chore: add grpc-Web TLS

getezy · Aug 28, 2022 · e3107f7 · e3107f7
1 parent b78eacb
commit e3107f7
Show file tree

Hide file tree

Showing 39 changed files with 669 additions and 278 deletions.
diff --git a/README.md b/README.md
@@ -38,8 +38,8 @@
 ✅ Unary calls.  
 ✅ Server streaming.  
 ✅ Stream cancelation.  
-✅ Metadata (BrowserHeaders) support.  
-<!-- ✅ TLS (Server-side) with CA certificates.   -->
+✅ Metadata (Browser Headers) support.  
+✅ TLS (Server-side/Mutual) with CA/Self-Signed certificates.  
 
 ## Getting started
 Install the latest version for your OS from [release page](https://github.com/getezy/ezy/releases/latest).

diff --git a/__tests__/tls-service/README.md b/__tests__/tls-service/README.md
@@ -1,7 +1,24 @@
+## gRPC
+
 ```bash
   $ npm run build
 
-  $ npm run start:mutual
+  $ npm run start:server
   # OR
+  $ npm run start:mutual
+```
+
+## gRPC-web
+If you want to run default (browser-like) server side TLS
+
+```bash
+  # Server-Side TLS
+  $ docker-compose up envoy-server
+```
+
+For mutual TLS I found the way when you can start grpc service with Server-Side TLS and then run envoy proxy wich verifying client certificate.
+
+```bash
   $ npm run start:server
+  $ docker-compose up envoy-mutual
 ```
diff --git a/__tests__/tls-service/docker-compose.yaml b/__tests__/tls-service/docker-compose.yaml
@@ -0,0 +1,18 @@
+services:
+  envoy-server:
+    image: envoyproxy/envoy:v1.22.0
+    ports:
+      - 8080:8080
+    volumes:
+      - ./envoy-server.yaml:/etc/envoy/envoy.yaml:ro
+      - ./certs/server-cert.pem:/etc/server-cert.pem
+      - ./certs/server-key.pem:/etc/server-key.pem
+  envoy-mutual:
+    image: envoyproxy/envoy:v1.22.0
+    ports:
+      - 8080:8080
+    volumes:
+      - ./envoy-mutual.yaml:/etc/envoy/envoy.yaml:ro
+      - ./certs/ca-cert.pem:/etc/ca-cert.pem
+      - ./certs/server-cert.pem:/etc/server-cert.pem
+      - ./certs/server-key.pem:/etc/server-key.pem
diff --git a/__tests__/tls-service/envoy-mutual.yaml b/__tests__/tls-service/envoy-mutual.yaml
@@ -0,0 +1,87 @@
+static_resources:
+  listeners:
+    - name: listener_0
+      address:
+        socket_address: { address: 0.0.0.0, port_value: 8080 }
+      filter_chains:
+        - filters:
+          - name: envoy.filters.network.http_connection_manager
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+              codec_type: auto
+              stat_prefix: ingress_http
+              route_config:
+                name: local_route
+                virtual_hosts:
+                  - name: local_service
+                    domains: ["*"]
+                    routes:
+                      - match: { prefix: "/" }
+                        route:
+                          cluster: simple_service
+                          timeout: 0s
+                          max_stream_duration:
+                            grpc_timeout_header_max: 0s
+                    cors:
+                      allow_origin_string_match:
+                        - prefix: "*"
+                      allow_methods: GET, PUT, DELETE, POST, OPTIONS
+                      allow_headers: keep-alive,user-agent,cache-control,content-type,content-transfer-encoding,custom-header-1,x-accept-content-transfer-encoding,x-accept-response-streaming,x-user-agent,x-grpc-web,grpc-timeout
+                      max_age: "1728000"
+                      expose_headers: custom-header-1,grpc-status,grpc-message
+              http_filters:
+                - name: envoy.filters.http.grpc_web
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
+                - name: envoy.filters.http.cors
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors
+                - name: envoy.filters.http.router
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+          transport_socket:
+            name: envoy.transport_sockets.tls
+            typed_config:
+              # https://www.envoyproxy.io/docs/envoy/v1.15.0/api-v3/extensions/transport_sockets/tls/v3/tls.proto#extensions-transport-sockets-tls-v3-downstreamtlscontext
+              "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+              require_client_certificate: true
+              common_tls_context:
+                tls_certificates:
+                  - certificate_chain:
+                      # Certificate must be PEM-encoded
+                      filename: /etc/server-cert.pem
+                    private_key:
+                      filename: /etc/server-key.pem
+                validation_context:
+                  only_verify_leaf_cert_crl: true
+                  trusted_ca:
