From 7f678ce93633ef69b004eb84fd3dba71ff72c46e Mon Sep 17 00:00:00 2001 From: Pushpinder Singh Date: Tue, 8 Sep 2026 23:03:25 -0400 Subject: [PATCH 1/3] fix(docs): simplify Istio auth headers Co-Authored-By: Codex --- src/content/docs/docs/community/kubernetes.mdx | 18 ++---------------- 1 file changed, 2 insertions(+), 16 deletions(-) diff --git a/src/content/docs/docs/community/kubernetes.mdx b/src/content/docs/docs/community/kubernetes.mdx index 4547d43..6af801b 100644 --- a/src/content/docs/docs/community/kubernetes.mdx +++ b/src/content/docs/docs/community/kubernetes.mdx @@ -79,14 +79,7 @@ extensionProviders: service: "tinyauth.tinyauth.svc.cluster.local" port: "3000" pathPrefix: "/api/auth/envoy?path=" - includeRequestHeadersInCheck: ["cookie", "x-forwarded-for", "x-forwarded-proto", "x-forwarded-host", "accept", "user-agent"] - includeAdditionalHeadersInCheck: - "x-forwarded-for": "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%" - "x-real-ip": "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%" - "x-forwarded-proto": "%REQ(:SCHEME)%" - "x-forwarded-host": "%REQ(:AUTHORITY)%" - "x-forwarded-uri": "%REQ(:PATH)%" - "x-forwarded-method": "%REQ(:METHOD)%" + includeRequestHeadersInCheck: ["cookie", "x-forwarded-for", "x-forwarded-proto", "user-agent"] headersToDownstreamOnAllow: ["set-cookie"] headersToDownstreamOnDeny: ["content-type", "set-cookie"] ``` @@ -111,14 +104,7 @@ meshConfig: service: "tinyauth.tinyauth.svc.cluster.local" port: "3000" pathPrefix: "/api/auth/envoy?path=" - includeRequestHeadersInCheck: ["cookie", "x-forwarded-for", "x-forwarded-proto", "x-forwarded-host", "accept", "user-agent"] - includeAdditionalHeadersInCheck: - "x-forwarded-for": "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%" - "x-real-ip": "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%" - "x-forwarded-proto": "%REQ(:SCHEME)%" - "x-forwarded-host": "%REQ(:AUTHORITY)%" - "x-forwarded-uri": "%REQ(:PATH)%" - "x-forwarded-method": "%REQ(:METHOD)%" + includeRequestHeadersInCheck: ["cookie", "x-forwarded-for", "x-forwarded-proto", "user-agent"] headersToDownstreamOnAllow: ["set-cookie"] headersToDownstreamOnDeny: ["content-type", "set-cookie"] ``` From 2fd74dc61d90925ccfb4c3ce76e2a2550e3dada5 Mon Sep 17 00:00:00 2001 From: Pushpinder Singh Date: Sun, 13 Sep 2026 15:17:16 -0400 Subject: [PATCH 2/3] fix(docs): add x-real-ip and example for sending remote-email to the backend --- src/content/docs/docs/community/kubernetes.mdx | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/content/docs/docs/community/kubernetes.mdx b/src/content/docs/docs/community/kubernetes.mdx index 6af801b..471c2aa 100644 --- a/src/content/docs/docs/community/kubernetes.mdx +++ b/src/content/docs/docs/community/kubernetes.mdx @@ -105,6 +105,9 @@ meshConfig: port: "3000" pathPrefix: "/api/auth/envoy?path=" includeRequestHeadersInCheck: ["cookie", "x-forwarded-for", "x-forwarded-proto", "user-agent"] + includeAdditionalHeadersInCheck: + "x-real-ip": "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%" + headersToUpstreamOnAllow: ["remote-user", "remote-email"] headersToDownstreamOnAllow: ["set-cookie"] headersToDownstreamOnDeny: ["content-type", "set-cookie"] ``` From bcaf090de1b759356f8f31db738af47e444f80cc Mon Sep 17 00:00:00 2001 From: Pushpinder Singh Date: Sun, 13 Sep 2026 15:20:31 -0400 Subject: [PATCH 3/3] fix(docs): update ref --- src/content/docs/docs/community/kubernetes.mdx | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/content/docs/docs/community/kubernetes.mdx b/src/content/docs/docs/community/kubernetes.mdx index 471c2aa..3b33ef3 100644 --- a/src/content/docs/docs/community/kubernetes.mdx +++ b/src/content/docs/docs/community/kubernetes.mdx @@ -80,6 +80,9 @@ extensionProviders: port: "3000" pathPrefix: "/api/auth/envoy?path=" includeRequestHeadersInCheck: ["cookie", "x-forwarded-for", "x-forwarded-proto", "user-agent"] + includeAdditionalHeadersInCheck: + "x-real-ip": "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%" + headersToUpstreamOnAllow: ["remote-user", "remote-email"] headersToDownstreamOnAllow: ["set-cookie"] headersToDownstreamOnDeny: ["content-type", "set-cookie"] ```