istio

extended-single-policy-out.yaml
515 строк · 17.4 Кб
Перенос по словам
1
name: envoy.filters.http.rbac
2
typedConfig:
3
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
4
  rules:
5
    policies:
6
      ns[foo]-policy[httpbin]-rule[0]:
7
        permissions:
8
        - andRules:
9
            rules:
10
            - orRules:
11
                rules:
12
                - header:
13
                    name: :authority
14
                    stringMatch:
15
                      exact: rule[0]-to[0]-host[1]
16
                      ignoreCase: true
17
                - header:
18
                    name: :authority
19
                    stringMatch:
20
                      exact: rule[0]-to[0]-host[2]
21
                      ignoreCase: true
22
            - orRules:
23
                rules:
24
                - header:
25
                    name: :method
26
                    stringMatch:
27
                      exact: rule[0]-to[0]-method[1]
28
                - header:
29
                    name: :method
30
                    stringMatch:
31
                      exact: rule[0]-to[0]-method[2]
32
            - orRules:
33
                rules:
34
                - urlPath:
35
                    path:
36
                      exact: rule[0]-to[0]-path[1]
37
                - urlPath:
38
                    path:
39
                      exact: rule[0]-to[0]-path[2]
40
            - orRules:
41
                rules:
42
                - destinationPort: 9001
43
                - destinationPort: 9002
44
            - orRules:
45
                rules:
46
                - destinationIp:
47
                    addressPrefix: 10.10.10.10
48
                    prefixLen: 32
49
                - destinationIp:
50
                    addressPrefix: 192.168.10.0
51
                    prefixLen: 24
52
        - andRules:
53
            rules:
54
            - orRules:
55
                rules:
56
                - header:
57
                    name: :authority
58
                    stringMatch:
59
                      exact: rule[0]-to[1]-host[1]
60
                      ignoreCase: true
61
                - header:
62
                    name: :authority
63
                    stringMatch:
64
                      exact: rule[0]-to[1]-host[2]
65
                      ignoreCase: true
66
            - orRules:
67
                rules:
68
                - header:
69
                    name: :method
70
                    stringMatch:
71
                      exact: rule[0]-to[1]-method[1]
72
                - header:
73
                    name: :method
74
                    stringMatch:
75
                      exact: rule[0]-to[1]-method[2]
76
            - orRules:
77
                rules:
78
                - urlPath:
79
                    path:
80
                      exact: rule[0]-to[1]-path[1]
81
                - urlPath:
82
                    path:
83
                      exact: rule[0]-to[1]-path[2]
84
            - orRules:
85
                rules:
86
                - destinationPort: 9011
87
                - destinationPort: 9012
88
            - orRules:
89
                rules:
90
                - destinationIp:
91
                    addressPrefix: 10.10.10.10
92
                    prefixLen: 32
93
                - destinationIp:
94
                    addressPrefix: 192.168.10.0
95
                    prefixLen: 24
96
        principals:
97
        - andIds:
98
            ids:
99
            - orIds:
100
                ids:
101
                - authenticated:
102
                    principalName:
103
                      exact: spiffe://rule[0]-from[0]-principal[1]
104
                - authenticated:
105
                    principalName:
106
                      exact: spiffe://rule[0]-from[0]-principal[2]
107
            - orIds:
108
                ids:
109
                - andIds:
110
                    ids:
111
                    - metadata:
112
                        filter: envoy.filters.http.jwt_authn
113
                        path:
114
                        - key: payload
115
                        - key: iss
116
                        value:
117
                          stringMatch:
118
                            exact: rule[0]-from[0]-requestPrincipal[1]
119
                    - metadata:
120
                        filter: envoy.filters.http.jwt_authn
121
                        path:
122
                        - key: payload
123
                        - key: sub
124
                        value:
125
                          stringMatch:
126
                            exact: ""
127
                - andIds:
128
                    ids:
129
                    - metadata:
130
                        filter: envoy.filters.http.jwt_authn
131
                        path:
132
                        - key: payload
133
                        - key: iss
134
                        value:
