Class RBAC
java.lang.Object
com.google.protobuf.AbstractMessageLite
com.google.protobuf.AbstractMessage
com.google.protobuf.GeneratedMessageV3
io.envoyproxy.envoy.extensions.filters.network.rbac.v3.RBAC
- All Implemented Interfaces:
com.google.protobuf.Message,com.google.protobuf.MessageLite,com.google.protobuf.MessageLiteOrBuilder,com.google.protobuf.MessageOrBuilder,RBACOrBuilder,Serializable
RBAC network filter config. Header should not be used in rules/shadow_rules in RBAC network filter as this information is only available in :ref:`RBAC http filter <config_http_filters_rbac>`. [#next-free-field: 9]Protobuf type
envoy.extensions.filters.network.rbac.v3.RBAC- See Also:
-
Nested Class Summary
Nested ClassesModifier and TypeClassDescriptionstatic final classRBAC network filter config.static enumProtobuf enumenvoy.extensions.filters.network.rbac.v3.RBAC.EnforcementTypeNested classes/interfaces inherited from class com.google.protobuf.GeneratedMessageV3
com.google.protobuf.GeneratedMessageV3.BuilderParent, com.google.protobuf.GeneratedMessageV3.ExtendableBuilder<MessageT extends com.google.protobuf.GeneratedMessageV3.ExtendableMessage<MessageT>,BuilderT extends com.google.protobuf.GeneratedMessageV3.ExtendableBuilder<MessageT, BuilderT>>, com.google.protobuf.GeneratedMessageV3.ExtendableMessage<MessageT extends com.google.protobuf.GeneratedMessageV3.ExtendableMessage<MessageT>>, com.google.protobuf.GeneratedMessageV3.ExtendableMessageOrBuilder<MessageT extends com.google.protobuf.GeneratedMessageV3.ExtendableMessage<MessageT>>, com.google.protobuf.GeneratedMessageV3.FieldAccessorTable, com.google.protobuf.GeneratedMessageV3.UnusedPrivateParameter Nested classes/interfaces inherited from class com.google.protobuf.AbstractMessageLite
com.google.protobuf.AbstractMessageLite.InternalOneOfEnum -
Field Summary
FieldsModifier and TypeFieldDescriptionstatic final intstatic final intstatic final intstatic final intstatic final intstatic final intstatic final intstatic final intFields inherited from class com.google.protobuf.GeneratedMessageV3
alwaysUseFieldBuilders, unknownFieldsFields inherited from class com.google.protobuf.AbstractMessage
memoizedSizeFields inherited from class com.google.protobuf.AbstractMessageLite
memoizedHashCode -
Method Summary
Modifier and TypeMethodDescriptionbooleanstatic RBACcom.google.protobuf.DurationDelay the specified duration before closing the connection when the policy evaluation result is ``DENY``.com.google.protobuf.DurationOrBuilderDelay the specified duration before closing the connection when the policy evaluation result is ``DENY``.static final com.google.protobuf.Descriptors.DescriptorRBAC enforcement strategy.intRBAC enforcement strategy.The match tree to use when resolving RBAC action for incoming connections.The match tree to use when resolving RBAC action for incoming connections.com.google.protobuf.Parser<RBAC>getRules()Specify the RBAC rules to be applied globally.Specify the RBAC rules to be applied globally.intThe match tree to use for emitting stats and logs which can be used for rule testing for incoming connections.The match tree to use for emitting stats and logs which can be used for rule testing for incoming connections.Shadow rules are not enforced by the filter but will emit stats and logs and can be used for rule testing.Shadow rules are not enforced by the filter but will emit stats and logs and can be used for rule testing.If specified, shadow rules will emit stats with the given prefix.com.google.protobuf.ByteStringIf specified, shadow rules will emit stats with the given prefix.The prefix to use when emitting statistics.com.google.protobuf.ByteStringThe prefix to use when emitting statistics.booleanDelay the specified duration before closing the connection when the policy evaluation result is ``DENY``.inthashCode()booleanThe match tree to use when resolving RBAC action for incoming connections.booleanhasRules()Specify the RBAC rules to be applied globally.booleanThe match tree to use for emitting stats and logs which can be used for rule testing for incoming connections.booleanShadow rules are not enforced by the filter but will emit stats and logs and can be used for rule testing.protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTablefinal booleanstatic RBAC.Builderstatic RBAC.BuildernewBuilder(RBAC prototype) protected RBAC.BuildernewBuilderForType(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) protected ObjectnewInstance(com.google.protobuf.GeneratedMessageV3.UnusedPrivateParameter unused) static RBACparseDelimitedFrom(InputStream input) static RBACparseDelimitedFrom(InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry) static RBACparseFrom(byte[] data) static RBACparseFrom(byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry) static RBACparseFrom(com.google.protobuf.ByteString data) static RBACparseFrom(com.google.protobuf.ByteString data, com.google.protobuf.ExtensionRegistryLite extensionRegistry) static RBACparseFrom(com.google.protobuf.CodedInputStream input) static RBACparseFrom(com.google.protobuf.CodedInputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry) static RBACparseFrom(InputStream input) static RBACparseFrom(InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry) static RBACparseFrom(ByteBuffer data) static RBACparseFrom(ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry) static com.google.protobuf.Parser<RBAC>parser()voidwriteTo(com.google.protobuf.CodedOutputStream output) Methods inherited from class com.google.protobuf.GeneratedMessageV3
canUseUnsafe, computeStringSize, computeStringSizeNoTag, emptyBooleanList, emptyDoubleList, emptyFloatList, emptyIntList, emptyList, emptyLongList, getAllFields, getDescriptorForType, getField, getOneofFieldDescriptor, getRepeatedField, getRepeatedFieldCount, getUnknownFields, hasField, hasOneof, internalGetMapField, internalGetMapFieldReflection, isStringEmpty, makeExtensionsImmutable, makeMutableCopy, makeMutableCopy, mergeFromAndMakeImmutableInternal, mutableCopy, mutableCopy, mutableCopy, mutableCopy, mutableCopy, newBooleanList, newBuilderForType, newDoubleList, newFloatList, newIntList, newLongList, parseDelimitedWithIOException, parseDelimitedWithIOException, parseUnknownField, parseUnknownFieldProto3, parseWithIOException, parseWithIOException, parseWithIOException, parseWithIOException, serializeBooleanMapTo, serializeIntegerMapTo, serializeLongMapTo, serializeStringMapTo, writeReplace, writeString, writeStringNoTagMethods inherited from class com.google.protobuf.AbstractMessage
findInitializationErrors, getInitializationErrorString, hashBoolean, hashEnum, hashEnumList, hashFields, hashLong, toStringMethods inherited from class com.google.protobuf.AbstractMessageLite
addAll, addAll, checkByteStringIsUtf8, toByteArray, toByteString, writeDelimitedTo, writeToMethods inherited from class java.lang.Object
clone, finalize, getClass, notify, notifyAll, wait, wait, waitMethods inherited from interface com.google.protobuf.MessageLite
toByteArray, toByteString, writeDelimitedTo, writeToMethods inherited from interface com.google.protobuf.MessageOrBuilder
findInitializationErrors, getAllFields, getDescriptorForType, getField, getInitializationErrorString, getOneofFieldDescriptor, getRepeatedField, getRepeatedFieldCount, getUnknownFields, hasField, hasOneof
-
Field Details
-
RULES_FIELD_NUMBER
public static final int RULES_FIELD_NUMBER- See Also:
-
MATCHER_FIELD_NUMBER
public static final int MATCHER_FIELD_NUMBER- See Also:
-
SHADOW_RULES_FIELD_NUMBER
public static final int SHADOW_RULES_FIELD_NUMBER- See Also:
-
SHADOW_MATCHER_FIELD_NUMBER
public static final int SHADOW_MATCHER_FIELD_NUMBER- See Also:
-
SHADOW_RULES_STAT_PREFIX_FIELD_NUMBER
public static final int SHADOW_RULES_STAT_PREFIX_FIELD_NUMBER- See Also:
-
STAT_PREFIX_FIELD_NUMBER
public static final int STAT_PREFIX_FIELD_NUMBER- See Also:
-
ENFORCEMENT_TYPE_FIELD_NUMBER
public static final int ENFORCEMENT_TYPE_FIELD_NUMBER- See Also:
-
DELAY_DENY_FIELD_NUMBER
public static final int DELAY_DENY_FIELD_NUMBER- See Also:
-
-
Method Details
-
newInstance
- Overrides:
newInstancein classcom.google.protobuf.GeneratedMessageV3
-
getDescriptor
public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() -
internalGetFieldAccessorTable
protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable internalGetFieldAccessorTable()- Specified by:
internalGetFieldAccessorTablein classcom.google.protobuf.GeneratedMessageV3
-
hasRules
public boolean hasRules()Specify the RBAC rules to be applied globally. If absent, no enforcing RBAC policy will be applied. If present and empty, DENY. If both rules and matcher are configured, rules will be ignored.
