From 05ae467b53708439f1e245ac73235c0fc2ae073a Mon Sep 17 00:00:00 2001 From: Rama Chavali Date: Sun, 3 May 2026 14:49:28 +0530 Subject: [PATCH 1/3] cleariy idle timeout docs Signed-off-by: Rama Chavali --- networking/v1alpha3/destination_rule.pb.go | 11 ++++++++--- networking/v1alpha3/destination_rule.pb.html | 13 +++++++++---- networking/v1alpha3/destination_rule.proto | 11 ++++++++--- 3 files changed, 25 insertions(+), 10 deletions(-) diff --git a/networking/v1alpha3/destination_rule.pb.go b/networking/v1alpha3/destination_rule.pb.go index abc3b42a55..c8b3f7f5b3 100644 --- a/networking/v1alpha3/destination_rule.pb.go +++ b/networking/v1alpha3/destination_rule.pb.go @@ -2418,14 +2418,19 @@ type ConnectionPoolSettings_TCPSettings struct { // was established. If not set, there is no max duration. When `maxConnectionDuration` // is reached the connection will be closed. Duration must be at least 1ms. MaxConnectionDuration *duration.Duration `protobuf:"bytes,4,opt,name=max_connection_duration,json=maxConnectionDuration,proto3" json:"max_connection_duration,omitempty"` - // The idle timeout for TCP connections. - // The idle timeout is defined as the period in which there are no bytes sent or received on either - // the upstream or downstream connection. + // The idle timeout for TCP connections. This is applied to the outbound TCP proxy + // filter on the listener for the upstream cluster. + // The idle timeout is defined as the period in which there are no bytes sent or received on the + // upstream connection. // If not set, the default idle timeout is 1 hour. If set to 0s, the timeout will be disabled. // Idle timeout is not configured per each cluster individually when weighted destinations are used, // because idleTimeout is a property of a listener, not a cluster. In that case, idleTimeout // specified in a destination rule for the first weighted route is configured in the listener, // which means also for all weighted routes. + // To set the idle timeout for downstream (inbound) TCP connections, use the + // `idleTimeout` field in the proxy configuration (e.g., via the `proxy.istio.io/config` + // annotation) or use an EnvoyFilter to patch the inbound listener's + // `envoy.filters.network.tcp_proxy` network filter. // +protoc-gen-crd:duration-validation:none IdleTimeout *duration.Duration `protobuf:"bytes,5,opt,name=idle_timeout,json=idleTimeout,proto3" json:"idle_timeout,omitempty"` unknownFields protoimpl.UnknownFields diff --git a/networking/v1alpha3/destination_rule.pb.html b/networking/v1alpha3/destination_rule.pb.html index f2e065f0ee..91f9199ecd 100644 --- a/networking/v1alpha3/destination_rule.pb.html +++ b/networking/v1alpha3/destination_rule.pb.html @@ -1111,14 +1111,19 @@

TCPSettings

Duration
-

The idle timeout for TCP connections. -The idle timeout is defined as the period in which there are no bytes sent or received on either -the upstream or downstream connection. +

The idle timeout for TCP connections. This is applied to the outbound TCP proxy +filter on the listener for the upstream cluster. +The idle timeout is defined as the period in which there are no bytes sent or received on the +upstream connection. If not set, the default idle timeout is 1 hour. If set to 0s, the timeout will be disabled. Idle timeout is not configured per each cluster individually when weighted destinations are used, because idleTimeout is a property of a listener, not a cluster. In that case, idleTimeout specified in a destination rule for the first weighted route is configured in the listener, -which means also for all weighted routes.

+which means also for all weighted routes. +To set the idle timeout for downstream (inbound) TCP connections, use the +idleTimeout field in the proxy configuration (e.g., via the proxy.istio.io/config +annotation) or use an EnvoyFilter to patch the inbound listener’s +envoy.filters.network.tcp_proxy network filter.

