feat: Support adding a proxy server in between when forwarding requests to upstream (#2710)

Co-authored-by: 澄潭 <zty98751@alibaba-inc.com>

api/kubernetes/customresourcedefinitions.gen.yaml

@@ -247,6 +247,23 @@ spec:
         properties:
           spec:
             properties:
+              proxies:
+                items:
+                  properties:
+                    connectTimeout:
+                      type: integer
+                    listenerPort:
+                      type: integer
+                    name:
+                      type: string
+                    serverAddress:
+                      type: string
+                    serverPort:
+                      type: integer
+                    type:
+                      type: string
+                  type: object
+                type: array
               registries:
                 items:
                   properties:
@@ -309,6 +326,8 @@ spec:
                       type: integer
                     protocol:
                       type: string
+                    proxyName:
+                      type: string
                     sni:
                       type: string
                     type:

api/networking/v1/mcp_bridge.pb.go

@@ -65,6 +65,7 @@ type McpBridge struct {
 	unknownFields protoimpl.UnknownFields
 
 	Registries []*RegistryConfig `protobuf:"bytes,1,rep,name=registries,proto3" json:"registries,omitempty"`
+	Proxies    []*ProxyConfig    `protobuf:"bytes,2,rep,name=proxies,proto3" json:"proxies,omitempty"`
 }
 
 func (x *McpBridge) Reset() {
@@ -106,6 +107,13 @@ func (x *McpBridge) GetRegistries() []*RegistryConfig {
 	return nil
 }
 
+func (x *McpBridge) GetProxies() []*ProxyConfig {
+	if x != nil {
+		return x.Proxies
+	}
+	return nil
+}
+
 type RegistryConfig struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -136,6 +144,7 @@ type RegistryConfig struct {
 	EnableScopeMcpServers  *wrappers.BoolValue  `protobuf:"bytes,23,opt,name=enableScopeMcpServers,proto3" json:"enableScopeMcpServers,omitempty"`
 	AllowMcpServers        []string             `protobuf:"bytes,24,rep,name=allowMcpServers,proto3" json:"allowMcpServers,omitempty"`
 	Metadata               map[string]*InnerMap `protobuf:"bytes,25,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	ProxyName              string               `protobuf:"bytes,26,opt,name=proxyName,proto3" json:"proxyName,omitempty"`
 }
 
 func (x *RegistryConfig) Reset() {
@@ -345,6 +354,100 @@ func (x *RegistryConfig) GetMetadata() map[string]*InnerMap {
 	return nil
 }
 
+func (x *RegistryConfig) GetProxyName() string {
+	if x != nil {
+		return x.ProxyName
+	}
+	return ""
+}
+
+type ProxyConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Type           string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
+	Name           string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	ServerAddress  string `protobuf:"bytes,3,opt,name=serverAddress,proto3" json:"serverAddress,omitempty"`
+	ServerPort     uint32 `protobuf:"varint,4,opt,name=serverPort,proto3" json:"serverPort,omitempty"`
+	ListenerPort   uint32 `protobuf:"varint,5,opt,name=listenerPort,proto3" json:"listenerPort,omitempty"`
+	ConnectTimeout uint32 `protobuf:"varint,6,opt,name=connectTimeout,proto3" json:"connectTimeout,omitempty"`
+}
+
+func (x *ProxyConfig) Reset() {
+	*x = ProxyConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_networking_v1_mcp_bridge_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ProxyConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ProxyConfig) ProtoMessage() {}
+
+func (x *ProxyConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_networking_v1_mcp_bridge_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ProxyConfig.ProtoReflect.Descriptor instead.
+func (*ProxyConfig) Descriptor() ([]byte, []int) {
+	return file_networking_v1_mcp_bridge_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ProxyConfig) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *ProxyConfig) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *ProxyConfig) GetServerAddress() string {
+	if x != nil {
+		return x.ServerAddress
+	}
+	return ""
+}
+
+func (x *ProxyConfig) GetServerPort() uint32 {
+	if x != nil {
+		return x.ServerPort
+	}
+	return 0
+}
+
+func (x *ProxyConfig) GetListenerPort() uint32 {
+	if x != nil {
+		return x.ListenerPort
+	}
+	return 0
+}
+
+func (x *ProxyConfig) GetConnectTimeout() uint32 {
+	if x != nil {
+		return x.ConnectTimeout
+	}
+	return 0
+}
+
 type InnerMap struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -356,7 +459,7 @@ type InnerMap struct {
 func (x *InnerMap) Reset() {
 	*x = InnerMap{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_networking_v1_mcp_bridge_proto_msgTypes[2]
+		mi := &file_networking_v1_mcp_bridge_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -369,7 +472,7 @@ func (x *InnerMap) String() string {
 func (*InnerMap) ProtoMessage() {}
 
