Skip to content

#232 - Add authz sidecar service with Go implementation #240

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
RyaliNvidia wants to merge 2 commits into
base: feature/PROJ-148-auth-rework
Choose a base branch
from
Open

#232 - Add authz sidecar service with Go implementation #240

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a228a23
Add authz sidecar service with Go implementation
RyaliNvidia Jan 15, 2026
c6450a0
Remove unneeded code
RyaliNvidia Jan 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions src/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,20 +3,41 @@ module go.corp.nvidia.com/osmo
go 1.24.3

require (
// Runtime dependencies
github.com/conduitio/bwlimit v0.1.0
github.com/creack/pty v1.1.18
github.com/envoyproxy/go-control-plane v0.13.0
github.com/gokrazy/rsync v0.0.0-20250601185929-d3cb1d4a4fcd
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
github.com/gorilla/websocket v1.5.0
github.com/jackc/pgx/v5 v5.7.2
google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422
google.golang.org/grpc v1.67.3
gopkg.in/yaml.v3 v3.0.1
)

require (
github.com/envoyproxy/protoc-gen-validate v1.1.0 // indirect
// Runtime indirect dependencies
github.com/google/renameio/v2 v2.0.0 // indirect
github.com/landlock-lsm/go-landlock v0.0.0-20250303204525-1544bccde3a3 // indirect
github.com/mmcloughlin/md4 v0.1.2 // indirect
golang.org/x/net v0.28.0 // indirect
golang.org/x/sync v0.13.0 // indirect
golang.org/x/sys v0.32.0 // indirect
golang.org/x/text v0.24.0 // indirect
golang.org/x/time v0.3.0 // indirect
google.golang.org/protobuf v1.36.1 // indirect
kernel.org/pub/linux/libs/security/libcap/psx v1.2.76 // indirect
)

require (
github.com/cncf/xds/go v0.0.0-20240723142845-024c85f92f20 // indirect
github.com/jackc/pgpassfile v1.0.0 // indirect
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
github.com/jackc/puddle/v2 v2.2.2 // indirect
github.com/kr/text v0.2.0 // indirect
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
github.com/rogpeppe/go-internal v1.14.1 // indirect
golang.org/x/crypto v0.37.0 // indirect
)
49 changes: 48 additions & 1 deletion src/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,17 @@
github.com/cncf/xds/go v0.0.0-20240723142845-024c85f92f20 h1:N+3sFI5GUjRKBi+i0TxYVST9h4Ie192jJWpHvthBBgg=
github.com/cncf/xds/go v0.0.0-20240723142845-024c85f92f20/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
github.com/conduitio/bwlimit v0.1.0 h1:x3ijON0TSghQob4tFKaEvKixFmYKfVJQeSpXluC2JvE=
github.com/conduitio/bwlimit v0.1.0/go.mod h1:E+ASZ1/5L33MTb8hJTERs5Xnmh6Ulq3jbRh7LrdbXWU=
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/envoyproxy/go-control-plane v0.13.0 h1:HzkeUz1Knt+3bK+8LG1bxOO/jzWZmdxpwC51i202les=
github.com/envoyproxy/go-control-plane v0.13.0/go.mod h1:GRaKG3dwvFoTg4nj7aXdZnvMg4d7nvT/wl9WgVXn3Q8=
github.com/envoyproxy/protoc-gen-validate v1.1.0 h1:tntQDh69XqOCOZsDz0lVJQez/2L6Uu2PdjCQwWCJ3bM=
github.com/envoyproxy/protoc-gen-validate v1.1.0/go.mod h1:sXRDRVmzEbkM7CVcM06s9shE/m23dg3wzjl0UWqJ2q4=
github.com/gokrazy/rsync v0.0.0-20250601185929-d3cb1d4a4fcd h1:SF3hnrM/YPI+GQJnWq2ldcWZ0Y6Bdm+VP3KItdoxRL4=
github.com/gokrazy/rsync v0.0.0-20250601185929-d3cb1d4a4fcd/go.mod h1:nrvfy+3qYcxt92pGtVa38uKlQ0dl2SrXEmtIaY/vCHA=
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
Expand All @@ -12,18 +22,55 @@ github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaU
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
github.com/jackc/pgx/v5 v5.7.2 h1:mLoDLV6sonKlvjIEsV56SkWNCnuNv531l94GaIzO+XI=
github.com/jackc/pgx/v5 v5.7.2/go.mod h1:ncY89UGWxg82EykZUwSpUKEfccBGGYq1xjrOpsbsfGQ=
github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
github.com/landlock-lsm/go-landlock v0.0.0-20250303204525-1544bccde3a3 h1:zcMi8R8vP0WrrXlFMNUBpDy/ydo3sTnCcUPowq1XmSc=
github.com/landlock-lsm/go-landlock v0.0.0-20250303204525-1544bccde3a3/go.mod h1:RSub3ourNF8Hf+swvw49Catm3s7HVf4hzdFxDUnEzdA=
github.com/mmcloughlin/md4 v0.1.2 h1:kGYl+iNbxhyz4u76ka9a+0TXP9KWt/LmnM0QhZwhcBo=
github.com/mmcloughlin/md4 v0.1.2/go.mod h1:AAxFX59fddW0IguqNzWlf1lazh1+rXeIt/Bj49cqDTQ=
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
golang.org/x/net v0.28.0 h1:a9JDOJc5GMUJ0+UDqmLT86WiEy7iWyIhz8gz8E4e5hE=
golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg=
golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 h1:3UsHvIr4Wc2aW4brOaSCmcxh9ksica6fHEr8P1XhkYw=
google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
google.golang.org/grpc v1.67.3 h1:OgPcDAFKHnH8X3O4WcO4XUc8GRDeKsKReqbQtiCj7N8=
google.golang.org/grpc v1.67.3/go.mod h1:YGaHCc6Oap+FzBJTZLBzkGSYt/cvGPFTPxkn7QfSU8s=
google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
kernel.org/pub/linux/libs/security/libcap/psx v1.2.76 h1:3DyzQ30OHt3wiOZVL1se2g1PAPJIU7+tMUyvfMUj1dY=
Expand Down
228 changes: 228 additions & 0 deletions src/service/authz_sidecar/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,228 @@
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0

