I’ve been running a small K3S setup to toy with various things, and recently I’d added a deny-all NetworkPolicy to prevent different namespaces from talking to each other:

1
2
3
4
5
6

spec: 
  podSelector:
     matchLabels: {}
  ingress:
  - from:
    - podSelector: {}

It’s one of those example policies and it does exactly what it says: allows all pods to talk to all pods, thus isolating them from other namespaces.

JSON Web Tokens is a popular web standard for representing claims securely between two parties. In a nutshell, a JSON Web Token is several chunks of Base64-encoded JSON concatenated together, specifying who issued it and for whom, what’s the audience of the token, for how long it’s valid, and what the holder may do.

Web tokens are immensely useful when you want to talk to some API on behalf of your user, but also when your user wants to talk to your own set of APIs. JWTs are not to be confused with OAuth—the former is just a piece of JSON, the latter is a protocol (that might use JWT under the hood).

Envoy is an extremely flexible reverse proxy, most known by its use in istio where it functions as an envelope in every job, routing the traffic and managing authorization.

That said, it’s totally fine to use envoy on its own; one case for such would be gRPC-Web. Despite gRPC being based on HTTP/2, the web browsers don’t expose enough of the HTTP insides to the JS runtime for the client code to talk gRPC directly, and thus there’s a need in proxying a web-safe gRPC-Web into the “native” gRPC. This is where envoy comes in.