Table of contents

Table of contents

1. Airlock Secure Access Hub

2. About this document

2.1. How information is structured in this manual

2.2. Leveled prerequisites

2.3. Warning tiers in this document

2.4. Additional panel types

2.5. Advanced Lucene searches within this online help

3. About Airlock Microgateway

3.1. Airlock Microgateway license editions and support

3.2. Release and support information

3.3. Incubating features in Airlock Microgateway

3.4. Online labs

4. How to establish security controls

4.1. Empower your counterpart

4.1.1. Blueprints

4.1.2. Templates

4.1.3. Enforce policies

4.1.4. Assess the active configuration

4.1.5. Monitor and analyze

4.1.6. Education and guidelines

4.1.7. Establish GitOps principles

5. System architectures

5.1. Architecture of sidecar-based Airlock Microgateway deployments

5.1.1. Sidecar-based Kubernetes cluster without a service mesh

5.1.2. Sidecar-based Kubernetes cluster with an Istio service mesh

5.1.3. Sidecar-based Kubernetes cluster with Cilium

5.1.4. Sidecar-based installation mode types

5.2. Architecture of K8s Gateway API-based sidecarless Airlock Microgateway deployments

5.2.1. Sidecarless Kubernetes cluster without a service mesh

5.2.2. Sidecar-based Installation mode types

6. Getting started – installation and follow-ups

7. Requirements and limitations

8. Container image repositories and registries

8.1. Verify the image signature

8.2. Using a custom image registry

9. Installation, upgrade, and uninstallation instructions

9.1. Sidecar-based Microgateway installation, upgrade, and uninstallation instructions

9.1.1. Installation in Kubernetes

9.1.2. Installation in OpenShift

9.1.3. Installation in Kubernetes or OpenShift with Istio Service Mesh

9.1.4. Installation in Kubernetes cluster with Cilium

9.1.5. Uninstallation and upgrade instructions

9.2. Sidecarless K8s Gateway API-based Microgateway installation, upgrade, and uninstallation instructions

9.2.1. Installation in Kubernetes

9.2.2. Uninstallation and upgrade instructions

10. Configuration

10.1. Sidecar-based Microgateway configuration

10.1.1. Microgateway Operator

10.1.2. Microgateway CNI

10.1.3. Microgateway Engine sidecar injection and configuration

10.1.4. Microgateway Session Agent

10.1.5. Labels and annotations for Airlock Microgateway in sidecar-based data plane mode

10.2. Sidecarless K8s Gateway API-based Microgateway configuration

10.2.1. Airlock Microgateway configuration with K8s Gateway API

10.3. Custom Resource Definitions

10.3.1. CR AccessControl

10.3.2. CR ContentSecurity

10.3.3. CR ContentSecurityPolicy

10.3.4. CR DenyRules

10.3.5. CR EnvoyCluster

10.3.6. CR EnvoyConfiguration

10.3.7. CR EnvoyHTTPFilter

10.3.8. CR GraphQL

10.3.9. CR HeaderRewrites

10.3.10. CR IdentityPropagation

10.3.11. CR JWKS

10.3.12. CR Limits

10.3.13. CR OIDCProvider

10.3.14. CR OIDCRelyingParty

10.3.15. CR OpenAPI

10.3.16. CR Parser

10.3.17. CR RedisProvider

10.3.18. CR SessionHandling

10.3.19. CR SidecarGateway

10.3.20. CR Telemetry

11.1. Configuration and monitoring of licenses

11.1.1. Monitor the licensed throughput

11.2. Reducing false-positive blocks

11.3. Logging configuration and output formatting

11.4. Grafana dashboards for metric and log visualization

11.5. Using Microgateway Prometheus metrics

12.1. Completion, validation and tooltips in Visual Studio Code

13. Troubleshooting and support

13.1. Pod is not ready

13.2. List Pods with SidecarGateway selectors

13.3. Listing the SidecarGateway status

13.4. Envoy Admininistration interface

13.5. Inspect the Envoy configuration

13.6. Several SidecarGateway CRs point to the same Pod

13.7. Troubleshooting Microgateway CNI Helm test

13.8. Troubleshooting Microgateway Operator Helm test

13.9. Troubleshooting for network routing issues in the application pod

13.9.1. Network Validator sanity check

13.10. HTTP protocol selection

13.11. Debugging with additional Envoy filters

14. Reference documentation

14.1. Airlock Microgateway API reference documentation

14.2. Available metrics in Prometheus format

14.3. Access log field reference

14.4. License texts