question about path match order?

[zirain]

there's an sample httproute as follows:

apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: match-order
spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: eg/kuma/contour # change to different
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: httpbin
          port: 8000
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /api/store
        - path:
            type: RegularExpression
            value: ^/api/[1-9][0-9]*/.*$
    - backendRefs:
        - group: ""
          kind: Service
          name: httpbin
          port: 8000
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /

I test with EnvoyGateway, Contour and Kuma (all of them base on envoy)but got different result:

• Contour

- ignorePortInHostMatching: true
  name: http-80
  requestHeadersToAdd:
  - header:
      key: x-request-start
      value: t=%START_TIME(%s.%3f)%
  virtualHosts:
  - domains:
    - '*'
    name: '*'
    routes:
    - match:
        safeRegex:
          regex: ^^/api/[1-9][0-9]*/.*$
      metadata:
        filterMetadata:
          envoy.access_loggers.file:
            io.projectcontour.kind: HTTPRoute
            io.projectcontour.name: match-order
            io.projectcontour.namespace: default
      route:
        cluster: default/httpbin/8000/da39a3ee5e
    - match:
        pathSeparatedPrefix: /api/store
      metadata:
        filterMetadata:
          envoy.access_loggers.file:
            io.projectcontour.kind: HTTPRoute
            io.projectcontour.name: match-order
            io.projectcontour.namespace: default
      route:
        cluster: default/httpbin/8000/da39a3ee5e
    - match:
        prefix: /
      metadata:
        filterMetadata:
          envoy.access_loggers.file:
            io.projectcontour.kind: HTTPRoute
            io.projectcontour.name: match-order
            io.projectcontour.namespace: default
      route:
        cluster: default/httpbin/8000/da39a3ee5e

• EnvoyGateway

- ignorePortInHostMatching: true
  name: default/eg/http
  virtualHosts:
  - domains:
    - '*'
    name: default/eg/http/*
    routes:
    - match:
        safeRegex:
          regex: ^/api/[1-9][0-9]*/.*$
      name: httproute/default/match-order/rule/0/match/1/*
      route:
        cluster: httproute/default/match-order/rule/0
        upgradeConfigs:
        - upgradeType: websocket
    - match:
        pathSeparatedPrefix: /api/store
      name: httproute/default/match-order/rule/0/match/0/*
      route:
        cluster: httproute/default/match-order/rule/0
        upgradeConfigs:
        - upgradeType: websocket
    - match:
        prefix: /
      name: httproute/default/match-order/rule/1/match/0/*
      route:
        cluster: httproute/default/match-order/rule/1
        upgradeConfigs:
        - upgradeType: websocket

• Kuma

- ignorePortInHostMatching: true
  name: kuma.default:HTTP:8080:*
  requestHeadersToRemove:
  - x-kuma-tags
  validateClusters: false
  virtualHosts:
  - domains:
    - '*'
    name: '*'
    routes:
    - match:
        path: /api/store
      route:
        clusterNotFoundResponseCode: INTERNAL_SERVER_ERROR
        idleTimeout: 5s
        retryPolicy:
          numRetries: 5
          perTryTimeout: 16s
          retryBackOff:
            baseInterval: 0.025s
            maxInterval: 0.250s
          retryOn: gateway-error,connect-failure,refused-stream
        timeout: 15s
        weightedClusters:
          clusters:
          - name: httpbin_default_svc_8000-732a2f143c735941
            requestHeadersToAdd:
            - header:
                key: x-kuma-tags
                value: '&kuma.io/service=kuma_default_gateway&&kuma.io/zone=default&'
            weight: 1
    - match:
        prefix: /api/store/
      route:
        clusterNotFoundResponseCode: INTERNAL_SERVER_ERROR
        idleTimeout: 5s
        retryPolicy:
          numRetries: 5
          perTryTimeout: 16s
          retryBackOff:
            baseInterval: 0.025s
            maxInterval: 0.250s
          retryOn: gateway-error,connect-failure,refused-stream
        timeout: 15s
        weightedClusters:
          clusters:
          - name: httpbin_default_svc_8000-732a2f143c735941
            requestHeadersToAdd:
            - header:
                key: x-kuma-tags
                value: '&kuma.io/service=kuma_default_gateway&&kuma.io/zone=default&'
            weight: 1
    - match:
        prefix: /
      route:
        clusterNotFoundResponseCode: INTERNAL_SERVER_ERROR
        idleTimeout: 5s
        retryPolicy:
          numRetries: 5
          perTryTimeout: 16s
          retryBackOff:
            baseInterval: 0.025s
            maxInterval: 0.250s
          retryOn: gateway-error,connect-failure,refused-stream
        timeout: 15s
        weightedClusters:
          clusters:
          - name: httpbin_default_svc_8000-732a2f143c735941
            requestHeadersToAdd:
            - header:
                key: x-kuma-tags
                value: '&kuma.io/service=kuma_default_gateway&&kuma.io/zone=default&'
            weight: 1
    - match:
        safeRegex:
          regex: ^/api/[1-9][0-9]*/.*$
      route:
        clusterNotFoundResponseCode: INTERNAL_SERVER_ERROR
        idleTimeout: 5s
        retryPolicy:
          numRetries: 5
          perTryTimeout: 16s
          retryBackOff:
            baseInterval: 0.025s
            maxInterval: 0.250s
          retryOn: gateway-error,connect-failure,refused-stream
        timeout: 15s
        weightedClusters:
          clusters:
          - name: httpbin_default_svc_8000-732a2f143c735941
            requestHeadersToAdd:
            - header:
                key: x-kuma-tags
                value: '&kuma.io/service=kuma_default_gateway&&kuma.io/zone=default&'
            weight: 1

Is there a guidance tell vendor how to implement the route match?

[zirain]

xref: for istio, please see istio/istio#50108

[arkodg]

previous discussion on path precedence in #1770

[zirain]

@arkodg so what the conclusion?

[dprotaso]

Digging through - https://github.com/kubernetes-sigs/gateway-api/pull/1855/files#r1146317544

Using RegularExpressions means you let the implementation decide on the precedence

[arkodg]

the current spec (and conformance tests test this) specifies Exact > Prefix precedence
RegularExpression precedence is implementation specific, but some implementations such as Contour, Nginx and Envoy Gateway have implemented the following precedence order - Exact > RegularExpression > Prefix, since Prefix matches are used as catch alls so are moved to the end of the match order

[zirain]

thanks!