[BUG] `openai-compat` provider fails when using IP:port base URL

[yaoyi098]

Bug Description

What happened

When using openai-compat LLM provider with a custom base URL containing a ip & port (e.g., http://10.43.46.12:3000/v1), the Higress AI provider's openaiCustomUrl field is set to the full URL including the port. Higress Console extracts the host:port from this URL and displays it as "自定义 OpenAI 服务主机域" (Custom OpenAI Service Host Domain) = 10.43.46.12:3000.

This causes Higress to use 10.43.46.12:3000 as the host domain for DNS resolution / upstream routing. Since 10.43.46.12:3000 is not a valid DNS hostname, resolution fails and the LLM endpoint is unreachable.

The port is already provided separately via openaiCustomServicePort (displayed as "选择服务" = openai-compat.dns:3000), so including it in openaiCustomUrl is redundant and breaks the host domain.

Actual Higress provider config after initialization:

Field	Value
选择服务	openai-compat.dns:3000
自定义 OpenAI 服务路径	/v1
自定义 OpenAI 服务主机域	10.43.46.12:3000 ❌ (port included)

What I expected

The openaiCustomUrl should not include the port. The port should only come from openaiCustomServicePort. The "自定义 OpenAI 服务主机域" should be 10.43.46.12 (without port), and LLM requests should be forwarded to 10.43.46.12:3000 successfully.

Expected Higress provider config:

Field	Value
选择服务	openai-compat.dns:3000
自定义 OpenAI 服务路径	/v1
自定义 OpenAI 服务主机域	10.43.46.12 ✅ (no port)

Steps to Reproduce

1. Initialize the system: docker version. use one click script

2. use local ai provider with port such as xx.xx.xxx.xx:3000/v1

AI Analysis

Root Cause

openaiCustomUrl is set to the full base URL (including port) instead of the URL with the port stripped. The port is duplicated — once in openaiCustomUrl (causing the host domain to include the port) and once in openaiCustomServicePort.

Affected code path 1: Go controller

File: hiclaw-controller/internal/initializer/initializer.go (~line 362)

raw := map[string]interface{}{
    "hiclawMode":              true,
    "openaiCustomUrl":         cfg.OpenAIBaseURL,           // ← "http://10.43.46.12:3000/v1" (port included)
    "openaiCustomServiceName": "openai-compat.dns",
    "openaiCustomServicePort": port,                         // ← 3000 (port already provided here)
}

Affected code path 2: Shell script

File: manager/scripts/init/setup-higress.sh (~line 221)

PROVIDER_BODY='{..."rawConfigs":{"openaiCustomUrl":"'"${OPENAI_BASE_URL}"'","openaiCustomServiceName":"openai-compat.dns","openaiCustomServicePort":'"${OC_PORT}"',"hiclawMode":true}}'
#                                              ↑ full URL with port            ↑ port already provided here

How it breaks

1. Code sets openaiCustomUrl = http://10.43.46.12:3000/v1 (full URL with port)
2. Higress Console extracts host:port from openaiCustomUrl → displays "自定义 OpenAI 服务主机域" = 10.43.46.12:3000
3. Higress uses 10.43.46.12:3000 as the host domain for DNS resolution / upstream routing
4. 10.43.46.12:3000 is not a valid DNS hostname → resolution fails → LLM endpoint unreachable

Suggested Fix

Strip the port from openaiCustomUrl. The port should only come from openaiCustomServicePort.

initializer.go:

u, _ := url.Parse(cfg.OpenAIBaseURL)
customUrl := fmt.Sprintf("%s://%s%s", proto, host, u.Path)   // "http://10.43.46.12/v1" (no port)

raw := map[string]interface{}{
    "hiclawMode":              true,
    "openaiCustomUrl":         customUrl,                    // "http://10.43.46.12/v1"
    "openaiCustomServiceName": "openai-compat.dns",
    "openaiCustomServicePort": port,                          // 3000
}

setup-higress.sh:

# Extract path from URL
OC_PATH="/${OC_URL_STRIP#*/}"
[ "${OC_PATH}" = "/" ] && OC_PATH=""

# Build openaiCustomUrl without port
OC_CUSTOM_URL="${OC_PROTO}://${OC_DOMAIN}${OC_PATH}"          # "http://10.43.46.12/v1" (no port)

PROVIDER_BODY='{..."rawConfigs":{"openaiCustomUrl":"'"${OC_CUSTOM_URL}"'","openaiCustomServiceName":"openai-compat.dns","openaiCustomServicePort":'"${OC_PORT}"',"hiclawMode":true}}'

Related Secondary Bug

ensureServiceSource() and EnsureAIProvider() in higress.go only use POST (treat 409 Conflict as success without updating the existing resource). This means even after fixing the code, existing incorrectly configured providers cannot be corrected by re-running the initializer — they must be manually deleted first. The shell script setup-higress.sh handles this correctly with GET → PUT if exists / POST if not, but the Go controller does not.

Relevant Logs

Component

Install / Setup

Version / Commit

v1.1.2

[yaoyi098]

Fix: openai-compat provider fails when using IP:port base URL

Summary

When openai-compat LLM provider is configured with an IP:port base URL (e.g., http://10.43.46.12:3000/v1), the LLM endpoint is unreachable. Two bugs in the Higress setup code cause this failure:

1. DNS-type service source used for IP addresses — The code unconditionally creates a DNS-type service source regardless of whether the host is an IP address or a domain name. Envoy's DNS cluster cannot resolve bare IP addresses, resulting in a cluster with no endpoints.

2. openaiCustomUrl includes the port — The full base URL (with port) is set as openaiCustomUrl, causing the "Custom OpenAI Service Host Domain" field in Higress Console to display host:port instead of just host. This pollutes the upstream Host header and may cause host-domain matching failures.

Both bugs exist in two code paths: the Go controller (initializer.go) and the shell script (setup-higress.sh).

---

Bug 1: Unconditional DNS-type service source

Problem

initializer.go always calls EnsureServiceSource() (DNS type) for the openai-compat provider, even when the host is a bare IP address:

// initializer.go (~line 357)
if err := i.Gateway.EnsureServiceSource(ctx, "openai-compat", host, port, proto); err != nil {
    logger.Error(err, "failed to register openai-compat service source (non-fatal)")
}

// higress.go (~line 670)
func (c *HigressClient) ensureServiceSource(ctx context.Context, name, dnsDomain string, port int, protocol string) error {
    body := map[string]interface{}{
        "type": "dns", "name": name, "domain": dnsDomain,  // ← always "dns"
        "port": port, "protocol": protocol,
        ...
    }
    ...
}

A static-type service source function (ensureStaticServiceSource) already exists but is only used for tuwunel and element-web, never for openai-compat:

// higress.go (~line 690)
func (c *HigressClient) ensureStaticServiceSource(ctx context.Context, name, address string, port int) error {
    body := map[string]interface{}{
        "type": "static", "name": name, "domain": fmt.Sprintf("%s:%d", address, port),
        "port": port, "protocol": "http",
        ...
    }
    ...
}

Impact

Host type	DNS-type service source behavior
Domain name (e.g., api.example.com)	DNS resolution succeeds — works correctly
IP address (e.g., 10.43.46.12)	DNS resolution of a bare IP is undefined in Envoy — cluster has no endpoints — upstream connection fails

Fix

Detect whether the host is an IP address or a domain name, and use the appropriate service source type:

// initializer.go — replace the single EnsureServiceSource call with:

import "net"

if net.ParseIP(host) != nil {
    // IP address → static-type service source
    if err := i.Gateway.EnsureStaticServiceSource(ctx, "openai-compat", host, port); err != nil {
        logger.Error(err, "failed to register openai-compat static service source (non-fatal)")
    }
} else {
    // Domain name → DNS-type service source
    if err := i.Gateway.EnsureServiceSource(ctx, "openai-compat", host, port, proto); err != nil {
        logger.Error(err, "failed to register openai-compat DNS service source (non-fatal)")
    }
}

The provider's openaiCustomServiceName must also be adjusted to reference the correct service source type suffix:

var svcSuffix string
if net.ParseIP(host) != nil {
    svcSuffix = "static"
} else {
    svcSuffix = "dns"
}

raw := map[string]interface{}{
    "hiclawMode":              true,
    "openaiCustomUrl":         customUrl,
    "openaiCustomServiceName": "openai-compat." + svcSuffix,
    "openaiCustomServicePort": port,
}

---

Bug 2: openaiCustomUrl includes the port

Problem

openaiCustomUrl is set to the full base URL including the port:

// initializer.go (~line 362)
raw := map[string]interface{}{
    "openaiCustomUrl":         cfg.OpenAIBaseURL,           // "http://10.43.46.12:3000/v1" — port included
    "openaiCustomServiceName": "openai-compat.dns",
    "openaiCustomServicePort": port,                         // 3000 — port already provided here
}

# setup-higress.sh (~line 221)
PROVIDER_BODY='{..."rawConfigs":{"openaiCustomUrl":"'"${OPENAI_BASE_URL}"'",...}}'
#                                              ↑ full URL with port

Higress Console extracts the host:port from openaiCustomUrl and displays it as the "Custom OpenAI Service Host Domain". The port is duplicated — once in openaiCustomUrl (polluting the host domain) and once in openaiCustomServicePort (where it belongs).

