istio

single-policy-out.yaml
427 строк · 14.1 Кб
Перенос по словам
1
name: envoy.filters.http.rbac
2
typedConfig:
3
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
4
  rules:
5
    policies:
6
      ns[foo]-policy[httpbin]-rule[0]:
7
        permissions:
8
        - andRules:
9
            rules:
10
            - orRules:
11
                rules:
12
                - header:
13
                    name: :authority
14
                    stringMatch:
15
                      exact: rule[0]-to[0]-host[1]
16
                      ignoreCase: true
17
                - header:
18
                    name: :authority
19
                    stringMatch:
20
                      exact: rule[0]-to[0]-host[2]
21
                      ignoreCase: true
22
            - orRules:
23
                rules:
24
                - header:
25
                    name: :method
26
                    stringMatch:
27
                      exact: rule[0]-to[0]-method[1]
28
                - header:
29
                    name: :method
30
                    stringMatch:
31
                      exact: rule[0]-to[0]-method[2]
32
            - orRules:
33
                rules:
34
                - urlPath:
35
                    path:
36
                      exact: rule[0]-to[0]-path[1]
37
                - urlPath:
38
                    path:
39
                      exact: rule[0]-to[0]-path[2]
40
            - orRules:
41
                rules:
42
                - destinationPort: 9001
43
                - destinationPort: 9002
44
            - orRules:
45
                rules:
46
                - destinationIp:
47
                    addressPrefix: 10.10.10.10
48
                    prefixLen: 32
49
                - destinationIp:
50
                    addressPrefix: 192.168.10.0
51
                    prefixLen: 24
52
        - andRules:
53
            rules:
54
            - orRules:
55
                rules:
56
                - header:
57
                    name: :authority
58
                    stringMatch:
59
                      exact: rule[0]-to[1]-host[1]
60
                      ignoreCase: true
61
                - header:
62
                    name: :authority
63
                    stringMatch:
64
                      exact: rule[0]-to[1]-host[2]
65
                      ignoreCase: true
66
            - orRules:
67
                rules:
68
                - header:
69
                    name: :method
70
                    stringMatch:
71
                      exact: rule[0]-to[1]-method[1]
72
                - header:
73
                    name: :method
74
                    stringMatch:
75
                      exact: rule[0]-to[1]-method[2]
76
            - orRules:
77
                rules:
78
                - urlPath:
79
                    path:
80
                      exact: rule[0]-to[1]-path[1]
81
                - urlPath:
82
                    path:
83
                      exact: rule[0]-to[1]-path[2]
84
            - orRules:
85
                rules:
86
                - destinationPort: 9011
87
                - destinationPort: 9012
88
            - orRules:
89
                rules:
90
                - destinationIp:
91
                    addressPrefix: 10.10.10.10
92
                    prefixLen: 32
93
                - destinationIp:
94
                    addressPrefix: 192.168.10.0
95
                    prefixLen: 24
96
        principals:
97
        - andIds:
98
            ids:
99
            - orIds:
100
                ids:
101
                - authenticated:
102
                    principalName:
103
                      exact: spiffe://rule[0]-from[0]-principal[1]
104
                - authenticated:
105
                    principalName:
106
                      exact: spiffe://rule[0]-from[0]-principal[2]
107
            - orIds:
108
                ids:
109
                - metadata:
110
                    filter: istio_authn
111
                    path:
112
                    - key: request.auth.principal
113
                    value:
114
                      stringMatch:
115
                        exact: rule[0]-from[0]-requestPrincipal[1]
116
                - metadata:
117
                    filter: istio_authn
118
                    path:
119
                    - key: request.auth.principal
120
                    value:
121
                      stringMatch:
122
                        exact: rule[0]-from[0]-requestPrincipal[2]
123
            - orIds:
124
                ids:
125
                - authenticated:
126
                    principalName:
127
                      safeRegex:
128
                        regex: .*/ns/rule[0]-from[0]-ns[1]/.*
129
                - authenticated:
130
                    principalName:
131
                      safeRegex:
132
                        regex: .*/ns/rule[0]-from[0]-ns[2]/.*
133
            - orIds:
134
                ids:
135
                - remoteIp:
136
                    addressPrefix: 172.16.10.10
137
                    prefixLen: 32
138
            - orIds:
139
                ids:
140
                - directRemoteIp:
141
                    addressPrefix: 10.0.0.1
142
                    prefixLen: 32
143
                - directRemoteIp:
144
                    addressPrefix: 10.0.0.2
145
                    prefixLen: 32
146