 func (x *InnerMap) ProtoReflect() protoreflect.Message {
-	mi := &file_networking_v1_mcp_bridge_proto_msgTypes[2]
+	mi := &file_networking_v1_mcp_bridge_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -382,7 +485,7 @@ func (x *InnerMap) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InnerMap.ProtoReflect.Descriptor instead.
 func (*InnerMap) Descriptor() ([]byte, []int) {
-	return file_networking_v1_mcp_bridge_proto_rawDescGZIP(), []int{2}
+	return file_networking_v1_mcp_bridge_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *InnerMap) GetInnerMap() map[string]string {
@@ -404,100 +507,119 @@ var file_networking_v1_mcp_bridge_proto_rawDesc = []byte{
 	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x77, 0x72, 0x61, 0x70, 0x70, 0x65,
 	0x72, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1c, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
 	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x73, 0x74, 0x72, 0x75, 0x63, 0x74,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x52, 0x0a, 0x09, 0x4d, 0x63, 0x70, 0x42, 0x72, 0x69,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x90, 0x01, 0x0a, 0x09, 0x4d, 0x63, 0x70, 0x42, 0x72,
-	0x64, 0x67, 0x65, 0x12, 0x45, 0x0a, 0x0a, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x69, 0x65,
+	0x69, 0x64, 0x67, 0x65, 0x12, 0x45, 0x0a, 0x0a, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x69,
-	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73,
+	0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65,
-	0x73, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31, 0x2e,
-	0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0a,
-	0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x69, 0x65, 0x73, 0x22, 0xa8, 0x09, 0x0a, 0x0e, 0x52,
-	0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x17, 0x0a,
-	0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x03, 0xe0, 0x41, 0x02,
-	0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x06, 0x64, 0x6f,
-	0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52,
-	0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x17, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x0d, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74,
-	0x12, 0x2e, 0x0a, 0x12, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73,
-	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x6e, 0x61,
-	0x63, 0x6f, 0x73, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x12, 0x26, 0x0a, 0x0e, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4b,
-	0x65, 0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x41,
-	0x63, 0x63, 0x65, 0x73, 0x73, 0x4b, 0x65, 0x79, 0x12, 0x26, 0x0a, 0x0e, 0x6e, 0x61, 0x63, 0x6f,
-	0x73, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x4b, 0x65, 0x79, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x0e, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x4b, 0x65, 0x79,
-	0x12, 0x2a, 0x0a, 0x10, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61,
-	0x63, 0x65, 0x49, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x6e, 0x61, 0x63, 0x6f,
-	0x73, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x26, 0x0a, 0x0e,
-	0x6e, 0x61, 0x63, 0x6f, 0x73, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x09,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x4e, 0x61, 0x6d, 0x65, 0x73,
-	0x70, 0x61, 0x63, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x47, 0x72, 0x6f,
-	0x75, 0x70, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0b, 0x6e, 0x61, 0x63, 0x6f, 0x73,
-	0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x52,
-	0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x0b,
-	0x20, 0x01, 0x28, 0x03, 0x52, 0x14, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x52, 0x65, 0x66, 0x72, 0x65,
-	0x73, 0x68, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x28, 0x0a, 0x0f, 0x63, 0x6f,
-	0x6e, 0x73, 0x75, 0x6c, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x0c, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x4e, 0x61, 0x6d, 0x65, 0x73,
-	0x70, 0x61, 0x63, 0x65, 0x12, 0x26, 0x0a, 0x0e, 0x7a, 0x6b, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x73, 0x50, 0x61, 0x74, 0x68, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x7a, 0x6b,
-	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x50, 0x61, 0x74, 0x68, 0x12, 0x2a, 0x0a, 0x10,
-	0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x63, 0x65, 0x6e, 0x74, 0x65, 0x72,
-	0x18, 0x0e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x44, 0x61,
-	0x74, 0x61, 0x63, 0x65, 0x6e, 0x74, 0x65, 0x72, 0x12, 0x2a, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x73,
-	0x75, 0x6c, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x54, 0x61, 0x67, 0x18, 0x0f, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x10, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x54, 0x61, 0x67, 0x12, 0x34, 0x0a, 0x15, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x52, 0x65,
-	0x66, 0x72, 0x65, 0x73, 0x68, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x10, 0x20,
-	0x01, 0x28, 0x03, 0x52, 0x15, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x52, 0x65, 0x66, 0x72, 0x65,
-	0x73, 0x68, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x26, 0x0a, 0x0e, 0x61, 0x75,
-	0x74, 0x68, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x11, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x4e, 0x61,
-	0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x12,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x10,
-	0x0a, 0x03, 0x73, 0x6e, 0x69, 0x18, 0x13, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x73, 0x6e, 0x69,
-	0x12, 0x36, 0x0a, 0x16, 0x6d, 0x63, 0x70, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x45, 0x78, 0x70,
-	0x6f, 0x72, 0x74, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x14, 0x20, 0x03, 0x28, 0x09,
-	0x52, 0x16, 0x6d, 0x63, 0x70, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x45, 0x78, 0x70, 0x6f, 0x72,
-	0x74, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x2a, 0x0a, 0x10, 0x6d, 0x63, 0x70, 0x53,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x42, 0x61, 0x73, 0x65, 0x55, 0x72, 0x6c, 0x18, 0x15, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x10, 0x6d, 0x63, 0x70, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x42, 0x61, 0x73,
-	0x65, 0x55, 0x72, 0x6c, 0x12, 0x44, 0x0a, 0x0f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x43,
-	0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x18, 0x16, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x42, 0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0f, 0x65, 0x6e, 0x61, 0x62, 0x6c,
-	0x65, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x12, 0x50, 0x0a, 0x15, 0x65, 0x6e,
-	0x61, 0x62, 0x6c, 0x65, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4d, 0x63, 0x70, 0x53, 0x65, 0x72, 0x76,
-	0x65, 0x72, 0x73, 0x18, 0x17, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c,
-	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x15, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x63, 0x6f,
-	0x70, 0x65, 0x4d, 0x63, 0x70, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x28, 0x0a, 0x0f,
-	0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x4d, 0x63, 0x70, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18,
-	0x18, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0f, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x4d, 0x63, 0x70, 0x53,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x4f, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x18, 0x19, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x33, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65,
 	0x73, 0x73, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31,
-	0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e,
+	0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52,
-	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x6d,
+	0x0a, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x69, 0x65, 0x73, 0x12, 0x3c, 0x0a, 0x07, 0x70,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x1a, 0x5c, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x72, 0x6f, 0x78, 0x69, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x68,
-	0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
+	0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x35, 0x0a, 0x05, 0x76, 0x61,
+	0x67, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x68, 0x69, 0x67, 0x72,
+	0x52, 0x07, 0x70, 0x72, 0x6f, 0x78, 0x69, 0x65, 0x73, 0x22, 0xc6, 0x09, 0x0a, 0x0e, 0x52, 0x65,
-	0x65, 0x73, 0x73, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x2e, 0x76,
+	0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x17, 0x0a, 0x04,
-	0x31, 0x2e, 0x49, 0x6e, 0x6e, 0x65, 0x72, 0x4d, 0x61, 0x70, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52,
-	0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x93, 0x01, 0x0a, 0x08, 0x49, 0x6e, 0x6e, 0x65, 0x72, 0x4d,
+	0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20,
-	0x61, 0x70, 0x12, 0x4a, 0x0a, 0x09, 0x69, 0x6e, 0x6e, 0x65, 0x72, 0x5f, 0x6d, 0x61, 0x70, 0x18,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x06, 0x64, 0x6f, 0x6d,
-	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2e,
+	0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x06,
-	0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x49, 0x6e,
+	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x17, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x04,
-	0x6e, 0x65, 0x72, 0x4d, 0x61, 0x70, 0x2e, 0x49, 0x6e, 0x6e, 0x65, 0x72, 0x4d, 0x61, 0x70, 0x45,
+	0x20, 0x01, 0x28, 0x0d, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12,
-	0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x69, 0x6e, 0x6e, 0x65, 0x72, 0x4d, 0x61, 0x70, 0x1a, 0x3b,
+	0x2e, 0x0a, 0x12, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x53,
-	0x0a, 0x0d, 0x49, 0x6e, 0x6e, 0x65, 0x72, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
+	0x65, 0x72, 0x76, 0x65, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x6e, 0x61, 0x63,
-	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
+	0x6f, 0x73, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x12,
-	0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x26, 0x0a, 0x0e, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4b, 0x65,
-	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x2e, 0x5a, 0x2c, 0x67,
+	0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x41, 0x63,
-	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x61, 0x6c, 0x69, 0x62, 0x61, 0x62,
+	0x63, 0x65, 0x73, 0x73, 0x4b, 0x65, 0x79, 0x12, 0x26, 0x0a, 0x0e, 0x6e, 0x61, 0x63, 0x6f, 0x73,
-	0x61, 0x2f, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x6e, 0x65,
+	0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x4b, 0x65, 0x79, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f,
+	0x0e, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x4b, 0x65, 0x79, 0x12,
-	0x74, 0x6f, 0x33,
+	0x2a, 0x0a, 0x10, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63,
+	0x65, 0x49, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x6e, 0x61, 0x63, 0x6f, 0x73,
+	0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x26, 0x0a, 0x0e, 0x6e,
+	0x61, 0x63, 0x6f, 0x73, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x09, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0e, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x47, 0x72, 0x6f, 0x75,
+	0x70, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0b, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x47,
+	0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x32, 0x0a, 0x14, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x52, 0x65,
+	0x66, 0x72, 0x65, 0x73, 0x68, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x0b, 0x20,
+	0x01, 0x28, 0x03, 0x52, 0x14, 0x6e, 0x61, 0x63, 0x6f, 0x73, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73,
+	0x68, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x28, 0x0a, 0x0f, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6c, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x0c, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x12, 0x26, 0x0a, 0x0e, 0x7a, 0x6b, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x73, 0x50, 0x61, 0x74, 0x68, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x7a, 0x6b, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x50, 0x61, 0x74, 0x68, 0x12, 0x2a, 0x0a, 0x10, 0x63,
+	0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x63, 0x65, 0x6e, 0x74, 0x65, 0x72, 0x18,
+	0x0e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x44, 0x61, 0x74,
+	0x61, 0x63, 0x65, 0x6e, 0x74, 0x65, 0x72, 0x12, 0x2a, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x73, 0x75,
+	0x6c, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x54, 0x61, 0x67, 0x18, 0x0f, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x10, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x54, 0x61, 0x67, 0x12, 0x34, 0x0a, 0x15, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x52, 0x65, 0x66,
+	0x72, 0x65, 0x73, 0x68, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x10, 0x20, 0x01,
+	0x28, 0x03, 0x52, 0x15, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73,
+	0x68, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x26, 0x0a, 0x0e, 0x61, 0x75, 0x74,
+	0x68, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x11, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x4e, 0x61, 0x6d,
+	0x65, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x12, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x10, 0x0a,
+	0x03, 0x73, 0x6e, 0x69, 0x18, 0x13, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x73, 0x6e, 0x69, 0x12,
+	0x36, 0x0a, 0x16, 0x6d, 0x63, 0x70, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x45, 0x78, 0x70, 0x6f,
+	0x72, 0x74, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x14, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x16, 0x6d, 0x63, 0x70, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x45, 0x78, 0x70, 0x6f, 0x72, 0x74,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x2a, 0x0a, 0x10, 0x6d, 0x63, 0x70, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x42, 0x61, 0x73, 0x65, 0x55, 0x72, 0x6c, 0x18, 0x15, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x10, 0x6d, 0x63, 0x70, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x42, 0x61, 0x73, 0x65,
+	0x55, 0x72, 0x6c, 0x12, 0x44, 0x0a, 0x0f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x4d, 0x43, 0x50,
+	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x18, 0x16, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42,
+	0x6f, 0x6f, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x12, 0x50, 0x0a, 0x15, 0x65, 0x6e, 0x61,
+	0x62, 0x6c, 0x65, 0x53, 0x63, 0x6f, 0x70, 0x65, 0x4d, 0x63, 0x70, 0x53, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x73, 0x18, 0x17, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x42, 0x6f, 0x6f, 0x6c, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x52, 0x15, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x53, 0x63, 0x6f, 0x70,
+	0x65, 0x4d, 0x63, 0x70, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x28, 0x0a, 0x0f, 0x61,
+	0x6c, 0x6c, 0x6f, 0x77, 0x4d, 0x63, 0x70, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18, 0x18,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x0f, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x4d, 0x63, 0x70, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x4f, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x18, 0x19, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x33, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73,
+	0x73, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31, 0x2e,
+	0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x1c, 0x0a, 0x09, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x4e,
+	0x61, 0x6d, 0x65, 0x18, 0x1a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x70, 0x72, 0x6f, 0x78, 0x79,
+	0x4e, 0x61, 0x6d, 0x65, 0x1a, 0x5c, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x35, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73, 0x73,
+	0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x49,
+	0x6e, 0x6e, 0x65, 0x72, 0x4d, 0x61, 0x70, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02,
+	0x38, 0x01, 0x22, 0xdb, 0x01, 0x0a, 0x0b, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x12, 0x17, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x17, 0x0a, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x29, 0x0a, 0x0d, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64,
+	0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0x03, 0xe0, 0x41, 0x02,
+	0x52, 0x0d, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12,
+	0x23, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x0d, 0x42, 0x03, 0xe0, 0x41, 0x02, 0x52, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x50, 0x6f, 0x72, 0x74, 0x12, 0x22, 0x0a, 0x0c, 0x6c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72,
+	0x50, 0x6f, 0x72, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0c, 0x6c, 0x69, 0x73, 0x74,
+	0x65, 0x6e, 0x65, 0x72, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x26, 0x0a, 0x0e, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0d,
+	0x52, 0x0e, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74,
+	0x22, 0x93, 0x01, 0x0a, 0x08, 0x49, 0x6e, 0x6e, 0x65, 0x72, 0x4d, 0x61, 0x70, 0x12, 0x4a, 0x0a,
+	0x09, 0x69, 0x6e, 0x6e, 0x65, 0x72, 0x5f, 0x6d, 0x61, 0x70, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x2d, 0x2e, 0x68, 0x69, 0x67, 0x72, 0x65, 0x73, 0x73, 0x2e, 0x6e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x49, 0x6e, 0x6e, 0x65, 0x72, 0x4d, 0x61,
+	0x70, 0x2e, 0x49, 0x6e, 0x6e, 0x65, 0x72, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x08, 0x69, 0x6e, 0x6e, 0x65, 0x72, 0x4d, 0x61, 0x70, 0x1a, 0x3b, 0x0a, 0x0d, 0x49, 0x6e, 0x6e,
+	0x65, 0x72, 0x4d, 0x61, 0x70, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
+	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x2e, 0x5a, 0x2c, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x61, 0x6c, 0x69, 0x62, 0x61, 0x62, 0x61, 0x2f, 0x68, 0x69, 0x67,
+	0x72, 0x65, 0x73, 0x73, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x69, 0x6e, 0x67, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -512,27 +634,29 @@ func file_networking_v1_mcp_bridge_proto_rawDescGZIP() []byte {
 	return file_networking_v1_mcp_bridge_proto_rawDescData
 }
 
