Fix(gatewayapi): allow mixed IP and UDS endpoints in backend route references by stekole · Pull Request #8530 · envoyproxy/gateway

stekole · 2026-03-16T03:32:02Z

What type of PR is this?
/kind bug

What this PR does / why we need it:
Backend resources with mixed IP and Unix Domain Socket (UDS) endpoints were incorrectly rejected as unsupported mixed address types. Additionally, UDS endpoints were blocked entirely in route backend references.

Classifies IP + UDS combinations as IP (static) instead of MIXED
Allows UDS endpoints in route Backend references
Only rejects MIXED when FQDN is involved with IP or UDS

Which issue(s) this PR fixes:
Fixes #8229

Release Notes: Yes

netlify · 2026-03-16T03:32:17Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`90cc4f1`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/69c1fa50c4cfa800085f131b
😎 Deploy Preview	https://deploy-preview-8530--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

codecov · 2026-03-16T03:51:38Z

Codecov Report

❌ Patch coverage is 85.71429% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 74.37%. Comparing base (a049df2) to head (90cc4f1).

Files with missing lines	Patch %	Lines
internal/gatewayapi/listener.go	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8530      +/-   ##
==========================================
+ Coverage   74.35%   74.37%   +0.01%     
==========================================
  Files         242      242              
  Lines       37811    37808       -3     
==========================================
+ Hits        28113    28118       +5     
+ Misses       7748     7743       -5     
+ Partials     1950     1947       -3

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

zirain · 2026-03-17T10:40:23Z

internal/gatewayapi/validate.go

 		}
 	case egv1a1.KindBackend:
-		if err := t.validateBackendRefBackend(backendRef.BackendObjectReference, resources, backendNamespace, false); err != nil {
+		if err := t.validateBackendRefBackend(backendRef.BackendObjectReference, resources, backendNamespace, true); err != nil {


IIRC, we're find to remove the last one parameter from function validateBackendRefBackend.

Makes sense - Thanks - Addressed.

zirain · 2026-03-19T02:53:12Z

is it possible to add an e2e test to ensure that a mixed backend worked as expected?

stekole · 2026-03-19T03:25:42Z

Yes - I can write something to validate the route is accepted (not rejected as "MIXED") and traffic flows through. If we want a full HTTP on UDS and serve traffic that may require additional containers and complexity.

I think ensuring the route is created is a good first step. Let me know if you'd like to see something else. We can discuss further or happy to address it in a follow-up.

Fixes envoyproxy#8229 Signed-off-by: stekole <stefan@sandnetworks.com>

zirain · 2026-03-22T05:12:38Z

/retest

Signed-off-by: stekole <30674956+stekole@users.noreply.github.com>

arkodg · 2026-03-23T06:17:49Z

site/content/en/contributions/design/backend.md

-* For security reasons, Envoy Gateway MUST reject references to a `Backend` in xRoute resources. For example, UDS and
-  localhost references will not be supported for xRoutes.
+* For security reasons, Envoy Gateway MUST reject localhost references to a `Backend` in xRoute resources.
+  Unix domain socket references are supported in xRoutes, but admins must ensure proper access controls.


how would admins ensure proper access control if app developers can route back into the proxy ?

Good question. I may not have all the answers but I will references a few things I know.

rbac on Backend resources - the docs already reference restricting who can create Backend CRs, consistent with guidance on CVE-2021-25740. An app developer without RBAC to create Backend resources can't reference UDS: https://github.com/envoyproxy/gateway/blob/main/site/content/en/latest/tasks/traffic/backend.md#L14-L21

UDS also requires a mounted socket in the proxy pod - UDS path in a Backend spec is a no-op unless the socketfile is actually present in the proxy pods filesystem. Mounting it requires an envoyproxy infrastructure patch, which is an admin resource that app developers shouldnt control.
ref: https://github.com/envoyproxy/gateway/blob/main/site/content/en/contributions/design/backend.md#L129-L131
Task doc: https://github.com/envoyproxy/gateway/blob/main/site/content/en/latest/tasks/traffic/backend.md#L37

loopback routing also looks to be disabled - https://github.com/envoyproxy/gateway/blob/main/internal/gatewayapi/backend.go#L198

