Skip to content

update topaz config new #742

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aserto-bot merged 6 commits into from
Jul 11, 2026
Merged

update topaz config new #742

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
4775a5e
Add aserto_edge plugin config doc
gertd Jul 11, 2026
dabf347
rm aserto related allowed_origins
gertd Jul 11, 2026
ff6bf27
rm aserto related allowed_origins
gertd Jul 11, 2026
b597da0
partition template script
gertd Jul 11, 2026
4f50ead
unify --force short to -f
gertd Jul 11, 2026
e349405
two minor text and format fixes
gertd Jul 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 20 additions & 12 deletions docs/config.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,8 +189,6 @@ api:
- https://localhost
- https://localhost:*
- https://0.0.0.0:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: '${TOPAZ_CERTS_DIR}/gateway.key'
tls_cert_path: '${TOPAZ_CERTS_DIR}/gateway.crt'
Expand Down Expand Up @@ -234,8 +232,6 @@ api:
- http://localhost:*
- https://localhost
- https://localhost:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: '${TOPAZ_CERTS_DIR}/gateway.key'
tls_cert_path: '${TOPAZ_CERTS_DIR}/gateway.crt'
Expand Down Expand Up @@ -282,8 +278,6 @@ api:
- https://localhost
- https://localhost:*
- https://0.0.0.0:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: '${TOPAZ_CERTS_DIR}/gateway.key'
tls_cert_path: '${TOPAZ_CERTS_DIR}/gateway.crt'
Expand Down Expand Up @@ -329,8 +323,6 @@ api:
- http://localhost:*
- https://localhost
- https://localhost:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: '${TOPAZ_CERTS_DIR}/gateway.key'
tls_cert_path: '${TOPAZ_CERTS_DIR}/gateway.crt'
Expand Down Expand Up @@ -398,8 +390,6 @@ api:
- https://localhost
- https://localhost:*
- https://0.0.0.0:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: '${TOPAZ_CERTS_DIR}/gateway.key'
tls_cert_path: '${TOPAZ_CERTS_DIR}/gateway.crt'
Expand All @@ -422,6 +412,10 @@ opa:
policy-registry:
url: "https://ghcr.io"
type: "oci"
credentials:
bearer:
scheme: "Bearer"
token: "${GIT_TOKEN}"
response_header_timeout_seconds: 15
bundles:
rebac:
Expand All @@ -435,7 +429,7 @@ opa:
decision_logs:
console: false
plugins:

# topaz file decision logger plugin configuration
topaz_file_decision_logger:
enabled: false
logger:
Expand All @@ -451,5 +445,19 @@ opa:
registry_image: 'aserto-policies/policy-rebac'
registry_tag: 'latest'
digest: ''


