Repository: envoyproxy/gateway

Issue:
docs: Unexpected Output in Client Traffic Policy
While following the Configure Client IP Detection section in the Client Traffic Policy documentation, the config_dump query does not return the expected output. 

The output I received was:
```
{
  "use_remote_address": false,
  "original_ip_detection_extensions": [
    {
      "name": "envoy.extensions.http.original_ip_detection.xff",
      "typed_config": {
        "@type": "type.googleapis.com/envoy.extensions.http.original_ip_detection.xff.v3.XffConfig",
        "xff_num_trusted_hops": 1,
        "skip_xff_append": false
      }
    }
  ]
}
```

After this step, I receive the following error while trying to curl the example app.
```
curl -v http://$GATEWAY_HOST/get \
  -H "Host: www.example.com" \
  -H "X-Forwarded-Proto: https" \
  -H "X-Forwarded-For: 1.1.1.1,2.2.2.2"
* Host get:80 was resolved.
* IPv6: (none)
* IPv4: 143.244.220.150
*   Trying 143.244.220.150:80...
* connect to 143.244.220.150 port 80 from 10.33.33.1 port 57711 failed: Operation timed out
* Failed to connect to get port 80 after 75221 ms: Couldn't connect to server
* Closing connection
curl: (28) Failed to connect to get port 80 after 75221 ms: Couldn't connect to server
```

Environment Details:
- Envoy Gateway Version: v1.3.1
- Kubernetes Version: 1.32.2
- Cluster Setup: Running on Docker Desktop v4.39.0
- Operating System: macOS
- Load Balancer: MetalLB


Discussion:
@melsal13: @arkodg @arkodg: cc @rudrakhp @rudrakhp: Hey @melsal13 I tried reproducing this, you were right about the mismatch in config output, this is expected after we moved to original IP detection extension. Fixing this, thanks for reporting!
About the error while curling the gateway, I see the expected output:
```
❯ curl -v http://localhost:8888/get \
  -H "Host: www.example.com" \
  -H "X-Forwarded-Proto: https" \
  -H "X-Forwarded-For: 1.1.1.1,2.2.2.2"

* Host localhost:8888 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:8888...
* Connected to localhost (::1) port 8888
> GET /get HTTP/1.1
> Host: www.example.com
> User-Agent: curl/8.7.1
> Accept: */*
> X-Forwarded-Proto: https
> X-Forwarded-For: 1.1.1.1,2.2.2.2
>
* Request completely sent off
< HTTP/1.1 200 OK
< content-type: application/json
< x-content-type-options: nosniff
< date: Sat, 17 May 2025 12:46:11 GMT
< content-length: 432
<
{
 "path": "/get",
 "host": "www.example.com",
 "method": "GET",
 "proto": "HTTP/1.1",
 "headers": {
  "Accept": [
   "*/*"
  ],
  "User-Agent": [
   "curl/8.7.1"
  ],
  "X-Forwarded-For": [
   "1.1.1.1,2.2.2.2,10.244.2.3"
  ],
  "X-Forwarded-Proto": [
   "https"
  ],
  "X-Request-Id": [
   "dc973b80-98e2-45aa-8e40-5c863b07c8b9"
  ]
 },
 "namespace": "default",
 "ingress": "",
 "service": "",
 "pod": "backend-869c8646c5-kmjpt"
* Connection #0 to host localhost left intact
}%
```
FYI I set this up locally and didn't use external load balancer support. Your error is suggesting that the port forward to the gateway might not be set correctly, or if you are using a load balancer an issue with that maybe:
```
* IPv4: 143.244.220.150
*   Trying 143.244.220.150:80...
* connect to 143.244.220.150 port 80 from 10.33.33.1 port 57711 failed: Operation timed out
```
Do let me know if you see this locally/without load balancer as well. 

