Filter example that uses third-party libraries

[hzariv]

Is there a recommend approach for developing a filter that uses third-party C++ libraries?
This document describes how to add external libraries to envoy but how can a filter developer add external third-party opensource C or C++ libraries for filter usage?

https://github.com/lyft/envoy/blob/master/bazel/EXTERNAL_DEPS.md

[mattklein123]

We probably need to somehow allow all of the locations in https://github.com/lyft/envoy/blob/master/bazel/EXTERNAL_DEPS.md to be extended by the consuming project somehow. @htuch ?

[htuch]

Yeah, but TBH the original recursive make solution is a complete hack and I don't think we want to build castles on it. My best advice on this is to either:

1. Integrate the filter into Envoy and add the dependency there.
2. Add the 3rd party library as a Bazel dependency in the consuming project (and do the work to Bazelify the project if necessary). This may or may not be reasonable, depending on how complicated the build system of the dependency is.
3. Add a repository_rule to the consuming project for the sole purpose of building the dependency. This respository_rule can use https://github.com/lyft/envoy/blob/master/bazel/repositories.bzl#L138 for inspiration.

[hzariv]

I am trying to develop a filter to validate JWT token. There are C++ open source libraries for JWT token (here is one example https://github.com/pokowaka/jwt-cpp). This library also has external dependency on https://github.com/akheron/jansson. @htuch which approach above would you recommend for this type of filter?

[lizan]

@hzariv FYI, We're actively developing a JWT token filter in https://github.com/istio/proxy/tree/master/src/envoy/auth

[htuch]

jwt-cpp seems simple enough for (2). Its dependency on Jansson will make the BUILD file writing probably a bit involved, since that is a bit larger and also uses autoconf.

BTW, are you aware that Datawire are working on an external auth filter that would probably be capable of doing this by calling out to a separate process/server? @ark3

[htuch]

Looks like someone has figured out the Jansson BUILD bit: https://github.com/twitter/heron/tree/master/third_party/jansson. A bit of a megahack with genrule, but when in Bazel...

[hzariv]

@lizan Yes I saw that but are you going to implement JWT token validation and authorization claims from scratch yourself or use some third party library. In the second case, wouldn't you face the same issue?

[hzariv]

@htuch yes I have looked at https://github.com/datawire/ambassador-envoy the external service call is a performance bottleneck.

[lizan]

@hzariv Yes, I was just curious if we can converge the efforts implementing JWT filters. I'm open to contribute the JWT filter (though it is still WIP). we evaluated those deps and decided to implementing from scratch because it is simple and we already have similar code. Also I didn't want to introduce 2 different libraries to deal with JSON (RapidJSON / jansson)

re: third-party deps in general, I think @htuch covered options. One least favorable option is install to system (i.e. /usr/local) and along with copts and linkopts. In istio/proxy we are mostly doing (2).

[hzariv]

@htuch / @lizan could you point me to some option (2) examples?
(sorry I come from Java world where build systems are simple :))

[lizan]

@hzariv https://github.com/istio/proxy/blob/master/repositories.bzl#L75 this is the sample to bazelify googletest, this is already in envoy as (3), but we excluded that in istio/proxy.

[mattklein123]

Closing this out as answered.