7672532b05
When the protocol is http-like, and an intention has a peered source
then the normal RBAC mTLS SAN field check is replaces with a joint combo
of:
mTLS SAN field must be the service's local mesh gateway leaf cert
AND
the first XFCC header (from the MGW) must have a URI field that matches the original intention source
Also:
- Update the regex program limit to be much higher than the teeny
defaults, since the RBAC regex constructions are more complicated now.
- Fix a few stray panics in xds generation.
203 lines
6.5 KiB
Plaintext
203 lines
6.5 KiB
Plaintext
{
|
|
"admin": {
|
|
"access_log_path": "/some/path/access.log",
|
|
"address": {
|
|
"socket_address": {
|
|
"address": "127.0.0.1",
|
|
"port_value": 19000
|
|
}
|
|
}
|
|
},
|
|
"node": {
|
|
"cluster": "test",
|
|
"id": "test-proxy",
|
|
"metadata": {
|
|
"namespace": "default",
|
|
"partition": "default"
|
|
}
|
|
},
|
|
"layered_runtime": {
|
|
"layers": [
|
|
{
|
|
"name": "base",
|
|
"static_layer": {
|
|
"re2.max_program_size.error_level": 1048576
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"static_resources": {
|
|
"clusters": [
|
|
{
|
|
"name": "local_agent",
|
|
"ignore_health_on_host_removal": false,
|
|
"connect_timeout": "1s",
|
|
"type": "STATIC",
|
|
"http2_protocol_options": {},
|
|
"loadAssignment": {
|
|
"clusterName": "local_agent",
|
|
"endpoints": [
|
|
{
|
|
"lbEndpoints": [
|
|
{
|
|
"endpoint": {
|
|
"address": {
|
|
"socket_address": {
|
|
"address": "127.0.0.1",
|
|
"port_value": 8502
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"stats_config": {
|
|
"stats_tags": [
|
|
{
|
|
"regex": "^cluster\\.(?:passthrough~)?((?:([^.]+)~)?(?:[^.]+\\.)?[^.]+\\.[^.]+\\.(?:[^.]+\\.)?[^.]+\\.[^.]+\\.[^.]+\\.consul\\.)",
|
|
"tag_name": "consul.destination.custom_hash"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.(?:passthrough~)?((?:[^.]+~)?(?:([^.]+)\\.)?[^.]+\\.[^.]+\\.(?:[^.]+\\.)?[^.]+\\.[^.]+\\.[^.]+\\.consul\\.)",
|
|
"tag_name": "consul.destination.service_subset"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.(?:passthrough~)?((?:[^.]+~)?(?:[^.]+\\.)?([^.]+)\\.[^.]+\\.(?:[^.]+\\.)?[^.]+\\.[^.]+\\.[^.]+\\.consul\\.)",
|
|
"tag_name": "consul.destination.service"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.(?:passthrough~)?((?:[^.]+~)?(?:[^.]+\\.)?[^.]+\\.([^.]+)\\.(?:[^.]+\\.)?[^.]+\\.[^.]+\\.[^.]+\\.consul\\.)",
|
|
"tag_name": "consul.destination.namespace"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.(?:passthrough~)?((?:[^.]+~)?(?:[^.]+\\.)?[^.]+\\.[^.]+\\.(?:([^.]+)\\.)?[^.]+\\.[^.]+\\.[^.]+\\.consul\\.)",
|
|
"tag_name": "consul.destination.partition"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.(?:passthrough~)?((?:[^.]+~)?(?:[^.]+\\.)?[^.]+\\.[^.]+\\.(?:[^.]+\\.)?([^.]+)\\.[^.]+\\.[^.]+\\.consul\\.)",
|
|
"tag_name": "consul.destination.datacenter"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.(?:passthrough~)?((?:[^.]+~)?(?:[^.]+\\.)?[^.]+\\.[^.]+\\.(?:[^.]+\\.)?[^.]+\\.([^.]+)\\.[^.]+\\.consul\\.)",
|
|
"tag_name": "consul.destination.routing_type"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.(?:passthrough~)?((?:[^.]+~)?(?:[^.]+\\.)?[^.]+\\.[^.]+\\.(?:[^.]+\\.)?[^.]+\\.[^.]+\\.([^.]+)\\.consul\\.)",
|
|
"tag_name": "consul.destination.trust_domain"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.(?:passthrough~)?(((?:[^.]+~)?(?:[^.]+\\.)?[^.]+\\.[^.]+\\.(?:[^.]+\\.)?[^.]+)\\.[^.]+\\.[^.]+\\.consul\\.)",
