AccessControlPolicy

microgateway.airlock.com/v1alpha1

AccessControlPolicy is a Direct Attached Policy for the Kubernetes Gateway API.
It defines a rule-based policy for enforcing authentication, authorization and performing identity propagation.

apiVersion: microgateway.airlock.com/v1alpha1
kind: AccessControlPolicy
metadata:
  name: access-control-policy-example
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: backend
  policies:
    # Requests to /secure need to be authorized using the certificate presented by the client.
    - requestConditions:
        path:
          matcher:
            prefix: /secure
      authorization:
        # All following conditions must be satisfied for authorization.
        requireAll:
          - clientCertificate:
              # Client certificate must match one of the specified hashes.
              hash:
                in:
                  values:
                    - "69e4caf01b2b3490cd938b053274a2c9001c45c21b2cb58e3612c550568a42ca"
                    - "df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a"
          - clientCertificate:
              # Client certificate must contain the expected organization in the subject.
              subject:
                field: Organization
                value:
                  matcher:
                    exact: "Company"
          - clientCertificate:
              # Client certificate must include an email SAN ending with the company domain.
              san:
                type: Email
                value:
                  matcher:
                    suffix: "@company.com"
    # All other requests are denied by default.
    - authorization:
        deny: {}

apiVersion: microgateway.airlock.com/v1alpha1
kind: AccessControlPolicy
metadata:
  name: access-control-policy-example
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: backend
  policies:
    - requestConditions:
        path:
          matcher:
            prefix: /api
      authorization:
        requireAll:
          - jwt:
              claim:
                name: sub
                value:
                  matcher:
                    prefix: "/group/a/"
        authentication:
          jwt:
            jwtRef:
              name: test-jwt
    - authorization:
        deny: {}

apiVersion: microgateway.airlock.com/v1alpha1
kind: AccessControlPolicy
metadata:
  name: access-control-policy-example
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: backend
  policies:
    # Deny access from 192.168.0.0/16
    - requestConditions:
        invert: true
        remoteIP:
          cidrRanges:
            - 192.168.0.0/16
      authorization:
        deny: {}
    # Grant access to /partner/ based on the exchanged token with claim 'group=partner'
    - requestConditions:
        path:
          matcher:
            regex:
              ^/partner/
      authorization:
        requireAll:
          - tokenExchange:
              claim:
                name: group
                value:
                  matcher:
                    exact: partner
        authentication:
          oidc:
            oidcRelyingPartyRef:
              name: test-2
      tokenExchange:
        actions:
          - tokenExchangeRef:
              name: token-exchange-example
    # Grant access to /admin/ based on the OIDC ID token
    - requestConditions:
        path:
          matcher:
            regex:
              ^/admin/
      authorization:
        requireAll:
          - oidc:
              claim:
                name: name
                value:
                  matcher:
                    exact: admin
          - oidc:
              claim:
                name: email
                value:
                  matcher:
                    suffix: "@company.com"
        authentication:
          oidc:
            oidcRelyingPartyRef:
              name: test-2
            introspection:
              # configure token introspection with a probability of `0.1%` for the
              # 'random' strategy, i.e., for every request there is a
              # 1 in 1000 chance that the request is being introspected
              strategy:
                random:
                  probability: "0.1%"
      identityPropagation:
        actions:
          - identityPropagationRef:
              name: identity-propagation-example
        onFailure: Pass
    - authorization:
        deny: {}

AccessControlPolicy

Field	Description	Type	Required
metadata	defines the resource’s metadata	ObjectMeta	yes
spec	defines the desired access control configuration.	object	yes
status	describes the current status of the AccessControlPolicy.	PolicyStatus	no

AccessControlPolicy.spec

Field	Description	Type	Required	Default	Allowed Values
policies	configures access control policies. The first matching policy (from top to bottom) applies.	object[]	yes
targetRefs	are the resources this policy is being attached to. Referenced resources must be in the same namespace as the policy. Support: HTTPRoute.	LocalPolicyTargetReference[]	yes

AccessControlPolicy.spec.policies[]

Field	Description	Type	Required
authorization	configures how requests are authorized. An empty object value {} disables authorization.	object	yes
identityPropagation	configures how the authenticated user’s identity is communicated to the protected application.	object	no
requestConditions	defines additional request properties which must all be matched in order for this policy to apply. A policy without request conditions will always match. WARNING: There is currently a limitation that if `authentication.oidc` is configured for this policy, you must ensure that the request condition also matches logout requests and callback redirects from the OIDC Provider as configured in the OIDCRelyingParty (`pathMapping.logoutPath` / `pathMapping.redirectPath`).	object	no
tokenExchange	configures how downstream authentication tokens (e.g. JWT or OIDC Access Token) are exchanged with an OAuth2 Token Exchange Server.	object	no

