RBAC Config deserialization code

Luigi_Ferrettino · July 30, 2020, 9:38am

Can someone point me to how Envoy uses the RBAC config YAML in order to build the effective filters and policies in the proxy? I am trying to find it on GitHub, but I can’t! Thanks.

incfly · August 6, 2020, 9:06pm

github.com

istio/istio/blob/9939ad57ed0e7154df6637948bc7b2b3e0ce4201/pilot/pkg/networking/plugin/authz/authorization.go#L90


	if in.Push == nil || in.Push.AuthzPolicies == nil {
		authzLog.Debugf("no authorization policy in push context")
		return
	}

	// TODO: Get trust domain from MeshConfig instead.
	// https://github.com/istio/istio/issues/17873
	tdBundle := trustdomain.NewBundle(spiffe.GetTrustDomain(), in.Push.Mesh.TrustDomainAliases)
	namespace := in.Node.ConfigNamespace
	workload := labels.Collection{in.Node.Metadata.Labels}
	b := builder.New(tdBundle, workload, namespace, in.Push.AuthzPolicies, util.IsIstioVersionGE15(in.Node))
	if b == nil {
		authzLog.Debugf("no authorization policy for workload %v in %s", workload, namespace)
		return
	}

	switch in.ListenerProtocol {
	case networking.ListenerProtocolTCP:
		authzLog.Debugf("building filter for TCP listener protocol")
		tcpFilters := b.BuildTCP()
		if in.Node.Type == model.Router {

You can start from here.

Topic		Replies	Views
Correct config for EnvoyFilter ext.authz	2	2544	June 12, 2020
EnvoyFilter - ext_authz for istio 1.3 Security	1	2142	November 19, 2019
Helped needed creating Envoy-Filter Config	2	755	April 9, 2020
Envoy.ext_authz filter config for Istio 1.1.3 Networking	4	2484	January 15, 2020
EnvoyFilter for ext-authz Security	5	2040	August 26, 2019

RBAC Config deserialization code

Related Topics