grpc

Documentation

Index

• func NewAuthenticatingStreamInterceptor(a Authenticator) grpc.StreamServerInterceptor
• func NewAuthenticatingUnaryInterceptor(a Authenticator) grpc.UnaryServerInterceptor
• func NewGRPCClientFromConfiguration(configuration *configuration.GRPCClientConfiguration) (*grpc.ClientConn, error)
• func NewGRPCServersFromConfigurationAndServe(configurations []*configuration.GRPCServerConfiguration, ...) error
• type Authenticator
  • func NewAnyAuthenticator(authenticators []Authenticator) Authenticator
  • func NewAuthenticatorFromConfiguration(policy *configuration.AuthenticationPolicy) (Authenticator, error)
  • func NewDenyAuthenticator(message string) Authenticator
  • func NewTLSClientCertificateAuthenticator(clientCAs *x509.CertPool, clock clock.Clock) Authenticator

Functions

func NewAuthenticatingStreamInterceptor

func NewAuthenticatingStreamInterceptor(a Authenticator) grpc.StreamServerInterceptor

NewAuthenticatingStreamInterceptor creates a gRPC request interceptor for streaming calls that passes all requests through an Authenticator. This may be used to enable authentication support on a gRPC server.

func NewAuthenticatingUnaryInterceptor

func NewAuthenticatingUnaryInterceptor(a Authenticator) grpc.UnaryServerInterceptor

NewAuthenticatingUnaryInterceptor creates a gRPC request interceptor for unary calls that passes all requests through an Authenticator. This may be used to enable authentication support on a gRPC server.

func NewGRPCClientFromConfiguration

func NewGRPCClientFromConfiguration(configuration *configuration.GRPCClientConfiguration) (*grpc.ClientConn, error)

NewGRPCClientFromConfiguration creates a gRPC client based on a configuration stored in a Protobuf message. This Protobuf message is used within all configuration files of Buildbarn applications.

func NewGRPCServersFromConfigurationAndServe

func NewGRPCServersFromConfigurationAndServe(configurations []*configuration.GRPCServerConfiguration, registrationFunc func(*grpc.Server)) error

NewGRPCServersFromConfigurationAndServe creates a series of gRPC servers based on a configuration stored in a list of Protobuf messages. In then lets all of these gRPC servers listen on the network addresses of UNIX socket paths provided.

Types

type Authenticator

type Authenticator interface {
	Authenticate(ctx context.Context) error
}

Authenticator can be used to grant or deny access to a gRPC server. Implementations may grant access based on TLS connection state, provided headers, source IP address ranges, etc. etc. etc.

var AllowAuthenticator Authenticator = allowAuthenticator{}

AllowAuthenticator is an implementation of Authenticator that simply always returns success. This implementation can be used in case a gRPC server needs to be started that does not perform any authentication (e.g., one listening on a UNIX socket with restricted file permissions).

func NewAnyAuthenticator

func NewAnyAuthenticator(authenticators []Authenticator) Authenticator

NewAnyAuthenticator wraps a series of Authenticators into a single instance. Access is granted only when one or more backing Authenticators permit access, similar to Python's any() function.

func NewAuthenticatorFromConfiguration

func NewAuthenticatorFromConfiguration(policy *configuration.AuthenticationPolicy) (Authenticator, error)

NewAuthenticatorFromConfiguration creates a tree of Authenticator objects based on a configuration file.

func NewDenyAuthenticator

func NewDenyAuthenticator(message string) Authenticator

NewDenyAuthenticator creates an Authenticator that always returns an UNAUTHENTICATED error with a fixed error message string. This implementation can be used in case a gRPC server needs to be administratively disabled without shutting it down entirely.

func NewTLSClientCertificateAuthenticator

func NewTLSClientCertificateAuthenticator(clientCAs *x509.CertPool, clock clock.Clock) Authenticator

NewTLSClientCertificateAuthenticator creates an Authenticator that only grants access in case the client connected to the gRPC server using a TLS client certificate that can be validated against the chain of CAs used by the server.