UNCLASSIFIED - NO CUI

Skip to content

Authorization Policy Naming Conventions

When generating a wildcard authorization policy using bb-common the resulting name throws an error upon deployment:

* AuthorizationPolicy.security.istio.io "allow-ingress-to-tempo-tcp-port-9411-from-any-ns-any-pod-from-ns-*" is invalid: metadata.name: Invalid value: "allow-ingress-to-tempo-tcp-port-9411-from-any-ns-any-pod-from-ns-*": a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')

For some reason, it templates just fine, but the deployment is a different situation. The name of the authorization policy is clear enough that we can probably just remove the trailing * character altogether.