Skip to content

Commit a7bfc7f

Browse files
labuladonglabuladong
authored
Add authorization policy to components (#1249)
<!-- ### Contribution Checklist - Name the pull request in the form "[charts/<chart-name>] Title of the pull request". Skip *[charts/<chart-name>]* if the PR doesn't change a specific chart. E.g. `[docs] Fix typo in README`. - Fill out the template below to describe the changes contributed by the pull request. That will give reviewers the context they need to do the review. - Each pull request should address only one issue, not mix up code from multiple issues. - Each commit in the pull request has a meaningful commit message - Once all items of the checklist are addressed, remove the above text and this checklist, leaving only the filled out template below. **(The sections below can be removed for hotfixes of typos)** --> *(If this PR fixes a github issue, please add `Fixes #<xyz>`.)* Fixes #<xyz> *(or if this PR is one task of a github issue, please add `Master Issue: #<xyz>` to link to the master issue.)* Master Issue: #<xyz> ### Motivation *Explain here the context, and why you're making that change. What is the problem you're trying to solve.* ### Modifications *Describe the modifications you've done.* ### Verifying this change - [ ] Make sure that the change passes the CI checks. *(Please pick either of the following options)* This change is a trivial rework / code cleanup without any test coverage. *(or)* This change is already covered by existing tests, such as *(please describe tests)*. *(or)* This change added tests and can be verified as follows: *(example:)* - *Added integration tests for end-to-end deployment with large payloads (10MB)* - *Extended integration test for recovery after broker failure* ### Documentation Check the box below. Need to update docs? - [ ] `doc-required` (If you need help on updating docs, create a doc issue) - [ ] `no-need-doc` (Please explain why) - [ ] `doc` (If this PR contains doc changes)
1 parent 857d782 commit a7bfc7f

16 files changed

+444
-18
lines changed

‎charts/sn-platform-slim/templates/detector/pulsar-detector-authorizationpolicy.yaml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,21 @@ metadata:
1010
namespace: {{ template "pulsar.namespace" . }}
1111
spec:
1212
rules:
13-
- to:
13+
- {{- if and .Values.pulsar_detector.authorizationPolicy .Values.pulsar_detector.authorizationPolicy.from }}
14+
from:
15+
{{ toYaml .Values.pulsar_detector.authorizationPolicy.from | indent 4 }}
16+
{{- end }}
17+
{{- if and .Values.pulsar_detector.authorizationPolicy .Values.pulsar_detector.authorizationPolicy.to }}
18+
to:
19+
{{ toYaml .Values.pulsar_detector.authorizationPolicy.to | indent 4 }}
20+
{{- else }}
21+
to:
1422
- operation:
1523
ports:
1624
- "{{ .Values.pulsar_detector.port }}"
25+
{{- end }}
1726
action: ALLOW
1827
selector:
1928
matchLabels:
2029
component: {{ .Values.pulsar_detector.component }}
21-
{{- end }}
30+
{{- end }}

‎charts/sn-platform-slim/templates/function-worker/function-worker-authorizationpolicy.yaml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,22 @@ metadata:
1111
spec:
1212
action: ALLOW
1313
rules:
14-
- to:
14+
- {{- if and .Values.functions.authorizationPolicy .Values.functions.authorizationPolicy.from }}
15+
from:
16+
{{ toYaml .Values.functions.authorizationPolicy.from | indent 4 }}
17+
{{- end }}
18+
{{- if and .Values.functions.authorizationPolicy .Values.functions.authorizationPolicy.to }}
19+
to:
20+
{{ toYaml .Values.functions.authorizationPolicy.to | indent 4 }}
21+
{{- else }}
22+
to:
1523
- operation:
1624
ports:
1725
- "{{ .Values.functions.ports.http }}"
1826
{{- if and .Values.tls.enabled .Values.tls.functions.enabled }}
1927
- "{{ .Values.functions.ports.https }}"
2028
{{- end }}
29+
{{- end }}
2130
selector:
2231
matchLabels:
2332
{{- include "pulsar.template.labels" . | nindent 6 }}

‎charts/sn-platform-slim/templates/grafana/grafana-authorizationpolicy.yaml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,19 @@ metadata:
1010
namespace: {{ template "pulsar.namespace" . }}
1111
spec:
1212
rules:
13-
- to:
13+
- {{- if and .Values.grafana.authorizationPolicy .Values.grafana.authorizationPolicy.from }}
14+
from:
15+
{{ toYaml .Values.grafana.authorizationPolicy.from | indent 4 }}
16+
{{- end }}
17+
{{- if and .Values.grafana.authorizationPolicy .Values.grafana.authorizationPolicy.to }}
18+
to:
19+
{{ toYaml .Values.grafana.authorizationPolicy.to | indent 4 }}
20+
{{- else }}
21+
to:
1422
- operation:
1523
ports:
1624
- "{{ .Values.grafana.port }}"
25+
{{- end }}
1726
action: ALLOW
1827
selector:
1928
matchLabels:

