Control egress traffic to an external website by using an authorization policy - Alibaba Cloud Service Mesh

In a Kubernetes cluster, a NetworkPolicy can control which services in a namespace can access specific external websites. However, a NetworkPolicy provides coarse-grained network isolation and may not be sufficient for application or business security. You can use Alibaba Cloud Service Mesh (ASM) to dynamically configure an authorization policy for fine-grained control over outbound access, to reduce security risks. This topic demonstrates how to block all services in the demo-frontend namespace from accessing the external website aliyun.com.

Prerequisites

The cluster is added to the ASM instance. For more information, see Add a cluster to an ASM instance.
A namespace named demo-frontend has been created, and sidecar proxy injection has been enabled for it. For more information, see Manage global namespaces.

Step 1: Create a test service

Obtain the kubeconfig file of the cluster and use kubectl to connect to the cluster.

Create a sleep service in the demo-frontend namespace.

Create a file named sleep.yaml with the following content.

sleep.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: sleep
---
apiVersion: v1
kind: Service
metadata:
  name: sleep
  labels:
    app: sleep
    service: sleep
spec:
  ports:
  - port: 80
    name: http
  selector:
    app: sleep
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: sleep
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sleep
  template:
    metadata:
      labels:
        app: sleep
    spec:
      terminationGracePeriodSeconds: 0
      serviceAccountName: sleep
      containers:
      - name: sleep
        image: curlimages/curl
        command: ["/bin/sleep", "3650d"]
        imagePullPolicy: IfNotPresent
        volumeMounts:
        - mountPath: /etc/sleep/tls
          name: secret-volume
      volumes:
      - name: secret-volume
        secret:
          secretName: sleep-secret
          optional: true
---

Run the following command to create the sleep service.
```
kubectl apply -f sleep.yaml -n demo-frontend
```

Verify that a sidecar proxy is injected into the test service.
1. Log on to the ACK console. In the left navigation pane, click Clusters.
2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Workloads > Pods.
3. At the top of the Pods page, select demo-frontend from the Namespace drop-down list and click the name of the pod that runs the sleep service.
  
  On the Containers tab, you can find a container named istio-proxy. This indicates that the sidecar proxy was successfully injected.

Step 2: Create an egress gateway

When services in a Service Mesh access websites outside the mesh, you can use an egress gateway to manage the traffic. After you configure an authorization policy for the egress gateway, you can set conditions to control access to external websites. In this topic, the egress gateway is named egressgateway. For more information, see Create an egress gateway.

Step 3: Configure the outbound traffic policy

By default, services in a service mesh can access all external services. To control access to specific external websites, you must set the outbound traffic policy to REGISTRY_ONLY. This ensures that services in the Service Mesh can access only external services registered as a ServiceEntry.

Configure the outbound traffic policy.
1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Data Plane Component Management > Configure the agent parameters of the injected Sidecar.
3. On the global tab, click Outbound Traffic Policy, set Outbound Traffic Policy to REGISTRY_ONLY, and then click Update Settings.
Register the external service as a ServiceEntry.
1. On the details page of the ASM instance, choose Cluster & Workload Management > External Service(ServiceEntry) in the left-side navigation pane. On the page that appears, click Create from YAML.
2. Set Namespace to istio-system, copy the following content to the text box, and then click Create.
```
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: aliyuncom-ext
  namespace: istio-system
spec:
  hosts:
    - www.aliyun.com  
  location: MESH_EXTERNAL
  ports:
    - name: http
      number: 80
      protocol: HTTP
    - name: tls
      number: 443
      protocol: TLS
  resolution: DNS
```

Step 4: Create traffic policies

Create a gateway rule, a destination rule, and a virtual service to route traffic from the demo-frontend namespace to the egress gateway, which then routes the traffic to the external website.

Use the following YAML content to create a gateway rule in the istio-system namespace. For more information, see Manage gateway rules.
```
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: istio-egressgateway
  namespace: istio-system
spec:
  selector:
    istio: egressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTPS
      tls:
        mode: ISTIO_MUTUAL
      hosts:
        - '*'
```
Setting mode to ISTIO_MUTUAL enables mutual TLS (mTLS) authentication. This requires services within the mesh to use mTLS authentication when sending traffic through the egress gateway.

Use the following YAML content to create a destination rule in the demo-frontend namespace. For more information, see Manage destination rules.

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: target-egress-gateway
  namespace: demo-frontend
spec:
  host: istio-egressgateway.istio-system.svc.cluster.local
  subsets:
    - name: target-egress-gateway-mTLS
      trafficPolicy:
        loadBalancer:
          simple: ROUND_ROBIN
        tls:
          mode: ISTIO_MUTUAL

Setting mode to ISTIO_MUTUAL enables mutual TLS (mTLS) authentication. mTLS is required for traffic to the egress gateway.

Use the following content to create a virtual service in the demo-frontend namespace. For more information, see Manage virtual services.

VirtualService YAML

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: example-com-through-egress-gateway
  namespace: demo-frontend
spec:
  exportTo:
    - istio-system
    - demo-frontend
  gateways:
    - mesh
    - istio-system/istio-egressgateway
  hosts:
    - www.aliyun.com
  http:
    - match:
        - gateways:
            - mesh
          port: 80
      route:
        - destination:
            host: istio-egressgateway.istio-system.svc.cluster.local
            port:
              number: 80
            subset: target-egress-gateway-mTLS
          weight: 100
    - match:
        - gateways:
            - istio-system/istio-egressgateway
          port: 80
      route:
        - destination:
            host: www.aliyun.com
            port:
              number: 80
          weight: 100

The http section defines two matching rules:

The first rule sets gateways to mesh. This rule applies to sidecar proxies in the demo-frontend namespace, routing traffic from this namespace to the egress gateway.
The second rule sets gateways to istio-system/istio-egressgateway. This rule routes traffic from the egress gateway to the registered external service.

Step 5: Create an authorization policy

Create an authorization policy in the demo-frontend namespace that applies to the egressgateway to deny requests from this namespace.

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Mesh Security Center > AuthorizationPolicy. On the page that appears, click Create.

On the Create page, configure the parameters and click Create.

Parameter	Description
Name	Enter a name for the authorization policy.
Policy Type	Select DENY.
ASM Gateway	On the Gateway Scope tab, set ASM Gateway to egressgateway.
Request Matching Rules	In the Add Request Source section, enable Namespaces and set the value to `demo-frontend`.

Step 6: Verify access control

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Workloads > Pods.
At the top of the Pods page, select demo-frontend from the Namespace drop-down list. In the Actions column for the sleep pod, click Terminal > sleep.
Run the following command to access the external website aliyun.com.
```
curl -I http://www.aliyun.com
```
Expected output:
```
HTTP/1.1 403 Forbidden
content-length: 19
content-type: text/plain
date: Thu, 12 Oct 2023 07:14:09 GMT
server: envoy
x-envoy-upstream-service-time: 4
```
The 403 Forbidden response indicates that the authorization policy successfully blocked the request from the demo-frontend namespace to the external website aliyun.com.