How to add multiple headers with the same name from extauth response to upstream

[Jingru]

As mentioned in gloo's documentation: https://docs.solo.io/gloo/1.2.0/api/github.com/solo-io/gloo/projects/gloo/api/v1/enterprise/options/extauth/v1/extauth.proto.sk/#response, I can set allowedUpstreamHeaders to ask gloo to add headers sent from extauth response then send to upstream. But I can't add multiple headers with the same name becase Note that coexistent headers will be overridden.

However, in kubernetes authenticating proxy: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authenticating-proxy, I have to add multiple headers with the same --requestheader-group-headers name if this user belongs to multiple groups.

Any chances that I can use gloo as kubernetes authenticating proxy?

[yuval-k]

unfortunately, the way envoy ext_authz filter is written today, it only allows setting a header, or appending (value will be added to existing header, separated by a comma).

this is the relevant code:

https://github.com/envoyproxy/envoy/blob/0f5dd5b45b5e17eb316c1502ac11aa4d1cd39d55/source/extensions/filters/http/ext_authz/ext_authz.cc#L164-L170

to enable this use-case, an envoy PR will be needed to support addCopy in addtion to setCopy and appendCopy

[Jingru]

Thanks for the reply!
It seems like kubernetes api server won't split group string concatenated by comma. It just takes the group header as a whole.
I guess an envoy PR is necessary.