# aserto edge directory sync plugin configuration
aserto_edge:
enabled: false
addr: "" # gRPC directory service address.
apikey: "" # directory API key.
timeout: 5 # gRPC connection timeout in seconds.
sync_interval: 1 # sync run interval in minutes.
insecure: true # when using TLS connections, skip verification of the server certificate.
page_size: 0 # deprecated: no longer used.
client_cert_path: "" # when using mTLS connections, ClientCertPath is the path of the client's certificate file.
client_key_path: "" # when using mTLS connections, ClientKeyPath is the path of the client's private key file.
no_tls: false # disable TLS and use a plaintext connection.
no_proxy: false # bypasses any configured HTTP proxy.
headers: # additional headers to include in requests to the service.
```
14 changes: 0 additions & 14 deletions docs/deployments/docker-compose/config/local.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,8 +37,6 @@ api:
- https://localhost
- https://localhost:*
- https://0.0.0.0:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: "${TOPAZ_CERTS_DIR}/gateway.key"
tls_cert_path: "${TOPAZ_CERTS_DIR}/gateway.crt"
Expand Down Expand Up @@ -66,8 +64,6 @@ api:
- https://localhost
- https://localhost:*
- https://0.0.0.0:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
# if no certs are specified, the gateway will have the http flag enabled (http: true)
certs:
tls_key_path: "${TOPAZ_CERTS_DIR}/gateway.key"
Expand All @@ -92,8 +88,6 @@ api:
- http://localhost:*
- https://localhost
- https://localhost:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: "${TOPAZ_CERTS_DIR}/gateway.key"
tls_cert_path: "${TOPAZ_CERTS_DIR}/gateway.crt"
Expand All @@ -117,8 +111,6 @@ api:
- http://localhost:*
- https://localhost
- https://localhost:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: "${TOPAZ_CERTS_DIR}/gateway.key"
tls_cert_path: "${TOPAZ_CERTS_DIR}/gateway.crt"
Expand All @@ -142,8 +134,6 @@ api:
- http://localhost:*
- https://localhost
- https://localhost:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: "${TOPAZ_CERTS_DIR}/gateway.key"
tls_cert_path: "${TOPAZ_CERTS_DIR}/gateway.crt"
Expand All @@ -167,8 +157,6 @@ api:
- http://localhost:*
- https://localhost
- https://localhost:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: "${TOPAZ_CERTS_DIR}/gateway.key"
tls_cert_path: "${TOPAZ_CERTS_DIR}/gateway.crt"
Expand Down Expand Up @@ -197,8 +185,6 @@ api:
- https://localhost
- https://localhost:*
- https://0.0.0.0:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: "${TOPAZ_CERTS_DIR}/gateway.key"
tls_cert_path: "${TOPAZ_CERTS_DIR}/gateway.crt"
Expand Down
12 changes: 0 additions & 12 deletions docs/deployments/sidecar-deployment/topaz-configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,8 +44,6 @@ data:
- https://localhost
- https://localhost:*
- https://0.0.0.0:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
# if no certs are specified, the gateway will have the http flag enabled (http: true)
certs:
tls_key_path: "/root/.config/topaz/certs/gateway.key"
Expand All @@ -68,8 +66,6 @@ data:
- http://localhost:*
- https://localhost
- https://localhost:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
# if no certs are specified, the gateway will have the http flag enabled (http: true)
certs:
tls_key_path: "/root/.config/topaz/certs/gateway.key"
Expand All @@ -96,8 +92,6 @@ data:
- http://localhost:*
- https://localhost
- https://localhost:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
# if no certs are specified, the gateway will have the http flag enabled (http: true)
certs:
tls_key_path: "/root/.config/topaz/certs/gateway.key"
Expand All @@ -122,8 +116,6 @@ data:
- http://localhost:*
- https://localhost
- https://localhost:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: "/root/.config/topaz/certs/gateway.key"
tls_cert_path: "/root/.config/topaz/certs/gateway.crt"
Expand All @@ -147,8 +139,6 @@ data:
- http://localhost:*
- https://localhost
- https://localhost:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: "/root/.config/topaz/certs/gateway.key"
tls_cert_path: "/root/.config/topaz/certs/gateway.crt"
Expand All @@ -172,8 +162,6 @@ data:
- http://localhost:*
- https://localhost
- https://localhost:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: "/root/.config/topaz/certs/gateway.key"
