extensions_metadata.yaml

envoy.access_loggers.file:
  categories:
  - envoy.access_loggers
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.access_loggers.file.v3.FileAccessLog
envoy.access_loggers.extension_filters.cel:
  categories:
  - envoy.access_loggers.extension_filters
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.access_loggers.filters.cel.v3.ExpressionFilter
envoy.access_loggers.fluentd:
  categories:
  - envoy.access_loggers
  security_posture: robust_to_untrusted_downstream
  status: alpha
  type_urls:
  - envoy.extensions.access_loggers.fluentd.v3.FluentdAccessLogConfig
envoy.access_loggers.http_grpc:
  categories:
  - envoy.access_loggers
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.access_loggers.grpc.v3.HttpGrpcAccessLogConfig
envoy.access_loggers.open_telemetry:
  categories:
  - envoy.access_loggers
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig
envoy.access_loggers.stdout:
  categories:
  - envoy.access_loggers
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
envoy.access_loggers.stderr:
  categories:
  - envoy.access_loggers
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.access_loggers.stream.v3.StderrAccessLog
envoy.access_loggers.tcp_grpc:
  categories:
  - envoy.access_loggers
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.access_loggers.grpc.v3.TcpGrpcAccessLogConfig
envoy.access_loggers.wasm:
  categories:
  - envoy.access_loggers
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.access_loggers.wasm.v3.WasmAccessLog
envoy.bootstrap.internal_listener:
  categories:
  - envoy.bootstrap
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.bootstrap.internal_listener.v3.InternalListener
envoy.bootstrap.wasm:
  categories:
  - envoy.bootstrap
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.wasm.v3.WasmService
envoy.extensions.http.cache.file_system_http_cache:
  categories:
  - envoy.http.cache
  security_posture: unknown
  status: wip
  type_urls:
  - envoy.extensions.http.cache.file_system_http_cache.v3.FileSystemHttpCacheConfig
envoy.extensions.http.cache.simple:
  categories:
  - envoy.http.cache
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: wip
  type_urls:
  - envoy.extensions.http.cache.simple_http_cache.v3.SimpleHttpCacheConfig
envoy.clusters.aggregate:
  categories:
  - envoy.clusters
  security_posture: requires_trusted_downstream_and_upstream
  status: stable
envoy.clusters.dynamic_forward_proxy:
  categories:
  - envoy.clusters
  security_posture: robust_to_untrusted_downstream
  status: stable
envoy.clusters.static:
  categories:
  - envoy.clusters
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
envoy.clusters.strict_dns:
  categories:
  - envoy.clusters
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
envoy.clusters.original_dst:
  categories:
  - envoy.clusters
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
envoy.clusters.eds:
  categories:
  - envoy.clusters
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
envoy.clusters.redis:
  categories:
  - envoy.clusters
  security_posture: requires_trusted_downstream_and_upstream
  status: stable
envoy.clusters.logical_dns:
  categories:
  - envoy.clusters
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
envoy.compression.brotli.compressor:
  categories:
  - envoy.compression.compressor
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.compression.brotli.compressor.v3.Brotli
envoy.compression.brotli.decompressor:
  categories:
  - envoy.compression.decompressor
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.compression.brotli.decompressor.v3.Brotli
envoy.compression.gzip.compressor:
  categories:
  - envoy.compression.compressor
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.compression.gzip.compressor.v3.Gzip
envoy.compression.gzip.decompressor:
  categories:
  - envoy.compression.decompressor
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.compression.gzip.decompressor.v3.Gzip
envoy.compression.zstd.compressor:
  categories:
  - envoy.compression.compressor
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.compression.zstd.compressor.v3.Zstd
envoy.compression.zstd.decompressor:
  categories:
  - envoy.compression.decompressor
  security_posture: requires_trusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.compression.zstd.decompressor.v3.Zstd
envoy.config.validators.minimum_clusters_validator:
  categories:
  - envoy.config.validators
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.config.validators.minimum_clusters.v3.MinimumClustersValidator
envoy.filters.http.adaptive_concurrency:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.filters.http.adaptive_concurrency.v3.AdaptiveConcurrency
envoy.filters.http.admission_control:
  categories:
  - envoy.filters.http
  - envoy.filters.http.upstream
  security_posture: unknown
  status: stable
  status_upstream: alpha
  type_urls:
  - envoy.extensions.filters.http.admission_control.v3.AdmissionControl
envoy.filters.http.alternate_protocols_cache:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.alternate_protocols_cache.v3.FilterConfig
envoy.filters.http.aws_lambda:
  categories:
  - envoy.filters.http
  - envoy.filters.http.upstream
  security_posture: requires_trusted_downstream_and_upstream
  status: alpha
  status_upstream: alpha
  type_urls:
  - envoy.extensions.filters.http.aws_lambda.v3.Config
  - envoy.extensions.filters.http.aws_lambda.v3.PerRouteConfig
envoy.filters.http.aws_request_signing:
  categories:
  - envoy.filters.http
  - envoy.filters.http.upstream
  security_posture: requires_trusted_downstream_and_upstream
  status: alpha
  status_upstream: alpha
  type_urls:
  - envoy.extensions.filters.http.aws_request_signing.v3.AwsRequestSigning
  - envoy.extensions.filters.http.aws_request_signing.v3.AwsRequestSigningPerRoute
envoy.filters.http.bandwidth_limit:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.filters.http.bandwidth_limit.v3.BandwidthLimit
