Styjun

The instant an accelerating object has zero speed, is it speeding up, slowing down, or neither?

Right indicator flash-frequency has increased and rear-right bulb is out

Basic power tool set for Home repair and simple projects

Do my partner and son need an SSN to be dependents on my taxes?

How to make all magic-casting innate, but still rare?

Is it a bad idea to have a pen name with only an initial for a surname?

How can I detect if I'm in a subshell?

Showing that a language is NP Complete (advice)

Is using Legacy mode is a bad thing to do?

How to ask if I can mow my neighbor's lawn

When is the phrase "j'ai bon" used?

How do I gain the trust of other PCs?

Bash function: Execute $@ command with each argument in sequence executed separately

How to recover a single blank shot from a film camera

Why do you need to heat the pan before heating the olive oil?

Would a 7805 5v regulator drain a 9v battery?

What do I put on my resume to make the company i'm applying to think i'm mature enough to handle a job?

Fibonacci sequence and other metallic sequences emerged in the form of fractions

Graphing large functions in LaTeX

How to use random to choose colors

Selecting unique column position of a non-zero value for each row of a matrix

Do details of my undergraduate title matter?

In windows systems, is renaming files functionally similar to deleting them?

How would Japanese people react to someone refusing to say “itadakimasu” for religious reasons?

Apply mixer policy to specific services

Difference between Mixer and Pilot in Istio?How to create an instance of the mixer config rule?Kubernetes with Istio Ingress Not Running on Standard HTTP Ports 443/80How to get feedback that Istio Policies are in actionWhy Istio Mixer use two deployments to do Telemetry collection and policy checking separately?Configuring Istio, Kubernetes and MetalLB to use a Istio LoadBalancerIstio Mixer container logs causing high disk space usageIstio virtual service not applying timeoutWhy is my ISTIO policy configuration not applied?

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

0

I have a mixer policy and adapter that will look for the auth_key in the token I pass, but it applies to all my pods in my default namespace. I need to be able to access two of my pods in the default namespace to login and be granted a header that will allow me to get passed this rule. So can I list the names of the pods I want to apply this rule to instead of it applying to all?

# handler for adapter mygrpcadapter
apiVersion: "config.istio.io/v1alpha2"
kind: handler
metadata:
 name: h1
 namespace: istio-system
spec:
 adapter: mygrpcadapter
 connection:
# address: "[::]:44225"
 address: "mygrpcadapterservice:44225"
 #address: "35.184.34.117:44225"
 params:
 auth_key: "Bearer"
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
 name: icheck
 namespace: istio-system
spec:
 template: authorization
 params:
 subject:
 properties:
 custom_token_header: request.headers["authorization"]
---

# rule to dispatch to handler h1
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
 name: r1
 namespace: istio-system
spec:
 actions:
 - handler: h1.istio-system
 instances:
 - icheck
---

istio

share|improve this question

asked Mar 25 at 4:42

Jordan WilliamsJordan Williams

597

add a comment | 

0

I have a mixer policy and adapter that will look for the auth_key in the token I pass, but it applies to all my pods in my default namespace. I need to be able to access two of my pods in the default namespace to login and be granted a header that will allow me to get passed this rule. So can I list the names of the pods I want to apply this rule to instead of it applying to all?

# handler for adapter mygrpcadapter
apiVersion: "config.istio.io/v1alpha2"
kind: handler
metadata:
 name: h1
 namespace: istio-system
spec:
 adapter: mygrpcadapter
 connection:
# address: "[::]:44225"
 address: "mygrpcadapterservice:44225"
 #address: "35.184.34.117:44225"
 params:
 auth_key: "Bearer"
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
 name: icheck
 namespace: istio-system
spec:
 template: authorization
 params:
 subject:
 properties:
 custom_token_header: request.headers["authorization"]
---

# rule to dispatch to handler h1
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
 name: r1
 namespace: istio-system
spec:
 actions:
 - handler: h1.istio-system
 instances:
 - icheck
---

istio

share|improve this question

asked Mar 25 at 4:42

Jordan WilliamsJordan Williams

597

add a comment | 

I have a mixer policy and adapter that will look for the auth_key in the token I pass, but it applies to all my pods in my default namespace. I need to be able to access two of my pods in the default namespace to login and be granted a header that will allow me to get passed this rule. So can I list the names of the pods I want to apply this rule to instead of it applying to all?

