envoyproxy
diff --git a/‎charts/gateway-helm/templates/envoy-gateway-hpa.yaml‎
Lines changed: 1 addition & 1 deletion b/‎charts/gateway-helm/templates/envoy-gateway-hpa.yaml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎internal/cmd/egctl/status.go‎
Lines changed: 19 additions & 0 deletions b/‎internal/cmd/egctl/status.go‎
Lines changed: 19 additions & 0 deletions
diff --git a/‎internal/crypto/cert_load.go‎
Lines changed: 31 additions & 0 deletions b/‎internal/crypto/cert_load.go‎
Lines changed: 31 additions & 0 deletions
diff --git a/‎internal/crypto/cert_load_test.go‎
Lines changed: 109 additions & 0 deletions b/‎internal/crypto/cert_load_test.go‎
Lines changed: 109 additions & 0 deletions
diff --git a/‎internal/gatewayapi/backendtlspolicy.go‎
Lines changed: 12 additions & 4 deletions b/‎internal/gatewayapi/backendtlspolicy.go‎
Lines changed: 12 additions & 4 deletions
diff --git a/‎internal/gatewayapi/route.go‎
Lines changed: 25 additions & 11 deletions b/‎internal/gatewayapi/route.go‎
Lines changed: 25 additions & 11 deletions
diff --git a/‎internal/gatewayapi/route_test.go‎
Lines changed: 58 additions & 0 deletions b/‎internal/gatewayapi/route_test.go‎
Lines changed: 58 additions & 0 deletions
@@ -12,7 +12,7 @@ spec:
   {{- if .Values.hpa.minReplicas }}
   minReplicas: {{ .Values.hpa.minReplicas }}
   {{- end }}
-  maxReplicas: {{ required ".Values.hps.maxReplicas is required when hpa is enabled" .Values.hpa.maxReplicas }}
+  maxReplicas: {{ required ".Values.hpa.maxReplicas is required when hpa is enabled" .Values.hpa.maxReplicas }}
   {{- if .Values.hpa.behavior }}
   behavior:
 {{ toYaml .Values.hpa.behavior | indent 4 }}
 
@@ -15,6 +15,7 @@ import (
 	"text/tabwriter"
 
 	"github.com/spf13/cobra"
+	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
@@ -93,20 +94,38 @@ func newStatusCommand() *cobra.Command {
 			case "all":
 				for _, rt := range supportedAllTypes {
 					if err = runStatus(ctx, cmd.OutOrStdout(), k8sClient, rt, namespace, quiet, verbose, allNamespaces, true, true); err != nil {
+						if meta.IsNoMatchError(err) {
+							if verbose {
+								fmt.Fprintf(cmd.ErrOrStderr(), "skipping %s: CRD not installed in cluster\n", rt)
+							}
+							continue
+						}
 						return err
 					}
 				}
 				return nil
 			case "xroute":
 				for _, rt := range supportedXRouteTypes {
 					if err = runStatus(ctx, cmd.OutOrStdout(), k8sClient, rt, namespace, quiet, verbose, allNamespaces, true, true); err != nil {
+						if meta.IsNoMatchError(err) {
+							if verbose {
+								fmt.Fprintf(cmd.ErrOrStderr(), "skipping %s: CRD not installed in cluster\n", rt)
+							}
+							continue
+						}
 						return err
 					}
 				}
 				return nil
 			case "xpolicy":
 				for _, rt := range supportedXPolicyTypes {
 					if err = runStatus(ctx, cmd.OutOrStdout(), k8sClient, rt, namespace, quiet, verbose, allNamespaces, true, true); err != nil {
+						if meta.IsNoMatchError(err) {
+							if verbose {
+								fmt.Fprintf(cmd.ErrOrStderr(), "skipping %s: CRD not installed in cluster\n", rt)
+							}
+							continue
+						}
 						return err
 					}
 				}
 
