Skip to content

Sync ext auth server config into envoy when virtualhost authPolicy is disabled#7468

Open
LittleLittleLittleBoy wants to merge 1 commit intoprojectcontour:mainfrom
LittleLittleLittleBoy:users/candleflame/fixauthserverdisablelogic
Open

Sync ext auth server config into envoy when virtualhost authPolicy is disabled#7468
LittleLittleLittleBoy wants to merge 1 commit intoprojectcontour:mainfrom
LittleLittleLittleBoy:users/candleflame/fixauthserverdisablelogic

Conversation

@LittleLittleLittleBoy
Copy link

problem

When setting external auth server in virtualhost. Under this virtualhost, there are many service under this virtualhost, and we just want to set up auth server for one service

the root httpproxy:

  virtualhost:
    authorization:
      authPolicy:
        disabled: true
      extensionRef:
        name: authserver
        namespace: projectcontour
      failOpen: true

the route level:

    routes:
    - authPolicy:
        disabled: false

After this config, we found auth service config didn't sync auth server config to envoy when the httpproxy.Spec.VirtualHost.Authorization.disabled==true

From route config Contour support to use route level config overwrite virtualhost or global config.
But it only support when virtualhost is disabled:false, and route disabled:true.

Solution

remove this httpproxy.Spec.VirtualHost.Authorization.disabled==true check to allow contour always sync ext auth server config into envoy. And route can overwrite this disabled flag when aythorization is disbaled in vistualhost .

@LittleLittleLittleBoy LittleLittleLittleBoy requested a review from a team as a code owner March 18, 2026 10:06
@LittleLittleLittleBoy LittleLittleLittleBoy requested review from sunjayBhatia and tsaarni and removed request for a team March 18, 2026 10:06
@sunjayBhatia sunjayBhatia requested review from a team, clayton-gonsalves and davinci26 and removed request for a team March 18, 2026 10:07
@github-actions
Copy link

Hi @LittleLittleLittleBoy! Welcome to our community and thank you for opening your first Pull Request. Someone will review it soon. Thank you for committing to making Contour better. You can also join us on our mailing list and in our channel in the Kubernetes Slack Workspace

@LittleLittleLittleBoy LittleLittleLittleBoy changed the title Allow auth server set disabled for all service and only enable in se… Sync ext auth server config into envoy when virtualhost authPolicy is disabled Mar 18, 2026
@codecov
Copy link

codecov bot commented Mar 18, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.84%. Comparing base (180d62f) to head (3e8e0a6).

Additional details and impacted files

Impacted file tree graph

@@           Coverage Diff           @@
##             main    #7468   +/-   ##
=======================================
  Coverage   81.84%   81.84%           
=======================================
  Files         130      130           
  Lines       15722    15722           
=======================================
  Hits        12868    12868           
  Misses       2571     2571           
  Partials      283      283           
Files with missing lines Coverage Δ
internal/dag/httpproxy_processor.go 91.41% <100.00%> (ø)
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant