Avoiding infrastructure annotations limits

[sashalarsoo]

Hey,
For now the field of gateway spec.infrastructure.annotations has a limit of 8. I need 9 annotations to provision my external lb, is there a way to bypass this limit with envoy ?

[arkodg]

use https://gateway.envoyproxy.io/docs/tasks/operations/customize-envoyproxy/#customize-envoyproxy-service-annotations

[sashalarsoo]

Hey thanks its working. But i see some issue: when adding my cloud provider annotation to add proxy protocol https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengconfiguringloadbalancersnetworkloadbalancers-subtopic.htm#contengcreatingloadbalancer_topic_Enabling_proxy_protocol i have got instantly connexion failed. Using ingress nginx as current ingress controler there is no problem with this annotation.

Here is my envoyproxy conf:

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: custom-proxy-config
  namespace: envoy-gateway-system
spec:
  provider:
    type: Kubernetes
    kubernetes:
      envoyService:
        externalTrafficPolicy: Cluster
        annotations:
          service.beta.kubernetes.io/oci-load-balancer-subnet1: 'ocixxxxxxxxxx'
          service.beta.kubernetes.io/oci-load-balancer-connection-proxy-protocol-version: "2"
          service.beta.kubernetes.io/oci-load-balancer-shape: flexible
          service.beta.kubernetes.io/oci-load-balancer-shape-flex-min: '10'
          service.beta.kubernetes.io/oci-load-balancer-shape-flex-max: '50'
          service.beta.kubernetes.io/oci-load-balancer-internal: 'true'
          oci.oraclecloud.com/initial-freeform-tags-override: '{"Name": "envoy"}'
          service.beta.kubernetes.io/oci-load-balancer-security-list-management-mode: None
          

Here are the logs for the gateway data plane when request arriving:

{":authority":null,"bytes_received":0,"bytes_sent":0,"connection_termination_details":null,"downstream_local_address":"10.244.4.25:10443","downstream_remote_address":"10.244.1.128:2209","duration":0,"method":null,"protocol":null,"requested_server_name":null,"response_code":0,"response_code_details":"filter_chain_not_found","response_flags":"NR","route_name":null,"start_time":"2025-11-26T14:58:27.366Z","upstream_cluster":null,"upstream_host":null,"upstream_local_address":null,"upstream_transport_failure_reason":null,"user-agent":null,"x-envoy-origin-path":null,"x-envoy-upstream-service-time":null,"x-forwarded-for":null,"x-request-id":null}

[sashalarsoo]

Found the issue, it works when adding enableProxyProtocol: true to clienttrafficpolicy

[zirain]

I think this's a good question to raise on upstream.