@@ -55,3 +55,34 @@ func LoadTLSConfig(tlsCrt, tlsKey, caCrt string) (*tls.Config, error) {
 		},
 	}, nil
 }
+
+// LoadServerTLSConfig returns a server-only TLSConfig from a certificate. Unlike
+// LoadTLSConfig it does not require client certificate verification, for callers
+// that authenticate peers out-of-band (e.g. JWT).
+func LoadServerTLSConfig(tlsCrt, tlsKey string) (*tls.Config, error) {
+	loadConfig := func() (*tls.Config, error) {
+		cert, err := tls.LoadX509KeyPair(tlsCrt, tlsKey)
+		if err != nil {
+			return nil, err
+		}
+
+		return &tls.Config{
+			Certificates: []tls.Certificate{cert},
+			NextProtos:   []string{"h2"},
+			MinVersion:   tls.VersionTLS13,
+		}, nil
+	}
+
+	// Attempt to load certificate and key to catch configuration errors early.
+	if _, err := loadConfig(); err != nil {
+		return nil, err
+	}
+
+	return &tls.Config{
+		MinVersion: tls.VersionTLS13,
+		Rand:       rand.Reader,
+		GetConfigForClient: func(*tls.ClientHelloInfo) (*tls.Config, error) {
+			return loadConfig()
+		},
+	}, nil
+}
@@ -0,0 +1,109 @@
+// Copyright Envoy Gateway Authors
+// SPDX-License-Identifier: Apache-2.0
+// The full text of the Apache license is available in the LICENSE file at
+// the root of the repo.
+
+package crypto
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"io"
+	"net"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/tsaarni/certyaml"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+)
+
+// TestLoadServerTLSConfig verifies the returned tls.Config re-reads the cert from
+// disk on every handshake and does not request a client certificate.
+func TestLoadServerTLSConfig(t *testing.T) {
+	configDir := t.TempDir()
+	certFile := filepath.Join(configDir, "tls.crt")
+	keyFile := filepath.Join(configDir, "tls.key")
+
+	caCert := certyaml.Certificate{Subject: "cn=test-ca"}
+
+	serverCertBefore := certyaml.Certificate{
+		Subject:         "cn=server-before",
+		SubjectAltNames: []string{"DNS:localhost"},
+		Issuer:          &caCert,
+	}
+	serverCertAfter := certyaml.Certificate{
+		Subject:         "cn=server-after",
+		SubjectAltNames: []string{"DNS:localhost"},
+		Issuer:          &caCert,
+	}
+
+	require.NoError(t, serverCertBefore.WritePEM(certFile, keyFile))
+
+	tlsCfg, err := LoadServerTLSConfig(certFile, keyFile)
+	require.NoError(t, err)
+	require.NotNil(t, tlsCfg)
+
+	require.NotNil(t, tlsCfg.GetConfigForClient)
+	require.Equal(t, uint16(tls.VersionTLS13), tlsCfg.MinVersion)
+	require.Equal(t, tls.NoClientCert, tlsCfg.ClientAuth)
+	require.Empty(t, tlsCfg.Certificates)
+
+	// Stand up a TLS server, dial it, rotate the cert on disk, dial again.
+	caPool := x509.NewCertPool()
+	ca, err := caCert.X509Certificate()
+	require.NoError(t, err)
+	caPool.AddCert(&ca)
+
+	srv := grpc.NewServer(grpc.Creds(credentials.NewTLS(tlsCfg)))
+	defer srv.GracefulStop()
+
+	l, err := net.Listen("tcp", "localhost:0")
+	require.NoError(t, err)
+
+	go func() { _ = srv.Serve(l) }()
+
+	dial := func() *x509.Certificate {
+		t.Helper()
+		conn, err := tls.Dial("tcp", l.Addr().String(), &tls.Config{
+			ServerName: "localhost",
+			MinVersion: tls.VersionTLS13,
+			RootCAs:    caPool,
+			NextProtos: []string{"h2"},
+		})
+		require.NoError(t, err)
+		defer conn.Close()
+		// TLS 1.3 defers server alerts until first read; surface them now.
+		_ = conn.SetReadDeadline(time.Now().Add(100 * time.Millisecond))
+		_, readErr := conn.Read(make([]byte, 1))
+		if readErr != nil && !errors.Is(readErr, io.EOF) {
+			var netErr net.Error
+			require.True(t, errors.As(readErr, &netErr) && netErr.Timeout(),
+				"unexpected read error after handshake: %v", readErr)
+		}
+		require.NotEmpty(t, conn.ConnectionState().PeerCertificates)
+		return conn.ConnectionState().PeerCertificates[0]
+	}
+
+	gotBefore := dial()
+	expectedBefore, err := serverCertBefore.X509Certificate()
+	require.NoError(t, err)
+	assert.Equal(t, expectedBefore.Subject.CommonName, gotBefore.Subject.CommonName)
+
+	require.NoError(t, serverCertAfter.WritePEM(certFile, keyFile))
+
+	gotAfter := dial()
+	expectedAfter, err := serverCertAfter.X509Certificate()
+	require.NoError(t, err)
+	assert.Equal(t, expectedAfter.Subject.CommonName, gotAfter.Subject.CommonName)
+	assert.NotEqual(t, gotBefore.Subject.CommonName, gotAfter.Subject.CommonName)
+}
+
+func TestLoadServerTLSConfig_MissingFiles(t *testing.T) {
+	_, err := LoadServerTLSConfig("/does/not/exist/tls.crt", "/does/not/exist/tls.key")
+	require.Error(t, err)
+}
@@ -403,15 +403,15 @@ func (t *Translator) processClientTLSSettings(
 	return tlsConfig, nil
 }
 
