diff --git a/api/v1alpha1/envoyproxy_types.go b/api/v1alpha1/envoyproxy_types.go index a4ef2ee57a..72889e4f07 100644 --- a/api/v1alpha1/envoyproxy_types.go +++ b/api/v1alpha1/envoyproxy_types.go @@ -189,6 +189,22 @@ type EnvoyProxySpec struct { // +optional LuaValidation *LuaValidation `json:"luaValidation,omitempty"` + // DetectMisdirectedRequests enables detection of HTTP/2 requests that were + // coalesced onto a connection whose SNI selected a different listener with + // overlapping TLS configuration, as described in GEP-3567 + // (https://gateway-api.sigs.k8s.io/geps/gep-3567/). + // When enabled, such requests receive a 421 Misdirected Request response, + // prompting compliant clients to retry on a new connection with the correct + // SNI, and the default ALPN downgrade to HTTP/1.1 for listeners with + // overlapping TLS configuration is not applied, keeping HTTP/2 enabled. + // When disabled, listeners with overlapping TLS configuration downgrade + // ALPN to HTTP/1.1 unless ALPN is explicitly configured via + // ClientTrafficPolicy. + // Default: false + // + // +optional + DetectMisdirectedRequests *bool `json:"detectMisdirectedRequests,omitempty"` + // DynamicModules defines the set of dynamic modules that are allowed to be // used by EnvoyExtensionPolicy resources and dynamic module load balancer // policies. Each entry registers a module by a logical name and specifies diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go index ed5a44424d..874f0c2110 100644 --- a/api/v1alpha1/zz_generated.deepcopy.go +++ b/api/v1alpha1/zz_generated.deepcopy.go @@ -3264,6 +3264,11 @@ func (in *EnvoyProxySpec) DeepCopyInto(out *EnvoyProxySpec) { *out = new(LuaValidation) **out = **in } + if in.DetectMisdirectedRequests != nil { + in, out := &in.DetectMisdirectedRequests, &out.DetectMisdirectedRequests + *out = new(bool) + **out = **in + } if in.DynamicModules != nil { in, out := &in.DynamicModules, &out.DynamicModules *out = make([]DynamicModuleEntry, len(*in)) diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml index 93db35107b..309d55f693 100644 --- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml +++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml @@ -322,6 +322,21 @@ spec: the number of cpuset threads on the platform. format: int32 type: integer + detectMisdirectedRequests: + description: |- + DetectMisdirectedRequests enables detection of HTTP/2 requests that were + coalesced onto a connection whose SNI selected a different listener with + overlapping TLS configuration, as described in GEP-3567 + (https://gateway-api.sigs.k8s.io/geps/gep-3567/). + When enabled, such requests receive a 421 Misdirected Request response, + prompting compliant clients to retry on a new connection with the correct + SNI, and the default ALPN downgrade to HTTP/1.1 for listeners with + overlapping TLS configuration is not applied, keeping HTTP/2 enabled. + When disabled, listeners with overlapping TLS configuration downgrade + ALPN to HTTP/1.1 unless ALPN is explicitly configured via + ClientTrafficPolicy. + Default: false + type: boolean dynamicModules: description: |- DynamicModules defines the set of dynamic modules that are allowed to be diff --git a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml index eafaa9486a..237245013b 100644 --- a/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml +++ b/charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml @@ -321,6 +321,21 @@ spec: the number of cpuset threads on the platform. format: int32 type: integer + detectMisdirectedRequests: + description: |- + DetectMisdirectedRequests enables detection of HTTP/2 requests that were + coalesced onto a connection whose SNI selected a different listener with + overlapping TLS configuration, as described in GEP-3567 + (https://gateway-api.sigs.k8s.io/geps/gep-3567/). + When enabled, such requests receive a 421 Misdirected Request response, + prompting compliant clients to retry on a new connection with the correct + SNI, and the default ALPN downgrade to HTTP/1.1 for listeners with + overlapping TLS configuration is not applied, keeping HTTP/2 enabled. + When disabled, listeners with overlapping TLS configuration downgrade + ALPN to HTTP/1.1 unless ALPN is explicitly configured via + ClientTrafficPolicy. + Default: false + type: boolean dynamicModules: description: |- DynamicModules defines the set of dynamic modules that are allowed to be diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md index 741ff2f568..b2f27b72fc 100644 --- a/site/content/en/latest/api/extension_types.md +++ b/site/content/en/latest/api/extension_types.md @@ -2238,6 +2238,7 @@ _Appears in:_ | `ipFamily` | _[IPFamily](#ipfamily)_ | false | | IPFamily specifies the IP family for the EnvoyProxy fleet.
This setting only affects the Gateway listener port and does not impact
other aspects of the Envoy proxy configuration.
If not specified, the system will operate as follows:
- It defaults to IPv4 only.
- IPv6 and dual-stack environments are not supported in this default configuration.
Note: To enable IPv6 or dual-stack functionality, explicit configuration is required. | | `preserveRouteOrder` | _boolean_ | false | | PreserveRouteOrder determines if the order of matching for HTTPRoutes is determined by Gateway-API
specification (https://gateway-api.sigs.k8s.io/reference/api-spec/main/spec/#httprouterule)
or preserves the order defined by users in the HTTPRoute's HTTPRouteRule list.
