Open wbpcode opened 2 weeks ago
I think may be an explicit flag to tell if the envoy is front envoy or not would be better. And use the internal_address_config
as the unique approach to determine whether a request is trust request. (The allow_trusted_address_checks
flag just make things more complex and hybrid the original ip dectection and trust ip detection. Considering the #36643, I didn't see the value of that.)
I know it may be impossible or very hard to change this, because this feature has very very long history. But anyway, I record its problems here for discussion or reference.
cc @mattklein123
cc @alyssawilk
Title: problem of exist edge request and internal request determination
Description:
This is a feature has almost same lifetime with the Envoy self. But I think there are some problem in this feature:
use_remote_address
is enabled. But today, theoriginal_ip_detection_extensions
may be used as alternative ofuse_remote_address
.use_remote_address
is used, the requests will always be treated as external requests except in the first hop.use_remote_address
is used in a inner proxy, some requests may be determined as edge request incorrectly.[optional Relevant Links:]