api: support for external authz

[zhaohuabing]

External authorization API.

Related: #1059

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (236cba5) 64.63% compared to head (eb7997f) 64.63%.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2435   +/-   ##
=======================================
  Coverage   64.63%   64.63%           
=======================================
  Files         116      116           
  Lines       17797    17797           
=======================================
  Hits        11503    11503           
  Misses       5558     5558           
  Partials      736      736           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[zirain]

LGTM

[arkodg]

@zhaohuabing can you link the envoy config that the tls config here will be translated into for http and grpc ?

[zhaohuabing]

@zhaohuabing can you link the envoy config that the tls config here will be translated into for http and grpc ?

TheTLSConfig should be used in the Cluster transport_socket of the GRPC/HTTP ext auth service cluster.

The CertificateRef will be used in tls_certificate_sds_secret_configs , and the CACertRef will be used in validation_context_sds_secret_config .
https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/tls.proto#envoy-v3-api-msg-extensions-transport-sockets-tls-v3-commontlscontext

For gRPC service, the cluster is specified in EnvoyGrpc's cluster_name field.
https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/grpc_service.proto#envoy-v3-api-msg-config-core-v3-grpcservice-envoygrpc
For HTTP service, the cluster is specified in HttpUri's cluster field.
https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/http_uri.proto#envoy-v3-api-msg-config-core-v3-httpuri

[arkodg]

awesome thanks @zhaohuabing ! I brought this up to bring up a common question around proxy identity, do we want to support a unique key/cert for

• ext auth
• backend TLS

or should we reuse listener/downstream certs ?

[zhaohuabing]

awesome thanks @zhaohuabing ! I brought this up to bring up a common question around proxy identity, do we want to support a unique key/cert for

• ext auth
• backend TLS

or should we reuse listener/downstream certs ?

Envoy docs says that Only a single TLS certificate is supported in client contexts

tls_certificates
(repeated extensions.transport_sockets.tls.v3.TlsCertificate) Only a single TLS certificate is supported in client contexts. In server contexts, Multiple TLS certificates can be associated with the same context to allow both RSA and ECDSA certificates and support SNI-based selection.

https://www.envoyproxy.io/docs/envoy/v1.29.0/api-v3/extensions/transport_sockets/tls/v3/tls.proto#envoy-v3-api-msg-extensions-transport-sockets-tls-v3-commontlscontext

We can reuse this for JWT as well.

[arkodg]

LGTM thanks !