# Configuring low-level envoy proxy settings in the consul-api-gateway

**URL:** <https://discuss.hashicorp.com/t/configuring-low-level-envoy-proxy-settings-in-the-consul-api-gateway/42356>\
**Category:** Consul\
**Tags:** consul-api-gateway\
**Created:** [July 22, 2022, 9:41pm UTC](https://discuss.hashicorp.com/t/configuring-low-level-envoy-proxy-settings-in-the-consul-api-gateway/42356 "2022-07-22T21:41:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![immabird](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/immabird/32/29547_2.png) [@immabird](https://discuss.hashicorp.com/u/immabird)\
**Post date:** [July 22, 2022, 9:41pm UTC](https://discuss.hashicorp.com/t/configuring-low-level-envoy-proxy-settings-in-the-consul-api-gateway/42356/1 "2022-07-22T21:41:47Z")

</div>

Hello, I was trying to follow [this guide](https://www.consul.io/docs/connect/config-entries/proxy-defaults#configuration) to configure the underlying envoy proxy of the consul-api-gateway. My goal was to add the [Lua http filter](https://www.envoyproxy.io/docs/envoy/v1.17.2/configuration/http/http_filters/lua_filter#overview) to the envoy proxy in the consul-api-gateway.

My config file looks like this:

```auto
---
apiVersion: consul.hashicorp.com/v1alpha1
kind: ProxyDefaults
metadata:
  name: global
spec:
  config:
    lua_filter:
      name: envoy.filters.http.lua
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
        inline_code: |
          -- Called on the response path.
          function envoy_on_response(response_handle)
            response_handle:headers():add("some_header", "some_value")
          end

```

I used the command `kubectl apply -f filename.yaml` to apply it. No matter what I do I can’t seem to get any config changes to work for the envoy proxy. Any advice as to what I’m doing wrong would be greatly appreciated. Thanks!

---

<div class="post-metadata">

**Author:** ![andrewstucki](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/andrewstucki/32/23470_2.png) [@andrewstucki](https://discuss.hashicorp.com/u/andrewstucki)\
**Post date:** [July 26, 2022, 5:41pm UTC](https://discuss.hashicorp.com/t/configuring-low-level-envoy-proxy-settings-in-the-consul-api-gateway/42356/2 "2022-07-26T17:41:42Z")

</div>

Hi @immabird unfortunately ProxyDefaults only apply to specific mesh service proxies (i.e. services that aren’t gateways). There have been some issues created some time ago to allow for adding escape hatch overrides to ingress gateways (API Gateways are custom ingress gateways):

> [@Using Escape Hatch Overrides with Ingress Gateway](https://discuss.hashicorp.com/t/using-escape-hatch-overrides-with-ingress-gateway/10834):
>
> I am trying to configure an Ingress Gateway to use Envoy escape hatch overrides, namely the [“envoy\_public\_listeners\_json”](https://www.consul.io/docs/connect/proxies/envoy#envoy_public_listener_json) flag. In the docs for an Ingress Gateway it says you can use [escape hatch overrides](https://www.consul.io/docs/connect/ingress-gateway), but I am not able to get this to work. Here is how I am configuring my ingress gateway currently. I am using “consul config write ingress-service.hcl” to write the config file to my consul agent, alongside a service router whose name is “api”. When I try to add an escape hatch to the config …

and the corresponding GitHub issue here:

> <https://github.com/hashicorp/consul/issues/8722>
>
> Ingress gateways are unable to utilize any of the existing listener escape hatch… overrides.
> 
> At the moment, \[their upstream config is generated\](https://github.com/hashicorp/consul/blob/master/agent/proxycfg/state.go#L1478) from the \`GatewayService\` type which comes from the ingress gateway config entry. One potential solution is to accept a listener override in the \[ingress listener definition\](https://www.consul.io/docs/agent/config-entries/ingress-gateway#listeners).
> 
> A caveat with using that escape hatch is that we need to document that users need to ensure the \[route\_config\_name is set to the listener port\](https://github.com/hashicorp/consul/blob/master/agent/xds/testdata/listeners/ingress-http-multiple-services.envoy-1-12-x.golden#L29), since this is the key we use for RDS routes.
> 
> For additional context see this discuss thread: https://discuss.hashicorp.com/t/using-escape-hatch-overrides-with-ingress-gateway/10834

from a corresponding comment in another issue, it looks like we just got this put on an internal roadmap for the core Consul team, but I can’t give you an estimate as to when this would be supported yet:

