docs: backend #3550
docs: backend #3550
Conversation
Signed-off-by: Guy Daich <[email protected]>
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #3550 +/- ##
=======================================
Coverage 68.14% 68.14%
=======================================
Files 168 168
Lines 20408 20408
=======================================
Hits 13908 13908
Misses 5497 5497
Partials 1003 1003 ☔ View full report in Codecov by Sentry. |
Signed-off-by: Guy Daich <[email protected]>
| @@ -0,0 +1,208 @@ | |||
| --- | |||
| title: "Backend Routing" | |||
There was a problem hiding this comment.
can we add the contents here into routing-outside-kubernetes.md and push the endpointslice to the bottom of the page, saying "in case dont want to enable the enableBackend knob, here's another way ..". ?
There was a problem hiding this comment.
I was hoping to build out this doc to cover additional use cases like unix sockets (once these are supported for more common use cases like ext-auth, RL, ..). I also feel like this is a more experimental feature at this time, without much production burn time, so I'm not sure that we should recommend it as the go-to approach. WDYT?
Signed-off-by: Guy Daich <[email protected]>
Signed-off-by: Guy Daich <[email protected]>
|
/retest |
| ## Motivation | ||
| The Backend API was added to support several use cases: | ||
| - Allowing users to integrate Envoy with services (Ext Auth, Rate Limit, ALS, ...) using Unix Domain Sockets, which are currently not supported by K8s. | ||
| - Simplify [routing to cluster-external backends][], which currently requires users to maintain both K8s `Service` and `Endpoint` resources. |
There was a problem hiding this comment.
| - Simplify [routing to cluster-external backends][], which currently requires users to maintain both K8s `Service` and `Endpoint` resources. | |
| - Simplify [routing to cluster-external backends][], which currently requires users to maintain both K8s `Service` and `EndpointSlice` resources. |
|
|
||
| ## Warning | ||
|
|
||
| Similar to the K8s Endpoint API, the Backend API can be misused to allow traffic to be sent to otherwise restricted destinations, as described in [CVE-2021-25740][]. |
There was a problem hiding this comment.
| Similar to the K8s Endpoint API, the Backend API can be misused to allow traffic to be sent to otherwise restricted destinations, as described in [CVE-2021-25740][]. | |
| Similar to the K8s EndpointSlice API, the Backend API can be misused to allow traffic to be sent to otherwise restricted destinations, as described in [CVE-2021-25740][]. |
Signed-off-by: Guy Daich <[email protected]>
What this PR does / why we need it:
Docs for Backend API.
Which issue(s) this PR fixes:
Fixes #3549