syntax = "proto3";

package envoy.extensions.filters.network.rbac.v3;

import "envoy/config/rbac/v3/rbac.proto";

import "google/protobuf/duration.proto";

import "xds/annotations/v3/status.proto";
import "xds/type/matcher/v3/matcher.proto";

import "udpa/annotations/migrate.proto";
import "udpa/annotations/status.proto";
import "udpa/annotations/versioning.proto";
import "validate/validate.proto";

option java_package = "io.envoyproxy.envoy.extensions.filters.network.rbac.v3";
option java_outer_classname = "RbacProto";
option java_multiple_files = true;
option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/rbac/v3;rbacv3";
option (udpa.annotations.file_status).package_version_status = ACTIVE;

// [#protodoc-title: RBAC]
// Role-Based Access Control :ref:`configuration overview <config_network_filters_rbac>`.
// [#extension: envoy.filters.network.rbac]

// RBAC network filter config.
//
// Header should not be used in rules/shadow_rules in RBAC network filter as
// this information is only available in :ref:`RBAC http filter <config_http_filters_rbac>`.
// [#next-free-field: 9]
message RBAC {
  option (udpa.annotations.versioning).previous_message_type =
      "envoy.config.filter.network.rbac.v2.RBAC";

  enum EnforcementType {
    // Apply RBAC policies when the first byte of data arrives on the connection.
    ONE_TIME_ON_FIRST_BYTE = 0;

    // Continuously apply RBAC policies as data arrives. Use this mode when
    // using RBAC with message oriented protocols such as Mongo, MySQL, Kafka,
    // etc. when the protocol decoders emit dynamic metadata such as the
    // resources being accessed and the operations on the resources.
    CONTINUOUS = 1;
  }

  // Specify the RBAC rules to be applied globally.
  // If absent, no enforcing RBAC policy will be applied.
  // If present and empty, DENY.
  // If both rules and matcher are configured, rules will be ignored.
  config.rbac.v3.RBAC rules = 1
      [(udpa.annotations.field_migrate).oneof_promotion = "rules_specifier"];

  // The match tree to use when resolving RBAC action for incoming connections. Connections do
  // not match any matcher will be denied.
  // If absent, no enforcing RBAC matcher will be applied.
  // If present and empty, deny all connections.
  xds.type.matcher.v3.Matcher matcher = 6 [
    (udpa.annotations.field_migrate).oneof_promotion = "rules_specifier",
    (xds.annotations.v3.field_status).work_in_progress = true
  ];

  // Shadow rules are not enforced by the filter but will emit stats and logs
  // and can be used for rule testing.
  // If absent, no shadow RBAC policy will be applied.
  // If both shadow rules and shadow matcher are configured, shadow rules will be ignored.
  config.rbac.v3.RBAC shadow_rules = 2
      [(udpa.annotations.field_migrate).oneof_promotion = "shadow_rules_specifier"];

  // The match tree to use for emitting stats and logs which can be used for rule testing for
  // incoming connections.
  // If absent, no shadow matcher will be applied.
  xds.type.matcher.v3.Matcher shadow_matcher = 7 [
    (udpa.annotations.field_migrate).oneof_promotion = "shadow_rules_specifier",
    (xds.annotations.v3.field_status).work_in_progress = true
  ];

  // If specified, shadow rules will emit stats with the given prefix.
  // This is useful to distinguish the stat when there are more than 1 RBAC filter configured with
  // shadow rules.
  string shadow_rules_stat_prefix = 5;

  // The prefix to use when emitting statistics.
  string stat_prefix = 3 [(validate.rules).string = {min_len: 1}];

  // RBAC enforcement strategy. By default RBAC will be enforced only once
  // when the first byte of data arrives from the downstream. When used in
  // conjunction with filters that emit dynamic metadata after decoding
  // every payload (e.g., Mongo, MySQL, Kafka) set the enforcement type to
  // CONTINUOUS to enforce RBAC policies on every message boundary.
  EnforcementType enforcement_type = 4;

  // Delay the specified duration before closing the connection when the policy evaluation
  // result is ``DENY``. If this is not present, the connection will be closed immediately.
  // This is useful to provide a better protection for Envoy against clients that retries
  // aggressively when the connection is rejected by the RBAC filter.
  google.protobuf.Duration delay_deny = 8;
}
