Skip to content

Forward original grpc authority host:port to downstream plugins #6091

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

nikotih
Copy link
Contributor

@nikotih nikotih commented May 28, 2025

Pull Request check list

  • Commit conforms to CONTRIBUTING.md?
  • Proper tests/regressions included?
  • Documentation updated?

Affected functionality

When Spire agent connects via grpc to Spire server it is using configuration e.g.:
server_address = "spire-server-xyz.spiffe.io"
server_port = "8081"

This information is naturally present in grpc context as ":authority" metadata in spire server core. Further, when spire server does node attestation it initiates downstream grpc calls to plugins. This overrides original ":authority" header with "localhost" since all plugins are next to the server.

For our tenancy model we use spire domains as selectors in node attestation plugins so we would like to "preserve" original authority context.

See example usage in unit test

Feel free to suggest alternative places for this e.g. middleware or let me know if you think its not a good idea

Description of change

Spire server forwards original ":authority" grpc context metadata to outgoing node attestation plugins under another context key

Which issue this PR fixes

#6101

@nikotih nikotih force-pushed the Forward-original-authority-to-plugins branch from 296d15d to e2a930c Compare May 28, 2025 16:22
@sorindumitru
Copy link
Collaborator

@nikotih Could you open an issue with some more details about what you're doing? For example what do you mean by "spire domains"? Is it the trust domain name(this is already available in the Configure plugin call) or something else?

Some more details on how this ends up being used would also be useful.

@nikotih
Copy link
Contributor Author

nikotih commented Jun 2, 2025

Hi @sorindumitru

No its not trust domain. I've created #6101 to describe what we are doing. Let me know if you want me to clarify something more

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants