java.lang.Object
- com.google.protobuf.AbstractMessageLite
- - com.google.protobuf.AbstractMessage
  - - com.google.protobuf.GeneratedMessageV3
    - - io.envoyproxy.envoy.config.rbac.v3.RBAC

All Implemented Interfaces:: com.google.protobuf.Message, com.google.protobuf.MessageLite, com.google.protobuf.MessageLiteOrBuilder, com.google.protobuf.MessageOrBuilder, RBACOrBuilder, Serializable

public final class RBAC
extends com.google.protobuf.GeneratedMessageV3
implements RBACOrBuilder

 Role Based Access Control (RBAC) provides service-level and method-level access control for a
 service. Requests are allowed or denied based on the ``action`` and whether a matching policy is
 found. For instance, if the action is ALLOW and a matching policy is found the request should be
 allowed.
 RBAC can also be used to make access logging decisions by communicating with access loggers
 through dynamic metadata. When the action is LOG and at least one policy matches, the
 ``access_log_hint`` value in the shared key namespace 'envoy.common' is set to ``true`` indicating
 the request should be logged.
 Here is an example of RBAC configuration. It has two policies:
 * Service account ``cluster.local/ns/default/sa/admin`` has full access to the service, and so
   does "cluster.local/ns/default/sa/superuser".
 * Any user can read (``GET``) the service at paths with prefix ``/products``, so long as the
   destination port is either 80 or 443.
  .. code-block:: yaml
   action: ALLOW
   policies:
     "service-admin":
       permissions:
         - any: true
       principals:
         - authenticated:
             principal_name:
               exact: "cluster.local/ns/default/sa/admin"
         - authenticated:
             principal_name:
               exact: "cluster.local/ns/default/sa/superuser"
     "product-viewer":
       permissions:
           - and_rules:
               rules:
                 - header:
                     name: ":method"
                     string_match:
                       exact: "GET"
                 - url_path:
                     path: { prefix: "/products" }
                 - or_rules:
                     rules:
                       - destination_port: 80
                       - destination_port: 443
       principals:
         - any: true

Protobuf type envoy.config.rbac.v3.RBAC

See Also:: Serialized Form

Nested Class Summary

Nested Classes
Modifier and Type	Class	Description
`static class`	`RBAC.Action`	Should we do safe-list or block-list style access control?
`static class`	`RBAC.Builder`	Role Based Access Control (RBAC) provides service-level and method-level access control for a service.

Nested classes/interfaces inherited from class com.google.protobuf.GeneratedMessageV3
com.google.protobuf.GeneratedMessageV3.BuilderParent, com.google.protobuf.GeneratedMessageV3.ExtendableBuilder<MessageType extends com.google.protobuf.GeneratedMessageV3.ExtendableMessage,BuilderType extends com.google.protobuf.GeneratedMessageV3.ExtendableBuilder<MessageType,BuilderType>>, com.google.protobuf.GeneratedMessageV3.ExtendableMessage<MessageType extends com.google.protobuf.GeneratedMessageV3.ExtendableMessage>, com.google.protobuf.GeneratedMessageV3.ExtendableMessageOrBuilder<MessageType extends com.google.protobuf.GeneratedMessageV3.ExtendableMessage>, com.google.protobuf.GeneratedMessageV3.FieldAccessorTable, com.google.protobuf.GeneratedMessageV3.UnusedPrivateParameter

Nested classes/interfaces inherited from class com.google.protobuf.AbstractMessageLite
com.google.protobuf.AbstractMessageLite.InternalOneOfEnum

Field Summary

Fields
Modifier and Type Field Description

static int ACTION_FIELD_NUMBER

static int POLICIES_FIELD_NUMBER
- Fields inherited from class com.google.protobuf.GeneratedMessageV3
  alwaysUseFieldBuilders, unknownFields
- Fields inherited from class com.google.protobuf.AbstractMessage
  memoizedSize
- Fields inherited from class com.google.protobuf.AbstractMessageLite
  memoizedHashCode

Method Summary

All Methods Static Methods Instance Methods Concrete Methods Deprecated Methods
Modifier and Type	Method	Description
`boolean`	`containsPolicies(String key)`	Maps from policy name to policy.
`boolean`	`equals(Object obj)`
`RBAC.Action`	`getAction()`	The action to take if a policy matches.
`int`	`getActionValue()`	The action to take if a policy matches.
`static RBAC`	`getDefaultInstance()`
`RBAC`	`getDefaultInstanceForType()`
`static com.google.protobuf.Descriptors.Descriptor`	`getDescriptor()`
`com.google.protobuf.Parser<RBAC>`	`getParserForType()`
`Map<String,Policy>`	`getPolicies()`	Deprecated.
`int`	`getPoliciesCount()`	Maps from policy name to policy.
`Map<String,Policy>`	`getPoliciesMap()`	Maps from policy name to policy.
`Policy`	`getPoliciesOrDefault(String key, Policy defaultValue)`	Maps from policy name to policy.
`Policy`	`getPoliciesOrThrow(String key)`	Maps from policy name to policy.
`int`	`getSerializedSize()`
`com.google.protobuf.UnknownFieldSet`	`getUnknownFields()`
`int`	`hashCode()`
`protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable`	`internalGetFieldAccessorTable()`
`protected com.google.protobuf.MapField`	`internalGetMapField(int number)`
`boolean`	`isInitialized()`
`static RBAC.Builder`	`newBuilder()`
`static RBAC.Builder`	`newBuilder(RBAC prototype)`
`RBAC.Builder`	`newBuilderForType()`
`protected RBAC.Builder`	`newBuilderForType(com.google.protobuf.GeneratedMessageV3.BuilderParent parent)`
`protected Object`	`newInstance(com.google.protobuf.GeneratedMessageV3.UnusedPrivateParameter unused)`
`static RBAC`	`parseDelimitedFrom(InputStream input)`
`static RBAC`	`parseDelimitedFrom(InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)`
`static RBAC`	`parseFrom(byte[] data)`
`static RBAC`	`parseFrom(byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)`
`static RBAC`	`parseFrom(com.google.protobuf.ByteString data)`
`static RBAC`	`parseFrom(com.google.protobuf.ByteString data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)`
`static RBAC`	`parseFrom(com.google.protobuf.CodedInputStream input)`
`static RBAC`	`parseFrom(com.google.protobuf.CodedInputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)`
`static RBAC`	`parseFrom(InputStream input)`
`static RBAC`	`parseFrom(InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)`
`static RBAC`	`parseFrom(ByteBuffer data)`
`static RBAC`	`parseFrom(ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)`
`static com.google.protobuf.Parser<RBAC>`	`parser()`
`RBAC.Builder`	`toBuilder()`
`void`	`writeTo(com.google.protobuf.CodedOutputStream output)`

