eg-security-guide
Installation
SKILL.md
Envoy Gateway Security
4-Tier RBAC Model (Gateway API)
| Role | Scope | Manages |
|---|---|---|
| Infrastructure Provider | Cluster-wide | GatewayClass, Envoy Gateway controller deployment |
| Cluster Operator | Cluster/namespace | Gateways, TLS certificates, cluster-wide policies |
| Application Admin | Namespace | Routes, SecurityPolicy, BackendTrafficPolicy for their apps |
| Application Developer | Namespace | Services, Deployments, backend configuration |
- Map these roles to Kubernetes RBAC ClusterRoles/Roles
- Principle of least privilege: developers should not create Gateways or GatewayClasses