From 2e6d541b2d182f3750dd7033d0e60b849b3e23f8 Mon Sep 17 00:00:00 2001 From: mo khan Date: Mon, 14 Jul 2025 14:02:17 -0600 Subject: chore: run authzd on 50052 instead of 50051 to prevent port collision --- etc/envoy/envoy.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'etc/envoy') diff --git a/etc/envoy/envoy.yaml b/etc/envoy/envoy.yaml index 19df6a4f..9594c9e4 100644 --- a/etc/envoy/envoy.yaml +++ b/etc/envoy/envoy.yaml @@ -34,7 +34,7 @@ static_resources: address: socket_address: address: 127.0.0.1 - port_value: 50051 + port_value: 50052 typed_extension_protocol_options: envoy.extensions.upstreams.http.v3.HttpProtocolOptions: "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions -- cgit v1.2.3 From d3b876c7181731a8596d58750d1c2046bad8e8a5 Mon Sep 17 00:00:00 2001 From: mo khan Date: Mon, 14 Jul 2025 14:23:07 -0600 Subject: chore: update envoy to proxy requests directly to spicedb --- etc/envoy/envoy.yaml | 42 ++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 40 insertions(+), 2 deletions(-) (limited to 'etc/envoy') diff --git a/etc/envoy/envoy.yaml b/etc/envoy/envoy.yaml index 9594c9e4..bfe2ce16 100644 --- a/etc/envoy/envoy.yaml +++ b/etc/envoy/envoy.yaml @@ -53,6 +53,37 @@ static_resources: max_pending_requests: 1024 max_requests: 1024 max_retries: 3 + - name: spicedb + connect_timeout: 5s + type: STATIC + lb_policy: ROUND_ROBIN + load_assignment: + cluster_name: spicedb + endpoints: + - lb_endpoints: + - endpoint: + address: + socket_address: + address: 127.0.0.1 + port_value: 50051 + typed_extension_protocol_options: + envoy.extensions.upstreams.http.v3.HttpProtocolOptions: + "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions + explicit_http_config: + http2_protocol_options: {} + health_checks: + - timeout: 3s + interval: 5s + unhealthy_threshold: 2 + healthy_threshold: 2 + grpc_health_check: {} + circuit_breakers: + thresholds: + - priority: DEFAULT + max_connections: 1024 + max_pending_requests: 1024 + max_requests: 1024 + max_retries: 3 listeners: - name: main_listener address: @@ -120,14 +151,21 @@ static_resources: key: "x-xss-protection" value: "1; mode=block" virtual_hosts: - - name: backend + - name: grpc_services domains: ["*"] routes: + # Route ext_authz to authzd - match: - prefix: "/" + prefix: "/envoy.service.auth.v3.Authorization/" route: cluster: authzd timeout: 30s + # Default route - everything else goes to SpiceDB + - match: + prefix: "/" + route: + cluster: spicedb + timeout: 30s retry_policy: retry_on: "5xx,reset,connect-failure,retriable-status-codes" num_retries: 3 -- cgit v1.2.3 From debf8403c595c98213bf17913824b081262c15e2 Mon Sep 17 00:00:00 2001 From: mo khan Date: Mon, 14 Jul 2025 14:32:53 -0600 Subject: chore: handle health checks in envoy rather than authzd --- Cargo.toml | 2 -- etc/envoy/envoy.yaml | 3 +++ src/authorization/server.rs | 16 +--------------- 3 files changed, 4 insertions(+), 17 deletions(-) (limited to 'etc/envoy') diff --git a/Cargo.toml b/Cargo.toml index c99f5625..0a3f3483 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -22,8 +22,6 @@ serde = { version = "1.0", features = ["derive"] } serde_json = "1.0" tokio = { version = "1.0.0", features = ["macros", "rt-multi-thread"] } tonic = "0.13.1" -tonic-health = "0.13.1" -tonic-reflection = "0.13.1" tracing = "0.1" tracing-subscriber = { version = "0.3", features = ["json"] } urlencoding = "2.1" diff --git a/etc/envoy/envoy.yaml b/etc/envoy/envoy.yaml index bfe2ce16..62f8345b 100644 --- a/etc/envoy/envoy.yaml +++ b/etc/envoy/envoy.yaml @@ -131,6 +131,9 @@ static_resources: - name: ":path" string_match: exact: "/health" + cluster_min_healthy_percentages: + authzd: 100.0 + spicedb: 100.0 - name: envoy.filters.http.router typed_config: "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router diff --git a/src/authorization/server.rs b/src/authorization/server.rs index 90d3edf6..31bf2af8 100644 --- a/src/authorization/server.rs +++ b/src/authorization/server.rs @@ -9,25 +9,11 @@ pub struct Server { impl Server { pub fn new(authorizer: T) -> Result> { - let (health_reporter, health_service) = tonic_health::server::health_reporter(); - std::mem::drop( - health_reporter.set_service_status("", tonic_health::ServingStatus::Serving), - ); let authorization_service = AuthorizationServer::new(CheckService::new(Arc::new(authorizer))); - let reflection_service = tonic_reflection::server::Builder::configure() - .register_encoded_file_descriptor_set(tonic_health::pb::FILE_DESCRIPTOR_SET) - .register_encoded_file_descriptor_set(include_bytes!( - "../../vendor/envoy-types/src/generated/types.bin" - )) - .build_v1()?; - Ok(Self::new_with(|mut builder| { - builder - .add_service(authorization_service) - .add_service(health_service) - .add_service(reflection_service) + builder.add_service(authorization_service) })) } -- cgit v1.2.3 From 52640fad10e8d0c07230ca552dac5d168f5b8deb Mon Sep 17 00:00:00 2001 From: mo khan Date: Mon, 14 Jul 2025 14:55:28 -0600 Subject: chore: remove invalid envoy configuration --- etc/envoy/envoy.yaml | 3 --- 1 file changed, 3 deletions(-) (limited to 'etc/envoy') diff --git a/etc/envoy/envoy.yaml b/etc/envoy/envoy.yaml index 62f8345b..bfe2ce16 100644 --- a/etc/envoy/envoy.yaml +++ b/etc/envoy/envoy.yaml @@ -131,9 +131,6 @@ static_resources: - name: ":path" string_match: exact: "/health" - cluster_min_healthy_percentages: - authzd: 100.0 - spicedb: 100.0 - name: envoy.filters.http.router typed_config: "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router -- cgit v1.2.3