feat(extauth): expose headersToClient in AuthorizationResponse for HTTP ext auth by babakzarrinbal · Pull Request #13592 · kgateway-dev/kgateway

babakzarrinbal · 2026-03-02T09:40:15Z

Description

Adds headersToClient and headersToClientOnSuccess to AuthorizationResponse in ExtHttpService, mapping to Envoy's allowed_client_headers and allowed_client_headers_on_success.

Fixes #13594.

Problem

When using httpService for ext auth with an external oauth2-proxy, unauthenticated requests receive a 403 from the gateway even though the auth service returns a 302 + Location redirect. Envoy's AllowedClientHeaders was never set, so the redirect headers were stripped on denial and never reached the browser.

Solution

Expose headersToClient (denial path) and headersToClientOnSuccess (allow path) on the CRD type and wire them to AllowedClientHeaders / AllowedClientHeadersOnSuccess in the Envoy ext_authz config builder. This lets redirect headers pass through to the client, enabling oauth2-proxy redirect flows without an in-cluster nginx/gRPC adapter.

Changes

api/v1alpha1/kgateway/gateway_extensions_types.go: add HeadersToClient and HeadersToClientOnSuccess to AuthorizationResponse.
api/v1alpha1/kgateway/zz_generated.deepcopy.go: deepcopy for the new fields.
install/helm/kgateway-crds/templates/gateway.kgateway.dev_gatewayextensions.yaml: regenerated CRD.
pkg/kgateway/extensions2/plugins/trafficpolicy/gateway_extension.go: wire the fields to AllowedClientHeaders / AllowedClientHeadersOnSuccess.
pkg/kgateway/extensions2/plugins/trafficpolicy/gateway_extension_test.go: unit coverage for the new wiring.

Usage

httpService:
  backendRef:
    name: ext-oauth2-relay
    port: 443
  authorizationResponse:
    headersToClient:
      - location
      - set-cookie
    headersToClientOnSuccess:
      - set-cookie

Change Type

/kind feature

Changelog

Add headersToClient and headersToClientOnSuccess fields to AuthorizationResponse in ExtHttpService, mapping to Envoy's allowed_client_headers and allowed_client_headers_on_success. This enables redirect-based OAuth2 flows by forwarding auth service response headers (e.g. Location) to the downstream client.

Copilot

Pull request overview

This PR significantly expands configuration and test support around Rustformation (Envoy dynamic module)–backed transformations, updates validation/runtime tooling to use an envoy-wrapper image, and refreshes a broad set of golden files and CI workflows. The scope goes well beyond the PR title/description (which focus on HTTP ext-auth headersToClient).

Changes:

Switch/extend transformation plumbing and merge behavior to support Rustformation dynamic module configs (including deep-merge behavior and new template handling).
Update validator and build/release plumbing for dynamic modules (envoy-wrapper image, module search path, multi-arch Envoy image selection).
Add/adjust e2e and plugin test coverage plus many golden outputs/workflow updates (including new arm64 conformance matrix).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
test/e2e/features/transformation/testdata/transform-for-headers.yaml	Adds a header transformation case exercising header lookup/template behavior.
test/e2e/features/transformation/testdata/transform-for-body-local-reply.yaml	Adds new manifests for local-reply body transformation scenarios.
test/e2e/features/transformation/suite.go	Adds new test manifest/cases and adjusts rustformation toggling/expectations.
test/e2e/features/route_delegation/testdata/policy_merging.yaml	Updates transformation response semantics from `add` to `set` in test data.
test/e2e/features/route_delegation/suite.go	Skips the policy merging test (linked issue).
test/e2e/features/agentgateway/extauth/types.go	Adds a new manifest constant for a missing backendRef scenario.
test/e2e/features/agentgateway/extauth/testdata/secured-route-missing-ref.yaml	Adds a route/policy fixture with a missing ext-auth backendRef.
test/e2e/features/agentgateway/extauth/suite.go	Adds a new e2e test for missing backendRef behavior.
test/deployer/testdata/stats-matcher-inclusion-out.yaml	Updates expected Envoy HCM config (normalize_path/merge_slashes, formatting).
test/deployer/testdata/stats-matcher-exclusion-out.yaml	Updates expected Envoy HCM config (normalize_path/merge_slashes, formatting).
test/deployer/testdata/priority-class-name-out.yaml	Updates expected Envoy HCM config (normalize_path/merge_slashes, formatting).
test/deployer/testdata/omit-default-security-context-via-gw-out.yaml	Updates expected rendered output for securityContext deletion behavior.
test/deployer/testdata/omit-default-security-context-out.yaml	Updates expected rendered output for securityContext deletion behavior.
test/deployer/testdata/loadbalancer-static-ip-out.yaml	Updates expected Envoy HCM config (normalize_path/merge_slashes, formatting).
test/deployer/testdata/istio-enabled-waypoint-out.yaml	Updates expected Envoy HCM config (normalize_path/merge_slashes, formatting).
test/deployer/testdata/istio-enabled-out.yaml	Updates expected Envoy HCM config (normalize_path/merge_slashes, formatting).
test/deployer/testdata/gwc-with-replicas-out.yaml	Updates expected Envoy HCM config (normalize_path/merge_slashes, formatting).
test/deployer/testdata/envoy-infrastructure-out.yaml	Updates expected Envoy HCM config (normalize_path/merge_slashes, formatting).
test/deployer/testdata/envoy-controller-ignores-agentgateway-class-name-out.yaml	Updates expected Envoy HCM config (normalize_path/merge_slashes, formatting).
test/deployer/testdata/both-gwc-and-gw-have-params-reversed-out.yaml	Updates expected Envoy HCM config (normalize_path/merge_slashes, formatting).
test/deployer/testdata/both-gwc-and-gw-have-params-out.yaml	Updates expected Envoy HCM config (normalize_path/merge_slashes, formatting).
test/deployer/testdata/base-gateway-tls-out.yaml	Updates expected Envoy HCM config (normalize_path/merge_slashes, formatting).
test/deployer/testdata/base-gateway-out.yaml	Updates expected Envoy HCM config (normalize_path/merge_slashes, formatting).
test/deployer/testdata/agentgateway-omitdefaultsecuritycontext.yaml	Updates overlay examples to demonstrate `$patch: delete` vs `null`.
test/deployer/testdata/agentgateway-omitdefaultsecuritycontext-ref-gwp-on-gw.yaml	Updates overlay examples to demonstrate `$patch: delete` vs `null`.
test/deployer/testdata/agentgateway-omitdefaultsecuritycontext-ref-gwp-on-gw-out.yaml	Updates expected output to reflect empty securityContext rendering.
test/deployer/testdata/agentgateway-omitdefaultsecuritycontext-out.yaml	Updates expected output to reflect empty securityContext rendering.
test/deployer/internal_helm_test.go	Improves helm test documentation and updates validator used for securityContext expectations.
test/deployer/deployer_helm.go	Adds `EmptySecurityContextValidator` and clarifies validator semantics.
pkg/validator/validator.go	Switches default Envoy image to envoy-wrapper and adjusts validation invocation behavior.
pkg/kgateway/utils/any.go	Adds helpers to convert Any(StringValue(JSON)) ⇄ Go objects for rustformation config merging.
pkg/kgateway/translator/gateway/testutils/outputs/traffic-policy/transformation-deep-merge.yaml	Updates golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/traffic-policy/merge.yaml	Updates golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/traffic-policy/label_based_global_policy.yaml	Updates golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/traffic-policy/label_based.yaml	Updates golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/status/basic.yaml	Updates golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/route-replacement/strict/policy/policy-transformation-malformed-template-invalid-out.yaml	Updates strict-mode error message golden output for dynamic module behavior.
pkg/kgateway/translator/gateway/testutils/outputs/route-replacement/strict/policy/policy-template-structure-invalid-out.yaml	Updates strict-mode golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/route-replacement/strict/attachment/xlistenerset-listener-invalid-out.yaml	Updates strict-mode error message golden output for dynamic module behavior.
