Fold Ambassador auth functionality into ext_authz

[kflynn]

Ambassador's auth filter (described in #2621) is deliberately more general than the authz mechanism embodied by external_auth.proto and implemented in #2417. After discussions between Envoy, Tigera, and Datawire folks, it seems that the best way forward is to fold Ambassador's auth functionality into the existing auth filter.

This issue will track the work of getting this done. We expect it to comprise multiple PRs, starting with a data-plane-api PR.

Description:

There are several tasks here:

The auth service needs to be able to control the response back to the downstream client on auth failure.

This should require enabling it in config, and currently will apply only to HTTP requests.

• Extend external_auth.proto to allow the auth service to pass back HTTP status, headers, and body on failure
• Extend filter config for opt-in to this functionality
• Extend filter itself to pass back the response from the auth service on failure.

The auth service needs to be able to modify the request that continues downstream on success.

"Modifying the request" here means allowing the auth service to send back HTTP headers to inject into the request as it goes upstream. This will also apply only to HTTP requests, and only headers that have been whitelisted in config will be accepted for injected.

• Extend external_auth.proto to allow the auth service to pass HTTP headers to inject on success.
• Extend filter config to support whitelisting headers which may be injected.
• Extend filter itself to modify the request going upstream on success (if requested)

The auth service needs to support raw HTTP requests to the auth service, rather than gRPC.

Only the HTTP method and headers will be passed to the auth service: no body will be passed, and no TLS and peer information will be passed (unless X-Forwarded-* headers are present). The HTTP Content-Length header will be forced to 0.

• Extend filter config to support an encapsulation attribute, which will default to gRPC.
• Extend filter itself to support raw HTTP if requested.

[stale]

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in the next 7 days unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.

[kflynn]

#3162 is progressing through review. I'll make a pass probably tomorrow AM over the checklist above.

[stale]

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in the next 7 days unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.

[richarddli]

cc: @gsagula

[gsagula]

@richarddli Except with one issue in the raw HTTP auth client, the #2828 is done.

Please, see Matt's comment about the current raw HTTP client approach #3888.

[mattklein123]

OK let's close this and we can track addition work as individual issues. Thank you all!

[kflynn]

Thanks all! 😄