Documentation
¶
Overview ¶
Package grpcx centralizes the transport options every fenced gRPC boundary uses: message size ceilings above the largest payloads (assignments embed the full workload spec and receipt lists), keepalive so long-lived worker connections detect dead peers promptly instead of hanging on a half-open transport, bounded connect attempts so a down endpoint surfaces quickly instead of wedging the first call, and OpenTelemetry interceptors so every boundary participates in the reference observability stack.
Index ¶
- Constants
- func ClientMTLSOptions(svid tls.Certificate, trustBundle *x509.CertPool) []grpc.DialOption
- func ClientOptions() []grpc.DialOption
- func RegisterLegacyServiceAlias(registrar grpc.ServiceRegistrar, stable grpc.ServiceDesc, implementation any, ...) error
- func ServerMTLSOptions(serverSVID tls.Certificate, trustBundle *x509.CertPool) []grpc.ServerOption
- func ServerOptions() []grpc.ServerOption
- func WithSpiffeIdentity(pattern spiffe.Pattern) grpc.ServerOption
Constants ¶
const MaxMessageBytes = 8 << 20
MaxMessageBytes is the ceiling for both directions on every fenced boundary. The control-plane assignment embeds the workload spec (up to the API's 1 MiB cap) plus goal and receipt lists, so 1 MiB is too tight.
Variables ¶
This section is empty.
Functions ¶
func ClientMTLSOptions ¶
func ClientMTLSOptions(svid tls.Certificate, trustBundle *x509.CertPool) []grpc.DialOption
ClientMTLSOptions returns the dial options for a worker: it presents its X.509-SVID and verifies the server against the trust bundle.
func ClientOptions ¶
func ClientOptions() []grpc.DialOption
ClientOptions configures a fenced gRPC client: keepalive pings every 30s (idle workers have no streams), bounded connect attempts, a receive ceiling matching the servers, and OTel span propagation.
func RegisterLegacyServiceAlias ¶
func RegisterLegacyServiceAlias(registrar grpc.ServiceRegistrar, stable grpc.ServiceDesc, implementation any, legacyServiceName string) error
RegisterLegacyServiceAlias exposes a stable protobuf implementation under an N-1 fully-qualified service name. This is safe only while v1 and alpha message field numbers remain wire-identical; compatibility tests enforce that invariant. The implementation and decoder stay stable-v1 types.
func ServerMTLSOptions ¶
func ServerMTLSOptions(serverSVID tls.Certificate, trustBundle *x509.CertPool) []grpc.ServerOption
ServerMTLSOptions returns the transport options for a mutually authenticated fenced server: it serves its own X.509-SVID (issued by the same CA as the trust bundle) and requires every client to present a certificate chain rooted in the trust bundle. Combined with WithSpiffeIdentity this is the X.509-SVID boundary (ADR-011).
func ServerOptions ¶
func ServerOptions() []grpc.ServerOption
ServerOptions configures a fenced gRPC server.
func WithSpiffeIdentity ¶
func WithSpiffeIdentity(pattern spiffe.Pattern) grpc.ServerOption
WithSpiffeIdentity is a unary interceptor that rejects every call whose peer does not present a verified X.509-SVID matching the pattern. Chain verification is performed by TLS itself (RequireAndVerifyClientCert); this interceptor enforces the SPIFFE ID authorization on top of it.
Types ¶
This section is empty.
Source Files