Invalid 404 response when handling multi level subdomain routes

[tekulvw]

Description:

Mixing requests to multi level subdomain routes result in 404 unless requesting a full refresh (shift + refresh in firefox) from browser.

Repro steps:

1. Route foo.example.com to one service.
2. Route bar.foo.example.com to another service.
3. Browse to foo.example.com (page should load)
4. Browse to bar.foo.example.com (EG returns 404 with mixed log payload)
5. Force full refresh (shift + refresh) and bar.foo.example.com loads.

Example log payload from step 4:

{"start_time":"2025-02-06T04:57:43.295Z","method":"GET","x-envoy-origin-path":"/favicon.ico","protocol":"HTTP/2","response_code":"404","response_flags":"NR","response_code_details":"route_not_found","connection_termination_details":"-","upstream_transport_failure_reason":"-","bytes_received":"0","bytes_sent":"0","duration":"0","x-envoy-upstream-service-time":"-","x-forwarded-for":"redacted","user-agent":"Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0","x-request-id":"1f2c78b3-7dd4-43a7-b744-e15daa2e2c6c",":authority":"foo.example.com","upstream_host":"-","upstream_cluster":"-","upstream_local_address":"-","downstream_local_address":"redacted","downstream_remote_address":"redacted","requested_server_name":"bar.foo.example.com","route_name":"-"}

Environment:
EG 1.3.0 helm chart

[arkodg]

Are you hitting #2675 ?

[tekulvw]

I believe so, yes. My gateway has two different listeners, one for *.example.com and another for *.foo.example.com. I had to do this to get cert-manager to correctly generate a single certificate valid for both domains.

As I learned, a certificate valid for *.example.com is not valid for bar.foo.example.com.

I don't think the workaround from #2675 works in my case. Do I need to have unique gateways to get around this?

[arkodg]

Apart from specifying the hostname on the listeners are you also specifying the hostname on the xRoutes ?

[tekulvw]

The two routes specify foo.example.com and bar.foo.example.com respectively.

[arkodg]

hey @tekulvw I'm going to close this issue, lets discuss workarounds in #2675