| name: envoy.filters.http.rbac |
| typedConfig: |
| '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC |
| rules: |
| policies: |
| ns[foo]-policy[httpbin-1]-rule[0]: |
| permissions: |
| - andRules: |
| rules: |
| - orRules: |
| rules: |
| - header: |
| name: :authority |
| stringMatch: |
| exact: exact.com |
| ignoreCase: true |
| - header: |
| name: :authority |
| stringMatch: |
| ignoreCase: true |
| suffix: .suffix.com |
| - header: |
| name: :authority |
| stringMatch: |
| ignoreCase: true |
| prefix: prefix. |
| - header: |
| name: :authority |
| presentMatch: true |
| - notRule: |
| orRules: |
| rules: |
| - header: |
| name: :authority |
| stringMatch: |
| exact: not-exact.com |
| ignoreCase: true |
| - header: |
| name: :authority |
| stringMatch: |
| ignoreCase: true |
| suffix: .not-suffix.com |
| - header: |
| name: :authority |
| stringMatch: |
| ignoreCase: true |
| prefix: not-prefix. |
| - header: |
| name: :authority |
| presentMatch: true |
| - orRules: |
| rules: |
| - header: |
| exactMatch: method |
| name: :method |
| - header: |
| name: :method |
| prefixMatch: method-prefix- |
| - header: |
| name: :method |
| suffixMatch: -suffix-method |
| - header: |
| name: :method |
| presentMatch: true |
| - notRule: |
| orRules: |
| rules: |
| - header: |
| exactMatch: not-method |
| name: :method |
| - header: |
| name: :method |
| prefixMatch: not-method-prefix- |
| - header: |
| name: :method |
| suffixMatch: -not-suffix-method |
| - header: |
| name: :method |
| presentMatch: true |
| - orRules: |
| rules: |
| - urlPath: |
| path: |
| exact: /exact |
| - urlPath: |
| path: |
| prefix: /prefix/ |
| - urlPath: |
| path: |
| suffix: /suffix |
| - urlPath: |
| path: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - notRule: |
| orRules: |
| rules: |
| - urlPath: |
| path: |
| exact: /not-exact |
| - urlPath: |
| path: |
| prefix: /not-prefix/ |
| - urlPath: |
| path: |
| suffix: /not-suffix |
| - urlPath: |
| path: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - orRules: |
| rules: |
| - destinationPort: 80 |
| - destinationPort: 90 |
| - notRule: |
| orRules: |
| rules: |
| - destinationPort: 8000 |
| - destinationPort: 9000 |
| - orRules: |
| rules: |
| - destinationIp: |
| addressPrefix: 10.10.10.10 |
| prefixLen: 32 |
| - destinationIp: |
| addressPrefix: 192.168.10.0 |
| prefixLen: 24 |
| - notRule: |
| orRules: |
| rules: |
| - destinationIp: |
| addressPrefix: 90.10.10.10 |
| prefixLen: 32 |
| - destinationIp: |
| addressPrefix: 90.168.10.0 |
| prefixLen: 24 |
| - orRules: |
| rules: |
| - destinationPort: 91 |
| - destinationPort: 92 |
| - notRule: |
| orRules: |
| rules: |
| - destinationPort: 9001 |
| - destinationPort: 9002 |
| - orRules: |
| rules: |
| - requestedServerName: |
| exact: exact.com |
| - requestedServerName: |
| suffix: .suffix.com |
| - requestedServerName: |
| prefix: prefix. |
| - requestedServerName: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - notRule: |
| orRules: |
| rules: |
| - requestedServerName: |
| exact: not-exact.com |
| - requestedServerName: |
| suffix: .not-suffix.com |
| - requestedServerName: |
| prefix: not-prefix. |
| - requestedServerName: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - orRules: |
| rules: |
| - metadata: |
| filter: envoy.filters.a.b |
| path: |
| - key: c |
| value: |
| stringMatch: |
| exact: exact |
| - metadata: |
| filter: envoy.filters.a.b |
| path: |
| - key: c |
| value: |
| stringMatch: |
| prefix: prefix- |
| - metadata: |
| filter: envoy.filters.a.b |
| path: |
| - key: c |
| value: |
| stringMatch: |
| suffix: -suffix |
| - metadata: |
| filter: envoy.filters.a.b |
| path: |
| - key: c |
| value: |
| stringMatch: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - notRule: |
| orRules: |
| rules: |
| - metadata: |
| filter: envoy.filters.a.b |
| path: |
| - key: c |
| value: |
| stringMatch: |
| exact: not-exact |
| - metadata: |
| filter: envoy.filters.a.b |
| path: |
| - key: c |
| value: |
| stringMatch: |
| prefix: not-prefix- |
| - metadata: |
| filter: envoy.filters.a.b |
| path: |
| - key: c |
| value: |
| stringMatch: |
| suffix: -not-suffix |
| - metadata: |
| filter: envoy.filters.a.b |
| path: |
| - key: c |
| value: |
| stringMatch: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| principals: |
| - andIds: |
| ids: |
| - orIds: |
| ids: |
| - authenticated: |
| principalName: |
| exact: spiffe://principal |
| - authenticated: |
| principalName: |
| prefix: spiffe://principal-prefix- |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: spiffe://.*-suffix-principal |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - notId: |
| orIds: |
| ids: |
| - authenticated: |
| principalName: |
| exact: spiffe://not-principal |
| - authenticated: |
| principalName: |
| prefix: spiffe://not-principal-prefix- |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: spiffe://.*-not-suffix-principal |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - orIds: |
| ids: |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.principal |
| value: |
| stringMatch: |
| exact: requestPrincipals |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.principal |
| value: |
| stringMatch: |
| prefix: requestPrincipals-prefix- |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.principal |
| value: |
| stringMatch: |