Methods inherited from class com.google.protobuf.GeneratedMessageV3
canUseUnsafe, computeStringSize, computeStringSizeNoTag, emptyBooleanList, emptyDoubleList, emptyFloatList, emptyIntList, emptyLongList, getAllFields, getDescriptorForType, getField, getOneofFieldDescriptor, getRepeatedField, getRepeatedFieldCount, hasField, hasOneof, isStringEmpty, makeExtensionsImmutable, mergeFromAndMakeImmutableInternal, mutableCopy, mutableCopy, mutableCopy, mutableCopy, mutableCopy, newBooleanList, newBuilderForType, newDoubleList, newFloatList, newIntList, newLongList, parseDelimitedWithIOException, parseDelimitedWithIOException, parseUnknownField, parseUnknownFieldProto3, parseWithIOException, parseWithIOException, parseWithIOException, parseWithIOException, serializeBooleanMapTo, serializeIntegerMapTo, serializeLongMapTo, serializeStringMapTo, writeReplace, writeString, writeStringNoTag

Methods inherited from class com.google.protobuf.AbstractMessage
findInitializationErrors, getInitializationErrorString, hashBoolean, hashEnum, hashEnumList, hashFields, hashLong, toString

Methods inherited from class com.google.protobuf.AbstractMessageLite
addAll, addAll, checkByteStringIsUtf8, toByteArray, toByteString, writeDelimitedTo, writeTo

Methods inherited from class java.lang.Object
clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Methods inherited from interface com.google.protobuf.MessageLite
toByteArray, toByteString, writeDelimitedTo, writeTo

Methods inherited from interface com.google.protobuf.MessageOrBuilder
findInitializationErrors, getAllFields, getDescriptorForType, getField, getInitializationErrorString, getOneofFieldDescriptor, getRepeatedField, getRepeatedFieldCount, hasField, hasOneof

Field Detail
- ACTION_FIELD_NUMBER
```
public static final int ACTION_FIELD_NUMBER
```
  See Also:
  
  Constant Field Values
- POLICIES_FIELD_NUMBER
```
public static final int POLICIES_FIELD_NUMBER
```
  See Also:
  
  Constant Field Values

Method Detail

newInstance

protected Object newInstance(com.google.protobuf.GeneratedMessageV3.UnusedPrivateParameter unused)

Overrides:: newInstance in class com.google.protobuf.GeneratedMessageV3

getUnknownFields
```
public final com.google.protobuf.UnknownFieldSet getUnknownFields()
```
Specified by:

getUnknownFields in interface com.google.protobuf.MessageOrBuilder

Overrides:

getUnknownFields in class com.google.protobuf.GeneratedMessageV3

getDescriptor

public static final com.google.protobuf.Descriptors.Descriptor getDescriptor()

internalGetMapField
```
protected com.google.protobuf.MapField internalGetMapField(int number)
```
Overrides:

internalGetMapField in class com.google.protobuf.GeneratedMessageV3

internalGetFieldAccessorTable
```
protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable internalGetFieldAccessorTable()
```
Specified by:

internalGetFieldAccessorTable in class com.google.protobuf.GeneratedMessageV3

getActionValue

public int getActionValue()

 The action to take if a policy matches. Every action either allows or denies a request,
 and can also carry out action-specific operations.
 Actions:
  * ``ALLOW``: Allows the request if and only if there is a policy that matches
    the request.
  * ``DENY``: Allows the request if and only if there are no policies that
    match the request.
  * ``LOG``: Allows all requests. If at least one policy matches, the dynamic
    metadata key ``access_log_hint`` is set to the value ``true`` under the shared
    key namespace ``envoy.common``. If no policies match, it is set to ``false``.
    Other actions do not modify this key.

.envoy.config.rbac.v3.RBAC.Action action = 1 [(.validate.rules) = { ... }

Specified by:: getActionValue in interface RBACOrBuilder
Returns:: The enum numeric value on the wire for action.

getAction

public RBAC.Action getAction()

 The action to take if a policy matches. Every action either allows or denies a request,
 and can also carry out action-specific operations.
 Actions:
  * ``ALLOW``: Allows the request if and only if there is a policy that matches
    the request.
  * ``DENY``: Allows the request if and only if there are no policies that
    match the request.
  * ``LOG``: Allows all requests. If at least one policy matches, the dynamic
    metadata key ``access_log_hint`` is set to the value ``true`` under the shared
    key namespace ``envoy.common``. If no policies match, it is set to ``false``.
    Other actions do not modify this key.

.envoy.config.rbac.v3.RBAC.Action action = 1 [(.validate.rules) = { ... }

Specified by:: getAction in interface RBACOrBuilder
Returns:: The action.