[0xmc]

Summary

Every response through a load balancer was cut at about 15 seconds, so streams, large downloads and slow APIs failed mid-transfer with nothing in the proxy API to change it.

The generated route carried no timeout, so Envoy applied its own default, and the only way around it was an Envoy Gateway policy aimed at a route the user never created.

Each proxy rule now carries the Gateway API timeouts, with the request timeout defaulting to one hour and capped at the same limit the operator already enforces on policies.

A timeout of zero is refused, because Envoy Gateway would drop the idle timeout with it and leave abandoned streams open.

Test plan

• A 20-second streaming response completes through the edge with the default, and the same stream is cut when the rule sets a 5-second timeout
• A timeout above the maximum or of zero is refused at admission with a message naming the field and the limit
• Unit, envtest and lint pass
• After release, a production proxy streams past 15 seconds and the per-route timeout counter stops rising on routes that were cut

Fixes #459

[ecv]

Request changes.

The new request: 1h default silently overrides any shorter timeout a user already set with a BackendTrafficPolicy. In Envoy Gateway v1.8.1, getEffectiveRequestTimeout (internal/xds/translator/route.go:407-418) gives the HTTPRoute rule timeout precedence and only falls back to the policy's timeout.http.requestTimeout when the rule has none. After this change every generated rule carries one, so a user's deliberate 30s fail-fast limit becomes 1h on the first reconcile, with nothing in status to say so.

Ask: leave the rule timeout unset, or skip copying the default, when a BackendTrafficPolicy with requestTimeout targets the proxy, and cover that case in the chainsaw test.

Otherwise sound. Zero is refused for both fields in the webhook and controller, backendRequest is held to request by CEL, and the default is idempotent.

Follow-ups:

• The new startup check refuses httpMaxRequestTimeout below 1h, which was valid before. No known deployment sets it, but say so in the release notes.
• The default moves every existing proxy from Envoy's 15s to 1h, so release it on a tag of its own and watch edge connection counts.
• Lowering httpMaxRequestTimeout later turns stored proxies above it Invalid at reconcile; document that in the config docs.