load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library", "go_test")
load("@bazel_gazelle//:def.bzl", "gazelle")
load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
load("@rules_oci//oci:defs.bzl", "oci_image", "oci_load", "oci_push")
load("@osmo_constants//:constants.bzl", "BASE_IMAGE_URL", "IMAGE_TAG")

# gazelle:prefix go.corp.nvidia.com/osmo
gazelle(name = "gazelle")

go_library(
name = "authz_sidecar",
srcs = ["main.go"],
importpath = "go.corp.nvidia.com/osmo/service/authz_sidecar",
visibility = ["//visibility:private"],
deps = [
"//src/service/authz_sidecar/server:server",
"//src/service/utils_go/postgres:postgres",
"@org_golang_google_grpc//:go_default_library",
"@org_golang_google_grpc//health:go_default_library",
"@org_golang_google_grpc//health/grpc_health_v1:go_default_library",
"@org_golang_google_grpc//keepalive:go_default_library",
],
)

go_binary(
name = "authz_sidecar_bin",
embed = [":authz_sidecar"],
visibility = ["//visibility:public"],
)

################
# x86_64 #
################

go_binary(
name = "authz_sidecar_bin_x86_64",
basename = "authz_sidecar",
embed = [":authz_sidecar"],
goarch = "amd64",
goos = "linux",
pure = "on",
visibility = ["//visibility:public"],
)

pkg_tar(
name = "authz_sidecar_pkg_x86_64",
extension = "tgz",
package_dir = "/osmo",
srcs = [":authz_sidecar_bin_x86_64"],
mode = "0755",
visibility = ["//visibility:public"],
)

oci_image(
name = "authz_sidecar_image_x86_64",
base = "//src:osmo_docker_distroless_image_amd64",
tars = [":authz_sidecar_pkg_x86_64"],
entrypoint = ["/osmo/authz_sidecar"],
visibility = ["//visibility:public"],
target_compatible_with = [
"@platforms//cpu:x86_64",
],
)

oci_load(
name = "authz_sidecar_image_load_x86_64",
image = ":authz_sidecar_image_x86_64",
repo_tags = ["osmo.local/authz-sidecar:latest-x86_64"],
tags = ["manual"],
target_compatible_with = [
"@platforms//cpu:x86_64",
],
)

oci_push(
name = "authz_sidecar_push_x86_64",
image = ":authz_sidecar_image_x86_64",
repository = BASE_IMAGE_URL + "authz-sidecar",
remote_tags = [IMAGE_TAG + "-amd64"] if IMAGE_TAG else None,
visibility = ["//visibility:public"],
tags = ["manual"],
target_compatible_with = [
"@platforms//cpu:x86_64",
],
)

