## 4.3.1.2.3.3  Exposing Workloads with noAuth
Expose your workload using the noAuth access strategy, which allows access to the workload through the specified HTTP methods without requiring authentication.
## Prerequisites
- You have the Istio and API Gateway modules added. See Adding and Deleting a Kyma Module [page 3157].
- You have access to Kyma dashboard. Alternatively, to use CLI instructions, you must install kubectl and configure it to communicate with your Kyma runtime instance. See Access a Kyma Instance Using kubectl [page 2018].
- You have installed curl .
- You have a deployed workload.
##  Note
To expose a workload using APIRule in version v2 , the workload must be a part of the Istio service mesh. See Enabling Istio Sidecar Proxy Injection [page 1783].
- You have set up your custom domain . Alternatively, you can use the default domain of your Kyma cluster and the default Gateway kyma-system/kyma-gateway .
<!-- image -->
##  Note
Because the default Kyma domain is a wildcard domain, which uses a simple TLS Gateway, it is recommended that you set up your custom domain for use in a production environment.
```
 Tip To learn what the default domain of your Kyma cluster is, run the following command: kubectl get gateway -n kyma-system kyma-gateway -o jsonpath='{.spec.servers[0].hosts}'
```
## Context
The intended functionality of the noAuth access strategy is to provide a simple configuration for exposing workloads. It only allows access to the specified HTTP methods of the exposed workload.
##  Caution
Exposing a workload to the outside world is a potential security vulnerability, so be careful. In a production environment, always secure the workload you expose.
## Procedure
- You can use either Kyma dashboard or kubectl.
- Use Kyma dashboard.
- a. Go to the namespace in which you want to create an APIRule CR.
- b. Go to Discovery and Network &gt; API Rules and select Create .
- c. Provide the name of the APIRule CR.
- d. Add the name and port of the service you want to expose.
- e. Add a Gateway.
- f. Add a rule with the following configuration:
- g. Add one more rule with the following configuration:
- h. Send a GET request to the exposed workload:
| Option   | Description   |
|----------|---------------|
| Path     | /.*           |
| Handler  | No Auth       |
| Methods  | GET           |
| Option   | Description   |
|----------|---------------|
| Path     | /post         |
| Handler  | No Auth       |
| Methods  | POST          |
```
curl -ik -X GET https://{SUBDOMAIN}.{DOMAIN_NAME}/ip
```
If successful, the call returns the 200 OK response code.
- i. Send a POST request to the exposed workload:
```
curl -ik -X POST https://{SUBDOMAIN}.{DOMAIN_NAME}/post -d "test data"
```
If successful, the call returns the 200 OK response code.
- Use kubectl.
- a. To create an APIRule CR with noAuth configuration, replace the placeholders and run the following command. You can adjust the configuration, if needed.
- b. Send a GET request to the exposed workload:
```
cat <<EOF | kubectl apply -f apiVersion: gateway.kyma-project.io/v2 kind: APIRule metadata: name: {APIRULE_NAME} namespace: {APIRULE_NAMESPACE} spec: hosts: - {SUBDOMAIN}.{DOMAIN_NAME} service: name: {SERVICE_NAME} namespace: {SERVICE_NAMESPACE} port: {SERVICE_PORT} gateway: {NAMESPACE/GATEWAY} rules: - path: /* methods: ["GET"] noAuth: true - path: /post methods: ["POST"] noAuth: true EOF
```
```
curl -ik -X GET https://{SUBDOMAIN}.{DOMAIN_NAME}/ip
```
If successful, the call returns the 200 OK response code.
- c. Send a POST request to the exposed workload:
```
curl -ik -X POST https://{SUBDOMAIN}.{DOMAIN_NAME}/post -d "test data"
```
If successful, the call returns the 200 OK response code.