| Attachment | Type URL (@type) | Per-route override | Build feature |
|---|---|---|---|
Filter chain (filters) | type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC | Not applicable | None |
What it does
Network RBAC decides per connection, before any bytes reach the terminal filter, using only L4 facts: the client address, the destination address and port, and the TLS SNI. A denied connection is closed without a response. For request-level decisions on headers, use the HTTP RBAC filter instead.
Minimal configuration
The fragment sits under filter_chains[].filters, before the terminal filter:
- name: rbac
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
rules:
action: ALLOW
policies:
internal-only:
permissions:
- any: true
principals:
- direct_remote_ip:
address_prefix: 10.0.0.0
prefix_len: 8Fields
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
rules.action | enum | Yes | — | ALLOW (only matching connections pass) or DENY (matching connections are dropped). LOG is rejected. |
rules.policies | map | Yes | — | Named policies; a policy matches when any permission and any principal match. Policies are evaluated in lexical order of their names. |
stat_prefix | string | No | — | Accepted for Envoy compatibility but ignored; Arion logs a warning. |
Shadow rules, matchers, enforcement_type and policy condition expressions are unsupported and refused at startup.
Permissions
| Kind | Value | Description |
|---|---|---|
any | true | Matches every connection. |
destination_ip | CIDR | Matches the local (destination) address. |
destination_port | uint16 | Matches the destination port. |
destination_port_range | {start, end} | Matches start <= port < end. |
requested_server_name | string matcher | Matches the TLS SNI (exact, prefix, suffix, contains or safe_regex). Requires a TLS inspector; without SNI it never matches. |
Principals
| Kind | Value | Description |
|---|---|---|
any | true | Matches every client. |
direct_remote_ip | CIDR | Matches the client address of the connection (the proxy-protocol-restored address when that filter is configured). |
Ordering and interactions
Several RBAC filters may appear in one chain and every one must permit the connection; all must precede the terminal filter. At runtime RBAC runs after the connection limit and rate limit checks, and before the terminal filter starts reading.