kubesphere/vendor/istio.io/api/rbac/v1alpha1/istio.rbac.v1alpha1.pb.html

---
title: istio.rbac.v1alpha1
layout: protoc-gen-docs
generator: protoc-gen-docs
schema: istio.rbac.v1alpha1.RbacConfig
schema: istio.rbac.v1alpha1.ServiceRole
schema: istio.rbac.v1alpha1.ServiceRoleBinding
number_of_entries: 0
---
<p>Note: The v1alpha1 RBAC policy is deprecated by the v1beta1 Authorization policy.
This page is kept for migration purpose and will be removed in Istio 1.6.</p>

<p>Istio RBAC (Role Based Access Control) defines ServiceRole and ServiceRoleBinding
objects.</p>

<p>A ServiceRole specification includes a list of rules (permissions). Each rule has
the following standard fields:</p>

<ul>
<li>services: a list of services.</li>
<li>methods: A list of HTTP methods. You can set the value to <code>[&quot;*&quot;]</code> to include all HTTP methods.
         This field should not be set for TCP services. The policy will be ignored.
         For gRPC services, only <code>POST</code> is allowed; other methods will result in denying services.</li>
<li>paths: HTTP paths or gRPC methods. Note that gRPC methods should be
presented in the form of &ldquo;/packageName.serviceName/methodName&rdquo; and are case sensitive.</li>
</ul>

<p>In addition to the standard fields, operators can also use custom keys in the <code>constraints</code> field,
the supported keys are listed in the &ldquo;constraints and properties&rdquo; page.</p>

<p>Below is an example of ServiceRole object &ldquo;product-viewer&rdquo;, which has &ldquo;read&rdquo; (&ldquo;GET&rdquo; and &ldquo;HEAD&rdquo;)
access to &ldquo;products.svc.cluster.local&rdquo; service at versions &ldquo;v1&rdquo; and &ldquo;v2&rdquo;. &ldquo;path&rdquo; is not specified,
so it applies to any path in the service.</p>

<pre><code class="language-yaml">apiVersion: &quot;rbac.istio.io/v1alpha1&quot;
kind: ServiceRole
metadata:
  name: products-viewer
  namespace: default
spec:
  rules:
  - services: [&quot;products.svc.cluster.local&quot;]
    methods: [&quot;GET&quot;, &quot;HEAD&quot;]
    constraints:
    - key: &quot;destination.labels[version]&quot;
      values: [&quot;v1&quot;, &quot;v2&quot;]
</code></pre>

<p>A ServiceRoleBinding specification includes two parts:</p>

<ul>
<li>The <code>roleRef</code> field that refers to a ServiceRole object in the same namespace.</li>
<li>A list of <code>subjects</code> that are assigned the roles.</li>
</ul>

<p>In addition to a simple <code>user</code> field, operators can also use custom keys in the <code>properties</code> field,
the supported keys are listed in the &ldquo;constraints and properties&rdquo; page.</p>

<p>Below is an example of ServiceRoleBinding object &ldquo;test-binding-products&rdquo;, which binds two subjects
to ServiceRole &ldquo;product-viewer&rdquo;:</p>

<ul>
<li>User &ldquo;alice@yahoo.com&rdquo;</li>
<li>Services in &ldquo;abc&rdquo; namespace.</li>
</ul>

<pre><code class="language-yaml">apiVersion: &quot;rbac.istio.io/v1alpha1&quot;
kind: ServiceRoleBinding
metadata:
  name: test-binding-products
  namespace: default
spec:
  subjects:
  - user: alice@yahoo.com
  - properties:
      source.namespace: &quot;abc&quot;
  roleRef:
    kind: ServiceRole
    name: &quot;products-viewer&quot;
</code></pre>