<p>I have seen example for EnvoyFilter in ISTIO where <code>grpc_service</code> is supported as filterconfig for external service call out. </p>

<pre><code>kind: EnvoyFilter
metadata:
  name: ext-authz
  namespace: istio-system
spec:
  filters:
  - insertPosition:
      index: FIRST
    listenerMatch:
      listenerType: SIDECAR_INBOUND
      listenerProtocol: HTTP
    filterType: HTTP
    filterName: "envoy.ext_authz"
    filterConfig:
      grpc_service:
        google_grpc:
          target_uri: 127.0.0.1:9191
          stat_prefix: "ext_authz" 
</code></pre>

<p>But I want to use my external service as filterconfig using <strong>http_service</strong> instead of <strong>grpc_service</strong> but everytime I get <code>404 not found</code> error.</p>

<p>Is <code>http_service</code> supported as <code>filterConfig</code> in Istio's <code>envoyFilter</code>?</p>

<p>version info : GKE is 14 and istio is 1.1.17</p>

esha ingle
<p><strong>Update: modified entire answer</strong>.</p>

<p>After further verification it appears that Istio had <code>http_service</code> authorization service in the past it was not fully functional.</p>

<p>There were attempts to implement external HTTP service authorization for older versions of Istio, however it did work and the only workaround solutions were to use http lua filter or Nginx-Ingress Controller as Ingress Gateway that delegates the authentication part.</p>

<p>All of above cases can be found in <a href="https://github.com/istio/istio/issues/13819" rel="nofollow noreferrer">this</a> github issue. The HTTP call was successful but the headers were not being passed.</p>

<p><a href="https://github.com/istio/istio/issues/9097" rel="nofollow noreferrer">Here</a> is another attempt in running <code>http_service</code> as authorization service.</p>

<hr>

<p>As You noticed the <a href="https://www.envoyproxy.io/docs/envoy/v1.11.0/configuration/http_filters/ext_authz_filter.html?highlight=http_service#external-authorization" rel="nofollow noreferrer">Envoy</a> documentation for Envoy <code>1.11.0</code> <code>http_service</code> <code>filterConfig</code> has different syntax. Therefore I suggest trying the configuration for filter from the <a href="https://github.com/istio/istio/issues/13819" rel="nofollow noreferrer">github</a> issue. And if It doesnt't work, try the http lua filter as a workaround.</p>

<p>The HTTP service as an external authorization service its not mentioned in Istio documentation so, I think its safe to say its not fully supported.</p>
