fix: active health check respect endpoint hostname

internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.in.yaml

@@ -166,6 +166,22 @@ httpRoutes:
       backendRefs:
       - name: service-4
         port: 8080
+      - group: gateway.envoyproxy.io
+        kind: Backend
+        name: backend-1
+backends:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: Backend
+  metadata:
+    name: backend-1
+    namespace: default
+  spec:
+    endpoints:
+    - hostname: "example.com"
+      ip:
+        address: 1.1.1.1
+        port: 3001
+      zone: zone1
 backendTrafficPolicies:
 - apiVersion: gateway.envoyproxy.io/v1alpha1
   kind: BackendTrafficPolicy

internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml

@@ -378,6 +378,26 @@ backendTrafficPolicies:
         status: "True"
         type: Overridden
       controllerName: gateway.envoyproxy.io/gatewayclass-controller
+backends:
+- apiVersion: gateway.envoyproxy.io/v1alpha1
+  kind: Backend
+  metadata:
+    name: backend-1
+    namespace: default
+  spec:
+    endpoints:
+    - hostname: example.com
+      ip:
+        address: 1.1.1.1
+        port: 3001
+      zone: zone1
+  status:
+    conditions:
+    - lastTransitionTime: null
+      message: The Backend was accepted
+      reason: Accepted
+      status: "True"
+      type: Accepted
 gateways:
 - apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
@@ -719,6 +739,9 @@ httpRoutes:
     - backendRefs:
       - name: service-4
         port: 8080
+      - group: gateway.envoyproxy.io
+        kind: Backend
+        name: backend-1
       matches:
       - path:
           value: /v5
@@ -1175,6 +1198,19 @@ xdsIR:
             name: httproute/default/httproute-5/rule/0/backend/0
             protocol: HTTP
             weight: 1
+          - addressType: IP
+            endpoints:
+            - host: 1.1.1.1
+              hostname: example.com
+              port: 3001
+              zone: zone1
+            metadata:
+              kind: Backend
+              name: backend-1
+              namespace: default
+            name: httproute/default/httproute-5/rule/0/backend/1
+            protocol: HTTP
+            weight: 1
         hostname: gateway.envoyproxy.io
         isHTTP2: false
         metadata:

internal/xds/translator/cluster.go

@@ -817,7 +817,7 @@ func buildZonalLocalities(metadata *corev3.Metadata, ds *ir.DestinationSetting,
 				Endpoint: &endpointv3.Endpoint{
 					Hostname:          ptr.Deref(irEp.Hostname, ""),
 					Address:           buildAddress(irEp),
-					HealthCheckConfig: buildHealthCheckConfig(hc),
+					HealthCheckConfig: buildHealthCheckConfig(hc, irEp),
 				},
 			},
 			LoadBalancingWeight: wrapperspb.UInt32(1),
@@ -868,7 +868,7 @@ func buildWeightedZonalLocalities(metadata *corev3.Metadata, ds *ir.DestinationS
 				Endpoint: &endpointv3.Endpoint{
 					Hostname:          ptr.Deref(irEp.Hostname, ""),
 					Address:           buildAddress(irEp),
-					HealthCheckConfig: buildHealthCheckConfig(hc),
+					HealthCheckConfig: buildHealthCheckConfig(hc, irEp),
 				},
 			},
 			LoadBalancingWeight: wrapperspb.UInt32(1),
@@ -919,7 +919,7 @@ func buildWeightedLocalities(metadata *corev3.Metadata, ds *ir.DestinationSettin
 				Endpoint: &endpointv3.Endpoint{
 					Hostname:          ptr.Deref(irEp.Hostname, ""),
 					Address:           buildAddress(irEp),
-					HealthCheckConfig: buildHealthCheckConfig(hc),
+					HealthCheckConfig: buildHealthCheckConfig(hc, irEp),
 				},
 			},
 			HealthStatus: healthStatus,
@@ -949,14 +949,47 @@ func buildWeightedLocalities(metadata *corev3.Metadata, ds *ir.DestinationSettin
 	return locality
 }
 
-func buildHealthCheckConfig(hc *ir.HealthCheck) *endpointv3.Endpoint_HealthCheckConfig {
-	if hc == nil || hc.Active == nil || hc.Active.Overrides == nil {
+func buildHealthCheckConfig(hc *ir.HealthCheck, ep *ir.DestinationEndpoint) *endpointv3.Endpoint_HealthCheckConfig {
+	if hc == nil || hc.Active == nil {
 		return nil
 	}
+	hostname := getHealthCheckOverridesHostname(hc, ep)
+	port := getHealthCheckOverridesPort(hc)
 
-	return &endpointv3.Endpoint_HealthCheckConfig{
-		PortValue: hc.Active.Overrides.Port,
+	if hostname == "" && port == nil {
+		return nil
+	}
+	epHC := &endpointv3.Endpoint_HealthCheckConfig{}
+	if hostname != "" {
+		epHC.Hostname = hostname
+	}
+
+	if port != nil {
+		epHC.PortValue = *port
+	}
+
+	return epHC
+}
+
+func getHealthCheckOverridesPort(hc *ir.HealthCheck) *uint32 {
+	if hc.Active.Overrides == nil {
+		return nil
+	}
+
+	return ptr.To(hc.Active.Overrides.Port)
+}
+
+func getHealthCheckOverridesHostname(hc *ir.HealthCheck, ep *ir.DestinationEndpoint) string {
+	// If Active Health Check has an explicit hostname override, it will be used on Cluster.
+	// Otherwise, if the endpoint has a hostname, set the hostname on the EndpointHealthCheckConfig
+	// so that Envoy can use it for health checking.
+	if hc.Active.HTTP != nil && hc.Active.HTTP.Host != "" {
+		return ""
+	}
+	if ep == nil || ep.Hostname == nil {
+		return ""
 	}
+	return *ep.Hostname
 }
 
 func buildTypedExtensionProtocolOptions(args *xdsClusterArgs, requiresAutoHTTPConfig, requiresHTTP2Options, requiresAutoSNI bool) (map[string]*anypb.Any, []*tlsv3.Secret, error) {

internal/xds/translator/testdata/in/xds-ir/health-check.yaml

@@ -149,6 +149,7 @@ http:
       settings:
       - endpoints:
         - host: "1.2.3.4"
+          hostname: example.com
           port: 50000
         protocol: GRPC
         name: "fifth-route-dest/backend/0"

internal/xds/translator/testdata/out/xds-ir/health-check.endpoints.yaml

@@ -54,6 +54,9 @@
           socketAddress:
             address: 1.2.3.4
             portValue: 50000
+        healthCheckConfig:
+          hostname: example.com
+        hostname: example.com
       loadBalancingWeight: 1
     loadBalancingWeight: 1
     locality:

release-notes/current.yaml

@@ -40,6 +40,7 @@ bug fixes: |
   Fixed xPolicy resources being processed from all namespaces when NamespaceSelector watch mode is configured in the Kubernetes provider.
   Fixed route and policy status aggregation across multiple GatewayClasses managed by the same controller, so resources preserve status from all relevant parents and ancestors instead of being overwritten by the last processed GatewayClass.
   Made ConnectionLimit.Value optional so users can configure MaxConnectionDuration, MaxRequestsPerConnection, or MaxStreamDuration without setting a max connections value.
+  Fixed endpoint hostname is not respected when doing active health check.
 
 # Enhancements that improve performance.
 performance improvements: |