            - orIds:
147
                ids:
148
                - header:
149
                    name: X-header
150
                    stringMatch:
151
                      exact: header
152
                - header:
153
                    name: X-header
154
                    stringMatch:
155
                      prefix: header-prefix-
156
                - header:
157
                    name: X-header
158
                    stringMatch:
159
                      suffix: -suffix-header
160
                - header:
161
                    name: X-header
162
                    presentMatch: true
163
            - orIds:
164
                ids:
165
                - remoteIp:
166
                    addressPrefix: 10.99.10.8
167
                    prefixLen: 32
168
                - remoteIp:
169
                    addressPrefix: 10.80.64.0
170
                    prefixLen: 18
171
        - andIds:
172
            ids:
173
            - orIds:
174
                ids:
175
                - authenticated:
176
                    principalName:
177
                      exact: spiffe://rule[0]-from[1]-principal[1]
178
                - authenticated:
179
                    principalName:
180
                      exact: spiffe://rule[0]-from[1]-principal[2]
181
            - orIds:
182
                ids:
183
                - metadata:
184
                    filter: istio_authn
185
                    path:
186
                    - key: request.auth.principal
187
                    value:
188
                      stringMatch:
189
                        exact: rule[0]-from[1]-requestPrincipal[1]
190
                - metadata:
191
                    filter: istio_authn
192
                    path:
193
                    - key: request.auth.principal
194
                    value:
195
                      stringMatch:
196
                        exact: rule[0]-from[1]-requestPrincipal[2]
197
            - orIds:
198
                ids:
199
                - authenticated:
200
                    principalName:
201
                      safeRegex:
202
                        regex: .*/ns/rule[0]-from[1]-ns[1]/.*
203
                - authenticated:
204
                    principalName:
205
                      safeRegex:
206
                        regex: .*/ns/rule[0]-from[1]-ns[2]/.*
207
            - orIds:
208
                ids:
209
                - remoteIp:
210
                    addressPrefix: 172.17.8.0
211
                    prefixLen: 24
212
                - remoteIp:
213
                    addressPrefix: 172.17.9.4
214
                    prefixLen: 32
215
            - orIds:
216
                ids:
217
                - directRemoteIp:
218
                    addressPrefix: 10.0.1.1
219
                    prefixLen: 32
220
                - directRemoteIp:
221
                    addressPrefix: 192.0.1.2
222
                    prefixLen: 32
223
            - orIds:
224
                ids:
225
                - header:
226
                    name: X-header
227
                    stringMatch:
228
                      exact: header
229
                - header:
230
                    name: X-header
231
                    stringMatch:
232
                      prefix: header-prefix-
233
                - header:
234
                    name: X-header
235
                    stringMatch:
236
                      suffix: -suffix-header
237
                - header:
238
                    name: X-header
239
                    presentMatch: true
240
            - orIds:
241
                ids:
242
                - remoteIp:
243
                    addressPrefix: 10.99.10.8
244
                    prefixLen: 32
245
                - remoteIp:
246
                    addressPrefix: 10.80.64.0
247
                    prefixLen: 18
248
      ns[foo]-policy[httpbin]-rule[1]:
249
        permissions:
250
        - andRules:
251
            rules:
252
            - orRules:
253
                rules:
254
                - header:
255
                    name: :authority
256
                    stringMatch:
257
                      exact: rule[1]-to[0]-host[1]
258
                      ignoreCase: true
259
                - header:
260
                    name: :authority
261
                    stringMatch:
262
                      exact: rule[1]-to[0]-host[2]
263
                      ignoreCase: true
264
            - orRules:
265
                rules:
266
                - header:
267
                    name: :method
268
                    stringMatch:
269
                      exact: rule[1]-to[0]-method[1]
270
                - header:
271
                    name: :method
272
                    stringMatch:
273
                      exact: rule[1]-to[0]-method[2]
274
            - orRules:
275
                rules:
276
                - urlPath:
277
                    path:
278
                      exact: rule[1]-to[0]-path[1]
279
                - urlPath:
280
                    path:
281
                      exact: rule[1]-to[0]-path[2]
282
            - orRules:
283
                rules:
284
                - destinationPort: 9101
285
                - destinationPort: 9102
286
        - andRules:
287
            rules:
288
            - orRules:
289
                rules:
290
                - header:
291
