WebSockets over TLSRoute

[eadwu]

I saw that it is supported for HTTPRoute by default now #836 and I didn't have any problems using it, but now I wish to perform SSL passthrough so I converted it to a TLSRoute and the SSL and webpage are successfully loaded, although WebSockets fail to be connected.

It doesn't look like wss urls work over TLSRoute and I do see a RFC (https://gateway-api.sigs.k8s.io/geps/gep-1911/?h=) although it doesn't look like it has made it into implementation.

Is it possible to WebSockets working over TLSRoute?

[arkodg]

probably worth digging into why its not working in EG
do you have access logs handy ?
envoy examples says it supports it https://www.envoyproxy.io/docs/envoy/latest/start/sandboxes/websocket#step-6-test-proxying-wss-passthrough

[eadwu]

I think Step 5 is more like what I am doing, although I am not terminated the TLS here. I don't use any TCPProxy or TCPRoute.

If I compare the YAML files, I don't see

      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_wss_to_wss
          upgrade_configs:
          - upgrade_type: websocket

which I think is required based of the step 5 description.

[arkodg]

Step 5 does TLS termination, TLSRoute performs TLS Passthrough which uses tcp_proxy under the hood
https://github.com/envoyproxy/gateway/blob/main/internal/xds/translator/testdata/out/xds-ir/tls-route-passthrough.listeners.yaml

[eadwu]

I'm looking through the logs still, can't really find anything descriptive. The request reaches the service behind Envoy but fails handshake so far.

"response-code":403,"response-code-details":"websocket_handshake_unsuccessful"

Specific high level network setup is the following:

• Tailscale (exposed by service annotation pointing towards Envoy Gateway service)
• Envoy Gateway (routes to Pomerium Proxy explicitly)
  • SSL passthrough
• Pomerium Proxy (routes to Code Server via hostname and proxy is configured via Ingress)
  • SSL Certificates by Let's Encrypt (pomerium.example.org and code.example.org)
• Code Server

[eadwu]

Problem on Pomerium Proxy side I think, I tried layering 2 Envoy Gateways and it worked.