Alibaba Cloud Service Mesh:Zero trust security

View workload identities in the console

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Mesh Security Center > Workload Identity.

3. On the Workload Identity page, select a cluster from the Data Plane drop-down list and a namespace from the Namespace drop-down list to view workload identities.

Example: Set up JWT authentication for a service

This example uses the Bookinfo sample application as the target service and a sleep pod as the client.

Prerequisites

Deploy the Bookinfo application. For details, see Deploy an application in an ASM instance.

Step 1: Deploy the sleep client

1. Create a sleep.yaml file with the following content:

   Click to view sleep.yaml

      apiVersion: v1
      kind: ServiceAccount
      metadata:
        name: sleep
      ---
      apiVersion: v1
      kind: Service
      metadata:
        name: sleep
        labels:
          app: sleep
          service: sleep
      spec:
        ports:
        - port: 80
          name: http
        selector:
          app: sleep
      ---
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: sleep
      spec:
        replicas: 1
        selector:
          matchLabels:
            app: sleep
        template:
          metadata:
            labels:
              app: sleep
          spec:
            terminationGracePeriodSeconds: 0
            serviceAccountName: sleep
            containers:
            - name: sleep
              image: curlimages/curl
              command: ["/bin/sleep", "3650d"]
              imagePullPolicy: IfNotPresent
              volumeMounts:
              - mountPath: /etc/sleep/tls
                name: secret-volume
            volumes:
            - name: secret-volume
              secret:
                secretName: sleep-secret
                optional: true

2. Use kubectl to connect to your Container Service for Kubernetes (ACK) cluster and deploy the sleep application:

      kubectl apply -f sleep.yaml -n default

Step 2: Create a request authentication policy

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Mesh Security Center > RequestAuthentication. Click Create.

3. Define a JWT rule for the details workload with the following parameters, then click Create. Key parameters: JWKS value: For more information, see jwks.json.

   Parameter	Value	Description
   issuer	testing@asm.istio.io	The JWT issuer.
   audiences	(blank)	Leave blank to allow all services to use this JWT.
   jwks	See below	The JSON Web Key Set used to verify JWT signatures.

      { "keys":[ {"e":"AQAB","kid":"DHFbpoIUqrY8t2zpA2qXfCmr5VO5ZEr4RzHU_-envvQ","kty":"RSA","n":"xAE7eB6qugXyCAG3yhh7pkDkT65pHymX-P7KfIupjf59vsdo91bSP9C8H07pSAGQO1MV_xFj9VswgsCg4R6otmg5PV2He95lZdHtOcU5DXIg_pbhLdKXbi66GlVeK6ABZOUW3WYtnNHD-91gVuoeJT_DwtGGcp4ignkgXfkiEm4sw-4sfb4qdt5oLbyVpmW6x9cfa7vs2WTfURiCrBoUqgBo_-4WTiULmmHSGZHOjzwa8WtrtOQGsAFjIbno85jp6MnGGGZPYZbDAa_b3y5u-YpW7ypZrvD8BgtKVjgtQgZhLAGezMt0ua3DRrWnKqTZ0BJ_EyxOGuHJrLsn00fnMQ"}]}

   

Step 3: Verify the policy

1. Use a JWT tool to encode the JWKS into a JWT string. Expected result:

      eyJhbGciOiJSUzI1NiIsImtpZCI6IkRIRmJwb0lVcXJZOHQyenBBMnFYZkNtcjVWTzVaRXI0UnpIVV8tZW52dlEiLCJ0eXAiOiJKV1QifQ.eyJleHAiOjQ2ODU5ODk3MDAsImZvbyI6ImJhciIsImlhdCI6MTUzMjM4OTcwMCwiaXNzIjoidGVzdGluZ0BzZWN1cmUuaXN0aW8uaW8iLCJzdWIiOiJ0ZXN0aW5nQHNlY3VyZS5pc3Rpby5pbyJ9.CfNnxWP2tcnR9q0vxyxweaF3ovQYHYZl82hAUsn21bwQd9zP7c-LS9qd_vpdLG4Tn1A15NxfCjp5f7QNBUo-KC9PJqYpgGbaXhaGx7bEdFWjcwv3nZzvc7M__ZpaCERdwU7igUmJqYGBYQ51vr2njU9ZimyKkfDe3axcyiBZde7G6dabliUosJvvKOPcKIWPccCgefSj_GNfwIip3-SsFdlR7BtbVUcqR-yv-XOxJ3Uc1MI0tz3uMiiZcyPV7sNCU4KRnemRIMHVOfuvHsU60_GhGbiSFzgPTAa9WTltbnarTbxudb_YEOx12JiwYToeX0DCPb43W1tzIBxgm8NxUg

