proposal: add a filter for injecting credentials into outgoing HTTP requests #21851
Description
Title: Add a filter for injecting credentials into outgoing HTTP requests
Description:
It would be conventient to have a standard filter that can inject credentials into outgoing HTTP requests (as a value of Authorization header).
The most common use cases:
- OAuth2 access token credential
- basic auth credential
- opaque bearer token credential
The primary focus of this proposal is on injecting OAuth2 access token credential.
Proposal:
Add an HTTP filter with the following configuration model:
- name: envoy.filters.network.http_connection_manager
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
http_filters:
- name: envoy.filters.http.credentials
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.credentials.v3alpha.Injector
config:
rules:
- match:
... # HTTP requests to match
inject:
credential: { ... } # credential to injectIf the list of rules is empty, the filter will have no effect.
With regards to OAuth2 support:
- the filter will allow a user to specify
client_idandclient_password - and let filter to acquire OAuth2 access token through Client Credentials Grant flow
- the filter will also take care of refreshing access token
Usage examples:
Injecting OAuth2 access token
- name: envoy.filters.network.http_connection_manager
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
http_filters:
- name: envoy.filters.http.credentials
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.credentials.v3alpha.Injector
config:
rules:
- match:
prefix: /
inject:
credential:
oauth2:
token_endpoint:
cluster: oauth
uri: oauth.com/token
timeout: 3s
client_credentials:
client_id:
secret:
name: client-id
sds_config:
path: "/var/run/secret/credentials/oauth2/client-id.yaml"
client_password:
secret:
name: client-password
sds_config:
path: "/var/run/secret/credentials/oauth2/client-password.yaml"
# (Optional)
scopes:
- "example"Injecting basic auth credentials
- name: envoy.filters.network.http_connection_manager
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
http_filters:
- name: envoy.filters.http.credentials
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.credentials.v3alpha.Injector
config:
rules:
- match:
prefix: /
inject:
credential:
basic:
username:
secret:
name: username
sds_config:
path: "/var/run/secret/credentials/basic/username.yaml"
password:
secret:
name: password
sds_config:
path: "/var/run/secret/credentials/basic/password.yaml"Injecting opaque bearer token credential
- name: envoy.filters.network.http_connection_manager
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
http_filters:
- name: envoy.filters.http.credentials
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.credentials.v3alpha.Injector
config:
rules:
- match:
prefix: /
inject:
credential:
generic:
prefix: "Bearer "
value:
secret:
name: bearer-token
sds_config:
path: "/var/run/secret/credentials/generic/bearer-token.yaml"