SecurityPolicy (strategicmerge) Composition does not work

[johnvox]

Description:
What I want to aeheive is the following:

1. Setup OIDC Authentication at the Gateway Level
2. Setup Authorization at the Route Level

Here the example:

---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: oidc
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: gateway
  oidc:
    provider:
      issuer: https://login.microsoftonline.com/-/v2.0
    clientID: -
    clientSecret:
      name: envoy-client-secret
    forwardAccessToken: false
    redirectURL: https://oidc.example.com/oauth2/callback
    cookieDomain: example.com
    cookieNames:
      accessToken: EnvoyAccessToken
      idToken: EnvoyIdToken
  jwt:
    providers:
      - name: entra
        issuer: https://login.microsoftonline.com/-/v2.0
        remoteJWKS:
          uri: https://login.microsoftonline.com/-/discovery/v2.0/keys
        extractFrom:
          cookies:
            - EnvoyIdToken

---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: argocd
spec:
  mergeType: StrategicMerge  
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: argocd
  authorization:
    defaultAction: Deny
    rules:
      - name: "allow-jwt-claim"
        action: Allow
        principal:
          jwt:
            provider: entra
            claims:
              - name: roles
                valueType: "StringArray"
                values:
                  - "argocd"

I assume that a the end the resulting security policy should be

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: argocd
spec:
  mergeType: StrategicMerge  
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: argocd
  authorization:
    defaultAction: Deny
    rules:
      - name: "allow-jwt-claim"
        action: Allow
        principal:
          jwt:
            provider: entra
            claims:
              - name: roles
                valueType: "StringArray"
                values:
                  - "argocd"
  oidc:
    provider:
      issuer: https://login.microsoftonline.com/-/v2.0
    clientID: -
    clientSecret:
      name: envoy-client-secret
    forwardAccessToken: false
    redirectURL: https://oidc.example.com/oauth2/callback
    cookieDomain: example.com
    cookieNames:
      accessToken: EnvoyAccessToken
      idToken: EnvoyIdToken
  jwt:
    providers:
      - name: entra
        issuer: https://login.microsoftonline.com/-/v2.0
        remoteJWKS:
          uri: https://login.microsoftonline.com/-/discovery/v2.0/keys
        extractFrom:
          cookies:
            - EnvoyIdToken                  

However it's not working.

[johnvox]

Don't know if what I want of achieve is doable / valid / antipattern

[johnvox]

Good day, did anyone have an answers to that topic ? thank you

[arkodg]

cc @kkk777-7 @rudrakhp

[kkk777-7]

Hi @johnvox , could you share the followings?

• Envoy Gateway version
• Policy resources status, Gateway/HTTPRoute manifest

[johnvox]

Hello please find manifest withn private data stripped
Envoy GW Version: envoyproxy/gateway:v1.8.2

