Attribute Context (proto)¶

See network filter configuration overview and HTTP filter configuration overview.

service.auth.v3.AttributeContext¶

[service.auth.v3.AttributeContext proto]

An attribute is a piece of metadata that describes an activity on a network. For example, the size of an HTTP request, or the status code of an HTTP response.

Each attribute has a type and a name, which is logically defined as a proto message field of the AttributeContext. The AttributeContext is a collection of individual attributes supported by Envoy authorization system.

{
  "source": {...},
  "destination": {...},
  "request": {...},
  "context_extensions": {...},
  "metadata_context": {...}
}

source: (service.auth.v3.AttributeContext.Peer) The source of a network activity, such as starting a TCP connection. In a multi hop network activity, the source represents the sender of the last hop.

destination: (service.auth.v3.AttributeContext.Peer) The destination of a network activity, such as accepting a TCP connection. In a multi hop network activity, the destination represents the receiver of the last hop.

request: (service.auth.v3.AttributeContext.Request) Represents a network request, such as an HTTP request.

context_extensions: (repeated map<string, string>) This is analogous to http_request.headers, however these contents will not be sent to the upstream server. Context_extensions provide an extension mechanism for sending additional information to the auth server without modifying the proto definition. It maps to the internal opaque context in the filter chain.

metadata_context: (config.core.v3.Metadata) Dynamic metadata associated with the request.

service.auth.v3.AttributeContext.Peer¶

[service.auth.v3.AttributeContext.Peer proto]

This message defines attributes for a node that handles a network request. The node can be either a service or an application that sends, forwards, or receives the request. Service peers should fill in the service, principal, and labels as appropriate.

{
  "address": {...},
  "service": ...,
  "labels": {...},
  "principal": ...,
  "certificate": ...
}

address: (config.core.v3.Address) The address of the peer, this is typically the IP address. It can also be UDS path, or others.

service: (string) The canonical service name of the peer. It should be set to the HTTP x-envoy-downstream-service-cluster If a more trusted source of the service name is available through mTLS/secure naming, it should be used.

labels: (repeated map<string, string>) The labels associated with the peer. These could be pod labels for Kubernetes or tags for VMs. The source of the labels could be an X.509 certificate or other configuration.

principal

(string) The authenticated identity of this peer. For example, the identity associated with the workload such as a service account. If an X.509 certificate is used to assert the identity this field should be sourced from URI Subject Alternative Names, DNS Subject Alternate Names or Subject in that order. The primary identity should be the principal. The principal format is issuer specific.

Example: * SPIFFE format is spiffe://trust-domain/path * Google account format is https://accounts.google.com/{userid}

certificate: (string) The X.509 certificate used to authenticate the identify of this peer. When present, the certificate contents are encoded in URL and PEM format.

service.auth.v3.AttributeContext.Request¶

[service.auth.v3.AttributeContext.Request proto]

Represents a network request, such as an HTTP request.

{
  "time": {...},
  "http": {...}
}

time: (Timestamp) The timestamp when the proxy receives the first byte of the request.

http: (service.auth.v3.AttributeContext.HttpRequest) Represents an HTTP request or an HTTP-like request.

service.auth.v3.AttributeContext.HttpRequest¶

[service.auth.v3.AttributeContext.HttpRequest proto]

This message defines attributes for an HTTP request. HTTP/1.x, HTTP/2, gRPC are all considered as HTTP requests.

{
  "id": ...,
  "method": ...,
  "headers": {...},
  "path": ...,
  "host": ...,
  "scheme": ...,
  "query": ...,
  "fragment": ...,
  "size": ...,
  "protocol": ...,
  "body": ...,
  "raw_body": ...
}

id: (string) The unique ID for a request, which can be propagated to downstream systems. The ID should have low probability of collision within a single day for a specific service. For HTTP requests, it should be X-Request-ID or equivalent.

method: (string) The HTTP request method, such as GET, POST.

headers: (repeated map<string, string>) The HTTP request headers. If multiple headers share the same key, they must be merged according to the HTTP spec. All header keys must be lower-cased, because HTTP header keys are case-insensitive.

path: (string) The request target, as it appears in the first line of the HTTP request. This includes the URL path and query-string. No decoding is performed.

host: (string) The HTTP request Host or ‘Authority` header value.

scheme: (string) The HTTP URL scheme, such as http and https.

query: (string) This field is always empty, and exists for compatibility reasons. The HTTP URL query is included in path field.

fragment: (string) This field is always empty, and exists for compatibility reasons. The URL fragment is not submitted as part of HTTP requests; it is unknowable.

size: (int64) The HTTP request size in bytes. If unknown, it must be -1.

protocol

(string) The network protocol used with the request, such as “HTTP/1.0”, “HTTP/1.1”, or “HTTP/2”.

See headers.h:ProtocolStrings for a list of all possible values.

body: (string) The HTTP request body.

raw_body: (bytes) The HTTP request body in bytes. This is used instead of body when pack_as_bytes is set to true.