AccessControlPolicy.spec.policies[].authorization

Field	Description	Type	Required	Allowed Values
authentication	specifies that clients need to be authenticated with the provided method.	object	no	`jwt{}`, `oidc{}`
deny	specifies to deny access for all requests matching this policy.	object	no	`{}`
requireAll	specifies conditions which must all be satisfied for the request to be authorized.	object[]	no
requireAny	specifies conditions of which at least one must be satisfied for the request to be authorized.	object[]	no

AccessControlPolicy.spec.policies[].authorization.authentication

Field	Description	Type	Required	Default	Allowed Values
jwt	configures client authentication using JWT.	object	no
oidc	configures client authentication using OpenID Connect.	object	no

AccessControlPolicy.spec.policies[].authorization.authentication.jwt

Field	Description	Type	Required	Default	Allowed Values
jwtRef	selects the JWT configuration to apply.	object	yes

AccessControlPolicy.spec.policies[].authorization.authentication.jwt.jwtRef

Field	Description	Type	Required	Default	Allowed Values
name	of the resource	string	yes

AccessControlPolicy.spec.policies[].authorization.authentication.oidc

Field	Description	Type	Required	Default	Allowed Values
introspection	configures how token introspection is performed. An empty object value {} defaults to the always strategy.	object	no
oidcRelyingPartyRef	configures how the Airlock Microgateway Engine interacts with the OpenID provider.	object	yes

AccessControlPolicy.spec.policies[].authorization.authentication.oidc.introspection

Field	Description	Type	Required	Default	Allowed Values
strategy	defines the behavior for token introspection.	object	no	`always{...}`	`always{}`, `periodic{}`, `random{}`

AccessControlPolicy.spec.policies[].authorization.authentication.oidc.introspection.strategy

Field	Description	Type	Required
always	strategy defines a strategy for checking every request.	object	no
periodic	strategy defines a time-based strategy for checking requests. Introspection is non-blocking, concurrent requests proceed without delay.	object	no
random	strategy defines a probabilistic strategy for checking the `x-th` request. Introspection is non-blocking, concurrent requests proceed without delay.	object	no

AccessControlPolicy.spec.policies[].authorization.authentication.oidc.introspection.strategy.always

Field	Description	Type	Required	Default	Allowed Values
onError	specifies the behavior for a request if the token introspection returns an error, e.g., timeouts or 5xx errors. Block: The current in-flight request is blocked. InvalidateToken: Behaves as if the token introspection had returned `false`. This results in an invalidation of the current and requesting of a new token. Pass: Behaves as if the token introspection had returned `true`.	enum	no	`Block`	`Block`, `InvalidateToken`, `Pass`

AccessControlPolicy.spec.policies[].authorization.authentication.oidc.introspection.strategy.periodic

Field	Description	Type	Required	Default	Allowed Values
onError	specifies the behavior for a request if the token introspection returns an error, e.g., timeouts or 5xx errors. InvalidateToken: Behaves as if the token introspection had returned `false`. This results in an invalidation of the current and requesting of a new token. Pass: Behaves as if the token introspection had returned `true`.	enum	no	`InvalidateToken`	`InvalidateToken`, `Pass`
period	specifies the minimum time interval between token introspections for requests part of the same session. Once the interval has elapsed, introspection will be performed for the next request in the session. Must be >= ‘1s’.	string (duration)	yes		See link

AccessControlPolicy.spec.policies[].authorization.authentication.oidc.introspection.strategy.random

Field	Description	Type	Required	Default	Allowed Values
onError	specifies the behavior for a request if the token introspection returns an error, e.g., timeouts or 5xx errors. InvalidateToken: Behaves as if the token introspection had returned `false`. This results in an invalidation of the current and requesting of a new token. Pass: Behaves as if the token introspection had returned `true`.	enum	no	`InvalidateToken`	`InvalidateToken`, `Pass`
probability	specifies the probability in % with which a request is selected to be introspected. A valid value for probability must be from the range: [`0.01%`,`99.99%`]. To introspect the token on every request the always strategy must be used.	string	yes

AccessControlPolicy.spec.policies[].authorization.authentication.oidc.oidcRelyingPartyRef

Field	Description	Type	Required	Default	Allowed Values
name	of the resource	string	yes

AccessControlPolicy.spec.policies[].authorization.requireAll[]

