K
Q

Is having an HTTP service as an external authorization service supported in istio?

1/3/2020

I have seen example for EnvoyFilter in ISTIO where grpc_service is supported as filterconfig for external service call out.

kind: EnvoyFilter
metadata:
  name: ext-authz
  namespace: istio-system
spec:
  filters:
  - insertPosition:
      index: FIRST
    listenerMatch:
      listenerType: SIDECAR_INBOUND
      listenerProtocol: HTTP
    filterType: HTTP
    filterName: "envoy.ext_authz"
    filterConfig:
      grpc_service:
        google_grpc:
          target_uri: 127.0.0.1:9191
          stat_prefix: "ext_authz"

But I want to use my external service as filterconfig using http_service instead of grpc_service but everytime I get 404 not found error.

Is http_service supported as filterConfig in Istio's envoyFilter?

version info : GKE is 14 and istio is 1.1.17

-- esha ingle
istio
kubernetes

Similar Questions

Can kubernetes resource request/limit definition slow down pods?
Why did I encounter an "Error syncing pod" with Dataflow pipeline?
How to bind gateway to a specific namespace?
Traefik Dashboard - custom API path

1 Answer

1/3/2020

Update: modified entire answer.

After further verification it appears that Istio had http_service authorization service in the past it was not fully functional.

There were attempts to implement external HTTP service authorization for older versions of Istio, however it did work and the only workaround solutions were to use http lua filter or Nginx-Ingress Controller as Ingress Gateway that delegates the authentication part.

All of above cases can be found in this github issue. The HTTP call was successful but the headers were not being passed.

Here is another attempt in running http_service as authorization service.

As You noticed the Envoy documentation for Envoy 1.11.0 http_service filterConfig has different syntax. Therefore I suggest trying the configuration for filter from the github issue. And if It doesnt't work, try the http lua filter as a workaround.

The HTTP service as an external authorization service its not mentioned in Istio documentation so, I think its safe to say its not fully supported.

-- Piotr Malec
Source: StackOverflow