days to Istio 1.5

Authorization Policy Conditions

This page describes the supported keys and value formats you can use as conditions in the when field of authorization policy resources.

For more information, refer to the authorization concept page.

Supported Conditions

NameDescriptionSupported ProtocolsExample
request.headersHTTP request headers. The actual header name is surrounded by bracketsHTTP onlykey: request.headers[User-Agent]
values: ["Mozilla/*"]
source.ipSource workload instance IP address, supports single IP or CIDRHTTP and TCPkey: source.ip
values: [""]
source.namespaceSource workload instance namespaceHTTP and TCPkey: source.namespace
values: ["default"]
source.principalThe identity of the source workloadHTTP and TCPkey: source.principal
values: ["cluster.local/ns/default/sa/productpage"]
request.auth.principalThe authenticated principal of the request.HTTP onlykey: request.auth.principal
values: [""]
request.auth.audiencesThe intended audience(s) for this authentication informationHTTP onlykey: request.auth.audiences
values: [""]
request.auth.presenterThe authorized presenter of the credentialHTTP onlykey: request.auth.presenter
values: [""]
request.auth.claimsClaims from the origin JWT. The actual claim name is surrounded by bracketsHTTP onlykey:[iss]
values: ["*"]
destination.ipDestination workload instance IP address, supports single IP or CIDRHTTP and TCPkey: destination.ip
values: ["", ""]
destination.portThe recipient port on the server IP address, must be in the range [0, 65535]HTTP and TCPkey: destination.port
values: ["80", "443"]
connection.sniThe server name indicationHTTP and TCPkey: connection.sni
values: [""]
experimental.envoy.filters.*Experimental metadata matching for filters, values wrapped in [] are matched as a listHTTP and TCPkey:[db.table]
values: ["[update]"]
Was this information useful?
Do you have any suggestions for improvement?

Thanks for your feedback!