Alibaba Cloud Service Mesh:Overview of zero trust security

Benefits over application-level security

With a single control plane, ASM delivers identity and access management, transparent TLS encryption, authentication, authorization, and audit logging out of the box.

Set up request authentication with JWT validation

Prerequisites

• Deploy the Bookinfo sample application with Ambient mode enabled. For details, see Deploy the sample application and enable Ambient mode.

• Enable a waypoint proxy for the namespace where the application resides.

Step 1: Deploy a test client

1. Create a sleep.yaml file with the following content.

   Expand to view sleep.yaml

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: sleep
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: sleep
     labels:
       app: sleep
       service: sleep
   spec:
     ports:
     - port: 80
       name: http
     selector:
       app: sleep
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: sleep
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: sleep
     template:
       metadata:
         labels:
           app: sleep
       spec:
         terminationGracePeriodSeconds: 0
         serviceAccountName: sleep
         containers:
         - name: sleep
           image: registry-cn-hangzhou.ack.aliyuncs.com/ack-demo/curl:asm-sleep
           command: ["/bin/sleep", "3650d"]
           imagePullPolicy: IfNotPresent
           volumeMounts:
           - mountPath: /etc/sleep/tls
             name: secret-volume
         volumes:
         - name: secret-volume
           secret:
             secretName: sleep-secret
             optional: true
   ---

2. Deploy the sleep application:

   kubectl apply -f sleep.yaml -n default

Step 2: Create a request authentication policy

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the target ASM instance. In the left-side navigation pane, choose Mesh Security Center > RequestAuthentication. Click Create.

3. Configure a JWT rule for the details workload with the following settings:

   • issuer: testing@secure.istio.io

   • audiences: Leave blank (no restrictions on which services can use the JWT).

   • jwks: The JSON Web Key Set for validating JWTs. Use the following value:

     { "keys":[ {"e":"AQAB","kid":"DHFbpoIUqrY8t2zpA2qXfCmr5VO5ZEr4RzHU_-envvQ","kty":"RSA","n":"xAE7eB6qugXyCAG3yhh7pkDkT65pHymX-P7KfIupjf59vsdo91bSP9C8H07pSAGQO1MV_xFj9VswgsCg4R6otmg5PV2He95lZdHtOcU5DXIg_pbhLdKXbi66GlVeK6ABZOUW3WYtnNHD-91gVuoeJT_DwtGGcp4ignkgXfkiEm4sw-4sfb4qdt5oLbyVpmW6x9cfa7vs2WTfURiCrBoUqgBo_-4WTiULmmHSGZHOjzwa8WtrtOQGsAFjIbno85jp6MnGGGZPYZbDAa_b3y5u-YpW7ypZrvD8BgtKVjgtQgZhLAGezMt0ua3DRrWnKqTZ0BJ_EyxOGuHJrLsn00fnMQ"}]}

     For more information, see jwks.json.

4. Click Create.

Step 3: Encode and test with a JWT

Use a JWT tool to encode the JWKS into a token. The expected encoded token is:

eyJhbGciOiJSUzI1NiIsImtpZCI6IkRIRmJwb0lVcXJZOHQyenBBMnFYZkNtcjVWTzVaRXI0UnpIVV8tZW52dlEiLCJ0eXAiOiJKV1QifQ.eyJleHAiOjQ2ODU5ODk3MDAsImZvbyI6ImJhciIsImlhdCI6MTUzMjM4OTcwMCwiaXNzIjoidGVzdGluZ0BzZWN1cmUuaXN0aW8uaW8iLCJzdWIiOiJ0ZXN0aW5nQHNlY3VyZS5pc3Rpby5pbyJ9.CfNnxWP2tcnR9q0vxyxweaF3ovQYHYZl82hAUsn21bwQd9zP7c-LS9qd_vpdLG4Tn1A15NxfCjp5f7QNBUo-KC9PJqYpgGbaXhaGx7bEdFWjcwv3nZzvc7M__ZpaCERdwU7igUmJqYGBYQ51vr2njU9ZimyKkfDe3axcyiBZde7G6dabliUosJvvKOPcKIWPccCgefSj_GNfwIip3-SsFdlR7BtbVUcqR-yv-XOxJ3UcMI0tz3uMiiZcyPV7sNCU4KRnemRIMHVOfuvHsU60_GhGbiSFzgPTAa9WTltbnarTbxudb_YEOx12JiwYToeX0DCPb43W1tzIBxgm8NxUg

