Data Plane Configuration

The data plane configuration file is located at gateway/configs/dataplane/config.yaml. It controls every aspect of the data plane process: node identity, control plane connection, logging, access logging, runtime behavior, performance tuning, protection limits, TLS, and feature flags.

Node Identity

Parameter	Type	Default	Description
`nodeId`	string	`dp-local`	Unique identifier for this data plane instance
`cluster`	string	`default`	Logical cluster name this instance belongs to

The nodeId must be unique across all data plane instances connected to the same control plane. In Kubernetes, the Helm chart sets this to the pod name automatically. The cluster field groups data planes into logical clusters for multi-cluster deployments.

Control Plane Connection

Parameter	Type	Default	Description
`controlPlaneAddr`	string	`http://127.0.0.1:18080`	Address of the control plane gRPC server
`adminAddr`	string	`127.0.0.1:19080`	Address for the data plane’s own admin HTTP server

The controlPlaneAddr is the gRPC endpoint where the data plane connects to receive configuration snapshots. Use https:// when TLS is enabled on the control plane’s gRPC server.

The adminAddr is the data plane’s own admin HTTP server, used by the control plane for health checks and aggregation.

Logging

The data plane uses Rust’s tracing framework with fine-grained per-module control:

Parameter	Type	Default	Description
`log.level`	string	`info,nantian_core::connectors=off`	Tracing filter directives
`log.format`	string	`json`	Output format: `json` or `text`
`log.addSource`	bool	`false`	Include source file and line number
`log.includeTarget`	bool	`false`	Include the tracing target (Rust module path)
`log.includeThreadIds`	bool	`false`	Include thread IDs
`log.includeThreadNames`	bool	`false`	Include thread names
`log.nonBlocking`	bool	`true`	Use non-blocking log output
`log.nonBlockingBufferedLines`	int	`65536`	Ring buffer capacity for non-blocking logging
`log.dropWhenFull`	bool	`true`	Drop logs when the buffer is full

The level field accepts tracing filter syntax for per-module granularity: info,hyper=warn,tower=debug.

OpenTelemetry Log Export

Parameter	Type	Default	Description
`log.openTelemetry.enabled`	bool	`false`	Export logs via OpenTelemetry
`log.openTelemetry.endpoint`	string	`""`	OTLP collector endpoint
`log.openTelemetry.protocol`	string	`grpc`	OTLP protocol: `grpc` or `http`
`log.openTelemetry.timeoutMs`	int	`3000`	Export timeout in milliseconds
`log.openTelemetry.insecure`	bool	`false`	Use insecure connection to the collector
`log.openTelemetry.sampleRatio`	float	`1.0`	Sampling ratio (0.0 to 1.0)
`log.openTelemetry.serviceName`	string	`nantian-dataplane`	Service name in exported data
`log.openTelemetry.serviceNamespace`	string	`""`	Service namespace in exported data

Admin Authentication

Parameter	Type	Default	Description
`adminAuth.bearerToken`	string	`""`	Static bearer token for admin API authentication
`adminAuth.bearerTokenFile`	string	`""`	Path to a file containing the bearer token

Access Logging

Access logs record every request processed by the data plane:

Parameter	Type	Default	Description
`accessLog.enabled`	bool	`false`	Enable access logging
`accessLog.path`	string	`stdout`	Output path (`stdout`, `stderr`, or file path)
`accessLog.format`	string	(see below)	Log format string with placeholders
`accessLog.mode`	string	`json`	Output mode: `json` or `text`
`accessLog.sampleRate`	float	`0.01`	Sampling rate (0.0 to 1.0)
`accessLog.routeAnnotationPrefix`	string	`gateway.nantian.dev/access-log-`	Annotation prefix for per-route log configuration

Available format placeholders: %TIMESTAMP%, %EVENT%, %PROTOCOL%, %LISTENER%, %CLIENT_IP%, %HOST%, %METHOD%, %PATH%, %REQUEST_ID%, %ROUTE_NAMESPACE%, %ROUTE_NAME%, %BACKEND%, %STATUS%, %LATENCY_MS%, %BYTES_RECEIVED%, %BYTES_SENT%, %SNAPSHOT_VERSION%, %RETRY_ATTEMPTS%, %RESPONSE_FLAGS%.

