Skip to content

Commit 7019d19

Browse files
JSticklerJStickler
authored
Merge pull request #28594 from neal-timpe/ossmdoc-200
OSSMDOC-200
2 parents 4c8e717 + 6435faf commit 7019d19

File tree

2 files changed

+183
-0
lines changed

2 files changed

+183
-0
lines changed

‎modules/ossm-security-auth-policy.adoc‎

Lines changed: 181 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
////
2+
Module included in the following assemblies:
3+
-service_mesh/v2x/ossm-security.adoc
4+
////
5+
6+
[id="ossm-vs-istio_{context}"]
7+
= Configuring Role Based Access Control (RBAC)
8+
9+
Role-based access control (RBAC) objects determine whether a user or service is allowed to perform a given action within a project. You can define mesh-, namespace-, and workload-wide access control for your workloads in the mesh.
10+
11+
To configure RBAC, create an `AuthorizationPolicy` resource in the namespace for which you are configuring access. If you are configuring mesh-wide access, use `istio-system`.
12+
13+
For example, with RBAC, you can create policies that:
14+
15+
* Configure intra-project communication.
16+
* Allow or deny full access to all workloads in the default namespace.
17+
* Allow or deny ingress gateway access.
18+
* Require a token for access.
19+
20+
An authorization policy includes a selector, an action, and a list of rules:
21+
22+
* The `selector` field specifies the target of the policy.
23+
* The `action` field specifies whether to allow or deny the request.
24+
* The `rules` field specifies when to trigger the action.
25+
** The `from` field specifies constraints on the request origin.
26+
** The `to` field specifies constraints on request target and parameters.
27+
** The `when` field specifies additional conditions that to apply the rule.
28+
29+
.Procedure
30+
31+
. Create your `AuthorizationPolicy` resource. The following example shows a resource that updates the ingress-policy `AuthorizationPolicy` to deny an IP address from accessing the ingress gateway.
32+
+
33+
[source,yaml]
34+
----
35+
apiVersion: security.istio.io/v1beta1
36+
kind: AuthorizationPolicy
37+
metadata:
38+
name: ingress-policy
39+
namespace: istio-system
40+
spec:
41+
selector:
42+
matchLabels:
43+
app: istio-ingressgateway
44+
action: DENY
45+
rules:
46+
- from:
47+
- source:
48+
ipBlocks: ["1.2.3.4"]
49+
----
50+
+
51+
. Run the following command after you write your resource to create your resource in your namespace. The namespace must match your `metadata.namespace` field in your `AuthorizationPolicy` resource.
52+
+
53+
[source,terminal]
54+
----
55+
$ oc create -n istio-system -f <filename>
56+
----
57+
58+
.Next steps
59+
60+
Consider the following examples for other common configurations.
61+
62+
== Configure intra-project communication
63+
64+
You can use `AuthorizationPolicy` to configure your control plane to allow or deny the traffic communicating with your mesh or services in your mesh.
65+
66+
=== Restrict access to services outside a namespace
67+
68+
You can deny requests from any source that is not in the `bookinfo` namespace with the following `AuthorizationPolicy` resource example.
69+
70+
[source,yaml]
71+
----
72+
apiVersion: security.istio.io/v1beta1
73+
kind: AuthorizationPolicy
74+
metadata:
75+
name: httpbin-deny
76+
namespace: bookinfo
77+
spec:
78+
selector:
79+
matchLabels:
80+
app: httpbin
81+
version: v1
82+
action: DENY
83+
rules:
84+
- from:
85+
- source:
86+
notNamespaces: ["bookinfo"]
87+
----
88+
89+
=== Creating allow-all and default deny-all authorization policies
90+
91+
The following example shows an allow-all authorization policy that allows full access to all workloads in the `bookinfo` namespace.
92+
93+
[source,yaml]
94+
----
95+
apiVersion: security.istio.io/v1beta1
96+
kind: AuthorizationPolicy
97+
metadata:
98+
name: allow-all
99+
namespace: bookinfo
100+
spec:
101+
action: ALLOW
102+
rules:
103+
- {}
104+
----
105+
106+
The following example shows a policy that denies any access to all workloads in the `bookinfo` namespace.
107+
108+
[source,yaml]
109+
----
110+
apiVersion: security.istio.io/v1beta1
111+
kind: AuthorizationPolicy
112+
metadata:
113+
name: deny-all
114+
namespace: bookinfo
115+
spec:
116+
{}
117+
----
118+
119+
== Allow or deny access to the ingress gateway
120+
121+
You can set an authorization policy to add allow or deny lists based on IP addresses.
122+
123+
[source,yaml]
124+
----
125+
apiVersion: security.istio.io/v1beta1
126+
kind: AuthorizationPolicy
127+
metadata:
128+
name: ingress-policy
129+
namespace: istio-system
130+
spec:
131+
selector:
132+
matchLabels:
133+
app: istio-ingressgateway
134+
action: ALLOW
135+
rules:
136+
- from:
137+
- source:
138+
ipBlocks: ["1.2.3.4", "5.6.7.0/24"]
139+
----
140+
141+
== Restrict access with JSON Web Token
142+
143+
You can restrict what can access your mesh with a JSON Web Token (JWT). After authentication, a user or service can access routes, services that are associated with that token.
144+
145+
Create a `RequestAuthentication` resource, which defines the authentication methods that are supported by a workload. The following example accepts a JWT issued by `http://localhost:8080/auth/realms/master`.
146+
147+
[source,yaml]
148+
----
149+
apiVersion: "security.istio.io/v1beta1"
150+
kind: "RequestAuthentication"
151+
metadata:
152+
name: "jwt-example"
153+
namespace: bookinfo
154+
spec:
155+
selector:
156+
matchLabels:
157+
app: httpbin
158+
jwtRules:
159+
- issuer: "http://localhost:8080/auth/realms/master"
160+
jwksUri: "http://keycloak.default.svc:8080/auth/realms/master/protocol/openid-connect/certs"
161+
----
162+
163+
Then, create an `AuthorizationPolicy` resource in the same namespace to work with `RequestAuthentication` resource you created. The following example requires a JWT to be present in the `Authorization` header when sending a request to `httpbin` workloads.
164+
165+
[source,yaml]
166+
----
167+
apiVersion: "security.istio.io/v1beta1"
168+
kind: "AuthorizationPolicy"
169+
metadata:
170+
name: "frontend-ingress"
171+
namespace: bookinfo
172+
spec:
173+
selector:
174+
matchLabels:
175+
app: httpbin
176+
action: DENY
177+
rules:
178+
- from:
179+
- source:
180+
notRequestPrincipals: ["*"]
181+
----

‎service_mesh/v2x/ossm-security.adoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ If you don't have a project, install the xref:../../service_mesh/v2x/prepare-to-
2020

2121
include::modules/ossm-security-mtls.adoc[leveloffset=+1]
2222

23+
include::modules/ossm-security-auth-policy.adoc[leveloffset=+1]
24+
2325
include::modules/ossm-security-cipher.adoc[leveloffset=+1]
2426

2527
include::modules/ossm-security-cert-manage.adoc[leveloffset=+1]

0 commit comments

Comments
 (0)