Unable to add %TRACE_ID% as response header

[lboynton]

I've configured tracing as per the docs here, and I have the following HTTPRoute configured:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: backend
  namespace: default
spec:
  hostnames:
  - www.example.com
  parentRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: eg
  rules:
  - backendRefs:
    - group: ""
      kind: Service
      name: backend
      port: 3000
      weight: 1
    filters:
    - responseHeaderModifier:
        add:
        - name: request-id
          value: '%REQ(x-request-id)%'
        - name: trace-id
          value: '%TRACE_ID%'
      type: ResponseHeaderModifier
    matches:
    - path:
        type: PathPrefix
        value: /

When I make a request to this, I can see the request-id header is set but not the trace-id header:

curl --header "Host: www.example.com" http://localhost:8888/foo -i
HTTP/1.1 200 Ok
request-id: 22a55966-268b-905a-a118-4e12f01bd06a

I expected the trace-id header to be set to the trace ID that envoy generates for the request. Should this work?

Same issue when using in the response body:

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
  name: response-override
  namespace: default
spec:
  responseOverride:
  - match:
      statusCodes:
      - type: Value
        value: 401
    response:
      body:
        inline: |
          {"status":%RESPONSE_CODE%,"trace_id":"%TRACE_ID%"}
        type: Inline
      contentType: application/json
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: backend

curl --header "Host: www.example.com" http://localhost:8888/get -i
HTTP/1.1 401 Unauthorized
request-id: 903be43a-08a8-97b5-bf65-bc68f5303d9e
content-type: application/json
content-length: 137
date: Wed, 13 Aug 2025 13:26:30 GMT

{"status":401,"trace_id":"-"}

[zirain]

this's a envoy issue, can you kindly create an issue in envoy?

cc @wbpcode

[lboynton]

Thanks, I've raised envoyproxy/envoy#40698. I'm not exactly sure how to reproduce this with just envoy proxy, so I've linked to this discussion.