Runtime

Core runtime settings for the data plane proxy:

Parameter	Type	Default	Description
`runtime.httpListenAddr`	string	`0.0.0.0:10080`	Address for the HTTP listener
`runtime.enableIpv6`	bool	`true`	Enable IPv6 support
`runtime.enableHttp3`	bool	`false`	Enable HTTP/3 (QUIC) support
`runtime.tlsMinVersion`	string	`1.2`	Minimum TLS version accepted
`runtime.tlsMaxVersion`	string	`1.3`	Maximum TLS version offered
`runtime.tlsAssetDir`	string	`""`	Directory for TLS certificate assets

Runtime Tuning

Performance tuning parameters for the data plane:

Parameter	Type	Default	Description
`runtimeTuning.httpReloadRetryIntervalMs`	int	`1000`	Retry interval for HTTP listener reload (ms)
`runtimeTuning.streamReloadRetryIntervalMs`	int	`1000`	Retry interval for stream listener reload (ms)
`runtimeTuning.downstreamReadTimeoutMs`	int	`60000`	Timeout for reading from downstream clients (ms)
`runtimeTuning.httpMaxConnectionAgeMs`	int	`0`	Maximum HTTP connection age (0 = unlimited)
`runtimeTuning.httpKeepaliveRequestLimit`	int	`0`	Maximum requests per keepalive connection (0 = unlimited)
`runtimeTuning.upstreamConnectionTimeoutMs`	int	`5000`	Timeout for establishing upstream connections (ms)
`runtimeTuning.upstreamReadTimeoutMs`	int	`30000`	Timeout for reading from upstream services (ms)
`runtimeTuning.upstreamIdleTimeoutMs`	int	`60000`	Idle timeout for upstream connections (ms)

HTTP Capacity

Parameter	Type	Default	Description
`runtimeTuning.httpCapacity.workerThreads`	int	`0`	Worker thread count (0 = CPU count)
`runtimeTuning.httpCapacity.acceptConcurrency`	int	`16`	Concurrent TCP accept operations
`runtimeTuning.httpCapacity.upstreamKeepalivePoolSize`	int	`32768`	Maximum idle connections in the upstream pool
`runtimeTuning.httpCapacity.reusePort`	bool	`null`	Enable SO_REUSEPORT (null = auto-detect)

Request Mirroring

Parameter	Type	Default	Description
`runtimeTuning.requestMirrorMaxConcurrency`	int	`1024`	Maximum concurrent mirrored requests

UDP

Parameter	Type	Default	Description
`runtimeTuning.udpResponseIdleTimeoutMs`	int	`500`	Idle timeout for UDP responses (ms)

TCP Proxy

Parameter	Type	Default	Description
`runtimeTuning.tcpProxyBufferBytes`	int	`16384`	Buffer size for TCP proxy connections
`runtimeTuning.tcpSessionIdleTimeoutMs`	int	`0`	TCP session idle timeout (0 = unlimited)
`runtimeTuning.tcpMaxConnectionAgeMs`	int	`0`	Maximum TCP connection age (0 = unlimited)

Retry Budget

Parameter	Type	Default	Description
`runtimeTuning.retryBudgetEnabled`	bool	`true`	Enable retry budget for circuit breaking
`runtimeTuning.retryBudgetRatioPercent`	int	`20`	Ratio of retries to total requests (%)
`runtimeTuning.retryBudgetBurst`	int	`16`	Maximum burst of retries allowed

Stream Connection Pool

Parameter	Type	Default	Description
`runtimeTuning.streamUpstreamPoolSize`	int	`128`	Maximum idle stream connections in the upstream pool
`runtimeTuning.streamUpstreamPoolIdleTimeoutMs`	int	`30000`	Idle timeout for stream upstream connections (ms)

Work Stealing

Parameter	Type	Default	Description
`runtimeTuning.workStealing`	bool	`true`	Enable Tokio work-stealing across worker threads

HTTP Cache

Parameter	Type	Default	Description
`runtimeTuning.httpCache.enabled`	bool	`false`	Enable HTTP response caching
`runtimeTuning.httpCache.maxSizeMb`	int	`256`	Maximum cache size in megabytes
`runtimeTuning.httpCache.defaultTtlSeconds`	int	`60`	Default cache TTL in seconds

Graceful Shutdown

Parameter	Type	Default	Description
`runtimeTuning.gracefulDrainPeriodMs`	int	`0`	Grace period for draining connections on shutdown (ms)

Active Health Checks

Parameter	Type	Default	Description
`runtimeTuning.activeHealthCheckEnabled`	bool	`false`	Enable active health checking of backends
`runtimeTuning.activeHealthCheckIntervalMs`	int	`5000`	Interval between health checks (ms)
`runtimeTuning.activeHealthCheckTimeoutMs`	int	`1000`	Timeout for health check requests (ms)
`runtimeTuning.activeHealthCheckUnhealthyThreshold`	int	`2`	Consecutive failures before marking unhealthy

TCP Keepalive

Downstream (client-facing)

Parameter	Type	Default	Description
`runtimeTuning.downstreamTcpKeepalive.enabled`	bool	`false`	Enable TCP keepalive for downstream connections
`runtimeTuning.downstreamTcpKeepalive.idleMs`	int	`60000`	Idle time before sending keepalive probes (ms)
`runtimeTuning.downstreamTcpKeepalive.intervalMs`	int	`15000`	Interval between keepalive probes (ms)
`runtimeTuning.downstreamTcpKeepalive.probeCount`	int	`4`	Number of probes before declaring dead
`runtimeTuning.downstreamTcpKeepalive.userTimeoutMs`	int	`0`	User timeout for keepalive (0 = OS default)

Upstream (backend-facing)

Parameter	Type	Default	Description
`runtimeTuning.upstreamTcpKeepalive.enabled`	bool	`true`	Enable TCP keepalive for upstream connections
`runtimeTuning.upstreamTcpKeepalive.idleMs`	int	`60000`	Idle time before sending keepalive probes (ms)
`runtimeTuning.upstreamTcpKeepalive.intervalMs`	int	`15000`	Interval between keepalive probes (ms)
`runtimeTuning.upstreamTcpKeepalive.probeCount`	int	`4`	Number of probes before declaring dead
`runtimeTuning.upstreamTcpKeepalive.userTimeoutMs`	int	`0`	User timeout for keepalive (0 = OS default)

TCP Optimizations

Parameter	Type	Default	Description
`runtimeTuning.downstreamTcpFastopen`	bool	`null`	Enable TCP Fast Open for downstream (null = auto-detect)
`runtimeTuning.downstreamDscp`	int	`null`	DSCP marking for downstream connections (null = disabled)
`runtimeTuning.upstreamTcpRecvBuf`	int	`0`	Upstream TCP receive buffer size in bytes (0 = OS default)
`runtimeTuning.upstreamTcpFastOpen`	bool	`true`	Enable TCP Fast Open for upstream connections
`runtimeTuning.upstreamDscp`	int	`null`	DSCP marking for upstream connections (null = disabled)

TCP Fast Open reduces connection latency by allowing data to be sent during the initial TCP handshake. DSCP (Differentiated Services Code Point) marking enables QoS prioritization at the network level.

Runtime Protection

Protection limits to prevent overload and resource exhaustion:

Global Limits

Parameter	Type	Default	Description
`runtimeProtection.httpGlobalInflightLimit`	int	`0`	Maximum concurrent in-flight HTTP requests (0 = unlimited)
`runtimeProtection.httpGlobalRateLimitRequestsPerSecond`	int	`0`	Global rate limit (requests/second, 0 = unlimited)
`runtimeProtection.httpGlobalRateLimitBurst`	int	`0`	Burst allowance for global rate limit

Listener Limits

Parameter	Type	Default	Description
`runtimeProtection.httpListenerInflightLimit`	int	`0`	Maximum concurrent requests per listener (0 = unlimited)
`runtimeProtection.httpListenerRateLimitRequestsPerSecond`	int	`0`	Per-listener rate limit (0 = unlimited)
`runtimeProtection.httpListenerRateLimitBurst`	int	`0`	Burst allowance for listener rate limit

Route Limits

Parameter	Type	Default	Description
`runtimeProtection.httpRouteInflightLimit`	int	`0`	Maximum concurrent requests per route (0 = unlimited)
`runtimeProtection.httpRouteRateLimitRequestsPerSecond`	int	`0`	Per-route rate limit (0 = unlimited)
`runtimeProtection.httpRouteRateLimitBurst`	int	`0`	Burst allowance for route rate limit

Backend Circuit Breaker

Parameter	Type	Default	Description
`runtimeProtection.httpBackendCircuitBreakerMaxRequests`	int	`0`	Maximum concurrent requests per backend (0 = unlimited)

Request Size Limits

Parameter	Type	Default	Description
`runtimeProtection.httpMaxRequestBodyBytes`	int	`0`	Maximum request body size in bytes (0 = unlimited)
`runtimeProtection.httpMaxRequestHeaderBytes`	int	`0`	Maximum request header size in bytes (0 = unlimited)

TCP/UDP Limits

Parameter	Type	Default	Description
`runtimeProtection.tcpGlobalConnectionLimit`	int	`0`	Maximum concurrent TCP connections (0 = unlimited)
`runtimeProtection.tcpListenerConnectionLimit`	int	`0`	Maximum TCP connections per listener (0 = unlimited)
`runtimeProtection.udpGlobalDatagramLimit`	int	`0`	Maximum concurrent UDP datagrams (0 = unlimited)
`runtimeProtection.udpListenerDatagramLimit`	int	`0`	Maximum UDP datagrams per listener (0 = unlimited)

Session Persistence

Parameter	Type	Default	Description
`sessionPersistence.secretKey`	string	`""`	Secret key for session cookie signing
`sessionPersistence.secretKeyFile`	string	`""`	Path to file containing the secret key

xDS TLS

TLS configuration for the xDS connection to the control plane:

Parameter	Type	Default	Description
`xdsTls.enabled`	bool	`false`	Enable TLS for the xDS connection
`xdsTls.caPath`	string	`""`	Path to the CA certificate for verifying the control plane
`xdsTls.certPath`	string	`""`	Path to the client certificate (for mTLS)
`xdsTls.keyPath`	string	`""`	Path to the client private key (for mTLS)
`xdsTls.domainName`	string	`""`	Expected server name for certificate validation

xDS Transport

Parameter	Type	Default	Description
`xdsTransport.connectTimeoutMs`	int	`5000`	Timeout for establishing the xDS connection (ms)
`xdsTransport.keepaliveIntervalMs`	int	`10000`	Interval for xDS keepalive pings (ms)
`xdsTransport.keepaliveTimeoutMs`	int	`5000`	Timeout for xDS keepalive ping responses (ms)
`xdsTransport.initialReconnectBackoffMs`	int	`2000`	Initial backoff for xDS reconnection (ms)
`xdsTransport.maxReconnectBackoffMs`	int	`30000`	Maximum backoff for xDS reconnection (ms)
`xdsTransport.applyTimeoutMs`	int	`3000`	Timeout for applying a received configuration snapshot (ms)
`xdsTransport.applyPollIntervalMs`	int	`100`	Polling interval when waiting for snapshot application (ms)
`xdsTransport.staleStreamTimeoutMs`	int	`30000`	Time before considering a stale xDS stream as failed (ms)
`xdsTransport.snapshotFreshnessTimeoutMs`	int	`90000`	Time before considering the current snapshot as stale (ms)

Feature Flags

Parameter	Type	Default	Description
`experimental.enableExperimentalGateway`	bool	`false`	Enable experimental Gateway API features
`experimental.enableAiGateway`	bool	`false`	Enable the built-in AI gateway module

Complete Example

The following is a complete data plane configuration with all available options:

nodeId: "dp-local"
cluster: "default"
controlPlaneAddr: "http://127.0.0.1:18080"
adminAddr: "127.0.0.1:19080"

log:
  level: "info,nantian_core::connectors=off"
  format: "json"
  addSource: false
  includeTarget: false
  includeThreadIds: false
  includeThreadNames: false
  nonBlocking: true
  nonBlockingBufferedLines: 65536
  dropWhenFull: true
  openTelemetry:
    enabled: false
    endpoint: ""
    protocol: "grpc"
    timeoutMs: 3000
    insecure: false
    sampleRatio: 1.0
    serviceName: "nantian-dataplane"
    serviceNamespace: ""

adminAuth:
  bearerToken: ""
  bearerTokenFile: ""