‎charts/sn-platform-slim/templates/prometheus/prometheus-authorizationpolicy.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,24 @@ metadata:
1010
namespace: {{ template "pulsar.namespace" . }}
1111
spec:
1212
rules:
13-
- from:
13+
- {{- if and .Values.prometheus.authorizationPolicy .Values.prometheus.authorizationPolicy.from }}
14+
from:
15+
{{ toYaml .Values.prometheus.authorizationPolicy.from | indent 4 }}
16+
{{- else }}
17+
from:
1418
- source:
1519
namespaces:
1620
- {{ template "pulsar.namespace" . }}
17-
- to:
21+
{{- end }}
22+
{{- if and .Values.prometheus.authorizationPolicy .Values.prometheus.authorizationPolicy.to }}
23+
to:
24+
{{ toYaml .Values.prometheus.authorizationPolicy.to | indent 4 }}
25+
{{- else }}
26+
to:
1827
- operation:
1928
ports:
2029
- "{{ .Values.prometheus.port }}"
30+
{{- end }}
2131
action: ALLOW
2232
selector:
2333
matchLabels:

‎charts/sn-platform-slim/templates/proxy/proxy-authorizationpolicy.yaml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,23 @@ metadata:
1111
namespace: {{ template "pulsar.namespace" . }}
1212
spec:
1313
rules:
14-
- to:
14+
- {{- if and .Values.proxy.authorizationPolicy .Values.proxy.authorizationPolicy.from }}
15+
from:
16+
{{ toYaml .Values.proxy.authorizationPolicy.from | indent 4 }}
17+
{{- end }}
18+
{{- if and .Values.proxy.authorizationPolicy .Values.proxy.authorizationPolicy.to }}
19+
to:
20+
{{ toYaml .Values.proxy.authorizationPolicy.to | indent 4 }}
21+
{{- else }}
22+
to:
1523
- operation:
1624
ports:
1725
- "6650"
1826
- "8080"
1927
{{- if .Values.proxy.websocket }}
2028
- "9090"
2129
{{- end }}
30+
{{- end }}
2231
action: ALLOW
2332
selector:
2433
matchLabels:

‎charts/sn-platform-slim/templates/toolset/toolset-authorizationpolicy.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#
2+
# Copyright (c) 2019 - 2024 StreamNative, Inc.. All Rights Reserved.
3+
#
4+
5+
{{- if and .Values.components.toolset .Values.istio.enabled }}
6+
{{- if or (and .Values.toolset.authorizationPolicy .Values.toolset.authorizationPolicy.from) (and .Values.toolset.authorizationPolicy .Values.toolset.authorizationPolicy.to) }}
7+
apiVersion: security.istio.io/v1beta1
8+
kind: AuthorizationPolicy
9+
metadata:
10+
name: "{{ template "pulsar.fullname" . }}-{{ .Values.toolset.component }}"
11+
namespace: {{ template "pulsar.namespace" . }}
12+
spec:
13+
rules:
14+
- {{- if and .Values.toolset.authorizationPolicy .Values.toolset.authorizationPolicy.from }}
15+
from:
16+
{{ toYaml .Values.toolset.authorizationPolicy.from | indent 4 }}
17+
{{- end }}
18+
{{- if and .Values.toolset.authorizationPolicy .Values.toolset.authorizationPolicy.to }}
19+
to:
20+
{{ toYaml .Values.toolset.authorizationPolicy.to | indent 4 }}
21+
{{- end }}
22+
action: ALLOW
23+
selector:
24+
matchLabels:
25+
{{- include "pulsar.matchLabels" . | nindent 6 }}
26+
component: {{ .Values.toolset.component }}
27+
{{- end }}
28+
{{- end }}
29+

‎charts/sn-platform-slim/values.yaml‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1411,6 +1411,26 @@ broker:
14111411
## templates/function-worker-configmap.yaml
14121412
##
14131413
functions:
1414+
# Istio AuthorizationPolicy configuration
1415+
# Configure the 'from' and 'to' sections to restrict sources and operations
1416+
# If 'to' is not specified, default ports (8080, 8443 for HTTPS) will be used
1417+
# Example:
1418+
# authorizationPolicy:
1419+
# from:
1420+
# - source:
1421+
# principals: ["cluster.local/ns/default/sa/pulsar-broker"]
1422+
# - source:
1423+
# namespaces: ["pulsar"]
1424+
# to:
1425+
# - operation:
1426+
# ports: ["8080", "8443"]
1427+
# methods: ["GET", "POST"]
1428+
# paths: ["/metrics"]
1429+
# hosts: ["function-worker.pulsar.svc.cluster.local"]
1430+
authorizationPolicy:
1431+
from: []
1432+
to: []
1433+
14141434
component: functions-worker
14151435
enableCustomizerRuntime: false
14161436
useDedicatedRunner: false
@@ -1513,6 +1533,26 @@ functions:
15131533
## templates/pulsar-detector-statefulset.yaml
15141534
##
15151535
pulsar_detector:
1536+
# Istio AuthorizationPolicy configuration
1537+
# Configure the 'from' and 'to' sections to restrict sources and operations
1538+
# If 'to' is not specified, default port (9000) will be used
1539+
# Example:
1540+
# authorizationPolicy:
1541+
# from:
1542+
# - source:
1543+
# principals: ["cluster.local/ns/default/sa/pulsar-admin"]
1544+
# - source:
1545+
# namespaces: ["pulsar"]
1546+
# to:
1547+
# - operation:
1548+
# ports: ["9000"]
1549+
# methods: ["GET", "POST"]
1550+
# paths: ["/metrics"]
1551+
# hosts: ["pulsar-detector.pulsar.svc.cluster.local"]
1552+
authorizationPolicy:
1553+
from: []
1554+
to: []
1555+
15161556
component: pulsar-detector
15171557
replicaCount: 1
15181558
labels: {}
@@ -1586,6 +1626,26 @@ proxy:
15861626
# The template field can totally change the log config of the component. The value is a string, which is the content of the log config file.
15871627
template: {}
15881628

1629+
# Istio AuthorizationPolicy configuration
1630+
# Configure the 'from' and 'to' sections to restrict sources and operations
1631+
# If 'to' is not specified, default ports (6650, 8080, 9090) will be used
1632+
# Example:
1633+
# authorizationPolicy:
1634+
# from:
1635+
# - source:
1636+
# principals: ["cluster.local/ns/default/sa/pulsar-client"]
1637+
# - source:
1638+
# namespaces: ["pulsar"]
1639+
# to:
1640+
# - operation:
1641+
# ports: ["6650", "8080", "9090"]
1642+
# methods: ["GET", "POST"]
1643+
# paths: ["/metrics"]
1644+
# hosts: ["proxy.pulsar.svc.cluster.local"]
1645+
authorizationPolicy:
1646+
from: []
1647+
to: []
1648+
15891649
# use a component name that matches your grafana configuration
15901650
# so the metrics are correctly rendered in grafana dashboard
15911651
component: proxy
@@ -1700,6 +1760,25 @@ proxy:
17001760
## templates/toolset-deployment.yaml
17011761
##
17021762
toolset:
1763+
# Istio AuthorizationPolicy configuration
1764+
# Configure the 'from' and 'to' sections to restrict sources and operations
1765+
# Toolset is a headless service, no default 'to' ports are specified
1766+
# Example:
1767+
# authorizationPolicy:
1768+
# from:
1769+
# - source:
1770+
# principals: ["cluster.local/ns/default/sa/pulsar-admin"]
1771+
# - source:
1772+
# namespaces: ["pulsar"]
1773+
# to:
1774+
# - operation:
1775+
# ports: ["8080"]
1776+
# methods: ["GET", "POST"]
1777+
# hosts: ["toolset.pulsar.svc.cluster.local"]
1778+
authorizationPolicy:
1779+
from: []
1780+
to: []
1781+
17031782
component: toolset
17041783
useProxy: false
17051784
installBusybox: true
@@ -1817,6 +1896,25 @@ configmapReload:
18171896
## templates/prometheus-deployment.yaml
18181897
##
18191898
prometheus:
1899+
# Istio AuthorizationPolicy configuration
1900+
# Configure the 'from' and 'to' sections to restrict sources and operations
1901+
# If 'from' is not specified, default will allow from the same namespace
1902+
# If 'to' is not specified, default port (9090) will be used
1903+
# Example:
1904+
# authorizationPolicy:
1905+
# from:
1906+
# - source:
1907+
# namespaces: ["pulsar"]
1908+
# to:
1909+
# - operation:
1910+
# ports: ["9090"]
1911+
# methods: ["GET", "POST"]
1912+
# paths: ["/metrics", "/api/*"]
1913+
# hosts: ["prometheus.pulsar.svc.cluster.local"]
1914+
authorizationPolicy:
1915+
from: []
1916+
to: []
1917+
18201918
component: prometheus
18211919
replicaCount: 1
18221920
scrape:
@@ -1964,6 +2062,26 @@ datadog:
19642062
## templates/grafana-statefulset.yaml
19652063
##
19662064
grafana:
2065+
# Istio AuthorizationPolicy configuration
2066+
# Configure the 'from' and 'to' sections to restrict sources and operations
2067+
# If 'to' is not specified, default port (3000) will be used
2068+
# Example:
2069+
# authorizationPolicy:
2070+
# from:
2071+
# - source:
2072+
# principals: ["cluster.local/ns/default/sa/grafana-user"]
2073+
# - source:
2074+
# namespaces: ["pulsar"]
2075+
# to:
2076+
# - operation:
2077+
# ports: ["3000"]
2078+
# methods: ["GET", "POST"]
2079+
# paths: ["/api/*"]
2080+
# hosts: ["grafana.pulsar.svc.cluster.local"]
2081+
authorizationPolicy:
2082+
from: []
2083+
to: []
2084+
19672085
component: grafana
19682086
grafana.ini:
19692087
paths:

