feat/HTTPRouteFilter: host rewrite from path

[zhaohuabing]

Implements #8916

This PR adds support for host rewrite from path using regex, for example:

with this filter:

  apiVersion: gateway.envoyproxy.io/v1alpha1
  kind: HTTPRouteFilter
  metadata:
    name: valid-path-regex
    namespace: default
  spec:
    urlRewrite:
      hostname:
        type: PathRegex
        pathRegex:
          pattern: "^/node/([0-9]+)/api.*"
          substitution: "backend-\\1.service.namespace.svc.cluster.local"

A request to http://foo.bar.com/node/1/api has its upstream Host header rewritten to backend-1.service.namespace.svc.cluster.local.

Dynamic Resolver backends are not supported with this filter for security considerations.

[netlify]

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	021b5c6
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6a62cdca9b08e40008224d22
😎 Deploy Preview	https://deploy-preview-8964--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 057f0036cd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[codecov]

Codecov Report

❌ Patch coverage is 92.59259% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 75.62%. Comparing base (2874485) to head (021b5c6).
⚠️ Report is 17 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/gatewayapi/route.go	90.90%	1 Missing and 1 partial ⚠️
internal/ir/xds.go	33.33%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8964      +/-   ##
==========================================
+ Coverage   75.59%   75.62%   +0.03%     
==========================================
  Files         252      252              
  Lines       41713    41809      +96     
==========================================
+ Hits        31531    31619      +88     
- Misses       8057     8061       +4     
- Partials     2125     2129       +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[zirain]

cc @guydc

[zhaohuabing]

@codex review

[zhaohuabing]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1732af84a1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[zhaohuabing]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8edfd0794e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Adds a new HTTPRouteFilter hostname rewrite mode (type: PathRegex) that derives the upstream Host header from regex captures on the request path, and rejects this mode when used with DynamicResolver backends for SSRF/loopback-protection reasons.

Changes:

• Extends the v1alpha1 API/CRD/doc generation to support urlRewrite.hostname.type: PathRegex with pathRegex.pattern + pathRegex.substitution.
• Implements translation to xDS using Envoy hostRewritePathRegex, plus Gateway API translation-time validation and DynamicResolver rejection behavior.
• Adds coverage via CEL validation tests, xDS translator tests/testdata, and an e2e conformance case.

Reviewed changes

Copilot reviewed 19 out of 24 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml	Updates rendered CRD output to include PathRegex hostname rewrite schema + validations.
test/helm/gateway-crds-helm/e2e.out.yaml	Same CRD output update for e2e chart rendering snapshot.
test/helm/gateway-crds-helm/all.out.yaml	Same CRD output update for “all” chart rendering snapshot.
test/e2e/tests/httproute_rewrite_host.go	Adds e2e test case asserting Host rewrite derived from path regex capture.
test/e2e/testdata/httproute-rewrite-host.yaml	Adds HTTPRouteFilter + route wiring for the new PathRegex Host rewrite e2e case.
test/cel-validation/httproutefilter_test.go	Adds CEL validation coverage for valid/invalid PathRegex hostname rewrite configs.
site/content/en/latest/api/extension_types.md	Documents the new pathRegex field and PathRegex enum value.
release-notes/current.yaml	Adds release note entry for the new PathRegex hostname rewrite feature.
internal/xds/translator/testdata/out/xds-ir/http-route-rewrite-url-host.routes.yaml	Updates expected xDS route output to include hostRewritePathRegex.
internal/xds/translator/testdata/in/xds-ir/http-route-rewrite-url-host.yaml	Adds IR input case for PathRegex host rewrite.
internal/xds/translator/route.go	Implements hostRewritePathRegex emission in xDS RouteAction.
internal/xds/translator/route_test.go	Adds unit test coverage for PathRegex host rewrite translation and XFH behavior.
internal/ir/zz_generated.deepcopy.go	Adds deepcopy support for IR HTTPHostModifier.PathRegex.
internal/ir/xds.go	Extends IR host modifier validation + new error for empty PathRegex settings.
internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter.out.yaml	Updates Gateway API translation golden output to include PathRegex host rewrite scenario.
internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter.in.yaml	Adds Gateway API translation input for valid PathRegex host rewrite filter.
internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter-invalid.out.yaml	Adds golden outputs for invalid PathRegex cases and DynamicResolver rejection behavior.
internal/gatewayapi/testdata/httproute-with-urlrewrite-hostname-filter-invalid.in.yaml	Adds translation inputs for invalid PathRegex combinations and DynamicResolver backend.
internal/gatewayapi/route.go	Rejects PathRegex host rewrite when used with DynamicResolver backends; adds helper detection.
internal/gatewayapi/filters.go	Adds PathRegex host rewrite parsing/validation (non-empty + regex compilation check).
charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_httproutefilters.yaml	Updates generated CRD schema for PathRegex hostname rewrite.
charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_httproutefilters.yaml	Updates templated CRD schema for PathRegex hostname rewrite.
api/v1alpha1/zz_generated.deepcopy.go	Adds deepcopy support for API HTTPHostnameModifier.PathRegex and new struct.
api/v1alpha1/httproutefilter_types.go	Adds PathRegex hostname modifier type and HostnamePathRegexRewrite API type + validations.

Files not reviewed (2)

• api/v1alpha1/zz_generated.deepcopy.go: Language not supported
• internal/ir/zz_generated.deepcopy.go: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 19 out of 24 changed files in this pull request and generated 3 comments.

Files not reviewed (2)

• api/v1alpha1/zz_generated.deepcopy.go: Language not supported
• internal/ir/zz_generated.deepcopy.go: Language not supported

[zhaohuabing]

/retest

[zhaohuabing]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kkk777-7]

This looks good to me. I left one small comment.

[arkodg]

hey codex is flagging a few things, can you ptal

• This guard only covers HTTPRoute. GRPCRoute accepts the same HTTPRouteFilter, but never rejects PathRegex with a DynamicResolver backend
• PathRegex is silently ignored when the filter is attached to a BackendRef., should we reject this path or support the filter ?