-var file_networking_v1_mcp_bridge_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
+var file_networking_v1_mcp_bridge_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
 var file_networking_v1_mcp_bridge_proto_goTypes = []interface{}{
 	(*McpBridge)(nil),          // 0: higress.networking.v1.McpBridge
 	(*RegistryConfig)(nil),     // 1: higress.networking.v1.RegistryConfig
-	(*InnerMap)(nil),           // 2: higress.networking.v1.InnerMap
+	(*ProxyConfig)(nil),        // 2: higress.networking.v1.ProxyConfig
-	nil,                        // 3: higress.networking.v1.RegistryConfig.MetadataEntry
+	(*InnerMap)(nil),           // 3: higress.networking.v1.InnerMap
-	nil,                        // 4: higress.networking.v1.InnerMap.InnerMapEntry
+	nil,                        // 4: higress.networking.v1.RegistryConfig.MetadataEntry
-	(*wrappers.BoolValue)(nil), // 5: google.protobuf.BoolValue
+	nil,                        // 5: higress.networking.v1.InnerMap.InnerMapEntry
+	(*wrappers.BoolValue)(nil), // 6: google.protobuf.BoolValue
 }
 var file_networking_v1_mcp_bridge_proto_depIdxs = []int32{
 	1, // 0: higress.networking.v1.McpBridge.registries:type_name -> higress.networking.v1.RegistryConfig
-	5, // 1: higress.networking.v1.RegistryConfig.enableMCPServer:type_name -> google.protobuf.BoolValue
+	2, // 1: higress.networking.v1.McpBridge.proxies:type_name -> higress.networking.v1.ProxyConfig
-	5, // 2: higress.networking.v1.RegistryConfig.enableScopeMcpServers:type_name -> google.protobuf.BoolValue
+	6, // 2: higress.networking.v1.RegistryConfig.enableMCPServer:type_name -> google.protobuf.BoolValue
-	3, // 3: higress.networking.v1.RegistryConfig.metadata:type_name -> higress.networking.v1.RegistryConfig.MetadataEntry
+	6, // 3: higress.networking.v1.RegistryConfig.enableScopeMcpServers:type_name -> google.protobuf.BoolValue
-	4, // 4: higress.networking.v1.InnerMap.inner_map:type_name -> higress.networking.v1.InnerMap.InnerMapEntry
+	4, // 4: higress.networking.v1.RegistryConfig.metadata:type_name -> higress.networking.v1.RegistryConfig.MetadataEntry
-	2, // 5: higress.networking.v1.RegistryConfig.MetadataEntry.value:type_name -> higress.networking.v1.InnerMap
+	5, // 5: higress.networking.v1.InnerMap.inner_map:type_name -> higress.networking.v1.InnerMap.InnerMapEntry
-	6, // [6:6] is the sub-list for method output_type
+	3, // 6: higress.networking.v1.RegistryConfig.MetadataEntry.value:type_name -> higress.networking.v1.InnerMap
-	6, // [6:6] is the sub-list for method input_type
+	7, // [7:7] is the sub-list for method output_type
-	6, // [6:6] is the sub-list for extension type_name
+	7, // [7:7] is the sub-list for method input_type
-	6, // [6:6] is the sub-list for extension extendee
+	7, // [7:7] is the sub-list for extension type_name
-	0, // [0:6] is the sub-list for field type_name
+	7, // [7:7] is the sub-list for extension extendee
+	0, // [0:7] is the sub-list for field type_name
 }
 
 func init() { file_networking_v1_mcp_bridge_proto_init() }
@@ -566,6 +690,18 @@ func file_networking_v1_mcp_bridge_proto_init() {
 			}
 		}
 		file_networking_v1_mcp_bridge_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ProxyConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_networking_v1_mcp_bridge_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*InnerMap); i {
 			case 0:
 				return &v.state
@@ -584,7 +720,7 @@ func file_networking_v1_mcp_bridge_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_networking_v1_mcp_bridge_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   5,
+			NumMessages:   6,
 			NumExtensions: 0,
 			NumServices:   0,
 		},

api/networking/v1/mcp_bridge.proto

@@ -46,6 +46,7 @@ option go_package = "github.com/alibaba/higress/api/networking/v1";
 // -->
 message McpBridge {
   repeated RegistryConfig registries = 1;
+  repeated ProxyConfig proxies = 2;
 }
 
 message RegistryConfig {
@@ -74,6 +75,16 @@ message RegistryConfig {
   google.protobuf.BoolValue enableScopeMcpServers = 23;
   repeated string allowMcpServers = 24;
   map<string, InnerMap> metadata = 25;
+  string proxyName = 26;
+}
+
+message ProxyConfig {
+  string type = 1 [(google.api.field_behavior) = REQUIRED];
+  string name = 2 [(google.api.field_behavior) = REQUIRED];
+  string serverAddress = 3 [(google.api.field_behavior) = REQUIRED];
+  uint32 serverPort = 4 [(google.api.field_behavior) = REQUIRED];
+  uint32 listenerPort = 5;
+  uint32 connectTimeout = 6;
 }
 
 message InnerMap {

api/networking/v1/mcp_bridge_deepcopy.gen.go

@@ -47,6 +47,27 @@ func (in *RegistryConfig) DeepCopyInterface() interface{} {
 	return in.DeepCopy()
 }
 
+// DeepCopyInto supports using ProxyConfig within kubernetes types, where deepcopy-gen is used.
+func (in *ProxyConfig) DeepCopyInto(out *ProxyConfig) {
+	p := proto.Clone(in).(*ProxyConfig)
+	*out = *p
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyConfig. Required by controller-gen.
+func (in *ProxyConfig) DeepCopy() *ProxyConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInterface is an autogenerated deepcopy function, copying the receiver, creating a new ProxyConfig. Required by controller-gen.
+func (in *ProxyConfig) DeepCopyInterface() interface{} {
+	return in.DeepCopy()
+}
+
 // DeepCopyInto supports using InnerMap within kubernetes types, where deepcopy-gen is used.
 func (in *InnerMap) DeepCopyInto(out *InnerMap) {
 	p := proto.Clone(in).(*InnerMap)

api/networking/v1/mcp_bridge_json.gen.go

@@ -28,6 +28,17 @@ func (this *RegistryConfig) UnmarshalJSON(b []byte) error {
 	return McpBridgeUnmarshaler.Unmarshal(bytes.NewReader(b), this)
 }
 
+// MarshalJSON is a custom marshaler for ProxyConfig
+func (this *ProxyConfig) MarshalJSON() ([]byte, error) {
+	str, err := McpBridgeMarshaler.MarshalToString(this)
+	return []byte(str), err
+}
+
+// UnmarshalJSON is a custom unmarshaler for ProxyConfig
+func (this *ProxyConfig) UnmarshalJSON(b []byte) error {
+	return McpBridgeUnmarshaler.Unmarshal(bytes.NewReader(b), this)
+}
+
 // MarshalJSON is a custom marshaler for InnerMap
 func (this *InnerMap) MarshalJSON() ([]byte, error) {
 	str, err := McpBridgeMarshaler.MarshalToString(this)

client/Makefile

@@ -95,6 +95,6 @@ generate-k8s-client:
 
 
 .PHONY: clean-k8s-client
-clean-k8s-cliennt:
+clean-k8s-client:
     # remove generated code
 	@rm -rf pkg/

pkg/common/protocol.go

@@ -93,6 +93,15 @@ func (p Protocol) IsUnsupported() bool {
 	return p == Unsupported
 }
 
+func (p Protocol) IsSupportedByProxy() bool {
+	switch p {
+	case HTTPS:
+		return true
+	default:
+		return false
+	}
+}
+
 func (p Protocol) String() string {
 	return string(p)
 }

pkg/common/proxy.go

@@ -0,0 +1,59 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package common
+
+import (
+	"strings"
+)
+
+type ProxyType string
+
+const (
+	ProxyType_Unknown ProxyType = "Unknown"
+	ProxyType_HTTP    ProxyType = "HTTP"
+	ProxyType_HTTPS   ProxyType = "HTTPS"
+	ProxyType_SOCKS4  ProxyType = "SOCKS4"
+	ProxyType_SOCKS5  ProxyType = "SOCKS5"
+)
+
+func ParseProxyType(s string) ProxyType {
+	switch strings.ToLower(s) {
+	case "http":
+		return ProxyType_HTTP
+	case "https":
+		return ProxyType_HTTPS
+	case "socks4":
+		return ProxyType_SOCKS4
+	case "socks5":
+		return ProxyType_SOCKS5
+	}
+	return ProxyType_Unknown
+}
+
+func (p ProxyType) GetTransportProtocol() Protocol {
+	switch p {
+	case ProxyType_HTTP:
+		return HTTP
+	case ProxyType_HTTPS:
+		return HTTPS
+	case ProxyType_SOCKS4, ProxyType_SOCKS5:
+		return TCP
+	}
+	return Unsupported
+}
+
+func (p ProxyType) String() string {
+	return string(p)
+}

pkg/ingress/config/ingress_config.go

@@ -69,7 +69,7 @@ import (
 	"github.com/alibaba/higress/pkg/ingress/kube/wasmplugin"
 	. "github.com/alibaba/higress/pkg/ingress/log"
 	"github.com/alibaba/higress/pkg/kube"
-	"github.com/alibaba/higress/registry/memory"
+	"github.com/alibaba/higress/registry"
 	"github.com/alibaba/higress/registry/reconcile"
 )
 
