Envoy HTTP/2 CANCEL frame does not trigger upstream deadline expiration

Direct Answer

In Envoy 1.28 a received HTTP/2 CANCEL frame is interpreted as a request deadline expiration. The core HTTP/2 codec sets the x-envoy‑upstream‑rq‑timeout header and forwards the deadline to the upstream cluster. This behavior is baked into the core and cannot be disabled with a flag.

How a Short xDS Lease Affects the Connection

When the xDS lease (the time Envoy keeps a control‑plane connection alive) expires, Envoy may close idle connections regardless of any per‑request deadlines. If a CANCEL arrives but the connection has not yet sent data, the lease expiry can terminate the stream before the deadline is processed.

Ensuring the CANCEL Is Treated as a Deadline

• Make sure the filter chain does not consume or drop CANCEL frames. A custom filter or WebAssembly module that handles cancellation internally will prevent the core from seeing the frame.
• Verify that the route’s idle_timeout and the cluster’s timeout settings are still in place; the CANCEL-derived deadline only affects the request, not the global connection timeout.
• There is no runtime toggle; the behavior is fixed in 1.28.

Verification Steps (Safe, Scoped)

1. Enable HTTP/2 debug logging to see the frame flow:

   # In the listener filter chain
   typed_per_filter_config:
     envoy.filters.network.http_connection_manager:
       "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
       log_level: debug
       # Ensure log_format includes h2_frame tags
   

2. Trigger a client abort (e.g., curl --max-time 1 http://slow‑endpoint) and watch the logs for a CANCEL frame and a “request deadline expired” event.
3. Inspect the upstream request headers with a simple proxy or by enabling envoy.filters.http.router logging. The header x-envoy‑upstream‑rq‑timeout should appear with the timeout value.
4. Test with a short xDS lease (e.g., 10 s) in the bootstrap and observe that the connection is closed once the lease expires, even if the CANCEL was received earlier.
5. Repeat the test with a minimal filter chain that passes all frames unchanged, then with a filter that consumes CANCEL frames to confirm the difference.

One Missing Diagnostic Detail

Does your filter chain include any custom filters or WebAssembly modules that process HTTP/2 frames? If so, the CANCEL might never reach Envoy’s core, preventing the deadline propagation.