RBAC

This documentation is for the Envoy v3 API.

As of Envoy v1.18 the v2 API has been removed and is no longer supported.

If you are upgrading from v2 API config you may wish to view the v2 API documentation:

config/filter/network/rbac/v2/rbac.proto

This extension may be referenced by the qualified name envoy.filters.network.rbac

Note

This extension is intended to be robust against untrusted downstream traffic. It assumes that the upstream is trusted.

Tip

This extension extends and can be used with the following extension category:

Role-Based Access Control configuration overview.

extensions.filters.network.rbac.v3.RBAC

[extensions.filters.network.rbac.v3.RBAC proto]

RBAC network filter config.

Header should not be used in rules/shadow_rules in RBAC network filter as this information is only available in RBAC http filter.

  1. {
  2.   "rules": "{...}",
  3.   "shadow_rules": "{...}",
  4.   "shadow_rules_stat_prefix": "...",
  5.   "stat_prefix": "...",
  6.   "enforcement_type": "..."
  7. }

rules

(config.rbac.v3.RBAC) Specify the RBAC rules to be applied globally. If absent, no enforcing RBAC policy will be applied. If present and empty, DENY.

shadow_rules

(config.rbac.v3.RBAC) Shadow rules are not enforced by the filter but will emit stats and logs and can be used for rule testing. If absent, no shadow RBAC policy will be applied.

shadow_rules_stat_prefix

(string) If specified, shadow rules will emit stats with the given prefix. This is useful to distinguish the stat when there are more than 1 RBAC filter configured with shadow rules.

stat_prefix

(string, REQUIRED) The prefix to use when emitting statistics.

enforcement_type

(extensions.filters.network.rbac.v3.RBAC.EnforcementType) RBAC enforcement strategy. By default RBAC will be enforced only once when the first byte of data arrives from the downstream. When used in conjunction with filters that emit dynamic metadata after decoding every payload (e.g., Mongo, MySQL, Kafka) set the enforcement type to CONTINUOUS to enforce RBAC policies on every message boundary.

Enum extensions.filters.network.rbac.v3.RBAC.EnforcementType

[extensions.filters.network.rbac.v3.RBAC.EnforcementType proto]

ONE_TIME_ON_FIRST_BYTE

(DEFAULT) ⁣Apply RBAC policies when the first byte of data arrives on the connection.

CONTINUOUS

⁣Continuously apply RBAC policies as data arrives. Use this mode when using RBAC with message oriented protocols such as Mongo, MySQL, Kafka, etc. when the protocol decoders emit dynamic metadata such as the resources being accessed and the operations on the resources.