Field	Description	Type	Required	Allowed Values
clientCertificate	specifies a condition on the presented client certificate. If no client certificate is presented, the condition is never satisfied.	object	no	`hash{}`, `issuer{}`, `san{}`, `subject{}`
jwt	specifies a condition on the JWT.	object	no
oidc	specifies a condition on the result of an OpenID Connect flow.	object	no
tokenExchange	specifies a condition on the exchanged token.	object	no

AccessControlPolicy.spec.policies[].authorization.requireAll[].clientCertificate

Field	Description	Type	Required
hash	specifies a condition on the SHA256 hash/fingerprint of the DER encoded presented client certificate.	object	no
issuer	specifies a condition on the issuer fields of the presented client certificate. Note: For security reasons, only client certificates passing TLS validation can satisfy this condition.	object	no
san	specifies a condition on the subject alternative names of the presented client certificate. Note: For security reasons, only client certificates passing TLS validation can satisfy this condition.	object	no
subject	specifies a condition on the subject fields of the presented client certificate. Note: For security reasons, only client certificates passing TLS validation can satisfy this condition.	object	no

AccessControlPolicy.spec.policies[].authorization.requireAll[].clientCertificate.hash

Field	Description	Type	Required	Default	Allowed Values
in	specifies that the hash must match one of these values.	object	yes		`values{}`, `valuesFrom{}`

AccessControlPolicy.spec.policies[].authorization.requireAll[].clientCertificate.hash.in

Field	Description	Type	Required	Default	Allowed Values
values	is a list of hex encoded SHA256 hashes (e.g., df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a) or fingerprints (e.g., DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A).	string[]	no
valuesFrom	selects the source from which to extract the list of hex encoded SHA256 hashes (e.g., df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a) or fingerprints (e.g., DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A).	object	no

AccessControlPolicy.spec.policies[].authorization.requireAll[].clientCertificate.hash.in.valuesFrom

Field	Description	Type	Required	Default	Allowed Values
configMapRef	defines the reference to a configmap containing a list of hex-encoded SHA-256 hashes under the key ‘fingerprints.txt’. Each line represents one fingerprint, blank lines and comments beginning with ‘#’ are ignored.	object	yes

AccessControlPolicy.spec.policies[].authorization.requireAll[].clientCertificate.hash.in.valuesFrom.configMapRef

Field	Description	Type	Required	Default	Allowed Values
name	of the resource	string	yes

AccessControlPolicy.spec.policies[].authorization.requireAll[].clientCertificate.issuer

Field	Description	Type	Required	Default	Allowed Values
field	selects the issuer field to match.	enum	yes		`CommonName`, `Country`, `Locality`, `Organization`, `OrganizationalUnit`, `State`
value	which the selected issuer field must match. If the selected field occurs multiple times in the certificate (e.g., multiple organizational units), the value of at least one of them must match.	object	yes

AccessControlPolicy.spec.policies[].authorization.requireAll[].clientCertificate.issuer.value

Field	Description	Type	Required	Default	Allowed Values
matcher		object	yes		`contains{}`, `exact{}`, `prefix{}`, `regex{}`, `suffix{}`

AccessControlPolicy.spec.policies[].authorization.requireAll[].clientCertificate.issuer.value.matcher

Field	Description	Type	Required	Default	Allowed Values
contains	defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
exact	defines an explicit match on the string specified here. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
ignoreCase	indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.	bool	no	`false`	`true`, `false`
prefix	defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
regex	defines a regex match on the regular expression specified here. Google’s RE2 regex engine is used. The regex matches only single-line by default, even with “.*”. To match a multi-line string prepend (?s) to your regex. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
suffix	defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no

AccessControlPolicy.spec.policies[].authorization.requireAll[].clientCertificate.san

Field	Description	Type	Required	Default	Allowed Values
type	selects the SAN type to match.	enum	yes		`DNS`, `Email`, `IPAddress`, `URI`
value	which at least one of the subject alternative names of the specified type must match.	object	yes

AccessControlPolicy.spec.policies[].authorization.requireAll[].clientCertificate.san.value

Field	Description	Type	Required	Default	Allowed Values
matcher		object	yes		`contains{}`, `exact{}`, `prefix{}`, `regex{}`, `suffix{}`

AccessControlPolicy.spec.policies[].authorization.requireAll[].clientCertificate.san.value.matcher

Field	Description	Type	Required	Default	Allowed Values
contains	defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
exact	defines an explicit match on the string specified here. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
ignoreCase	indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.	bool	no	`false`	`true`, `false`
prefix	defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
regex	defines a regex match on the regular expression specified here. Google’s RE2 regex engine is used. The regex matches only single-line by default, even with “.*”. To match a multi-line string prepend (?s) to your regex. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
suffix	defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no

