Skip to content

Commit 6844c39

Browse files
ecordellmiparnisari
authored andcommitted
feat: add Memory Protection Middleware via RTML
1 parent 1f51bd5 commit 6844c39

33 files changed

+3356
-93
lines changed

.gitattributes

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
internal/**/mock_*.go linguist-generated=true
12
*.pb.go linguist-generated=true
23
*.pb.*.go linguist-generated=true
34
proto/internal/buf.lock linguist-generated=true

.github/workflows/build-test.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,8 @@ jobs:
5959
username: "${{ env.DOCKERHUB_PUBLIC_USER }}"
6060
password: "${{ env.DOCKERHUB_PUBLIC_ACCESS_TOKEN }}"
6161
- uses: "authzed/actions/go-build@70432bd54a9e690d7fe19817dda46d8e4c0a2c3a" # main
62+
with:
63+
ldflags: "-checklinkname=0"
6264
- name: "Image tests"
6365
run: "go run mage.go test:image"
6466

.goreleaser.nightly.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ builds:
1212
- "arm64"
1313
mod_timestamp: "{{ .CommitTimestamp }}"
1414
ldflags:
15-
- "-s -w"
15+
- "-s -w -checklinkname=0"
1616
- "-X github.com/jzelinskie/cobrautil/v2.Version=v{{ .Version }}"
1717
kos:
1818
- id: "spicedb"

.goreleaser.windows.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ builds:
1717
- "amd64"
1818
mod_timestamp: "{{ .CommitTimestamp }}"
1919
ldflags:
20-
- "-s -w"
20+
- "-s -w -checklinkname=0"
2121
- "-X github.com/jzelinskie/cobrautil/v2.Version=v{{ .Version }}"
2222
archives:
2323
- files:

.goreleaser.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ builds:
2020
- "arm64"
2121
mod_timestamp: "{{ .CommitTimestamp }}"
2222
ldflags:
23-
- "-s -w"
23+
- "-s -w -checklinkname=0"
2424
- "-X github.com/jzelinskie/cobrautil/v2.Version=v{{ .Version }}"
2525
archives:
2626
- files:
@@ -95,7 +95,7 @@ brews:
9595
if build.head?
9696
versionVar = "github.com/jzelinskie/cobrautil/v2.Version"
9797
versionCmd = "$(git describe --always --abbrev=7 --dirty --tags)"
98-
system "go build --ldflags '-s -w -X #{versionVar}=#{versionCmd}' ./cmd/spicedb"
98+
system "go build --ldflags '-s -w -checklinkname=0 -X #{versionVar}=#{versionCmd}' ./cmd/spicedb"
9999
end
100100
bin.install "spicedb"
101101
generate_completions_from_executable(bin/"spicedb", "completion", shells: [:bash, :zsh, :fish])

Dockerfile

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@ FROM golang:1.25.3-alpine@sha256:aee43c3ccbf24fdffb7295693b6e33b21e01baec1b2a55a
33
WORKDIR /go/src/app
44
RUN apk update && apk add --no-cache git
55
COPY . .
6-
RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg/mod CGO_ENABLED=0 go build -v -o spicedb ./cmd/spicedb
6+
# https://github.com/odigos-io/go-rtml#about-ldflags-checklinkname0
7+
RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg/mod CGO_ENABLED=0 go build -v -ldflags=-checklinkname=0 -o spicedb ./cmd/spicedb
78

89
# use `docker buildx imagetools inspect <image>` to get the multi-platform sha256
910
FROM golang:1.25.3-alpine@sha256:aee43c3ccbf24fdffb7295693b6e33b21e01baec1b2a55acc351fde345e9ec34 AS health-probe-builder

cmd/spicedb/serve_integration_test.go

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,56 @@ func TestServe(t *testing.T) {
9292
}
9393
}
9494

