Documentation
¶
Index ¶
- Variables
- type Action
- func (*Action) Descriptor() ([]byte, []int)deprecated
- func (x *Action) GetAction() RBAC_Action
- func (x *Action) GetName() string
- func (*Action) ProtoMessage()
- func (x *Action) ProtoReflect() protoreflect.Message
- func (x *Action) Reset()
- func (x *Action) String() string
- func (m *Action) Validate() error
- func (m *Action) ValidateAll() error
- type ActionMultiError
- type ActionValidationError
- type Permission
- func (*Permission) Descriptor() ([]byte, []int)deprecated
- func (x *Permission) GetAndRules() *Permission_Set
- func (x *Permission) GetAny() bool
- func (x *Permission) GetDestinationIp() *v32.CidrRange
- func (x *Permission) GetDestinationPort() uint32
- func (x *Permission) GetDestinationPortRange() *v33.Int32Range
- func (x *Permission) GetHeader() *v3.HeaderMatcher
- func (x *Permission) GetMatcher() *v32.TypedExtensionConfig
- func (x *Permission) GetMetadata() *v31.MetadataMatcher
- func (x *Permission) GetNotRule() *Permission
- func (x *Permission) GetOrRules() *Permission_Set
- func (x *Permission) GetRequestedServerName() *v31.StringMatcher
- func (m *Permission) GetRule() isPermission_Rule
- func (x *Permission) GetUrlPath() *v31.PathMatcher
- func (*Permission) ProtoMessage()
- func (x *Permission) ProtoReflect() protoreflect.Message
- func (x *Permission) Reset()
- func (x *Permission) String() string
- func (m *Permission) Validate() error
- func (m *Permission) ValidateAll() error
- type PermissionMultiError
- type PermissionValidationError
- type Permission_AndRules
- type Permission_Any
- type Permission_DestinationIp
- type Permission_DestinationPort
- type Permission_DestinationPortRange
- type Permission_Header
- type Permission_Matcher
- type Permission_Metadata
- type Permission_NotRule
- type Permission_OrRules
- type Permission_RequestedServerName
- type Permission_Set
- func (*Permission_Set) Descriptor() ([]byte, []int)deprecated
- func (x *Permission_Set) GetRules() []*Permission
- func (*Permission_Set) ProtoMessage()
- func (x *Permission_Set) ProtoReflect() protoreflect.Message
- func (x *Permission_Set) Reset()
- func (x *Permission_Set) String() string
- func (m *Permission_Set) Validate() error
- func (m *Permission_Set) ValidateAll() error
- type Permission_SetMultiError
- type Permission_SetValidationError
- func (e Permission_SetValidationError) Cause() error
- func (e Permission_SetValidationError) Error() string
- func (e Permission_SetValidationError) ErrorName() string
- func (e Permission_SetValidationError) Field() string
- func (e Permission_SetValidationError) Key() bool
- func (e Permission_SetValidationError) Reason() string
- type Permission_UrlPath
- type Policy
- func (*Policy) Descriptor() ([]byte, []int)deprecated
- func (x *Policy) GetCheckedCondition() *v1alpha1.CheckedExpr
- func (x *Policy) GetCondition() *v1alpha1.Expr
- func (x *Policy) GetPermissions() []*Permission
- func (x *Policy) GetPrincipals() []*Principal
- func (*Policy) ProtoMessage()
- func (x *Policy) ProtoReflect() protoreflect.Message
- func (x *Policy) Reset()
- func (x *Policy) String() string
- func (m *Policy) Validate() error
- func (m *Policy) ValidateAll() error
- type PolicyMultiError
- type PolicyValidationError
- type Principal
- func (*Principal) Descriptor() ([]byte, []int)deprecated
- func (x *Principal) GetAndIds() *Principal_Set
- func (x *Principal) GetAny() bool
- func (x *Principal) GetAuthenticated() *Principal_Authenticated
- func (x *Principal) GetDirectRemoteIp() *v32.CidrRange
- func (x *Principal) GetHeader() *v3.HeaderMatcher
- func (m *Principal) GetIdentifier() isPrincipal_Identifier
- func (x *Principal) GetMetadata() *v31.MetadataMatcher
- func (x *Principal) GetNotId() *Principal
- func (x *Principal) GetOrIds() *Principal_Set
- func (x *Principal) GetRemoteIp() *v32.CidrRange
- func (x *Principal) GetSourceIp() *v32.CidrRangedeprecated
- func (x *Principal) GetUrlPath() *v31.PathMatcher
- func (*Principal) ProtoMessage()
- func (x *Principal) ProtoReflect() protoreflect.Message
- func (x *Principal) Reset()
- func (x *Principal) String() string
- func (m *Principal) Validate() error
- func (m *Principal) ValidateAll() error
- type PrincipalMultiError
- type PrincipalValidationError
- type Principal_AndIds
- type Principal_Any
- type Principal_Authenticated
- func (*Principal_Authenticated) Descriptor() ([]byte, []int)deprecated
- func (x *Principal_Authenticated) GetPrincipalName() *v31.StringMatcher
- func (*Principal_Authenticated) ProtoMessage()
- func (x *Principal_Authenticated) ProtoReflect() protoreflect.Message
- func (x *Principal_Authenticated) Reset()
- func (x *Principal_Authenticated) String() string
- func (m *Principal_Authenticated) Validate() error
- func (m *Principal_Authenticated) ValidateAll() error
- type Principal_AuthenticatedMultiError
- type Principal_AuthenticatedValidationError
- func (e Principal_AuthenticatedValidationError) Cause() error
- func (e Principal_AuthenticatedValidationError) Error() string
- func (e Principal_AuthenticatedValidationError) ErrorName() string
- func (e Principal_AuthenticatedValidationError) Field() string
- func (e Principal_AuthenticatedValidationError) Key() bool
- func (e Principal_AuthenticatedValidationError) Reason() string
- type Principal_Authenticated_
- type Principal_DirectRemoteIp
- type Principal_Header
- type Principal_Metadata
- type Principal_NotId
- type Principal_OrIds
- type Principal_RemoteIp
- type Principal_Set
- func (*Principal_Set) Descriptor() ([]byte, []int)deprecated
- func (x *Principal_Set) GetIds() []*Principal
- func (*Principal_Set) ProtoMessage()
- func (x *Principal_Set) ProtoReflect() protoreflect.Message
- func (x *Principal_Set) Reset()
- func (x *Principal_Set) String() string
- func (m *Principal_Set) Validate() error
- func (m *Principal_Set) ValidateAll() error
- type Principal_SetMultiError
- type Principal_SetValidationError
- func (e Principal_SetValidationError) Cause() error
- func (e Principal_SetValidationError) Error() string
- func (e Principal_SetValidationError) ErrorName() string
- func (e Principal_SetValidationError) Field() string
- func (e Principal_SetValidationError) Key() bool
- func (e Principal_SetValidationError) Reason() string
- type Principal_SourceIp
- type Principal_UrlPath
- type RBAC
- func (*RBAC) Descriptor() ([]byte, []int)deprecated
- func (x *RBAC) GetAction() RBAC_Action
- func (x *RBAC) GetPolicies() map[string]*Policy
- func (*RBAC) ProtoMessage()
- func (x *RBAC) ProtoReflect() protoreflect.Message
- func (x *RBAC) Reset()
- func (x *RBAC) String() string
- func (m *RBAC) Validate() error
- func (m *RBAC) ValidateAll() error
- type RBACMultiError
- type RBACValidationError
- type RBAC_Action
- func (RBAC_Action) Descriptor() protoreflect.EnumDescriptor
- func (x RBAC_Action) Enum() *RBAC_Action
- func (RBAC_Action) EnumDescriptor() ([]byte, []int)deprecated
- func (x RBAC_Action) Number() protoreflect.EnumNumber
- func (x RBAC_Action) String() string
- func (RBAC_Action) Type() protoreflect.EnumType
Constants ¶
This section is empty.
Variables ¶
var ( RBAC_Action_name = map[int32]string{ 0: "ALLOW", 1: "DENY", 2: "LOG", } RBAC_Action_value = map[string]int32{ "ALLOW": 0, "DENY": 1, "LOG": 2, } )
Enum value maps for RBAC_Action.
var File_envoy_config_rbac_v3_rbac_proto protoreflect.FileDescriptor
Functions ¶
This section is empty.
Types ¶
type Action ¶ added in v0.10.2
type Action struct { // The name indicates the policy name. Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` // The action to take if the matcher matches. Every action either allows or denies a request, // and can also carry out action-specific operations. // // Actions: // // * ALLOW: If the request gets matched on ALLOW, it is permitted. // * DENY: If the request gets matched on DENY, it is not permitted. // * LOG: If the request gets matched on LOG, it is permitted. Besides, the // dynamic metadata key `access_log_hint` under the shared key namespace // 'envoy.common' will be set to the value `true`. // * If the request cannot get matched, it will fallback to DENY. // // Log behavior: // // If the RBAC matcher contains at least one LOG action, the dynamic // metadata key `access_log_hint` will be set based on if the request // get matched on the LOG action. // Action RBAC_Action `protobuf:"varint,2,opt,name=action,proto3,enum=envoy.config.rbac.v3.RBAC_Action" json:"action,omitempty"` // contains filtered or unexported fields }
Action defines the result of allowance or denial when a request matches the matcher.
func (*Action) Descriptor
deprecated
added in
v0.10.2
func (*Action) GetAction ¶ added in v0.10.2
func (x *Action) GetAction() RBAC_Action
func (*Action) ProtoMessage ¶ added in v0.10.2
func (*Action) ProtoMessage()
func (*Action) ProtoReflect ¶ added in v0.10.2
func (x *Action) ProtoReflect() protoreflect.Message
func (*Action) Validate ¶ added in v0.10.2
Validate checks the field values on Action with the rules defined in the proto definition for this message. If any rules are violated, the first error encountered is returned, or nil if there are no violations.
func (*Action) ValidateAll ¶ added in v0.10.2
ValidateAll checks the field values on Action with the rules defined in the proto definition for this message. If any rules are violated, the result is a list of violation errors wrapped in ActionMultiError, or nil if none found.
type ActionMultiError ¶ added in v0.10.2
type ActionMultiError []error
ActionMultiError is an error wrapping multiple validation errors returned by Action.ValidateAll() if the designated constraints aren't met.
func (ActionMultiError) AllErrors ¶ added in v0.10.2
func (m ActionMultiError) AllErrors() []error
AllErrors returns a list of validation violation errors.
func (ActionMultiError) Error ¶ added in v0.10.2
func (m ActionMultiError) Error() string
Error returns a concatenation of all the error messages it wraps.
type ActionValidationError ¶ added in v0.10.2
type ActionValidationError struct {
// contains filtered or unexported fields
}
ActionValidationError is the validation error returned by Action.Validate if the designated constraints aren't met.
func (ActionValidationError) Cause ¶ added in v0.10.2
func (e ActionValidationError) Cause() error
Cause function returns cause value.
func (ActionValidationError) Error ¶ added in v0.10.2
func (e ActionValidationError) Error() string
Error satisfies the builtin error interface
func (ActionValidationError) ErrorName ¶ added in v0.10.2
func (e ActionValidationError) ErrorName() string
ErrorName returns error name.
func (ActionValidationError) Field ¶ added in v0.10.2
func (e ActionValidationError) Field() string
Field function returns field value.
func (ActionValidationError) Key ¶ added in v0.10.2
func (e ActionValidationError) Key() bool
Key function returns key value.