AccessControlPolicy.spec.policies[].authorization.requireAll[].clientCertificate.subject

Field	Description	Type	Required	Default	Allowed Values
field	selects the subject field to match.	enum	yes		`CommonName`, `Country`, `Locality`, `Organization`, `OrganizationalUnit`, `State`
value	which the selected subject field must match. If the selected field occurs multiple times in the certificate (e.g., multiple organizational units), the value of at least one of them must match.	object	yes

AccessControlPolicy.spec.policies[].authorization.requireAll[].clientCertificate.subject.value

Field	Description	Type	Required	Default	Allowed Values
matcher		object	yes		`contains{}`, `exact{}`, `prefix{}`, `regex{}`, `suffix{}`

AccessControlPolicy.spec.policies[].authorization.requireAll[].clientCertificate.subject.value.matcher

Field	Description	Type	Required	Default	Allowed Values
contains	defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
exact	defines an explicit match on the string specified here. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
ignoreCase	indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.	bool	no	`false`	`true`, `false`
prefix	defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
regex	defines a regex match on the regular expression specified here. Google’s RE2 regex engine is used. The regex matches only single-line by default, even with “.*”. To match a multi-line string prepend (?s) to your regex. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
suffix	defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no

AccessControlPolicy.spec.policies[].authorization.requireAll[].jwt

Field	Description	Type	Required	Default	Allowed Values
claim	specifies a condition on a JWT claim.	object	yes

AccessControlPolicy.spec.policies[].authorization.requireAll[].jwt.claim

Field	Description	Type	Required	Default	Allowed Values
name	of the claim.	string	yes
value	of the claim. If not specified, only existence of the claim is checked (any value is allowed). Value matching is only supported if the data type of the claim is either primitive (`number`, `boolean`, `string`) or `array` of primitives. In case of a non-string value, the match will be performed against the stringified value. If the claim has an unsupported data type (e.g. `object` or `null`), its value will never match.	object	no

AccessControlPolicy.spec.policies[].authorization.requireAll[].jwt.claim.value

Field	Description	Type	Required	Default	Allowed Values
matcher		object	yes		`contains{}`, `exact{}`, `prefix{}`, `regex{}`, `suffix{}`

AccessControlPolicy.spec.policies[].authorization.requireAll[].jwt.claim.value.matcher

Field	Description	Type	Required	Default	Allowed Values
contains	defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
exact	defines an explicit match on the string specified here. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
ignoreCase	indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.	bool	no	`false`	`true`, `false`
prefix	defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
regex	defines a regex match on the regular expression specified here. Google’s RE2 regex engine is used. The regex matches only single-line by default, even with “.*”. To match a multi-line string prepend (?s) to your regex. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
suffix	defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no

AccessControlPolicy.spec.policies[].authorization.requireAll[].oidc

Field	Description	Type	Required	Default	Allowed Values
claim	specifies a condition on an ID token claim.	object	yes

AccessControlPolicy.spec.policies[].authorization.requireAll[].oidc.claim

Field	Description	Type	Required	Default	Allowed Values
name	of the claim.	string	yes
value	of the claim. If not specified, only existence of the claim is checked (any value is allowed). Value matching is only supported if the data type of the claim is either primitive (`number`, `boolean`, `string`) or `array` of primitives. In case of a non-string value, the match will be performed against the stringified value. If the claim has an unsupported data type (e.g. `object` or `null`), its value will never match.	object	no

AccessControlPolicy.spec.policies[].authorization.requireAll[].oidc.claim.value

Field	Description	Type	Required	Default	Allowed Values
matcher		object	yes		`contains{}`, `exact{}`, `prefix{}`, `regex{}`, `suffix{}`

AccessControlPolicy.spec.policies[].authorization.requireAll[].oidc.claim.value.matcher

Field	Description	Type	Required	Default	Allowed Values
contains	defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
exact	defines an explicit match on the string specified here. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
ignoreCase	indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.	bool	no	`false`	`true`, `false`
prefix	defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
regex	defines a regex match on the regular expression specified here. Google’s RE2 regex engine is used. The regex matches only single-line by default, even with “.*”. To match a multi-line string prepend (?s) to your regex. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
suffix	defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no

AccessControlPolicy.spec.policies[].authorization.requireAll[].tokenExchange

Field	Description	Type	Required	Default	Allowed Values
claim	specifies a condition on a JWT or ID token claim of on the exchanged token.	object	yes

