envoyproxy/envoy

rbac: support match based on destination cluster

Open

#4,455 opened on Sep 18, 2018

View on GitHub
 (22 comments) (1 reaction) (0 assignees)C++ (5,373 forks)batch import
design proposalhelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

Description: Envoy can route traffic to clusters based on external given input, e.g. cluster_header in http_conn_manager, and there will be similar proposal for TCP in #4444. We should disallow traffic from listeners going to certain clusters, e.g. xDS API cluster (especially SDS), ratelimit cluster, ext_authz cluster etc.

cc @rshriram

Relevant Links: https://github.com/envoyproxy/envoy/pull/4444#discussion_r218427696

Contributor guide

Research direction
Study Envoy's RBAC implementation and the destination cluster matching logic in the route configuration. Review the referenced PR #4444 for TCP cluster header proposal. Understand how to integrate RBAC with cluster header and similar mechanisms.
Tech stack
cpp
Domain
backendnetworking
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
C++Envoy internals
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40