:Dynamically update OPA policies in ASM

Step 1: Enable OPA

1. Log on to the ASM console.

2. In the left-side navigation pane, choose Service Mesh > Mesh Management.

3. On the Mesh Management page, find the ASM instance that you want to configure. Click the name of the ASM instance or click Manage in the Actions column.

4. In the Basic Information section, click Settings in the upper-right corner.

5. In the Settings Update panel, select Enable OPA Plug-in.

6. Click OK.

   In the Basic Information section, you can find that the status in the OPA Plug-in field changes to Enabled.

Step 2: Create ConfigMaps

1. Specify the KubeConfig credential type. For more information, see Step 2: Select a type of cluster credentials.

2. Create a ConfigMap that is named opa-policy.

   The startup of an OPA sidecar container relies on a ConfigMap that is named opa-policy. The ConfigMap supports the dynamic update of OPA policies. We recommend that you configure only basic policy settings in the ConfigMap. You can create other ConfigMaps to configure complex policy settings.

   1. Use the following content to create a YAML file that is named opa-policy:

      apiVersion: v1
      kind: ConfigMap
      metadata:
        name: opa-policy
      data:
        policy.rego: | ### The dynamic push of OPA policies relies on the paths that are allowed in the ConfigMap. If you do not specify the paths in the ConfigMap, OPA policies fail to be dynamically updated. 
          package istio.authz
      
          import input.parsed_path
          
          allow {
                  parsed_path[0] = "v1"
                  parsed_path[1] = "policies"
          }

   2. Run the following command to create the ConfigMap:

      kubectl apply -f opa-policy.yaml

3. Create a ConfigMap that is named opa-policy-add.

   Use the ConfigMap to define an OPA policy.

   1. Use the following content to create a YAML file that is named opa-policy-add:

      apiVersion: v1
      kind: ConfigMap
      metadata:
        name: opa-policy-add
        labels:
          ### You must configure the following label in the ConfigMap. Otherwise, the OPA policy that the ConfigMap defines cannot be dynamically updated. 
          openpolicyagent.org/policy: rego
      data:
        policy.rego: |  ### The following code shows the definition of a sample policy. Define a policy based on your actual needs. 
          package istio.authz
          import input.attributes.request.http as http_request
          default allow = false
          allow {
              roles_for_user[r]
              required_roles[r]
          }
          roles_for_user[r] {
              r := user_roles[user_name][_]
          }
          required_roles[r] {
              perm := role_perms[r][_]
              perm.method = http_request.method
              perm.path = http_request.path
          }
          user_name = parsed {
              [_, encoded] := split(http_request.headers.authorization, " ")
              [parsed, _] := split(base64url.decode(encoded), ":")
          }
          user_roles = {
              "guest1": ["guest"],
              "admin1": ["admin"]
          }
          role_perms = {
              "guest": [
                  {"method": "GET",  "path": "/productpage"},
              ],
              "admin": [
                  {"method": "GET",  "path": "/productpage"},
                  {"method": "GET",  "path": "/api/v1/products"},
              ],
          }     

      • user_roles: assigns roles to users. In this example, assign the guest role to the guest1 user and the admin role to the admin1 user.

      • role_perms: specifies the permissions of each role. In this example, grant the guest role the permissions to access an application by using a URL that contains /productpage, and grant the admin role the permissions to access an application by using a URL that contains /productpage or /api/v1/products.

   2. Run the following command to create the ConfigMap:

      kubectl apply -f opa-policy-add.yaml

4. Run the following command to view the policy push result:

   The policy push result is recorded in the annotations parameter in the ConfigMap.

   kubectl get configmap  opa-policy-add -o yaml  

   View the ConfigMap in the command output:

   • If the push is successful, the following information is displayed in the ConfigMap.

     openpolicyagent.org/policy-status: '{"status":"ok"}'

   • If the push fails, the corresponding error information is displayed in the ConfigMap.

Step 3: Inject an OPA sidecar

Deploy the sample application Bookinfo in the ASM instance and check whether an OPA sidecar is injected into each pod of the Bookinfo application.

1. Deploy the Bookinfo application in the ASM instance. For more information, see Deploy an application in an ASM instance.

2. Define Istio virtual services and an ingress gateway service as required. For more information, see Use Istio resources to route traffic to different versions of a service.

3. Check whether an OPA sidecar is injected into the pods of each application in the Bookinfo application.

   1. Log on to the ACK console.
   2. In the left-side navigation pane of the ACK console, click Clusters.
   3. On the Clusters page, find the cluster that you want to manage and click the name of the cluster or click Details in the Actions column. The details page of the cluster appears.
   4. In the left-side navigation pane of the details page, choose Workloads > Pods.