func (ActionValidationError) Reason ¶ added in v0.10.2
func (e ActionValidationError) Reason() string
Reason function returns reason value.
type Permission ¶
type Permission struct { // Types that are assignable to Rule: // *Permission_AndRules // *Permission_OrRules // *Permission_Any // *Permission_Header // *Permission_UrlPath // *Permission_DestinationIp // *Permission_DestinationPort // *Permission_DestinationPortRange // *Permission_Metadata // *Permission_NotRule // *Permission_RequestedServerName // *Permission_Matcher Rule isPermission_Rule `protobuf_oneof:"rule"` // contains filtered or unexported fields }
Permission defines an action (or actions) that a principal can take. [#next-free-field: 13]
func (*Permission) Descriptor
deprecated
func (*Permission) Descriptor() ([]byte, []int)
Deprecated: Use Permission.ProtoReflect.Descriptor instead.
func (*Permission) GetAndRules ¶
func (x *Permission) GetAndRules() *Permission_Set
func (*Permission) GetAny ¶
func (x *Permission) GetAny() bool
func (*Permission) GetDestinationIp ¶
func (x *Permission) GetDestinationIp() *v32.CidrRange
func (*Permission) GetDestinationPort ¶
func (x *Permission) GetDestinationPort() uint32
func (*Permission) GetDestinationPortRange ¶ added in v0.10.0
func (x *Permission) GetDestinationPortRange() *v33.Int32Range
func (*Permission) GetHeader ¶
func (x *Permission) GetHeader() *v3.HeaderMatcher
func (*Permission) GetMatcher ¶ added in v0.10.0
func (x *Permission) GetMatcher() *v32.TypedExtensionConfig
func (*Permission) GetMetadata ¶
func (x *Permission) GetMetadata() *v31.MetadataMatcher
func (*Permission) GetNotRule ¶
func (x *Permission) GetNotRule() *Permission
func (*Permission) GetOrRules ¶
func (x *Permission) GetOrRules() *Permission_Set
func (*Permission) GetRequestedServerName ¶
func (x *Permission) GetRequestedServerName() *v31.StringMatcher
func (*Permission) GetRule ¶
func (m *Permission) GetRule() isPermission_Rule
func (*Permission) GetUrlPath ¶ added in v0.9.4
func (x *Permission) GetUrlPath() *v31.PathMatcher
func (*Permission) ProtoMessage ¶
func (*Permission) ProtoMessage()
func (*Permission) ProtoReflect ¶ added in v0.9.6
func (x *Permission) ProtoReflect() protoreflect.Message
func (*Permission) Reset ¶
func (x *Permission) Reset()
func (*Permission) String ¶
func (x *Permission) String() string
func (*Permission) Validate ¶
func (m *Permission) Validate() error
Validate checks the field values on Permission with the rules defined in the proto definition for this message. If any rules are violated, the first error encountered is returned, or nil if there are no violations.
func (*Permission) ValidateAll ¶ added in v0.10.0
func (m *Permission) ValidateAll() error
ValidateAll checks the field values on Permission with the rules defined in the proto definition for this message. If any rules are violated, the result is a list of violation errors wrapped in PermissionMultiError, or nil if none found.
type PermissionMultiError ¶ added in v0.10.0
type PermissionMultiError []error
PermissionMultiError is an error wrapping multiple validation errors returned by Permission.ValidateAll() if the designated constraints aren't met.
func (PermissionMultiError) AllErrors ¶ added in v0.10.0
func (m PermissionMultiError) AllErrors() []error
AllErrors returns a list of validation violation errors.
func (PermissionMultiError) Error ¶ added in v0.10.0
func (m PermissionMultiError) Error() string
Error returns a concatenation of all the error messages it wraps.
type PermissionValidationError ¶
type PermissionValidationError struct {
// contains filtered or unexported fields
}
PermissionValidationError is the validation error returned by Permission.Validate if the designated constraints aren't met.
func (PermissionValidationError) Cause ¶
func (e PermissionValidationError) Cause() error
Cause function returns cause value.
func (PermissionValidationError) Error ¶
func (e PermissionValidationError) Error() string
Error satisfies the builtin error interface
func (PermissionValidationError) ErrorName ¶
func (e PermissionValidationError) ErrorName() string
ErrorName returns error name.
func (PermissionValidationError) Field ¶
func (e PermissionValidationError) Field() string
Field function returns field value.
func (PermissionValidationError) Key ¶
func (e PermissionValidationError) Key() bool
Key function returns key value.
func (PermissionValidationError) Reason ¶
func (e PermissionValidationError) Reason() string
Reason function returns reason value.
