How to debug "fault filter abort" of GKE HTTPRoute?

Question

This is my HTTPRoute:

apiVersion: v1
items:
- apiVersion: gateway.networking.k8s.io/v1beta1
  kind: HTTPRoute
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {"apiVersion":"gateway.networking.k8s.io/v1beta1","kind":"HTTPRoute","metadata":{"annotations":{},"labels":{"app.kubernetes.io/environment":"review","app.kubernetes.io/instance":"gaia-review-contra-web-app","app.kubernetes.io/managed-by":"helm","app.kubernetes.io/name":"gaia-review-contra-web-app","app.kubernetes.io/version":"ce3cb555","contra.com/app-name":"gaia-review-contra-web-app-c522e1fa"},"name":"gaia-review-contra-web-app","namespace":"gaia-review-c522e1fa"},"spec":{"hostnames":["web-app-c522e1fa.contra.dev"],"parentRefs":[{"name":"contra-gateway","namespace":"contra","sectionName":"https"}],"rules":[{"backendRefs":[{"name":"gaia-review-contra-web-app","port":80}],"matches":[{"path":{"type":"PathPrefix","value":"/"}}]}]}}
    creationTimestamp: "2023-08-18T17:06:39Z"
    generation: 2
    labels:
      app.kubernetes.io/environment: review
      app.kubernetes.io/instance: gaia-review-contra-web-app
      app.kubernetes.io/managed-by: helm
      app.kubernetes.io/name: gaia-review-contra-web-app
      app.kubernetes.io/version: ce3cb555
      contra.com/app-name: gaia-review-contra-web-app-c522e1fa
    name: gaia-review-contra-web-app
    namespace: gaia-review-c522e1fa
    resourceVersion: "868181459"
    uid: 608df240-3590-449d-8baf-7506f9270afa
  spec:
    hostnames:
    - web-app-c522e1fa.contra.dev
    parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: contra-gateway
      namespace: contra
      sectionName: https
    rules:
    - backendRefs:
      - group: ""
        kind: Service
        name: gaia-review-contra-web-app
        port: 80
        weight: 1
      matches:
      - path:
          type: PathPrefix
          value: /
kind: List
metadata:
  resourceVersion: ""

and this is my Gateway:

