envoyproxy / envoyproxy/gateway
responseOverride fails when scheme does not match
- Dominant language
- Go
- Stars
- 3k
- Forks
- 864
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 140
Description
*Description*:
>What issue is being seen? Describe what should be happening instead of
the bug, for example: The expected value isn't returned, etc.
When using a responseOverride that points to an http-only hostname from an https origin, the override does not occur.
**http**://mypage.example.com/page-not-found -> status code 404 redirect -> errorpage.redirect.local
**https:**//mypage.example.com/page-not-found -> no redirect -> regular 404 page
*Repro steps*:
> Include sample requests, environment, etc. All data and inputs
required to reproduce the bug.
```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: error-pages-direct
spec:
parentRefs:
- name: default
sectionName: http
hostnames:
- error-pages.redirect.local
rules:
- backendRefs:
- name: error-pages
port: 8080
weight: 1
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
name: default
spec:
targetSelectors:
- group: gateway.networking.k8s.io
kind: Gateway
responseOverride:
- match:
statusCodes:
- type: Value
value: 404 # Not Found
redirect:
hostname: error-pages.redirect.local
path:
type: ReplaceFullPath
replaceFullPath: /404
statusCode: 302
```
There are some instances where this "works" with an https listener and a wildcard certificate but we shouldn't need to add a certificate requirement for what should be considered an internal redirect.
*Environment*:
>Include the environment like gateway version, envoy version and so on.
Using gateway 1.8.1 deployed through helm chart.
*Logs*:
>Include the access logs and the Envoy logs.
No logs as no redirect occurs~
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the reported responseOverride configuration with the HTTP and HTTPS listener cases described in the issue. Trace how the responseOverride redirect is handled for an HTTP-only hostname, then verify that the HTTPS-origin request redirects to error-pages.redirect.local like the HTTP-origin request without requiring an HTTPS certificate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, helm, kubernetes
- Domain
- api, infrastructure, networking
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100