Documentation ¶
Index ¶
- Variables
- type Permission
- func (*Permission) Descriptor() ([]byte, []int)
- func (m *Permission) GetAndRules() *Permission_Set
- func (m *Permission) GetAny() bool
- func (m *Permission) GetDestinationIp() *core.CidrRange
- func (m *Permission) GetDestinationPort() uint32
- func (m *Permission) GetHeader() *route.HeaderMatcher
- func (m *Permission) GetMetadata() *v3alpha.MetadataMatcher
- func (m *Permission) GetNotRule() *Permission
- func (m *Permission) GetOrRules() *Permission_Set
- func (m *Permission) GetRequestedServerName() *v3alpha.StringMatcher
- func (m *Permission) GetRule() isPermission_Rule
- func (*Permission) ProtoMessage()
- func (m *Permission) Reset()
- func (m *Permission) String() string
- func (m *Permission) XXX_DiscardUnknown()
- func (m *Permission) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *Permission) XXX_Merge(src proto.Message)
- func (*Permission) XXX_OneofWrappers() []interface{}
- func (m *Permission) XXX_Size() int
- func (m *Permission) XXX_Unmarshal(b []byte) error
- type Permission_AndRules
- type Permission_Any
- type Permission_DestinationIp
- type Permission_DestinationPort
- type Permission_Header
- type Permission_Metadata
- type Permission_NotRule
- type Permission_OrRules
- type Permission_RequestedServerName
- type Permission_Set
- func (*Permission_Set) Descriptor() ([]byte, []int)
- func (m *Permission_Set) GetRules() []*Permission
- func (*Permission_Set) ProtoMessage()
- func (m *Permission_Set) Reset()
- func (m *Permission_Set) String() string
- func (m *Permission_Set) XXX_DiscardUnknown()
- func (m *Permission_Set) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *Permission_Set) XXX_Merge(src proto.Message)
- func (m *Permission_Set) XXX_Size() int
- func (m *Permission_Set) XXX_Unmarshal(b []byte) error
- type Policy
- func (*Policy) Descriptor() ([]byte, []int)
- func (m *Policy) GetCondition() *v1alpha1.Expr
- func (m *Policy) GetPermissions() []*Permission
- func (m *Policy) GetPrincipals() []*Principal
- func (*Policy) ProtoMessage()
- func (m *Policy) Reset()
- func (m *Policy) String() string
- func (m *Policy) XXX_DiscardUnknown()
- func (m *Policy) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *Policy) XXX_Merge(src proto.Message)
- func (m *Policy) XXX_Size() int
- func (m *Policy) XXX_Unmarshal(b []byte) error
- type Principal
- func (*Principal) Descriptor() ([]byte, []int)
- func (m *Principal) GetAndIds() *Principal_Set
- func (m *Principal) GetAny() bool
- func (m *Principal) GetAuthenticated() *Principal_Authenticated
- func (m *Principal) GetHeader() *route.HeaderMatcher
- func (m *Principal) GetIdentifier() isPrincipal_Identifier
- func (m *Principal) GetMetadata() *v3alpha.MetadataMatcher
- func (m *Principal) GetNotId() *Principal
- func (m *Principal) GetOrIds() *Principal_Set
- func (m *Principal) GetSourceIp() *core.CidrRange
- func (*Principal) ProtoMessage()
- func (m *Principal) Reset()
- func (m *Principal) String() string
- func (m *Principal) XXX_DiscardUnknown()
- func (m *Principal) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *Principal) XXX_Merge(src proto.Message)
- func (*Principal) XXX_OneofWrappers() []interface{}
- func (m *Principal) XXX_Size() int
- func (m *Principal) XXX_Unmarshal(b []byte) error
- type Principal_AndIds
- type Principal_Any
- type Principal_Authenticated
- func (*Principal_Authenticated) Descriptor() ([]byte, []int)
- func (m *Principal_Authenticated) GetPrincipalName() *v3alpha.StringMatcher
- func (*Principal_Authenticated) ProtoMessage()
- func (m *Principal_Authenticated) Reset()
- func (m *Principal_Authenticated) String() string
- func (m *Principal_Authenticated) XXX_DiscardUnknown()
