apply ExtAuthz configuration to direct response routes #5962

shadialtarsha · 2023-11-14T14:22:24Z

Currently, disabling external auth on direct responses doesn't work because we handle the case of direct responses in a different branch of the code while creating the Envoy route.

This PR fixes this bug.

P.S: For rate limiting it turns out it is an issue because direct responses don't care about the rate limit filter. I added tests to confirm that as well.

internal/envoy/v3/route.go

codecov · 2023-11-14T14:30:13Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (dba50bc) 78.56% compared to head (aebe4fa) 78.57%.
Report is 40 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5962   +/-   ##
=======================================
  Coverage   78.56%   78.57%           
=======================================
  Files         139      139           
  Lines       19615    19623    +8     
=======================================
+ Hits        15411    15419    +8     
  Misses       3901     3901           
  Partials      303      303

Files	Coverage Δ
internal/envoy/v3/route.go	`80.67% <100.00%> (+0.19%)`	⬆️

davinci26

can we add release note as well? Or mark the pr as not need one

shadialtarsha · 2023-11-14T16:01:35Z

@davinci26 I don't have permissions to do that

davinci26 · 2023-11-14T16:04:20Z

@shadialtarsha done

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

github-actions · 2023-11-29T00:20:06Z

The Contour project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 14d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, the PR is closed

You can:

Ensure your PR is passing all CI checks. PRs that are fully green are more likely to be reviewed. If you are having trouble with CI checks, reach out to the #contour channel in the Kubernetes Slack workspace.
Mark this PR as fresh by commenting or pushing a commit
Close this PR
Offer to help out with triage

Please send feedback to the #contour channel in the Kubernetes Slack

shadialtarsha · 2023-12-08T21:12:59Z

Still fresh

internal/envoy/v3/route.go

sunjayBhatia · 2023-12-11T22:28:43Z

changelogs/unreleased/5962-shadialtarsha-small.md

@@ -0,0 +1,2 @@
+## Configure TypedPerFilterConfig with direct responses


nit: since this is a small change, can make this a single line with no title

something like Fixes bug where external authorization configuration was ignored on HTTPRoute rules configured with direct responses.

sunjayBhatia · 2023-12-11T22:32:43Z

test/e2e/httpproxy/external_auth_test.go

+
+		f.Certs.CreateSelfSignedCert(namespace, "testserver-cert", "testserver-cert", "testserver")
+
+		// auth testserver


looks like we can pull all this setup logic into a BeforeEach in httpproxy_test.go and use it for existing tests as well?

sunjayBhatia · 2023-12-11T22:34:08Z

test/e2e/httpproxy/external_auth_test.go

@@ -283,4 +283,232 @@ func testExternalAuth(namespace string) {
 		assert.Equal(t, "default", body.RequestHeaders.Get("Auth-Context-Target"))
 		assert.Equal(t, "externalauth.projectcontour.io", body.RequestHeaders.Get("Auth-Context-Hostname"))
 	})
+
+	Specify("external auth can be configured on a direct response route", func() {


lets move this one into its own namespacedtest wrapper for debugability

sunjayBhatia · 2023-12-11T22:36:09Z

test/e2e/httpproxy/external_auth_test.go

+							Disabled: true,
+						},
+						DirectResponsePolicy: &contourv1.HTTPDirectResponsePolicy{
+							StatusCode: 200,


nit: maybe use a different status code here to be precise

sunjayBhatia · 2023-12-11T22:36:37Z

test/e2e/httpproxy/external_auth_test.go

+								"target": "first",
+							},
+						},
+						Services: []contourv1.Service{


should we use a directresponsepolicy here instead?

github-actions · 2023-12-29T00:16:33Z

The Contour project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 14d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, the PR is closed

You can:

Ensure your PR is passing all CI checks. PRs that are fully green are more likely to be reviewed. If you are having trouble with CI checks, reach out to the #contour channel in the Kubernetes Slack workspace.
Mark this PR as fresh by commenting or pushing a commit
Close this PR
Offer to help out with triage

Please send feedback to the #contour channel in the Kubernetes Slack

shadialtarsha · 2024-01-03T13:13:22Z

refresh

skriss · 2024-01-04T20:42:18Z

@shadialtarsha if you can address @sunjayBhatia's comments we should be able to get this into the upcoming release.

davinci26 · 2024-01-04T20:50:02Z

@skriss when is the next release? @shadialtarsha is on PTO till next week, so I wanted to see if I should push the changes myself or we can wait for it

skriss · 2024-01-04T20:52:39Z

Release will be end of Jan (est. 1/31), with an RC a week or so beforehand. I'll leave it up to you but there should be time.

