grpc-java icon indicating copy to clipboard operation
grpc-java copied to clipboard

feat(xds): Add ExternalAuthorizationFilter

Open sauravzg opened this issue 1 month ago • 0 comments

This PR sits on top of #12497 , so only the last commit + any fixups need to be reviewed.

This commit introduces the ExternalAuthorizationFilter, an implementation of the Filter interface that provides external authorization capabilities.

The ExternalAuthorizationFilter is responsible for:

  • Parsing ExtAuthz and ExtAuthzPerRoute configurations.
  • Creating ExtAuthzClientInterceptor and ExtAuthzServerInterceptor to handle client and server-side authorization.
  • Managing the lifecycle of the authorization stub using a StubManager.

The StubManager is a new class that manages the lifecycle of the AuthorizationStub, including creating and caching the gRPC channel and stub based on the provided configuration. This ensures that a single channel and stub are reused for the same configuration, improving performance and resource utilization.

  • [] #12491 feat(xds): Update Envoy proto definitions and add ExtAuthz gRPC service
  • [] #12492 feat(xds): Add configuration objects for ExtAuthz and GrpcService
  • [] #12493 feat(xds): Implement request builder for external authorization
  • [] #12494 feat(xds): Add header mutations library
  • [] #12495 feat(xds): Implement response handling for external authorization
  • [] #12496 feat(xds): Add ExtAuthzClientInterceptor and related components
  • [] #12497 feat(xds): Add ExtAuthzServerInterceptor and tests
  • [x] #12498 feat(xds): Add ExternalAuthorizationFilter

sauravzg avatar Nov 11 '25 09:11 sauravzg