https://pizza.rs/tags/rbac/Recent content in Rbac on INFINI PizzaHugoenhttps://pizza.rs/docs/administration/security/Mon, 01 Jan 0001 00:00:00 +0000https://pizza.rs/docs/administration/security/<h1 id="security"> Security <a class="anchor" href="#security">#</a> </h1> <p>Pizza ships an API-key based authentication and role model for the data plane and management APIs. It is <strong>off by default</strong>; the shipped <code>pizza.yml</code> enables it.</p> <h2 id="enabling-authentication"> Enabling authentication <a class="anchor" href="#enabling-authentication">#</a> </h2> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"><span class="line"><span class="cl"><span class="nt">security</span><span class="p">:</span><span class="w"> </span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="nt">auth_enabled</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w"> </span></span></span><span class="line"><span class="cl"><span class="w"> </span><span class="c"># no bootstrap_key here — see below</span><span class="w"> </span></span></span></code></pre></div><p>With auth enabled, every data-plane and management request must carry a valid API key — <code>Authorization: Bearer &lt;key&gt;</code> or <code>X-Api-Key: &lt;key&gt;</code>. Unauthenticated requests are answered with <code>401</code> and a deliberately generic body. Anonymous operational-plane reads (console assets, readiness probes) stay open; mutating <code>/_cluster</code> and <code>/_node</code> management requires a key once auth is on.</p>