AccessControlPolicy

apiVersion: microgateway.airlock.com/v1alpha1
kind: AccessControlPolicy
metadata:
  name: access-control-policy-example
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: backend
  policies:
    # Requests to /secure need to be authorized using the certificate presented by the client.
    - requestConditions:
        path:
          matcher:
            prefix: /secure
      authorization:
        # All following conditions must be satisfied for authorization.
        requireAll:
          - clientCertificate:
              # Client certificate must match one of the specified hashes.
              hash:
                in:
                  values:
                    - "69e4caf01b2b3490cd938b053274a2c9001c45c21b2cb58e3612c550568a42ca"
                    - "df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a"
          - clientCertificate:
              # Client certificate must contain the expected organization in the subject.
              subject:
                field: Organization
                value:
                  matcher:
                    exact: "Company"
          - clientCertificate:
              # Client certificate must include an email SAN ending with the company domain.
              san:
                type: Email
                value:
                  matcher:
                    suffix: "@company.com"
    # All other requests are denied by default.
    - authorization:
        deny: {}

apiVersion: microgateway.airlock.com/v1alpha1
kind: AccessControlPolicy
metadata:
  name: access-control-policy-example
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: backend
  policies:
    - requestConditions:
        path:
          matcher:
            prefix: /api
      authorization:
        requireAll:
          - jwt:
              claim:
                name: sub
                value:
                  matcher:
                    prefix: "/group/a/"
        authentication:
          jwt:
            jwtRef:
              name: test-jwt
    - authorization:
        deny: {}

apiVersion: microgateway.airlock.com/v1alpha1
kind: AccessControlPolicy
metadata:
  name: access-control-policy-example
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: backend
  policies:
    # Deny access from 192.168.0.0/16
    - requestConditions:
        invert: true
        remoteIP:
          cidrRanges:
            - 192.168.0.0/16
      authorization:
        deny: {}
    # Grant access to /partner/ based on the exchanged token with claim 'group=partner'
    - requestConditions:
        path:
          matcher:
            regex:
              ^/partner/
      authorization:
        requireAll:
          - tokenExchange:
              claim:
                name: group
                value:
                  matcher:
                    exact: partner
        authentication:
          oidc:
            oidcRelyingPartyRef:
              name: test-2
      tokenExchange:
        actions:
          - tokenExchangeRef:
              name: token-exchange-example
    # Grant access to /admin/ based on the OIDC ID token and OIDC ACR (to enforce 2FA)
    - requestConditions:
        path:
          matcher:
            regex:
              ^/admin/
      authorization:
        ensured:
          oidc:
            acrInValues:
              - mfa
              - mfa:otp
        requireAll:
          - oidc:
              claim:
                name: name
                value:
                  matcher:
                    exact: admin
          - oidc:
              claim:
                name: email
                value:
                  matcher:
                    suffix: "@company.com"
        authentication:
          oidc:
            oidcRelyingPartyRef:
              name: test-2
            introspection:
              # configure token introspection with a probability of `0.1%` for the
              # 'random' strategy, i.e., for every request there is a
              # 1 in 1000 chance that the request is being introspected
              strategy:
                random:
                  probability: "0.1%"
            timeouts:
              acrValues: 15m
      identityPropagation:
        actions:
          - identityPropagationRef:
              name: identity-propagation-example
        onFailure: Pass
    - authorization:
        deny: {}