https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/rbac/v3/rbac.proto#envoy-v3-api-msg-config-rbac-v3-principal

if the SecurityPolicy with ip subnet info is applied at the Gateway level, it can be overridden at the route level if another SecurityPolicy is applied at route level

I didn't get it. A route level SecurityPolicy without Allow/Deny IP setting won't override the Allow/Deny IP setting in Gateway level. "Allow/Deny IP Subnets" should be only configured at the gateway level?

gateway/internal/gatewayapi/securitypolicy.go

Lines 359 to 374 in 95f4c10

    
           for _, http := range ir.HTTP { 
        
           	for _, r := range http.Routes { 
        
           		// Apply if not already set 
        
           		if r.CORS == nil { 
        
           			r.CORS = cors 
        
           		} 
        
           		if r.JWT == nil { 
        
           			r.JWT = jwt 
        
           		} 
        
           		if r.OIDC == nil { 
        
           			r.OIDC = oidc 
        
           		} 
        
           		if r.BasicAuth == nil { 
        
           			r.BasicAuth = basicAuth 
        
           		} 
        
           	}

	for _, http := range ir.HTTP {
	for _, r := range http.Routes {
	// Apply if not already set
	if r.CORS == nil {
	r.CORS = cors
	}
	if r.JWT == nil {
	r.JWT = jwt
	}
	if r.OIDC == nil {
	r.OIDC = oidc
	}
	if r.BasicAuth == nil {
	r.BasicAuth = basicAuth
	}
	}

Support Allow/Deny IP Subnets #2462

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions