Skip to content

Commit 279b301

Browse files
olix0rolix0r
authored
inbound: Support multiple authorization types (#1560)
The inbound policy module uses the label `saz_name` to indicate the authorization resource being employed to allow/deny traffic. This corresponds to the `ServerAuthorization` kubernetes resource (with the `saz` shortname). This resource type is going to be deprecated in favor of a new, more general, `AuthorizationPolicy` resource. When this change is made in the control plane, the policy controller will include a `kind` label on gRPC messages indicating whether the resource type, or `default` if a default policy is in effect. This change honors this new `kind` field and adds a dedicated label to indicate the kind. Server labels are changed from: srv_name="default:foo" srv_name="fah" to: srv_kind="default",srv_name="foo" srv_kind="server",srv_name="fah" Authorization labels are changed from: saz_name="default:bar" saz_name="bah" to: authz_kind="default",authz_name="bar" authz_kind="serverauthorization",authz_name="bah" Signed-off-by: Oliver Gould <[email protected]>
1 parent f08371e commit 279b301

File tree

17 files changed

+130
-62
lines changed

17 files changed

+130
-62
lines changed

‎linkerd/app/core/src/metrics.rs‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -64,13 +64,17 @@ pub struct InboundEndpointLabels {
6464

6565
/// A label referencing an inbound `Server` (i.e. for policy).
6666
#[derive(Clone, Debug, Eq, PartialEq, Hash)]
67-
pub struct ServerLabel(pub Arc<str>);
67+
pub struct ServerLabel {
68+
pub kind: Arc<str>,
69+
pub name: Arc<str>,
70+
}
6871

6972
/// Labels referencing an inbound `ServerAuthorization.
7073
#[derive(Clone, Debug, Eq, PartialEq, Hash)]
7174
pub struct AuthzLabels {
7275
pub server: ServerLabel,
73-
pub authz: Arc<str>,
76+
pub kind: Arc<str>,
77+
pub name: Arc<str>,
7478
}
7579

7680
#[derive(Clone, Debug, PartialEq, Eq, Hash)]
@@ -289,22 +293,20 @@ impl FmtLabels for InboundEndpointLabels {
289293
}
290294
}
291295

292-
impl fmt::Display for ServerLabel {
293-
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
294-
self.0.fmt(f)
295-
}
296-
}
297-
298296
impl FmtLabels for ServerLabel {
299297
fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
300-
write!(f, "srv_name=\"{}\"", self.0)
298+
write!(f, "srv_kind=\"{}\",srv_name=\"{}\"", self.kind, self.name)
301299
}
302300
}
303301

304302
impl FmtLabels for AuthzLabels {
305303
fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
306304
self.server.fmt_labels(f)?;
307-
write!(f, ",saz_name=\"{}\"", self.authz)
305+
write!(
306+
f,
307+
",authz_kind=\"{}\",authz_name=\"{}\"",
308+
self.kind, self.name
309+
)
308310
}
309311
}
310312

‎linkerd/app/core/src/transport/labels.rs‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -194,14 +194,17 @@ mod tests {
194194
negotiated_protocol: None,
195195
}),
196196
([192, 0, 2, 4], 40000).into(),
197-
PolicyServerLabel("testserver".into()),
197+
PolicyServerLabel {
198+
kind: "server".into(),
199+
name: "testserver".into(),
200+
},
198201
);
199202
assert_eq!(
200203
labels.to_string(),
201204
"direction=\"inbound\",peer=\"src\",\
202205
target_addr=\"192.0.2.4:40000\",target_ip=\"192.0.2.4\",target_port=\"40000\",\
203206
tls=\"true\",client_id=\"foo.id.example.com\",\
204-
srv_name=\"testserver\""
207+
srv_kind=\"server\",srv_name=\"testserver\""
205208
);
206209
}
207210
}

‎linkerd/app/inbound/src/accept.rs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,8 +129,10 @@ mod tests {
129129
authorizations: vec![Authorization {
130130
authentication: Authentication::Unauthenticated,
131131
networks: vec![Default::default()],
132+
kind: "serverauthorization".into(),
132133
name: "testsaz".into(),
133134
}],
135+
kind: "server".into(),
134136
name: "testsrv".into(),
135137
},
136138
None,

‎linkerd/app/inbound/src/detect.rs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -469,8 +469,10 @@ mod tests {
469469
authorizations: vec![Authorization {
470470
authentication: Authentication::Unauthenticated,
471471
networks: vec![client_addr().ip().into()],
472+
kind: "serverathorizationu".into(),
472473
name: "testsaz".into(),
473474
}],
475+
kind: "server".into(),
474476
name: "testsrv".into(),
475477
},
476478
);

