Make downstream Listener connection limit configurable

[sunjayBhatia]

Please describe the problem you have

This is often useful for large installations in order to manage resources, prevent DDOS, etc. and falls in line with Envoys edge proxy guidelines: https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/edge

This is an explicit follow on from #4717 to make key edge best practices configurable

[github-actions]

The Contour project currently lacks enough contributors to adequately respond to all Issues.

This bot triages Issues according to the following rules:

• After 60d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, the Issue is closed

You can:

• Mark this Issue as fresh by commenting
• Close this Issue
• Offer to help out with triage

Please send feedback to the #contour channel in the Kubernetes Slack

[flawedmatrix]

Hi, we'd like help out and work on this issue.

[sunjayBhatia]

thanks @flawedmatrix @christianang!

[sunjayBhatia]

hm, github won't let me assign both of yall atm

[sunjayBhatia]

@flawedmatrix @christianang I may have misspoke when we chatted about configuring Listener downstream connection limits, I don't believe it can be done by a field on the Listener object itself, rather via "runtime" configuration: https://www.envoyproxy.io/docs/envoy/latest/configuration/listeners/runtime

[sunjayBhatia]

there is a global downstream connection limit available to configure, that we could maybe make a follow-on issue for: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/resource_monitors/downstream_connections/v3/downstream_connections.proto.html