Control the injection scope of the OPA sidecar proxy for fine-grained authorization and access control - Alibaba Cloud Service Mesh

The Open Policy Agent (OPA) plug-in defines access control policies by injecting an OPA sidecar proxy into your applications. If you need fine-grained authorization and access control for applications in specific namespaces, you can enable injection scope control. After you enable this feature, an OPA sidecar proxy is injected only into pods in namespaces labeled withopa-istio-injection=enabled, enabling finer-grained access control.

Prerequisites

You have added a cluster to an ASM instance, and the instance is version 1.12.4.19 or later. For more information, see Add a cluster to an ASM instance.
You have created the default and develop namespaces. For more information, see Manage namespaces and quotas.

You have deployed an Nginx application in the default namespace and a sleep application in the develop namespace. For more information, see Create a stateless Deployment.

Nginx and sleep examples

Use the following content to create nginx.yaml and sleep.yaml.

nginx.yaml

apiVersion: apps/v1 # for versions before 1.9.0 use apps/v1beta2
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 1
  template:
    metadata:
      labels:
        app: nginx
        sidecarset-injected: "true"
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: nginx
spec:
  ports:
    - name: http
      port: 80
      protocol: TCP
      targetPort: 80
  selector:
    app: nginx
  type: ClusterIP

sleep.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: sleep
---
apiVersion: v1
kind: Service
metadata:
  name: sleep
  labels:
    app: sleep
    service: sleep
spec:
  ports:
  - port: 80
    name: http
  selector:
    app: sleep
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: sleep
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sleep
  template:
    metadata:
      labels:
        app: sleep
    spec:
      terminationGracePeriodSeconds: 0
      serviceAccountName: sleep
      containers:
      - name: sleep
        image: curlimages/curl
        command: ["/bin/sleep", "infinity"]
        imagePullPolicy: IfNotPresent
        volumeMounts:
        - mountPath: /etc/sleep/tls
          name: secret-volume
      volumes:
      - name: secret-volume
        secret:
          secretName: sleep-secret
          optional: true
---

Run the following commands to deploy the Nginx application in the default namespace and the sleep application in the develop namespace:
```
kubectl apply -f nginx.yaml -n default
kubectl apply -f sleep.yaml -n develop
```

Step 1: Enable OPA and scope control

In this topic, after the OPA plugin and injection scope control are enabled, the opa-istio-injection=enabled label is added to the default namespace, but the opa-istio-injection=enabled label is not added to the develop namespace. You can then check whether the OPA sidecar proxy is injected into the Nginx and Sleep applications to verify that you have successfully controlled the injection scope of the OPA sidecar proxy.

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Mesh Security Center > OPA Policy.
On the OPA Policy page, select Enable the Open Policy Agent (OPA) plug-in and Enable the feature of controlling the OPA injection scope. Then, click Enable OPA and click OK in the Note dialog box.

Step 2: Label the namespace

The following steps describe how to add theopa-istio-injection=enabled label to the default namespace in the ACK console. Alternatively, you can connect to the cluster with kubectl and run the kubectl label namespace default opa-istio-injection=enabled --overwrite command to add the label. For more information about how to connect to a cluster, see Obtain the KubeConfig of a cluster and use kubectl to connect to the cluster.

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Namespaces and Quotas.
On the Namespaces page, click Edit in the Actions column of the default namespace.
In the Edit Namespace dialog box, set the label name to opa-istio-injection and the value to enabled, click Add, and then click OK.

Step 3: Restart the applications

Restart the applications by deleting their pods to trigger the automatic injection of the OPA sidecar proxy.

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Workloads > Pods.
On the Pods page, set Namespace to default. In the Actions column for the Nginx application pod, click More > Delete. In the Note dialog box, click OK.
If your application has multiple pods, delete all of them to restart it. The restart is successful when the pod's status is Running.
Repeat the preceding steps to restart the sleep application's pod in the develop namespace.

Step 4: Verify scope control

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Workloads > Pods.
On the Pods page, check whether the Nginx and sleep applications are injected with the OPA sidecar proxy.
- Set Namespace to default and click the name of the Nginx application. On the Containers tab, you can see opa-istio, which indicates that the Nginx application is injected with the OPA sidecar proxy.
- Set Namespace to develop and click the name of the sleep application. On the Containers tab, you do not see opa-istio, which indicates that the sleep application is not injected with the OPA sidecar proxy.
These results show that after you enable injection scope control, applications in namespaces labeled withopa-istio-injection=enabled are injected with the OPA sidecar proxy, while applications in namespaces without theopa-istio-injection=enabled label are not injected. This confirms that injection scope control works as expected.