Repository navigation
feat(grpc): token-based authentication for gRPC requests (#4417) - #2130
Open
DoubleCore wants to merge 2 commits into
Open
DoubleCore wants to merge 2 commits into
DoubleCore wants to merge 2 commits into
Conversation
Add JWT (HS256) bearer-token authentication to the client's gRPC stack: - grpc::interceptor: server-side auth interceptor validating bearer tokens (expiry, audience, signature), plus a client-side interceptor that injects the token from config or a file; health checks stay unauthenticated - dragonfly-client-config: token/token_file/audience knobs for manager, scheduler and dfdaemon gRPC endpoints, with validation at load time - manager/scheduler/dfdaemon clients and dynconfig use the interceptors; when no token is configured the previous unauthenticated behaviour is kept and a warning is logged once - docs/grpc-jwt-auth.md documents the claim layout and rollout Tests: 18 grpc tests pass (token accepted/rejected, expired, tampered signature, malformed token, file-based token, no-token dev mode). Signed-off-by: DoubleCore <851678303@qq.com>
DoubleCore
requested review from
ClementMaH,
EvanCley,
chlins,
gaius-qi,
xujihui1985 and
yyzai384
November 4, 2026 11:01
HealthClient::connect needs the tonic transport feature, which this workspace does not enable, so the test target failed to compile. Construct the channel via Endpoint::from_shared().connect() and use HealthClient::new(), matching check_with_interceptor above. Also restore opentelemetry-semantic-conventions to =0.33.1 and rebuild Cargo.lock from the base revision; the previous lockfile downgraded unrelated dependencies. Verified: cargo check -p dragonfly-client --all-targets (clean); cargo test -p dragonfly-client --lib grpc::interceptor -> 12 passed, 0 failed. Signed-off-by: DoubleCore <851678303@qq.com>
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #2130 +/- ##
==========================================
+ Coverage 65.76% 65.78% +0.01%
==========================================
Files 102 102
Lines 31270 32190 +920
==========================================
+ Hits 20566 21177 +611
- Misses 10704 11013 +309
🚀 New features to boost your workflow:
|
DoubleCore
force-pushed
the
issue-4417-jwt
branch
from
November 4, 2026 14:44
c21a4cb to
b90dec0
Compare
Author
|
Kindly asking a maintainer to add one kind label (
|
6 of 8 tasks
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
说明
实现 dragonflyoss/dragonfly#4417 的 client 侧 gRPC token 鉴权（JWT / HS256）。
主仓服务端部分在 dragonflyoss/dragonfly#5098。
改动
1.
dragonfly-client/src/grpc/interceptor.rs（+525 行）authorization: Bearer <token>，验签 +exp/aud（可选），失败返回Unauthenticated；grpc.health.v1.Health默认豁免，避免影响 k8s probe2. 配置（
dragonfly-client-config）manager/scheduler/dfdaemon各加token、token_file、audience，加载期校验；支持从文件读（便于挂 Secret）。3. 接线
grpc/{manager,scheduler,dfdaemon_download,dfdaemon_upload,health}.rs与dynconfig/{local,remote}.rs使用该 interceptor。4. 文档
docs/grpc-jwt-auth.md：claim 结构、配置示例、滚动升级顺序。验证
覆盖：token 注入、过期拒绝、签名篡改、格式错误、文件读取、无 token 开发模式、audience 宽容策略。
refs: #4417