envoy.filters.http.basic_auth:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.basic_auth.v3.BasicAuth
  - envoy.extensions.filters.http.basic_auth.v3.BasicAuthPerRoute
envoy.filters.http.api_key_auth:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.api_key_auth.v3.ApiKeyAuth
  - envoy.extensions.filters.http.api_key_auth.v3.ApiKeyAuthPerRoute
envoy.filters.http.buffer:
  categories:
  - envoy.filters.http
  - envoy.filters.http.upstream
  security_posture: robust_to_untrusted_downstream
  status: stable
  status_upstream: stable
  type_urls:
  - envoy.extensions.filters.http.buffer.v3.Buffer
  - envoy.extensions.filters.http.buffer.v3.BufferPerRoute
envoy.filters.http.cache:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: wip
  type_urls:
  - envoy.extensions.filters.http.cache.v3.CacheConfig
envoy.filters.http.cdn_loop:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.cdn_loop.v3.CdnLoopConfig
envoy.filters.http.geoip:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: wip
  type_urls:
  - envoy.extensions.filters.http.geoip.v3.Geoip
envoy.filters.http.upstream_codec:
  categories:
  - envoy.filters.http.upstream
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  status_upstream: stable
  type_urls:
  - envoy.extensions.filters.http.upstream_codec.v3.UpstreamCodec
envoy.filters.http.composite:
  categories:
  - envoy.filters.http
  - envoy.filters.http.upstream
  security_posture: unknown
  status: stable
  status_upstream: alpha
  type_urls:
  - envoy.extensions.filters.http.composite.v3.Composite
envoy.filters.http.compressor:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.compressor.v3.Compressor
  - envoy.extensions.filters.http.compressor.v3.CompressorPerRoute
envoy.filters.http.connect_grpc_bridge:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.connect_grpc_bridge.v3.FilterConfig
envoy.filters.http.cors:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.cors.v3.Cors
  - envoy.extensions.filters.http.cors.v3.CorsPolicy
envoy.filters.http.credential_injector:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.credential_injector.v3.CredentialInjector
envoy.filters.http.csrf:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.csrf.v3.CsrfPolicy
envoy.filters.http.decompressor:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.decompressor.v3.Decompressor
envoy.filters.http.dynamic_forward_proxy:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.dynamic_forward_proxy.v3.FilterConfig
  - envoy.extensions.filters.http.dynamic_forward_proxy.v3.PerRouteConfig
envoy.filters.http.ext_authz:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
  - envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
envoy.filters.http.ext_proc:
  categories:
  - envoy.filters.http
  - envoy.filters.http.upstream
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  status_upstream: alpha
  type_urls:
  - envoy.extensions.filters.http.ext_proc.v3.ExtProcPerRoute
  - envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
envoy.filters.http.fault:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.fault.v3.HTTPFault
envoy.filters.http.file_system_buffer:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: wip
  type_urls:
  - envoy.extensions.filters.http.file_system_buffer.v3.FileSystemBufferFilterConfig
envoy.filters.http.gcp_authn:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig
envoy.filters.http.grpc_field_extraction:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.grpc_field_extraction.v3.GrpcFieldExtractionConfig
envoy.filters.http.grpc_http1_bridge:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.filters.http.grpc_http1_bridge.v3.Config
envoy.filters.http.grpc_http1_reverse_bridge:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.grpc_http1_reverse_bridge.v3.FilterConfig
  - envoy.extensions.filters.http.grpc_http1_reverse_bridge.v3.FilterConfigPerRoute
envoy.filters.http.grpc_json_reverse_transcoder:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.grpc_json_reverse_transcoder.v3.GrpcJsonReverseTranscoder
envoy.filters.http.grpc_json_transcoder:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder
envoy.filters.http.grpc_stats:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.filters.http.grpc_stats.v3.FilterConfig
envoy.filters.http.grpc_web:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
envoy.filters.http.header_to_metadata:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.header_to_metadata.v3.Config
envoy.filters.http.health_check:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.health_check.v3.HealthCheck
envoy.filters.http.ip_tagging:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.ip_tagging.v3.IPTagging
envoy.filters.http.json_to_metadata:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.json_to_metadata.v3.JsonToMetadata
envoy.filters.http.jwt_authn:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
  - envoy.extensions.filters.http.jwt_authn.v3.PerRouteConfig
envoy.filters.http.kill_request:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.kill_request.v3.KillRequest
envoy.filters.http.local_ratelimit:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
envoy.filters.http.lua:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.lua.v3.Lua
  - envoy.extensions.filters.http.lua.v3.LuaPerRoute
envoy.filters.http.oauth2:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.oauth2.v3.OAuth2
envoy.filters.http.on_demand:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.on_demand.v3.OnDemand
  - envoy.extensions.filters.http.on_demand.v3.PerRouteConfig
envoy.filters.http.original_src:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.original_src.v3.OriginalSrc
envoy.filters.http.proto_message_extraction:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.proto_message_extraction.v3.ProtoMessageExtractionConfig
envoy.filters.http.ratelimit:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.ratelimit.v3.RateLimit
  - envoy.extensions.filters.http.ratelimit.v3.RateLimitPerRoute
envoy.filters.http.rate_limit_quota:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: wip
  type_urls:
  - envoy.extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaFilterConfig
  - envoy.extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaOverride
  - envoy.extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaBucketSettings
envoy.filters.http.rbac:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.rbac.v3.RBAC
  - envoy.extensions.filters.http.rbac.v3.RBACPerRoute
envoy.filters.http.router:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.router.v3.Router
envoy.filters.http.set_metadata:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.filters.http.set_metadata.v3.Config
envoy.filters.http.tap:
  categories:
  - envoy.filters.http
  security_posture: requires_trusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.tap.v3.Tap
envoy.filters.http.thrift_to_metadata:
  categories:
  - envoy.filters.http
  security_posture: robust_to_untrusted_downstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.thrift_to_metadata.v3.ThriftToMetadata
envoy.filters.http.wasm:
  categories:
  - envoy.filters.http
  - envoy.filters.http.upstream
  security_posture: unknown
  status: alpha
  status_upstream: alpha
  type_urls:
  - envoy.extensions.filters.http.wasm.v3.Wasm
envoy.filters.http.stateful_session:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.stateful_session.v3.StatefulSession
  - envoy.extensions.filters.http.stateful_session.v3.StatefulSessionPerRoute
envoy.filters.http.header_mutation:
  categories:
  - envoy.filters.http
  - envoy.filters.http.upstream
  security_posture: unknown
  status: alpha
  status_upstream: alpha
  type_urls:
  - envoy.extensions.filters.http.header_mutation.v3.HeaderMutation
  - envoy.extensions.filters.http.header_mutation.v3.HeaderMutationPerRoute
envoy.filters.listener.http_inspector:
  categories:
  - envoy.filters.listener
  security_posture: requires_trusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.filters.listener.http_inspector.v3.HttpInspector
envoy.filters.listener.local_ratelimit:
  categories:
  - envoy.filters.listener
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.listener.local_ratelimit.v3.LocalRateLimit
envoy.filters.listener.original_dst:
  categories:
  - envoy.filters.listener
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.listener.original_dst.v3.OriginalDst
envoy.filters.listener.original_src:
  categories:
  - envoy.filters.listener
  security_posture: robust_to_untrusted_downstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.listener.original_src.v3.OriginalSrc
envoy.filters.listener.proxy_protocol:
  categories:
  - envoy.filters.listener
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol
envoy.filters.listener.tls_inspector:
  categories:
  - envoy.filters.listener
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
envoy.filters.network.connection_limit:
  categories:
  - envoy.filters.network
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.filters.network.connection_limit.v3.ConnectionLimit
envoy.filters.network.direct_response:
  categories:
  - envoy.filters.network
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.filters.network.direct_response.v3.Config
envoy.filters.network.dubbo_proxy:
  categories:
  - envoy.filters.network
  security_posture: requires_trusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.network.dubbo_proxy.v3.DubboProxy
envoy.filters.network.echo:
  categories:
  - envoy.filters.network
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.filters.network.echo.v3.Echo
envoy.filters.network.ext_authz:
  categories:
  - envoy.filters.network
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.network.ext_authz.v3.ExtAuthz
envoy.filters.network.http_connection_manager:
  categories:
  - envoy.filters.network
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
envoy.filters.network.envoy_mobile_http_connection_manager:
  categories:
  - envoy.filters.network
  security_posture: robust_to_untrusted_downstream
  status: stable
envoy.filters.network.local_ratelimit:
  categories:
  - envoy.filters.network
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.network.local_ratelimit.v3.LocalRateLimit
envoy.filters.network.mongo_proxy:
  categories:
  - envoy.filters.network
  security_posture: requires_trusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.filters.network.mongo_proxy.v3.MongoProxy
envoy.filters.network.ratelimit:
  categories:
  - envoy.filters.network
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.network.ratelimit.v3.RateLimit
envoy.filters.network.rbac:
  categories:
  - envoy.filters.network
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.network.rbac.v3.RBAC
envoy.filters.network.redis_proxy:
  categories:
  - envoy.filters.network
  security_posture: requires_trusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.filters.network.redis_proxy.v3.RedisProxy
envoy.filters.network.sni_cluster:
  categories:
  - envoy.filters.network
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.filters.network.sni_cluster.v3.SniCluster
envoy.filters.network.sni_dynamic_forward_proxy:
  categories:
  - envoy.filters.network
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.filters.network.sni_dynamic_forward_proxy.v3.FilterConfig
envoy.filters.network.tcp_proxy:
  categories:
  - envoy.filters.network
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
envoy.filters.network.thrift_proxy:
  categories:
  - envoy.filters.network
  security_posture: requires_trusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.filters.network.thrift_proxy.v3.ThriftProxy
envoy.filters.network.wasm:
  categories:
  - envoy.filters.network
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.filters.network.wasm.v3.Wasm
envoy.filters.network.zookeeper_proxy:
  categories:
  - envoy.filters.network
  security_posture: requires_trusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.network.zookeeper_proxy.v3.ZooKeeperProxy
envoy.filters.thrift.header_to_metadata:
  categories:
  - envoy.thrift_proxy.filters
  security_posture: requires_trusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.network.thrift_proxy.filters.header_to_metadata.v3.HeaderToMetadata
envoy.filters.thrift.payload_to_metadata:
  categories:
  - envoy.thrift_proxy.filters
  security_posture: requires_trusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.network.thrift_proxy.filters.payload_to_metadata.v3.PayloadToMetadata
envoy.filters.thrift.rate_limit:
  categories:
  - envoy.thrift_proxy.filters
  security_posture: requires_trusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.network.thrift_proxy.filters.ratelimit.v3.RateLimit
envoy.filters.thrift.router:
  categories:
  - envoy.thrift_proxy.filters
  security_posture: requires_trusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.filters.network.thrift_proxy.router.v3.Router
envoy.filters.udp.dns_filter:
  categories:
  - envoy.filters.udp_listener
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.udp.dns_filter.v3.DnsFilterConfig
envoy.filters.udp_listener.udp_proxy:
  categories:
  - envoy.filters.udp_listener
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.filters.udp.udp_proxy.v3.UdpProxyConfig
envoy.filters.udp.session.http_capsule:
  categories:
  - envoy.filters.udp.session
  security_posture: robust_to_untrusted_downstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.udp.udp_proxy.session.http_capsule.v3.FilterConfig
envoy.filters.udp.session.dynamic_forward_proxy:
  categories:
  - envoy.filters.udp.session
  security_posture: robust_to_untrusted_downstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.udp.udp_proxy.session.dynamic_forward_proxy.v3.FilterConfig
envoy.formatter.cel:
  categories:
  - envoy.formatter
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.formatter.cel.v3.Cel
envoy.formatter.metadata:
  categories:
  - envoy.formatter
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.formatter.metadata.v3.Metadata
envoy.formatter.req_without_query:
  categories:
  - envoy.formatter
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.formatter.req_without_query.v3.ReqWithoutQuery
envoy.geoip_providers.maxmind:
  categories:
  - envoy.geoip_providers
  security_posture: unknown
  status: wip
  type_urls:
  - envoy.extensions.geoip_providers.maxmind.v3.MaxMindConfig
envoy.grpc_credentials.aws_iam:
  categories:
  - envoy.grpc_credentials
  security_posture: data_plane_agnostic
  status: alpha
envoy.grpc_credentials.file_based_metadata:
  categories:
  - envoy.grpc_credentials
  security_posture: data_plane_agnostic
  status: alpha
envoy.health_checkers.http:
  categories:
  - envoy.health_checkers
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.config.core.v3.HealthCheck.HttpHealthCheck
envoy.health_checkers.grpc:
  categories:
  - envoy.health_checkers
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.config.core.v3.HealthCheck.GrpcHealthCheck
envoy.health_checkers.tcp:
  categories:
  - envoy.health_checkers
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.config.core.v3.HealthCheck.TcpHealthCheck
envoy.health_checkers.redis:
  categories:
  - envoy.health_checkers
  security_posture: requires_trusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.health_checkers.redis.v3.Redis
envoy.health_checkers.thrift:
  categories:
  - envoy.health_checkers
  security_posture: requires_trusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.health_checkers.thrift.v3.Thrift
envoy.health_check.event_sinks.file:
  categories:
  - envoy.health_check.event_sinks
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.health_check.event_sinks.file.v3.HealthCheckEventFileSink
envoy.http.original_ip_detection.custom_header:
  categories:
  - envoy.http.original_ip_detection
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.http.original_ip_detection.custom_header.v3.CustomHeaderConfig
envoy.http.original_ip_detection.xff:
  categories:
  - envoy.http.original_ip_detection
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.http.original_ip_detection.xff.v3.XffConfig
envoy.http.stateful_header_formatters.preserve_case:
  categories:
  - envoy.http.stateful_header_formatters
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig
envoy.http.header_validators.envoy_default:
  categories:
  - envoy.http.header_validators
  security_posture: unknown
  status: wip
  type_urls:
  - envoy.extensions.http.header_validators.envoy_default.v3.HeaderValidatorConfig
envoy.http.injected_credentials.generic:
  categories:
  - envoy.http.injected_credentials
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.http.injected_credentials.generic.v3.Generic
envoy.http.injected_credentials.oauth2:
  categories:
  - envoy.http.injected_credentials
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.http.injected_credentials.oauth2.v3.OAuth2
envoy.internal_redirect_predicates.allow_listed_routes:
  categories:
  - envoy.internal_redirect_predicates
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.internal_redirect.allow_listed_routes.v3.AllowListedRoutesConfig
envoy.internal_redirect_predicates.previous_routes:
  categories:
  - envoy.internal_redirect_predicates
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.internal_redirect.previous_routes.v3.PreviousRoutesConfig
envoy.internal_redirect_predicates.safe_cross_scheme:
  categories:
  - envoy.internal_redirect_predicates
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.internal_redirect.safe_cross_scheme.v3.SafeCrossSchemeConfig
envoy.io_socket.user_space:
  categories:
  - envoy.io_socket
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  undocumented: true
envoy.matching.common_inputs.environment_variable:
  categories:
  - envoy.matching.common_inputs
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.matching.common_inputs.environment_variable.v3.Config
envoy.matching.matchers.consistent_hashing:
  categories:
  - envoy.matching.input_matchers
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.matching.input_matchers.consistent_hashing.v3.ConsistentHashing
envoy.matching.matchers.ip:
  categories:
  - envoy.matching.input_matchers
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.matching.input_matchers.ip.v3.Ip
envoy.matching.matchers.runtime_fraction:
  categories:
  - envoy.matching.input_matchers
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.matching.input_matchers.runtime_fraction.v3.RuntimeFraction
envoy.matching.matchers.cel_matcher:
  categories:
  - envoy.matching.input_matchers
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - xds.type.matcher.v3.CelMatcher
envoy.path.match.uri_template.uri_template_matcher:
  categories:
  - envoy.path.match
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  undocumented: true
  type_urls:
  - envoy.extensions.path.match.uri_template.v3.UriTemplateMatchConfig
envoy.path.rewrite.uri_template.uri_template_rewriter:
  categories:
  - envoy.path.rewrite
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  undocumented: true
  type_urls:
  - envoy.extensions.path.rewrite.uri_template.v3.UriTemplateRewriteConfig
envoy.quic.proof_source.filter_chain:
  categories:
  - envoy.quic.proof_source
  security_posture: robust_to_untrusted_downstream
  status: alpha
  type_urls:
  - envoy.extensions.quic.proof_source.v3.ProofSourceConfig
envoy.quic.server_preferred_address.fixed:
  categories:
  - envoy.quic.server_preferred_address
  security_posture: robust_to_untrusted_downstream
  status: alpha
  type_urls:
  - envoy.extensions.quic.server_preferred_address.v3.FixedServerPreferredAddressConfig
envoy.quic.server_preferred_address.datasource:
  categories:
  - envoy.quic.server_preferred_address
  security_posture: robust_to_untrusted_downstream
  status: alpha
  type_urls:
  - envoy.extensions.quic.server_preferred_address.v3.DataSourceServerPreferredAddressConfig
envoy.udp_packet_writer.default:
  categories:
  - envoy.udp_packet_writer
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.udp_packet_writer.v3.UdpDefaultWriterFactory
envoy.udp_packet_writer.gso:
  categories:
  - envoy.udp_packet_writer
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.udp_packet_writer.v3.UdpGsoBatchWriterFactory
envoy.quic.deterministic_connection_id_generator:
  categories:
  - envoy.quic.connection_id_generator
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.quic.connection_id_generator.v3.DeterministicConnectionIdGeneratorConfig
envoy.quic.crypto_stream.server.quiche:
  categories:
  - envoy.quic.server.crypto_stream
  security_posture: robust_to_untrusted_downstream
  status: alpha
  type_urls:
  - envoy.extensions.quic.crypto_stream.v3.CryptoServerStreamConfig
envoy.rate_limit_descriptors.expr:
  categories:
  - envoy.rate_limit_descriptors
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.rate_limit_descriptors.expr.v3.Descriptor
envoy.regex_engines.google_re2:
  categories:
  - envoy.regex_engines
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.regex_engines.v3.GoogleRE2
envoy.request_id.uuid:
  categories:
  - envoy.request_id
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.request_id.uuid.v3.UuidRequestIdConfig
envoy.resource_monitors.cpu_utilization:
  categories:
  - envoy.resource_monitors
  security_posture: data_plane_agnostic
  status: alpha
  type_urls:
  - envoy.extensions.resource_monitors.cpu_utilization.v3.CpuUtilizationConfig
envoy.resource_monitors.global_downstream_max_connections:
  categories:
  - envoy.resource_monitors
  security_posture: data_plane_agnostic
  status: stable
  type_urls:
  - envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
envoy.resource_monitors.fixed_heap:
  categories:
  - envoy.resource_monitors
  security_posture: data_plane_agnostic
  status: alpha
  type_urls:
  - envoy.extensions.resource_monitors.fixed_heap.v3.FixedHeapConfig
envoy.resource_monitors.injected_resource:
  categories:
  - envoy.resource_monitors
  security_posture: data_plane_agnostic
  status: alpha
  type_urls:
  - envoy.extensions.resource_monitors.injected_resource.v3.InjectedResourceConfig
envoy.retry_host_predicates.omit_canary_hosts:
  categories:
  - envoy.retry_host_predicates
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.retry.host.omit_canary_hosts.v3.OmitCanaryHostsPredicate
envoy.retry_host_predicates.omit_host_metadata:
  categories:
  - envoy.retry_host_predicates
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.retry.host.omit_host_metadata.v3.OmitHostMetadataConfig
envoy.retry_host_predicates.previous_hosts:
  categories:
  - envoy.retry_host_predicates
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate
envoy.retry_priorities.previous_priorities:
  categories:
  - envoy.retry_priorities
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.retry.priority.previous_priorities.v3.PreviousPrioritiesConfig
envoy.route.early_data_policy.default:
  categories:
  - envoy.route.early_data_policy
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.extensions.early_data.v3.DefaultEarlyDataPolicy
envoy.router.cluster_specifier_plugin.lua:
  categories:
  - envoy.router.cluster_specifier_plugin
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.router.cluster_specifiers.lua.v3.LuaConfig
envoy.stat_sinks.dog_statsd:
  categories:
  - envoy.stats_sinks
  security_posture: data_plane_agnostic
  status: stable
  type_urls:
  - envoy.config.metrics.v3.DogStatsdSink
envoy.stat_sinks.graphite_statsd:
  categories:
  - envoy.stats_sinks
  security_posture: data_plane_agnostic
  status: alpha
  type_urls:
  - envoy.extensions.stat_sinks.graphite_statsd.v3.GraphiteStatsdSink
envoy.stat_sinks.hystrix:
  categories:
  - envoy.stats_sinks
  security_posture: data_plane_agnostic
  status: stable
  type_urls:
  - envoy.config.metrics.v3.HystrixSink
envoy.stat_sinks.metrics_service:
  categories:
  - envoy.stats_sinks
  security_posture: data_plane_agnostic
  status: stable
  type_urls:
  - envoy.config.metrics.v3.MetricsServiceConfig
envoy.stat_sinks.open_telemetry:
  categories:
  - envoy.stats_sinks
  security_posture: data_plane_agnostic
  status: alpha
  type_urls:
  - envoy.extensions.stat_sinks.open_telemetry.v3.SinkConfig
envoy.stat_sinks.statsd:
  categories:
  - envoy.stats_sinks
  security_posture: data_plane_agnostic
  status: stable
  type_urls:
  - envoy.config.metrics.v3.StatsdSink
envoy.stat_sinks.wasm:
  categories:
  - envoy.stats_sinks
  security_posture: data_plane_agnostic
  status: alpha
  type_urls:
  - envoy.extensions.stat_sinks.wasm.v3.Wasm
envoy.string_matcher.lua:
  categories:
  - envoy.string_matcher
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.string_matcher.lua.v3.Lua
envoy.tls.cert_validator.spiffe:
  categories:
  - envoy.tls.cert_validator
  security_posture: requires_trusted_downstream_and_upstream
  status: alpha
envoy.tracers.datadog:
  categories:
  - envoy.tracers
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.config.trace.v3.DatadogConfig
envoy.tracers.opentelemetry:
  categories:
  - envoy.tracers
  security_posture: unknown
  status: wip
  type_urls:
  - envoy.config.trace.v3.OpenTelemetryConfig
envoy.tracers.opentelemetry.samplers.always_on:
  categories:
  - envoy.tracers.opentelemetry.samplers
  security_posture: unknown
  status: wip
  type_urls:
  - envoy.extensions.tracers.opentelemetry.samplers.v3.AlwaysOnSamplerConfig
envoy.tracers.opentelemetry.samplers.dynatrace:
  categories:
  - envoy.tracers.opentelemetry.samplers
  security_posture: unknown
  status: wip
  type_urls:
  - envoy.extensions.tracers.opentelemetry.samplers.v3.DynatraceSamplerConfig
envoy.tracers.skywalking:
  categories:
  - envoy.tracers
  security_posture: robust_to_untrusted_downstream
  status: wip
  type_urls:
  - envoy.config.trace.v3.SkyWalkingConfig
envoy.tracers.xray:
  categories:
  - envoy.tracers
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.config.trace.v3.XRayConfig
envoy.tracers.zipkin:
  categories:
  - envoy.tracers
  security_posture: robust_to_untrusted_downstream
  status: stable
  type_urls:
  - envoy.config.trace.v3.ZipkinConfig
envoy.transport_sockets.alts:
  categories:
  - envoy.transport_sockets.downstream
  - envoy.transport_sockets.upstream
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.transport_sockets.alts.v3.Alts
envoy.transport_sockets.internal_upstream:
  categories:
  - envoy.transport_sockets.upstream
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.transport_sockets.internal_upstream.v3.InternalUpstreamTransport
envoy.transport_sockets.raw_buffer:
  categories:
  - envoy.transport_sockets.downstream
  - envoy.transport_sockets.upstream
  security_posture: requires_trusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer
envoy.transport_sockets.starttls:
  categories:
  - envoy.transport_sockets.downstream
  - envoy.transport_sockets.upstream
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.transport_sockets.starttls.v3.StartTlsConfig
  - envoy.extensions.transport_sockets.starttls.v3.UpstreamStartTlsConfig
envoy.transport_sockets.tap:
  categories:
  - envoy.transport_sockets.downstream
  - envoy.transport_sockets.upstream
  security_posture: requires_trusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.transport_sockets.tap.v3.Tap
envoy.transport_sockets.tcp_stats:
  categories:
  - envoy.transport_sockets.downstream
  - envoy.transport_sockets.upstream
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.transport_sockets.tcp_stats.v3.Config
envoy.transport_sockets.tls:
  categories:
  - envoy.transport_sockets.downstream
  - envoy.transport_sockets.upstream
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
  - envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
envoy.transport_sockets.upstream_proxy_protocol:
  categories:
  - envoy.transport_sockets.upstream
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
envoy.transport_sockets.http_11_proxy:
  categories:
  - envoy.transport_sockets.upstream
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.transport_sockets.http_11_proxy.v3.Http11ProxyUpstreamTransport
envoy.upstreams.http.generic:
  categories:
  - envoy.upstreams
  security_posture: robust_to_untrusted_downstream
  status: stable
envoy.upstreams.http.http:
  categories:
  - envoy.upstreams
  security_posture: robust_to_untrusted_downstream
  status: stable
envoy.upstreams.http.http_protocol_options:
  categories:
  - envoy.upstreams
  security_posture: robust_to_untrusted_downstream
  status: stable
envoy.upstreams.http.tcp:
  categories:
  - envoy.upstreams
  security_posture: robust_to_untrusted_downstream
  status: stable
envoy.upstreams.http.udp:
  categories:
  - envoy.upstreams
  security_posture: robust_to_untrusted_downstream
  status: alpha
envoy.upstreams.tcp.generic:
  categories:
  - envoy.upstreams
  security_posture: robust_to_untrusted_downstream
  status: stable
envoy.upstreams.tcp.tcp_protocol_options:
  categories:
  - envoy.upstreams
  security_posture: unknown
  status: alpha
envoy.upstream.local_address_selector.default_local_address_selector:
  categories:
  - envoy.upstream.local_address_selector
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.config.upstream.local_address_selector.v3.DefaultLocalAddressSelector
envoy.wasm.runtime.null:
  categories:
  - envoy.wasm.runtime
  security_posture: unknown
  status: alpha
envoy.wasm.runtime.v8:
  categories:
  - envoy.wasm.runtime
  security_posture: unknown
  status: alpha
envoy.wasm.runtime.wamr:
  categories:
  - envoy.wasm.runtime
  # "This may never change from unknown until the threat model at
  # https://envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/threat_model#core-and-extensions
  # is updated to capture additional Wasm runtimes".
  security_posture: unknown
  status: alpha
envoy.wasm.runtime.wasmtime:
  categories:
  - envoy.wasm.runtime
  # "This may never change from unknown until the threat model at
  # https://envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/threat_model#core-and-extensions
  # is updated to capture additional Wasm runtimes".
  security_posture: unknown
  status: alpha
envoy.watchdog.profile_action:
  categories:
  - envoy.guarddog_actions
  security_posture: data_plane_agnostic
  status: alpha
  type_urls:
  - envoy.extensions.watchdog.profile_action.v3.ProfileActionConfig
envoy.key_value.file_based:
  categories:
  - envoy.common.key_value
  security_posture: data_plane_agnostic
  status: alpha
  type_urls:
  - envoy.extensions.key_value.file_based.v3.FileBasedKeyValueStoreConfig
envoy.network.dns_resolver.cares:
  categories:
  - envoy.network.dns_resolver
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.network.dns_resolver.cares.v3.CaresDnsResolverConfig
envoy.network.dns_resolver.apple:
  categories:
  - envoy.network.dns_resolver
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.network.dns_resolver.apple.v3.AppleDnsResolverConfig
envoy.network.dns_resolver.getaddrinfo:
  categories:
  - envoy.network.dns_resolver
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.network.dns_resolver.getaddrinfo.v3.GetAddrInfoDnsResolverConfig
envoy.rbac.matchers.upstream_ip_port:
  categories:
  - envoy.rbac.matchers
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.rbac.matchers.upstream_ip_port.v3.UpstreamIpPortMatcher
envoy.http.stateful_session.cookie:
  categories:
  - envoy.http.stateful_session
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.http.stateful_session.cookie.v3.CookieBasedSessionState
envoy.http.stateful_session.header:
  categories:
  - envoy.http.stateful_session
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.http.stateful_session.header.v3.HeaderBasedSessionState
envoy.matching.inputs.request_headers:
  categories:
  - envoy.matching.http.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.type.matcher.v3.HttpRequestHeaderMatchInput
envoy.matching.inputs.request_trailers:
  categories:
  - envoy.matching.http.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.type.matcher.v3.HttpRequestTrailerMatchInput
envoy.matching.inputs.response_headers:
  categories:
  - envoy.matching.http.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.type.matcher.v3.HttpResponseHeaderMatchInput
envoy.matching.inputs.response_trailers:
  categories:
  - envoy.matching.http.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.type.matcher.v3.HttpResponseTrailerMatchInput
envoy.matching.inputs.query_params:
  categories:
  - envoy.matching.http.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.type.matcher.v3.HttpRequestQueryParamMatchInput
envoy.matching.inputs.cel_data_input:
  categories:
  - envoy.matching.http.input
  security_posture: unknown
  status: stable
  type_urls:
  - xds.type.matcher.v3.HttpAttributesCelMatchInput
envoy.matching.inputs.destination_ip:
  categories:
  - envoy.matching.http.input
  - envoy.matching.network.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.matching.common_inputs.network.v3.DestinationIPInput
envoy.matching.inputs.destination_port:
  categories:
  - envoy.matching.http.input
  - envoy.matching.network.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.matching.common_inputs.network.v3.DestinationPortInput
envoy.matching.inputs.source_ip:
  categories:
  - envoy.matching.http.input
  - envoy.matching.network.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.matching.common_inputs.network.v3.SourceIPInput
envoy.matching.inputs.source_port:
  categories:
  - envoy.matching.http.input
  - envoy.matching.network.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.matching.common_inputs.network.v3.SourcePortInput
envoy.matching.inputs.direct_source_ip:
  categories:
  - envoy.matching.http.input
  - envoy.matching.network.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.matching.common_inputs.network.v3.DirectSourceIPInput
envoy.matching.inputs.source_type:
  categories:
  - envoy.matching.http.input
  - envoy.matching.network.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.matching.common_inputs.network.v3.SourceTypeInput
envoy.matching.inputs.server_name:
  categories:
  - envoy.matching.http.input
  - envoy.matching.network.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.matching.common_inputs.network.v3.ServerNameInput
envoy.matching.inputs.transport_protocol:
  categories:
  - envoy.matching.network.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.matching.common_inputs.network.v3.TransportProtocolInput
envoy.matching.inputs.application_protocol:
  categories:
  - envoy.matching.network.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.matching.common_inputs.network.v3.ApplicationProtocolInput
envoy.matching.inputs.filter_state:
  categories:
  - envoy.matching.http.input
  - envoy.matching.network.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.matching.common_inputs.network.v3.FilterStateInput
envoy.matching.inputs.dynamic_metadata:
  categories:
  - envoy.matching.http.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.matching.common_inputs.network.v3.DynamicMetadataInput
envoy.matching.inputs.uri_san:
  categories:
  - envoy.matching.http.input
  - envoy.matching.network.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.matching.common_inputs.ssl.v3.UriSanInput
envoy.matching.inputs.dns_san:
  categories:
  - envoy.matching.http.input
  - envoy.matching.network.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.matching.common_inputs.ssl.v3.DnsSanInput
envoy.matching.inputs.subject:
  categories:
  - envoy.matching.http.input
  - envoy.matching.network.input
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.matching.common_inputs.ssl.v3.SubjectInput
envoy.matching.custom_matchers.trie_matcher:
  categories:
  - envoy.matching.http.custom_matchers
  - envoy.matching.network.custom_matchers
  security_posture: unknown
  status: stable
  type_urls:
  - xds.type.matcher.v3.IPMatcher
envoy.matching.matchers.metadata_matcher:
  categories:
  - envoy.matching.input_matchers
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.matching.input_matchers.metadata.v3.Metadata
envoy.load_balancing_policies.least_request:
  categories:
  - envoy.load_balancing_policies
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest
envoy.load_balancing_policies.random:
  categories:
  - envoy.load_balancing_policies
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.load_balancing_policies.random.v3.Random
envoy.load_balancing_policies.round_robin:
  categories:
  - envoy.load_balancing_policies
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.load_balancing_policies.round_robin.v3.RoundRobin
envoy.load_balancing_policies.ring_hash:
  categories:
  - envoy.load_balancing_policies
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.load_balancing_policies.ring_hash.v3.RingHash
envoy.load_balancing_policies.maglev:
  categories:
  - envoy.load_balancing_policies
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.load_balancing_policies.maglev.v3.Maglev
envoy.load_balancing_policies.subset:
  categories:
  - envoy.load_balancing_policies
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.load_balancing_policies.subset.v3.Subset
envoy.load_balancing_policies.cluster_provided:
  categories:
  - envoy.load_balancing_policies
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: stable
  type_urls:
  - envoy.extensions.load_balancing_policies.cluster_provided.v3.ClusterProvided
envoy.load_balancing_policies.client_side_weighted_round_robin:
  categories:
  - envoy.load_balancing_policies
  security_posture: unknown
  status: wip
  type_urls:
  - envoy.extensions.load_balancing_policies.client_side_weighted_round_robin.v3.ClientSideWeightedRoundRobin
envoy.http.early_header_mutation.header_mutation:
  categories:
  - envoy.http.early_header_mutation
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.http.early_header_mutation.header_mutation.v3.HeaderMutation
envoy.filters.http.custom_response:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: wip
  type_urls:
  - envoy.extensions.filters.http.custom_response.v3.CustomResponse
envoy.matching.actions.format_string:
  categories:
  - envoy.matching.action
  security_posture: unknown
  status: stable
  type_urls:
  - envoy.config.core.v3.SubstitutionFormatString
envoy.http.custom_response.redirect_policy:
  categories:
  - envoy.http.custom_response
  security_posture: unknown
  status: wip
  type_urls:
  - envoy.extensions.http.custom_response.redirect_policy.v3.RedirectPolicy
envoy.http.custom_response.local_response_policy:
  categories:
  - envoy.http.custom_response
  security_posture: unknown
  status: wip
  type_urls:
  - envoy.extensions.http.custom_response.local_response_policy.v3.LocalResponsePolicy
envoy.config_subscription.rest:
  categories:
  - envoy.config_subscription
  security_posture: unknown
  status: stable
envoy.config_subscription.filesystem:
  categories:
  - envoy.config_subscription
  security_posture: unknown
  status: stable
envoy.config_subscription.ads_collection:
  categories:
  - envoy.config_subscription
  security_posture: unknown
  status: stable
envoy.config_subscription.aggregated_delta_grpc_collection:
  categories:
  - envoy.config_subscription
  security_posture: unknown
  status: stable
envoy.config_subscription.aggregated_grpc_collection:
  categories:
  - envoy.config_subscription
  security_posture: unknown
  status: stable
envoy.config_subscription.ads:
  categories:
  - envoy.config_subscription
  security_posture: unknown
  status: stable
envoy.config_subscription.delta_grpc:
  categories:
  - envoy.config_subscription
  security_posture: unknown
  status: stable
envoy.config_subscription.grpc:
  categories:
  - envoy.config_subscription
  security_posture: unknown
  status: stable
envoy.config_subscription.filesystem_collection:
  categories:
  - envoy.config_subscription
  security_posture: unknown
  status: stable
envoy.config_mux.delta_grpc_mux_factory:
  categories:
  - envoy.config_mux
  security_posture: unknown
  status: stable
envoy.config_mux.sotw_grpc_mux_factory:
  categories:
  - envoy.config_mux
  security_posture: unknown
  status: stable
envoy.filters.http.set_filter_state:
  categories:
  - envoy.filters.http
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.filters.http.set_filter_state.v3.Config
envoy.filters.network.set_filter_state:
  categories:
  - envoy.filters.network
  security_posture: unknown
  status: alpha
  type_urls:
  - envoy.extensions.filters.network.set_filter_state.v3.Config
envoy.tracers.opentelemetry.resource_detectors.environment:
  categories:
  - envoy.tracers.opentelemetry.resource_detectors
  security_posture: unknown
  status: wip
  type_urls:
  - envoy.extensions.tracers.opentelemetry.resource_detectors.v3.EnvironmentResourceDetectorConfig
envoy.tracers.opentelemetry.resource_detectors.dynatrace:
  categories:
  - envoy.tracers.opentelemetry.resource_detectors
  security_posture: unknown
  status: wip
  type_urls:
  - envoy.extensions.tracers.opentelemetry.resource_detectors.v3.DynatraceResourceDetectorConfig
envoy.tracers.opentelemetry.resource_detectors.static_config:
  categories:
  - envoy.tracers.opentelemetry.resource_detectors
  security_posture: unknown
  status: wip
  type_urls:
  - envoy.extensions.tracers.opentelemetry.resource_detectors.v3.StaticConfigResourceDetectorConfig
envoy.quic.connection_debug_visitor.basic:
  categories:
  - envoy.quic.connection_debug_visitor
  security_posture: requires_trusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.quic.connection_debug_visitor.v3.BasicConfig
envoy.quic.connection_debug_visitor.quic_stats:
  categories:
  - envoy.quic.connection_debug_visitor
  security_posture: robust_to_untrusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.quic.connection_debug_visitor.quic_stats.v3.Config
envoy.filters.network.generic_proxy:
  categories:
  - envoy.filters.network
  security_posture: requires_trusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.network.generic_proxy.v3.GenericProxy
envoy.filters.generic.router:
  categories:
  - envoy.generic_proxy.filters
  security_posture: requires_trusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.network.generic_proxy.router.v3.Router
envoy.generic_proxy.codecs.dubbo:
  categories:
  - envoy.generic_proxy.codecs
  security_posture: requires_trusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.network.generic_proxy.codecs.dubbo.v3.DubboCodecConfig
envoy.generic_proxy.codecs.http1:
  categories:
  - envoy.generic_proxy.codecs
  security_posture: requires_trusted_downstream_and_upstream
  status: alpha
  type_urls:
  - envoy.extensions.filters.network.generic_proxy.codecs.http1.v3.Http1CodecConfig