Alibaba Cloud Service Mesh:Configure an authorization policy for HTTP traffic

Step 1: Configure a deny-all authorization policy

First, configure a baseline policy to deny all requests to the workloads. You will then incrementally grant specific permissions.

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Mesh Security Center > AuthorizationPolicy. On the page that appears, click Create from YAML.

3. On the Create page, select default from the Namespaces drop-down list, select any Scenario Template, paste the following YAML content into the YAML editor, and then click Create.

   apiVersion: security.istio.io/v1beta1
   kind: AuthorizationPolicy
   metadata:
     name: allow-nothing
     namespace: default
   spec:
     {}

   After the policy is created, the allow-nothing authorization policy appears on the AuthorizationPolicy page.

4. In your browser's address bar, enter http://{your_ingress_gateway_address}/productpage to access the Bookinfo application.

   The page returns RBAC: access denied, which indicates that you do not have the required permissions. For information about how to obtain the gateway IP address, see Obtain an ingress gateway address.

Step 2: Configure policy for the Productpage service

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Mesh Security Center > AuthorizationPolicy.

3. Use one of the following methods to create an authorization policy that allows access to the Productpage service.

   Method 1: Create from YAML

   1. On the AuthorizationPolicy page, click Create from YAML.

   2. On the Create page, select default from the Namespaces drop-down list, select any Scenario Template, paste the following YAML content into the YAML editor, and then click Create.

      apiVersion: security.istio.io/v1beta1
      kind: AuthorizationPolicy
      metadata:
        name: "productpage-viewer"
        namespace: default
      spec:
        selector:
          matchLabels:
            app: productpage
        action: ALLOW
        rules:
        - to:
          - operation:
              methods: ["GET"]

   Method 2: Create by using the UI

   1. On the AuthorizationPolicy page, click Create.

   2. On the Create page, configure the parameters as described in the following table, and then click Create.

      Parameter	Description
      Name	Enter productpage-viewer.
      Policy Type	Select ALLOW.
      Namespaces	On the Workload Scope tab, set Namespaces to default.
      Effective Scope	Select Service.
      Workload	Select productpage.
      Request Matching Rules	In the Add Request Target section, enable Methods and set the value to GET.

   After the policy is created, the productpage-viewer authorization policy appears on the AuthorizationPolicy page.

4. In your browser's address bar, enter http://{your_ingress_gateway_address}/productpage to access the Bookinfo application.

   You can now access the Productpage page. However, the Details and Reviews services fail to load because they still require authorization.

Step 3: Configure policy for the Details service

Configure an authorization policy for the Details service to allow requests from the Productpage serviceAccount.

1. Obtain the value of the serviceAccount parameter for the Productpage workload.

   1. Log on to the ACK console. In the left navigation pane, click Clusters.

   2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Workloads > Deployments.

   3. On the Deployments page, find the productpage-v1 deployment. In the Actions column, choose More > View in YAML to find the value of the serviceAccount parameter.

      The value of the serviceAccount parameter is bookinfo-productpage.

      dnsPolicy: ClusterFirst
            restartPolicy: Always
            schedulerName: default-scheduler
            securityContext: {}
            serviceAccount: bookinfo-productpage
            serviceAccountName: bookinfo-productpage

2. Create the authorization policy.

   1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

   2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Mesh Security Center > AuthorizationPolicy.

   3. Create the authorization policy using one of the following methods.

      Method 1: Create from YAML

      1. On the AuthorizationPolicy page, click Create from YAML.

      2. On the Create page, select default from the Namespaces drop-down list, select any Scenario Template, paste the following YAML content into the YAML editor, and then click Create.

         kind: AuthorizationPolicy
         apiVersion: security.istio.io/v1beta1
         metadata:
           name: details-viewer
           namespace: default
         spec:
           action: ALLOW
           rules:
             - to:
                 - operation:
                     methods:
                       - GET
             - from:
                 - source:
                     principals:
                       - cluster.local/ns/default/sa/bookinfo-productpage # This is the serviceAccount value obtained in the previous sub-step.
           selector:
             matchLabels:
               app: details

      Method 2: Create by using the UI

      1. On the AuthorizationPolicy page, click Create.

      2. On the Create page, configure the parameters as described in the following table, and then click Create.

         Parameter	Description
         Name	Enter details-viewer.
         Policy Type	Select ALLOW.
         Namespaces	On the Workload Scope tab, set Namespaces to default.
         Effective Scope	Select Service.
         Workload	Select details.
         Request Matching Rules	In the Add Request Source section, enable Principals and set the value to cluster.local/ns/default/sa/bookinfo-productpage. Note bookinfo-productpage is the value of the serviceAccount parameter that you obtained in the first sub-step. In the Add Request Target section, enable Methods and set the value to GET.

      After the policy is created, the details-viewer authorization policy appears on the AuthorizationPolicy page.

3. In your browser's address bar, enter http://{your_ingress_gateway_address}/productpage to access the Bookinfo application.

   The Details service is now accessible, but the Reviews service is not.

Step 4: Configure policy for the Reviews service

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Mesh Security Center > AuthorizationPolicy.

3. Create the authorization policy using one of the following methods.

   Method 1: Create from YAML

   1. On the AuthorizationPolicy page, click Create from YAML.

   2. On the Create page, select default from the Namespaces drop-down list, select any Scenario Template, paste the following YAML content into the YAML editor, and then click Create.

      kind: AuthorizationPolicy
      apiVersion: security.istio.io/v1beta1
      metadata:
        name: reviews-viewer
        namespace: default
      spec:
        action: ALLOW
        rules:
          - to:
              - operation:
                  methods:
                    - GET
          - from:
              - source:
                  principals:
                    - cluster.local/ns/default/sa/bookinfo-productpage
        selector:
          matchLabels:
            app: reviews

   Method 2: Create by using the UI

   1. On the AuthorizationPolicy page, click Create.

   2. On the Create page, configure the parameters as described in the following table, and then click Create.

      Parameter	Description
      Name	Enter reviews-viewer.
      Policy Type	Select ALLOW.
      Namespaces	On the Workload Scope tab, set Namespaces to default.
      Effective Scope	Select Service.
      Workload	Select reviews.
      Request Matching Rules	In the Add Request Source section, enable Principals and set the value to cluster.local/ns/default/sa/bookinfo-productpage. Note bookinfo-productpage is the value of the serviceAccount parameter that you obtained in Step 3. In the Add Request Target section, enable Methods and set the value to GET.

   After the policy is created, the reviews-viewer authorization policy appears on the AuthorizationPolicy page.

4. In your browser's address bar, enter http://{your_ingress_gateway_address}/productpage to access the Bookinfo application.

   Both the Details and Reviews services are now accessible.

Related documents

• Misconfigured authorization policies can cause unintended access denials or grants. To prevent this, you can use the dry-run mode to test a policy's effects by analyzing logs before enforcement. For more information, see Use the dry-run mode for an ASM authorization policy.

• To apply fine-grained control over TCP traffic between services, see Configure an authorization policy for TCP traffic.

• To control access to services outside the mesh, see Control access from services in a mesh to an external website and Control access from services in a mesh to an external database.

• You can customize the content of ASM gateway access logs to promptly identify potential security issues. For more information, see Generate and collect ASM gateway access logs.

• You can enable the mesh audit feature to record and trace user operations. You can also configure audit alerts for operations on mesh resources to be notified when critical resources are modified. For more information, see Use KubeAPI operation audit and Configure audit alerts for operations on mesh resources.