Add xDS support for Athenz filters - #6853
Merged
Merged
Conversation
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
💤 Files with no reviewable changes (1)
📝 WalkthroughWalkthroughAdds Athenz protobuf contracts and a new ChangesAthenz contracts and matcher support
Athenz filter factories
Module discovery and build wiring
Docker-backed integration coverage
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 6
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
xds-api/src/main/proto/armeria/xds/athenz/athenz_filter_config.proto (1)
1-19: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winMissing copyright header.
As per path instructions, all modified/added source files must include the LY Corporation copyright header. Please add the required header to this proto file.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@xds-api/src/main/proto/armeria/xds/athenz/athenz_filter_config.proto` around lines 1 - 19, Add the repository-standard LY Corporation copyright header at the beginning of the proto file, before the syntax declaration, while leaving the package, imports, and message definitions unchanged.Source: Path instructions
🧹 Nitpick comments (4)
it/xds-client/build.gradle (1)
18-30: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚖️ Poor tradeoffConsider
testFixturesinstead of copying.javasources across modules.Copying
AthenzDocker.java/AthenzExtension.javafrom:athenzat build time works, but duplicating source files viaCopyis more fragile than consuming ajava-test-fixturesartifact from:athenz(auto-refactors on rename, IDE navigation stays correct, avoids drift between copies). Low priority if this mirrors an existing convention elsewhere in the build.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@it/xds-client/build.gradle` around lines 18 - 30, Replace the copyTestResources-based sharing of AthenzDocker.java and AthenzExtension.java with consumption of the :athenz java-test-fixtures artifact. Configure :athenz to publish its test fixtures if needed, then make the it/xds-client test source set depend on those fixtures and remove the copy task and its task dependencies.it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenConstraintFilterTest.java (1)
131-283: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDuplicate ZTS/TLS YAML-scaffolding logic across both Athenz IT tests. Both test classes independently rebuild
ATHENZ_RESOURCES-relative cert/key paths and near-identicalzts-clusterTLSBootstrapYAML fragments; the shared root cause is a missing common test helper for Athenz xDS bootstrap scaffolding.
it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenConstraintFilterTest.java#L131-L283: extract the cert-path resolution (lines 135-139) and thezts-clusterTLS cluster YAML block (lines 248-273) into a shared helper/base class reusable by both tests.it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenFilterTest.java#L101-L183: replace the equivalent cert-path resolution (lines 103-107) andzts-clusterTLS block (lines 152-176) with the same shared helper.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenConstraintFilterTest.java` around lines 131 - 283, Extract the shared Athenz certificate/key path resolution and zts-cluster TLS Bootstrap YAML construction from bootstrapYaml in it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenConstraintFilterTest.java#L131-L283 into a reusable helper or base class, then update both bootstrapYaml implementations to use it. Apply the same replacement in it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenFilterTest.java#L101-L183, preserving each test’s existing listener and filter-specific configuration.xds/src/main/java/com/linecorp/armeria/xds/internal/XdsStringMatcher.java (1)
41-43: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winAdd a null check to the now-public constructor.
XdsStringMatcheris now public and used across module boundaries; the constructor doesn't validatestringMatcher, so a null argument would surface as an unclear NPE deep in theswitchrather than a clear error at the boundary.♻️ Suggested fix
public XdsStringMatcher(StringMatcher stringMatcher) { + requireNonNull(stringMatcher, "stringMatcher"); ignoreCase = stringMatcher.getIgnoreCase();As per path instructions, "do explicit null checks for user-facing public method parameters (use
Objects.requireNonNull)".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@xds/src/main/java/com/linecorp/armeria/xds/internal/XdsStringMatcher.java` around lines 41 - 43, Add an explicit Objects.requireNonNull validation for the stringMatcher parameter in the public XdsStringMatcher constructor before accessing it, producing a clear boundary error while preserving existing initialization behavior.Source: Path instructions
xds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenTargetFilterFactory.java (1)
1-1: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDuplicate
create()boilerplate across both filter factories. Bothcreate()overrides are byte-for-byte identical except forNAME; this pattern likely belongs as a default method on the sharedHttpFilterFactoryinterface for stream-only factories.
xds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenTargetFilterFactory.java#L62-67: extract to a shared default/helper instead of repeating theUnsupportedOperationExceptionthrow.xds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenConstraintFilterFactory.java#L79-84: same extraction.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@xds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenTargetFilterFactory.java` at line 1, Move the identical stream-only create() implementation from AccessTokenTargetFilterFactory and AccessTokenConstraintFilterFactory into a shared default/helper on HttpFilterFactory that throws UnsupportedOperationException. Remove both duplicate overrides while preserving each factory’s distinct NAME and other behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenConstraintFilterTest.java`:
- Around line 99-106: Move the newAssertion(String action, String resource)
helper out of the anonymous AthenzExtension class into the enclosing test class,
preserving its private static signature and existing assertion setup.
