mirror of https://github.com/istio/istio.io.git
Authz TD migration test (#7653)
* Authz TD migration tests * cleanup * remove samples source
This commit is contained in:
Frank Budinsky
GitHub
parent
ff262acb69
commit
eadc0629dc
|
|
@ -3,7 +3,7 @@ title: Authorization Policy Trust Domain Migration
|
|||
description: Shows how to migrate from one trust domain to another without changing authorization policy.
|
||||
weight: 60
|
||||
keywords: [security,access-control,rbac,authorization,trust domain, migration]
|
||||
test: no
|
||||
test: yes
|
||||
---
|
||||
|
||||
This task shows you how to migrate from one trust domain to another without changing authorization policy.
|
||||
|
|
@ -69,14 +69,14 @@ Notice that it may take tens of seconds for the authorization policy to be propa
|
|||
* `sleep` in the `default` namespace are denied.
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl exec $(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c sleep -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
$ kubectl exec "$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})" -c sleep -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
403
|
||||
{{< /text >}}
|
||||
|
||||
* `sleep` in the `sleep-allow` namespace are allowed.
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl exec $(kubectl -n sleep-allow get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c sleep -n sleep-allow -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
$ kubectl exec "$(kubectl -n sleep-allow get pod -l app=sleep -o jsonpath={.items..metadata.name})" -c sleep -n sleep-allow -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
200
|
||||
{{< /text >}}
|
||||
|
||||
|
|
@ -103,12 +103,12 @@ Notice that it may take tens of seconds for the authorization policy to be propa
|
|||
1. Verify that requests to `httpbin` from both `sleep` in `default` namespace and `sleep-allow` namespace are denied.
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl exec $(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c sleep -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
$ kubectl exec "$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})" -c sleep -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
403
|
||||
{{< /text >}}
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl exec $(kubectl -n sleep-allow get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c sleep -n sleep-allow -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
$ kubectl exec "$(kubectl -n sleep-allow get pod -l app=sleep -o jsonpath={.items..metadata.name})" -c sleep -n sleep-allow -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
403
|
||||
{{< /text >}}
|
||||
|
||||
|
|
@ -142,14 +142,14 @@ Notice that it may take tens of seconds for the authorization policy to be propa
|
|||
* `sleep` in the `default` namespace are denied.
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl exec $(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c sleep -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
$ kubectl exec "$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})" -c sleep -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
403
|
||||
{{< /text >}}
|
||||
|
||||
* `sleep` in the `sleep-allow` namespace are allowed.
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl exec $(kubectl -n sleep-allow get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c sleep -n sleep-allow -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
$ kubectl exec "$(kubectl -n sleep-allow get pod -l app=sleep -o jsonpath={.items..metadata.name})" -c sleep -n sleep-allow -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
200
|
||||
{{< /text >}}
|
||||
|
||||
|
|
@ -170,4 +170,5 @@ $ kubectl delete deploy httpbin; kubectl delete service httpbin; kubectl delete