diff --git a/networking/v1alpha3/destination_rule.proto b/networking/v1alpha3/destination_rule.proto index ff76a60204..1125f6edba 100644 --- a/networking/v1alpha3/destination_rule.proto +++ b/networking/v1alpha3/destination_rule.proto @@ -630,14 +630,19 @@ message ConnectionPoolSettings { // is reached the connection will be closed. Duration must be at least 1ms. google.protobuf.Duration max_connection_duration = 4; - // The idle timeout for TCP connections. - // The idle timeout is defined as the period in which there are no bytes sent or received on either - // the upstream or downstream connection. + // The idle timeout for TCP connections. This is applied to the outbound TCP proxy + // filter on the listener for the upstream cluster. + // The idle timeout is defined as the period in which there are no bytes sent or received on the + // upstream connection. // If not set, the default idle timeout is 1 hour. If set to 0s, the timeout will be disabled. // Idle timeout is not configured per each cluster individually when weighted destinations are used, // because idleTimeout is a property of a listener, not a cluster. In that case, idleTimeout // specified in a destination rule for the first weighted route is configured in the listener, // which means also for all weighted routes. + // To set the idle timeout for downstream (inbound) TCP connections, use the + // `idleTimeout` field in the proxy configuration (e.g., via the `proxy.istio.io/config` + // annotation) or use an EnvoyFilter to patch the inbound listener's + // `envoy.filters.network.tcp_proxy` network filter. // +protoc-gen-crd:duration-validation:none google.protobuf.Duration idle_timeout = 5; } From fe045441c2946e5df730dfd28181a8f4adbadd4d Mon Sep 17 00:00:00 2001 From: Rama Chavali Date: Mon, 4 May 2026 10:31:07 +0530 Subject: [PATCH 2/3] update docs Signed-off-by: Rama Chavali --- networking/v1alpha3/destination_rule.pb.go | 8 +++----- networking/v1alpha3/destination_rule.pb.html | 8 +++----- networking/v1alpha3/destination_rule.proto | 8 +++----- 3 files changed, 9 insertions(+), 15 deletions(-) diff --git a/networking/v1alpha3/destination_rule.pb.go b/networking/v1alpha3/destination_rule.pb.go index c8b3f7f5b3..3fb209b95e 100644 --- a/networking/v1alpha3/destination_rule.pb.go +++ b/networking/v1alpha3/destination_rule.pb.go @@ -2418,8 +2418,7 @@ type ConnectionPoolSettings_TCPSettings struct { // was established. If not set, there is no max duration. When `maxConnectionDuration` // is reached the connection will be closed. Duration must be at least 1ms. MaxConnectionDuration *duration.Duration `protobuf:"bytes,4,opt,name=max_connection_duration,json=maxConnectionDuration,proto3" json:"max_connection_duration,omitempty"` - // The idle timeout for TCP connections. This is applied to the outbound TCP proxy - // filter on the listener for the upstream cluster. + // The idle timeout for TCP connections. This is applied to the outbound connections to the upstream service. // The idle timeout is defined as the period in which there are no bytes sent or received on the // upstream connection. // If not set, the default idle timeout is 1 hour. If set to 0s, the timeout will be disabled. @@ -2427,10 +2426,9 @@ type ConnectionPoolSettings_TCPSettings struct { // because idleTimeout is a property of a listener, not a cluster. In that case, idleTimeout // specified in a destination rule for the first weighted route is configured in the listener, // which means also for all weighted routes. - // To set the idle timeout for downstream (inbound) TCP connections, use the + // To set the idle timeout for downstream (inbound) connections, use the // `idleTimeout` field in the proxy configuration (e.g., via the `proxy.istio.io/config` - // annotation) or use an EnvoyFilter to patch the inbound listener's - // `envoy.filters.network.tcp_proxy` network filter. + // annotation) which applies to all inbound connections. // +protoc-gen-crd:duration-validation:none IdleTimeout *duration.Duration `protobuf:"bytes,5,opt,name=idle_timeout,json=idleTimeout,proto3" json:"idle_timeout,omitempty"` unknownFields protoimpl.UnknownFields diff --git a/networking/v1alpha3/destination_rule.pb.html b/networking/v1alpha3/destination_rule.pb.html index 91f9199ecd..a61436eae8 100644 --- a/networking/v1alpha3/destination_rule.pb.html +++ b/networking/v1alpha3/destination_rule.pb.html @@ -1111,8 +1111,7 @@

TCPSettings

Duration
-

The idle timeout for TCP connections. This is applied to the outbound TCP proxy -filter on the listener for the upstream cluster. +

The idle timeout for TCP connections. This is applied to the outbound connections to the upstream service. The idle timeout is defined as the period in which there are no bytes sent or received on the upstream connection. If not set, the default idle timeout is 1 hour. If set to 0s, the timeout will be disabled. @@ -1120,10 +1119,9 @@

TCPSettings

because idleTimeout is a property of a listener, not a cluster. In that case, idleTimeout specified in a destination rule for the first weighted route is configured in the listener, which means also for all weighted routes. -To set the idle timeout for downstream (inbound) TCP connections, use the +To set the idle timeout for downstream (inbound) connections, use the idleTimeout field in the proxy configuration (e.g., via the proxy.istio.io/config -annotation) or use an EnvoyFilter to patch the inbound listener’s -envoy.filters.network.tcp_proxy network filter.

