package envoy.extensions.filters.network.ext_authz.v3

Get desktop application:
View/edit binary Protocol Buffers messages

External Authorization filter calls out to an external service over the gRPC Authorization API defined by :ref:`CheckRequest <envoy_v3_api_msg_service.auth.v3.CheckRequest>`. A failed check will cause this filter to close the TCP connection. [#next-free-field: 9]

• string stat_prefix = 1

  The prefix to use when emitting statistics.

• optional config.core.v3.GrpcService grpc_service = 2

  The external authorization gRPC service configuration. The default timeout is set to 200ms by this filter.

• bool failure_mode_allow = 3

  The filter's behaviour in case the external authorization service does not respond back. When it is set to true, Envoy will also allow traffic in case of communication failure between authorization service and the proxy. Defaults to false.

• bool include_peer_certificate = 4

  Specifies if the peer certificate is sent to the external service. When this field is true, Envoy will include the peer X.509 certificate, if available, in the :ref:`certificate<envoy_v3_api_field_service.auth.v3.AttributeContext.Peer.certificate>`.

• config.core.v3.ApiVersion transport_api_version = 5

  API version for ext_authz transport protocol. This describes the ext_authz gRPC endpoint and version of Check{Request,Response} used on the wire.

• optional type.matcher.v3.MetadataMatcher filter_enabled_metadata = 6

  Specifies if the filter is enabled with metadata matcher. If this field is not specified, the filter will be enabled for all requests.

• string bootstrap_metadata_labels_key = 7

  Optional labels that will be passed to :ref:`labels<envoy_v3_api_field_service.auth.v3.AttributeContext.Peer.labels>` in :ref:`destination<envoy_v3_api_field_service.auth.v3.AttributeContext.destination>`. The labels will be read from :ref:`metadata<envoy_v3_api_msg_config.core.v3.Node>` with the specified key.

• bool include_tls_session = 8

  Specifies if the TLS session level details like SNI are sent to the external service. When this field is true, Envoy will include the SNI name used for TLSClientHello, if available, in the :ref:`tls_session<envoy_v3_api_field_service.auth.v3.AttributeContext.tls_session>`.