v1

Documentation

Overview

Code generated by protoc-gen-alias. DO NOT EDIT.

Code generated by protoc-gen-alias. DO NOT EDIT.

Code generated by protoc-gen-alias. DO NOT EDIT.

Index

• type AuthorizationPolicy
• type AuthorizationPolicy_Action
• type AuthorizationPolicy_ExtensionProvider
• type AuthorizationPolicy_Provider
• type ClaimToHeader
• type Condition
• type JWTHeader
• type JWTRule
• type Operation
• type PeerAuthentication
• type PeerAuthentication_MutualTLS
• type PeerAuthentication_MutualTLS_Mode
• type RequestAuthentication
• type Rule
• type Rule_From
• type Rule_To
• type Source

Types

type AuthorizationPolicy

type AuthorizationPolicy = v1beta1.AuthorizationPolicy

AuthorizationPolicy enables access control on workloads.

<!-- crd generation tags +cue-gen:AuthorizationPolicy:groupName:security.istio.io +cue-gen:AuthorizationPolicy:versions:v1beta1,v1 +cue-gen:AuthorizationPolicy:storageVersion +cue-gen:AuthorizationPolicy:annotations:helm.sh/resource-policy=keep +cue-gen:AuthorizationPolicy:labels:app=istio-pilot,chart=istio,istio=security,heritage=Tiller,release=istio +cue-gen:AuthorizationPolicy:subresource:status +cue-gen:AuthorizationPolicy:scope:Namespaced +cue-gen:AuthorizationPolicy:resource:categories=istio-io,security-istio-io,shortNames=ap,plural=authorizationpolicies +cue-gen:AuthorizationPolicy:preserveUnknownFields:false +cue-gen:AuthorizationPolicy:printerColumn:name=Action,type=string,JSONPath=.spec.action,description="The operation to take." +cue-gen:AuthorizationPolicy:printerColumn:name=Age,type=date,JSONPath=.metadata.creationTimestamp,description="CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata" -->

<!-- go code generation tags +kubetype-gen +kubetype-gen:groupVersion=security.istio.io/v1beta1 +genclient +k8s:deepcopy-gen=true --> +kubebuilder:validation:XValidation:message="only one of targetRefs or selector can be set",rule="(has(self.selector)?1:0)+(has(self.targetRef)?1:0)+(has(self.targetRefs)?1:0)<=1"

type AuthorizationPolicy_Action

type AuthorizationPolicy_Action = v1beta1.AuthorizationPolicy_Action

Action specifies the operation to take.

const AuthorizationPolicy_ALLOW AuthorizationPolicy_Action = v1beta1.AuthorizationPolicy_ALLOW

Allow a request only if it matches the rules. This is the default type.

const AuthorizationPolicy_AUDIT AuthorizationPolicy_Action = v1beta1.AuthorizationPolicy_AUDIT

Audit a request if it matches any of the rules.

const AuthorizationPolicy_CUSTOM AuthorizationPolicy_Action = v1beta1.AuthorizationPolicy_CUSTOM

The CUSTOM action allows an extension to handle the user request if the matching rules evaluate to true. The extension is evaluated independently and before the native ALLOW and DENY actions. When used together, A request is allowed if and only if all the actions return allow, in other words, the extension cannot bypass the authorization decision made by ALLOW and DENY action. Extension behavior is defined by the named providers declared in MeshConfig. The authorization policy refers to the extension by specifying the name of the provider. One example use case of the extension is to integrate with a custom external authorization system to delegate the authorization decision to it.

The following authorization policy applies to an ingress gateway and delegates the authorization check to a named extension `my-custom-authz` if the request path has prefix `/admin/`.

```yaml apiVersion: security.istio.io/v1 kind: AuthorizationPolicy metadata:

name: ext-authz
namespace: istio-system

spec:

selector:
  matchLabels:
    app: istio-ingressgateway
action: CUSTOM
provider:
  name: "my-custom-authz"
rules:
- to:
  - operation:
      paths: ["/admin/*"]

```

const AuthorizationPolicy_DENY AuthorizationPolicy_Action = v1beta1.AuthorizationPolicy_DENY

Deny a request if it matches any of the rules.

type AuthorizationPolicy_ExtensionProvider

type AuthorizationPolicy_ExtensionProvider = v1beta1.AuthorizationPolicy_ExtensionProvider

type AuthorizationPolicy_Provider

type AuthorizationPolicy_Provider = v1beta1.AuthorizationPolicy_Provider

Specifies detailed configuration of the CUSTOM action. Must be used only with CUSTOM action.

type ClaimToHeader

type ClaimToHeader = v1beta1.ClaimToHeader

This message specifies the detail for copying claim to header.

type Condition

type Condition = v1beta1.Condition

Condition specifies additional required attributes.

type JWTHeader

type JWTHeader = v1beta1.JWTHeader

This message specifies a header location to extract JWT token.

type JWTRule

type JWTRule = v1beta1.JWTRule

JSON Web Token (JWT) token format for authentication as defined by [RFC 7519](https://tools.ietf.org/html/rfc7519). See [OAuth 2.0](https://tools.ietf.org/html/rfc6749) and [OIDC 1.0](http://openid.net/connect) for how this is used in the whole authentication flow.

Examples:

Spec for a JWT that is issued by `https://example.com`, with the audience claims must be either `bookstore_android.apps.example.com` or `bookstore_web.apps.example.com`. The token should be presented at the `Authorization` header (default). The JSON Web Key Set (JWKS) will be discovered following OpenID Connect protocol.

```yaml issuer: https://example.com audiences:

• bookstore_android.apps.example.com bookstore_web.apps.example.com

```

This example specifies a token in a non-default location (`x-goog-iap-jwt-assertion` header). It also defines the URI to fetch JWKS explicitly.

```yaml issuer: https://example.com jwksUri: https://example.com/.secret/jwks.json fromHeaders: - "x-goog-iap-jwt-assertion" ``` +kubebuilder:validation:XValidation:message="only one of jwks or jwksUri can be set",rule="(has(self.jwksUri)?1:0)+(has(self.jwks_uri)?1:0)+(has(self.jwks)?1:0)<=1"

type Operation

type Operation = v1beta1.Operation

Operation specifies the operations of a request. Fields in the operation are ANDed together.

For example, the following operation matches if the host has suffix `.example.com` and the method is `GET` or `HEAD` and the path doesn't have prefix `/admin`.

```yaml hosts: ["*.example.com"] methods: ["GET", "HEAD"] notPaths: ["/admin*"] ```

type PeerAuthentication

type PeerAuthentication = v1beta1.PeerAuthentication

<!-- crd generation tags +cue-gen:PeerAuthentication:groupName:security.istio.io +cue-gen:PeerAuthentication:versions:v1beta1,v1 +cue-gen:PeerAuthentication:storageVersion +cue-gen:PeerAuthentication:annotations:helm.sh/resource-policy=keep +cue-gen:PeerAuthentication:labels:app=istio-pilot,chart=istio,istio=security,heritage=Tiller,release=istio +cue-gen:PeerAuthentication:subresource:status +cue-gen:PeerAuthentication:scope:Namespaced +cue-gen:PeerAuthentication:resource:categories=istio-io,security-istio-io,shortNames=pa +cue-gen:PeerAuthentication:preserveUnknownFields:false +cue-gen:PeerAuthentication:printerColumn:name=Mode,type=string,JSONPath=.spec.mtls.mode,description="Defines the mTLS mode used for peer authentication." +cue-gen:PeerAuthentication:printerColumn:name=Age,type=date,JSONPath=.metadata.creationTimestamp,description="CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata" -->

<!-- go code generation tags +kubetype-gen +kubetype-gen:groupVersion=security.istio.io/v1beta1 +genclient +k8s:deepcopy-gen=true --> +kubebuilder:validation:XValidation:message="portLevelMtls requires selector",rule="(has(self.selector) && has(self.selector.matchLabels) && self.selector.matchLabels.size() > 0) || !has(self.portLevelMtls)"

type PeerAuthentication_MutualTLS

type PeerAuthentication_MutualTLS = v1beta1.PeerAuthentication_MutualTLS

Mutual TLS settings.

type PeerAuthentication_MutualTLS_Mode

type PeerAuthentication_MutualTLS_Mode = v1beta1.PeerAuthentication_MutualTLS_Mode

const PeerAuthentication_MutualTLS_DISABLE PeerAuthentication_MutualTLS_Mode = v1beta1.PeerAuthentication_MutualTLS_DISABLE

Connection is not tunneled.

const PeerAuthentication_MutualTLS_PERMISSIVE PeerAuthentication_MutualTLS_Mode = v1beta1.PeerAuthentication_MutualTLS_PERMISSIVE

Connection can be either plaintext or mTLS tunnel.

const PeerAuthentication_MutualTLS_STRICT PeerAuthentication_MutualTLS_Mode = v1beta1.PeerAuthentication_MutualTLS_STRICT

Connection is an mTLS tunnel (TLS with client cert must be presented).

const PeerAuthentication_MutualTLS_UNSET PeerAuthentication_MutualTLS_Mode = v1beta1.PeerAuthentication_MutualTLS_UNSET

Inherit from parent, if has one. Otherwise treated as `PERMISSIVE`.

type RequestAuthentication

type RequestAuthentication = v1beta1.RequestAuthentication

<!-- crd generation tags +cue-gen:RequestAuthentication:groupName:security.istio.io +cue-gen:RequestAuthentication:versions:v1beta1,v1 +cue-gen:RequestAuthentication:storageVersion +cue-gen:RequestAuthentication:annotations:helm.sh/resource-policy=keep +cue-gen:RequestAuthentication:labels:app=istio-pilot,chart=istio,istio=security,heritage=Tiller,release=istio +cue-gen:RequestAuthentication:subresource:status +cue-gen:RequestAuthentication:scope:Namespaced +cue-gen:RequestAuthentication:resource:categories=istio-io,security-istio-io,shortNames=ra +cue-gen:RequestAuthentication:preserveUnknownFields:false -->

<!-- go code generation tags +kubetype-gen +kubetype-gen:groupVersion=security.istio.io/v1beta1 +genclient +k8s:deepcopy-gen=true --> +kubebuilder:validation:XValidation:message="only one of targetRefs or selector can be set",rule="(has(self.selector)?1:0)+(has(self.targetRef)?1:0)+(has(self.targetRefs)?1:0)<=1"

type Rule

type Rule = v1beta1.Rule

Rule matches requests from a list of sources that perform a list of operations subject to a list of conditions. A match occurs when at least one source, one operation and all conditions matches the request. An empty rule is always matched.

Any string field in the rule supports Exact, Prefix, Suffix and Presence match:

- Exact match: `abc` will match on value `abc`. - Prefix match: `abc*` will match on value `abc` and `abcd`. - Suffix match: `*abc` will match on value `abc` and `xabc`. - Presence match: `*` will match when value is not empty.

type Rule_From

type Rule_From = v1beta1.Rule_From

From includes a list of sources.

type Rule_To

type Rule_To = v1beta1.Rule_To

To includes a list of operations.

type Source

type Source = v1beta1.Source

Source specifies the source identities of a request. Fields in the source are ANDed together.

For example, the following source matches if the principal is `admin` or `dev` and the namespace is `prod` or `test` and the ip is not `203.0.113.4`.

```yaml principals: ["admin", "dev"] namespaces: ["prod", "test"] notIpBlocks: ["203.0.113.4"] ``` +kubebuilder:validation:XValidation:message="Cannot set serviceAccounts with namespaces or principals",rule="(has(self.serviceAccounts) || has(self.notServiceAccounts)) ? (!has(self.principals) && !has(self.notPrincipals) && !has(self.namespaces) && !has(self.notNamespaces)) : true"