Websockets

Websockets is a protocol allowing full-duplex communication through a single TCP connection. Gloo Gateway enables websocket upgrades by default without any additional configuration changes. This document will show how to fine tune the websocket support as needed.

Configuring Websockets on entire listener

Since websocket upgrades are enabled by default on an entire Listener, we can use the HttpConnectionManager configuration on the Gateway to turn off websocket upgrades for all connections on that listener.

For example, the default gateway-proxy can be configured like the following:

apiVersion: gateway.solo.io/v1
kind: Gateway
metadata:
  labels:
    app: gloo
  name: gateway-proxy
  namespace: gloo-system
spec:
  bindAddress: '::'
  bindPort: 8080
  httpGateway:
    options:
      httpConnectionManagerSettings:
        upgrades:
        - websocket:
            enabled: false
  proxyNames:
  - gateway-proxy
  useProxyProto: false

Note the httpGateway configuration above with settings for the httpConnectionManager.

We can also configure whether websocket is enabled per route as we see in the next section.

Configuring websocket per route

If you need more fine-grained control configuring websockets, you can use the Route configuration in a VirtualService . For example, if you have websockets disabled for your listener (as seen in previous section), you can enable it per route with the following:

- matchers:
    - prefix: /foo
   routeAction:
     single:
       upstream:
         name: foo
         namespace: gloo-system
    options:
      upgrades:
      - websocket: {}

Please reach out to us on Slack or File an Issue if you’re having trouble configuring websockets.

WAF compatibility

By default, the Web Application Firewall (WAF) filter buffers the full request body and waits for an HTTP end-of-stream signal before evaluating WAF rules. While WebSocket upgrades start as an HTTP/1.1 request with an Upgrade: websocket header, the connection then switches to a persistent, full-duplex WebSocket stream that never sends an HTTP end-of-stream signal. Because of that, WebSocket upgrades are silently dropped with no error or 403 HTTP response.

To allow WebSocket upgrades through the WAF, add requestHeadersOnly: true and responseHeadersOnly: true to your WAF configuration. For more information, see Streaming protocols: gRPC and WebSockets.

Next Steps

For background on Traffic Management, check out the concepts page dealing with the topic. You may also be interested in how routing decisions are made and the possible destinations for routing.