cloudflare / cloudflare/cloudflared
🐛 Cloudflare origin monitors don't send configured Host header when using http checks.
- Dominant language
- Go
- Stars
- 15.6k
- Forks
- 1.4k
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
Cloudflare origin monitors don't send the configured Host header when using http checks. When an origin monitor http health check comes in we get an id for the host like `3f91d878-3b79-4293-8f74-ae00a17a121c` instead of `xyz.example.com` which we then return a 503 since we don't have a configured route.
All other normal traffic comes through with the correct host and work fine. We currently work around this by using tcp health checks.
We run cloudflared in warp mode inside of our k8s+istio service mesh to allow external connectivity to services.
**To Reproduce**
Steps to reproduce the behavior:
1. Have eks/k8s setup
2. Have istio configured
3. Have warp private network configured
4. Run cloudflared in warp mode with istio sidecar
5. Run another internal service on k8s+istio with a /health endpoint
6. Configure load balancer and origin to point to internal service ip+private network id and hostname xyz.example.com
7. Configure origin monitor as http and to hit our /health endpoint and set a Host header to xyz.example.com
8. Look at request logs to see 503s with a weird id string instead of the host header configured.
**Expected behavior**
Cloudflare origin monitors should send configured Host header when performing http health checks.
**Environment and versions**
- cloudflare/cloudflared:2024.4.1
- aws eks 1.29
- aws bottlerocket linux
- istio 1.20.1
**Logs and errors**
Partial access log from our cloudflared istio sidecar showing the authority/host header. Logs for non origin monitor health checks report the correct Host.
---
authority | 3f91d878-3b79-4293-8f74-ae00a17a121c
bytes_received | 0
bytes_sent | 95
cloudflare_ray_id | 88c9ebddb32b0c0f-DFW
downstream_local_address | xxxxx:80
downstream_remote_address | xxxxx:0
duration | 2
method | GET
path | /health
protocol | HTTP/1.1
response_code | 503
---
**Additional context**
I've tried setting the header everywhere I saw it was configurable for LB/origins/origin monitors with the same results.
Contributor guide
Assessment
This issue has not been assessed yet.