EnvoyFilter：应用 ExtAuthz 过滤器后跟 Lua 过滤器

我正在尝试构建一个使用 v3 API 的 EnvoyFilter，与 Istio 和 OAuth2-Proxy（作为外部 Authz 服务）一起使用。基本上，我需要一个设置，将调用 ExtAuthz 进行身份验证，并检索头文件 x-auth-request-email 并将其重命名为 kubeflow-userid。我在很大程度上难以理解 Envoy 链过滤器。

我目前的尝试如下所示:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: istio-ingressgateway
  namespace: istio-system
spec:
  filters:
  - applyTo: HTTP_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
            subFilter:
              name: envoy.filters.http.jwt_authn
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filters.http.ext_authz
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
          http_service:
            server_uri:
              uri: http://oauth2-proxy.oauth2-proxy.svc.cluster.local:4180
              cluster: outbound|4180||oauth2-proxy.oauth2-proxy.svc.cluster.local
              timeout: 10s
            authorizationRequest:
              allowedHeaders:
                patterns:
                - exact: cookie
              authorizationResponse:
                allowedUpstreamHeaders:
                  patterns:
                    # - exact: "kubeflow-userid"
                    - exact: "authorization"
                    - exact: "x-auth-request-email"
  - applyTo: HTTP_FILTER # should this be NETWORK_FILTER instead?
    match: # how do I define the context here?
      #context: GATEWAY
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
            subFilter:
              name: envoy.filters.http.jwt_authn
    patch:
      operation: MERGE # what should this be?
      value:
        name: envoy.filters.http.lua
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
          inline_code: |
            function envoy_on_request(request_handle)
              headers = request_handle:headers()
              request_handle:headers():add("kubeflow-userid", headers:get("x-auth-request-email))
            end