use istio client-go library instead of knative (#1661)
use istio client-go library instead of knative bump kubernetes dependency version change code coverage to codecov
This commit is contained in:
zryfish
513
vendor/istio.io/api/security/v1beta1/istio.security.v1beta1.pb.html
generated
vendored
Normal file
513
vendor/istio.io/api/security/v1beta1/istio.security.v1beta1.pb.html
generated
vendored
Normal file
@@ -0,0 +1,513 @@
|
||||
---
|
||||
title: Authorization Policy
|
||||
description: Configuration for access control on workloads.
|
||||
location: https://istio.io/docs/reference/config/security/authorization-policy.html
|
||||
layout: protoc-gen-docs
|
||||
generator: protoc-gen-docs
|
||||
weight: 20
|
||||
aliases: [/docs/reference/config/authorization/authorization-policy.html]
|
||||
number_of_entries: 8
|
||||
---
|
||||
<p>Istio Authorization Policy enables access control on workloads in the mesh.</p>
|
||||
|
||||
<p>For example, the following authorization policy applies to workloads matched with
|
||||
label selector “app: httpbin, version: v1”.</p>
|
||||
|
||||
<p>It allows requests from:
|
||||
- service account “cluster.local/ns/default/sa/sleep” or
|
||||
- namespace “test”
|
||||
to access the workload with:
|
||||
- “GET” method at paths of prefix “/info” or,
|
||||
- “POST” method at path “/data”.
|
||||
when the request has a valid JWT token issued by “https://accounts.google.com”.</p>
|
||||
|
||||
<p>Any other requests will be rejected.</p>
|
||||
|
||||
<pre><code class="language-yaml">apiVersion: security.istio.io/v1beta1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: httpbin
|
||||
namespace: foo
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: httpbin
|
||||
version: v1
|
||||
rules:
|
||||
- from:
|
||||
- source:
|
||||
principals: ["cluster.local/ns/default/sa/sleep"]
|
||||
- source:
|
||||
namespaces: ["test"]
|
||||
to:
|
||||
- operation:
|
||||
methods: ["GET"]
|
||||
paths: ["/info*"]
|
||||
- operation:
|
||||
methods: ["POST"]
|
||||
paths: ["/data"]
|
||||
when:
|
||||
- key: request.auth.claims[iss]
|
||||
values: ["https://accounts.google.com"]
|
||||
</code></pre>
|
||||
|
||||
<p>Access control is enabled on a workload if there is any authorization policies selecting
|
||||
the workload. When access control is enabled, the default behavior is deny (deny-by-default)
|
||||
which means requests to the workload will be rejected if the request is not allowed by any of
|
||||
the authorization policies selecting the workload.</p>
|
||||
|
||||
<p>Currently AuthorizationPolicy only supports “ALLOW” action. This means that
|
||||
if multiple authorization policies apply to the same workload, the effect is additive.</p>
|
||||
|
||||
<p>Authorization Policy scope (target) is determined by “metadata/namespace” and
|
||||
an optional “selector”.
|
||||
- “metadata/namespace” tells which namespace the policy applies. If set to root
|
||||
namespace, the policy applies to all namespaces in a mesh.
|
||||
- workload “selector” can be used to further restrict where a policy applies.</p>
|
||||
|
||||
<p>For example,</p>
|
||||
|
||||
<p>The following authorization policy applies to workloads containing label
|
||||
“app: httpbin” in namespace bar.</p>
|
||||
|
||||
<pre><code class="language-yaml">apiVersion: security.istio.io/v1beta1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: policy
|
||||
namespace: bar
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: httpbin
|
||||
</code></pre>
|
||||
|
||||
<p>The following authorization policy applies to all workloads in namespace foo.</p>
|
||||
|
||||
<pre><code class="language-yaml">apiVersion: security.istio.io/v1beta1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: policy
|
||||
namespace: foo
|
||||
spec:
|
||||
</code></pre>
|
||||
|
||||
<p>The following authorization policy applies to workloads containing label
|
||||
“version: v1” in all namespaces in the mesh. (Assuming the root namespace is
|
||||
configured to “istio-config”).</p>
|
||||
|
||||
<pre><code class="language-yaml">apiVersion: security.istio.io/v1beta1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: policy
|
||||
namespace: istio-config
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
version: v1
|
||||
</code></pre>
|
||||
|
||||
<h2 id="AuthorizationPolicy">AuthorizationPolicy</h2>
|
||||
<section>
|
||||
<p>AuthorizationPolicy enables access control on workloads.</p>
|
||||
|
||||
<p>For example, the following authorization policy denies all requests to workloads
|
||||
in namespace foo.</p>
|
||||
|
||||
<pre><code class="language-yaml">apiVersion: security.istio.io/v1beta1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: deny-all
|
||||
namespace: foo
|
||||
spec:
|
||||
</code></pre>
|
||||
|
||||
<p>The following authorization policy allows all requests to workloads in namespace
|
||||
foo.</p>
|
||||
|
||||
<pre><code class="language-yaml">apiVersion: security.istio.io/v1beta1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: allow-all
|
||||
namespace: foo
|
||||
spec:
|
||||
rules:
|
||||
- {}
|
||||
</code></pre>
|
||||
|
||||
<table class="message-fields">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Field</th>
|
||||
<th>Type</th>
|
||||
<th>Description</th>
|
||||
<th>Required</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr id="AuthorizationPolicy-selector">
|
||||
<td><code>selector</code></td>
|
||||
<td><code><a href="https://istio.io/docs/reference/config/type/v1beta1/workload-selector.html#WorkloadSelector">WorkloadSelector</a></code></td>
|
||||
<td>
|
||||
<p>Optional. Workload selector decides where to apply the authorization policy.