Test all three cases:

# Set the token
export TOKEN=eyJhbGciOiJSUzI1NiIsImtpZCI6IkRIRmJwb0lVcXJZOHQyenBBMnFYZkNtcjVWTzVaRXI0UnpIVV8tZW52dlEiLCJ0eXAiOiJKV1QifQ.eyJleHAiOjQ2ODU5ODk3MDAsImZvbyI6ImJhciIsImlhdCI6MTUzMjM4OTcwMCwiaXNzIjoidGVzdGluZ0BzZWN1cmUuaXN0aW8uaW8iLCJzdWIiOiJ0ZXN0aW5nQHNlY3VyZS5pc3Rpby5pbyJ9.CfNnxWP2tcnR9q0vxyxweaF3ovQYHYZl82hAUsn21bwQd9zP7c-LS9qd_vpdLG4Tn1A15NxfCjp5f7QNBUo-KC9PJqYpgGbaXhaGx7bEdFWjcwv3nZzvc7M__ZpaCERdwU7igUmJqYGBYQ51vr2njU9ZimyKkfDe3axcyiBZde7G6dabliUosJvvKOPcKIWPccCgefSj_GNfwIip3-SsFdlR7BtbVUcqR-yv-XOxJ3UcMI0tz3uMiiZcyPV7sNCU4KRnemRIMHVOfuvHsU60_GhGbiSFzgPTAa9WTltbnarTbxudb_YEOx12JiwYToeX0DCPb43W1tzIBxgm8NxUg

# Test 1: Valid JWT -- expect HTTP 200
kubectl exec $(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c sleep \
  -- curl http://details:9080/details/1 -o /dev/null \
  --header "Authorization: Bearer $TOKEN" -s -w '%{http_code}\n'

# Test 2: Invalid JWT -- expect HTTP 403
kubectl exec $(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c sleep \
  -- curl http://details:9080/details/1 -o /dev/null \
  --header "Authorization: Bearer badtoken" -s -w '%{http_code}\n'

# Test 3: No JWT -- expect HTTP 200
kubectl exec $(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c sleep \
  -- curl http://details:9080/details/1 -o /dev/null -s -w '%{http_code}\n'

The results confirm that request authentication validates JWTs when present but does not block requests without a JWT. To enforce JWT requirements, add an authorization policy.

Require a valid JWT for service access

The following example builds on the request authentication above by requiring a valid JWT for all requests to the details service.

Prerequisites

• Deploy the Bookinfo sample application. For details, see Deploy applications in clusters associated with ASM instances.

• Deploy the sleep test client as described in the request authentication section above.

Create the authorization policy

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the target ASM instance. In the left-side navigation pane, choose Mesh Security Center > AuthorizationPolicy. Click Create from YAML.

3. Select the default namespace and apply the following YAML:

   apiVersion: security.istio.io/v1beta1
   kind: AuthorizationPolicy
   metadata:
     name: require-jwt
     namespace: default
   spec:
     action: ALLOW
     rules:
       - from:
           - source:
               requestPrincipals:
                 - testing@secure.istio.io/testing@secure.istio.io
     selector:
       matchLabels:
         app: details

   This policy allows requests to the details service only when the request principal matches testing@secure.istio.io/testing@secure.istio.io. All other requests are denied.

   For field reference, see Authorization Policy.

4. Click Create.

Verify the policy

Send a request without a JWT:

kubectl exec $(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c sleep \
  -- curl http://details:9080/details/1 -o /dev/null -s -w '%{http_code}\n'

Expected output: 403. The authorization policy blocks requests that lack a valid JWT issued by testing@secure.istio.io.

Reference use cases

• Use authorization policies on the ingress gateway to implement IP-based access control or access control based on custom external authorization.

• A fintech customer uses ASM authorization policies to isolate external-facing zones from application zones, controlling access for cross-cluster, multi-language applications. They also use the egress gateway to audit outbound mesh traffic and combine it with authorization policies to govern access to third-party services.