Alibaba Cloud Service Mesh:Implement custom authorization by using the HTTP protocol

How it works

When a client sends a request to a protected service, the Envoy sidecar intercepts the request and forwards it to the external authorization service. The authorization service inspects request attributes -- headers, path, and method -- and returns an allow or deny decision. Envoy then either forwards the request to the upstream service or returns an error to the caller.

Client  -->  Envoy sidecar  -->  ext-authz service
                  |                      |
                  |<-- allow/deny -------+
                  |
         allow --> upstream service
         deny  --> 403 Forbidden to caller

Behavior details:

• Authorization checks trigger only for requests that match the rules in the authorization policy. For example, you can limit checks to specific paths.

• Requests that do not match any rule pass through without authorization checks.

• If the external authorization service is unavailable, ASM denies all matching requests by default (fail-closed). You can configure fail-open behavior if needed.

Step 1: Deploy the external authorization service

Deploy the ext-authz service in the ACK cluster. This service complies with the Istio external authorization API specification and supports both HTTP and gRPC.

1. Create a file named ext-authz.yaml with the following content:

   View ext-authz.yaml

      apiVersion: v1
      kind: Service
      metadata:
        name: ext-authz
        labels:
          app: ext-authz
      spec:
        ports:
        - name: http
          port: 8000
          targetPort: 8000
        - name: grpc
          port: 9000
          targetPort: 9000
        selector:
          app: ext-authz
      ---
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: ext-authz
      spec:
        replicas: 1
        selector:
          matchLabels:
            app: ext-authz
        template:
          metadata:
            labels:
              app: ext-authz
          spec:
            containers:
            - image: istio/ext-authz:0.6
              imagePullPolicy: IfNotPresent
              name: ext-authz
              ports:
              - containerPort: 8000
              - containerPort: 9000

2. Apply the manifest:

      kubectl apply -f ext-authz.yaml

3. Verify that the Pod is running: Expected output:

      kubectl get pod -l app=ext-authz

      NAME                         READY   STATUS    RESTARTS   AGE
      ext-authz-6b5db88f86-2m7c6   2/2     Running   0          79m

4. Confirm that the authorization service started successfully: Expected output:

      kubectl logs "$(kubectl get pod -l app=ext-authz -n default -o jsonpath={.items..metadata.name})" -n default -c ext-authz

      2023/12/20 08:15:39 Starting gRPC server at [::]:9000
      2023/12/20 08:15:39 Starting HTTP server at [::]:8000

5. Note the HTTP endpoint: ext-authz.default.svc.cluster.local:8000. You need this value when registering the service with ASM in the next step. To confirm the port, go to the ACK console. Navigate to Clusters > *your cluster* > Network > Services, click ext-authz, and check the Endpoint section.

Step 2: Deploy sample applications

Deploy the httpbin and sleep applications to test authorization behavior.

1. Create a file named httpbin.yaml with the following content:

   View httpbin.yaml

      apiVersion: v1
      kind: ServiceAccount
      metadata:
        name: httpbin
      ---
      apiVersion: v1
      kind: Service
      metadata:
        name: httpbin
        labels:
          app: httpbin
          service: httpbin
      spec:
        ports:
        - name: http
          port: 8000
          targetPort: 80
        selector:
          app: httpbin
      ---
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: httpbin
      spec:
        replicas: 1
        selector:
          matchLabels:
            app: httpbin
            version: v1
        template:
          metadata:
            labels:
              app: httpbin
              version: v1
          spec:
            serviceAccountName: httpbin
            containers:
            - image: docker.io/kennethreitz/httpbin
              imagePullPolicy: IfNotPresent
              name: httpbin
              ports:
              - containerPort: 80

2. Apply the manifest:

      kubectl apply -f httpbin.yaml

3. Create a file named sleep.yaml with the following content:

   View sleep.yaml

      apiVersion: v1
      kind: ServiceAccount
      metadata:
        name: sleep
      ---
      apiVersion: v1
      kind: Service
      metadata:
        name: sleep
        labels:
          app: sleep
          service: sleep
      spec:
        ports:
        - port: 80
          name: http
        selector:
          app: sleep
      ---
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: sleep
      spec:
        replicas: 1
        selector:
          matchLabels:
            app: sleep
        template:
          metadata:
            labels:
              app: sleep
          spec:
            terminationGracePeriodSeconds: 0
            serviceAccountName: sleep
            containers:
            - name: sleep
              image: curlimages/curl
              command: ["/bin/sleep", "3650d"]
              imagePullPolicy: IfNotPresent
              volumeMounts:
              - mountPath: /etc/sleep/tls
                name: secret-volume
            volumes:
            - name: secret-volume
              secret:
                secretName: sleep-secret
                optional: true

4. Apply the manifest:

      kubectl apply -f sleep.yaml

Step 3: Register the authorization service with ASM

Register the ext-authz service so that ASM can route authorization checks to it.