Impact

Field	Actual value	Expected value
Service	openai-compat.dns:3000	openai-compat.dns:3000
Path	/v1	/v1
Host Domain	10.43.46.12:3000 ❌	10.43.46.12

The host domain with port may cause:

• DNS resolution failure (host:port is not a valid DNS hostname)
• Host header rejection by upstream servers
• Service source matching failure (host domain does not match the service source's domain field)

Fix

Strip the port from openaiCustomUrl. The port should only come from openaiCustomServicePort.

initializer.go:

import "net/url"

// Parse the base URL to extract the path
u, err := url.Parse(cfg.OpenAIBaseURL)
if err != nil {
    return fmt.Errorf("parse openai base url: %w", err)
}

// Reconstruct URL without port: scheme://host/path
customUrl := fmt.Sprintf("%s://%s%s", proto, host, u.Path)
if u.RawQuery != "" {
    customUrl += "?" + u.RawQuery
}

raw := map[string]interface{}{
    "hiclawMode":              true,
    "openaiCustomUrl":         customUrl,                    // "http://10.43.46.12/v1" — no port
    "openaiCustomServiceName": "openai-compat." + svcSuffix,
    "openaiCustomServicePort": port,                          // 3000
}

setup-higress.sh:

# Extract path from URL (after domain:port has been stripped)
OC_PATH="/${OC_URL_STRIP#*/}"
[ "${OC_PATH}" = "/" ] && OC_PATH=""

# Build openaiCustomUrl without port: protocol://domain/path
OC_CUSTOM_URL="${OC_PROTO}://${OC_DOMAIN}${OC_PATH}"

PROVIDER_BODY='{"type":"openai","name":"openai-compat","tokens":["'"${AGENTTEAMS_LLM_API_KEY}"'"],"version":0,"protocol":"openai/v1","tokenFailoverConfig":{"enabled":false},"rawConfigs":{"openaiCustomUrl":"'"${OC_CUSTOM_URL}"'","openaiCustomServiceName":"openai-compat.dns","openaiCustomServicePort":'"${OC_PORT}"',"hiclawMode":true}}'

---

Bug 3 (secondary): Go controller only POST, never PUT

Problem

ensureServiceSource() and EnsureAIProvider() in higress.go only use POST. When the resource already exists (HTTP 409), they return success without updating:

// higress.go (~line 680)
_, sc, err := c.doJSON(ctx, http.MethodPost, "/v1/service-sources", body)
if sc != 200 && sc != 201 && sc != 409 {  // 409 treated as success
    return fmt.Errorf(...)
}
return nil  // no update performed

// higress.go (~line 410)
_, sc, err := c.doJSON(ctx, http.MethodPost, "/v1/ai/providers", body)
if sc == 200 || sc == 201 || sc == 409 {  // 409 treated as success
    return nil  // no update performed
}

The shell script setup-higress.sh handles this correctly with GET → PUT if exists / POST if not, but the Go controller does not.

Impact

After applying the fixes for Bug 1 and Bug 2, existing incorrectly configured providers and service sources cannot be corrected by re-running the initializer. They must be manually deleted first.

Fix

Implement GET → PUT if exists / POST if not, matching the shell script pattern:

func (c *HigressClient) ensureServiceSource(ctx context.Context, name, dnsDomain string, port int, protocol string) error {
    body := map[string]interface{}{
        "type": "dns", "name": name, "domain": dnsDomain,
        "port": port, "protocol": protocol,
        "properties": map[string]interface{}{},
        "authN":      map[string]interface{}{"enabled": false},
    }

    // Check if resource exists
    existing, _, _ := c.doJSON(ctx, http.MethodGet, "/v1/service-sources/"+name, nil)
    if existing != nil {
        // Update existing
        _, sc, err := c.doJSON(ctx, http.MethodPut, "/v1/service-sources/"+name, body)
        if err != nil {
            return fmt.Errorf("update service source %s: %w", name, err)
        }
        if sc != 200 && sc != 201 {
            return fmt.Errorf("update service source %s: HTTP %d", name, sc)
        }
        return nil
    }

    // Create new
    _, sc, err := c.doJSON(ctx, http.MethodPost, "/v1/service-sources", body)
    if err != nil {
        return fmt.Errorf("ensure service source %s: %w", name, err)
    }
    if sc != 200 && sc != 201 {
        return fmt.Errorf("ensure service source %s: HTTP %d", name, sc)
    }
    return nil
}

Apply the same pattern to EnsureAIProvider().

---

Affected Files

File	Bugs
hiclaw-controller/internal/initializer/initializer.go	Bug 1, Bug 2
hiclaw-controller/internal/gateway/higress.go	Bug 1, Bug 3
manager/scripts/init/setup-higress.sh	Bug 2

---

Verification

After applying all fixes, the Higress provider config for openai-compat with base URL http://10.43.46.12:3000/v1 should display:

Field	Value
Service	openai-compat.static:3000
Path	/v1
Host Domain	10.43.46.12

And with base URL http://api.example.com:3000/v1:

Field	Value
Service	openai-compat.dns:3000
Path	/v1
Host Domain	api.example.com

LLM requests should be forwarded successfully in both cases.