- func (m *Principal_Authenticated) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *Principal_Authenticated) XXX_Merge(src proto.Message)
- func (m *Principal_Authenticated) XXX_Size() int
- func (m *Principal_Authenticated) XXX_Unmarshal(b []byte) error
- type Principal_Authenticated_
- type Principal_Header
- type Principal_Metadata
- type Principal_NotId
- type Principal_OrIds
- type Principal_Set
- func (*Principal_Set) Descriptor() ([]byte, []int)
- func (m *Principal_Set) GetIds() []*Principal
- func (*Principal_Set) ProtoMessage()
- func (m *Principal_Set) Reset()
- func (m *Principal_Set) String() string
- func (m *Principal_Set) XXX_DiscardUnknown()
- func (m *Principal_Set) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *Principal_Set) XXX_Merge(src proto.Message)
- func (m *Principal_Set) XXX_Size() int
- func (m *Principal_Set) XXX_Unmarshal(b []byte) error
- type Principal_SourceIp
- type RBAC
- func (*RBAC) Descriptor() ([]byte, []int)
- func (m *RBAC) GetAction() RBAC_Action
- func (m *RBAC) GetPolicies() map[string]*Policy
- func (*RBAC) ProtoMessage()
- func (m *RBAC) Reset()
- func (m *RBAC) String() string
- func (m *RBAC) XXX_DiscardUnknown()
- func (m *RBAC) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
- func (m *RBAC) XXX_Merge(src proto.Message)
- func (m *RBAC) XXX_Size() int
- func (m *RBAC) XXX_Unmarshal(b []byte) error
- type RBAC_Action
Constants ¶
This section is empty.
Variables ¶
var RBAC_Action_name = map[int32]string{
0: "ALLOW",
1: "DENY",
}
var RBAC_Action_value = map[string]int32{
"ALLOW": 0,
"DENY": 1,
}
Functions ¶
This section is empty.
Types ¶
type Permission ¶
type Permission struct { // Types that are valid to be assigned to Rule: // *Permission_AndRules // *Permission_OrRules // *Permission_Any // *Permission_Header // *Permission_DestinationIp // *Permission_DestinationPort // *Permission_Metadata // *Permission_NotRule // *Permission_RequestedServerName Rule isPermission_Rule `protobuf_oneof:"rule"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
Permission defines an action (or actions) that a principal can take. [#next-free-field: 10]
func (*Permission) Descriptor ¶
func (*Permission) Descriptor() ([]byte, []int)
func (*Permission) GetAndRules ¶
func (m *Permission) GetAndRules() *Permission_Set
func (*Permission) GetAny ¶
func (m *Permission) GetAny() bool
func (*Permission) GetDestinationIp ¶
func (m *Permission) GetDestinationIp() *core.CidrRange
func (*Permission) GetDestinationPort ¶
func (m *Permission) GetDestinationPort() uint32
func (*Permission) GetHeader ¶
func (m *Permission) GetHeader() *route.HeaderMatcher
func (*Permission) GetMetadata ¶
func (m *Permission) GetMetadata() *v3alpha.MetadataMatcher
func (*Permission) GetNotRule ¶
func (m *Permission) GetNotRule() *Permission
func (*Permission) GetOrRules ¶
func (m *Permission) GetOrRules() *Permission_Set
func (*Permission) GetRequestedServerName ¶
func (m *Permission) GetRequestedServerName() *v3alpha.StringMatcher
func (*Permission) GetRule ¶
func (m *Permission) GetRule() isPermission_Rule
func (*Permission) ProtoMessage ¶
func (*Permission) ProtoMessage()
func (*Permission) Reset ¶
func (m *Permission) Reset()
func (*Permission) String ¶
func (m *Permission) String() string
func (*Permission) XXX_DiscardUnknown ¶
func (m *Permission) XXX_DiscardUnknown()
func (*Permission) XXX_Marshal ¶
func (m *Permission) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
func (*Permission) XXX_Merge ¶
func (m *Permission) XXX_Merge(src proto.Message)
func (*Permission) XXX_OneofWrappers ¶
func (*Permission) XXX_OneofWrappers() []interface{}
XXX_OneofWrappers is for the internal use of the proto package.