135
                          stringMatch:
136
                            exact: rule[0]-from[0]-requestPrincipal[2]
137
                    - metadata:
138
                        filter: envoy.filters.http.jwt_authn
139
                        path:
140
                        - key: payload
141
                        - key: sub
142
                        value:
143
                          stringMatch:
144
                            exact: ""
145
            - orIds:
146
                ids:
147
                - authenticated:
148
                    principalName:
149
                      safeRegex:
150
                        regex: .*/ns/rule[0]-from[0]-ns[1]/.*
151
                - authenticated:
152
                    principalName:
153
                      safeRegex:
154
                        regex: .*/ns/rule[0]-from[0]-ns[2]/.*
155
            - orIds:
156
                ids:
157
                - remoteIp:
158
                    addressPrefix: 172.16.10.10
159
                    prefixLen: 32
160
            - orIds:
161
                ids:
162
                - directRemoteIp:
163
                    addressPrefix: 10.0.0.1
164
                    prefixLen: 32
165
                - directRemoteIp:
166
                    addressPrefix: 10.0.0.2
167
                    prefixLen: 32
168
            - orIds:
169
                ids:
170
                - header:
171
                    name: X-header
172
                    stringMatch:
173
                      exact: header
174
                - header:
175
                    name: X-header
176
                    stringMatch:
177
                      prefix: header-prefix-
178
                - header:
179
                    name: X-header
180
                    stringMatch:
181
                      suffix: -suffix-header
182
                - header:
183
                    name: X-header
184
                    presentMatch: true
185
            - orIds:
186
                ids:
187
                - remoteIp:
188
                    addressPrefix: 10.99.10.8
189
                    prefixLen: 32
190
                - remoteIp:
191
                    addressPrefix: 10.80.64.0
192
                    prefixLen: 18
193
        - andIds:
194
            ids:
195
            - orIds:
196
                ids:
197
                - authenticated:
198
                    principalName:
199
                      exact: spiffe://rule[0]-from[1]-principal[1]
200
                - authenticated:
201
                    principalName:
202
                      exact: spiffe://rule[0]-from[1]-principal[2]
203
            - orIds:
204
                ids:
205
                - andIds:
206
                    ids:
207
                    - metadata:
208
                        filter: envoy.filters.http.jwt_authn
209
                        path:
210
                        - key: payload
211
                        - key: iss
212
                        value:
213
                          stringMatch:
214
                            exact: rule[0]-from[1]-requestPrincipal[1]
215
                    - metadata:
216
                        filter: envoy.filters.http.jwt_authn
217
                        path:
218
                        - key: payload
219
                        - key: sub
220
                        value:
221
                          stringMatch:
222
                            exact: ""
223
                - andIds:
224
                    ids:
225
                    - metadata:
226
                        filter: envoy.filters.http.jwt_authn
227
                        path:
228
                        - key: payload
229
                        - key: iss
230
                        value:
231
                          stringMatch:
232
                            exact: rule[0]-from[1]-requestPrincipal[2]
233
                    - metadata:
234
                        filter: envoy.filters.http.jwt_authn
235
                        path:
236
                        - key: payload
237
                        - key: sub
238
                        value:
239
                          stringMatch:
240
                            exact: ""
241
            - orIds:
242
                ids:
243
                - authenticated:
244
                    principalName:
245
                      safeRegex:
246
                        regex: .*/ns/rule[0]-from[1]-ns[1]/.*
247
                - authenticated:
248
                    principalName:
249
                      safeRegex:
250
                        regex: .*/ns/rule[0]-from[1]-ns[2]/.*
251
            - orIds:
252
                ids:
253
                - remoteIp:
254
                    addressPrefix: 172.17.8.0
255
                    prefixLen: 24
256
                - remoteIp:
257
                    addressPrefix: 172.17.9.4
258
                    prefixLen: 32
259
            - orIds:
260
                ids:
