Health-check host value with external Backend services #7798
Description
Hello I have config with two backends of external services with header host rewrite to type of backend like so:
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: external-https-split
spec:
hostnames:
- some.domain.test
parentRefs:
- name: eg
rules:
- matches:
- path:
type: PathPrefix
value: /
filters:
- type: ExtensionRef
extensionRef:
group: gateway.envoyproxy.io
kind: HTTPRouteFilter
name: dynamic-host-rewrite
backendRefs:
- group: gateway.envoyproxy.io
kind: Backend
name: https-backend-1
weight: 50
- group: gateway.envoyproxy.io
kind: Backend
name: https-backend-2
weight: 50
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: HTTPRouteFilter
metadata:
name: dynamic-host-rewrite
spec:
urlRewrite:
hostname:
type: Backend
---
# External HTTPS Backend 1
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: Backend
metadata:
name: https-backend-1
spec:
endpoints:
- fqdn:
hostname: svc1.some.domain.com
port: 443
---
# External HTTPS Backend 2
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: Backend
metadata:
name: https-backend-2
spec:
endpoints:
- fqdn:
hostname: svc2.some.domain.com
port: 443
---
apiVersion: gateway.networking.k8s.io/v1
kind: BackendTLSPolicy
metadata:
name: svc1-backend-tls
spec:
targetRefs:
- group: gateway.envoyproxy.io
kind: Backend
name: https-backend-1
validation:
hostname: svc1.some.domain.com #SNI TLS
wellKnownCACertificates: System
---
apiVersion: gateway.networking.k8s.io/v1
kind: BackendTLSPolicy
metadata:
name: svc2-backend-tls
spec:
targetRefs:
- group: gateway.envoyproxy.io
kind: Backend
name: https-backend-2
validation:
hostname: svc2.some.domain.com #SNI TLS
wellKnownCACertificates: SystemAll seems to be fine, but observe problem with health-check within BackendTrafficPolicy:
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
name: external-https-healthcheck
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: HTTPRoute
name: external-https-split
healthCheck:
active:
type: HTTP
http:
path: "/health"
method: "GET"
expectedStatuses: [200]
interval: "5s"
timeout: "2s"
unhealthyThreshold: 3
healthyThreshold: 2as health check is not using the backend host header, but the header from the HTTPRoute:
{
"name": "httproute/default/external-https-split/rule/0",
"health_checks": [
{
"timeout": "2s",
"interval": "5s",
"unhealthy_threshold": 3,
"healthy_threshold": 2,
"http_health_check": {
"host": "some.domain.test",
"path": "/health",
"expected_statuses": [
{
"start": "200",
"end": "201"
}
],
"method": "GET"
}
}
],
}Would it be possible to use for health check host value from FQDN of the Backend resource, because as for now active health-checks in those kind of scenario are not able to work correctly, after activating it marking alll endpoints as not healthy:
httproute/default/external-https-split/rule/0::X.X.X.X:443::health_flags::/failed_active_hc
httproute/default/external-https-split/rule/0::Y.Y.Y.Y:443::health_flags::/failed_active_hcMetadata
Metadata
Assignees
Labels
No labels