pkg/kgateway/translator/gateway/testutils/outputs/route-replacement/strict/attachment/xlistenerset-invalid-out.yaml	Updates strict-mode error message golden output for dynamic module behavior.
pkg/kgateway/translator/gateway/testutils/outputs/route-replacement/strict/attachment/multi-target-invalid-out.yaml	Updates strict-mode error message golden output for dynamic module behavior.
pkg/kgateway/translator/gateway/testutils/outputs/route-replacement/strict/attachment/httproute-invalid-out.yaml	Updates strict-mode error message golden output for dynamic module behavior.
pkg/kgateway/translator/gateway/testutils/outputs/route-replacement/strict/attachment/gateway-listener-merge-invalid-out.yaml	Updates strict-mode error message golden output for dynamic module behavior.
pkg/kgateway/translator/gateway/testutils/outputs/route-replacement/strict/attachment/gateway-listener-invalid-out.yaml	Updates strict-mode error message golden output for dynamic module behavior.
pkg/kgateway/translator/gateway/testutils/outputs/route-replacement/strict/attachment/gateway-invalid-out.yaml	Updates strict-mode error message golden output for dynamic module behavior.
pkg/kgateway/translator/gateway/testutils/outputs/route-replacement/standard/attachment/xlistenerset-listener-invalid-out.yaml	Updates standard-mode golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/route-replacement/standard/attachment/xlistenerset-invalid-out.yaml	Updates standard-mode golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/route-replacement/standard/attachment/multi-target-invalid-out.yaml	Updates standard-mode golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/route-replacement/standard/attachment/httproute-invalid-out.yaml	Updates standard-mode golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/route-replacement/standard/attachment/gateway-listener-merge-invalid-out.yaml	Updates standard-mode golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/route-replacement/standard/attachment/gateway-listener-invalid-out.yaml	Updates standard-mode golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/route-replacement/standard/attachment/gateway-invalid-out.yaml	Updates standard-mode golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/httplistenerpolicy/preserve-external-request-id.yaml	Re-formats/updates golden output (normalizePath/mergeSlashes ordering/structure).
pkg/kgateway/translator/gateway/testutils/outputs/httplistenerpolicy/generate-request-id-false.yaml	Re-formats/updates golden output (normalizePath/mergeSlashes ordering/structure).
pkg/kgateway/translator/gateway/testutils/outputs/discovery-namespace-selector/base_select_infra.yaml	Updates golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/discovery-namespace-selector/base_select_all.yaml	Updates golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/delegation/traffic_policy_multi_level_inheritance_override_enabled.yaml	Updates golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/delegation/traffic_policy_multi_level_inheritance_override_disabled.yaml	Updates golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/delegation/traffic_policy_inheritance_child_override_ok.yaml	Updates golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/delegation/traffic_policy_inheritance_child_override_ignore.yaml	Updates golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/delegation/traffic_policy_inheritance.yaml	Updates golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/delegation/traffic_policy_filter_override_merge.yaml	Updates golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/delegation/traffic_policy.yaml	Updates golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/testutils/outputs/delegation/policy_deep_merge.yaml	Updates golden output to dynamic module filter config format.
pkg/kgateway/translator/gateway/gateway_translator_test.go	Disables certain strict validation tests pending rustformation capabilities.
pkg/kgateway/setup/testdata/standard/transformation-out.yaml	Updates setup golden outputs to dynamic module filter config format.
pkg/kgateway/setup/testdata/standard/transform-route-only-out.yaml	Updates setup golden outputs to dynamic module filter config format.
pkg/kgateway/setup/testdata/standard/transform-gw-only-out.yaml	Updates setup golden outputs to dynamic module filter config format.
pkg/kgateway/setup/testdata/standard/transform-gw-and-route-disable-out.yaml	Updates setup golden outputs to dynamic module filter config format.
pkg/kgateway/setup/testdata/standard/routeoptions-out.yaml	Updates setup golden outputs to dynamic module filter config format.
pkg/kgateway/setup/testdata/standard/lambda-qualifiers-out.yaml	Removes trailing whitespace in golden output.
pkg/kgateway/setup/testdata/standard/extproc-targetref-out.yaml	Updates endpoint ordering/locality formatting in golden output.
pkg/kgateway/setup/testdata/standard/extproc-routerule-out.yaml	Updates endpoint ordering/locality formatting in golden output.
pkg/kgateway/helm/envoy/templates/configmap.yaml	Adds normalize_path/merge_slashes to HCM config in helm template.
pkg/kgateway/extensions2/plugins/trafficpolicy/transformation_plugin.go	Fixes transformation IR construction gating when rustformations are enabled.
pkg/kgateway/extensions2/plugins/trafficpolicy/traffic_policy_plugin.go	Adds deprecation warning and adjusts local rate limit filter staging.
