Sidecar Configuration

Custom Resource Definitions

PlainidInjector

The PlainidInjector CRD provides a mechanism to inject the PlainID Authorizer into a pod.

Sample authz-v1-plainidinjector.yaml

apiVersion: authz.plainid.io/v1
kind: PlainidInjector
metadata:
  name: plainidinjector-sample
spec:
  volume:
    name: podinfo
    downwardAPI:
      items:
        - path: "labels"
          fieldRef:
            fieldPath: metadata.labels
        - path: "annotations"
          fieldRef:
            fieldPath: metadata.annotations
  container:
    name: plainid-authz
    image: docker.io/plainid/authz-envoy-sidecar:1.6.0
    resources:
      requests:
        cpu: "0.05"
        memory: "50M"
      limits:
        cpu: "0.2"
    imagePullPolicy: Always
    ports:
      - containerPort: 50051
      - containerPort: 9090
    volumeMounts:
      - name: podinfo
        mountPath: /config
    env:
      - name: POD_NAME
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.name
      - name: POD_NAMESPACE
        valueFrom:
          fieldRef:
            apiVersion: v1
            fieldPath: metadata.namespace
  config:
    params:
      mgr: plainid-controller-manager-discover.plainid-system:16000
      SKIP_TLS_VERIFY: "true"

The following table lists the keys that should be updated in the authz-v1-plainidinjector.
All remaining text should be the default value.

PlainidSidecar

The PlainidSidecar CRD provides a mechanism to customize the Sidecar configuration generated by the operator. Use the
PlainidSidecar CRD to modify values for certain fields and define the specific behavior of the Sidecar.
*This feature must be used with care, as incorrect configurations could potentially destabilize the Sidecar and the service. *
Apply configuration by workload selectors and namespaces. The following example applies to all workloads with the label
app:echo in a namespace test.

Sample sidecar-echo.yaml

Following is an example of a microservice sidecar configuration file.

apiVersion: authz.plainid.io/v1
kind: PlainidSidecar
metadata:
  name: echo
spec:
  workloadSelector:
    labels:
      app: echo
  sidecarConfig:
    matchers: # API Matchers section (Optional)
      - match: /echo/bypass# Request path pattern
        method: # Request methods
          - POST
          - GET
        bypass: true       # Bypass request (ignore all validations and authorization) 
      - match: /echo/:abc
        runtime: # Specific runtime configuratoin for matching requests 
          entityTypeid: jwt
          cacheTime: 11s
        mode: # Specific mode configuratoin for matching requests
          entitlement: true
          format: 5
          flat: false
          denyOnEmpty: true
      - match: /echo
        runtime:
          entityTypeid: jwt
          cacheTime: 11s
          clientId: client_id_goes_here
          clientSecret: client_secret_goes_here
          environments:
            amount: "$.body.amount"
            account: "$.body.account"
            url: $.path.[0]
        mode:
          resolution: true
          format: 5
          flat: false
          denyOnEmpty: true
    runtime:
      clientId: client_id_goes_here           # Mandatory: From Policy Manager Management UI
      clientSecret: client_secret_goes_here   # From Policy Manager Management UI, if no Secret store used 
      entityTypeid: jwt
      plainidUrl: https://demo.plainid.cloud  # Mandatory: PDP URL, Should be set
      resourceTypes: # Asset mappings example (only for PDP API v1-4)
        - name: Accounts
          assetPath: $.path[4]
        - name: Loans
      environments:
        amount: "$.body.amount"
        account: "$.path[2]"
        url: $.path.[0]
      options:
        includeDetails: true
        includeAccessPolicy: true
        includeAssetAttributes: true
        includeIdentity: true
        includeDenyReason: true
    jwt: # Mandatory: External request JWT configuration
      header: authorization
      allowed:
        - name: demo.plainid.cloud            # Mandatory: JWT Issuer example
        - name: demo                          # Mandatory: JWT Issuer mapping example in case of JWT issuer do not match an issuer provided by Auth service
          mapped: https://demo.plainid.cloud/auth/realms/demo
      userClaim: "$.user.preferred_username[0]"
      validateJwt: true
      algs: # List of supported Signing Algorythms (RS256 by default if not set)
        - ES256
        - RS256
    mode: # Mandatory: Operation mode, ONLY ONE OF SHOULD BE TRUE: decision/entitlement/resolution/denyOnEmpty
      decision: true     # PERMIT/DENY Mode
      entitlement: false # Header Injection mode
      resolution: false  # Header injection mode Query format
      denyOnEmpty: false # DENY transaction when no policy fits the access request.
      format: 2
    logger:
      logLevel: debug
      detailedLog: false
      format: text
    tlsSkip: true
    grpc:
      servicePort: "7001"

ResourceTypes

Request Parts Locations

Operation Modes

The Platform sidecar supports three operation modes:

• Decision – a basic Permit/Deny mode that enables or blocks the transaction.
• Entitlements – an advanced mode that can enrich the request header with a list of entitlements or any authorization supporting data.
• Resolution – an advanced mode that can enrich the request header with a “policy resolution” decision - JSON or SQL filtering for data.
  For more information on these options, refer to the Authorization APIs in the Developer Portal.

Example

Request Sample

Mapping Sample