Add support for HTTP External Authorization Services by therealak12 · Pull Request #7418 · projectcontour/contour

therealak12 · 2026-02-14T05:57:05Z

Envoy external authorization filter supports HTTP and GRPC servers. Contour only supports configuring gRPC services at the moment. The PR adds support for HTTP ext-authz services.

We've been using this in production for >1 year.

Closes #6509

Signed-off-by: therealak12 <ak12hastam@gmail.com>

codecov · 2026-02-14T06:08:48Z

Codecov Report

❌ Patch coverage is 79.31034% with 36 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.32%. Comparing base (9477aaf) to head (b53f49d).
⚠️ Report is 111 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/envoy/v3/listener.go	77.61%	15 Missing ⚠️
cmd/contour/serve.go	0.00%	9 Missing ⚠️
internal/dag/httpproxy_processor.go	89.65%	6 Missing ⚠️
internal/dag/conditions.go	75.00%	2 Missing and 2 partials ⚠️
cmd/contour/servecontext.go	33.33%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7418      +/-   ##
==========================================
+ Coverage   81.85%   82.32%   +0.47%     
==========================================
  Files         130      130              
  Lines       15747    15789      +42     
==========================================
+ Hits        12889    12998     +109     
+ Misses       2574     2505      -69     
- Partials      284      286       +2

Files with missing lines	Coverage Δ
internal/dag/dag.go	`98.44% <ø> (ø)`
internal/envoy/v3/cluster.go	`96.24% <100.00%> (+0.03%)`	⬆️
internal/featuretests/v3/envoy.go	`99.36% <100.00%> (+0.01%)`	⬆️
internal/xdscache/v3/listener.go	`92.09% <100.00%> (+0.16%)`	⬆️
pkg/config/parameters.go	`87.10% <ø> (ø)`
cmd/contour/servecontext.go	`86.56% <33.33%> (-0.07%)`	⬇️
internal/dag/conditions.go	`96.29% <75.00%> (-1.35%)`	⬇️
internal/dag/httpproxy_processor.go	`91.26% <89.65%> (-0.18%)`	⬇️
cmd/contour/serve.go	`24.01% <0.00%> (+0.40%)`	⬆️
internal/envoy/v3/listener.go	`95.89% <77.61%> (-2.28%)`	⬇️

... and 20 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

tsaarni

Thank you @therealak12 for the contribution!

The changes look good overall but I would like to discuss some of the API aspects and potential error scenarios.

tsaarni · 2026-02-24T13:44:37Z

+	// HttpAuthorizationServerSettings defines configurations for interacting with an external HTTP authorization server.
+	//
+	// +optional
+	HTTPServerSettings *contour_v1.HTTPAuthorizationServerSettings `json:"httpSettings,omitempty"`


Config file is parsed as YAML

Suggested change

HTTPServerSettings *contour_v1.HTTPAuthorizationServerSettings `json:"httpSettings,omitempty"`

HTTPServerSettings *contour_v1.HTTPAuthorizationServerSettings `yaml:"httpSettings,omitempty"`

tsaarni · 2026-02-27T13:16:03Z

+	switch contourConfiguration.GlobalExternalAuthorization.ServiceAPIType {
+	case contour_v1.AuthorizationGRPCService:
+		globalExternalAuthConfig.ServiceAPIType = contour_v1.AuthorizationGRPCService


Should we have fall back to the gRPC authorization server type here if type is not set?

tsaarni · 2026-02-27T13:21:12Z

 		AuthorizationResponseTimeout: *respTimeout,
 	}

+	switch auth.ServiceAPIType {


We should refactor the switch-case logic in internal/dag/httpproxy_processor.go within computeVirtualHostAuthorization() and the corresponding logic in cmd/contour/serve.go within setupGlobalExternalAuthentication() into one.

