HTTPRoute Filter not applying

[gid-fieldcode]

We'd appreciate your help with this:

Using version 1.2.1, we have this somewhat complex HTTPRoute definition that differentiates between HTTP methods. We have confirmed that the filters we define do not actually apply to the traffic and therefore the request is received by the backend with the full initial prefix, even though the route is accepted/validated. What are we doing wrong?

The first block below shows the route that fails, and the second block shows a simpler route (all methods treated the same) where the filter is applied as expected.

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: category-gsl-auth-httproute
  namespace: test
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: apps
      namespace: envoy-gateway
  hostnames:
    - "*.acme.club"
  rules:           
    - matches:
      - path:
          type: PathPrefix
          value: /api/public/category-gsl
        method: PUT
      - path:
          type: PathPrefix
          value: /api/public/category-gsl
        method: GET
      - path:
          type: PathPrefix
          value: /api/public/category-gsl
        method: POST
      - path:
          type: PathPrefix
          value: /api/public/category-gsl
        method: PATCH
      - path:
          type: PathPrefix
          value: /api/public/category-gsl
        method: DELETE                              
      timeouts:
        request: "60s"
        backendRequest: "58s"
      backendRefs:
        - group: ""
          kind: Service
          name: category-gsl
          namespace: test
          port: 4900
          weight: 1
    - filters:
        - type: URLRewrite
          urlRewrite:
            path:
              type: ReplacePrefixMatch
              replacePrefixMatch: /
        - type: RequestHeaderModifier
          requestHeaderModifier:
            set:
              - name: X-Forwarded-Proto
                value: "https"                            
              - name: X-Forwarded-Port
                value: "443"          
              - name: X-Forwarded-Host
                value: "%REQ(Host)%"

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: category-gsl-httproute
  namespace: test
spec:
  hostnames:
    - '*.acme.club'
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: apps
      namespace: envoy-gateway
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: category-gsl
          port: 4900
          weight: 1
      filters:
        - type: URLRewrite
          urlRewrite:
            path:
              replacePrefixMatch: /
              type: ReplacePrefixMatch
        - requestHeaderModifier:
            set:
              - name: X-Forwarded-Proto
                value: https
              - name: X-Forwarded-Port
                value: "443"
              - name: X-Forwarded-Host
                value: '%REQ(Host)%'
          type: RequestHeaderModifier
      matches:
        - path:
            type: PathPrefix
            value: /api/public/category-gsl

[gid-fieldcode]

We were able to resolve this by replacing the PrefixMatch filter with a Regex filter. We also had to create a second filter with the exact same functionality and only a different name, otherwise we'd receive the error: "Cannot configure multiple urlRewrite filters for a single HTTPRouteRule". It is very strange that the same filter cannot be applied to two distinct routes. Without this silly fix, we could only create one of the two routes. Creating the second one would lead to this error message. This looks like a bug to us. Even the error message is totally misleading, because the problem was not "multiple filters for the same rule", but "the same filter for two routes". When the situation became "two distinct filters for two distinct routes" the problem was resolved.

So now the working YAML is this:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: category-gsl-auth-httproute
  namespace: test
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: apps
      namespace: envoy-gateway
  hostnames:
    - "*.acme.club"
  rules:           
    - matches:
      - path:
          type: PathPrefix
          value: /api/public/category-gsl
        method: GET
      - path:
          type: PathPrefix
          value: /api/public/category-gsl
        method: PUT
      - path:
          type: PathPrefix
          value: /api/public/category-gsl
        method: POST
      - path:
          type: PathPrefix
          value: /api/public/category-gsl
        method: PATCH
      - path:
          type: PathPrefix
          value: /api/public/category-gsl
        method: DELETE                              
      timeouts:
        request: "60s"
        backendRequest: "58s"
      backendRefs:
        - group: ""
          kind: Service
          name: category-gsl
          namespace: test
          port: 4900
          weight: 1
      filters:
        - type: ExtensionRef
          extensionRef:
            group: gateway.envoyproxy.io
            kind: HTTPRouteFilter
            name: regex-path-rewrite
            # namespace: envoy-gateway
        - type: RequestHeaderModifier
          requestHeaderModifier:
            set:
              - name: X-Forwarded-Proto
                value: "https"                            
              - name: X-Forwarded-Port
                value: "443"          
              - name: X-Forwarded-Host
                value: "%REQ(Host)%"

---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: category-gsl-noauth-httproute
  namespace: test
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: apps
      namespace: envoy-gateway
  hostnames:
    - "*.acme.club"
  rules:    
    - matches:
      - path:
          type: PathPrefix
          value: /api/public/category-gsl
        method: OPTIONS
      - path:
          type: PathPrefix
          value: /api/public/category-gsl
        method: HEAD        
      timeouts:
        request: "60s"
        backendRequest: "58s"
      backendRefs:
        - group: ""
          kind: Service
          name: category-gsl
          namespace: test
          port: 4900
          weight: 1
      filters:
        - type: ExtensionRef
          extensionRef:
            group: gateway.envoyproxy.io
            kind: HTTPRouteFilter
            name: regex-path-rewrite-noauth
            # namespace: envoy-gateway
        - type: RequestHeaderModifier
          requestHeaderModifier:
            set:
              - name: X-Forwarded-Proto
                value: "https"                            
              - name: X-Forwarded-Port
                value: "443"          
              - name: X-Forwarded-Host
                value: "%REQ(Host)%"
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: HTTPRouteFilter
metadata:
  name: regex-path-rewrite
  namespace: test
spec:
  urlRewrite:
    path:
      type: ReplaceRegexMatch
      replaceRegexMatch:
        pattern: '^/api/public/category-gsl(/.*)$'
        substitution: '\1'

---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: HTTPRouteFilter
metadata:
  name: regex-path-rewrite-noauth
  namespace: test
spec:
  urlRewrite:
    path:
      type: ReplaceRegexMatch
      replaceRegexMatch:
        pattern: '^/api/public/category-gsl(/.*)$'
        substitution: '\1'

[arkodg]

glad you found the HTTPRouteFilter useful for this, @gid-fieldcode the issue around reusing the same HTTPRouteFilter is fixed in v1.2.5 #4989