# handler for adapter mygrpcadapter
apiVersion: "config.istio.io/v1alpha2"
kind: handler
metadata:
 name: h1
 namespace: istio-system
spec:
 adapter: mygrpcadapter
 connection:
# address: "[::]:44225"
 address: "mygrpcadapterservice:44225"
 #address: "35.184.34.117:44225"
 params:
 auth_key: "Bearer"
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
 name: icheck
 namespace: istio-system
spec:
 template: authorization
 params:
 subject:
 properties:
 custom_token_header: request.headers["authorization"]
---

# rule to dispatch to handler h1
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
 name: r1
 namespace: istio-system
spec:
 actions:
 - handler: h1.istio-system
 instances:
 - icheck
---

istio

share|improve this question

asked Mar 25 at 4:42

Jordan WilliamsJordan Williams

597

# handler for adapter mygrpcadapter
apiVersion: "config.istio.io/v1alpha2"
kind: handler
metadata:
 name: h1
 namespace: istio-system
spec:
 adapter: mygrpcadapter
 connection:
# address: "[::]:44225"
 address: "mygrpcadapterservice:44225"
 #address: "35.184.34.117:44225"
 params:
 auth_key: "Bearer"
---
apiVersion: "config.istio.io/v1alpha2"
kind: instance
metadata:
 name: icheck
 namespace: istio-system
spec:
 template: authorization
 params:
 subject:
 properties:
 custom_token_header: request.headers["authorization"]
---

# rule to dispatch to handler h1
apiVersion: "config.istio.io/v1alpha2"
kind: rule
metadata:
 name: r1
 namespace: istio-system
spec:
 actions:
 - handler: h1.istio-system
 instances:
 - icheck
---

share|improve this question

asked Mar 25 at 4:42

Jordan WilliamsJordan Williams

597

share|improve this question

asked Mar 25 at 4:42

Jordan WilliamsJordan Williams

597

asked Mar 25 at 4:42

Jordan WilliamsJordan Williams

597

asked Mar 25 at 4:42

Jordan WilliamsJordan Williams

597

1 Answer
1

active

oldest

votes

1

Istio Mixer Rules have the match attribute, you can use it to specify where to apply the rule by matching Istio Mixer attributes.

For example, from the Istio documentation:

match(destination.service.host, "ratings.*) selects any request
targeting a service whose name starts with “ratings”

share|improve this answer

answered Mar 25 at 8:09

Vadim EisenbergVadim Eisenberg

2,2341109

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks, couldn't find it ☺.
  
  – Jordan Williams
  Mar 25 at 9:56
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  You are welcome :)
  
  – Vadim Eisenberg
  Mar 25 at 12:49
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55331371%2fapply-mixer-policy-to-specific-services%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

1

Istio Mixer Rules have the match attribute, you can use it to specify where to apply the rule by matching Istio Mixer attributes.

For example, from the Istio documentation:

match(destination.service.host, "ratings.*) selects any request
targeting a service whose name starts with “ratings”

share|improve this answer

answered Mar 25 at 8:09

Vadim EisenbergVadim Eisenberg

2,2341109

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks, couldn't find it ☺.
  
  – Jordan Williams
  Mar 25 at 9:56
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  You are welcome :)
  
  – Vadim Eisenberg
  Mar 25 at 12:49
  

  
  
  
  

add a comment | 

1

Istio Mixer Rules have the match attribute, you can use it to specify where to apply the rule by matching Istio Mixer attributes.

For example, from the Istio documentation:

match(destination.service.host, "ratings.*) selects any request
targeting a service whose name starts with “ratings”

share|improve this answer

answered Mar 25 at 8:09

Vadim EisenbergVadim Eisenberg

2,2341109

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks, couldn't find it ☺.
  
  – Jordan Williams
  Mar 25 at 9:56
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  You are welcome :)
  
  – Vadim Eisenberg
  Mar 25 at 12:49
  

  
  
  
  

add a comment | 

Istio Mixer Rules have the match attribute, you can use it to specify where to apply the rule by matching Istio Mixer attributes.

For example, from the Istio documentation:

match(destination.service.host, "ratings.*) selects any request
targeting a service whose name starts with “ratings”

share|improve this answer

answered Mar 25 at 8:09

Vadim EisenbergVadim Eisenberg

2,2341109

share|improve this answer

answered Mar 25 at 8:09

Vadim EisenbergVadim Eisenberg

2,2341109

answered Mar 25 at 8:09

Vadim EisenbergVadim Eisenberg

2,2341109

answered Mar 25 at 8:09

Vadim EisenbergVadim Eisenberg

2,2341109