mirror of https://github.com/istio/istio.io.git
180 lines
9.9 KiB
Markdown
180 lines
9.9 KiB
Markdown
---
|
|
title: Authorization permissive mode
|
|
description: Shows how to use Authorization permissive mode.
|
|
weight: 10
|
|
keywords: [security,access-control,rbac,authorization]
|
|
---
|
|
|
|
The [authorization permissive mode](/docs/concepts/security/#authorization-permissive-mode) allows
|
|
you to verify authorization policies before applying them in a production environment.
|
|
|
|
The authorization permissive mode is an experimental feature in version 1.1. Its interface can change
|
|
in future releases. If you do not want to try out the permissive mode feature, you can directly
|
|
[enable Istio authorization](/docs/tasks/security/authz-http#enabling-istio-authorization) to skip
|
|
enabling the permissive mode.
|
|
|
|
This task covers two scenarios regarding the use of the permissive mode for authorization:
|
|
|
|
* For environments where **authorization is disabled**, this task helps you test whether it's safe to
|
|
enable the authorization.
|
|
|
|
* For environments where **authorization is enabled**, this task helps you test whether it's safe to
|
|
add a new authorization policy.
|
|
|
|
## Before you begin
|
|
|
|
To complete this task, you should first take the following actions:
|
|
|
|
* Read the [authorization concept](/docs/concepts/security/#authorization).
|
|
|
|
* Follow the instructions in the [Kubernetes quick start](/docs/setup/kubernetes/install/kubernetes/) to
|
|
install Istio **with mutual TLS enabled**.
|
|
|
|
* Deploy the [Bookinfo](/docs/examples/bookinfo/) sample application.
|
|
|
|
* Create service accounts for the Bookinfo application. Run the following command to create service
|
|
account `bookinfo-productpage` for `productpage` and service account `bookinfo-reviews` for `reviews`:
|
|
|
|
{{< text bash >}}
|
|
$ kubectl apply -f <(istioctl kube-inject -f @samples/bookinfo/platform/kube/bookinfo-add-serviceaccount.yaml@)
|
|
{{< /text >}}
|
|
|
|
### Test enabling authorization globally
|
|
|
|
The following steps show you how to use authorization permissive mode to test whether it's safe to
|
|
turn on authorization globally:
|
|
|
|
1. To enable the permissive mode in the global authorization configuration, run the following command:
|
|
|
|
{{< text bash >}}
|
|
$ kubectl apply -f - <<EOF
|
|
apiVersion: "rbac.istio.io/v1alpha1"
|
|
kind: ClusterRbacConfig
|
|
metadata:
|
|
name: default
|
|
spec:
|
|
mode: 'ON_WITH_INCLUSION'
|
|
inclusion:
|
|
namespaces: ["default"]
|
|
enforcement_mode: PERMISSIVE
|
|
EOF
|
|
{{< /text >}}
|
|
|
|
1. Go to the `productpage` at `http://$GATEWAY_URL/productpage` and verify that everything works fine.
|
|
|
|
1. Apply the `rbac-permissive-telemetry.yaml` YAML file to enable the metric collection for the permissive mode:
|
|
|
|
{{< text bash >}}
|
|
$ kubectl apply -f @samples/bookinfo/platform/kube/rbac/rbac-permissive-telemetry.yaml@