func (*Permission) XXX_Size ¶
func (m *Permission) XXX_Size() int
func (*Permission) XXX_Unmarshal ¶
func (m *Permission) XXX_Unmarshal(b []byte) error
type Permission_AndRules ¶
type Permission_AndRules struct {
AndRules *Permission_Set `protobuf:"bytes,1,opt,name=and_rules,json=andRules,proto3,oneof"`
}
type Permission_Any ¶
type Permission_Any struct {
Any bool `protobuf:"varint,3,opt,name=any,proto3,oneof"`
}
type Permission_DestinationPort ¶
type Permission_DestinationPort struct {
DestinationPort uint32 `protobuf:"varint,6,opt,name=destination_port,json=destinationPort,proto3,oneof"`
}
type Permission_Header ¶
type Permission_Header struct {
Header *route.HeaderMatcher `protobuf:"bytes,4,opt,name=header,proto3,oneof"`
}
type Permission_Metadata ¶
type Permission_Metadata struct {
Metadata *v3alpha.MetadataMatcher `protobuf:"bytes,7,opt,name=metadata,proto3,oneof"`
}
type Permission_NotRule ¶
type Permission_NotRule struct {
NotRule *Permission `protobuf:"bytes,8,opt,name=not_rule,json=notRule,proto3,oneof"`
}
type Permission_OrRules ¶
type Permission_OrRules struct {
OrRules *Permission_Set `protobuf:"bytes,2,opt,name=or_rules,json=orRules,proto3,oneof"`
}
type Permission_RequestedServerName ¶
type Permission_RequestedServerName struct {
RequestedServerName *v3alpha.StringMatcher `protobuf:"bytes,9,opt,name=requested_server_name,json=requestedServerName,proto3,oneof"`
}
type Permission_Set ¶
type Permission_Set struct { Rules []*Permission `protobuf:"bytes,1,rep,name=rules,proto3" json:"rules,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
Used in the `and_rules` and `or_rules` fields in the `rule` oneof. Depending on the context, each are applied with the associated behavior.
func (*Permission_Set) Descriptor ¶
func (*Permission_Set) Descriptor() ([]byte, []int)
func (*Permission_Set) GetRules ¶
func (m *Permission_Set) GetRules() []*Permission
func (*Permission_Set) ProtoMessage ¶
func (*Permission_Set) ProtoMessage()
func (*Permission_Set) Reset ¶
func (m *Permission_Set) Reset()
func (*Permission_Set) String ¶
func (m *Permission_Set) String() string
func (*Permission_Set) XXX_DiscardUnknown ¶
func (m *Permission_Set) XXX_DiscardUnknown()
func (*Permission_Set) XXX_Marshal ¶
func (m *Permission_Set) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
func (*Permission_Set) XXX_Merge ¶
func (m *Permission_Set) XXX_Merge(src proto.Message)
func (*Permission_Set) XXX_Size ¶
func (m *Permission_Set) XXX_Size() int
func (*Permission_Set) XXX_Unmarshal ¶
func (m *Permission_Set) XXX_Unmarshal(b []byte) error
type Policy ¶
type Policy struct { // Required. The set of permissions that define a role. Each permission is matched with OR // semantics. To match all actions for this policy, a single Permission with the `any` field set // to true should be used. Permissions []*Permission `protobuf:"bytes,1,rep,name=permissions,proto3" json:"permissions,omitempty"` // Required. The set of principals that are assigned/denied the role based on “action”. Each // principal is matched with OR semantics. To match all downstreams for this policy, a single // Principal with the `any` field set to true should be used. Principals []*Principal `protobuf:"bytes,2,rep,name=principals,proto3" json:"principals,omitempty"` // An optional symbolic expression specifying an access control // :ref:`condition <arch_overview_condition>`. The condition is combined // with the permissions and the principals as a clause with AND semantics. Condition *v1alpha1.Expr `protobuf:"bytes,3,opt,name=condition,proto3" json:"condition,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
Policy specifies a role and the principals that are assigned/denied the role. A policy matches if and only if at least one of its permissions match the action taking place AND at least one of its principals match the downstream AND the condition is true if specified.
func (*Policy) Descriptor ¶
func (*Policy) GetCondition ¶
func (*Policy) GetPermissions ¶
func (m *Policy) GetPermissions() []*Permission
func (*Policy) GetPrincipals ¶
func (*Policy) ProtoMessage ¶
func (*Policy) ProtoMessage()
func (*Policy) XXX_DiscardUnknown ¶
func (m *Policy) XXX_DiscardUnknown()
func (*Policy) XXX_Marshal ¶
func (*Policy) XXX_Unmarshal ¶
type Principal ¶
type Principal struct { // Types that are valid to be assigned to Identifier: // *Principal_AndIds // *Principal_OrIds // *Principal_Any // *Principal_Authenticated_ // *Principal_SourceIp // *Principal_Header // *Principal_Metadata // *Principal_NotId Identifier isPrincipal_Identifier `protobuf_oneof:"identifier"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
Principal defines an identity or a group of identities for a downstream subject. [#next-free-field: 9]
func (*Principal) Descriptor ¶
func (*Principal) GetAndIds ¶
func (m *Principal) GetAndIds() *Principal_Set
func (*Principal) GetAuthenticated ¶
func (m *Principal) GetAuthenticated() *Principal_Authenticated
func (*Principal) GetHeader ¶
func (m *Principal) GetHeader() *route.HeaderMatcher
func (*Principal) GetIdentifier ¶
func (m *Principal) GetIdentifier() isPrincipal_Identifier
func (*Principal) GetMetadata ¶
func (m *Principal) GetMetadata() *v3alpha.MetadataMatcher
func (*Principal) GetOrIds ¶
func (m *Principal) GetOrIds() *Principal_Set
func (*Principal) GetSourceIp ¶
func (*Principal) ProtoMessage ¶
func (*Principal) ProtoMessage()
func (*Principal) XXX_DiscardUnknown ¶
func (m *Principal) XXX_DiscardUnknown()
func (*Principal) XXX_Marshal ¶
func (*Principal) XXX_OneofWrappers ¶
func (*Principal) XXX_OneofWrappers() []interface{}
XXX_OneofWrappers is for the internal use of the proto package.
func (*Principal) XXX_Unmarshal ¶
type Principal_AndIds ¶
type Principal_AndIds struct {
AndIds *Principal_Set `protobuf:"bytes,1,opt,name=and_ids,json=andIds,proto3,oneof"`
}
type Principal_Any ¶
type Principal_Any struct {
Any bool `protobuf:"varint,3,opt,name=any,proto3,oneof"`
}
type Principal_Authenticated ¶
type Principal_Authenticated struct { // The name of the principal. If set, The URI SAN or DNS SAN in that order is used from the // certificate, otherwise the subject field is used. If unset, it applies to any user that is // authenticated. PrincipalName *v3alpha.StringMatcher `protobuf:"bytes,2,opt,name=principal_name,json=principalName,proto3" json:"principal_name,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
Authentication attributes for a downstream.
func (*Principal_Authenticated) Descriptor ¶
func (*Principal_Authenticated) Descriptor() ([]byte, []int)
func (*Principal_Authenticated) GetPrincipalName ¶
func (m *Principal_Authenticated) GetPrincipalName() *v3alpha.StringMatcher
func (*Principal_Authenticated) ProtoMessage ¶
func (*Principal_Authenticated) ProtoMessage()
func (*Principal_Authenticated) Reset ¶
func (m *Principal_Authenticated) Reset()
func (*Principal_Authenticated) String ¶
func (m *Principal_Authenticated) String() string
func (*Principal_Authenticated) XXX_DiscardUnknown ¶
func (m *Principal_Authenticated) XXX_DiscardUnknown()
func (*Principal_Authenticated) XXX_Marshal ¶
func (m *Principal_Authenticated) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
func (*Principal_Authenticated) XXX_Merge ¶
func (m *Principal_Authenticated) XXX_Merge(src proto.Message)
func (*Principal_Authenticated) XXX_Size ¶
func (m *Principal_Authenticated) XXX_Size() int
func (*Principal_Authenticated) XXX_Unmarshal ¶
func (m *Principal_Authenticated) XXX_Unmarshal(b []byte) error
type Principal_Authenticated_ ¶
type Principal_Authenticated_ struct {
Authenticated *Principal_Authenticated `protobuf:"bytes,4,opt,name=authenticated,proto3,oneof"`
}
type Principal_Header ¶
type Principal_Header struct {
Header *route.HeaderMatcher `protobuf:"bytes,6,opt,name=header,proto3,oneof"`
}
type Principal_Metadata ¶
type Principal_Metadata struct {
Metadata *v3alpha.MetadataMatcher `protobuf:"bytes,7,opt,name=metadata,proto3,oneof"`
}
type Principal_NotId ¶
type Principal_NotId struct {
NotId *Principal `protobuf:"bytes,8,opt,name=not_id,json=notId,proto3,oneof"`
}
type Principal_OrIds ¶
type Principal_OrIds struct {
OrIds *Principal_Set `protobuf:"bytes,2,opt,name=or_ids,json=orIds,proto3,oneof"`
}
type Principal_Set ¶
type Principal_Set struct { Ids []*Principal `protobuf:"bytes,1,rep,name=ids,proto3" json:"ids,omitempty"` XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
Used in the `and_ids` and `or_ids` fields in the `identifier` oneof. Depending on the context, each are applied with the associated behavior.
