From 3451b755d4ac3f832b000fced29c7d6ad6b1ddb4 Mon Sep 17 00:00:00 2001 From: Jeffrey Smeets Date: Wed, 26 Aug 2026 17:31:19 +0200 Subject: [PATCH] envoy-gateway: enable CrowdSec ext_authz on the public gateway Wires crowdsec/gateway-public-securitypolicy.yaml into the kustomization now that LAPI, AppSec and the bouncer are all healthy and the envoy bouncer is registered with LAPI. Covers every listener on gateway-public rather than just one app, since EG v1.3.2 rejects targetRefs.sectionName on SecurityPolicy. gateway-internal is a separate Gateway and is untouched, so LAN access is unaffected. failOpen is true, so a bouncer outage lets traffic through instead of denying it. --- infra/envoy-gateway/kustomization.yaml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/infra/envoy-gateway/kustomization.yaml b/infra/envoy-gateway/kustomization.yaml index 9a8dfa7..1fd8c41 100644 --- a/infra/envoy-gateway/kustomization.yaml +++ b/infra/envoy-gateway/kustomization.yaml @@ -6,10 +6,9 @@ resources: - gateway.yaml - gateway-public.yaml - # CrowdSec (public gateway hardening) — HELD pending enforcement-scope decision - # (EG v1.3.2 SecurityPolicy does not support sectionName; see it-tools-securitypolicy.yaml) - # - crowdsec/envoyproxy-public.yaml - # - crowdsec/it-tools-securitypolicy.yaml + # CrowdSec ext_authz on the whole public gateway (sectionName scoping is + # unsupported on EG v1.3.2; envoyproxy-public.yaml is not needed, see its header) + - crowdsec/gateway-public-securitypolicy.yaml # Policies - pelican/pelican-wings-clienttrafficpolicy.yaml