RequestAuthentication
security.istio.io / v1
apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
name: example
spec object
Request authentication configuration for workloads. See more details at: https://istio.io/docs/reference/config/security/request_authentication.html
jwtRules []object
Define the list of JWTs that can be validated at the selected workloads' proxy.
maxItems:
4096
audiences
[]string
The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3) that are allowed to access.
forwardOriginalToken
boolean
If set to true, the original token will be kept for the upstream request.
fromCookies
[]string
List of cookie names from which JWT is expected.
fromHeaders []object
List of header locations from which JWT is expected.
name
string required
The HTTP header name.
minLength:
1
prefix
string
The prefix that should be stripped before decoding the token.
fromParams
[]string
List of query parameters from which JWT is expected.
issuer
string
Identifies the issuer that issued the JWT.
minLength:
1
jwks
string
JSON Web Key Set of public keys to validate signature of the JWT.
jwksUri
string
URL of the provider's public key set to validate signature of the JWT.
minLength:
1maxLength:
2048
jwks_uri
string
URL of the provider's public key set to validate signature of the JWT.
minLength:
1maxLength:
2048outputClaimToHeaders []object
This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.
claim
string required
The name of the claim to be copied from.
minLength:
1
header
string required
The name of the header to be created.
pattern:
^[-_A-Za-z0-9]+$minLength:
1
outputPayloadToHeader
string
This field specifies the header name to output a successfully verified JWT payload to the backend.
spaceDelimitedClaims
[]string
List of JWT claim names that should be treated as space-delimited strings.
maxItems:
64
timeout
string
The maximum amount of time that the resolver, determined by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable, will spend waiting for the JWKS to be fetched.
selector object
Optional.
matchLabels
object
One or more labels that indicate a specific set of pods/VMs on which a policy should be applied.
targetRef object
group
string
group is the group of the target resource.
pattern:
^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$maxLength:
253
kind
string required
kind is kind of the target resource.
pattern:
^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$minLength:
1maxLength:
63
name
string required
name is the name of the target resource.
minLength:
1maxLength:
253
namespace
string
namespace is the namespace of the referent.
targetRefs []object
Optional.
maxItems:
16
group
string
group is the group of the target resource.
pattern:
^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$maxLength:
253
kind
string required
kind is kind of the target resource.
pattern:
^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$minLength:
1maxLength:
63
name
string required
name is the name of the target resource.
minLength:
1maxLength:
253
namespace
string
namespace is the namespace of the referent.
status object
conditions []object
Current service state of the resource.
lastProbeTime
string
Last time we probed the condition.
format:
date-time
lastTransitionTime
string
Last time the condition transitioned from one status to another.
format:
date-time
message
string
Human-readable message indicating details about last transition.
observedGeneration
string | integer
Resource Generation to which the Condition refers.
reason
string
Unique, one-word, CamelCase reason for the condition's last transition.
status
string
Status is the status of the condition.
type
string
Type is the type of the condition.
observedGeneration
string | integer
validationMessages []object
Includes any errors or warnings detected by Istio's analyzers.
documentationUrl
string
A url pointing to the Istio documentation for this specific error type.
level
string
Represents how severe a message is.
Valid Options: UNKNOWN, ERROR, WARNING, INFO
enum:
UNKNOWN, ERROR, WARNING, INFOtype object
code
string
A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.
name
string
A human-readable name for the message type.
No matches. Try .spec.jwtRules for an exact path