# Code generated by skv2. DO NOT EDIT. apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 330af4ecc7b6f978 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: accesspolicies.security.policy.gloo.solo.io spec: group: security.policy.gloo.solo.io names: categories: - solo-io kind: AccessPolicy listKind: AccessPolicyList plural: accesspolicies shortNames: - ap singular: accesspolicy scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: Specifications for the policy. properties: applyToDestinations: description: |- Destinations to apply the policy to. Note that virtual destinations are not supported as destinations with this policy. If `applyToWorkloads` is non-empty, this field is ignored. If this field and `applyToWorkloads` are both empty, the policy applies to all ports on all destinations in the workspace. {{< alert context="info" >}} For security reasons, applyToWorkloads is preferred. {{< /alert >}} items: description: |- DestinationSelector is a selector for matching routable destinations for routes. DestinationSelectors can select a variety of object types. The behavior of the route action will vary depending on the type of destination selected. Defaults to the kubernetes `v1/Service`. Currently supported destination types: - v1 Service - networking.gloo.solo.io/v2 VirtualDestination (route traffic to a group of backing destinations) - networking.gloo.solo.io/v2 ExternalService (route traffic to a static set of service endpoints external to the mesh) properties: kind: description: The kind of destination being selected. defaults to Kubernetes Service. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: |- The port on the Destination which receives traffic. All ports on the Destination will be selected if left empty. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object selector: description: The selector used to match destination objects by their metadata properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: array applyToWorkloads: description: |- Workloads to apply the policy to. For security reasons, this field is preferred over `applyToDestinations`. If an empty selector is provided in the list, the policy applies to all workloads in a namespace, cluster, and workspace that are available in the parent object's workspace. items: description: |- Select individual namespaces and workloads within the namespaces by label. Workloads must have injected (sidecars) or be standalone proxies (gateways) to be selected by Gloo policies. properties: selector: description: Selector to match workload objects by their metadata. properties: cluster: description: |- Only select objects in the matching cluster. If empty, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: Only select workloads with matching labels. type: object namespace: description: |- Only select objects in the matching namespace. If empty, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If empty, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: array config: description: Details of the access policy to apply to the selected workloads. properties: authn: description: How clients are authenticated to the workload. properties: tlsMode: description: |- Type of TLS policy that is enforced on clients connecting to the workload. If service isolation is enabled for the workspace, this field is treated as 'STRICT'. enum: - DISABLE - PERMISSIVE - STRICT type: string type: object authz: description: |- Deprecated; Use authzList instead. If authzList is set, it takes precedence and this field is ignored. How clients are authorized to access the workload. properties: allowedClients: description: |- Client identities that are permitted to access the workload. To allow access for all client identities, provide a single empty selector. items: description: IdentitySelector is a Selector specifically built for selecting client identities for security policies. properties: externalWorkloadSelector: description: Select external workloads. properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object requestIdentityMatcher: description: |- Select identities based on properties of the request. If multiple fields are set, they are ANDed together. More information about the individual values can be found here: https://istio.io/latest/docs/reference/config/security/authorization-policy/#Source properties: notRequestPrincipals: description: 'Optional: A list of identities to negative match the request identity.' items: type: string type: array requestPrincipals: description: |- Optional: A list of identities to match the request identity ("iss/sub" from the JWT). If omitted all request identity values will be accepted. items: type: string type: array type: object serviceAccountSelector: description: |- Select kubernetes service accounts as identities. When selecting a service account that will be created in the future for use in a AuthorizationPolicy, ONLY provide the name, namespace and cluster where the service account will exist in the selector. Providing labels and/or the workspace, or omitting the name, namespace or cluster for a service account that does not exist in the selector will not result in that service account being added to the resulting AuthorizationPolicy. properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: array allowedIpBlocks: description: |- Optional: A list of IP blocks, populated from the source address of the IP packet. Single IP addresses (e.g. “1.2.3.4”) and CIDRs (e.g. “1.2.3.0/24”) are supported. If empty, any IP address is allowed. items: type: string type: array allowedMethods: description: |- Optional: A list of HTTP methods to allow (e.g., "GET", "POST"). If empty, any method is allowed. This field is ignored for gRPC, because the value is always "POST". items: type: string type: array allowedPaths: description: |- Optional: A list of HTTP paths or gRPC methods to allow. gRPC methods must be presented as fully-qualified name in the form of "/packageName.serviceName/methodName", and are case sensitive. Exact match, prefix match, and suffix match are supported for paths. For example, the path `/books/review` matches `/books/review` (exact match), `*books/` (suffix match), or `/books*` (prefix match). If empty, any path is allowed. items: type: string type: array allowedRemoteIpBlocks: description: |- Optional: A list of IP blocks, populated from X-Forwarded-For header or proxy protocol. Single IP addresses (e.g. “1.2.3.4”) and CIDRs (e.g. “1.2.3.0/24”) are supported. This field is equivalent to the remote.ip attribute. If empty, any IP address is allowed. {{< alert >}} To use this field, you must configure the meshConfig.defaultConfig.gatewayTopology.numTrustedProxies field in your Istio installation. For more info, see the Istio documentation. {{< /alert >}} items: type: string type: array dryRun: description: |- Set to true to enable a dry run of the access policy for L7 Istio service mesh authorization only. Then, you can check the sidecar proxy logs, metrics, and tracing to determine if traffic would be allowed or denied. However, the authorization is not enforced until you disable the dry run and re-apply the access policy. Note that when there are both dry run and enforced policies, dry run policies are considered independently of enforced policies; i.e. the logs, metrics, and tracing results indicating if traffic would be allowed or denied is based on the behavior if all dry run policies were enforced but all currently enforced policies were deleted. Note that dry run cannot be used to review allow or deny decisions for L4 traffic. Even if you enable the dry run feature with a Gloo Network setup, no Cilium network policy and decision logs are created or enforced. type: boolean match: description: 'Optional: Additional request matching conditions.' properties: request: description: 'Optional: HTTP request header matching conditions.' properties: headers: additionalProperties: properties: notValues: description: |- A list of negative match values for the header. A request must not match any values. Supports wildcards. For example, to _not_ match a request with header values containing `ignore-books` or `partial-ignored-books`, set `notValues` to `ignore-books` and `partial-ig*-books`. items: type: string type: array values: description: |- A list of match values for the header. A request must match at least one value. Supports wildcards. For example, to match a request with header values containing `exact-books` OR `partial-matched-books`, set `values` to `exact-books` and `partial-*-books`. items: type: string type: array type: object description: 'Optional: HTTP request header matching conditions.' type: object type: object type: object type: object authzList: description: |- How clients are authorized to access the workload. A request is allowed when it matches at least one authz entry in the list (logically OR'd together). items: description: |- Configure access to workloads. You can have multiple `authzList` entries. A request is allowed when it matches at least one of the `authzList` entries (logically OR'd together). For each entry, you can specify different requirements for allowed clients, paths, methods, IP blocks, and other configuration settings. Then, a request is allowed only when ALL of the requirements are met (logically AND'd together). If the policy uses `applyToWorkloads`, you can also allow NO requests by setting this value to the empty object `{}`, which will serve as a fallback when requests do not match another `authz` case for the given workload. properties: allowedClients: description: |- Client identities that are permitted to access the workload. To allow access for all client identities, provide a single empty selector. items: description: IdentitySelector is a Selector specifically built for selecting client identities for security policies. properties: externalWorkloadSelector: description: Select external workloads. properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object requestIdentityMatcher: description: |- Select identities based on properties of the request. If multiple fields are set, they are ANDed together. More information about the individual values can be found here: https://istio.io/latest/docs/reference/config/security/authorization-policy/#Source properties: notRequestPrincipals: description: 'Optional: A list of identities to negative match the request identity.' items: type: string type: array requestPrincipals: description: |- Optional: A list of identities to match the request identity ("iss/sub" from the JWT). If omitted all request identity values will be accepted. items: type: string type: array type: object serviceAccountSelector: description: |- Select kubernetes service accounts as identities. When selecting a service account that will be created in the future for use in a AuthorizationPolicy, ONLY provide the name, namespace and cluster where the service account will exist in the selector. Providing labels and/or the workspace, or omitting the name, namespace or cluster for a service account that does not exist in the selector will not result in that service account being added to the resulting AuthorizationPolicy. properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: array allowedIpBlocks: description: |- Optional: A list of IP blocks, populated from the source address of the IP packet. Single IP addresses (e.g. “1.2.3.4”) and CIDRs (e.g. “1.2.3.0/24”) are supported. If empty, any IP address is allowed. items: type: string type: array allowedMethods: description: |- Optional: A list of HTTP methods to allow (e.g., "GET", "POST"). If empty, any method is allowed. This field is ignored for gRPC, because the value is always "POST". items: type: string type: array allowedPaths: description: |- Optional: A list of HTTP paths or gRPC methods to allow. gRPC methods must be presented as fully-qualified name in the form of "/packageName.serviceName/methodName", and are case sensitive. Exact match, prefix match, and suffix match are supported for paths. For example, the path `/books/review` matches `/books/review` (exact match), `*books/` (suffix match), or `/books*` (prefix match). If empty, any path is allowed. items: type: string type: array allowedRemoteIpBlocks: description: |- Optional: A list of IP blocks, populated from X-Forwarded-For header or proxy protocol. Single IP addresses (e.g. “1.2.3.4”) and CIDRs (e.g. “1.2.3.0/24”) are supported. This field is equivalent to the remote.ip attribute. If empty, any IP address is allowed. {{< alert >}} To use this field, you must configure the meshConfig.defaultConfig.gatewayTopology.numTrustedProxies field in your Istio installation. For more info, see the Istio documentation. {{< /alert >}} items: type: string type: array dryRun: description: |- Set to true to enable a dry run of the access policy for L7 Istio service mesh authorization only. Then, you can check the sidecar proxy logs, metrics, and tracing to determine if traffic would be allowed or denied. However, the authorization is not enforced until you disable the dry run and re-apply the access policy. Note that when there are both dry run and enforced policies, dry run policies are considered independently of enforced policies; i.e. the logs, metrics, and tracing results indicating if traffic would be allowed or denied is based on the behavior if all dry run policies were enforced but all currently enforced policies were deleted. Note that dry run cannot be used to review allow or deny decisions for L4 traffic. Even if you enable the dry run feature with a Gloo Network setup, no Cilium network policy and decision logs are created or enforced. type: boolean match: description: 'Optional: Additional request matching conditions.' properties: request: description: 'Optional: HTTP request header matching conditions.' properties: headers: additionalProperties: properties: notValues: description: |- A list of negative match values for the header. A request must not match any values. Supports wildcards. For example, to _not_ match a request with header values containing `ignore-books` or `partial-ignored-books`, set `notValues` to `ignore-books` and `partial-ig*-books`. items: type: string type: array values: description: |- A list of match values for the header. A request must match at least one value. Supports wildcards. For example, to match a request with header values containing `exact-books` OR `partial-matched-books`, set `values` to `exact-books` and `partial-*-books`. items: type: string type: array type: object description: 'Optional: HTTP request header matching conditions.' type: object type: object type: object type: object type: array enforcementLayers: description: |- Optional: When NetworkPolicy translation is enabled, all available layers are used to enforce AccessPolicies by default. If you want to explicitly define which layers to use to enforce this AccessPolicy, you can set them by using this field. Note that the layer that you define in this field must be available to be configured. properties: cni: type: boolean mesh: type: boolean type: object type: object type: object status: description: The status of the policy after it is applied to your Gloo environment. properties: common: description: The state and workspace conditions of the applied policy. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object numAllowedServiceAccounts: description: The number of service accounts allowed to access the selected destinations. maximum: 4294967295 minimum: 0 type: integer numSelectedDestinationPorts: description: The number of destination ports selected by the policy. maximum: 4294967295 minimum: 0 type: integer numSelectedNamespaces: description: The number of namespaces containing selected workloads by the policy. maximum: 4294967295 minimum: 0 type: integer type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 506f77cdba75404e crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: corspolicies.security.policy.gloo.solo.io spec: group: security.policy.gloo.solo.io names: categories: - solo-io kind: CORSPolicy listKind: CORSPolicyList plural: corspolicies shortNames: - cors singular: corspolicy scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: |- CORSPolicy is used to set a Cross-Origin Resource Sharing policy (CORS) for requests matching selected routes. Refer to [this link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS for further details about cross origin resource sharing. CORSPolicies are applied at the *Route* level. properties: applyToRoutes: description: |- Select the routes where the policy will be applied. If empty, will apply to all routes in the workspace. items: description: |- RouteSelector is a Selector specifically built for individual Routes inside of RouteTables. This selector can be used to select individual routes or entire route tables using the same label selector. oneOf: - not: anyOf: - required: - route - required: - withDestinations - required: - route - required: - withDestinations properties: route: description: |- select routes based on their labels. these labels can be used to match route tables or individual routes within route tables. properties: cluster: description: Only select routes attached to route tables matching the cluster. type: string labels: additionalProperties: type: string description: Select routes including all specified labels on the route or route table. type: object namespace: description: Only select routes attached to route tables matching the namespace. type: string workspace: description: Only select routes attached to route tables matching the workspace. type: string type: object withDestinations: description: |- select routes with `forwardTo` actions based on their destinations. this can be used to apply policy to routes regardless of their labels properties: kind: description: The kind of destination being selected. defaults to Kubernetes Service. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: |- The port on the Destination which receives traffic. All ports on the Destination will be selected if left empty. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object selector: description: The selector used to match destination objects by their metadata properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: object type: array config: description: The details of the CORS policy to apply to the selected routes. properties: allowCredentials: description: |- Indicates whether the caller is allowed to send the actual request (not the preflight) using credentials. Translates to the `Access-Control-Allow-Credentials` header. nullable: true type: boolean allowHeaders: description: |- List of HTTP headers that can be used when requesting the resource. Serialized to the `Access-Control-Allow-Headers` header. items: type: string type: array allowMethods: description: |- List of HTTP methods allowed to access the resource. The content will be serialized to the `Access-Control-Allow-Methods` header. items: type: string type: array allowOrigins: description: String patterns that match allowed origins. An origin is allowed if any of the string matchers match. items: description: Describes how to match a given string in HTTP headers. Match is case-sensitive. oneOf: - not: anyOf: - required: - exact - required: - prefix - required: - regex - required: - suffix - required: - exact - required: - prefix - required: - regex - required: - suffix properties: exact: description: Exact string match. type: string ignoreCase: description: If true, indicates the exact/prefix/suffix matching should be case insensitive. This has no effect for the regex match. type: boolean prefix: description: Prefix-based match. type: string regex: description: '[Re2 style regex-based match](https://github.com/google/re2/wiki/).' type: string suffix: description: Warning! Suffix-based matching is not currently supported in Gloo Platform. type: string type: object type: array exposeHeaders: description: |- A list of HTTP headers that browsers are allowed to access. Serialized to the `Access-Control-Expose-Headers` header. items: type: string type: array maxAge: description: |- Specify how long the results of a preflight request can be cached. Serialized to the `Access-Control-Max-Age` header. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#duration). type: string type: object type: object status: description: The status of the policy after it is applied to your Gloo environment. properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object numSelectedRoutes: description: The number of routes selected by the policy. maximum: 4294967295 minimum: 0 type: integer type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 4cb2145ac045a803 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: csrfpolicies.security.policy.gloo.solo.io spec: group: security.policy.gloo.solo.io names: categories: - solo-io kind: CSRFPolicy listKind: CSRFPolicyList plural: csrfpolicies shortNames: - csrf singular: csrfpolicy scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: |- CSRFPolicy is used to set safeguard to prevent CSRF (cross-site request forgery) attacks in requests matching selected routes. CSRFPolicies are applied at the *Route* level. properties: applyToRoutes: description: |- Routes to apply the policy to. If empty, the policy applies to all routes in the workspace.