.envoy.config.rbac.v3.RBAC rules = 1 [(.udpa.annotations.field_migrate) = { ... }- Specified by:
hasRulesin interfaceRBACOrBuilder- Returns:
- Whether the rules field is set.
-
getRules
Specify the RBAC rules to be applied globally. If absent, no enforcing RBAC policy will be applied. If present and empty, DENY. If both rules and matcher are configured, rules will be ignored.
.envoy.config.rbac.v3.RBAC rules = 1 [(.udpa.annotations.field_migrate) = { ... }- Specified by:
getRulesin interfaceRBACOrBuilder- Returns:
- The rules.
-
getRulesOrBuilder
Specify the RBAC rules to be applied globally. If absent, no enforcing RBAC policy will be applied. If present and empty, DENY. If both rules and matcher are configured, rules will be ignored.
.envoy.config.rbac.v3.RBAC rules = 1 [(.udpa.annotations.field_migrate) = { ... }- Specified by:
getRulesOrBuilderin interfaceRBACOrBuilder
-
hasMatcher
public boolean hasMatcher()The match tree to use when resolving RBAC action for incoming connections. Connections do not match any matcher will be denied. If absent, no enforcing RBAC matcher will be applied. If present and empty, deny all connections.
.xds.type.matcher.v3.Matcher matcher = 6 [(.udpa.annotations.field_migrate) = { ... }- Specified by:
hasMatcherin interfaceRBACOrBuilder- Returns:
- Whether the matcher field is set.
-
getMatcher
The match tree to use when resolving RBAC action for incoming connections. Connections do not match any matcher will be denied. If absent, no enforcing RBAC matcher will be applied. If present and empty, deny all connections.
.xds.type.matcher.v3.Matcher matcher = 6 [(.udpa.annotations.field_migrate) = { ... }- Specified by:
getMatcherin interfaceRBACOrBuilder- Returns:
- The matcher.
-
getMatcherOrBuilder
The match tree to use when resolving RBAC action for incoming connections. Connections do not match any matcher will be denied. If absent, no enforcing RBAC matcher will be applied. If present and empty, deny all connections.
.xds.type.matcher.v3.Matcher matcher = 6 [(.udpa.annotations.field_migrate) = { ... }- Specified by:
getMatcherOrBuilderin interfaceRBACOrBuilder
-
hasShadowRules
public boolean hasShadowRules()Shadow rules are not enforced by the filter but will emit stats and logs and can be used for rule testing. If absent, no shadow RBAC policy will be applied. If both shadow rules and shadow matcher are configured, shadow rules will be ignored.
.envoy.config.rbac.v3.RBAC shadow_rules = 2 [(.udpa.annotations.field_migrate) = { ... }- Specified by:
hasShadowRulesin interfaceRBACOrBuilder- Returns:
- Whether the shadowRules field is set.
-
getShadowRules
Shadow rules are not enforced by the filter but will emit stats and logs and can be used for rule testing. If absent, no shadow RBAC policy will be applied. If both shadow rules and shadow matcher are configured, shadow rules will be ignored.
.envoy.config.rbac.v3.RBAC shadow_rules = 2 [(.udpa.annotations.field_migrate) = { ... }- Specified by:
getShadowRulesin interfaceRBACOrBuilder- Returns:
- The shadowRules.
-
getShadowRulesOrBuilder
Shadow rules are not enforced by the filter but will emit stats and logs and can be used for rule testing. If absent, no shadow RBAC policy will be applied. If both shadow rules and shadow matcher are configured, shadow rules will be ignored.
.envoy.config.rbac.v3.RBAC shadow_rules = 2 [(.udpa.annotations.field_migrate) = { ... }- Specified by:
getShadowRulesOrBuilderin interfaceRBACOrBuilder
-
hasShadowMatcher
public boolean hasShadowMatcher()The match tree to use for emitting stats and logs which can be used for rule testing for incoming connections. If absent, no shadow matcher will be applied.
