Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

client: bypass endpoint name resolution #477

Merged
merged 1 commit into from
Mar 7, 2025

Conversation

kartikaysaxena
Copy link
Contributor

Should fix #475

Works as per this (tested locally with socks5 proxy)

Copy link
Contributor

@tstirrat15 tstirrat15 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See comment

@@ -74,7 +75,7 @@ func newClientForContext(cmd *cobra.Command, contextName string, secretStore sto
return nil, err
}

return authzed.NewClient(token.Endpoint, dialOpts...)
return authzed.NewClient(withPassthroughTarget(token.Endpoint), dialOpts...)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm hesitant about the way that this changes the behavior for all calls. Ideally we'd only include this behavior when explicitly using a proxy. Is there a way to rework this so that we only apply it when the proxy is defined?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My current reading/understanding is that if you use the dns resolver, which is the default, it attempts to do DNS resolution before creating connections, which allows it to get a list of available hosts for client-side load balancing. Otherwise it's deferring the resolution to the lib underlying the gRPC client, which means it will only have a single target and a single connection.

That may be sufficient given that zed is a CLI utility, and it doesn't have the same performance requirements as (say) the dispatcher within SpiceDB.

I think I'd still prefer to minimize the possibility of surprising behaviors, which would point to leaving the default intact in as many cases as possible.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sounds about right, changing this logic to be employed only when a proxy is specified.

@kartikaysaxena kartikaysaxena force-pushed the passthrough-endpoint branch 2 times, most recently from fe0fde1 to bac042c Compare March 7, 2025 19:56
Signed-off-by: Kartikay <[email protected]>
Copy link
Contributor

@tstirrat15 tstirrat15 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thank you!

@tstirrat15 tstirrat15 merged commit 2146357 into authzed:main Mar 7, 2025
11 checks passed
@github-actions github-actions bot locked and limited conversation to collaborators Mar 7, 2025
@kartikaysaxena kartikaysaxena deleted the passthrough-endpoint branch March 7, 2025 20:50
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Support DNS resolution via SOCKS5 proxy
2 participants