type Permission_AndRules ¶
type Permission_AndRules struct { // A set of rules that all must match in order to define the action. AndRules *Permission_Set `protobuf:"bytes,1,opt,name=and_rules,json=andRules,proto3,oneof"` }
type Permission_Any ¶
type Permission_Any struct { // When any is set, it matches any action. Any bool `protobuf:"varint,3,opt,name=any,proto3,oneof"` }
type Permission_DestinationPort ¶
type Permission_DestinationPort struct { // A port number that describes the destination port connecting to. DestinationPort uint32 `protobuf:"varint,6,opt,name=destination_port,json=destinationPort,proto3,oneof"` }
type Permission_DestinationPortRange ¶ added in v0.10.0
type Permission_DestinationPortRange struct { // A port number range that describes a range of destination ports connecting to. DestinationPortRange *v33.Int32Range `protobuf:"bytes,11,opt,name=destination_port_range,json=destinationPortRange,proto3,oneof"` }
type Permission_Header ¶
type Permission_Header struct { // A header (or pseudo-header such as :path or :method) on the incoming HTTP request. Only // available for HTTP request. // Note: the pseudo-header :path includes the query and fragment string. Use the `url_path` // field if you want to match the URL path without the query and fragment string. Header *v3.HeaderMatcher `protobuf:"bytes,4,opt,name=header,proto3,oneof"` }
type Permission_Matcher ¶ added in v0.10.0
type Permission_Matcher struct { // Extension for configuring custom matchers for RBAC. // [#extension-category: envoy.rbac.matchers] Matcher *v32.TypedExtensionConfig `protobuf:"bytes,12,opt,name=matcher,proto3,oneof"` }
type Permission_Metadata ¶
type Permission_Metadata struct { // Metadata that describes additional information about the action. Metadata *v31.MetadataMatcher `protobuf:"bytes,7,opt,name=metadata,proto3,oneof"` }
type Permission_NotRule ¶
type Permission_NotRule struct { // Negates matching the provided permission. For instance, if the value of // `not_rule` would match, this permission would not match. Conversely, if // the value of `not_rule` would not match, this permission would match. NotRule *Permission `protobuf:"bytes,8,opt,name=not_rule,json=notRule,proto3,oneof"` }
type Permission_OrRules ¶
type Permission_OrRules struct { // A set of rules where at least one must match in order to define the action. OrRules *Permission_Set `protobuf:"bytes,2,opt,name=or_rules,json=orRules,proto3,oneof"` }
type Permission_RequestedServerName ¶
type Permission_RequestedServerName struct { // The request server from the client's connection request. This is // typically TLS SNI. // // .. attention:: // // The behavior of this field may be affected by how Envoy is configured // as explained below. // // * If the :ref:`TLS Inspector <config_listener_filters_tls_inspector>` // filter is not added, and if a `FilterChainMatch` is not defined for // the :ref:`server name // <envoy_v3_api_field_config.listener.v3.FilterChainMatch.server_names>`, // a TLS connection's requested SNI server name will be treated as if it // wasn't present. // // * A :ref:`listener filter <arch_overview_listener_filters>` may // overwrite a connection's requested server name within Envoy. // // Please refer to :ref:`this FAQ entry <faq_how_to_setup_sni>` to learn to // setup SNI. RequestedServerName *v31.StringMatcher `protobuf:"bytes,9,opt,name=requested_server_name,json=requestedServerName,proto3,oneof"` }
type Permission_Set ¶
type Permission_Set struct { Rules []*Permission `protobuf:"bytes,1,rep,name=rules,proto3" json:"rules,omitempty"` // contains filtered or unexported fields }
Used in the `and_rules` and `or_rules` fields in the `rule` oneof. Depending on the context, each are applied with the associated behavior.
func (*Permission_Set) Descriptor
deprecated
func (*Permission_Set) Descriptor() ([]byte, []int)
Deprecated: Use Permission_Set.ProtoReflect.Descriptor instead.
func (*Permission_Set) GetRules ¶
func (x *Permission_Set) GetRules() []*Permission
func (*Permission_Set) ProtoMessage ¶
func (*Permission_Set) ProtoMessage()
func (*Permission_Set) ProtoReflect ¶ added in v0.9.6
func (x *Permission_Set) ProtoReflect() protoreflect.Message
func (*Permission_Set) Reset ¶
func (x *Permission_Set) Reset()
func (*Permission_Set) String ¶
func (x *Permission_Set) String() string
func (*Permission_Set) Validate ¶
func (m *Permission_Set) Validate() error
Validate checks the field values on Permission_Set with the rules defined in the proto definition for this message. If any rules are violated, the first error encountered is returned, or nil if there are no violations.
func (*Permission_Set) ValidateAll ¶ added in v0.10.0
func (m *Permission_Set) ValidateAll() error
ValidateAll checks the field values on Permission_Set with the rules defined in the proto definition for this message. If any rules are violated, the result is a list of violation errors wrapped in Permission_SetMultiError, or nil if none found.
type Permission_SetMultiError ¶ added in v0.10.0
type Permission_SetMultiError []error
Permission_SetMultiError is an error wrapping multiple validation errors returned by Permission_Set.ValidateAll() if the designated constraints aren't met.
func (Permission_SetMultiError) AllErrors ¶ added in v0.10.0
func (m Permission_SetMultiError) AllErrors() []error
AllErrors returns a list of validation violation errors.
func (Permission_SetMultiError) Error ¶ added in v0.10.0
func (m Permission_SetMultiError) Error() string
Error returns a concatenation of all the error messages it wraps.
type Permission_SetValidationError ¶
type Permission_SetValidationError struct {
// contains filtered or unexported fields
}
Permission_SetValidationError is the validation error returned by Permission_Set.Validate if the designated constraints aren't met.
func (Permission_SetValidationError) Cause ¶
func (e Permission_SetValidationError) Cause() error
Cause function returns cause value.
func (Permission_SetValidationError) Error ¶
func (e Permission_SetValidationError) Error() string
Error satisfies the builtin error interface
func (Permission_SetValidationError) ErrorName ¶
func (e Permission_SetValidationError) ErrorName() string
ErrorName returns error name.
func (Permission_SetValidationError) Field ¶
func (e Permission_SetValidationError) Field() string
Field function returns field value.
func (Permission_SetValidationError) Key ¶
func (e Permission_SetValidationError) Key() bool
Key function returns key value.
func (Permission_SetValidationError) Reason ¶
func (e Permission_SetValidationError) Reason() string
Reason function returns reason value.
