Last active
June 10, 2020 08:26
-
-
Save incfly/fbf5ada547bb697b05629406dd589f8f to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| apiVersion: "security.istio.io/v1beta1" | |
| kind: "AuthorizationPolicy" | |
| metadata: | |
| name: "authz" | |
| namespace: default | |
| spec: | |
| selector: | |
| matchLabels: | |
| app: httpbin | |
| rules: | |
| - from: | |
| - source: | |
| namespaces: ["default"] | |
| #principals: ["cluster.local/ns/default/sa/bookinfo-productpage"] | |
| to: | |
| - operation: | |
| methods: ["GET"] | |
| --- | |
| # MTLS on default ns. | |
| apiVersion: "security.istio.io/v1beta1" | |
| kind: "PeerAuthentication" | |
| metadata: | |
| name: "default" | |
| namespace: "default" | |
| spec: | |
| mtls: | |
| mode: STRICT | |
| --- | |
| apiVersion: "security.istio.io/v1beta1" | |
| kind: "RequestAuthentication" | |
| metadata: | |
| name: "jwt-example" | |
| namespace: default | |
| spec: | |
| selector: | |
| matchLabels: | |
| app: httpbin | |
| jwtRules: | |
| - issuer: "[email protected]" | |
| jwksUri: "https://raw.githubusercontent.com/istio/istio/release-1.6/security/tools/jwt/samples/jwks.json" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "filter_chain_match": { | |
| "prefix_ranges": [ | |
| { | |
| "address_prefix": "10.40.3.35", | |
| "prefix_len": 32 | |
| } | |
| ], | |
| "destination_port": 80 | |
| }, | |
| "filters": [ | |
| { | |
| "name": "istio.metadata_exchange", | |
| "typed_config": { | |
| "@type": "type.googleapis.com/udpa.type.v1.TypedStruct", | |
| "type_url": "type.googleapis.com/envoy.tcp.metadataexchange.config.MetadataExchange", | |
| "value": { | |
| "protocol": "istio-peer-exchange" | |
| } | |
| } | |
| }, | |
| { | |
| "name": "envoy.http_connection_manager", | |
| "typed_config": { | |
| "@type": "type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager", | |
| "stat_prefix": "inbound_10.40.3.35_80", | |
| "route_config": { | |
| "name": "inbound|8000|http|httpbin.default.svc.cluster.local", | |
| "virtual_hosts": [ | |
| { | |
| "name": "inbound|http|8000", | |
| "domains": [ | |
| "*" | |
| ], | |
| "routes": [ | |
| { | |
| "match": { | |
| "prefix": "/" | |
| }, | |
| "route": { | |
| "cluster": "inbound|8000|http|httpbin.default.svc.cluster.local", | |
| "timeout": "0s", | |
| "max_grpc_timeout": "0s" | |
| }, | |
| "decorator": { | |
| "operation": "httpbin.default.svc.cluster.local:8000/*" | |
| }, | |
| "name": "default" | |
| } | |
| ] | |
| } | |
| ], | |
| "validate_clusters": false | |
| }, | |
| "http_filters": [ | |
| { | |
| "name": "istio.metadata_exchange", | |
| "typed_config": { | |
| "@type": "type.googleapis.com/udpa.type.v1.TypedStruct", | |
| "type_url": "type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm", | |
| "value": { | |
| "config": { | |
| "vm_config": { | |
| "runtime": "envoy.wasm.runtime.null", | |
| "code": { | |
| "local": { | |
| "inline_string": "envoy.wasm.metadata_exchange" | |
| } | |
| } | |
| }, | |
| "configuration": "{}\n" | |
| } | |
| } | |
| } | |
| }, | |
| { | |
