Support per route config for basic auth http filter

[fgouteroux]

Hi,

I would ask for an update of the basic auth http filter (#30079) to support per route config.

The use case is the following, I need to disable the basic auth filter in some routes and to allow differents source of users.

Maybe something like:

routes config

routes:
# route  with basic auth users
- match: { prefix: "/users" }
  route: { cluster: my-cluster }
  typed_per_filter_config:
    envoy.filters.http.basic_auth:
      "@type": type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuthPerRoute
      name: users.htpasswd

# route with basic auth admins
- match: { prefix: "/admins" }
  route: { cluster: my-cluster }
  typed_per_filter_config:
    envoy.filters.http.basic_auth:
      "@type": type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuthPerRoute
      name: admins.htpasswd

# route with no basic auth
- match: { prefix: "/" }
  route: { cluster: my-cluster }
  typed_per_filter_config:
    envoy.filters.http.basic_auth:
      "@type": type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuthPerRoute
      disabled: true

http filters config

http_filters:
- name: envoy.filters.http.basic_auth
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuth
    source_users:
      users.htpasswd
        filename: /etc/envoy/users.htpasswd
      admins.htpasswd
        filename: /etc/envoy/admins.htpasswd

cc @zhaohuabing

[jewertow]

I can try to implement this feature if you did not start yet.

[jewertow]

JFYI: I make a progress, I will submit a PR soon.

[zhaohuabing]

I realized that forward_username_header can't be set per route when applying this in Envoy Gateway. I would like to add it to the per-route config as well.

If this makes sense, I'm going to work on it.

WDYT? @wbpcode @jewertow

[jewertow]

@zhaohuabing I didn't include that setting in per-route settings, because I wasn't sure if there is such a use case, but I do not see any reason to not support it in per-route filter.

[zhaohuabing]

@jewertow I need this because I'm trying to implement per-route config for BasicAuth in the EG SecurityPolicy.