AuthorizationPolicy
security.istio.io / v1beta1
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: example
spec object
Configuration for access control on workloads. See more details at: https://istio.io/docs/reference/config/security/authorization-policy.html
action
string
Optional.
Valid Options: ALLOW, DENY, AUDIT, CUSTOM
enum:
ALLOW, DENY, AUDIT, CUSTOMprovider object
Specifies detailed configuration of the CUSTOM action.
name
string
Specifies the name of the extension provider.
rules []object
Optional.
maxItems:
512from []object
Optional.
maxItems:
512source object
Source specifies the source of a request.
ipBlocks
[]string
Optional.
namespaces
[]string
Optional.
notIpBlocks
[]string
Optional.
notNamespaces
[]string
Optional.
notPrincipals
[]string
Optional.
notRemoteIpBlocks
[]string
Optional.
notRequestPrincipals
[]string
Optional.
notServiceAccounts
[]string
Optional.
maxItems:
16
notTrustDomains
[]string
Optional.
principals
[]string
Optional.
remoteIpBlocks
[]string
Optional.
requestPrincipals
[]string
Optional.
serviceAccounts
[]string
Optional.
maxItems:
16
trustDomains
[]string
Optional.
to []object
Optional.
operation object
Operation specifies the operation of a request.
hosts
[]string
Optional.
methods
[]string
Optional.
notHosts
[]string
Optional.
notMethods
[]string
Optional.
notPaths
[]string
Optional.
notPorts
[]string
Optional.
paths
[]string
Optional.
ports
[]string
Optional.
when []object
Optional.
key
string required
The name of an Istio attribute.
notValues
[]string
Optional.
values
[]string
Optional.
selector object
Optional.
matchLabels
object
One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
targetRef object
group
string
group is the group of the target resource.
pattern:
^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$maxLength:
253
kind
string required
kind is kind of the target resource.
pattern:
^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$minLength:
1maxLength:
63
name
string required
name is the name of the target resource.
minLength:
1maxLength:
253
namespace
string
namespace is the namespace of the referent.
targetRefs []object
Optional.
maxItems:
16
group
string
group is the group of the target resource.
pattern:
^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$maxLength:
253
kind
string required
kind is kind of the target resource.
pattern:
^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$minLength:
1maxLength:
63
name
string required
name is the name of the target resource.
minLength:
1maxLength:
253
namespace
string
namespace is the namespace of the referent.
status object
conditions []object
Current service state of the resource.
lastProbeTime
string
Last time we probed the condition.
format:
date-time
lastTransitionTime
string
Last time the condition transitioned from one status to another.
format:
date-time
message
string
Human-readable message indicating details about last transition.
observedGeneration
string | integer
Resource Generation to which the Condition refers.
reason
string
Unique, one-word, CamelCase reason for the condition's last transition.
status
string
Status is the status of the condition.
type
string
Type is the type of the condition.
observedGeneration
string | integer
validationMessages []object
Includes any errors or warnings detected by Istio's analyzers.
documentationUrl
string
A url pointing to the Istio documentation for this specific error type.
level
string
Represents how severe a message is.
Valid Options: UNKNOWN, ERROR, WARNING, INFO
enum:
UNKNOWN, ERROR, WARNING, INFOtype object
code
string
A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
name
string
A human-readable name for the message type.
No matches. Try .spec.action for an exact path