Authorization Policy. Restrict access by IP-address

Security
1

Hi there! Could you please help me
I’m created a manifest:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin-app
  namespace: dev
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        namespaces: ["istio-system"]
    when:
    - key: request.headers[X-Envoy-External-Address]
      values: ["<IP_ADDR>"] #Ip to allow
  selector:
    matchLabels:
      app: httpbin-app

but this code not working. How can i restrict access to the podby IP address?

2

note the request.headers is doing simple string match (not IP match), you probably should use the sourceIP or remoteIP first class fields instead.

For the X-Envoy-External-Address case, you can check the envoy log to see the actual value of this header to confirm if it’s set to the expected value: Istio / Security Problems