28 lines
1.4 KiB
Markdown
28 lines
1.4 KiB
Markdown
|
# 1.6 — WebSocket upgrade (GREEN)
|
||
|
|
|
||
|
|
Phase: 1 — Proxy core
|
||
|
|
Stage: GREEN
|
||
|
|
Depends on: [1.5](1.5-header-hygiene.md)
|
||
|
|
|
||
|
|
- [ ] A route may be configured to allow protocol upgrade
|
||
|
|
- [ ] An upgrade request on such a route reaches the upstream with its `Upgrade` and `Connection` headers intact, despite hop-by-hop stripping
|
||
|
|
- [ ] The upstream's `101 Switching Protocols` response reaches the client, and bytes then flow bidirectionally
|
||
|
|
- [ ] Frames pass in both directions with no buffering delay
|
||
|
|
- [ ] Client close propagates to the upstream and upstream close propagates to the client
|
||
|
|
- [ ] An upgrade attempt on a route that does not allow it is rejected, not silently downgraded to a plain proxied request
|
||
|
|
- [ ] Idle upgraded connections are not cut by the route's read timeout while frames are still flowing
|
||
|
|
|
||
|
|
`agent-pod/console` serves a WebSocket and is one of the seven Kong-class Ingresses
|
||
|
|
being migrated. It is currently publicly routed and unauthenticated into a
|
||
|
|
shell-capable container, so it must work through the gateway before it can be put
|
||
|
|
behind gateway auth. Header hygiene and upgrade support interact directly: `Upgrade`
|
||
|
|
and `Connection` are hop-by-hop, and a naive strip breaks the handshake.
|
||
|
|
|
||
|
|
## Verify
|
||
|
|
|
||
|
|
```bash
|
||
|
|
go test ./internal/proxy/... -run TestWebSocketUpgrade -v
|
||
|
|
# expected: passes — client receives 101 from the stub, an echoed frame round-trips in
|
||
|
|
# both directions, and closing the client causes the stub to observe a close
|
||
|
|
```
|