Solution patch:
diff --git a/site/content/en/v1.4/boilerplates/testing.md b/site/content/en/v1.4/boilerplates/testing.md
index 58f5377da..3cda43e6d 100644
--- a/site/content/en/v1.4/boilerplates/testing.md
+++ b/site/content/en/v1.4/boilerplates/testing.md
@@ -28,6 +28,12 @@ Get the name of the Envoy service created the by the example Gateway:
 export ENVOY_SERVICE=$(kubectl get svc -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=default,gateway.envoyproxy.io/owning-gateway-name=eg -o jsonpath='{.items[0].metadata.name}')
 ```
 
+Get the deployment of the Envoy service created the by the example Gateway:
+
+```shell
+export ENVOY_DEPLOYMENT=$(kubectl get deploy -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=default,gateway.envoyproxy.io/owning-gateway-name=eg -o jsonpath='{.items[0].metadata.name}')
+```
+
 Port forward to the Envoy service:
 
 ```shell
diff --git a/site/content/en/v1.4/tasks/traffic/client-traffic-policy.md b/site/content/en/v1.4/tasks/traffic/client-traffic-policy.md
index 987bab510..cb9748160 100644
--- a/site/content/en/v1.4/tasks/traffic/client-traffic-policy.md
+++ b/site/content/en/v1.4/tasks/traffic/client-traffic-policy.md
@@ -406,16 +406,25 @@ Curl the admin interface port to fetch the configured value for `xff_num_trusted
 
 ```shell
 curl -s 'http://localhost:19000/config_dump?resource=dynamic_listeners' \
-  | jq -r '.configs[0].active_state.listener.default_filter_chain.filters[0].typed_config 
-      | with_entries(select(.key | match("xff|remote_address|original_ip")))'
+  | jq -r '.configs[1].active_state.listener.default_filter_chain.filters[0].typed_config
+    | {use_remote_address, original_ip_detection_extensions}'
 ```
 
 You should expect to see the following:
 
 ```json
 {
-  "use_remote_address": true,
-  "xff_num_trusted_hops": 2
+  "use_remote_address": false,
+  "original_ip_detection_extensions": [
+    {
+      "name": "envoy.extensions.http.original_ip_detection.xff",
+      "typed_config": {
+        "@type": "type.googleapis.com/envoy.extensions.http.original_ip_detection.xff.v3.XffConfig",
+        "xff_num_trusted_hops": 1,
+        "skip_xff_append": false
+      }
+    }
+  ]
 }
 ```
 



Test patch:
diff --git a/site/content/en/latest/boilerplates/testing.md b/site/content/en/latest/boilerplates/testing.md
index 58f5377da..3cda43e6d 100644
--- a/site/content/en/latest/boilerplates/testing.md
+++ b/site/content/en/latest/boilerplates/testing.md
@@ -28,6 +28,12 @@ Get the name of the Envoy service created the by the example Gateway:
 export ENVOY_SERVICE=$(kubectl get svc -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=default,gateway.envoyproxy.io/owning-gateway-name=eg -o jsonpath='{.items[0].metadata.name}')
 ```
 
+Get the deployment of the Envoy service created the by the example Gateway:
+
+```shell
+export ENVOY_DEPLOYMENT=$(kubectl get deploy -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=default,gateway.envoyproxy.io/owning-gateway-name=eg -o jsonpath='{.items[0].metadata.name}')
+```
+
 Port forward to the Envoy service:
 
 ```shell
diff --git a/site/content/en/latest/tasks/traffic/client-traffic-policy.md b/site/content/en/latest/tasks/traffic/client-traffic-policy.md
index 987bab510..cb9748160 100644
--- a/site/content/en/latest/tasks/traffic/client-traffic-policy.md
+++ b/site/content/en/latest/tasks/traffic/client-traffic-policy.md
@@ -406,16 +406,25 @@ Curl the admin interface port to fetch the configured value for `xff_num_trusted
 
 ```shell
 curl -s 'http://localhost:19000/config_dump?resource=dynamic_listeners' \
-  | jq -r '.configs[0].active_state.listener.default_filter_chain.filters[0].typed_config 
-      | with_entries(select(.key | match("xff|remote_address|original_ip")))'
+  | jq -r '.configs[1].active_state.listener.default_filter_chain.filters[0].typed_config
+    | {use_remote_address, original_ip_detection_extensions}'
 ```
 
 You should expect to see the following:
 
 ```json
 {
-  "use_remote_address": true,
-  "xff_num_trusted_hops": 2
+  "use_remote_address": false,
+  "original_ip_detection_extensions": [
+    {
+      "name": "envoy.extensions.http.original_ip_detection.xff",
+      "typed_config": {
+        "@type": "type.googleapis.com/envoy.extensions.http.original_ip_detection.xff.v3.XffConfig",
+        "xff_num_trusted_hops": 1,
+        "skip_xff_append": false
+      }
+    }
+  ]
 }
 ```