Added protos to support Role Based Access Control in Envoy.
Also removed existing auth.proto because the new RBAC proto is a replacement of it.
Ealier discussions at
envoyproxy/data-plane-api#586.
Signed-off-by: Limin Wang <liminwang@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 13de384ab34428af99c53201f6b3c95991b7ae10
Implements the header matching mechanism that was added to the API in #3097 .
Risk Level: Low
Testing: Unit tests were added for the new configuration options.
Docs Changes: #3097.
Release Notes: added release note.
Signed-off-by: Matt Rice <mattrice@google.com>
Mirrored from https://github.com/envoyproxy/envoy @ 132b36cdae221dd602ebd920a1025167c3a7753a
define a access log filter to filter requests based on the
value of a specified header.
This is the initial data plane api change for the issue envoyproxy/envoy#2544.
Signed-off-by: Kevin Chan <kchan@evernote.com>
This PR includes the necessary modifications in support of envoyproxy/envoy#2828.
Added additional configuration to ext_authz.proto so that the filter is able to call an HTTP/1.1 authorization service.
In external_auth.proto, added a nested message to CheckResponse that allows the authorization service to pass additional HTTP response attributes back to the authz filter.
Signed-off-by: Gabriel <gsagula@gmail.com>
These are required to generate xDS responses from a Go binary. If they
don't exist, implementations are required to vendor the data-plane-api
with this change applied.
Signed-off-by: John Millikin <jmillikin@stripe.com>
This is a follow-up PR of #325.
I mistook to add an unnecessary field here. What actually we need is just making dog_statsd_specifier oneof field, not adding tcp_cluster_name field.
We can safely drop this field because users has ended up with
initializing errors if they had specified this field.
[critical][main] source/server/server.cc:71] error initializing configuration '/envoy.yaml': Address must be a socket or pipe
This field has
never been used in envoy repo: 7d03b231c7/source/server/config/stats/dog_statsd.cc (L19-L23)
Signed-off-by: Taiki Ono <taiki-ono@cookpad.com>
* tcp proxy: add metadata_match to tcp proxy config
This should allow the tcp proxy to target a specific subset of endpoints
in a cluster by matching on the metadata, similar to what is currently
possible in the http_connection_manager filter.
See https://github.com/envoyproxy/envoy/issues/2696
Signed-off-by: Snow Pettersen <snowp@squareup.com>
V1 configuration does not support ip tagging. This pr cleans references to IP Tagging in V1 configs.
Signed-off-by: Constance Caramanolis <ccaramanolis@lyft.com>
1) Add ability to runtime filter to configure default, divisor, and
whether independent randomness is used.
2) Also add LE to the comparison filter.
Signed-off-by: Matt Klein <mklein@lyft.com>
In the proxy we've added an Unauthorized response flag. This PR adds the same to filter access logs.
Once this PR is merged it will be possible to set the flag in source/common/access_log/grpc_access_log_impl.cc
See also, comment in envoyproxy/envoy#2415
Signed-off-by: Saurabh Mohan <saurabh+github@tigera.io>
Updates the L7 IP tagging filter proto, v1 configuration documentation and overview documentation.
Signed-off-by: Constance Caramanolis <ccaramanolis@lyft.com>
The link wasn't quite correct for linking back to the filter
documentation. This PR just point it to the right place.
Signed-off-by: Dan Norris <protochron@users.noreply.github.com>
Fix up the comments for failure_mode_allow that was incorrectly worded and caught during review envoyproxy/envoy#2416
Signed-off-by: Saurabh Mohan <saurabh+github@tigera.io>
I went through and reorganized things to make the v2 docs more
human browsable. I also did a few misc cleanups. There is a lot
more to do here which I'm hoping to find a contractor to pay to
work on, but this is a step in the right direction.
Signed-off-by: Matt Klein <mklein@lyft.com>
There are several main changes in this PR:
Create envoy.api.v2.core packages to break circular dependencies from xDS on to subpackages on to base protos.
Create individual packages for each filter and add independent versioning to each filter.
Add visibility constraints to prevent formation of dependency cycles.
Add gogoproto annotations to improve go code generation.
After moving xDS service definitions and top-level resource protos back to envoy.core.api.v2, cycles were created, since the second-level definitions depend on base protobuf definitions, and are in turn included from xDS; however xDS and base definitions are in the same package.
The solution is to split the base protos into another package, envoy.api.v2.core. That eliminates dependency cycles (validated using go-control-plane).
Added a few gogoproto annotations to improve golang code generation.
Signed-off-by: Kuat Yessenov <kuat@google.com>
data-plane-api(CircleCI)
Kchan
Shakti Das
Akhil Thampy
Dhi Aurrahman
Gabriel Sagula
Scott Weiss
jmillikin-stripe
Wayne Zhang
Taiki Ono
Yingyu Cheng
Snow Pettersen
William Thurston
Constance Caramanolis
Matt Klein
Saurabh Mohan
Daniel Hochman
Dan Norris
Brian Pane
htuch
alyssawilk
Kuat
Piotr Sikora