Skip to content

api: add detectMisdirectedRequests to EnvoyProxy #9675

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
mmmommm wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

api: add detectMisdirectedRequests to EnvoyProxy #9675

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions api/v1alpha1/envoyproxy_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,6 +189,22 @@ type EnvoyProxySpec struct {
// +optional
LuaValidation *LuaValidation `json:"luaValidation,omitempty"`

// DetectMisdirectedRequests enables detection of HTTP/2 requests that were
// coalesced onto a connection whose SNI selected a different listener with
// overlapping TLS configuration, as described in GEP-3567
// (https://gateway-api.sigs.k8s.io/geps/gep-3567/).
// When enabled, such requests receive a 421 Misdirected Request response,
// prompting compliant clients to retry on a new connection with the correct
// SNI, and the default ALPN downgrade to HTTP/1.1 for listeners with
// overlapping TLS configuration is not applied, keeping HTTP/2 enabled.
// When disabled, listeners with overlapping TLS configuration downgrade
// ALPN to HTTP/1.1 unless ALPN is explicitly configured via
// ClientTrafficPolicy.
// Default: false
//
// +optional
DetectMisdirectedRequests *bool `json:"detectMisdirectedRequests,omitempty"`

@zirain zirain Aug 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we have another top level fields for features like this may happen in the future?

@mmmommm mmmommm Aug 5, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds good. How about a typed struct named features like following?

spec:
  features:
    detectMisdirectedRequests: true


// DynamicModules defines the set of dynamic modules that are allowed to be
// used by EnvoyExtensionPolicy resources and dynamic module load balancer
// policies. Each entry registers a module by a logical name and specifies
Expand Down
5 changes: 5 additions & 0 deletions api/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

