ext_authz: add grpc_service field on the per-route filter by agrawroh · Pull Request #40169 · envoyproxy/envoy

agrawroh · 2025-07-09T16:42:57Z

Description

This PR adds support for per-route gRPC service override in the ext_authz HTTP filter, allowing different routes to use different external authorization backends. Routes would now be able to specify a different authorization service by configuring grpc_service in the per-route check_settings.

Commit Message: ext_authz: add grpc_service field on the per-route filter
Additional Description: Add a new grpc_service field on the per-route ExtAuthZ filter to be able to override the AuthService backend on a per-route basis.
Risk Level: Low
Testing: Added Unit & Integration Tests
Docs Changes: Added
Release Notes: Added

repokitteh-read-only · 2025-07-09T16:43:03Z

As a reminder, PRs marked as draft will not be automatically assigned reviewers,
or be handled by maintainer-oncall triage.

Please mark your PR as ready when you want it to be reviewed!

🐱

Caused by: #40169 was opened by agrawroh.

see: more, trace.

repokitteh-read-only · 2025-07-09T16:43:08Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @wbpcode
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

🐱

Caused by: #40169 was opened by agrawroh.

see: more, trace.

agrawroh · 2025-07-09T21:05:42Z

/retest

mathetake

Generally I agree this would be useful, but I wonder if this would come with a security implication. If the route-recalculating filter comes after this per-route ext_authz, then it can somehow bypass the authz for a specific route. For example, let's say we have two routes A and B and each one has its own authz server. When a request comes in, say, route A got selected. Then ext_authz filter does the auth logic for that route A. Then some filter after authz change clears the route cache and then changes the destination route to route B. That means the request bypasses the auth for route B by using auth for route A.

I am not saying that this would be common thing but i guess at least we should document this implication?

agrawroh · 2025-07-12T17:19:44Z

Generally I agree this would be useful, but I wonder if this would come with a security implication. If the route-recalculating filter comes after this per-route ext_authz, then it can somehow bypass the authz for a specific route. For example, let's say we have two routes A and B and each one has its own authz server. When a request comes in, say, route A got selected. Then ext_authz filter does the auth logic for that route A. Then some filter after authz change clears the route cache and then changes the destination route to route B. That means the request bypasses the auth for route B by using auth for route A.

I am not saying that this would be common thing but i guess at least we should document this implication?

Thanks, @mathetake. It's a great point and I agree that we should document it.

The scenario you described also exists today as technically an incoming request can match on a Route A with per-route ExtAuthZ override to disable the filter, clear the route cache using LUA in a subsequent filter and make it match on a Route B which requires ExtAuthZ. Same risk of privilege escalation.

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

wbpcode

Thanks for this new feature. One comment to start the review.

wbpcode · 2025-07-15T02:16:48Z

api/envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto

+
+  // Set a different gRPC service for this route than the default.
+  // This allows different routes to use different external authorization service backends.
+  //
+  // .. note::
+  //
+  //   This setting is only applied to a filter configured with a
+  //   :ref:`grpc_service<envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.grpc_service>`.
+  //   If the filter is configured with an ``http_service``, this field is ignored.
+  config.core.v3.GrpcService grpc_service = 4;


Could we support http_service override here also? Thanks.

@wbpcode Yes, i think we can support HTTP as well. We internally use gRPC and have this use-case so I started with gRPC first. I can create a follow-up for HTTP next if that sounds good.

I think the behavior may be unexpected? From you comment of API, the grpc_service will only override the filter level grpc_service. But we may expect it override any http_service or http_service?

wbpcode · 2025-07-15T02:17:17Z

/wait

…ster

wbpcode

Thanks for the contribution and I add some comments to both API and the impl. :)

wbpcode · 2025-07-29T15:38:01Z

api/envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto

+
+  // Set a different gRPC service for this route than the default.
+  // This allows different routes to use different external authorization service backends.
+  //
+  // .. note::
+  //
+  //   This setting is only applied to a filter configured with a
+  //   :ref:`grpc_service<envoy_v3_api_field_extensions.filters.http.ext_authz.v3.ExtAuthz.grpc_service>`.
+  //   If the filter is configured with an ``http_service``, this field is ignored.
+  config.core.v3.GrpcService grpc_service = 4;


I think the behavior may be unexpected? From you comment of API, the grpc_service will only override the filter level grpc_service. But we may expect it override any http_service or http_service?

source/extensions/filters/http/ext_authz/ext_authz.cc

…ster

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

phlax · 2025-08-05T14:07:49Z

@agrawroh needs main merge

looks like this will have to wait for further review from @wbpcode

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

wbpcode

Thanks for your update. And some comments are added.

