mirror of
https://github.com/pomerium/pomerium.git
synced 2025-06-09 06:12:42 +02:00
7a6d7c5a3c
## Summary Update the `RouteID` to use the `policy.ID` if it is set. This makes it so that updated routes use a stable identifier between updates so if the envoy control plane is updated before the authorize service's internal definitions (or vice-versa) the authorize service will still be able to match the route. The current behavior results in a 404 if envoy passes the old route id. The new behavior will result in inconsistency, but it should be quickly remedied. To help with debugging 4 new fields were added to the authorize check log. The `route-id` and `route-checksum` as the authorize sees it and the `envoy-route-id` and `envoy-route-checksum` as envoy sees it. I also updated the way we send updates to envoy to try and model their recommended approach: > In general, to avoid traffic drop, sequencing of updates should follow a make before break model, wherein: > > - CDS updates (if any) must always be pushed first. > - EDS updates (if any) must arrive after CDS updates for the respective clusters. > - LDS updates must arrive after corresponding CDS/EDS updates. > - RDS updates related to the newly added listeners must arrive after CDS/EDS/LDS updates. > - VHDS updates (if any) related to the newly added RouteConfigurations must arrive after RDS updates. > - Stale CDS clusters and related EDS endpoints (ones no longer being referenced) can then be removed. This should help avoid 404s when configuration is being updated. ## Related issues - [ENG-2386](https://linear.app/pomerium/issue/ENG-2386/large-number-of-routes-leads-to-404s-and-slowness) ## Checklist - [x] reference any related issues - [x] updated unit tests - [x] add appropriate label (`enhancement`, `bug`, `breaking`, `dependencies`, `ci`) - [x] ready for review
68 lines
1.8 KiB
Go
68 lines
1.8 KiB
Go
// Package portal contains the code for the routes portal
|
|
package portal
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"github.com/pomerium/pomerium/config"
|
|
"github.com/pomerium/pomerium/internal/urlutil"
|
|
"github.com/pomerium/pomerium/pkg/zero/importutil"
|
|
)
|
|
|
|
// A Route is a portal route.
|
|
type Route struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
Type string `json:"type"`
|
|
From string `json:"from"`
|
|
Description string `json:"description"`
|
|
ConnectCommand string `json:"connect_command,omitempty"`
|
|
LogoURL string `json:"logo_url"`
|
|
}
|
|
|
|
// RoutesFromConfigRoutes converts config routes into portal routes.
|
|
func RoutesFromConfigRoutes(routes []*config.Policy) []Route {
|
|
prs := make([]Route, len(routes))
|
|
for i, route := range routes {
|
|
pr := Route{}
|
|
pr.ID = route.ID
|
|
if pr.ID == "" {
|
|
pr.ID = route.MustRouteID()
|
|
}
|
|
pr.Name = route.Name
|
|
pr.From = route.From
|
|
fromURL, err := urlutil.ParseAndValidateURL(route.From)
|
|
if err == nil {
|
|
if strings.HasPrefix(fromURL.Scheme, "tcp+") {
|
|
pr.Type = "tcp"
|
|
if len(fromURL.Path) > 1 {
|
|
pr.ConnectCommand = "pomerium-cli tcp " + fromURL.String()
|
|
} else {
|
|
pr.ConnectCommand = "pomerium-cli tcp " + fromURL.Host
|
|
}
|
|
} else if strings.HasPrefix(fromURL.Scheme, "udp+") {
|
|
pr.Type = "udp"
|
|
pr.ConnectCommand = "pomerium-cli udp " + fromURL.Host
|
|
if len(fromURL.Path) > 1 {
|
|
pr.ConnectCommand = "pomerium-cli udp " + fromURL.String()
|
|
} else {
|
|
pr.ConnectCommand = "pomerium-cli udp " + fromURL.Host
|
|
}
|
|
} else {
|
|
pr.Type = "http"
|
|
}
|
|
} else {
|
|
pr.Type = "http"
|
|
}
|
|
pr.Description = route.Description
|
|
pr.LogoURL = route.LogoURL
|
|
prs[i] = pr
|
|
}
|
|
// generate names if they're empty
|
|
for i, name := range importutil.GenerateRouteNames(routes) {
|
|
if prs[i].Name == "" {
|
|
prs[i].Name = name
|
|
}
|
|
}
|
|
return prs
|
|
}
|