HTTPRoute rule-level timeouts not enforced

[relu]

What is the issue?

It looks like the rule-level timeouts configured on HTTPRoutes are not enforced, even though the documentation suggests this should work. The annotation-based configuration does work correctly.

How can it be reproduced?

Here's a minimal set of manifests that can be used to reproduce the issue:

apiVersion: v1
kind: Namespace
metadata:
  name: linkerd-timeout-test
  annotations:
    linkerd.io/inject: enabled
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - {}
  egress:
  - {}
---
apiVersion: v1
kind: Service
metadata:
  name: httpbin
  namespace: linkerd-timeout-test
spec:
  ports:
  - port: 80
    name: http
    targetPort: 8080
  selector:
    app: httpbin
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin
  namespace: linkerd-timeout-test
spec:
  selector:
    matchLabels:
      app: httpbin
  template:
    metadata:
      labels:
        app: httpbin
    spec:
      containers:
      - name: httpbin
        image: mccutchen/go-httpbin
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Pod
metadata:
  name: debug
  namespace: linkerd-timeout-test
spec:
  containers:
  - name: curl
    image: curlimages/curl
    command: ["cat"]
    tty: true

Using the following HTTPRoute:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: httpbin
  namespace: linkerd-timeout-test
spec:
  parentRefs:
  - name: httpbin
    group: ""
    kind: Service
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    timeouts:
      request: "2s"
    backendRefs:
    - name: httpbin
      port: 80

Run:

$ time kubectl exec -ti -n linkerd-timeout-test -c curl debug -- curl -I http://httpbin.linkerd-timeout-test.svc.cluster.local/delay/5
HTTP/1.1 200 OK
access-control-allow-credentials: true
access-control-allow-origin: *
content-type: application/json; charset=utf-8
server-timing: initial_delay;dur=5000.00;desc="initial delay"
date: Wed, 12 Nov 2025 15:07:17 GMT

kubectl exec -ti -n linkerd-timeout-test -c curl debug -- curl -I   0.35s user 0.19s system 7% cpu 6.774 total

And with annotation request timeout configured:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: httpbin
  namespace: linkerd-timeout-test
  annotations:
    timeout.linkerd.io/request: 2s
spec:
  parentRefs:
  - name: httpbin
    group: ""
    kind: Service
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: httpbin
      port: 80

Run:

$ time kubectl exec -ti -n linkerd-timeout-test -c curl debug -- curl -I http://httpbin.linkerd-timeout-test.svc.cluster.local/delay/5
HTTP/1.1 504 Gateway Timeout
content-length: 0
l5d-proxy-error: logical service 172.20.136.15:80: route HTTPRoute.linkerd-timeout-test.httpbin: backend Service.linkerd-timeout-test.httpbin:80: Service.linkerd-timeout-test.httpbin:80: timed out waiting for response headers: request timeout: 2s
date: Wed, 12 Nov 2025 15:08:38 GMT

kubectl exec -ti -n linkerd-timeout-test -c curl debug -- curl -I   0.35s user 0.19s system 14% cpu 3.664 total

Logs, error output, etc

Provided above.

output of linkerd check -o short

linkerd-version
---------------
‼ cli is up-to-date
    is running version 25.10.7 but the latest edge version is 25.11.1
    see https://linkerd.io/2/checks/#l5d-version-cli for hints

control-plane-version
---------------------
‼ control plane is up-to-date
    is running version 25.10.7 but the latest edge version is 25.11.1
    see https://linkerd.io/2/checks/#l5d-version-control for hints

linkerd-control-plane-proxy
---------------------------
‼ control plane proxies are up-to-date
    some proxies are not running the current version:
	* linkerd-destination-6c9c64f74-7g2mf (edge-25.10.7)
	* linkerd-destination-6c9c64f74-dz5pk (edge-25.10.7)
	* linkerd-destination-6c9c64f74-sm6mm (edge-25.10.7)
	* linkerd-identity-7c98d4d5c6-8h2j9 (edge-25.10.7)
	* linkerd-identity-7c98d4d5c6-hdshd (edge-25.10.7)
	* linkerd-identity-7c98d4d5c6-pvmsp (edge-25.10.7)
	* linkerd-proxy-injector-67f7776c7c-22tbx (edge-25.10.7)
	* linkerd-proxy-injector-67f7776c7c-gxxdl (edge-25.10.7)
	* linkerd-proxy-injector-67f7776c7c-j6hqq (edge-25.10.7)
    see https://linkerd.io/2/checks/#l5d-cp-proxy-version for hints

Environment

• Kubernetes Version: 1.34.1
• Cluster Environment: EKS
• Host OS: Bottlerocket
• Linkerd version: edge-25.10.7

Possible solution

No response

Additional context

No response

Would you like to work on fixing this bug?

maybe