Skip to main content

authz_extensions

Creates, updates, deletes, gets or lists an authz_extensions resource.

Overview​

Nameauthz_extensions
TypeResource
Idgoogle.networkservices.authz_extensions

Fields​

The following fields are returned by SELECT queries:

NameDatatypeDescription
namestringRequired. Identifier. Name of the AuthzExtension resource in the following format: projects/{project}/locations/{location}/authzExtensions/{authz_extension}.
authoritystringOptional. The :authority header in the gRPC request sent from Envoy to the extension service. It is required when the service field points to a backend service.
createTimestring (google-datetime)Output only. The timestamp when the resource was created.
descriptionstringOptional. A human-readable description of the resource.
failOpenbooleanOptional. Determines how the proxy behaves if the call to the extension fails or times out. When set to TRUE, request or response processing continues without error. Any subsequent extensions in the extension chain are also executed. When set to FALSE or the default setting of FALSE is used, one of the following happens: * If response headers have not been delivered to the downstream client, a generic 500 error is returned to the client. The error response can be tailored by configuring a custom error response in the load balancer. * If response headers have been delivered, then the HTTP stream to the downstream client is reset.
forwardAttributesarrayOptional. List of the Envoy attributes to forward to the extension server. The attributes provided here are included as part of the ProcessingRequest.attributes field (of type map), where the keys are the attribute names. Refer to the documentation for the names of attributes that can be forwarded. If omitted, no attributes are sent. Each element is a string indicating the attribute name.
forwardHeadersarrayOptional. List of the HTTP headers to forward to the extension (from the client). If omitted, all headers are sent. Each element is a string indicating the header name.
labelsobjectOptional. Set of labels associated with the AuthzExtension resource. The format must comply with the requirements for labels for Google Cloud resources.
loadBalancingSchemestringOptional. All backend services and forwarding rules referenced by this extension must share the same load balancing scheme. The supported values are INTERNAL_MANAGED and EXTERNAL_MANAGED. You can omit this field for AuthzExtensions resources that don't reference a backend service. For more information, see Backend services overview. (LOAD_BALANCING_SCHEME_UNSPECIFIED, INTERNAL_MANAGED, EXTERNAL_MANAGED)
metadataobjectOptional. The metadata provided here is included as part of the metadata_context (of type google.protobuf.Struct) in the ProcessingRequest message sent to the extension server. The metadata is available under the namespace com.google.authz_extension.. The following variables are supported in the metadata Struct: {forwarding_rule_id} - substituted with the forwarding rule's fully qualified resource name.
servicestringRequired. The reference to the service that runs the extension. To configure a callout extension: For global AuthzExtension, service must be a fully-qualified reference to a backend service in the format: https://www.googleapis.com/compute/v1/projects/{project}/global/backendServices/{backendService}. For regional AuthzExtension, service must be a fully-qualified reference to one of the following: * a backend service in the format: https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/backendServices/{backendService}. * a fully qualified domain name that can be resolved by the Google Cloud DNS. * iap.googleapis.com and it can only be referenced by an AuthzPolicy with the policyProfile set to REQUEST_AUTHZ. * modelarmor..rep.googleapis.com and it can only be referenced by an AuthzPolicy with the policyProfile set to CONTENT_AUTHZ.
timeoutstring (google-duration)Required. Specifies the timeout for each individual message on the stream. The timeout must be between 10-10000 milliseconds.
updateTimestring (google-datetime)Output only. The timestamp when the resource was updated.
wireFormatstringOptional. The format of communication supported by the callout extension. This field is supported only for regional AuthzExtension resources. If not specified, the default value EXT_PROC_GRPC is used. Global AuthzExtension resources use the EXT_PROC_GRPC wire format. (WIRE_FORMAT_UNSPECIFIED, EXT_PROC_GRPC, EXT_AUTHZ_GRPC)

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
getselectprojectsId, locationsId, authzExtensionsIdGets details of the specified AuthzExtension resource.
listselectprojectsId, locationsIdpageSize, pageToken, filter, orderByLists AuthzExtension resources in a given project and location.
createinsertprojectsId, locationsIdauthzExtensionId, requestIdCreates a new AuthzExtension resource in a given project and location.
patchupdateprojectsId, locationsId, authzExtensionsIdupdateMask, requestIdUpdates the parameters of the specified AuthzExtension resource.
deletedeleteprojectsId, locationsId, authzExtensionsIdrequestIdDeletes the specified AuthzExtension resource.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
authzExtensionsIdstring
locationsIdstring
projectsIdstring
authzExtensionIdstring
filterstring
orderBystring
pageSizeinteger (int32)
pageTokenstring
requestIdstring
updateMaskstring (google-fieldmask)

SELECT examples​

Gets details of the specified AuthzExtension resource.

SELECT
name,
authority,
createTime,
description,
failOpen,
forwardAttributes,
forwardHeaders,
labels,
loadBalancingScheme,
metadata,
service,
timeout,
updateTime,
wireFormat
FROM google.networkservices.authz_extensions
WHERE projectsId = '{{ projectsId }}' -- required
AND locationsId = '{{ locationsId }}' -- required
AND authzExtensionsId = '{{ authzExtensionsId }}' -- required
;

INSERT examples​

Creates a new AuthzExtension resource in a given project and location.

INSERT INTO google.networkservices.authz_extensions (
data__name,
data__description,
data__labels,
data__loadBalancingScheme,
data__authority,
data__service,
data__timeout,
data__failOpen,
data__metadata,
data__forwardHeaders,
data__forwardAttributes,
data__wireFormat,
projectsId,
locationsId,
authzExtensionId,
requestId
)
SELECT 
'{{ name }}',
'{{ description }}',
'{{ labels }}',
'{{ loadBalancingScheme }}',
'{{ authority }}',
'{{ service }}',
'{{ timeout }}',
{{ failOpen }},
'{{ metadata }}',
'{{ forwardHeaders }}',
'{{ forwardAttributes }}',
'{{ wireFormat }}',
'{{ projectsId }}',
'{{ locationsId }}',
'{{ authzExtensionId }}',
'{{ requestId }}'
RETURNING
name,
done,
error,
metadata,
response
;

UPDATE examples​

Updates the parameters of the specified AuthzExtension resource.

UPDATE google.networkservices.authz_extensions
SET 
data__name = '{{ name }}',
data__description = '{{ description }}',
data__labels = '{{ labels }}',
data__loadBalancingScheme = '{{ loadBalancingScheme }}',
data__authority = '{{ authority }}',
data__service = '{{ service }}',
data__timeout = '{{ timeout }}',
data__failOpen = {{ failOpen }},
data__metadata = '{{ metadata }}',
data__forwardHeaders = '{{ forwardHeaders }}',
data__forwardAttributes = '{{ forwardAttributes }}',
data__wireFormat = '{{ wireFormat }}'
WHERE 
projectsId = '{{ projectsId }}' --required
AND locationsId = '{{ locationsId }}' --required
AND authzExtensionsId = '{{ authzExtensionsId }}' --required
AND updateMask = '{{ updateMask}}'
AND requestId = '{{ requestId}}'
RETURNING
name,
done,
error,
metadata,
response;

DELETE examples​

Deletes the specified AuthzExtension resource.

DELETE FROM google.networkservices.authz_extensions
WHERE projectsId = '{{ projectsId }}' --required
AND locationsId = '{{ locationsId }}' --required
AND authzExtensionsId = '{{ authzExtensionsId }}' --required
AND requestId = '{{ requestId }}'
;