Configure an authorization policy for TCP traffic to improve service security and reliability - Alibaba Cloud Service Mesh

Prerequisites

The cluster is added to the ASM instance.
Istio resources are defined. For more information, see Use Istio resources to route traffic based on version.
The foo namespace is created and sidecar proxy injection is enabled. For more information, see Create a namespace and Enable automatic injection.

Step 1: Deploy the sample applications

Deploy tcp-echo as the target TCP service that receives requests and sleep as the client TCP service that sends requests.

Deploy the target TCP service.

Create a tcp-echo.yaml file with the following content:

When the tcp-echo service receives a request, it adds the hello prefix to the request content and returns the result. For example, if you send world to tcp-echo, the service returns hello world.

tcp-echo.yaml

apiVersion: v1
kind: Service
metadata:
  name: tcp-echo
  labels:
    app: tcp-echo
    service: tcp-echo
spec:
  ports:
  - name: tcp
    port: 9000
  - name: tcp-other
    port: 9001
  selector:
    app: tcp-echo
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tcp-echo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: tcp-echo
      version: v1
  template:
    metadata:
      labels:
        app: tcp-echo
        version: v1
    spec:
      containers:
      - name: tcp-echo
        image: docker.io/istio/tcp-echo-server:1.2
        imagePullPolicy: IfNotPresent
        args: [ "9000,9001,9002", "hello" ]
        ports:
        - containerPort: 9000
        - containerPort: 9001

Use kubectl to connect to the cluster and run the following command to deploy the tcp-echo service to the foo namespace.

For more information about how to use kubectl to connect to a cluster, see Obtain the kubeconfig file of a cluster and use kubectl to connect to the cluster.
```
kubectl apply -f tcp-echo.yaml -n foo
```

Deploy the client TCP service.

Create a sleep.yaml file with the following content:

sleep.yaml

#Sleep service
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sleep
---
apiVersion: v1
kind: Service
metadata:
  name: sleep
  labels:
    app: sleep
    service: sleep
spec:
  ports:
  - port: 80
    name: http
  selector:
    app: sleep
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: sleep
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sleep
  template:
    metadata:
      labels:
        app: sleep
    spec:
      terminationGracePeriodSeconds: 0
      serviceAccountName: sleep
      containers:
      - name: sleep
        image: curlimages/curl
        command: ["/bin/sleep", "3650d"]
        imagePullPolicy: IfNotPresent
        volumeMounts:
        - mountPath: /etc/sleep/tls
          name: secret-volume
      volumes:
      - name: secret-volume
        secret:
          secretName: sleep-secret
          optional: true
---

Run the following command to deploy the sleep service to the foo namespace.
```
kubectl apply -f sleep.yaml -n foo
```

Step 2: Verify the connection before authorization

Before you create the authorization policy, confirm that the sleep service can reach both ports of the tcp-echo service. These results are the baseline for the verification in Step 4.

Run the following command to verify that the sleep service can access the tcp-echo service on port 9001.

kubectl exec "$(kubectl get pod -l app=sleep -n foo -o jsonpath={.items..metadata.name})" -c sleep -n foo -- sh -c 'echo "port 9001" | nc tcp-echo 9001' | grep "hello" && echo 'connection succeeded' || echo 'connection rejected'

Expected output:

hello port 9001
connection succeeded

The output confirms that the sleep service can access the tcp-echo service on port 9001.

Run the following command to verify that the sleep service can access the tcp-echo service on port 9000.

kubectl exec "$(kubectl get pod -l app=sleep -n foo -o jsonpath={.items..metadata.name})" -c sleep -n foo -- sh -c 'echo "port 9000" | nc tcp-echo 9000' | grep "hello" && echo 'connection succeeded' || echo 'connection rejected'

Expected output:

hello port 9000
connection succeeded

The output confirms that the sleep service can access the tcp-echo service on port 9000.

Step 3: Configure the authorization policy

Configure an authorization policy that allows access to the tcp-echo service on port 9000. The policy takes effect on the entire foo namespace, and its rules allow access only on port 9000. Access on port 9001 is therefore denied after the policy is created. Verify this in Step 4.

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
1. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Mesh Security Center > AuthorizationPolicy.

Create an authorization policy by using one of the following methods.

Method 1: Create the authorization policy by using YAML

On the AuthorizationPolicy page, click Create from YAML.

On the Create page, set Namespaces to foo, select any Scenario Template, paste the following YAML template into the YAML area, and then click Create.

kind: AuthorizationPolicy
apiVersion: security.istio.io/v1beta1
metadata:
  name: demo
  namespace: foo
spec:
  action: ALLOW
  rules:
    - to:
        - operation:
            ports:
              - '9000'

Method 2: Create the authorization policy in the console UI

Important

When you configure a TCP authorization policy, do not turn on the Methods switch. This setting applies only to HTTP requests and does not create a valid ALLOW rule for TCP traffic. The Service Mesh ignores invalid ALLOW rules, which causes requests to be denied and connection rejected to be returned.

On the AuthorizationPolicy page, click Create.

On the Create page, configure the following settings, and then click Create.

Parameter	Description
Name	In this example, enter `demo`.
Policy Type	Select ALLOW.
Namespaces	On the Workload Scope tab, select the `foo` namespace.
Effective Scope	Select Namespace Scope.
Request Matching Rules	In the Add Request Target section, turn on the Ports switch and set the value to `9000`.

Step 4: Verify the connection after authorization

After the authorization policy is created, run the same two connection tests as in Step 2 and compare the results.

Run the following command to verify that access to the tcp-echo service on port 9001 is denied.

kubectl exec "$(kubectl get pod -l app=sleep -n foo -o jsonpath={.items..metadata.name})" -c sleep -n foo -- sh -c 'echo "port 9001" | nc tcp-echo 9001' | grep "hello" && echo 'connection succeeded' || echo 'connection rejected'

Expected output:

connection rejected

The connection rejected output confirms that the sleep service can no longer access the tcp-echo service on port 9001.

Run the following command to verify that access to the tcp-echo service on port 9000 is still allowed.

kubectl exec "$(kubectl get pod -l app=sleep -n foo -o jsonpath={.items..metadata.name})" -c sleep -n foo -- sh -c 'echo "port 9000" | nc tcp-echo 9000' | grep "hello" && echo 'connection succeeded' || echo 'connection rejected'

Expected output:

hello port 9000
connection succeeded

Port 9001 is denied and port 9000 is still reachable, which confirms that the authorization policy takes effect as expected.

Note

A misconfigured authorization policy can cause requests to be unexpectedly denied or allowed. If either command does not return the expected output, use the trial mode of an ASM authorization policy to determine from the logs whether the policy produces the expected result. Then turn off the trial mode to make the authorization policy take effect. For more information, see Use trial mode for an ASM authorization policy.

References

To control HTTP traffic between services at a fine granularity, see Configure an authorization policy for HTTP traffic.
To control access to services outside the mesh, see Control access from services in the mesh to external websites and Control access from services in the mesh to external databases.
Customize the content of ASM gateway access logs to identify potential security issues promptly. For more information, see Generate and collect ASM gateway access logs.
Enable mesh audit to record and trace the daily operations of different users. Additionally, configure audit alerts for mesh resource operations, which send alert notifications to the alert contacts when critical resources change. For more information, see Use KubeAPI operation audit and Configure audit alerts for mesh resource operations.