type Permission_UrlPath ¶ added in v0.9.4
type Permission_UrlPath struct { // A URL path on the incoming HTTP request. Only available for HTTP. UrlPath *v31.PathMatcher `protobuf:"bytes,10,opt,name=url_path,json=urlPath,proto3,oneof"` }
type Policy ¶
type Policy struct { // Required. The set of permissions that define a role. Each permission is // matched with OR semantics. To match all actions for this policy, a single // Permission with the `any` field set to true should be used. Permissions []*Permission `protobuf:"bytes,1,rep,name=permissions,proto3" json:"permissions,omitempty"` // Required. The set of principals that are assigned/denied the role based on // “action”. Each principal is matched with OR semantics. To match all // downstreams for this policy, a single Principal with the `any` field set to // true should be used. Principals []*Principal `protobuf:"bytes,2,rep,name=principals,proto3" json:"principals,omitempty"` // An optional symbolic expression specifying an access control // :ref:`condition <arch_overview_condition>`. The condition is combined // with the permissions and the principals as a clause with AND semantics. // Only be used when checked_condition is not used. Condition *v1alpha1.Expr `protobuf:"bytes,3,opt,name=condition,proto3" json:"condition,omitempty"` // [#not-implemented-hide:] // An optional symbolic expression that has been successfully type checked. // Only be used when condition is not used. CheckedCondition *v1alpha1.CheckedExpr `protobuf:"bytes,4,opt,name=checked_condition,json=checkedCondition,proto3" json:"checked_condition,omitempty"` // contains filtered or unexported fields }
Policy specifies a role and the principals that are assigned/denied the role. A policy matches if and only if at least one of its permissions match the action taking place AND at least one of its principals match the downstream AND the condition is true if specified.
func (*Policy) Descriptor
deprecated
func (*Policy) GetCheckedCondition ¶ added in v0.9.7
func (x *Policy) GetCheckedCondition() *v1alpha1.CheckedExpr
func (*Policy) GetCondition ¶
func (*Policy) GetPermissions ¶
func (x *Policy) GetPermissions() []*Permission
func (*Policy) GetPrincipals ¶
func (*Policy) ProtoMessage ¶
func (*Policy) ProtoMessage()
func (*Policy) ProtoReflect ¶ added in v0.9.6
func (x *Policy) ProtoReflect() protoreflect.Message
func (*Policy) Validate ¶
Validate checks the field values on Policy with the rules defined in the proto definition for this message. If any rules are violated, the first error encountered is returned, or nil if there are no violations.
func (*Policy) ValidateAll ¶ added in v0.10.0
ValidateAll checks the field values on Policy with the rules defined in the proto definition for this message. If any rules are violated, the result is a list of violation errors wrapped in PolicyMultiError, or nil if none found.
type PolicyMultiError ¶ added in v0.10.0
type PolicyMultiError []error
PolicyMultiError is an error wrapping multiple validation errors returned by Policy.ValidateAll() if the designated constraints aren't met.
func (PolicyMultiError) AllErrors ¶ added in v0.10.0
func (m PolicyMultiError) AllErrors() []error
AllErrors returns a list of validation violation errors.
func (PolicyMultiError) Error ¶ added in v0.10.0
func (m PolicyMultiError) Error() string
Error returns a concatenation of all the error messages it wraps.
type PolicyValidationError ¶
type PolicyValidationError struct {
// contains filtered or unexported fields
}
PolicyValidationError is the validation error returned by Policy.Validate if the designated constraints aren't met.
func (PolicyValidationError) Cause ¶
func (e PolicyValidationError) Cause() error
Cause function returns cause value.
func (PolicyValidationError) Error ¶
func (e PolicyValidationError) Error() string
Error satisfies the builtin error interface
func (PolicyValidationError) ErrorName ¶
func (e PolicyValidationError) ErrorName() string
ErrorName returns error name.
func (PolicyValidationError) Field ¶
func (e PolicyValidationError) Field() string
Field function returns field value.
func (PolicyValidationError) Key ¶
func (e PolicyValidationError) Key() bool
Key function returns key value.
func (PolicyValidationError) Reason ¶
func (e PolicyValidationError) Reason() string
Reason function returns reason value.
type Principal ¶
type Principal struct { // Types that are assignable to Identifier: // *Principal_AndIds // *Principal_OrIds // *Principal_Any // *Principal_Authenticated_ // *Principal_SourceIp // *Principal_DirectRemoteIp // *Principal_RemoteIp // *Principal_Header // *Principal_UrlPath // *Principal_Metadata // *Principal_NotId Identifier isPrincipal_Identifier `protobuf_oneof:"identifier"` // contains filtered or unexported fields }
Principal defines an identity or a group of identities for a downstream subject. [#next-free-field: 12]
func (*Principal) Descriptor
deprecated
func (*Principal) GetAndIds ¶
func (x *Principal) GetAndIds() *Principal_Set
func (*Principal) GetAuthenticated ¶
func (x *Principal) GetAuthenticated() *Principal_Authenticated
func (*Principal) GetDirectRemoteIp ¶ added in v0.9.6
func (*Principal) GetHeader ¶
func (x *Principal) GetHeader() *v3.HeaderMatcher
func (*Principal) GetIdentifier ¶
func (m *Principal) GetIdentifier() isPrincipal_Identifier
func (*Principal) GetMetadata ¶
func (x *Principal) GetMetadata() *v31.MetadataMatcher
func (*Principal) GetOrIds ¶
func (x *Principal) GetOrIds() *Principal_Set
func (*Principal) GetRemoteIp ¶ added in v0.9.6
func (*Principal) GetSourceIp
deprecated
func (*Principal) GetUrlPath ¶ added in v0.9.4
func (x *Principal) GetUrlPath() *v31.PathMatcher
func (*Principal) ProtoMessage ¶
func (*Principal) ProtoMessage()
func (*Principal) ProtoReflect ¶ added in v0.9.6
func (x *Principal) ProtoReflect() protoreflect.Message
func (*Principal) Validate ¶
Validate checks the field values on Principal with the rules defined in the proto definition for this message. If any rules are violated, the first error encountered is returned, or nil if there are no violations.
func (*Principal) ValidateAll ¶ added in v0.10.0
ValidateAll checks the field values on Principal with the rules defined in the proto definition for this message. If any rules are violated, the result is a list of violation errors wrapped in PrincipalMultiError, or nil if none found.
