Route timeout behavior during retry attempts in Envoy

Timeout Calculation in Envoy Retries

The total route timeout acts as a hard ceiling for the entire request lifecycle. It includes the time spent on all previous failed retry attempts, as well as the time spent on the current attempt. The timer starts when the first downstream request is received and is not reset when a retry is triggered.

Interaction Logic

Envoy evaluates two timers concurrently during a request: the global route timeout and the per_try_timeout. The request is terminated as soon as either timer expires.

• Route Timeout: The maximum wall-clock time allowed for the entire request, regardless of how many retries occur.
• Per-Try Timeout: The maximum time allowed for a single upstream attempt.

Termination Scenarios

A request is terminated by the global route timeout before the final per_try_timeout expires when the remaining time budget is less than the configured per-try limit. For example, if the route timeout is 2 seconds and two previous attempts have already consumed 1.7 seconds, the third attempt will be terminated after 0.3 seconds, even if the per_try_timeout is set to 500ms.

Verification Steps

To verify this behavior in a test environment (assuming Envoy v1.18+), use the following configuration logic:

1. Set timeout: 2s and per_try_timeout: 500ms.
2. Configure a retry policy for 3 attempts.
3. Point the route to an upstream service that artificially delays responses by 600ms.
4. Observe the results: the first two attempts will fail due to per_try_timeout (at 500ms each). The third attempt will be terminated by the route timeout after approximately 1 second of total elapsed time (or the remaining budget), resulting in a 504 Gateway Timeout.

Diagnostic Verification

You can distinguish between these two timeout sources using Envoy statistics:

Statistic Counter	Meaning
retry_timeout	The individual attempt exceeded the per_try_timeout.
downstream_cx_total_timeout	The overall request exceeded the route-level timeout.

Note: Please specify if you are using a version of Envoy prior to 1.18, as older versions may handle per-attempt limits differently.