/lgtm api

changelogs/current.yaml

source/extensions/filters/http/ext_authz/ext_authz.cc

…ster

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

wbpcode

Thanks for the update. Overall is fine. I actually have a thought, but up to you. May be we cann create a function to load the configuration (grpc_service, http_service, encode_raw_headers) then return a lambda. This lambda will create a client instance when it's executed. Then, the config and per route config could share the tool function.

That would make our code much simple to read and may have better performance because avoiding unnecessary copies (although doesn't matter because the network consume the largest time)

changelogs/current.yaml

wbpcode · 2025-08-09T03:22:18Z

source/extensions/filters/http/ext_authz/ext_authz.cc

+  // Create a temporary ExtAuthz config with the HTTP service for the ClientConfig constructor.
+  envoy::extensions::filters::http::ext_authz::v3::ExtAuthz temp_config;
+  temp_config.mutable_http_service()->CopyFrom(http_service);


I think maybe we should update the constructor of ClientConfig to accept HttpService only to avoid the this copy. But it's not in a hurry. The auth is slow anyway.

source/extensions/filters/http/ext_authz/ext_authz.cc

source/extensions/filters/http/ext_authz/ext_authz.h

wbpcode · 2025-08-09T03:30:27Z

/wait

…ster

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

wbpcode

LGTM. Thanks.

antoniovleonti · 2025-08-22T19:20:33Z

I'm seeing ext_authz_test failures on #40811 and #40650 that are not related to my PR, can you check if they're related to this change?

antoniovleonti · 2025-08-22T19:22:53Z

The failing test is ParameterizedFilterConfig/HttpFilterTestParam.PerRouteConfigurationIntegrationTest/FailClosed_GrpcClient, gotta be related right?

…voyproxy#40169)" This reverts commit 8c03b2a.

…voyproxy#40169)" This reverts commit 8c03b2a. Signed-off-by: Ryan Northey <ryan@synca.io>

…#40169) ## Description This PR adds support for per-route gRPC service override in the `ext_authz` HTTP filter, allowing different routes to use different external authorization backends. Routes would now be able to specify a different authorization service by configuring `grpc_service` in the per-route `check_settings`. --- Commit Message: ext_authz: add grpc_service field on the per-route filter Additional Description: Add a new `grpc_service` field on the per-route ExtAuthZ filter to be able to override the AuthService backend on a per-route basis. Risk Level: Low Testing: Added Unit & Integration Tests Docs Changes: Added Release Notes: Added --------- Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com> Signed-off-by: Melissa Ginaldi <mginaldi@google.com>

…#40169) ## Description This PR adds support for per-route gRPC service override in the `ext_authz` HTTP filter, allowing different routes to use different external authorization backends. Routes would now be able to specify a different authorization service by configuring `grpc_service` in the per-route `check_settings`. --- Commit Message: ext_authz: add grpc_service field on the per-route filter Additional Description: Add a new `grpc_service` field on the per-route ExtAuthZ filter to be able to override the AuthService backend on a per-route basis. Risk Level: Low Testing: Added Unit & Integration Tests Docs Changes: Added Release Notes: Added --------- Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

repokitteh-read-only bot added the api label Jul 9, 2025

repokitteh-read-only bot assigned wbpcode Jul 9, 2025

agrawroh force-pushed the ext-authz-cluster branch from 0f6aadb to cad4ca6 Compare July 9, 2025 20:33

agrawroh force-pushed the ext-authz-cluster branch 5 times, most recently from 1aa7326 to c9b2026 Compare July 10, 2025 07:35

agrawroh marked this pull request as ready for review July 10, 2025 08:44

agrawroh requested review from ggreenway and tyxia as code owners July 10, 2025 08:44

mathetake reviewed Jul 11, 2025

View reviewed changes

ext_authz: add grpc_service field on the per-route filter

465e6a6

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

agrawroh force-pushed the ext-authz-cluster branch from c9b2026 to 465e6a6 Compare July 14, 2025 23:57

