Alibaba Cloud Service Mesh:Run an ASM authorization policy in trial mode

How trial mode works

When you enable trial mode on an authorization policy, Service Mesh (ASM) evaluates every request against the policy and logs the decision, but does not allow or deny traffic based on the result. This lets you:

• Verify that the policy matches the intended requests.

• Identify false positives (legitimate requests that would be denied) or false negatives (unauthorized requests that would be allowed).

• Fine-tune policy rules before enforcement.

After the logs confirm correct behavior, disable trial mode to start enforcement.

Step 1: Deploy sample applications and verify connectivity

This walkthrough uses two applications -- sleep (a curl client) and httpbin (an HTTP echo server) -- to demonstrate trial mode end to end.

1. Create a file named sleep.yaml with the following content:

   sleep.yaml

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: sleep
     namespace: foo
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: sleep
     namespace: foo
     labels:
       app: sleep
       service: sleep
   spec:
     ports:
     - port: 80
       name: http
     selector:
       app: sleep
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: sleep
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: sleep
     template:
       metadata:
         labels:
           app: sleep
       spec:
         terminationGracePeriodSeconds: 0
         serviceAccountName: sleep
         containers:
         - name: sleep
           image: curlimages/curl
           command: ["/bin/sleep", "3650d"]
           imagePullPolicy: IfNotPresent
           volumeMounts:
           - mountPath: /etc/sleep/tls
             name: secret-volume
         volumes:
         - name: secret-volume
           secret:
             secretName: sleep-secret
             optional: true

2. Connect to your cluster with kubectl and deploy the sleep application in the foo namespace. For connection instructions, see Obtain the kubeconfig file of a cluster and use kubectl to connect to the cluster.

   kubectl apply -f sleep.yaml -n foo

3. Create a file named httpbin.yaml with the following content:

   httpbin.yaml

   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: httpbin
     namespace: foo
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: httpbin
     namespace: foo
     labels:
       app: httpbin
       service: httpbin
   spec:
     ports:
     - name: http
       port: 8000
       targetPort: 80
     selector:
       app: httpbin
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: httpbin
     namespace: foo
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: httpbin
         version: v1
     template:
       metadata:
         labels:
           app: httpbin
           version: v1
       spec:
         serviceAccountName: httpbin
         containers:
         - image: docker.io/kennethreitz/httpbin
           imagePullPolicy: IfNotPresent
           name: httpbin
           ports:
           - containerPort: 80

4. Deploy the httpbin application in the foo namespace:

   kubectl apply -f httpbin.yaml -n foo

5. Send 20 requests from the sleep pod to httpbin to confirm connectivity:

   for i in {1..20}; do kubectl exec "$(kubectl get pod -l app=sleep -n foo -o jsonpath={.items..metadata.name})" -c sleep -n foo -- curl http://httpbin.foo:8000/headers -s -o /dev/null -w "%{http_code}\n"; done

   Expected output:

   200
   200
   200
   ...

   Every request returns 200, confirming that the sleep pod can reach httpbin over the mesh.

Step 2: Create an authorization policy with trial mode enabled

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of your ASM instance. In the left-side navigation pane, choose Mesh Security Center > AuthorizationPolicy. Click Create.

3. Configure the authorization policy to deny the target requests, enable trial mode (the Commissioning mode toggle), and click Create.

   

Step 3: Verify trial mode results

With trial mode enabled, the authorization policy logs its decisions without blocking traffic. Verify results through proxy logs.

Step 4: Disable trial mode to enforce the policy

After the logs confirm that the authorization policy matches only the intended requests, disable trial mode to start enforcement.

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of your ASM instance. In the left-side navigation pane, choose Mesh Security Center > AuthorizationPolicy.

3. Find the authorization policy created in Step 2. Turn off the switch in the Commissioning mode column, then click OK in the Submit dialog.

4. Send 20 requests again to verify that the policy now rejects traffic:

   for i in {1..20}; do kubectl exec "$(kubectl get pod -l app=sleep -n foo -o jsonpath={.items..metadata.name})" -c sleep -n foo -- curl http://httpbin.foo:8000/headers -s -o /dev/null -w "%{http_code}\n"; done

   Expected output:

   403
   403
   403
   ...

   Every request now returns 403, confirming that the authorization policy is active.

5. Restore the sidecar proxy RBAC log level to warning:

   kubectl exec "$(kubectl get pod -l app=httpbin -n foo -o jsonpath={.items..metadata.name})" -c istio-proxy -n foo -- curl -X POST 127.0.0.1:15000/logging?rbac=warning

   Verify that the output includes rbac: warning:

   active loggers:
     ...
     rbac: warning
     ...

See also

• Configure authorization policies for access control on workloads

• Configure authorization policies for HTTP requests

• Configure authorization policies for TCP requests

• Use an authorization policy to control access traffic from services in an ASM instance to an external website

• Use an authorization policy to control access traffic from services in an ASM instance to an external database

• Configure the features of generating and collecting the access logs of an ASM gateway

• Use the KubeAPI operation audit feature in ASM

• Configure audit alerts for operations on ASM resources