accessLog:
  enabled: false
  path: "stdout"
  format: "%TIMESTAMP% %EVENT% %PROTOCOL% %LISTENER% %CLIENT_IP% %HOST% %METHOD% %PATH% %REQUEST_ID% %ROUTE_NAMESPACE% %ROUTE_NAME% %BACKEND% %STATUS% %LATENCY_MS% %BYTES_RECEIVED% %BYTES_SENT% %SNAPSHOT_VERSION% %RETRY_ATTEMPTS% %RESPONSE_FLAGS%"
  mode: "json"
  sampleRate: 0.01
  routeAnnotationPrefix: "gateway.nantian.dev/access-log-"

runtime:
  httpListenAddr: "0.0.0.0:10080"
  enableIpv6: true
  enableHttp3: false
  tlsMinVersion: "1.2"
  tlsMaxVersion: "1.3"
  tlsAssetDir: ""

runtimeTuning:
  httpReloadRetryIntervalMs: 1000
  streamReloadRetryIntervalMs: 1000
  downstreamReadTimeoutMs: 60000
  httpMaxConnectionAgeMs: 0
  httpKeepaliveRequestLimit: 0
  upstreamConnectionTimeoutMs: 5000
  upstreamReadTimeoutMs: 30000
  upstreamIdleTimeoutMs: 60000
  httpCapacity:
    workerThreads: 0
    acceptConcurrency: 16
    upstreamKeepalivePoolSize: 32768
    reusePort: null
  requestMirrorMaxConcurrency: 1024
  udpResponseIdleTimeoutMs: 500
  tcpProxyBufferBytes: 16384
  tcpSessionIdleTimeoutMs: 0
  tcpMaxConnectionAgeMs: 0
  retryBudgetEnabled: true
  retryBudgetRatioPercent: 20
  retryBudgetBurst: 16
  streamUpstreamPoolSize: 128
  streamUpstreamPoolIdleTimeoutMs: 30000
  workStealing: true
  downstreamTcpFastopen: null
  downstreamDscp: null
  upstreamTcpRecvBuf: 0
  upstreamTcpFastOpen: true
  upstreamDscp: null
  httpCache:
    enabled: false
    maxSizeMb: 256
    defaultTtlSeconds: 60
  gracefulDrainPeriodMs: 0
  activeHealthCheckEnabled: false
  activeHealthCheckIntervalMs: 5000
  activeHealthCheckTimeoutMs: 1000
  activeHealthCheckUnhealthyThreshold: 2
  downstreamTcpKeepalive:
    enabled: false
    idleMs: 60000
    intervalMs: 15000
    probeCount: 4
    userTimeoutMs: 0
  upstreamTcpKeepalive:
    enabled: true
    idleMs: 60000
    intervalMs: 15000
    probeCount: 4
    userTimeoutMs: 0

runtimeProtection:
  httpGlobalInflightLimit: 0
  httpListenerInflightLimit: 0
  httpRouteInflightLimit: 0
  httpBackendCircuitBreakerMaxRequests: 0
  httpGlobalRateLimitRequestsPerSecond: 0
  httpGlobalRateLimitBurst: 0
  httpListenerRateLimitRequestsPerSecond: 0
  httpListenerRateLimitBurst: 0
  httpRouteRateLimitRequestsPerSecond: 0
  httpRouteRateLimitBurst: 0
  httpMaxRequestBodyBytes: 0
  httpMaxRequestHeaderBytes: 0
  tcpGlobalConnectionLimit: 0
  tcpListenerConnectionLimit: 0
  udpGlobalDatagramLimit: 0
  udpListenerDatagramLimit: 0

sessionPersistence:
  secretKey: ""
  secretKeyFile: ""

xdsTls:
  enabled: false
  caPath: ""
  certPath: ""
  keyPath: ""
  domainName: ""

xdsTransport:
  connectTimeoutMs: 5000
  keepaliveIntervalMs: 10000
  keepaliveTimeoutMs: 5000
  initialReconnectBackoffMs: 2000
  maxReconnectBackoffMs: 30000
  applyTimeoutMs: 3000
  applyPollIntervalMs: 100
  staleStreamTimeoutMs: 30000
  snapshotFreshnessTimeoutMs: 90000

experimental:
  enableExperimentalGateway: false
  enableAiGateway: false

Next Steps

Control Plane Configuration — control plane config reference
Performance Tuning — guidance on tuning parameters
TLS / mTLS — detailed TLS configuration guide