...
| Code Block | ||||
|---|---|---|---|---|
| ||||
rules:
- to:
- operation:
methods: ["GET", "POST", "PUT", "DELETE"]
paths: ["/a1-policy*"]
when:
- key: request.auth.claims[role]
values: ["pms_admin"]
- to:
- operation:
methods: ["GET"]
paths: ["/a1-policy*"]
when:
- key: request.auth.claims[role]
values: ["pms_viewer"] |
Further details on authorization policies are avaiable here
| Anchor | ||||
|---|---|---|---|---|
|
Istio network policy is enforced at the pod level (in the Envoy proxy), in user-space, (layer 7), as opposed to Kubernetes network policy, which is in kernel-space (layer 4), and is enforced on the host. By operating at application layer, Istio has a richer set of attributes to express and enforce policy in the protocols it understands (e.g. HTTP headers).
...