apiVersion: v1
items:
- apiVersion: gateway.networking.k8s.io/v1beta1
  kind: Gateway
  metadata:
    annotations:
      kubectl.kubernetes.io/last-applied-configuration: |
        {"apiVersion":"gateway.networking.k8s.io/v1beta1","kind":"Gateway","metadata":{"annotations":{"networking.gke.io/certmap":"contra"},"labels":{"app.kubernetes.io/environment":"production","app.kubernetes.io/instance":"contra-gateway","app.kubernetes.io/managed-by":"helm","app.kubernetes.io/name":"contra-gateway","app.kubernetes.io/version":"0.0.0","contra.com/app-name":"contra-gateway"},"name":"contra-gateway","namespace":"contra"},"spec":{"addresses":[{"type":"NamedAddress","value":"contra-gateway"}],"gatewayClassName":"gke-l7-global-external-managed","listeners":[{"name":"http","port":80,"protocol":"HTTP"},{"name":"https","port":443,"protocol":"HTTPS"}]}}
      networking.gke.io/addresses: ""
      networking.gke.io/backend-services: /projects/939918834766/global/backendServices/gkegw1-65a4-contra-gw-serve404-80-mjsz9skk7ox6,
        /projects/939918834766/global/backendServices/gkegw1-65a4-contra-gw-serve500-80-kxe9pu64nemt
      networking.gke.io/certmap: contra
      networking.gke.io/firewalls: /projects/939918834766/global/firewalls/gkegw1-65a4-l7-default-global
      networking.gke.io/forwarding-rules: /projects/939918834766/global/forwardingRules/gkegw1-65a4-contra-contra-gateway-4s97k8zu9kzu,
        /projects/939918834766/global/forwardingRules/gkegw1-65a4-contra-contra-gateway-irpnq0wksx4i
      networking.gke.io/health-checks: /projects/939918834766/global/healthChecks/gkegw1-65a4-contra-gw-serve404-80-mjsz9skk7ox6,
        /projects/939918834766/global/healthChecks/gkegw1-65a4-contra-gw-serve500-80-kxe9pu64nemt
      networking.gke.io/last-reconcile-time: "2023-08-18T17:20:51Z"
      networking.gke.io/ssl-certificates: ""
      networking.gke.io/target-http-proxies: /projects/939918834766/global/targetHttpProxies/gkegw1-65a4-contra-contra-gateway-gz8jzsqzogr6
      networking.gke.io/target-https-proxies: /projects/939918834766/global/targetHttpsProxies/gkegw1-65a4-contra-contra-gateway-qeu6j08qkwbd
      networking.gke.io/url-maps: /projects/939918834766/global/urlMaps/gkegw1-65a4-contra-contra-gateway-gz8jzsqzogr6,
        /projects/939918834766/global/urlMaps/gkegw1-65a4-contra-contra-gateway-qeu6j08qkwbd
    creationTimestamp: "2023-08-17T04:20:31Z"
    finalizers:
    - gateway.finalizer.networking.gke.io
    generation: 1
    labels:
      app.kubernetes.io/environment: production
      app.kubernetes.io/instance: contra-gateway
      app.kubernetes.io/managed-by: helm
      app.kubernetes.io/name: contra-gateway
      app.kubernetes.io/version: 0.0.0
      contra.com/app-name: contra-gateway
    name: contra-gateway
    namespace: contra
    resourceVersion: "868190956"
    uid: 6e576515-db2b-4ec0-bb9f-7cceb5e902e6
  spec:
    addresses:
    - type: NamedAddress
      value: contra-gateway
    gatewayClassName: gke-l7-global-external-managed
    listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
      name: https
      port: 443
      protocol: HTTPS
  status:
    addresses:
    - type: IPAddress
      value: 34.102.161.76
    conditions:
    - lastTransitionTime: "2023-08-17T04:22:03Z"
      message: The OSS Gateway API has deprecated this condition, do not depend on
        it.
      observedGeneration: 1
      reason: Scheduled
      status: "True"
      type: Scheduled
    - lastTransitionTime: "2023-08-17T04:22:03Z"
      message: ""
      observedGeneration: 1
      reason: Accepted
      status: "True"
      type: Accepted
    - lastTransitionTime: "2023-08-17T04:22:03Z"
      message: ""
      observedGeneration: 1
      reason: Programmed
      status: "True"
      type: Programmed
    - lastTransitionTime: "2023-08-17T04:22:03Z"
      message: The OSS Gateway API has altered the "Ready" condition semantics and
        reservedit for future use.  GKE Gateway will stop emitting it in a future
        update, use "Programmed" instead.
      observedGeneration: 1
      reason: Ready
      status: "True"
      type: Ready
    listeners:
    - attachedRoutes: 0
      conditions:
      - lastTransitionTime: "2023-08-17T04:22:03Z"
        message: ""
        observedGeneration: 1
        reason: Programmed
        status: "True"
        type: Programmed
      - lastTransitionTime: "2023-08-17T04:22:03Z"
        message: The OSS Gateway API has altered the "Ready" condition semantics and
          reservedit for future use.  GKE Gateway will stop emitting it in a future
          update, use "Programmed" instead.
        observedGeneration: 1
        reason: Ready
        status: "True"
        type: Ready
      name: http
      supportedKinds:
      - group: gateway.networking.k8s.io
        kind: HTTPRoute
    - attachedRoutes: 0
      conditions:
      - lastTransitionTime: "2023-08-17T04:22:03Z"
        message: ""
        observedGeneration: 1
        reason: Programmed
        status: "True"
        type: Programmed
      - lastTransitionTime: "2023-08-17T04:22:03Z"
        message: The OSS Gateway API has altered the "Ready" condition semantics and
          reservedit for future use.  GKE Gateway will stop emitting it in a future
          update, use "Programmed" instead.
        observedGeneration: 1
        reason: Ready
        status: "True"
        type: Ready
      name: https
      supportedKinds:
      - group: gateway.networking.k8s.io
        kind: HTTPRoute
kind: List
metadata:
  resourceVersion: ""

When I make a request:

curl 'https://web-app-c522e1fa.contra.dev/'
fault filter abort%

I am getting "fault filter abort" error.

Where do I look to understand what is not going according to the plan?

Nothing in the descriptions of HTTPRoute or Gateway screams of an error.

I am using Google Cloud (GKE) provided gateway.

Answer 1

So it appears that a healthy HTTPRoute is supposed to have these two statuses:

  status:
    parents:
    - conditions:
      - lastTransitionTime: "2023-08-18T17:45:19Z"
        message: ""
        observedGeneration: 1
        reason: Accepted
        status: "True"
        type: Accepted
      - lastTransitionTime: "2023-08-18T17:45:19Z"
        message: ""
        observedGeneration: 1
        reason: ReconciliationSucceeded
        status: "True"
        type: Reconciled

In my particular case this was not happening because I was linking resources across namespaces. Adding allowedRoutes to Gateway fixed this issue:

allowedRoutes:
  namespaces:
    from: All

Now I am facing no healthy upstream, but that's a different issue.