.xds.type.matcher.v3.Matcher shadow_matcher = 7 [(.udpa.annotations.field_migrate) = { ... }- Specified by:
hasShadowMatcherin interfaceRBACOrBuilder- Returns:
- Whether the shadowMatcher field is set.
-
getShadowMatcher
The match tree to use for emitting stats and logs which can be used for rule testing for incoming connections. If absent, no shadow matcher will be applied.
.xds.type.matcher.v3.Matcher shadow_matcher = 7 [(.udpa.annotations.field_migrate) = { ... }- Specified by:
getShadowMatcherin interfaceRBACOrBuilder- Returns:
- The shadowMatcher.
-
getShadowMatcherOrBuilder
The match tree to use for emitting stats and logs which can be used for rule testing for incoming connections. If absent, no shadow matcher will be applied.
.xds.type.matcher.v3.Matcher shadow_matcher = 7 [(.udpa.annotations.field_migrate) = { ... }- Specified by:
getShadowMatcherOrBuilderin interfaceRBACOrBuilder
-
getShadowRulesStatPrefix
If specified, shadow rules will emit stats with the given prefix. This is useful to distinguish the stat when there are more than 1 RBAC filter configured with shadow rules.
string shadow_rules_stat_prefix = 5;- Specified by:
getShadowRulesStatPrefixin interfaceRBACOrBuilder- Returns:
- The shadowRulesStatPrefix.
-
getShadowRulesStatPrefixBytes
public com.google.protobuf.ByteString getShadowRulesStatPrefixBytes()If specified, shadow rules will emit stats with the given prefix. This is useful to distinguish the stat when there are more than 1 RBAC filter configured with shadow rules.
string shadow_rules_stat_prefix = 5;- Specified by:
getShadowRulesStatPrefixBytesin interfaceRBACOrBuilder- Returns:
- The bytes for shadowRulesStatPrefix.
-
getStatPrefix
The prefix to use when emitting statistics.
string stat_prefix = 3 [(.validate.rules) = { ... }- Specified by:
getStatPrefixin interfaceRBACOrBuilder- Returns:
- The statPrefix.
-
getStatPrefixBytes
public com.google.protobuf.ByteString getStatPrefixBytes()The prefix to use when emitting statistics.
string stat_prefix = 3 [(.validate.rules) = { ... }- Specified by:
getStatPrefixBytesin interfaceRBACOrBuilder- Returns:
- The bytes for statPrefix.
-
getEnforcementTypeValue
public int getEnforcementTypeValue()RBAC enforcement strategy. By default RBAC will be enforced only once when the first byte of data arrives from the downstream. When used in conjunction with filters that emit dynamic metadata after decoding every payload (e.g., Mongo, MySQL, Kafka) set the enforcement type to CONTINUOUS to enforce RBAC policies on every message boundary.
.envoy.extensions.filters.network.rbac.v3.RBAC.EnforcementType enforcement_type = 4;- Specified by:
getEnforcementTypeValuein interfaceRBACOrBuilder- Returns:
- The enum numeric value on the wire for enforcementType.
-
getEnforcementType
RBAC enforcement strategy. By default RBAC will be enforced only once when the first byte of data arrives from the downstream. When used in conjunction with filters that emit dynamic metadata after decoding every payload (e.g., Mongo, MySQL, Kafka) set the enforcement type to CONTINUOUS to enforce RBAC policies on every message boundary.
.envoy.extensions.filters.network.rbac.v3.RBAC.EnforcementType enforcement_type = 4;- Specified by:
getEnforcementTypein interfaceRBACOrBuilder- Returns:
- The enforcementType.
-
hasDelayDeny
public boolean hasDelayDeny()Delay the specified duration before closing the connection when the policy evaluation result is ``DENY``. If this is not present, the connection will be closed immediately. This is useful to provide a better protection for Envoy against clients that retries aggressively when the connection is rejected by the RBAC filter.
.google.protobuf.Duration delay_deny = 8;- Specified by:
hasDelayDenyin interfaceRBACOrBuilder- Returns:
- Whether the delayDeny field is set.
-
getDelayDeny
public com.google.protobuf.Duration getDelayDeny()Delay the specified duration before closing the connection when the policy evaluation result is ``DENY``. If this is not present, the connection will be closed immediately. This is useful to provide a better protection for Envoy against clients that retries aggressively when the connection is rejected by the RBAC filter.
