Forward B3 tracing headers in envoyExtAuthzHttp side requests

[TimJongerius]

Describe the feature request

Can we have the B3 tracing headers added to the envoyExtAuthzHttp side requests? It would be helpful to see these requests in Jaeger.

Describe alternatives you've considered

Affected product area (please put an X in all that apply)

[ ] Ambient
[ ] Docs
[ ] Dual Stack
[ ] Installation
[X] Networking
[ ] Performance and Scalability
[ ] Extensions and Telemetry
[ ] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure

Affected features (please put an X in all that apply)

[ ] Multi Cluster
[ ] Virtual Machine
[ ] Multi Control Plane

Additional context

[hzxuzhonghu]

We have MeshConfig_ExtensionProvider_EnvoyExternalAuthorizationHttpProvider.IncludeRequestHeadersInCheck, could this satisfy your case
`

[TimJongerius]

I’ve tried this but the headers aren’t forwarded to the oauth proxy. My guess would be that the ingress gateway creates the B3 headers after the authentication was successful before routing the request upstream.

[hzxuzhonghu]

Yes, B3 is generated after ext-auth

[TimJongerius]

Is there a way to have the gateway create B3 before authz? Maybe you can get me started with an EnvoyFilter.

[hzxuzhonghu]

I believe there is no way that you can get B3 header before it is generated, this is in gateway. But you can get it on the backend server side as the B3 headers will be sent to server.

[istio-policy-bot]

🚧 This issue or pull request has been closed due to not having had activity from an Istio team member since 2023-10-17. If you feel this issue or pull request deserves attention, please reopen the issue. Please see this wiki page for more information. Thank you for your contributions.

Created by the issue and PR lifecycle manager.