| suffix: -suffix-requestPrincipals |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.principal |
| value: |
| stringMatch: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - notId: |
| orIds: |
| ids: |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.principal |
| value: |
| stringMatch: |
| exact: not-requestPrincipals |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.principal |
| value: |
| stringMatch: |
| prefix: not-requestPrincipals-prefix- |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.principal |
| value: |
| stringMatch: |
| suffix: -not-suffix-requestPrincipals |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.principal |
| value: |
| stringMatch: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - orIds: |
| ids: |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .*/ns/ns/.* |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .*/ns/ns-prefix-.*/.* |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .*/ns/.*-ns-suffix/.* |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .*/ns/.*/.* |
| - notId: |
| orIds: |
| ids: |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .*/ns/not-ns/.* |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .*/ns/not-ns-prefix-.*/.* |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .*/ns/.*-not-ns-suffix/.* |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .*/ns/.*/.* |
| - orIds: |
| ids: |
| - remoteIp: |
| addressPrefix: 1.2.3.4 |
| prefixLen: 32 |
| - remoteIp: |
| addressPrefix: 5.6.0.0 |
| prefixLen: 16 |
| - notId: |
| orIds: |
| ids: |
| - remoteIp: |
| addressPrefix: 9.0.0.1 |
| prefixLen: 32 |
| - remoteIp: |
| addressPrefix: 9.2.0.0 |
| prefixLen: 16 |
| - orIds: |
| ids: |
| - directRemoteIp: |
| addressPrefix: 1.2.3.4 |
| prefixLen: 32 |
| - directRemoteIp: |
| addressPrefix: 5.6.0.0 |
| prefixLen: 16 |
| - notId: |
| orIds: |
| ids: |
| - directRemoteIp: |
| addressPrefix: 9.0.0.1 |
| prefixLen: 32 |
| - directRemoteIp: |
| addressPrefix: 9.2.0.0 |
| prefixLen: 16 |
| - orIds: |
| ids: |
| - header: |
| exactMatch: header |
| name: X-header |
| - header: |
| name: X-header |
| prefixMatch: header-prefix- |
| - header: |
| name: X-header |
| suffixMatch: -suffix-header |
| - header: |
| name: X-header |
| presentMatch: true |
| - notId: |
| orIds: |
| ids: |
| - header: |
| exactMatch: not-header |
| name: X-header |
| - header: |
| name: X-header |
| prefixMatch: not-header-prefix- |
| - header: |
| name: X-header |
| suffixMatch: -not-suffix-header |
| - header: |
| name: X-header |
| presentMatch: true |
| - orIds: |
| ids: |
| - directRemoteIp: |
| addressPrefix: 10.10.10.10 |
| prefixLen: 32 |
| - directRemoteIp: |
| addressPrefix: 192.168.10.0 |
| prefixLen: 24 |
| - notId: |
| orIds: |
| ids: |
| - directRemoteIp: |
| addressPrefix: 90.10.10.10 |
| prefixLen: 32 |
| - directRemoteIp: |
| addressPrefix: 90.168.10.0 |
| prefixLen: 24 |
| - orIds: |
| ids: |
| - remoteIp: |
| addressPrefix: 10.10.10.10 |
| prefixLen: 32 |
| - remoteIp: |
| addressPrefix: 192.168.10.0 |
| prefixLen: 24 |
| - notId: |
| orIds: |
| ids: |
| - remoteIp: |
| addressPrefix: 90.10.10.10 |
| prefixLen: 32 |
| - remoteIp: |
| addressPrefix: 90.168.10.0 |
| prefixLen: 24 |
| - orIds: |
| ids: |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .*/ns/ns/.* |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .*/ns/ns-prefix-.*/.* |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .*/ns/.*-ns-suffix/.* |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .*/ns/.*/.* |
| - notId: |
| orIds: |
| ids: |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .*/ns/not-ns/.* |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .*/ns/not-ns-prefix-.*/.* |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .*/ns/.*-not-ns-suffix/.* |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .*/ns/.*/.* |
| - orIds: |
| ids: |
| - authenticated: |
| principalName: |
| exact: spiffe://principal |
| - authenticated: |
| principalName: |
| prefix: spiffe://principal-prefix- |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: spiffe://.*-suffix-principal |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - notId: |
| orIds: |
| ids: |
| - authenticated: |
| principalName: |
| exact: spiffe://not-principal |
| - authenticated: |
| principalName: |
| prefix: spiffe://not-principal-prefix- |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: spiffe://.*-not-suffix-principal |
| - authenticated: |
| principalName: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - orIds: |
| ids: |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.principal |
| value: |
| stringMatch: |
| exact: requestPrincipals |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.principal |
| value: |
| stringMatch: |
| prefix: requestPrincipals-prefix- |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.principal |
| value: |
| stringMatch: |
| suffix: -suffix-requestPrincipals |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.principal |
| value: |
| stringMatch: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - notId: |
| orIds: |
| ids: |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.principal |
| value: |
| stringMatch: |
| exact: not-requestPrincipals |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.principal |
| value: |
| stringMatch: |
