Skip to content

Add trustDomains and notTrustDomains to AuthzPolicy source #3665

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
istio-testing merged 2 commits into from
Mar 17, 2026
Merged

Add trustDomains and notTrustDomains to AuthzPolicy source #3665

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
25ec80e
Add trustDomains and notTrustDomains to AuthzPolicy source
ymesika Mar 5, 2026
a23a5bc
Release note and lint fix
ymesika Mar 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions kubernetes/customresourcedefinitions.gen.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 8 additions & 0 deletions releasenotes/notes/add-trust-domains-to-authz-policy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
apiVersion: release-notes/v2
kind: feature
area: security

releaseNotes:
- |
**Added** `trustDomains` and `notTrustDomains` fields to the `Source` in `AuthorizationPolicy`,
allowing users to match or exclude requests based on the trust domain derived from the peer certificate.
37 changes: 33 additions & 4 deletions security/v1beta1/authorization_policy.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

22 changes: 22 additions & 0 deletions security/v1beta1/authorization_policy.pb.html
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

15 changes: 15 additions & 0 deletions security/v1beta1/authorization_policy.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -506,6 +506,21 @@ message Source {

// Optional. A list of negative match of remote IP blocks.
repeated string not_remote_ip_blocks = 10;

// Optional. A list of trust domains derived from the peer certificate.
// Can be exact, prefix, suffix and presence.
Copy link
Contributor

@keithmattix keithmattix Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Based on the example, it seems like it's more global based with * vs an envoy string matcher type of API. Does it only match whole components of a SPIFFE URI? Can you do, eg "fo*-bar"?

Copy link
Member Author

@ymesika ymesika Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The matching semantics are clearly documented above. The trustdomains field supports the same pattern matching as all other string fields in the rule (suffix, prefix, exact or presence).
So no, you cannot do fo*-bar. But that's something to keep in mind to validate in the impl.

Copy link
Contributor

@keithmattix keithmattix Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack, thanks for the pointer

// This field requires mTLS enabled and is the same as the `source.trustDomain` attribute.
//
// If not set, any trust domain is allowed.
//
// +cue-gen:AuthorizationPolicy:releaseChannel:extended
repeated string trust_domains = 13;

// Optional. A list of negative match of trust domains.
Copy link
Contributor

@keithmattix keithmattix Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What are the semantics of notTrustDomains is set but the connection doesn't have mTLS enabled?

Copy link
Member Author

@ymesika ymesika Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's the same trap as notPrinicipals/notNamespaces.
For those, in positive values we have a comment that it requires mTLS and I also added it (https://github.com/ymesika/api/blob/a23a5bc7d3b28a0ca57056462867817b380479c7/security/v1beta1/authorization_policy.proto#L512) but we lack this comment on the negative ones.
I tried to be consistent with them.

Copy link
Member Author

@ymesika ymesika Mar 17, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BTW, for all those negative forms when mTLS is absent, not_* will trivially pass (empty string doesn't match any specified value), potentially allowing unauthenticated traffic through.

// Can be exact, prefix, suffix and presence.
//
// +cue-gen:AuthorizationPolicy:releaseChannel:extended
repeated string not_trust_domains = 14;
}

// Operation specifies the operations of a request. Fields in the operation are
Expand Down
5 changes: 5 additions & 0 deletions tests/testdata/authz-valid.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@ spec:
notNamespaces: ["not-ns", "not-ns-prefix-*", "*-not-ns-suffix", "*"]
notIpBlocks: ["9.0.0.1", "9.2.0.0/16"]
notRemoteIpBlocks: ["9.0.0.1", "9.2.0.0/16"]
trustDomains: ["cluster.local", "cluster-prefix-*", "*-suffix-cluster", "*"]
notTrustDomains: ["not-cluster.local", "not-cluster-prefix-*", "*-not-suffix-cluster", "*"]
to:
- operation:
methods: ["method", "method-prefix-*", "*-suffix-method", "*"]
Expand Down Expand Up @@ -69,6 +71,9 @@ spec:
- key: "connection.sni"
values: ["exact.com", "*.suffix.com", "prefix.*", "*"]
notValues: ["not-exact.com", "*.not-suffix.com", "not-prefix.*", "*"]
- key: "source.trustDomain"
values: ["cluster.local", "cluster-prefix-*", "*-suffix-cluster", "*"]
notValues: ["not-cluster.local", "not-cluster-prefix-*", "*-not-suffix-cluster", "*"]
- key: "experimental.envoy.filters.a.b[c]"
values: ["exact", "prefix-*", "*-suffix", "*"]
notValues: ["not-exact", "not-prefix-*", "*-not-suffix", "*"]
Expand Down