AccessControlPolicy.spec.policies[].authorization.requireAll[].tokenExchange.claim

Field	Description	Type	Required	Default	Allowed Values
name	of the claim.	string	yes
value	of the claim. If not specified, only existence of the claim is checked (any value is allowed). Value matching is only supported if the data type of the claim is either primitive (`number`, `boolean`, `string`) or `array` of primitives. In case of a non-string value, the match will be performed against the stringified value. If the claim has an unsupported data type (e.g. `object` or `null`), its value will never match.	object	no

AccessControlPolicy.spec.policies[].authorization.requireAll[].tokenExchange.claim.value

Field	Description	Type	Required	Default	Allowed Values
matcher		object	yes		`contains{}`, `exact{}`, `prefix{}`, `regex{}`, `suffix{}`

AccessControlPolicy.spec.policies[].authorization.requireAll[].tokenExchange.claim.value.matcher

Field	Description	Type	Required	Default	Allowed Values
contains	defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
exact	defines an explicit match on the string specified here. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
ignoreCase	indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.	bool	no	`false`	`true`, `false`
prefix	defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
regex	defines a regex match on the regular expression specified here. Google’s RE2 regex engine is used. The regex matches only single-line by default, even with “.*”. To match a multi-line string prepend (?s) to your regex. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
suffix	defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no

AccessControlPolicy.spec.policies[].authorization.requireAny[]

Field	Description	Type	Required	Allowed Values
clientCertificate	specifies a condition on the presented client certificate. If no client certificate is presented, the condition is never satisfied.	object	no	`hash{}`, `issuer{}`, `san{}`, `subject{}`
jwt	specifies a condition on the JWT.	object	no
oidc	specifies a condition on the result of an OpenID Connect flow.	object	no
tokenExchange	specifies a condition on the exchanged token.	object	no

AccessControlPolicy.spec.policies[].authorization.requireAny[].clientCertificate

Field	Description	Type	Required
hash	specifies a condition on the SHA256 hash/fingerprint of the DER encoded presented client certificate.	object	no
issuer	specifies a condition on the issuer fields of the presented client certificate. Note: For security reasons, only client certificates passing TLS validation can satisfy this condition.	object	no
san	specifies a condition on the subject alternative names of the presented client certificate. Note: For security reasons, only client certificates passing TLS validation can satisfy this condition.	object	no
subject	specifies a condition on the subject fields of the presented client certificate. Note: For security reasons, only client certificates passing TLS validation can satisfy this condition.	object	no

AccessControlPolicy.spec.policies[].authorization.requireAny[].clientCertificate.hash

Field	Description	Type	Required	Default	Allowed Values
in	specifies that the hash must match one of these values.	object	yes		`values{}`, `valuesFrom{}`

AccessControlPolicy.spec.policies[].authorization.requireAny[].clientCertificate.hash.in

Field	Description	Type	Required	Default	Allowed Values
values	is a list of hex encoded SHA256 hashes (e.g., df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a) or fingerprints (e.g., DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A).	string[]	no
valuesFrom	selects the source from which to extract the list of hex encoded SHA256 hashes (e.g., df6ff72fe9116521268f6f2dd4966f51df479883fe7037b39f75916ac3049d1a) or fingerprints (e.g., DF:6F:F7:2F:E9:11:65:21:26:8F:6F:2D:D4:96:6F:51:DF:47:98:83:FE:70:37:B3:9F:75:91:6A:C3:04:9D:1A).	object	no

AccessControlPolicy.spec.policies[].authorization.requireAny[].clientCertificate.hash.in.valuesFrom

Field	Description	Type	Required	Default	Allowed Values
configMapRef	defines the reference to a configmap containing a list of hex-encoded SHA-256 hashes under the key ‘fingerprints.txt’. Each line represents one fingerprint, blank lines and comments beginning with ‘#’ are ignored.	object	yes

AccessControlPolicy.spec.policies[].authorization.requireAny[].clientCertificate.hash.in.valuesFrom.configMapRef

Field	Description	Type	Required	Default	Allowed Values
name	of the resource	string	yes

AccessControlPolicy.spec.policies[].authorization.requireAny[].clientCertificate.issuer

Field	Description	Type	Required	Default	Allowed Values
field	selects the issuer field to match.	enum	yes		`CommonName`, `Country`, `Locality`, `Organization`, `OrganizationalUnit`, `State`
value	which the selected issuer field must match. If the selected field occurs multiple times in the certificate (e.g., multiple organizational units), the value of at least one of them must match.	object	yes

AccessControlPolicy.spec.policies[].authorization.requireAny[].clientCertificate.issuer.value

Field	Description	Type	Required	Default	Allowed Values
matcher		object	yes		`contains{}`, `exact{}`, `prefix{}`, `regex{}`, `suffix{}`

AccessControlPolicy.spec.policies[].authorization.requireAny[].clientCertificate.issuer.value.matcher

Field	Description	Type	Required	Default	Allowed Values
contains	defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
exact	defines an explicit match on the string specified here. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
ignoreCase	indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.	bool	no	`false`	`true`, `false`
prefix	defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
regex	defines a regex match on the regular expression specified here. Google’s RE2 regex engine is used. The regex matches only single-line by default, even with “.*”. To match a multi-line string prepend (?s) to your regex. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
suffix	defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no

AccessControlPolicy.spec.policies[].authorization.requireAny[].clientCertificate.san

Field	Description	Type	Required	Default	Allowed Values
type	selects the SAN type to match.	enum	yes		`DNS`, `Email`, `IPAddress`, `URI`
value	which at least one of the subject alternative names of the specified type must match.	object	yes

AccessControlPolicy.spec.policies[].authorization.requireAny[].clientCertificate.san.value

Field	Description	Type	Required	Default	Allowed Values
matcher		object	yes		`contains{}`, `exact{}`, `prefix{}`, `regex{}`, `suffix{}`

AccessControlPolicy.spec.policies[].authorization.requireAny[].clientCertificate.san.value.matcher

Field	Description	Type	Required	Default	Allowed Values
contains	defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
exact	defines an explicit match on the string specified here. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
ignoreCase	indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.	bool	no	`false`	`true`, `false`
prefix	defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
regex	defines a regex match on the regular expression specified here. Google’s RE2 regex engine is used. The regex matches only single-line by default, even with “.*”. To match a multi-line string prepend (?s) to your regex. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
suffix	defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no

AccessControlPolicy.spec.policies[].authorization.requireAny[].clientCertificate.subject

Field	Description	Type	Required	Default	Allowed Values
field	selects the subject field to match.	enum	yes		`CommonName`, `Country`, `Locality`, `Organization`, `OrganizationalUnit`, `State`
value	which the selected subject field must match. If the selected field occurs multiple times in the certificate (e.g., multiple organizational units), the value of at least one of them must match.	object	yes

AccessControlPolicy.spec.policies[].authorization.requireAny[].clientCertificate.subject.value

Field	Description	Type	Required	Default	Allowed Values
matcher		object	yes		`contains{}`, `exact{}`, `prefix{}`, `regex{}`, `suffix{}`

AccessControlPolicy.spec.policies[].authorization.requireAny[].clientCertificate.subject.value.matcher

Field	Description	Type	Required	Default	Allowed Values
contains	defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
exact	defines an explicit match on the string specified here. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
ignoreCase	indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.	bool	no	`false`	`true`, `false`
prefix	defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
regex	defines a regex match on the regular expression specified here. Google’s RE2 regex engine is used. The regex matches only single-line by default, even with “.*”. To match a multi-line string prepend (?s) to your regex. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
suffix	defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no

AccessControlPolicy.spec.policies[].authorization.requireAny[].jwt

Field	Description	Type	Required	Default	Allowed Values
claim	specifies a condition on a JWT claim.	object	yes

AccessControlPolicy.spec.policies[].authorization.requireAny[].jwt.claim

Field	Description	Type	Required	Default	Allowed Values
name	of the claim.	string	yes
value	of the claim. If not specified, only existence of the claim is checked (any value is allowed). Value matching is only supported if the data type of the claim is either primitive (`number`, `boolean`, `string`) or `array` of primitives. In case of a non-string value, the match will be performed against the stringified value. If the claim has an unsupported data type (e.g. `object` or `null`), its value will never match.	object	no

AccessControlPolicy.spec.policies[].authorization.requireAny[].jwt.claim.value

Field	Description	Type	Required	Default	Allowed Values
matcher		object	yes		`contains{}`, `exact{}`, `prefix{}`, `regex{}`, `suffix{}`

AccessControlPolicy.spec.policies[].authorization.requireAny[].jwt.claim.value.matcher

Field	Description	Type	Required	Default	Allowed Values
contains	defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
exact	defines an explicit match on the string specified here. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
ignoreCase	indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.	bool	no	`false`	`true`, `false`
prefix	defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
regex	defines a regex match on the regular expression specified here. Google’s RE2 regex engine is used. The regex matches only single-line by default, even with “.*”. To match a multi-line string prepend (?s) to your regex. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
suffix	defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no

