yc-k8s-test: istio ingress — запрет снаружи /api/token/user/* и /internal/* (п. 14, 15)

infrastructure/istio-config/yc-k8s-test/deny-token-endpoints.yaml

@@ -0,0 +1,16 @@
+apiVersion: security.istio.io/v1
+kind: AuthorizationPolicy
+metadata:
+  name: deny-external-token-endpoints
+  namespace: istio-system
+spec:
+  selector:
+    matchLabels:
+      istio: ingressgateway
+  action: DENY
+  rules:
+    - to:
+        - operation:
+            paths:
+              - /api/token/user/*
+              - /internal/*

infrastructure/istio-config/yc-k8s-test/kustomization.yaml

@@ -2,5 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+  - deny-token-endpoints.yaml
 patches:
   - path: istio-config.yaml