kubernetes-sigs / kubernetes-sigs/gateway-api

CEL Validation: HTTPRoute Case-Insensitive Header Name Uniqueness

Open
#2,277 9 comments 0 reactions 0 assignees View on GitHub
kind/bug lifecycle/frozen
Dominant language
Go
Stars
3k
Forks
789
Avg merge
2d 15h
Merged PRs (30d)
45

Description

**What happened**:
Unfortunately CEL is not currently capable of validating the case-insensitive uniqueness of header names in header modifier filters. This is the only standard channel validation we are still reliant on the validating webhook for. @gauravkghildiyal already developed a CEL rule for this:

```go
// +kubebuilder:validation:XValidation:message="Must not match the same header (case-insensitive) multiple times in the same rule",rule="self.all(h1, self.exists_one(h2, h1.name.lowerAscii() == h2.name.lowerAscii()))"
```

Unfortunately there is a problem with CEL cost estimation that prevents this https://github.com/kubernetes/kubernetes/issues/119749, @jpbetz is working on a fix for this.

**Anything else we need to know?**:
Given the Gateway API versioning policy to support the 5 latest minor Kubernetes versions, even when this is fixed upstream, it's going to be a long time before we can adopt this.

/lifecycle frozen

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the proposed CEL validation rule in the issue and Kubernetes issue #119749, which tracks the CEL cost-estimation blocker. The work is ready only when that upstream fix is available and the rule can be adopted for HTTPRoute header modifier filters; no repository file or test is named here.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
api, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.