tls_cert_path: "/root/.config/topaz/certs/gateway.crt"
Expand Down
7 changes: 5 additions & 2 deletions docs/examples/config-local-image.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,11 @@ api:
gateway:
listen_address: "localhost:8383"
allowed_origins:
- https://*.aserto.com
- https://*aserto-console.netlify.app
- http://localhost
- http://localhost:*
- https://localhost
- https://localhost:*
- https://0.0.0.0:*
certs:
tls_key_path: "${TOPAZ_CERTS_DIR}/gateway.key"
tls_cert_path: "${TOPAZ_CERTS_DIR}/gateway.crt"
Expand Down
39 changes: 0 additions & 39 deletions docs/examples/config-private-apcr.yaml
View file
Open in desktop

This file was deleted.

7 changes: 5 additions & 2 deletions docs/examples/config-public-ghcr.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,11 @@ api:
gateway:
listen_address: "0.0.0.0:8383"
allowed_origins:
- https://*.aserto.com
- https://*aserto-console.netlify.app
- http://localhost
- http://localhost:*
- https://localhost
- https://localhost:*
- https://0.0.0.0:*
certs:
tls_key_path: "${TOPAZ_CERTS_DIR}/gateway.key"
tls_cert_path: "${TOPAZ_CERTS_DIR}/gateway.crt"
Expand Down
40 changes: 21 additions & 19 deletions pkg/config/schema/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,8 +93,6 @@ api:
- https://localhost
- https://localhost:*
- https://0.0.0.0:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
allowed_headers:
- "Authorization"
- "Content-Type"
Expand Down Expand Up @@ -136,8 +134,6 @@ api:
- https://localhost
- https://localhost:*
- https://0.0.0.0:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
# if no certs are specified, the gateway will have the http flag enabled (http: true)
certs:
tls_key_path: '${TOPAZ_CERTS_DIR}/gateway.key'
Expand All @@ -163,8 +159,6 @@ api:
- http://localhost:*
- https://localhost
- https://localhost:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: '${TOPAZ_CERTS_DIR}/gateway.key'
tls_cert_path: '${TOPAZ_CERTS_DIR}/gateway.crt'
Expand All @@ -189,8 +183,6 @@ api:
- http://localhost:*
- https://localhost
- https://localhost:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: '${TOPAZ_CERTS_DIR}/gateway.key'
tls_cert_path: '${TOPAZ_CERTS_DIR}/gateway.crt'
Expand All @@ -215,8 +207,6 @@ api:
- http://localhost:*
- https://localhost
- https://localhost:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: '${TOPAZ_CERTS_DIR}/gateway.key'
tls_cert_path: '${TOPAZ_CERTS_DIR}/gateway.crt'
Expand All @@ -241,8 +231,6 @@ api:
- http://localhost:*
- https://localhost
- https://localhost:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
certs:
tls_key_path: '${TOPAZ_CERTS_DIR}/gateway.key'
tls_cert_path: '${TOPAZ_CERTS_DIR}/gateway.crt'
Expand Down Expand Up @@ -276,8 +264,6 @@ api:
- https://localhost
- https://localhost:*
- https://0.0.0.0:*
- https://*.aserto.com
- https://*aserto-console.netlify.app
allowed_headers:
- "Authorization"
- "Content-Type"
Expand Down Expand Up @@ -328,18 +314,34 @@ opa:
min_delay_seconds: 60
max_delay_seconds: 120
plugins:
# topaz file decision logger plugin configuration
topaz_file_decision_logger:
enabled: false
logger:
filename: '/tmp/decisions.json'
max_size: 50
max_age: 2
max_backups: 2
filename: '${TOPAZ_DECISIONS_DIR}/my-config.json'
max_size: 100
max_age: 0
max_backups: 0
local_time: false
compress: false
policy_info:
policy_name: 'policy-rebac'
policy_name: 'rebac'
registry_service: 'ghcr.io'
registry_image: 'aserto-policies/policy-rebac'
registry_tag: 'latest'
digest: ''

# aserto edge directory sync plugin configuration
aserto_edge:
enabled: false
addr: "" # gRPC directory service address.
apikey: "" # directory API key.
timeout: 5 # gRPC connection timeout in seconds.
sync_interval: 1 # sync run interval in minutes.
insecure: true # when using TLS connections, skip verification of the server certificate.
page_size: 0 # deprecated: no longer used.
client_cert_path: "" # when using mTLS connections, ClientCertPath is the path of the client's certificate file.
client_key_path: "" # when using mTLS connections, ClientKeyPath is the path of the client's private key file.
no_tls: false # disable TLS and use a plaintext connection.
no_proxy: false # bypasses any configured HTTP proxy.
headers: # additional headers to include in requests to the service.
Loading
Loading