---
title: "Resource types"
url: "/reference/xds/resource-types/"
kind: "reference"
summary: "The xDS resource types Arion accepts from a control plane, the delta ADS transport, and the bootstrap keys that enable each."
---

> Arion site index: [/llms.txt](/llms.txt)

# Resource types

The xDS resource types Arion accepts from a control plane, the delta ADS transport, and the bootstrap keys that enable each.

Arion consumes dynamic configuration over a single aggregated xDS stream and accepts six resource families: listeners, clusters, endpoints, route configurations, secrets, and Arion extension resources such as [TDS](@/reference/xds/tds-resources.md).

## Transport

Arion implements the **incremental (delta) xDS protocol** over **ADS**: one `DeltaAggregatedResources` stream on `envoy.service.discovery.v3.AggregatedDiscoveryService`, carrying `DeltaDiscoveryRequest` / `DeltaDiscoveryResponse` messages for every type URL. The state-of-the-world variants and per-type streams (separate LDS/CDS/EDS/RDS/SDS endpoints) are not used by the proxy.

On connect, Arion sends wildcard subscriptions for the five Envoy resource types in this order: Secret, Cluster, ClusterLoadAssignment, Listener, RouteConfiguration. Extension type URLs are subscribed on demand. Reconnects carry `initial_resource_versions`, so an unchanged control plane does not need to resend resources. Responses larger than 10 MiB are rejected by the gRPC decoder.

## Enabling xDS

`dynamic_resources.ads_config` names a statically defined cluster that reaches the control plane; `node` identifies this proxy:

```yaml,name=arion.yaml,arion=fragment
envoy_bootstrap:
  node:
    id: arion-1
    cluster: edge
  dynamic_resources:
    ads_config:
      grpc_services:
        - envoy_grpc:
            cluster_name: xds_cluster
  static_resources:
    clusters:
      - name: xds_cluster
        type: STATIC
        connect_timeout: 0.25s
        lb_policy: ROUND_ROBIN
        typed_extension_protocol_options:
          envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
            "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
            explicit_http_config:
              http2_protocol_options: {}
        load_assignment:
          cluster_name: xds_cluster
          endpoints:
            - lb_endpoints:
                - endpoint:
                    address:
                      socket_address: { address: 127.0.0.1, port_value: 50051 }
```

Only `envoy_grpc` targets are accepted (`google_grpc` is refused). When several `grpc_services` are listed, Arion cycles through their cluster names until a connection succeeds, retrying every 10 seconds; endpoints within a cluster are load-balanced round-robin.

## Resource types

| Resource | Type URL | Delivered via | Replaces or updates |
|---|---|---|---|
| Listener (LDS) | `type.googleapis.com/envoy.config.listener.v3.Listener` | ADS delta stream | Adds, replaces or removes a whole listener, including its filter chains, access-log and tracing configuration. |
| Cluster (CDS) | `type.googleapis.com/envoy.config.cluster.v3.Cluster` | ADS delta stream | Adds, replaces or removes a cluster; health checking restarts for the cluster. |
| Endpoints (EDS) | `type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment` | ADS delta stream | Replaces the endpoint set of the cluster whose name matches the resource name. |
| Route configuration (RDS) | `type.googleapis.com/envoy.config.route.v3.RouteConfiguration` | ADS delta stream | Replaces or removes the route table referenced by `rds.route_config_name`, without touching the listener. |
| Secret (SDS) | `type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret` | ADS delta stream | Updates or removes a named certificate or validation context. Updates refresh affected listeners and clusters. Removal deletes the stored secret; existing listeners and clusters retain their built TLS contexts until those consumers are updated. |
| Arion extensions (TDS) | `type.googleapis.com/arion.extensions.filters.http.mcp.mcp_gateway.v3.Tool`, `...OpenApiToolSource`, `...DynamicMcpServer`, `...Toolkit` | ADS delta stream (extension resources) | Adds, replaces or removes MCP tools, OpenAPI tool sources, dynamic MCP servers and code-mode toolkits in a gateway's tool registry — see [TDS resources](@/reference/xds/tds-resources.md). |

## Per-resource opt-in

Listeners and clusters need no opt-in beyond `dynamic_resources`: whatever the control plane pushes is applied. The other types are pulled in by references in the configuration:

**RDS** — an HTTP connection manager that names a route configuration; only the ADS config source is accepted:

```yaml,arion=fragment
rds:
  config_source:
    ads: {}
  route_config_name: main
```

**EDS** — a cluster of type `EDS` with no `load_assignment` (the `eds_cluster_config` service-name override is refused, so the resource name must equal the cluster name):

```yaml,arion=fragment
clusters:
  - name: api
    type: EDS
    connect_timeout: 0.25s
    lb_policy: ROUND_ROBIN
```

**SDS** — a TLS context that references secrets by name only (an inline `sds_config` source is refused; delivery is always the ADS stream):

```yaml,arion=fragment
common_tls_context:
  tls_certificate_sds_secret_configs:
    - name: server-cert
```

**TDS** — an MCP gateway filter with `tds.config_name` set; see [TDS resources](@/reference/xds/tds-resources.md).

## Acknowledgement semantics

Each delta response carries one resource type. If any resource fails decoding or conversion to Arion's configuration model, the whole response is NACKed before any of its updates or removals are applied. Decoded resources are then applied individually: application failures are reported in a NACK naming each resource and reason, while successful changes stay applied. There is no rollback of those changes or atomic transaction across resource types.

A response not acknowledged internally within 20 seconds is NACKed with a timeout; this does not cancel application already in progress. Stream failures reconnect with exponential backoff from 1 to 20 seconds.