# ext_authz for the whole PUBLIC gateway. Every public listener is checked
# against CrowdSec decisions and AppSec before the request reaches a backend.
#
# Scope is the entire Gateway because EG v1.3.2 rejects targetRefs.sectionName
# on SecurityPolicy ("this policy does not yet support the sectionName field").
# Targeting the HTTPRoute instead is not an option: public routes also parent
# gateway-internal, so that would gate LAN traffic too.
#
# failOpen: true -> if the bouncer is unreachable, requests are allowed through
# (a bouncer outage must not take every public service down).
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: crowdsec-gateway-public
  namespace: envoy-gateway
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: gateway-public
  extAuth:
    failOpen: true
    grpc:
      backendRefs:
        - group: ""
          kind: Service
          name: crowdsec-envoy-bouncer
          namespace: crowdsec
          port: 8080