Skip to content

docs: add a note on Network RBAC usage with TCP Proxy to delay connect#42392

Merged
agrawroh merged 1 commit intoenvoyproxy:mainfrom
agrawroh:docs-rbac
Dec 8, 2025
Merged

docs: add a note on Network RBAC usage with TCP Proxy to delay connect#42392
agrawroh merged 1 commit intoenvoyproxy:mainfrom
agrawroh:docs-rbac

Conversation

@agrawroh
Copy link
Copy Markdown
Member

@agrawroh agrawroh commented Dec 4, 2025

Description

This PR add documentation on how upstream_connect_mode in the TCP Proxy filter could be used to make sure that we wait for RBAC enforcement to complete before opening a connection to the backend.

Fix #9023


Commit Message: docs: add a note on Network RBAC usage with TCP Proxy to delay connect
Additional Description: Added documentation on how upstream_connect_mode in the TCP Proxy filter could be used to make sure that we wait for RBAC enforcement to complete before opening a connection to the backend.
Risk Level: N/A
Testing: CI
Docs Changes: Added
Release Notes: N/A

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>
@repokitteh-read-only
Copy link
Copy Markdown

Docs for this Pull Request will be rendered here:

https://storage.googleapis.com/envoy-cncf-pr/42392/docs/index.html

The docs are (re-)rendered each time the CI Envoy/Prechecks (docs) job completes.

🐱

Caused by: #42392 was opened by agrawroh.

see: more, trace.

@repokitteh-read-only
Copy link
Copy Markdown

As a reminder, PRs marked as draft will not be automatically assigned reviewers,
or be handled by maintainer-oncall triage.

Please mark your PR as ready when you want it to be reviewed!

🐱

Caused by: #42392 was opened by agrawroh.

see: more, trace.

@agrawroh agrawroh marked this pull request as ready for review December 4, 2025 10:38
@agrawroh agrawroh merged commit a424a6a into envoyproxy:main Dec 8, 2025
25 checks passed
grnmeira pushed a commit to grnmeira/envoy that referenced this pull request Mar 20, 2026
envoyproxy#42392)

## Description

This PR add documentation on how `upstream_connect_mode` in the TCP
Proxy filter could be used to make sure that we wait for RBAC
enforcement to complete before opening a connection to the backend.

Fix envoyproxy#9023

---

**Commit Message:** docs: add a note on Network RBAC usage with TCP
Proxy to delay connect
**Additional Description:** Added documentation on how
`upstream_connect_mode` in the TCP Proxy filter could be used to make
sure that we wait for RBAC enforcement to complete before opening a
connection to the backend.
**Risk Level:** N/A
**Testing:** CI
**Docs Changes:** Added
**Release Notes:** N/A

Signed-off-by: Rohit Agrawal <rohit.agrawal@databricks.com>
Signed-off-by: Gustavo <grnmeira@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

when network.rbac filter is used in combination with tcp_proxy, connection to the upstream is established in any case, even if RBAC decision is Deny

2 participants