davinci26 · 2024-01-04T20:57:24Z

We got time then I guess, will leave it to @shadialtarsha when he comes back

skriss · 2024-01-19T15:44:18Z

@davinci26 @shadialtarsha just a reminder that the release date is approaching, it'd be great to get this PR updated so we can include it.

skriss · 2024-02-07T17:16:42Z

Bumping to 1.29.

skriss · 2024-05-08T20:13:40Z

Merged #6426, closing this one out.

shadialtarsha requested a review from a team as a code owner November 14, 2023 14:22

shadialtarsha requested review from tsaarni and stevesloka and removed request for a team November 14, 2023 14:22

shadialtarsha commented Nov 14, 2023

View reviewed changes

internal/envoy/v3/route.go Show resolved Hide resolved

shadialtarsha force-pushed the TypedPerFilterConfigForDirectResp branch from 651b624 to 230fba2 Compare November 14, 2023 15:51

davinci26 approved these changes Nov 14, 2023

View reviewed changes

davinci26 reviewed Nov 14, 2023

View reviewed changes

davinci26 added the release-note/small A small change that needs one line of explanation in the release notes. label Nov 14, 2023

configure TypedPerFilterConfig with direct responses

27c73bc

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

shadialtarsha force-pushed the TypedPerFilterConfigForDirectResp branch from 02f0045 to 27c73bc Compare November 14, 2023 16:46

Fix a message

aebe4fa

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 29, 2023

github-actions bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Dec 9, 2023

sunjayBhatia reviewed Dec 11, 2023

View reviewed changes

github-actions bot added lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Dec 29, 2023

skriss requested review from skriss and removed request for stevesloka January 4, 2024 17:49

skriss changed the title ~~Configure TypedPerFilterConfig with direct responses~~ apply ExtAuthz configuration to direct response routes Jan 4, 2024

skriss added this to the 1.28.0 milestone Jan 4, 2024

skriss modified the milestones: 1.28.0, 1.29.0 Feb 7, 2024

skriss removed this from the 1.29.0 milestone May 2, 2024

skriss mentioned this pull request May 8, 2024

internal/envoy: support AuthPolicy on direct response routes #6426

Merged

skriss closed this May 8, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

apply ExtAuthz configuration to direct response routes #5962

apply ExtAuthz configuration to direct response routes #5962

shadialtarsha commented Nov 14, 2023

codecov bot commented Nov 14, 2023 •

edited

Loading

davinci26 left a comment

shadialtarsha commented Nov 14, 2023 •

edited

Loading

davinci26 commented Nov 14, 2023

github-actions bot commented Nov 29, 2023

shadialtarsha commented Dec 8, 2023

sunjayBhatia Dec 11, 2023

sunjayBhatia Dec 11, 2023

sunjayBhatia Dec 11, 2023

sunjayBhatia Dec 11, 2023

sunjayBhatia Dec 11, 2023

github-actions bot commented Dec 29, 2023

shadialtarsha commented Jan 3, 2024

skriss commented Jan 4, 2024

davinci26 commented Jan 4, 2024

skriss commented Jan 4, 2024

davinci26 commented Jan 4, 2024

skriss commented Jan 19, 2024

skriss commented Feb 7, 2024

skriss commented May 8, 2024

		@@ -0,0 +1,2 @@
		## Configure TypedPerFilterConfig with direct responses


		f.Certs.CreateSelfSignedCert(namespace, "testserver-cert", "testserver-cert", "testserver")

		// auth testserver

apply ExtAuthz configuration to direct response routes #5962

apply ExtAuthz configuration to direct response routes #5962

Conversation

shadialtarsha commented Nov 14, 2023

codecov bot commented Nov 14, 2023 • edited Loading

Codecov Report

davinci26 left a comment

Choose a reason for hiding this comment

shadialtarsha commented Nov 14, 2023 • edited Loading

davinci26 commented Nov 14, 2023

github-actions bot commented Nov 29, 2023

shadialtarsha commented Dec 8, 2023

sunjayBhatia Dec 11, 2023

Choose a reason for hiding this comment

sunjayBhatia Dec 11, 2023

Choose a reason for hiding this comment

sunjayBhatia Dec 11, 2023

Choose a reason for hiding this comment

sunjayBhatia Dec 11, 2023

Choose a reason for hiding this comment

sunjayBhatia Dec 11, 2023

Choose a reason for hiding this comment

github-actions bot commented Dec 29, 2023

shadialtarsha commented Jan 3, 2024

skriss commented Jan 4, 2024

davinci26 commented Jan 4, 2024

skriss commented Jan 4, 2024

davinci26 commented Jan 4, 2024

skriss commented Jan 19, 2024

skriss commented Feb 7, 2024

skriss commented May 8, 2024

codecov bot commented Nov 14, 2023 •

edited

Loading

shadialtarsha commented Nov 14, 2023 •

edited

Loading