gRPC: header specified in auth-response-headers is not rewritten

[kd7lxl]

Is this a request for help? (If yes, you should use our troubleshooting guide and community support channels, see https://kubernetes.io/docs/tasks/debug-application-cluster/troubleshooting/.): no

What keywords did you search in NGINX Ingress controller issues before filing this one? (If you have found any duplicates, you should instead reply there.): grpc

---

Is this a BUG REPORT or FEATURE REQUEST? (choose one): BUG REPORT

NGINX Ingress controller version: 0.21

What happened:
When using a gRPC backend, external auth, and auth-response-headers, the specified header is not rewritten with the one from the auth response. The original request header is passed through unmodified.

What you expected to happen:
Headers defined in auth-response-headers should be rewritten from the auth response.

How to reproduce it (as minimally and precisely as possible):

kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/auth-response-headers: Authorization
    nginx.ingress.kubernetes.io/auth-url: http://authn.authn.svc/verify
    nginx.ingress.kubernetes.io/backend-protocol: GRPC
...

Anything else we need to know:
This is caused because the auth-response-header template uses proxy_set_header instead of grpc_set_header.

Here is an example from the generated nginx conf:

            proxy_set_header 'Authorization' $authHeader0;
            
            client_max_body_size                    1m;
            
            grpc_set_header Host                   $best_http_host;
            
            # Pass the extracted client certificate to the backend
            
            # Allow websocket connections
            grpc_set_header                        Upgrade           $http_upgrade;
            grpc_set_header                        Connection        $connection_upgrade;

We can see that Authorization uses proxy_set_header while the other headers correctly use grpc_set_header.

[aledbf]

When using a gRPC backend, external auth, and auth-response-headers, the specified header is not rewritten with the one from the auth response.

There is no support for gRPC auth, the annotation only works for HTTP

[kd7lxl]

A workaround for this bug is to manually add the missing line with a configuration snippet annotation:

    nginx.ingress.kubernetes.io/configuration-snippet: |
      grpc_set_header 'Authorization' $authHeader0;

[kd7lxl]

Why is this kind/feature? The docs don't mention anything about this combination being mutually exclusive, and the code attempts to configure external auth with gRPC backends, it just does it wrong. Since the implementation exists, but is broken, it should be classified as a bug.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[kd7lxl]

/remove-lifecycle stale

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[fejta-bot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

[k8s-ci-robot]

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[derekperkins]

/remove-lifecycle rotten