In `@xds-api/src/main/proto/armeria/xds/athenz/athenz_access_token.proto`:
- Line 1: The documented syntax-version contract is not enforced by the consumer
factories. In AccessTokenTargetFilterFactory, validate target.getSyntaxVersion()
against the implemented maximum before constructing the token client; apply the
equivalent validation to constraint.getSyntaxVersion() in
AccessTokenConstraintFilterFactory before constructing the authorizer, rejecting
unsupported future versions while preserving supported-version behavior.
In
`@xds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenTargetFilterFactory.java`:
- Line 1: Add `@UnstableApi` to both public final classes
AccessTokenTargetFilterFactory and AccessTokenConstraintFilterFactory, including
the necessary import, while leaving their existing behavior unchanged.
In
`@xds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenTargetFilterFactoryProvider.java`:
- Around line 22-25: Add the `@UnstableApi` annotation to the public
AccessTokenTargetFilterFactoryProvider class, including the required import if
absent, while preserving its existing XdsExtensionFactoryProvider
implementation.
In
`@xds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/MappingTemplate.java`:
- Around line 88-97: Update the match placeholder parsing in MappingTemplate to
catch NumberFormatException from Integer.parseInt and rethrow it as an
IllegalArgumentException that includes the invalid index value and preserves the
original exception as the cause; keep valid indices and existing
unknown-placeholder handling unchanged.
In
`@xds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/XdsZtsBaseClient.java`:
- Around line 39-42: Update XdsZtsBaseClient.webClient(Consumer<? super
WebClientBuilder>) so it does not silently ignore the configurer; throw
UnsupportedOperationException when customization is unsupported in the
xDS-driven flow, matching the explicit-failure behavior used by the related
filter factories.
---
Outside diff comments:
In `@xds-api/src/main/proto/armeria/xds/athenz/athenz_filter_config.proto`:
- Around line 1-19: Add the repository-standard LY Corporation copyright header
at the beginning of the proto file, before the syntax declaration, while leaving
the package, imports, and message definitions unchanged.
---
Nitpick comments:
In `@it/xds-client/build.gradle`:
- Around line 18-30: Replace the copyTestResources-based sharing of
AthenzDocker.java and AthenzExtension.java with consumption of the :athenz
java-test-fixtures artifact. Configure :athenz to publish its test fixtures if
needed, then make the it/xds-client test source set depend on those fixtures and
remove the copy task and its task dependencies.
In
`@it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenConstraintFilterTest.java`:
- Around line 131-283: Extract the shared Athenz certificate/key path resolution
and zts-cluster TLS Bootstrap YAML construction from bootstrapYaml in
it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenConstraintFilterTest.java#L131-L283
into a reusable helper or base class, then update both bootstrapYaml
implementations to use it. Apply the same replacement in
it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenFilterTest.java#L101-L183,
preserving each test’s existing listener and filter-specific configuration.
In
`@xds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenTargetFilterFactory.java`:
- Line 1: Move the identical stream-only create() implementation from
AccessTokenTargetFilterFactory and AccessTokenConstraintFilterFactory into a
shared default/helper on HttpFilterFactory that throws
UnsupportedOperationException. Remove both duplicate overrides while preserving
each factory’s distinct NAME and other behavior.
In `@xds/src/main/java/com/linecorp/armeria/xds/internal/XdsStringMatcher.java`:
- Around line 41-43: Add an explicit Objects.requireNonNull validation for the
stringMatcher parameter in the public XdsStringMatcher constructor before
accessing it, producing a clear boundary error while preserving existing
initialization behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: dcaedd81-59f9-4cd3-93b6-a047bda75d2c
📒 Files selected for processing (21)
it/xds-client/build.gradleit/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenConstraintFilterTest.javait/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenFilterTest.javasettings.gradlexds-api/src/main/proto/armeria/xds/athenz/athenz_access_token.protoxds-api/src/main/proto/armeria/xds/athenz/athenz_filter_config.protoxds-athenz/build.gradlexds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenConstraintFilterFactory.javaxds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenConstraintFilterFactoryProvider.javaxds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenTargetFilterFactory.javaxds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenTargetFilterFactoryProvider.javaxds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AthenzTypeRegistryPackageProvider.javaxds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/MappingTemplate.javaxds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/XdsZtsBaseClient.javaxds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/package-info.javaxds-athenz/src/main/resources/META-INF/services/com.linecorp.armeria.xds.XdsExtensionFactoryProviderxds-athenz/src/main/resources/META-INF/services/com.linecorp.armeria.xds.XdsTypeRegistryPackageProviderxds/src/main/java/com/linecorp/armeria/xds/CertificateValidationContextSnapshot.javaxds/src/main/java/com/linecorp/armeria/xds/RouteEntryMatcher.javaxds/src/main/java/com/linecorp/armeria/xds/SanMatcher.javaxds/src/main/java/com/linecorp/armeria/xds/internal/XdsStringMatcher.java
Contributor
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (2)
xds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/XdsZtsBaseClient.java (1)
39-42: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winPast concern resolved; consider adding an explanatory message to the exception.