|
|
"tag_name": "consul.destination.target"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.(?:passthrough~)?(((?:[^.]+~)?(?:[^.]+\\.)?[^.]+\\.[^.]+\\.(?:[^.]+\\.)?[^.]+\\.[^.]+\\.[^.]+)\\.consul\\.)",
|
|
"tag_name": "consul.destination.full_target"
|
|
},
|
|
{
|
|
"regex": "^(?:tcp|http)\\.upstream\\.(([^.]+)(?:\\.[^.]+)?(?:\\.[^.]+)?\\.[^.]+\\.)",
|
|
"tag_name": "consul.upstream.service"
|
|
},
|
|
{
|
|
"regex": "^(?:tcp|http)\\.upstream\\.([^.]+(?:\\.[^.]+)?(?:\\.[^.]+)?\\.([^.]+)\\.)",
|
|
"tag_name": "consul.upstream.datacenter"
|
|
},
|
|
{
|
|
"regex": "^(?:tcp|http)\\.upstream\\.([^.]+(?:\\.([^.]+))?(?:\\.[^.]+)?\\.[^.]+\\.)",
|
|
"tag_name": "consul.upstream.namespace"
|
|
},
|
|
{
|
|
"regex": "^(?:tcp|http)\\.upstream\\.([^.]+(?:\\.[^.]+)?(?:\\.([^.]+))?\\.[^.]+\\.)",
|
|
"tag_name": "consul.upstream.partition"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.((?:([^.]+)~)?(?:[^.]+\\.)?[^.]+\\.[^.]+\\.(?:[^.]+\\.)?[^.]+\\.[^.]+\\.[^.]+\\.consul\\.)",
|
|
"tag_name": "consul.custom_hash"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.((?:[^.]+~)?(?:([^.]+)\\.)?[^.]+\\.[^.]+\\.(?:[^.]+\\.)?[^.]+\\.[^.]+\\.[^.]+\\.consul\\.)",
|
|
"tag_name": "consul.service_subset"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.((?:[^.]+~)?(?:[^.]+\\.)?([^.]+)\\.[^.]+\\.(?:[^.]+\\.)?[^.]+\\.[^.]+\\.[^.]+\\.consul\\.)",
|
|
"tag_name": "consul.service"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.((?:[^.]+~)?(?:[^.]+\\.)?[^.]+\\.([^.]+)\\.(?:[^.]+\\.)?[^.]+\\.[^.]+\\.[^.]+\\.consul\\.)",
|
|
"tag_name": "consul.namespace"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.((?:[^.]+~)?(?:[^.]+\\.)?[^.]+\\.[^.]+\\.(?:[^.]+\\.)?([^.]+)\\.[^.]+\\.[^.]+\\.consul\\.)",
|
|
"tag_name": "consul.datacenter"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.((?:[^.]+~)?(?:[^.]+\\.)?[^.]+\\.[^.]+\\.(?:[^.]+\\.)?[^.]+\\.([^.]+)\\.[^.]+\\.consul\\.)",
|
|
"tag_name": "consul.routing_type"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.((?:[^.]+~)?(?:[^.]+\\.)?[^.]+\\.[^.]+\\.(?:[^.]+\\.)?[^.]+\\.[^.]+\\.([^.]+)\\.consul\\.)",
|
|
"tag_name": "consul.trust_domain"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.(((?:[^.]+~)?(?:[^.]+\\.)?[^.]+\\.[^.]+\\.(?:[^.]+\\.)?[^.]+)\\.[^.]+\\.[^.]+\\.consul\\.)",
|
|
"tag_name": "consul.target"
|
|
},
|
|
{
|
|
"regex": "^cluster\\.(((?:[^.]+~)?(?:[^.]+\\.)?[^.]+\\.[^.]+\\.(?:[^.]+\\.)?[^.]+\\.[^.]+\\.[^.]+)\\.consul\\.)",
|
|
"tag_name": "consul.full_target"
|
|
},
|
|
{
|
|
"tag_name": "local_cluster",
|
|
"fixed_value": "test"
|
|
},
|
|
{
|
|
"tag_name": "consul.source.service",
|
|
"fixed_value": "test"
|
|
},
|
|
{
|
|
"tag_name": "consul.source.namespace",
|
|
"fixed_value": "default"
|
|
},
|
|
{
|
|
"tag_name": "consul.source.partition",
|
|
"fixed_value": "default"
|
|
},
|
|
{
|
|
"tag_name": "consul.source.datacenter",
|
|
"fixed_value": "dc1"
|
|
}
|
|
],
|
|
"use_all_default_tags": true
|
|
},
|
|
"dynamic_resources": {
|
|
"lds_config": {
|
|
"ads": {},
|
|
"resource_api_version": "V3"
|
|
},
|
|
"cds_config": {
|
|
"ads": {},
|
|
"resource_api_version": "V3"
|
|
},
|
|
"ads_config": {
|
|
"api_type": "DELTA_GRPC",
|
|
"transport_api_version": "V3",
|
|
"grpc_services": {
|
|
"initial_metadata": [
|
|
{
|
|
"key": "x-consul-token",
|
|
"value": ""
|
|
}
|
|
],
|
|
"envoy_grpc": {
|
|
"cluster_name": "local_agent"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|