add userguide for xdp_auth #100
Conversation
Signed-off-by: weli-l <[email protected]>
✅ Deploy Preview for kmesh-net ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
| apiVersion: security.istio.io/v1beta1 | ||
| kind: AuthorizationPolicy | ||
| metadata: | ||
| name: test-policy |
|
|
||
| #### Configure deny authorization policy | ||
|
|
||
| ##### Configure deny port authorization policy |
There was a problem hiding this comment.
| ##### Configure deny port authorization policy | |
| ##### Configure destination port deny authorization policy |
| root@master:~/kmesh# kubectl logs -f kmesh-vlxhd -n kmesh-system | ||
| ... ... | ||
| time="2024-12-25T15:23:12+08:00" level=info msg="[AUTH] INFO: port 8080 in destination_ports, matched" subsys=ebpf | ||
| time="2024-12-25T15:23:12+08:00" level=info msg="[AUTH] INFO: rule matched, action: DENY" subsys=ebpf |
There was a problem hiding this comment.
I may miss the code implement, but i think this level should be debug, otherwise too spammy
| time="2024-12-25T15:23:12+08:00" level=info msg="[AUTH] INFO: rule matched, action: DENY" subsys=ebpf | ||
| ``` | ||
|
|
||
| ##### Configure deny source ip authorization policy |
There was a problem hiding this comment.
| ##### Configure deny source ip authorization policy | |
| ##### Configure source ip deny authorization policy |
| rules: | ||
| - when: | ||
| - key: destination.ip | ||
| values: ["10.244.0.36"] |
There was a problem hiding this comment.
This is meaningless, i guess. This is equal to deny all
There was a problem hiding this comment.
This is meaningless, i guess. This is equal to deny all
I deployed two fortio server pod, and this policy only deny 10.244.0.36
There was a problem hiding this comment.
I mean you can setup some allow rules, that only allow some kind of src ip. That can be done later
Signed-off-by: weli-l <[email protected]>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: hzxuzhonghu The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
No description provided.