How to map a kube-secret as value for istio key: request.headers in 'when' condition?

user_11521170 0
Viewed 56

In the below Istio authentication policy, under "when", the token (617D8667CPPP3B3F0EA05814B7D9) is hard-coded which cannot be rotated. Is there any way we can map the value of a kubesecret instead. So that we can rotate the token?

kind: AuthorizationPolicy
metadata:
  name: allow-requests
spec:
  selector:
    matchLabels:
      run: test
  action: ALLOW
  rules:
    - to:
        - operation:
            methods: ["GET","POST"]
      when:
      - key: request.headers[x-token]
        values: ["617D8667CPPP3B3F0EA05814B7D9"]
istio
2 Answers

Thanks, guys. I used a cron job to recreate the authentication policy every few hours by rotating the when value. Stored the value in a secret where users can read the token from with appropriate RBAC control.

user_115211700

I agree with that what @suren mentioned in comments, it's rather not possible to do in authorization policy. At least I couldn't find any example with that.

There are conditions for authorization policy when value.

And the values type is string[].

Field   Type      Description     Required                                     

values  string[]  A list of allowed values for the attribute. Note: at least one of values or not_values must be set. No

so I would say it's either one or multiple hard-coded string values.

user_119777600
Related