Opa-Envoy & gRPC parsing

[Thomas-Rice]

Hello all,
Would anyone be able to help with my current problem please?

I have setup Opa-Envoy in my cluster with the following template (with some small modifications) from the docs https://github.com/open-policy-agent/opa-envoy-plugin/blob/main/examples/istio/quick_start.yaml

I have a mix of REST and gRPC services and I need to be able to parse both types in Envoy so I can write the correct rego policies.
From the REST side, this all works fine, however i'm having issues getting any information in the Envoy logs regarding the gRPC call.

Does anyone know if there is additional configuration that I would need to setup or any documentation to look at?

[ashutosh-narkar]

OPA implements Envoy's external authz API. You would probably have to check how Envoy (ie,. Istio proxy) handles calls from your services. I would imagine the EnvoyFilter configuration should remain the same.

[randyangeles2]

Thanks as well for the response @ashutosh-narkar!

You would probably have to check how Envoy...

Any particular spot you'd suggest to check? To add to @Thomas-Rice's initial question, we're not seeing the gRPC call getting logged at all in the Envoy logs (REST calls do show up). Maybe this is because of the missing protobuf file as mentioned in the answer below?

Apologies if the questions are basic, still very new to all things OPA 🙂

[ashutosh-narkar]

Yes @randyangeles2, seems to be related to protobuf definitions as described below.

[randyangeles2]

Ok thanks!

[srenatus]

I've interpreted this question as being about gRPC payloads. To have opa-envoy-plugin parse these and provide them as input to your policies, some extra configuration is needed.

The used protobuf definitions need to be compiled and provided via opa-envoy-plugin's config, see here:

Providing a file containing a protobuf descriptor set allows the plugin to decode gRPC message payloads. So far, only unary methods using uncompressed protobuf-encoded payloads are supported. The protoset can be generated using protoc, e.g. protoc --descriptor_set_out=protoset.pb --include_imports.

👉 Also see examples/grpc for a working example

[Thomas-Rice]

Thank you for the reply!
So would I be right in saying that without the complied protobuf, then it would not be able to parse the request?

[srenatus]

Yes. Nobody can make sense of a pb payload without knowing the schema.