RabbitMQ Management issue with redirection on backend calls

[iagosrodrigues]

Hello, I'm trying to make a RabbitMQ accessible using the Envoy gateway. However, for some API calls (backend), the Envoy redirects instead of just passing to the service, so the application breaks when, for example, I try to see details about a queue.

For example, when using just port forward:

curl 'http://localhost:53487/api/queues/%2F/my_queue?lengths_age=60&lengths_incr=5&msg_rates_age=60&msg_rates_incr=5&data_rates_age=60&data_rates_incr=5' ... -v

The response be like this:

> GET /api/queues/%2F/my_queue?lengths_age=60&lengths_incr=5&msg_rates_age=60&msg_rates_incr=5&data_rates_age=60&data_rates_incr=5 HTTP/1.1
> Host: localhost:53487
> Accept: */*
> Accept-Language: en-US,en;q=0.9
> Connection: keep-alive
> Cookie: ###
> DNT: 1
> Referer: http://localhost:53487/
> Sec-Fetch-Dest: empty
> Sec-Fetch-Mode: cors
> Sec-Fetch-Site: same-origin
> User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
> authorization: Basic Token
> sec-ch-ua: "Not-A.Brand";v="99", "Chromium";v="124"
> sec-ch-ua-mobile: ?0
> sec-ch-ua-platform: "macOS"
> x-vhost:
>
< HTTP/1.1 200 OK
< cache-control: no-cache
< content-length: 19872
< content-security-policy: script-src 'self' 'unsafe-eval' 'unsafe-inline'; object-src 'self'
< content-type: application/json
< date: Thu, 18 Apr 2024 18:25:50 GMT
< server: Cowboy
< vary: accept, accept-encoding, origin

But when I use the HTTPRoute the response is something like:

> GET /api/queues/%2F/my_queue?lengths_age=60&lengths_incr=5&msg_rates_age=60&msg_rates_incr=5&data_rates_age=60&data_rates_incr=5 HTTP/1.1
> Host: 10.206.10.99:15672
> Accept: */*
> Accept-Language: en-US,en;q=0.9
> Connection: keep-alive
> Cookie: m=59b9:true
> DNT: 1
> Referer: http://10.206.10.99:15672/
> User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
> authorization: Basic Token
> x-vhost: /
>
< HTTP/1.1 307 Temporary Redirect
< location: /api/queues/my_queue?lengths_age=60&lengths_incr=5&msg_rates_age=60&msg_rates_incr=5&data_rates_age=60&data_rates_incr=5
< date: Thu, 18 Apr 2024 18:22:40 GMT
< content-length: 0

I noticed that the Gateway redirects and uses another cookie from the Envoy itself and changes the x-vhost.

The GatewayClass and Gateway is the basic, only changing the EnvoyProxy to make a load balancer with internal IP.

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: internal-load-balancer
  namespace: envoy-gateway-system
spec:
  logging:
    level:
      default: warn
  provider:
    kubernetes:
      envoyService:
        annotations:
          service.beta.kubernetes.io/oci-load-balancer-internal: "true"
        externalTrafficPolicy: Local
        type: LoadBalancer
    type: Kubernetes

And the HTTPRoute is:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: rabbitmq-ui
spec:
  parentRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: rabbitmq
  rules:
  - backendRefs:
    - group: ""
      kind: Service
      name: rabbitmq
      port: 15672
      weight: 1
    matches:
    - path:
        type: PathPrefix
        value: /

The problem is:

Envoy is removing this %2F that rabbitmq expects to exist because the vhost is equal to "/."

Someone can give me some hints to fix this?

[liorokman]

Can you see if adding a ClientTrafficPolicy with the path.escapedSlashesAction attribute set to KeepUnchanged fixes the problem?

https://gateway.envoyproxy.io/latest/api/extension_types/#pathescapedslashaction

[iagosrodrigues]

Thank you, @liorokman; I created this ClientTrafficPolicy, which is now working as expected.

I appreciate it.