Cannot get HTTP -> HTTPS redirect example to work

[zmajeed]

I've got a kind cluster in podman on Windows 11 - I'm trying out Envoy Gateway 1.3.0-rc.1

I cannot get the HTTP to HTTPS redirect example to fully work - https://gateway.envoyproxy.io/docs/tasks/traffic/http-redirect

In particular the gateway eg is not actually listening on port 443 so the HTTP redirect doesn't complete and direct HTTPS requests don't connect

kubectl get gateway eg -n default

NAME   CLASS   ADDRESS      PROGRAMMED   AGE
eg     eg      10.89.0.83   True         33h

What's needed for the gateway to respond to HTTPS requests?

Here's output from the two curl commands from the example

curl --verbose --header "Host: www.example.com" http://10.89.0.83/get

*   Trying 10.89.0.83:80...
* Connected to 10.89.0.83 (10.89.0.83) port 80
* using HTTP/1.x
> GET /get HTTP/1.1
> Host: www.example.com
> User-Agent: curl/8.11.1
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 302 Found
< location: https://www.example.com/get
< date: Sat, 25 Jan 2025 01:13:25 GMT
< content-length: 0
<
* Connection #0 to host 10.89.0.83 left intact

curl -v -H 'Host:www.example.com' --resolve "www.example.com:443:10.89.0.83" --cacert CA.crt https://www.example.com:443/get

* Added www.example.com:443:10.89.0.83 to DNS cache
* Hostname www.example.com was found in DNS cache
*   Trying 10.89.0.83:443...
* connect to 10.89.0.83 port 443 from 0.0.0.0 port 60125 failed: Connection refused
* Failed to connect to www.example.com port 443 after 2021 ms: Could not connect to server
* closing connection #0
curl: (7) Failed to connect to www.example.com port 443 after 2021 ms: Could not connect to server

Here's the gateway

kubectl describe gateway eg -n default

Name:         eg
Namespace:    default
Labels:       <none>
Annotations:  <none>
API Version:  gateway.networking.k8s.io/v1
Kind:         Gateway
Metadata:
  Creation Timestamp:  2025-01-23T16:36:02Z
  Generation:          4
  Resource Version:    426487
  UID:                 8f8f88aa-4272-4b4f-82ea-22057365635c
Spec:
  Gateway Class Name:  eg
  Listeners:
    Allowed Routes:
      Namespaces:
        From:  Same
    Name:      http
    Port:      80
    Protocol:  HTTP
    Allowed Routes:
      Namespaces:
        From:  Same
    Name:      https
    Port:      443
    Protocol:  HTTPS
    Tls:
      Certificate Refs:
        Group:
        Kind:   Secret
        Name:   example-com
      Mode:     Terminate
Status:
  Addresses:
    Type:   IPAddress
    Value:  10.89.0.83
  Conditions:
    Last Transition Time:  2025-01-25T00:22:58Z
    Message:               The Gateway has been scheduled by Envoy Gateway
    Observed Generation:   4
    Reason:                Accepted
    Status:                True
    Type:                  Accepted
    Last Transition Time:  2025-01-25T00:22:58Z
    Message:               Address assigned to the Gateway, 1/1 envoy replicas available
    Observed Generation:   4
    Reason:                Programmed
    Status:                True
    Type:                  Programmed
  Listeners:
    Attached Routes:  1
    Conditions:
      Last Transition Time:  2025-01-25T00:22:58Z
      Message:               Sending translated listener configuration to the data plane
      Observed Generation:   4
      Reason:                Programmed
      Status:                True
      Type:                  Programmed
      Last Transition Time:  2025-01-25T00:22:58Z
      Message:               Listener has been successfully translated
      Observed Generation:   4
      Reason:                Accepted
      Status:                True
      Type:                  Accepted
      Last Transition Time:  2025-01-25T00:22:58Z
      Message:               Listener references have been resolved
      Observed Generation:   4
      Reason:                ResolvedRefs
      Status:                True
      Type:                  ResolvedRefs
    Name:                    http
    Supported Kinds:
      Group:          gateway.networking.k8s.io
      Kind:           HTTPRoute
      Group:          gateway.networking.k8s.io
      Kind:           GRPCRoute
    Attached Routes:  1
    Conditions:
      Last Transition Time:  2025-01-25T00:22:58Z
      Message:               Sending translated listener configuration to the data plane
      Observed Generation:   4
      Reason:                Programmed
      Status:                True
      Type:                  Programmed
      Last Transition Time:  2025-01-25T00:22:58Z
      Message:               Listener has been successfully translated
      Observed Generation:   4
      Reason:                Accepted
      Status:                True
      Type:                  Accepted
      Last Transition Time:  2025-01-25T00:22:58Z
      Message:               Listener references have been resolved
      Observed Generation:   4
      Reason:                ResolvedRefs
      Status:                True
      Type:                  ResolvedRefs
    Name:                    https
    Supported Kinds:
      Group:  gateway.networking.k8s.io
      Kind:   HTTPRoute
      Group:  gateway.networking.k8s.io
      Kind:   GRPCRoute
Events:       <none>

