fix: respect backend endpoint hostname for health checks by arkodg · Pull Request #8929 · envoyproxy/gateway

arkodg · 2026-05-07T03:58:55Z

### Summary
- Keep BackendTrafficPolicy HTTP health check hostnames as explicit cluster-level hosts, and leave route-derived host fallback to xDS cluster translation.
- Preserve Backend endpoint hostnames as per-endpoint overrides via Endpoint.HealthCheckConfig.hostname, ahead of the route fallback.
- Update gatewayapi/xDS fixtures and generated API docs/CRDs for the host selection order.

### Test plan
- go test ./internal/ir
- go test ./internal/xds/translator
- go test ./internal/gatewayapi -run TestTranslate/backendtrafficpolicy
- go test ./internal/gatewayapi -run TestTranslate/(clienttrafficpolicy-http-health-check|envoyextensionpolicy-with-extproc-with-retries|envoyextensionpolicy-with-extproc-with-traffic-features|envoyproxy-accesslog-with-traffic|envoyproxy-tracing-backend-uds|envoyproxy-tracing-backend|securitypolicy-with-jwt-backendcluster|securitypolicy-with-jwt-backendsettings)
- make generate
- make manifests
- git diff --check

Signed-off-by: Arko Dasgupta <arkodg@gmail.com>
Co-authored-by: Codex <noreply@openai.com>

netlify · 2026-05-07T03:59:00Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`8f3bf8b`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69fd2c93fd69480008c46c82
😎 Deploy Preview	https://deploy-preview-8929--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a75aca7348

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-07T04:03:24Z

+	// If active HTTP health check has an explicit hostname override, keep that cluster-level host.
+	// A route-derived host is only a default, so Backend endpoint hostname can still override it
+	// through EndpointHealthCheckConfig.
+	if hc.Active.HTTP != nil && hc.Active.HTTP.Host != "" && hc.Active.HTTP.Host != "*" && !hc.Active.HTTP.HostFromRoute {


Add a release note for this bug fix

This change fixes user-visible health-check behavior and changes generated xDS by emitting Endpoint.HealthCheckConfig.hostname when the cluster-level host was only route-derived, but release-notes/current.yaml was not updated. The repo review checklist requires bug fixes (and generated Envoy config behavior changes) to be called out so operators relying on health-check behavior or xDS extensions can discover the change during upgrade.

Useful? React with 👍 / 👎.

zirain · 2026-05-07T04:10:43Z

+	// Hostname defines the HTTP Host header used for active HTTP health checks.
+	// Host selection uses this order: this field, the associated Backend endpoint
+	// hostname if available, then the effective HTTPRoute or GRPCRoute hostname
+	// for the Gateway listener.


the API changed in a patch release?

changed the doc string, to highlight the API

need to update the v1.7 doc site manually, otherwise LGTM.

### Summary - Keep BackendTrafficPolicy HTTP health check hostnames as explicit cluster-level hosts, and leave route-derived host fallback to xDS cluster translation. - Preserve Backend endpoint hostnames as per-endpoint overrides via Endpoint.HealthCheckConfig.hostname, ahead of the route fallback. - Update gatewayapi/xDS fixtures, release notes, and generated API docs/CRDs for the host selection order. ### Test plan - go test ./internal/ir - go test ./internal/xds/translator - go test ./internal/gatewayapi -run TestTranslate/backendtrafficpolicy - go test ./internal/gatewayapi -run TestTranslate/(clienttrafficpolicy-http-health-check|envoyextensionpolicy-with-extproc-with-retries|envoyextensionpolicy-with-extproc-with-traffic-features|envoyproxy-accesslog-with-traffic|envoyproxy-tracing-backend-uds|envoyproxy-tracing-backend|securitypolicy-with-jwt-backendcluster|securitypolicy-with-jwt-backendsettings) - make generate - make manifests - git diff --check Signed-off-by: Arko Dasgupta <arkodg@gmail.com> Co-authored-by: Codex <noreply@openai.com>

codecov · 2026-05-07T04:48:46Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.73%. Comparing base (98a4def) to head (8f3bf8b).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8929      +/-   ##
==========================================
- Coverage   74.74%   74.73%   -0.01%     
==========================================
  Files         251      251              
  Lines       40372    40370       -2     
==========================================
- Hits        30176    30171       -5     
- Misses       8130     8132       +2     
- Partials     2066     2067       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

zirain · 2026-05-07T06:35:38Z

@albsga4 will this help on your case?

