contrib/envoyproxy: envoy external processing support #2895
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
e-n-0
force-pushed
the
flavien/service-extensions
branch
7 times, most recently
from
fcbd354 to
a587a09
Compare
BenchmarksBenchmark execution time: 2024-12-16 13:53:07 Comparing candidate commit bece5b0 in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 58 metrics, 1 unstable metrics. |
e-n-0
force-pushed
the
flavien/service-extensions
branch
16 times, most recently
from
4134743 to
a96cc2a
Compare
e-n-0
force-pushed
the
flavien/service-extensions
branch
from
c7063d8 to
b0844b8
Compare
Signed-off-by: Eliott Bouhana <[email protected]>
* Add support for context propagation * Normalize span tag use Co-authored-by: Flavien Darche <[email protected]> Signed-off-by: Eliott Bouhana <[email protected]>
e-n-0
force-pushed
the
flavien/service-extensions
branch
from
b0844b8 to
961d73d
Compare
Datadog ReportBranch report: ✅ 0 Failed, 5112 Passed, 70 Skipped, 2m 53.79s Total Time |
rarguelloF
reviewed
Dec 11, 2024
Comment on lines
16
to
29
| // Create a listener for the server. | ||
| ln, err := net.Listen("tcp", ":50051") | ||
| if err != nil { | ||
| log.Fatal(err) | ||
| } | ||
|
|
||
| // Create the server interceptor using the envoy go control plane package. | ||
| si := go_control_plane.StreamServerInterceptor() | ||
|
|
||
| // Initialize the grpc server as normal, using the envoy server interceptor. | ||
| s := grpc.NewServer(grpc.StreamInterceptor(si)) | ||
|
|
||
| // ... register your services | ||
|
|
There was a problem hiding this comment.
Could you add a more "real-world" like example? similar to https://github.com/envoyproxy/go-control-plane/blob/main/examples/dyplomat/main.go#L43-L53
(currently this example is just a generic grpc server without any envoyproxy stuff)
There was a problem hiding this comment.
I applied change in 22d7095
Tell me if that is looking good for you 😄
| } | ||
| }() | ||
|
|
||
| for { |
There was a problem hiding this comment.
I find this pattern a little bit odd for an interceptor / middleware.
Since it seems this is pretty much specifically intended to override the behaviour of ext_procv3.ExternalProcessorServer.Process, have you considered exporting this functionality as an implementation of this interface instead of a middleware? This way, users could just do:
import envoytrace "gopkg.in/DataDog/dd-trace-go.v1/contrib/envoyproxy/go-control-plane"
// srv would be the user provided implementation of `ext_procv3.ExternalProcessorServer`
appsecBlockSrv := envoytrace.AppsecBlockingProcessorServer(srv) // internally you would call srv.Process() when the request is not blocked
ext_procv3.RegisterExternalProcessorServer(grpcServer, appsecBlockSrv)There was a problem hiding this comment.
I changed it in 22d7095
Is that what you were thinking of?
rarguelloF
approved these changes
Dec 12, 2024
darccio
approved these changes
Dec 12, 2024
7 tasks
eliottness
added a commit
that referenced
this pull request
Dec 16, 2024
This PR adds a new gRPC Interceptor (StreamServerInterceptor) to support the interception of ext_proc v3 calls to gRPC server. When the interceptor is applied, all messages of the external processing protocol are instrumented without returning an handle to the original server code Co-authored-by: Eliott Bouhana <[email protected]> Co-authored-by: Flavien Darche <[email protected]>
e-n-0
added a commit
that referenced
this pull request
Dec 23, 2024
ddtrace/tracer: initialize runtimeMetricsV2 with statsd "direct" client (#3006) Co-authored-by: Felix Geisendörfer <[email protected]> Co-authored-by: Nayef Ghattas <[email protected]> fix(.github/workflows): add tags-ignore to avoid running CI on pushing tags for contribs and other nested modules (#3005) Co-authored-by: Hannah Kim <[email protected]> contrib/envoyproxy: envoy external processing support (#2895) This PR adds a new gRPC Interceptor (StreamServerInterceptor) to support the interception of ext_proc v3 calls to gRPC server. When the interceptor is applied, all messages of the external processing protocol are instrumented without returning an handle to the original server code Co-authored-by: Eliott Bouhana <[email protected]> Co-authored-by: Flavien Darche <[email protected]> add go mod to workflows/apps (#3036) go.mod: module go.opentelemetry.io/collector/pdata@latest found (v1.21.0), but does not contain package go.opentelemetry.io/collector/pdata/internal/data/protogen/profiles/v1experimental (#3042) Signed-off-by: Eliott Bouhana <[email protected]> chore: update latest majors (#2993)
e-n-0
added a commit
that referenced
this pull request
Dec 23, 2024
ddtrace/tracer: initialize runtimeMetricsV2 with statsd "direct" client (#3006) Co-authored-by: Felix Geisendörfer <[email protected]> Co-authored-by: Nayef Ghattas <[email protected]> fix(.github/workflows): add tags-ignore to avoid running CI on pushing tags for contribs and other nested modules (#3005) Co-authored-by: Hannah Kim <[email protected]> contrib/envoyproxy: envoy external processing support (#2895) This PR adds a new gRPC Interceptor (StreamServerInterceptor) to support the interception of ext_proc v3 calls to gRPC server. When the interceptor is applied, all messages of the external processing protocol are instrumented without returning an handle to the original server code Co-authored-by: Eliott Bouhana <[email protected]> Co-authored-by: Flavien Darche <[email protected]> add go mod to workflows/apps (#3036) go.mod: module go.opentelemetry.io/collector/pdata@latest found (v1.21.0), but does not contain package go.opentelemetry.io/collector/pdata/internal/data/protogen/profiles/v1experimental (#3042) Signed-off-by: Eliott Bouhana <[email protected]> chore: update latest majors (#2993)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation
This is the part 1 PR to support Envoy's External Processing.
You can find all related document for this implementation in Confluence ASM - GCP Services Extensions.
You can find the part 2 of this PR here.
What does this PR do?
This PR adds a new gRPC Interceptor (
StreamServerInterceptor) to support the interception of ext_proc v3 calls to gRPC server. When the interceptor is applied, all messages of the external processing protocol are instrumented without returning an handle to the original server code. The implementation of a server using this instrumentation can be found in the part 2.The implementation includes:
content-typeandredirect)http.Requestobject.Tests
This PR includes unit testing in the
envoy_tests.go, simulating scenarios of malicious or benign requests, validating span tags, security events and blocking results.System-tests have been implemented on this PR. A new
external-processingscenario has been added in thegolangstage.Reviewer's Checklist
Unsure? Have a question? Request a review!