and the two HTTPRoute resources

kubectl describe httproute tls-redirect

Name:         tls-redirect
Namespace:    default
Labels:       <none>
Annotations:  <none>
API Version:  gateway.networking.k8s.io/v1
Kind:         HTTPRoute
Metadata:
  Creation Timestamp:  2025-01-25T00:14:53Z
  Generation:          1
  Resource Version:    425459
  UID:                 edb7831e-91f7-476a-a002-7e3c4b8106e3
Spec:
  Hostnames:
    www.example.com
  Parent Refs:
    Group:         gateway.networking.k8s.io
    Kind:          Gateway
    Name:          eg
    Section Name:  http
  Rules:
    Filters:
      Request Redirect:
        Scheme:       https
        Status Code:  302
      Type:           RequestRedirect
    Matches:
      Path:
        Type:   PathPrefix
        Value:  /
Status:
  Parents:
    Conditions:
      Last Transition Time:  2025-01-25T00:14:53Z
      Message:               Route is accepted
      Observed Generation:   1
      Reason:                Accepted
      Status:                True
      Type:                  Accepted
      Last Transition Time:  2025-01-25T00:14:53Z
      Message:               Resolved all the Object references for the Route
      Observed Generation:   1
      Reason:                ResolvedRefs
      Status:                True
      Type:                  ResolvedRefs
    Controller Name:         gateway.envoyproxy.io/gatewayclass-controller
    Parent Ref:
      Group:         gateway.networking.k8s.io
      Kind:          Gateway
      Name:          eg
      Section Name:  http
Events:              <none>

kubectl describe httproute backend

Name:         backend
Namespace:    default
Labels:       <none>
Annotations:  <none>
API Version:  gateway.networking.k8s.io/v1
Kind:         HTTPRoute
Metadata:
  Creation Timestamp:  2025-01-23T16:36:02Z
  Generation:          8
  Resource Version:    426486
  UID:                 c2318e73-d0c6-4b93-9af4-57e02f172cd6
Spec:
  Hostnames:
    www.example.com
  Parent Refs:
    Group:         gateway.networking.k8s.io
    Kind:          Gateway
    Name:          eg
    Section Name:  https
  Rules:
    Backend Refs:
      Group:
      Kind:    Service
      Name:    backend
      Port:    3000
      Weight:  1
    Matches:
      Path:
        Type:   PathPrefix
        Value:  /
Status:
  Parents:
    Conditions:
      Last Transition Time:  2025-01-25T00:22:19Z
      Message:               Route is accepted
      Observed Generation:   7
      Reason:                Accepted
      Status:                True
      Type:                  Accepted
      Last Transition Time:  2025-01-25T00:22:19Z
      Message:               Resolved all the Object references for the Route
      Observed Generation:   7
      Reason:                ResolvedRefs
      Status:                True
      Type:                  ResolvedRefs
    Controller Name:         gateway.envoyproxy.io/gatewayclass-controller
    Parent Ref:
      Group:  gateway.networking.k8s.io
      Kind:   Gateway
      Name:   eg
    Conditions:
      Last Transition Time:  2025-01-24T01:23:08Z
      Message:               Route is accepted
      Observed Generation:   4
      Reason:                Accepted
      Status:                True
      Type:                  Accepted
      Last Transition Time:  2025-01-24T01:23:08Z
      Message:               Resolved all the Object references for the Route
      Observed Generation:   4
      Reason:                ResolvedRefs
      Status:                True
      Type:                  ResolvedRefs
    Controller Name:         gateway.envoyproxy.io/gatewayclass-controller
    Parent Ref:
      Group:  gateway.networking.k8s.io
      Kind:   Gateway
      Name:   gw
    Conditions:
      Last Transition Time:  2025-01-25T00:22:58Z
      Message:               Route is accepted
      Observed Generation:   8
      Reason:                Accepted
      Status:                True
      Type:                  Accepted
      Last Transition Time:  2025-01-25T00:22:58Z
      Message:               Resolved all the Object references for the Route
      Observed Generation:   8
      Reason:                ResolvedRefs
      Status:                True
      Type:                  ResolvedRefs
    Controller Name:         gateway.envoyproxy.io/gatewayclass-controller
    Parent Ref:
      Group:         gateway.networking.k8s.io
      Kind:          Gateway
      Name:          eg
      Section Name:  https
Events:              <none>

[guydc]

Hi @zmajeed !

Can you also provide a kubectl describe of the loadbalancer service created for the eg Gateway in envoy-gateway-system namespace?