@@ -340,10 +340,6 @@ func (m *IngressConfig) listFromIngressControllers(typ config.GroupVersionKind,
 			}
 			IngressLog.Infof("Append %d configmap EnvoyFilters", len(configmapEnvoyFilters))
 		}
-		if len(envoyFilters) == 0 {
-			IngressLog.Infof("resource type %s, configs number %d", typ, len(m.cachedEnvoyFilters))
-			return m.cachedEnvoyFilters
-		}
 		envoyFilters = append(envoyFilters, m.cachedEnvoyFilters...)
 		IngressLog.Infof("resource type %s, configs number %d", typ, len(envoyFilters))
 		return envoyFilters
@@ -490,6 +486,22 @@ func (m *IngressConfig) convertVirtualService(configs []common.WrapperConfig) []
 		VirtualServices:   map[string]*common.WrapperVirtualService{},
 		HTTPRoutes:        map[string][]*common.WrapperHTTPRoute{},
 		Route2Ingress:     map[string]*common.WrapperConfigWithRuleKey{},
+		ServiceWrappers:   make(map[string]*common.ServiceWrapper),
+		ProxyWrappers:     make(map[string]*common.ProxyWrapper),
+	}
+	if m.RegistryReconciler != nil {
+		for _, sew := range m.RegistryReconciler.GetAllServiceWrapper() {
+			hosts := sew.ServiceEntry.Hosts
+			if len(hosts) == 0 {
+				continue
+			}
+			for _, host := range hosts {
+				convertOptions.ServiceWrappers[host] = sew
+			}
+		}
+		for _, pw := range m.RegistryReconciler.GetAllProxyWrapper() {
+			convertOptions.ProxyWrappers[pw.ProxyName] = pw
+		}
 	}
 
 	// convert http route
@@ -669,6 +681,12 @@ func (m *IngressConfig) convertEnvoyFilter(convertOptions *common.ConvertOptions
 		}
 	}
 
+	if proxyEnvoyFilters := constructProxyEnvoyFilters(convertOptions.ProxyWrappers, convertOptions.ServiceWrappers, m.namespace); len(proxyEnvoyFilters) != 0 {
+		for _, ef := range proxyEnvoyFilters {
+			envoyFilters = append(envoyFilters, *ef)
+		}
+	}
+
 	// TODO Support other envoy filters
 
 	IngressLog.Infof("Found %d number of envoyFilters", len(envoyFilters))
@@ -1493,7 +1511,7 @@ func (m *IngressConfig) constructHttp2RpcEnvoyFilter(http2rpcConfig *annotations
 	return &config.Config{
 		Meta: config.Meta{
 			GroupVersionKind: gvk.EnvoyFilter,
-			Name:             common.CreateConvertedName(constants.IstioIngressGatewayName, http2rpcConfig.Name),
+			Name:             common.CreateConvertedName(constants.IstioIngressGatewayName, "http2rpc", http2rpcConfig.Name, "route", httpRoute.Name),
 			Namespace:        namespace,
 		},
 		Spec: &networking.EnvoyFilter{
@@ -1675,28 +1693,150 @@ func constructBasicAuthEnvoyFilter(rules *common.BasicAuthRules, namespace strin
 	}, nil
 }
 
-func QueryByName(serviceEntries []*memory.ServiceWrapper, serviceName string) (*memory.ServiceWrapper, error) {
+func constructProxyEnvoyFilters(proxyWrappers map[string]*common.ProxyWrapper, serviceWrappers map[string]*common.ServiceWrapper, namespace string) []*config.Config {
-	IngressLog.Infof("Found http2rpc serviceEntries %s", serviceEntries)
+	var envoyFilters []*config.Config
-	for _, se := range serviceEntries {
+	for _, proxyWrapper := range proxyWrappers {
-		if se.ServiceName == serviceName {
+		envoyFilters = append(envoyFilters, &config.Config{
-			return se, nil
+			Meta: config.Meta{
+				GroupVersionKind: gvk.EnvoyFilter,
+				Name:             common.CreateConvertedName(constants.IstioIngressGatewayName, "proxy", proxyWrapper.ProxyName),
+				Namespace:        namespace,
+			},
+			Spec: proxyWrapper.EnvoyFilter,
+		})
+	}
+
+	// Create a cluster for each service that uses a proxy.
+	var serviceProxyPatches []*networking.EnvoyFilter_EnvoyConfigObjectPatch
+	for _, serviceWrapper := range serviceWrappers {
+		proxyConfig := serviceWrapper.ProxyConfig
+		if proxyConfig == nil || proxyConfig.ProxyName == "" {
+			continue
+		}
+		IngressLog.Debugf("Found service %s using proxy %s", serviceWrapper.ServiceName, proxyConfig.ProxyName)
+		if err := validateServiceWrapperForProxy(serviceWrapper); err != nil {
+			IngressLog.Warnf("Service wrapper validation failed for proxy: %v", err)
+			continue
+		}
+		proxyWrapper := proxyWrappers[proxyConfig.ProxyName]
+		if proxyWrapper == nil {
+			IngressLog.Warnf("Service %s has proxy config %s, but no corresponding proxy wrapper found", serviceWrapper.ServiceName, proxyConfig.ProxyName)
+			continue
+		}
+		if !proxyConfig.UpstreamProtocol.IsSupportedByProxy() {
+			IngressLog.Warnf("Proxy %s does not support upstream protocol %s, skipping EnvoyFilter construction for service %s")
+			continue
+		}
+		if proxyWrapper.EnvoyFilter == nil {
+			IngressLog.Warnf("Proxy %s has no EnvoyFilter generated, meaning not ready for use.", proxyConfig.ProxyName)
+			continue
+		}
+		se := serviceWrapper.ServiceEntry
+		if se == nil || len(se.Hosts) == 0 || len(se.Ports) == 0 {
+			continue
+		}
+		for _, host := range se.Hosts {
+			IngressLog.Debugf("Constructing EnvoyFilter for service %s using proxy %s", host, proxyConfig.ProxyName)
+			for _, port := range se.Ports {
+				if port == nil || port.Number <= 0 {
+					continue
+				}
+				clusterName := fmt.Sprintf("outbound|%d||%s", port.Number, host)
+
+				// We need to delete the original cluster and add a new one pointing to the local proxy listener.
+				serviceProxyPatches = append(serviceProxyPatches, &networking.EnvoyFilter_EnvoyConfigObjectPatch{
+					ApplyTo: networking.EnvoyFilter_CLUSTER,
+					Match: &networking.EnvoyFilter_EnvoyConfigObjectMatch{
+						Context: networking.EnvoyFilter_GATEWAY,
+						ObjectTypes: &networking.EnvoyFilter_EnvoyConfigObjectMatch_Cluster{
+							Cluster: &networking.EnvoyFilter_ClusterMatch{
+								Name: clusterName,
+							},
+						},
+					},
+					Patch: &networking.EnvoyFilter_Patch{
+						Operation: networking.EnvoyFilter_Patch_REMOVE,
+					},
+				})
+
+				patchObj := map[string]interface{}{
+					"name":            clusterName,
+					"type":            "STATIC",
+					"connect_timeout": "10s",
+					"load_assignment": map[string]interface{}{
+						"cluster_name": clusterName,
+						"endpoints": []map[string]interface{}{
+							{
+								"lb_endpoints": []map[string]interface{}{
+									{
+										"endpoint": map[string]interface{}{
+											"address": map[string]interface{}{
+												"socket_address": map[string]interface{}{
+													"address":    "127.0.0.1",
+													"port_value": proxyWrapper.ListenerPort,
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				}
+				if proxyConfig.UpstreamProtocol.IsHTTPS() {
+					tlsTypedConfig := map[string]interface{}{
+						"@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+					}
+					if proxyConfig.UpstreamSni != "" {
+						tlsTypedConfig["sni"] = proxyConfig.UpstreamSni
+					}
+					patchObj["transport_socket"] = map[string]interface{}{
+						"name":         "envoy.transport_sockets.tls",
+						"typed_config": tlsTypedConfig,
 					}
 				}
-	return nil, fmt.Errorf("can't find ServiceEntry by serviceName:%v", serviceName)
+				patchJson, _ := json.Marshal(patchObj)
+				serviceProxyPatches = append(serviceProxyPatches, &networking.EnvoyFilter_EnvoyConfigObjectPatch{
+					ApplyTo: networking.EnvoyFilter_CLUSTER,
+					Match: &networking.EnvoyFilter_EnvoyConfigObjectMatch{
+						Context: networking.EnvoyFilter_GATEWAY,
+					},
+					Patch: &networking.EnvoyFilter_Patch{
+						Operation: networking.EnvoyFilter_Patch_ADD,
+						Value:     util.BuildPatchStruct(string(patchJson)),
+					},
+				})
+			}
+		}
+	}
+	if len(serviceProxyPatches) != 0 {
+		envoyFilters = append(envoyFilters, &config.Config{
+			Meta: config.Meta{
+				GroupVersionKind: gvk.EnvoyFilter,
+				Name:             common.CreateConvertedName(constants.IstioIngressGatewayName, "service-proxy"),
+				Namespace:        namespace,
+			},
+			Spec: &networking.EnvoyFilter{
+				ConfigPatches: serviceProxyPatches,
+			},
+		})
+	}
+
+	return envoyFilters
 }
 
-func QueryRpcServiceVersion(serviceEntry *memory.ServiceWrapper, serviceName string) (string, error) {
+func validateServiceWrapperForProxy(serviceWrapper *common.ServiceWrapper) error {
-	IngressLog.Infof("Found http2rpc serviceEntry %s", serviceEntry)
+	registryType := registry.ServiceRegistryType(serviceWrapper.RegistryType)
-	IngressLog.Infof("Found http2rpc ServiceEntry %s", serviceEntry.ServiceEntry)
+	switch registryType {
-	IngressLog.Infof("Found http2rpc WorkloadSelector %s", serviceEntry.ServiceEntry.WorkloadSelector)
+	case registry.DNS:
-	IngressLog.Infof("Found http2rpc Labels %s", serviceEntry.ServiceEntry.WorkloadSelector.Labels)
+		break
-	labels := (*serviceEntry).ServiceEntry.WorkloadSelector.Labels
+	default:
-	for key, value := range labels {
+		return fmt.Errorf("service %s has proxy config %s, but registry type %s is not supported for proxying", serviceWrapper.ServiceName, serviceWrapper.ProxyConfig.ProxyName, registryType)
-		if key == "version" {
-			return value, nil
 	}
+	if len(serviceWrapper.ServiceEntry.Endpoints) > 1 {
+		return fmt.Errorf("service %s has multiple endpoints, which is not supported for proxying with EnvoyFilter. Skipping EnvoyFilter construction", serviceWrapper.ServiceName)
 	}
-	return "", fmt.Errorf("can't get RpcServiceVersion for serviceName:%v", serviceName)
+	return nil
 }
 
 func (m *IngressConfig) Run(stop <-chan struct{}) {

pkg/ingress/kube/common/controller.go

@@ -16,9 +16,8 @@ package common
 
 import (
 	"strings"
+	"time"
 
