fix: proxies going from HTTP => HTTPS: matching upstream http(s) scheme by andreaswachs · Pull Request #7842 · envoyproxy/gateway

andreaswachs · 2025-12-30T08:56:41Z

This makes it possible to use gateways that are internally exposed to Kubernetes as an HTTP service that proxies to a strictly HTTPS service. Some HTTPS services will declare a protocol error when an HTTPS request is forwarded towards them but the HTTP2 :scheme header is still set to http.

What type of PR is this?

This fixes issues with proxying from an internally exposed HTTP proxy, that proxies to strict HTTPS services

What this PR does / why we need it:

I have found issues with a Envoy Gateway deployment that is internal to a Kubernetes cluster, exposed with an HTTP listener. It is talking to an HTTP/2 service that strictly speaks HTTPS. The :scheme meta header were being passed from the downstream source as http even though the backend were configured as HTTPS.

This remediation attempts to base the scheme of the proxied requests to match what the upstream is serving.

The same issue in spirit has been discussed before, specifically for the Envoy Proxy: envoyproxy/envoy#16255

I have tested this change in a local kind cluster hand have found it to fix my issue.

Note to reviewers: I am not well versed in this Envoy Gateway code base and I welcome any and all critique and comments. I don't have the experience to foresee the consequences of this change for users, if there are any.

Release Notes: Yes

Fixes #7979

This makes it possible to use gateways that are internally exposed to Kubernetes as an HTTP service that proxies to a strictly HTTPS service. Some HTTPS services will declare a protocol error when an HTTPS request is forwarded towards them but the HTTP2 `:scheme` header is still set to `http`. Signed-off-by: Andreas Wachs <awa@corti.ai>

Signed-off-by: Andreas Wachs <awa@corti.ai>

zirain · 2025-12-30T13:16:53Z

xref: envoyproxy/envoy#33020

internal/xds/translator/listener.go

Example usage now: ```yaml apiVersion: gateway.envoyproxy.io/v1alpha1 kind: BackendTrafficPolicy metadata: name: match-upstream-scheme namespace: envoy-gateway spec: targetRef: group: gateway.networking.k8s.io kind: Gateway name: my-gateway upstreamScheme: MatchUpstream # or PreserveDownstream (default) ``` Signed-off-by: Andreas Wachs <awa@corti.ai>

arkodg · 2026-01-11T05:45:10Z

api/v1alpha1/backendtrafficpolicy_types.go

 	// +optional
 	UseClientProtocol *bool `json:"useClientProtocol,omitempty"`

+	// UpstreamScheme configures how the :scheme pseudo-header is set for requests forwarded to backends.


can we use Client and Backend instead of Downstream and Upstream to match existing API

I have added a commit with renames - let me know if you like it or if there are more adjustments needed

still using Downstream and Upstream in the Enums

Ah sorry I have missed this

@arkodg would it make sense to rename the field new field clientScheme that this PR introduces on the BackendTrafficPolicy spec to scheme instead if I rename the enum values to Preserve and MatchBackend?

sure +1
cc @jukie

I've renamed the field (and also moved it to the Client Traffic Policy CR)

Signed-off-by: Andreas Wachs <awa@corti.ai>

netlify · 2026-01-12T09:18:57Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`e3872cd`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6979976cc66f580008d52570
😎 Deploy Preview	https://deploy-preview-7842--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

api/v1alpha1/backendtrafficpolicy_types.go

Signed-off-by: Andreas Wachs <awa@corti.ai>

arkodg

LGTM thanks

release-notes/current.yaml

Signed-off-by: Isaac Wilson <10012479+jukie@users.noreply.github.com>

release-notes/current.yaml

Signed-off-by: Isaac Wilson <10012479+jukie@users.noreply.github.com>

jukie · 2026-01-20T15:11:54Z

Fixed the merge conflict but needs a make gen-check @andreaswachs

Signed-off-by: Andreas Wachs <awa@corti.ai>

andreaswachs · 2026-01-22T09:13:06Z

Fixed the merge conflict but needs a make gen-check @andreaswachs

Thank you - done!

jukie · 2026-01-22T15:42:17Z

Still failing @andreaswachs

Signed-off-by: Andreas Wachs <awa@corti.ai>

Signed-off-by: Andreas Wachs <andreas@wachs.email>

codecov · 2026-01-26T16:09:08Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.85%. Comparing base (2951185) to head (e3872cd).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7842      +/-   ##
==========================================
+ Coverage   73.77%   73.85%   +0.07%     
==========================================
  Files         237      237              
  Lines       35754    35763       +9     
==========================================
+ Hits        26379    26412      +33     
+ Misses       7516     7498      -18     
+ Partials     1859     1853       -6

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

andreaswachs · 2026-01-27T08:24:04Z

Still failing @andreaswachs

I'm sorry, I failed to run all the CI checks that I could locally. I see they are working now and thank you for the approval!

Are the Ci checks on the PR something that I can trigger myself or need it be some of you guys?

jukie · 2026-01-27T21:19:29Z

For first time contributors you'll need someone to approve the workflow run upon each commit but in the future they'll be automatic.

Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com>

jukie · 2026-01-28T19:25:58Z

Thanks a lot for this @andreaswachs!