type PrincipalMultiError ¶ added in v0.10.0
type PrincipalMultiError []error
PrincipalMultiError is an error wrapping multiple validation errors returned by Principal.ValidateAll() if the designated constraints aren't met.
func (PrincipalMultiError) AllErrors ¶ added in v0.10.0
func (m PrincipalMultiError) AllErrors() []error
AllErrors returns a list of validation violation errors.
func (PrincipalMultiError) Error ¶ added in v0.10.0
func (m PrincipalMultiError) Error() string
Error returns a concatenation of all the error messages it wraps.
type PrincipalValidationError ¶
type PrincipalValidationError struct {
// contains filtered or unexported fields
}
PrincipalValidationError is the validation error returned by Principal.Validate if the designated constraints aren't met.
func (PrincipalValidationError) Cause ¶
func (e PrincipalValidationError) Cause() error
Cause function returns cause value.
func (PrincipalValidationError) Error ¶
func (e PrincipalValidationError) Error() string
Error satisfies the builtin error interface
func (PrincipalValidationError) ErrorName ¶
func (e PrincipalValidationError) ErrorName() string
ErrorName returns error name.
func (PrincipalValidationError) Field ¶
func (e PrincipalValidationError) Field() string
Field function returns field value.
func (PrincipalValidationError) Key ¶
func (e PrincipalValidationError) Key() bool
Key function returns key value.
func (PrincipalValidationError) Reason ¶
func (e PrincipalValidationError) Reason() string
Reason function returns reason value.
type Principal_AndIds ¶
type Principal_AndIds struct { // A set of identifiers that all must match in order to define the // downstream. AndIds *Principal_Set `protobuf:"bytes,1,opt,name=and_ids,json=andIds,proto3,oneof"` }
type Principal_Any ¶
type Principal_Any struct { // When any is set, it matches any downstream. Any bool `protobuf:"varint,3,opt,name=any,proto3,oneof"` }
type Principal_Authenticated ¶
type Principal_Authenticated struct { // The name of the principal. If set, The URI SAN or DNS SAN in that order // is used from the certificate, otherwise the subject field is used. If // unset, it applies to any user that is authenticated. PrincipalName *v31.StringMatcher `protobuf:"bytes,2,opt,name=principal_name,json=principalName,proto3" json:"principal_name,omitempty"` // contains filtered or unexported fields }
Authentication attributes for a downstream.
func (*Principal_Authenticated) Descriptor
deprecated
func (*Principal_Authenticated) Descriptor() ([]byte, []int)
Deprecated: Use Principal_Authenticated.ProtoReflect.Descriptor instead.
func (*Principal_Authenticated) GetPrincipalName ¶
func (x *Principal_Authenticated) GetPrincipalName() *v31.StringMatcher
func (*Principal_Authenticated) ProtoMessage ¶
func (*Principal_Authenticated) ProtoMessage()
func (*Principal_Authenticated) ProtoReflect ¶ added in v0.9.6
func (x *Principal_Authenticated) ProtoReflect() protoreflect.Message
func (*Principal_Authenticated) Reset ¶
func (x *Principal_Authenticated) Reset()
func (*Principal_Authenticated) String ¶
func (x *Principal_Authenticated) String() string
func (*Principal_Authenticated) Validate ¶
func (m *Principal_Authenticated) Validate() error
Validate checks the field values on Principal_Authenticated with the rules defined in the proto definition for this message. If any rules are violated, the first error encountered is returned, or nil if there are no violations.
func (*Principal_Authenticated) ValidateAll ¶ added in v0.10.0
func (m *Principal_Authenticated) ValidateAll() error
ValidateAll checks the field values on Principal_Authenticated with the rules defined in the proto definition for this message. If any rules are violated, the result is a list of violation errors wrapped in Principal_AuthenticatedMultiError, or nil if none found.
type Principal_AuthenticatedMultiError ¶ added in v0.10.0
type Principal_AuthenticatedMultiError []error
Principal_AuthenticatedMultiError is an error wrapping multiple validation errors returned by Principal_Authenticated.ValidateAll() if the designated constraints aren't met.
func (Principal_AuthenticatedMultiError) AllErrors ¶ added in v0.10.0
func (m Principal_AuthenticatedMultiError) AllErrors() []error
AllErrors returns a list of validation violation errors.
func (Principal_AuthenticatedMultiError) Error ¶ added in v0.10.0
func (m Principal_AuthenticatedMultiError) Error() string
Error returns a concatenation of all the error messages it wraps.
type Principal_AuthenticatedValidationError ¶
type Principal_AuthenticatedValidationError struct {
// contains filtered or unexported fields
}
Principal_AuthenticatedValidationError is the validation error returned by Principal_Authenticated.Validate if the designated constraints aren't met.
func (Principal_AuthenticatedValidationError) Cause ¶
func (e Principal_AuthenticatedValidationError) Cause() error
Cause function returns cause value.
func (Principal_AuthenticatedValidationError) Error ¶
func (e Principal_AuthenticatedValidationError) Error() string
Error satisfies the builtin error interface
func (Principal_AuthenticatedValidationError) ErrorName ¶
func (e Principal_AuthenticatedValidationError) ErrorName() string
ErrorName returns error name.
func (Principal_AuthenticatedValidationError) Field ¶
func (e Principal_AuthenticatedValidationError) Field() string
Field function returns field value.
func (Principal_AuthenticatedValidationError) Key ¶
func (e Principal_AuthenticatedValidationError) Key() bool
Key function returns key value.
func (Principal_AuthenticatedValidationError) Reason ¶
func (e Principal_AuthenticatedValidationError) Reason() string
Reason function returns reason value.
