Authorization with Envoy
summary
Square moves authorization into the Envoy sidecar using Envoy’s ext_authz filter and a centralized source of truth backed by a DB and UI, migrating ~250 services and targeting ~20k QPS. The service supports a logging-only mode, a 5% runtime fraction rollout, and migration scripts that extract rules from proto/eclike files; measured added latency stays under ~10 ms. Pain points include wildcard route conflicts, coexisting in-app rules during migration, and inability to differentiate multiple ext_authz uses per pipeline.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:20Agenda
- 0:40Definitions
- 1:55Envoy at Square
- 2:41Background
- 4:49Problems and motivation
- 7:47Authorization with Envoy
- 14:37Rollout strategy
- 16:30Lessons learned
- 19:47Next steps
related talks
10mOverview of Authentication and Authorization Features in Envoy
26mLeveraging Envoy to Implement Micro-Segmentation-Based Security Policies
17mContext Aware Traffic Routing for Stateful Services using Envoy
21mDeep Dive: Envoy
26mSecuring the Gateway: A Deep Dive Into Envoy Gateway's Advanced Security Pol...
36mSecuring Every Bit
05mKeynote: Envoy, the Engine for a Cloud Native Security Kernel
39mAuthN and AuthZ at Cruise: Crawl, Walk, Run