GRPC External authorization without extension providers

[agreedSkiing]

Hi,

Is there a way to register a grpc client with an envoy filter to authorize requests?

I got it working with http.

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: backend-filter
  namespace: agreedSkiing-playground
spec:
  workloadSelector:
    labels:
      app: candy-backend
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND
        listener:
          filterChain:
            filter:
              name: envoy.filters.network.http_connection_manager
              subFilter:
                name: envoy.filters.http.router
      patch:
        operation: INSERT_FIRST
        value:
          name: envoy.filters.http.ext_authz
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
            http_service:
              path_prefix: /auth
              server_uri: 
                uri: "http://auth-backend.agreedSkiing-playground.svc.cluster.local"
                cluster: outbound|8090||auth-backend.agreedSkiing-playground.svc.cluster.local
                timeout: 5s
              authorization_request:
                allowed_headers:
                  patterns:
                    - exact: "authorization"
                    - exact: "x-status"
              authorization_response:
                allowed_upstream_headers:
                  patterns:
                    - exact: "x-response"

I would rather user grpc but when i try to deploy my quarkus grpc application running on port 9000 with the generated library from io.envoyproxy.controlplane:api it can't find the service. I have tried these configs

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: backend-filter
  namespace: agreedSkiing-playground
spec:
  workloadSelector:
    labels:
      app: candy-backend
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND
        listener:
          filterChain:
            filter:
              name: envoy.filters.network.http_connection_manager
              subFilter:
                name: envoy.filters.http.router
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.ext_authz
          typed_config:
            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
            grpc_service:
              timeout: 5s
              envoy_grpc:
                # cluster_name: outbound|9000||auth-backend.agreedSkiing-playground.svc.cluster.local
                cluster_name: auth-backend
              # google_grpc:
              #  target_uri: 127.0.0.1:9000
              #  target_uri: auth-backend.agreedSkiing-playground.svc.cluster.local