envoy

Documentation

Index

• Variables
• func AuthzRequestToFlowLabels(request *ext_authz.AttributeContext_Request) flowlabel.FlowLabels
• func Register(handler *Handler, server *grpc.Server, healthsrv *health.Server)
• type Handler
  • func NewHandler(classifier *classification.ClassificationEngine, ...) *Handler
  • func (h *Handler) Check(ctx context.Context, req *ext_authz.CheckRequest) (*ext_authz.CheckResponse, error)
• type Invocations
  • func OnNamedServer(serverName string) Invocations

Variables

var Module = fx.Options(
	fx.Provide(ProvideHandler),
	fx.Invoke(Register),
)

Module provides authz handler

Authz handler is one of the APIs to classification and flowcontrol modules. Authz uses envoy's external authorization grpc API.

Note: Register function is not bundled inside this module and should be invoked explicitly.

var ProvideHandler = NewHandler

ProvideHandler provides an authz handler

See NewHandler for more docs.

Functions

func AuthzRequestToFlowLabels

func AuthzRequestToFlowLabels(request *ext_authz.AttributeContext_Request) flowlabel.FlowLabels

AuthzRequestToFlowLabels converts request attributes to new FlowLabels.

func Register

func Register(handler *Handler, server *grpc.Server, healthsrv *health.Server)

Register registers the handler on grpc.Server

To be used in fx.Invoke.

Types

type Handler

type Handler struct {
	// contains filtered or unexported fields
}

Handler implements envoy.service.auth.v3.Authorization and handles Check call.

func NewHandler

func NewHandler(
	classifier *classification.ClassificationEngine,
	entityCache *entitycache.EntityCache,
	fcHandler common.HandlerWithValues,
) *Handler

NewHandler creates new authorization handler for authz api

Authz will use the given classifier to inject flow labels and return them as metadata in the response to the Check calls

entityCache can be nil. In this case services will be guessed based on Host header. No-entity-cache support is mostly so that authz can be experimented with without the need for tagger to run.

func (*Handler) Check

func (h *Handler) Check(ctx context.Context, req *ext_authz.CheckRequest) (*ext_authz.CheckResponse, error)

Check is the Check method of Authorization service

Check * computes flow labels and returns them via DynamicMetadata. * makes the allow/deny decision - sends flow labels to flow control's Check function.

type Invocations

type Invocations struct {
	Register interface{}
}

Invocations is a set of register functions to be used in fx.Invoke.

func OnNamedServer

func OnNamedServer(serverName string) Invocations

OnNamedServer returns a register function that will register authz handler on *named* grpc.Server

Usage:

fx.Invoke(authz.OnNamedServer("foo").Register)