---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: srm-gateway-compose
  namespace: srm-backbone
spec:
  gatewayClassName: srm-envoy-gateway
  allowedListeners:
    namespaces:
      from: All
  listeners:
  - name: http
    protocol: HTTP
    hostname: '*.kubecompose.srm.example.com'
    port: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: ListenerSet
metadata:
  name: oidc-listener-compose
  namespace: srm-backbone  
  annotations:
    cert-manager.io/issuer-kind: ClusterAdcsIssuer
    cert-manager.io/issuer-group: adcs.certmanager.csf.nokia.com
    cert-manager.io/issuer: adcs-cluster-issuer   
spec:
  listeners:
  - allowedRoutes:
      namespaces:
        from: All
    hostname: oidcgw.kubecompose.srm.example.com
    name: oidc-compose
    port: 443
    protocol: HTTPS
    tls:
      certificateRefs:
      - group: ""
        kind: Secret
        name: oidc-composehttps
      mode: Terminate      
  parentRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: srm-gateway-compose
    namespace: srm-backbone
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: oidc-compose
  namespace: srm-backbone
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: srm-gateway-compose
  oidc:
    provider:
      issuer: https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/v2.0
    clientID: 00000000-0000-0000-0000-000000000000
    clientSecret:
      name: envoy-client-secret
    forwardAccessToken: false
    redirectURL: https://oidcgw.kubecompose.srm.example.com/oauth2/callback
    cookieDomain: kubecompose.srm.example.com
    cookieNames:
      accessToken: EnvoyAccessToken
      idToken: EnvoyIdToken
  jwt:
    providers:
      - name: entra
        issuer: https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/v2.0
        remoteJWKS:
          uri: https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/discovery/v2.0/keys
        extractFrom:
          cookies:
            - EnvoyIdToken
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: oidc-srm-redirect-compose
  namespace: srm-backbone  
spec:
  hostnames:
    - oidcgw.kubecompose.srm.example.com
  parentRefs:
    - name: oidc-listener-compose
      kind: ListenerSet
  rules:
    - matches:
        - path:
            type: Exact
            value: /oauth2/callback
      filters:
      - type: ExtensionRef
        extensionRef:
          group: gateway.envoyproxy.io
          kind: HTTPRouteFilter
          name: oidc-srm-redirect-compose
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: HTTPRouteFilter
metadata:
  name: oidc-srm-redirect-compose
  namespace: srm-backbone  
spec:
  directResponse:
    contentType: text/plain
    statusCode: 200
    body:
      type: Inline
      inline: "OK"
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-route-from-backbone-compose
  namespace: fleet-argocd
spec:
  from:
  - group: gateway.networking.k8s.io
    kind: HTTPRoute
    namespace: srm-backbone
  to:
  - group: ""
    kind: Service
---
apiVersion: gateway.networking.k8s.io/v1
kind: ListenerSet
metadata:
  annotations:
    cert-manager.io/issuer: adcs-cluster-issuer
    cert-manager.io/issuer-group: adcs.certmanager.csf.nokia.com
    cert-manager.io/issuer-kind: ClusterAdcsIssuer
  name: argocd-compose
  namespace: srm-backbone
spec:
  listeners:
  - allowedRoutes:
      namespaces:
        from: All
    hostname: argocd.kubecompose.srm.example.com
    name: argocd-composehttps
    port: 443
    protocol: HTTPS
    tls:
      certificateRefs:
      - group: ""
        kind: Secret
        name: argocd-composehttps
      mode: Terminate      
  parentRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: srm-gateway-compose
    namespace: srm-backbone
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: argocd-compose
  namespace: srm-backbone
  annotations:
    gethomepage.dev/enabled: "true"
    gethomepage.dev/description: ArgoCD
    gethomepage.dev/group: Backbone
    gethomepage.dev/icon: argo-cd.png
    gethomepage.dev/name: ArgoCD
    gethomepage.dev/href: https://argocd.kubecompose.srm.example.com
    gethomepage.dev/external: "true"
    gethomepage.dev/siteMonitor: http://fleet-argocd-server.fleet-argocd.svc.cluster.local:80
spec:
  parentRefs:
    - name: argocd-compose
      kind: ListenerSet
  hostnames:
    - argocd.kubecompose.srm.example.com
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: fleet-argocd-server
          namespace: fleet-argocd
          port: 80
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: argocd-compose
  namespace: srm-backbone
spec:
  mergeType: StrategicMerge  
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: argocd-compose
  # Without jwt key got following issue 
  # The SecurityPolicy "argocd-compose" is invalid: spec: Invalid value: if authorization.rules.principal.jwt is used, jwt must be defined
  # It Could be great
  jwt:
    providers:
    - name: k8s
      remoteJWKS:
        uri: https://kubernetes.default/.well-known/openid-configuration
  authorization:
    defaultAction: Deny
    rules:
      - name: "allow-jwt-claim"
        action: Allow
        principal:
          jwt:
            provider: k8s
            claims:
              - name: roles
                valueType: "StringArray"
                values:
                  - "argoxcd"

[arkodg]

cc @zirain
relates to #9054

[rudrakhp]

I think ListenerSet support was added in #9270 that should fix this. It has not been back-ported in any 1.8.x release though, scheduled in 1.9.0 release.

[jimmyjones2]

I'm seeing something similar - not sure if #9722 is a dupe or slightly different?