Apollo Federation (Apollo Router Core)
repository·dev·Indexed 21 days ago
https://github.com/apollographql/routerAn internal Rust-based component of the Apollo Router designed to run Apollo Federation 2 supergraphs. It includes the JSONSelection syntax, a declarative string literal system used with the @connect directive to transform JSON data into GraphQL-shaped JSON without procedural resolver code.
What's inside apollo-federation
- Apollo Router Core is a high-performance, configurable graph router written in Rust. It is designed to run Apollo Federation 2 supergraphs. It is intended for production-scale workloads and serves as a high-performance alternative to Apollo Gateway, featuring regular benchmarking and extensive testing.
Overview of Supergraph Security with GraphOS Router
devThe GraphOS Router acts as the public entry point for a federated GraphQL API and is responsible for protecting downstream subgraphs from malicious clients. It implements a defense-in-depth security model by applying authentication and authorization measures at multiple layers: the client, the router, and the subgraphs.
Key security capabilities include:
- Authorization: Controlling access to specific GraphQL fields and types via schema annotations.
- Persisted Queries: Restricting execution to a validated safelist of registered operations.
- CORS: Managing access from browser-based clients.
- CSRF Prevention: Protecting against cross-site request forgery.
- Request Limits: Mitigating attacks by enforcing limits on network, parser, and operation-based requests.
- Demand Control: Protecting the graph from high-cost GraphQL operations.
- JWT Authentication: Restricting access using JSON Web Tokens.
- Authentication Strategies: Implementing both Router-level and Subgraph-level authentication (including AWS SigV4).
Overview of GraphOS Observability
devApollo GraphOS serves as a central hub for monitoring the health and performance of your deployed supergraph. It collects operation and field usage metrics from clients, routers, and subgraphs.
Key capabilities include:
- Metric Collection: Automatically collects operation and field usage metrics. By default, the GraphOS Router reports these metrics to GraphOS Studio.
- Insights: Uses the GraphOS Studio Insights suite to visualize and analyze supergraph usage and performance.
- External Exporting: Supports forwarding metrics to external APM (Application Performance Monitoring) tools. This includes a dedicated Datadog integration for forwarding performance metrics from GraphOS to your Datadog account.
- Router Telemetry: Allows for deeper observability by collecting telemetry (logs, metrics, and traces) at various stages of the router request lifecycle.
Overview of GraphQL Subscription Support
devGraphQL subscriptions allow clients to receive real-time data updates (e.g., notifications, chat, stock tickers) without constant polling.
Key Connectivity Model:
- Client to Router: The Apollo Router does not support direct WebSocket connections from clients. Instead, client subscriptions are handled over HTTP using the multipart protocol.
- Router to Subgraphs: The router can use WebSocket internally to communicate with subgraphs that support subscription protocols.
Requirements:
- Minimum Router Version: v1.22.0
- Plan Requirements: Available on all self-hosted plans (Free, Developer, Standard, Enterprise). Note that Developer and Standard plans require Apollo Router v2.6.0 or later.
subscription OnStockPricesChanged { stockPricesChanged { symbol price } }What's new in GraphOS Router v2.x
devGraphOS Router v2.x is the latest Apollo runtime platform, featuring a new Native Query Planner written in Rust for improved CPU and memory efficiency. Key enhancements include:
- Apollo Connectors for REST: A declarative way to integrate REST services into supergraphs by defining integrations in the GraphQL schema.
- Back-pressure Management: Provides predictable resource utilization (CPU/Memory), which is particularly useful for triggering Horizontal Pod Autoscaling (HPA) in Kubernetes.
- Improved Observability: Uses OpenTelemetry by default for Apollo operation usage reporting and follows OpenTelemetry naming conventions for metrics.
- Enhanced Security: Updated core Rust dependencies including
axum,http,hyper,opentelemetry, andredis.
Usage of the apollo-federation crate
devTheapollo-federationcrate is an internal component of the Apollo Router. It is not intended to be used directly by end-users or external developers.Use the `connect-migrate` tool for schema migrations
devThe
connect-migratetool is a developer-facing CLI used to migrate Apollo Connectors schemas across differentconnect/v0.Xspec versions (e.g., moving from v0.3 to v0.4).Key capabilities include:
- Analysis: Walking a project tree to find
@connect(selection: ...)directives and dual-parsing them under different spec versions. - Output: Emitting
recommendations.mdor JSONL data (via the--format=jsonflag) following the v1 format spec. - Agent Guidance: Providing a developer-facing migration guide via the
agent-guidecommand.
- Analysis: Walking a project tree to find
GraphOS Router licensed features
devThe following features are available in the Apollo Router but require a licensed GraphOS plan and integration with Apollo GraphOS:
- Operations: Real-time updates via GraphQL subscriptions.
- Performance: Query batching and Redis-backed response caching (preview).
- Security:
- Authentication of inbound requests via JSON Web Token (JWT).
- Authorization of specific fields and types using
@requiresScopes,@authenticated, and@policydirectives. - Mitigation of malicious requests via request limits, demand control, and safelisting.
- Caching: Redis-backed distributed caching of query plans and automatic persisted queries (APQ).
- Customization: External coprocessing for custom request handling in any language.
- Telemetry: Custom instrumentation and telemetry, including custom attributes for spans.
- Offline Usage: An offline license that allows running the router with GraphOS features while disconnected from the internet.
Explore Apollo Router examples and customization patterns
devThe
examples/directory provides various ways to use and extend the Apollo Router. Examples are categorized by how they implement functionality:- Config-only: Examples that only require YAML configuration changes (e.g.,
telemetry). - Rhai Scripts: Examples using the Rhai scripting language for lightweight customization (e.g.,
logging,cookies-to-headers). - Native Rust Plugins: Examples for high-performance or complex extensions written in Rust (e.g.,
async-auth,jwt-auth). - Embedded: Advanced usage for embedding the router into a different web server.
- Config-only: Examples that only require YAML configuration changes (e.g.,
API Gateway support for HTTP multipart subscriptions
devWhen using an API gateway in front of the GraphOS Router, the gateway must support streaming multipart responses rather than buffering them. Support varies by vendor:
- AWS API Gateway: Supported via REST API response streaming configuration.
- Azure API Management (APIM): Supported by setting
buffer-response="false"in theforward-requestpolicy. - Google Apigee: Supported by setting
response.streaming.enabledtotrueinProxyEndpointandTargetEndpoint. - Kong: Supported out of the box with no additional configuration.
- Mulesoft Flex Gateway: Supported out of the box with no additional configuration.
- Mulesoft Proxy (Mule 4, CloudHub 2.0): Not supported. Use Flex Gateway instead.
Configure tracing exporters in Apollo Router
devApollo Router can collect and export tracing information to various backends. The router generates spans that capture request phases, sub-request response times, query shapes, and router post-processing.
Supported exporters include:
- OpenTelemetry Protocol (OTLP) over HTTP or gRPC
- Datadog (configured via OTLP)
- Dynatrace (configured via OTLP)
- Jaeger (configured via OTLP)
- New Relic (configured via OTLP)
- Zipkin
To maximize the effectiveness of distributed tracing, ensure all components in your system are instrumented.
What is Apollo Uplink?
devWhen using managed federation, your router (either GraphOS Router or
@apollo/gateway) regularly polls an endpoint called Apollo Uplink to fetch its latest supergraph schema and other configuration settings. If you are using Enterprise features, Uplink also serves your router's license.To ensure high availability, Uplink is hosted at two endpoints:
- GCP:
https://uplink.api.apollographql.com/ - AWS:
https://aws.uplink.api.apollographql.com/
- GCP: