ExtAuth Headers Based Routing

[joacoc]

I'm trying to setup ExtAuth with recomputeRoute: true + HTTPRoute for header-based routing (similar to JWT claims based routing), but requests with paths other than / return 404 errors.

Working: {envoy-host}/
Not working: {envoy-host}/v1, {envoy-host}/v1/data, etc.

Is this expected behavior, or is it a misconfiguration on my part?

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: ext-auth-service
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: routing
  extAuth:
    recomputeRoute: true
    http:
      backendRefs:
        - name: ext-auth-service
          namespace: default
          port: 8080
      headersToBackend: ["x-userid"]
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: routing
spec:
  parentRefs:
    - name: eg
  rules:
    - backendRefs:
        - kind: Service
          name: echo
          port: 3000
      matches:
        - headers:
            - name: x-userid
              value: "user1"
    # catch all
    - backendRefs:
        - kind: Service
          name: echo
          port: 3000
      matches:
        - path:
            type: PathPrefix
            value: /

[arkodg]

SP is targeting routing but the HTTPRoute is called user-routing

[joacoc]

Yeah. I changed the var names after pasting here, probably shouldn’t have done that. The issue still persists.

[joacoc]

Solved. Using failOpen on the private route, plus a catch-all internal path inside the ext-auth-service, helped solve the issue.