istio

1
apiVersion: security.istio.io/v1beta1
2
kind: AuthorizationPolicy
3
metadata:
4
  name: httpbin-1
5
  namespace: foo
6
spec:
7
  selector:
8
    matchLabels:
9
      app: httpbin
10
      version: v1
11
  rules:
12
    - from:
13
        - source:
14
            principals: ["principal", "principal-prefix-*", "*-suffix-principal", "*"]
15
            requestPrincipals: ["requestPrincipals", "requestPrincipals-prefix-*", "*-suffix-requestPrincipals", "*"]
16
            namespaces: ["ns", "ns-prefix-*", "*-ns-suffix", "*"]
17
            ipBlocks: ["1.2.3.4", "5.6.0.0/16"]
18
            remoteIpBlocks: ["1.2.3.4", "5.6.0.0/16"]
19
            notPrincipals: ["not-principal", "not-principal-prefix-*", "*-not-suffix-principal", "*"]
20
            notRequestPrincipals: ["not-requestPrincipals", "not-requestPrincipals-prefix-*", "*-not-suffix-requestPrincipals", "*"]
21
            notNamespaces: ["not-ns", "not-ns-prefix-*", "*-not-ns-suffix", "*"]
22
            notIpBlocks: ["9.0.0.1", "9.2.0.0/16"]
23
            notRemoteIpBlocks: ["9.0.0.1", "9.2.0.0/16"]
24
      to:
25
        - operation:
26
            methods: ["method", "method-prefix-*", "*-suffix-method", "*"]
27
            hosts: ["exact.com", "*.suffix.com", "prefix.*", "*"]
28
            ports: ["80", "90"]
29
            paths: ["/exact", "/prefix/*", "*/suffix", "*"]
30
            notMethods: ["not-method", "not-method-prefix-*", "*-not-suffix-method", "*"]
31
            notHosts: ["not-exact.com", "*.not-suffix.com", "not-prefix.*", "*"]
32
            notPorts: ["8000", "9000"]
33
            notPaths: ["/not-exact", "/not-prefix/*", "*/not-suffix", "*"]
34
      when:
35
        - key: "request.headers[X-header]"
36
          values: ["header", "header-prefix-*", "*-suffix-header", "*"]
37
          notValues: ["not-header", "not-header-prefix-*", "*-not-suffix-header", "*"]
38
        - key: "source.ip"
39
          values: ["10.10.10.10", "192.168.10.0/24"]
40
          notValues: ["90.10.10.10", "90.168.10.0/24"]
41
        - key: "remote.ip"
42
          values: ["10.10.10.10", "192.168.10.0/24"]
43
          notValues: ["90.10.10.10", "90.168.10.0/24"]
44
        - key: "source.namespace"
45
          values: ["ns", "ns-prefix-*", "*-ns-suffix", "*"]
46
          notValues: ["not-ns", "not-ns-prefix-*", "*-not-ns-suffix", "*"]
47
        - key: "source.principal"
48
          values: ["principal", "principal-prefix-*", "*-suffix-principal", "*"]
49
          notValues: ["not-principal", "not-principal-prefix-*", "*-not-suffix-principal", "*"]
50
        - key: "request.auth.principal"
51
          values: ["requestPrincipals", "requestPrincipals-prefix-*", "*-suffix-requestPrincipals", "*", "https://example.com/*"]
52
          notValues: ["not-requestPrincipals", "not-requestPrincipals-prefix-*", "*-not-suffix-requestPrincipals", "*"]
53
        - key: "request.auth.audiences"
54
          values: ["audiences", "audiences-prefix-*", "*-suffix-audiences", "*"]
55
          notValues: ["not-audiences", "not-audiences-prefix-*", "*-not-suffix-audiences", "*"]
56
        - key: "request.auth.presenter"
57
          values: ["presenter", "presenter-prefix-*", "*-suffix-presenter", "*"]
58
          notValues: ["not-presenter", "not-presenter-prefix-*", "*-not-suffix-presenter", "*"]
59
        - key: "request.auth.claims[iss]"
60
          values: ["iss", "iss-prefix-*", "*-suffix-iss", "*"]
61
          notValues: ["not-iss", "not-iss-prefix-*", "*-not-suffix-iss", "*"]
62
        - key: "request.auth.claims[nested1][nested2]"
63
          values: ["nested", "nested-prefix-*", "*-suffix-nested", "*"]
64
          notValues: ["not-nested", "not-nested-prefix-*", "*-not-suffix-nested", "*"]
65
        - key: "destination.ip"
66
          values: ["10.10.10.10", "192.168.10.0/24"]
67
          notValues: ["90.10.10.10", "90.168.10.0/24"]
68
        - key: "destination.port"
69
          values: ["91", "92"]
70
          notValues: ["9001", "9002"]
71
        - key: "connection.sni"
72
          values: ["exact.com", "*.suffix.com", "prefix.*", "*"]
73
          notValues: ["not-exact.com", "*.not-suffix.com", "not-prefix.*", "*"]
74
        - key: "experimental.envoy.filters.a.b[c]"
75
          values: ["exact", "prefix-*", "*-suffix", "*"]
76
          notValues: ["not-exact", "not-prefix-*", "*-not-suffix", "*"]
77