ext_authz(http): Read headers sent by ExtAuthz service in the next lua filter about envoy HOT 5 OPEN

CC: @esmet @tyxia @ggreenway @wbpcode

from envoy.

@htuch
any help please. thanks

from envoy.

When ExtAuthz service returns 5XX response, next lua filter cannot access the headers set by ExtAuthz service.

Is the request rejected at this point? If so, the filter after ext_authz won't run.

from envoy.

Hello @htuch

I have failure_mode_allow: true which allows ExtAuthz filter to pass the request to next Lua filter for 5XX but I want to identify (read status code) the cause of ExtAuthz failure in next Lua filter which I am unable to do as all the headers seems to be removed by ExtAuthz filter when it returns 5XX.

Mainly I want to identify 2 failures, 500 and 503. our ExtAuthz server returns 500 if there is any failure in processing the request. Also, sometime Envoy doesn't able to reach ExtAuthz server and fails with 503 (reported here with logs #32058).

I want to retry for 503 case (connection issue) in the next Lua filter but don't want to retry for 500 case (processing error by ExtAuthz server).

How can i identify the status code of ExtAuthz filter in the next Lua filter or any other way I can achieve the same?

from envoy.

Reading

One option might be to enhance failure_mode_allow_header_add to support status propagation.

from envoy.