AccessControlPolicy.spec.policies[].authorization.requireAny[].oidc

Field	Description	Type	Required	Default	Allowed Values
claim	specifies a condition on an ID token claim.	object	yes

AccessControlPolicy.spec.policies[].authorization.requireAny[].oidc.claim

Field	Description	Type	Required	Default	Allowed Values
name	of the claim.	string	yes
value	of the claim. If not specified, only existence of the claim is checked (any value is allowed). Value matching is only supported if the data type of the claim is either primitive (`number`, `boolean`, `string`) or `array` of primitives. In case of a non-string value, the match will be performed against the stringified value. If the claim has an unsupported data type (e.g. `object` or `null`), its value will never match.	object	no

AccessControlPolicy.spec.policies[].authorization.requireAny[].oidc.claim.value

Field	Description	Type	Required	Default	Allowed Values
matcher		object	yes		`contains{}`, `exact{}`, `prefix{}`, `regex{}`, `suffix{}`

AccessControlPolicy.spec.policies[].authorization.requireAny[].oidc.claim.value.matcher

Field	Description	Type	Required	Default	Allowed Values
contains	defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
exact	defines an explicit match on the string specified here. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
ignoreCase	indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.	bool	no	`false`	`true`, `false`
prefix	defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
regex	defines a regex match on the regular expression specified here. Google’s RE2 regex engine is used. The regex matches only single-line by default, even with “.*”. To match a multi-line string prepend (?s) to your regex. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
suffix	defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no

AccessControlPolicy.spec.policies[].authorization.requireAny[].tokenExchange

Field	Description	Type	Required	Default	Allowed Values
claim	specifies a condition on a JWT or ID token claim of on the exchanged token.	object	yes

AccessControlPolicy.spec.policies[].authorization.requireAny[].tokenExchange.claim

Field	Description	Type	Required	Default	Allowed Values
name	of the claim.	string	yes
value	of the claim. If not specified, only existence of the claim is checked (any value is allowed). Value matching is only supported if the data type of the claim is either primitive (`number`, `boolean`, `string`) or `array` of primitives. In case of a non-string value, the match will be performed against the stringified value. If the claim has an unsupported data type (e.g. `object` or `null`), its value will never match.	object	no

AccessControlPolicy.spec.policies[].authorization.requireAny[].tokenExchange.claim.value

Field	Description	Type	Required	Default	Allowed Values
matcher		object	yes		`contains{}`, `exact{}`, `prefix{}`, `regex{}`, `suffix{}`

AccessControlPolicy.spec.policies[].authorization.requireAny[].tokenExchange.claim.value.matcher

Field	Description	Type	Required	Default	Allowed Values
contains	defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
exact	defines an explicit match on the string specified here. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
ignoreCase	indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.	bool	no	`false`	`true`, `false`
prefix	defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
regex	defines a regex match on the regular expression specified here. Google’s RE2 regex engine is used. The regex matches only single-line by default, even with “.*”. To match a multi-line string prepend (?s) to your regex. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
suffix	defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no

AccessControlPolicy.spec.policies[].identityPropagation

Field	Description	Type	Required	Default	Allowed Values
actions	specifies the propagation actions.	object[]	yes
onFailure	configures what should happen, if an identity propagation fails. Meaning of the possible values: Pass: The request should be forwarded to the upstream, without including the information from the failed identity propagations.	enum	yes		`Pass`

AccessControlPolicy.spec.policies[].identityPropagation.actions[]

Field	Description	Type	Required	Default	Allowed Values
identityPropagationRef	selects an IdentityPropagation to apply.	object	yes

AccessControlPolicy.spec.policies[].identityPropagation.actions[].identityPropagationRef

Field	Description	Type	Required	Default	Allowed Values
name	of the resource	string	yes

AccessControlPolicy.spec.policies[].requestConditions

Field	Description	Type	Required	Default	Allowed Values
header	defines the matching headers of a request.	object	no
invert	indicates whether the request condition should be inverted.	bool	no	`false`	`true`, `false`
mediaType	defines the matching media type from the content-type header of a request.	object	no
method	defines the matching methods of a request.	enum[]	no		`CONNECT`, `DELETE`, `GET`, `HEAD`, `OPTIONS`, `PATCH`, `POST`, `PUT`, `TRACE`
path	defines the matching path of a request.	object	no
remoteIP	defines the matching remote IPs of a request. Note: Depending on your setup you may need to adapt the `remoteIP` configuration in the `SidecarGateway` / `GatewayParameters` resource to ensure correct client IP detection.	object	no

