Postgres Inspector (proto)

This extension has the qualified name envoy.filters.listener.postgres_inspector

Note

This extension is only available in contrib images.

Note

This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension is intended to be robust against untrusted downstream traffic. It assumes that the upstream is trusted.

Tip

This extension extends and can be used with the following extension category:

envoy.filters.listener

Warning

This API feature is currently work-in-progress. API features marked as work-in-progress are not considered stable, are not covered by the threat model, are not supported by the security team, and are subject to breaking changes. Do not use this feature without understanding each of the previous points.

Postgres Inspector configuration overview.

extensions.filters.listener.postgres_inspector.v3alpha.PostgresInspector

[extensions.filters.listener.postgres_inspector.v3alpha.PostgresInspector proto]

{
  "enable_metadata_extraction": {...},
  "max_startup_message_size": {...},
  "startup_timeout": {...}
}

enable_metadata_extraction

(BoolValue) Enable extraction of connection metadata (user, database, application name) from the startup message. This metadata is made available for access logging and stats.

Defaults to true.

max_startup_message_size

(UInt32Value) The maximum size of the startup message that the postgres inspector will accept. Messages larger than this will be rejected. If not specified, defaults to 10KB.

PostgreSQL defines MAX_STARTUP_PACKET_LENGTH as 10KB. Valid range is 256 bytes to 10KB.

startup_timeout

(Duration) Timeout for the inspector to receive and process the startup message. The timeout starts when the connection is accepted by the listener. If the timeout is reached before the startup message is fully received and processed, the connection will be closed.

If not specified, defaults to 10 seconds. Minimum is 1 second.

extensions.filters.listener.postgres_inspector.v3alpha.StartupMetadata

[extensions.filters.listener.postgres_inspector.v3alpha.StartupMetadata proto]

StartupMetadata stores connection attributes extracted from the PostgreSQL startup message. This is attached as typed dynamic metadata under the key envoy.postgres_inspector.

{
  "user": ...,
  "database": ...,
  "application_name": ...
}

user: (string) The username supplied in the startup message.

database: (string) The database name supplied in the startup message. If not provided, it may default to the user name.

application_name: (string) The application name supplied in the startup message.