The previously-flagged silent-ignore issue on
webClient(Consumer<...>)is now fixed by throwingUnsupportedOperationException. Consider adding a message so callers immediately understand why customization isn't supported for this internal ZTS client.♻️ Suggested tweak
public WebClient webClient(Consumer<? super WebClientBuilder> configurer) { - throw new UnsupportedOperationException(); + throw new UnsupportedOperationException( + "Customizing the WebClientBuilder is not supported for XdsZtsBaseClient"); }As per path instructions, "throw exceptions with detailed messages including the offending value and expected constraints."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@xds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/XdsZtsBaseClient.java` around lines 39 - 42, Update the webClient method in XdsZtsBaseClient to throw UnsupportedOperationException with a clear message explaining that custom WebClientBuilder configuration is not supported for this internal ZTS client.Source: Path instructions
it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenFilterTest.java (1)
197-285: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy liftExtract shared Envoy bootstrap-YAML boilerplate for Athenz integration tests. All three test methods rebuild the same Athenz cert/key/CA path resolution and identical static
echo-cluster/zts-cluster(with TLS) blocks, differing only in the listener's HTTP-filter wiring; the shared root cause is the lack of a common test helper for this boilerplate.
it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenFilterTest.java#L197-L285: extract the cert/key/CA-path setup and static-cluster YAML block shared withbootstrapYaml()into a common helper/constant, keeping only the listener filter-chain shape method-specific.it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenFilterTest.java#L114-L196: same extraction applies to this twin method.it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenRpcFilterTest.java#L85-L167: reuse the same shared helper instead of re-declaring the cert/cluster boilerplate in this file.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenFilterTest.java` around lines 197 - 285, Extract the shared Athenz certificate/key/CA path setup and static echo-cluster/zts-cluster TLS YAML from upstreamBootstrapYaml(), bootstrapYaml(), and the RPC test bootstrap method into one reusable test helper or constant. Update all three affected sites—AthenzAccessTokenFilterTest.java:197-285, AthenzAccessTokenFilterTest.java:114-196, and AthenzAccessTokenRpcFilterTest.java:85-167—to reuse it while retaining each method’s listener and HTTP-filter-specific wiring.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In
`@it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenFilterTest.java`:
- Around line 197-285: Extract the shared Athenz certificate/key/CA path setup
and static echo-cluster/zts-cluster TLS YAML from upstreamBootstrapYaml(),
bootstrapYaml(), and the RPC test bootstrap method into one reusable test helper
or constant. Update all three affected
sites—AthenzAccessTokenFilterTest.java:197-285,
AthenzAccessTokenFilterTest.java:114-196, and
AthenzAccessTokenRpcFilterTest.java:85-167—to reuse it while retaining each
method’s listener and HTTP-filter-specific wiring.
In
`@xds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/XdsZtsBaseClient.java`:
- Around line 39-42: Update the webClient method in XdsZtsBaseClient to throw
UnsupportedOperationException with a clear message explaining that custom
WebClientBuilder configuration is not supported for this internal ZTS client.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: f4f2a0e3-a217-443f-a3e6-53e75e67fd49
📒 Files selected for processing (14)
it/xds-client/build.gradleit/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenConstraintFilterTest.javait/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenFilterTest.javait/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenRpcFilterTest.javait/xds-client/src/test/thrift/echo.thriftxds-api/src/main/java/com/linecorp/armeria/xds/api/SupportedFieldValidator.javaxds-api/src/main/proto/armeria/xds/athenz/athenz_access_token.protoxds-api/src/main/proto/armeria/xds/athenz/athenz_filter_config.protoxds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenConstraintFilterFactory.javaxds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenConstraintFilterFactoryProvider.javaxds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenTargetFilterFactory.javaxds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenTargetFilterFactoryProvider.javaxds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AthenzTypeRegistryPackageProvider.javaxds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/XdsZtsBaseClient.java
🚧 Files skipped from review as they are similar to previous changes (8)
- xds-api/src/main/proto/armeria/xds/athenz/athenz_filter_config.proto
- xds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenTargetFilterFactoryProvider.java
- xds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenConstraintFilterFactoryProvider.java
- it/xds-client/build.gradle
- xds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenTargetFilterFactory.java
- xds-api/src/main/proto/armeria/xds/athenz/athenz_access_token.proto
- it/xds-client/src/test/java/com/linecorp/armeria/xds/it/athenz/AthenzAccessTokenConstraintFilterTest.java
- xds-athenz/src/main/java/com/linecorp/armeria/xds/filter/athenz/AccessTokenConstraintFilterFactory.java
jrhee17
marked this pull request as ready for review
July 15, 2026 01:25
|
Tick the box to add this pull request to the merge queue (same as
|
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #6853 +/- ##
============================================
+ Coverage 74.46% 75.12% +0.65%
- Complexity 22234 25396 +3162
============================================
Files 1963 2262 +299
Lines 82437 94335 +11898
Branches 10764 12336 +1572
============================================
+ Hits 61385 70866 +9481
- Misses 15918 17607 +1689
- Partials 5134 5862 +728 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
ikhoon
approved these changes
Jul 15, 2026
| CommonPools.blockingTaskExecutor().execute(() -> { | ||
| try { | ||
| final ZtsBaseClient ztsBaseClient = | ||
| new XdsZtsBaseClient(clusterSnapshot.preprocessor()); |
Contributor
There was a problem hiding this comment.
