mirror of
https://github.com/holos-run/holos.git
synced 2026-03-22 10:15:01 +00:00
ce8bc798f6
Problem:
The identity aware auth proxy attached to the default gateway is
blocking access to NATS and the Choria Provisioner cluster.
Solution:
Add configuration that causes the project hosts to get added to the
exclusion list of the AuthorizationPolicy/authproxy-custom rule.
Result:
Requests bypass the auth proxy and go straight to the backend. The
rules look like:
kubectl get authorizationpolicy authproxy-custom -o yaml
```yaml
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
name: authproxy-custom
namespace: istio-ingress
labels:
app.kubernetes.io/name: authproxy-custom
app.kubernetes.io/part-of: istio-ingressgateway
spec:
action: CUSTOM
provider:
name: ingressauth
rules:
- to:
- operation:
notHosts:
- login.ois.run
- vault.core.ois.run
- provision.holos.run
- nats.holos.run
- provision.dev.holos.run
- nats.dev.holos.run
- jeff.provision.dev.holos.run
- jeff.nats.dev.holos.run
- gary.provision.dev.holos.run
- gary.nats.dev.holos.run
- nate.provision.dev.holos.run
- nate.nats.dev.holos.run
- provision.k2.holos.run
- nats.k2.holos.run
- provision.dev.k2.holos.run
- nats.dev.k2.holos.run
- jeff.provision.dev.k2.holos.run
- jeff.nats.dev.k2.holos.run
- gary.provision.dev.k2.holos.run
- gary.nats.dev.k2.holos.run
- nate.provision.dev.k2.holos.run
- nate.nats.dev.k2.holos.run
when:
- key: request.headers[x-oidc-id-token]
notValues:
- '*'
selector:
matchLabels:
istio: ingressgateway
```
46 lines
1.3 KiB
CUE
46 lines
1.3 KiB
CUE
package holos
|
|
|
|
import ap "security.istio.io/authorizationpolicy/v1"
|
|
|
|
// #AuthPolicyRules represents AuthorizationPolicy rules for hosts that need
|
|
// specialized treatment. Entries in this struct are excluded from
|
|
// AuthorizationPolicy/authproxy-custom in the istio-ingress namespace. Entries
|
|
// are added to their own AuthorizationPolicy.
|
|
#AuthPolicyRules: {
|
|
// AuthProxySpec represents the identity provider configuration
|
|
AuthProxySpec: #AuthProxySpec & #Platform.authproxy
|
|
|
|
// Hosts are hosts that need specialized treatment
|
|
hosts: {
|
|
[Name=_]: {
|
|
// name is the fully qualifed hostname, a Host: header value.
|
|
name: Name
|
|
// slug is the resource name prefix
|
|
slug: string
|
|
// NoAuthorizationPolicy disables an AuthorizationPolicy for the host
|
|
NoAuthorizationPolicy: true | *false
|
|
|
|
// Refer to https://istio.io/latest/docs/reference/config/security/authorization-policy/#Rule
|
|
spec: ap.#AuthorizationPolicySpec & {
|
|
action: "CUSTOM"
|
|
provider: name: AuthProxySpec.provider
|
|
selector: matchLabels: istio: "ingressgateway"
|
|
}
|
|
}
|
|
}
|
|
|
|
objects: #APIObjects & {
|
|
for Host in hosts {
|
|
if Host.NoAuthorizationPolicy == false {
|
|
apiObjects: {
|
|
AuthorizationPolicy: "\(Host.slug)-custom": {
|
|
metadata: namespace: "istio-ingress"
|
|
metadata: name: "\(Host.slug)-custom"
|
|
spec: Host.spec
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|