## Context Per [ADR-014 — Interim embedded GLAZ for Artifact Registry](https://gitlab.com/gitlab-org/architecture/auth-architecture/design-doc/-/blob/main/proposals/014-embedded-glaz-ar-interim-design.md), AR (the host) assembles the GLAZ input, including the **supplied assignment tuples**. Those tuples come from `iam-data-access` via the Relationships API Lookup RPC (`ReadRelationships`). Per [ADR-024 — AR Infrastructure for GitLab.com Beta Delivery](https://handbook.gitlab.com/handbook/engineering/architecture/design-documents/artifact_registry/decisions/024_infrastructure_delivery/#architecture), east-west traffic between AR and `iam-data-access` (both deployed to Runway/GKE in `us-east1`) goes through a **Headless Service** in Phase 1, with PSC as the eventual Phase 2 target. Today AR has only auth/authz stub scaffolding in `internal/auth/` and `internal/authz/` (commit `2d81fb5` explicitly labels them stubs). **No gRPC client to `iam-data-access` exists in the AR codebase yet**, so GLAZ has no way to obtain the relationship tuples it needs to evaluate authorization decisions. ## What Implement an AR-side gRPC client to `iam-data-access`'s Lookup service. The client is the data-plane edge from AR into the IAM data layer; every authorization decision in Phase 1 will go through it. ### Required client configuration | Concern | Value | Notes | |---|---|---| | Target | `dns:///iam-data-gke-grpc.<namespace>.svc.cluster.local:5005` | Headless Service per ADR-024; DNS resolves to individual pod IPs | | Service config | `{"loadBalancingConfig": [{"round_robin": {}}]}` | `pick_first` would pin every RPC to one IAM pod, defeating horizontal scaling | | Auth credential | `authorization: Bearer <service-token>` in gRPC metadata | Per-RPC PerRPCCredentials, not channel-level | | Token source | Vault-distributed shared secret, mounted at deploy time | Mechanism TBD with #602281 (manual Vault copy as stopgap; Vault Agent sidecar / native Runway secrets as target) | | Audience | `gitlab-iam-data-access` | Per #602281 — IAM rejects tokens with other audiences | | Health check | gRPC health protocol (`grpc.health.v1.Health/Check`) | Server side recently landed in `iam-data-access` | | Keepalive | `Time: 30s, Timeout: 10s, PermitWithoutStream: true` | Sized for long-lived east-west connections; align with iam-data-access server keepalive policy | | Retries | Built-in gRPC retry policy for transient `UNAVAILABLE` / `DEADLINE_EXCEEDED` | Bounded attempts, exponential backoff | | Telemetry | Per-RPC latency, error counter, LB endpoint distribution | Existing AR observability conventions | ### Where the client lives - Belongs alongside the existing auth/authz seam in `internal/` — likely a new `internal/iam/` (or similar) package holding the client and a thin domain interface so callers don't import gRPC types directly. - The relationship-tuple fetch is invoked from the host-side GLAZ input assembly (per ADR-014), not from inside the GLAZ sidecar. ### Out of scope - Service-token issuance & distribution mechanism (tracked under #602281). - `iam-data-access` server-side endpoints (already implemented in `gitlab-org/auth/iam`). - PSC migration (Phase 2 per ADR-024 — Headless Service is the interim). - Rails-side write path (tracked under #602144). ## Acceptance criteria - [x] Client uses `dns:///` resolver + `round_robin` LB policy. - [x] `authorization: Bearer <token>` metadata attached to every outbound RPC. - [x] Token sourced from a Runway-mounted Vault secret (path TBD with #602281). - [ ] gRPC health checking enabled against `grpc.health.v1.Health/Check`. - [ ] Retry/backoff policy in place for transient failures. - [x] Latency + error metrics emitted; LB endpoint distribution observable. - [x] Integration test exercises a real `iam-data-access` instance (Caproni rig or equivalent — see #602998 / caproni-demo). - [ ] Domain-level interface in place so callers (GLAZ input assembly) don't depend on gRPC types directly. ## References - [ADR-014 — Embedded GLAZ for AR (interim)](https://gitlab.com/gitlab-org/architecture/auth-architecture/design-doc/-/blob/main/proposals/014-embedded-glaz-ar-interim-design.md) — host assembles input including relationship tuples - [ADR-024 — AR Infrastructure Delivery](https://handbook.gitlab.com/handbook/engineering/architecture/design-documents/artifact_registry/decisions/024_infrastructure_delivery/) — Headless Service for east-west traffic - gitlab-org/gitlab#599077 — Deploy iam-data-access to GKE via Runway (parent infra issue) - gitlab-org/gitlab#602281 — Service-to-service auth design (audience + service token) - gitlab-org/gitlab#602144 — Rails GraphQL wrapper for the IAM Relationships API (write-side counterpart) - [iam!202 — Relationships API proto](https://gitlab.com/gitlab-org/auth/iam/-/merge_requests/202) - [`lookup.proto`](https://gitlab.com/gitlab-org/auth/iam/-/blob/main/proto/lookup/lookup.proto) — Lookup service definition - gitlab-com/gl-infra/platform/runway/fairway#11 — Headless Service generation in Fairway (closed; landed) Part of &22004. 🤖 _Drafted by Claude Code._