The abstraction in xDS is impressive.
| @Override | ||
| public DecoratingHttpServiceFunction serviceDecorator() { | ||
| return (delegate, ctx, req) -> { | ||
| final AthenzTokenHeader tokenHeader = AthenzTokenHeader.ofAccessToken(); |
Contributor
There was a problem hiding this comment.
I understood only Authorization: Bearer <token> is supported in xDS-Athenz integration.
Contributor
Author
There was a problem hiding this comment.
This has been done for simplicity - if needed I think we can add a field at AccessTokenConstraintConfig/AccessTokenTargetConfig which denotes which headers to use
| @Nullable | ||
| public String resolve(ServiceRequestContext ctx, Map<String, List<String>> captures) { | ||
| final List<String> groups = captures.get(name); | ||
| if (groups == null || index < 0 || index >= groups.size()) { |
Contributor
There was a problem hiding this comment.
Question) Would it make sense to reject a negative index in the constructor?
| } | ||
| final ImmutableList.Builder<String> groups = ImmutableList.builder(); | ||
| for (int i = 0; i <= m.groupCount(); i++) { | ||
| if (m.group(i) == null) { |
Contributor
There was a problem hiding this comment.
Noted that capturing may fail if a regex contains an alternation such as regex: "(/a)|(/b)".
minwoox
approved these changes
Jul 21, 2026
| import com.linecorp.armeria.client.WebClientBuilder; | ||
| import com.linecorp.armeria.client.athenz.ZtsBaseClient; | ||
|
|
||
| final class XdsZtsBaseClient implements ZtsBaseClient { |
Contributor
There was a problem hiding this comment.
Is it okay not overriding addTlsKeyPairListener?
It seems like the method is called from AccessTokenClient
Contributor
Author
There was a problem hiding this comment.
AccessTokenClient uses it to immediately retrieve an access token using when TLS is updated.
I don't think this is really necessarily to function correctly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Add Athenz xDS filter support for access token injection (outbound) and access token constraint authorization (inbound). This is added in the upstream repo rather than downstream since Athenz test-related infrastructure (containers, ZMS/ZTS setup, key provisioning) is already well established here.
Modifications
xds-athenzmodule since jdk version requirements are different for the Athenz integrationathenz_access_token.proto):AccessTokenTarget(outbound): domain/roles to fetch a token forAccessTokenConstraint(inbound): domain to evaluate with optional action/resource mapping rulesWellKnownEndpointAttribute,EndpointAttributeMatch,AssertionMappingRule,AssertionMappingfor flexible per-request action/resource resolution(armeria.xds.supported.field)for strict validationarmeria.xds.athenzpackage (athenz_filter_config.proto):AccessTokenTargetConfigfor outbound filterAccessTokenConstraintConfigfor inbound filterAccessTokenTargetFilterFactory— outbound xDS HTTP filter that injects Athenz access tokens viaAthenzTokenClient, supporting all four filter paths (httpPreprocessor, rpcPreprocessor, httpDecorator, rpcDecorator)AccessTokenConstraintFilterFactory— inbound xDS HTTP filter that authorizes requests by evaluating Athenz access token constraints with configurable assertion mapping rulesMappingTemplatefor parsing and resolving${host},${method},${path},${match.<name>.<index>}placeholders in mapping rule templatesXdsStringMatcherto a shared location for reuse by both xDS routing and filter condition matchingunsupportedPackagefromSupportedFieldValidator; only skipgoogle.protobufmessages so that Athenz-related fields can also be validatedResult
google.protobuf) must have annotations