header-to-metadata: add support for regex substitutions

api/envoy/extensions/filters/http/header_to_metadata/v3/BUILD

@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/config/filter/http/header_to_metadata/v2:pkg",
+        "//envoy/type/matcher/v3:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
     ],
 )

api/envoy/extensions/filters/http/header_to_metadata/v3/header_to_metadata.proto

@@ -2,6 +2,9 @@ syntax = "proto3";
 
 package envoy.extensions.filters.http.header_to_metadata.v3;
 
+import "envoy/type/matcher/v3/regex.proto";
+
+import "udpa/annotations/migrate.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -44,7 +47,7 @@ message Config {
     BASE64 = 1;
   }
 
-  // [#next-free-field: 6]
+  // [#next-free-field: 7]
   message KeyValuePair {
     option (udpa.annotations.versioning).previous_message_type =
         "envoy.config.filter.http.header_to_metadata.v2.Config.KeyValuePair";
@@ -57,12 +60,22 @@ message Config {
 
     // The value to pair with the given key.
     //
-    // When used for a `on_header_present` case, if value is non-empty it'll be used
-    // instead of the header value. If both are empty, no metadata is added.
+    // When used for a
+    // :ref:`on_header_present <envoy_v3_api_field_extensions.filters.http.header_to_metadata.v3.Config.Rule.on_header_present>`
+    // case, if value is non-empty it'll be used instead of the header value. If both are empty, no metadata is added.
+    //
+    // When used for a :ref:`on_header_missing <envoy_v3_api_field_extensions.filters.http.header_to_metadata.v3.Config.Rule.on_header_missing>`
+    // case, a non-empty value must be provided otherwise no metadata is added.
+    string value = 3 [(udpa.annotations.field_migrate).oneof_promotion = "value_type"];
+
+    // If present, the header's value will be matched and substituted with this. If there is no match or substitution, the header value
+    // is used as-is.
+    //
+    // This is only used for :ref:`on_header_present <envoy_v3_api_field_extensions.filters.http.header_to_metadata.v3.Config.Rule.on_header_present>`.
     //
-    // When used for a `on_header_missing` case, a non-empty value must be provided
-    // otherwise no metadata is added.
-    string value = 3;
+    // Note: if the `value` field is non-empty this field should be empty.
+    type.matcher.v3.RegexMatchAndSubstitute regex_value_rewrite = 6
+        [(udpa.annotations.field_migrate).oneof_promotion = "value_type"];
 
     // The value's type — defaults to string.
     ValueType type = 4;

docs/root/configuration/http/http_filters/header_to_metadata_filter.rst

@@ -60,6 +60,26 @@ This would then allow requests with the `x-version` header set to be matched aga
 endpoints with the corresponding version. Whereas requests with that header missing
 would be matched with the default endpoints.
 
+If the header's value needs to be transformed before it's added to the request as
+dynamic metadata, this filter supports regex matching and substitution:
+
+.. code-block:: yaml
+
+  http_filters:
+    - name: envoy.filters.http.header_to_metadata
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.filters.http.header_to_metadata.v3.Config
+        request_rules:
+          - header: ":path"
+            on_header_present:
+              metadata_namespace: envoy.lb
+              key: cluster
+              regex_value_rewrite:
+                pattern:
+                  google_re2: {}
+                  regex: "^/(cluster[\\d\\w-]+)/?.*$"
+                substitution: "\\1"
+
 Note that this filter also supports per route configuration:
 
 .. code-block:: yaml

docs/root/version_history/current.rst

@@ -14,6 +14,7 @@ Minor Behavior Changes
 
 * access loggers: applied existing buffer limits to access logs, as well as :ref:`stats <config_access_log_stats>` for logged / dropped logs. This can be reverted temporarily by setting runtime feature `envoy.reloadable_features.disallow_unbounded_access_logs` to false.
 * build: run as non-root inside Docker containers. Existing behaviour can be restored by setting the environment variable `ENVOY_UID` to `0`. `ENVOY_UID` and `ENVOY_GID` can be used to set the envoy user's `uid` and `gid` respectively.
+* header to metadata: on_header_missing rules with empty values are now rejected (they were skipped before).
 * health check: in the health check filter the :ref:`percentage of healthy servers in upstream clusters <envoy_api_field_config.filter.http.health_check.v2.HealthCheck.cluster_min_healthy_percentages>` is now interpreted as an integer.
 * hot restart: added the option :option:`--use-dynamic-base-id` to select an unused base ID at startup and the option :option:`--base-id-path` to write the base id to a file (for reuse with later hot restarts).
 * http: changed early error path for HTTP/1.1 so that responses consistently flow through the http connection manager, and the http filter chains. This behavior may be temporarily reverted by setting runtime feature `envoy.reloadable_features.early_errors_via_hcm` to false.
@@ -86,6 +87,7 @@ New Features
 * grpc-json: send a `x-envoy-original-method` header to grpc services.
 * gzip filter: added option to set zlib's next output buffer size.
 * hds: updated to allow to explicitly set the API version of gRPC service endpoint and message to be used.
+* header to metadata: added support for regex substitutions on header values.
 * health checks: allow configuring health check transport sockets by specifying :ref:`transport socket match criteria <envoy_v3_api_field_config.core.v3.HealthCheck.transport_socket_match_criteria>`.
 * http: added :ref:`local_reply config <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.local_reply_config>` to http_connection_manager to customize :ref:`local reply <config_http_conn_man_local_reply>`.
 * http: added :ref:`stripping port from host header <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.strip_matching_host_port>` support.