diff --git a/kubernetes/customresourcedefinitions.gen.yaml b/kubernetes/customresourcedefinitions.gen.yaml index dcde14a27f..d90898e866 100644 --- a/kubernetes/customresourcedefinitions.gen.yaml +++ b/kubernetes/customresourcedefinitions.gen.yaml @@ -17229,6 +17229,15 @@ spec: description: This field specifies the header name to output a successfully verified JWT payload to the backend. type: string + presence: + description: |- + Configures whether the JWT token must be present in the request. + + Valid Options: OPTIONAL, REQUIRED + enum: + - OPTIONAL + - REQUIRED + type: string spaceDelimitedClaims: description: List of JWT claim names that should be treated as space-delimited strings. @@ -17518,6 +17527,15 @@ spec: description: This field specifies the header name to output a successfully verified JWT payload to the backend. type: string + presence: + description: |- + Configures whether the JWT token must be present in the request. + + Valid Options: OPTIONAL, REQUIRED + enum: + - OPTIONAL + - REQUIRED + type: string spaceDelimitedClaims: description: List of JWT claim names that should be treated as space-delimited strings. diff --git a/releasenotes/notes/jwt-required-field.yaml b/releasenotes/notes/jwt-required-field.yaml new file mode 100644 index 0000000000..7547c079f6 --- /dev/null +++ b/releasenotes/notes/jwt-required-field.yaml @@ -0,0 +1,13 @@ +apiVersion: release-notes/v2 +kind: feature +area: security +issue: + - https://github.com/istio/istio/issues/60823 + +releaseNotes: + - | + **Added** `presence` field in `RequestAuthentication` under `spec.jwtRules` to configure + whether a JWT token is required (`REQUIRED`) or optional (`OPTIONAL`, default). + When set to `REQUIRED`, requests missing the token are rejected with 401 even if other + JWT rules are satisfied, enabling configurations where all tokens must be present and valid simultaneously. + The default behavior is `OPTIONAL`, which allows requests to pass if at least one JWT rule is satisfied, even if others are missing or invalid (current behavior). diff --git a/security/v1/request_authentication_alias.gen.go b/security/v1/request_authentication_alias.gen.go index a0ea1dc617..baf9944eac 100644 --- a/security/v1/request_authentication_alias.gen.go +++ b/security/v1/request_authentication_alias.gen.go @@ -71,6 +71,17 @@ type RequestAuthentication = v1beta1.RequestAuthentication // +kubebuilder:validation:XValidation:message="only one of jwks or jwksUri can be set",rule="oneof(self.jwksUri, self.jwks_uri, self.jwks)" type JWTRule = v1beta1.JWTRule +// Specifies whether the JWT token is required or optional in the request. +type JWTRule_JWTRequirement = v1beta1.JWTRule_JWTRequirement + +// The JWT token is optional. Requests without a token are allowed as long as +// no invalid token is present. This is the default behavior. +const JWTRule_OPTIONAL JWTRule_JWTRequirement = v1beta1.JWTRule_OPTIONAL + +// The JWT token must be present and valid. Requests without this token will +// be rejected with 401 even if other JWT rules are satisfied. +const JWTRule_REQUIRED JWTRule_JWTRequirement = v1beta1.JWTRule_REQUIRED + // This message specifies a header location to extract JWT token. type JWTHeader = v1beta1.JWTHeader diff --git a/security/v1beta1/request_authentication.pb.go b/security/v1beta1/request_authentication.pb.go index 0e3b1d932e..3e8348b0c8 100644 --- a/security/v1beta1/request_authentication.pb.go +++ b/security/v1beta1/request_authentication.pb.go @@ -243,6 +243,57 @@ const ( _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) ) +// Specifies whether the JWT token is required or optional in the request. +type JWTRule_JWTRequirement int32 + +const ( + // The JWT token is optional. Requests without a token are allowed as long as + // no invalid token is present. This is the default behavior. + JWTRule_OPTIONAL JWTRule_JWTRequirement = 0 + // The JWT token must be present and valid. Requests without this token will + // be rejected with 401 even if other JWT rules are satisfied. + JWTRule_REQUIRED JWTRule_JWTRequirement = 1 +) + +// Enum value maps for JWTRule_JWTRequirement. +var ( + JWTRule_JWTRequirement_name = map[int32]string{ + 0: "OPTIONAL", + 1: "REQUIRED", + } + JWTRule_JWTRequirement_value = map[string]int32{ + "OPTIONAL": 0, + "REQUIRED": 1, + } +) + +func (x JWTRule_JWTRequirement) Enum() *JWTRule_JWTRequirement { + p := new(JWTRule_JWTRequirement) + *p = x + return p +} + +func (x JWTRule_JWTRequirement) String() string { + return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x)) +} + +func (JWTRule_JWTRequirement) Descriptor() protoreflect.EnumDescriptor { + return file_security_v1beta1_request_authentication_proto_enumTypes[0].Descriptor() +} + +func (JWTRule_JWTRequirement) Type() protoreflect.EnumType { + return &file_security_v1beta1_request_authentication_proto_enumTypes[0] +} + +func (x JWTRule_JWTRequirement) Number() protoreflect.EnumNumber { + return protoreflect.EnumNumber(x) +} + +// Deprecated: Use JWTRule_JWTRequirement.Descriptor instead. +func (JWTRule_JWTRequirement) EnumDescriptor() ([]byte, []int) { + return file_security_v1beta1_request_authentication_proto_rawDescGZIP(), []int{1, 0} +} + //