   5. At the top of the Pods page, select default from the Namespace drop-down list. Click the pod name of an application.

      On the Container tab, you can find that a sidecar proxy that is named istio-proxy and an OPA sidecar that is named opa-istio are injected into each container. Check the containers of each application in turn to ensure that the sidecar proxy and OPA sidecar are injected into each container.

Step 4: Verify that an OPA policy implements access control as expected

• Run the following cURL commands. The results indicate that the guest role is assigned to the guest1 user. In addition, the guest1 user has the permissions to access the application by using a URL that contains /productpage, but not /api/v1/products.

  curl -X GET http://{{The IP address of the ingress gateway service}}/productpage --user guest1:password -I

  The following output is expected:

  HTTP/1.1 200 OK

  curl -X GET http://{{The IP address of the ingress gateway service}}/api/v1/products --user guest1:password -I

  The following output is expected:

  HTTP/1.1 403 Forbidden

• Run the following cURL commands. The results indicate that the admin role is assigned to the admin1 user. In addition, the admin1 user has the permissions to access the application by using a URL that contains /productpage or /api/v1/products.

  curl -X GET http://{{The IP address of the ingress gateway service}}/productpage --user admin1:password -I

  The following output is expected:

  HTTP/1.1 200 OK

  curl -X GET http://{{The IP address of the ingress gateway service}}/api/v1/products --user admin1:password -I

  The following output is expected:

  HTTP/1.1 200 OK

  The preceding results indicate that the defined OPA policy implements access control as expected.

Step 5: Dynamically update an OPA policy

1. Run the following command on the ACK cluster to update the ConfigMap that is named opa-policy-add:

   kubectl replace -n {The namespace where the ACK cluster resides} -f - <<EOF
   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: opa-policy-add
     labels:
       ### You must configure the following label in the ConfigMap. Otherwise, the OPA policy that the ConfigMap defines cannot be dynamically updated. 
       openpolicyagent.org/policy: rego
   data:
     policy.rego: |  ### The following code shows the definition of a sample policy. Define a policy based on your actual needs. 
       package istio.authz
       import input.attributes.request.http as http_request
       default allow = false
       allow {
           roles_for_user[r]
           required_roles[r]
       }
       roles_for_user[r] {
           r := user_roles[user_name][_]
       }
       required_roles[r] {
           perm := role_perms[r][_]
           perm.method = http_request.method
           perm.path = http_request.path
       }
       user_name = parsed {
           [_, encoded] := split(http_request.headers.authorization, " ")
           [parsed, _] := split(base64url.decode(encoded), ":")
       }
       user_roles = {
           "guest1": ["guest", "admin"],
           "admin1": ["admin"]
       }
       role_perms = {
           "guest": [
               {"method": "GET",  "path": "/productpage"},
           ],
           "admin": [
               {"method": "GET",  "path": "/productpage"},
               {"method": "GET",  "path": "/api/v1/products"},
           ],
       }
   EOF

   • user_roles: assigns roles to users. In this example, assign the guest and admin roles to the guest1 user and the admin role to the admin1 user.

   • role_perms: specifies the permissions of each role. In this example, grant the guest role the permissions to access an application by using a URL that contains /productpage, and grant the admin role the permissions to access an application by using a URL that contains /productpage or /api/v1/products.

2. Run the following command to view the policy push result:

   The policy push result is recorded in the annotations parameter in the ConfigMap.

   kubectl get configmap  opa-policy-add -o yaml  

   View the ConfigMap in the command output:

   • If the push is successful, the following information is displayed in the ConfigMap.

     openpolicyagent.org/policy-status: '{"status":"ok"}'

   • If the push fails, the corresponding error information is displayed in the ConfigMap.

Step 6: Verify that an OPA policy is dynamically updated

Run the following cURL commands. The results indicate that the admin role is assigned to the guest1 user. In addition, the guest1 user has the permissions to access the application by using a URL that contains /productpage or /api/v1/products.

curl -X GET http://{{The IP address of the ingress gateway service}}/productpage --user guest1:password -I

The following output is expected:

HTTP/1.1 200 OK

curl -X GET http://{{The IP address of the ingress gateway service}}/api/v1/products --user guest1:password -I

The following output is expected:

HTTP/1.1 200 OK

Before the OPA policy is updated, the guest1 user can access the application by using a URL that contains /productpage, but not /api/v1/products. After the OPA policy is updated, the guest1 user can access the application by using a URL that contains /productpage or /api/v1/products. The result indicates that the OPA policy is dynamically updated.