Package akka.javasdk.annotations

Annotation Interface Acl.Matcher

Enclosing class:
Acl
@Target({TYPE,METHOD}) @Retention(RUNTIME) @Documented public static @interface Acl.Matcher
A principal matcher that can be used in an ACL.

A principal is a very broad concept. It can correlate to a person, a system, or a more abstract concept, such as the internet.

A single request may have multiple principals associated with it, for example, it may have come from a particular source system, and it may have certain credentials associated with it. When a matcher is applied to the request, the request is considered to match if at least one of the principals attached to the request matches.

Each Matcher can be configured with exactly one of 'service', 'spiffe' or 'principal'.

  • Optional Element Summary

    Optional Elements
    Modifier and Type
    Optional Element
    Description
    Acl.Principal
    principal
    A principal matcher that can be specified with no additional configuration.
    String
    service
    Match a service principal.
    String
    spiffe
    Match a calling component by its SPIFFE identity, allowing component-level rules such as all components of a service, all components of a given type, or one specific component.

  • Element Details

    • service

      String service
      Match a service principal.

      This matches a service in the same project.

      Supports glob matching, that is, * means all services in this project.

      Default:
      ""

    • spiffe

      String spiffe
      Match a calling component by its SPIFFE identity, allowing component-level rules such as all components of a service, all components of a given type, or one specific component.

      Supports segment-aware glob matching over the /-separated path: * matches within a single path segment, and ** (only allowed as the final token) matches across segments. The pattern is matched against the component-path suffix of the caller's SPIFFE id, i.e. svc/<service>/<component-type>/<component-id>. For example svc/shopping-cart/workflow/checkout for a single component, svc/shopping-cart/** for all components of a service, or svc/*/agent/* for all agents of any service. Only components that make outbound calls (such as workflows and agents) appear as callers.

      Only requests from in-mesh peers carry a SPIFFE identity (internet/ingress callers never match). The svc/<service> part is authenticated; the <component-type>/<component-id> part is self-asserted by the calling service.

      Default:
      ""

    • principal

      Acl.Principal principal
      A principal matcher that can be specified with no additional configuration.
      Default:
      UNSPECIFIED