envoyproxy / envoyproxy/gateway

responseOverride fails when scheme does not match

Open
#9,252 3 comments 0 reactions 0 assignees View on GitHub
triage
Dominant language
Go
Stars
3k
Forks
864
Avg merge
2d 2h
Merged PRs (30d)
140

Description

*Description*:
>What issue is being seen? Describe what should be happening instead of
the bug, for example: The expected value isn't returned, etc.

When using a responseOverride that points to an http-only hostname from an https origin, the override does not occur.

**http**://mypage.example.com/page-not-found -> status code 404 redirect -> errorpage.redirect.local
**https:**//mypage.example.com/page-not-found -> no redirect -> regular 404 page

*Repro steps*:
> Include sample requests, environment, etc. All data and inputs
required to reproduce the bug.

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: error-pages-direct
spec:
parentRefs:
- name: default
sectionName: http
hostnames:
- error-pages.redirect.local
rules:
- backendRefs:
- name: error-pages
port: 8080
weight: 1
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
name: default
spec:
targetSelectors:
- group: gateway.networking.k8s.io
kind: Gateway
responseOverride:
- match:
statusCodes:
- type: Value
value: 404 # Not Found
redirect:
hostname: error-pages.redirect.local
path:
type: ReplaceFullPath
replaceFullPath: /404
statusCode: 302
```

There are some instances where this "works" with an https listener and a wildcard certificate but we shouldn't need to add a certificate requirement for what should be considered an internal redirect.

*Environment*:
>Include the environment like gateway version, envoy version and so on.

Using gateway 1.8.1 deployed through helm chart.

*Logs*:
>Include the access logs and the Envoy logs.

No logs as no redirect occurs~

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the reported responseOverride configuration with the HTTP and HTTPS listener cases described in the issue. Trace how the responseOverride redirect is handled for an HTTP-only hostname, then verify that the HTTPS-origin request redirects to error-pages.redirect.local like the HTTP-origin request without requiring an HTTPS certificate.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, helm, kubernetes
Domain
api, infrastructure, networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.