+annotation) which applies to all inbound connections.

diff --git a/networking/v1alpha3/destination_rule.proto b/networking/v1alpha3/destination_rule.proto index 1125f6edba..d132fdc15d 100644 --- a/networking/v1alpha3/destination_rule.proto +++ b/networking/v1alpha3/destination_rule.proto @@ -630,8 +630,7 @@ message ConnectionPoolSettings { // is reached the connection will be closed. Duration must be at least 1ms. google.protobuf.Duration max_connection_duration = 4; - // The idle timeout for TCP connections. This is applied to the outbound TCP proxy - // filter on the listener for the upstream cluster. + // The idle timeout for TCP connections. This is applied to the outbound connections to the upstream service. // The idle timeout is defined as the period in which there are no bytes sent or received on the // upstream connection. // If not set, the default idle timeout is 1 hour. If set to 0s, the timeout will be disabled. @@ -639,10 +638,9 @@ message ConnectionPoolSettings { // because idleTimeout is a property of a listener, not a cluster. In that case, idleTimeout // specified in a destination rule for the first weighted route is configured in the listener, // which means also for all weighted routes. - // To set the idle timeout for downstream (inbound) TCP connections, use the + // To set the idle timeout for downstream (inbound) connections, use the // `idleTimeout` field in the proxy configuration (e.g., via the `proxy.istio.io/config` - // annotation) or use an EnvoyFilter to patch the inbound listener's - // `envoy.filters.network.tcp_proxy` network filter. + // annotation) which applies to all inbound connections. // +protoc-gen-crd:duration-validation:none google.protobuf.Duration idle_timeout = 5; } From 4befce1479a4c73b728007505aaa14bf44ab06b2 Mon Sep 17 00:00:00 2001 From: Rama Chavali Date: Fri, 8 May 2026 10:36:53 +0530 Subject: [PATCH 3/3] update docs Signed-off-by: Rama Chavali --- networking/v1alpha3/destination_rule.pb.go | 9 ++++++++- networking/v1alpha3/destination_rule.pb.html | 6 +++++- networking/v1alpha3/destination_rule.proto | 7 ++++++- 3 files changed, 19 insertions(+), 3 deletions(-) diff --git a/networking/v1alpha3/destination_rule.pb.go b/networking/v1alpha3/destination_rule.pb.go index 3fb209b95e..773b869045 100644 --- a/networking/v1alpha3/destination_rule.pb.go +++ b/networking/v1alpha3/destination_rule.pb.go @@ -2427,8 +2427,15 @@ type ConnectionPoolSettings_TCPSettings struct { // specified in a destination rule for the first weighted route is configured in the listener, // which means also for all weighted routes. // To set the idle timeout for downstream (inbound) connections, use the - // `idleTimeout` field in the proxy configuration (e.g., via the `proxy.istio.io/config` + // `ISTIO_META_IDLE_TIMEOUT` field in the proxy configuration (e.g., via the `proxy.istio.io/config` // annotation) which applies to all inbound connections. + // ``` + // proxy.istio.io/config: |- + // + // proxyMetadata: + // ISTIO_META_IDLE_TIMEOUT: "100s" + // + // ``` // +protoc-gen-crd:duration-validation:none IdleTimeout *duration.Duration `protobuf:"bytes,5,opt,name=idle_timeout,json=idleTimeout,proto3" json:"idle_timeout,omitempty"` unknownFields protoimpl.UnknownFields diff --git a/networking/v1alpha3/destination_rule.pb.html b/networking/v1alpha3/destination_rule.pb.html index a61436eae8..dfd14d87ec 100644 --- a/networking/v1alpha3/destination_rule.pb.html +++ b/networking/v1alpha3/destination_rule.pb.html @@ -1120,8 +1120,12 @@

TCPSettings

specified in a destination rule for the first weighted route is configured in the listener, which means also for all weighted routes. To set the idle timeout for downstream (inbound) connections, use the -idleTimeout field in the proxy configuration (e.g., via the proxy.istio.io/config +ISTIO_META_IDLE_TIMEOUT field in the proxy configuration (e.g., via the proxy.istio.io/config annotation) which applies to all inbound connections.

+
proxy.istio.io/config: |-
+   proxyMetadata:
+      ISTIO_META_IDLE_TIMEOUT: "100s"
+
diff --git a/networking/v1alpha3/destination_rule.proto b/networking/v1alpha3/destination_rule.proto index d132fdc15d..13da2da6ec 100644 --- a/networking/v1alpha3/destination_rule.proto +++ b/networking/v1alpha3/destination_rule.proto @@ -639,8 +639,13 @@ message ConnectionPoolSettings { // specified in a destination rule for the first weighted route is configured in the listener, // which means also for all weighted routes. // To set the idle timeout for downstream (inbound) connections, use the - // `idleTimeout` field in the proxy configuration (e.g., via the `proxy.istio.io/config` + // `ISTIO_META_IDLE_TIMEOUT` field in the proxy configuration (e.g., via the `proxy.istio.io/config` // annotation) which applies to all inbound connections. + // ``` + // proxy.istio.io/config: |- + // proxyMetadata: + // ISTIO_META_IDLE_TIMEOUT: "100s" + // ``` // +protoc-gen-crd:duration-validation:none google.protobuf.Duration idle_timeout = 5; }