static_resources:
	listeners: []
	clusters: []
	secrets: [] # 静态指定的Secret列表，定义时，以下三种方式可选其一; 
	- name: ... # 可用于引用此秘密(Secret)的惟一标识;
		tls_cretificate: {...} # 数字证书
			certificate_chain: {...} # TLS证书链
				filename: ... # 保存有证书信息的文件;也可使用inline_bytes或inline_string进行指定，即DataSource格式;
			private_key: {...} # TLS私钥，遵循DataSource格式;
			password: {...} # 私钥信息的加解密密钥，未指定时需要私钥文件处于未加密状态，遵循DataSource格式;
	- name: ... # 可用于引用此秘密的惟一标识;
		session_ticket_keys: {...} # 定义用于加密和解密TLS会话票证的密钥
			keys: [] # 密钥列表，未指定时将使用内部生成和管理的密钥，定义格式遵循DataSource格式; 
								#安全起见，应该每小时轮换一次，但使用安全的随机数据源;
	- name: ... # 可用于引用此秘密(Secret)的惟一标识;
		validation_context: {...} # 对等证书验证机制的相关配置
			trusted_ca: {...} # 信任的CA的证书，未指定时不会验证对端证书;
			crl: {...} # 可选的PEM格式的证书吊销列表，定义格式遵循DataSource格式;
			verify_certificate_spki: [] # base64编码的SHA-256哈希码，用于验证DER编码格式证书的公钥信息的SHA-256编码是否与列表项之一匹配 
			verify_certificate_hash: [] # base64编码的SHA-256哈希码，用于验证DER编码格式证书的SHA-256编码是否与列表项之一匹配 
			verify_subject_alt_name: [] # Subject备用名称列表，可选，用于验证证书的主题备用名称是否与列表项之一匹配 
			allow_expired_certificate: ... # 布尔型数据，用于定义是滞不会拒绝过期的证书
 

static_resources:
  secrets:
  - name: server_cert
    tls_certificate:
      certificate_chain:
        filename: "/etc/envoy/certs/server.crt"
      private_key:
        filename: "/etc/envoy/certs/server.key"
  - name: client_cert
    tls_certificate:
      certificate_chain:
        filename: "/etc/envoy/certs/client.crt"
      private_key:
        filename: "/etc/envoy/certs/client.key"
  - name: validation_context
    validation_context:
      trusted_ca:
        filename: "/etc/envoy/ca/ca.crt"

listeners:
- name: ...
	... 
	filter_chains: 
	- filters: []
		tls_context: {...} # 当前过滤器链的TLS上下文;
			tls_params: {...} # TLS协议版本和密码套件等; 
			tls_certificates: [] # TLS证书列表;
				certificate_chain: {...} # TLS证书链;
					filename: ... # 保存有证书信息的文件;也可使用inline_bytes或inline_string进行指定，即DataSource格式;
				private_key: {...} # TLS私钥;
				password: {...} # 解密私钥文件的口令，未指定时需要私钥文件处于未加密状态;
			tls_certificate_sds_secret_configs: {...} # 通过静态资源中定义的Secret或SDS获取Secret;
      	name: ... # secret的惟一标识，可以FQDN、UUID、SPKI或SHA256格式;
      						# 仅指定name时，表示加载static_resources中定义的secret;
				sds_config: {...} # xDS API ConfigSource，支持path、api_config_source或ads格式;
			validation_context: {...} # 如何验证对等证书
			validation_context_sds_secret_config: {...} # 通过SDS获取验证上下文;
		require_client_certificate: ... # 布尔型值，是否要求并验证客户端证书;、 
		session_ticket_keys: {...} # TLS会话票证相关的设置

static_resources:
  secrets:
  - name: server_cert
    tls_certificate:
      certificate_chain:
        filename: "/etc/envoy/certs/server.crt"
      private_key:
        filename: "/etc/envoy/certs/server.key"
  - name: client_cert
    tls_certificate:
      certificate_chain:
        filename: "/etc/envoy/certs/client.crt"
      private_key:
        filename: "/etc/envoy/certs/client.key"
  - name: validation_context
    validation_context:
      trusted_ca:
        filename: "/etc/envoy/ca/ca.crt"

