Chiebot-Mirror
/
data-plane-api
mirror of https://github.com/envoyproxy/data-plane-api.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

ext_authz: Add dynamic metadata field to CheckResponse (#12677)

Browse Source 
This adds a dynamic_metadata field to CheckResponse message, hence it can be used for any type of HTTP response (OkHttpResponse or DeniedHttpResponse).

Risk Level: Low
Testing: Updated
Docs Changes: Updated
Release Notes: Added
Fixes #12671

Signed-off-by: Dhi Aurrahman <dio@tetrate.io>

Mirrored from https://github.com/envoyproxy/envoy @ cbdd01c22b84ac5333f95f030821dfcf6db49734
master-ci-test
data-plane-api(CircleCI) 5 years ago
parent a89e7e0ace
commit 46bf7af76c
5 changed files with 306 additions and 9 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 4
      envoy/extensions/filters/http/ext_authz/v4alpha/ext_authz.proto
  2. 20
      envoy/service/auth/v3/external_auth.proto
  3. 15
      envoy/service/auth/v4alpha/BUILD
  4. 171
      envoy/service/auth/v4alpha/attribute_context.proto
  5. 105
      envoy/service/auth/v4alpha/external_auth.proto

4
envoy/extensions/filters/http/ext_authz/v4alpha/ext_authz.proto
Unescape View File

@ -115,7 +115,7 @@ message ExtAuthz {
// Specifies if the peer certificate is sent to the external service.
//
// When this field is true, Envoy will include the peer X.509 certificate, if available, in the
// :ref:`certificate<envoy_api_field_service.auth.v3.AttributeContext.Peer.certificate>`.
// :ref:`certificate<envoy_api_field_service.auth.v4alpha.AttributeContext.Peer.certificate>`.
bool include_peer_certificate = 10;
}
@ -253,7 +253,7 @@ message CheckSettings {
"envoy.extensions.filters.http.ext_authz.v3.CheckSettings";
// Context extensions to set on the CheckRequest's
// :ref:`AttributeContext.context_extensions<envoy_api_field_service.auth.v3.AttributeContext.context_extensions>`
// :ref:`AttributeContext.context_extensions<envoy_api_field_service.auth.v4alpha.AttributeContext.context_extensions>`
//
// Merge semantics for this field are such that keys from more specific configs override.
//

20
envoy/service/auth/v3/external_auth.proto
Unescape View File

@ -71,13 +71,11 @@ message OkHttpResponse {
// one if there is a match.
repeated config.core.v3.HeaderValueOption headers = 2;
// Optional response metadata that will be emitted as dynamic metadata to be consumed by the next
// filter. This metadata lives in a namespace specified by the canonical name of extension filter
// that requires it:
//
// - :ref:`envoy.filters.http.ext_authz <config_http_filters_ext_authz_dynamic_metadata>` for HTTP filter.
// - :ref:`envoy.filters.network.ext_authz <config_network_filters_ext_authz_dynamic_metadata>` for network filter.
google.protobuf.Struct dynamic_metadata = 3;
// This field has been deprecated in favor of :ref:`CheckResponse.dynamic_metadata
// <envoy_v3_api_field_service.auth.v3.CheckResponse.dynamic_metadata>`. Until it is removed,
// setting this field overrides :ref:`CheckResponse.dynamic_metadata
// <envoy_v3_api_field_service.auth.v3.CheckResponse.dynamic_metadata>`.
google.protobuf.Struct dynamic_metadata = 3 [deprecated = true];
}
// Intended for gRPC and Network Authorization servers `only`.
@ -98,4 +96,12 @@ message CheckResponse {
// Supplies http attributes for an ok response.
OkHttpResponse ok_response = 3;
}
// Optional response metadata that will be emitted as dynamic metadata to be consumed by the next
// filter. This metadata lives in a namespace specified by the canonical name of extension filter
// that requires it:
//
// - :ref:`envoy.filters.http.ext_authz <config_http_filters_ext_authz_dynamic_metadata>` for HTTP filter.
// - :ref:`envoy.filters.network.ext_authz <config_network_filters_ext_authz_dynamic_metadata>` for network filter.
google.protobuf.Struct dynamic_metadata = 4;
}

15
envoy/service/auth/v4alpha/BUILD
Unescape View File

@ -0,0 +1,15 @@
# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
licenses(["notice"]) # Apache 2
api_proto_package(
has_services = True,
deps = [
"//envoy/config/core/v4alpha:pkg",
"//envoy/service/auth/v3:pkg",
"//envoy/type/v3:pkg",
"@com_github_cncf_udpa//udpa/annotations:pkg",
],
)