Signed-off-by: zirain <zirain2009@gmail.com>

…8929) * fix: respect backend endpoint hostname for health checks - Keep BackendTrafficPolicy HTTP health check hostnames as explicit cluster-level hosts, and leave route-derived host fallback to xDS cluster translation. - Preserve Backend endpoint hostnames as per-endpoint overrides via Endpoint.HealthCheckConfig.hostname, ahead of the route fallback. - Update gatewayapi/xDS fixtures, release notes, and generated API docs/CRDs for the host selection order. - go test ./internal/ir - go test ./internal/xds/translator - go test ./internal/gatewayapi -run TestTranslate/backendtrafficpolicy - go test ./internal/gatewayapi -run TestTranslate/(clienttrafficpolicy-http-health-check|envoyextensionpolicy-with-extproc-with-retries|envoyextensionpolicy-with-extproc-with-traffic-features|envoyproxy-accesslog-with-traffic|envoyproxy-tracing-backend-uds|envoyproxy-tracing-backend|securitypolicy-with-jwt-backendcluster|securitypolicy-with-jwt-backendsettings) - make generate - make manifests - git diff --check Signed-off-by: Arko Dasgupta <arkodg@gmail.com> Co-authored-by: Codex <noreply@openai.com> * fix gen Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: Arko Dasgupta <arkodg@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> Co-authored-by: Codex <noreply@openai.com> Co-authored-by: zirain <zirain2009@gmail.com>

* fix json report (#8614) Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> (cherry picked from commit 4768ca7) * fix: deep copy status in translator layer to avoid race (#8778) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> (cherry picked from commit 3f70a89) * fix: force HTTP1 for upstream connections for WS and WSS backends (#8699) * force HTTP1 for upstream connections for WS and WSS backends Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * use different clusters for mixed upstream protocols Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix lint Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> (cherry picked from commit 7633125) * fix: reason with multiple errors rejected validation (#8859) * fix: reason with multiple errors rejected validation Signed-off-by: zirain <zirain2009@gmail.com> * release notes Signed-off-by: zirain <zirain2009@gmail.com> * fix lint Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> (cherry picked from commit 7811d86) * feat(chart): Allow configuring envoy proxy image via helm chart (#8785) * feat: Allow configuring envoy proxy defaults via helm chart This commit is a continuation of the previous work to support supplying default proxy settings added in #7698 and adds three new chart values under `global.images.envoyProxy`: | Value | Type | Default | Description | |----------------------------------------|--------|------|---------------------------------------------------------------------| | `global.images.envoyProxy.image` | string | `""` | Full image name (`registry/repo:tag`) for the Envoy Proxy container | | `global.images.envoyProxy.pullPolicy` | string | `""` | Image pull policy | | `global.images.envoyProxy.pullSecrets` | list | `[]` | Image pull secrets | When any of these are set, the chart generates an `envoyProxy:` block inside the `EnvoyGateway` ConfigMap, wiring into the existing `EnvoyGatewaySpec.envoyProxy` field (added in #7698). The global `imageRegistry` override takes highest precedence, consistent with other chart components. Full EnvoyProxy defaults (replicas, resources, etc.) can be provided via `config.envoyGateway.envoyProxy`; the image values are merged on top. Closes #4764. Signed-off-by: Michael Sommerville <msommerville@gmail.com> (cherry picked from commit 8570285) * add rn and version bump Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: respect backend endpoint hostname for health checks (#8929) * fix: respect backend endpoint hostname for health checks - Keep BackendTrafficPolicy HTTP health check hostnames as explicit cluster-level hosts, and leave route-derived host fallback to xDS cluster translation. - Preserve Backend endpoint hostnames as per-endpoint overrides via Endpoint.HealthCheckConfig.hostname, ahead of the route fallback. - Update gatewayapi/xDS fixtures, release notes, and generated API docs/CRDs for the host selection order. - go test ./internal/ir - go test ./internal/xds/translator - go test ./internal/gatewayapi -run TestTranslate/backendtrafficpolicy - go test ./internal/gatewayapi -run TestTranslate/(clienttrafficpolicy-http-health-check|envoyextensionpolicy-with-extproc-with-retries|envoyextensionpolicy-with-extproc-with-traffic-features|envoyproxy-accesslog-with-traffic|envoyproxy-tracing-backend-uds|envoyproxy-tracing-backend|securitypolicy-with-jwt-backendcluster|securitypolicy-with-jwt-backendsettings) - make generate - make manifests - git diff --check Signed-off-by: Arko Dasgupta <arkodg@gmail.com> Co-authored-by: Codex <noreply@openai.com> * fix gen Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: Arko Dasgupta <arkodg@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> Co-authored-by: Codex <noreply@openai.com> Co-authored-by: zirain <zirain2009@gmail.com> * update release notes Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix gen-check Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * Revert "feat(chart): Allow configuring envoy proxy image via helm chart (#8785)" This reverts commit 092cc67. Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Michael Sommerville <msommerville@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> Signed-off-by: Arko Dasgupta <arkodg@gmail.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Co-authored-by: zirain <zirain2009@gmail.com> Co-authored-by: Michael Sommerville <msommerville@gmail.com> Co-authored-by: Arko Dasgupta <arkodg@gmail.com> Co-authored-by: Codex <noreply@openai.com>

