fix: active health check respect endpoint hostname by zirain · Pull Request #8452 · envoyproxy/gateway

zirain · 2026-03-09T02:47:04Z

netlify · 2026-03-09T02:47:09Z

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name	Link
🔨 Latest commit	`0dc6831`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69b0bf34adf87e0008a67b1c

codecov · 2026-03-09T02:57:16Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.15%. Comparing base (2c9af84) to head (0dc6831).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8452      +/-   ##
==========================================
+ Coverage   74.10%   74.15%   +0.04%     
==========================================
  Files         242      242              
  Lines       37581    37599      +18     
==========================================
+ Hits        27850    27881      +31     
+ Misses       7786     7775      -11     
+ Partials     1945     1943       -2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

internal/xds/translator/testdata/in/xds-ir/health-check.yaml

internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.in.yaml

internal/xds/translator/testdata/out/xds-ir/health-check.endpoints.yaml

zhaohuabing · 2026-03-10T06:44:23Z

It's a bit difficult to review the test file change - seems not related to this PR directly.

Can we move these changes out? The improvement on existing test files can be in a separate follow-up PR if needed.

zirain · 2026-03-10T07:04:22Z

It's a bit difficult to review the test file change - seems not related to this PR directly.

Can we move these changes out? The improvement on existing test files can be in a separate follow-up PR if needed.

updated

zhaohuabing

LGTM. Thanks!

kkk777-7 · 2026-03-10T14:24:13Z

LGTM, thanks!

arko-oai · 2026-03-10T20:40:10Z

internal/xds/translator/cluster.go

+	return ptr.To(hc.Active.Overrides.Port)
+}
+
+func getHealthCheckOverridesHostname(hc *ir.HealthCheck, ep *ir.DestinationEndpoint) string {


there are 3 cases

hc hostname unset

hc hostname set in BTP

hostname from Backend to be used as hc hostname
(most specific wins over least specific)

can we make sure this is true, and a test case captures this precedence

there're coverd by:

first-route-dest

third-route-dest
with no change in this patch.

I copied the yaml from the gateway api, but it make this patch hard to review as @zhaohuabing mentioned.

zirain · 2026-03-11T00:15:07Z

internal/xds/translator/testdata/out/xds-ir/health-check.endpoints.yaml

@@ -1 +1 @@
 - clusterName: first-route-dest


@arkodg this's the case that had hostname in health check

- name: "first-route" hostname: "*" traffic: healthCheck: active: timeout: "500ms" interval: "3s" unhealthyThreshold: 3 healthyThreshold: 1 http: host: "*" path: "/healthz" expectedResponse: text: "ok" expectedStatuses: - 200 - 300 passive: baseEjectionTime: 180s interval: 2s maxEjectionPercent: 100 consecutive5XxErrors: 5 consecutiveGatewayErrors: 0 consecutiveLocalOriginFailures: 5 splitExternalLocalOriginErrors: false destination: name: "first-route-dest" settings: - endpoints: - host: "1.2.3.4" port: 50000 name: "first-route-dest/backend/0"

Signed-off-by: zirain <zirain2009@gmail.com>

revert unrelated changes Signed-off-by: zirain <zirain2009@gmail.com>

revert unrelated changes Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

* api: make ConnectionLimit.Value optional (#8478) * api: make ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> * release-notes: add entry for ConnectionLimit.Value optional Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> * fix: add CEL rule to require value when closeDelay is set Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> --------- Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix up release notes Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner (#8387) * fix: aggregate xRoute/xPolicy statuses across GWCs in gateway-api runner Signed-off-by: y-rabie <youssef.rabie@procore.com> * polish Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * add e2e test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * release note Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * truncate policy status & add tests Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * update Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: y-rabie <youssef.rabie@procore.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: y-rabie <youssef.rabie@procore.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: active health check respect endpoint hostname (#8452) revert unrelated changes Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: exclude unmanaged route parents from xPolicy status ancestors (#8321) * add test for mixed managed and unmanaged Gateway parents Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix the policy status when the targeting routes have managed and unmanged Gateway parents Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * fix test Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: add ownerReferences to ratelimit ConfigMap and HPA (#8358) Signed-off-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com> Co-authored-by: Karol Szwaj <karol.szwaj@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: computeHosts doesn't work when listener and route both wildcard (#8186) * fix: computeHosts doesn't work when listener and route both wildcard Signed-off-by: zirain <zirain2009@gmail.com> * remove skipped tests Signed-off-by: zirain <zirain2009@gmail.com> * Update internal/gatewayapi/helpers.go Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> --------- Signed-off-by: zirain <zirain2009@gmail.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: fixed local object reference resolution from parent in merged BackendTrafficPolicies (#8210) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: XListenerSet allows route from same namespace (#8226) Previously, using allowedRoutes/Same for an XListenerSet with an xRoute in the same namespace would return an error. Now it properly allows xRoutes from the same namespace. Signed-off-by: Kris Hicks <khicks@nvidia.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix: API key auth (#8267) * add test for multiple keys Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> * revert secret transform Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> --------- Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * fix gen-check Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * add release notes Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> * add release notes for envoy proxy image Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> --------- Signed-off-by: Felipe Sabadini Facina <fsabadini@hotmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com> Signed-off-by: y-rabie <youssef.rabie@procore.com> Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com> Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: Kris Hicks <khicks@nvidia.com> Co-authored-by: Felipe Sabadini Facina <fsabadini@hotmail.com> Co-authored-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Co-authored-by: y-rabie <youssef.rabie@procore.com> Co-authored-by: zirain <zirain2009@gmail.com> Co-authored-by: Tejasriram Parvathaneni <tejaparvathaneni90@gmail.com> Co-authored-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Co-authored-by: Kris Hicks <khicks@nvidia.com>

zirain requested a review from a team as a code owner March 9, 2026 02:47

zirain force-pushed the endpoint-healthcheck branch 3 times, most recently from 6df6cfa to a12724d Compare March 9, 2026 08:12

arkodg added this to the v1.8.0-rc.1 Release milestone Mar 10, 2026

arkodg added the cherrypick/release-v1.7.1 label Mar 10, 2026

zirain commented Mar 10, 2026

View reviewed changes

internal/xds/translator/testdata/in/xds-ir/health-check.yaml Show resolved Hide resolved

zirain commented Mar 10, 2026

View reviewed changes

internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.in.yaml Outdated Show resolved Hide resolved

zirain commented Mar 10, 2026

View reviewed changes

internal/xds/translator/testdata/out/xds-ir/health-check.endpoints.yaml Show resolved Hide resolved

zirain force-pushed the endpoint-healthcheck branch from a12724d to a9b6015 Compare March 10, 2026 07:04

zhaohuabing previously approved these changes Mar 10, 2026

View reviewed changes

zhaohuabing requested a review from a team March 10, 2026 12:11

kkk777-7 previously approved these changes Mar 10, 2026

View reviewed changes

arko-oai reviewed Mar 10, 2026

View reviewed changes

arkodg requested a review from nareddyt March 10, 2026 20:40

zirain commented Mar 11, 2026

View reviewed changes

revert unrelated changes

0dc6831

Signed-off-by: zirain <zirain2009@gmail.com>

zirain dismissed stale reviews from kkk777-7 and zhaohuabing via 0dc6831 March 11, 2026 01:02

zirain force-pushed the endpoint-healthcheck branch from a9b6015 to 0dc6831 Compare March 11, 2026 01:02

zirain requested review from arko-oai, kkk777-7 and zhaohuabing March 11, 2026 01:02

zhaohuabing approved these changes Mar 11, 2026

View reviewed changes

cnvergence approved these changes Mar 11, 2026

View reviewed changes

cnvergence merged commit 366170a into envoyproxy:main Mar 11, 2026
36 checks passed

cnvergence pushed a commit to cnvergence/gateway that referenced this pull request Mar 11, 2026

fix: active health check respect endpoint hostname (envoyproxy#8452)

be6df57

revert unrelated changes Signed-off-by: zirain <zirain2009@gmail.com>

cnvergence pushed a commit to cnvergence/gateway that referenced this pull request Mar 11, 2026

fix: active health check respect endpoint hostname (envoyproxy#8452)

d118fe1

revert unrelated changes Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

cnvergence pushed a commit to cnvergence/gateway that referenced this pull request Mar 11, 2026

fix: active health check respect endpoint hostname (envoyproxy#8452)

5f83d7a

revert unrelated changes Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

cnvergence pushed a commit to cnvergence/gateway that referenced this pull request Mar 11, 2026

fix: active health check respect endpoint hostname (envoyproxy#8452)

bc60d35

revert unrelated changes Signed-off-by: zirain <zirain2009@gmail.com> Signed-off-by: Karol Szwaj <karol.szwaj@gmail.com>

zirain deleted the endpoint-healthcheck branch March 11, 2026 22:57

wengyao04 mentioned this pull request Mar 20, 2026

Title: Active health check per-endpoint hostname override blocked by wildcard Host: "*" #8564

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: active health check respect endpoint hostname#8452

fix: active health check respect endpoint hostname#8452
cnvergence merged 1 commit intoenvoyproxy:mainfrom
zirain:endpoint-healthcheck

zirain commented Mar 9, 2026

netlify bot commented Mar 9, 2026 •

edited

Loading

codecov bot commented Mar 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

zhaohuabing commented Mar 10, 2026

zirain commented Mar 10, 2026

zhaohuabing left a comment

kkk777-7 commented Mar 10, 2026

arko-oai Mar 10, 2026

zirain Mar 11, 2026

zirain Mar 11, 2026

Uh oh!

Labels

6 participants

Conversation

zirain commented Mar 9, 2026

netlify bot commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

codecov bot commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

zhaohuabing commented Mar 10, 2026

zirain commented Mar 10, 2026

zhaohuabing left a comment

Choose a reason for hiding this comment

kkk777-7 commented Mar 10, 2026

arko-oai Mar 10, 2026

Choose a reason for hiding this comment

zirain Mar 11, 2026

Choose a reason for hiding this comment

zirain Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Labels

6 participants

netlify bot commented Mar 9, 2026 •

edited

Loading

codecov bot commented Mar 9, 2026 •

edited

Loading