yahoojapan/authorization-proxy

Moved to https://github.com/AthenZ/authorization-proxy

authorization-proxy's Issues

remove go.mod replace when the underlining dependency have versioned up

dependency tree

• github.com/yahoojapan/athenz-authorizer/v5
  • github.com/AthenZ/athenz
    • golang.org/x/net
      • golang.org/x/text

authorization-proxy/go.mod

Lines 13 to 15 in 15fed79

	replace golang.org/x/text v0.3.0 => golang.org/x/text v0.3.3
	replace golang.org/x/text v0.3.2 => golang.org/x/text v0.3.3

better support for liveness probe and readiness probe

• liveness probe
  1. define conditions that the sidecar needs to be restarted
  2. add endpoint for liveness probe
• readiness probe
  1. current, health check port only check whether the proxy is up or not
  2. health check port should also report internal status (e.g. policies of all domains are cached)

expose golang transport parameters to config.go

For application handling high RPS, the default values of transport struct in golang is not enough, and causes the proxy to be unstable.

related transport parameters

• https://github.com/golang/go/blob/a98589711da5e9d935e8d690cfca92892e86d557/src/net/http/transport.go#L56-L58
• https://github.com/golang/go/blob/a98589711da5e9d935e8d690cfca92892e86d557/src/net/http/transport.go#L192-L206

related code

• authorization-proxy/handler/handler.go

  Lines 61 to 65 in 5af0b96

  	Transport: &transport{
  	prov: prov,
  	RoundTripper: &http.Transport{},
  	cfg: cfg,
  	},

verify config.Proxy during startup

effect

prevent the proxy get in fatal error during runtime

authorization-proxy/handler/handler.go

Lines 49 to 59 in 6c6a4ee

	Director: func(r *http.Request) {
	u := *r.URL
	u.Scheme = scheme
	u.Host = host
	req, err := http.NewRequest(r.Method, u.String(), r.Body)
	if err != nil {
	glg.Fatal(errors.Wrap(err, "NewRequest returned error"))
	}
	req.Header = r.Header
	*r = *req
	},

fix

return error if config.Proxy contains invalid values during startup, e.g.

1. scheme != 'http' || scheme != 'https'
2. host ~ '@'

authorization-proxy/usecase/authz_proxyd.go

Lines 47 to 66 in 6c6a4ee

	// New returns a Authorization Proxy daemon, or error occurred.
	// The daemon contains a token service authentication and authorization server.
	// This function will also initialize the mapping rules for the authentication and authorization check.
	func New(cfg config.Config) (AuthzProxyDaemon, error) {
	athenz, err := newAuthzD(cfg)
	if err != nil {
	return nil, errors.Wrap(err, "cannot newAuthzD(cfg)")
	}
	debugMux := router.NewDebugRouter(cfg.Server, athenz)
	return &authzProxyDaemon{
	cfg: cfg,
	athenz: athenz,
	server: service.NewServer(
	service.WithServerConfig(cfg.Server),
	service.WithServerHandler(handler.New(cfg.Proxy, infra.NewBuffer(cfg.Proxy.BufferSize), athenz)),
	service.WithDebugHandler(debugMux)),
	}, nil
	}

configuration name is not consistency

Configuration name should be _ separated or by letter case?

authorization-proxy/config/config.go

Line 63 in 1360c02

HealthzPort int `yaml:"health_check_port"`

authorization-proxy/config/config.go

Line 137 in 1360c02

PubKeyRefreshDuration string `yaml:"pubKeyRefreshDuration"`

config `AthenzRootCA` is not used

as title.
https://github.com/yahoojapan/authorization-proxy/search?q=AthenzRootCA&unscoped_q=AthenzRootCA

TODO

1. create HTTP client by AthenzRootCA
2. add HTTP client option in https://github.com/yahoojapan/athenz-authorizer/blob/master/option.go
3. update the authorizer creation logic accordingly

RFC7807Error not used

as title

authorization-proxy/handler/error.go

Lines 19 to 28 in 6c6a4ee

	// RFC7807Error represent the error message fulfilling RFC7807 standard.
	type RFC7807Error struct {
	Type string `json:"type"`
	Title string `json:"title"`
	Status int
	InvalidParams []InvalidParam `json:"invalid-params,ommitempty"`
	Detail string `json:"detail"`
	Instance string `json:"instance"`
	RoleToken string `json:"role_token"`
	}

Add config for "Bot from GolangCI" to ignore glg error handling

Error return value of glg.Debug is not checked (from errcheck)
#41 (comment)