171
envoy/service/auth/v4alpha/attribute_context.proto
Unescape View File

@ -0,0 +1,171 @@
syntax = "proto3";
package envoy.service.auth.v4alpha;
import "envoy/config/core/v4alpha/address.proto";
import "envoy/config/core/v4alpha/base.proto";
import "google/protobuf/timestamp.proto";
import "udpa/annotations/status.proto";
import "udpa/annotations/versioning.proto";
option java_package = "io.envoyproxy.envoy.service.auth.v4alpha";
option java_outer_classname = "AttributeContextProto";
option java_multiple_files = true;
option (udpa.annotations.file_status).package_version_status = NEXT_MAJOR_VERSION_CANDIDATE;
// [#protodoc-title: Attribute Context ]
// See :ref:`network filter configuration overview <config_network_filters_ext_authz>`
// and :ref:`HTTP filter configuration overview <config_http_filters_ext_authz>`.
// An attribute is a piece of metadata that describes an activity on a network.
// For example, the size of an HTTP request, or the status code of an HTTP response.
//
// Each attribute has a type and a name, which is logically defined as a proto message field
// of the `AttributeContext`. The `AttributeContext` is a collection of individual attributes
// supported by Envoy authorization system.
// [#comment: The following items are left out of this proto
// Request.Auth field for jwt tokens
// Request.Api for api management
// Origin peer that originated the request
// Caching Protocol
// request_context return values to inject back into the filter chain
// peer.claims -- from X.509 extensions
// Configuration
// - field mask to send
// - which return values from request_context are copied back
// - which return values are copied into request_headers]
// [#next-free-field: 12]
message AttributeContext {
option (udpa.annotations.versioning).previous_message_type =
"envoy.service.auth.v3.AttributeContext";
// This message defines attributes for a node that handles a network request.
// The node can be either a service or an application that sends, forwards,
// or receives the request. Service peers should fill in the `service`,
// `principal`, and `labels` as appropriate.
// [#next-free-field: 6]
message Peer {
option (udpa.annotations.versioning).previous_message_type =
"envoy.service.auth.v3.AttributeContext.Peer";
// The address of the peer, this is typically the IP address.
// It can also be UDS path, or others.
config.core.v4alpha.Address address = 1;
// The canonical service name of the peer.
// It should be set to :ref:`the HTTP x-envoy-downstream-service-cluster
// <config_http_conn_man_headers_downstream-service-cluster>`
// If a more trusted source of the service name is available through mTLS/secure naming, it
// should be used.
string service = 2;
// The labels associated with the peer.
// These could be pod labels for Kubernetes or tags for VMs.
// The source of the labels could be an X.509 certificate or other configuration.
map<string, string> labels = 3;
// The authenticated identity of this peer.
// For example, the identity associated with the workload such as a service account.
// If an X.509 certificate is used to assert the identity this field should be sourced from
// `URI Subject Alternative Names`, `DNS Subject Alternate Names` or `Subject` in that order.
// The primary identity should be the principal. The principal format is issuer specific.
//
// Example:
// * SPIFFE format is `spiffe://trust-domain/path`
// * Google account format is `https://accounts.google.com/{userid}`
string principal = 4;
// The X.509 certificate used to authenticate the identify of this peer.
// When present, the certificate contents are encoded in URL and PEM format.
string certificate = 5;
}
// Represents a network request, such as an HTTP request.
message Request {
option (udpa.annotations.versioning).previous_message_type =
"envoy.service.auth.v3.AttributeContext.Request";
// The timestamp when the proxy receives the first byte of the request.
google.protobuf.Timestamp time = 1;
// Represents an HTTP request or an HTTP-like request.
HttpRequest http = 2;
}
// This message defines attributes for an HTTP request.
// HTTP/1.x, HTTP/2, gRPC are all considered as HTTP requests.
// [#next-free-field: 12]
message HttpRequest {
option (udpa.annotations.versioning).previous_message_type =
"envoy.service.auth.v3.AttributeContext.HttpRequest";
// The unique ID for a request, which can be propagated to downstream
// systems. The ID should have low probability of collision
// within a single day for a specific service.
// For HTTP requests, it should be X-Request-ID or equivalent.
string id = 1;
// The HTTP request method, such as `GET`, `POST`.
string method = 2;
// The HTTP request headers. If multiple headers share the same key, they
// must be merged according to the HTTP spec. All header keys must be
// lower-cased, because HTTP header keys are case-insensitive.
map<string, string> headers = 3;
// The request target, as it appears in the first line of the HTTP request. This includes
// the URL path and query-string. No decoding is performed.
string path = 4;
// The HTTP request `Host` or 'Authority` header value.
string host = 5;
// The HTTP URL scheme, such as `http` and `https`.
string scheme = 6;
// This field is always empty, and exists for compatibility reasons. The HTTP URL query is
// included in `path` field.
string query = 7;
// This field is always empty, and exists for compatibility reasons. The URL fragment is
// not submitted as part of HTTP requests; it is unknowable.
string fragment = 8;
// The HTTP request size in bytes. If unknown, it must be -1.
int64 size = 9;
// The network protocol used with the request, such as "HTTP/1.0", "HTTP/1.1", or "HTTP/2".
//
// See :repo:`headers.h:ProtocolStrings <source/common/http/headers.h>` for a list of all
// possible values.
string protocol = 10;
// The HTTP request body.
string body = 11;
}
// The source of a network activity, such as starting a TCP connection.
// In a multi hop network activity, the source represents the sender of the
// last hop.
Peer source = 1;
// The destination of a network activity, such as accepting a TCP connection.
// In a multi hop network activity, the destination represents the receiver of
// the last hop.
Peer destination = 2;
// Represents a network request, such as an HTTP request.
Request request = 4;
// This is analogous to http_request.headers, however these contents will not be sent to the
// upstream server. Context_extensions provide an extension mechanism for sending additional
// information to the auth server without modifying the proto definition. It maps to the
// internal opaque context in the filter chain.
map<string, string> context_extensions = 10;
// Dynamic metadata associated with the request.
config.core.v4alpha.Metadata metadata_context = 11;
}

