api: clarify StripPort normalizes the forwarded Host header

Address Copilot review on #9115: Envoy's strip_any_host_port not only
strips the port for route matching but also normalizes the actual
Host/:authority value forwarded upstream. Make the StripPort godoc state
this explicitly (mirroring StripTrailingHostDot's upstream-header note), so
the generated CRD/API docs reflect the real effect. Regenerated CRDs, helm
snapshots and API docs.

Signed-off-by: Salim Boulkour <salim.boulkour@algolia.com>

Author: sboulkour

api/v1alpha1/hostsettings_types.go

@@ -8,9 +8,11 @@ package v1alpha1
 // HostSettings provides settings that manage how the incoming Host/Authority header
 // set by clients is normalized.
 type HostSettings struct {
-	// StripPort determines whether the port is removed from the Host/Authority header
-	// before route matching. It maps to Envoy's strip_any_host_port, which strips the
-	// port unconditionally.
+	// StripPort determines whether the port is removed from the Host/Authority header.
+	// It maps to Envoy's strip_any_host_port, which strips the port unconditionally.
+	// The port is removed before route matching, and this affects the upstream host header
+	// as well: backends and access logs see the normalized Host/:authority value without
+	// the port.
 	// If not set, no port stripping is performed (Envoy default).
 	//
 	// Stripping only the port that matches the listener port (Envoy's

charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml

@@ -491,9 +491,11 @@ spec:
                     properties:
                       stripPort:
                         description: |-
-                          StripPort determines whether the port is removed from the Host/Authority header
-                          before route matching. It maps to Envoy's strip_any_host_port, which strips the
-                          port unconditionally.
+                          StripPort determines whether the port is removed from the Host/Authority header.
+                          It maps to Envoy's strip_any_host_port, which strips the port unconditionally.
+                          The port is removed before route matching, and this affects the upstream host header
+                          as well: backends and access logs see the normalized Host/:authority value without
+                          the port.
                           If not set, no port stripping is performed (Envoy default).
 
                           Stripping only the port that matches the listener port (Envoy's

charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_clienttrafficpolicies.yaml

@@ -490,9 +490,11 @@ spec:
                     properties:
                       stripPort:
                         description: |-
-                          StripPort determines whether the port is removed from the Host/Authority header
-                          before route matching. It maps to Envoy's strip_any_host_port, which strips the
-                          port unconditionally.
+                          StripPort determines whether the port is removed from the Host/Authority header.
+                          It maps to Envoy's strip_any_host_port, which strips the port unconditionally.
+                          The port is removed before route matching, and this affects the upstream host header
+                          as well: backends and access logs see the normalized Host/:authority value without
+                          the port.
                           If not set, no port stripping is performed (Envoy default).
 
                           Stripping only the port that matches the listener port (Envoy's

site/content/en/latest/api/extension_types.md

@@ -3377,7 +3377,7 @@ _Appears in:_
 
 | Field | Type | Required | Default | Description |
 | ---   | ---  | ---      | ---     | ---         |
-| `stripPort` | _boolean_ |  false  |  | StripPort determines whether the port is removed from the Host/Authority header<br />before route matching. It maps to Envoy's strip_any_host_port, which strips the<br />port unconditionally.<br />If not set, no port stripping is performed (Envoy default).<br />Stripping only the port that matches the listener port (Envoy's<br />strip_matching_host_port) is intentionally not offered: Envoy compares against the<br />Envoy listener port, which differs from the user-facing Gateway listener port (for<br />example, a Gateway listener on port 80 is translated to an Envoy listener on port<br />10080). Matching-port stripping would therefore be silently ineffective for the<br />port clients actually use, so only unconditional stripping is exposed. |
+| `stripPort` | _boolean_ |  false  |  | StripPort determines whether the port is removed from the Host/Authority header.<br />It maps to Envoy's strip_any_host_port, which strips the port unconditionally.<br />The port is removed before route matching, and this affects the upstream host header<br />as well: backends and access logs see the normalized Host/:authority value without<br />the port.<br />If not set, no port stripping is performed (Envoy default).<br />Stripping only the port that matches the listener port (Envoy's<br />strip_matching_host_port) is intentionally not offered: Envoy compares against the<br />Envoy listener port, which differs from the user-facing Gateway listener port (for<br />example, a Gateway listener on port 80 is translated to an Envoy listener on port<br />10080). Matching-port stripping would therefore be silently ineffective for the<br />port clients actually use, so only unconditional stripping is exposed. |
 | `stripTrailingHostDot` | _boolean_ |  false  |  | StripTrailingHostDot determines if the trailing dot of the host should be removed<br />from the Host/Authority header before any processing of the request.<br />This affects the upstream host header as well. Without this option, incoming requests<br />with host "example.com." will not match routes with domains set to "example.com".<br />When the host includes a port (for example "example.com.:443"), only the trailing dot<br />from the host section is stripped, leaving the port as-is ("example.com:443").<br />Defaults to false. |
 
 

test/helm/gateway-crds-helm/all.out.yaml

@@ -26773,9 +26773,11 @@ spec:
                     properties:
                       stripPort:
                         description: |-
-                          StripPort determines whether the port is removed from the Host/Authority header
-                          before route matching. It maps to Envoy's strip_any_host_port, which strips the
-                          port unconditionally.
+                          StripPort determines whether the port is removed from the Host/Authority header.
+                          It maps to Envoy's strip_any_host_port, which strips the port unconditionally.
+                          The port is removed before route matching, and this affects the upstream host header
+                          as well: backends and access logs see the normalized Host/:authority value without
+                          the port.
                           If not set, no port stripping is performed (Envoy default).
 
                           Stripping only the port that matches the listener port (Envoy's

test/helm/gateway-crds-helm/e2e.out.yaml

@@ -4746,9 +4746,11 @@ spec:
                     properties:
                       stripPort:
                         description: |-
-                          StripPort determines whether the port is removed from the Host/Authority header
-                          before route matching. It maps to Envoy's strip_any_host_port, which strips the
-                          port unconditionally.
+                          StripPort determines whether the port is removed from the Host/Authority header.
+                          It maps to Envoy's strip_any_host_port, which strips the port unconditionally.
+                          The port is removed before route matching, and this affects the upstream host header
+                          as well: backends and access logs see the normalized Host/:authority value without
+                          the port.
                           If not set, no port stripping is performed (Envoy default).
 
                           Stripping only the port that matches the listener port (Envoy's

test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml

@@ -4746,9 +4746,11 @@ spec:
                     properties:
                       stripPort:
                         description: |-
-                          StripPort determines whether the port is removed from the Host/Authority header
-                          before route matching. It maps to Envoy's strip_any_host_port, which strips the
-                          port unconditionally.
+                          StripPort determines whether the port is removed from the Host/Authority header.
+                          It maps to Envoy's strip_any_host_port, which strips the port unconditionally.
+                          The port is removed before route matching, and this affects the upstream host header
+                          as well: backends and access logs see the normalized Host/:authority value without
+                          the port.
                           If not set, no port stripping is performed (Envoy default).
 
                           Stripping only the port that matches the listener port (Envoy's