This project is in the process of being donated to the CNCF and is not affiliated with the Kubernetes project.

Decode base64 headers

In the following example, you combine multiple Inja functions to accomplish the following tasks:

  • Extract a base64-encoded value from a specific request header.
  • Decode the base64-encoded value.
  • Trim the decoded value and only capture everything starting from the 11th character.
  • Add the captured string as a response header.

Before you begin

  1. Follow the Get started guide to install K8sGateway, set up a gateway resource, and deploy the httpbin sample app.

  2. Get the external address of the gateway and save it in an environment variable.

    export INGRESS_GW_ADDRESS=$(kubectl get svc -n gloo-system gloo-proxy-http -o jsonpath="{.status.loadBalancer.ingress[0]['hostname','ip']}")
    echo $INGRESS_GW_ADDRESS  
    kubectl port-forward deployment/gloo-proxy-http -n gloo-system 8080:8080

Decode base64 headers

  1. Encode a string to base64.

    echo -n "transformation test" | base64

    Example output:

    dHJhbnNmb3JtYXRpb24gdGVzdA==
  2. Create a VirtualHostOption resource with your transformation rules. In the following example, you decode the base64-encoded value from the x-base64-encoded request header and populate the decoded value into an x-base64-decoded header starting from the 11th character.

    kubectl apply -n gloo-system -f- <<EOF
    apiVersion: gateway.solo.io/v1
    kind: VirtualHostOption
    metadata:
      name: transformation
      namespace: gloo-system
    spec:
      options:
        transformations:
          responseTransformation:
            transformationTemplate:
              headers:
                x-base64-decoded:
                  text: '{{substring(base64_decode(request_header("x-base64-encoded")), 11)}}'
      targetRefs:
      - group: gateway.networking.k8s.io
        kind: Gateway
        name: http
        namespace: gloo-system
    EOF
  3. Send a request to the httpbin app and include your base64-encoded string in the x-base64-encoded request header. Verify that you get back a 200 HTTP response code and that you see the trimmed decoded value of your base64-encoded string in the x-base64-decoded response header.

    curl -vik http://$INGRESS_GW_ADDRESS:8080/response-headers \
     -H "host: www.example.com:8080" \
     -H "x-base64-encoded: dHJhbnNmb3JtYXRpb24gdGVzdA==" 
    curl -vik localhost:8080/response-headers \
    -H "host: www.example.com" \
    -H "x-base64-encoded: dHJhbnNmb3JtYXRpb24gdGVzdA==" 

    Example output:

     1
     2
     3
     4
     5
     6
     7
     8
     9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    
    * Mark bundle as not supporting multiuse
    < HTTP/1.1 200 OK
    HTTP/1.1 200 OK
    < access-control-allow-credentials: true
    access-control-allow-credentials: true
    < access-control-allow-origin: *
    access-control-allow-origin: *
    < content-type: application/json; encoding=utf-8
    content-type: application/json; encoding=utf-8
    < date: Wed, 26 Jun 2024 02:54:48 GMT
    date: Wed, 26 Jun 2024 02:54:48 GMT
    < content-length: 3
    content-length: 3
    < x-envoy-upstream-service-time: 2
    x-envoy-upstream-service-time: 2
    < server: envoy
    server: envoy
    < x-envoy-decorator-operation: httpbin.httpbin.svc.cluster.local:8000/*
    x-envoy-decorator-operation: httpbin.httpbin.svc.cluster.local:8000/*
    < x-base64-decoded: ion test
    x-base64-decoded: ion test

Cleanup

You can remove the resources that you created in this guide.
kubectl delete virtualhostoption transformation -n gloo-system