envoyproxy/envoy

feat: Credential Injection for ext_authz and ext_proc calls

Open

#41,767 opened on Oct 29, 2025

View on GitHub
 (5 comments) (1 reaction) (0 assignees)C++ (5,373 forks)batch import
area/ext_authzarea/ext_procenhancementhelp wantedno stalebot

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

Title: Add Credential Injection compatible with ext_authz and ext_proc gRPC and HTTP calls

Description:

I have need for a feature facilitating workload authentication on external calls by the envoy.filters.http.ext_authz and envoy.filters.http.ext_proc filters. The Credential Injector filter almost works for this use case, but the secrets are only injected to the routed request, not the side-processing requests.

I don't know if this is best implemented as an enhancement to the ext_* filters to access SDS, or to somehow make secrets available to the existing API.

Contributor guide

Research direction
Understand the current credential injector filter and how ext authz/ext proc filters issue external calls. Identify where secrets need to be injected and design an enhancement.
Tech stack
cpp
Domain
backend
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Over 1 week
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
C++EnvoygRPC
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
25