  listeners:
  - name: listener_https
    address:
      socket_address: { address: 0.0.0.0, port_value: 443 }
    filter_chains:
    - filters:
      - name: envoy.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager
          stat_prefix: ingress_https
          codec_type: AUTO
          route_config:
            name: https_route
            virtual_hosts:
            - name: https_route
              domains: ["*"]
              routes:
              - match:
                  prefix: "/service/gray"
                route:
                  cluster: service-gray
              - match:
                  prefix: "/service/purple"
                route:
                  cluster: service-purple
              - match:
                  prefix: "/"
                route:
                  cluster: mycluster
          http_filters:
          - name: envoy.router
            typed_config: {}
      tls_context:
        common_tls_context:
          tls_certificate_sds_secret_configs:
          - name: server_cert

      tls_context:
        common_tls_context:
          tls_certificates:
          - certificate_chain:
              filename: "/etc/envoy/certs/server.crt"
            private_key:
              filename: "/etc/envoy/certs/server.key"

clusters:
- name: ...
	...
		tls_context: {...} # 当前过滤器的TLS上下文;
			tls_params: {...} # TLS协议版本和密码套件等; 
			tls_certificates: [] # TLS证书列表;
				certificate_chain: {...} # TLS证书链;
					filename: ... # 保存有证书信息的文件;也可使用inline_bytes或inline_string进行指定，即DataSource格式;
				private_key: {...} # TLS私钥;
				password: {...} # 解密私钥文件的口令，未指定时需要私钥文件处于未加密状态;
			tls_certificate_sds_secret_configs: {...} # 通过静态资源中定义的Secret或SDS获取Secret;
				name: ... # secret的惟一标识，可以FQDN、UUID、SPKI或SHA256格式;仅指定name时，表示加载static_resources中定义的secret;
				sds_config: {...} # xDS API ConfigSource，支持path、api_config_source或ads格式;
			validation_context: {...} # 如何验证对等证书
			validation_context_sds_secret_config: {...} # 通过SDS获取验证上下文;
		allow_renegotiation: ... # 布尔型值，是否允许服务器启动的TLS重新协商;
		max_session_key: ... # 为会话恢复而存储的最大会话密钥数，默认为1，0表示禁用会话恢复; 
		sni: ... # 创建TLS后端连接时使用的SNI字符串
 

  clusters:
  - name: service-purple
    connect_timeout: 0.25s
    type: STRICT_DNS
    lb_policy: ROUND_ROBIN
    http2_protocol_options: {}
    load_assignment:
      cluster_name: service-purple
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address:
                address: service-purple
                port_value: 443
    tls_context:
      common_tls_context:
        tls_certificate_sds_secret_configs:
        - name: client_cert
        validation_context_sds_secret_config:
          name: validation_context

root@istio:~/ServiceMesh_in_Practise/security/tls-static# ls
README.md  certs  docker-compose.yaml  front-envoy.yaml  gencerts.sh  openssl.conf  service-gray.yaml  service-purple.yaml

