Well Known Dynamic Metadata

Filters can emit dynamic metadata via the setDynamicMetadata routine in the StreamInfo interface on a Connection. This metadata emitted by a filter can be consumed by other filters and useful features can be built by stacking such filters. For example, a logging filter can consume dynamic metadata from an RBAC filter to log details about runtime shadow rule behavior. Another example is where an RBAC filter permits/restricts MySQL/MongoDB operations by looking at the operational metadata emitted by the MongoDB filter.

The following Envoy filters emit dynamic metadata that other filters can leverage.

• External Authorization Filter

• External Authorization Network Filter

• Header-To-Metadata Filter

• JWT Authentication Filter for the extracted header and payload

• Mongo Proxy Filter

• MySQL Proxy Filter

• Postgres Proxy Filter

• Role Based Access Control (RBAC) Filter

• Role Based Access Control (RBAC) Network Filter

• ZooKeeper Proxy Filter

The following Envoy filters can be configured to consume dynamic metadata emitted by other filters.

• External Authorization Filter via the metadata context namespaces

• RateLimit Filter limit override

Shared Dynamic Metadata

Dynamic metadata that is set by multiple filters is placed in the common key namespace envoy.common. Refer to the corresponding rules when setting this metadata.

Name	Type	Description	Rules
access_log_hint	boolean	Whether access loggers should log the request.	When this metadata is already set: A true value should not be overwritten by a false value, while a false value can be overwritten by a true value.

The following Envoy filters emit shared dynamic metadata.

• Role Based Access Control (RBAC) Filter

• Role Based Access Control (RBAC) Network Filter

The following filters consume shared dynamic metadata.

• Metadata Access Log Filter