Set internal_address_config on HttpConnectionManager explicitly

[jijiechen]

Description

Envoy is warning when HCM does not have explicit internal_address_config set and it will not consider any IP address as internal in a future release, so we need to adapte to this change before our next Envoy version bump.

This is considered a feature because it did not impact our existing versions.

Reproduce steps

1. download Kuma
2. Run the zone cp and a DP following the quick start guide
3. check the sidecar log

Actual result

A warning shows up:

[2024-12-09 06:12:49.716][20][warning][misc] [source/extensions/filters/network/http_connection_manager/config.cc:82] internal_address_config is not configured. The existing default behaviour will trust RFC1918 IP addresses, but this will be changed in next release. Please explictily config internal address config as the migration step.

Expected result

No warning.

More information

As the warning states, the HCM recognized IP addresses defined in RFC1918 as internal by default, and this will be changed in a newer release. This will impact the behaviour of logging and header santination of Envoy.

This behaviour can be controlled by Envoy runtime feature flag
envoy.reloadable_features.explicit_internal_address_config
This feature flag defaults to false in all existing Envoy versions (1.29.11, 1.32.2), but the code has been changed to defaults to true on the main branch.

There is a related Envoy CVE:

• CVE-2024-45806: (CVSS Score 6.5, Moderate): Potential for x-envoy headers to be manipulated by external sources.

What is an internal address?

.InternalAddressConfig Configures what network addresses are considered internal for stats and header sanitation purposes. If unspecified, only RFC1918 IP addresses will be considered internal. See the documentation for x-envoy-internal for more information about internal/external addresses.
Source: Envoy docs

Other projects had fixed/discussed simimar issue:

• Cilium: envoy: Configure internal_address_config to avoid warning log cilium/cilium#35090 envoy: Configure internal_address_config to avoid warning log cilium/cilium#35943
• Istio: Internal envoy header sanitization  istio/istio#53402

Envoy implementation

The runtime feature flag: https://github.com/envoyproxy/envoy/blob/a0504e87c5a246cb097b37049b1e4dc7706c2a90/source/common/http/conn_manager_config.h#L194

Default implementation: https://github.com/envoyproxy/envoy/blob/v1.32.2/source/common/network/utility.cc#L272

[lukidzi]

Triage: We should configure defaults compliant with RFC. The question is if there are cases of using a different pool of addresses than one in RFC? We should check if that is the case.

[jijiechen]

This configuration can be a zone CP configuration since it can differ from zone to zone.