Skip to content

fix: map proxy errors to correct HTTP status codes) #765

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix: map proxy errors to correct HTTP status codes) #765

wants to merge 1 commit into from
+76 −12

Conversation

ipochi
Copy link
Contributor

@ipochi ipochi commented Aug 9, 2025 •
edited
Loading

Previously, the apiserver-network-proxy returned a blanket 503 (Service Unavailable) status for all backend connection failures, which was incorrect for a proxy server. Additionally, HTTP CONNECT mode would send 200 OK immediately after hijacking, preventing proper error reporting but also violating HTTP CONNECT protocol

This PR:

  • Adds mapDialErrorToHTTPStatus() to map TCP/network errors to appropriate HTTP status codes:
    • 502 Bad Gateway: connection refused, DNS failures, network unreachable
    • 503 Service Unavailable: resource exhaustion (too many open files)
    • 504 Gateway Timeout: I/O timeouts, deadline exceeded
  • Delays sending "200 Connection Established" until after successful backend connection in HTTP CONNECT mode
  • Ensures proper HTTP/1.1 protocol version in error responses
  • Preserves original error messages in response body for debugging

Fixes: #764

@k8s-ci-robot k8s-ci-robot added do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Aug 9, 2025
@k8s-ci-robot k8s-ci-robot requested a review from elmiko August 9, 2025 02:04
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ipochi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot requested a review from tallclair August 9, 2025 02:04
@k8s-ci-robot k8s-ci-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Aug 9, 2025
@ipochi ipochi force-pushed the imran/fix-error-response-http-connect branch from 619e98f to 939a08c Compare August 9, 2025 02:05
@ipochi
fix: map proxy errors to correct HTTP status codes
4d6bd6b 
Previously, the apiserver-network-proxy returned a blanket 503 (Service
Unavailable) status for all backend connection failures, which was
incorrect for a proxy server. Additionally, HTTP CONNECT mode would send
200 OK immediately after hijacking, preventing proper error reporting
but also violating HTTP CONNECT protocol

This commit:
- Adds mapDialErrorToHTTPStatus() to map TCP/network errors to appropriate
  HTTP status codes:
  * 502 Bad Gateway: connection refused, DNS failures, network unreachable
  * 503 Service Unavailable: resource exhaustion (too many open files)
  * 504 Gateway Timeout: I/O timeouts, deadline exceeded
- Delays sending "200 Connection Established" until after successful
  backend connection in HTTP CONNECT mode
- Ensures proper HTTP/1.1 protocol version in error responses
- Preserves original error messages in response body for debugging

Signed-off-by: Imran Pochi <[email protected]>
@ipochi ipochi force-pushed the imran/fix-error-response-http-connect branch from 939a08c to 4d6bd6b Compare August 9, 2025 02:06
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Aug 9, 2025
@k8s-ci-robot
Copy link
Contributor

@ipochi: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-apiserver-network-proxy-test-master 4d6bd6b link true /test pull-apiserver-network-proxy-test-master

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@elmiko elmiko Awaiting requested review from elmiko

@tallclair tallclair Awaiting requested review from tallclair

Assignees
No one assigned
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

http-connect: incorrect behaviour when the outbound connection not established
2 participants
@ipochi @k8s-ci-robot