wbpcode reviewed Jul 15, 2025

View reviewed changes

repokitteh-read-only bot added the waiting label Jul 15, 2025

Merge branch 'main' of github.com:envoyproxy/envoy into ext-authz-clu…

a6bfc33

…ster

repokitteh-read-only bot removed the waiting label Jul 23, 2025

wbpcode reviewed Jul 29, 2025

View reviewed changes

agrawroh added 2 commits July 31, 2025 21:05

Merge branch 'main' of github.com:envoyproxy/envoy into ext-authz-clu…

713548d

…ster

addressed comments from @wbpcode

bb0fd60

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

agrawroh requested a review from wbpcode August 1, 2025 04:41

fixes

18bb804

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

Merge branch 'main' into ext-authz-cluster

03ec656

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

wbpcode reviewed Aug 7, 2025

View reviewed changes

changelogs/current.yaml Show resolved Hide resolved

source/extensions/filters/http/ext_authz/ext_authz.cc Show resolved Hide resolved

source/extensions/filters/http/ext_authz/ext_authz.cc Show resolved Hide resolved

repokitteh-read-only bot removed the api label Aug 7, 2025

agrawroh added 2 commits August 7, 2025 14:08

Merge branch 'main' of github.com:envoyproxy/envoy into ext-authz-clu…

8fcd7b1

…ster

addressed comments from @wbpcode

6b71150

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

agrawroh requested a review from wbpcode August 7, 2025 21:24

agrawroh added 3 commits August 7, 2025 14:25

fix

d921670

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

fix

25bab2d

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

add tests

7ffdadb

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

wbpcode reviewed Aug 9, 2025

View reviewed changes

repokitteh-read-only bot added the waiting label Aug 9, 2025

agrawroh added 2 commits August 15, 2025 01:04

Merge branch 'main' of github.com:envoyproxy/envoy into ext-authz-clu…

56f0983

…ster

addressed comments from @wbpcode

63d75e3

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

repokitteh-read-only bot removed the waiting label Aug 15, 2025

agrawroh added 4 commits August 15, 2025 01:40

fixes

7a65cea

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

fixes

00d5cb9

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

fixes

f5ea213

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

Merge branch 'main' into ext-authz-cluster

0b87c69

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>

wbpcode approved these changes Aug 22, 2025

View reviewed changes

agrawroh merged commit 8c03b2a into envoyproxy:main Aug 22, 2025
25 checks passed

phlax added a commit to phlax/envoy that referenced this pull request Aug 23, 2025

Revert "ext_authz: add grpc_service field on the per-route filter (en…

64e7d50

…voyproxy#40169)" This reverts commit 8c03b2a.

phlax added a commit to phlax/envoy that referenced this pull request Aug 23, 2025

Revert "ext_authz: add grpc_service field on the per-route filter (en…

e592c9d

…voyproxy#40169)" This reverts commit 8c03b2a. Signed-off-by: Ryan Northey <ryan@synca.io>

Pawan-Bishnoi mentioned this pull request Aug 23, 2025

rate-limit - add unit_multiplier #40830

Closed

Conversation

agrawroh commented Jul 9, 2025

Description

Uh oh!

repokitteh-read-only bot commented Jul 9, 2025

Uh oh!

repokitteh-read-only bot commented Jul 9, 2025

Uh oh!

agrawroh commented Jul 9, 2025

Uh oh!

mathetake left a comment

Choose a reason for hiding this comment

Uh oh!

agrawroh commented Jul 12, 2025

Uh oh!

wbpcode left a comment

Choose a reason for hiding this comment

Uh oh!

wbpcode Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

agrawroh Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

wbpcode Jul 29, 2025

Choose a reason for hiding this comment

Uh oh!

wbpcode commented Jul 15, 2025

Uh oh!

wbpcode left a comment

Choose a reason for hiding this comment

Uh oh!

wbpcode Jul 29, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

phlax commented Aug 5, 2025

Uh oh!

wbpcode left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wbpcode left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

wbpcode Aug 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

wbpcode commented Aug 9, 2025

Uh oh!

wbpcode left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

antoniovleonti commented Aug 22, 2025

Uh oh!

antoniovleonti commented Aug 22, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants