Boundary Lab
Go · Protobuf · Envoy · GKELive architecture demonstration
Public and private,
enforced.
One protobuf contract, two entrances. Make real requests and see where each boundary holds—with backend execution counts to prove it.
Synthetic tenants and data. Running on Google Cloud behind Cloudflare.
The key stays in this tab. Requests require a valid fixture credential.
The paths under test
Browser→Cloudflare + origin mTLS→Frontend LB / BFF→Private Envoy→Go gRPC
API client→Separate API LB→Public Envoy→Go gRPC / HTTP receiver
The authenticated demo harness sends API checks through the real external load balancer. Private checks use the BFF path. Counter inspection is fixture-only instrumentation.
PUBLICGetWidget
option (boundary.policy.exposure) = {
visibility: PUBLIC
required_scope: "widgets:read"
};PRIVATEGetDiagnostics
option (boundary.policy.exposure) = {
visibility: PRIVATE
required_scope: "diagnostics:read"
};