|
||||
If not set, the authorization policy will be applied to all workloads in the
|
||||
same namespace as the authorization policy.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
No
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="AuthorizationPolicy-rules">
|
||||
<td><code>rules</code></td>
|
||||
<td><code><a href="#Rule">Rule[]</a></code></td>
|
||||
<td>
|
||||
<p>Optional. A list of rules to specify the allowed access to the workload.</p>
|
||||
|
||||
<p>If not set, access is denied unless explicitly allowed by other authorization policy.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
No
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</section>
|
||||
<h2 id="Condition">Condition</h2>
|
||||
<section>
|
||||
<p>Condition specifies additional required attributes.</p>
|
||||
|
||||
<table class="message-fields">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Field</th>
|
||||
<th>Type</th>
|
||||
<th>Description</th>
|
||||
<th>Required</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr id="Condition-key">
|
||||
<td><code>key</code></td>
|
||||
<td><code>string</code></td>
|
||||
<td>
|
||||
<p>The name of an Istio attribute.
|
||||
See the <a href="https://istio.io/docs/reference/config/">full list of supported attributes</a>.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
Yes
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="Condition-values">
|
||||
<td><code>values</code></td>
|
||||
<td><code>string[]</code></td>
|
||||
<td>
|
||||
<p>The allowed values for the attribute.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
Yes
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</section>
|
||||
<h2 id="Operation">Operation</h2>
|
||||
<section>
|
||||
<p>Operation specifies the operations of a request.</p>
|
||||
|
||||
<table class="message-fields">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Field</th>
|
||||
<th>Type</th>
|
||||
<th>Description</th>
|
||||
<th>Required</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr id="Operation-hosts">
|
||||
<td><code>hosts</code></td>
|
||||
<td><code>string[]</code></td>
|
||||
<td>
|
||||
<p>Optional. A list of hosts, which matches to the “request.host” attribute.</p>
|
||||
|
||||
<p>If not set, any host is allowed. Must be used only with HTTP.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
No
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="Operation-ports">
|
||||
<td><code>ports</code></td>
|
||||
<td><code>string[]</code></td>
|
||||
<td>
|
||||
<p>Optional. A list of ports, which matches to the “destination.port” attribute.</p>
|
||||
|
||||
<p>If not set, any port is allowed.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
No
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="Operation-methods">
|
||||
<td><code>methods</code></td>
|
||||
<td><code>string[]</code></td>
|
||||
<td>
|
||||
<p>Optional. A list of methods, which matches to the “request.method” attribute.
|
||||
For gRPC service, this should be the fully-qualified name in the form of
|
||||
“/package.service/method”</p>
|
||||
|
||||
<p>If not set, any method is allowed. Must be used only with HTTP or gRPC.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
No
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="Operation-paths">
|
||||
<td><code>paths</code></td>
|
||||
<td><code>string[]</code></td>
|
||||
<td>
|
||||
<p>Optional. A list of paths, which matches to the “request.url_path” attribute.</p>
|
||||
|
||||
<p>If not set, any path is allowed. Must be used only with HTTP.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
No
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</section>
|
||||
<h2 id="Rule">Rule</h2>
|
||||
<section>
|
||||
<p>Rule allows access from a list of sources to perform a list of operations when
|
||||
the condition is matched.</p>
|
||||
|
||||
<p>Any string field in the rule supports Exact, Prefix, Suffix and Presence match:
|
||||
- Exact match: “abc” will match on value “abc”.
|
||||
- Prefix match: “abc<em>” will match on value “abc” and “abcd”.
|
||||
- Suffix match: “</em>abc” will match on value “abc” and “xabc”.
