tweak

docker-compose.yml

@@ -17,7 +17,7 @@ services:
       - "443:10000"
     volumes:
       - ./envoy.yaml:/etc/envoy/envoy.yaml:ro
-      - ./access.log:/var/log/envoy/access.log
       - /var/lib/tls:/certs
+      - ./access.log:/var/log/envoy/access.log
     depends_on:
       - rest-server

envoy.yaml

@@ -64,18 +64,30 @@ static_resources:
               rules:
                 action: ALLOW
                 policies:
-                  "test_policy":
+                  "ubuntu-policy":
                     permissions:
                       - and_rules:
                           rules:
                             - header:
                                 name: ":path"
                                 string_match:
-                                  prefix: "/dev-test"
+                                  prefix: "/john-ubuntu"
                     principals:
                       - authenticated:
                           principal_name:
                             exact: "spiffe://john-stream.com/ubuntu"
+                  "p14-policy":
+                    permissions:
+                      - and_rules:
+                          rules:
+                            - header:
+                                name: ":path"
+                                string_match:
+                                  prefix: "/john-p14s"
+                    principals:
+                      - authenticated:
+                          principal_name:
+                            exact: "spiffe://john-stream.com/john-p14s"
           # --8<-- [end:rbac]
           - name: envoy.filters.http.router
             typed_config: