apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: ml-pipeline-ui
  namespace: kubeflow
spec:
  rules:
    ## allow requests from `deploykf-istio-gateway` Pods
    - from:
        - source:
            principals:
              - "cluster.local/ns/{{< .Values.deploykf_core.deploykf_istio_gateway.namespace >}}/sa/{{< .Values.deploykf_core.deploykf_istio_gateway.gatewayDeployment.serviceAccount.name >}}"
      to:
        - operation:
            ports:
              - "3000"

    ## allow requests from anywhere if the "authorization" HTTP header is set AND the "kubeflow-userid" is NOT set
    ##
    ## this allows access from within the cluster to the Kubeflow Pipelines REST API when an authorization token is
    ## passed in the "authorization" header, but prevents setting a "kubeflow-userid" header, which should only be
    ## set by traffic coming from the istio gateway
    - when:
        - key: request.headers[authorization]
          values:
            - "*"
        - key: request.headers[kubeflow-userid]
          notValues:
            - "*"
      to:
        - operation:
            ports:
              - "3000"