http_filters:
- name: envoy.filters.http.jwt_authn
	config:
		providers:  	# 定义provider名称及其相关的属性，以指定如何验证JWT;可定义多个porovider
	    xxx: ... 											# provider名称;
				issuer: ... 								# JWT的签发者，通常是一个URL或一个email;
				audiences: [] 							# 允许访问的JWT受众列表，含有此处指定的audiences其中之一的JWT即可被接受; 
				remote_jwks: {...} 					# 可通过HTTP/HTTPS远程获取到的JWK，因此内嵌的最重要字段即为uri; 
				local_jwks: {...} 					# 本地数据源可以访问到的JWK，支持通过本地文件或inline_string方式加载; 
				from_headers: {...} 				# 定义从通过哪个HTTP协议标头获取JWT，例如“Authorization: Bear <token>”; 
				from_params: {...} 					# 定义从哪个URL param中获取JWT;
				forward: ... 								# 布尔型值，定义是否无需在认证成功后从请求中移除JWT，默认为false，即需要移除; 
				forward_payload_header: ... # 指定用于将经过验证的JWT的payload转发至后端的标头;
		rules: [] # 定义特定路由条件下的JWT验证要求（对哪些request进行jwt验证）; 
		- match: {...} # 路由匹配条件
			requires: {...} # JWT验证要求，以下验证方式仅能使用其中一种;
				provider_name: ... # 需要的provider名称;
				provider_and_audiences: {...} # 需要的provider和audiences;
				requires_any: {...} # 由requirements参数指定需要的providers列表，其中任何一个provider验证通过，结果即为通过; 
				requires_all: {...} # 由requirements参数指定需要的providers列表，其中所有的provider验证通过，结果才为通过; 
				allow_missing_or_failed: {...} # 即便JWT缺失或验证失败，结果依然通过;

action: ... # 策略匹配时的操作行为，支持ALLOW和DENY两个; 
policies: {...} # 授权策略
	ROLE_NAM: # 角色名称
		permissions: [] # 应用于一个角色之上的权限许可列表，各列表项之间为“或”关系;
			any: ... # 布尔型值，是否匹配所有操作权限;
			header: {...} # 核验传入的HTTP请求报文的指定标头;仅适用于HTTP请求; 
			destination_ip: {...} # 针对于目标IP的CIDR地址块的操作权限; 
			destination_port: {...} # 针对于目标端口的操作权限;
			metadata: {...} # 针对于指定的元数据的操作权限; 
			requested_server_name: ... # 针对于客户端请求的目标服务器的操作权限; 
			and_rules: {...} # 以“与”关系定义的一组操作权限;
			or_rules: {...} # 以“或”关系定义的一组操作权限;
			not_rules: {...} # 以“非”关系定义的一组操作权限;
		principals: []  # 如何才能具有相关的权限，多个列表“或”关系
			authenticated: {...} # 经过认证的;
			header: {...} # 传入HTTP请求报文的指定标头;
			metadata: {...} # 描述有关Subject的其它信息的元数据; 
			and_ids: {...} # “与”关系的一组主体;
			or_ids: {...} # “或”关系的一组主体;
			not_id: {...} # “非”关系主体，即指定主体之外的其他主体;
 

action: ALLOW 
policies:
	service-admin:
		permissions:
			- any: true
		principals:
			- authenticated:
					principal_name:
						exact: "cluster.local/ns/default/sa/admin"
			- authenticated:
					principal_name:
						exact: "cluster.local/ns/default/sa/superuser"
	product-viewer:
  	permissions:
  		- and_rules:
  				rules:
  					- header: { name: ":method", exact_match: "GET" }
						- header: { name: ":path", regex_match: "/products(/.*)?" } 
						- or_rules:
								rules:
									- destination_port: 80 
									- destination_port: 443
  	principals:
  		- any: true

root@istio:~/ServiceMesh_in_Practise/security/envoy-spire-ext-authz# cat docker/web/opa/policies/policy.rego
package envoy.authz

import input.attributes.request.http as http_request
import input.attributes.source.address as source_address

default allow = false

allowed_paths = {"/hello", "/the/good/path", "/the/bad/path"}
allowed_local_paths = {"/good/backend", "/good/db"}

# allow access to the Web service from the subnet 172.28.0.0/16 for the allowed paths
allow {
    allowed_paths[http_request.path]
    http_request.method == "GET"
    net.cidr_contains("172.28.0.0/16", source_address.Address.SocketAddress.address)
}

# allow Web service access from localhost for locally allowed paths
allow {
    source_address.Address.SocketAddress.address == "127.0.0.1"
    allowed_local_paths[http_request.path]
    http_request.method == "GET"
}

root@istio:~/ServiceMesh_in_Practise/security/envoy-spire-ext-authz# ls
LICENSE  README.md  arch.png  build.sh  configure-spire.sh  docker  docker-compose.yml  gencerts.go  src  start-spire-agent.sh