Signed-off-by: stekole <30674956+stekole@users.noreply.github.com>

stekole requested a review from a team as a code owner March 16, 2026 03:32

stekole mentioned this pull request Mar 16, 2026

Mixed IP and UDS endpoints rejected #8229

Open

stekole force-pushed the fix/mixed-ip-uds-endpoints branch from 66020cd to e279442 Compare March 16, 2026 03:41

stekole force-pushed the fix/mixed-ip-uds-endpoints branch 2 times, most recently from 5d23c9f to 32d38cb Compare March 17, 2026 10:33

zirain reviewed Mar 17, 2026

View reviewed changes

stekole force-pushed the fix/mixed-ip-uds-endpoints branch 2 times, most recently from 6f00c6d to 9d4545d Compare March 18, 2026 03:53

stekole requested a review from zirain March 19, 2026 02:51

zirain previously approved these changes Mar 19, 2026

View reviewed changes

stekole dismissed zirain’s stale review via bf926fd March 19, 2026 03:58

stekole requested a review from zirain March 19, 2026 04:06

stekole added 2 commits March 21, 2026 22:37

fix: allow mixed IP and UDS endpoints in Backend route references

f3bb40c

Fixes envoyproxy#8229 Signed-off-by: stekole <stefan@sandnetworks.com>

fix: allow mixed IP and UDS endpoints in Backend route references

d648970

Fixes envoyproxy#8229 Signed-off-by: stekole <stefan@sandnetworks.com>

stekole force-pushed the fix/mixed-ip-uds-endpoints branch from b76668c to d648970 Compare March 22, 2026 02:37

stekole and others added 2 commits March 22, 2026 21:53

Merge branch 'main' into fix/mixed-ip-uds-endpoints

bec8511

Signed-off-by: stekole <30674956+stekole@users.noreply.github.com>

Merge branch 'main' into fix/mixed-ip-uds-endpoints

15c612c

arkodg reviewed Mar 23, 2026

View reviewed changes

Merge branch 'main' into fix/mixed-ip-uds-endpoints

90cc4f1

Signed-off-by: stekole <30674956+stekole@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix(gatewayapi): allow mixed IP and UDS endpoints in backend route references#8530

Fix(gatewayapi): allow mixed IP and UDS endpoints in backend route references#8530
stekole wants to merge 5 commits intoenvoyproxy:mainfrom
stekole:fix/mixed-ip-uds-endpoints

stekole commented Mar 16, 2026

Uh oh!

netlify bot commented Mar 16, 2026 •

edited

Loading

Uh oh!

codecov bot commented Mar 16, 2026 •

edited

Loading

Uh oh!

zirain Mar 17, 2026

Uh oh!

stekole Mar 17, 2026

Uh oh!

zirain commented Mar 19, 2026

Uh oh!

stekole commented Mar 19, 2026 •

edited

Loading

Uh oh!

zirain commented Mar 22, 2026

Uh oh!

arkodg Mar 23, 2026

Uh oh!

arkodg Mar 23, 2026

Uh oh!

stekole Mar 24, 2026 •

edited

Loading

Uh oh!

stekole Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

stekole commented Mar 16, 2026

Uh oh!

netlify bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

codecov bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

zirain Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

stekole Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

zirain commented Mar 19, 2026

Uh oh!

stekole commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zirain commented Mar 22, 2026

Uh oh!

arkodg Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

arkodg Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

stekole Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stekole Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify bot commented Mar 16, 2026 •

edited

Loading

codecov bot commented Mar 16, 2026 •

edited

Loading

stekole commented Mar 19, 2026 •

edited

Loading

stekole Mar 24, 2026 •

edited

Loading