Overview of Authentication and Authorization Features in Envoy
summary
Covers Envoy’s jwt_authn token verification (providers, jwks URI, local vs remote keys, where to extract tokens, and endpoint-level enforcement), the in-proxy RBAC filter (action = ALLOW or DENY, policies with permission + principal + CEL conditions, and shadow mode), and the ext_authz filter (HTTP/RPC check to external service, failure_mode, metadata context, TLS). Notes performance and deployment tradeoffs: ext_authz adds latency but is more flexible, RBAC is fastest in-proxy, and recommends positive/negative tests and placing auth filters early in the chain.
AI-written summary · about
chapters (7)
- 0:00Authentication and authorization overview
- 1:04JWT token validation
- 2:53RBAC and external auth
- 4:16RBAC filter config
- 5:24External auth integration
- 7:31Layered security with filters
- 8:34Best practices and pitfalls
related talks
28mAuthorization with Envoy
33mIntro: Envoy
26mSecuring the Gateway: A Deep Dive Into Envoy Gateway's Advanced Security Pol...
33mIntro: Envoy
26mLeveraging Envoy to Implement Micro-Segmentation-Based Security Policies
33mGet to know Envoy - the modern proxy for cloud-native infrastructure - Baptiste Collard
36mAdvanced Authentication patterns at the Edge
21mDeep Dive: Envoy