tsaarni · 2026-02-27T16:17:44Z

@therealak12 I did some experiments related to my previous comments. You are free to use any of this work: snapp-incubator/contour@http-ext-authz...Nordix:contour:http-based-ext-authz

github-actions · 2026-04-11T00:44:06Z

The Contour project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 30d of inactivity, lifecycle/stale is applied
After 60d of inactivity since lifecycle/stale was applied, the PR is closed

You can:

Ensure your PR is passing all CI checks. PRs that are fully green are more likely to be reviewed. If you are having trouble with CI checks, reach out to the #contour channel in the Kubernetes Slack workspace.
Mark this PR as fresh by commenting or pushing a commit
Close this PR
Offer to help out with triage

Please send feedback to the #contour channel in the Kubernetes Slack

Signed-off-by: therealak12 <ak12hastam@gmail.com>

therealak12 · 2026-04-11T07:12:28Z

Hi, thank you for your review and the helpful suggestions.

Apologies for the delay. Due to the recent war affecting my country, I was unable to continue working on this PR for some time. Now that the situation has stabilized, I applied the requested changes.

Please take another look when you have a chance.

therealak12 · 2026-04-26T05:56:29Z

@tsaarni Does this code compile? I've picked all of the changes and applied them to the current branch, but the NewExternalAuthorization function is not defined.

I would appreciate if you could help me find the definition of NewExternalAuthorization.

github-actions · 2026-05-27T01:05:21Z

The Contour project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 30d of inactivity, lifecycle/stale is applied
After 60d of inactivity since lifecycle/stale was applied, the PR is closed

You can:

Ensure your PR is passing all CI checks. PRs that are fully green are more likely to be reviewed. If you are having trouble with CI checks, reach out to the #contour channel in the Kubernetes Slack workspace.
Mark this PR as fresh by commenting or pushing a commit
Close this PR
Offer to help out with triage

Please send feedback to the #contour channel in the Kubernetes Slack

therealak12 · 2026-05-30T05:48:10Z

/remove-lifecycle-stale

…imeout and its tests Signed-off-by: Tero Saarni <tero.saarni@est.tech>

tsaarni · 2026-06-02T14:18:58Z

@tsaarni Does this code compile? I've picked all of the changes and applied them to the current branch, but the NewExternalAuthorization function is not defined.

Hi @therealak12, You are right, sorry it was broken. I have now re-implemented it and pushed update here Nordix@19757e6.

Signed-off-by: Tero Saarni <tero.saarni@est.tech>

therealak12 · 2026-06-03T06:23:57Z

Hi @therealak12, You are right, sorry it was broken. I have now re-implemented it and pushed update here Nordix@19757e6.

Thanks. I've pushed your commits to our branch as-is. Meanwhile, I'm reviewing the rest of the PR to ensure all the changes are aligned with the original intent.

tsaarni · 2026-06-03T07:42:50Z

Thanks @therealak12!

By the way, the e2e test case is something I was experimenting yesterday as I thought e2e coverage would be good, because this functionality is quite sensitive.

Previously, we tested the gRPC-based external authorization using a separate server image deployed on a Kind cluster. However, I think it would be unnecessarily complicated to introduce that. Instead we can configure Envoy to connect to the host via a Service and EndpointSlice, and then set up an HTTP server as part of e2e test suite, giving the test case full control to run assertions.

therealak12 · 2026-06-03T10:22:49Z

I reviewed the code. The local http-server idea is cool. I pushed the e2e test commit again.
@tsaarni

Signed-off-by: Tero Saarni <tero.saarni@est.tech>

tsaarni · 2026-06-04T07:16:15Z

Hi @therealak12, could you still apply this formatting fix Nordix@b53f49d
Thanks!

therealak12 · 2026-06-04T16:22:49Z

Hi @therealak12, could you still apply this formatting fix Nordix@b53f49d Thanks!