105
envoy/service/auth/v4alpha/external_auth.proto
Unescape View File

@ -0,0 +1,105 @@
syntax = "proto3";
package envoy.service.auth.v4alpha;
import "envoy/config/core/v4alpha/base.proto";
import "envoy/service/auth/v4alpha/attribute_context.proto";
import "envoy/type/v3/http_status.proto";
import "google/protobuf/struct.proto";
import "google/rpc/status.proto";
import "udpa/annotations/status.proto";
import "udpa/annotations/versioning.proto";
import "validate/validate.proto";
option java_package = "io.envoyproxy.envoy.service.auth.v4alpha";
option java_outer_classname = "ExternalAuthProto";
option java_multiple_files = true;
option java_generic_services = true;
option (udpa.annotations.file_status).package_version_status = NEXT_MAJOR_VERSION_CANDIDATE;
// [#protodoc-title: Authorization Service ]
// The authorization service request messages used by external authorization :ref:`network filter
// <config_network_filters_ext_authz>` and :ref:`HTTP filter <config_http_filters_ext_authz>`.
// A generic interface for performing authorization check on incoming
// requests to a networked service.
service Authorization {
// Performs authorization check based on the attributes associated with the
// incoming request, and returns status `OK` or not `OK`.
rpc Check(CheckRequest) returns (CheckResponse) {
}
}
message CheckRequest {
option (udpa.annotations.versioning).previous_message_type = "envoy.service.auth.v3.CheckRequest";
// The request attributes.
AttributeContext attributes = 1;
}
// HTTP attributes for a denied response.
message DeniedHttpResponse {
option (udpa.annotations.versioning).previous_message_type =
"envoy.service.auth.v3.DeniedHttpResponse";
// This field allows the authorization service to send a HTTP response status
// code to the downstream client other than 403 (Forbidden).
type.v3.HttpStatus status = 1 [(validate.rules).message = {required: true}];
// This field allows the authorization service to send HTTP response headers
// to the downstream client.
repeated config.core.v4alpha.HeaderValueOption headers = 2;
// This field allows the authorization service to send a response body data
// to the downstream client.
string body = 3;
}
// HTTP attributes for an OK response.
message OkHttpResponse {
option (udpa.annotations.versioning).previous_message_type =
"envoy.service.auth.v3.OkHttpResponse";
reserved 3;
reserved "dynamic_metadata";
// HTTP entity headers in addition to the original request headers. This allows the authorization
// service to append, to add or to override headers from the original request before
// dispatching it to the upstream. By setting `append` field to `true` in the `HeaderValueOption`,
// the filter will append the correspondent header value to the matched request header. Note that
// by Leaving `append` as false, the filter will either add a new header, or override an existing
// one if there is a match.
repeated config.core.v4alpha.HeaderValueOption headers = 2;
}
// Intended for gRPC and Network Authorization servers `only`.
message CheckResponse {
option (udpa.annotations.versioning).previous_message_type =
"envoy.service.auth.v3.CheckResponse";
// Status `OK` allows the request. Any other status indicates the request should be denied.
google.rpc.Status status = 1;
// An message that contains HTTP response attributes. This message is
// used when the authorization service needs to send custom responses to the
// downstream client or, to modify/add request headers being dispatched to the upstream.
oneof http_response {
// Supplies http attributes for a denied response.
DeniedHttpResponse denied_response = 2;
// Supplies http attributes for an ok response.
OkHttpResponse ok_response = 3;
}
// Optional response metadata that will be emitted as dynamic metadata to be consumed by the next
// filter. This metadata lives in a namespace specified by the canonical name of extension filter
// that requires it:
//
// - :ref:`envoy.filters.http.ext_authz <config_http_filters_ext_authz_dynamic_metadata>` for HTTP filter.
// - :ref:`envoy.filters.network.ext_authz <config_network_filters_ext_authz_dynamic_metadata>` for network filter.
google.protobuf.Struct dynamic_metadata = 4;
}
Write Preview
Loading…
Cancel
Save