gRPC server reflection

[eguzki]

What

gRPC server reflection provided by tonic-reflection

Opt-in feature to be enabled using --grpc-reflection-service command line option.

Verification steps

Run sandbox dev environment

cd limitador-server/sandbox
make build
make deploy-in-memory

Note: make deploy-in-memory runs limitador with the --grpc-reflection-service command line option set.

In a separate shell, inspect the RLS GRPC endpoint. First, let's install grpcurl tool. You need Go SDK 1.8+ installed.

make grpcurl

Inspect RateLimitService GRPC service

bin/grpcurl -plaintext 127.0.0.1:18081 describe envoy.service.ratelimit.v3.RateLimitService

The output should be the following

envoy.service.ratelimit.v3.RateLimitService is a service:
service RateLimitService {
  // Determine whether rate limiting should take place.
  rpc ShouldRateLimit ( .envoy.service.ratelimit.v3.RateLimitRequest ) returns ( .envoy.service.ratelimit.v3.RateLimitResponse );
}

If the reflection API is not available the output looks like

Failed to resolve symbol "envoy.service.ratelimit.v3.RateLimitService": server does not support the reflection API

Make a manual request to the RLS endpoint

bin/grpcurl -plaintext -d @ 127.0.0.1:18081 envoy.service.ratelimit.v3.RateLimitService.ShouldRateLimit <<EOM
{
    "domain": "test_namespace",
    "hits_addend": 1,
    "descriptors": [
        {
            "entries": [
                {
                    "key": "req.method",
                    "value": "POST"
                }
            ]
        }
    ]
}
EOM

Note that grpcurl does not need proto files or compiled protoset files. The reflection service tells grpc how to parse request and response.

The response should be the following:

{
  "overallCode": "OK"
}

Let's check that rate limiting is working. The limits file looks like

- namespace: test_namespace
  max_value: 5
  seconds: 60
  conditions:
    - "req.method == 'POST'"
  variables: []

Thus, the limit is set to max 5 request for 60 seconds. Do repeated requests. you should see OVER_LIMIT response after 5 requests.

while :; do bin/grpcurl -plaintext -d @ 127.0.0.1:18081 envoy.service.ratelimit.v3.RateLimitService.ShouldRateLimit <<EOM; sleep 1; done
{
    "domain": "test_namespace",
    "hits_addend": 1,
    "descriptors": [
        {
            "entries": [
                {
                    "key": "req.method",
                    "value": "POST"
                }
            ]
        }
    ]
}
EOM

The expected output

{
  "overallCode": "OK"
}
{
  "overallCode": "OK"
}
{
  "overallCode": "OK"
}
{
  "overallCode": "OK"
}
{
  "overallCode": "OK"
}
{
  "overallCode": "OVER_LIMIT"
}
{
  "overallCode": "OVER_LIMIT"
}
{
  "overallCode": "OVER_LIMIT"
}

[alexsnaps]

Thinking we may want to add this when not building for target release. We can check for debug_assertions. Or introduce it as a feature? I guess this isn't meant for a production deployment, right?

[eguzki]

Yes, makes sense. I will give it a try

[eguzki]

Implemented as command line option, which defaults to not being exposed.

[eguzki]

The downside of this implementation is that the build will include tonic-reflection crate now. The feature approach could save us doing that. I think it is handier to have a command line option instead of custom compilation to the reflection service working. Let me know what you think,