**Configuration constraints**:

Only one CSRF policy can apply to a route. Subsequent policies (sorted by creation time) are ignored and put into a FAILED state.
CSRF policies are only applied to routes on a VirtualGateway. East-west routes that are configured with the `workloadSelectors` field in the RouteTable cannot be selected.

If empty and `applyToRoutes` is unset, the policy applies to all destinations in the workspace.

If empty and `applyToRoutes` is set, the policy does not apply to any destinations in the workspace.

**Configuration constraints**: Only one external auth policy can apply to a destination. Subsequent policies (sorted by creation time) are ignored and put into a FAILED state. If an external auth policy is applied to a VirtualDestination and another is applied to a Kubernetes Service backing the VD, the policy applied to the Service directly takes precedence. The other is ignored and put into a FAILED state. items: description: |- DestinationSelector is a selector for matching routable destinations for routes. DestinationSelectors can select a variety of object types. The behavior of the route action will vary depending on the type of destination selected. Defaults to the kubernetes `v1/Service`. Currently supported destination types: - v1 Service - networking.gloo.solo.io/v2 VirtualDestination (route traffic to a group of backing destinations) - networking.gloo.solo.io/v2 ExternalService (route traffic to a static set of service endpoints external to the mesh) properties: kind: description: The kind of destination being selected. defaults to Kubernetes Service. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: |- The port on the Destination which receives traffic. All ports on the Destination will be selected if left empty. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object selector: description: The selector used to match destination objects by their metadata properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: array applyToRoutes: description: |- Routes to apply the policy to. If empty, the policy does not apply to any routes in the workspace.
**Configuration constraints**:

Only one external auth policy can apply to a route. Subsequent policies (sorted by creation time) are ignored and put into a FAILED state.
External auth policies are only applied to routes on a VirtualGateway. East-west routes that are configured with the `workloadSelectors` field in the RouteTable cannot be selected.

items: description: |- RouteSelector is a Selector specifically built for individual Routes inside of RouteTables. This selector can be used to select individual routes or entire route tables using the same label selector. oneOf: - not: anyOf: - required: - route - required: - withDestinations - required: - route - required: - withDestinations properties: route: description: |- select routes based on their labels. these labels can be used to match route tables or individual routes within route tables. properties: cluster: description: Only select routes attached to route tables matching the cluster. type: string labels: additionalProperties: type: string description: Select routes including all specified labels on the route or route table. type: object namespace: description: Only select routes attached to route tables matching the namespace. type: string workspace: description: Only select routes attached to route tables matching the workspace. type: string type: object withDestinations: description: |- select routes with `forwardTo` actions based on their destinations. this can be used to apply policy to routes regardless of their labels properties: kind: description: The kind of destination being selected. defaults to Kubernetes Service. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: |- The port on the Destination which receives traffic. All ports on the Destination will be selected if left empty. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object selector: description: The selector used to match destination objects by their metadata properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: object type: array config: description: The details of the external auth policy to apply to the selected routes and/or destinations. oneOf: - not: anyOf: - required: - glooAuth - required: - customAuth - required: - glooAuth - required: - customAuth properties: customAuth: description: Configure the selected route or destination with auth options provided by your own custom external auth server. properties: contextExtensions: additionalProperties: type: string description: |- Add context extensions to the request that matches on the route or destination and is sent to the external auth server. This allows the server to base the auth decision on metadata that you define on the source of the request. This attribute is analogous to Envoy's config.filter.http.ext_authz.v2.CheckSettings. For more info, see the [Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/listeners/network_filters/ext_authz_filter.html?highlight=extauthz#config-filter-http-ext-authz-v2-checksettings). type: object type: object glooAuth: description: Configure the selected route or destination with auth options provided by one or more Gloo `ext-auth-service` Kubernetes services. properties: booleanExpr: description: |- How to handle processing of named configs within an auth config chain. An example config might be: `( basic1 \|\| basic2 \|\| (oidc1 && !oidc2) )` The boolean expression is evaluated left to right but honors parenthesis and short-circuiting. nullable: true type: string configs: description: |- List of auth configs to be checked for requests on a route referencing this auth config, By default, every config must be authorized for the entire request to be authorized. This behavior can be changed by defining names for each config and defining `boolean_expr` below. State is shared between successful requests on the chain, i.e., the headers returned from each successful auth service get appended into the final auth response. items: oneOf: - not: anyOf: - required: - basicAuth - required: - oauth - required: - oauth2 - required: - apiKeyAuth - required: - pluginAuth - required: - opaAuth - required: - ldap - required: - jwt - required: - passThroughAuth - required: - hmacAuth - required: - opaServerAuth - required: - portalAuth - required: - basicAuth - required: - oauth - required: - oauth2 - required: - apiKeyAuth - required: - pluginAuth - required: - opaAuth - required: - ldap - required: - jwt - required: - passThroughAuth - required: - hmacAuth - required: - opaServerAuth - required: - portalAuth properties: apiKeyAuth: oneOf: - not: anyOf: - required: - k8sSecretApikeyStorage - required: - aerospikeApikeyStorage - required: - k8sSecretApikeyStorage - required: - aerospikeApikeyStorage properties: aerospikeApikeyStorage: description: |- Deprecated: Support for Aerospike is deprecated and will be removed in a future release. Use of this feature is not recommended. oneOf: - not: anyOf: - required: - commitAll - required: - commitMaster - required: - commitAll - required: - commitMaster properties: allowInsecure: description: The TLS insecure setting. If set to `true`, the authority of the certificate on the client's end is not authenticated. You might use insecure mode in non-production environments when the certificate is not known. type: boolean batchSize: description: The size of the batch, which is the number of keys sent in the request. Defaults to 5000. format: int32 type: integer certPath: description: The path to the TLS certfiicate. type: string commitAll: description: '"commit_all" indicates that the server waits until successfully committing the master and all replicas.' maximum: 4294967295 minimum: 0 type: integer commitMaster: description: '"commit_master" indicates that the server waits until successfully committing the master only.' maximum: 4294967295 minimum: 0 type: integer hostname: description: |- The IP address or hostname of one of the cluster members of your Aerospike database. The address must be reachable from Gloo Edge, such as in a virtual machine with a public IP address or in a pod in the cluster. The client automatically discovers other members of the cluster after establishing a connection. type: string keyPath: description: The path to the key. type: string labelSelector: additionalProperties: type: string description: |- Identify the set of required labels (key/value) which an Aerospike secret must contain If a secret contains the provided set of labels, it will be considered valid when authorizing an ApiKey provided in a request type: object namespace: description: The Aerospike namespace of the database. Defaults to "solo-namespace". type: string nodeTlsName: description: |- TLS settings to enable mutual TLS (mTLS) on the server side. These configuration options must match what you configured in your Aerospike setup. For more information, see the Aerospike [security](https://docs.aerospike.com/server/guide/security/tls) and [network TLS](https://docs.aerospike.com/server/operations/configure/network/tls) guides. The subject name of the TLS authority. For more information, see the [Aerospike docs](https://docs.aerospike.com/reference/configuration#tls-name). type: string port: description: The port on which to connect to the Aerospike server. Defaults to 3000. format: int32 type: integer readModeAp: description: |- The read settings for availability (AP). For possible values, see the [Aerospike read mode AP](https://github.com/aerospike/aerospike-client-go/blob/master/read_mode_ap.go). Defaults to "read_mode_ap_one". oneOf: - not: anyOf: - required: - readModeApOne - required: - readModeApAll - required: - readModeApOne - required: - readModeApAll properties: readModeApAll: description: |- "all" indicates that all duplicate nodes are consulted in the read operation. maximum: 4294967295 minimum: 0 type: integer readModeApOne: description: '"one" indicates that a single node is involved in the read operation.' maximum: 4294967295 minimum: 0 type: integer type: object readModeSc: description: |- The read settings for strong consistency (SC). For possible values, see the [Aerospike read mode SC](https://github.com/aerospike/aerospike-client-go/blob/master/read_mode_sc.go). Defaults to "read_mode_sc_session". oneOf: - not: anyOf: - required: - readModeScSession - required: - readModeScLinearize - required: - readModeScReplica - required: - readModeScAllowUnavailable - required: - readModeScSession - required: - readModeScLinearize - required: - readModeScReplica - required: - readModeScAllowUnavailable properties: readModeScAllowUnavailable: description: |- "allow_unavailable" indicates that the server can read from master or any full (non-migrating) replica or from unavailable partitions. An increasing sequence of record versions is not guaranteed. maximum: 4294967295 minimum: 0 type: integer readModeScLinearize: description: |- "linearize" ensures that ALL clients see only an increasing sequence of record versions. "server" reads only from master. maximum: 4294967295 minimum: 0 type: integer readModeScReplica: description: |- "replica" indicates that the server can read from master or any full (non-migrating) replica. An increasing sequence of record versions is not guaranteed. maximum: 4294967295 minimum: 0 type: integer readModeScSession: description: |- The session ensures this client sees only an increasing sequence of record versions. Server reads only from master, which is the default. maximum: 4294967295 minimum: 0 type: integer type: object rootCaPath: description: If the root certificate authority (CA) is not set, add the system certs by default. type: string set: description: The Aerospike set to use for storage of API keys. Defaults to "apikeys". type: string tlsCurveGroups: description: The TLS identifier for an elliptic curve. For more information, see [TLS supported groups](https://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-8). items: oneOf: - not: anyOf: - required: - curveP256 - required: - curveP384 - required: - curveP521 - required: - x25519 - required: - curveP256 - required: - curveP384 - required: - curveP521 - required: - x25519 properties: curveP256: maximum: 4294967295 minimum: 0 type: integer curveP384: maximum: 4294967295 minimum: 0 type: integer curveP521: maximum: 4294967295 minimum: 0 type: integer x25519: maximum: 4294967295 minimum: 0 type: integer type: object type: array tlsVersion: description: The TLS version. Versions 1.0, 1.1, 1.2, and 1.3 are supported. Defaults to 1.3 type: string type: object apiKeySecretRefs: description: |- DEPRECATED: use K8sSecretApiKeyStorage to configure secrets storage backend. Values here will be overwritten if values are specified in the storage backend. A way to directly reference API key secrets. This configuration can be useful for testing, but in general the more flexible label selector should be preferred. items: description: A way to reference resources across namespaces properties: name: type: string namespace: type: string type: object type: array digest: description: |- Optional digest verification mode for API key validation. When configured, stored API key values are treated as digests and the request API key is transformed prior to comparison. When omitted, existing raw API key comparison behavior remains unchanged. properties: algorithm: description: Algorithm used to compute the digest for comparison against stored API key values. enum: - ALGORITHM_UNSPECIFIED - SHA256 type: string type: object headerName: description: |- When receiving a request, the Gloo Edge Enterprise external auth server will look for an API key in a header with this name. This field is optional; if not provided it defaults to `api-key`. type: string headersFromMetadata: additionalProperties: properties: name: description: |- DEPRECATED (Required) The key of the API key metadata entry to inspect. type: string required: description: |- DEPRECATED If this field is set to `true`, Gloo will reject an API key structure that does not contain data for the given key. Defaults to `false`. In this case, if an API key structure does not contain the requested data, no header will be added to the request. type: boolean type: object description: 'DEPRECATED: use headers_from_metadata_entry' type: object headersFromMetadataEntry: additionalProperties: properties: name: description: (Required) The key of the API key metadata entry to inspect. type: string required: description: |- If this field is set to `true`, Gloo will reject an API key structure that does not contain data for the given key. Defaults to `false`. In this case, if an API key structure does not contain the requested data, no header will be added to the request. type: boolean type: object description: |- API key structures might contain additional data (e.g. the ID of the user that the API key belongs to) in the form of extra fields included in the API key metadata structure. This configuration can be used to add this data to the headers of successfully authenticated requests. Each key in the map represents the name of header to be added; the corresponding value determines the key in the API key metadata structure that will be inspected to determine the value for the header. When the provided API key token has been successfully validated, and this field has been configured, then any extra API key metadata fields that were able to be discovered will be added to the `AuthorizationRequest` state under the key name that was configured. For example, using the `x-user-name` string as the header name, and referencing an existing "user-email" API key metadata entry will result in the value of this "user-email" metadata entry being accessable in other auth modules in the `AuthorizationRequest.State["x-user-name"]` key. This behavior allows other modules (e.g. OPA) to build more powerful rules to further validate the contents of the extra API key metadata than what's possible using the standalone API key module. type: object hmac: description: |- Optional HMAC digest verification mode for API key validation. When configured, stored API key values are treated as HMAC digests and the request API key is transformed prior to comparison. properties: algorithm: description: Algorithm used to compute the digest for comparison against stored API key values. enum: - ALGORITHM_UNSPECIFIED - HMAC_SHA256 type: string sharedSecretRef: description: Reference to the shared secret used to compute request-time HMAC digests. properties: name: type: string namespace: type: string type: object type: object k8sSecretApikeyStorage: properties: apiKeySecretRefs: description: |- A way to directly reference API key secrets. This configuration can be useful for testing, but in general the more flexible label selector should be preferred. items: description: A way to reference resources across namespaces properties: name: type: string namespace: type: string type: object type: array labelSelector: additionalProperties: type: string description: |- Identify all valid API key secrets that match the provided label selector.
API key secrets must be in one of the watch namespaces for gloo to locate them. type: object type: object labelSelector: additionalProperties: type: string description: |- DEPRECATED: use K8sSecretApiKeyStorage to configure secrets storage backend. Values here will be overwritten if values are specified in the storage backend. Identify all valid API key secrets that match the provided label selector. API key secrets must be in one of the watch namespaces for gloo to locate them. type: object match: description: |- Optional additional request header matching for digest-based API key validation. This field is only valid when digest is configured. ext-auth-service should reject configs that set match without digest. When configured, each header must match a same-named data key on the matched API key secret. properties: headers: items: description: A request header that must match the same-named data key on the matched API key secret. properties: name: description: |- Header name to match. Request headers are case-insensitive, but this configured name is also used as the Secret data key for same-name matching, so operators should use a canonical lowercase name. type: string type: object type: array type: object skipMetadataValidation: description: |- API key metadata may contain data is is invalid for a header, such as a newline. By default, this data will be validated in the data plane and mitigated in a way that provides a consistent experience for the user and visibility for the operator. This validation comes with a performance cost, and can be disabled by setting this field to `true`. type: boolean type: object basicAuth: oneOf: - not: anyOf: - required: - userList - required: - userList properties: apr: properties: users: additionalProperties: properties: hashedPassword: description: Salted and hashed password for the user type: string salt: description: Salt used with the apr algorithm for the user type: string type: object description: Map of authorized usernames to stored credentials type: object type: object encryption: description: |- The encryption type to use to store the password on the server If 'encryption' is defined, 'user_source' must be defined and the top level 'apr' field must not be defined or the config will fail validation oneOf: - not: anyOf: - required: - apr - required: - sha1 - required: - apr - required: - sha1 properties: apr: type: object sha1: type: object type: object realm: type: string userList: properties: users: additionalProperties: properties: hashedPassword: description: Salted and hashed password for the user type: string salt: description: Salt used with the hashing algorithm for the user type: string type: object type: object type: object type: object hmacAuth: allOf: - oneOf: - not: anyOf: - required: - secretRefs - required: - secretRefs - oneOf: - not: anyOf: - required: - parametersInHeaders - required: - parametersInHeaders properties: parametersInHeaders: type: object secretRefs: properties: secretRefs: description: list of secrets as registered with the issuer items: description: A way to reference resources across namespaces properties: name: type: string namespace: type: string type: object type: array required: - secretRefs type: object required: - secretRefs type: object jwt: description: |- This is a "dummy" extauth service which can be used to support multiple auth mechanisms with JWT authentication. If Jwt authentication is to be used in the [boolean expression](https://docs.solo.io/gloo-edge/latest/reference/api/github.com/solo-io/solo-apis/api/gloo/enterprise.gloo/v1/auth_config.proto.sk/#authconfig) in an AuthConfig, you can use this auth config type to include Jwt as an Auth config. In addition, `allow_missing_or_failed_jwt` must be set on the Virtual Host or Route that uses JWT auth or else the JWT filter will short circuit this behaviour. maxProperties: 0 type: object ldap: properties: address: description: Address of the LDAP server to query. Should be in the form ADDRESS:PORT, e.g. `ldap.default.svc.cluster.local:389`. type: string allowedGroups: description: |- In order for the request to be authenticated, the membership attribute (e.g. *memberOf*) on the user entry must contain at least of one of the group DNs specified via this option. E.g. []string{ "cn=managers,ou=groups,dc=solo,dc=io", "cn=developers,ou=groups,dc=solo,dc=io" } items: type: string type: array disableGroupChecking: description: |- Disables group checking, regardless of the value for allowedGroups, and disables validation for the membership attribute of the user entry. Group checking is enabled by default. type: boolean groupLookupSettings: description: |- Settings for using a separate service account for looking up group membership To use this, you also need to configure credentials in a secret properties: checkGroupsWithServiceAccount: description: If true, Gloo will use the service account to check group membership type: boolean credentialsSecretRef: description: Reference to an AccountCredentialsSecret to use to authenticate as the service account properties: name: type: string namespace: type: string type: object type: object membershipAttributeName: description: |- Case-insensitive name of the attribute that contains the names of the groups an entry is member of. Gloo will look for attributes with the given name to determine which groups the user entry belongs to. Defaults to 'memberOf' if not provided. type: string pool: description: Use this property to tune the pool of connections to the LDAP server that Gloo maintains. properties: initialSize: description: Number of connections that the pool will be pre-populated with upon initialization. The default value is 2. maximum: 4294967295 minimum: 0 nullable: true type: integer maxSize: description: Maximum number connections that are pooled at any give time. The default value is 5. maximum: 4294967295 minimum: 0 nullable: true type: integer type: object searchFilter: description: Use to set a custom filter when searching a member. Defaults to "(uid=*)". type: string userDnTemplate: description: |- Template to build user entry distinguished names (DN). This must contains a single occurrence of the "%s" placeholder. When processing a request, Gloo will substitute the name of the user (extracted from the auth header) for the placeholder and issue a search request with the resulting DN as baseDN (and 'base' search scope). E.g. "uid=%s,ou=people,dc=solo,dc=io" type: string required: - address type: object name: description: |- optional: used when defining complex boolean logic, if `boolean_expr` is defined below. Also used in logging. If omitted, an automatically generated name will be used (e.g. config_0, of the pattern 'config_$INDEX_IN_CHAIN'). In the case of plugin auth, this field is ignored in favor of the name assigned on the plugin config itself. nullable: true type: string oauth: properties: appUrl: description: |- we to redirect after successful auth, if we can't determine the original url this should be your publicly available app url. type: string authEndpointQueryParams: additionalProperties: type: string description: extra query parameters to apply to the Ext-Auth service's authorization request to the identity provider. type: object callbackPath: description: |- a callback path relative to app url that will be used for OIDC callbacks. needs to not be used by the application type: string clientId: description: your client id as registered with the issuer type: string clientSecretRef: description: your client secret as registered with the issuer properties: name: type: string namespace: type: string type: object issuerUrl: description: |- The url of the issuer. We will look for OIDC information in issuerUrl+ ".well-known/openid-configuration" type: string scopes: description: Scopes to request in addition to openid scope. items: type: string type: array required: - appUrl type: object oauth2: oneOf: - not: anyOf: - required: - oidcAuthorizationCode - required: - accessTokenValidation - required: - oauth2 - required: - oidcAuthorizationCode - required: - accessTokenValidation - required: - oauth2 properties: accessTokenValidation: allOf: - oneOf: - not: anyOf: - required: - introspectionUrl - required: - jwt - required: - introspection - required: - introspectionUrl - required: - jwt - required: - introspection - oneOf: - not: anyOf: - required: - requiredScopes - required: - requiredScopes - oneOf: - not: anyOf: - required: - default - required: - azure - required: - default - required: - azure description: |- provide the access token on the request and let gloo handle authorization. according to https://datatracker.ietf.org/doc/html/rfc6750 you can pass tokens through: - form-encoded body parameter. recommended, more likely to appear. e.g.: Authorization: Bearer mytoken123 - URI query parameter e.g. access_token=mytoken123 - and (preferably) secure cookies properties: azure: properties: claimsCachingOptions: description: |- Redis connection details to cache MS Entra claims. This way, you avoid performance issues of accessing the Microsoft Graph API too many times. Note that this setting does NOT turn on Redis caching for the user session. To turn on Redis user session caching, use the `userSessionConfig` field. properties: db: description: db to use. can leave unset for db 0. format: int32 type: integer host: description: address of the redis. can be address:port or unix://path/to/unix.sock type: string poolSize: description: |- size of the connection pool. can leave unset for default. defaults to 10 connections per every CPU format: int32 type: integer socketType: description: the socket type, default is TCP. enum: - TCP - TLS type: string tlsCertMountPath: description: |- enabled with a socket type of TLS. this is the tls cert mount path for this particular host. the generic secret can include the keys 'ca.crt', 'tls.crt', and 'tls.key'. the secret can contain the root-ca ,'ca.crt', at minimum. If a certificate is needed, both the 'tls.crt' and 'tls.key' need to be included. reference this to equal the 'mountPath' on the 'redis.certs[x].mountPath' in the helm chart values. an example of a mount path is '/certs'. type: string type: object clientId: description: |- The client ID for the ExtAuthService app that is registered in MS Entra, to access the Microsoft Graph API to retrieve distributed claims. This app is NOT the app that you want to configure external auth for. type: string clientSecret: description: |- The client secret of the ExtAuthService app that is registered with MS Entra to communicate with the MS Graph API. The client secret data must be placed in a k8s secret under a key called 'client-secret'. properties: name: type: string namespace: type: string type: object tenantId: description: |- The tenant ID represents the MS Entra organization ID where the ExtAuthService app is registered. This tenant ID may or may not be the same as in the top level `OidcAuthorizationCodeConfig`, depending on how your Azure account is provisioned. type: string type: object cacheTimeout: description: |- How long the token introspection and userinfo endpoint response for a specific access token should be kept in the in-memory cache. The result will be invalidated at this timeout, or at "exp" time from the introspection result, whichever comes sooner. If omitted, defaults to 10 minutes. If zero, then no caching will be done. type: string claimsToHeaders: description: |- A list of claims to be mapped from the JWT token received by ext-auth-service to an upstream destination. This option is not supported for opaque tokens. items: description: Map a single claim from an OAuth2 or OIDC token to a header in the request to the upstream destination. properties: append: description: If the header exists, append the claim value to the header (true), or overwrite any existing value (false). The default behavior is to overwrite any existing value (false). type: boolean claim: description: The claim name from the token, such as `sub`. type: string header: description: The header to copy the claim to, such as `x-sub`. type: string type: object type: array default: type: object dynamicMetadataFromClaims: additionalProperties: type: string description: |- Map claims to dynamic metadata keys in the authorization response, such as 'dynamic_metadata_from_claims.issuer=iss' and 'dynamic_metadata_from_claims.email=email'. Use this approach to enrich the metadata that is passed to upstream services so that they can be further processed or used for decision-making. Note that metadata keys must be unique, and the claim names must be alphanumeric and use `-` or `_` as separators. The metadata live in a namespace specified by the canonical name of the extauth filter (`envoy.filters.http.ext_authz`), and the structure of the claim value is preserved in the metadata struct. Dynamic metadata can be viewed in the authorization response. You can view the authorization response in the logs of the extauth pod when debug logging is enabled. To further process dynamic metadata, you can extract the dynamic metadata keys with an Inja template in a transformation or rate limiting policy. For example, to extract a nested `sub` key that is stored under `config_0`, use `{{ dynamic_metadata("config_0:sub", "envoy.filters.http.ext_authz")}}`. type: object introspection: description: |- Defines how (opaque) access tokens, received from the oauth authorization endpoint, are validated [OAuth2.0 Token Introspection](https://datatracker.ietf.org/doc/html/rfc7662) specification. properties: clientId: description: |- Your client id as registered with the issuer. Optional: Use if the token introspection url requires client authentication. type: string clientSecretRef: description: |- Your client secret as registered with the issuer. Optional: Use if the token introspection url requires client authentication. properties: name: type: string namespace: type: string type: object disableClientSecret: description: Allows setting a client id but not a client secret. nullable: true type: boolean introspectionUrl: description: |- The URL for the [OAuth2.0 Token Introspection](https://datatracker.ietf.org/doc/html/rfc7662) endpoint. If provided, the (opaque) access token provided or received from the oauth authorization endpoint will be validated against this endpoint, or locally cached responses for this access token. type: string userIdAttributeName: description: |- The name of the [introspection response](https://datatracker.ietf.org/doc/html/rfc7662#section-2.2) attribute that contains the ID of the resource owner (e.g. `sub`, `username`). If specified, the external auth server will use the value of the attribute as the identifier of the authenticated user and add it to the request headers and/or dynamic metadata (depending on how the server is configured); if the field is set and the attribute cannot be found, the request will be denied. This field is optional and by default the server will not try to derive the user ID. type: string required: - introspectionUrl type: object introspectionUrl: description: |- The URL for the [OAuth2.0 Token Introspection](https://datatracker.ietf.org/doc/html/rfc7662) endpoint. If provided, the (opaque) access token provided or received from the oauth authorization endpoint will be validated against this endpoint, or locally cached responses for this access token. This field is deprecated as it does not support authenticated introspection requests type: string jwt: description: |- Validate access tokens that conform to the [JSON Web Token (JWT)](https://datatracker.ietf.org/doc/rfc7662/) specification. oneOf: - not: anyOf: - required: - remoteJwks - required: - localJwks - required: - remoteJwks - required: - localJwks properties: audiences: description: |- List of JWT audiences allowed for this provider. The token's "aud" claim must