Adam Sayah

@chrisgaun this is needed, to be able to use externaldns with NodePort Services

@caleygoff-invitae can you please post some examples of how you use to do it without Gloo Mesh (annotation on svc + annotation on vs), thanks

That's risky but fine imo, (ideal it would be in the metadatas) the scenario can be: - Request received - Do authn - Add a Plugin auth, and based on...

The scope of this can be reduced to only the PassthroughAuth feature. we need something like "failOpenIfConnectionErr", it needs to fail open only if there is a connection issue or...

Will this include an option to strip `x-envoy-peer-metadata` too potentially ? more concerned about the MESH_EXTERNAL usecase

did you figure out the issue here @bb-k8 ?

Just a thought, we can probably use an envoy internal listener for this to avoid upstream changes

This bug seems to have been already fixed in envoy https://github.com/envoyproxy/envoy/pull/33674

@nfuden to confirm, after backporting the fix, we still need to work on the span name that is defaulting today to ingress