‎linkerd/app/inbound/src/http.rs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,7 @@ pub mod fuzz {
216216
authorizations: vec![policy::Authorization {
217217
authentication: policy::Authentication::Unauthenticated,
218218
networks: vec![std::net::IpAddr::from([192, 0, 2, 3]).into()],
219+
kind: "server".into(),
219220
name: "testsaz".into(),
220221
}],
221222
name: "testsrv".into(),

‎linkerd/app/inbound/src/http/router.rs‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -253,8 +253,16 @@ where
253253
{
254254
fn from((permit, t): (policy::Permit, T)) -> Self {
255255
let labels = vec![
256-
("srv_name".to_string(), permit.labels.server.to_string()),
257-
("saz_name".to_string(), permit.labels.authz.to_string()),
256+
(
257+
"srv_kind".to_string(),
258+
permit.labels.server.kind.to_string(),
259+
),
260+
(
261+
"srv_name".to_string(),
262+
permit.labels.server.name.to_string(),
263+
),
264+
("authz_kind".to_string(), permit.labels.kind.to_string()),
265+
("authz_name".to_string(), permit.labels.name.to_string()),
258266
];
259267

260268
Self {

‎linkerd/app/inbound/src/http/tests.rs‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -610,8 +610,10 @@ impl svc::Param<policy::AllowPolicy> for Target {
610610
authorizations: vec![policy::Authorization {
611611
authentication: policy::Authentication::Unauthenticated,
612612
networks: vec![std::net::IpAddr::from([192, 0, 2, 3]).into()],
613+
kind: "serverauthorization".into(),
613614
name: "testsaz".into(),
614615
}],
616+
kind: "server".into(),
615617
name: "testsrv".into(),
616618
},
617619
);
@@ -621,7 +623,10 @@ impl svc::Param<policy::AllowPolicy> for Target {
621623

622624
impl svc::Param<policy::ServerLabel> for Target {
623625
fn param(&self) -> policy::ServerLabel {
624-
policy::ServerLabel("testsrv".into())
626+
policy::ServerLabel {
627+
kind: "server".into(),
628+
name: "testsrv".into(),
629+
}
625630
}
626631
}
627632

‎linkerd/app/inbound/src/policy.rs‎

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,8 @@ impl From<DefaultPolicy> for ServerPolicy {
7070
DefaultPolicy::Deny => ServerPolicy {
7171
protocol: Protocol::Opaque,
7272
authorizations: vec![],
73-
name: "default:deny".into(),
73+
kind: "default".into(),
74+
name: "deny".into(),
7475
},
7576
}
7677
}
@@ -101,7 +102,11 @@ impl AllowPolicy {
101102

102103
#[inline]
103104
pub fn server_label(&self) -> ServerLabel {
104-
ServerLabel(self.server.borrow().name.clone())
105+
let s = self.server.borrow();
106+
ServerLabel {
107+
kind: s.kind.clone(),
108+
name: s.name.clone(),
109+
}
105110
}
106111

107112
async fn changed(&mut self) {
@@ -169,8 +174,12 @@ impl Permit {
169174
dst,
170175
protocol: server.protocol,
171176
labels: AuthzLabels {
172-
server: ServerLabel(server.name.clone()),
173-
authz: authz.name.clone(),
177+
kind: authz.kind.clone(),
178+
name: authz.name.clone(),
179+
server: ServerLabel {
180+
kind: server.kind.clone(),
181+
name: server.name.clone(),
182+
},
174183
},
175184
}
176185
}

‎linkerd/app/inbound/src/policy/authorize/http.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ where
105105
}
106106
Err(e) => {
107107
tracing::info!(
108-
server = %self.policy.server_label(),
108+
server = %format_args!("{}:{}", self.policy.server_label().kind, self.policy.server_label().name),
109109
tls = ?self.tls,
110110
client = %self.client_addr,
111111
"Request denied",

‎linkerd/app/inbound/src/policy/authorize/tcp.rs‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,11 @@ where
8585
})
8686
}
8787
Err(deny) => {
88-
tracing::info!(server = %policy.server_label(), ?tls, %client, "Connection denied");
88+
tracing::info!(
89+
server = %format_args!("{}:{}", policy.server_label().kind, policy.server_label().name),
90+
?tls, %client,
91+
"Connection denied"
92+
);
8993
self.metrics.deny(&policy, tls);
9094
AuthorizeTcp::Unauthorized(Unauthorized { deny })
9195
}
@@ -150,7 +154,7 @@ where
150154
_ = policy.changed() => {
151155
if let Err(denied) = policy.check_authorized(client, &tls) {
152156
tracing::info!(
153-
server = %policy.server_label(),
157+
server = %policy.server_label().name,
154158
?tls,
155159
%client,
156160
"Connection terminated due to policy change",

0 commit comments

Comments
 (0)