envoyconfig: add authority header to outbound gRPC requests (#3545)

config/envoyconfig/outbound.go

@@ -9,6 +9,7 @@ import (
 	envoy_config_route_v3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
 	envoy_http_connection_manager "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
 	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
 
 	"github.com/pomerium/pomerium/config"
 )
@@ -122,6 +123,10 @@ func (b *Builder) buildOutboundRoutes() []*envoy_config_route_v3.Route {
 						ClusterSpecifier: &envoy_config_route_v3.RouteAction_Cluster{
 							Cluster: def.Cluster,
 						},
+						// rewrite the host header
+						HostRewriteSpecifier: &envoy_config_route_v3.RouteAction_AutoHostRewrite{
+							AutoHostRewrite: wrapperspb.Bool(true),
+						},
 						// disable the timeout to support grpc streaming
 						Timeout:     durationpb.New(0),
 						IdleTimeout: durationpb.New(0),

config/envoyconfig/outbound_test.go

@@ -0,0 +1,79 @@
+package envoyconfig
+
+import (
+	"testing"
+
+	"github.com/pomerium/pomerium/internal/testutil"
+)
+
+func Test_buildOutboundRoutes(t *testing.T) {
+	b := New("local-grpc", "local-http", "local-metrics", nil, nil)
+	routes := b.buildOutboundRoutes()
+	testutil.AssertProtoJSONEqual(t, `[
+		{
+			"match": {
+				"grpc": {},
+				"prefix": "/envoy.service.auth.v3.Authorization/"
+			},
+			"name": "pomerium-authorize",
+			"route": {
+				"autoHostRewrite": true,
+				"cluster": "pomerium-authorize",
+				"idleTimeout": "0s",
+				"timeout": "0s"
+			}
+		},
+		{
+			"match": {
+				"grpc": {},
+				"prefix": "/databroker.DataBrokerService/"
+			},
+			"name": "pomerium-databroker",
+			"route": {
+				"autoHostRewrite": true,
+				"cluster": "pomerium-databroker",
+				"idleTimeout": "0s",
+				"timeout": "0s"
+			}
+		},
+		{
+			"match": {
+				"grpc": {},
+				"prefix": "/directory.DirectoryService/"
+			},
+			"name": "pomerium-databroker",
+			"route": {
+				"autoHostRewrite": true,
+				"cluster": "pomerium-databroker",
+				"idleTimeout": "0s",
+				"timeout": "0s"
+			}
+		},
+		{
+			"match": {
+				"grpc": {},
+				"prefix": "/registry.Registry/"
+			},
+			"name": "pomerium-databroker",
+			"route": {
+				"autoHostRewrite": true,
+				"cluster": "pomerium-databroker",
+				"idleTimeout": "0s",
+				"timeout": "0s"
+			}
+		},
+		{
+			"match": {
+				"grpc": {},
+				"prefix": "/"
+			},
+			"name": "pomerium-control-plane-grpc",
+			"route": {
+				"autoHostRewrite": true,
+				"cluster": "pomerium-control-plane-grpc",
+				"idleTimeout": "0s",
+				"timeout": "0s"
+			}
+		}
+	]`, routes)
+}