api: add detectMisdirectedRequests to EnvoyProxy

api/v1alpha1/tls_types.go

@@ -19,6 +19,16 @@ type ClientTLSSettings struct {
 	ClientValidation *ClientValidationContext `json:"clientValidation,omitempty"`
 	TLSSettings      `json:",inline"`
 
+	// DetectMisdirectedRequests enables 421 responses for HTTP/2 requests
+	// coalesced onto a TLS connection selected by a different SNI, as described in
+	// [GEP-3567](https://gateway-api.sigs.k8s.io/geps/gep-3567/).
+	// When disabled, overlapping TLS listeners keep the default ALPN downgrade to
+	// HTTP/1.1 unless ClientTrafficPolicy configures ALPN.
+	// Default: false
+	//
+	// +optional
+	DetectMisdirectedRequests *bool `json:"detectMisdirectedRequests,omitempty"`
+
 	// Session defines settings related to TLS session management.
 	// +optional
 	Session *Session `json:"session,omitempty"`

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml

@@ -1816,6 +1816,15 @@ spec:
                         VerifyIfGiven or RequireAndVerify
                       rule: '!has(self.allowExpiredCertificate) || !self.allowExpiredCertificate
                         || !has(self.mode) || self.mode in [''VerifyIfGiven'', ''RequireAndVerify'']'
+                  detectMisdirectedRequests:
+                    description: |-
+                      DetectMisdirectedRequests enables 421 responses for HTTP/2 requests
+                      coalesced onto a TLS connection selected by a different SNI, as described in
+                      [GEP-3567](https://gateway-api.sigs.k8s.io/geps/gep-3567/).
+                      When disabled, overlapping TLS listeners keep the default ALPN downgrade to
+                      HTTP/1.1 unless ClientTrafficPolicy configures ALPN.
+                      Default: false
+                    type: boolean
                   ecdhCurves:
                     description: |-
                       ECDHCurves specifies the set of supported ECDH curves.

charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml

@@ -1815,6 +1815,15 @@ spec:
                         VerifyIfGiven or RequireAndVerify
                       rule: '!has(self.allowExpiredCertificate) || !self.allowExpiredCertificate
                         || !has(self.mode) || self.mode in [''VerifyIfGiven'', ''RequireAndVerify'']'
+                  detectMisdirectedRequests:
+                    description: |-
+                      DetectMisdirectedRequests enables 421 responses for HTTP/2 requests
+                      coalesced onto a TLS connection selected by a different SNI, as described in
+                      [GEP-3567](https://gateway-api.sigs.k8s.io/geps/gep-3567/).
+                      When disabled, overlapping TLS listeners keep the default ALPN downgrade to
+                      HTTP/1.1 unless ClientTrafficPolicy configures ALPN.
+                      Default: false
+                    type: boolean
                   ecdhCurves:
                     description: |-
                       ECDHCurves specifies the set of supported ECDH curves.

release-notes/current/new_features/9675-envoyproxy-detect-misdirected-requests.md

@@ -0,0 +1 @@
+Added the `spec.features.detectMisdirectedRequests` EnvoyProxy API field for future HTTP/2 misdirected request detection support. The field is disabled by default and currently does not change runtime behavior.

site/content/en/latest/api/extension_types.md

@@ -965,6 +965,7 @@ _Appears in:_
 | `signatureAlgorithms` | _string array_ |  false  |  | SignatureAlgorithms specifies which signature algorithms the listener should<br />support. |
 | `alpnProtocols` | _[ALPNProtocol](#alpnprotocol) array_ |  false  |  | ALPNProtocols supplies the list of ALPN protocols that should be<br />exposed by the listener or used by the proxy to connect to the backend.<br />Defaults:<br />1. HTTPS Routes: h2 and http/1.1 are enabled in listener context.<br />2. Other Routes: ALPN is disabled.<br />3. Backends: proxy uses the appropriate ALPN options for the backend protocol.<br />When an empty list is provided, the ALPN TLS extension is disabled.<br />Defaults to [h2, http/1.1] if not specified.<br />Typical Supported values are:<br />- http/1.0<br />- http/1.1<br />- h2 |
 | `fingerprints` | _[TLSFingerprintType](#tlsfingerprinttype) array_ |  false  |  | Fingerprints specifies TLS client fingerprinting.<br />When specified, a JAX fingerprint derived from the client’s TLS handshake<br />is generated. The fingerprint can be logged in access logs or<br />forwarded to upstream services using request headers.<br />Fingerprinting is disabled if not specified.<br />Supported values are:<br />- JA3<br />- JA4 |
+| `detectMisdirectedRequests` | _boolean_ |  false  |  | DetectMisdirectedRequests enables 421 responses for HTTP/2 requests<br />coalesced onto a TLS connection selected by a different SNI, as described in<br />[GEP-3567](https://gateway-api.sigs.k8s.io/geps/gep-3567/).<br />When disabled, overlapping TLS listeners keep the default ALPN downgrade to<br />HTTP/1.1 unless ClientTrafficPolicy configures ALPN.<br />Default: false |
 | `session` | _[Session](#session)_ |  false  |  | Session defines settings related to TLS session management. |
 