intersect this list. If empty or unset, audience validation is skipped. items: type: string type: array issuer: description: |- Allow only tokens that have been issued by this principal (i.e. whose "iss" claim matches this value). If empty, issuer validation will be skipped. type: string localJwks: description: Loads the JWKS from a local data source. properties: inlineString: description: JWKS is embedded as a string. type: string required: - inlineString type: object remoteJwks: description: Fetches the JWKS from a remote location. properties: refreshInterval: description: |- The frequency at which the JWKS should be refreshed. If not specified, the default value is 5 minutes. type: string url: description: The HTTP URI to fetch the JWKS. type: string required: - url type: object type: object requiredScopes: description: |- Require access token to have all of the scopes in the given list. This configuration applies to both opaque and JWT tokens. In the case of opaque tokens, this will check the scopes returned in the "scope" member of introspection response (as described in [Section 2.2 of RFC7662](https://datatracker.ietf.org/doc/html/rfc7662#section-2.2). In case of JWTs the scopes to be validated are expected to be contained in the "scope" claim of the token in the form of a space-separated string. Omitting this field means that scope validation will be skipped. properties: scope: items: type: string type: array type: object userinfoUrl: description: |- The URL for the OIDC userinfo endpoint. If provided, the (opaque) access token provided or received from the oauth endpoint will be queried and the userinfo response (or cached response) will be added to the `AuthorizationRequest` state under the "introspection" key. This can be useful to leverage the userinfo response in, for example, an external auth server plugin. type: string type: object oauth2: description: |- Enterprise-Only: THIS FEATURE IS IN TECH PREVIEW. APIs are versioned as alpha and subject to change. provide issuer location and let Gloo handle Oauth2 flow for you. requests authorized by validating the contents of access token. Prefer to use OIDC for better security. properties: afterLogoutUrl: description: |- URL to redirect to after logout. Set this field to a publicly available URL. If not provided, this value defaults to the `app_url` value. type: string appUrl: description: |- Where to redirect after successful auth, if Gloo can't determine the original URL. Set this field to your publicly available app URL. type: string authEndpoint: description: The URL of the provider authorization endpoint. type: string authEndpointQueryParams: additionalProperties: type: string description: |- Extra query parameters to apply to the Ext-Auth service's authorization request to the identity provider. These parameters can be useful for flows such as [PKCE](https://www.oauth.com/oauth2-servers/pkce/authorization-request/) to set the `code_challenge` and `code_challenge_method`. type: object callbackPath: description: |- A callback path relative to the app URL to be used for OAuth2 callbacks. Do not use this path in the application itself. type: string clientId: description: Your client ID as registered with the issuer type: string clientSecretRef: description: |- Your client secret as registered with the issuer. This is required unless `disable_client_secret` is set. properties: name: type: string namespace: type: string type: object disableClientSecret: description: |- If true, do not check for or use the client secret. Generally the client secret is required and AuthConfigs will be rejected if it isn't set. However certain implementations of the PKCE flow do not use a client secret (including Okta) so this setting allows configuring Oauth2 without a client secret. nullable: true type: boolean logoutPath: description: |- A path relative to the app URL to use for logging out from an OAuth2 session. Do not use this path in the application itself. If not provided, logout functionality is disabled. type: string revocationEndpoint: description: |- The URL of the provider token revocation endpoint. For more information, refer to https://www.rfc-editor.org/rfc/rfc7009. type: string scopes: description: Scopes to request for. items: type: string type: array session: description: Configuration related to the user session. oneOf: - not: anyOf: - required: - cookie - required: - redis - required: - cookie - required: - redis properties: cipherConfig: description: the cipher config enables the symmetric key encryption of the cookie values of the user session. oneOf: - not: anyOf: - required: - keyRef - required: - keyRef properties: keyRef: description: The key reference used for the cipher. The reference must be a Kubernetes Secret of type `gloo.solo.io.EncryptionKeySecret`. properties: name: type: string namespace: type: string type: object type: object cookie: description: Set the tokens in the cookie itself. No need for server side state. properties: allowRefreshing: description: |- Refresh expired id-tokens using the refresh-token. The tokens refreshes when the client issues a call. Defaults to false. To enable refreshing, set to true. nullable: true type: boolean keyPrefix: description: |- Prefix to append to cookie keys, such as for separate domain and subdomain prefixes. Cookie keys are stored in the form `_`. For more information, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#attributes type: string targetDomain: description: |- Domain used to validate against requests in order to ensure that request host name matches target domain. If the target domain is provided will prevent requests that do not match the target domain according to the domain matching specifications in RFC 6265. For more information, see https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.3 type: string type: object cookieOptions: description: Set-Cookie options properties: domain: description: Cookie domain type: string httpOnly: description: Set the cookie to be HttpOnly. defaults to true. Set explicity to false to disable. nullable: true type: boolean maxAge: description: |- Max age for the cookie. Leave unset for a default of 30 days (2592000 seconds). To disable cookie expiry, set explicitly to 0. maximum: 4294967295 minimum: 0 nullable: true type: integer notSecure: description: |- Use a non-secure cookie. Note - this should only be used for testing and in trusted environments. type: boolean path: description: |- Path of the cookie. If unset, defaults to "/". Set it explicitly to "" to avoid setting a path. nullable: true type: string sameSite: description: |- Whether the cookie should be restricted to a first-party or same-site context. The default mode is LaxMode. enum: - DefaultMode - LaxMode - StrictMode - NoneMode type: string type: object failOnFetchFailure: description: |- should we fail auth flow when failing to get a session from redis, or allow it to continue, potentially starting a new auth flow and setting a new session. type: boolean redis: description: Use redis to store the tokens and just store a random id in the cookie. properties: allowRefreshing: description: |- Refresh expired id-tokens using the refresh-token. The tokens refreshes when the client issues a call. Defaults to true. To disable refreshing, set to false. nullable: true type: boolean cookieName: description: Cookie name to set and store the session id. If empty the default "__session" is used. type: string headerName: description: |- If set, the name of the header that will include the randomly generated session id This would be used as part of the code exchange with the Oauth2 token endpoint type: string keyPrefix: description: Key prefix inside redis type: string options: description: Options to connect to redis properties: db: description: db to use. can leave unset for db 0. format: int32 type: integer host: description: address of the redis. can be address:port or unix://path/to/unix.sock type: string poolSize: description: |- size of the connection pool. can leave unset for default. defaults to 10 connections per every CPU format: int32 type: integer socketType: description: the socket type, default is TCP. enum: - TCP - TLS type: string tlsCertMountPath: description: |- enabled with a socket type of TLS. this is the tls cert mount path for this particular host. the generic secret can include the keys 'ca.crt', 'tls.crt', and 'tls.key'. the secret can contain the root-ca ,'ca.crt', at minimum. If a certificate is needed, both the 'tls.crt' and 'tls.key' need to be included. reference this to equal the 'mountPath' on the 'redis.certs[x].mountPath' in the helm chart values. an example of a mount path is '/certs'. type: string type: object preExpiryBuffer: description: |- Specifies a time buffer in which an id-token will be refreshed prior to its actual expiration. Defaults to 2 seconds. A duration of 0 will only refresh tokens after they have already expired. To refresh tokens, you must also set 'allowRefreshing' to 'true'; otherwise, this field is ignored. type: string targetDomain: description: |- Domain used to validate against requests in order to ensure that request host name matches target domain. If the target domain is provided will prevent requests that do not match the target domain according to the domain matching specifications in RFC 6265. For more information, see https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.3 type: string type: object type: object tokenEndpoint: description: The URL of the provider token endpoint. type: string tokenEndpointQueryParams: additionalProperties: type: string description: |- Extra query parameters to apply to the Ext-Auth service's token request to the identity provider. These parameters can be useful for flows such as [PKCE](https://www.oauth.com/oauth2-servers/pkce/authorization-request/) to set the `code_verifier`. type: object required: - clientId - appUrl - callbackPath - authEndpoint - tokenEndpoint type: object oidcAuthorizationCode: description: |- provide issuer location and let gloo handle OIDC flow for you. requests authorized by validating the contents of ID token. can also authorize the access token if configured. oneOf: - not: anyOf: - required: - default - required: - azure - required: - default - required: - azure properties: accessToken: description: 'Optional: Configuration specific to the OAuth2 access token received and processed by the ext-auth-service.' properties: claimsToHeaders: description: |- A list of claims to be mapped from the JWT token received by ext-auth-service to an upstream destination. This option is not available for opaque tokens. items: description: Map a single claim from an OAuth2 or OIDC token to a header in the request to the upstream destination. properties: append: description: If the header exists, append the claim value to the header (true), or overwrite any existing value (false). The default behavior is to overwrite any existing value (false). type: boolean claim: description: The claim name from the token, such as `sub`. type: string header: description: The header to copy the claim to, such as `x-sub`. type: string type: object type: array type: object afterLogoutUrl: description: |- url to redirect to after logout. This should be a publicly available URL. If not provided, will default to the `app_url`. type: string appUrl: description: |- where to redirect after successful auth, if we can't determine the original url. this should be your publicly available app url. type: string authEndpointQueryParams: additionalProperties: type: string description: |- extra query parameters to apply to the Ext-Auth service's authorization request to the identity provider. this can be useful for flows such as PKCE (https://www.oauth.com/oauth2-servers/pkce/authorization-request/) to set the `code_challenge` and `code_challenge_method`. type: object autoMapFromMetadata: description: |- If specified, authEndpointQueryParams and tokenEndpointQueryParams will be populated using dynamic metadata values. By default parameters will be extracted from the solo_authconfig_oidc namespace this behavior can be overridden by explicitly specifying a namespace properties: namespace: description: The namespace from which to map metadata type: string type: object azure: properties: claimsCachingOptions: description: |- Redis connection details to cache MS Entra claims. This way, you avoid performance issues of accessing the Microsoft Graph API too many times. Note that this setting does NOT turn on Redis caching for the user session. To turn on Redis user session caching, use the `userSessionConfig` field. properties: db: description: db to use. can leave unset for db 0. format: int32 type: integer host: description: address of the redis. can be address:port or unix://path/to/unix.sock type: string poolSize: description: |- size of the connection pool. can leave unset for default. defaults to 10 connections per every CPU format: int32 type: integer socketType: description: the socket type, default is TCP. enum: - TCP - TLS type: string tlsCertMountPath: description: |- enabled with a socket type of TLS. this is the tls cert mount path for this particular host. the generic secret can include the keys 'ca.crt', 'tls.crt', and 'tls.key'. the secret can contain the root-ca ,'ca.crt', at minimum. If a certificate is needed, both the 'tls.crt' and 'tls.key' need to be included. reference this to equal the 'mountPath' on the 'redis.certs[x].mountPath' in the helm chart values. an example of a mount path is '/certs'. type: string type: object clientId: description: |- The client ID for the ExtAuthService app that is registered in MS Entra, to access the Microsoft Graph API to retrieve distributed claims. This app is NOT the app that you want to configure external auth for. type: string clientSecret: description: |- The client secret of the ExtAuthService app that is registered with MS Entra to communicate with the MS Graph API. The client secret data must be placed in a k8s secret under a key called 'client-secret'. properties: name: type: string namespace: type: string type: object tenantId: description: |- The tenant ID represents the MS Entra organization ID where the ExtAuthService app is registered. This tenant ID may or may not be the same as in the top level `OidcAuthorizationCodeConfig`, depending on how your Azure account is provisioned. type: string type: object callbackPath: description: |- a callback path relative to app url that will be used for OIDC callbacks. should not be used by the application. type: string clientAuthentication: oneOf: - not: anyOf: - required: - clientSecret - required: - privateKeyJwt - required: - clientSecret - required: - privateKeyJwt properties: clientSecret: description: Use the client secret method to authenticate the client properties: clientSecretRef: description: |- your client secret as registered with the issuer. This is required unless `disable_client_secret` is true properties: name: type: string namespace: type: string type: object disableClientSecret: description: |- If true, do not check for or use the client secret. Generally the client secret is required and AuthConfigs will be rejected if it isn't set. However certain implementations of the PKCE flow do not use a client secret (including Okta) so this setting allows configuring Oidc without a client secret. nullable: true type: boolean type: object privateKeyJwt: description: Use the private ket JWT method to authenticate the client properties: signingKeyRef: description: Signing key for the JWT used to authenticate the client properties: name: type: string namespace: type: string type: object validFor: description: |- Amount of time for which the JWT is valid. No maximum is enforced, but different IDPs may impose limits on how far in the future the expiration time is allowed to be. If omitted, default