envoyproxy / envoyproxy/gateway

HTTPURLRewriteFilter hostname type: Backend does not rewrite host name to Kubernetes DNS (auto_host_rewrite ineffective for K8s Services)

Open
#7,984 4 comments 0 reactions 0 assignees View on GitHub
area/translator help wanted kind/enhancement
Dominant language
Go
Stars
3k
Forks
864
Avg merge
2d 2h
Merged PRs (30d)
140

Description

** full disclosure - this issue is created with help of Github Copilot **
## Description

When using the `HTTPURLRewriteFilter` extension with `hostname` set to `{ type: Backend }`, the host name is not rewritten to the expected Kubernetes service DNS (e.g. `backend.default.svc.cluster.local`). Instead, the original host header is forwarded to the backend.

**Expected behavior:**
Using:
```yaml
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: HTTPRouteFilter
spec:
urlRewrite:
hostname:
type: Backend
```
to rewrite the Host header to the cluster DNS name of the backend Kubernetes service referenced in the HTTPRoute `backendRefs`.

**Actual behavior:**
The Host header is not rewritten, and backend application receives the original host header, not the expected service DNS.

## Technical Analysis

1. The implementation configures `auto_host_rewrite: true` on the generated Envoy route, but Kubernetes Service backends are configured as `EDS` clusters (endpoints = static IPs).
2. According to [Envoy docs](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-auto-host-rewrite), `auto_host_rewrite` **only works with STRICT_DNS or LOGICAL_DNS clusters**.
3. For k8s Services, Envoy Gateway uses EDS clusters with IP addresses (not DNS), so auto host rewrite is ineffective.
4. As a result, the Host header rewrite does not work as expected for Kubernetes Service backends, even though the extension's API implies it should.

## Suggested Remediation

- The translation logic could detect when `hostname: { type: Backend }` is configured, and instead of EDS/IP clusters for referenced Services, create STRICT_DNS clusters pointed at the service's Kubernetes DNS name (e.g. `backend.default.svc.cluster.local`).
- Alternatively (less desirable), detect the case and explicitly set the DNS name as a literal host rewrite, or emit a warning if not supported for EDS clusters.

## References
- [Envoy docs: auto_host_rewrite](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-auto-host-rewrite)

## Repro steps

1. Create an HTTPRoute with a backendRef to a Kubernetes Service
2. Apply an HTTPRouteFilter extension with hostname rewrite `{ type: Backend }`
3. Send a request through Envoy Gateway
4. Observe that the backend receives the original Host header, not the expected service DNS

*Notes: This bug explains why host rewrite works for header and static literal modes, but not for Backend mode on Services. The root cause is the cluster type mismatch with what Envoy supports for auto host rewrite.*

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.