill) are uint32 on the wire. RateLimitValue.Requests was unbounded in the CRD and narrowed with an unchecked uint32(...) cast in the xDS translator, so values above 4294967295 were silently truncated modulo 2^32 (e.g. 30000000000 -> 4230196224). Add kubebuilder Minimum=1 / Maximum=4294967295 markers so such values are rejected at admission with a clear schema error, and regenerate the CRDs and helm-template snapshots. The existing uint32(...) narrowings are now safe by construction. Includes CEL validation coverage for the boundary, the above-max case (using the 30B repro value), the zero case, and the local rate-limit path. Fixes envoyproxy#8797 Refs envoyproxy/ai-gateway#2012 Signed-off-by: Hrushikesh Patil <hrushikesh.patil@nutanix.com> Made-with: Cursor * api: align rate-limit requests with uint32 limits Made-with: Cursor Signed-off-by: Hrushikesh Patil <hrushikesh.patil@nutanix.com> Made-with: Cursor * test: exercise uint32 max in rate-limit testdata Bumps one rule in backendtrafficpolicy-with-ratelimit (gatewayapi) and multiple-rules (xds/translator RLS config) to 4294967295 to confirm the uint32 boundary renders end-to-end as requests_per_unit: 4294967295 without wraparound. Addresses review feedback on envoyproxy#8798. Signed-off-by: Hrushikesh Patil <hrushikesh.patil@nutanix.com> * api: trim RateLimitValue.Requests docstring Signed-off-by: Hrushikesh Patil <hrushikesh.patil@nutanix.com> * xds/translator: drop redundant uint32 casts on RateLimitValue.Requests Signed-off-by: Hrushikesh Patil <hrushi2900@gmail.com> * fit lint and minor refactoring Signed-off-by: Hrushikesh Patil <hrushi2900@gmail.com> --------- Signed-off-by: Hrushikesh Patil <hrushikesh.patil@nutanix.com> Signed-off-by: Hrushikesh Patil <hrushi2900@gmail.com> Co-authored-by: Hrushikesh Patil <hrushikesh.patil@nutanix.com> Signed-off-by: Jake Oliver <jake@truelayer.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
api: boundBackendTrafficPolicyrate limitrequeststo uint32 maxWhat this PR does / why we need it:
RateLimitValue.Requestsis unbounded in the CRD but narrowed with an uncheckeduint32(...)cast in the xDS translator. Since the RLS config proto (RateLimitPolicy.requests_per_unit) and Envoy'sTokenBucket(max_tokens/tokens_per_fill) areuint32on the wire, values above4294967295get silently truncated modulo2^32(e.g.30000000000→4230196224, ~14% of intent). This PR adds+kubebuilder:validation:Minimum=1 / Maximum=4294967295toRateLimitValue.Requests, regenerates the CRDs and helm-template snapshots, and adds CEL validation coverage (boundary, above-max with the 30B repro value, zero, and the local-RL path). The existinguint32(...)narrowings ininternal/xds/translator/ratelimit.goandinternal/xds/translator/local_ratelimit.goare now safe by construction.Which issue(s) this PR fixes:
Fixes #8797
Refs envoyproxy/ai-gateway#2012
Release Notes: Yes