95+
func TestServeWithMemoryProtectionMiddleware(t *testing.T) {
96+
t.Parallel()
97+
98+
pool, err := dockertest.NewPool("")
99+
require.NoError(t, err)
100+
101+
serverToken := "mykey"
102+
serveResource, err := pool.RunWithOptions(&dockertest.RunOptions{
103+
Repository: "authzed/spicedb",
104+
Tag: "ci",
105+
Cmd: []string{"serve", "--log-level=debug", "--grpc-preshared-key", serverToken, "--telemetry-endpoint=\"\""},
106+
ExposedPorts: []string{"50051/tcp"},
107+
Env: []string{"GOMEMLIMIT=1B"}, // NOTE: Absurdly low on purpose
108+
}, func(config *docker.HostConfig) {
109+
config.RestartPolicy = docker.RestartPolicy{
110+
Name: "no",
111+
}
112+
})
113+
require.NoError(t, err)
114+
t.Cleanup(func() {
115+
require.NoError(t, pool.Purge(serveResource))
116+
})
117+
118+
serverPort := serveResource.GetPort("50051/tcp")
119+
conn, err := grpc.NewClient(fmt.Sprintf("localhost:%s", serverPort),
120+
grpc.WithTransportCredentials(insecure.NewCredentials()),
121+
grpcutil.WithInsecureBearerToken(serverToken),
122+
)
123+
124+
require.NoError(t, err)
125+
t.Cleanup(func() {
126+
_ = conn.Close()
127+
})
128+
129+
// Health requests bypass the memory middleware
130+
require.Eventually(t, func() bool {
131+
resp, err := healthpb.NewHealthClient(conn).Check(context.Background(), &healthpb.HealthCheckRequest{Service: "authzed.api.v1.SchemaService"})
132+
return err == nil && resp.GetStatus() == healthpb.HealthCheckResponse_SERVING
133+
}, 5*time.Second, 1*time.Second, "server never became healthy")
134+
135+
// Other requests have the memory middleware
136+
client := v1.NewSchemaServiceClient(conn)
137+
_, err = client.WriteSchema(context.Background(), &v1.WriteSchemaRequest{
138+
Schema: `definition user {}`,
139+
})
140+
s, ok := status.FromError(err)
141+
require.True(t, ok)
142+
require.Equal(t, codes.ResourceExhausted, s.Code())
143+
}
144+
95145
func gracefulShutdown(pool *dockertest.Pool, serveResource *dockertest.Resource) bool {
96146
closed := make(chan bool, 1)
97147
go func() {

development/prometheus.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
global:
3-
scrape_interval: "15s"
4-
evaluation_interval: "15s"
3+
scrape_interval: "1s"
4+
evaluation_interval: "1s"
55

66
scrape_configs:
77
- job_name: "spicedb"

e2e/go.mod

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ require (
5959
github.com/jzelinskie/stringz v0.0.3 // indirect
6060
github.com/mattn/go-colorable v0.1.14 // indirect
6161
github.com/mattn/go-isatty v0.0.20 // indirect
62+
github.com/odigos-io/go-rtml v0.0.1 // indirect
6263
github.com/onsi/ginkgo/v2 v2.23.4 // indirect
6364
github.com/onsi/gomega v1.38.0 // indirect
6465
github.com/planetscale/vtprotobuf v0.6.1-0.20240917153116-6f2963f01587 // indirect

e2e/go.sum

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1789,6 +1789,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq
17891789
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
17901790
github.com/ngrok/sqlmw v0.0.0-20220520173518-97c9c04efc79 h1:Dmx8g2747UTVPzSkmohk84S3g/uWqd6+f4SSLPhLcfA=
17911791
github.com/ngrok/sqlmw v0.0.0-20220520173518-97c9c04efc79/go.mod h1:E26fwEtRNigBfFfHDWsklmo0T7Ixbg0XXgck+Hq4O9k=
1792+
github.com/odigos-io/go-rtml v0.0.1 h1:5w21AOXZGq/6UhECv5B9RCrW7R8PzA8YgwdxqtajD0w=
1793+
github.com/odigos-io/go-rtml v0.0.1/go.mod h1:LqKwlorUKSNj1WQ0p/5e9+aOkirEiHQx+FOxdhku/cs=
17921794
github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus=
17931795
github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8=
17941796
github.com/onsi/gomega v1.38.0 h1:c/WX+w8SLAinvuKKQFh77WEucCnPk4j2OTUr7lt7BeY=
@@ -1821,6 +1823,8 @@ github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzM
18211823
github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
18221824
github.com/prometheus/statsd_exporter v0.22.7 h1:7Pji/i2GuhK6Lu7DHrtTkFmNBCudCPT1pX2CziuyQR0=
18231825
github.com/prometheus/statsd_exporter v0.22.7/go.mod h1:N/TevpjkIh9ccs6nuzY3jQn9dFqnUakOjnEuMPJJJnI=
1826+
github.com/puzpuzpuz/xsync/v4 v4.2.0 h1:dlxm77dZj2c3rxq0/XNvvUKISAmovoXF4a4qM6Wvkr0=
1827+
github.com/puzpuzpuz/xsync/v4 v4.2.0/go.mod h1:VJDmTCJMBt8igNxnkQd86r+8KUeN1quSfNKu5bLYFQo=
18241828
github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
18251829
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
18261830
github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=

0 commit comments

Comments
 (0)