-
Notifications
You must be signed in to change notification settings - Fork 360
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use native per-route config for basic auth #3182
Conversation
5fab569
to
0a83056
Compare
Signed-off-by: huabing zhao <zhaohuabing@gmail.com>
0d82082
to
71aab5f
Compare
Signed-off-by: huabing zhao <zhaohuabing@gmail.com>
Signed-off-by: huabing zhao <zhaohuabing@gmail.com>
Signed-off-by: huabing zhao <zhaohuabing@gmail.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Big +1 for reducing FC size, one small question on the top-level filter config
basicAuthProto = &basicauthv3.BasicAuth{ | ||
Users: &corev3.DataSource{ | ||
Specifier: &corev3.DataSource_InlineBytes{ | ||
InlineBytes: basicAuth.Users, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Are we using the first route's security policy basic config to define the top-level HCM "global" config? It's overriden on each route, but makes XDS look a bit strange... Maybe just leave it blank?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, I'd like to leave it blank as well, but the Users
field is mandatory.
Signed-off-by: huabing zhao <zhaohuabing@gmail.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
thanks !
Switching to native per-route config for basic auth to shrink HCM filter chain size.
Per-route config for basic auth has been supported in Envoy.