…me (envoyproxy#7842) * fix(translator): matching upstream http(s) scheme This makes it possible to use gateways that are internally exposed to Kubernetes as an HTTP service that proxies to a strictly HTTPS service. Some HTTPS services will declare a protocol error when an HTTPS request is forwarded towards them but the HTTP2 `:scheme` header is still set to `http`. Signed-off-by: Andreas Wachs <awa@corti.ai> * rename `UpstreamScheme` to `ClientScheme` in the public facing API Signed-off-by: Andreas Wachs <awa@corti.ai> Signed-off-by: Sadmi Bouhafs <sadmibouhafs@gmail.com>

andreaswachs requested a review from a team as a code owner December 30, 2025 08:56

andreaswachs and others added 2 commits December 30, 2025 09:56

Merge branch 'main' into fix/matching-upstream-scheme

1e75483

ci: fix test data

5fe88f6

Signed-off-by: Andreas Wachs <awa@corti.ai>

jukie reviewed Dec 30, 2025

View reviewed changes

internal/xds/translator/listener.go Outdated Show resolved Hide resolved

andreaswachs requested a review from jukie January 9, 2026 12:03

arkodg reviewed Jan 11, 2026

View reviewed changes

rename UpstreamScheme to ClientScheme in the public facing API

27b518b

Signed-off-by: Andreas Wachs <awa@corti.ai>

arkodg mentioned this pull request Jan 17, 2026

feat: Add SchemeHeaderTransformation to ClientTrafficPolicy #7980

Closed

jukie reviewed Jan 18, 2026

View reviewed changes

api/v1alpha1/backendtrafficpolicy_types.go Outdated Show resolved Hide resolved

move filed to CTP and rename

073746a

Signed-off-by: Andreas Wachs <awa@corti.ai>

arkodg previously approved these changes Jan 20, 2026

View reviewed changes

arkodg requested a review from jukie January 20, 2026 00:04

arkodg added this to the v1.7.0-rc.1 Release milestone Jan 20, 2026

arkodg requested review from a team January 20, 2026 00:04

zirain reviewed Jan 20, 2026

View reviewed changes

release-notes/current.yaml Outdated Show resolved Hide resolved

zirain previously approved these changes Jan 20, 2026

View reviewed changes

jukie previously approved these changes Jan 20, 2026

View reviewed changes

Merge branch 'main' into fix/matching-upstream-scheme

23df9ef

Signed-off-by: Isaac Wilson <10012479+jukie@users.noreply.github.com>

jukie dismissed stale reviews from zirain, arkodg, and themself via 23df9ef January 20, 2026 15:02

jukie reviewed Jan 20, 2026

View reviewed changes

release-notes/current.yaml Outdated Show resolved Hide resolved

Update release-notes/current.yaml

035b77a

Signed-off-by: Isaac Wilson <10012479+jukie@users.noreply.github.com>

jukie requested review from arkodg and zirain January 20, 2026 15:05

jukie self-requested a review January 20, 2026 15:05

jukie previously approved these changes Jan 20, 2026

View reviewed changes

generate files

5bea17e

Signed-off-by: Andreas Wachs <awa@corti.ai>

andreaswachs dismissed jukie’s stale review via 5bea17e January 22, 2026 09:12

andreaswachs added 2 commits January 26, 2026 13:26

regenerate test data files

14a0ea1

Signed-off-by: Andreas Wachs <awa@corti.ai>

Merge branch 'main' into fix/matching-upstream-scheme

68c0919

Signed-off-by: Andreas Wachs <andreas@wachs.email>

andreaswachs force-pushed the fix/matching-upstream-scheme branch from 731a852 to 68c0919 Compare January 26, 2026 12:27

Merge branch 'main' into fix/matching-upstream-scheme

9ae715c

jukie previously approved these changes Jan 26, 2026

View reviewed changes

jukie requested review from a team January 26, 2026 21:01

zirain previously approved these changes Jan 28, 2026

View reviewed changes

Merge branch 'main' into fix/matching-upstream-scheme

e3872cd

Signed-off-by: Arko Dasgupta <arkodg@users.noreply.github.com>

arkodg dismissed stale reviews from zirain and jukie via e3872cd January 28, 2026 04:58

arkodg merged commit f0a05ca into envoyproxy:main Jan 28, 2026
47 of 50 checks passed

jukie mentioned this pull request Feb 7, 2026

.NET servers reject https gRPC requests terminated to plaintext by Envoy #7979

Closed

Conversation

andreaswachs commented Dec 30, 2025 • edited by jukie Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zirain commented Dec 30, 2025

Uh oh!

Uh oh!

arkodg Jan 11, 2026

Choose a reason for hiding this comment

Uh oh!

andreaswachs Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

arkodg Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

andreaswachs Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

andreaswachs Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

arkodg Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

andreaswachs Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

netlify bot commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

Uh oh!

arkodg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

jukie commented Jan 20, 2026

Uh oh!

andreaswachs commented Jan 22, 2026

Uh oh!

jukie commented Jan 22, 2026

Uh oh!

codecov bot commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

andreaswachs commented Jan 27, 2026

Uh oh!

jukie commented Jan 27, 2026

Uh oh!

Uh oh!

jukie commented Jan 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

andreaswachs commented Dec 30, 2025 •

edited by jukie

Loading

netlify bot commented Jan 12, 2026 •

edited

Loading

codecov bot commented Jan 26, 2026 •

edited

Loading