envoyproxy / envoyproxy/envoy

feat: Credential Injection for ext_authz and ext_proc calls

Open
#41,767 7 comments 1 reaction 1 assignee Claimed by @dio View on GitHub
area/ext_authz area/ext_proc enhancement help wanted no stalebot
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
428

Description

*Title*: *Add Credential Injection compatible with ext_authz and ext_proc gRPC and HTTP calls*

*Description*:
> I have need for a feature facilitating workload authentication on external calls by the [envoy.filters.http.ext_authz](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/ext_authz_filter) and [envoy.filters.http.ext_proc](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/ext_proc_filter.html) filters. The [Credential Injector](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/credential_injector_filter.html) filter almost works for this use case, but the secrets are only injected to the routed request, not the side-processing requests.

I don't know if this is best implemented as an enhancement to the ext_* filters to access SDS, or to somehow make secrets available to the existing API.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.