mirror of https://github.com/istio/istio.io.git
472 lines
14 KiB
HTML
472 lines
14 KiB
HTML
---
|
|
title: RBAC
|
|
description: Configuration for Role Based Access Control
|
|
location: https://istio.io/docs/reference/config/istio.rbac.v1alpha1.html
|
|
layout: protoc-gen-docs
|
|
generator: protoc-gen-docs
|
|
number_of_entries: 9
|
|
---
|
|
<p>Istio RBAC (Role Based Access Control) defines ServiceRole and ServiceRoleBinding
|
|
objects.</p>
|
|
|
|
<p>A ServiceRole specification includes a list of rules (permissions). Each rule has
|
|
the following standard fields:
|
|
* services: a list of services.
|
|
* methods: HTTP methods. In the case of gRPC, this field is ignored because the value is always “POST”.
|
|
* paths: HTTP paths or gRPC methods. Note that gRPC methods should be
|
|
presented in the form of “packageName.serviceName/methodName”.</p>
|
|
|
|
<p>In addition to the standard fields, operators can use custom fields in the “constraints”
|
|
section. The name of a custom field must match one of the “properties” in the “action” part
|
|
of the “authorization” template (https://github.com/istio/istio/blob/master/mixer/template/authorization/template.proto).</p>
|
|
|
|
<p>For example, suppose we define an instance of the “authorization” template, named “requestcontext”.</p>
|
|
|
|
<pre><code class="language-yaml">apiVersion: "config.istio.io/v1alpha1"
|
|
kind: authorization
|
|
metadata:
|
|
name: requestcontext
|
|
namespace: istio-system
|
|
spec:
|
|
subject:
|
|
user: source.user | ""
|
|
groups: ""
|
|
properties:
|
|
service: source.service | ""
|
|
namespace: source.namespace | ""
|
|
action:
|
|
namespace: destination.namespace | ""
|
|
service: destination.service | ""
|
|
method: request.method | ""
|
|
path: request.path | ""
|
|
properties:
|
|
version: request.headers["version"] | ""
|
|
</code></pre>
|
|
|
|
<p>Below is an example of ServiceRole object “product-viewer”, which has “read” (“GET” and “HEAD”)
|
|
access to “products.svc.cluster.local” service at versions “v1” and “v2”. “path” is not specified,
|
|
so it applies to any path in the service.</p>
|
|
|
|
<pre><code class="language-yaml">apiVersion: "config.istio.io/v1alpha1"
|
|
kind: ServiceRole
|
|
metadata:
|
|
name: products-viewer
|
|
namespace: default
|
|
spec:
|
|
rules:
|
|
- services: ["products.svc.cluster.local"]
|
|
methods: ["GET", "HEAD"]
|
|
constraints:
|
|
- key: "version"
|
|
value: ["v1", "v2"]
|
|
</code></pre>
|
|
|
|
<p>A ServiceRoleBinding specification includes two parts:
|
|
* “roleRef” refers to a ServiceRole object in the same namespace.
|
|
* A list of “subjects” that are assigned the roles.</p>
|
|
|
|
<p>A subject is represented with a set of “properties”. The name of a property must match one of
|
|
the fields (“user” or “groups” or one of the “properties”) in the “subject” part of the “authorization”
|
|
template (https://github.com/istio/istio/blob/master/mixer/template/authorization/template.proto).</p>
|
|
|
|
<p>Below is an example of ServiceRoleBinding object “test-binding-products”, which binds two subjects
|
|
to ServiceRole “product-viewer”:
|
|
* User “alice@yahoo.com”
|
|
* “reviews” service in “abc” namespace.</p>
|
|
|
|
<pre><code class="language-yaml">apiVersion: "config.istio.io/v1alpha1"
|
|
kind: ServiceRoleBinding
|
|
metadata:
|
|
name: test-binding-products
|
|
namespace: default
|
|
spec:
|
|
subjects:
|
|
- user: alice@yahoo.com
|
|
- properties:
|
|
service: "reviews"
|
|
namespace: "abc"
|
|
roleRef:
|
|
kind: ServiceRole
|
|
name: "products-viewer"
|
|
</code></pre>
|
|
|
|
<h2 id="AccessRule">AccessRule</h2>
|
|
<section>
|
|
<p>AccessRule defines a permission to access a list of services.</p>
|
|
|
|
<table class="message-fields">
|
|
<thead>
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Type</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr id="AccessRule-services">
|
|
<td><code>services</code></td>
|
|
<td><code>string[]</code></td>
|
|
<td>
|
|
<p>Required. A list of service names.
|
|
Exact match, prefix match, and suffix match are supported for service names.
|
|
For example, the service name “bookstore.mtv.cluster.local” matches
|
|
“bookstore.mtv.cluster.local” (exact match), or “bookstore<em>” (prefix match),
|
|
or “</em>.mtv.cluster.local” (suffix match).
|
|
If set to [“*”], it refers to all services in the namespace.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
<tr id="AccessRule-paths">
|
|
<td><code>paths</code></td>
|
|
<td><code>string[]</code></td>
|
|
<td>
|
|
<p>Optional. A list of HTTP paths or gRPC methods.
|
|
gRPC methods must be presented as fully-qualified name in the form of
|
|
packageName.serviceName/methodName.
|
|
Exact match, prefix match, and suffix match are supported for paths.
|
|
For example, the path “/books/review” matches
|
|
“/books/review” (exact match), or “/books/<em>” (prefix match),
|
|
or “</em>/review” (suffix match).
|
|
If not specified, it applies to any path.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
<tr id="AccessRule-methods">
|
|
<td><code>methods</code></td>
|
|
<td><code>string[]</code></td>
|
|
<td>
|
|
<p>Optional. A list of HTTP methods (e.g., “GET”, “POST”).
|
|
It is ignored in gRPC case because the value is always “POST”.
|
|
If set to [“*”] or not specified, it applies to any method.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
<tr id="AccessRule-constraints">
|
|
<td><code>constraints</code></td>
|
|
<td><code><a href="#AccessRule-Constraint">AccessRule.Constraint[]</a></code></td>
|
|
<td>
|
|
<p>Optional. Extra constraints in the ServiceRole specification.
|
|
The above ServiceRole examples shows an example of constraint “version”.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</section>
|
|
<h2 id="AccessRule-Constraint">AccessRule.Constraint</h2>
|
|
<section>
|
|
<p>Definition of a custom constraint. The key of a custom constraint must match
|
|
one of the “properties” in the “action” part of the “authorization” template
|
|
(https://github.com/istio/istio/blob/master/mixer/template/authorization/template.proto).</p>
|
|
|
|
<table class="message-fields">
|
|
<thead>
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Type</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr id="AccessRule-Constraint-key">
|
|
<td><code>key</code></td>
|
|
<td><code>string</code></td>
|
|
<td>
|
|
<p>Key of the constraint.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
<tr id="AccessRule-Constraint-values">
|
|
<td><code>values</code></td>
|
|
<td><code>string[]</code></td>
|
|
<td>
|
|
<p>List of valid values for the constraint.
|
|
Exact match, prefix match, and suffix match are supported for constraint values.
|
|
For example, the value “v1alpha2” matches
|
|
“v1alpha2” (exact match), or “v1<em>” (prefix match),
|
|
or “</em>alpha2” (suffix match).</p>
|
|
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</section>
|
|
<h2 id="RbacConfig">RbacConfig</h2>
|
|
<section>
|
|
<p>RbacConfig defines the global config to control Istio RBAC behavior.
|
|
This Custom Resource is a singleton where only one Custom Resource should be created globally in
|
|
the mesh and the namespace should be the same to other Istio components, which usually is istio-system.