‎charts/sn-platform/templates/detector/pulsar-detector-authorizationpolicy.yaml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,21 @@ metadata:
1010
namespace: {{ template "pulsar.namespace" . }}
1111
spec:
1212
rules:
13-
- to:
13+
- {{- if and .Values.pulsar_detector.authorizationPolicy .Values.pulsar_detector.authorizationPolicy.from }}
14+
from:
15+
{{ toYaml .Values.pulsar_detector.authorizationPolicy.from | indent 4 }}
16+
{{- end }}
17+
{{- if and .Values.pulsar_detector.authorizationPolicy .Values.pulsar_detector.authorizationPolicy.to }}
18+
to:
19+
{{ toYaml .Values.pulsar_detector.authorizationPolicy.to | indent 4 }}
20+
{{- else }}
21+
to:
1422
- operation:
1523
ports:
1624
- "{{ .Values.pulsar_detector.port }}"
25+
{{- end }}
1726
action: ALLOW
1827
selector:
1928
matchLabels:
2029
component: {{ .Values.pulsar_detector.component }}
21-
{{- end }}
30+
{{- end }}

‎charts/sn-platform/templates/function-worker/function-worker-authorizationpolicy.yaml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,22 @@ metadata:
1111
spec:
1212
action: ALLOW
1313
rules:
14-
- to:
14+
- {{- if and .Values.functions.authorizationPolicy .Values.functions.authorizationPolicy.from }}
15+
from:
16+
{{ toYaml .Values.functions.authorizationPolicy.from | indent 4 }}
17+
{{- end }}
18+
{{- if and .Values.functions.authorizationPolicy .Values.functions.authorizationPolicy.to }}
19+
to:
20+
{{ toYaml .Values.functions.authorizationPolicy.to | indent 4 }}
21+
{{- else }}
22+
to:
1523
- operation:
1624
ports:
1725
- "{{ .Values.functions.ports.http }}"
1826
{{- if and .Values.tls.enabled .Values.tls.functions.enabled }}
1927
- "{{ .Values.functions.ports.https }}"
2028
{{- end }}
29+
{{- end }}
2130
selector:
2231
matchLabels:
2332
{{- include "pulsar.template.labels" . | nindent 6 }}

‎charts/sn-platform/templates/grafana/grafana-authorizationpolicy.yaml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,19 @@ metadata:
1010
namespace: {{ template "pulsar.namespace" . }}
1111
spec:
1212
rules:
13-
- to:
13+
- {{- if and .Values.grafana.authorizationPolicy .Values.grafana.authorizationPolicy.from }}
14+
from:
15+
{{ toYaml .Values.grafana.authorizationPolicy.from | indent 4 }}
16+
{{- end }}
17+
{{- if and .Values.grafana.authorizationPolicy .Values.grafana.authorizationPolicy.to }}
18+
to:
19+
{{ toYaml .Values.grafana.authorizationPolicy.to | indent 4 }}
20+
{{- else }}
21+
to:
1422
- operation:
1523
ports:
1624
- "{{ .Values.grafana.port }}"
25+
{{- end }}
1726
action: ALLOW
1827
selector:
1928
matchLabels:

0 commit comments

Comments
 (0)