security policies for tcp gateways not working #4908
Description
Description:
Security Policies can be applied on gateways, but they don't work on gateways with TCP listeners
[optional Relevant Links:]
gh discussion on it from this discussion
Internally a HTTP RBAC Filter is used, to enable this we'll need to use https://www.envoyproxy.io/docs/envoy/latest/configuration/listeners/network_filters/rbac_filter# when the listener is a TCP listener (tcp_proxy)
example log from from TCP gateway, you can see the source IP listed as downstream_remote_address":"<redacted_public_address:51822"
{"start_time":"2024-12-11T23:59:57.831Z","method":"-","x-envoy-origin-path":"-","protocol":"-","response_code":"0","response_flags":"-","response_code_details":"-","connection_termination_details":"-","upstream_transport_failure_reason":"-","bytes_received":"781","bytes_sent":"2235","duration":"353","x-envoy-upstream-service-time":"-","x-forwarded-for":"-","user-agent":"-","x-request-id":"-",":authority":"-","upstream_host":"10.101.67.104:5432","upstream_cluster":"tcproute/default/pgo-tools-dre/rule/-1","upstream_local_address":"10.101.68.80:36306","downstream_local_address":"10.101.68.80:32000","downstream_remote_address":"<redacted_public_address:51822","requested_server_name":"-","route_name":"-"}example of the security policy
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
name: pgo-authorization-client-ip
namespace: envoy-gateway-system
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: pgo-gateway-2
authorization:
defaultAction: Deny
rules:
- action: Allow
principal:
clientCIDRs:
- <public_address>
```
currently using v1.2.3