-func backendTLSTargetMatched(policy *gwapiv1.BackendTLSPolicy, target gwapiv1.LocalPolicyTargetReferenceWithSectionName, backendNamespace string) bool {
+func backendTLSTargetMatched(policy *gwapiv1.BackendTLSPolicy, target gwapiv1.LocalPolicyTargetReferenceWithSectionName, backendNamespace string, shouldSectionNameMatch bool) bool {
 	for _, currTarget := range policy.Spec.TargetRefs {
 		if target.Group == currTarget.Group &&
 			target.Kind == currTarget.Kind &&
 			backendNamespace == policy.Namespace &&
 			target.Name == currTarget.Name {
 			// if section name is not set, then it targets the entire backend
-			if currTarget.SectionName == nil {
-				return true
+			if currTarget.SectionName == nil && target.SectionName != nil {
+				return !shouldSectionNameMatch
 			} else if reflect.DeepEqual(currTarget.SectionName, target.SectionName) {
 				return true
 			}
@@ -427,8 +427,16 @@ func (t *Translator) getBackendTLSPolicy(
 ) *gwapiv1.BackendTLSPolicy {
 	// SectionName is port number for EG Backend object
 	target := t.getTargetBackendReference(backendRef, backendNamespace)
+	if target.SectionName != nil {
+		for _, policy := range policies {
+			if backendTLSTargetMatched(policy, target, backendNamespace, true) {
+				// prefer policies that target this specific section over wildcard matches
+				return policy
+			}
+		}
+	}
 	for _, policy := range policies {
-		if backendTLSTargetMatched(policy, target, backendNamespace) {
+		if backendTLSTargetMatched(policy, target, backendNamespace, false) {
 			return policy
 		}
 	}
 
@@ -1996,6 +1996,9 @@ func (t *Translator) processServiceImportDestinationSetting(
 	if servicePort.AppProtocol != nil {
 		protocol = serviceAppProtocolToIRAppProtocol(*servicePort.AppProtocol, protocol, false)
 	}
+	// For WebSocket services, force HTTP/1.1 upstream to ensure Envoy can establish a successful connection,
+	// as WebSocket over HTTP/2 is not widely supported by upstreams and can lead to connection failures.
+	forceHTTP1Upstream := servicePort.AppProtocol != nil && isWebSocketServiceAppProtocol(*servicePort.AppProtocol)
 
 	backendIps := serviceImport.Spec.IPs
 	isHeadless := len(backendIps) == 0
@@ -2020,11 +2023,12 @@ func (t *Translator) processServiceImportDestinationSetting(
 	}
 
 	return &ir.DestinationSetting{
-		Name:        name,
-		Protocol:    protocol,
-		Endpoints:   endpoints,
-		AddressType: addrType,
-		Metadata:    buildResourceMetadata(serviceImport, ptr.To(gwapiv1.SectionName(strconv.Itoa(int(*backendRef.Port))))),
+		Name:               name,
+		Protocol:           protocol,
+		ForceHTTP1Upstream: forceHTTP1Upstream,
+		Endpoints:          endpoints,
+		AddressType:        addrType,
+		Metadata:           buildResourceMetadata(serviceImport, ptr.To(gwapiv1.SectionName(strconv.Itoa(int(*backendRef.Port))))),
 	}, nil
 }
 
@@ -2053,6 +2057,9 @@ func (t *Translator) processServiceDestinationSetting(
 	if servicePort.AppProtocol != nil {
 		protocol = serviceAppProtocolToIRAppProtocol(*servicePort.AppProtocol, protocol, true)
 	}
+	// For WebSocket services, force HTTP/1.1 upstream to ensure Envoy can establish a successful connection,
+	// as WebSocket over HTTP/2 is not widely supported by upstreams and can lead to connection failures.
+	forceHTTP1Upstream := servicePort.AppProtocol != nil && isWebSocketServiceAppProtocol(*servicePort.AppProtocol)
 
 	isHeadless := isServiceHeadless(service)
 
@@ -2074,12 +2081,13 @@ func (t *Translator) processServiceDestinationSetting(
 	}
 
 	return &ir.DestinationSetting{
-		Name:        name,
-		Protocol:    protocol,
-		Endpoints:   endpoints,
-		AddressType: addrType,
-		PreferLocal: processPreferLocalZone(service),
-		Metadata:    buildResourceMetadata(service, ptr.To(gwapiv1.SectionName(strconv.Itoa(int(*backendRef.Port))))),
+		Name:               name,
+		Protocol:           protocol,
+		ForceHTTP1Upstream: forceHTTP1Upstream,
+		Endpoints:          endpoints,
+		AddressType:        addrType,
+		PreferLocal:        processPreferLocalZone(service),
+		Metadata:           buildResourceMetadata(service, ptr.To(gwapiv1.SectionName(strconv.Itoa(int(*backendRef.Port))))),
 	}, nil
 }
 
@@ -2537,13 +2545,19 @@ func serviceAppProtocolToIRAppProtocol(ap string, defaultProtocol ir.AppProtocol
 	switch {
 	case ap == "kubernetes.io/h2c":
 		return ir.HTTP2
+	case ap == "kubernetes.io/ws" || ap == "kubernetes.io/wss":
+		return ir.HTTP
 	case ap == "grpc" && grpcCompatibility:
 		return ir.GRPC
 	default:
 		return defaultProtocol
 	}
 }
 
+func isWebSocketServiceAppProtocol(ap string) bool {
+	return ap == "kubernetes.io/ws" || ap == "kubernetes.io/wss"
+}
+
 func backendAppProtocolToIRAppProtocol(ap egv1a1.AppProtocolType, defaultProtocol ir.AppProtocol) ir.AppProtocol {
 	switch ap {
 	case egv1a1.AppProtocolTypeH2C:
 
@@ -22,6 +22,64 @@ import (
 	"github.com/envoyproxy/gateway/internal/ir"
 )
 
+func TestServiceAppProtocolToIRAppProtocol(t *testing.T) {
+	tests := []struct {
+		name              string
+		appProtocol       string
+		defaultProtocol   ir.AppProtocol
+		grpcCompatibility bool
+		want              ir.AppProtocol
+		wantForceHTTP1    bool
+	}{
+		{
+			name:            "h2c",
+			appProtocol:     "kubernetes.io/h2c",
+			defaultProtocol: ir.HTTP,
+			want:            ir.HTTP2,
+		},
+		{
+			name:            "ws",
+			appProtocol:     "kubernetes.io/ws",
+			defaultProtocol: ir.HTTP2,
+			want:            ir.HTTP,
+			wantForceHTTP1:  true,
+		},
+		{
+			name:            "wss",
+			appProtocol:     "kubernetes.io/wss",
+			defaultProtocol: ir.HTTP2,
+			want:            ir.HTTP,
+			wantForceHTTP1:  true,
+		},
+		{
+			name:              "grpc compatible",
+			appProtocol:       "grpc",
+			defaultProtocol:   ir.HTTP,
+			grpcCompatibility: true,
+			want:              ir.GRPC,
+		},
+		{
+			name:            "grpc not compatible",
+			appProtocol:     "grpc",
+			defaultProtocol: ir.HTTP,
+			want:            ir.HTTP,
+		},
+		{
+			name:            "unknown",
+			appProtocol:     "example.com/custom",
+			defaultProtocol: ir.HTTP,
+			want:            ir.HTTP,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.want, serviceAppProtocolToIRAppProtocol(tt.appProtocol, tt.defaultProtocol, tt.grpcCompatibility))
+			require.Equal(t, tt.wantForceHTTP1, isWebSocketServiceAppProtocol(tt.appProtocol))
+		})
+	}
+}
+
 func TestGetIREndpointsFromEndpointSlices(t *testing.T) {
 	tests := []struct {
 		name              string