ExtAuthZ Extension support for clear_route_cacheΒ #53555
Description
Describe the feature request
The ExtAuthZ Extension is awesome and is super easy to configure to use in an AuthorizationPolicy.
However it supports a limited amount of fields. As was initially documented in the design doc over here:
One key parameter that we are missing is the boolean clear_route_cache
, which allows the extension to force a recalculation of the routes based on the new headers added/removed from ExtAuthZ.
We are currently directly using a filter as follow:
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: extauthz-filter
namespace: istio-system
spec:
configPatches:
- applyTo: HTTP_FILTER
match:
context: GATEWAY
listener:
filterChain:
filter:
name: envoy.filters.network.http_connection_manager
subFilter:
name: envoy.filters.http.router
patch:
operation: INSERT_BEFORE
value:
name: envoy.ext_authz
typed_config:
'@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
clear_route_cache: true
grpc_service:
envoy_grpc:
cluster_name: "COMPLICATED ISTIO NAME"
timeout: 5s
status_on_error:
code: ServiceUnavailable
transport_api_version: V3
It would be great to be able to configure this direcly on the extensionProvider.
In the past years, new parameters have been successfully added to the ExtensionProvider. For example, the BodyRequest as documented here:
I hope we can do the same thing for that parameter.
Describe alternatives you've considered
Currently the alternative is to use an EnvoyFilter (which is what we are currently doing), which require some shenanigans to guess the correct destination cluster name on istio.
Affected product area (please put an X in all that apply)
[ ] Ambient
[ ] Docs
[ ] Dual Stack
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[X] Extensions and Telemetry
[X] Security
[ ] Test and Release
[X] User Experience
[ ] Developer Infrastructure
Affected features (please put an X in all that apply)
[ ] Multi Cluster
[ ] Virtual Machine
[ ] Multi Control Plane
Additional context
Happy to get a PR for this field in if we decide it is a good addition.