|
|
logentry.config.istio.io/rbacsamplelog created
|
|
stdio.config.istio.io/rbacsamplehandler created
|
|
rule.config.istio.io/rabcsamplestdio created
|
|
{{< /text >}}
|
|
|
|
1. Send traffic to the sample application with the following command:
|
|
|
|
{{< text bash >}}
|
|
$ curl http://$GATEWAY_URL/productpage
|
|
{{< /text >}}
|
|
|
|
1. Go to the `productpage` at `http://$GATEWAY_URL/productpage` and verify that everything works fine.
|
|
|
|
1. Get the log for telemetry and search for the `permissiveResponseCode` with the following command:
|
|
|
|
{{< text bash json >}}
|
|
$ kubectl -n istio-system logs -l istio-mixer-type=telemetry -c mixer | grep \"instance\":\"rbacsamplelog.logentry.istio-system\"
|
|
{"level":"warn","time":"2018-08-30T21:53:42.059444Z","instance":"rbacsamplelog.logentry.istio-system","destination":"ratings","latency":"9.158879ms","permissiveResponseCode":"denied","permissiveResponsePolicyID":"","responseCode":200,"responseSize":48,"source":"reviews","user":"cluster.local/ns/default/sa/bookinfo-reviews"}
|
|
{"level":"warn","time":"2018-08-30T21:53:41.037824Z","instance":"rbacsamplelog.logentry.istio-system","destination":"reviews","latency":"1.091670916s","permissiveResponseCode":"denied","permissiveResponsePolicyID":"","responseCode":200,"responseSize":379,"source":"productpage","user":"cluster.local/ns/default/sa/bookinfo-productpage"}
|
|
{"level":"warn","time":"2018-08-30T21:53:41.019851Z","instance":"rbacsamplelog.logentry.istio-system","destination":"productpage","latency":"1.112521495s","permissiveResponseCode":"denied","permissiveResponsePolicyID":"","responseCode":200,"responseSize":5723,"source":"istio-ingressgateway","user":"cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account"}
|
|
{{< /text >}}
|
|
|
|
1. Verify that the the log shows a `responseCode` of `200` and a `permissiveResponseCode` of `denied`.
|
|
|
|
1. Apply the `productpage-policy.yaml` authorization policy in permissive mode with the following command:
|
|
|
|
{{< text bash >}}
|
|
$ kubectl apply -f @samples/bookinfo/platform/kube/rbac/productpage-policy.yaml@
|
|
{{< /text >}}
|
|
|
|
1. Send traffic to the sample application with the following command:
|
|
|
|
{{< text bash >}}
|
|
$ curl http://$GATEWAY_URL/productpage
|
|
{{< /text >}}
|
|
|
|
1. Get the log for telemetry and search for the `permissiveResponseCode` with the following command:
|
|
|
|
{{< text bash json >}}
|
|
$ kubectl -n istio-system logs -l istio-mixer-type=telemetry -c mixer | grep \"instance\":\"rbacsamplelog.logentry.istio-system\"
|
|
{"level":"warn","time":"2018-08-30T21:55:53.590430Z","instance":"rbacsamplelog.logentry.istio-system","destination":"ratings","latency":"4.415633ms","permissiveResponseCode":"denied","permissiveResponsePolicyID":"","responseCode":200,"responseSize":48,"source":"reviews","user":"cluster.local/ns/default/sa/bookinfo-reviews"}
|
|
{"level":"warn","time":"2018-08-30T21:55:53.565914Z","instance":"rbacsamplelog.logentry.istio-system","destination":"reviews","latency":"32.97524ms","permissiveResponseCode":"denied","permissiveResponsePolicyID":"","responseCode":200,"responseSize":379,"source":"productpage","user":"cluster.local/ns/default/sa/bookinfo-productpage"}
|
|
{"level":"warn","time":"2018-08-30T21:55:53.544441Z","instance":"rbacsamplelog.logentry.istio-system","destination":"productpage","latency":"57.800056ms","permissiveResponseCode":"allowed","permissiveResponsePolicyID":"productpage-viewer","responseCode":200,"responseSize":5723,"source":"istio-ingressgateway","user":"cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account"}
|
|
{{< /text >}}
|
|
|
|
1. Verify that the the log shows a `responseCode` of `200` and a `permissiveResponseCode` of `allowed`
|
|
for `productpage` service.