| "name": "envoy.filters.http.jwt_authn", | |
| "typed_config": { | |
| "@type": "type.googleapis.com/envoy.config.filter.http.jwt_authn.v2alpha.JwtAuthentication", | |
| "providers": { | |
| "origins-0": { | |
| "issuer": "[email protected]", | |
| "local_jwks": { | |
| "inline_string": "{ \"keys\":[ {\"e\":\"AQAB\",\"kid\":\"DHFbpoIUqrY8t2zpA2qXfCmr5VO5ZEr4RzHU_-envvQ\",\"kty\":\"RSA\",\"n\":\"xAE7eB6qugXyCAG3yhh7pkDkT65pHymX-P7KfIupjf59vsdo91bSP9C8H07pSAGQO1MV_xFj9VswgsCg4R6otmg5PV2He95lZdHtOcU5DXIg_pbhLdKXbi66GlVeK6ABZOUW3WYtnNHD-91gVuoeJT_DwtGGcp4ignkgXfkiEm4sw-4sfb4qdt5oLbyVpmW6x9cfa7vs2WTfURiCrBoUqgBo_-4WTiULmmHSGZHOjzwa8WtrtOQGsAFjIbno85jp6MnGGGZPYZbDAa_b3y5u-YpW7ypZrvD8BgtKVjgtQgZhLAGezMt0ua3DRrWnKqTZ0BJ_EyxOGuHJrLsn00fnMQ\"}]}" | |
| }, | |
| "payload_in_metadata": "[email protected]" | |
| } | |
| }, | |
| "rules": [ | |
| { | |
| "match": { | |
| "prefix": "/" | |
| }, | |
| "requires": { | |
| "requires_any": { | |
| "requirements": [ | |
| { | |
| "provider_name": "origins-0" | |
| }, | |
| { | |
| "allow_missing": {} | |
| } | |
| ] | |
| } | |
| } | |
| } | |
| ] | |
| } | |
| }, | |
| { | |
| "name": "istio_authn", | |
| "typed_config": { | |
| "@type": "type.googleapis.com/istio.envoy.config.filter.http.authn.v2alpha1.FilterConfig", | |
| "policy": { | |
| "peers": [ | |
| { | |
| "mtls": {} | |
| } | |
| ], | |
| "origins": [ | |
| { | |
| "jwt": { | |
| "issuer": "[email protected]" | |
| } | |
| } | |
| ], | |
| "origin_is_optional": true, | |
| "principal_binding": "USE_ORIGIN" | |
| } | |
| } | |
| }, | |
| { | |
| "name": "envoy.filters.http.rbac", | |
| "typed_config": { | |
| "@type": "type.googleapis.com/envoy.config.filter.http.rbac.v2.RBAC", | |
| "rules": { | |
| "policies": { | |
| "ns[default]-policy[authz]-rule[0]": { | |
| "permissions": [ | |
| { | |
| "and_rules": { | |
| "rules": [ | |
| { | |
| "or_rules": { | |
| "rules": [ | |
| { | |
| "header": { | |
| "name": ":method", | |
| "exact_match": "GET" | |
| } | |
| } | |
| ] | |
| } | |
| } | |
| ] | |
| } | |
| } | |
| ], | |
| "principals": [ | |
| { | |
| "and_ids": { | |
| "ids": [ | |
| { | |
| "or_ids": { | |
| "ids": [ | |
| { | |
| "metadata": { | |
| "filter": "istio_authn", | |
| "path": [ | |
| { | |
| "key": "source.principal" | |
| } | |
| ], | |
| "value": { | |
| "string_match": { | |
| "safe_regex": { | |
| "google_re2": {}, | |
| "regex": ".*/ns/default/.*" | |
| } | |
| } | |
| } | |
| } | |
| } | |
| ] | |
| } | |
| } | |
| ] | |
| } | |
| } | |
| ] | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| { | |
| "name": "envoy.cors", | |
| "typed_config": { | |
| "@type": "type.googleapis.com/envoy.config.filter.http.cors.v2.Cors" | |
| } | |
| }, | |
| { | |
| "name": "envoy.fault", | |
| "typed_config": { | |
| "@type": "type.googleapis.com/envoy.config.filter.http.fault.v2.HTTPFault" | |
| } | |
| }, | |
| { | |
| "name": "istio.stats", | |
| "typed_config": { | |
| "@type": "type.googleapis.com/udpa.type.v1.TypedStruct", | |
| "type_url": "type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm", | |