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. Click the name of your ASM instance. In the left-side navigation pane, choose Mesh Security Center > Custom Authorization Service, then click Define Custom Authorization Service.

3. On the Register Custom Authorization Service page, click the Custom authorization service (HTTP or gRPC protocol) implemented based on envoy.ext_authz tab. Configure the following parameters and click Create.

Step 4: Create an authorization policy

Create an authorization policy that defines which requests require authorization checks.

1. In the ASM console, navigate to your ASM instance and choose Mesh Security Center > AuthorizationPolicy. Click Create.

2. Configure the following parameters and click Create.

   Parameter	Value for this tutorial	Description
   Name	test1	A name to identify the authorization policy.
   Policy Type	Custom Authorization Service	Delegates authorization to the external authorization service registered in Step 3.
   Custom Authorization Service	httpextauth-test4http(HTTP)	The authorization service registered in Step 3.
   Namespace	default	On the Workload Scope tab, select the namespace where the target workload runs.
   Effective Scope	Service	Apply the policy at the service level.
   Workload	httpbin	The workload to protect with authorization checks.
   Request Matching Rules	Paths: /headers	Under Add Request Target, turn on Paths and set the value to /headers. Only requests to this path trigger authorization.

Step 5: Verify the authorization behavior

Run three test cases from the sleep Pod to confirm that authorization works as expected.

kubectl exec "$(kubectl get pod -l app=sleep -n default -o jsonpath={.items..metadata.name})" \
  -c sleep -n default -- \
  curl "http://httpbin.default:8000/ip" -s -o /dev/null -w "%{http_code}\n"

kubectl exec "$(kubectl get pod -l app=sleep -n default -o jsonpath={.items..metadata.name})" \
  -c sleep -n default -- \
  curl "http://httpbin.default:8000/headers" -H "x-ext-authz: deny" -s -i

HTTP/1.1 403 Forbidden
x-ext-authz-check-result: denied
...
denied by ext_authz for not found header `x-ext-authz: allow` in the request

kubectl exec "$(kubectl get pod -l app=sleep -n default -o jsonpath={.items..metadata.name})" \
  -c sleep -n default -- \
  curl "http://httpbin.default:8000/headers" -H "x-ext-authz: allow" -s

{
  "headers": {
    "Accept": "*/*",
    "Host": "httpbin.default:8000",
    "User-Agent": "curl/8.5.0",
    "X-Ext-Authz": "allow",
    "X-Ext-Authz-Check-Result": "allowed",
    ...
  }
}

Security and operational considerations

• Fail-open vs. fail-closed: By default, ASM denies requests when the authorization service is unavailable (fail-closed). To switch to fail-open mode, enable Skip authentication while authorization service is unavailable in the authorization service configuration. Evaluate the security impact before enabling fail-open in production -- a fail-open configuration allows unauthenticated requests when the authorization service is down.

• Filter ordering: Place authorization checks early in the request processing pipeline. If other filters (such as Lua filters) modify routing after the authorization check, requests could bypass authorization. For more information about this risk, see the Envoy ext_authz documentation.

• Timeout tuning: Set the authorization timeout based on the expected latency of your authorization service. A timeout that is too short may cause false denials under load.

Clean up

Remove the resources created in this tutorial:

kubectl delete -f ext-authz.yaml
kubectl delete -f httpbin.yaml
kubectl delete -f sleep.yaml

Also delete the authorization service and policy from the ASM console:

1. Navigate to Mesh Security Center > AuthorizationPolicy, select the test1 policy, and delete it.

2. Navigate to Mesh Security Center > Custom Authorization Service, select test4http, and delete it.

What's next

• Develop an HTTP-based custom authorization service: Build a production-grade authorization service tailored to your business logic.

• Develop a gRPC-based custom authorization service: Use gRPC instead of HTTP for lower-latency authorization checks.

• Implement custom authorization by using the gRPC protocol: Configure ASM to use a gRPC-based external authorization service.

• Use an authorization policy to control access traffic from services in an ASM instance to an external website: Manage outbound traffic from services in your ASM instance to external websites.

• Use an authorization policy to control access traffic from services in an ASM instance to an external database: Manage outbound traffic from services in your ASM instance to external databases.

• Use the KubeAPI operation audit feature in ASM: Record and trace daily operations of different users in your ASM instance.

• Configure audit alerts for ASM resource operations: Monitor and alert on changes to ASM configurations.