envoyproxy / envoyproxy/gateway

Proxy protocol header includes wrong destination port

Open
#6,388 16 comments 0 reactions 0 assignees View on GitHub
kind/bug no stalebot
Dominant language
Go
Stars
3k
Forks
864
Avg merge
2d 2h
Merged PRs (30d)
140

Description

*Description*:
- listener set to listen on port 443
- proxy protocol enabled by backendtrafficpolicy
- proxy protocol header to the backend contains 10443 port

This is probably due to envoy actually listening on 10443 port and service rewriting it to 443
![Image](https://github.com/user-attachments/assets/ee82ec9a-9978-4652-a9ee-d4bc72b41570)

*Repro steps*:
```
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
name: proxy-protocol-route-knyfyrtel-ingress-tls
namespace: knyfyrtel
spec:
proxyProtocol:
version: V2
targetRef:
group: gateway.networking.k8s.io
kind: TLSRoute
name: knyfyrtel-ingress-tls
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: default
namespace: envoy-gateway-system
spec:
gatewayClassName: envoy-gateway
listeners:
- allowedRoutes:
namespaces:
from: All
name: http-0
port: 80
protocol: HTTP
- allowedRoutes:
namespaces:
from: All
name: tls-pass-0
port: 443
protocol: TLS
tls:
mode: Passthrough
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TLSRoute
metadata:
name: knyfyrtel-ingress-tls
namespace: knyfyrtel
spec:
hostnames:
-
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: default
namespace: envoy-gateway-system
sectionName: tls-pass-0
rules:
- backendRefs:
- group: ''
kind: Service
name: ingress-nginx-controller-x-ingress-nginx-x-knyfyrtel-vcluster
port: 443
weight: 1
```
`tshark -i - --disable-protocol tls -V -Y "proxy.src.ipv4"`

![Image](https://github.com/user-attachments/assets/4490b6d6-4c94-4e2c-8036-e41d333d03c0)

*Environment*:
Envoy Gateway Helm Chart deployment 1.4.1

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.