:Getting started

Create a productpage-viewer.yaml file that contains the following content.

kind: AuthorizationPolicy
metadata:
 name: productpage-viewer
 namespace: default
spec:
  targetRef:
    kind: Service
    group: ""
    name: productpage
  action: ALLOW
  rules:
  - from:
    - source:
        principals:
        - cluster.local/ns/default/sa/sleep

Use kubectl to connect to the ASM instance based on the information in the kubeconfig file. Then, run the following command to deploy the authorization policy to explicitly allow the service account of the sleep application to call the productpage service:

kubectl apply -f productpage-viewer.yaml

Verify whether the authorization policy takes effect.

1. Run the following command:

   kubectl exec deploy/sleep -- curl -s "http://productpage:9080/productpage" | grep -o "<title>.*</title>"

   Expected output:

   <title>Simple Bookstore App</title>

2. Run the following command:

   kubectl exec deploy/notsleep -- curl -s http://productpage:9080/ | grep -o "<title>.*</title>"

   Expected output:

   RBAC: access denied

   The preceding results indicate that the authorization policy takes effect.

Use the following content to create a productpage-viewer.yaml file that allows the service account of the sleep application to access the productpage service by using the GET method, but does not allow other operations to be performed.

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: productpage-viewer
 namespace: default
spec:
  targetRef:
    kind: Service
    group: ""
    name: productpage
  action: ALLOW
  rules:
  - from:
    - source:
        principals:
        - cluster.local/ns/default/sa/sleep
    to:
    - operation:
        methods: ["GET"]

Use kubectl to connect to the ASM instance based on the information in the kubeconfig file. Then, run the following command to deploy the authorization policy:

kubectl apply -f productpage-viewer.yaml

Verify whether the authorization policy takes effect.

1. Run the following command to use the GET request from the sleep application pod to access the productpage service:

   kubectl exec deploy/sleep -- curl -s "http://productpage:9080/productpage" | grep -o "<title>.*</title>"

   Expected output:

   <title>Simple Bookstore App</title>

2. Run the following command to use the DELETE request from the sleep application pod to access the productpage service:

   kubectl exec deploy/sleep -- curl -s "http://productpage:9080/productpage" -X DELETE

   Expected output:

   RBAC: access denied

3. Run the following command to use the GET request from the notsleep application pod to access the productpage service:

   kubectl exec deploy/notsleep -- curl -s "http://productpage:9080/productpage"

   Expected output:

   RBAC: access denied

   The preceding results show that the GET request from the sleep application can access the productpage service, and the GET request from the notsleep application and the DELETE request from the sleep application fail to access the productpage service. This indicates that the authorization policy takes effect.