type Principal_Authenticated_ ¶
type Principal_Authenticated_ struct { // Authenticated attributes that identify the downstream. Authenticated *Principal_Authenticated `protobuf:"bytes,4,opt,name=authenticated,proto3,oneof"` }
type Principal_DirectRemoteIp ¶ added in v0.9.6
type Principal_DirectRemoteIp struct { // A CIDR block that describes the downstream remote/origin address. // Note: This is always the physical peer even if the // :ref:`remote_ip <envoy_v3_api_field_config.rbac.v3.Principal.remote_ip>` is // inferred from for example the x-forwarder-for header, proxy protocol, // etc. DirectRemoteIp *v32.CidrRange `protobuf:"bytes,10,opt,name=direct_remote_ip,json=directRemoteIp,proto3,oneof"` }
type Principal_Header ¶
type Principal_Header struct { // A header (or pseudo-header such as :path or :method) on the incoming HTTP // request. Only available for HTTP request. Note: the pseudo-header :path // includes the query and fragment string. Use the `url_path` field if you // want to match the URL path without the query and fragment string. Header *v3.HeaderMatcher `protobuf:"bytes,6,opt,name=header,proto3,oneof"` }
type Principal_Metadata ¶
type Principal_Metadata struct { // Metadata that describes additional information about the principal. Metadata *v31.MetadataMatcher `protobuf:"bytes,7,opt,name=metadata,proto3,oneof"` }
type Principal_NotId ¶
type Principal_NotId struct { // Negates matching the provided principal. For instance, if the value of // `not_id` would match, this principal would not match. Conversely, if the // value of `not_id` would not match, this principal would match. NotId *Principal `protobuf:"bytes,8,opt,name=not_id,json=notId,proto3,oneof"` }
type Principal_OrIds ¶
type Principal_OrIds struct { // A set of identifiers at least one must match in order to define the // downstream. OrIds *Principal_Set `protobuf:"bytes,2,opt,name=or_ids,json=orIds,proto3,oneof"` }
type Principal_RemoteIp ¶ added in v0.9.6
type Principal_RemoteIp struct { // A CIDR block that describes the downstream remote/origin address. // Note: This may not be the physical peer and could be different from the // :ref:`direct_remote_ip // <envoy_v3_api_field_config.rbac.v3.Principal.direct_remote_ip>`. E.g, if the // remote ip is inferred from for example the x-forwarder-for header, proxy // protocol, etc. RemoteIp *v32.CidrRange `protobuf:"bytes,11,opt,name=remote_ip,json=remoteIp,proto3,oneof"` }
type Principal_Set ¶
type Principal_Set struct { Ids []*Principal `protobuf:"bytes,1,rep,name=ids,proto3" json:"ids,omitempty"` // contains filtered or unexported fields }
Used in the `and_ids` and `or_ids` fields in the `identifier` oneof. Depending on the context, each are applied with the associated behavior.
func (*Principal_Set) Descriptor
deprecated
func (*Principal_Set) Descriptor() ([]byte, []int)
Deprecated: Use Principal_Set.ProtoReflect.Descriptor instead.
func (*Principal_Set) GetIds ¶
func (x *Principal_Set) GetIds() []*Principal
func (*Principal_Set) ProtoMessage ¶
func (*Principal_Set) ProtoMessage()
func (*Principal_Set) ProtoReflect ¶ added in v0.9.6
func (x *Principal_Set) ProtoReflect() protoreflect.Message
func (*Principal_Set) Reset ¶
func (x *Principal_Set) Reset()
func (*Principal_Set) String ¶
func (x *Principal_Set) String() string
func (*Principal_Set) Validate ¶
func (m *Principal_Set) Validate() error
Validate checks the field values on Principal_Set with the rules defined in the proto definition for this message. If any rules are violated, the first error encountered is returned, or nil if there are no violations.
func (*Principal_Set) ValidateAll ¶ added in v0.10.0
func (m *Principal_Set) ValidateAll() error
ValidateAll checks the field values on Principal_Set with the rules defined in the proto definition for this message. If any rules are violated, the result is a list of violation errors wrapped in Principal_SetMultiError, or nil if none found.
type Principal_SetMultiError ¶ added in v0.10.0
type Principal_SetMultiError []error
Principal_SetMultiError is an error wrapping multiple validation errors returned by Principal_Set.ValidateAll() if the designated constraints aren't met.
func (Principal_SetMultiError) AllErrors ¶ added in v0.10.0
func (m Principal_SetMultiError) AllErrors() []error
AllErrors returns a list of validation violation errors.
func (Principal_SetMultiError) Error ¶ added in v0.10.0
func (m Principal_SetMultiError) Error() string
Error returns a concatenation of all the error messages it wraps.
type Principal_SetValidationError ¶
type Principal_SetValidationError struct {
// contains filtered or unexported fields
}
Principal_SetValidationError is the validation error returned by Principal_Set.Validate if the designated constraints aren't met.
func (Principal_SetValidationError) Cause ¶
func (e Principal_SetValidationError) Cause() error
Cause function returns cause value.
func (Principal_SetValidationError) Error ¶
func (e Principal_SetValidationError) Error() string
Error satisfies the builtin error interface
func (Principal_SetValidationError) ErrorName ¶
func (e Principal_SetValidationError) ErrorName() string
ErrorName returns error name.
func (Principal_SetValidationError) Field ¶
func (e Principal_SetValidationError) Field() string
Field function returns field value.
func (Principal_SetValidationError) Key ¶
func (e Principal_SetValidationError) Key() bool
Key function returns key value.
func (Principal_SetValidationError) Reason ¶
func (e Principal_SetValidationError) Reason() string
Reason function returns reason value.
