| Attachment | Type URL (@type) | Per-route override | Build feature |
|---|---|---|---|
HTTP filter chain (http_filters) | type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC | Yes — envoy.extensions.filters.http.rbac.v3.RBACPerRoute, or envoy.config.route.v3.FilterConfig | None |
What it does
HTTP RBAC evaluates named policies against each request and either lets it continue or answers 403 ("RBAC: access denied"). At L7 the facts available are request headers — including :method, :path and :authority pseudo-headers — matched with string matchers. For connection-level facts such as client IP or SNI, use the network RBAC filter; for expression-based policies over JWT claims, use Cedar.
Minimal configuration
The fragment is an entry in http_filters, before the router:
- name: rbac
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
rules:
action: DENY
policies:
block-legacy-clients:
permissions:
- any: true
principals:
- header:
name: user-agent
string_match:
prefix: "legacy-app/"Fields
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
rules.action | enum | Yes | — | ALLOW (only matching requests pass) or DENY (matching requests get 403). LOG is rejected. |
rules.policies | map | Yes | — | Named policies, evaluated in lexical order of their names; the first whose permissions and principals both match decides. |
A policy's permissions and principals each accept two kinds:
| Kind | Value | Description |
|---|---|---|
any | true | Always matches. |
header | header matcher | name plus a string_match (exact, prefix, suffix, contains, safe_regex, each with optional ignore_case), present_match, invert_match or treat_missing_header_as_empty. |
Shadow rules, matchers, rules_stat_prefix, per-rule stats and policy condition expressions are unsupported and refused at startup.
Per-route override
Routes adjust RBAC through typed_per_filter_config, keyed by the filter's name in the chain. An RBACPerRoute with rbac replaces the policies for that route; an empty RBACPerRoute removes RBAC from the route entirely; a FilterConfig with disabled: true switches the filter off:
routes:
- match: { prefix: "/public" }
route: { cluster: api }
typed_per_filter_config:
rbac:
"@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute
rbac: {} # no rules: this route skips RBACThe override must name an existing RBAC filter, or the configuration is rejected.
Ordering and interactions
Place RBAC after JWT authentication when policies match on headers the JWT filter writes via claim_to_headers. Denied requests short-circuit the chain before the router.