contrib/envoyproxy: envoy external processing support#2895
Conversation
fcbd354 to
a587a09
Compare
BenchmarksBenchmark execution time: 2024-12-16 13:53:07 Comparing candidate commit bece5b0 in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 58 metrics, 1 unstable metrics. |
4134743 to
a96cc2a
Compare
eliottness
changed the title
0929de5 to
e3bb1e5
Compare
c7063d8 to
b0844b8
Compare
Signed-off-by: Eliott Bouhana <[email protected]>
* Add support for context propagation * Normalize span tag use Co-authored-by: Flavien Darche <[email protected]> Signed-off-by: Eliott Bouhana <[email protected]>
b0844b8 to
961d73d
Compare
Datadog ReportBranch report: ✅ 0 Failed, 5112 Passed, 70 Skipped, 2m 53.79s Total Time |
| // Create a listener for the server. | ||
| ln, err := net.Listen("tcp", ":50051") | ||
| if err != nil { | ||
| log.Fatal(err) | ||
| } | ||
|
|
||
| // Create the server interceptor using the envoy go control plane package. | ||
| si := go_control_plane.StreamServerInterceptor() | ||
|
|
||
| // Initialize the grpc server as normal, using the envoy server interceptor. | ||
| s := grpc.NewServer(grpc.StreamInterceptor(si)) | ||
|
|
||
| // ... register your services | ||
|
|
There was a problem hiding this comment.
Could you add a more "real-world" like example? similar to https://github.com/envoyproxy/go-control-plane/blob/main/examples/dyplomat/main.go#L43-L53
(currently this example is just a generic grpc server without any envoyproxy stuff)
There was a problem hiding this comment.
I applied change in 22d7095
Tell me if that is looking good for you 😄
| } | ||
| }() | ||
|
|
||
| for { |
There was a problem hiding this comment.
I find this pattern a little bit odd for an interceptor / middleware.
Since it seems this is pretty much specifically intended to override the behaviour of ext_procv3.ExternalProcessorServer.Process, have you considered exporting this functionality as an implementation of this interface instead of a middleware? This way, users could just do:
import envoytrace "gopkg.in/DataDog/dd-trace-go.v1/contrib/envoyproxy/go-control-plane"
// srv would be the user provided implementation of `ext_procv3.ExternalProcessorServer`
appsecBlockSrv := envoytrace.AppsecBlockingProcessorServer(srv) // internally you would call srv.Process() when the request is not blocked
ext_procv3.RegisterExternalProcessorServer(grpcServer, appsecBlockSrv)There was a problem hiding this comment.
I changed it in 22d7095
Is that what you were thinking of?
rarguelloF
left a comment
rarguelloF
left a comment
There was a problem hiding this comment.
LGTM! thanks for your patience! 😄 @e-n-0
darccio
left a comment
darccio
left a comment
There was a problem hiding this comment.
Approving this PR with some nits (only apply if you want).
5 participants
Motivation
This is the part 1 PR to support Envoy's External Processing.
You can find all related document for this implementation in Confluence ASM - GCP Services Extensions.
You can find the part 2 of this PR here.
What does this PR do?
This PR adds a new gRPC Interceptor (
StreamServerInterceptor) to support the interception of ext_proc v3 calls to gRPC server. When the interceptor is applied, all messages of the external processing protocol are instrumented without returning an handle to the original server code. The implementation of a server using this instrumentation can be found in the part 2.The implementation includes:
content-typeandredirect)http.Requestobject.Tests
This PR includes unit testing in the
envoy_tests.go, simulating scenarios of malicious or benign requests, validating span tags, security events and blocking results.System-tests have been implemented on this PR. A new
external-processingscenario has been added in thegolangstage.Reviewer's Checklist
Unsure? Have a question? Request a review!