envoyproxy/envoy

Proto validation of gRPC runtime credentials

Open

#8,010 opened on Aug 22, 2019

View on GitHub
 (0 comments) (0 reactions) (0 assignees)C++ (5,373 forks)batch import
enhancementhelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

In some places, e.g. https://github.com/envoyproxy/envoy/blob/7267542177ef49b33d6dd7b6ae6cdaa4ce2fb9ce/source/extensions/grpc_credentials/file_based_metadata/config.cc#L31, https://github.com/envoyproxy/envoy/blob/7267542177ef49b33d6dd7b6ae6cdaa4ce2fb9ce/source/extensions/grpc_credentials/aws_iam/config.cc#L39, we're explicitly plumbing in a null proto validation visitor, rather than using something derived from server settings. We also, more generally, lack handling of proto validation failure.

In some sense, this is totally fine today, since these are not control plane API and don't use PGV. In principle, it might be useful to have unknown field validation here and PGV support, so opening this issue to track future work here.

Contributor guide

Research direction
Identify all places in the grpc credentials directory where null proto validation visitor is used. Then implement a proper validation visitor or add PGV support for those configurations.
Tech stack
cpp
Domain
backendinfrastructure
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
C++gRPCProtobuf
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30