pkg/kgateway/extensions2/plugins/trafficpolicy/merge.go	Implements rustformation deep-merge behavior by merging JSON filter configs.
pkg/kgateway/extensions2/plugins/listenerpolicy/listener_plugin.go	Fixes equality logic to include HTTP listener policy sub-IR comparison.
pkg/kgateway/agentgatewaysyncer/workloads.go	Exports WorkloadToAddress and centralizes workload address population logic.
pkg/kgateway/agentgatewaysyncer/syncer.go	Adds injectable address provider hooks for workloads/services when AsAddress isn’t populated.
pkg/kgateway/agentgatewaysyncer/service.go	Centralizes service address population logic.
pkg/kgateway/agentgatewaysyncer/option.go	Adds new syncer options for address provider functions.
pkg/agentgateway/plugins/testdata/trafficpolicy/http-route-missing-not-attached.yaml	Adds plugin test fixture for missing HTTPRoute attachment.
pkg/agentgateway/plugins/testdata/trafficpolicy/http-route-ancestor-gateway.yaml	Adds plugin test fixture validating ancestor gateway selection.
pkg/agentgateway/plugins/testdata/trafficpolicy/gateway-missing-not-attached.yaml	Adds plugin test fixture for missing Gateway attachment.
pkg/agentgateway/plugins/testdata/trafficpolicy/extauthz-missing-backend.yaml	Adds plugin test fixture for missing extAuth backend service.
pkg/agentgateway/plugins/testdata/trafficpolicy/_defaults.yaml	Adds shared defaults fixture for trafficpolicy tests.
pkg/agentgateway/plugins/testdata/frontendpolicy/tls.yaml	Adds gateway defaults to frontendpolicy fixture.
pkg/agentgateway/plugins/testdata/frontendpolicy/tls-listener-no-gw.yaml	Adds fixture for missing gateway attachment in frontend TLS policy.
pkg/agentgateway/plugins/testdata/frontendpolicy/tcp-keepalive.yaml	Adds gateway defaults to frontendpolicy fixture.
pkg/agentgateway/plugins/testdata/frontendpolicy/http.yaml	Adds gateway defaults to frontendpolicy fixture.
pkg/agentgateway/plugins/testdata/frontendpolicy/full.yaml	Adds gateway defaults to frontendpolicy fixture.
pkg/agentgateway/plugins/testdata/frontendpolicy/_defaults.yaml	Adds shared defaults fixture for frontendpolicy tests.
pkg/agentgateway/plugins/testdata/backendpolicy/simple.yaml	Updates ancestor kind in expected status output.
pkg/agentgateway/plugins/testdata/backendpolicy/mcp-authz-route.yaml	Updates ancestor kind in expected status output.
pkg/agentgateway/plugins/testdata/backendpolicy/httproute-missing-not-attached.yaml	Adds plugin test fixture for missing HTTPRoute backendpolicy attachment.
pkg/agentgateway/plugins/testdata/backendpolicy/backend-missing-not-attached.yaml	Adds plugin test fixture for missing AgentgatewayBackend attachment.
pkg/agentgateway/plugins/testdata/backendpolicy/backend-ancestor-backend.yaml	Adds plugin test fixture for backend ancestor status behavior.
pkg/agentgateway/plugins/testdata/backendpolicy/awsauth.yaml	Updates ancestor kind in expected status output.
pkg/agentgateway/plugins/testdata/backendpolicy/ai.yaml	Updates ancestor kind in expected status output.
pkg/agentgateway/plugins/testdata/backendpolicy/_defaults.yaml	Adds shared defaults fixture for backendpolicy tests.
internal/envoyinit/transformations/src/lib.rs	Adjusts transformation config struct derivations.
internal/envoyinit/transformations/src/jinja.rs	Adds template pre-compilation/lookup and case-insensitive header access behavior.
internal/envoyinit/transformations/Cargo.toml	Enables minijinja loader feature.
internal/envoyinit/rustformations/src/lib.rs	Adds arch-specific SDK wiring for envoy dynamic modules.
internal/envoyinit/rustformations/src/http_simple_mutations.rs	Implements env/template caching, local reply body handling, and arch-specific add-header behavior.
internal/envoyinit/rustformations/Cargo.toml	Adds target-specific dependencies for local vs remote SDK builds.
internal/envoyinit/patched-envoy-sdk/envoy-proxy-dynamic-modules-rust-sdk/dynamic_modules/sdk/rust/src/lib.rs	Minor formatting fix in patched SDK code.
internal/envoyinit/Cargo.toml	Removes git patch override block (patched SDK handling changes).
internal/envoyinit/Cargo.lock	Updates lockfile for new deps/feature flags and dual-SDK sources.
install/helm/kgateway-crds/templates/gateway.kgateway.dev_trafficpolicies.yaml	Updates CRD schema descriptions about arm64 add-header limitation.
hack/kind/setup-kind.sh	Improves Gateway API CRD installation logic (release vs kustomize based on ref).
hack/bump_deps.sh	Adds helpers to update Makefile/workflow pins and improves gateway-api bump flow.
docs/guides/transformation.md	Adds documentation describing classic vs rustformation differences and limitations.
api/v1alpha1/kgateway/traffic_policy_types.go	Adds API comment about arm64 add-header limitation.
api/v1alpha1/agentgateway/agentgateway_parameters_types.go	Clarifies overlay semantics for `$patch: delete`, `null`, and `$patch: replace`.
api/settings/settings_test.go	Updates expectations for default/use of rustformations flag.
api/settings/settings.go	Changes default `UseRustFormations` to true and adds strict-mode note.
Makefile	Adds per-arch Envoy image vars, updates CRD install logic, and refactors sections.
.goreleaser.yaml	Uses per-arch Envoy image build args for multi-arch releases.
.github/workflows/release.yaml	Adds support for release branches matching `vX.Y.x`.
.github/workflows/nightly-tests.yaml	Bumps Gateway API versions in the nightly matrix.
.github/workflows/conformance.yaml	Adds an `arch` matrix and arm64 runner selection for conformance jobs.

babakzarrinbal · 2026-03-02T09:53:24Z

/kind feature

davidjumani · 2026-03-09T13:55:07Z

Thanks @babakzarrinbal for raising this. Could you please add tests around this ? Thanks

babakzarrinbal · 2026-03-20T08:07:21Z

@davidjumani
added the test as well , hope all should be good now

andy-fong · 2026-04-09T13:52:46Z

@davidjumani added the test as well , hope all should be good now

@babakzarrinbal Thank you for the contribution, can you follow https://github.com/kgateway-dev/kgateway/blob/main/devel/contributing/README.md to create the DCO and make verify to pass the lint check.

github-actions · 2026-05-10T10:31:25Z

This pull request has been marked as stale because of no activity in the last 30 days. It will be closed in the next 5 days unless it is tagged "no stalebot" or other activity occurs.

…TP ext auth Add HeadersToClient field to AuthorizationResponse which maps to Envoy's AllowedClientHeaders. This allows headers from the auth service denial response (e.g. Location on a 302 redirect) to be forwarded back to the downstream client, enabling redirect-based OAuth2 flows without an additional relay component. Signed-off-by: Babak Zarrinbal <[email protected]>

Signed-off-by: Babak Zarrinbal <[email protected]>

Regenerate the CRD YAML to include the headersToClient field in AuthorizationResponse. This was missing from the initial commit. Signed-off-by: Babak Zarrinbal <[email protected]>

babakzarrinbal · 2026-05-11T09:57:02Z

check-labelsExpected — Waiting for status to be reported

@andy-fong
label fixed and lint and test all passed, hope I covered everything this time 🙃

andy-fong · 2026-05-12T17:32:38Z

@babakzarrinbal Just noticed this behavior change in envoy 1.37 release note:

ext_authz: Fixed HTTP ext_authz service to propagate headers (such as set-cookie) back to clients. The filter now uses allowed_client_headers for denied responses and allowed_client_headers_on_success for successful responses.

does that affect what you do? Maybe we can add the allowed_client_headers_on_success as well?

andy-fong · 2026-06-09T20:17:29Z

@babakzarrinbal somehow your last commit is missing DCO again, would you be able to fix that. Might need to amend the last commit and force push.

…for HTTP ext auth Signed-off-by: Babak Zarrinbal <[email protected]>

babakzarrinbal · 2026-06-11T07:15:43Z

@andy-fong DCO fixed - amended the last commit and force-pushed. All 4 commits now have valid sign-offs. Thanks for the heads up!

andy-fong · 2026-06-25T21:23:41Z

@babakzarrinbal Sorry. Have been quite busy the past couple weeks. Looks like you need to run "make generate-all" again after you added "headersToClientOnSuccess".