| prefix: not-requestPrincipals-prefix- |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.principal |
| value: |
| stringMatch: |
| suffix: -not-suffix-requestPrincipals |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.principal |
| value: |
| stringMatch: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - orIds: |
| ids: |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.audiences |
| value: |
| stringMatch: |
| exact: audiences |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.audiences |
| value: |
| stringMatch: |
| prefix: audiences-prefix- |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.audiences |
| value: |
| stringMatch: |
| suffix: -suffix-audiences |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.audiences |
| value: |
| stringMatch: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - notId: |
| orIds: |
| ids: |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.audiences |
| value: |
| stringMatch: |
| exact: not-audiences |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.audiences |
| value: |
| stringMatch: |
| prefix: not-audiences-prefix- |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.audiences |
| value: |
| stringMatch: |
| suffix: -not-suffix-audiences |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.audiences |
| value: |
| stringMatch: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - orIds: |
| ids: |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.presenter |
| value: |
| stringMatch: |
| exact: presenter |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.presenter |
| value: |
| stringMatch: |
| prefix: presenter-prefix- |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.presenter |
| value: |
| stringMatch: |
| suffix: -suffix-presenter |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.presenter |
| value: |
| stringMatch: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - notId: |
| orIds: |
| ids: |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.presenter |
| value: |
| stringMatch: |
| exact: not-presenter |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.presenter |
| value: |
| stringMatch: |
| prefix: not-presenter-prefix- |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.presenter |
| value: |
| stringMatch: |
| suffix: -not-suffix-presenter |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.presenter |
| value: |
| stringMatch: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - orIds: |
| ids: |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.claims |
| - key: iss |
| value: |
| listMatch: |
| oneOf: |
| stringMatch: |
| exact: iss |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.claims |
| - key: iss |
| value: |
| listMatch: |
| oneOf: |
| stringMatch: |
| prefix: iss-prefix- |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.claims |
| - key: iss |
| value: |
| listMatch: |
| oneOf: |
| stringMatch: |
| suffix: -suffix-iss |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.claims |
| - key: iss |
| value: |
| listMatch: |
| oneOf: |
| stringMatch: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - notId: |
| orIds: |
| ids: |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.claims |
| - key: iss |
| value: |
| listMatch: |
| oneOf: |
| stringMatch: |
| exact: not-iss |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.claims |
| - key: iss |
| value: |
| listMatch: |
| oneOf: |
| stringMatch: |
| prefix: not-iss-prefix- |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.claims |
| - key: iss |
| value: |
| listMatch: |
| oneOf: |
| stringMatch: |
| suffix: -not-suffix-iss |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.claims |
| - key: iss |
| value: |
| listMatch: |
| oneOf: |
| stringMatch: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - orIds: |
| ids: |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.claims |
| - key: nested1 |
| - key: nested2 |
| value: |
| listMatch: |
| oneOf: |
| stringMatch: |
| exact: nested |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.claims |
| - key: nested1 |
| - key: nested2 |
| value: |
| listMatch: |
| oneOf: |
| stringMatch: |
| prefix: nested-prefix- |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.claims |
| - key: nested1 |
| - key: nested2 |
| value: |
| listMatch: |
| oneOf: |
| stringMatch: |
| suffix: -suffix-nested |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.claims |
| - key: nested1 |
| - key: nested2 |
| value: |
| listMatch: |
| oneOf: |
| stringMatch: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| - notId: |
| orIds: |
| ids: |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.claims |
| - key: nested1 |
| - key: nested2 |
| value: |
| listMatch: |
| oneOf: |
| stringMatch: |
| exact: not-nested |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.claims |
| - key: nested1 |
| - key: nested2 |
| value: |
| listMatch: |
| oneOf: |
| stringMatch: |
| prefix: not-nested-prefix- |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.claims |
| - key: nested1 |
| - key: nested2 |
| value: |
| listMatch: |
| oneOf: |
| stringMatch: |
| suffix: -not-suffix-nested |
| - metadata: |
| filter: istio_authn |
| path: |
| - key: request.auth.claims |
| - key: nested1 |
| - key: nested2 |
| value: |
| listMatch: |
| oneOf: |
| stringMatch: |
| safeRegex: |
| googleRe2: {} |
| regex: .+ |
| shadowRulesStatPrefix: istio_dry_run_allow_ |
