倉庫指標
- Star
- (2,871 star)
- PR 合併指標
- (PR 指標待抓取)
描述
Description:
SecurityPolicies don't currently support TLSRoute's. I'd like to propose allowing SecurityPolicies for TLSRoutes. Specifically client IP based auth from Security Policies.
Related:
Example Policy:
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
name: restrict-client-ips-tlsroute-example
namespace: envoy-gateway-system
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: TLSRoute
name: tlsroute-example
authorization:
defaultAction: Deny
rules:
- action: Allow
principal:
clientCIDRs:
- <public_address>
Known Issues:
A known bug with the RBAC network filter https://github.com/envoyproxy/envoy/issues/9023 allows connections to the upstream to be initiated even if the rbac policy evaluates to DENY. This can be mitigated by instead using filter_chain_match with the source_prefix_range filter. However, doing that I believe might not allow the user to have a SecurityPolicy defaultAction other than Deny.
Workarounds:
I can and have tested this with EnvoyPatchPolicy, however, I would love official support in SecurityPolicy or another similar CR if possible.
I am willing to work on adding this if the team is interested in this.