Control OPA sidecar injection scope - Alibaba Cloud Service Mesh

The Open Policy Agent (OPA) plug-in defines access control policies by injecting an OPA sidecar proxy into applications. To apply fine-grained authorization and access control for applications in specific namespaces, enable OPA injection scope control. This feature injects an OPA sidecar proxy only into pods in namespaces labeled with opa-istio-injection=enabled, enabling more fine-grained access control.

Prerequisites

A cluster added to an ASM instance of v1.12.4.19 or later. For more information, see Add a cluster to an ASM instance.
The default and develop namespaces created. For more information, see Manage namespaces and quotas.

An Nginx application deployed in the default namespace and a Sleep application deployed in the develop namespace. For more information, see Create a stateless workload Deployment.

Example applications

Create nginx.yaml and sleep.yaml files with the following content.

nginx.yaml

apiVersion: apps/v1 # for versions before 1.9.0 use apps/v1beta2
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 1
  template:
    metadata:
      labels:
        app: nginx
        sidecarset-injected: "true"
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: nginx
spec:
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: 80
  selector:
    app: nginx
  type: ClusterIP

sleep.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: sleep
---
apiVersion: v1
kind: Service
metadata:
  name: sleep
  labels:
    app: sleep
    service: sleep
spec:
  ports:
  - port: 80
    name: http
  selector:
    app: sleep
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: sleep
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sleep
  template:
    metadata:
      labels:
        app: sleep
    spec:
      terminationGracePeriodSeconds: 0
      serviceAccountName: sleep
      containers:
      - name: sleep
        image: curlimages/curl
        command: ["/bin/sleep", "infinity"]
        imagePullPolicy: IfNotPresent
        volumeMounts:
        - mountPath: /etc/sleep/tls
          name: secret-volume
      volumes:
      - name: secret-volume
        secret:
          secretName: sleep-secret
          optional: true
---

Run the following commands to deploy the Nginx application in the default namespace and the Sleep application in the develop namespace.
```
kubectl apply -f nginx.yaml -n default
kubectl apply -f sleep.yaml -n develop
```

Step 1: Enable OPA and scope control

In this article, after you enable the OPA plugin and injection scope control, you add the opa-istio-injection=enabled label to the default namespace but do not add the opa-istio-injection=enabled label to the develop namespace. You can then check whether the OPA sidecar proxy is injected into the Nginx and Sleep applications to verify that the injection scope is successfully controlled.

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Mesh Security Center > OPA Policy.
On the OPA Policy page, select Enable Open Policy Agent (OPA) Plugin and Enable OPA Injection Scope Control. Click Enable OPA, and then click OK in the Note dialog box.

Step 2: Add a label to the namespace

This topic describes how to add the opa-istio-injection=enabled label to the default namespace in the ACK console. Alternatively, connect to the cluster by using the kubectl tool and run the kubectl label namespace default opa-istio-injection=enabled --overwrite command. For more information, see Obtain a kubeconfig file and use kubectl to connect to a cluster.

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Namespaces and Quotas.
On the Namespaces page, find the default namespace and click Edit in the Actions column.
In the Edit Namespace dialog box, set the label name to opa-istio-injection and the value to enabled. Click Add, and then click OK.

Step 3: Restart the applications

Restart the applications by deleting their pods. The OPA sidecar proxy is automatically injected after the restart.

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Workloads > Pods.
At the top of the Pods page, set Namespace to default. For the Nginx application pod, click More > Delete in the Actions column. In the Note dialog box, click OK.

If an application has multiple pods, you must delete all of them to restart the application. The restart is complete when the pod status changes to Running.
Repeat the preceding steps to restart the pod for the Sleep application in the develop namespace.

Step 4: Verify injection scope

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Workloads > Pods.
On the Pods page, check whether the OPA sidecar proxy is injected into the Nginx and Sleep applications.
- Set Namespace to default and click the name of the Nginx application pod. On the Containers tab, the opa-istio container is visible, indicating that the OPA sidecar proxy is injected into the Nginx application.
- Set the Namespace to develop and click the name of the Sleep application. On the Containers tab, you can see that opa-istio is not displayed. Only the istio-proxy and sleep containers are listed, and the opa-istio container is absent. This indicates that the OPA sidecar proxy is not injected into the Sleep application and that the OPA injection scope control has taken effect.
The results show that the OPA sidecar proxy is injected into applications in namespaces with the opa-istio-injection=enabled label, but not into applications in namespaces without this label. This confirms that you have successfully controlled the OPA injection scope.