|
|||
$ kubectl delete deploy sleep; kubectl delete service sleep; kubectl delete serviceaccount sleep
|
||||
$ kubectl delete namespace sleep-allow
|
||||
$ istioctl manifest generate --set profile=demo -f td-installation.yaml | kubectl delete --ignore-not-found=true -f -
|
||||
$ rm ./td-installation.yaml
|
||||
{{< /text >}}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,141 @@
|
|||
#!/bin/bash
|
||||
# shellcheck disable=SC2034,SC2153,SC2155,SC2164
|
||||
|
||||
# Copyright Istio Authors. All Rights Reserved.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
####################################################################################################
|
||||
# WARNING: THIS IS AN AUTO-GENERATED FILE, DO NOT EDIT. PLEASE MODIFY THE ORIGINAL MARKDOWN FILE:
|
||||
# docs/tasks/security/authorization/authz-td-migration/index.md
|
||||
####################################################################################################
|
||||
|
||||
snip_before_you_begin_1() {
|
||||
istioctl install --set profile=demo --set values.global.trustDomain=old-td
|
||||
}
|
||||
|
||||
snip_before_you_begin_2() {
|
||||
kubectl label namespace default istio-injection=enabled
|
||||
kubectl apply -f samples/httpbin/httpbin.yaml
|
||||
kubectl apply -f samples/sleep/sleep.yaml
|
||||
kubectl create namespace sleep-allow
|
||||
kubectl label namespace sleep-allow istio-injection=enabled
|
||||
kubectl apply -f samples/sleep/sleep.yaml -n sleep-allow
|
||||
}
|
||||
|
||||
snip_before_you_begin_3() {
|
||||
kubectl apply -f - <<EOF
|
||||
apiVersion: security.istio.io/v1beta1
|
||||
kind: AuthorizationPolicy
|
||||
metadata:
|
||||
name: service-httpbin.default.svc.cluster.local
|
||||
namespace: default
|
||||
spec:
|
||||
rules:
|
||||
- from:
|
||||
- source:
|
||||
principals:
|
||||
- old-td/ns/sleep-allow/sa/sleep
|
||||
to:
|
||||
- operation:
|
||||
methods:
|
||||
- GET
|
||||
selector:
|
||||
matchLabels:
|
||||
app: httpbin
|
||||
---
|
||||
EOF
|
||||
}
|
||||
|
||||
snip_before_you_begin_4() {
|
||||
kubectl exec "$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})" -c sleep -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
}
|
||||
|
||||
! read -r -d '' snip_before_you_begin_4_out <<\ENDSNIP
|
||||
403
|
||||
ENDSNIP
|
||||
|
||||
snip_before_you_begin_5() {
|
||||
kubectl exec "$(kubectl -n sleep-allow get pod -l app=sleep -o jsonpath={.items..metadata.name})" -c sleep -n sleep-allow -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
}
|
||||
|
||||
! read -r -d '' snip_before_you_begin_5_out <<\ENDSNIP
|
||||
200
|
||||
ENDSNIP
|
||||
|
||||
snip_migrate_trust_domain_without_trust_domain_aliases_1() {
|
||||
istioctl install --set profile=demo --set values.global.trustDomain=new-td
|
||||
}
|
||||
|
||||
snip_migrate_trust_domain_without_trust_domain_aliases_2() {
|
||||
kubectl delete pod --all
|
||||
}
|
||||
|
||||
snip_migrate_trust_domain_without_trust_domain_aliases_3() {
|
||||
kubectl delete pod --all -n sleep-allow
|
||||
}
|
||||
|
||||
snip_migrate_trust_domain_without_trust_domain_aliases_4() {
|
||||
kubectl exec "$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})" -c sleep -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
}
|
||||
|
||||
! read -r -d '' snip_migrate_trust_domain_without_trust_domain_aliases_4_out <<\ENDSNIP
|
||||
403
|
||||
ENDSNIP
|
||||
|
||||
snip_migrate_trust_domain_without_trust_domain_aliases_5() {
|
||||
kubectl exec "$(kubectl -n sleep-allow get pod -l app=sleep -o jsonpath={.items..metadata.name})" -c sleep -n sleep-allow -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
}
|
||||
|
||||
! read -r -d '' snip_migrate_trust_domain_without_trust_domain_aliases_5_out <<\ENDSNIP
|
||||
403
|
||||
ENDSNIP
|
||||
|
||||