|
|
|
|
1. Remove the YAML files related to enabling the permissive mode:
|
|
|
|
{{< text bash >}}
|
|
$ kubectl delete -f @samples/bookinfo/platform/kube/rbac/productpage-policy.yaml@
|
|
$ kubectl delete -f @samples/bookinfo/platform/kube/rbac/rbac-config-on-permissive.yaml@
|
|
$ kubectl delete -f @samples/bookinfo/platform/kube/rbac/rbac-permissive-telemetry.yaml@
|
|
{{< /text >}}
|
|
|
|
1. Congratulations! You tested an authorization policy with permissive mode and verified it works
|
|
as expected. To enable the authorization policy, follow the steps described in the
|
|
[Enabling Istio authorization task](/docs/tasks/security/authz-http#enabling-istio-authorization).
|
|
|
|
### Test adding authorization policy
|
|
|
|
The following steps show how to test a new authorization policy with permissive mode when authorization
|
|
has already been enabled.
|
|
|
|
1. Allow access to the `producepage` service by following the instructions in
|
|
[Enabling authorization for HTTP services step 1](/docs/tasks/security/authz-http#step-1-allowing-access-to-the-productpage-service).
|
|
|
|
1. Allow access to the details and reviews service in permissive mode with the following command:
|
|
|
|
{{< text bash >}}
|
|
$ kubectl apply -f @samples/bookinfo/platform/kube/rbac/details-reviews-policy-permissive.yaml@
|
|
{{< /text >}}
|
|
|
|
1. Verify there are errors `Error fetching product details` and `Error fetching product reviews` on
|
|
the Bookinfo `productpage` by pointing your browser at the `productpage` (`http://$GATEWAY_URL/productpage`),
|
|
These errors are expected because the policy is in `PERMISSIVE` mode.
|
|
|
|
1. Apply the `rbac-permissive-telemetry.yaml` YAML file to enable the permissive mode metric collection.
|
|
|
|
{{< text bash >}}
|
|
$ kubectl apply -f @samples/bookinfo/platform/kube/rbac/rbac-permissive-telemetry.yaml@
|
|
{{< /text >}}
|
|
|
|
1. Send traffic to the sample application:
|
|
|
|
{{< text bash >}}
|
|
$ curl http://$GATEWAY_URL/productpage
|
|
{{< /text >}}
|
|
|
|
1. Get the log for telemetry and search for the `permissiveResponseCode` with the following command:
|
|
|
|
{{< text bash json >}}
|
|
$ kubectl -n istio-system logs -l istio-mixer-type=telemetry -c mixer | grep \"instance\":\"rbacsamplelog.logentry.istio-system\"
|
|
{"level":"warn","time":"2018-08-30T22:59:42.707093Z","instance":"rbacsamplelog.logentry.istio-system","destination":"details","latency":"423.381µs","permissiveResponseCode":"allowed","permissiveResponsePolicyID":"details-reviews-viewer","responseCode":403,"responseSize":19,"source":"productpage","user":"cluster.local/ns/default/sa/bookinfo-productpage"}
|
|
{"level":"warn","time":"2018-08-30T22:59:42.763423Z","instance":"rbacsamplelog.logentry.istio-system","destination":"reviews","latency":"237.333µs","permissiveResponseCode":"allowed","permissiveResponsePolicyID":"details-reviews-viewer","responseCode":403,"responseSize":19,"source":"productpage","user":"cluster.local/ns/default/sa/bookinfo-productpage"}
|
|
{{< /text >}}
|
|
|
|
1. Verify that the the log shows a `responseCode` of `403` and a `permissiveResponseCode` of `allowed`
|
|
for ratings and reviews services.
|
|
|
|
1. Remove the YAML files related to enabling the permissive mode:
|
|
|
|
{{< text bash >}}
|
|
$ kubectl delete -f @samples/bookinfo/platform/kube/rbac/details-reviews-policy-permissive.yaml@
|
|
$ kubectl delete -f @samples/bookinfo/platform/kube/rbac/rbac-permissive-telemetry.yaml@
|
|
{{< /text >}}
|
|
|
|
1. Congratulations! You tested adding an authorization policy with permissive mode and verified it will
|
|
work as expected. To add the authorization policy, follow the steps described in the
|
|
[Enabling Istio authorization task](/docs/tasks/security/authz-http#enabling-istio-authorization).
|