opa-authz-read-only-outside.yaml

apiVersion: authorino.kuadrant.io/v1beta1
kind: AuthConfig
metadata:
  name: talker-api-protection
spec:
  hosts:
  - talker-api.127.0.0.1.nip.io
  identity:
  - name: friends
    apiKey:
      selector:
        matchLabels:
          group: friends
    credentials:
      in: authorization_header
      keySelector: APIKEY
  authorization:
  - name: read-only-outside
    opa:
      inlineRego: |
        ips := split(input.context.request.http.headers["x-forwarded-for"], ",")
        trusted_network { regex.match(`192\.168\.1\.\d+`, ips[0]) }

        allow { trusted_network }
        allow { not trusted_network; input.context.request.http.method == "GET" }
---
apiVersion: v1
kind: Secret
metadata:
  name: api-key-1
  labels:
    authorino.kuadrant.io/managed-by: authorino
    group: friends
stringData:
  api_key: ndyBzreUzF4zqDQsqSPMHkRhriEOtcRx
type: Opaque