envoyproxy / envoyproxy/gateway

BackendTrafficPolicy responseOverride not applied when no HTTPRoute matches

Open
#9,057 2 comments 0 reactions 1 assignee Claimed by @rudrakhp View on GitHub
kind/bug triage
Dominant language
Go
Stars
3k
Forks
864
Avg merge
2d 2h
Merged PRs (30d)
140

Description

Hi, reading the docs at https://gateway.envoyproxy.io/docs/tasks/traffic/response-override/ it seems that it should be possible to override responses generated by envoyproxy when no HTTPRoute matches.

See this example config:
```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
spec:
parentRefs:
- name: development-gateway
hostnames: ["helloworld.sample.com"]
rules:
- matches:
- path:
type: RegularExpression
value: "/[Hh]ell[oO]"
backendRefs:
- name: helloworld
port: 5000
- matches:
- path:
type: PathPrefix
value: /api
backendRefs:
- name: api-backend
port: 3000
```

and this BackendTrafficPolicy
```yaml
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
spec:
responseOverride:
- match:
statusCodes:
- type: Value
value: 404
response:
body:
inline: not found - 404
type: Inline
contentType: text/html
source: Local # In my opinion, 'Local' should be correct, but neither one works.
- match:
statusCodes:
- range:
end: 505
start: 500
type: Range
response:
body:
inline: Maintenance 50x
type: Inline
contentType: text/html
source: Local # In my opinion, 'Local' should be correct, but neither one works.
targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: development-gateway
```

A down backend (helloworld set replicas to 0) gives me the correct overridden response:
```
➜ ~ curl -v helloworld.sample.com:8080/hello
* Host helloworld.sample.com:8080 was resolved.
* IPv6: (none)
* IPv4: 127.0.0.1
* Trying 127.0.0.1:8080...
* Established connection to helloworld.sample.com (127.0.0.1 port 8080) from 127.0.0.1 port 46538
* using HTTP/1.x
> GET /hello HTTP/1.1
> Host: helloworld.sample.com:8080
> User-Agent: curl/8.18.0
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 503 Service Unavailable
< content-type: text/html
< content-length: 41
< date: Thu, 21 May 2026 10:48:48 GMT
<
* Connection #0 to host helloworld.sample.com:8080 left intact
Maintenance 50x
```

but a 404, generated by envoyproxy because no HTTPRoute matches, does **not** override the response:
```
➜ ~ curl -v helloworld.sample.com:8080/non-exsistent-route
* Host helloworld.sample.com:8080 was resolved.
* IPv6: (none)
* IPv4: 127.0.0.1
* Trying 127.0.0.1:8080...
* Established connection to helloworld.sample.com (127.0.0.1 port 8080) from 127.0.0.1 port 44736
* using HTTP/1.x
> GET /non-exsistent-route HTTP/1.1
> Host: helloworld.sample.com:8080
> User-Agent: curl/8.18.0
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 404 Not Found
< date: Thu, 21 May 2026 10:49:56 GMT
< content-length: 0
<
* Connection #0 to host helloworld.sample.com:8080 left intact
```
(see no `not found - 404` here)

the proxy logs this:
```
{
":authority": "helloworld.sample.com:8080",
"bytes_received": 0,
"bytes_sent": 0,
"connection_termination_details": null,
"downstream_local_address": "127.0.0.1:10080",
"downstream_remote_address": "127.0.0.1:45166",
"duration": 0,
"method": "GET",
"protocol": "HTTP/1.1",
"requested_server_name": null,
"response_code": 404,
"response_code_details": "route_not_found",
"response_flags": "NR",
"route_name": null,
"start_time": "2026-05-21T10:52:34.109Z",
"upstream_cluster": null,
"upstream_host": null,
"upstream_local_address": null,
"upstream_transport_failure_reason": null,
"user-agent": "curl/8.18.0",
"x-envoy-origin-path": "/non-exsistent-route",
"x-envoy-upstream-service-time": null,
"x-forwarded-for": "10.124.162.173",
"x-request-id": "ad40fc51-ddf5-45fa-8be5-7a08e8904110"
}
```

Of course, I could implement a custom-error-pages service the old-fashioned way, but this would be way more elegant.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.