Resource types

Arion consumes dynamic configuration over a single aggregated xDS stream and accepts six resource families: listeners, clusters, endpoints, route configurations, secrets, and Arion extension resources such as TDS.

Transport

Arion implements the incremental (delta) xDS protocol over ADS: one DeltaAggregatedResources stream on envoy.service.discovery.v3.AggregatedDiscoveryService, carrying DeltaDiscoveryRequest / DeltaDiscoveryResponse messages for every type URL. The state-of-the-world variants and per-type streams (separate LDS/CDS/EDS/RDS/SDS endpoints) are not used by the proxy.

On connect, Arion sends wildcard subscriptions for the five Envoy resource types in this order: Secret, Cluster, ClusterLoadAssignment, Listener, RouteConfiguration. Extension type URLs are subscribed on demand. Reconnects carry initial_resource_versions, so an unchanged control plane does not need to resend resources. Responses larger than 10 MiB are rejected by the gRPC decoder.

Enabling xDS

dynamic_resources.ads_config names a statically defined cluster that reaches the control plane; node identifies this proxy:

envoy_bootstrap:
  node:
    id: arion-1
    cluster: edge
  dynamic_resources:
    ads_config:
      grpc_services:
        - envoy_grpc:
            cluster_name: xds_cluster
  static_resources:
    clusters:
      - name: xds_cluster
        type: STATIC
        connect_timeout: 0.25s
        lb_policy: ROUND_ROBIN
        typed_extension_protocol_options:
          envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
            "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
            explicit_http_config:
              http2_protocol_options: {}
        load_assignment:
          cluster_name: xds_cluster
          endpoints:
            - lb_endpoints:
                - endpoint:
                    address:
                      socket_address: { address: 127.0.0.1, port_value: 50051 }

Only envoy_grpc targets are accepted (google_grpc is refused). When several grpc_services are listed, Arion cycles through their cluster names until a connection succeeds, retrying every 10 seconds; endpoints within a cluster are load-balanced round-robin.

Resource types

Per-resource opt-in

Listeners and clusters need no opt-in beyond dynamic_resources: whatever the control plane pushes is applied. The other types are pulled in by references in the configuration:

RDS — an HTTP connection manager that names a route configuration; only the ADS config source is accepted:

rds:
  config_source:
    ads: {}
  route_config_name: main

EDS — a cluster of type EDS with no load_assignment (the eds_cluster_config service-name override is refused, so the resource name must equal the cluster name):

clusters:
  - name: api
    type: EDS
    connect_timeout: 0.25s
    lb_policy: ROUND_ROBIN

SDS — a TLS context that references secrets by name only (an inline sds_config source is refused; delivery is always the ADS stream):

common_tls_context:
  tls_certificate_sds_secret_configs:
    - name: server-cert

TDS — an MCP gateway filter with tds.config_name set; see TDS resources.

Acknowledgement semantics

Each delta response carries one resource type. If any resource fails decoding or conversion to Arion's configuration model, the whole response is NACKed before any of its updates or removals are applied. Decoded resources are then applied individually: application failures are reported in a NACK naming each resource and reason, while successful changes stay applied. There is no rollback of those changes or atomic transaction across resource types.

A response not acknowledged internally within 20 seconds is NACKed with a timeout; this does not cancel application already in progress. Stream failures reconnect with exponential backoff from 1 to 20 seconds.