Implementing Proxies and Middleware
1. Using Envoy as gRPC Proxy
| Feature | Detail |
|---|---|
| HTTP/2 native | First-class gRPC support |
| Load balancing | Round-robin, least-request, ring-hash |
| Retries / timeouts | Per-route policy |
| Observability | Stats, tracing, access logs |
2. Configuring Envoy Routes
Example: gRPC route
routes:
- match: { prefix: "/user.v1.UserService/", grpc: {} }
route:
cluster: user_service
timeout: 5s
retry_policy:
retry_on: cancelled,deadline-exceeded,unavailable
num_retries: 33. Using NGINX for gRPC
Example: nginx grpc_pass
server {
listen 443 ssl http2;
ssl_certificate /etc/ssl/cert.pem;
ssl_certificate_key /etc/ssl/key.pem;
location / {
grpc_pass grpc://backend:50051;
grpc_set_header X-Real-IP $remote_addr;
}
}4. Implementing Auth Middleware
| Layer | Detail |
|---|---|
| Envoy JWT filter | Validate before reaching backend |
| External authz | ext_authz filter calls OPA/custom |
| Interceptor | App-level auth in gRPC server |
5. Implementing Logging Middleware
| Approach | Detail |
|---|---|
| Envoy access log | JSON/text format with gRPC status |
| go-grpc-middleware logging | Interceptor with field extraction |
6. Implementing Caching Middleware
| Approach | Detail |
|---|---|
| Read-through cache | Per-method cache key from request hash |
| Cache TTL via metadata | Honor cache-control from response |
| Avoid for streams | Cache only safe, idempotent unary calls |
7. Implementing Compression Middleware
| Layer | Detail |
|---|---|
| Built-in | Per-call grpc.UseCompressor(gzip.Name) |
| Envoy | Disabled by default for gRPC (already compressed) |
8. Chaining Middleware
Example: Chain with go-grpc-middleware
import gmw "github.com/grpc-ecosystem/go-grpc-middleware/v2"
srv := grpc.NewServer(
grpc.ChainUnaryInterceptor(
recovery.UnaryServerInterceptor(),
logging.UnaryServerInterceptor(logger),
auth.UnaryServerInterceptor(authFn),
validate.UnaryServerInterceptor(),
),
)9. Setting Middleware Order
| Order (typical) | Reason |
|---|---|
| 1. Recovery | Outermost to catch panics in others |
| 2. Tracing / metrics | Measure full handling time |
| 3. Logging | Capture all attempts |
| 4. Auth | Reject early |
| 5. Rate limit | After auth (per-principal) |
| 6. Validation | Just before business logic |
10. Implementing Custom Middleware
| Tip | Detail |
|---|---|
| Stateless | Pass deps via closure, not globals |
| Both interceptors | Provide unary + stream variants |
| Stream wrapping | Wrap grpc.ServerStream to intercept Recv/Send |