|
|
Note: This is enforced in both istioctl and server side, new Custom Resource will be rejected if found any
|
|
existing one, the user should either delete the existing one or change the existing one directly.</p>
|
|
|
|
<p>Below is an example of RbacConfig object “istio-rbac-config” which enables Istio RBAC for all
|
|
services in the default namespace.</p>
|
|
|
|
<pre><code class="language-yaml">apiVersion: "config.istio.io/v1alpha1"
|
|
kind: RbacConfig
|
|
metadata:
|
|
name: istio-rbac-config
|
|
namespace: istio-system
|
|
spec:
|
|
mode: ON_WITH_INCLUSION
|
|
inclusion:
|
|
namespaces: [ "default" ]
|
|
</code></pre>
|
|
|
|
<table class="message-fields">
|
|
<thead>
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Type</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr id="RbacConfig-mode">
|
|
<td><code>mode</code></td>
|
|
<td><code><a href="#RbacConfig-Mode">RbacConfig.Mode</a></code></td>
|
|
<td>
|
|
<p>Istio RBAC mode.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
<tr id="RbacConfig-inclusion">
|
|
<td><code>inclusion</code></td>
|
|
<td><code><a href="#RbacConfig-Target">RbacConfig.Target</a></code></td>
|
|
<td>
|
|
<p>A list of services or namespaces that should be enforced by Istio RBAC policies. Note: This field have
|
|
effect only when mode is ON<em>WITH</em>INCLUSION and will be ignored for any other modes.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
<tr id="RbacConfig-exclusion">
|
|
<td><code>exclusion</code></td>
|
|
<td><code><a href="#RbacConfig-Target">RbacConfig.Target</a></code></td>
|
|
<td>
|
|
<p>A list of services or namespaces that should not be enforced by Istio RBAC policies. Note: This field have
|
|
effect only when mode is ON<em>WITH</em>EXCLUSION and will be ignored for any other modes.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</section>
|
|
<h2 id="RbacConfig-Mode">RbacConfig.Mode</h2>
|
|
<section>
|
|
<table class="enum-values">
|
|
<thead>
|
|
<tr>
|
|
<th>Name</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr id="RbacConfig-Mode-OFF">
|
|
<td><code>OFF</code></td>
|
|
<td>
|
|
<p>Disable Istio RBAC completely, any other config in RbacConfig will be ignored and Istio RBAC policies
|
|
will not be enforced.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
<tr id="RbacConfig-Mode-ON">
|
|
<td><code>ON</code></td>
|
|
<td>
|
|
<p>Enable Istio RBAC for all services and namespaces.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
<tr id="RbacConfig-Mode-ON_WITH_INCLUSION">
|
|
<td><code>ON_WITH_INCLUSION</code></td>
|
|
<td>
|
|
<p>Enable Istio RBAC only for services and namespaces specified in the inclusion field. Any other
|
|
services and namespaces not in the inclusion field will not be enforced by Istio RBAC policies.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
<tr id="RbacConfig-Mode-ON_WITH_EXCLUSION">
|
|
<td><code>ON_WITH_EXCLUSION</code></td>
|
|
<td>
|
|
<p>Enable Istio RBAC for all services and namespaces except those specified in the exclusion field. Any other
|
|
services and namespaces not in the exclusion field will be enforced by Istio RBAC policies.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</section>
|
|
<h2 id="RbacConfig-Target">RbacConfig.Target</h2>
|
|
<section>
|
|
<p>Target defines a list of services or namespaces.</p>
|
|
|
|
<table class="message-fields">
|
|
<thead>
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Type</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr id="RbacConfig-Target-services">
|
|
<td><code>services</code></td>
|
|
<td><code>string[]</code></td>
|
|
<td>
|
|
<p>A list of services.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
<tr id="RbacConfig-Target-namespaces">
|
|
<td><code>namespaces</code></td>
|
|
<td><code>string[]</code></td>
|
|
<td>
|
|
<p>A list of namespaces.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</section>
|
|
<h2 id="RoleRef">RoleRef</h2>
|
|
<section>
|
|
<p>RoleRef refers to a role object.</p>
|
|
|
|
<table class="message-fields">
|
|
<thead>
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Type</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr id="RoleRef-kind">
|
|
<td><code>kind</code></td>
|
|
<td><code>string</code></td>
|
|
<td>
|
|
<p>Required. The type of the role being referenced.
