api: drop StripPort from ClientTrafficPolicy host normalization

Scope the first iteration of host normalization down to trailing-dot removal only, removing the StripPort field (Envoy's strip_any_host_port) per maintainer feedback.

Signed-off-by: Salim Boulkour <salim.boulkour@algolia.com>

Author: sboulkour

api/v1alpha1/hostsettings_types.go

@@ -8,22 +8,6 @@ package v1alpha1
 // HostSettings provides settings that manage how the incoming Host/Authority header
 // set by clients is normalized.
 type HostSettings struct {
-	// StripPort determines whether the port is removed from the Host/Authority header.
-	// It maps to Envoy's strip_any_host_port, which strips the port unconditionally.
-	// The port is removed before route matching, and this affects the upstream host header
-	// as well: backends and access logs see the normalized Host/:authority value without
-	// the port.
-	// If not set, no port stripping is performed (Envoy default).
-	//
-	// Stripping only the port that matches the listener port (Envoy's
-	// strip_matching_host_port) is intentionally not offered: Envoy compares against the
-	// Envoy listener port, which differs from the user-facing Gateway listener port (for
-	// example, a Gateway listener on port 80 is translated to an Envoy listener on port
-	// 10080). Matching-port stripping would therefore be silently ineffective for the
-	// port clients actually use, so only unconditional stripping is exposed.
-	//
-	// +optional
-	StripPort *bool `json:"stripPort,omitempty"`
 	// StripTrailingHostDot determines if the trailing dot of the host should be removed
 	// from the Host/Authority header before any processing of the request.
 	// This affects the upstream host header as well. Without this option, incoming requests

api/v1alpha1/zz_generated.deepcopy.go

@@ -489,22 +489,6 @@ spec:
                     description: Host enables managing how the Host/Authority header
                       set by clients can be normalized.
                     properties:
-                      stripPort:
-                        description: |-
-                          StripPort determines whether the port is removed from the Host/Authority header.
-                          It maps to Envoy's strip_any_host_port, which strips the port unconditionally.
-                          The port is removed before route matching, and this affects the upstream host header
-                          as well: backends and access logs see the normalized Host/:authority value without
-                          the port.
-                          If not set, no port stripping is performed (Envoy default).
-
-                          Stripping only the port that matches the listener port (Envoy's
-                          strip_matching_host_port) is intentionally not offered: Envoy compares against the
-                          Envoy listener port, which differs from the user-facing Gateway listener port (for
-                          example, a Gateway listener on port 80 is translated to an Envoy listener on port
-                          10080). Matching-port stripping would therefore be silently ineffective for the
-                          port clients actually use, so only unconditional stripping is exposed.
-                        type: boolean
                       stripTrailingHostDot:
                         description: |-
                           StripTrailingHostDot determines if the trailing dot of the host should be removed

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml

@@ -488,22 +488,6 @@ spec:
                     description: Host enables managing how the Host/Authority header
                       set by clients can be normalized.
                     properties:
-                      stripPort:
-                        description: |-
-                          StripPort determines whether the port is removed from the Host/Authority header.
-                          It maps to Envoy's strip_any_host_port, which strips the port unconditionally.
-                          The port is removed before route matching, and this affects the upstream host header
-                          as well: backends and access logs see the normalized Host/:authority value without
-                          the port.
-                          If not set, no port stripping is performed (Envoy default).
-
-                          Stripping only the port that matches the listener port (Envoy's
-                          strip_matching_host_port) is intentionally not offered: Envoy compares against the
-                          Envoy listener port, which differs from the user-facing Gateway listener port (for
-                          example, a Gateway listener on port 80 is translated to an Envoy listener on port
-                          10080). Matching-port stripping would therefore be silently ineffective for the
-                          port clients actually use, so only unconditional stripping is exposed.
-                        type: boolean
                       stripTrailingHostDot:
                         description: |-
                           StripTrailingHostDot determines if the trailing dot of the host should be removed

charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml

@@ -848,11 +848,10 @@ func translateHostSettings(hostSettings *egv1a1.HostSettings, httpIR *ir.HTTPLis
 	if hostSettings == nil {
 		return
 	}
-	if hostSettings.StripPort == nil && hostSettings.StripTrailingHostDot == nil {
+	if hostSettings.StripTrailingHostDot == nil {
 		return
 	}
 	httpIR.Host = &ir.HostSettings{
-		StripPort:            ptr.Deref(hostSettings.StripPort, false),
 		StripTrailingHostDot: ptr.Deref(hostSettings.StripTrailingHostDot, false),
 	}
 }

internal/gatewayapi/clienttrafficpolicy.go

@@ -594,9 +594,6 @@ type PathSettings struct {
 // HostSettings holds configuration for Host/Authority header normalization
 // +k8s:deepcopy-gen=true
 type HostSettings struct {
-	// StripPort strips the port from the Host/Authority header unconditionally
-	// (Envoy's strip_any_host_port). A false value means no port stripping is performed.
-	StripPort bool `json:"stripPort,omitempty" yaml:"stripPort,omitempty"`
 	// StripTrailingHostDot strips the trailing dot from the Host/Authority header before processing.
 	StripTrailingHostDot bool `json:"stripTrailingHostDot,omitempty" yaml:"stripTrailingHostDot,omitempty"`
 }

internal/gatewayapi/testdata/clienttrafficpolicy-host-strip-port.in.yaml

@@ -402,12 +402,7 @@ func (t *Translator) addHCMToXDSListener(
 	}
 
 	// Normalize the Host/Authority header if configured.
-	// StripAnyHostPort uses the strip_port_mode oneof, so it must be assigned outside the
-	// struct literal to avoid a typed-nil that silently breaks xDS translation.
 	if irListener.Host != nil {
-		if irListener.Host.StripPort {
-			mgr.StripPortMode = &hcmv3.HttpConnectionManager_StripAnyHostPort{StripAnyHostPort: true}
-		}
 		mgr.StripTrailingHostDot = irListener.Host.StripTrailingHostDot
 	}
 

internal/gatewayapi/testdata/clienttrafficpolicy-host-strip-port.out.yaml

@@ -15,7 +15,6 @@ http:
                   port: 8081
               name: "first-route-dest/backend/0"
     host:
-      stripPort: true
       stripTrailingHostDot: true
   - name: "second-listener"
     address: "::"
@@ -32,8 +31,6 @@ http:
                 - host: "2.2.2.2"
                   port: 8082
               name: "second-route-dest/backend/0"
-    host:
-      stripPort: true
   - name: "third-listener"
     address: "::"
     port: 8083