-	"github.com/alibaba/higress/pkg/cert"
-	"github.com/alibaba/higress/pkg/ingress/kube/annotations"
 	networking "istio.io/api/networking/v1alpha3"
 	"istio.io/istio/pilot/pkg/model"
 	"istio.io/istio/pkg/cluster"
@@ -26,6 +25,10 @@ import (
 	gatewaytool "istio.io/istio/pkg/config/gateway"
 	listerv1 "k8s.io/client-go/listers/core/v1"
 	"k8s.io/client-go/tools/cache"
+
+	"github.com/alibaba/higress/pkg/cert"
+	"github.com/alibaba/higress/pkg/common"
+	"github.com/alibaba/higress/pkg/ingress/kube/annotations"
 )
 
 type ServiceKey struct {
@@ -120,6 +123,68 @@ type WrapperDestinationRule struct {
 	ServiceKey      ServiceKey
 }
 
+type ServiceProxyConfig struct {
+	ProxyName        string
+	UpstreamProtocol common.Protocol
+	UpstreamSni      string
+}
+
+type ServiceWrapper struct {
+	ServiceName            string
+	ServiceEntry           *networking.ServiceEntry
+	DestinationRuleWrapper *WrapperDestinationRule
+	Suffix                 string
+	RegistryType           string
+	RegistryName           string
+	ProxyConfig            *ServiceProxyConfig
+	createTime             time.Time
+}
+
+func (sew *ServiceWrapper) DeepCopy() *ServiceWrapper {
+	res := &ServiceWrapper{}
+	*res = *sew
+	res.ServiceEntry = sew.ServiceEntry.DeepCopy()
+
+	if sew.DestinationRuleWrapper != nil {
+		res.DestinationRuleWrapper = sew.DestinationRuleWrapper
+		res.DestinationRuleWrapper.DestinationRule = sew.DestinationRuleWrapper.DestinationRule.DeepCopy()
+	}
+	return res
+}
+
+func (sew *ServiceWrapper) SetCreateTime(createTime time.Time) {
+	sew.createTime = createTime
+}
+
+func (sew *ServiceWrapper) GetCreateTime() time.Time {
+	return sew.createTime
+}
+
+type ProxyWrapper struct {
+	ProxyName    string
+	ListenerPort uint32
+	EnvoyFilter  *networking.EnvoyFilter
+	createTime   time.Time
+}
+
+func (pw *ProxyWrapper) DeepCopy() *ProxyWrapper {
+	res := &ProxyWrapper{}
+	*res = *pw
+
+	if pw.EnvoyFilter != nil {
+		res.EnvoyFilter = pw.EnvoyFilter.DeepCopy()
+	}
+	return res
+}
+
+func (pw *ProxyWrapper) SetCreateTime(createTime time.Time) {
+	pw.createTime = createTime
+}
+
+func (pw *ProxyWrapper) GetCreateTime() time.Time {
+	return pw.createTime
+}
+
 type IngressController interface {
 	// RegisterEventHandler adds a handler to receive config update events for a
 	// configuration type

pkg/ingress/kube/common/model.go

@@ -169,6 +169,10 @@ type ConvertOptions struct {
 
 	Service2TrafficPolicy map[ServiceKey]*WrapperTrafficPolicy
 
+	ServiceWrappers map[string]*ServiceWrapper
+
+	ProxyWrappers map[string]*ProxyWrapper
+
 	HasDefaultBackend bool
 }
 

registry/consul/watcher.go

@@ -20,14 +20,16 @@ import (
 	"sync"
 	"time"
 
-	apiv1 "github.com/alibaba/higress/api/networking/v1"
-	"github.com/alibaba/higress/pkg/common"
-	provider "github.com/alibaba/higress/registry"
-	"github.com/alibaba/higress/registry/memory"
 	consulapi "github.com/hashicorp/consul/api"
 	"github.com/hashicorp/consul/api/watch"
 	"istio.io/api/networking/v1alpha3"
 	"istio.io/pkg/log"
+
+	apiv1 "github.com/alibaba/higress/api/networking/v1"
+	"github.com/alibaba/higress/pkg/common"
+	ingress "github.com/alibaba/higress/pkg/ingress/kube/common"
+	provider "github.com/alibaba/higress/registry"
+	"github.com/alibaba/higress/registry/memory"
 )
 
 const (
@@ -295,7 +297,7 @@ func (w *watcher) getSubscribeCallback(serviceName string) func(idx uint64, data
 			serviceEntry := w.generateServiceEntry(host, services)
 			if serviceEntry != nil {
 				log.Infof("consul update serviceEntry %s cache", host)
-				w.cache.UpdateServiceWrapper(host, &memory.ServiceWrapper{
+				w.cache.UpdateServiceWrapper(host, &ingress.ServiceWrapper{
 					ServiceEntry: serviceEntry,
 					ServiceName:  serviceName,
 					Suffix:       suffix,

registry/direct/watcher.go

@@ -94,6 +94,12 @@ func WithSNI(sni string) WatcherOption {
 	}
 }
 
+func WithProxyName(proxyName string) WatcherOption {
+	return func(w *watcher) {
+		w.ProxyName = proxyName
+	}
+}
+
 func (w *watcher) Run() {
 	w.mutex.Lock()
 	defer w.mutex.Unlock()
@@ -108,12 +114,14 @@ func (w *watcher) Run() {
 				ServiceKey:      ingress.CreateMcpServiceKey(host, int32(w.Port)),
 			}
 		}
-		w.cache.UpdateServiceWrapper(host, &memory.ServiceWrapper{
+		proxyConfig := w.generateProxyConfig(serviceEntry)
+		w.cache.UpdateServiceWrapper(host, &ingress.ServiceWrapper{
 			ServiceName:            w.Name,
 			ServiceEntry:           serviceEntry,
 			Suffix:                 w.Type,
 			RegistryType:           w.Type,
 			RegistryName:           w.Name,
+			ProxyConfig:            proxyConfig,
 			DestinationRuleWrapper: destinationRuleWrapper,
 		})
 		w.UpdateService()
@@ -197,11 +205,7 @@ func (w *watcher) generateDestinationRule(se *v1alpha3.ServiceEntry) *v1alpha3.D
 	if !common.Protocol(se.Ports[0].Protocol).IsHTTPS() {
 		return nil
 	}
-	sni := w.Sni
+	sni := w.getSni(se)
-	// DNS type, automatically sets SNI based on domain name.
-	if sni == "" && w.Type == string(registry.DNS) && len(se.Endpoints) == 1 {
-		sni = w.Domain
-	}
 	return &v1alpha3.DestinationRule{
 		Host: se.Hosts[0],
 		TrafficPolicy: &v1alpha3.TrafficPolicy{
@@ -218,7 +222,26 @@ func (w *watcher) generateDestinationRule(se *v1alpha3.ServiceEntry) *v1alpha3.D
 			},
 		},
 	}
+}
 
+func (w *watcher) generateProxyConfig(entry *v1alpha3.ServiceEntry) *ingress.ServiceProxyConfig {
+	if w.ProxyName == "" {
+		return nil
+	}
+	return &ingress.ServiceProxyConfig{
+		ProxyName:        w.ProxyName,
+		UpstreamProtocol: common.ParseProtocol(entry.Ports[0].Protocol),
+		UpstreamSni:      w.getSni(entry),
+	}
+}
+
+func (w *watcher) getSni(se *v1alpha3.ServiceEntry) string {
+	sni := w.Sni
+	// DNS type, automatically sets SNI based on domain name.
+	if sni == "" && w.Type == string(registry.DNS) && len(se.Endpoints) == 1 {
+		sni = w.Domain
+	}
+	return sni
 }
 
 func (w *watcher) GetRegistryType() string {

registry/eureka/watcher.go

@@ -27,6 +27,7 @@ import (
 
 	apiv1 "github.com/alibaba/higress/api/networking/v1"
 	"github.com/alibaba/higress/pkg/common"
+	ingress "github.com/alibaba/higress/pkg/ingress/kube/common"
 	provider "github.com/alibaba/higress/registry"
 	. "github.com/alibaba/higress/registry/eureka/client"
 	"github.com/alibaba/higress/registry/memory"
@@ -203,7 +204,7 @@ func (w *watcher) subscribe(service *fargo.Application) error {
 			if err != nil {
 				return err
 			}
-			w.cache.UpdateServiceWrapper(makeHost(service.Name), &memory.ServiceWrapper{
+			w.cache.UpdateServiceWrapper(makeHost(service.Name), &ingress.ServiceWrapper{
 				ServiceName:  service.Name,
 				ServiceEntry: se,
 				Suffix:       suffix,

registry/memory/cache.go

@@ -21,8 +21,6 @@ import (
 	"sync"
 	"time"
 
-	higressconfig "github.com/alibaba/higress/pkg/config"
-	"github.com/alibaba/higress/registry"
 	"google.golang.org/protobuf/encoding/protojson"
 	"google.golang.org/protobuf/types/known/structpb"
 	"google.golang.org/protobuf/types/known/wrapperspb"
@@ -33,44 +31,56 @@ import (
 	"istio.io/pkg/log"
 
 	"github.com/alibaba/higress/pkg/common"
+	higressconfig "github.com/alibaba/higress/pkg/config"
 	ingress "github.com/alibaba/higress/pkg/ingress/kube/common"
+	"github.com/alibaba/higress/registry"
 )
 
 type Cache interface {
-	UpdateServiceWrapper(service string, data *ServiceWrapper)
+	UpdateServiceWrapper(service string, data *ingress.ServiceWrapper)
 	DeleteServiceWrapper(service string)
+	UpdateProxyWrapper(name string, data *ingress.ProxyWrapper)
+	DeleteProxyWrapper(name string)
 	UpdateConfigCache(kind config.GroupVersionKind, key string, config *config.Config, forceDelete bool)
 	GetAllConfigs(kind config.GroupVersionKind) map[string]*config.Config
-	PurgeStaleService()
+	PurgeStaleItems() bool
 	UpdateServiceEntryEndpointWrapper(service, ip, regionId, zoneId, protocol string, labels map[string]string)
 	GetServiceByEndpoints(requestVersions, endpoints map[string]bool, versionKey string, protocol common.Protocol) map[string][]string
 	GetAllServiceEntry() []*v1alpha3.ServiceEntry
-	GetAllServiceWrapper() []*ServiceWrapper
+	GetAllServiceWrapper() []*ingress.ServiceWrapper
+	GetAllProxyWrapper() []*ingress.ProxyWrapper
 	GetAllDestinationRuleWrapper() []*ingress.WrapperDestinationRule
-	GetIncrementalServiceWrapper() (updatedList []*ServiceWrapper, deletedList []*ServiceWrapper)
+	GetIncrementalServiceWrapper() (updatedList []*ingress.ServiceWrapper, deletedList []*ingress.ServiceWrapper)
 	RemoveEndpointByIp(ip string)
 }
 
 func NewCache() Cache {
 	return &store{
 		mux:                    &sync.RWMutex{},
-		sew:           make(map[string]*ServiceWrapper),
 		configs:                make(map[string]map[string]*config.Config),
-		toBeUpdated:   make([]*ServiceWrapper, 0),
+		sew:                    make(map[string]*ingress.ServiceWrapper),
-		toBeDeleted:   make([]*ServiceWrapper, 0),
+		toBeUpdated:            make([]*ingress.ServiceWrapper, 0),
+		toBeDeleted:            make([]*ingress.ServiceWrapper, 0),
 		ip2services:            make(map[string]map[string]bool),
-		deferedDelete: make(map[string]struct{}),
+		deferredDeleteServices: make(map[string]struct{}),
+		pw:                     make(map[string]*ingress.ProxyWrapper),
+		deferredDeleteProxies:  make(map[string]struct{}),
 	}
 }
 
 type store struct {
 	mux *sync.RWMutex
-	sew           map[string]*ServiceWrapper
+
 	configs map[string]map[string]*config.Config
-	toBeUpdated   []*ServiceWrapper
+
-	toBeDeleted   []*ServiceWrapper
+	sew                    map[string]*ingress.ServiceWrapper
+	toBeUpdated            []*ingress.ServiceWrapper
+	toBeDeleted            []*ingress.ServiceWrapper
 	ip2services            map[string]map[string]bool
-	deferedDelete map[string]struct{}
+	deferredDeleteServices map[string]struct{}
+
+	pw                    map[string]*ingress.ProxyWrapper
+	deferredDeleteProxies map[string]struct{}
 }
 
 func (s *store) GetAllConfigs(kind config.GroupVersionKind) map[string]*config.Config {
@@ -179,14 +189,12 @@ func (s *store) UpdateServiceEntryEndpointWrapper(service, ip, regionId, zoneId,
 				}
 				return
 			}
-
 		}
-
 	}
 	return
 }
 
-func (s *store) UpdateServiceWrapper(service string, data *ServiceWrapper) {
+func (s *store) UpdateServiceWrapper(service string, data *ingress.ServiceWrapper) {
 	s.mux.Lock()
 	defer s.mux.Unlock()
 
@@ -196,16 +204,16 @@ func (s *store) UpdateServiceWrapper(service string, data *ServiceWrapper) {
 		data.SetCreateTime(time.Now())
 	}
 
-	log.Debugf("mcp service entry update, name:%s, data:%v", service, data)
+	log.Debugf("mcp service entry update, name: %s, data: %v", service, data)
 
 	s.toBeUpdated = append(s.toBeUpdated, data)
 	s.sew[service] = data
 	// service is updated, should not be deleted
-	if _, ok := s.deferedDelete[service]; ok {
+	if _, ok := s.deferredDeleteServices[service]; ok {
-		delete(s.deferedDelete, service)
+		delete(s.deferredDeleteServices, service)
-		log.Debugf("service in deferedDelete updated, host:%s", service)
+		log.Debugf("service in deferredDeleteServices updated, host: %s", service)
 	}
-	log.Infof("ServiceEntry updated, host:%s", service)
+	log.Infof("ServiceEntry updated, host: %s", service)
 }
 
 func (s *store) DeleteServiceWrapper(service string) {
@@ -214,19 +222,64 @@ func (s *store) DeleteServiceWrapper(service string) {
 
 	if data, exist := s.sew[service]; exist {
 		s.toBeDeleted = append(s.toBeDeleted, data)
-		s.deferedDelete[service] = struct{}{}
+		s.deferredDeleteServices[service] = struct{}{}
+	}
+}
+
+func (s *store) UpdateProxyWrapper(name string, data *ingress.ProxyWrapper) {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+
+	if old, exist := s.pw[name]; exist {
+		data.SetCreateTime(old.GetCreateTime())
+	} else {
+		data.SetCreateTime(time.Now())
+	}
+
+	log.Debugf("mcp proxy entry update, name: %s, data: %v", name, data)
+
+	s.pw[name] = data
+	// service is updated, should not be deleted
+	if _, ok := s.deferredDeleteServices[name]; ok {
+		delete(s.deferredDeleteServices, name)
+		log.Debugf("proxy in deferredDeleteProxies updated, na: %s", name)
+	}
+	log.Infof("ProxyWrapper updated, name: %s", name)
+}
+
+func (s *store) DeleteProxyWrapper(name string) {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+
+	if _, exist := s.pw[name]; exist {
+		s.deferredDeleteProxies[name] = struct{}{}
 	}
 }
 
 // should only be called when reconcile is done
-func (s *store) PurgeStaleService() {
+func (s *store) PurgeStaleItems() bool {
 	s.mux.Lock()
 	defer s.mux.Unlock()
-	for service := range s.deferedDelete {
+
+	deleted := false
+
+	for service := range s.deferredDeleteServices {
 		delete(s.sew, service)
-		delete(s.deferedDelete, service)
+		delete(s.deferredDeleteServices, service)
-		log.Infof("ServiceEntry deleted, host:%s", service)
+		log.Infof("ServiceEntry deleted, host: %s", service)
+
+		deleted = true
 	}
+
+	for proxy := range s.deferredDeleteProxies {
+		delete(s.pw, proxy)
+		delete(s.deferredDeleteProxies, proxy)
+		log.Infof("ProxyWrapper deleted, name: %s", proxy)
+
+		deleted = true
+	}
+
+	return deleted
 }
 
 // GetServiceByEndpoints get the list of services of which "address:port" contained by the endpoints
@@ -292,18 +345,30 @@ func (s *store) GetAllServiceEntry() []*v1alpha3.ServiceEntry {
 }
 
 // GetAllServiceWrapper get all ServiceWrapper in the store for xds push
-func (s *store) GetAllServiceWrapper() []*ServiceWrapper {
+func (s *store) GetAllServiceWrapper() []*ingress.ServiceWrapper {
 	s.mux.RLock()
 	defer s.mux.RUnlock()
 	defer s.cleanUpdateAndDeleteArray()
 
-	sewList := make([]*ServiceWrapper, 0)
+	sewList := make([]*ingress.ServiceWrapper, 0)
 	for _, serviceEntryWrapper := range s.sew {
 		sewList = append(sewList, serviceEntryWrapper.DeepCopy())
 	}
 	return sewList
 }
 
+// GetAllProxyWrapper get all ServiceWrapper in the store for xds push
+func (s *store) GetAllProxyWrapper() []*ingress.ProxyWrapper {
+	s.mux.RLock()
+	defer s.mux.RUnlock()
+
+	pwList := make([]*ingress.ProxyWrapper, 0)
+	for _, pw := range s.pw {
+		pwList = append(pwList, pw.DeepCopy())
+	}
+	return pwList
+}
+
 // GetAllDestinationRuleWrapper get all DestinationRuleWrapper in the store for xds push
 func (s *store) GetAllDestinationRuleWrapper() []*ingress.WrapperDestinationRule {
 	s.mux.RLock()
@@ -329,17 +394,17 @@ func (s *store) GetAllDestinationRuleWrapper() []*ingress.WrapperDestinationRule
 }
 
 // GetIncrementalServiceWrapper get incremental ServiceWrapper in the store for xds push
-func (s *store) GetIncrementalServiceWrapper() ([]*ServiceWrapper, []*ServiceWrapper) {
+func (s *store) GetIncrementalServiceWrapper() ([]*ingress.ServiceWrapper, []*ingress.ServiceWrapper) {
 	s.mux.RLock()
 	defer s.mux.RUnlock()
 	defer s.cleanUpdateAndDeleteArray()
 
-	updatedList := make([]*ServiceWrapper, 0)
+	updatedList := make([]*ingress.ServiceWrapper, 0)
 	for _, serviceEntryWrapper := range s.toBeUpdated {
 		updatedList = append(updatedList, serviceEntryWrapper.DeepCopy())
 	}
 
-	deletedList := make([]*ServiceWrapper, 0)
+	deletedList := make([]*ingress.ServiceWrapper, 0)
 	for _, serviceEntryWrapper := range s.toBeDeleted {
 		deletedList = append(deletedList, serviceEntryWrapper.DeepCopy())
 	}
@@ -352,7 +417,7 @@ func (s *store) cleanUpdateAndDeleteArray() {
 	s.toBeDeleted = nil
 }
 
