Pluggable Interception: Using ExtAuthz and ExtProc in gRPC Using XDS
summary
gRPC adds ExtAuthz and ExtProc via xDS so interception runs as side‑channel callouts, not sidecars: the library becomes XDS‑aware and performs real‑time allow/deny on initial metadata (client and server) while ExtProc streams decompressed gRPC bodies and headers to an external processor that can mutate messages, redact PII, or immediately close the RPC. Independent flow control is implemented, composite filters allow per‑route application, sampling and failure‑handling modes exist, security is enforced by a gRPC service protocol and allowlist, and caching of decisions is discussed but not implemented yet.
AI-written summary · about
chapters (10)
- 0:00gRPC and service mesh intro
- 3:17Service mesh XDS basics
- 6:06Proxyless gRPC mesh
- 8:14ExtAuthz and ExtProc filters
- 13:14ExtAuthz security filters
- 15:42ExtAuthz interception flow
- 18:14ExtProc streaming details
- 21:25gRPC in service mesh future
- 22:51gRPC resources
- 23:55Q&A on ExtAuthz
related talks
34mgRPC Proxyless Service Mesh with Security
29mThe Security Evolution of GRPC Services in the Mesh
22mThe Security Evolution of gRPC Services in the Mesh - Amim Knabben, VMware
21mDeep Diving Into gRPC Security: A Case Study on API Security... - Dana White & Austin Pearigen
30mSecuring Your Services with Authentication, Authorization, and RBAC in gRPC
21mHigh-Performance Cloud Native Traffic Authentication Solutions
31mAuthentication and Security in gRPC Microservices
33mHunting Vulnerabilities of gRPC Protocol Armed Mobile/IoT Applications