mirror of
https://github.com/status-im/consul.git
synced 2025-02-08 11:54:12 +00:00
342306c312
* Add InboundPeerTrustBundle maps to Terminating Gateway * Add notify and cancelation of watch for inbound peer trust bundles * Pass peer trust bundles to the RBAC creation function * Regenerate Golden Files * add changelog, also adds another spot that needed peeredTrustBundles * Add basic test for terminating gateway with peer trust bundle * Add intention to cluster peered golden test * rerun codegen * update changelog * really update the changelog --------- Co-authored-by: Melisa Griffin <melisa.griffin@hashicorp.com>
122 lines
3.6 KiB
Plaintext
122 lines
3.6 KiB
Plaintext
{
|
|
"filters": [
|
|
{
|
|
"name": "envoy.filters.network.rbac",
|
|
"typedConfig": {
|
|
"@type": "type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC",
|
|
"rules": {
|
|
"action": "DENY",
|
|
"policies": {
|
|
"consul-intentions-layer4": {
|
|
"permissions": [
|
|
{
|
|
"any": true
|
|
}
|
|
],
|
|
"principals": [
|
|
{
|
|
"authenticated": {
|
|
"principalName": {
|
|
"safeRegex": {
|
|
"googleRe2": {},
|
|
"regex": "^spiffe://test.consul/ns/default/dc/[^/]+/svc/db$"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"authenticated": {
|
|
"principalName": {
|
|
"safeRegex": {
|
|
"googleRe2": {},
|
|
"regex": "^spiffe://test.consul/ns/default/dc/[^/]+/svc/cron$"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"statPrefix": "connect_authz"
|
|
}
|
|
},
|
|
{
|
|
"name": "envoy.filters.network.rbac",
|
|
"typedConfig": {
|
|
"@type": "type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC",
|
|
"rules": {
|
|
"policies": {
|
|
"consul-intentions-layer4-0": {
|
|
"permissions": [
|
|
{
|
|
"any": true
|
|
}
|
|
],
|
|
"principals": [
|
|
{
|
|
"authenticated": {
|
|
"principalName": {
|
|
"safeRegex": {
|
|
"googleRe2": {},
|
|
"regex": "^spiffe://test.consul/ns/default/dc/[^/]+/svc/api$"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"andIds": {
|
|
"ids": [
|
|
{
|
|
"authenticated": {
|
|
"principalName": {
|
|
"safeRegex": {
|
|
"googleRe2": {},
|
|
"regex": "^spiffe://test.consul/ns/default/dc/[^/]+/svc/[^/]+$"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"notId": {
|
|
"authenticated": {
|
|
"principalName": {
|
|
"safeRegex": {
|
|
"googleRe2": {},
|
|
"regex": "^spiffe://test.consul/ns/default/dc/[^/]+/svc/unsafe$"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"consul-intentions-layer4-1": {
|
|
"permissions": [
|
|
{
|
|
"any": true
|
|
}
|
|
],
|
|
"principals": [
|
|
{
|
|
"authenticated": {
|
|
"principalName": {
|
|
"safeRegex": {
|
|
"googleRe2": {},
|
|
"regex": "^spiffe://test.consul/ns/default/dc/[^/]+/svc/web$"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"statPrefix": "connect_authz"
|
|
}
|
|
}
|
|
]
|
|
} |