|
||||
- Presence match: “*” will match when value is not empty.</p>
|
||||
|
||||
<table class="message-fields">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Field</th>
|
||||
<th>Type</th>
|
||||
<th>Description</th>
|
||||
<th>Required</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr id="Rule-from">
|
||||
<td><code>from</code></td>
|
||||
<td><code><a href="#Rule-From">From[]</a></code></td>
|
||||
<td>
|
||||
<p>Optional. from specifies the source of a request.</p>
|
||||
|
||||
<p>If not set, any source is allowed.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
No
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="Rule-to">
|
||||
<td><code>to</code></td>
|
||||
<td><code><a href="#Rule-To">To[]</a></code></td>
|
||||
<td>
|
||||
<p>Optional. to specifies the operation of a request.</p>
|
||||
|
||||
<p>If not set, any operation is allowed.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
No
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="Rule-when">
|
||||
<td><code>when</code></td>
|
||||
<td><code><a href="#Condition">Condition[]</a></code></td>
|
||||
<td>
|
||||
<p>Optional. when specifies a list of additional conditions of a request.</p>
|
||||
|
||||
<p>If not set, any condition is allowed.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
No
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</section>
|
||||
<h2 id="Rule-From">Rule.From</h2>
|
||||
<section>
|
||||
<p>From includes a list or sources.</p>
|
||||
|
||||
<table class="message-fields">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Field</th>
|
||||
<th>Type</th>
|
||||
<th>Description</th>
|
||||
<th>Required</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr id="Rule-From-source">
|
||||
<td><code>source</code></td>
|
||||
<td><code><a href="#Source">Source</a></code></td>
|
||||
<td>
|
||||
<p>Source specifies the source of a request.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
No
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</section>
|
||||
<h2 id="Rule-To">Rule.To</h2>
|
||||
<section>
|
||||
<p>To includes a list or operations.</p>
|
||||
|
||||
<table class="message-fields">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Field</th>
|
||||
<th>Type</th>
|
||||
<th>Description</th>
|
||||
<th>Required</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr id="Rule-To-operation">
|
||||
<td><code>operation</code></td>
|
||||
<td><code><a href="#Operation">Operation</a></code></td>
|
||||
<td>
|
||||
<p>Operation specifies the operation of a request.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
No
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</section>
|
||||
<h2 id="Source">Source</h2>
|
||||
<section>
|
||||
<p>Source specifies the source identities of a request.</p>
|
||||
|
||||
<table class="message-fields">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Field</th>
|
||||
<th>Type</th>
|
||||
<th>Description</th>
|
||||
<th>Required</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr id="Source-principals">
|
||||
<td><code>principals</code></td>
|
||||
<td><code>string[]</code></td>
|
||||
<td>
|
||||
<p>Optional. A list of source peer identities (i.e. service account), which
|
||||
matches to the “source.principal” attribute.</p>
|
||||
|
||||
<p>If not set, any principal is allowed.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
No
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="Source-request_principals">
|
||||
<td><code>requestPrincipals</code></td>
|
||||
<td><code>string[]</code></td>
|
||||
<td>
|
||||
<p>Optional. A list of request identities (i.e. “iss/sub” claims), which
|
||||
matches to the “request.auth.principal” attribute.</p>
|
||||
|
||||
<p>If not set, any request principal is allowed.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
No
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="Source-namespaces">
|
||||
<td><code>namespaces</code></td>
|
||||
<td><code>string[]</code></td>
|
||||
<td>
|
||||
<p>Optional. A list of namespaces, which matches to the “source.namespace”
|
||||
attribute.</p>
|
||||
|
||||
<p>If not set, any namespace is allowed.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
No
|
||||
</td>
|
||||
</tr>
|
||||
<tr id="Source-ip_blocks">
|
||||
<td><code>ipBlocks</code></td>
|
||||
<td><code>string[]</code></td>
|
||||
<td>
|
||||
<p>Optional. A list of IP blocks, which matches to the “source.ip” attribute.
|
||||
Single IP (e.g. “1.2.3.4”) and CIDR (e.g. “1.2.3.0/24”) are supported.</p>
|
||||
|
||||
<p>If not set, any IP is allowed.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
No
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</section>
|
||||
<h2 id="istio-type-v1beta1-WorkloadSelector">istio.type.v1beta1.WorkloadSelector</h2>
|
||||
<section>
|
||||
<p>WorkloadSelector specifies the criteria used to determine if a policy can be applied
|
||||
to a proxy. The matching criteria includes the metadata associated with a proxy,
|
||||
workload instance info such as labels attached to the pod/VM, or any other info
|
||||
that the proxy provides to Istio during the initial handshake. If multiple conditions are
|
||||
specified, all conditions need to match in order for the workload instance to be
|
||||
selected. Currently, only label based selection mechanism is supported.</p>
|
||||
|
||||
<table class="message-fields">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Field</th>
|
||||
<th>Type</th>
|
||||
<th>Description</th>
|
||||
<th>Required</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr id="istio-type-v1beta1-WorkloadSelector-match_labels">
|
||||
<td><code>matchLabels</code></td>
|
||||
<td><code>map<string, string></code></td>
|
||||
<td>
|
||||
<p>One or more labels that indicate a specific set of pods/VMs
|
||||
on which a policy should be applied. The scope of label search is restricted to
|
||||
the configuration namespace in which the resource is present.</p>
|
||||
|
||||
</td>
|
||||
<td>
|
||||
Yes
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</section>
|
||||
Reference in New Issue
Block a user