java.lang.Object
- com.google.protobuf.AbstractMessageLite
- - com.google.protobuf.AbstractMessage
  - - com.google.protobuf.GeneratedMessage
    - - io.envoyproxy.envoy.config.rbac.v3.RBAC

All Implemented Interfaces:: com.google.protobuf.Message, com.google.protobuf.MessageLite, com.google.protobuf.MessageLiteOrBuilder, com.google.protobuf.MessageOrBuilder, RBACOrBuilder, java.io.Serializable

public final class RBAC
extends com.google.protobuf.GeneratedMessage
implements RBACOrBuilder

 Role Based Access Control (RBAC) provides service-level and method-level access control for a
 service. Requests are allowed or denied based on the ``action`` and whether a matching policy is
 found. For instance, if the action is ALLOW and a matching policy is found the request should be
 allowed.

 RBAC can also be used to make access logging decisions by communicating with access loggers
 through dynamic metadata. When the action is LOG and at least one policy matches, the
 ``access_log_hint`` value in the shared key namespace 'envoy.common' is set to ``true`` indicating
 the request should be logged.

 Here is an example of RBAC configuration. It has two policies:

 * Service account ``cluster.local/ns/default/sa/admin`` has full access to the service, and so
 does "cluster.local/ns/default/sa/superuser".

 * Any user can read (``GET``) the service at paths with prefix ``/products``, so long as the
 destination port is either 80 or 443.

 .. code-block:: yaml

 action: ALLOW
 policies:
 "service-admin":
 permissions:
 - any: true
 principals:
 - authenticated:
 principal_name:
 exact: "cluster.local/ns/default/sa/admin"
 - authenticated:
 principal_name:
 exact: "cluster.local/ns/default/sa/superuser"
 "product-viewer":
 permissions:
 - and_rules:
 rules:
 - header:
 name: ":method"
 string_match:
 exact: "GET"
 - url_path:
 path: { prefix: "/products" }
 - or_rules:
 rules:
 - destination_port: 80
 - destination_port: 443
 principals:
 - any: true

Protobuf type envoy.config.rbac.v3.RBAC

See Also:: Serialized Form

Nested Class Summary

Nested Classes
Modifier and Type	Class	Description
`static class`	`RBAC.Action`	Should we do safe-list or block-list style access control?
`static class`	`RBAC.AuditLoggingOptions`	Protobuf type `envoy.config.rbac.v3.RBAC.AuditLoggingOptions`
`static interface`	`RBAC.AuditLoggingOptionsOrBuilder`
`static class`	`RBAC.Builder`	Role Based Access Control (RBAC) provides service-level and method-level access control for a service.
`private static class`	`RBAC.PoliciesDefaultEntryHolder`

Nested classes/interfaces inherited from class com.google.protobuf.GeneratedMessage
com.google.protobuf.GeneratedMessage.ExtendableBuilder<MessageT extends com.google.protobuf.GeneratedMessage.ExtendableMessage<MessageT>,BuilderT extends com.google.protobuf.GeneratedMessage.ExtendableBuilder<MessageT,BuilderT>>, com.google.protobuf.GeneratedMessage.ExtendableMessage<MessageT extends com.google.protobuf.GeneratedMessage.ExtendableMessage<MessageT>>, com.google.protobuf.GeneratedMessage.ExtendableMessageOrBuilder<MessageT extends com.google.protobuf.GeneratedMessage.ExtendableMessage<MessageT>>, com.google.protobuf.GeneratedMessage.FieldAccessorTable, com.google.protobuf.GeneratedMessage.GeneratedExtension<ContainingT extends com.google.protobuf.Message,T extends java.lang.Object>, com.google.protobuf.GeneratedMessage.UnusedPrivateParameter

Nested classes/interfaces inherited from class com.google.protobuf.AbstractMessage
com.google.protobuf.AbstractMessage.BuilderParent

Nested classes/interfaces inherited from class com.google.protobuf.AbstractMessageLite
com.google.protobuf.AbstractMessageLite.InternalOneOfEnum

Field Summary

Fields
Modifier and Type	Field	Description
`private int`	`action_`
`static int`	`ACTION_FIELD_NUMBER`
`static int`	`AUDIT_LOGGING_OPTIONS_FIELD_NUMBER`
`private RBAC.AuditLoggingOptions`	`auditLoggingOptions_`
`private int`	`bitField0_`
`private static RBAC`	`DEFAULT_INSTANCE`
`private byte`	`memoizedIsInitialized`
`private static com.google.protobuf.Parser<RBAC>`	`PARSER`
`private com.google.protobuf.MapField<java.lang.String,Policy>`	`policies_`
`static int`	`POLICIES_FIELD_NUMBER`
`private static long`	`serialVersionUID`

Fields inherited from class com.google.protobuf.GeneratedMessage
alwaysUseFieldBuilders, unknownFields

Fields inherited from class com.google.protobuf.AbstractMessage
memoizedSize

Fields inherited from class com.google.protobuf.AbstractMessageLite
memoizedHashCode

Constructor Summary

Constructors
Modifier Constructor Description

private RBAC()

private RBAC(com.google.protobuf.GeneratedMessage.Builder<?> builder)

Method Summary

All Methods Static Methods Instance Methods Concrete Methods Deprecated Methods
Modifier and Type	Method	Description
`boolean`	`containsPolicies(java.lang.String key)`	Maps from policy name to policy.
`boolean`	`equals(java.lang.Object obj)`
`RBAC.Action`	`getAction()`	The action to take if a policy matches.
`int`	`getActionValue()`	The action to take if a policy matches.
`RBAC.AuditLoggingOptions`	`getAuditLoggingOptions()`	Audit logging options that include the condition for audit logging to happen and audit logger configurations.
`RBAC.AuditLoggingOptionsOrBuilder`	`getAuditLoggingOptionsOrBuilder()`	Audit logging options that include the condition for audit logging to happen and audit logger configurations.
`static RBAC`	`getDefaultInstance()`
`RBAC`	`getDefaultInstanceForType()`
`static com.google.protobuf.Descriptors.Descriptor`	`getDescriptor()`
`com.google.protobuf.Parser<RBAC>`	`getParserForType()`
`java.util.Map<java.lang.String,Policy>`	`getPolicies()`	Deprecated.
`int`	`getPoliciesCount()`	Maps from policy name to policy.
`java.util.Map<java.lang.String,Policy>`	`getPoliciesMap()`	Maps from policy name to policy.
`Policy`	`getPoliciesOrDefault(java.lang.String key, Policy defaultValue)`	Maps from policy name to policy.
`Policy`	`getPoliciesOrThrow(java.lang.String key)`	Maps from policy name to policy.
`int`	`getSerializedSize()`
`boolean`	`hasAuditLoggingOptions()`	Audit logging options that include the condition for audit logging to happen and audit logger configurations.
`int`	`hashCode()`
`protected com.google.protobuf.GeneratedMessage.FieldAccessorTable`	`internalGetFieldAccessorTable()`
`protected com.google.protobuf.MapFieldReflectionAccessor`	`internalGetMapFieldReflection(int number)`
`private com.google.protobuf.MapField<java.lang.String,Policy>`	`internalGetPolicies()`
`boolean`	`isInitialized()`
`static RBAC.Builder`	`newBuilder()`
`static RBAC.Builder`	`newBuilder(RBAC prototype)`
`RBAC.Builder`	`newBuilderForType()`
`protected RBAC.Builder`	`newBuilderForType(com.google.protobuf.AbstractMessage.BuilderParent parent)`
`static RBAC`	`parseDelimitedFrom(java.io.InputStream input)`
`static RBAC`	`parseDelimitedFrom(java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)`
`static RBAC`	`parseFrom(byte[] data)`
`static RBAC`	`parseFrom(byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)`
`static RBAC`	`parseFrom(com.google.protobuf.ByteString data)`
`static RBAC`	`parseFrom(com.google.protobuf.ByteString data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)`
`static RBAC`	`parseFrom(com.google.protobuf.CodedInputStream input)`
`static RBAC`	`parseFrom(com.google.protobuf.CodedInputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)`
`static RBAC`	`parseFrom(java.io.InputStream input)`
`static RBAC`	`parseFrom(java.io.InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)`
`static RBAC`	`parseFrom(java.nio.ByteBuffer data)`
`static RBAC`	`parseFrom(java.nio.ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)`
`static com.google.protobuf.Parser<RBAC>`	`parser()`
`RBAC.Builder`	`toBuilder()`
`void`	`writeTo(com.google.protobuf.CodedOutputStream output)`

Methods inherited from class com.google.protobuf.GeneratedMessage
canUseUnsafe, computeStringSize, computeStringSizeNoTag, emptyBooleanList, emptyDoubleList, emptyFloatList, emptyIntList, emptyList, emptyLongList, getAllFields, getDescriptorForType, getField, getOneofFieldDescriptor, getRepeatedField, getRepeatedFieldCount, getUnknownFields, hasField, hasOneof, internalGetMapField, isStringEmpty, makeMutableCopy, makeMutableCopy, mergeFromAndMakeImmutableInternal, newFileScopedGeneratedExtension, newInstance, newMessageScopedGeneratedExtension, parseDelimitedWithIOException, parseDelimitedWithIOException, parseUnknownField, parseUnknownFieldProto3, parseWithIOException, parseWithIOException, parseWithIOException, parseWithIOException, serializeBooleanMapTo, serializeIntegerMapTo, serializeLongMapTo, serializeStringMapTo, writeReplace, writeString, writeStringNoTag

Methods inherited from class com.google.protobuf.AbstractMessage
findInitializationErrors, getInitializationErrorString, hashFields, toString

Methods inherited from class com.google.protobuf.AbstractMessageLite
addAll, checkByteStringIsUtf8, toByteArray, toByteString, writeDelimitedTo, writeTo

Methods inherited from class java.lang.Object
clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Methods inherited from interface com.google.protobuf.MessageLite
toByteArray, toByteString, writeDelimitedTo, writeTo

Methods inherited from interface com.google.protobuf.MessageOrBuilder
findInitializationErrors, getAllFields, getDescriptorForType, getField, getInitializationErrorString, getOneofFieldDescriptor, getRepeatedField, getRepeatedFieldCount, getUnknownFields, hasField, hasOneof

Field Detail

serialVersionUID
```
private static final long serialVersionUID
```
See Also:

Constant Field Values

bitField0_
```
private int bitField0_
```

ACTION_FIELD_NUMBER
```
public static final int ACTION_FIELD_NUMBER
```
See Also:

Constant Field Values

action_
```
private int action_
```

POLICIES_FIELD_NUMBER
```
public static final int POLICIES_FIELD_NUMBER
```
See Also:

Constant Field Values

policies_

private com.google.protobuf.MapField<java.lang.String,Policy> policies_

AUDIT_LOGGING_OPTIONS_FIELD_NUMBER
```
public static final int AUDIT_LOGGING_OPTIONS_FIELD_NUMBER
```
See Also:

Constant Field Values

auditLoggingOptions_

private RBAC.AuditLoggingOptions auditLoggingOptions_

memoizedIsInitialized
```
private byte memoizedIsInitialized
```

DEFAULT_INSTANCE

private static final RBAC DEFAULT_INSTANCE

PARSER

private static final com.google.protobuf.Parser<RBAC> PARSER

Constructor Detail

RBAC

private RBAC(com.google.protobuf.GeneratedMessage.Builder<?> builder)

RBAC
```
private RBAC()
```

Method Detail

getDescriptor

public static final com.google.protobuf.Descriptors.Descriptor getDescriptor()

internalGetMapFieldReflection
```
protected com.google.protobuf.MapFieldReflectionAccessor internalGetMapFieldReflection(int number)
```
Overrides:

internalGetMapFieldReflection in class com.google.protobuf.GeneratedMessage

internalGetFieldAccessorTable
```
protected com.google.protobuf.GeneratedMessage.FieldAccessorTable internalGetFieldAccessorTable()
```
Specified by:

internalGetFieldAccessorTable in class com.google.protobuf.GeneratedMessage

getActionValue

public int getActionValue()

 The action to take if a policy matches. Every action either allows or denies a request,
 and can also carry out action-specific operations.

 Actions:

 * ``ALLOW``: Allows the request if and only if there is a policy that matches
 the request.
 * ``DENY``: Allows the request if and only if there are no policies that
 match the request.
 * ``LOG``: Allows all requests. If at least one policy matches, the dynamic
 metadata key ``access_log_hint`` is set to the value ``true`` under the shared
 key namespace ``envoy.common``. If no policies match, it is set to ``false``.
 Other actions do not modify this key.

.envoy.config.rbac.v3.RBAC.Action action = 1 [(.validate.rules) = { ... }

Specified by:: getActionValue in interface RBACOrBuilder
Returns:: The enum numeric value on the wire for action.

getAction

public RBAC.Action getAction()

 The action to take if a policy matches. Every action either allows or denies a request,
 and can also carry out action-specific operations.

 Actions:

 * ``ALLOW``: Allows the request if and only if there is a policy that matches
 the request.
 * ``DENY``: Allows the request if and only if there are no policies that
 match the request.
 * ``LOG``: Allows all requests. If at least one policy matches, the dynamic
 metadata key ``access_log_hint`` is set to the value ``true`` under the shared
 key namespace ``envoy.common``. If no policies match, it is set to ``false``.
 Other actions do not modify this key.

.envoy.config.rbac.v3.RBAC.Action action = 1 [(.validate.rules) = { ... }

Specified by:: getAction in interface RBACOrBuilder
Returns:: The action.

internalGetPolicies

private com.google.protobuf.MapField<java.lang.String,Policy> internalGetPolicies()