From be59cffb487b640a17e75095bca009970c7ac39b Mon Sep 17 00:00:00 2001 From: John Lybeck Date: Tue, 4 Aug 2026 08:10:40 +0000 Subject: [PATCH] EAI-7243: forward x-ai-eg-backend for header-less metric attribution Add x-ai-eg-backend to the default-deny SP's headersToBackend so the resolved backend that discovery forwards (core #4309) reaches the ext_proc and populates aim_service_id on the header-less path, where the gateway can't resolve the backend from EDS endpoint metadata. Stacked on the bump branch (that's where the default-deny SP lives); retarget to main after #794 merges. --- .../templates/security-policy-ai-gateway-default-deny.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/sources/envoy-gateway-config/templates/security-policy-ai-gateway-default-deny.yaml b/sources/envoy-gateway-config/templates/security-policy-ai-gateway-default-deny.yaml index 81223d1e..a5619b87 100644 --- a/sources/envoy-gateway-config/templates/security-policy-ai-gateway-default-deny.yaml +++ b/sources/envoy-gateway-config/templates/security-policy-ai-gateway-default-deny.yaml @@ -51,4 +51,9 @@ spec: port: 8083 headersToBackend: - x-api-key-id + # Resolved backend (workload id) discovery authorized against — forwarded so the ext_proc + # stamps aim_service_id on the header-less path (the gateway can't resolve the backend + # from EDS endpoint metadata). Exact for single-backend models; approximate when several + # backends share a model name. See EAI-7243 metrics note. + - x-ai-eg-backend {{- end }}