Add app access headers rewrite #6601
Conversation
|
@awly @andrejtokarcik Could you folks take a look please? |
r0mant
force-pushed
the
roman/traits
branch
2 times, most recently
from
8164ca7
to
71589ef
Compare
| // Headers is a list of extra headers to inject in the request. | ||
| Headers []string `yaml:"headers,omitempty"` |
There was a problem hiding this comment.
how about making this a map, so you don't have to do any parsing?
There was a problem hiding this comment.
I thought about the same during implementation but decided to keep it as a list for a couple of reasons:
- If it was a map, scenario with adding multiple same headers would be kinda awkward.
- This was the UX requested in the original ticket.
Shouldn't be a big deal, the parsing is pretty trivial.
lib/srv/app/transport.go
Outdated
| logrus.Warnf("Failed to apply traits to %q: %v.", header.Value, err) | ||
| continue |
There was a problem hiding this comment.
why not treat this as an error?
There was a problem hiding this comment.
I don't think this should be an error - the most common scenario this would fail is if there's no such trait which I imagine would be quite common so we probably don't want to make this a hard failure. We treat missing trait same way elsewhere as well, just log it.
r0mant
changed the title
| func (t *transport) rewriteHeaders(r *http.Request) { | ||
| for _, header := range t.c.rewrite.Headers { | ||
| if IsReservedHeader(header.Name) { | ||
| t.c.log.Debugf("Not rewriting Teleport header %q.", header.Name) |
There was a problem hiding this comment.
Could be even a warning?
This PR adds headers passthrough to applications behind app access. Users can configure headers that will be passed to applications, for example:
This PR builds on #6540 which implements external traits passthrough to leaf clusters which is needed to be able to use
{{external.xxx}}variables in leaf clusters like shown in the example above.Fixes #4762. Needs backport to v6.