name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    policies:
      ns[foo]-policy[httpbin]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - header:
                    name: :authority
                    stringMatch:
                      exact: rule[0]-to[0]-host[1]
                      ignoreCase: true
                - header:
                    name: :authority
                    stringMatch:
                      exact: rule[0]-to[0]-host[2]
                      ignoreCase: true
            - orRules:
                rules:
                - header:
                    name: :method
                    stringMatch:
                      exact: rule[0]-to[0]-method[1]
                - header:
                    name: :method
                    stringMatch:
                      exact: rule[0]-to[0]-method[2]
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: rule[0]-to[0]-path[1]
                - urlPath:
                    path:
                      exact: rule[0]-to[0]-path[2]
            - orRules:
                rules:
                - destinationPort: 9001
                - destinationPort: 9002
            - orRules:
                rules:
                - destinationIp:
                    addressPrefix: 10.10.10.10
                    prefixLen: 32
                - destinationIp:
                    addressPrefix: 192.168.10.0
                    prefixLen: 24
        - andRules:
            rules:
            - orRules:
                rules:
                - header:
                    name: :authority
                    stringMatch:
                      exact: rule[0]-to[1]-host[1]
                      ignoreCase: true
                - header:
                    name: :authority
                    stringMatch:
                      exact: rule[0]-to[1]-host[2]
                      ignoreCase: true
            - orRules:
                rules:
                - header:
                    name: :method
                    stringMatch:
                      exact: rule[0]-to[1]-method[1]
                - header:
                    name: :method
                    stringMatch:
                      exact: rule[0]-to[1]-method[2]
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: rule[0]-to[1]-path[1]
                - urlPath:
                    path:
                      exact: rule[0]-to[1]-path[2]
            - orRules:
                rules:
                - destinationPort: 9011
                - destinationPort: 9012
            - orRules:
                rules:
                - destinationIp:
                    addressPrefix: 10.10.10.10
                    prefixLen: 32
                - destinationIp:
                    addressPrefix: 192.168.10.0
                    prefixLen: 24
        principals:
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      exact: spiffe://rule[0]-from[0]-principal[1]
                - authenticated:
                    principalName:
                      exact: spiffe://rule[0]-from[0]-principal[2]
            - orIds:
                ids:
                - andIds:
                    ids:
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            exact: rule[0]-from[0]-requestPrincipal[1]
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub
                        value:
                          stringMatch:
                            exact: ""
                - andIds:
                    ids:
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            exact: rule[0]-from[0]-requestPrincipal[2]
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub
                        value:
                          stringMatch:
                            exact: ""
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/rule[0]-from[0]-ns[1]/.*
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/rule[0]-from[0]-ns[2]/.*
            - orIds:
                ids:
                - remoteIp:
                    addressPrefix: 172.16.10.10
                    prefixLen: 32
            - orIds:
                ids:
                - directRemoteIp:
                    addressPrefix: 10.0.0.1
                    prefixLen: 32
                - directRemoteIp:
                    addressPrefix: 10.0.0.2
                    prefixLen: 32
            - orIds:
                ids:
                - header:
                    name: X-header
                    stringMatch:
                      exact: header
                - header:
                    name: X-header
                    stringMatch:
                      prefix: header-prefix-
                - header:
                    name: X-header
                    stringMatch:
                      suffix: -suffix-header
                - header:
                    name: X-header
                    presentMatch: true
            - orIds:
                ids:
                - remoteIp:
                    addressPrefix: 10.99.10.8
                    prefixLen: 32
                - remoteIp:
                    addressPrefix: 10.80.64.0
                    prefixLen: 18
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      exact: spiffe://rule[0]-from[1]-principal[1]
                - authenticated:
                    principalName:
                      exact: spiffe://rule[0]-from[1]-principal[2]
            - orIds:
                ids:
                - andIds:
                    ids:
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            exact: rule[0]-from[1]-requestPrincipal[1]
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub
                        value:
                          stringMatch:
                            exact: ""
                - andIds:
                    ids:
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            exact: rule[0]-from[1]-requestPrincipal[2]
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub
                        value:
                          stringMatch:
                            exact: ""
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/rule[0]-from[1]-ns[1]/.*
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/rule[0]-from[1]-ns[2]/.*
            - orIds:
                ids:
                - remoteIp:
                    addressPrefix: 172.17.8.0
                    prefixLen: 24
                - remoteIp:
                    addressPrefix: 172.17.9.4
                    prefixLen: 32
            - orIds:
                ids:
                - directRemoteIp:
                    addressPrefix: 10.0.1.1
                    prefixLen: 32
                - directRemoteIp:
                    addressPrefix: 192.0.1.2
                    prefixLen: 32
            - orIds:
                ids:
                - header:
                    name: X-header
                    stringMatch:
                      exact: header
                - header:
                    name: X-header
                    stringMatch:
                      prefix: header-prefix-
                - header:
                    name: X-header
                    stringMatch:
                      suffix: -suffix-header
                - header:
                    name: X-header
                    presentMatch: true
            - orIds:
                ids:
                - remoteIp:
                    addressPrefix: 10.99.10.8
                    prefixLen: 32
                - remoteIp:
                    addressPrefix: 10.80.64.0
                    prefixLen: 18
      ns[foo]-policy[httpbin]-rule[1]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - header:
                    name: :authority
                    stringMatch:
                      exact: rule[1]-to[0]-host[1]
                      ignoreCase: true
                - header:
                    name: :authority
                    stringMatch:
                      exact: rule[1]-to[0]-host[2]
                      ignoreCase: true
            - orRules:
                rules:
                - header:
                    name: :method
                    stringMatch:
                      exact: rule[1]-to[0]-method[1]
                - header:
                    name: :method
                    stringMatch:
                      exact: rule[1]-to[0]-method[2]
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: rule[1]-to[0]-path[1]
                - urlPath:
                    path:
                      exact: rule[1]-to[0]-path[2]
            - orRules:
                rules:
                - destinationPort: 9101
                - destinationPort: 9102
        - andRules:
            rules:
            - orRules:
                rules:
                - header:
                    name: :authority
                    stringMatch:
                      exact: rule[1]-to[1]-host[1]
                      ignoreCase: true
                - header:
                    name: :authority
                    stringMatch:
                      exact: rule[1]-to[1]-host[2]
                      ignoreCase: true
            - orRules:
                rules:
                - header:
                    name: :method
                    stringMatch:
                      exact: rule[1]-to[1]-method[1]
                - header:
                    name: :method
                    stringMatch:
                      exact: rule[1]-to[1]-method[2]
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: rule[1]-to[1]-path[1]
                - urlPath:
                    path:
                      exact: rule[1]-to[1]-path[2]
            - orRules:
                rules:
                - destinationPort: 9111
                - destinationPort: 9112
        principals:
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      exact: spiffe://rule[1]-from[0]-principal[1]
                - authenticated:
                    principalName:
                      exact: spiffe://rule[1]-from[0]-principal[2]
            - orIds:
                ids:
                - andIds:
                    ids:
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            exact: rule[1]-from[0]-requestPrincipal[1]
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub
                        value:
                          stringMatch:
                            exact: ""
                - andIds:
                    ids:
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            exact: rule[1]-from[0]-requestPrincipal[2]
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub
                        value:
                          stringMatch:
                            exact: ""
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/rule[1]-from[0]-ns[1]/.*
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/rule[1]-from[0]-ns[2]/.*
            - orIds:
                ids:
                - remoteIp:
                    addressPrefix: 172.22.2.0
                    prefixLen: 23
                - remoteIp:
                    addressPrefix: 172.21.234.254
                    prefixLen: 32
            - orIds:
                ids:
                - directRemoteIp:
                    addressPrefix: 10.1.0.1
                    prefixLen: 32
                - directRemoteIp:
                    addressPrefix: 10.1.0.2
                    prefixLen: 32
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      exact: spiffe://rule[1]-from[1]-principal[1]
                - authenticated:
                    principalName:
                      exact: spiffe://rule[1]-from[1]-principal[2]
            - orIds:
                ids:
                - andIds:
                    ids:
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            exact: rule[1]-from[1]-requestPrincipal[1]
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub
                        value:
                          stringMatch:
                            exact: ""
                - andIds:
                    ids:
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: iss
                        value:
                          stringMatch:
                            exact: rule[1]-from[1]-requestPrincipal[2]
                    - metadata:
                        filter: envoy.filters.http.jwt_authn
                        path:
                        - key: payload
                        - key: sub
                        value:
                          stringMatch:
                            exact: ""
            - orIds:
                ids:
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/rule[1]-from[1]-ns[1]/.*
                - authenticated:
                    principalName:
                      safeRegex:
                        regex: .*/ns/rule[1]-from[1]-ns[2]/.*
            - orIds:
                ids:
                - remoteIp:
                    addressPrefix: 192.168.4.0
                    prefixLen: 24
                - remoteIp:
                    addressPrefix: 192.168.7.8
                    prefixLen: 32
            - orIds:
                ids:
                - directRemoteIp:
                    addressPrefix: 10.1.1.1
                    prefixLen: 32
                - directRemoteIp:
                    addressPrefix: 192.1.1.2
                    prefixLen: 32
  shadowRulesStatPrefix: istio_dry_run_allow_