261
                - directRemoteIp:
262
                    addressPrefix: 10.0.1.1
263
                    prefixLen: 32
264
                - directRemoteIp:
265
                    addressPrefix: 192.0.1.2
266
                    prefixLen: 32
267
            - orIds:
268
                ids:
269
                - header:
270
                    name: X-header
271
                    stringMatch:
272
                      exact: header
273
                - header:
274
                    name: X-header
275
                    stringMatch:
276
                      prefix: header-prefix-
277
                - header:
278
                    name: X-header
279
                    stringMatch:
280
                      suffix: -suffix-header
281
                - header:
282
                    name: X-header
283
                    presentMatch: true
284
            - orIds:
285
                ids:
286
                - remoteIp:
287
                    addressPrefix: 10.99.10.8
288
                    prefixLen: 32
289
                - remoteIp:
290
                    addressPrefix: 10.80.64.0
291
                    prefixLen: 18
292
      ns[foo]-policy[httpbin]-rule[1]:
293
        permissions:
294
        - andRules:
295
            rules:
296
            - orRules:
297
                rules:
298
                - header:
299
                    name: :authority
300
                    stringMatch:
301
                      exact: rule[1]-to[0]-host[1]
302
                      ignoreCase: true
303
                - header:
304
                    name: :authority
305
                    stringMatch:
306
                      exact: rule[1]-to[0]-host[2]
307
                      ignoreCase: true
308
            - orRules:
309
                rules:
310
                - header:
311
                    name: :method
312
                    stringMatch:
313
                      exact: rule[1]-to[0]-method[1]
314
                - header:
315
                    name: :method
316
                    stringMatch:
317
                      exact: rule[1]-to[0]-method[2]
318
            - orRules:
319
                rules:
320
                - urlPath:
321
                    path:
322
                      exact: rule[1]-to[0]-path[1]
323
                - urlPath:
324
                    path:
325
                      exact: rule[1]-to[0]-path[2]
326
            - orRules:
327
                rules:
328
                - destinationPort: 9101
329
                - destinationPort: 9102
330
        - andRules:
331
            rules:
332
            - orRules:
333
                rules:
334
                - header:
335
                    name: :authority
336
                    stringMatch:
337
                      exact: rule[1]-to[1]-host[1]
338
                      ignoreCase: true
339
                - header:
340
                    name: :authority
341
                    stringMatch:
342
                      exact: rule[1]-to[1]-host[2]
343
                      ignoreCase: true
344
            - orRules:
345
                rules:
346
                - header:
347
                    name: :method
348
                    stringMatch:
349
                      exact: rule[1]-to[1]-method[1]
350
                - header:
351
                    name: :method
352
                    stringMatch:
353
                      exact: rule[1]-to[1]-method[2]
354
            - orRules:
355
                rules:
356
                - urlPath:
357
                    path:
358
                      exact: rule[1]-to[1]-path[1]
359
                - urlPath:
360
                    path:
361
                      exact: rule[1]-to[1]-path[2]
362
            - orRules:
363
                rules:
364
                - destinationPort: 9111
365
                - destinationPort: 9112
366
        principals:
367
        - andIds:
368
            ids:
369
            - orIds:
370
                ids:
371
                - authenticated:
372
                    principalName:
373
                      exact: spiffe://rule[1]-from[0]-principal[1]
374
                - authenticated:
375
                    principalName:
376
                      exact: spiffe://rule[1]-from[0]-principal[2]
377
            - orIds:
378
                ids:
379
                - andIds:
380
                    ids:
381
                    - metadata:
382
                        filter: envoy.filters.http.jwt_authn
383
                        path:
384
                        - key: payload
385
                        - key: iss
386
                        value:
387
                          stringMatch:
388
                            exact: rule[1]-from[0]-requestPrincipal[1]
389
                    - metadata:
390
                        filter: envoy.filters.http.jwt_authn
391
                        path:
392
                        - key: payload
393