|
|
Currently, “ServiceRole” is the only supported value for “kind”.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
<tr id="RoleRef-name">
|
|
<td><code>name</code></td>
|
|
<td><code>string</code></td>
|
|
<td>
|
|
<p>Required. The name of the ServiceRole object being referenced.
|
|
The ServiceRole object must be in the same namespace as the ServiceRoleBinding
|
|
object.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</section>
|
|
<h2 id="ServiceRole">ServiceRole</h2>
|
|
<section>
|
|
<p>ServiceRole specification contains a list of access rules (permissions).
|
|
This represent the “Spec” part of the ServiceRole object. The name and namespace
|
|
of the ServiceRole is specified in “metadata” section of the ServiceRole object.</p>
|
|
|
|
<table class="message-fields">
|
|
<thead>
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Type</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr id="ServiceRole-rules">
|
|
<td><code>rules</code></td>
|
|
<td><code><a href="#AccessRule">AccessRule[]</a></code></td>
|
|
<td>
|
|
<p>Required. The set of access rules (permissions) that the role has.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</section>
|
|
<h2 id="ServiceRoleBinding">ServiceRoleBinding</h2>
|
|
<section>
|
|
<p>ServiceRoleBinding assigns a ServiceRole to a list of subjects.
|
|
This represents the “Spec” part of the ServiceRoleBinding object. The name and namespace
|
|
of the ServiceRoleBinding is specified in “metadata” section of the ServiceRoleBinding
|
|
object.</p>
|
|
|
|
<table class="message-fields">
|
|
<thead>
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Type</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr id="ServiceRoleBinding-subjects">
|
|
<td><code>subjects</code></td>
|
|
<td><code><a href="#Subject">Subject[]</a></code></td>
|
|
<td>
|
|
<p>Required. List of subjects that are assigned the ServiceRole object.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
<tr id="ServiceRoleBinding-roleRef">
|
|
<td><code>roleRef</code></td>
|
|
<td><code><a href="#RoleRef">RoleRef</a></code></td>
|
|
<td>
|
|
<p>Required. Reference to the ServiceRole object.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</section>
|
|
<h2 id="Subject">Subject</h2>
|
|
<section>
|
|
<p>Subject defines an identity or a group of identities. The identity is either a user or
|
|
a group or identified by a set of “properties”. The name of the “properties” must match
|
|
the “properties” in the “subject” part of the “authorization” template
|
|
(https://github.com/istio/istio/blob/master/mixer/template/authorization/template.proto).</p>
|
|
|
|
<table class="message-fields">
|
|
<thead>
|
|
<tr>
|
|
<th>Field</th>
|
|
<th>Type</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr id="Subject-user">
|
|
<td><code>user</code></td>
|
|
<td><code>string</code></td>
|
|
<td>
|
|
<p>Optional. The user name/ID that the subject represents.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
<tr id="Subject-group">
|
|
<td><code>group</code></td>
|
|
<td><code>string</code></td>
|
|
<td>
|
|
<p>Optional. The group that the subject belongs to.</p>
|
|
|
|
</td>
|
|
</tr>
|
|
<tr id="Subject-properties">
|
|
<td><code>properties</code></td>
|
|
<td><code>map<string, string></code></td>
|
|
<td>
|
|
<p>Optional. The set of properties that identify the subject.
|
|
In the above ServiceRoleBinding example, the second subject has two properties:
|
|
service: “reviews”
|
|
namespace: “abc”</p>
|
|
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</section>
|