is 5s. type: string required: - signingKeyRef type: object type: object clientId: description: your client id as registered with the issuer type: string clientSecretRef: description: |- your client secret as registered with the issuer. This is required unless `disable_client_secret` is true This field has been deprecated and can be set in the client_secret option of client_authentication properties: name: type: string namespace: type: string type: object default: type: object disableClientSecret: description: |- If true, do not check for or use the client secret. Generally the client secret is required and AuthConfigs will be rejected if it isn't set. However certain implementations of the PKCE flow do not use a client secret (including Okta) so this setting allows configuring Oidc without a client secret. This field has been deprecated and can be set in the client_secret option of client_authentication nullable: true type: boolean discoveryOverride: description: |- OIDC configuration is discovered at /.well-known/openid-configuration The discovery override defines any properties that should override this discovery configuration For example, the following AuthConfig CRD could be defined as: ```yaml apiVersion: enterprise.gloo.solo.io/v1 kind: AuthConfig metadata: name: google-oidc namespace: gloo-system spec: configs: - oauth: app_url: http://localhost:8080 callback_path: /callback client_id: $CLIENT_ID client_secret_ref: name: google namespace: gloo-system issuer_url: https://accounts.google.com discovery_override: token_endpoint: "https://token.url/gettoken" ``` And this will ensure that regardless of what value is discovered at /.well-known/openid-configuration, "https://token.url/gettoken" will be used as the token endpoint properties: authEndpoint: description: url of the provider authorization endpoint type: string authMethods: description: list of client authentication methods supported by the provider token endpoint items: type: string type: array claims: description: list of claim types that the provider supports items: type: string type: array endSessionEndpoint: description: url of the provider end session endpoint type: string idTokenAlgs: description: list of json web signature signing algorithms that the provider supports for encoding claims in a jwt items: type: string type: array jwksUri: description: url of the provider json web key set type: string responseTypes: description: list of response types that the provider supports items: type: string type: array revocationEndpoint: description: url of the provider token revocation endpoint type: string scopes: description: list of scope values that the provider supports items: type: string type: array subjects: description: list of subject identifier types that the provider supports items: type: string type: array tokenEndpoint: description: url of the provider token endpoint type: string type: object discoveryPollInterval: description: |- The interval at which OIDC configuration is discovered at /.well-known/openid-configuration If not specified, the default value is 30 minutes. type: string dynamicMetadataFromClaims: additionalProperties: type: string description: |- Map claims to dynamic metadata keys in the authorization response, such as `dynamic_metadata.issuer=iss` and `dynamic_metadata.email=email`. Use this approach to enrich the metadata that is passed to upstream services so that they can be further processed or used for decision-making. Note that metadata keys must be unique, and the claim names must be alphanumeric and use `-` or `_` as separators. The metadata live in a namespace specified by the canonical name of the extauth filter (`envoy.filters.http.ext_authz`), and the structure of the claim value is preserved in the metadata struct. Dynamic metadata can be viewed in the authorization response. You can view the authorization response in the logs of the extauth pod when debug logging is enabled. To further process dynamic metadata, you can extract the dynamic metadata keys with an Inja template in a transformation or rate limiting policy. For example, to extract a nested `sub` key that is stored under `config_0`, use `{{ dynamic_metadata("config_0:sub", "envoy.filters.http.ext_authz")}}`. type: object endSessionProperties: description: |- If specified, these are properties defined for the end session endpoint specifications. Noted [here](https://openid.net/specs/openid-connect-rpinitiated-1_0.html) in the OIDC documentation. properties: methodType: description: The method type used by the end session endpoint, defaults to GET. enum: - GetMethod - PostMethod type: string type: object frontChannelLogout: description: |- Configuration for front channel logout. This is used to log out the user from multiple apps/clients associated with one OpenId Provider (OP). The path is registered with the OP and is called for each app/client that the user is logged into when the logout endpoint is called. properties: path: description: Path to use for front channel logout. Should not be the same as logout or callback paths. type: string type: object headers: description: Configures headers added to requests. properties: accessTokenHeader: description: If set, the access token will be forward upstream using this header name. type: string idTokenHeader: description: If set, the id token will be forward upstream using this header name. type: string useBearerSchemaForAuthorization: description: If true, adds the "Bearer" prefix to the upstream access token header value. nullable: true type: boolean type: object identityToken: description: 'Optional: Configuration specific to the OIDC identity token received and processed by the ext-auth-service.' properties: claimsToHeaders: description: |- A list of claims to be mapped from the JWT token received by ext-auth-service to an upstream destination. This option is not available for opaque tokens. items: description: Map a single claim from an OAuth2 or OIDC token to a header in the request to the upstream destination. properties: append: description: If the header exists, append the claim value to the header (true), or overwrite any existing value (false). The default behavior is to overwrite any existing value (false). type: boolean claim: description: The claim name from the token, such as `sub`. type: string header: description: The header to copy the claim to, such as `x-sub`. type: string type: object type: array type: object issuerUrl: description: |- The url of the issuer. We will look for OIDC information in issuerUrl+ ".well-known/openid-configuration" type: string jwksCacheRefreshPolicy: description: |- If a user executes a request with a key that is not found in the JWKS, it could be that the keys have rotated on the remote source, and not yet in the local cache. This policy lets you define the behavior for how to refresh the local cache during a request where an invalid key is provided oneOf: - not: anyOf: - required: - never - required: - always - required: - maxIdpReqPerPollingInterval - required: - never - required: - always - required: - maxIdpReqPerPollingInterval properties: always: description: |- If a key is not in the cache, fetch the most recent keys from the IdP and update the cache. NOTE: This should only be done in trusted environments, since missing keys will each trigger a request to the IdP. Using this in an environment exposed to the internet will allow malicious agents to execute a DDoS attack by spamming protected endpoints with tokens signed by invalid keys. maxProperties: 0 type: object maxIdpReqPerPollingInterval: description: |- If a key is not in the cache, fetch the most recent keys from the IdP and update the cache. This value sets the number of requests to the IdP per polling interval. If that limit is exceeded, we will stop fetching from the IdP for the remainder of the polling interval. maximum: 4294967295 minimum: 0 type: integer never: description: |- Never refresh the local JWKS cache on demand. If a key is not in the cache, it is assumed to be malicious. This is the default policy since we assume that IdPs publish keys before they rotate them, and frequent polling finds the newest keys. maxProperties: 0 type: object type: object logoutPath: description: |- a path relative to app url that will be used for logging out from an OIDC session. should not be used by the application. If not provided, logout functionality will be disabled. type: string parseCallbackPathAsRegex: description: If set, CallbackPath will be evaluated as a regular expression type: boolean scopes: description: Scopes to request in addition to openid scope. items: type: string type: array session: description: Configuration related to the user session. oneOf: - not: anyOf: - required: - cookie - required: - redis - required: - cookie - required: - redis properties: cipherConfig: description: the cipher config enables the symmetric key encryption of the cookie values of the user session. oneOf: - not: anyOf: - required: - keyRef - required: - keyRef properties: keyRef: description: The key reference used for the cipher. The reference must be a Kubernetes Secret of type `gloo.solo.io.EncryptionKeySecret`. properties: name: type: string namespace: type: string type: object type: object cookie: description: Set the tokens in the cookie itself. No need for server side state. properties: allowRefreshing: description: |- Refresh expired id-tokens using the refresh-token. The tokens refreshes when the client issues a call. Defaults to false. To enable refreshing, set to true. nullable: true type: boolean keyPrefix: description: |- Prefix to append to cookie keys, such as for separate domain and subdomain prefixes. Cookie keys are stored in the form `_`. For more information, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#attributes type: string targetDomain: description: |- Domain used to validate against requests in order to ensure that request host name matches target domain. If the target domain is provided will prevent requests that do not match the target domain according to the domain matching specifications in RFC 6265. For more information, see https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.3 type: string type: object cookieOptions: description: Set-Cookie options properties: domain: description: Cookie domain type: string httpOnly: description: Set the cookie to be HttpOnly. defaults to true. Set explicity to false to disable. nullable: true type: boolean maxAge: description: |- Max age for the cookie. Leave unset for a default of 30 days (2592000 seconds). To disable cookie expiry, set explicitly to 0. maximum: 4294967295 minimum: 0 nullable: true type: integer notSecure: description: |- Use a non-secure cookie. Note - this should only be used for testing and in trusted environments. type: boolean path: description: |- Path of the cookie. If unset, defaults to "/". Set it explicitly to "" to avoid setting a path. nullable: true type: string sameSite: description: |- Whether the cookie should be restricted to a first-party or same-site context. The default mode is LaxMode. enum: - DefaultMode - LaxMode - StrictMode - NoneMode type: string type: object failOnFetchFailure: description: |- should we fail auth flow when failing to get a session from redis, or allow it to continue, potentially starting a new auth flow and setting a new session. type: boolean redis: description: Use redis to store the tokens and just store a random id in the cookie. properties: allowRefreshing: description: |- Refresh expired id-tokens using the refresh-token. The tokens refreshes when the client issues a call. Defaults to true. To disable refreshing, set to false. nullable: true type: boolean cookieName: description: Cookie name to set and store the session id. If empty the default "__session" is used. type: string headerName: description: |- If set, the name of the header that will include the randomly generated session id This would be used as part of the code exchange with the Oauth2 token endpoint type: string keyPrefix: description: Key prefix inside redis type: string options: description: Options to connect to redis properties: db: description: db to use. can leave unset for db 0. format: int32 type: integer host: description: address of the redis. can be address:port or unix://path/to/unix.sock type: string poolSize: description: |- size of the connection pool. can leave unset for default. defaults to 10 connections per every CPU format: int32 type: integer socketType: description: the socket type, default is TCP. enum: - TCP - TLS type: string tlsCertMountPath: description: |- enabled with a socket type of TLS. this is the tls cert mount path for this particular host. the generic secret can include the keys 'ca.crt', 'tls.crt', and 'tls.key'. the secret can contain the root-ca ,'ca.crt', at minimum. If a certificate is needed, both the 'tls.crt' and 'tls.key' need to be included. reference this to equal the 'mountPath' on the 'redis.certs[x].mountPath' in the helm chart values. an example of a mount path is '/certs'. type: string type: object preExpiryBuffer: description: |- Specifies a time buffer in which an id-token will be refreshed prior to its actual expiration. Defaults to 2 seconds. A duration of 0 will only refresh tokens after they have already expired. To refresh tokens, you must also set 'allowRefreshing' to 'true'; otherwise, this field is ignored. type: string targetDomain: description: |- Domain used to validate against requests in order to ensure that request host name matches target domain. If the target domain is provided will prevent requests that do not match the target domain according to the domain matching specifications in RFC 6265. For more information, see https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.3 type: string type: object type: object sessionIdHeaderName: description: |- DEPRECATED: Prefer the RedisSession.HeaderName field If set, the randomly generated session id will be sent to the token endpoint as part of the code exchange The session id is used as the key for sessions in Redis type: string tokenEndpointQueryParams: additionalProperties: type: string description: |- extra query parameters to apply to the Ext-Auth service's token request to the identity provider. this can be useful for flows such as PKCE (https://www.oauth.com/oauth2-servers/pkce/authorization-request/) to set the `code_verifier`. type: object required: - clientId - issuerUrl - appUrl - callbackPath type: object type: object opaAuth: properties: modules: description: An optional resource reference to config maps containing modules to assist in the resolution of `query`. items: description: A way to reference resources across namespaces properties: name: type: string namespace: type: string type: object type: array options: description: Additional Options for Opa Auth configuration. properties: fastInputConversion: description: |- Decreases OPA latency by speeding up conversion of input to the OPA engine. If this is set to true, only http_request and state fields which are a scalar, map, or string array are included in the request input. All other fields are dropped. Dropped fields will not be evaluated by the OPA engine. By default, this is set to false and all fields are evaluated by OPA. type: boolean returnDecisionReason: description: |- DEPRECATED: It's recommended to use the `dynamic_metadata` field within Rego policies to specify the decision reason. To learn more about this approach, see the [OPA Envoy Plugin docs](https://github.com/open-policy-agent/opa/blob/c12463c/docs/content/envoy-primer.md#example-policy-with-additional-controls). When `returnDecisionReason` is set to true, the decision reason is stored in the Envoy Dynamic Metadata and has the following properties:

`body` - a textual explanation of the decision
`allowed` - whether the request was allowed or rejected

