rbac: clarify rbac empty rules means deny (#16870)

Risk Level: N/A
Testing: N/A
Docs Changes: docs only
Release Notes: N/A
Signed-off-by: Rama Chavali <rama.rao@salesforce.com>

Mirrored from https://github.com/envoyproxy/envoy @ 4f5c279cb40866065ad6551e4ac0f372ad07bf6f

envoy/extensions/filters/http/rbac/v3/rbac.proto

@@ -23,6 +23,7 @@ message RBAC {
 
   // Specify the RBAC rules to be applied globally.
   // If absent, no enforcing RBAC policy will be applied.
+  // If present and empty, DENY.
   config.rbac.v3.RBAC rules = 1;
 
   // Shadow rules are not enforced by the filter (i.e., returning a 403)

envoy/extensions/filters/http/rbac/v4alpha/rbac.proto

@@ -23,6 +23,7 @@ message RBAC {
 
   // Specify the RBAC rules to be applied globally.
   // If absent, no enforcing RBAC policy will be applied.
+  // If present and empty, DENY.
   config.rbac.v4alpha.RBAC rules = 1;
 
   // Shadow rules are not enforced by the filter (i.e., returning a 403)

envoy/extensions/filters/network/rbac/v3/rbac.proto

@@ -39,6 +39,7 @@ message RBAC {
 
   // Specify the RBAC rules to be applied globally.
   // If absent, no enforcing RBAC policy will be applied.
+  // If present and empty, DENY.
   config.rbac.v3.RBAC rules = 1;
 
   // Shadow rules are not enforced by the filter but will emit stats and logs

envoy/extensions/filters/network/rbac/v4alpha/rbac.proto

@@ -39,6 +39,7 @@ message RBAC {
 
   // Specify the RBAC rules to be applied globally.
   // If absent, no enforcing RBAC policy will be applied.
+  // If present and empty, DENY.
   config.rbac.v4alpha.RBAC rules = 1;
 
   // Shadow rules are not enforced by the filter but will emit stats and logs