Skip to main content

Enforce the Ingress Policy
ENTERPRISE

You can see the policies in place for your Envoy system in its app, egress, and ingress folders.

  • For app policy type, click your Envoy system to expand the policy folder >> app >> rules.rego to see the application rules for your Envoy system.

  • For egress policy type, click your Envoy system to expand the policy folder >> egress >> rules.rego to see the egress rules for your Envoy system.

  • For ingress policy type, click your Envoy system to expand the policy folder >> ingress >> rules.rego to see the ingress rules for your Envoy system.

The client-load deployment repeatedly executes the following HTTP calls in an interval of 30 seconds, pretending to be different users to help generate sample data for visualization.

curl --user alice:password example-app/finance/salary/alice
curl --user bob:password example-app/finance/salary/alice
curl --user bob:password example-app/finance/salary/charlie
curl --user david:password example-app/finance/salary/bob
curl --user david:password example-app/hr/dashboard
curl --user eve:password example-app/admin
curl -is httpbin.org/anything;

By default, all policies allow traffic to the service with Envoy data plane as sidecar container. You could click on Decisions tab for the Envoy system created and verify all the Allowed decisions.

The Envoy system Quick Start provides a link to replace the sample Ingress policy. With this Ingress policy published, example-app can receive Ingress traffic only on the whitelisted endpoint /finance/salary. Switch to Decisions tab and verify traffic to path /hr/dashboard and /admin are Denied.