Skip to content

Instantly share code, notes, and snippets.

@galo

galo/auth_rule.yaml

Created January 26, 2018 02:05
Show Gist options
  • Save galo/3cd6f46cf4411283eb13b84a80125872 to your computer and use it in GitHub Desktop.
Save galo/3cd6f46cf4411283eb13b84a80125872 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. galo created this gist Jan 26, 2018.
    51 changes: 51 additions & 0 deletions auth_rule.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,51 @@
    apiVersion: config.istio.io/v1alpha2
    kind: EndUserAuthenticationPolicySpec
    metadata:
    name: meme-auth-policy
    namespace: default
    spec:
    jwts:
    - issuer: https://hpcorp-cwp-dev.apigee.net
    jwks_uri: https://hpcorp-cwp-dev.apigee.net/hpid-oauth-meme-apiproxy/v1/jwks
    ---
    apiVersion: config.istio.io/v1alpha2
    kind: EndUserAuthenticationPolicySpecBinding
    metadata:
    name: meme-auth-policy-binding
    namespace: default
    spec:
    policies:
    - name: meme-auth-policy
    namespace: default
    services:
    - name: meme
    namespace: default
    # See - https://groups.google.com/forum/#!topic/istio-security/DzLR6Gqqjxk
    ---
    apiVersion: "config.istio.io/v1alpha2"
    kind: denier
    metadata:
    name: handler
    namespace: default
    spec:
    status:
    code: 16
    message: Not Authorized
    ---
    apiVersion: "config.istio.io/v1alpha2"
    kind: checknothing
    metadata:
    name: denyrequest
    namespace: default
    spec:
    ---
    apiVersion: "config.istio.io/v1alpha2"
    kind: rule
    metadata:
    name: denymeme
    namespace: default
    spec:
    match: destination.service == "meme.default.svc.cluster.local" && request.headers["authorization"] == "unauthorized"
    actions:
    - handler: handler.denier
    instances: [ denyrequest.checknothing]