fix: honor BackendConfigPolicy health check host on static backends#14201
Merged
puertomontt merged 3 commits intoJun 23, 2026
Merged
Conversation
The static backend plugin stamps each endpoint's health_check_config.hostname with the backend's dial address. Per Envoy semantics, that endpoint-level hostname overrides the cluster-level http_health_check host, so an explicitly configured BackendConfigPolicy.healthCheck.http.host was silently ignored and health checks used the wrong Host header (causing 503s against backends that route on Host, e.g. ALBs). When a BackendConfigPolicy configures a health check host (HTTP host or gRPC authority), clear the auto-stamped endpoint hostname so the configured cluster-level value is used. The default endpoint hostname is preserved when no host is configured, matching prior behavior. This restores the Gloo Edge v1 behavior, where the static plugin overrode the endpoint hostname with the configured health check host. Signed-off-by: omar <[email protected]>
gateway-bot
added
do-not-merge/description-invalid
kind/fix
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes a regression where BackendConfigPolicy-configured health check host/authority was ignored for Static backends because the static backend plugin stamped an endpoint-level health_check_config.hostname, which (per Envoy behavior) overrides the cluster-level health check host/authority.
Changes:
- Clear per-endpoint
health_check_config.hostnamewhen the policy configures an explicit HTTPhostor gRPCauthority, allowing the cluster-level config to take effect. - Add unit coverage for HTTP host override, gRPC authority override, and preserving the default when no host is configured.
- Add a gateway translator golden test reproducing the Static DNS backend +
BackendConfigPolicy.healthCheck.http.hostscenario.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/kgateway/extensions2/plugins/backendconfigpolicy/plugin.go | Clears endpoint-level health check hostname when an explicit cluster-level host/authority is configured. |
| pkg/kgateway/extensions2/plugins/backendconfigpolicy/plugin_test.go | Adds unit tests validating hostname clearing/preservation behavior. |
| pkg/kgateway/translator/gateway/gateway_translator_test.go | Adds a translator golden test case exercising the scenario end-to-end. |
| pkg/kgateway/translator/gateway/testutils/inputs/backendconfigpolicy/healthcheck-static-backend.yaml | New input fixture reproducing the Static backend + policy health check host configuration. |
| pkg/kgateway/translator/gateway/testutils/outputs/backendconfigpolicy/healthcheck-static-backend.yaml | New expected output ensuring cluster-level host is set and endpoint health check hostname override is removed. |
puertomontt
enabled auto-merge
June 8, 2026 15:48
…fix/static-backend-healthcheck-host-override Signed-off-by: omar <[email protected]>
sheidkamp
reviewed
Jun 22, 2026
sheidkamp
left a comment
sheidkamp
left a comment
Contributor
There was a problem hiding this comment.
One small update to the tests - otherwise lgtm
| cluster := clusterWithEndpointHealthCheckHostname(dialHost) | ||
| processBackend(context.Background(), policyIR, ir.BackendObjectIR{}, cluster) | ||
|
|
||
| assert.Empty(t, endpointHealthCheckHostname(cluster), "endpoint hostname should be cleared so the configured authority wins") |
Contributor
There was a problem hiding this comment.
The HTTP test also checks the healthcheck host. Should we do the same here?
Signed-off-by: omar <[email protected]>
sheidkamp
approved these changes
Jun 22, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Jun 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The static backend plugin stamps each endpoint's
health_check_config.hostnamewith the backend's dial address. Per Envoy semantics, a non-empty endpoint-level hostname overrides the cluster-levelhttp_health_check.host. As a result, an explicitly configuredBackendConfigPolicy.healthCheck.http.hostwas silently ignored: the cluster-level health check was set correctly, but the endpoint-level hostname (the backend's DNS dial address) took precedence, so health checks were sent with the wrongHostheader.For backends that route on the
Hostheader (e.g. AWS ALBs, host-routing proxies), this marks all endpoints unhealthy and causes 503s.Fix
When a
BackendConfigPolicyconfigures a health check host (HTTPhostor gRPCauthority), clear the auto-stamped endpoint-level hostname inprocessBackendso the configured cluster-level value governs. When no host is configured, the endpoint hostname is preserved as a sensible default (the backend's real hostname rather than the internal cluster name), keeping prior behavior.This is the reconciliation point where both the backend's dial address (set by the backend plugin) and the configured health check host (from the policy) are first available together. It restores the Gloo Edge v1 behavior, where the static plugin overrode the endpoint hostname with the configured health check host inline — logic that was dropped when health-check config moved from the monolithic
Upstreamspec into the separateBackendConfigPolicyCRD.Regression
This was a regression from Gloo Edge v1, which honored the configured health check host.
Change Type
/kind fix
Changelog
Additional Notes
Tests added:
backendconfigpolicy/plugin_test.gocovering HTTP host override, gRPC authority override, and the no-host default-preserved case.backendconfigpolicy/healthcheck-static-backend.yaml) reproducing the exact issue scenario (Static DNS backend + BackendConfigPolicy withhealthCheck.http.host).