Signed-off-by: Babak Zarrinbal <[email protected]>

babakzarrinbal · 2026-07-09T13:03:56Z

@andy-fong done — ran the codegen and pushed; the regenerated gateway.kgateway.dev_gatewayextensions.yaml (now including headersToClientOnSuccess) is in the PR and make verify is clean locally. And yes, per your envoy 1.37 note I wired headersToClientOnSuccess → allowed_client_headers_on_success alongside headersToClient → allowed_client_headers. Ready for another look 🙏

Copilot AI review requested due to automatic review settings March 2, 2026 09:40

babakzarrinbal requested a review from a team as a code owner March 2, 2026 09:40

Copilot started reviewing on behalf of babakzarrinbal March 2, 2026 09:40 View session

gateway-bot added do-not-merge/description-invalid do-not-merge/kind-invalid Indicates a PR lacks a `kind/foo` label and requires one. do-not-merge/release-note-invalid Indicates that a PR should not merge because it's missing one of the release note labels. labels Mar 2, 2026

babakzarrinbal force-pushed the feat/extauth-http-headers-to-client branch from 4662912 to 9f64066 Compare March 2, 2026 09:48

Copilot AI reviewed Mar 2, 2026

View reviewed changes

Comment thread pkg/validator/validator.go

Comment thread pkg/kgateway/extensions2/plugins/trafficpolicy/traffic_policy_plugin.go Outdated

Comment thread pkg/kgateway/extensions2/plugins/trafficpolicy/merge.go

gateway-bot added release-note and removed do-not-merge/release-note-invalid Indicates that a PR should not merge because it's missing one of the release note labels. labels Mar 2, 2026

gateway-bot added kind/feature Categorizes issue or PR as related to a new feature. and removed do-not-merge/kind-invalid Indicates a PR lacks a `kind/foo` label and requires one. do-not-merge/description-invalid labels Mar 2, 2026

babakzarrinbal mentioned this pull request Mar 2, 2026

ExtHttpService: denial response headers (e.g. Location) not forwarded to client #13594

Closed

andy-fong requested a review from davidjumani March 9, 2026 13:54

github-actions Bot added the stale Issues that are stale. These will not be prioritized without further engagement on the issue. label May 10, 2026

babakzarrinbalmasouleh-douglas added 3 commits May 11, 2026 11:07

feat(tests): add unit tests for buildStringListMatcher function

b3f4115

Signed-off-by: Babak Zarrinbal <[email protected]>

codegen: update GatewayExtensions CRD for headersToClient field

8f42b52

Regenerate the CRD YAML to include the headersToClient field in AuthorizationResponse. This was missing from the initial commit. Signed-off-by: Babak Zarrinbal <[email protected]>

babakzarrinbal force-pushed the feat/extauth-http-headers-to-client branch from d8f8033 to 8f42b52 Compare May 11, 2026 09:29

github-actions Bot removed the stale Issues that are stale. These will not be prioritized without further engagement on the issue. label May 11, 2026

feat(extauth): add HeadersToClientOnSuccess to AuthorizationResponse …

049cb62

…for HTTP ext auth Signed-off-by: Babak Zarrinbal <[email protected]>

babakzarrinbal force-pushed the feat/extauth-http-headers-to-client branch from a52bd47 to 049cb62 Compare June 11, 2026 07:12

chore: regenerate gatewayextensions CRD for headersToClient(OnSuccess)

657104a

Signed-off-by: Babak Zarrinbal <[email protected]>

fajpunk mentioned this pull request Jul 9, 2026

HTTP external auth: pass auth server headers back to downstream clients? agentgateway/agentgateway#2483

Closed

andy-fong enabled auto-merge July 13, 2026 17:20

andy-fong approved these changes Jul 13, 2026

View reviewed changes

andy-fong added this pull request to the merge queue Jul 13, 2026

Merged via the queue into kgateway-dev:main with commit 0adaa2d Jul 13, 2026
32 checks passed

Uh oh!

Conversation

babakzarrinbal commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Problem

Solution

Changes

Usage

Change Type

Changelog

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

babakzarrinbal commented Mar 2, 2026

Uh oh!

davidjumani commented Mar 9, 2026

Uh oh!

babakzarrinbal commented Mar 20, 2026

Uh oh!

andy-fong commented Apr 9, 2026

Uh oh!

github-actions Bot commented May 10, 2026

Uh oh!

babakzarrinbal commented May 11, 2026

check-labelsExpected — Waiting for status to be reported

Uh oh!

andy-fong commented May 12, 2026

Uh oh!

andy-fong commented Jun 9, 2026

Uh oh!

babakzarrinbal commented Jun 11, 2026

Uh oh!

andy-fong commented Jun 25, 2026

Uh oh!

babakzarrinbal commented Jul 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

babakzarrinbal commented Mar 2, 2026 •

edited

Loading