Add istio meshConfig, internal auth gateway and token-vendor auth httproutes#687
Conversation
| spec: | ||
| containers: | ||
| - name: nginx | ||
| image: nginxinc/nginx-unprivileged:alpine |
There was a problem hiding this comment.
Will we be allowed to use open-source (Apache 2 license) NGINX image here for CRC?
There was a problem hiding this comment.
Not authoritative, but CRC itself is apache-2.0 so I would assume yes.
There was a problem hiding this comment.
i have updated to use nginxinc/nginx-unprivileged:1.30.1-alpine
There was a problem hiding this comment.
Yes, the license is fine. We can also consider a simple go-lang server if all it needs to do is to reply with OK 200. But that can be a followup.
awhdesmond
requested review from
ensonic,
koonpeng and
liyin00
and removed request for
koonpeng and
liyin00
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: explicit-allow-svc |
There was a problem hiding this comment.
It's may be worth to refactor this service out to its own file.
There was a problem hiding this comment.
Yeah, it appears to be only for testing?
There was a problem hiding this comment.
This service is used as the catch-all service with pathprefix / under the auth gateway. I would assume not all paths require authz, so this catch-all service will respond with HTTP 200 for all those services.
There was a problem hiding this comment.
Yes, we need to support routes that don't require auth.
There was a problem hiding this comment.
Can we try this:
filters:
- type: RequestRedirect
requestRedirect:
statusCode: 200
There was a problem hiding this comment.
will result in:
The HTTPRoute "crc-auth-catchall" is invalid:
* spec.rules[0].filters[0].requestRedirect.statusCode: Unsupported value: 200: supported values: "301", "302"
* <nil>: Invalid value: null: some validation rules were not checked because the object was invalid; correct the existing errors to complete validation
ensonic
left a comment
ensonic
left a comment
There was a problem hiding this comment.
Awesome, lets iterate in followups to finetune it.
3 participants
crc-auth-gatewaycrc-auth-gatewayusing Gateway APIGatewayresource, but only give it an internal clusterIP.AuthorizationPolicyoncrc-gatewayto usecrc-auth-gatewayextension provider for external HTTP authorization.public-key-access-authandpublic-key-access-auth, targettingcrc-auth-gatewaycatch-allroute forcrc-auth-gatewayas not all paths require authz. (It can be switched to explicit-deny)