# Consul API Gateway doesn't seem completely conformant with official Specs

**URL:** <https://discuss.hashicorp.com/t/consul-api-gateway-doesnt-seem-completely-conformant-with-official-specs/76398>\
**Category:** Consul\
**Tags:** k8s, consul, consul-api-gateway\
**Created:** [August 29, 2025, 5:31pm UTC](https://discuss.hashicorp.com/t/consul-api-gateway-doesnt-seem-completely-conformant-with-official-specs/76398 "2025-08-29T17:31:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![academian](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/academian/32/46350_2.png) [@academian](https://discuss.hashicorp.com/u/academian)\
**Post date:** [August 29, 2025, 5:31pm UTC](https://discuss.hashicorp.com/t/consul-api-gateway-doesnt-seem-completely-conformant-with-official-specs/76398/1 "2025-08-29T17:31:33Z")

</div>

Hi,

I am trying to use Consul API gateway on a EKS cluster but the gateway doesn’t seem to be fully compliant with the official conformance specs. I’m specifically looking at HTTPRoute and RequestRedirect which is a **core** filter.

The documentation has no mention of it: [HTTP route configuration entry reference | Consul | HashiCorp Developer](https://developer.hashicorp.com/consul/docs/reference/config-entry/http-route)

Weirdly it does kind of work, as in the controller accepts routes with `RequestRedirect` filters but the routes don’t do anything in my setup.

```auto
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: external-gtw
  namespace: kube-system
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: "external"
    service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"
    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "ip"
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "<redacted>"
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
spec:
  gatewayClassName: consul
  listeners:
    - protocol: HTTPS
      port: 443
      name: https
      allowedRoutes:
        namespaces:
          from: "All"
    - protocol: HTTP
      port: 80
      name: http
      allowedRoutes:
        namespaces:
          from: "All"

```

```auto
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: http-to-https-redirect
  annotations:
    gateway.networking.k8s.io/controller: consul.hashicorp.com/gateway-controller
spec:
  parentRefs:
    - name: external-gtw
      sectionName: http
      namespace: kube-system
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      backendRefs:
        - kind: Service
          name: <redacted>
          namespace: <redacted>
          port: 81

```

The way the controller accepts the route is also a bit strange, in that it needs a `backendref` and without it I get

```auto
 status:
  parents:
    - conditions:
        - lastTransitionTime: '2025-08-29T16:36:23Z'
          message: resolved backend references
          observedGeneration: 1
          reason: ResolvedRefs
          status: 'True'
          type: ResolvedRefs
        - lastTransitionTime: '2025-08-29T16:36:23Z'
          message: route accepted
          observedGeneration: 1
          reason: Accepted
          status: 'True'
          type: Accepted
        - lastTransitionTime: '2025-08-29T16:36:23Z'
          message: route synced to Consul
          observedGeneration: 1
          reason: Synced
          status: 'True'
          type: Synced
        - lastTransitionTime: '2025-08-29T16:36:23Z'
          message: route must target at least one upstream service
          observedGeneration: 1
          reason: NoUpstreamServicesTargeted
          status: 'False'
          type: ConsulAccepted

```

Which is wildly different from the Gateway API example at: [HTTP redirects and rewrites - Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/#redirects)

The other issue I’ve run into is that HTTPRoute Hostnames should support wildcards based on the official CRD, but the consul controller spits out

```auto
message: >-
            Unexpected response code: 500 (host "*.<redacted>.com" must not be
            a wildcard)

```

Versions:

consul-helm: 1.4.8

consul: 1.18.2

---

<div class="post-metadata">

**Author:** ![brucelok](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/brucelok/32/40570_2.png) [@brucelok](https://discuss.hashicorp.com/u/brucelok)\
**Post date:** [August 27, 2026, 4:51am UTC](https://discuss.hashicorp.com/t/consul-api-gateway-doesnt-seem-completely-conformant-with-official-specs/76398/2 "2026-08-27T04:51:43Z")

</div>

Consul’s Gateway controller currently does not support the `RequestRedirect` filter from the Gateway API spec, and it also rejects wildcard hostnames by design. The controller still expects at least one `backendRef` because it maps every route to an upstream service in Consul.  
It also does not allow wildcard hostnames(e.g. `*.example.com`). The error message you’re seeing reflects this restriction.  
ref:

- [Consul API Gateway – HTTPRoute](https://developer.hashicorp.com/consul/docs/observability/api-gateway/gateway-apis/http-route)
- [Consul API Gateway – Gateway APIs Overview](https://developer.hashicorp.com/consul/docs/observability/api-gateway/gateway-apis)