15 changes: 15 additions & 0 deletions charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -322,6 +322,21 @@ spec:
the number of cpuset threads on the platform.
format: int32
type: integer
detectMisdirectedRequests:
description: |-
DetectMisdirectedRequests enables detection of HTTP/2 requests that were
coalesced onto a connection whose SNI selected a different listener with
overlapping TLS configuration, as described in GEP-3567
(https://gateway-api.sigs.k8s.io/geps/gep-3567/).
When enabled, such requests receive a 421 Misdirected Request response,
prompting compliant clients to retry on a new connection with the correct
SNI, and the default ALPN downgrade to HTTP/1.1 for listeners with
overlapping TLS configuration is not applied, keeping HTTP/2 enabled.
When disabled, listeners with overlapping TLS configuration downgrade
ALPN to HTTP/1.1 unless ALPN is explicitly configured via
ClientTrafficPolicy.
Default: false
type: boolean
dynamicModules:
description: |-
DynamicModules defines the set of dynamic modules that are allowed to be
Expand Down
15 changes: 15 additions & 0 deletions charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -321,6 +321,21 @@ spec:
the number of cpuset threads on the platform.
format: int32
type: integer
detectMisdirectedRequests:
description: |-
DetectMisdirectedRequests enables detection of HTTP/2 requests that were
coalesced onto a connection whose SNI selected a different listener with
overlapping TLS configuration, as described in GEP-3567
(https://gateway-api.sigs.k8s.io/geps/gep-3567/).
When enabled, such requests receive a 421 Misdirected Request response,
prompting compliant clients to retry on a new connection with the correct
SNI, and the default ALPN downgrade to HTTP/1.1 for listeners with
overlapping TLS configuration is not applied, keeping HTTP/2 enabled.
When disabled, listeners with overlapping TLS configuration downgrade
ALPN to HTTP/1.1 unless ALPN is explicitly configured via
ClientTrafficPolicy.
Default: false
type: boolean
dynamicModules:
description: |-
DynamicModules defines the set of dynamic modules that are allowed to be
Expand Down
1 change: 1 addition & 0 deletions site/content/en/latest/api/extension_types.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2238,6 +2238,7 @@ _Appears in:_
| `ipFamily` | _[IPFamily](#ipfamily)_ | false | | IPFamily specifies the IP family for the EnvoyProxy fleet.<br />This setting only affects the Gateway listener port and does not impact<br />other aspects of the Envoy proxy configuration.<br />If not specified, the system will operate as follows:<br />- It defaults to IPv4 only.<br />- IPv6 and dual-stack environments are not supported in this default configuration.<br />Note: To enable IPv6 or dual-stack functionality, explicit configuration is required. |
| `preserveRouteOrder` | _boolean_ | false | | PreserveRouteOrder determines if the order of matching for HTTPRoutes is determined by Gateway-API<br />specification (https://gateway-api.sigs.k8s.io/reference/api-spec/main/spec/#httprouterule)<br />or preserves the order defined by users in the HTTPRoute's HTTPRouteRule list.<br />Default: False |
| `luaValidation` | _[LuaValidation](#luavalidation)_ | false | | LuaValidation determines strictness of the Lua script validation for Lua EnvoyExtensionPolicies<br />Default: Strict |
| `detectMisdirectedRequests` | _boolean_ | false | | DetectMisdirectedRequests enables detection of HTTP/2 requests that were<br />coalesced onto a connection whose SNI selected a different listener with<br />overlapping TLS configuration, as described in GEP-3567<br />(https://gateway-api.sigs.k8s.io/geps/gep-3567/).<br />When enabled, such requests receive a 421 Misdirected Request response,<br />prompting compliant clients to retry on a new connection with the correct<br />SNI, and the default ALPN downgrade to HTTP/1.1 for listeners with<br />overlapping TLS configuration is not applied, keeping HTTP/2 enabled.<br />When disabled, listeners with overlapping TLS configuration downgrade<br />ALPN to HTTP/1.1 unless ALPN is explicitly configured via<br />ClientTrafficPolicy.<br />Default: false |
| `dynamicModules` | _[DynamicModuleEntry](#dynamicmoduleentry) array_ | false | | DynamicModules defines the set of dynamic modules that are allowed to be<br />used by EnvoyExtensionPolicy resources and dynamic module load balancer<br />policies. Each entry registers a module by a logical name and specifies<br />the shared library that Envoy will load.<br />The EnvoyProxy owner is responsible for ensuring the module .so files are available<br />on the proxy container's filesystem (e.g., via init containers, custom images,<br />or shared volumes). |
| `geoIP` | _[EnvoyProxyGeoIP](#envoyproxygeoip)_ | false | | GeoIP defines shared GeoIP provider configuration for this EnvoyProxy fleet. |
| `mergeType` | _[MergeType](#mergetype)_ | false | | MergeType controls how this EnvoyProxy merges with less specific configurations<br />in the hierarchy (EnvoyGateway defaults < GatewayClass < Gateway).<br />If unset, this EnvoyProxy completely replaces less specific settings.<br />Note: this field has no effect when set in EnvoyGateway's default EnvoyProxySpec. |
Expand Down
15 changes: 15 additions & 0 deletions test/helm/gateway-crds-helm/all.out.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33981,6 +33981,21 @@ spec:
the number of cpuset threads on the platform.
format: int32
type: integer
detectMisdirectedRequests:
description: |-
DetectMisdirectedRequests enables detection of HTTP/2 requests that were
coalesced onto a connection whose SNI selected a different listener with
overlapping TLS configuration, as described in GEP-3567
(https://gateway-api.sigs.k8s.io/geps/gep-3567/).
When enabled, such requests receive a 421 Misdirected Request response,
prompting compliant clients to retry on a new connection with the correct
SNI, and the default ALPN downgrade to HTTP/1.1 for listeners with
overlapping TLS configuration is not applied, keeping HTTP/2 enabled.
When disabled, listeners with overlapping TLS configuration downgrade
ALPN to HTTP/1.1 unless ALPN is explicitly configured via
ClientTrafficPolicy.
Default: false
type: boolean
dynamicModules:
description: |-
DynamicModules defines the set of dynamic modules that are allowed to be
Expand Down
15 changes: 15 additions & 0 deletions test/helm/gateway-crds-helm/e2e.out.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9919,6 +9919,21 @@ spec:
the number of cpuset threads on the platform.
format: int32
type: integer
detectMisdirectedRequests:
description: |-
DetectMisdirectedRequests enables detection of HTTP/2 requests that were
coalesced onto a connection whose SNI selected a different listener with
overlapping TLS configuration, as described in GEP-3567
(https://gateway-api.sigs.k8s.io/geps/gep-3567/).
When enabled, such requests receive a 421 Misdirected Request response,
prompting compliant clients to retry on a new connection with the correct
SNI, and the default ALPN downgrade to HTTP/1.1 for listeners with
overlapping TLS configuration is not applied, keeping HTTP/2 enabled.
When disabled, listeners with overlapping TLS configuration downgrade
ALPN to HTTP/1.1 unless ALPN is explicitly configured via
ClientTrafficPolicy.
Default: false
type: boolean
dynamicModules:
description: |-
DynamicModules defines the set of dynamic modules that are allowed to be
Expand Down
15 changes: 15 additions & 0 deletions test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9919,6 +9919,21 @@ spec:
the number of cpuset threads on the platform.
format: int32
type: integer
detectMisdirectedRequests:
description: |-
DetectMisdirectedRequests enables detection of HTTP/2 requests that were
coalesced onto a connection whose SNI selected a different listener with
overlapping TLS configuration, as described in GEP-3567
(https://gateway-api.sigs.k8s.io/geps/gep-3567/).
When enabled, such requests receive a 421 Misdirected Request response,
prompting compliant clients to retry on a new connection with the correct
SNI, and the default ALPN downgrade to HTTP/1.1 for listeners with
overlapping TLS configuration is not applied, keeping HTTP/2 enabled.
When disabled, listeners with overlapping TLS configuration downgrade
ALPN to HTTP/1.1 unless ALPN is explicitly configured via
ClientTrafficPolicy.
Default: false
type: boolean
dynamicModules:
description: |-
DynamicModules defines the set of dynamic modules that are allowed to be
Expand Down
Loading