arkodg requested a review from a team as a code owner May 7, 2026 03:58

chatgpt-codex-connector Bot reviewed May 7, 2026

View reviewed changes

arkodg force-pushed the healthcheck-fix branch from a75aca7 to 882c021 Compare May 7, 2026 04:08

zirain reviewed May 7, 2026

View reviewed changes

arkodg force-pushed the healthcheck-fix branch from 882c021 to af88c67 Compare May 7, 2026 04:31

arkodg force-pushed the healthcheck-fix branch from af88c67 to 3afdd5a Compare May 7, 2026 04:37

zhaohuabing added the cherrypick/release-v1.7.3 label May 7, 2026

zhaohuabing added this to the v1.8.0 Release milestone May 8, 2026

zirain added 2 commits May 8, 2026 08:20

Merge branch 'main' into healthcheck-fix

4203fcc

fix gen

8f3bf8b

Signed-off-by: zirain <zirain2009@gmail.com>

zhaohuabing approved these changes May 8, 2026

View reviewed changes

zirain approved these changes May 8, 2026

View reviewed changes

arkodg merged commit dd2aadd into envoyproxy:main May 8, 2026
39 of 42 checks passed

cnvergence mentioned this pull request May 8, 2026

[release/v1.7] Cherry-pick for v1.7.3 #8869

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: respect backend endpoint hostname for health checks#8929

fix: respect backend endpoint hostname for health checks#8929
arkodg merged 3 commits intoenvoyproxy:mainfrom
arkodg:healthcheck-fix

arkodg commented May 7, 2026 •

edited

Loading

Uh oh!

netlify Bot commented May 7, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot May 7, 2026

Uh oh!

zirain May 7, 2026

Uh oh!

arkodg May 7, 2026

Uh oh!

zirain May 7, 2026 •

edited

Loading

Uh oh!

codecov Bot commented May 7, 2026 •

edited

Loading

Uh oh!

zirain commented May 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

arkodg commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 7, 2026

Choose a reason for hiding this comment

Uh oh!

zirain May 7, 2026

Choose a reason for hiding this comment

Uh oh!

arkodg May 7, 2026

Choose a reason for hiding this comment

Uh oh!

zirain May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

zirain commented May 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

arkodg commented May 7, 2026 •

edited

Loading

netlify Bot commented May 7, 2026 •

edited

Loading

zirain May 7, 2026 •

edited

Loading

codecov Bot commented May 7, 2026 •

edited

Loading