+                    filename: /etc/ca-cert.pem
+  clusters:
+    - name: simple_service
+      connect_timeout: 0.25s
+      type: logical_dns
+      http2_protocol_options: {}
+      lb_policy: round_robin
+      load_assignment:
+        cluster_name: cluster_0
+        endpoints:
+          - lb_endpoints:
+            - endpoint:
+                address:
+                  socket_address:
+                    # address: 0.0.0.0
+                    address: host.docker.internal
+                    port_value: 4000
+      # http2_protocol_options: {} # Force HTTP/2
+      # Your grpc server communicates over TLS. You must configure the transport
+      # socket. If you care about the overhead, you should configure the grpc
+      # server to listen without TLS. If you need to listen to grpc-web and grpc
+      # over HTTP/2 both you can also proxy your TCP traffic with the envoy.
+      transport_socket:
+        name: envoy.transport_sockets.tls
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+          common_tls_context:
+            validation_context:
+              trusted_ca:
+                filename: /etc/ca-cert.pem
diff --git a/__tests__/tls-service/envoy-server.yaml b/__tests__/tls-service/envoy-server.yaml
@@ -0,0 +1,78 @@
+static_resources:
+  listeners:
+    - name: listener_0
+      address:
+        socket_address: { address: 0.0.0.0, port_value: 8080 }
+      filter_chains:
+        - filters:
+          - name: envoy.filters.network.http_connection_manager
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+              codec_type: auto
+              stat_prefix: ingress_http
+              route_config:
+                name: local_route
+                virtual_hosts:
+                  - name: local_service
+                    domains: ["*"]
+                    routes:
+                      - match: { prefix: "/" }
+                        route:
+                          cluster: simple_service
+                          timeout: 0s
+                          max_stream_duration:
+                            grpc_timeout_header_max: 0s
+                    cors:
+                      allow_origin_string_match:
+                        - prefix: "*"
+                      allow_methods: GET, PUT, DELETE, POST, OPTIONS
+                      allow_headers: keep-alive,user-agent,cache-control,content-type,content-transfer-encoding,custom-header-1,x-accept-content-transfer-encoding,x-accept-response-streaming,x-user-agent,x-grpc-web,grpc-timeout
+                      max_age: "1728000"
+                      expose_headers: custom-header-1,grpc-status,grpc-message
+              http_filters:
+                - name: envoy.filters.http.grpc_web
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
+                - name: envoy.filters.http.cors
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors
+                - name: envoy.filters.http.router
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+          transport_socket:
+            name: envoy.transport_sockets.tls
+            typed_config:
+              # https://www.envoyproxy.io/docs/envoy/v1.15.0/api-v3/extensions/transport_sockets/tls/v3/tls.proto#extensions-transport-sockets-tls-v3-downstreamtlscontext
+              "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+              common_tls_context:
+                tls_certificates:
+                  - certificate_chain:
+                      # Certificate must be PEM-encoded
+                      filename: /etc/server-cert.pem
+                    private_key:
+                      filename: /etc/server-key.pem
+  clusters:
+    - name: simple_service
+      connect_timeout: 0.25s
+      type: logical_dns
+      http2_protocol_options: {}
+      lb_policy: round_robin
+      load_assignment:
+        cluster_name: cluster_0
+        endpoints:
+          - lb_endpoints:
+            - endpoint:
+                address:
+                  socket_address:
+                    # address: 0.0.0.0
+                    address: host.docker.internal
+                    port_value: 4000
+      # http2_protocol_options: {} # Force HTTP/2
+      # Your grpc server communicates over TLS. You must configure the transport
+      # socket. If you care about the overhead, you should configure the grpc
+      # server to listen without TLS. If you need to listen to grpc-web and grpc
+      # over HTTP/2 both you can also proxy your TCP traffic with the envoy.
+      transport_socket:
+        name: envoy.transport_sockets.tls
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext