Docs / dflux EdgeGuard
ContactGet started

Overview

The admin surface for dflux EdgeGuard is the typed EdgeControl gRPC service on admin.grpc_listen. d3x-edgectl is the supported client. This page covers address, auth, resource groups, and how mutations hot-reload.

Address

Configure the admin listener with admin.grpc_listen (for example 127.0.0.1:9091 or :9091). d3x-edgectl defaults to -addr 127.0.0.1:9091 — a host:port, not an HTTP URL. The legacy -url flag is rejected.

Bash

Production should enable TLS under admin.tls and drop admin.allow_insecure. See Securing the admin API.

gRPC-only control plane
The legacy HTTP admin API under /admin/* was removed. Resource pages in this section still use the historical path names (for example /admin/status) as operation labels that map 1:1 to EdgeControl RPCs — drive them with d3x-edgectl, not curl.

Authentication

This page is the canonical home for admin authentication; other /api/* pages link here. EdgeControl accepts two credential types, configured under admin.auth:

  • API key — pass with d3x-edgectl -key or the D3X_EDGE_ADMIN_KEY environment variable (metadata on the gRPC call).
  • JWT bearer — pass with d3x-edgectl -token. The proxy validates the signature and expiry, then maps the token's role claim to an admin role for role-based access control.

Each request tries the bearer token first, then falls back to the API key. When neither admin.auth credentials nor admin.allow_anonymous: true is configured, the proxy refuses to start.

On top of credentials, you can require a client certificate at the transport layer with admin.require_client_cert: true (which needs admin.tls.ca_file). This is transport hardening, not a third credential type — see Securing the admin API.

Preferred client

Use d3x-edgectl for day-to-day operations: status, policy/rate-limit/routing CRUD, producers, validate, health, and log level. JSON payloads can be inline or @file. Declarative YAML uses apply -f. See d3x-edgectl reference.

Bash
d3x-edgectl is the supported surface
The operation groups below describe the same resources d3x-edgectl mutates. Prefer the CLI over hand-rolled gRPC clients unless you are integrating EdgeControl programmatically.

Hot reload

Mutations land in the control-plane store. The proxy's store-watcher polls every process.store_watch_interval (default 5s) and atomically swaps the filter chain. There is no separate "reload" endpoint — apply the change, the proxy picks it up. See Hot reload and runtime ops for what is and isn't hot-reloadable.

Mutations and decisions are logged

Admin mutations and data-path decisions are emitted as structured JSON logs (zerolog), not stored in a queryable audit endpoint — there is no admin audit API. Ship those logs to your log pipeline or SIEM for operator forensics, and pair them with Prometheus metrics. See Observability.

Endpoint groups