snip_migrate_trust_domain_with_trust_domain_aliases_1() {
|
||||
cat <<EOF > ./td-installation.yaml
|
||||
apiVersion: install.istio.io/v1alpha1
|
||||
kind: IstioOperator
|
||||
spec:
|
||||
values:
|
||||
global:
|
||||
trustDomain: new-td
|
||||
trustDomainAliases:
|
||||
- old-td
|
||||
EOF
|
||||
istioctl install --set profile=demo -f td-installation.yaml
|
||||
}
|
||||
|
||||
snip_migrate_trust_domain_with_trust_domain_aliases_2() {
|
||||
kubectl exec "$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})" -c sleep -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
}
|
||||
|
||||
! read -r -d '' snip_migrate_trust_domain_with_trust_domain_aliases_2_out <<\ENDSNIP
|
||||
403
|
||||
ENDSNIP
|
||||
|
||||
snip_migrate_trust_domain_with_trust_domain_aliases_3() {
|
||||
kubectl exec "$(kubectl -n sleep-allow get pod -l app=sleep -o jsonpath={.items..metadata.name})" -c sleep -n sleep-allow -- curl http://httpbin.default:8000/ip -s -o /dev/null -w "%{http_code}\n"
|
||||
}
|
||||
|
||||
! read -r -d '' snip_migrate_trust_domain_with_trust_domain_aliases_3_out <<\ENDSNIP
|
||||
200
|
||||
ENDSNIP
|
||||
|
||||
snip_clean_up_1() {
|
||||
kubectl delete authorizationpolicy service-httpbin.default.svc.cluster.local
|
||||
kubectl delete deploy httpbin; kubectl delete service httpbin; kubectl delete serviceaccount httpbin
|
||||
kubectl delete deploy sleep; kubectl delete service sleep; kubectl delete serviceaccount sleep
|
||||
kubectl delete namespace sleep-allow
|
||||
istioctl manifest generate --set profile=demo -f td-installation.yaml | kubectl delete --ignore-not-found=true -f -
|
||||
rm ./td-installation.yaml
|
||||
}
|
||||
|
|
@ -0,0 +1,70 @@
|
|||
#!/usr/bin/env bash
|
||||
# shellcheck disable=SC1090,SC2154
|
||||
|
||||
# Copyright Istio Authors
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
# @setup profile=none
|
||||
|
||||
set -e
|
||||
set -u
|
||||
set -o pipefail
|
||||
|
||||
#export VERIFY_RETRIES=10
|
||||
|
||||
snip_before_you_begin_1
|
||||
|
||||
# Remove the injection label to prevent the following command from failing
|
||||
kubectl label namespace default istio-injection-
|
||||
|
||||
# Wait fo Istio to start up.
|
||||
_wait_for_deployment istio-system istiod
|
||||
|
||||
snip_before_you_begin_2
|
||||
|
||||
_wait_for_deployment default sleep
|
||||
_wait_for_deployment default httpbin
|
||||
_wait_for_deployment sleep-allow sleep
|
||||
|
||||
snip_before_you_begin_3
|
||||
|
||||
_verify_same snip_before_you_begin_4 "$snip_before_you_begin_4_out"
|
||||
|
||||
_verify_same snip_before_you_begin_5 "$snip_before_you_begin_5_out"
|
||||
|
||||
snip_migrate_trust_domain_without_trust_domain_aliases_1
|
||||
|
||||
_wait_for_deployment istio-system istiod
|
||||
|
||||
snip_migrate_trust_domain_without_trust_domain_aliases_2
|
||||
|
||||
snip_migrate_trust_domain_without_trust_domain_aliases_3
|
||||
|
||||
_verify_same snip_migrate_trust_domain_without_trust_domain_aliases_4 "$snip_migrate_trust_domain_without_trust_domain_aliases_4_out"
|
||||
|
||||
_verify_same snip_migrate_trust_domain_without_trust_domain_aliases_5 "$snip_migrate_trust_domain_without_trust_domain_aliases_5_out"
|
||||
|
||||
snip_migrate_trust_domain_with_trust_domain_aliases_1
|
||||
|
||||
_wait_for_deployment istio-system istiod
|
||||
|
||||
_verify_same snip_migrate_trust_domain_with_trust_domain_aliases_2 "$snip_migrate_trust_domain_with_trust_domain_aliases_2_out"
|
||||
|
||||
#_verify_same snip_migrate_trust_domain_with_trust_domain_aliases_3 "$snip_migrate_trust_domain_with_trust_domain_aliases_3_out"
|
||||
# TODO: This trustDomainAliases check fails, even with much longer wait
|
||||
|
||||
# @cleanup
|
||||
|
||||
set +e # ignore cleanup errors
|
||||
snip_clean_up_1
|
||||
Loading…
Reference in New Issue