Add trustDomains and notTrustDomains to AuthzPolicy source

releasenotes/notes/add-trust-domains-to-authz-policy.yaml

@@ -0,0 +1,8 @@
+apiVersion: release-notes/v2
+kind: feature
+area: security
+
+releaseNotes:
+  - |
+    **Added** `trustDomains` and `notTrustDomains` fields to the `Source` in `AuthorizationPolicy`,
+    allowing users to match or exclude requests based on the trust domain derived from the peer certificate.

security/v1beta1/authorization_policy.proto

@@ -506,6 +506,21 @@ message Source {
 
   // Optional. A list of negative match of remote IP blocks.
   repeated string not_remote_ip_blocks = 10;
+
+  // Optional. A list of trust domains derived from the peer certificate.
+  // Can be exact, prefix, suffix and presence.
+  // This field requires mTLS enabled and is the same as the `source.trustDomain` attribute.
+  //
+  // If not set, any trust domain is allowed.
+  //
+  // +cue-gen:AuthorizationPolicy:releaseChannel:extended
+  repeated string trust_domains = 13;
+
+  // Optional. A list of negative match of trust domains.
+  // Can be exact, prefix, suffix and presence.
+  //
+  // +cue-gen:AuthorizationPolicy:releaseChannel:extended
+  repeated string not_trust_domains = 14;
 }
 
 // Operation specifies the operations of a request. Fields in the operation are

tests/testdata/authz-valid.yaml

@@ -19,6 +19,8 @@ spec:
             notNamespaces: ["not-ns", "not-ns-prefix-*", "*-not-ns-suffix", "*"]
             notIpBlocks: ["9.0.0.1", "9.2.0.0/16"]
             notRemoteIpBlocks: ["9.0.0.1", "9.2.0.0/16"]
+            trustDomains: ["cluster.local", "cluster-prefix-*", "*-suffix-cluster", "*"]
+            notTrustDomains: ["not-cluster.local", "not-cluster-prefix-*", "*-not-suffix-cluster", "*"]
       to:
         - operation:
             methods: ["method", "method-prefix-*", "*-suffix-method", "*"]
@@ -69,6 +71,9 @@ spec:
         - key: "connection.sni"
           values: ["exact.com", "*.suffix.com", "prefix.*", "*"]
           notValues: ["not-exact.com", "*.not-suffix.com", "not-prefix.*", "*"]
+        - key: "source.trustDomain"
+          values: ["cluster.local", "cluster-prefix-*", "*-suffix-cluster", "*"]
+          notValues: ["not-cluster.local", "not-cluster-prefix-*", "*-not-suffix-cluster", "*"]
         - key: "experimental.envoy.filters.a.b[c]"
           values: ["exact", "prefix-*", "*-suffix", "*"]
           notValues: ["not-exact", "not-prefix-*", "*-not-suffix", "*"]