5eace88ce2
Fixes: #5396 This PR adds a proxy configuration stanza called expose. These flags register listeners in Connect sidecar proxies to allow requests to specific HTTP paths from outside of the node. This allows services to protect themselves by only listening on the loopback interface, while still accepting traffic from non Connect-enabled services. Under expose there is a boolean checks flag that would automatically expose all registered HTTP and gRPC check paths. This stanza also accepts a paths list to expose individual paths. The primary use case for this functionality would be to expose paths for third parties like Prometheus or the kubelet. Listeners for requests to exposed paths are be configured dynamically at run time. Any time a proxy, or check can be registered, a listener can also be created. In this initial implementation requests to these paths are not authenticated/encrypted.
77 lines
2 KiB
Go
77 lines
2 KiB
Go
package checks
|
|
|
|
import (
|
|
"context"
|
|
"crypto/tls"
|
|
"fmt"
|
|
"strings"
|
|
"time"
|
|
|
|
"google.golang.org/grpc"
|
|
"google.golang.org/grpc/credentials"
|
|
hv1 "google.golang.org/grpc/health/grpc_health_v1"
|
|
)
|
|
|
|
var ErrGRPCUnhealthy = fmt.Errorf("gRPC application didn't report service healthy")
|
|
|
|
// GrpcHealthProbe connects to gRPC application and queries health service for application/service status.
|
|
type GrpcHealthProbe struct {
|
|
server string
|
|
request *hv1.HealthCheckRequest
|
|
timeout time.Duration
|
|
dialOptions []grpc.DialOption
|
|
}
|
|
|
|
// NewGrpcHealthProbe constructs GrpcHealthProbe from target string in format
|
|
// server[/service]
|
|
// If service is omitted, health of the entire application is probed
|
|
func NewGrpcHealthProbe(target string, timeout time.Duration, tlsConfig *tls.Config) *GrpcHealthProbe {
|
|
serverAndService := strings.SplitN(target, "/", 2)
|
|
|
|
request := hv1.HealthCheckRequest{}
|
|
if len(serverAndService) > 1 {
|
|
request.Service = serverAndService[1]
|
|
}
|
|
|
|
var dialOptions = []grpc.DialOption{}
|
|
|
|
if tlsConfig != nil {
|
|
dialOptions = append(dialOptions, grpc.WithTransportCredentials(credentials.NewTLS(tlsConfig)))
|
|
} else {
|
|
dialOptions = append(dialOptions, grpc.WithInsecure())
|
|
}
|
|
|
|
return &GrpcHealthProbe{
|
|
request: &request,
|
|
timeout: timeout,
|
|
dialOptions: dialOptions,
|
|
}
|
|
}
|
|
|
|
// Check if the target of this GrpcHealthProbe is healthy
|
|
// If nil is returned, target is healthy, otherwise target is not healthy
|
|
func (probe *GrpcHealthProbe) Check(target string) error {
|
|
serverAndService := strings.SplitN(target, "/", 2)
|
|
server := serverAndService[0]
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), probe.timeout)
|
|
defer cancel()
|
|
|
|
connection, err := grpc.DialContext(ctx, server, probe.dialOptions...)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer connection.Close()
|
|
|
|
client := hv1.NewHealthClient(connection)
|
|
response, err := client.Check(ctx, probe.request)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if response == nil || response.Status != hv1.HealthCheckResponse_SERVING {
|
|
return ErrGRPCUnhealthy
|
|
}
|
|
|
|
return nil
|
|
}
|