type Principal_SourceIp ¶
type Principal_UrlPath ¶ added in v0.9.4
type Principal_UrlPath struct { // A URL path on the incoming HTTP request. Only available for HTTP. UrlPath *v31.PathMatcher `protobuf:"bytes,9,opt,name=url_path,json=urlPath,proto3,oneof"` }
type RBAC ¶
type RBAC struct { // The action to take if a policy matches. Every action either allows or denies a request, // and can also carry out action-specific operations. // // Actions: // // * ALLOW: Allows the request if and only if there is a policy that matches // the request. // * DENY: Allows the request if and only if there are no policies that // match the request. // * LOG: Allows all requests. If at least one policy matches, the dynamic // metadata key `access_log_hint` is set to the value `true` under the shared // key namespace 'envoy.common'. If no policies match, it is set to `false`. // Other actions do not modify this key. // Action RBAC_Action `protobuf:"varint,1,opt,name=action,proto3,enum=envoy.config.rbac.v3.RBAC_Action" json:"action,omitempty"` // Maps from policy name to policy. A match occurs when at least one policy matches the request. // The policies are evaluated in lexicographic order of the policy name. Policies map[string]*Policy `` /* 157-byte string literal not displayed */ // contains filtered or unexported fields }
Role Based Access Control (RBAC) provides service-level and method-level access control for a service. Requests are allowed or denied based on the `action` and whether a matching policy is found. For instance, if the action is ALLOW and a matching policy is found the request should be allowed.
RBAC can also be used to make access logging decisions by communicating with access loggers through dynamic metadata. When the action is LOG and at least one policy matches, the `access_log_hint` value in the shared key namespace 'envoy.common' is set to `true` indicating the request should be logged.
Here is an example of RBAC configuration. It has two policies:
- Service account "cluster.local/ns/default/sa/admin" has full access to the service, and so does "cluster.local/ns/default/sa/superuser".
Any user can read ("GET") the service at paths with prefix "/products", so long as the destination port is either 80 or 443.
.. code-block:: yaml
action: ALLOW policies: "service-admin": permissions:
any: true principals:
authenticated: principal_name: exact: "cluster.local/ns/default/sa/admin"
authenticated: principal_name: exact: "cluster.local/ns/default/sa/superuser" "product-viewer": permissions:
and_rules: rules:
header: name: ":method" string_match: exact: "GET"
url_path: path: { prefix: "/products" }
or_rules: rules:
destination_port: 80
destination_port: 443 principals:
any: true
func (*RBAC) Descriptor
deprecated
func (*RBAC) GetAction ¶
func (x *RBAC) GetAction() RBAC_Action
func (*RBAC) GetPolicies ¶
func (*RBAC) ProtoMessage ¶
func (*RBAC) ProtoMessage()
func (*RBAC) ProtoReflect ¶ added in v0.9.6
func (x *RBAC) ProtoReflect() protoreflect.Message
func (*RBAC) Validate ¶
Validate checks the field values on RBAC with the rules defined in the proto definition for this message. If any rules are violated, the first error encountered is returned, or nil if there are no violations.
func (*RBAC) ValidateAll ¶ added in v0.10.0
ValidateAll checks the field values on RBAC with the rules defined in the proto definition for this message. If any rules are violated, the result is a list of violation errors wrapped in RBACMultiError, or nil if none found.
type RBACMultiError ¶ added in v0.10.0
type RBACMultiError []error
RBACMultiError is an error wrapping multiple validation errors returned by RBAC.ValidateAll() if the designated constraints aren't met.
func (RBACMultiError) AllErrors ¶ added in v0.10.0
func (m RBACMultiError) AllErrors() []error
AllErrors returns a list of validation violation errors.
func (RBACMultiError) Error ¶ added in v0.10.0
func (m RBACMultiError) Error() string
Error returns a concatenation of all the error messages it wraps.
type RBACValidationError ¶
type RBACValidationError struct {
// contains filtered or unexported fields
}
RBACValidationError is the validation error returned by RBAC.Validate if the designated constraints aren't met.
func (RBACValidationError) Cause ¶
func (e RBACValidationError) Cause() error
Cause function returns cause value.
func (RBACValidationError) Error ¶
func (e RBACValidationError) Error() string
Error satisfies the builtin error interface
func (RBACValidationError) ErrorName ¶
func (e RBACValidationError) ErrorName() string
ErrorName returns error name.
func (RBACValidationError) Field ¶
func (e RBACValidationError) Field() string
Field function returns field value.
func (RBACValidationError) Key ¶
func (e RBACValidationError) Key() bool
Key function returns key value.
func (RBACValidationError) Reason ¶
func (e RBACValidationError) Reason() string
Reason function returns reason value.
type RBAC_Action ¶
type RBAC_Action int32
Should we do safe-list or block-list style access control?
const ( // The policies grant access to principals. The rest are denied. This is safe-list style // access control. This is the default type. RBAC_ALLOW RBAC_Action = 0 // The policies deny access to principals. The rest are allowed. This is block-list style // access control. RBAC_DENY RBAC_Action = 1 // The policies set the `access_log_hint` dynamic metadata key based on if requests match. // All requests are allowed. RBAC_LOG RBAC_Action = 2 )
func (RBAC_Action) Descriptor ¶ added in v0.9.6
func (RBAC_Action) Descriptor() protoreflect.EnumDescriptor
func (RBAC_Action) Enum ¶ added in v0.9.6
func (x RBAC_Action) Enum() *RBAC_Action
func (RBAC_Action) EnumDescriptor
deprecated
func (RBAC_Action) EnumDescriptor() ([]byte, []int)
Deprecated: Use RBAC_Action.Descriptor instead.
func (RBAC_Action) Number ¶ added in v0.9.6
func (x RBAC_Action) Number() protoreflect.EnumNumber
func (RBAC_Action) String ¶
func (x RBAC_Action) String() string
func (RBAC_Action) Type ¶ added in v0.9.6
func (RBAC_Action) Type() protoreflect.EnumType