Patching ExtAuthzPerRoute to sidecar's virtual host

1

I am using ExtAuthzPerRoute to send metadata to the ext_authz server.

The static config when using Envoy looks like this:

    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:  
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          route_config:
            virtual_hosts:
            - name: default
              domains: "*"
              typed_per_filter_config:
                envoy.filters.http.ext_authz:
                  "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
                  check_settings:
                    context_extensions:
                      key: value
              routes:
                 ...

Now I am trying to configure the same thing on an Istio sidecar with the following EnvoyFilter Patch:

...
- applyTo: VIRTUAL_HOST
    match:
      context: SIDECAR_INBOUND
      routeConfiguration:
        vhost:
          name: inbound|http|80
    patch:
      operation: MERGE
      value:
        per_filter_config:
          "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
          check_settings:
            context_extensions:
              key: value
...

but have had no success.

Any one has any insight on this? Thanks.

2

@Luwei_Ge did you get this working? I’m trying to do something similar and am having a hard time wrapping my head around it too.

3

Unfortunately no. And I haven’t tried it again for a while…

4

That’s a shame. Thanks for getting back to me though. Looks like what I need can possibly be done with AuthorizationPolicy, but the feature is only available from 1,9 forward and I’m still “stuck” on 1.8 :frowning: