Security
/ Security, / Authentication, / RbacSecurity #
Pizza ships an API-key based authentication and role model for the data
plane and management APIs. It is off by default; the shipped
pizza.yml enables it.
Enabling authentication #
security:
auth_enabled: true
# no bootstrap_key here — see below
With auth enabled, every data-plane and management request must carry a
valid API key — Authorization: Bearer <key> or X-Api-Key: <key>.
Unauthenticated requests are answered with 401 and a deliberately
generic body. Anonymous operational-plane reads (console assets,
readiness probes) stay open; mutating /_cluster and /_node
management requires a key once auth is on.