Alibaba Cloud Service Mesh:Layer 7 authentication and authorization

Prerequisites

An ingress gateway and related applications are deployed, and basic features are verified. For more information, see Prerequisites and Step 1 in Getting started.

Limits

• The following limits are applicable to authorization policies in a waypoint proxy:

  • The action field cannot be set to CUSTOM, which indicates that a waypoint proxy does not support custom authorization services.

  • ipBlocks is not supported in the source field.

• If a waypoint proxy is deployed, a corresponding ztunnel allows all requests from the waypoint proxy to pass through. In this case, authorization policies must be bound to the waypoint proxy for the authorization policies to take effect.

Preparations

Example 1: If a waypoint proxy is deployed for the productpage service, the authorization policy on ztunnels does not take effect.

If a waypoint proxy is deployed for the productpage service, the corresponding ztunnels allow all traffic from the waypoint proxy of the productpage service to pass through. In this case, if an authorization policy is applied to a ztunnel (an application pod is selected by the selector of the authorization policy), the authorization policy does not take effect.

1. Use the following content to create a productpage-viewer.yaml file.

   The following authorization policy applies to the corresponding ztunnel and prohibits access to port 9080 of the productpage service.

   apiVersion: security.istio.io/v1beta1
   kind: AuthorizationPolicy
   metadata:
    name: productpage-viewer
    namespace: default
   spec:
    selector:
      matchLabels:
        app: productpage
    action: DENY
    rules:
    - to:
      - operation:
          ports:
          - "9080"

2. Use kubectl to connect to the ASM instance based on the information in the kubeconfig file, and then run the following command to create the authorization policy:

   kubectl apply -f productpage-viewer.yaml

3. Verify whether the authorization policy takes effect.

   1. Run the following command to perform an access test:

      kubectl exec deploy/sleep -- curl -s http://productpage:9080/| grep -o "<title>.*</title>"

      Expected output:

      command terminated with exit code 56

   2. Run the following command to perform an access test:

      kubectl exec deploy/notsleep -- curl -s http://productpage:9080/ | grep -o "<title>.*</title>"

      Expected output:

      <title>Simple Bookstore App</title>

   The preceding tests and the tests in Example 2: Prohibit access to port 9080 of the productpage service (no waypoint proxy is deployed) use the same authorization policy. However, all accesses to port 9080 of the productpage service were successful in the preceding tests.

   The preceding results show that after you deploy a waypoint proxy, all authorization policies on the ztunnel become invalid.

4. Change the productpage-viewer.yaml file to the following content and run the kubectl apply -f productpage-viewer.yaml command to deploy the authorization policy.

   For ASM instances of V1.21 and earlier

   The configuration of the selector field is changed in the following YAML file.

   apiVersion: security.istio.io/v1beta1
   kind: AuthorizationPolicy
   metadata:
    name: productpage-viewer
    namespace: default
   spec:
    selector:
      matchLabels:
        istio.io/gateway-name: bookinfo-productpage
    action: DENY
    rules:
    - to:
      - operation:
          ports:
          - "9080"

   For ASM instances of V1.22 and later

   The desired service is specified in the following YAML file.

   apiVersion: security.istio.io/v1beta1
   kind: AuthorizationPolicy
   metadata:
     name: productpage-viewer
     namespace: default
   spec:
     targetRefs:
     - kind: Service
       group: ""
       name: productpage
     action: DENY
     rules:
     - to:
       - operation:
           ports:
           - "9080"

5. Verify whether the authorization policy takes effect.

   1. Run the following command to perform an access test:

      kubectl exec deploy/sleep -- curl -s http://productpage:9080/

      Expected output:

      RBAC: access denied%

   2. Run the following command to perform an access test:

      kubectl exec deploy/notsleep -- curl -s http://productpage:9080/

      Expected output:

      RBAC: access denied%

      The error message returned here is RBAC: access denied%, which is different from that in Example 2: Prohibit access to port 9080 of the productpage service in the "Layer 4 authentication and authorization" topic. This error is actually returned by the waypoint proxy of the productpage service. When the waypoint proxy finds that access to port 9080 is refused, it returns an HTTP RBAC error with the HTTP 403 status code.

