From 0a740955b1059f2c9eb461d8d9f7c4a953d60b3e Mon Sep 17 00:00:00 2001
From: ivan <ivan@MacBook-Air-som-tillhor-ivan.local>
Date: Thu, 5 Nov 2026 20:10:23 +0500
Subject: [PATCH] =?UTF-8?q?yc-k8s-test:=20istio=20ingress=20=E2=80=94=20?=
 =?UTF-8?q?=D0=B7=D0=B0=D0=BF=D1=80=D0=B5=D1=82=20=D1=81=D0=BD=D0=B0=D1=80?=
 =?UTF-8?q?=D1=83=D0=B6=D0=B8=20/api/token/user/*=20=D0=B8=20/internal/*?=
 =?UTF-8?q?=20(=D0=BF.=2014,=2015)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../yc-k8s-test/deny-token-endpoints.yaml        | 16 ++++++++++++++++
 .../istio-config/yc-k8s-test/kustomization.yaml  |  1 +
 2 files changed, 17 insertions(+)
 create mode 100644 infrastructure/istio-config/yc-k8s-test/deny-token-endpoints.yaml

diff --git a/infrastructure/istio-config/yc-k8s-test/deny-token-endpoints.yaml b/infrastructure/istio-config/yc-k8s-test/deny-token-endpoints.yaml
new file mode 100644
index 0000000..dd2131c
--- /dev/null
+++ b/infrastructure/istio-config/yc-k8s-test/deny-token-endpoints.yaml
@@ -0,0 +1,16 @@
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: deny-external-token-endpoints
+  namespace: istio-system
+spec:
+  selector:
+    matchLabels:
+      istio: ingressgateway
+  action: DENY
+  rules:
+    - to:
+        - operation:
+            paths:
+              - /api/token/user/*
+              - /internal/*
diff --git a/infrastructure/istio-config/yc-k8s-test/kustomization.yaml b/infrastructure/istio-config/yc-k8s-test/kustomization.yaml
index 894c51a..f5072f8 100644
--- a/infrastructure/istio-config/yc-k8s-test/kustomization.yaml
+++ b/infrastructure/istio-config/yc-k8s-test/kustomization.yaml
@@ -2,5 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+  - deny-token-endpoints.yaml
 patches:
   - path: istio-config.yaml