feat(network): add api service static IP for proxy force-through#181
Closed
feat(network): add api service static IP for proxy force-through#181
Conversation
…ction Add SecretRule message to CodeMetadata in the gravity session proto. This enables Ion to send secret injection rules to Hadron via the deployment metadata response, telling the transparent proxy how to replace hashed placeholder tokens with real secret values in outbound HTTP requests to platform services.
…ring Replace the freeform string scheme field on SecretRule with a typed SecretScheme enum (BEARER, BASIC, RAW) for compile-time safety. Clarify host_match semantics: empty means matches no hosts (deny-by-default) and will be rejected at validation time.
Add 'api' to the list of services that get a static magic IPv6 address
in the Graviton overlay network. This allows the eBPF firewall to
force traffic to api.agentuity.{io,cloud} through the transparent
proxy for secret injection, same as catalyst, streams, and otel.
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThis PR introduces secret injection rules for HTTP headers in protobuf definitions, adds an "api" service to the network code generator, and extends network infrastructure with API service mappings and EU region subnet support. Changes
📝 Coding Plan
Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
apito the static service IP generation listApiServiceIPconstant (fd15:d710:2c:e000:9dc5:82b5::)Why
The eBPF firewall in Hadron needs to force traffic to
api.agentuity.{io,cloud}through the transparent proxy for secret injection. Like catalyst, streams, and otel, the api service needs a magic IPv6 address so the eBPF program can identify it and redirect traffic to the proxy instead of letting it bypass via the Gravity tunnel.What changed
network/gen_static.go— added"api"to the services listnetwork/static_generated.go— regenerated with newApiServiceIPconstant,Servicesmap entry, andAddressesmap entrySummary by CodeRabbit