{
"configs": [
{
"@type": "type.googleapis.com/envoy.admin.v2alpha.BootstrapConfigDump",
"bootstrap": {
"node": {
"build_version": "8f2515a19bdcc75bea0bfd7016231a7661d0be6e/1.12.2/Clean/RELEASE/BoringSSL"
},
"static_resources": {
"listeners": [
{
"address": {
"socket_address": {
"address": "0.0.0.0",
"port_value": 10002
}
},
"filter_chains": [
{
"filters": [
{
"name": "envoy.http_connection_manager",
"typed_config": {
"@type": "type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager",
"route_config": {
"virtual_hosts": [
{
"routes": [
{
"route": {
"cluster": "backend_cluster"
},
"match": {
"prefix": "/"
}
}
],
"name": "service",
"domains": [
"*"
]
}
],
"name": "satellite_route"
},
"http_filters": [
{
"config": {
"clear_route_cache": true,
"grpc_service": {
"envoy_grpc": {
"cluster_name": "extauthz_cluster"
}
},
"with_request_body": {
"allow_partial_message": false,
"max_request_bytes": 5000000
}
},
"name": "envoy.ext_authz"
},
{
"typed_config": {
"@type": "type.googleapis.com/envoy.config.filter.http.router.v2.Router",
"start_child_span": true
},
"name": "envoy.router"
}
],
"access_log": [
{
"typed_config": {
"@type": "type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog",
"path": "/dev/stdout"
},
"name": "envoy.file_access_log"
}
],
"stat_prefix": "ingress",
"codec_type": "AUTO"
}
}
],
"transport_socket": {
"name": "envoy.transport_sockets.tls",
"typed_config": {
"@type": "type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext",
"common_tls_context": {
"tls_certificates": [
{
"private_key": {
"filename": "certs/example.key.pem"
},
"certificate_chain": {
"filename": "certs/example.bundle.pem"
}
}
]
}
}
}
}
]
}
],
"clusters": [
{
"name": "extauthz_cluster",
"type": "STRICT_DNS",
"connect_timeout": "15s",
"hosts": [
{
"socket_address": {
"address": "host.docker.internal",
"port_value": 9123
}
}
]
},
{
"name": "backend_cluster",
"type": "STRICT_DNS",
"connect_timeout": "15s",
"hosts": [
{
"socket_address": {
"address": "host.docker.internal",
"port_value": 9998
}
}
],
"http2_protocol_options": {}
}
]
},
"admin": {
"access_log_path": "/dev/stdout",
"address": {
"socket_address": {
"address": "0.0.0.0",
"port_value": 9901
}
}
}
},
"last_updated": "2020-01-24T17:28:38.540Z"
},
{
"@type": "type.googleapis.com/envoy.admin.v2alpha.ClustersConfigDump",
"static_clusters": [
{
"cluster": {
"name": "backend_cluster",
"type": "STRICT_DNS",
"connect_timeout": "15s",
"hosts": [
{
"socket_address": {
"address": "host.docker.internal",
"port_value": 9998
}
}
],
"http2_protocol_options": {}
},
"last_updated": "2020-01-24T17:28:38.546Z"
},
{
"cluster": {
"name": "extauthz_cluster",
"type": "STRICT_DNS",
"connect_timeout": "15s",
"hosts": [
{
"socket_address": {
"address": "host.docker.internal",
"port_value": 9123
}
}
]
},
"last_updated": "2020-01-24T17:28:38.544Z"
}
]
},
{
"@type": "type.googleapis.com/envoy.admin.v2alpha.ListenersConfigDump",
"static_listeners": [
{
"listener": {
"address": {
"socket_address": {
"address": "0.0.0.0",
"port_value": 10002
}
},
"filter_chains": [
{
"filters": [
{
"name": "envoy.http_connection_manager",
"typed_config": {
"@type": "type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager",
"route_config": {
"virtual_hosts": [
{
"routes": [
{
"route": {
"cluster": "backend_cluster"
},
"match": {
"prefix": "/"
}
}
],
"name": "service",
"domains": [
"*"
]
}
],
"name": "satellite_route"
},
"http_filters": [
{
"config": {
"clear_route_cache": true,
"grpc_service": {
"envoy_grpc": {
"cluster_name": "extauthz_cluster"
}
},
"with_request_body": {
"allow_partial_message": false,
"max_request_bytes": 5000000
}
},
"name": "envoy.ext_authz"
},
{
"typed_config": {
"@type": "type.googleapis.com/envoy.config.filter.http.router.v2.Router",
"start_child_span": true
},
"name": "envoy.router"
}
],
"access_log": [
{
"typed_config": {
"@type": "type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog",
"path": "/dev/stdout"
},
"name": "envoy.file_access_log"
}
],
"stat_prefix": "ingress",
"codec_type": "AUTO"
}
}
],
"transport_socket": {
"name": "envoy.transport_sockets.tls",
"typed_config": {
"@type": "type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext",
"common_tls_context": {
"tls_certificates": [
{
"private_key": {
"filename": "certs/example.key.pem"
},
"certificate_chain": {
"filename": "certs/example.bundle.pem"
}
}
]
}
}
}
}
]
},
"last_updated": "2020-01-24T17:28:38.569Z"
}
]
},
{
"@type": "type.googleapis.com/envoy.admin.v2alpha.ScopedRoutesConfigDump"
},
{
"@type": "type.googleapis.com/envoy.admin.v2alpha.RoutesConfigDump",
"static_route_configs": [
{
"route_config": {
"name": "satellite_route",
"virtual_hosts": [
{
"name": "service",
"domains": [
"*"
],
"routes": [
{
"match": {
"prefix": "/"
},
"route": {
"cluster": "backend_cluster"
}
}
]
}
]
},
"last_updated": "2020-01-24T17:28:38.566Z"
}
]
},
{
"@type": "type.googleapis.com/envoy.admin.v2alpha.SecretsConfigDump"
}
]
}
Description:
Hello! I'm trying to use the
extauthzfilter with thewith_request_bodyoption and am running into issues. Specifically, I am trying to forward the body of an incoming GRPC request to an external auth service (so that it can decode the GRPC body and perform auth as necessary). When I do this, I am seeing the following error in the envoy logs:I expected the
extauthzfilter to be totally agnostic to the format of the underlying request body that it was forwarding but it seems that it can only send UTF-8 data. My current workaround is using theluafilter instead of theextauthzone.I suspect that this is the result of how the proto is defined here
envoy/api/envoy/service/auth/v2/attribute_context.proto
Line 131 in 062c895
Repro steps:
This same error can be reproduced more simply by issuing a curl request with binary data.
which yields in the logs:
If I run the same command without binary data
I don't get the error message, just the UAEX access log (which is expected)
Logs and other output
/clusters : Click to expand!
/stats : Click to expand!
/server_info : Click to expand!
/config_dump : Click to expand!
Logs : Click to expand!