`body` - a textual explanation of the decision
`allowed` - whether the request was allowed or rejected

When using OpaAuth, the `body` field must be the second parameter of the query. Both the OpaAuth and OpaServerAuth approaches use the `allowed` and `body` values from the OPA response in the decision reason. You can find the `body` and `allowed` fields in the Envoy Filter Dynamic Metadata under the `envoy.filters.http.ext_authz..reason` section. If, however, `returnDecisionReason` is set to false, OPA's decision to allow or reject a request is made according to the Rego policy rules, and no explanation is provided. Despite of this, the `dynamic_metadata` field can still be used to convey any necessary information to the Envoy Dynamic Metadata, including the decision reason. type: boolean type: object package: description: The package from your Rego policy bundle used to query the OPA data API. type: string ruleName: description: The rule in your Rego policy bundle used to query the OPA data API. Supports querying subfields with a `/`. For more information, see the [OPA docs for the Data API](https://www.openpolicyagent.org/docs/latest/rest-api/#data-api). type: string serverAddr: description: |- The address of the OPA server to query, in the format `ADDRESS:PORT`. For OPA servers within the cluster, the address is the pod's service address, such as `opa-svc.default.svc.cluster.local:8181`. For OPA servers outside the cluster, the server must be accessible to the cluster, such as through an ExternalService. If you do not have your own OPA server instance, omit this field. When the external auth service has the OPA server sidecar enabled, the OPA server sidecar will be used instead, with an address such as `http://localhost:8181`. type: string required: - package type: object passThroughAuth: oneOf: - not: anyOf: - required: - grpc - required: - http - required: - grpc - required: - http properties: config: description: Custom config to be passed per request to the passthrough auth service. type: object x-kubernetes-preserve-unknown-fields: true failureModeAllow: description: |- If set to true, the service will accept client request even if the communication with the authorization service has failed, or if the authorization service has returned a server error. Defaults to false. type: boolean grpc: properties: address: description: Address of the auth server to query. Should be in the form ADDRESS:PORT, e.g. `default.svc.cluster.local:389`. type: string connectionTimeout: description: Timeout for the auth server to respond. Defaults to 5s type: string retryPolicy: description: |- Indicates the retry policy for re-establishing the gRPC stream. This field is optional and failed calls will not retry unless configured. oneOf: - not: anyOf: - required: - retryBackOff - required: - retryBackOff properties: numRetries: description: |- Specifies the allowed number of retries. This parameter is optional and defaults to 1. maximum: 4294967295 minimum: 0 nullable: true type: integer retryBackOff: description: |- Specifies parameters that control the backoff strategy. This parameter is optional, in which case the default base interval is 1000 milliseconds. The default maximum interval is 10 times the base interval. properties: baseInterval: description: |- The base interval to be used for the next back off computation. Defaults to 1000 milliseconds type: string maxInterval: description: |- Specifies the maximum delay between retries. Defaults to 10 times the base interval. type: string type: object type: object tlsConfig: description: |- TLS config for the gRPC passthrough, if not configured the connection will use insecure. When specified, this supports configuration for either simple TLS or mTLS. properties: secretRef: description: |- SecretRef contains the secret ref to a Kubernetes tls secret. This secret can contain the certificate, key and CA bundle to establish mTLS. If CA is not provided it will attempt to perform a simple TLS. properties: name: type: string namespace: type: string type: object sslParams: description: Additional TLS parameters properties: maximumProtocolVersion: description: |- Maximum TLS protocol version. If not explicitly set, the default protocol will be TLS 1.3. enum: - TLS_AUTO - TLSv1_1 - TLSv1_2 - TLSv1_3 type: string minimumProtocolVersion: description: |- Minimum TLS protocol version. If not explicitly set, the default protocol will be TLS 1.2. Avoid using TLS version earlier than 1.2, as this poses significant security risks. For more details, refer to https://www.ietf.org/rfc/rfc8996.html. enum: - TLS_AUTO - TLSv1_1 - TLSv1_2 - TLSv1_3 type: string type: object type: object required: - address type: object http: properties: connectionPool: description: |- Connection pool tuning. If unset, defaults apply (max_conns=100, idle_timeout=0). properties: idleTimeout: description: |- How long an idle (keep-alive) connection remains in the pool before being closed. Defaults to 0 (no idle expiry). type: string maxConns: description: |- Maximum total concurrent connections to the auth server, including in-flight requests. When reached, additional requests block until a slot frees. Defaults to 100. maximum: 4294967295 minimum: 0 type: integer type: object connectionTimeout: description: Timeout for the auth server to respond. Defaults to 5s type: string request: description: |- Pass through the incoming request body, ext auth state, and filter metadata. For more information, see the [PassThrough Http Request description](#passthroughhttp-request). properties: allowedHeaders: description: |- These headers will be copied from the incoming request to the request going to the auth server. By default, no headers are copied from the incoming request. Pseudo-headers such as `:Path`, and `:Method` can not be specified here. items: type: string type: array headersToAdd: additionalProperties: type: string description: |- These headers that will be included to the request to authorization service. Note that client request of the same key will be overridden. Pseudo-headers such as `:Path`, and `:Method` can not be specified here. type: object passThroughBody: description: |- Whether or not to include the body in the passthrough request body. In order for this to work, the settings.extauth.requestBody must be set in the Gloo Edge Settings CRD so that the request body is buffered and sent to the ext-auth service. If pass_through_body, pass_through_filter_metadata and pass_through_state are false, the authorization request body will be empty. A non-empty body will increase latency times slightly, so this is set to false by default, and should only be set to to true if the request body is needed in the auth request. type: boolean passThroughFilterMetadata: description: |- Whether or not to include the filter metadata in the passthrough request body. If pass_through_body, pass_through_filter_metadata and pass_through_state are false, the authorization request body will be empty. A non-empty body will increase latency times slightly, so this is set to false by default, and should only be set to to true if the filter metadata is needed in the auth request. type: boolean passThroughState: description: |- Whether or not to include the ext-auth state object in the passthrough request body. If this is set to true, it is expected that the state is returned in the HTTP response from the passthrough service. The state received from the response will be the state that is shared with other ext-auth service methods. If pass_through_body, pass_through_filter_metadata and pass_through_state are false, the authorization request body will be empty. A non-empty body will increase latency times slightly, so this is set to false by default, and should only be set to to true if the extauth state is needed in the auth request. type: boolean type: object response: description: |- Pass through response information such as the headers and body to downstream clients. For more information, see the [PassThrough Http Response description](#passthroughhttp-response). properties: allowedClientHeadersOnDenied: description: |- When this is set, authorization response headers in this list will be added to the response to the downstream client when the auth request is denied. If the response header already exists, it will replace the response header. If this is empty, by default, no authorization response headers will be added to the response to the downstream client. items: type: string type: array allowedClientHeadersOnSuccess: description: |- When this is set, authorization response headers in this list will be added to the response to the downstream client when the auth request is successful. Only headers that are present on the authorization response are added. If an added header already exists on the client response, it will be overwritten. If a listed header is absent from the authorization response, the client response is not modified: an existing client response header with the same name is preserved, not cleared. If this is empty, by default, no authorization response headers will be added to the response to the downstream client on success. items: type: string type: array allowedUpstreamHeaders: description: |- When this is set, authorization response headers that have a header in this list will be added to the original client request and sent to the upstream when the auth request is successful. These will be appended to any request headers that already exist. If this and allowed_upstream_headers_to_overwrite are empty, by default, no authorization response headers will be added to the upstream request. Header names may not be included in both allowed_upstream_headers and allowed_upstream_headers_to_overwrite. items: type: string type: array allowedUpstreamHeadersToOverwrite: description: |- When this is set, authorization response headers that have a header in this list will be added to the original client request and sent to the upstream when the auth request is successful. These will overwrite to any request headers that already exist. If this and allowed_upstream_headers are empty, by default, no authorization response headers will be added to the upstream request. Header names may not be included in both allowed_upstream_headers and allowed_upstream_headers_to_overwrite. items: type: string type: array readStateFromResponse: description: |- If this is set to true, the body of the response from the http passthrough auth server is expected to have shape { "state": object (map[string]interface{}) } The state will be marshalled from the response body and this is the state that will be passed on to other auth configs. Because of the marshalling from JSON to Go map, this will add some latency to the request. If the marshalling fails, the authorization check will fail and the request will be unauthorized after the ext-auth-service pod logs the marshal error. type: boolean type: object responseHeaderTimeout: description: |- Maximum time to wait for the passthrough auth server to begin sending response headers after the request is fully written. Independent from connection_timeout (the overall request budget) — whichever fires first wins. Defaults to 0 (unset; only connection_timeout applies). type: string tlsConfig: description: |- TLS config for the HTTP passthrough, if not configured the connection will use insecure. When specified, this supports configuration for either simple TLS or mTLS. properties: secretRef: description: |- SecretRef contains the secret ref to a Kubernetes tls secret. This secret can contain the certificate, key and CA bundle to establish mTLS. If CA is not provided it will attempt to perform a simple TLS. properties: name: type: string namespace: type: string type: object sslParams: description: Additional TLS parameters properties: maximumProtocolVersion: description: |- Maximum TLS protocol version. If not explicitly set, the default protocol will be TLS 1.3. enum: - TLS_AUTO - TLSv1_1 - TLSv1_2 - TLSv1_3 type: string minimumProtocolVersion: description: |- Minimum TLS protocol version. If not explicitly set, the default protocol will be TLS 1.2. Avoid using TLS version earlier than 1.2, as this poses significant security risks. For more details, refer to https://www.ietf.org/rfc/rfc8996.html. enum: - TLS_AUTO - TLSv1_1 - TLSv1_2 - TLSv1_3 type: string type: object type: object url: description: |- Required: URL of the passthrough http service, is a fully qualified domain name. Example: http://ext-auth-service.svc.local:9001. Path provided in the URL will be respected. To use https, provide the cert in the HTTPS_PASSTHROUGH_CA_CERT environment variable to the ext-auth-service pod as a base64-encoded string type: string required: - url type: object type: object pluginAuth: properties: config: type: object x-kubernetes-preserve-unknown-fields: true exportedSymbolName: description: |- Name of the exported symbol that implements the plugin interface in the plugin. If not specified, defaults to the name of the plugin type: string name: description: Name of the plugin type: string pluginFileName: description: Name of the compiled plugin file. If not specified, Gloo Edge will look for an ".so" file with same name as the plugin. type: string required: - config type: object portalAuth: properties: apiKeyHeader: description: |- The api key header name used to find the api key in the request headers. If provided will not authorize requests without the api key in the request headers. If not provided, will authorize requests with a Bearer token but must be chained with an AccessTokenValidation AuthConfig which will validate the token. type: string cacheDuration: description: The frequency at which the validated credential data should be refreshed by quering the portal web server. Defaults to 60s. type: string redisOptions: description: Options to connect to redis. If not provided, data will be cached in memory. properties: db: description: db to use. can leave unset for db 0. format: int32 type: integer host: description: address of the redis. can be address:port or unix://path/to/unix.sock type: string poolSize: description: |- size of the connection pool. can leave unset for default. defaults to 10 connections per every CPU format: int32 type: integer socketType: description: the socket type, default is TCP. enum: - TCP - TLS type: string tlsCertMountPath: description: |- enabled with a socket type of TLS. this is the tls cert mount path for this particular host. the generic secret can include the keys 'ca.crt', 'tls.crt', and 'tls.key'. the secret can contain the root-ca ,'ca.crt', at minimum. If a certificate is needed, both the 'tls.crt' and 'tls.key' need to be included. reference this to equal the 'mountPath' on the 'redis.certs[x].mountPath' in the helm chart values. an example of a mount path is '/certs'. type: string type: object requestTimeout: description: Timeout for the portal web server to respond. Defaults to 200ms type: string url: description: The portal web server url used to validate credentials generated by the portal for the backing service(s). type: string type: object type: object type: array failOnRedirect: description: |- How the service should handle a redirect response from an OIDC issuer. In the default false mode, the redirect will be considered a successful response, and the client will receive a 302 with a location header. If this is set to true, the client will instead receive a 401 unauthorized response. This is useful in cases where API calls are being made or other such occurrences where the client cannot handle the redirect. type: boolean required: - configs type: object server: description: |- Reference to the ExtAuthServer to use for this policy. To create an ExtAuthServer resource, see [External auth server setup](../../../security/external-auth/server/#setup).
