feat: api for credential injector http filter by zhaohuabing · Pull Request #27769 · envoyproxy/envoy

zhaohuabing · 2023-06-02T08:33:15Z

API for the credential injector HTTP filter.

Note: based on feedback in the comments, the original PR has been split into multiple PRs, this one only contains APIs so it would be easier to review. The implementations of the Credential Injector Filter and Extensions will be in follow-up PRs.

Commit Message: add API for the credential injector HTTP filter.

Additional Description:
The credential injector HTTP filter serves the purpose of injecting credentials into outgoing HTTP requests. At present, the filter configuration is used to retrieve the credentials, or they can be requested through the OAuth2 client credential grant. Furthermore, it has the potential to support additional credential sources in the future, such as the OAuth2 resource owner password credentials grant , STS, etc. The credentials obtained are then injected into the Authorization header of the proxied HTTP requests, utilizing either the Basic or Bearer scheme.

Notice: This filter is intended to be used for workload authentication, which means that the identity associated with the inserted credential is considered as the identity of the workload behind the envoy proxy(in this case, envoy is typically deployed as a sidecar alongside that workload). Please note that this filter does not handle end user authentication. Its purpose is solely to authenticate the workload itself.

Sponsor: @kyessenov kindly offered to be the sponsor of this new filter.

Risk Level: low
Testing: no, only APIs, testing will be in follow-up PRs with implementation.
Docs Changes: yes
Release Notes: no
Platform Specific Features: No
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]

generic, can be used to inject a custom credential in any specified header

          http_filters:
          - name: envoy.filters.http.credential_injector
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.credential_injector.v3.CredentialInjector
              overwrite: false
              credential:
                name:  custom_credential      
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.credentials.generic.v3.Generic
                  header: my_custom_credential_header // default "Authorization"
                  credential:
                    name: my_credential
                    sds_config:
                      path_config_source:
                        path: /home/ubuntu/credential.yaml

basic auth, used to inject HTTP basic auth credential(username password)

          http_filters:
          - name: envoy.filters.http.credential_injector
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.credential_injector.v3.CredentialInjector
              overwrite: false
              credential:
                name: basic_auth      
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.credentials.basic_auth.v3.BasicAuth
                  username: test
                  password:
                    name: password
                    sds_config:
                      path_config_source:
                        path: /home/ubuntu/password.yaml

bearer token, used to inject HTTP bearer token

          http_filters:
          - name: envoy.filters.http.credential_injector
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.credential_injector.v3.CredentialInjector
              overwrite: false
              credential:
                name: bearer_token      
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.credentials.bearer_token.v3.BearerToken
                  bearer_token:
                    name: bearer_token
                    sds_config:
                      path_config_source:
                        path: /home/ubuntu/bearer_token.yaml

oauth2, used to get token via oauth2 client credentials grant and inject it into the http header

          http_filters:
          - name: envoy.filters.http.credential_injector
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.credential_injector.v3.CredentialInjector
              overwrite: false
              credential:
                name: oauth2      
                typed_config:
                  "@type": type.googleapis.com/envoy.extensions.credentials.oauth2.v3.OAuth2
                  token_endpoint: https://foo.bar.com/oauth
                  client_credentials:
                    client_id: my_client_id
                    client_secret: 
                       name: client_secret
                      sds_config:
                       ..... //omitted for brevity

repokitteh-read-only · 2023-06-02T08:33:25Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @lizan
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

🐱

Caused by: #27769 was opened by zhaohuabing.

see: more, trace.

api/envoy/extensions/filters/http/credential_injector/v3alpha/credential_injector.proto

zhaohuabing · 2023-06-09T03:15:10Z

Need help here. Precheck protobuf failed but the log doesn't give explicit reasons.
https://dev.azure.com/cncf/envoy/_build/results?buildId=139531&view=logs&j=c95d62a5-6bb9-58f0-2a02-7575fd482a15&t=76c9b3e6-0d40-57e9-06f3-2219e9228a0a

api/envoy/extensions/filters/http/credential_injector/v3/credential_injector.proto

KBaichoo · 2023-06-13T14:42:31Z

ping @lizan on api
ping @kyessenov if there's additional review

kyessenov

Looks fine to me. Need API reviewers feedback.

api/envoy/extensions/filters/http/credential_injector/v3/credential_injector.proto

lizan

This is in good direction, do you have a draft for the implementation so I can refer for those API?

api/envoy/extensions/filters/http/credential_injector/v3/credential_injector.proto

zhaohuabing · 2023-06-17T12:19:18Z

Yes, we do have a draft implementation internally, but the API is a bit different than this one and the functionality has not been fully finished yet. If it's needed, I can create another pr in draft. @lizan

…

On Sat, Jun 17, 2023, 00:58 Lizan Zhou ***@***.***> wrote: ***@***.**** commented on this pull request. This is in good direction, do you have a draft for the implementation so I can refer for those API? — Reply to this email directly, view it on GitHub <#27769 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAKCWISORBCLCBRMLGLUKYLXLSGFDANCNFSM6AAAAAAYX76XOQ> . You are receiving this because you authored the thread.Message ID: ***@***.***>

zhaohuabing · 2023-06-17T12:21:43Z

A matcher might be useful but it's not blocking since even the credentials are added to every outgoing requests, it won't be any problems.

…

On Sat, Jun 17, 2023, 10:57 Vikas Choudhary (vikasc) < ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In api/envoy/extensions/filters/http/credential_injector/v3/credential_injector.proto <#27769 (comment)>: > +import "validate/validate.proto"; + +option java_package = "io.envoyproxy.envoy.extensions.filters.http.credential_injector.v3"; +option java_outer_classname = "CredentialInjectorProto"; +option java_multiple_files = true; +option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/credential_injector/v3;credential_injectorv3"; +option (udpa.annotations.file_status).package_version_status = ACTIVE; +option (xds.annotations.v3.file_status).work_in_progress = true; + +// [#protodoc-title: Credential Injector] +// [#not-implemented-hide:] +// Credential Injector :ref:`configuration overview <config_http_filters_credential_injector>`. +// [#extension: envoy.filters.http.credential_injector] + +// Filter config. +message CredentialInjector { Hi @zhaohuabing <https://github.com/zhaohuabing> , should we support matcher as well so that filter can inject credentials only the matched requests? — Reply to this email directly, view it on GitHub <#27769 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAKCWIVVZ6PYKCNKREGW6QLXLUMJRANCNFSM6AAAAAAYX76XOQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

zhaohuabing · 2023-10-25T04:56:46Z

Looking at the implementation of these two injector and they are pretty similar. We should be able to refactor them into one similar implementation.

@lizan I moved the shared code from those extensions into the common directory to reduce redundancy. Does this address your concern?

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

wbpcode · 2023-10-26T03:13:32Z

I agree with @adisuissa's suggestion, this patch is huge and it would be better to split it to multiple different parts. Then we do more reasonable review.

And compared to implementation, we should try to figure out a final conclusion of the API first. Seems the discussion about the API has not ended.

wbpcode · 2023-10-26T03:15:12Z

/wait-any

zhaohuabing · 2023-10-26T07:30:20Z

/lgtm api

This looks much cleaner, thank you!

@wbpcode @adisuissa Thanks for your suggestion. We have already agreed on the APIs before I push implementations into this PR, please see the above discussion on the APIs.

If this is too big for review, I can split this into multiple PRs. This one is just for APIs, and Filter and Extensions implementation will be in follow-up PRs.

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

api/envoy/extensions/credentials/basic_auth/v3/basic_auth.proto

source/extensions/extensions_build_config.bzl

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

adisuissa

I think the directory name is confusing, as these are only credentials that are injected (not being fetched IIUC). Please change the directory name from api/envoy/extensions/credentials/ to api/envoy/extensions/injected_credentials/

api/envoy/extensions/credentials/generic/v3/generic.proto

api/envoy/extensions/filters/http/credential_injector/v3/credential_injector.proto

api/envoy/extensions/credentials/oauth2/v3/oauth2.proto

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

phlax · 2023-10-31T09:13:31Z

/docs

repokitteh-read-only · 2023-10-31T09:13:36Z

Docs for this Pull Request will be rendered here:

https://storage.googleapis.com/envoy-pr/27769/docs/index.html

The docs are (re-)rendered each time the CI envoy-presubmit (precheck docs) job completes.

🐱

Caused by: a #27769 (comment) was created by @phlax.

see: more, trace.

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

lizan

/lgtm api

defer to @adisuissa

kyessenov · 2023-11-02T17:42:51Z

/wait-any
for @adisuissa response

adisuissa

Ok, LGTM API. We can reiterate over the details as these are WIP.
Thanks!
/lgtm api

zhaohuabing · 2023-11-06T17:04:09Z

Thank guys for reviewing the PR and the help on the API!

Need your last help. How can I fix this to get this PR merged? I already added a new envoy.injected_credentials category in tools/extensions/extensions_schema.yaml.

Unable to find extension category:  envoy.injected_credentials

https://dev.azure.com/cncf/envoy/_build/results?buildId=154742&view=logs&j=9fd58ae0-0c50-56b1-f517-c2b9afda9c9b&t=f871f0ce-3dc6-5bd2-7916-5ec61dbe723c&l=138

As you suggested, the implementation of the credential injector and the generic credential extension will be in a follow-up PR soo after this PR gets merged.

api/envoy/extensions/filters/http/credential_injector/v3/credential_injector.proto

