envoyproxy / envoyproxy/gateway

Not all patches are applied !

Open
#7,035 2 comments 0 reactions 0 assignees View on GitHub
stale triage
Dominant language
Go
Stars
3k
Forks
864
Avg merge
2d 2h
Merged PRs (30d)
140

Description

*Description*:

I would like to include the *_envoy.filters.http.header_to_metadata_* into the route configuration using patches.

Do have the following patches:

```yaml
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyPatchPolicy
metadata:
name: enable-ja4
namespace: envoy-gateway-system
spec:
targetRef:
group: gateway.networking.k8s.io
kind: Gateway
name: ingress-gateway
type: JSONPatch
jsonPatches:
- type: "type.googleapis.com/envoy.config.listener.v3.Listener"
name: envoy-gateway-system/ingress-gateway/https-aweu-cmk-p-02
operation:
op: add
jsonPath: $.listener_filters[?(@.name == 'envoy.filters.listener.tls_inspector')].typed_config
path: "/enable_ja4_fingerprinting"
value: true
```

```yaml
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyPatchPolicy
metadata:
name: inject-ja4-header
spec:
targetRef:
group: gateway.networking.k8s.io
kind: Gateway
name: ingress-gateway
type: JSONPatch
jsonPatches:
- type: "type.googleapis.com/envoy.config.listener.v3.Listener"
name: envoy-gateway-system/ingress-gateway/https-aweu-cmk-p-02
operation:
op: add
jsonPath: $.filter_chains[0].filters[?(@.name == 'envoy.filters.network.http_connection_manager')].typed_config.http_filters
path: "/0"
value:
name: envoy.filters.http.header_to_metadata
typed_config:
"@type": "type.googleapis.com/envoy.extensions.filters.http.header_to_metadata.v3.Config"
request_rules:
- on_header_present:
metadata_namespace: "envoy.extensions.filters.listener.tls_inspector"
key: "ja4_hash"
value: "X-JA4-Fingerprint2"
- on_header_missing:
metadata_namespace: "envoy.extensions.filters.listener.tls_inspector"
key: "ja4_hash"
value: "X-JA4-Fingerprint2"
- type: "type.googleapis.com/envoy.config.route.v3.RouteConfiguration"
name: envoy-gateway-system/ingress-gateway/https-aweu-cmk-p-02
operation:
op: add
jsonPath: $.virtual_hosts[?(@.name == 'envoy-gateway-system/ingress-gateway/https-aweu-cmk-p-02/ing_aweu-cmk-p-02_cmks')].routes[?(@.name == 'httproute/envoy-gateway-system/echoserver-http-route/rule/0/match/0/ing_aweu-cmk-p-02_cmks')]
path: "/request_headers_to_add/-"
value:
header:
key: "X-JA4-Fingerprint"
value: "%DYNAMIC_METADATA(envoy.extensions.filters.listener.tls_inspector:ja4_hash)%"
append_action: APPEND_IF_EXISTS_OR_ADD
```

Both Patches were applied wth success according to the CRD status, but checking the ingress gateway full Envoy configuration, the second patch configuration is missing!

1. Why are the patches applied after being wiped out (might be that reconciliation does overwrite the patch ...)?
2. How should the ja4_fingerprinting be injected as a header and propagated further?

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.