area: security
issue:
- https://github.com/istio/api/pull/1933
docs:
- '[usage] https://istio.io/latest/docs/tasks/security/authorization/authz-dry-run/'
- '[design] https://docs.google.com/document/d/1xQdZsEgJ3Ld2qebfT3EJkg2COTtCR1TqBVojmnvI78g'
releaseNotes:
- |

apiVersion: release-notes/v2
kind: feature
area: security
issue:
- https://github.com/istio/enhancements/pull/112
releaseNotes:
- |
  **Promoted** the authorization policy dry-run mode to alpha.
docs:

  namespace: foo
  annotations:
    "istio.io/dry-run": "true"
spec:
  selector:
    matchLabels:
      app: httpbin
      version: v1
  action: ALLOW
  rules:
    - to:
        - operation:
            ports: ["80"]
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin-2
  namespace: foo
  annotations:
    "istio.io/dry-run": "false"
spec:
  selector:

  annotations:
    "istio.io/dry-run": "true"
spec:
  selector:
    matchLabels:
      app: httpbin
      version: v1
  action: ALLOW
  rules:
    - to:
        - operation:
            paths: ["/allow"]
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin-2
  namespace: foo
  annotations:
    "istio.io/dry-run": "false"
spec:
  selector:

# Unpacks a tarfile of etcd scrapes and runs a simple web server exposing it
# and a Prometheus server scraping that simple web server.
# The simple web server listens on port 9091.
# The Prometheus server is run in a container and looks for the
# simple web server at the host's first global IPv4 address.

# Usage: $0 scrapes_tar_pathname
#
# Where scrapes_tar_pathname is a gzipped tar archive containing

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin-1
  namespace: foo
  annotations:
    "istio.io/dry-run": "true"
spec:
  selector:
    matchLabels:
      app: httpbin
      version: v1
  rules:
    - to:
        - operation:

	exit_1
fi

./mc admin policy create minio1 projecta ./docs/site-replication/rw.json
sleep 5

# Generate STS credential with STS call to minio1
STS_CRED=$(MINIO_ENDPOINT=http://localhost:9001 go run ./docs/site-replication/gen-oidc-sts-cred.go)

MC_HOST_foo=http://${STS_CRED}@localhost:9001 ./mc ls foo
if [ $? -ne 0 ]; then
	echo "Expected sts credential to work, exiting.."
	exit_1
fi

sleep 2

Yuri Schimke <******@****.***> 1605965325 +0000

  annotations:
    "istio.io/dry-run": "true"
spec:
  selector:
    matchLabels:
      app: httpbin
      version: v1
  action: ALLOW
  rules:
    - to:
        - operation:
            paths: ["/allow"]
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin-2
  namespace: foo
  annotations:
    "istio.io/dry-run": "true"
spec:
  selector:

Yangmin Zhu <******@****.***> 1617651067 -0700