Default: False | | `luaValidation` | _[LuaValidation](#luavalidation)_ | false | | LuaValidation determines strictness of the Lua script validation for Lua EnvoyExtensionPolicies
Default: Strict | +| `detectMisdirectedRequests` | _boolean_ | false | | DetectMisdirectedRequests enables detection of HTTP/2 requests that were
coalesced onto a connection whose SNI selected a different listener with
overlapping TLS configuration, as described in GEP-3567
(https://gateway-api.sigs.k8s.io/geps/gep-3567/).
When enabled, such requests receive a 421 Misdirected Request response,
prompting compliant clients to retry on a new connection with the correct
SNI, and the default ALPN downgrade to HTTP/1.1 for listeners with
overlapping TLS configuration is not applied, keeping HTTP/2 enabled.
When disabled, listeners with overlapping TLS configuration downgrade
ALPN to HTTP/1.1 unless ALPN is explicitly configured via
ClientTrafficPolicy.
Default: false | | `dynamicModules` | _[DynamicModuleEntry](#dynamicmoduleentry) array_ | false | | DynamicModules defines the set of dynamic modules that are allowed to be
used by EnvoyExtensionPolicy resources and dynamic module load balancer
policies. Each entry registers a module by a logical name and specifies
the shared library that Envoy will load.
The EnvoyProxy owner is responsible for ensuring the module .so files are available
on the proxy container's filesystem (e.g., via init containers, custom images,
or shared volumes). | | `geoIP` | _[EnvoyProxyGeoIP](#envoyproxygeoip)_ | false | | GeoIP defines shared GeoIP provider configuration for this EnvoyProxy fleet. | | `mergeType` | _[MergeType](#mergetype)_ | false | | MergeType controls how this EnvoyProxy merges with less specific configurations
in the hierarchy (EnvoyGateway defaults < GatewayClass < Gateway).
If unset, this EnvoyProxy completely replaces less specific settings.
Note: this field has no effect when set in EnvoyGateway's default EnvoyProxySpec. | diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml index 5499e8824e..a32fa82716 100644 --- a/test/helm/gateway-crds-helm/all.out.yaml +++ b/test/helm/gateway-crds-helm/all.out.yaml @@ -33981,6 +33981,21 @@ spec: the number of cpuset threads on the platform. format: int32 type: integer + detectMisdirectedRequests: + description: |- + DetectMisdirectedRequests enables detection of HTTP/2 requests that were + coalesced onto a connection whose SNI selected a different listener with + overlapping TLS configuration, as described in GEP-3567 + (https://gateway-api.sigs.k8s.io/geps/gep-3567/). + When enabled, such requests receive a 421 Misdirected Request response, + prompting compliant clients to retry on a new connection with the correct + SNI, and the default ALPN downgrade to HTTP/1.1 for listeners with + overlapping TLS configuration is not applied, keeping HTTP/2 enabled. + When disabled, listeners with overlapping TLS configuration downgrade + ALPN to HTTP/1.1 unless ALPN is explicitly configured via + ClientTrafficPolicy. + Default: false + type: boolean dynamicModules: description: |- DynamicModules defines the set of dynamic modules that are allowed to be diff --git a/test/helm/gateway-crds-helm/e2e.out.yaml b/test/helm/gateway-crds-helm/e2e.out.yaml index 194623aac3..7420ca1b44 100644 --- a/test/helm/gateway-crds-helm/e2e.out.yaml +++ b/test/helm/gateway-crds-helm/e2e.out.yaml @@ -9919,6 +9919,21 @@ spec: the number of cpuset threads on the platform. format: int32 type: integer + detectMisdirectedRequests: + description: |- + DetectMisdirectedRequests enables detection of HTTP/2 requests that were + coalesced onto a connection whose SNI selected a different listener with + overlapping TLS configuration, as described in GEP-3567 + (https://gateway-api.sigs.k8s.io/geps/gep-3567/). + When enabled, such requests receive a 421 Misdirected Request response, + prompting compliant clients to retry on a new connection with the correct + SNI, and the default ALPN downgrade to HTTP/1.1 for listeners with + overlapping TLS configuration is not applied, keeping HTTP/2 enabled. + When disabled, listeners with overlapping TLS configuration downgrade + ALPN to HTTP/1.1 unless ALPN is explicitly configured via + ClientTrafficPolicy. + Default: false + type: boolean dynamicModules: description: |- DynamicModules defines the set of dynamic modules that are allowed to be diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml index 5e3951fca6..f0e3fa5f1a 100644 --- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml +++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml @@ -9919,6 +9919,21 @@ spec: the number of cpuset threads on the platform. format: int32 type: integer + detectMisdirectedRequests: + description: |- + DetectMisdirectedRequests enables detection of HTTP/2 requests that were + coalesced onto a connection whose SNI selected a different listener with + overlapping TLS configuration, as described in GEP-3567 + (https://gateway-api.sigs.k8s.io/geps/gep-3567/). + When enabled, such requests receive a 421 Misdirected Request response, + prompting compliant clients to retry on a new connection with the correct + SNI, and the default ALPN downgrade to HTTP/1.1 for listeners with + overlapping TLS configuration is not applied, keeping HTTP/2 enabled. + When disabled, listeners with overlapping TLS configuration downgrade + ALPN to HTTP/1.1 unless ALPN is explicitly configured via + ClientTrafficPolicy. + Default: false + type: boolean dynamicModules: description: |- DynamicModules defines the set of dynamic modules that are allowed to be