Additional Configuration Settings

Additional Configuration Information

Support PDP JWT

Example

samples/sidecar-echo.yaml (example of microservice sidecar configuration)

apiVersion: authz.plainid.io/v1
kind: PlainidSidecar
metadata:
  name: echo
spec:
  workloadSelector:
    labels:
      app: echo
  sidecarConfig:
    matchers: # API Matchers section (Optional)
      - match: /echo/bypass                                   # Request path pattern
        method: # Request methods
          - POST
          - GET
        bypass: true                                          # Bypass request (ignore all validations and authorization) 
      - match: /echo/:abc
        runtime: # Specific runtime configuration for matching requests 
          entityTypeid: jwt
          cacheTime: 11s
        mode: # Specific mode configuration for matching requests
          entitlement: true
          format: 5
          flat: false
          denyOnEmpty: true
      - match: /echo
        runtime:
          entityTypeid: jwt
          cacheTime: 11s
          clientId: PCTPBVXSCXINRLCKLDNFX
          clientSecret: qw66NNZTw98(*.jtzPZXBZvbA3a+T1Huc(7nIhla
          environments:
            amount: "$.body.amount"
            account: "$.body.account"
            url: $.path.[0]
        mode:
          resolution: true
          format: 5
          flat: false
          denyOnEmpty: true
    runtime:
      clientId: PHMW79EBNUCWO4NLGLPE                         # Mandatory: From Policy Manager Management UI
      clientSecret: 8xPReuKhkTXCo4n1ymDkSY7oAsBNkCJGyE7jkKMV # From Policy Manager Management UI, if no Secret store used 
      entityTypeid: jwt
      plainidUrl: https://demo.plainid.cloud                 # Mandatory: PDP URL, Should be set
      resourceTypes: # Asset mappings example (only for PDP API v1-4)
        - name: Accounts
          assetPath: $.path[4]
        - name: Loans
      environments:
        amount: "$.body.amount"
        account: "$.path[2]"
        url: $.path.[0]
      accessTokenFormat: JWT                                # Policy decision format
      passIncomingJwt: true                                 # to pass the IDP JWT as-is to the PDP
    jwt: # Mandatory: External request JWT configuration
      header: authorization
      allowed:
        - name: demo.plainid.cloud                          # Mandatory: JWT Issuer example
        - name: demo                                        # Mandatory: JWT Issuer mapping example in case of JWT issuer do not match an issuer provided by Auth service
          mapped: https://demo.plainid.cloud/auth/realms/demo
      userClaim: "$.user.preferred_username[0]"
      validateJwt: true
      algs: # List of supported Signing Algorithms (RS256 by default if not set)
        - ES256
        - RS256
      authorizationHeaderName: Authorization                # JWT Header key/name in case of accessTokenFormat is JWT or StandardJWT
      authorizationTokenType: Bearer                        # JWT Header prefix in case of accessTokenFormat is JWT or StandardJWT
    mode: # Mandatory: Operation mode, ONLY ONE OF SHOULD BE TRUE: decision/entitlement/resolution/denyOnEmpty
      decision: true                                        # PERMIT/DENY Mode
      entitlement: false                                    # Header Injection mode
      resolution: false                                     # Header injection mode Query format
      denyOnEmpty: false                                    # DENY transaction when no policy fits the access request.
      format: 2
    logger:
      logLevel: debug
      detailedLog: false
      format: text
    tlsSkip: true
    grpc:
      servicePort: "7001"

Override Default Configuration

The helm install command accepts parameters to override default configuration values inline or that are defined in a
file.

1. Example – To override the configuration found in the file:
   cat override-values.yml

runtime:
  debugLevel: info
  replicas: 5

helm install sidecar-test1 ./ --values override-values.yml

Sample values.yaml

Note: For versions 4.x, you should remove the following from the values.yaml configuration file:
pdpAPIVersion: v5 #Optional: PDP Runtime API v5 integration

# Please Generate  Public key, Private key, and  Certificate Chain
# Based on the documentation provided by PlainID and place in values under webhook file names should match the example files  in the chart
image:
  pullPolicy: Always
imagePullSecrets:
  - name: cr-creds
nameOverride: ""
fullnameOverride: ""
serviceAccount: plainid
podSecurityContext: { }
operator:
  image:
    repository: "docker.io/plainid/authz-operator"
    tag: "1.6.0"
  namespace: plainid-system
  resources:
    limits:
      cpu: 100m
      memory: 100Mi
    requests:
      cpu: 100m
      memory: 20Mi
  replicas: 1
  debug: true
redis:
  local: true
  image: redis
  port: 6379
  pass: ""
  tls: false
  masterhost: test-plainid-redis-ro.plainid    # Administration point address
securityContext:
  capabilities:
    drop:
      - ALL
  runAsNonRoot: true
  runAsUser: 1000610001
webhook:
  enabled: true
  selfCert: true # If false, please set the values for certificates below
  # for your certificate please set the following values. Values should be encoded to base64
  bundle:
  crt:
  key:
auth: # Optional: Secret store configuration
  file: "/keys/key"
  iss: "ruleengine"
  exp: 10s
pdpAPIVersion: v5                            #Optional: PDP Runtime API v5 integration
authorizer:
  id: test-authorizer                         # Mandatory: Should be updated
  version: 1.2.3
moreVolumes: # Optional: Extra volumes configuration
  - name: key-config
    configMap:
      name: key-config
nodeSelector: { }
tolerations: [ ]
affinity: { }

Following are the optional keys and values for the values.yaml file.

Operator

Redis

Auth

GRPC Support

The PlainID sidecar supports GRPC (Google Remote Procedure Call) parsing. This capability can be achieved in different
ways:

• Auto learning
• Providing a Protocol Buffer (protobuf) descriptor file

Auto Learning

To support auto learning, the Application Developer should be enabled GRPC reflection on the server side (backend). In
the sidecar configuration YAML, the service port should be defined. Example

grpc:
  servicePort: "7001"

Providing a protobuf Descriptor File

Providing a protobuf descriptor file can be accomplished in one of the following ways:

Multiple Descriptors

It is possible to include multiple descriptors. You can use the same image for all the services. To use the same image
for multiple descriptors:

1. Change the PlainidInjector yaml to provide a new image tag.
2. In the plainidsidecar.yaml file, provide the path to the relevant descriptor file.

HTTP Support

The PlainID Authorizer Sidecar supports HTTP connection. We should define a listener for HTTP connection:

http:
  listener: 127.0.0.1:50080

grpc: protoFile: "/proto/demo.pb"