@@ -36,11 +36,7 @@ var _ httpFilter = &oidc{}
3636
3737// patchHCM builds and appends the oauth2 Filters to the HTTP Connection Manager
3838// if applicable, and it does not already exist.
39- // Note: this method creates an oauth2 filter for each route that contains an OIDC config.
40- // the filter is disabled by default. It is enabled on the route level.
4139func (* oidc ) patchHCM (mgr * hcmv3.HttpConnectionManager , irListener * ir.HTTPListener ) error {
42- var errs error
43-
4440 if mgr == nil {
4541 return errors .New ("hcm is nil" )
4642 }
@@ -49,55 +45,42 @@ func (*oidc) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPListe
4945 return errors .New ("ir listener is nil" )
5046 }
5147
48+ if hcmContainsFilter (mgr , string (egv1a1 .EnvoyFilterOAuth2 )) {
49+ return nil
50+ }
51+
5252 for _ , route := range irListener .Routes {
5353 if ! routeContainsOIDC (route ) {
5454 continue
5555 }
5656
57- // Only generates one OAuth2 Envoy filter for each unique name.
58- // For example, if there are two routes under the same gateway with the
59- // same OAuth2 config, only one OAuth2 filter will be generated.
60- if hcmContainsFilter (mgr , oauth2FilterName (route .Security .OIDC )) {
61- continue
62- }
63-
64- filter , err := buildHCMOAuth2Filter (route .Security )
57+ filter , err := buildHCMOAuth2Filter ()
6558 if err != nil {
66- errs = errors .Join (errs , err )
67- continue
59+ return err
6860 }
69-
7061 mgr .HttpFilters = append (mgr .HttpFilters , filter )
62+ return nil
7163 }
7264
73- return errs
65+ return nil
7466}
7567
76- // buildHCMOAuth2Filter returns an OAuth2 HTTP filter from the provided IR HTTPRoute.
77- func buildHCMOAuth2Filter (securityFeatures * ir.SecurityFeatures ) (* hcmv3.HttpFilter , error ) {
78- oauth2Proto , err := oauth2Config (securityFeatures )
79- if err != nil {
80- return nil , err
81- }
82-
68+ // buildHCMOAuth2Filter returns the listener-level OAuth2 HTTP filter.
69+ func buildHCMOAuth2Filter () (* hcmv3.HttpFilter , error ) {
70+ oauth2Proto := & oauth2v3.OAuth2 {}
8371 OAuth2Any , err := proto .ToAnyWithValidation (oauth2Proto )
8472 if err != nil {
8573 return nil , err
8674 }
8775
8876 return & hcmv3.HttpFilter {
89- Name : oauth2FilterName (securityFeatures .OIDC ),
90- Disabled : true ,
77+ Name : string (egv1a1 .EnvoyFilterOAuth2 ),
9178 ConfigType : & hcmv3.HttpFilter_TypedConfig {
9279 TypedConfig : OAuth2Any ,
9380 },
9481 }, nil
9582}
9683
97- func oauth2FilterName (oidc * ir.OIDC ) string {
98- return perRouteFilterName (egv1a1 .EnvoyFilterOAuth2 , oidc .Name )
99- }
100-
10184func oauth2Config (securityFeatures * ir.SecurityFeatures ) (* oauth2v3.OAuth2 , error ) {
10285 var (
10386 tokenEndpointCluster string
@@ -586,11 +569,19 @@ func (*oidc) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute, _ *ir.HTTPL
586569 if irRoute .Security == nil || irRoute .Security .OIDC == nil {
587570 return nil
588571 }
589- filterName := oauth2FilterName (irRoute .Security .OIDC )
590- if err := enableFilterOnRoute (route , filterName , & routev3.FilterConfig {
591- Config : & anypb.Any {},
592- }); err != nil {
572+ oauth2Proto , err := oauth2Config (irRoute .Security )
573+ if err != nil {
593574 return err
594575 }
576+ if route .TypedPerFilterConfig == nil {
577+ route .TypedPerFilterConfig = make (map [string ]* anypb.Any )
578+ }
579+
580+ oauth2Any , err := proto .ToAnyWithValidation (oauth2Proto )
581+ if err != nil {
582+ return err
583+ }
584+
585+ route .TypedPerFilterConfig [string (egv1a1 .EnvoyFilterOAuth2 )] = oauth2Any
595586 return nil
596587}
0 commit comments