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

adisuissa

/lgtm api

repokitteh-read-only bot added the api label Jun 2, 2023

repokitteh-read-only bot assigned lizan Jun 2, 2023

zhaohuabing force-pushed the credential_injector_api branch 2 times, most recently from 91faebe to 3a6f1fe Compare June 2, 2023 09:29

zhaohuabing marked this pull request as draft June 2, 2023 09:48

yanavlasov assigned kyessenov Jun 2, 2023

zhaohuabing force-pushed the credential_injector_api branch 5 times, most recently from cb5ad8a to 3638f5e Compare June 3, 2023 15:05

zhaohuabing changed the title ~~API for the credential injector http filter~~ api: credential injector http filter Jun 3, 2023

zhaohuabing marked this pull request as ready for review June 6, 2023 01:42

kyessenov reviewed Jun 6, 2023

View reviewed changes

zhaohuabing force-pushed the credential_injector_api branch 2 times, most recently from 2b04b1b to 52ba2f7 Compare June 9, 2023 10:13

phlax reviewed Jun 9, 2023

View reviewed changes

api/envoy/extensions/filters/http/credential_injector/v3/credential_injector.proto Outdated Show resolved Hide resolved

zhaohuabing force-pushed the credential_injector_api branch 4 times, most recently from be739c8 to e6edf1d Compare June 10, 2023 04:24

kyessenov reviewed Jun 13, 2023

View reviewed changes

lizan reviewed Jun 16, 2023

View reviewed changes

vikaschoudhary16 reviewed Jun 17, 2023

View reviewed changes

api/envoy/extensions/filters/http/credential_injector/v3/credential_injector.proto Outdated Show resolved Hide resolved

vikaschoudhary16 mentioned this pull request Jun 19, 2023

Credentials Injector http filter extension implementation #28027

Closed

zhaohuabing added 2 commits October 25, 2023 02:17

address comment

e7ff00a

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

move shared code to common

28c28b0

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

make class variables const

926125a

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

remove implementation for review

666fabf

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

abeyad reviewed Oct 26, 2023

View reviewed changes

api/envoy/extensions/credentials/basic_auth/v3/basic_auth.proto Outdated Show resolved Hide resolved

source/extensions/extensions_build_config.bzl Outdated Show resolved Hide resolved

zhaohuabing added 5 commits October 30, 2023 15:07

remove basic auth and bearer token extensions

912a2d0

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

address comments

4edba7c

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

fix format

e54f9f4

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

fix format

ff9c3d0

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

fix proto format

dfe4e11

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

adisuissa reviewed Oct 30, 2023

View reviewed changes

zhaohuabing added 2 commits October 31, 2023 11:03

address comments

c1992b4

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

fix proto format

8b5f7e4

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

rename credentials to injected_credentials

c35d463

Signed-off-by: huabing zhao <zhaohuabing@gmail.com>

lizan reviewed Nov 1, 2023

View reviewed changes

zhaohuabing mentioned this pull request Nov 4, 2023

proposal: add a filter for injecting credentials into outgoing HTTP requests #21851

Open

adisuissa reviewed Nov 6, 2023

View reviewed changes

adisuissa reviewed Nov 8, 2023

View reviewed changes

api/envoy/extensions/filters/http/credential_injector/v3/credential_injector.proto Outdated Show resolved Hide resolved

remove extension-category for now

a874c78

Signed-off-by: Huabing Zhao <zhaohuabing@gmail.com>

adisuissa approved these changes Nov 9, 2023

View reviewed changes

adisuissa mentioned this pull request Nov 10, 2023

cleanup: udpa to xds naming fix in BUILD files #30826

Merged

zhaohuabing mentioned this pull request Nov 13, 2023

feat: credential injector impl #30850

Merged

Conversation

zhaohuabing commented Jun 2, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

repokitteh-read-only bot commented Jun 2, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

zhaohuabing commented Jun 9, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

KBaichoo commented Jun 13, 2023

Uh oh!

kyessenov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lizan left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

zhaohuabing commented Jun 17, 2023 via email • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zhaohuabing commented Jun 17, 2023 via email

Uh oh!

zhaohuabing commented Oct 25, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wbpcode commented Oct 26, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wbpcode commented Oct 26, 2023

Uh oh!

zhaohuabing commented Oct 26, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

adisuissa left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

phlax commented Oct 31, 2023

Uh oh!

repokitteh-read-only bot commented Oct 31, 2023

Uh oh!

lizan left a comment

Choose a reason for hiding this comment

Uh oh!

kyessenov commented Nov 2, 2023

Uh oh!

adisuissa left a comment

Choose a reason for hiding this comment

Uh oh!

zhaohuabing commented Nov 6, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

adisuissa left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants

zhaohuabing commented Jun 2, 2023 •

edited

Loading

zhaohuabing commented Jun 9, 2023 •

edited

Loading

zhaohuabing commented Jun 17, 2023 via email •

edited

Loading

zhaohuabing commented Oct 25, 2023 •

edited

Loading

wbpcode commented Oct 26, 2023 •

edited

Loading

zhaohuabing commented Oct 26, 2023 •

edited

Loading

zhaohuabing commented Nov 6, 2023 •

edited

Loading