| "value": { | |
| "config": { | |
| "root_id": "stats_inbound", | |
| "vm_config": { | |
| "vm_id": "stats_inbound", | |
| "runtime": "envoy.wasm.runtime.null", | |
| "code": { | |
| "local": { | |
| "inline_string": "envoy.wasm.stats" | |
| } | |
| } | |
| }, | |
| "configuration": "{\n \"debug\": \"false\",\n \"stat_prefix\": \"istio\"\n}\n" | |
| } | |
| } | |
| } | |
| }, | |
| { | |
| "name": "envoy.router", | |
| "typed_config": { | |
| "@type": "type.googleapis.com/envoy.config.filter.http.router.v2.Router" | |
| } | |
| } | |
| ], | |
| "tracing": { | |
| "client_sampling": { | |
| "value": 100 | |
| }, | |
| "random_sampling": { | |
| "value": 100 | |
| }, | |
| "overall_sampling": { | |
| "value": 100 | |
| } | |
| }, | |
| "server_name": "istio-envoy", | |
| "access_log": [ | |
| { | |
| "name": "envoy.file_access_log", | |
| "typed_config": { | |
| "@type": "type.googleapis.com/envoy.config.accesslog.v2.FileAccessLog", | |
| "path": "/dev/stdout", | |
| "format": "[%START_TIME%] \"%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%\" %RESPONSE_CODE% %RESPONSE_FLAGS% \"%DYNAMIC_METADATA(istio.mixer:status)%\" \"%UPSTREAM_TRANSPORT_FAILURE_REASON%\" %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% \"%REQ(X-FORWARDED-FOR)%\" \"%REQ(USER-AGENT)%\" \"%REQ(X-REQUEST-ID)%\" \"%REQ(:AUTHORITY)%\" \"%UPSTREAM_HOST%\" %UPSTREAM_CLUSTER% %UPSTREAM_LOCAL_ADDRESS% %DOWNSTREAM_LOCAL_ADDRESS% %DOWNSTREAM_REMOTE_ADDRESS% %REQUESTED_SERVER_NAME% %ROUTE_NAME%\n" | |
| } | |
| } | |
| ], | |
| "use_remote_address": false, | |
| "generate_request_id": true, | |
| "forward_client_cert_details": "APPEND_FORWARD", | |
| "set_current_client_cert_details": { | |
| "subject": true, | |
| "dns": true, | |
| "uri": true | |
| }, | |
| "upgrade_configs": [ | |
| { | |
| "upgrade_type": "websocket" | |
| } | |
| ], | |
| "stream_idle_timeout": "0s", | |
| "normalize_path": true | |
| } | |
| } | |
| ], | |
| "transport_socket": { | |
| "name": "envoy.transport_sockets.tls", | |
| "typed_config": { | |
| "@type": "type.googleapis.com/envoy.api.v2.auth.DownstreamTlsContext", | |
| "common_tls_context": { | |
| "alpn_protocols": [ | |
| "h2", | |
| "http/1.1" | |
| ], | |
| "tls_certificate_sds_secret_configs": [ | |
| { | |
| "name": "default", | |
| "sds_config": { | |
| "api_config_source": { | |
| "api_type": "GRPC", | |
| "grpc_services": [ | |
| { | |
| "envoy_grpc": { | |
| "cluster_name": "sds-grpc" | |
| } | |
| } | |
| ] | |
| } | |
| } | |
| } | |
| ], | |
| "combined_validation_context": { | |
| "default_validation_context": {}, | |
| "validation_context_sds_secret_config": { | |
| "name": "ROOTCA", | |
| "sds_config": { | |
| "api_config_source": { | |
| "api_type": "GRPC", | |
| "grpc_services": [ | |
| { | |
| "envoy_grpc": { | |
| "cluster_name": "sds-grpc" | |
| } | |
| } | |
| ] | |
| } | |
| } | |
| } | |
| } | |
| }, | |
| "require_client_certificate": true | |
| } | |
| }, | |
| "name": "10.40.3.35_80" | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment