RBAC

This extension may be referenced by the qualified name envoy.filters.http.rbac

Note

This extension is intended to be robust against untrusted downstream traffic. It assumes that the upstream is trusted.

Tip

This extension extends and can be used with the following extension categories:

Role-Based Access Control configuration overview.

extensions.filters.http.rbac.v3.RBAC

[extensions.filters.http.rbac.v3.RBAC proto]

RBAC filter config.

{
  "rules": "{...}",
  "shadow_rules": "{...}"
}
rules

(config.rbac.v3.RBAC) Specify the RBAC rules to be applied globally. If absent, no enforcing RBAC policy will be applied.

shadow_rules

(config.rbac.v3.RBAC) Shadow rules are not enforced by the filter (i.e., returning a 403) but will emit stats and logs and can be used for rule testing. If absent, no shadow RBAC policy will be applied.

extensions.filters.http.rbac.v3.RBACPerRoute

[extensions.filters.http.rbac.v3.RBACPerRoute proto]

{
  "rbac": "{...}"
}
rbac

(extensions.filters.http.rbac.v3.RBAC) Override the global configuration of the filter with this new config. If absent, the global RBAC policy will be disabled for this route.