**Implementation notes**:

The ExtAuthServer must be in the same workspace as this ExtAuthPolicy. Be sure to select the appropriate ExtAuthServer to use, which might be in a different cluster and namespace than the policy.
If this field is omitted, Gloo generates a default ExtAuthServer configuration. To review the default values for an ExtAuthServer, see the [API reference](../ext_auth_server/).

**Configuration constraints:**

Routes on a single gateway must share a single ExtAuthServer.
If `glooAuth` is used, the `server` must reference an ExtAuthServer that is backed by one or more Gloo `ext-auth-service` Kubernetes services.
If `customAuth` is used, the `server` must reference an ExtAuthServer that is backed by your own custom external auth server.
For auth configurations that require a client secret from the identity provider issuer, the secret must be in the same cluster as the ExtAuthServer resource.

properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object type: object type: object status: description: The status of the policy after it is applied to your Gloo environment. properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object numSelectedDestinationPorts: description: The number of destination ports selected by the policy. maximum: 4294967295 minimum: 0 type: integer numSelectedRoutes: description: The number of routes selected by the policy. maximum: 4294967295 minimum: 0 type: integer type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 643177e69b819ae5 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: graphqlallowedquerypolicies.security.policy.gloo.solo.io spec: group: security.policy.gloo.solo.io names: categories: - solo-io kind: GraphQLAllowedQueryPolicy listKind: GraphQLAllowedQueryPolicyList plural: graphqlallowedquerypolicies shortNames: - gqlaq - gqlaqp singular: graphqlallowedquerypolicy scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: properties: applyToRoutes: description: |- Select the graphql routes where the policy will be applied. If empty, will apply to no graphql routes. selection via Destination selectors will not work for this policy, and only route selectors will work. If more than one GraphQLAllowedQueryPolicy applies to a GraphQLRoute, the oldest one will be applied. items: description: |- RouteSelector is a Selector specifically built for individual Routes inside of RouteTables. This selector can be used to select individual routes or entire route tables using the same label selector. oneOf: - not: anyOf: - required: - route - required: - withDestinations - required: - route - required: - withDestinations properties: route: description: |- select routes based on their labels. these labels can be used to match route tables or individual routes within route tables. properties: cluster: description: Only select routes attached to route tables matching the cluster. type: string labels: additionalProperties: type: string description: Select routes including all specified labels on the route or route table. type: object namespace: description: Only select routes attached to route tables matching the namespace. type: string workspace: description: Only select routes attached to route tables matching the workspace. type: string type: object withDestinations: description: |- select routes with `forwardTo` actions based on their destinations. this can be used to apply policy to routes regardless of their labels properties: kind: description: The kind of destination being selected. defaults to Kubernetes Service. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: |- The port on the Destination which receives traffic. All ports on the Destination will be selected if left empty. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object selector: description: The selector used to match destination objects by their metadata properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: object type: array config: properties: allowedQueryHashes: description: |- A list of SHA-256 hashed graphql queries that are allowed to be executed by the server. If a query hash is not in this list, the server will return an error. If this list is empty, all queries are allowed. Else, all queries must be in this list. Queries that are not sent as hashes will be hashed and compared against the list. This is useful for preventing malicious queries from being executed. items: type: string type: array type: object type: object status: properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object numSelectedRoutes: description: The number of routes the policy selects. maximum: 4294967295 minimum: 0 type: integer type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 40687a4ae8d08c31 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: jwtpolicies.security.policy.gloo.solo.io spec: group: security.policy.gloo.solo.io names: categories: - solo-io kind: JWTPolicy listKind: JWTPolicyList plural: jwtpolicies shortNames: - jwt singular: jwtpolicy scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: |- Fill out the spec of the JWT policy to enable JWT authentication. You can apply JWT policies to routes and destinations. Multiple policies: If multiple JWT policies select the same route or destination, only the oldest policy applies. Multiple selectors: You can select routes and destinations together in the same policy. Using both selectors might impact the other. For example, you might omit a route selector. If you also omit a destination selector, then the policy applies to all routes. If you use a destination selector, the policy applies only to those destinations and no longer to any routes. If different JWT policies having conflicting rules for the same routes and destinations, then access is blocked. properties: applyToDestinations: description: |- Select the destinations where the policy will be applied. By default if omitted, the policy does not apply to any destinations. If empty (`{}`), the policy applies to all destinations in the workspace.
**Configuration constraints**: Only one JWT policy can apply to a destination. Subsequent policies (sorted by creation time) are ignored and put into a FAILED state. If a JWT policy is applied to a VirtualDestination and another is applied to a Kubernetes Service backing the VD, the policy applied to the Service directly takes precedence. The other is ignored and put into a FAILED state. items: description: |- DestinationSelector is a selector for matching routable destinations for routes. DestinationSelectors can select a variety of object types. The behavior of the route action will vary depending on the type of destination selected. Defaults to the kubernetes `v1/Service`. Currently supported destination types: - v1 Service - networking.gloo.solo.io/v2 VirtualDestination (route traffic to a group of backing destinations) - networking.gloo.solo.io/v2 ExternalService (route traffic to a static set of service endpoints external to the mesh) properties: kind: description: The kind of destination being selected. defaults to Kubernetes Service. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: |- The port on the Destination which receives traffic. All ports on the Destination will be selected if left empty. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object selector: description: The selector used to match destination objects by their metadata properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: array applyToRoutes: description: |- Select the routes where the policy will be applied. If empty (`{}`), the policy applies to all routes in the workspace. If omitted and the policy also does not select any destinations, the policy applies to all routes in the workspace. If omitted and the policy selects a destination, the policy does not apply to any routes. items: description: |- RouteSelector is a Selector specifically built for individual Routes inside of RouteTables. This selector can be used to select individual routes or entire route tables using the same label selector. oneOf: - not: anyOf: - required: - route - required: - withDestinations - required: - route - required: - withDestinations properties: route: description: |- select routes based on their labels. these labels can be used to match route tables or individual routes within route tables. properties: cluster: description: Only select routes attached to route tables matching the cluster. type: string labels: additionalProperties: type: string description: Select routes including all specified labels on the route or route table. type: object namespace: description: Only select routes attached to route tables matching the namespace. type: string workspace: description: Only select routes attached to route tables matching the workspace. type: string type: object withDestinations: description: |- select routes with `forwardTo` actions based on their destinations. this can be used to apply policy to routes regardless of their labels properties: kind: description: The kind of destination being selected. defaults to Kubernetes Service. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: |- The port on the Destination which receives traffic. All ports on the Destination will be selected if left empty. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object selector: description: The selector used to match destination objects by their metadata properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: object type: array config: description: The details of the JWT policy to apply to the selected routes. properties: allowMissingOrFailed: description: |- Deprecated: Set the `validationPolicy` field to `ALLOW_MISSING_OR_FAILED` instead of setting this field to "true". Note that if `validationPolicy` is set to `ALLOW_MISSING_OR_FAILED` or `ALLOW_MISSING`, it takes precedence and this field is ignored. Allow requests to succeed even if JWT authentication is missing or fails. For example, you might apply multiple policies to your routes so that requests can authenticate with either a JWT or another method such as external auth. Set this value to "true" to allow a failed JWT auth request to pass through to the other authentication method. By default, this value is "false" so that requests that fail JWT authentication then fail authorization immediately. type: boolean claims: description: |- Optional: A key-value list of claims to require for JWT authorization. The JWT must meet all of the claims to be allowed (logically AND'd together). For each claim, you can specify values that must or must not be present. items: description: |- Optionally configure a list of key-value claims for JWT authorization rules. The JWT must meet all of the claims to be allowed (logically AND'd together). For each claim, you can specify values that must or must not be present. If a claim has multiple supported values, any of these values is allowed (logically OR'd together). You can also use wildcards, such as `"*"` to allow any value, or for example `"*@solo.io"` to allow any `@solo.io` email. Nested claims are not supported at this time. properties: key: description: |- The name of the JWT claim's key. [RFC 7519 spec](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1) reserves seven claims, and the [IANA JSON Web Token Claims](https://www.iana.org/assignments/jwt/jwt.xhtml#claims) outline many more registered claims to encourage interoperability across providers. Further, your OIDC provider might have custom claims, such as described in the [Auth0 docs](https://auth0.com/docs/get-started/apis/scopes/sample-use-cases-scopes-and-claims). type: string nestedClaimDelimiter: description: |- Optional: Specify a delimiter to enable nested claims, which are claims that are children of top-level claims. The delimiter is the character that separates the nested levels within the claims names of the JWT. The delimiter is commonly set to a period ("."), which allows nested claim names of the form parent.child.grandchild. JWTs that match the value you set for the grandchild nested claim are allowed. type: string notValues: description: |- Optional: A list of values that are not allowed for the JWT claim. If a claim contains one of these values, the request is denied. You can also use wildcards, such as `"*"` to deny any value, or for example `"*@solo.io"` to deny any `@solo.io` email. Note: You must set at least one of "values" or "not_values". items: type: string type: array values: description: |- Optional: A list of allowed values for the JWT claim. If a claim has multiple supported values, any of these values is allowed (logically OR'd together). You can also use wildcards, such as `"*"` to allow any value or for example `"*@solo.io"` to allow any `@solo.io` email. Nested claims are not supported at this time. Note: You must set at least one of "values" or "not_values". items: type: string type: array type: object type: array clearRouteCache: description: |- Optional: Decide whether to clear the route cache after the JWT filter. By clearing the route cache, the gateway recomputes route matching. This way, you can configure traffic rules after JWT auth, such as claim-based routing on cleared routes or direct response on cached routes. Defaults to the `AUTO` option. enum: - AUTO - "FALSE" - "TRUE" type: string phase: description: |- Optional: Set when to apply the JWT filter in the request chain, either before (`preAuthz`) or after (`postAuthz`) authorization to have access to the JWT token. If no phase is specified, defaults to `preAuthz`. oneOf: - not: anyOf: - required: - preAuthz - required: - postAuthz - required: - preAuthz - required: - postAuthz properties: postAuthz: description: Apply this policy after Authorization policies are applied. properties: priority: description: |- The priority at which this policy should be applied relative to other policies defined in the same phase. The lowest priority will be run first and the default priority value is 0. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#int32-value). maximum: 2147483647 minimum: -2147483648 nullable: true type: integer type: object preAuthz: description: Apply this policy before Authorization policies are applied. properties: priority: description: |- The priority at which this policy should be applied relative to other policies defined in the same phase. The lowest priority will be run first and the default priority value is 0. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#int32-value). maximum: 2147483647 minimum: -2147483648 nullable: true type: integer type: object type: object providers: additionalProperties: oneOf: - not: anyOf: - required: - local - required: - remote - required: - local - required: - remote properties: audiences: description: |- Optional: A list of intended audiences for this JWT token. If specified, a JWT token containing any of these `aud` field values is accepted. If omitted, the `aud` field in the JWT token is not checked. items: type: string type: array claimsToHeaders: description: |- Optional: Specify the claims from the JWT payload to copy to individual headers before forwarding the request to the upstream destination. To copy the entire payload to a single header instead, use the OutputPayloadToHeader field. items: description: Specify the claims from the JWT payload to copy to individual headers before forwarding the request to the upstream destination. properties: append: description: If the header already exists, append this copied value to it (true), or overwrite the existing value (false). type: boolean claim: description: Claim name, such as `"sub"`. type: string header: description: The request header to copy the claim to, such as `"x-sub"`. type: string type: object type: array clockSkewSeconds: description: |- Optional: Verify time constraints, such as `exp` and `npf`. Default is 60s. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#u-int32-value). maximum: 4294967295 minimum: 0 nullable: true type: integer customDelimiter: description: 'Optional: Specify a custom delimiter to append claims. Defaults to a comma (`,`).' type: string issuer: description: |- Optional: The principal that issued the JWT, usually a URL or an email address. If specified, the `iss` field in JWT token of the incoming request must match this field, or else the request is denied. If omitted, the `iss` field in the JWT token is not checked. type: string keepToken: description: 'Optional: Keep the JWT in the request post verification.' type: boolean local: description: |- Get the public keys to validate the JWT from a local source, such as a Kubernetes secret or an inline PEM-formatted public key. oneOf: - not: anyOf: - required: - secretRef - required: - inline - required: - secretRef - required: - inline properties: inline: description: Provide an inline PEM-formatted public key in the configuration of this JWT policy. type: string secretRef: description: Refer to a secret that has the PEM-formatted public key. properties: key: description: Refer to the key of data that has the PEM-formatted public key within the specified secret. type: string objectRef: description: Refer to the secret explicitly by the cluster and namespace where the secret is located. properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object type: object type: object outputPayloadToHeader: description: |- Optional: Copy the output of the JWT payload to a single header before forwarding the request to the upstream destination. The header is the name that you enter in this field. The payload data is base64-encoded before forwarding. If this field is omitted or empty, the payload is not forwarded with the request. To send select claims in the payload in individual headers, use the ClaimsToHeaders field instead. type: string remote: description: |- Get the public keys from a remote JSON Web Key Set (JWKS) server. This server must be accessible from your cluster. properties: cacheDuration: description: |- Duration after which the cached JWKS expires. If omitted, defaults to 5 minutes. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#duration). type: string destinationRef: description: |- The destination that represents the JWKS server. If the JWKS server runs in your cluster, the destination can be a Kubernetes Service or Gloo VirtualDestination. If the JWKS server is a remote URL, the destination must be a Gloo ExternalService. oneOf: - not: anyOf: - required: - ref - required: - awsLambda - required: - ref - required: - awsLambda properties: awsLambda: description: Reference an AWS Lambda function. properties: cloudProvider: description: Reference to the AWS Cloud Provider. properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object function: description: Name of the function to reference. type: string options: description: |- Specify how the destinations should be configured, for configuring lambda functions. If the destination config is required for the destination and not provided by the user, Gloo will invalidate the destination and its parent resources. properties: invocationStyle: description: |- Can be either Sync or Async. See [AWS Invoke](https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html) for more details. enum: - SYNC - ASYNC type: string requestTransformation: enum: - REQUEST_DEFAULT - REQUEST_DISABLE type: string responseTransformation: enum: - RESPONSE_DEFAULT - RESPONSE_DISABLE type: string type: object qualifier: description: Qualifier of the function to reference. Defaults to $LATEST type: string type: object kind: description: |- the kind of Kubernetes destination being referenced. defaults to Service. Only applicable for Kubernetes destinations. For non Kubernetes destinations, this field is ignored. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: the port on the destination object being targeted. required if the object provides more than one port. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object ref: description: reference to a Kubernetes destination object by its metadata properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object subset: additionalProperties: type: string description: |- select a subset of the destination's endpoints for routing based on their labels. Only applicable for Kubernetes destinations. type: object weight: description: |- Specify the proportion of traffic to be forwarded to this destination. Weights across all of the `destinations` must sum to 100. Weight is only relevant when used in the context of a route with multiple destinations. maximum: 4294967295 minimum: 0 type: integer type: object enableAsyncFetch: description: |- Fetch the JWKS asynchronously in the main thread before activating the listener. Then, the fetched JWKS can be used by all worker threads. When set to false (default): The JWKS is fetched on-demand when requests come. The first few requests are paused until the JWKS is fetched. Because the JWKS cache is per worker thread, each worker thread fetches its own JWKS. You might leave async fetching disabled in simple environments with minimal traffic or resources, during testing to simplify debugging issues, or when you want more control over when and how the JWKS is fetched. When set to true: The JWKS is fetched in the main thread before activating the listener. Then, the JWKS can be used by all worker threads. Each worker thread doesn't need to fetch its own. This way, the JWKS is ready when requests come. You might enable async fetching to reduce latency, improve responsiveness, and have consistent JWKS across worker threads such as in multi-threaded, concurrent, and large-scale environments. type: boolean failedRefetchDuration: description: |- The duration to wait after a failed fetch cycle (retries exhausted) before starting a new fetch cycle. Only applies when `enableAsyncFetch` is true; otherwise this field is ignored. If omitted, defaults to 1 second per Envoy default behavior, which can produce request storms against the JWKS server during outages. Set this to a higher value (for example, 5 minutes) to limit the rate of failed fetches. type: string retryPolicy: description: Configure retry behavior when a JWKS fetch fails. properties: backoff: description: |- Configure exponential backoff between retries. If omitted, retries occur with a fixed 1 second interval. properties: baseInterval: description: |- The base interval before the first retry. Must be greater than 0 and less than or equal to `maxInterval`. If omitted, defaults to 1 second. type: string maxInterval: description: |- The maximum interval between retries. If omitted, defaults to 10 times `baseInterval`. type: string type: object numRetries: description: |- The maximum number of retries to attempt per failed fetch. If omitted, defaults to 1. maximum: 4294967295 minimum: 0 nullable: true type: integer type: object timeout: description: |- Set the maximum duration in seconds that a response can take to arrive upon request. If omitted, defaults to 5 seconds. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#duration). type: string url: description: |- The URL to access the remote destination for JWKS server. This value sets the host and path in the request. type: string type: object tokenSource: description: |- Optional: Where to extract the JWT from the HTTP request. If no explicit token source location is specified, the following default locations are tried in order: First, the Authorization header using the `Bearer ` prefix, such as: `Authorization: Bearer `. Second, the `access_token` query parameter, such as: `https:///path?access_token=`. Gloo can verify multiple JWTs for a request. Each JWT is extracted from the location that is specified per provider, or from the default locations previously described. Note that if a single request contains multiple sources, such as both a header and query parameter, then all tokens found in the request must be valid for the request to be accepted. Configured fields are case sensitive and are matched verbatim. properties: headers: description: Try to retrieve the token from these headers. items: description: Describes how to retrieve the JWT from a header. properties: name: description: The name of header, such as `"Authorization"`. type: string prefix: description: The prefix before the token, such as `"Bearer "` (with a space before the token). type: string type: object type: array queryParams: description: Try to retrieve the token from these query parameters. items: type: string type: array type: object type: object description: |- Set up the provider for the JWT configuration. You can have multiple providers in the same JWT policy, or create separate policies per provider. Successfully verified JWT payloads will be written to Envoy Dynamic Metadata in the format `{{ policy generated prefix }}.{{ provider }}`. For more info, see the `payload_in_metadata` field [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/jwt_authn/v3/config.proto.html). Note: You can name the providers to help you map the provider when viewing logs to debug. However, the provider name does not affect the policy's behavior and cannot be used by other resources to select the policy. type: object requiredScopes: description: |- Optional: An unordered list of required JWT scopes. The JWT "scope" claim must have all of the listed scopes to be allowed (logically AND'd together). Scopes typically come from an identity provider and are formatted similar to `":"` or `"is:"`. For more information, see the [IETF docs](https://datatracker.ietf.org/doc/html/rfc8693#name-scope-scopes-claim). For example, you might use this field to set `email` and `is:developer` as required scopes. Then the scope claim in the JWT must have all of those required scopes, but could also have others. JWTs with scopes such as `"scope":"email is:developer"` or `"scope":"email is:developer phone address"` would be allowed. JWTs with only one of the required scopes, such as `"scope":"email address"` would not be allowed. If you want to set scopes that if present in the claim are not allowed (`notValues`), or to allow a request to succeed with just one of many listed scopes (`email OR is:developer`), use the claims field instead. To skip scope validation, omit this value or leave the list empty. Note that nested scopes (a scope with multiple sub scopes) are not supported at this time. items: type: string type: array validationPolicy: description: |- Optional: Configure how JWT validation works, with the flexibility to handle requests with missing or invalid JWTs. By default, after applying JWT policy to a route, only requests that authenticate with a valid JWT succeed. enum: - REQUIRE_VALID - ALLOW_MISSING - ALLOW_MISSING_OR_FAILED type: string type: object type: object status: description: The status of the policy after it is applied to your Gloo environment.Status properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object numSelectedDestinationPorts: description: The number of destination ports selected by the policy. maximum: 4294967295 minimum: 0 type: integer numSelectedRoutes: description: The number of routes selected by the policy. maximum: 4294967295 minimum: 0 type: integer type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: aa2dba7a45a69dc3 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: wafpolicies.security.policy.gloo.solo.io spec: group: security.policy.gloo.solo.io names: categories: - solo-io kind: WAFPolicy listKind: WAFPolicyList plural: wafpolicies shortNames: - waf singular: wafpolicy scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: |- WAFPolicy is used to set safeguard your services with the functionality of Web ApplicationFirewall WAFPolicies are applied at the *Route* level. properties: applyToRoutes: description: |- Routes to apply the policy to. If empty, the policy applies to all routes in the workspace. items: description: |- RouteSelector is a Selector specifically built for individual Routes inside of RouteTables. This selector can be used to select individual routes or entire route tables using the same label selector. oneOf: - not: anyOf: - required: - route - required: - withDestinations - required: - route - required: - withDestinations properties: route: description: |- select routes based on their labels. these labels can be used to match route tables or individual routes within route tables. properties: cluster: description: Only select routes attached to route tables matching the cluster. type: string labels: additionalProperties: type: string description: Select routes including all specified labels on the route or route table. type: object namespace: description: Only select routes attached to route tables matching the namespace. type: string workspace: description: Only select routes attached to route tables matching the workspace. type: string type: object withDestinations: description: |- select routes with `forwardTo` actions based on their destinations. this can be used to apply policy to routes regardless of their labels properties: kind: description: The kind of destination being selected. defaults to Kubernetes Service. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: |- The port on the Destination which receives traffic. All ports on the Destination will be selected if left empty. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object selector: description: The selector used to match destination objects by their metadata properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: object type: array config: description: The details of the WAF policy to apply to the selected routes. oneOf: - not: anyOf: - required: - coreRuleSetSettingsString - required: - coreRuleSetSettingsPath - required: - coreRuleSetSettingsString - required: - coreRuleSetSettingsPath properties: auditLogging: description: This instructs the filter what to do with the transaction's audit log. properties: action: enum: - NEVER - RELEVANT_ONLY - ALWAYS type: string location: enum: - FILTER_STATE - DYNAMIC_METADATA type: string type: object coreRuleSetSettingsPath: description: The path to the core rule set settings to use type: string coreRuleSetSettingsString: description: An inline string of the core rule set settings type: string customInterventionMessage: description: Custom message to display when an intervention occurs type: string customRuleSets: description: Overwrite the global rules on this route items: properties: directory: description: |- A directory to include. all *.conf files in this directory will be included. sub directories will NOT be checked. type: string files: description: Array of files to include items: type: string type: array ruleStr: description: String of rules which are added directly type: string type: object type: array disableCoreRuleSet: description: Disable the OWASP core rule set from being applied type: boolean priority: description: |- Optional field that is used to determine the order in which rule sets between policies are applied. Modsec rulesets for each policy is applied from the lowest numerical priority to the highest numerical priority if it is provided. Use this field for all WAF policies applicable to a route or not at all. Defaults to nil if not provided, and WAF policies will be applied in order of ascending creation time. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#u-int32-value). maximum: 4294967295 minimum: 0 nullable: true type: integer requestHeadersOnly: description: |- If set, the body will not be buffered and fed to ModSecurity. Only the headers will. This can help improve performance. type: boolean responseHeadersOnly: type: boolean type: object type: object status: properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object numSelectedRoutes: description: The number of routes selected by the policy. maximum: 4294967295 minimum: 0 type: integer type: object type: object served: true storage: true subresources: status: {} ---