AccessControlPolicy.spec.policies[].requestConditions.header

Field	Description	Type	Required	Default	Allowed Values
name	defines the name of a header.	object	no
value	defines the value of a header.	object	no

AccessControlPolicy.spec.policies[].requestConditions.header.name

Field	Description	Type	Required	Default	Allowed Values
matcher	defines the way to match a string. In comparison to a normal StringMatcher, a value is always matched ignoring the case and can’t be inverted.	object	yes		`contains{}`, `exact{}`, `prefix{}`, `regex{}`, `suffix{}`

AccessControlPolicy.spec.policies[].requestConditions.header.name.matcher

Field	Description	Type	Required
contains	defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
exact	defines an explicit match on the string specified here. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
prefix	defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
regex	defines a regex match on the regular expression specified here. Google’s RE2 regex engine is used. The regex matches only single-line by default, even with “.*”. To match a multi-line string prepend (?s) to your regex. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
suffix	defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no

AccessControlPolicy.spec.policies[].requestConditions.header.value

Field	Description	Type	Required	Default	Allowed Values
matcher		object	yes		`contains{}`, `exact{}`, `prefix{}`, `regex{}`, `suffix{}`

AccessControlPolicy.spec.policies[].requestConditions.header.value.matcher

Field	Description	Type	Required	Default	Allowed Values
contains	defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
exact	defines an explicit match on the string specified here. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
ignoreCase	indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.	bool	no	`false`	`true`, `false`
prefix	defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
regex	defines a regex match on the regular expression specified here. Google’s RE2 regex engine is used. The regex matches only single-line by default, even with “.*”. To match a multi-line string prepend (?s) to your regex. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
suffix	defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no

AccessControlPolicy.spec.policies[].requestConditions.mediaType

Field	Description	Type	Required	Default	Allowed Values
matcher		object	yes		`contains{}`, `exact{}`, `prefix{}`, `regex{}`, `suffix{}`

AccessControlPolicy.spec.policies[].requestConditions.mediaType.matcher

Field	Description	Type	Required
contains	defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
exact	defines an explicit match on the string specified here. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
prefix	defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
regex	defines a regex match on the regular expression specified here. Google’s RE2 regex engine is used. The regex matches only single-line by default, even with “.*”. To match a multi-line string prepend (?s) to your regex. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
suffix	defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no

AccessControlPolicy.spec.policies[].requestConditions.path

Field	Description	Type	Required	Default	Allowed Values
matcher		object	yes		`contains{}`, `exact{}`, `prefix{}`, `regex{}`, `suffix{}`

AccessControlPolicy.spec.policies[].requestConditions.path.matcher

Field	Description	Type	Required	Default	Allowed Values
contains	defines a substring match on the substring specified here. Empty contains match is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
exact	defines an explicit match on the string specified here. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
ignoreCase	indicates whether the matching should be case-insensitive. In case of a regex match, the regex gets wrapped with a group `(?i:...)`.	bool	no	`false`	`true`, `false`
prefix	defines a prefix match on the prefix specified here. Empty prefix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
regex	defines a regex match on the regular expression specified here. Google’s RE2 regex engine is used. The regex matches only single-line by default, even with “.*”. To match a multi-line string prepend (?s) to your regex. Only one of exact, prefix, suffix, regex or contains can be set.	string	no
suffix	defines a suffix match on the suffix specified here. Empty suffix is not allowed, please use regex instead. Only one of exact, prefix, suffix, regex or contains can be set.	string	no

AccessControlPolicy.spec.policies[].requestConditions.remoteIP

Field	Description	Type	Required	Default	Allowed Values
cidrRanges	defines the IPv4 or IPv6 CIDR ranges, e.g. `196.148.3.128/26` or `2001:db8::/28`.	string[]	yes
invert	indicates whether the match should be inverted.	bool	no	`false`	`true`, `false`

AccessControlPolicy.spec.policies[].tokenExchange

Field	Description	Type	Required	Default	Allowed Values
actions	specifies the chain of token exchange actions to execute.	object[]	yes
onFailure	configures what should happen, if the token exchange fails. Meaning of the possible values: Block: The downstream request is blocked. Pass: Processing of the downstream request will proceed, but no exchanged token will be available (e.g. for identity propagation).	enum	no	`Block`	`Block`, `Pass`

AccessControlPolicy.spec.policies[].tokenExchange.actions[]

Field	Description	Type	Required	Default	Allowed Values
tokenExchangeRef	selects a TokenExchange to perform.	object	yes

AccessControlPolicy.spec.policies[].tokenExchange.actions[].tokenExchangeRef

Field	Description	Type	Required	Default	Allowed Values
name	of the resource	string	yes