envoyproxy/envoy
View on GitHubext_authz(http): Envoy turns AuthorizationResponse status 500 into 403 and drops body
Open
#14,001 opened on Nov 12, 2020
area/ext_authzhelp wanted
Repository metrics
- Stars
- (27,997 stars)
- PR merge metrics
- (Avg merge 8d) (378 merged PRs in 30d)
Description
Title: ext_authz(http): Envoy turns AuthorizationResponse status 500 into 403 and drops body
Description:
- User makes an HTTP request against Envoy.
- Envoy makes AuthorizationRequest to ext_authz filter's http server.
- ext_authz server replies with 503 and a body.
- Envoy returns 403 and no body.
Repro steps: This came up as part of a project so it's easier to include instructions for that project:
# Clone and checkout branch made for reproducing this issue (see last commit)
git clone git@github.com:arrikto/oidc-authservice.git
cd oidc-authservice
git checkout feature-envoy-ext-authz-repo
# Run the E2E test to get a K3d cluster up with everything running.
# The test will fail, but it's expected.
make bin/deps
make e2e
# Port-forward the service locally
export KUBECONFIG=$HOME/.k3d/kubeconfig-e2e-test-cluster.yaml
kubectl port-forward -n istio-system svc/istio-ingressgateway 8080:80
# Make a request and see that it returns a 403
curl -v http://localhost:8080
Config: Here is the config dump taken from port 15000 of the istio ingressgateway proxy: config_dump.log
Logs: access_log.log