istio

1
name: envoy.filters.http.rbac
2
typedConfig:
3
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
4
  rules:
5
    policies:
6
      ns[foo]-policy[httpbin]-rule[0]:
7
        permissions:
8
        - andRules:
9
            rules:
10
            - orRules:
11
                rules:
12
                - header:
13
                    name: :method
14
                    stringMatch:
15
                      exact: rule[0]-to[0]-method[0]
16
        principals:
17
        - andIds:
18
            ids:
19
            - orIds:
20
                ids:
21
                - authenticated:
22
                    principalName:
23
                      exact: spiffe://td1/ns/rule[0]/sa/from[0]-principal[0]
24
                - authenticated:
25
                    principalName:
26
                      exact: spiffe://cluster.local/ns/rule[0]/sa/from[0]-principal[0]
27
        - andIds:
28
            ids:
29
            - orIds:
30
                ids:
31
                - authenticated:
32
                    principalName:
33
                      exact: spiffe://td1/ns/rule[0]/sa/from[1]-principal[0]
34
                - authenticated:
35
                    principalName:
36
                      exact: spiffe://cluster.local/ns/rule[0]/sa/from[1]-principal[0]
37
                - authenticated:
38
                    principalName:
39
                      exact: spiffe://td1/ns/rule[0]/sa/from[1]-principal[1]
40
                - authenticated:
41
                    principalName:
42
                      exact: spiffe://cluster.local/ns/rule[0]/sa/from[1]-principal[1]
43
            - orIds:
44
                ids:
45
                - authenticated:
46
                    principalName:
47
                      safeRegex:
48
                        regex: .*/ns/rule[0]-from[1]-ns[0]/.*
49
      ns[foo]-policy[httpbin]-rule[1]:
50
        permissions:
51
        - andRules:
52
            rules:
53
            - orRules:
54
                rules:
55
                - header:
56
                    name: :method
57
                    stringMatch:
58
                      exact: rule[1]-to[0]-method[0]
59
        principals:
60
        - andIds:
61
            ids:
62
            - orIds:
63
                ids:
64
                - authenticated:
65
                    principalName:
66
                      exact: spiffe://td1/ns/rule[1]/sa/from[0]-principal[0]
67
                - authenticated:
68
                    principalName:
69
                      exact: spiffe://cluster.local/ns/rule[1]/sa/from[0]-principal[0]
70
  shadowRulesStatPrefix: istio_dry_run_allow_
71