                        - key: sub
394
                        value:
395
                          stringMatch:
396
                            exact: ""
397
                - andIds:
398
                    ids:
399
                    - metadata:
400
                        filter: envoy.filters.http.jwt_authn
401
                        path:
402
                        - key: payload
403
                        - key: iss
404
                        value:
405
                          stringMatch:
406
                            exact: rule[1]-from[0]-requestPrincipal[2]
407
                    - metadata:
408
                        filter: envoy.filters.http.jwt_authn
409
                        path:
410
                        - key: payload
411
                        - key: sub
412
                        value:
413
                          stringMatch:
414
                            exact: ""
415
            - orIds:
416
                ids:
417
                - authenticated:
418
                    principalName:
419
                      safeRegex:
420
                        regex: .*/ns/rule[1]-from[0]-ns[1]/.*
421
                - authenticated:
422
                    principalName:
423
                      safeRegex:
424
                        regex: .*/ns/rule[1]-from[0]-ns[2]/.*
425
            - orIds:
426
                ids:
427
                - remoteIp:
428
                    addressPrefix: 172.22.2.0
429
                    prefixLen: 23
430
                - remoteIp:
431
                    addressPrefix: 172.21.234.254
432
                    prefixLen: 32
433
            - orIds:
434
                ids:
435
                - directRemoteIp:
436
                    addressPrefix: 10.1.0.1
437
                    prefixLen: 32
438
                - directRemoteIp:
439
                    addressPrefix: 10.1.0.2
440
                    prefixLen: 32
441
        - andIds:
442
            ids:
443
            - orIds:
444
                ids:
445
                - authenticated:
446
                    principalName:
447
                      exact: spiffe://rule[1]-from[1]-principal[1]
448
                - authenticated:
449
                    principalName:
450
                      exact: spiffe://rule[1]-from[1]-principal[2]
451
            - orIds:
452
                ids:
453
                - andIds:
454
                    ids:
455
                    - metadata:
456
                        filter: envoy.filters.http.jwt_authn
457
                        path:
458
                        - key: payload
459
                        - key: iss
460
                        value:
461
                          stringMatch:
462
                            exact: rule[1]-from[1]-requestPrincipal[1]
463
                    - metadata:
464
                        filter: envoy.filters.http.jwt_authn
465
                        path:
466
                        - key: payload
467
                        - key: sub
468
                        value:
469
                          stringMatch:
470
                            exact: ""
471
                - andIds:
472
                    ids:
473
                    - metadata:
474
                        filter: envoy.filters.http.jwt_authn
475
                        path:
476
                        - key: payload
477
                        - key: iss
478
                        value:
479
                          stringMatch:
480
                            exact: rule[1]-from[1]-requestPrincipal[2]
481
                    - metadata:
482
                        filter: envoy.filters.http.jwt_authn
483
                        path:
484
                        - key: payload
485
                        - key: sub
486
                        value:
487
                          stringMatch:
488
                            exact: ""
489
            - orIds:
490
                ids:
491
                - authenticated:
492
                    principalName:
493
                      safeRegex:
494
                        regex: .*/ns/rule[1]-from[1]-ns[1]/.*
495
                - authenticated:
496
                    principalName:
497
                      safeRegex:
498
                        regex: .*/ns/rule[1]-from[1]-ns[2]/.*
499
            - orIds:
500
                ids:
501
                - remoteIp:
502
                    addressPrefix: 192.168.4.0
503
                    prefixLen: 24
504
                - remoteIp:
505
                    addressPrefix: 192.168.7.8
506
                    prefixLen: 32
507
            - orIds:
508
                ids:
509
                - directRemoteIp:
510
                    addressPrefix: 10.1.1.1
511
                    prefixLen: 32
512
                - directRemoteIp:
513
                    addressPrefix: 192.1.1.2
514
                    prefixLen: 32
515
  shadowRulesStatPrefix: istio_dry_run_allow_
516
istio

Использование cookies
