istio

1
name: envoy.filters.http.rbac
2
typedConfig:
3
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
4
  rules:
5
    action: DENY
6
    policies:
7
      ns[foo]-policy[httpbin-deny]-rule[0]:
8
        permissions:
9
        - andRules:
10
            rules:
11
            - any: true
12
        principals:
13
        - andIds:
14
            ids:
15
            - orIds:
16
                ids:
17
                - authenticated:
18
                    principalName:
19
                      exact: spiffe://deny
20
  shadowRulesStatPrefix: istio_dry_run_allow_
21