RouteAuthFilter configuration reference

This topic provides reference information for the HTTP route auth filter resource, which defines authorization filter configurations for specific routes in Consul service mesh on Kubernetes-orchestrated networks.

Configuration model

The following list outlines field hierarchy, data types, and requirements in an HTTP route auth filter resource. Click on a property name to view additional details, including default values.

• apiVersion: string | required | must be set to consul.hashicorp.com/v1alpha1
• kind: string | required | must be set to RouteAuthFilter
• metadata: map | required
  • name: string | required
  • namespace: string | default
• spec: map | required
  • jwt: map | required
    • providers: list | required
      • name: string | required
      • verifyClaims: map | required
        • path: list of strings | required
        • value: string | required

Complete configuration

When every field is defined, an HTTP route auth filter has the following form:

Specification

This section provides details about the fields you can configure in the HTTP route auth filter resource.

apiVersion

Specifies the version of the Consul API for integrating with Kubernetes. The value must be consul.hashicorp.com/v1alpha1.

Values

• Default: None
• This field is required.
• String value that must be set to consul.hashicorp.com/v1alpha1.

kind

Specifies the type of configuration entry to implement. Must be set to RouteAuthFilter.

Values

• Default: None
• This field is required.
• Data type: String value that must be set to RouteAuthFilter.

metadata

Map that contains an arbitrary name for the resource and the namespace it applies to.

Values

• Default: None
• Data type: Map

metadata.name

Specifies a name for the resource. The name is metadata that you can use to reference the resource when performing Consul operations, such as applying the resource to a specific cluster.

Values

• Default: None
• This field is required.
• Data type: String

metadata.namespace

Specifies the namespace that the configuration applies to. Refer to Namespaces for more information.

Values

• Default: default
• Data type: String

spec

Map that contains the details about the HTTP route auth filter. The apiVersion, kind, and metadata fields are siblings of the spec field. All other configurations are children.

Values

• Default: None
• This field is required.
• Data type: Map

spec.jwt

Map that contains JWT verification configurations to apply to listeners when the filter is attached to the route. These route-specific settings have precedence over the default configurations, but not override JWT configurations, that are defined in the GatewayPolicy resource.

Values

• Default: None
• Data type: Map

spec.jwt.providers

Specifies a list of JWT provider configurations to apply to listeners when the filter is attached to the route. A provider configuration contains the name of the provider and claims. The route-specific settings have precedence over the default configurations, but not override configurations, that are defined in the GatewayPolicy resource. Refer to Use JWTs to verify requests to API gateways on Kubernetes for additional information.

Values

• Default: None
• Data type: List of maps

The following table describes the parameters you can specify in a member of the providers list:

Example configuration

In the following example, requests sent to HTTP routes attached to the filter must have admin permissions.

apiVersion: consul.hashicorp.com/v1alpha1
kind: RouteAuthFilter
metadata:
    name: example-route-jwt-filter
    namespace: default
spec:
    JWT:
      Providers:
        - Name: "okta"
          VerifyClaims:
          - Path:
            - "roles"
            - "perm"
            Value: "admin"