envoyproxy / envoyproxy/gateway
Not all patches are applied !
- Dominant language
- Go
- Stars
- 3k
- Forks
- 864
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 140
Description
*Description*:
I would like to include the *_envoy.filters.http.header_to_metadata_* into the route configuration using patches.
Do have the following patches:
```yaml
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyPatchPolicy
metadata:
name: enable-ja4
namespace: envoy-gateway-system
spec:
targetRef:
group: gateway.networking.k8s.io
kind: Gateway
name: ingress-gateway
type: JSONPatch
jsonPatches:
- type: "type.googleapis.com/envoy.config.listener.v3.Listener"
name: envoy-gateway-system/ingress-gateway/https-aweu-cmk-p-02
operation:
op: add
jsonPath: $.listener_filters[?(@.name == 'envoy.filters.listener.tls_inspector')].typed_config
path: "/enable_ja4_fingerprinting"
value: true
```
```yaml
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyPatchPolicy
metadata:
name: inject-ja4-header
spec:
targetRef:
group: gateway.networking.k8s.io
kind: Gateway
name: ingress-gateway
type: JSONPatch
jsonPatches:
- type: "type.googleapis.com/envoy.config.listener.v3.Listener"
name: envoy-gateway-system/ingress-gateway/https-aweu-cmk-p-02
operation:
op: add
jsonPath: $.filter_chains[0].filters[?(@.name == 'envoy.filters.network.http_connection_manager')].typed_config.http_filters
path: "/0"
value:
name: envoy.filters.http.header_to_metadata
typed_config:
"@type": "type.googleapis.com/envoy.extensions.filters.http.header_to_metadata.v3.Config"
request_rules:
- on_header_present:
metadata_namespace: "envoy.extensions.filters.listener.tls_inspector"
key: "ja4_hash"
value: "X-JA4-Fingerprint2"
- on_header_missing:
metadata_namespace: "envoy.extensions.filters.listener.tls_inspector"
key: "ja4_hash"
value: "X-JA4-Fingerprint2"
- type: "type.googleapis.com/envoy.config.route.v3.RouteConfiguration"
name: envoy-gateway-system/ingress-gateway/https-aweu-cmk-p-02
operation:
op: add
jsonPath: $.virtual_hosts[?(@.name == 'envoy-gateway-system/ingress-gateway/https-aweu-cmk-p-02/ing_aweu-cmk-p-02_cmks')].routes[?(@.name == 'httproute/envoy-gateway-system/echoserver-http-route/rule/0/match/0/ing_aweu-cmk-p-02_cmks')]
path: "/request_headers_to_add/-"
value:
header:
key: "X-JA4-Fingerprint"
value: "%DYNAMIC_METADATA(envoy.extensions.filters.listener.tls_inspector:ja4_hash)%"
append_action: APPEND_IF_EXISTS_OR_ADD
```
Both Patches were applied wth success according to the CRD status, but checking the ingress gateway full Envoy configuration, the second patch configuration is missing!
1. Why are the patches applied after being wiped out (might be that reconciliation does overwrite the patch ...)?
2. How should the ja4_fingerprinting be injected as a header and propagated further?
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.