mirror of
https://github.com/holos-run/holos.git
synced 2026-03-19 16:54:58 +00:00
ce8bc798f6
Problem:
The identity aware auth proxy attached to the default gateway is
blocking access to NATS and the Choria Provisioner cluster.
Solution:
Add configuration that causes the project hosts to get added to the
exclusion list of the AuthorizationPolicy/authproxy-custom rule.
Result:
Requests bypass the auth proxy and go straight to the backend. The
rules look like:
kubectl get authorizationpolicy authproxy-custom -o yaml
```yaml
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: authproxy-custom
namespace: istio-ingress
labels:
app.kubernetes.io/name: authproxy-custom
app.kubernetes.io/part-of: istio-ingressgateway
spec:
action: CUSTOM
provider:
name: ingressauth
rules:
- to:
- operation:
notHosts:
- login.ois.run
- vault.core.ois.run
- provision.holos.run
- nats.holos.run
- provision.dev.holos.run
- nats.dev.holos.run
- jeff.provision.dev.holos.run
- jeff.nats.dev.holos.run
- gary.provision.dev.holos.run
- gary.nats.dev.holos.run
- nate.provision.dev.holos.run
- nate.nats.dev.holos.run
- provision.k2.holos.run
- nats.k2.holos.run
- provision.dev.k2.holos.run
- nats.dev.k2.holos.run
- jeff.provision.dev.k2.holos.run
- jeff.nats.dev.k2.holos.run
- gary.provision.dev.k2.holos.run
- gary.nats.dev.k2.holos.run
- nate.provision.dev.k2.holos.run
- nate.nats.dev.k2.holos.run
when:
- key: request.headers[x-oidc-id-token]
notValues:
- '*'
selector:
matchLabels:
istio: ingressgateway
```