api: Authorization API design

api/v1alpha1/authorization_types.go

@@ -0,0 +1,61 @@
+// Copyright Envoy Gateway Authors
+// SPDX-License-Identifier: Apache-2.0
+// The full text of the Apache license is available in the LICENSE file at
+// the root of the repo.
+
+package v1alpha1
+
+// Authorization defines the authorization configuration.
+type Authorization struct {
+	// Rules contains all the authorization rules.
+	// Rules are evaluated in order, the first matching rule will be applied,
+	// and the rest will be skipped.
+	//
+	// For example, if there are two rules, the first rule allows the request,
+	// and the second rule denies the request, the request will be allowed.
+	// If the first rule denies the request, and the second rule allows it,
+	// the request will be denied.
+	//
+	// +optional
+	Rules []Rule `json:"rules"`
+
+	// DefaultAction defines the default action to be taken if no rules match.
+	// If not specified, the default action is Deny.
+	// +optional
+	DefaultAction *RuleActionType `json:"defaultAction"`
+}
+
+// Rule defines the single authorization rule.
+type Rule struct {
+	// Action defines the action to be taken if the rule matches.
+	Action RuleActionType `json:"action"`
+
+	// Subject contains the subject of the rule.
+	Subject Subject `json:"subjects,omitempty"`
+
+	// Permissions contains allowed HTTP methods.
+	// If empty, all methods are matching.
+	//
+	// +optional
+	// Permissions []string `json:"permissions,omitempty"`
+}
+
+// Subject contains the subject configuration.
+type Subject struct {
+	// ClientCIDR contains client cidr configuration.
+	// Valid examples are "192.168.1.0/24" or "2001:db8::/64"
+	//
+	// +kubebuilder:validation:MinItems=1
+	ClientCIDR []string `json:"clientCIDR"`
+}
+
+// RuleActionType specifies the types of authorization rule action.
+// +kubebuilder:validation:Enum=Allow;Deny
+type RuleActionType string
+
+const (
+	// Allow is the action to allow the request.
+	Allow RuleActionType = "Allow"
+	// Deny is the action to deny the request.
+	Deny RuleActionType = "Deny"
+)

api/v1alpha1/securitypolicy_types.go

@@ -69,6 +69,12 @@ type SecurityPolicySpec struct {
 	//
 	// +optional
 	ExtAuth *ExtAuth `json:"extAuth,omitempty"`
+
+	// Authorization defines the authorization configuration.
+	//
+	// +optional
+	// +notImplementedHide
+	Authorization *Authorization `json:"authorization,omitempty"`
 }
 
 //+kubebuilder:object:root=true

charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml

@@ -49,6 +49,57 @@ spec:
           spec:
             description: Spec defines the desired state of SecurityPolicy.
             properties:
+              authorization:
+                description: Authorization defines the authorization configuration.
+                properties:
+                  defaultAction:
+                    description: |-
+                      DefaultAction defines the default action to be taken if no rules match.
+                      If not specified, the default action is Deny.
+                    enum:
+                    - Allow
+                    - Deny
+                    type: string
+                  rules:
+                    description: |-
+                      Rules contains all the authorization rules.
+                      Rules are evaluated in order, the first matching rule will be applied,
+                      and the rest will be skipped.
+
+
+                      For example, if there are two rules, the first rule allows the request,
+                      and the second rule denies the request, the request will be allowed.
+                      If the first rule denies the request, and the second rule allows it,
+                      the request will be denied.
+                    items:
+                      description: Rule defines the single authorization rule.
+                      properties:
+                        action:
+                          description: Action defines the action to be taken if the
+                            rule matches.
+                          enum:
+                          - Allow
+                          - Deny
+                          type: string
+                        subjects:
+                          description: Subject contains the subject of the rule.
+                          properties:
+                            clientCIDR:
+                              description: |-
+                                ClientCIDR contains client cidr configuration.
+                                Valid examples are "192.168.1.0/24" or "2001:db8::/64"
+                              items:
+                                type: string
+                              minItems: 1
+                              type: array
+                          required:
+                          - clientCIDR
+                          type: object
+                      required:
+                      - action
+                      type: object
+                    type: array
+                type: object
               basicAuth:
                 description: BasicAuth defines the configuration for the HTTP Basic
                   Authentication.

site/content/en/latest/api/extension_types.md

@@ -171,6 +171,21 @@ _Appears in:_
 | `TCP` | ActiveHealthCheckerTypeTCP defines the TCP type of health checking.<br /> | 
 
 
+#### Authorization
+
+
+
+Authorization defines the authorization configuration.
+
+_Appears in:_
+- [SecurityPolicySpec](#securitypolicyspec)
+
+| Field | Type | Required | Description |
+| ---   | ---  | ---      | ---         |
+| `rules` | _[Rule](#rule) array_ |  false  | Rules contains all the authorization rules.<br />Rules are evaluated in order, the first matching rule will be applied,<br />and the rest will be skipped.<br /><br />For example, if there are two rules, the first rule allows the request,<br />and the second rule denies the request, the request will be allowed.<br />If the first rule denies the request, and the second rule allows it,<br />the request will be denied. |
+| `defaultAction` | _[RuleActionType](#ruleactiontype)_ |  false  | DefaultAction defines the default action to be taken if no rules match.<br />If not specified, the default action is Deny. |
+
+
 #### BackOffPolicy
 
 
@@ -2865,6 +2880,37 @@ _Appears in:_
 | `httpStatusCodes` | _[HTTPStatus](#httpstatus) array_ |  false  | HttpStatusCodes specifies the http status codes to be retried.<br />The retriable-status-codes trigger must also be configured for these status codes to trigger a retry. |
 
 
+#### Rule
+
+
+
+Rule defines the single authorization rule.
+
+_Appears in:_
+- [Authorization](#authorization)
+
+| Field | Type | Required | Description |
+| ---   | ---  | ---      | ---         |
+| `action` | _[RuleActionType](#ruleactiontype)_ |  true  | Action defines the action to be taken if the rule matches. |
+| `subjects` | _[Subject](#subject)_ |  true  | Subject contains the subject of the rule. |
+
+
+#### RuleActionType
+
+_Underlying type:_ _string_
+
+RuleActionType specifies the types of authorization rule action.
+
+_Appears in:_
+- [Authorization](#authorization)
+- [Rule](#rule)
+
+| Value | Description |
+| ----- | ----------- |
+| `Allow` | Allow is the action to allow the request.<br /> | 
+| `Deny` | Deny is the action to deny the request.<br /> | 
+
+
 #### SecurityPolicy
 
 
@@ -3032,6 +3078,20 @@ _Appears in:_
 | `RegularExpression` | StringMatchRegularExpression :The input string must match the regular expression<br />specified in the match value.<br />The regex string must adhere to the syntax documented in<br />https://github.com/google/re2/wiki/Syntax.<br /> | 
 
 
+#### Subject
+
+
+
+Subject contains the subject configuration.
+
+_Appears in:_
+- [Rule](#rule)
+
+| Field | Type | Required | Description |
+| ---   | ---  | ---      | ---         |
+| `clientCIDR` | _string array_ |  true  | ClientCIDR contains client cidr configuration.<br />Valid examples are "192.168.1.0/24" or "2001:db8::/64" |
+
+
 #### TCPActiveHealthChecker