func (*Principal_Set) Descriptor ¶
func (*Principal_Set) Descriptor() ([]byte, []int)
func (*Principal_Set) GetIds ¶
func (m *Principal_Set) GetIds() []*Principal
func (*Principal_Set) ProtoMessage ¶
func (*Principal_Set) ProtoMessage()
func (*Principal_Set) Reset ¶
func (m *Principal_Set) Reset()
func (*Principal_Set) String ¶
func (m *Principal_Set) String() string
func (*Principal_Set) XXX_DiscardUnknown ¶
func (m *Principal_Set) XXX_DiscardUnknown()
func (*Principal_Set) XXX_Marshal ¶
func (m *Principal_Set) XXX_Marshal(b []byte, deterministic bool) ([]byte, error)
func (*Principal_Set) XXX_Merge ¶
func (m *Principal_Set) XXX_Merge(src proto.Message)
func (*Principal_Set) XXX_Size ¶
func (m *Principal_Set) XXX_Size() int
func (*Principal_Set) XXX_Unmarshal ¶
func (m *Principal_Set) XXX_Unmarshal(b []byte) error
type Principal_SourceIp ¶
type RBAC ¶
type RBAC struct { // The action to take if a policy matches. The request is allowed if and only if: // // * `action` is "ALLOWED" and at least one policy matches // * `action` is "DENY" and none of the policies match Action RBAC_Action `protobuf:"varint,1,opt,name=action,proto3,enum=envoy.config.rbac.v3alpha.RBAC_Action" json:"action,omitempty"` // Maps from policy name to policy. A match occurs when at least one policy matches the request. Policies map[string]*Policy `` /* 157-byte string literal not displayed */ XXX_NoUnkeyedLiteral struct{} `json:"-"` XXX_unrecognized []byte `json:"-"` XXX_sizecache int32 `json:"-"` }
Role Based Access Control (RBAC) provides service-level and method-level access control for a service. RBAC policies are additive. The policies are examined in order. A request is allowed once a matching policy is found (suppose the `action` is ALLOW).
Here is an example of RBAC configuration. It has two policies:
- Service account "cluster.local/ns/default/sa/admin" has full access to the service, and so does "cluster.local/ns/default/sa/superuser".
Any user can read ("GET") the service at paths with prefix "/products", so long as the destination port is either 80 or 443.
.. code-block:: yaml
action: ALLOW policies: "service-admin": permissions:
any: true principals:
authenticated: principal_name: exact: "cluster.local/ns/default/sa/admin"
authenticated: principal_name: exact: "cluster.local/ns/default/sa/superuser" "product-viewer": permissions:
and_rules: rules:
header: { name: ":method", exact_match: "GET" }
header: { name: ":path", regex_match: "/products(/.*)?" }
or_rules: rules:
destination_port: 80
destination_port: 443 principals:
any: true
func (*RBAC) Descriptor ¶
func (*RBAC) GetAction ¶
func (m *RBAC) GetAction() RBAC_Action
func (*RBAC) GetPolicies ¶
func (*RBAC) ProtoMessage ¶
func (*RBAC) ProtoMessage()
func (*RBAC) XXX_DiscardUnknown ¶
func (m *RBAC) XXX_DiscardUnknown()
func (*RBAC) XXX_Unmarshal ¶
type RBAC_Action ¶
type RBAC_Action int32
Should we do safe-list or block-list style access control?
const ( // The policies grant access to principals. The rest is denied. This is safe-list style // access control. This is the default type. RBAC_ALLOW RBAC_Action = 0 // The policies deny access to principals. The rest is allowed. This is block-list style // access control. RBAC_DENY RBAC_Action = 1 )
func (RBAC_Action) EnumDescriptor ¶
func (RBAC_Action) EnumDescriptor() ([]byte, []int)
func (RBAC_Action) String ¶
func (x RBAC_Action) String() string