ginuerzh
b9d74c1b8e
Add package-level documentation and Go doc comments for all exported types, functions, and methods across the admission package, its plugin sub-packages, and connection/listener wrappers.
103 lines
2.8 KiB
Go
103 lines
2.8 KiB
Go
// Package admission implements gRPC-based admission plugins.
|
|
// An admission plugin delegates the admit/deny decision to an external
|
|
// service via gRPC. This allows admission logic to be implemented in
|
|
// a separate process using any language supported by protobuf.
|
|
//
|
|
// The gRPC service definition is in plugin/admission/proto.
|
|
package admission
|
|
|
|
import (
|
|
"context"
|
|
"io"
|
|
|
|
"github.com/go-gost/core/admission"
|
|
"github.com/go-gost/core/logger"
|
|
"github.com/go-gost/plugin/admission/proto"
|
|
"github.com/go-gost/x/internal/plugin"
|
|
"google.golang.org/grpc"
|
|
)
|
|
|
|
// grpcPlugin is an admission controller that delegates to an external
|
|
// gRPC admission service.
|
|
//
|
|
// If the gRPC connection cannot be established at construction time,
|
|
// the client field remains nil and Admit returns true (fail-open),
|
|
// allowing all traffic through rather than blocking everything.
|
|
type grpcPlugin struct {
|
|
conn grpc.ClientConnInterface
|
|
client proto.AdmissionClient
|
|
log logger.Logger
|
|
}
|
|
|
|
// NewGRPCPlugin creates an admission controller that communicates with
|
|
// an external gRPC admission service at the given address.
|
|
//
|
|
// The name is used only for log identification. The addr should be a
|
|
// gRPC target string (e.g. "127.0.0.1:9000"). Additional plugin options
|
|
// (TLS, token, retry) can be passed via opts.
|
|
//
|
|
// If the connection fails, the plugin logs the error and operates in
|
|
// fail-open mode: all admission requests return true.
|
|
func NewGRPCPlugin(name string, addr string, opts ...plugin.Option) admission.Admission {
|
|
var options plugin.Options
|
|
for _, opt := range opts {
|
|
opt(&options)
|
|
}
|
|
|
|
log := logger.Default().WithFields(map[string]any{
|
|
"kind": "admission",
|
|
"admission": name,
|
|
})
|
|
conn, err := plugin.NewGRPCConn(addr, &options)
|
|
if err != nil {
|
|
log.Error(err)
|
|
}
|
|
|
|
p := &grpcPlugin{
|
|
conn: conn,
|
|
log: log,
|
|
}
|
|
if conn != nil {
|
|
p.client = proto.NewAdmissionClient(conn)
|
|
}
|
|
return p
|
|
}
|
|
|
|
// Admit sends an admission request to the external gRPC service.
|
|
// It passes the network, address, and service name from the client
|
|
// connection.
|
|
//
|
|
// If the gRPC client is nil (connection failed at startup), it returns
|
|
// true (fail-open). If the RPC returns an error, it logs the error and
|
|
// returns false.
|
|
func (p *grpcPlugin) Admit(ctx context.Context, network, addr string, opts ...admission.Option) bool {
|
|
if p.client == nil {
|
|
return true
|
|
}
|
|
|
|
var options admission.Options
|
|
for _, opt := range opts {
|
|
opt(&options)
|
|
}
|
|
|
|
r, err := p.client.Admit(ctx,
|
|
&proto.AdmissionRequest{
|
|
Service: options.Service,
|
|
Network: network,
|
|
Addr: addr,
|
|
})
|
|
if err != nil {
|
|
p.log.Error(err)
|
|
return false
|
|
}
|
|
return r.Ok
|
|
}
|
|
|
|
// Close closes the underlying gRPC connection if it implements io.Closer.
|
|
func (p *grpcPlugin) Close() error {
|
|
if closer, ok := p.conn.(io.Closer); ok {
|
|
return closer.Close()
|
|
}
|
|
return nil
|
|
}
|