Skip to main content

Enforce the Ingress Policy on a Kong Mesh System

The following policies are automatically installed when you add the Kong Mesh system.

The client-load application is installed along with the sample-app and executes the following HTTP calls in an interval of 15 seconds, pretending to be different users to generate sample data for visualization.

The following policies are automatically installed when you add a Kong Mesh System.

You can see the policies in place for your Kong Mesh System in the app, egress, and ingress folders.

  • For the app policy type, from your Kong Mesh System expand policy > app > rules.rego to see the application rules.
  • For the egress policy type, from your Kong Mesh System expand policy > egress > rules.rego to see the egress rules.
  • For ingress policy type, from your Kong Mesh System expand policy > ingress > rules.rego to see the ingress rules.

The client-load deployment repeatedly executes the following HTTP calls in an interval of 30 seconds, pretending to be different users to help generate sample data for visualization.

curl --user alice:password example-app/finance/salary/alice
curl --user bob:password example-app/finance/salary/alice
curl --user bob:password example-app/finance/salary/charlie
curl --user david:password example-app/finance/salary/bob
curl --user david:password example-app/hr/dashboard
curl --user eve:password example-app/admin

By default, all policies allow traffic to the service with Kong Mesh data plane sidecar container. Click on the Decisions tab to verify all decisions are Allowed for the newly created Kong Mesh system.

The Kong Mesh system Quick Start provides a link to replace the sample ingress policy. With this ingress policy published, example-app can receive ingress traffic only on the allowed list of endpoint /finance/salary. Switch to Decisions tab and verify traffic to path /hr/dashboard and /admin are Denied.