envoyproxy/envoy

Title: Envoy support HTTP Query Method (RFC 10008) Description: Currently, Envoy is not supporting HTTP Query Method and return 400 Bad Request. HTTP Query method has been released in June 2026. is there any timeline to start supporting this method? [optional Relevant Links:] https://datatracker.ietf.org/doc/html/rfc10008

Title: Envoys do not use previous secret discovery provider when fetch timeout is changed Description: This is an identical issue to #32283 but for SDS instead. A change in the fetch timeout on the SDS config provider causes the SDS secrets to be discarded and request new SDS secrets. However the control plane does not receive the fetch timeout as part of the secret request so it does not send the secrets again. This causes the secret discovery provider to stop until the fetch timeout occurs and the listener finally warms. At that point new connections are rejected until either the envoy is restarted or the secret is changed. Repro steps: I have a PR with a repro and fix in #46154

RLQS RateLimitStrategy only supports absolute counts, not percentage/ratio-based limits Description: The Rate Limit Quota Service (RLQS) protocol expresses quota assignments via type.v3.RateLimitStrategy, which currently supports only: blanket_rule (allow all / deny all) requests_per_time_unit (an absolute uint64 count per time unit) token_bucket (absolute max tokens + fill rate) There is no way to express a quota as a percentage or ratio of some baseline (e.g. "allow 10% of traffic to this bucket" or "shed 25% of requests"). This would be useful for use cases like gradual rollout/ramp-up of a rate limiting policy, proportional load shedding across buckets, or percentage-based traffic shaping that scales automatically with incoming volume instead of requiring a control plane to compute and continuously update absolute request-per-second figures. Requesting a new RateLimitStrategy variant (e.g. PercentageRule or ratio) that lets the control plane express limits as a percentage/fractio

Title: Reporting Interval not configurable from EnvoyFilters. Description: Currently we have the reporting_interval as hardcoded in the Envoy layer. We have a use-case to push the rate-limit-quota usage reports more frequently , more like every 1sec. Git code : https://github.com/envoyproxy/envoy/blob/main/source/extensions/filters/http/rate_limit_quota/filter_persistence.cc#L45C48-L45C52 Need help to override this interval , if there is a way to do so, please let us know. [optional Relevant Links:] Any extra documentation required to understand the issue.

Title: dynamic_modules/tls: support auto_host_sni for runtime hosts and SNI-scoped session reuse Description: I would like to propose making auto_host_sni usable with hosts added at runtime by dynamic-module clusters, and making upstream TLS session reuse safe when one shared UpstreamTlsContext connects to multiple effective SNI names. cc @wbpcode for visibility/context. Today, dynamic-module clusters can add hosts dynamically, but the host-add ABI only carries socket addresses. For HTTPS upstreams using: auto_host_sni: true auto_sni_san_validation: true Envoy needs a logical hostname on the selected HostDescription, separate from the concrete socket address used to connect. Without that, runtime-added hosts cannot cleanly use host-driven SNI/SAN validation without pushing per-host transport socket config through xDS. There is also a related TLS correctness issue: upstream client TLS sessions are currently cached at ClientContextImpl scope. That is fine when a client TLS context maps t