.google.protobuf.Duration delay_deny = 8;- Specified by:
getDelayDenyin interfaceRBACOrBuilder- Returns:
- The delayDeny.
-
getDelayDenyOrBuilder
public com.google.protobuf.DurationOrBuilder getDelayDenyOrBuilder()Delay the specified duration before closing the connection when the policy evaluation result is ``DENY``. If this is not present, the connection will be closed immediately. This is useful to provide a better protection for Envoy against clients that retries aggressively when the connection is rejected by the RBAC filter.
.google.protobuf.Duration delay_deny = 8;- Specified by:
getDelayDenyOrBuilderin interfaceRBACOrBuilder
-
isInitialized
public final boolean isInitialized()- Specified by:
isInitializedin interfacecom.google.protobuf.MessageLiteOrBuilder- Overrides:
isInitializedin classcom.google.protobuf.GeneratedMessageV3
-
writeTo
- Specified by:
writeToin interfacecom.google.protobuf.MessageLite- Overrides:
writeToin classcom.google.protobuf.GeneratedMessageV3- Throws:
IOException
-
getSerializedSize
public int getSerializedSize()- Specified by:
getSerializedSizein interfacecom.google.protobuf.MessageLite- Overrides:
getSerializedSizein classcom.google.protobuf.GeneratedMessageV3
-
equals
- Specified by:
equalsin interfacecom.google.protobuf.Message- Overrides:
equalsin classcom.google.protobuf.AbstractMessage
-
hashCode
public int hashCode()- Specified by:
hashCodein interfacecom.google.protobuf.Message- Overrides:
hashCodein classcom.google.protobuf.AbstractMessage
-
parseFrom
public static RBAC parseFrom(ByteBuffer data) throws com.google.protobuf.InvalidProtocolBufferException - Throws:
com.google.protobuf.InvalidProtocolBufferException
-
parseFrom
public static RBAC parseFrom(ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws com.google.protobuf.InvalidProtocolBufferException - Throws:
com.google.protobuf.InvalidProtocolBufferException
-
parseFrom
public static RBAC parseFrom(com.google.protobuf.ByteString data) throws com.google.protobuf.InvalidProtocolBufferException - Throws:
com.google.protobuf.InvalidProtocolBufferException
-
parseFrom
public static RBAC parseFrom(com.google.protobuf.ByteString data, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws com.google.protobuf.InvalidProtocolBufferException - Throws:
com.google.protobuf.InvalidProtocolBufferException
-
parseFrom
- Throws:
com.google.protobuf.InvalidProtocolBufferException
-
parseFrom
public static RBAC parseFrom(byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws com.google.protobuf.InvalidProtocolBufferException - Throws:
com.google.protobuf.InvalidProtocolBufferException
-
parseFrom
- Throws:
IOException
-
parseFrom
public static RBAC parseFrom(InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws IOException - Throws:
IOException
-
parseDelimitedFrom
- Throws:
IOException
-
parseDelimitedFrom
public static RBAC parseDelimitedFrom(InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws IOException - Throws:
IOException
-
parseFrom
- Throws:
IOException
-
parseFrom
public static RBAC parseFrom(com.google.protobuf.CodedInputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws IOException - Throws:
IOException
-
newBuilderForType
- Specified by:
newBuilderForTypein interfacecom.google.protobuf.Message- Specified by:
newBuilderForTypein interfacecom.google.protobuf.MessageLite
-
newBuilder
-
newBuilder
-
toBuilder
- Specified by:
toBuilderin interfacecom.google.protobuf.Message- Specified by:
toBuilderin interfacecom.google.protobuf.MessageLite
-
newBuilderForType
protected RBAC.Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.BuilderParent parent) - Specified by:
newBuilderForTypein classcom.google.protobuf.GeneratedMessageV3
-
getDefaultInstance
-
parser
-
getParserForType
- Specified by:
getParserForTypein interfacecom.google.protobuf.Message- Specified by:
getParserForTypein interfacecom.google.protobuf.MessageLite- Overrides:
getParserForTypein classcom.google.protobuf.GeneratedMessageV3
-
getDefaultInstanceForType
- Specified by:
getDefaultInstanceForTypein interfacecom.google.protobuf.MessageLiteOrBuilder- Specified by:
getDefaultInstanceForTypein interfacecom.google.protobuf.MessageOrBuilder
-