Unexpected port number increase in Standalone mode

[dshatokhin]

Description:
I'm trying to run envoy-gateway in standalone mode inside docker container with host network.

I've created Gateway resource with port 80:

spec:
  listeners:
  - name: http-80
    protocol: HTTP
    port: 80

But envoy-gateway logs say it runs envoy with port 10080:

{
  "http":[
    {
      "name":"envoy-gateway-system/compose/http-80",
      "address":"0.0.0.0",
      "port":10080
    }
  ]
}

I found this in internal/gatewayapi/helpers.go:

// If the service port is a privileged port (1-1023)
// add a constant to the value converting it into an ephemeral port.
// This allows the container to bind to the port without needing a
// CAP_NET_BIND_SERVICE capability.
if servicePort < minEphemeralPort {
	return servicePort + wellKnownPortShift
}
return servicePort

Both minEphemeralPort and wellKnownPortShift are const so I can't change this behavior via settings.

The idea to run less privileged container is nice and I see how in kubernetes cluster it will be working as expected in almost all situations but in my case (host network) it means I unable to use envoy-gateway with the ports I need and I was not expecting ports will be changed to something else.

Should it be available as some sort of a setting?

[arkodg]

hey @dshatokhin you need to set useListenerPortAsContainerPort: true https://gateway.envoyproxy.io/docs/api/extension_types/#envoyproxykubernetesprovider in the EnvoyProxy API to solve your use case

[zhaohuabing]

you need to set useListenerPortAsContainerPort: true

Oops, I missed this option ...

[zhaohuabing]

Reopen this - we may want to set this as true by default in the host mode.

[dshatokhin]

It works, thanks for help!

I now think there is a room for improvement in the docs and codebase, because I completely overlooked any settings for Kubernetes provider due to focus on Custom one - I have 2 objects:

• EnvoyGateway object with provider.type: Custom
• EnvoyProxy object with spec.provider.type: Kubernetes

Given the experimental status of standalone mode it's totally understandable ☺️

[arkodg]

thanks for re flagging this @zhaohuabing, my suggestion is a workaround, this should work seamlessly in standalone mode, raised #5027 to address it