# Allow\_websockets

**URL:** <https://discuss.pomerium.com/t/allow-websockets/511>\
**Category:** Support\
**Created:** [June 5, 2026, 10:59am UTC](https://discuss.pomerium.com/t/allow-websockets/511 "2026-06-05T10:59:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![franklin](https://avatars.discourse-cdn.com/v4/letter/f/3e96dc/32.png) [@franklin](https://discuss.pomerium.com/u/franklin)\
**Post date:** [June 5, 2026, 10:59am UTC](https://discuss.pomerium.com/t/allow-websockets/511/1 "2026-06-05T10:59:51Z")

</div>

What happened?  
WebSocket connections are blocked with `403 upgrade_failed` when using Pomerium Gateway API mode. Terminals and kernels in JupyterLab are completely non-functional.

What did you expect to happen?  
WebSocket connections should be allowed just like they were with the Ingress controller using `ingress.pomerium.io/allow_websockets: "true"` annotation.

## How’d it happen?

1. Migrated from Pomerium Ingress to Gateway API using `PolicyFilter`
2. Accessed JupyterLab via `https://gxxxx.staging.kenya.co/lab`
3. Terminal and kernel connections fail with `403 upgrade_failed` in Pomerium logs

## What’s your environment like?

- 
  1. Pomerium version: `v0.32.8` installed via `kubectl apply -k "github.com/pomerium/ingress-controller/config/gateway-api?ref=v0.32.8"`
  2. Server: Azure Kubernetes Service (AKS), Ubuntu, southafricanorth region
  3. Gateway API CRDs: `v1.5.1`
  4. Envoy Gateway: `v1.8.0`

## What’s your config.yaml?

```auto
apiVersion: ingress.pomerium.io/v1
kind: Pomerium
metadata:
  name: global
  namespace: pomerium
spec:
  secrets: pomerium/bootstrap
  authenticate:
    url: "https://xxx.pomerium.staging.kenya.co"
  identityProvider:
    provider: azure
    secret: pomerium/idp-azure
  certificates:
    - pomerium/production-kenya-coapiVersion: 

gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: xxx-httproute
  namespace: staging
spec:
  parentRefs:
    - name: pomerium
      namespace: pomerium
  hostnames:
    - xxxxx.staging.kenya.co
  rules:
    - backendRefs:
        - name: applications-0-service
          port: 8888
      filters:
        - type: ExtensionRef
          extensionRef:
            group: gateway.pomerium.io
            kind: PolicyFilter
            name: xxx-policy

apiVersion: gateway.pomerium.io/v1alpha1
kind: PolicyFilter
metadata:
  name: xxx-policy
  namespace: staging
spec:
  ppl: |
    allow:
      or:
        - email:
            is: user@example.com

```

## What did you see in the logs?

```logs
{"level":"info","service":"envoy","method":"GET",
"path":"/terminals/websocket/4",
"response-code":403,
"response-code-details":"upgrade_failed",
"time":"2026-06-05T08:53:22Z","message":"http-request"}

```

## Additional context

**What I tried:**

1. Adding `allow_websockets: true` to `PolicyFilter` spec:

```auto
Error: unknown field "spec.allowWebsockets"

```

1. Adding `allow_websockets: true` as PPL action:

```auto
couldn't parse policy: invalid rules in policy: 
invalid action in rule: unsupported action: "allow_websockets"

```

1. Adding `spec.policy` to Pomerium global config:

```auto
Error: unknown field "spec.policy"

```

**Additional context**

With Ingress controller, WebSocket worked perfectly using:

yaml

```auto
annotations:
  ingress.pomerium.io/allow_websockets: "true"

```

There appears to be no equivalent for this in Gateway API mode. Is `allow_websockets` supported in Gateway API `PolicyFilter`? If not, is it on the roadmap?

This is a blocker for migrating WebSocket-heavy applications like JupyterLab from Ingress to Gateway API.

---

<div class="post-metadata">

**Author:** ![calebdoxsey](https://avatars.discourse-cdn.com/v4/letter/c/7bcc69/32.png) [@calebdoxsey](https://discuss.pomerium.com/u/calebdoxsey)\
**Post date:** [June 5, 2026, 4:06pm UTC](https://discuss.pomerium.com/t/allow-websockets/511/2 "2026-06-05T16:06:59Z")

</div>

Hi @franklin ,

This is currently not implemented with the Gateway controller. I will add an issue to our backlog to look into this. I believe it would entail a new CRD object that would be referenced as an `ExtensionRef` filter, rather than the existing `PolicyFilter`.

Thanks,  
Caleb

---

<div class="post-metadata">

**Author:** ![franklin](https://avatars.discourse-cdn.com/v4/letter/f/3e96dc/32.png) [@franklin](https://discuss.pomerium.com/u/franklin)\
**Post date:** [June 9, 2026, 5:44am UTC](https://discuss.pomerium.com/t/allow-websockets/511/3 "2026-06-09T05:44:52Z")

</div>

Hi Caleb,

Thanks for your feedback. Once it’s added you can let me know. I’ll appreciate.