Hi. Done. Sorry, I must have already done that.

therealak12 · 2026-06-04T16:37:20Z

Please feel free to make any changes to this code as you see fit. I'll also check my email more frequently to take any necessary actions.
@tsaarni

tsaarni

Thank You for contributing @therealak12 !

therealak12 requested a review from a team as a code owner February 14, 2026 05:57

therealak12 requested review from sunjayBhatia and tsaarni and removed request for a team February 14, 2026 05:57

sunjayBhatia requested review from a team, davinci26 and wilsonwu and removed request for a team February 14, 2026 05:57

therealak12 force-pushed the http-ext-authz branch from 47679b5 to 4651b0c Compare February 14, 2026 05:59

add support for http authz server

e0bce55

Signed-off-by: therealak12 <ak12hastam@gmail.com>

therealak12 force-pushed the http-ext-authz branch from 4651b0c to e0bce55 Compare February 14, 2026 06:05

tsaarni added the release-note/minor A minor change that needs about a paragraph of explanation in the release notes. label Feb 14, 2026

tsaarni mentioned this pull request Feb 26, 2026

Support allowed_client_headers_on_success in External Auth #7367

Closed

tsaarni requested changes Feb 27, 2026

View reviewed changes

tsaarni reviewed Feb 27, 2026

View reviewed changes

Comment thread internal/envoy/v3/listener.go Outdated

github-actions Bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Apr 11, 2026

Apply Tero Saarni's suggestions

0a50822

Signed-off-by: therealak12 <ak12hastam@gmail.com>

github-actions Bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Apr 12, 2026

github-actions Bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 27, 2026

tsaarni removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 30, 2026

Add NewExternalAuthorization, remove redundant determineExternalAuthT…

19757e6

…imeout and its tests Signed-off-by: Tero Saarni <tero.saarni@est.tech>

Add local http ext authz mock server

8c7dd93

Signed-off-by: Tero Saarni <tero.saarni@est.tech>

therealak12 force-pushed the http-ext-authz branch from 8c7dd93 to 19757e6 Compare June 3, 2026 08:10

Format fix to get golangci-lint happy

b53f49d

Signed-off-by: Tero Saarni <tero.saarni@est.tech>

tsaarni approved these changes Jun 4, 2026

View reviewed changes

tsaarni merged commit 77c3f77 into projectcontour:main Jun 4, 2026
41 of 43 checks passed

tsaarni mentioned this pull request Jun 15, 2026

Replace contour-authserver in e2e with gRPC server running in test suite #7597

Draft

	HTTPServerSettings *contour_v1.HTTPAuthorizationServerSettings `json:"httpSettings,omitempty"`
	HTTPServerSettings *contour_v1.HTTPAuthorizationServerSettings `yaml:"httpSettings,omitempty"`

Uh oh!

Conversation

therealak12 commented Feb 14, 2026 • edited by tsaarni Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Feb 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

tsaarni left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tsaarni Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tsaarni Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tsaarni Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tsaarni commented Feb 27, 2026

Uh oh!

github-actions Bot commented Apr 11, 2026

Uh oh!

therealak12 commented Apr 11, 2026

Uh oh!

therealak12 commented Apr 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 27, 2026

Uh oh!

therealak12 commented May 30, 2026

Uh oh!

tsaarni commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

therealak12 commented Jun 3, 2026

Uh oh!

tsaarni commented Jun 3, 2026

Uh oh!

therealak12 commented Jun 3, 2026

Uh oh!

tsaarni commented Jun 4, 2026

Uh oh!

therealak12 commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

therealak12 commented Jun 4, 2026

Uh oh!

tsaarni left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

therealak12 commented Feb 14, 2026 •

edited by tsaarni

Loading

codecov Bot commented Feb 14, 2026 •

edited

Loading

therealak12 commented Apr 26, 2026 •

edited

Loading

tsaarni commented Jun 2, 2026 •

edited

Loading

therealak12 commented Jun 4, 2026 •

edited

Loading