Git Product home page Git Product logo

envoy-preflight's Introduction

envoy-preflight

envoy-preflight is a simple wrapper application which makes it easier to run applications which depend on envoy as a sidecar container for outside network access. It ensures that your application doesn't start until envoy is ready, and that envoy shuts down when the application exits. It is best used as a prefix to your existing Docker entrypoint. It executes any argument passed to it, doing a simple path lookup:

envoy-preflight echo "hi"
envoy-preflight /bin/ls -a

The envoy-preflight wrapper won't do anything special unless you provide at least the ENVOY_ADMIN_API environment variable. This makes, e.g., local development of your app easy.

If you do provide the ENVOY_ADMIN_API environment variable, envoy-preflight will poll the proxy indefinitely with backoff, waiting for Envoy to report itself as live. This implies it has loaded cluster configuration (for example from an ADS server). Only then will it execute the command provided as an argument, so that your app can immediately start accessing the outside network.

All signals are passed to the underlying application. Be warned that SIGKILL cannot be passed, so this can leave behind a orphaned process.

When the application exits, as long as it does so with exit code 0, envoy-preflight will instruct envoy to shut down immediately.

Environment variables

Variable Purpose
ENVOY_ADMIN_API This is the path to envoy's administration interface, in the format http://127.0.0.1:9010. If provided, envoy-preflight will poll this url at /server_info waiting for envoy to report as LIVE. If provided and local (127.0.0.1 or localhost), then envoy will be instructed to shut down if the application exits cleanly.
ENVOY_KILL_API This is the endpoint of the POST command to kill envoy, which defaults to $ENVOY_ADMIN_API/quitquitquit, but you can provide any value in format http://127.0.0.1:9010/quitquitquit. This can be used to support istio by providing the pilot-agent port.
NEVER_KILL_ENVOY If provided and set to true, envoy-preflight will not instruct envoy to exit under any circumstances.
ALWAYS_KILL_ENVOY If provided and set to true, envoy-preflight will instruct envoy to exit, even if the main application exits with a nonzero exit code.
START_WITHOUT_ENVOY If provided and set to true, envoy-preflight will not wait for envoy to be LIVE before starting the main application. However, it will still instruct envoy to exit.

envoy-preflight's People

Contributors

jackkleeman avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

envoy-preflight's Issues

Support separate status and kill endpoints

Normally, envoy-preflight expects that before startup, it can poll the admin endpoint for proxy status, then run the process, and finally hit the same admin endpoint with POST to /quitquitquit to finalise and shutdown.

On Istio, this approach fails. Istio runs a thing called pilot-agent which bootstraps and wraps the Envoy proxy sidecar. When one directly hits the kill endpoint on Envoy, Envoy quits, but pilot-agent just restarts it, defeating the object.

Since Istio 1.3.0, pilot-agent supports a /quitquitquit endpoint, too.

I think the simplest approach to solve this issue would be something like optional separate configuration of the kill-endpoint in envoy-preflight. For example, apart from the ENVOY_ADMIN_API variable, perhaps also have an optional ENVOY_QUIT_ENDPOINT_API (better name would be useful), for those running Istio.

Latest Image have many ciritical CVES

CVES.txt
Vulnerabilities found for image total - 21, critical - 1, high - 13, medium - 7, low - 0
I have attached the CVES which are critical and high.

Could you please help us to fix the issue at the earliest.

Thanks,
Kumar

License?

We'd like to extend this utility (to wait for a LDS/ CDS update before starting). Would you consider releasing with a permissive license?

How to use?

Hi,
thank you for open sourcing this script.

I am pretty new to the container world. Could you eli5 the installation process of this?

Do I need to compile this before i can add it to my Dockerfile?

I am interested in envoy-preflight because of the problem that the sidecar does not shut down and a kubernetes job never completes due to that.

Thank you again!

Go runtime Signal 23 (SIGURG) before child process is running causes preflight to silently exit

The Go runtime scheduling uses signal 23 (SIGURG) since Go 1.14 (see 24543-non-cooperative-preemption.md). Because the Go runtime does not know if the process expects external SIGURG signals, the signal is not filtered out from signal.Notify, but always reported to the process (see golang/go#37942 for discussion). Preflight should filter this signal out itself before forwarding and when the child process isn't up yet it should also not exit when it is received.

envoy-preflight/main.go

Lines 46 to 53 in eb1500e

signal.Notify(stop)
for sig := range stop {
if proc != nil {
proc.Signal(sig)
} else {
// Signal received before the process even started. Let's just exit.
os.Exit(1)
}

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.