Skip to content

EAI-7043: fix UUID-based AIM routing via Lua filter #764

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
johnl-amd merged 5 commits into from
Jun 25, 2026
Merged

EAI-7043: fix UUID-based AIM routing via Lua filter #764

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
b628b22
EAI-7043: fix UUID routing by not setting x-ai-eg-model when backend …
johnl-amd Jun 24, 2026
a31bc97
EAI-7043: preserve model attribution in access logs via x-ai-eg-model…
johnl-amd Jun 24, 2026
c6f0f73
EAI-7043: switch to 3-condition UUID rule, Lua sets both backend and …
johnl-amd Jun 24, 2026
810bda7
bump cluster-auth to 0.6.0-rc9
johnl-amd Jun 24, 2026
80bea9c
bump cluster-auth to 0.6.0-rc10
johnl-amd Jun 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion sources/cluster-auth/0.5.9/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ replicaCount: 1
image:
repository: ghcr.io/silogen/cluster-auth
pullPolicy: Always
tag: "0.6.0-rc8"
tag: "0.6.0-rc10"

imagePullSecrets: []
nameOverride: ""
Expand Down
23 changes: 12 additions & 11 deletions sources/envoy-gateway-config/templates/envoy-extension-policy-model-header.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,11 @@
{{- if .Values.aiGateway.enabled }}
# Lua filter that sets x-ai-eg-model from the request body before ext_authz runs, on the
# ai-gateway (where all AI traffic terminates and is authorized).
# Lua filter that extracts routing headers from the request body before ext_authz runs,
# on the ai-gateway (where all AI traffic terminates and is authorized).
#
# The AI Gateway's ext_proc reads the body and sets x-ai-eg-model, but it is inserted via
# xdsTranslator post-hooks which run after filterOrder is applied. So ext_authz (cluster-auth)
# would run without x-ai-eg-model and fall through to a catch-all route with no auth
# annotations, allowing the request regardless of which model is targeted (EAI-6805).
#
# This Lua filter runs early (ordered before ext_authz via the ai-gateway EnvoyProxy
# filterOrder), reads the model field from the JSON body, and sets x-ai-eg-model so
# cluster-auth can match the correct per-model route and enforce cluster-auth/allowed-group.
# Both x-ai-eg-backend and x-ai-eg-model are set from the request body so that the
# 3-condition UUID rule (Host + x-ai-eg-backend + x-ai-eg-model) wins by specificity
# over any catch-all rules in other HTTPRoutes, regardless of HTTPRoute creation order.
# The model-name fallback rule has been removed — clients must supply a backend UUID.
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyExtensionPolicy
metadata:
Expand All @@ -28,7 +24,12 @@ spec:
if body == nil then
return
end
local model = tostring(body):match('"model"%s*:%s*"([^"]+)"')
local body_str = tostring(body)
local backend = body_str:match('"backend"%s*:%s*"([^"]+)"')
local model = body_str:match('"model"%s*:%s*"([^"]+)"')
if backend ~= nil then
request_handle:headers():replace("x-ai-eg-backend", backend)
end
if model ~= nil then
request_handle:headers():replace("x-ai-eg-model", model)
end
Expand Down
Loading