Question/documentation: GRPC-JSON transcoder and grpc ext_authz filter (envoy control plane ext_authz ) integration

Title: GRPC-JSON transcoder is ignoring ext_authz filter, can we have documentation/example updates in which both filter are working together

Description:

we are Using envoy latest (tag-v1.30.1 ) as front proxy (client submit request as http) and configured the grpc-json and ext_auth filter (envoy control plane Check https://github.com/envoyproxy/go-control-plane/blob/main/envoy/service/auth/v3/external_auth.pb.go ) , as Individual filter are working alone. But once They are used together, means authentication delegate to ext_auth and once authentication done request submitted to grpc service then Its not working ( faced major 3 scenario)

1. request submitted to grpc service without authentication (call not reaching out to ext_auth filter)
2. 501 error code (grpc service Not implemented error)
3. 415 error code (mismatch json content-type and grpc service in upstream) We have gone through several issue/help posted for this: [ https://github.com/envoyproxy/envoy/issues/9929, https://github.com/envoyproxy/envoy/issues/19910]

** Expectation:** in envoy ext_authz control plane authenticate and pass the CheckResponse to upstream grpc-service. how to apply missing envoy-config or how we can resolve the 501 error code ( as auth is passing request to grpc but not in correct url )

Based on suggestion Tried Solution/steps :

for solving 1st issue ( without auth) : we have updated the filters order, grpc-json filter before the ext auth Then we have got the second issue. { "code": 12, "message": "unknown method RPC_METHODE_NAME for service proto.package.RPC_SERVICE_NAME”, "details": [] } HTTP error code as (501 Not implemented error)

for solving second issue: we tried multiple thing like 2.a). Trying not clearing the the route cache, clear_route_cache 2.b) setting header in ext_auth LUA print / proto.package.RPC_SERVICE_NAME/RPC_METHODE_NAME?a=3 Envoy log prints {"envoy.upstream.cluster":"grpc_cluster","http.request.method":"POST","client.local.address":"172.18.0.5:80","host.hostname":"a8dc1e8353de”,,”service.version":"1.28","envoy.route.name":null,"http.request.path”:”/http_reuest_url/xyz/abc?a=3&b=4","http.request.headers.authority":"local.api.xyz.com","http.request.start_time":"2024-04-20T15:58:31.357Z","http.request.headers.x_forwarded_proto":"http","http.request.duration":1,"http.response.response_code":501,"http.request.body.bytes":0,"http.response.body.bytes":199,"http.response.response_flag”:”-“,”http.request.headers.x_forwarded_for":null,"http.request.protocol":"HTTP/1.1","service.name":"envoy","http.request.headers.accept":"/",}

for solving 1st issue/2nd issue : When we added the one intermediate path mentioned on https://github.com/envoyproxy/envoy/issues/9929 we have got the 415 http error code in client (grpc-message as content-type recieved to grpc was content-type json) through ext_auth

Listener envoy config:

Any extra documentation required to understand the issue. Please help us to resolve the workflow and later i am feeling we can add one example for this common usecase to envoy example repo as end to end grpc integration in envoy.