Terminate TLS, prove who is calling, and decide what they are allowed to do — with JWT authentication, RBAC and Cedar policies.
Security
Secure the gateway: TLS and mTLS, secret rotation, JWT authentication, authorization with RBAC and Cedar, and CORS.
7 pages
In this group
- TLS and mTLSTerminate TLS on listeners, require client certificates, originate TLS to upstreams, and select certificate chains by SNI. Read →
- Secrets and rotationName TLS certificates and CAs as secrets, reference them from listeners and clusters, and rotate them over xDS without a restart. Read →
- JWT authenticationValidate JSON Web Tokens against local or remote JWKS, choose which routes require which provider, and forward claims to backends. Read →
- AuthorizationChoose between RBAC rules, Cedar policies, and your own ext_proc or WASM extension for deciding what a caller may do. Read →
- RBACDeclarative allow/deny policies on connections (network RBAC) and requests (HTTP RBAC), with per-route overrides. Read →
- Cedar policiesAuthorize HTTP requests with Cedar policy text evaluated in-process against the caller's JWT and the request's method, path and query. Read →
- CORSAnswer browser preflights at the gateway and control which web origins may call your API. Read →