-func (s *store) updateIpMap(service string, data *ServiceWrapper) {
+func (s *store) updateIpMap(service string, data *ingress.ServiceWrapper) {
 	for _, ep := range data.ServiceEntry.Endpoints {
 		if s.ip2services[ep.Address] == nil {
 			s.ip2services[ep.Address] = make(map[string]bool)

registry/memory/model.go

@@ -1,54 +0,0 @@
-// Copyright (c) 2022 Alibaba Group Holding Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package memory
-
-import (
-	"time"
-
-	"istio.io/api/networking/v1alpha3"
-
-	"github.com/alibaba/higress/pkg/ingress/kube/common"
-)
-
-type ServiceWrapper struct {
-	ServiceName            string
-	ServiceEntry           *v1alpha3.ServiceEntry
-	DestinationRuleWrapper *common.WrapperDestinationRule
-	Suffix                 string
-	RegistryType           string
-	RegistryName           string
-	createTime             time.Time
-}
-
-func (sew *ServiceWrapper) DeepCopy() *ServiceWrapper {
-	res := &ServiceWrapper{}
-	res = sew
-	res.ServiceEntry = sew.ServiceEntry.DeepCopy()
-	res.createTime = sew.GetCreateTime()
-
-	if sew.DestinationRuleWrapper != nil {
-		res.DestinationRuleWrapper = sew.DestinationRuleWrapper
-		res.DestinationRuleWrapper.DestinationRule = sew.DestinationRuleWrapper.DestinationRule.DeepCopy()
-	}
-	return res
-}
-
-func (sew *ServiceWrapper) SetCreateTime(createTime time.Time) {
-	sew.createTime = createTime
-}
-
-func (sew *ServiceWrapper) GetCreateTime() time.Time {
-	return sew.createTime
-}

registry/nacos/v2/watcher.go

@@ -35,6 +35,7 @@ import (
 
 	apiv1 "github.com/alibaba/higress/api/networking/v1"
 	"github.com/alibaba/higress/pkg/common"
+	ingress "github.com/alibaba/higress/pkg/ingress/kube/common"
 	"github.com/alibaba/higress/registry"
 	provider "github.com/alibaba/higress/registry"
 	"github.com/alibaba/higress/registry/memory"
@@ -514,7 +515,7 @@ func (w *watcher) getSubscribeCallback(groupName string, serviceName string) fun
 			return
 		}
 		serviceEntry := w.generateServiceEntry(host, services)
-		w.cache.UpdateServiceWrapper(host, &memory.ServiceWrapper{
+		w.cache.UpdateServiceWrapper(host, &ingress.ServiceWrapper{
 			ServiceName:  serviceName,
 			ServiceEntry: serviceEntry,
 			Suffix:       suffix,

registry/nacos/watcher.go

@@ -30,6 +30,7 @@ import (
 
 	apiv1 "github.com/alibaba/higress/api/networking/v1"
 	"github.com/alibaba/higress/pkg/common"
+	ingress "github.com/alibaba/higress/pkg/ingress/kube/common"
 	provider "github.com/alibaba/higress/registry"
 	"github.com/alibaba/higress/registry/memory"
 )
@@ -312,7 +313,7 @@ func (w *watcher) getSubscribeCallback(groupName string, serviceName string) fun
 			return
 		}
 		serviceEntry := w.generateServiceEntry(host, services)
-		w.cache.UpdateServiceWrapper(host, &memory.ServiceWrapper{
+		w.cache.UpdateServiceWrapper(host, &ingress.ServiceWrapper{
 			ServiceName:  serviceName,
 			ServiceEntry: serviceEntry,
 			Suffix:       suffix,

registry/proxy/factory.go

@@ -0,0 +1,243 @@
+// Copyright (c) 2022 Alibaba Group Holding Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package proxy
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+
+	"istio.io/api/networking/v1alpha3"
+
+	apiv1 "github.com/alibaba/higress/api/networking/v1"
+	"github.com/alibaba/higress/pkg/common"
+	ingress "github.com/alibaba/higress/pkg/ingress/kube/common"
+	"github.com/alibaba/higress/pkg/ingress/kube/util"
+)
+
+const (
+	proxyPortRangeStart uint32 = 50001
+	proxyPortRangeEnd   uint32 = 51000 // Exclusive
+
+	defaultProxyConnectTimeout = 1200
+
+	proxyClusterPatchTemplate = `{
+  "name": "{{name}}",
+  "connect_timeout": "{{connect_timeout}}ms",
+  "type": "{{type}}",
+  "dns_lookup_family": "V4_ONLY",
+  "load_assignment": {
+    "cluster_name": "{{name}}",
+    "endpoints": [
+      {
+        "lb_endpoints": [
+          {
+            "endpoint": {
+              "address": {
+                "socket_address": {
+                  "address": "{{address}}",
+                  "port_value": {{port}}
+                }
+              }
+            }
+          }
+        ]
+      }
+    ]
+  }
+}`
+	proxyListenerPatchTemplate = `{
+  "name": "istio-autogenerated-proxy-listener-{{proxy_name}}",
+  "address": {
+    "socket_address": {
+      "address": "127.0.0.1",
+      "port_value": {{port}}
+    }
+  },
+  "listener_filters": [
+    {
+      "name": "envoy.filters.listener.tls_inspector",
+      "typed_config": {
+        "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+      }
+    }
+  ],
+  "filter_chains": [
+    {
+      "filters": [
+        {
+          "name": "tcp",
+          "typed_config": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy",
+            "stat_prefix": "tcpproxy.{{proxy_name}}",
+            "cluster": "{{cluster_name}}",
+            "tunneling_config": {
+              "hostname": "%REQUESTED_SERVER_NAME%:443"
+            }
+          }
+        }
+      ]
+    }
+  ]
+}`
+)
+
+var (
+	configPatchesBuilders = map[common.ProxyType]func(*apiv1.ProxyConfig) []*v1alpha3.EnvoyFilter_EnvoyConfigObjectPatch{
+		common.ProxyType_HTTP: buildConfigPatchesForHttpProxy,
+	}
+
+	ipv4AddressRegexp = regexp.MustCompile("(\\b25[0-5]|\\b2[0-4][0-9]|\\b[01]?[0-9][0-9]?)(\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}")
+)
+
+func NeedToFillProxyListenerPorts(proxies []*apiv1.ProxyConfig) bool {
+	if proxies == nil || len(proxies) == 0 {
+		return false
+	}
+	for _, proxy := range proxies {
+		if proxy.ListenerPort <= 0 {
+			return true
+		}
+	}
+	return false
+}
+
+func FillProxyListenerPorts(proxies []*apiv1.ProxyConfig) bool {
+	if proxies == nil || len(proxies) == 0 {
+		return false
+	}
+	filled := false
+	var usedPorts = make(map[uint32]bool)
+	for _, proxy := range proxies {
+		if proxy.ListenerPort > 0 {
+			usedPorts[proxy.ListenerPort] = true
+		}
+	}
+	for _, proxy := range proxies {
+		if proxy.ListenerPort > 0 {
+			continue
+		}
+		for port := proxyPortRangeStart; port < proxyPortRangeEnd; port++ {
+			if !usedPorts[port] {
+				proxy.ListenerPort = port
+				usedPorts[port] = true
+				filled = true
+				break
+			}
+		}
+	}
+	return filled
+}
+
+func BuildProxyWrapper(config *apiv1.ProxyConfig) *ingress.ProxyWrapper {
+	if config == nil {
+		return nil
+	}
+	if len(config.ServerAddress) == 0 || config.ServerPort <= 0 || config.ServerPort > 65535 || config.ListenerPort <= 0 || config.ListenerPort > 65535 {
+		return nil
+	}
+
+	envoyFilter := buildEnvoyFilter(config)
+	if envoyFilter == nil {
+		return nil
+	}
+
+	return &ingress.ProxyWrapper{
+		ProxyName:    config.Name,
+		ListenerPort: config.ListenerPort,
+		EnvoyFilter:  envoyFilter,
+	}
+}
+
+func buildEnvoyFilter(config *apiv1.ProxyConfig) *v1alpha3.EnvoyFilter {
+	if config == nil {
+		return nil
+	}
+
+	configPatchesBuilder := configPatchesBuilders[common.ParseProxyType(config.Type)]
+	if configPatchesBuilder == nil {
+		return nil
+	}
+
+	configPatches := configPatchesBuilder(config)
+	return &v1alpha3.EnvoyFilter{ConfigPatches: configPatches}
+}
+
+func buildConfigPatchesForHttpProxy(config *apiv1.ProxyConfig) []*v1alpha3.EnvoyFilter_EnvoyConfigObjectPatch {
+	if common.ParseProxyType(config.Type) != common.ProxyType_HTTP {
+		return nil
+	}
+
+	clusterName := buildClusterName(config)
+
+	var patches []*v1alpha3.EnvoyFilter_EnvoyConfigObjectPatch
+
+	// Add a cluster for the proxy  server
+	proxyClusterPatchJson := proxyClusterPatchTemplate
+	{
+		clusterType := ""
+		if ipv4AddressRegexp.MatchString(config.ServerAddress) {
+			clusterType = "STATIC"
+		} else {
+			clusterType = "STRICT_DNS"
+		}
+		connectTimeout := config.ConnectTimeout
+		if connectTimeout <= 0 {
+			connectTimeout = defaultProxyConnectTimeout
+		}
+		proxyClusterPatchJson = strings.ReplaceAll(proxyClusterPatchJson, "{{name}}", clusterName)
+		proxyClusterPatchJson = strings.ReplaceAll(proxyClusterPatchJson, "{{type}}", clusterType)
+		proxyClusterPatchJson = strings.ReplaceAll(proxyClusterPatchJson, "{{connect_timeout}}", fmt.Sprintf("%d", connectTimeout))
+		proxyClusterPatchJson = strings.ReplaceAll(proxyClusterPatchJson, "{{address}}", config.ServerAddress)
+		proxyClusterPatchJson = strings.ReplaceAll(proxyClusterPatchJson, "{{port}}", fmt.Sprintf("%d", config.ServerPort))
+	}
+	proxyClusterPatch := &v1alpha3.EnvoyFilter_EnvoyConfigObjectPatch{
+		ApplyTo: v1alpha3.EnvoyFilter_CLUSTER,
+		Match: &v1alpha3.EnvoyFilter_EnvoyConfigObjectMatch{
+			Context: v1alpha3.EnvoyFilter_GATEWAY,
+		},
+		Patch: &v1alpha3.EnvoyFilter_Patch{
+			Operation: v1alpha3.EnvoyFilter_Patch_ADD,
+			Value:     util.BuildPatchStruct(proxyClusterPatchJson),
+		},
+	}
+	patches = append(patches, proxyClusterPatch)
+
+	// Add a listener to accept requests from the gateway itself
+	proxyListenerPatchJson := proxyListenerPatchTemplate
+	proxyListenerPatchJson = strings.ReplaceAll(proxyListenerPatchJson, "{{proxy_name}}", config.Name)
+	proxyListenerPatchJson = strings.ReplaceAll(proxyListenerPatchJson, "{{port}}", fmt.Sprintf("%d", config.ListenerPort))
+	proxyListenerPatchJson = strings.ReplaceAll(proxyListenerPatchJson, "{{cluster_name}}", clusterName)
+	proxyListenerPatch := &v1alpha3.EnvoyFilter_EnvoyConfigObjectPatch{
+		ApplyTo: v1alpha3.EnvoyFilter_LISTENER,
+		Match: &v1alpha3.EnvoyFilter_EnvoyConfigObjectMatch{
+			Context: v1alpha3.EnvoyFilter_GATEWAY,
+		},
+		Patch: &v1alpha3.EnvoyFilter_Patch{
+			Operation: v1alpha3.EnvoyFilter_Patch_ADD,
+			Value:     util.BuildPatchStruct(proxyListenerPatchJson),
+		},
+	}
+	patches = append(patches, proxyListenerPatch)
+
+	return patches
+}
+
+func buildClusterName(config *apiv1.ProxyConfig) string {
+	if config == nil {
+		return ""
+	}
+	return fmt.Sprintf("outbound|%d||%s.proxy", config.ServerPort, config.Name)
+}