                    name: :authority
292
                    stringMatch:
293
                      exact: rule[1]-to[1]-host[1]
294
                      ignoreCase: true
295
                - header:
296
                    name: :authority
297
                    stringMatch:
298
                      exact: rule[1]-to[1]-host[2]
299
                      ignoreCase: true
300
            - orRules:
301
                rules:
302
                - header:
303
                    name: :method
304
                    stringMatch:
305
                      exact: rule[1]-to[1]-method[1]
306
                - header:
307
                    name: :method
308
                    stringMatch:
309
                      exact: rule[1]-to[1]-method[2]
310
            - orRules:
311
                rules:
312
                - urlPath:
313
                    path:
314
                      exact: rule[1]-to[1]-path[1]
315
                - urlPath:
316
                    path:
317
                      exact: rule[1]-to[1]-path[2]
318
            - orRules:
319
                rules:
320
                - destinationPort: 9111
321
                - destinationPort: 9112
322
        principals:
323
        - andIds:
324
            ids:
325
            - orIds:
326
                ids:
327
                - authenticated:
328
                    principalName:
329
                      exact: spiffe://rule[1]-from[0]-principal[1]
330
                - authenticated:
331
                    principalName:
332
                      exact: spiffe://rule[1]-from[0]-principal[2]
333
            - orIds:
334
                ids:
335
                - metadata:
336
                    filter: istio_authn
337
                    path:
338
                    - key: request.auth.principal
339
                    value:
340
                      stringMatch:
341
                        exact: rule[1]-from[0]-requestPrincipal[1]
342
                - metadata:
343
                    filter: istio_authn
344
                    path:
345
                    - key: request.auth.principal
346
                    value:
347
                      stringMatch:
348
                        exact: rule[1]-from[0]-requestPrincipal[2]
349
            - orIds:
350
                ids:
351
                - authenticated:
352
                    principalName:
353
                      safeRegex:
354
                        regex: .*/ns/rule[1]-from[0]-ns[1]/.*
355
                - authenticated:
356
                    principalName:
357
                      safeRegex:
358
                        regex: .*/ns/rule[1]-from[0]-ns[2]/.*
359
            - orIds:
360
                ids:
361
                - remoteIp:
362
                    addressPrefix: 172.22.2.0
363
                    prefixLen: 23
364
                - remoteIp:
365
                    addressPrefix: 172.21.234.254
366
                    prefixLen: 32
367
            - orIds:
368
                ids:
369
                - directRemoteIp:
370
                    addressPrefix: 10.1.0.1
371
                    prefixLen: 32
372
                - directRemoteIp:
373
                    addressPrefix: 10.1.0.2
374
                    prefixLen: 32
375
        - andIds:
376
            ids:
377
            - orIds:
378
                ids:
379
                - authenticated:
380
                    principalName:
381
                      exact: spiffe://rule[1]-from[1]-principal[1]
382
                - authenticated:
383
                    principalName:
384
                      exact: spiffe://rule[1]-from[1]-principal[2]
385
            - orIds:
386
                ids:
387
                - metadata:
388
                    filter: istio_authn
389
                    path:
390
                    - key: request.auth.principal
391
                    value:
392
                      stringMatch:
393
                        exact: rule[1]-from[1]-requestPrincipal[1]
394
                - metadata:
395
                    filter: istio_authn
396
                    path:
397
                    - key: request.auth.principal
398
                    value:
399
                      stringMatch:
400
                        exact: rule[1]-from[1]-requestPrincipal[2]
401
            - orIds:
402
                ids:
403
                - authenticated:
404
                    principalName:
405
                      safeRegex:
406
                        regex: .*/ns/rule[1]-from[1]-ns[1]/.*
407
                - authenticated:
408
                    principalName:
409
                      safeRegex:
410
                        regex: .*/ns/rule[1]-from[1]-ns[2]/.*
411
            - orIds:
412
                ids:
413
                - remoteIp:
414
                    addressPrefix: 192.168.4.0
415
                    prefixLen: 24
416
                - remoteIp:
417
                    addressPrefix: 192.168.7.8
418
                    prefixLen: 32
419
            - orIds:
420
                ids:
421
                - directRemoteIp:
422
                    addressPrefix: 10.1.1.1
423
                    prefixLen: 32
424
                - directRemoteIp:
425
                    addressPrefix: 192.1.1.2
426
                    prefixLen: 32
427
  shadowRulesStatPrefix: istio_dry_run_allow_
428
istio

Использование cookies