> <https://github.com/hashicorp/consul/issues/13374#issuecomment-1175173880>
>
> Team,
> I have a service deployed in a mesh and I am leveraging ingress gateway t…o route traffic from outside to my service. 
> My service serves HTTP traffic and have long running connections to the service, service can have up to 25k open connections. 
> 
> I am simulating 20k open connections for performance evaluation and running into this error: 
> \`Sending local reply with details upstream\_reset\_before\_response\_started{overflow}\` 
> and receiving 503 response for the request. 
> 
> Here is a diagram which shows the communication flow: 
> \<img width="970" alt="Screen Shot 2022-06-06 at 3 37 15 PM" src="https://user-images.githubusercontent.com/30634133/172244604-1e9157f0-30a8-4818-a724-712a8141f5a7.png"\>
> 
> As I understand, I would need to update the max connection configuration at two places: 
> \- connect-proxy (running as a sidecar task for Service A)
> \- Ingress gateway
> 
> Here is the configuration that I have tried but no luck with resolving the issue: 
> \- Configuration for connect-proxy:
> \`\`\`
> connect {
> sidecar\_service {
> proxy {
> config {
> local\_request\_timeout\_ms = 0
> envoy\_local\_cluster\_json = \<\<EOF
> {
> "@type": "type.googleapis.com/envoy.config.cluster.v3.Cluster",
> "name": "local\_app",
> "type": "STATIC",
> "connect\_timeout": "5s",
> "circuit\_breakers": {
> "thresholds": \[
> {
> "priority": "DEFAULT",
> "max\_connections": 10000,
> "max\_requests": 10000
> }
> \]
> },
> "load\_assignment": {
> "cluster\_name": "local\_app",
> "endpoints": \[
> {
> "lb\_endpoints": \[
> {
> "endpoint": {
> "address": {
> "socket\_address": {
> "address": "127.0.0.1",
> "port\_value": 2001
> }
> }
> }
> }
> \]
> }
> \]
> }
> }
> EOF
> }
> }
> }
> }
> \`\`\`
> I was able to verify the max connection change in config\_dump on connect-proxy 
> 
> \- Configuration for ingress-gateway 
> \`\`\`
> consul config read -kind service-defaults -name ingress
> {
> "Kind": "service-defaults",
> "Name": "ingress",
> "TransparentProxy": {},
> "MeshGateway": {},
> "Expose": {},
> "UpstreamConfig": {
> "Defaults": {
> "Limits": {
> "MaxConnections": 10000,
> "MaxPendingRequests": 512,
> "MaxConcurrentRequests": 10000
> },
> "MeshGateway": {}
> }
> }
> }
> 
> \`\`\`
> config\_dump on ingress gateway did not update. 
> 
> Is this configuration even supported?
> If currently not, is there any workaround to first at least test it out? 
>  
> Appreciate any assistance on this ticket. 
> 
> Versions: 
> Consul - 1.10.8
> Nomad - 1.2.6
> 
> 
> Related ticket: 
> https://github.com/hashicorp/consul/issues/12373

---

<div class="post-metadata">

**Author:** ![immabird](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/immabird/32/29547_2.png) [@immabird](https://discuss.hashicorp.com/u/immabird)\
**Post date:** [July 26, 2022, 5:54pm UTC](https://discuss.hashicorp.com/t/configuring-low-level-envoy-proxy-settings-in-the-consul-api-gateway/42356/3 "2022-07-26T17:54:34Z")

</div>

Thanks for the detailed information! I was not aware there was a distinction between gateways and services I thought they were treated equally as part of the mesh. You saved me a lot of time because I was determined to keep trying things until it worked lol.

---

<div class="post-metadata">

**Author:** ![acarrilho](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/acarrilho/32/31398_2.png) [@acarrilho](https://discuss.hashicorp.com/u/acarrilho)\
**Post date:** [October 17, 2022, 10:05am UTC](https://discuss.hashicorp.com/t/configuring-low-level-envoy-proxy-settings-in-the-consul-api-gateway/42356/4 "2022-10-17T10:05:15Z")

</div>

I am trying to do a similar thing but for specific proxies (pod level sidecar). To test I’m applying this as a global proxyDefault but it doesn’t seem to be working for me. Config is as follows:

```auto
apiVersion: consul.hashicorp.com/v1alpha1
kind: ProxyDefaults
metadata:
  name: global
spec:
  config:
    lua_filter:
      name: envoy.filters.http.lua
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
        inline_code: |
          -- Called on the response path.
          function envoy_on_response(response_handle)
            response_handle:headers():add("some_header", "some_value")
            responde_handle:logInfo("Logging Hello")
          end

```

But I don’t see the message “Logging Hello” in the stdout/logs.  
Should I be applying this in a different way?