|
|
|
|
licenses(["notice"]) # Apache 2
|
|
|
|
|
|
|
|
|
|
load("@envoy_api//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library_internal")
|
|
|
|
|
|
|
|
|
|
api_proto_library_internal(
|
|
|
|
|
name = "rbac",
|
|
|
|
|
srcs = ["rbac.proto"],
|
filter: add conditions to access control filter (#7716)
Introduces a generic expression-based admission filter using https://github.com/google/cel-cpp.
This is a follow-up to discussion in https://github.com/envoyproxy/envoy/issues/6751.
The advantage of this approach is:
1. Un-opinionated about the policy structure since the only config is an expression. This is friendly towards control planes which can bear the complexity of translation, analysis, and evolution of policies.
2. Multi-language, CEL supports go, java, and c++ runtimes.
3. Inter-operability with other filters using request `metadata`. Companion filters can populate metadata about requests and resources that affect policy decisions.
4. Generic utility, it can be used for custom metric labels, access log entries, etc.
The dis-advantage of this approach is that its performance is lower than domain-optimized interpreters. On a fair example, the interpreter evaluates in around 1ms (see https://github.com/google/cel-cpp/blob/master/eval/tests/benchmark_test.cc#L591) vs ~150ns for hand-written C++ native code. There is space for improvement (especially if WASM can be used as a compilation target), but ultimately the generic expression form carries a cost.
Conditions are added to support RBAC filter for complementing the existing principal/permission model. They add support for the extended checks (e.g. time of query, resource-bound), but add no cost unless used.
Description: add expression-based admission filter
Risk Level: low
Testing:
Docs Changes:
Release Notes:
Signed-off-by: Kuat Yessenov <kuat@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ f90e1b08ac5b4973c45a6529780ebdd211ff901f
5 years ago
|
|
|
external_cc_proto_deps = [
|
|
|
|
|
"@com_google_googleapis//google/api/expr/v1alpha1:syntax_cc_proto",
|
|
|
|
|
],
|
|
|
|
|
external_proto_deps = [
|
|
|
|
|
"@com_google_googleapis//google/api/expr/v1alpha1:syntax_proto",
|
|
|
|
|
],
|
|
|
|
|
external_py_proto_deps = [
|
|
|
|
|
"@com_google_googleapis//google/api/expr/v1alpha1:syntax_py_proto",
|
|
|
|
|
],
|
|
|
|
|
visibility = ["//visibility:public"],
|
|
|
|
|
deps = [
|
|
|
|
|
"//envoy/api/v2/core:address",
|
|
|
|
|
"//envoy/api/v2/route",
|
|
|
|
|
"//envoy/type/matcher:metadata",
|
|
|
|
|
"//envoy/type/matcher:string",
|
|
|
|
|
],
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
api_go_proto_library(
|
|
|
|
|
name = "rbac",
|
|
|
|
|
proto = ":rbac",
|
|
|
|
|
deps = [
|
|
|
|
|
"//envoy/api/v2/core:address_go_proto",
|
|
|
|
|
"//envoy/api/v2/route:route_go_proto",
|
|
|
|
|
"//envoy/type/matcher:metadata_go_proto",
|
|
|
|
|
"//envoy/type/matcher:string_go_proto",
|
filter: add conditions to access control filter (#7716)
Introduces a generic expression-based admission filter using https://github.com/google/cel-cpp.
This is a follow-up to discussion in https://github.com/envoyproxy/envoy/issues/6751.
The advantage of this approach is:
1. Un-opinionated about the policy structure since the only config is an expression. This is friendly towards control planes which can bear the complexity of translation, analysis, and evolution of policies.
2. Multi-language, CEL supports go, java, and c++ runtimes.
3. Inter-operability with other filters using request `metadata`. Companion filters can populate metadata about requests and resources that affect policy decisions.
4. Generic utility, it can be used for custom metric labels, access log entries, etc.
The dis-advantage of this approach is that its performance is lower than domain-optimized interpreters. On a fair example, the interpreter evaluates in around 1ms (see https://github.com/google/cel-cpp/blob/master/eval/tests/benchmark_test.cc#L591) vs ~150ns for hand-written C++ native code. There is space for improvement (especially if WASM can be used as a compilation target), but ultimately the generic expression form carries a cost.
Conditions are added to support RBAC filter for complementing the existing principal/permission model. They add support for the extended checks (e.g. time of query, resource-bound), but add no cost unless used.
Description: add expression-based admission filter
Risk Level: low
Testing:
Docs Changes:
Release Notes:
Signed-off-by: Kuat Yessenov <kuat@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ f90e1b08ac5b4973c45a6529780ebdd211ff901f
5 years ago
|
|
|
"@com_google_googleapis//google/api/expr/v1alpha1:cel_go_proto",
|
|
|
|
|
],
|
|
|
|
|
)
|