 

test/helm/gateway-addons-helm/default.out.yaml

@@ -32,10 +32,10 @@ metadata:
   name: loki
   namespace: monitoring
   labels:
-    helm.sh/chart: loki-7.3.0
+    helm.sh/chart: loki-7.0.0
     app.kubernetes.io/name: loki
     app.kubernetes.io/instance: gateway-addons-helm
-    app.kubernetes.io/version: "3.6.11"
+    app.kubernetes.io/version: "3.6.7"
 automountServiceAccountToken: true
 ---
 # Source: gateway-addons-helm/charts/prometheus/templates/serviceaccount.yaml
@@ -197,10 +197,10 @@ metadata:
   name: loki
   namespace: monitoring
   labels:
-    helm.sh/chart: loki-7.3.0
+    helm.sh/chart: loki-7.0.0
     app.kubernetes.io/name: loki
     app.kubernetes.io/instance: gateway-addons-helm
-    app.kubernetes.io/version: "3.6.11"
+    app.kubernetes.io/version: "3.6.7"
 data:
   config.yaml: |
 
@@ -298,10 +298,10 @@ metadata:
   name: loki-runtime
   namespace: monitoring
   labels:
-    helm.sh/chart: loki-7.3.0
+    helm.sh/chart: loki-7.0.0
     app.kubernetes.io/name: loki
     app.kubernetes.io/instance: gateway-addons-helm
-    app.kubernetes.io/version: "3.6.11"
+    app.kubernetes.io/version: "3.6.7"
 data:
   runtime-config.yaml: |
     {}
@@ -10128,10 +10128,10 @@ kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   labels:
-    helm.sh/chart: loki-7.3.0
+    helm.sh/chart: loki-7.0.0
     app.kubernetes.io/name: loki
     app.kubernetes.io/instance: gateway-addons-helm
-    app.kubernetes.io/version: "3.6.11"
+    app.kubernetes.io/version: "3.6.7"
   name: loki-clusterrole
 rules:
 - apiGroups: [""] # "" indicates the core API group
@@ -10232,10 +10232,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: loki-clusterrolebinding
   labels:
-    helm.sh/chart: loki-7.3.0
+    helm.sh/chart: loki-7.0.0
     app.kubernetes.io/name: loki
     app.kubernetes.io/instance: gateway-addons-helm
-    app.kubernetes.io/version: "3.6.11"
+    app.kubernetes.io/version: "3.6.7"
 subjects:
   - kind: ServiceAccount
     name: loki
@@ -10351,10 +10351,10 @@ metadata:
   name: loki-memberlist
   namespace: monitoring
   labels:
-    helm.sh/chart: loki-7.3.0
+    helm.sh/chart: loki-7.0.0
     app.kubernetes.io/name: loki
     app.kubernetes.io/instance: gateway-addons-helm
-    app.kubernetes.io/version: "3.6.11"
+    app.kubernetes.io/version: "3.6.7"
   annotations:
 spec:
   type: ClusterIP
@@ -10376,10 +10376,10 @@ metadata:
   name: loki-headless
   namespace: monitoring
   labels:
-    helm.sh/chart: loki-7.3.0
+    helm.sh/chart: loki-7.0.0
     app.kubernetes.io/name: loki
     app.kubernetes.io/instance: gateway-addons-helm
-    app.kubernetes.io/version: "3.6.11"
+    app.kubernetes.io/version: "3.6.7"
     variant: headless
     prometheus.io/service-monitor: "false"
   annotations:
@@ -10401,10 +10401,10 @@ metadata:
   name: loki
   namespace: monitoring
   labels:
-    helm.sh/chart: loki-7.3.0
+    helm.sh/chart: loki-7.0.0
     app.kubernetes.io/name: loki
     app.kubernetes.io/instance: gateway-addons-helm
-    app.kubernetes.io/version: "3.6.11"
+    app.kubernetes.io/version: "3.6.7"
   annotations:
 spec:
   type: ClusterIP
@@ -10846,10 +10846,10 @@ metadata:
   name: loki
   namespace: monitoring
   labels:
-    helm.sh/chart: loki-7.3.0
+    helm.sh/chart: loki-7.0.0
     app.kubernetes.io/name: loki
     app.kubernetes.io/instance: gateway-addons-helm
-    app.kubernetes.io/version: "3.6.11"
+    app.kubernetes.io/version: "3.6.7"
     app.kubernetes.io/component: single-binary
     app.kubernetes.io/part-of: memberlist
 spec:
@@ -10889,7 +10889,7 @@ spec:
       terminationGracePeriodSeconds: 30
       containers:
         - name: loki
-          image: docker.io/grafana/loki:3.6.11
+          image: docker.io/grafana/loki:3.6.7
           imagePullPolicy: IfNotPresent
           args:
             - -config.file=/etc/loki/config/config.yaml