istio

1
apiVersion: security.istio.io/v1beta1
2
kind: AuthorizationPolicy
3
metadata:
4
  name: allow
5
spec:
6
  action: ALLOW
7
  rules:
8
  - from:
9
    - source:
10
        principals: [ "principal", "principal-prefix-*", "*-suffix-principal", "*" ]
11
        notPrincipals: [ "not-principal", "not-principal-prefix-*", "*-suffix-not-principal", "*" ]
12
  - from:
13
    - source:
14
        requestPrincipals: [ "requestPrincipals", "requestPrincipals-prefix-*", "*-suffix-requestPrincipals", "*" ]
15
        notRequestPrincipals: [ "not-requestPrincipals", "not-requestPrincipals-prefix-*", "*-suffix-not-requestPrincipals", "*" ]
16
  - from:
17
    - source:
18
        namespaces: [ "ns", "ns-prefix-*", "*-ns-suffix", "*" ]
19
        notNamespaces: [ "not-ns", "not-ns-prefix-*", "*-not-ns-suffix", "*" ]
20
  - from:
21
    - source:
22
        ipBlocks: [ "1.2.3.4", "5.6.0.0/16" ]
23
        notIpBlocks: [ "2.2.3.4", "6.6.0.0/16" ]
24
  - from:
25
    - source:
26
        remoteIpBlocks: [ "1.2.3.4", "5.6.0.0/16" ]
27
        notRemoteIpBlocks: [ "2.2.3.4", "6.6.0.0/16" ]
28
  - to:
29
    - operation:
30
        methods: ["method", "method-prefix-*", "*-suffix-method", "*"]
31
        notMethods: ["not-method", "not-method-prefix-*", "*-suffix-not-method", "*"]
32
  - to:
33
    - operation:
34
        hosts: ["exact.com", "*.suffix.com", "prefix.*", "*"]
35
        notHosts: ["not-exact.com", "*.not-suffix.com", "not-prefix.*", "*"]
36
  - to:
37
    - operation:
38
        ports: ["80", "90"]
39
        notPorts: ["800", "900"]
40
  - to:
41
    - operation:
42
        paths: ["/exact", "/prefix/*", "*/suffix", "*"]
43
        notPaths: ["/not-exact", "/not-prefix/*", "*/not-suffix", "*"]
44
  - when:
45
    - key: "request.headers[X-header]"
46
      values: ["header", "header-prefix-*", "*-suffix-header", "*"]
47
      notValues: ["not-header", "not-header-prefix-*", "*-not-suffix-header", "*"]
48
  - when:
49
    - key: "source.ip"
50
      values: ["10.10.10.10", "192.168.10.0/24"]
51
      notValues: ["90.10.10.10", "90.168.10.0/24"]
52
  - when:
53
    - key: "remote.ip"
54
      values: ["10.10.10.10", "192.168.10.0/24"]
55
      notValues: ["90.10.10.10", "90.168.10.0/24"]
56
  - when:
57
    - key: "source.namespace"
58
      values: ["ns", "ns-prefix-*", "*-ns-suffix", "*"]
59
      notValues: ["not-ns", "not-ns-prefix-*", "*-not-ns-suffix", "*"]
60
  - when:
61
    - key: "source.principal"
62
      values: ["principal", "principal-prefix-*", "*-suffix-principal", "*"]
63
      notValues: ["not-principal", "not-principal-prefix-*", "*-not-suffix-principal", "*"]
64
  - when:
65
    - key: "request.auth.principal"
66
      values: ["requestPrincipals", "requestPrincipals-prefix-*", "*-suffix-requestPrincipals", "*"]
67
      notValues: ["not-requestPrincipals", "not-requestPrincipals-prefix-*", "*-not-suffix-requestPrincipals", "*"]
68
  - when:
69
    - key: "request.auth.audiences"
70
      values: ["audiences", "audiences-prefix-*", "*-suffix-audiences", "*"]
71
      notValues: ["not-audiences", "not-audiences-prefix-*", "*-not-suffix-audiences", "*"]
72
  - when:
73
    - key: "request.auth.presenter"
74
      values: ["presenter", "presenter-prefix-*", "*-suffix-presenter", "*"]
75
      notValues: ["not-presenter", "not-presenter-prefix-*", "*-not-suffix-presenter", "*"]
76
  - when:
77
    - key: "request.auth.claims[iss]"
78
      values: ["iss", "iss-prefix-*", "*-suffix-iss", "*"]
79
      notValues: ["not-iss", "not-iss-prefix-*", "*-not-suffix-iss", "*"]
80
  - when:
81
    - key: "request.auth.claims[nested1][nested2]"
82
      values: ["nested", "nested-prefix-*", "*-suffix-nested", "*"]
83
      notValues: ["not-nested", "not-nested-prefix-*", "*-not-suffix-nested", "*"]
84
  - when:
85
    - key: "destination.ip"
86
      values: ["10.10.10.10", "192.168.10.0/24"]
87
      notValues: ["90.10.10.10", "90.168.10.0/24"]
88
  - when:
89
    - key: "destination.port"
90
      values: ["91", "92"]
91
      notValues: ["9001", "9002"]
92
  - when:
93
    - key: "connection.sni"
94
      values: ["exact.com", "*.suffix.com", "prefix.*", "*"]
95
      notValues: ["not-exact.com", "*.not-suffix.com", "not-prefix.*", "*"]
96
  - when:
97
    - key: "experimental.envoy.filters.a.b[c]"
98
      values: ["exact", "prefix-*", "*-suffix", "*"]
99
      notValues: ["not-exact", "not-prefix-*", "*-not-suffix", "*"]
100

101