1.17 metadata header validation (#10147)

Co-authored-by: soloio-bulldozer[bot] <48420018+soloio-bulldozer[bot]@users.noreply.github.com>
Co-authored-by: changelog-bot <changelog-bot>

changelog/v1.17.14/validate-apikey-data.yaml

@@ -0,0 +1,7 @@
+changelog:
+  - type: NON_USER_FACING
+    issueLink: https://github.com/solo-io/ext-auth-service/issues/762
+    resolvesIssue: false
+    description: >-
+      Updating extauth APIKey config to add 'skipMetadataValidation', which will allow EE users to turn off data plane valdiation
+      of headers returned by the APIKey service.

install/helm/gloo/crds/enterprise.gloo.solo.io_v1_AuthConfig.yaml

@@ -170,6 +170,8 @@ spec:
                           additionalProperties:
                             type: string
                           type: object
+                        skipMetadataValidation:
+                          type: boolean
                       type: object
                     basicAuth:
                       properties:

projects/gloo/api/v1/enterprise/options/extauth/v1/extauth.proto

@@ -1094,6 +1094,11 @@ message ApiKeyAuth {
         // to the request.
         bool required = 2;
     }
+
+    // API key metadata may contain data is is invalid for a header, such as a newline. By default, this data will be validated
+    // in the data plane and mitigated in a way that provides a consistent experience for the user and visibility for the operator.
+    // This validation comes with a performance cost, and can be disabled by setting this field to `true`.
+    bool skip_metadata_validation = 8;
 }
 message K8sSecretApiKeyStorage {
     // Identify all valid API key secrets that match the provided label selector.<br/>
@@ -2021,6 +2026,11 @@ message ExtAuthConfig {
             K8sSecretApiKeyStorage k8s_secret_apikey_storage = 4;
             AerospikeApiKeyStorage aerospike_apikey_storage = 5;
         }
+
+        // API key metadata may contain data is is invalid for a header, such as a newline. By default, this data will be validated
+        // in the data plane and mitigated in a way that provides a consistent experience for the user and visibility for the operator.
+        // This validation comes with a performance cost, and can be disabled by setting this field to `true`.
+        bool skip_metadata_validation = 6;
     }
 
     message OpaAuthConfig {