kubernetes-sigs / kubernetes-sigs/gateway-api
CEL Validation: HTTPRoute Case-Insensitive Header Name Uniqueness
- Dominant language
- Go
- Stars
- 3k
- Forks
- 789
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 45
Description
**What happened**:
Unfortunately CEL is not currently capable of validating the case-insensitive uniqueness of header names in header modifier filters. This is the only standard channel validation we are still reliant on the validating webhook for. @gauravkghildiyal already developed a CEL rule for this:
```go
// +kubebuilder:validation:XValidation:message="Must not match the same header (case-insensitive) multiple times in the same rule",rule="self.all(h1, self.exists_one(h2, h1.name.lowerAscii() == h2.name.lowerAscii()))"
```
Unfortunately there is a problem with CEL cost estimation that prevents this https://github.com/kubernetes/kubernetes/issues/119749, @jpbetz is working on a fix for this.
**Anything else we need to know?**:
Given the Gateway API versioning policy to support the 5 latest minor Kubernetes versions, even when this is fixed upstream, it's going to be a long time before we can adopt this.
/lifecycle frozen
Contributor guide
Research direction
Start by reviewing the proposed CEL validation rule in the issue and Kubernetes issue #119749, which tracks the CEL cost-estimation blocker. The work is ready only when that upstream fix is available and the rule can be adopted for HTTPRoute header modifier filters; no repository file or test is named here.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- api, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 20/100