registry/reconcile/reconcile.go

@@ -37,6 +37,7 @@ import (
 	"github.com/alibaba/higress/registry/memory"
 	"github.com/alibaba/higress/registry/nacos"
 	nacosv2 "github.com/alibaba/higress/registry/nacos/v2"
+	"github.com/alibaba/higress/registry/proxy"
 	"github.com/alibaba/higress/registry/zookeeper"
 )
 
@@ -47,6 +48,7 @@ const (
 type Reconciler struct {
 	memory.Cache
 	registries    map[string]*apiv1.RegistryConfig
+	proxies       map[string]*apiv1.ProxyConfig
 	watchers      map[string]Watcher
 	serviceUpdate func()
 	client        kube.Client
@@ -58,6 +60,7 @@ func NewReconciler(serviceUpdate func(), client kube.Client, namespace, clusterI
 	return &Reconciler{
 		Cache:         memory.NewCache(),
 		registries:    make(map[string]*apiv1.RegistryConfig),
+		proxies:       make(map[string]*apiv1.ProxyConfig),
 		watchers:      make(map[string]Watcher),
 		serviceUpdate: serviceUpdate,
 		client:        client,
@@ -67,11 +70,45 @@ func NewReconciler(serviceUpdate func(), client kube.Client, namespace, clusterI
 }
 
 func (r *Reconciler) Reconcile(mcpbridge *v1.McpBridge) error {
-	newRegistries := make(map[string]*apiv1.RegistryConfig)
+	var registries []*apiv1.RegistryConfig
+	var proxies []*apiv1.ProxyConfig
+
 	if mcpbridge != nil {
-		for _, registry := range mcpbridge.Spec.Registries {
+		if proxy.NeedToFillProxyListenerPorts(mcpbridge.Spec.Proxies) {
-			newRegistries[path.Join(registry.Type, registry.Name)] = registry
+			// Make a deep copy of the McpBridge resource to avoid modifying the original one
+			mcpBridgeForUpdate := mcpbridge.DeepCopy()
+			if proxy.FillProxyListenerPorts(mcpBridgeForUpdate.Spec.Proxies) {
+				// Some listener ports are filled, we need to update the resource and reconcile again
+				mcpBridgeClient := r.client.Higress().NetworkingV1().McpBridges(mcpBridgeForUpdate.Namespace)
+				if _, err := mcpBridgeClient.Update(context.Background(), mcpBridgeForUpdate, metav1.UpdateOptions{}); err != nil {
+					return fmt.Errorf("failed to save filled proxy listener ports: %v", err)
 				}
+				return nil
+			}
+		}
+
+		registries = mcpbridge.Spec.Registries
+		proxies = mcpbridge.Spec.Proxies
+	}
+
+	if err := r.reconcileRegistries(registries); err != nil {
+		return err
+	}
+	if err := r.reconcileProxies(proxies); err != nil {
+		return err
+	}
+
+	if r.Cache.PurgeStaleItems() {
+		// Something stale are purged. We need to notify the service update handler
+		r.serviceUpdate()
+	}
+	return nil
+}
+
+func (r *Reconciler) reconcileRegistries(registries []*apiv1.RegistryConfig) error {
+	newRegistries := make(map[string]*apiv1.RegistryConfig)
+	for _, registry := range registries {
+		newRegistries[path.Join(registry.Type, registry.Name)] = registry
 	}
 	var wg sync.WaitGroup
 	toBeCreated := make(map[string]*apiv1.RegistryConfig)
@@ -142,7 +179,6 @@ func (r *Reconciler) Reconcile(mcpbridge *v1.McpBridge) error {
 	case <-readyTimer.C:
 		return errors.New("ReoncileRegistries failed, waiting for ready timeout")
 	}
-	r.Cache.PurgeStaleService()
 	log.Infof("Registries is reconciled")
 	return nil
 }
@@ -221,6 +257,7 @@ func (r *Reconciler) generateWatcherFromRegistryConfig(registry *apiv1.RegistryC
 			direct.WithPort(registry.Port),
 			direct.WithProtocol(registry.Protocol),
 			direct.WithSNI(registry.Sni),
+			direct.WithProxyName(registry.ProxyName),
 		)
 	case string(Eureka):
 		watcher, err = eureka.NewWatcher(
@@ -289,6 +326,55 @@ func (r *Reconciler) getAuthOption(registry *apiv1.RegistryConfig) (AuthOption,
 	return authOption, nil
 }
 
+func (r *Reconciler) reconcileProxies(proxies []*apiv1.ProxyConfig) error {
+	newProxies := make(map[string]*apiv1.ProxyConfig)
+	for _, p := range proxies {
+		newProxies[p.Name] = p
+	}
+
+	toBeUpdated := make(map[string]*apiv1.ProxyConfig)
+	toBeDeleted := make(map[string]*apiv1.ProxyConfig)
+
+	for key, newProxy := range newProxies {
+		if oldProxy, ok := r.proxies[key]; !ok || !reflect.DeepEqual(newProxy, oldProxy) {
+			toBeUpdated[key] = newProxy
+		}
+	}
+
+	for key, oldProxy := range r.proxies {
+		if _, ok := newProxies[key]; !ok {
+			toBeDeleted[key] = oldProxy
+		}
+	}
+
+	log.Infof("ReconcileProxies, toBeUpdated: %d, toBeDeleted: %d",
+		len(toBeUpdated), len(toBeDeleted))
+
+	needNotify := false
+
+	for k := range toBeDeleted {
+		r.Cache.DeleteProxyWrapper(k)
+		delete(r.proxies, k)
+		needNotify = true
+	}
+	for k, v := range toBeUpdated {
+		proxyWrapper := proxy.BuildProxyWrapper(v)
+		if proxyWrapper == nil {
+			continue
+		}
+		r.Cache.UpdateProxyWrapper(k, proxyWrapper)
+		r.proxies[k] = v
+		needNotify = true
+	}
+
+	if needNotify {
+		r.serviceUpdate()
+	}
+
+	log.Infof("Proxies are reconciled")
+	return nil
+}
+
 func (r *Reconciler) GetMcpServers() []*higressmcpserver.McpServer {
 	mcpServersFromMcp := r.GetAllConfigs(higressmcpserver.GvkMcpServer)
 	servers := make([]*higressmcpserver.McpServer, 0, len(mcpServersFromMcp))

registry/zookeeper/watcher.go

@@ -34,6 +34,7 @@ import (
 
 	apiv1 "github.com/alibaba/higress/api/networking/v1"
 	"github.com/alibaba/higress/pkg/common"
+	ingress "github.com/alibaba/higress/pkg/ingress/kube/common"
 	provider "github.com/alibaba/higress/registry"
 	"github.com/alibaba/higress/registry/memory"
 )
@@ -331,7 +332,7 @@ func (w *watcher) DataChange(eventType Event) bool {
 		se := w.generateServiceEntry(w.serviceEntry[host])
 
 		w.seMux.Unlock()
-		w.cache.UpdateServiceWrapper(host, &memory.ServiceWrapper{
+		w.cache.UpdateServiceWrapper(host, &ingress.ServiceWrapper{
 			ServiceName:  host,
 			ServiceEntry: se,
 			Suffix:       "zookeeper",
@@ -362,7 +363,7 @@ func (w *watcher) DataChange(eventType Event) bool {
 				w.cache.DeleteServiceWrapper(host)
 			}
 		} else {
-			w.cache.UpdateServiceWrapper(host, &memory.ServiceWrapper{
+			w.cache.UpdateServiceWrapper(host, &ingress.ServiceWrapper{
 				ServiceName:  host,
 				ServiceEntry: se,
 				Suffix:       "zookeeper",
@@ -562,7 +563,7 @@ func (w *watcher) ChildToServiceEntry(children []string, interfaceName, zkPath s
 				if !reflect.DeepEqual(value, config) {
 					w.serviceEntry[host] = config
 					//todo update or create serviceentry
-					w.cache.UpdateServiceWrapper(host, &memory.ServiceWrapper{
+					w.cache.UpdateServiceWrapper(host, &ingress.ServiceWrapper{
 						ServiceName:  host,
 						ServiceEntry: se,
 						Suffix:       "zookeeper",
@@ -572,7 +573,7 @@ func (w *watcher) ChildToServiceEntry(children []string, interfaceName, zkPath s
 				}
 			} else {
 				w.serviceEntry[host] = config
-				w.cache.UpdateServiceWrapper(host, &memory.ServiceWrapper{
+				w.cache.UpdateServiceWrapper(host, &ingress.ServiceWrapper{
 					ServiceName:  host,
 					ServiceEntry: se,
 					Suffix:       "zookeeper",