mirror of
https://github.com/hanzoai/egress.git
synced 2026-10-30 15:08:38 +00:00
zooqueen
46297b6264
A caller sends a request with no vendor credential. Egress authenticates the workload behind it, checks that workload may spend on that provider, rewrites the call onto an address it chose itself, and attaches the credential it holds in memory. The credential is never returned and never written down. Three allowlists, none of them reachable from a request field: the provider table fixes the destination, the operation set fixes which calls exist, and the grant table fixes who may spend on what. A caller names a provider; it cannot name a host, so the credential can never sign a request to somewhere else. Callers present the projected service-account token the kubelet mints for them. Egress asks the cluster what one means rather than verifying it here, which keeps revocation instant and leaves no signature checking to get wrong. Credentials resolve from KMS at boot and refresh on a timer, so a value rewritten there is in use within the interval with no redeploy. A read names the full coordinate - path, name and environment - because a bare name resolves to a different partition and a missing environment to a different environment, and both return "not found" for a record that exists.
42 lines
1.5 KiB
Docker
42 lines
1.5 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS build
|
|
|
|
RUN apk add --no-cache git ca-certificates
|
|
|
|
ARG TARGETOS=linux
|
|
ARG TARGETARCH=amd64
|
|
ARG VERSION=v0.0.0
|
|
|
|
WORKDIR /src
|
|
ENV GOPRIVATE=github.com/hanzoai/*,github.com/luxfi/*,github.com/zap-proto/*
|
|
COPY go.mod go.sum ./
|
|
RUN --mount=type=secret,id=gh_token \
|
|
if [ -s /run/secrets/gh_token ]; then \
|
|
git config --global url."https://x-access-token:$(cat /run/secrets/gh_token)@github.com/".insteadOf "https://github.com/"; \
|
|
fi && \
|
|
go mod download
|
|
|
|
COPY . .
|
|
RUN --mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=cache,target=/root/.cache/go-build \
|
|
CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
|
|
go build -trimpath -ldflags="-w -s" -o /egress ./cmd/egress
|
|
|
|
# The runtime holds a live credential in memory, so it carries nothing that
|
|
# could read it out: no shell, no package manager, no utilities. `kubectl exec`
|
|
# into this image has nothing to run. Certificates are the only thing copied in,
|
|
# because talking to a vendor over TLS is the job.
|
|
FROM scratch
|
|
|
|
LABEL org.opencontainers.image.source="https://github.com/hanzoai/egress"
|
|
LABEL org.opencontainers.image.title="Hanzo Egress"
|
|
LABEL org.opencontainers.image.description="The outbound trust boundary: callers ask for a call, egress holds the credential"
|
|
|
|
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
COPY --from=build /egress /egress
|
|
|
|
EXPOSE 8080
|
|
USER 65532:65532
|
|
ENTRYPOINT ["/egress"]
|