2. Send a request with the valid JWT: Expected output: 200. The valid JWT was accepted.

      export TOKEN=eyJhbGciOiJSUzI1NiIsImtpZCI6IkRIRmJwb0lVcXJZOHQyenBBMnFYZkNtcjVWTzVaRXI0UnpIVV8tZW52dlEiLCJ0eXAiOiJKV1QifQ.eyJleHAiOjQ2ODU5ODk3MDAsImZvbyI6ImJhciIsImlhdCI6MTUzMjM4OTcwMCwiaXNzIjoidGVzdGluZ0BzZWN1cmUuaXN0aW8uaW8iLCJzdWIiOiJ0ZXN0aW5nQHNlY3VyZS5pc3Rpby5pbyJ9.CfNnxWP2tcnR9q0vxyxweaF3ovQYHYZl82hAUsn21bwQd9zP7c-LS9qd_vpdLG4Tn1A15NxfCjp5f7QNBUo-KC9PJqYpgGbaXhaGx7bEdFWjcwv3nZzvc7M__ZpaCERdwU7igUmJqYGBYQ51vr2njU9ZimyKkfDe3axcyiBZde7G6dabliUosJvvKOPcKIWPccCgefSj_GNfwIip3-SsFdlR7BtbVUcqR-yv-XOxJ3Uc1MI0tz3uMiiZcyPV7sNCU4KRnemRIMHVOfuvHsU60_GhGbiSFzgPTAa9WTltbnarTbxudb_YEOx12JiwYToeX0DCPb43W1tzIBxgm8NxUg
   
      kubectl exec $(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c sleep \
        -- curl http://details:9080/details/1 -o /dev/null \
        --header "Authorization: Bearer $TOKEN" -s -w '%{http_code}\n'

3. Send a request with an invalid JWT: Expected output: 403. The invalid token was rejected.

      kubectl exec $(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c sleep \
        -- curl http://details:9080/details/1 -o /dev/null \
        --header "Authorization: Bearer badtoken" -s -w '%{http_code}\n'

4. Send a request without a JWT: Expected output: 200. Without a JWT, the request bypasses JWT validation and is allowed through.

      kubectl exec $(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c sleep \
        -- curl http://details:9080/details/1 -o /dev/null -s -w '%{http_code}\n'

These results confirm the policy works as expected: valid JWTs pass, invalid JWTs are rejected, and requests without JWTs are allowed unless restricted by an authorization policy.

Example: Require a valid JWT for all requests

This example builds on the request authentication setup above. It adds an authorization policy that blocks requests without a valid JWT.

Prerequisites

• Deploy the Bookinfo application. For details, see Deploy an application in an ASM instance.

• Deploy the sleep client as described in the request authentication section above.

Step 1: Create the authorization policy

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Mesh Security Center > AuthorizationPolicy. Click Create from YAML.

3. Select default from the Namespace drop-down list, paste the following YAML, and click Create. This policy allows requests to the details service only when the request principal matches testing@secure.istio.io/testing@secure.istio.io -- meaning the request must carry a valid JWT issued by this identity. For more information about authorization policy fields, see Authorization Policy.

      apiVersion: security.istio.io/v1beta1
      kind: AuthorizationPolicy
      metadata:
        name: require-jwt
        namespace: default
      spec:
        action: ALLOW
        rules:
          - from:
              - source:
                  requestPrincipals:
                    - testing@secure.istio.io/testing@secure.istio.io
        selector:
          matchLabels:
            app: details

Step 2: Verify the policy

Send a request without a JWT:

kubectl exec $(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c sleep \
  -- curl http://details:9080/details/1 -o /dev/null -s -w '%{http_code}\n'

Expected output: 403. The authorization policy blocks requests without a valid JWT from testing@secure.istio.io.