6. Run the following command to remove the authorization policy:

   kubectl delete authorizationpolicy productpage-viewer

Example 2: Prohibit the IP address of the sleep pod from accessing the productpage service directly

Currently, authorization policies configured on a waypoint proxy do not support the ipBlocks field, and only support the remoteIpBlocks field. You can configure only the remoteIpBlocks field to match requests that pass through the gateway.

1. Create a productpage-viewer.yaml file with the following content to prohibit the sleep pod from accessing the productpage service:

   For ASM instances of V1.21 and earlier

   apiVersion: security.istio.io/v1beta1
   kind: AuthorizationPolicy
   metadata:
    name: productpage-viewer
    namespace: default
   spec:
    selector:
      matchLabels:
        istio.io/gateway-name: bookinfo-productpage
    action: DENY
    rules:
    - from:
      - source:
          remoteIpBlocks:
          - "${sleep Pod IP}"

   For ASM instances of V1.22 and later

   apiVersion: security.istio.io/v1beta1
   kind: AuthorizationPolicy
   metadata:
     name: productpage-viewer
     namespace: default
   spec:
     targetRefs:
     - kind: Service
       group: ""
       name: productpage
     action: DENY
     rules:
     - from:
       - source:
           remoteIpBlocks:
           - "${sleep Pod IP}"

2. Use kubectl to connect to the ASM instance based on the information in the kubeconfig file, and then run the following command to create the authorization policy:

   kubectl apply -f productpage-viewer.yaml

3. Verify whether the authorization policy takes effect.

4. Run the following command to perform an access test:

   kubectl exec deploy/sleep -- curl -s http://productpage:9080/ -I

   Expected output:

   HTTP/1.1 403 Forbidden
   content-length: 19
   content-type: text/plain
   date: Fri, 19 Jul 2024 08:17:08 GMT
   server: istio-envoy

   The expected output indicates that the sleep pod cannot directly access the productpage service or through the gateway.

5. Run the following command to remove the authorization policy:

   kubectl delete authorizationpolicy productpage-viewer

Example 3: Prohibit the HEAD method from accessing the /productpage path

1. Use the following content to create a productpage-viewer.yaml file:

   For ASM instances of V1.21 and earlier

   apiVersion: security.istio.io/v1beta1
   kind: AuthorizationPolicy
   metadata:
     name: productpage-viewer
     namespace: default
   spec:
     selector:
       matchLabels:
         istio.io/gateway-name: bookinfo-productpage
     action: DENY
     rules:
     - to:
       - operation:
           methods: ["HEAD"]
           paths: ["/productpage"]

   For ASM instances of V1.22 and later

   apiVersion: security.istio.io/v1beta1
   kind: AuthorizationPolicy
   metadata:
     name: productpage-viewer
     namespace: default
   spec:
     targetRefs:
     - kind: Service
       group: ""
       name: productpage
     action: DENY
     rules:
     - to:
       - operation:
           methods:
           - "HEAD"
           paths:
           - "/productpage"

2. Use kubectl to connect to the ASM instance based on the information in the kubeconfig file, and then run the following command to create the authorization policy:

   kubectl apply -f productpage-viewer.yaml

3. Verify whether the authorization policy takes effect.

   1. Run the following command to access the /productpage path by using the HEAD method:

      kubectl exec deploy/sleep -- curl -s productpage:9080/productpage -I

      Expected output:

      HTTP/1.1 403 Forbidden
      content-length: 19
      content-type: text/plain
      date: Thu, 15 Aug 2024 12:20:51 GMT
      server: istio-envoy

   2. Run the following command to access the /productpage path by using the GET method:

      kubectl exec deploy/sleep -- curl -s productpage:9080/productpage | grep -o "<title>.*</title>"

      Expected output:

      <title>Simple Bookstore App</title>

      Accessing the /productpage path is successful.

   3. Run the following command to access the / path by using the HEAD method:

      kubectl exec deploy/sleep -- curl -s productpage:9080/ -I

      Expected output:

      HTTP/1.1 200 OK
      server: istio-envoy
      date: Thu, 15 Aug 2024 12:23:17 GMT
      content-type: text/html; charset=utf-8
      content-length: 1743
      x-envoy-upstream-service-time: 2

4. Run the following command to remove the authorization policy:

   kubectl delete authorizationpolicy productpage-viewer