###############
# arm64 #
###############

go_binary(
name = "authz_sidecar_bin_arm64",
basename = "authz_sidecar",
embed = [":authz_sidecar"],
goarch = "arm64",
goos = "linux",
pure = "on",
visibility = ["//visibility:public"],
)

pkg_tar(
name = "authz_sidecar_pkg_arm64",
extension = "tgz",
package_dir = "/osmo",
srcs = [":authz_sidecar_bin_arm64"],
mode = "0755",
visibility = ["//visibility:public"],
)

oci_image(
name = "authz_sidecar_image_arm64",
base = "//src:osmo_docker_distroless_image_arm64",
tars = [":authz_sidecar_pkg_arm64"],
entrypoint = ["/osmo/authz_sidecar"],
visibility = ["//visibility:public"],
target_compatible_with = [
"@platforms//cpu:arm64",
],
)

oci_load(
name = "authz_sidecar_image_load_arm64",
image = ":authz_sidecar_image_arm64",
repo_tags = ["osmo.local/authz-sidecar:latest-arm64"],
tags = ["manual"],
target_compatible_with = [
"@platforms//cpu:arm64",
],
)

oci_push(
name = "authz_sidecar_push_arm64",
image = ":authz_sidecar_image_arm64",
repository = BASE_IMAGE_URL + "authz-sidecar",
remote_tags = [IMAGE_TAG + "-arm64"] if IMAGE_TAG else None,
visibility = ["//visibility:public"],
tags = ["manual"],
target_compatible_with = [
"@platforms//cpu:arm64",
],
)

# Legacy target alias for backward compatibility
pkg_tar(
name = "authz_sidecar_pkg",
extension = "tgz",
package_dir = "/osmo",
srcs = [":authz_sidecar_bin"],
mode = "0755",
visibility = ["//visibility:public"],
)

# Integration test - requires running authz_sidecar service
#
# To run this test:
# 1. Start PostgreSQL:
# docker run --rm -d --name postgres -p 5432:5432 \
# -e POSTGRES_PASSWORD=osmo -e POSTGRES_DB=osmo_db postgres:15.1
#
# 2. Start authz_sidecar:
# bazel run //src/service/authz_sidecar:authz_sidecar_bin -- \
# --postgres-password=osmo --postgres-db=osmo_db --postgres-host=localhost
#
# 3. Run the test:
# bazel test //src/service/authz_sidecar:authz_sidecar_integration_test --test_output=streamed
#
# Custom service address:
# bazel test //src/service/authz_sidecar:authz_sidecar_integration_test \
# --test_output=streamed \
# --test_arg=-authz-addr=localhost:50052
#
go_test(
name = "authz_sidecar_integration_test",
srcs = ["integration_test.go"],
deps = [
"@com_github_envoyproxy_go_control_plane//envoy/service/auth/v3:auth",
"@org_golang_google_grpc//:go_default_library",
"@org_golang_google_grpc//credentials/insecure:go_default_library",
"@org_golang_google_grpc//health/grpc_health_v1:go_default_library",
],
visibility = ["//visibility:public"],
tags = ["service", "manual"], # Requires service
local = True, # Run locally without sandboxing
)

# Performance benchmark test for Go authz_sidecar
#
# To run this test:
# 1. Start PostgreSQL:
# docker run --rm -d --name postgres -p 5432:5432 \
# -e POSTGRES_PASSWORD=osmo -e POSTGRES_DB=osmo_db postgres:15.1
#
# 2. Start Go authz_sidecar:
# bazel run //src/service/authz_sidecar:authz_sidecar_bin -- \
# --postgres-password=osmo --postgres-db=osmo_db --postgres-host=localhost
#
# 3. Run the benchmark:
# bazel test //src/service/authz_sidecar:performance_comparison --test_output=streamed
#
go_test(
name = "performance_comparison",
srcs = ["performance_comparison_test.go"],
deps = [
"@com_github_envoyproxy_go_control_plane//envoy/service/auth/v3:auth",
"@org_golang_google_grpc//:go_default_library",
"@org_golang_google_grpc//credentials/insecure:go_default_library",
],
visibility = ["//visibility:public"],
tags = ["service", "manual", "benchmark"],
local = True,
)

Loading
Loading