mirror of https://github.com/istio/istio.io.git
190 lines
7.1 KiB
Markdown
190 lines
7.1 KiB
Markdown
---
|
|
title: Basic Access Control
|
|
description: Shows how to control access to a service using the Kubernetes labels.
|
|
weight: 20
|
|
aliases:
|
|
- /docs/tasks/basic-access-control.html
|
|
---
|
|
|
|
This task shows how to control access to a service using the Kubernetes labels.
|
|
|
|
## Before you begin
|
|
|
|
* Set up Istio on Kubernetes by following the instructions in the
|
|
[Installation guide](/docs/setup/kubernetes/).
|
|
|
|
* Deploy the [Bookinfo](/docs/guides/bookinfo/) sample application.
|
|
|
|
* Initialize the application version routing to direct `reviews` service requests from
|
|
test user "jason" to version v2 and requests from any other user to v3.
|
|
|
|
```command
|
|
$ istioctl create -f samples/bookinfo/kube/route-rule-reviews-test-v2.yaml
|
|
$ istioctl create -f samples/bookinfo/kube/route-rule-reviews-v3.yaml
|
|
```
|
|
|
|
> If you have conflicting rules that you set in previous tasks,
|
|
> use `istioctl replace` instead of `istioctl create`.
|
|
>
|
|
> If you are using a namespace other than `default`,
|
|
> use `istioctl -n namespace ...` to specify the namespace.
|
|
|
|
## Access control using _denials_
|
|
|
|
Using Istio you can control access to a service based on any attributes that are available within Mixer.
|
|
This simple form of access control is based on conditionally denying requests using Mixer selectors.
|
|
|
|
Consider the [Bookinfo](/docs/guides/bookinfo/) sample application where the `ratings` service is accessed by multiple versions
|
|
of the `reviews` service. We would like to cut off access to version `v3` of the `reviews` service.
|
|
|
|
1. Point your browser at the Bookinfo `productpage` (http://$GATEWAY_URL/productpage).
|
|
|
|
If you log in as user "jason", you should see black rating stars with each review,
|
|
indicating that the `ratings` service is being called by the "v2" version of the `reviews` service.
|
|
|
|
If you log in as any other user (or logout) you should see red rating stars with each review,
|
|
indicating that the `ratings` service is being called by the "v3" version of the `reviews` service.
|
|
|
|
1. Explicitly deny access to version `v3` of the `reviews` service.
|
|
|
|
Run the following command to set up the deny rule along with a handler and an instance.
|
|
|
|
```command
|
|
$ istioctl create -f samples/bookinfo/kube/mixer-rule-deny-label.yaml
|
|
Created config denier/default/denyreviewsv3handler at revision 2882105
|
|
Created config checknothing/default/denyreviewsv3request at revision 2882106
|
|
Created config rule/default/denyreviewsv3 at revision 2882107
|
|
```
|
|
|
|
Notice the following in the `denyreviewsv3` rule:
|
|
|
|
```plain
|
|
match: destination.labels["app"] == "ratings" && source.labels["app"]=="reviews" && source.labels["version"] == "v3"
|
|
```
|
|
|
|
It matches requests coming from the service `reviews` with label `v3` to the service `ratings`.
|
|
|
|
This rule uses the `denier` adapter to deny requests coming from version `v3` of the reviews service.
|
|
The adapter always denies requests with a preconfigured status code and message.
|
|
The status code and the message is specified in the [denier](/docs/reference/config/policy-and-telemetry/adapters/denier/)
|
|
adapter configuration.
|
|
|
|
1. Refresh the `productpage` in your browser.
|
|
|
|
If you are logged out or logged in as any user other than "jason" you will no longer see red ratings stars because
|
|
the `reviews:v3` service has been denied access to the `ratings` service.
|
|
In contrast, if you log in as user "jason" (the `reviews:v2` user) you continue to see
|
|
the black ratings stars.
|
|
|
|
## Access control using _whitelists_
|
|
|
|
Istio also supports attribute-based whitelists and blacklists. The following whitelist configuration is equivalent to the
|
|
`denier` configuration in the previous section. The rule effectively rejects requests from version `v3` of the `reviews` service.
|
|
|
|
1. Remove the denier configuration that you added in the previous section.
|
|
|
|
```command
|
|
$ istioctl delete -f samples/bookinfo/kube/mixer-rule-deny-label.yaml
|
|
```
|
|
|
|
1. Verify that when you access the Bookinfo `productpage` (http://$GATEWAY_URL/productpage) without logging in, you see red stars.
|
|
After performing the following steps you will no longer be able to see stars unless you are logged in as "jason".
|
|
|
|
1. Create configuration for the [`list`](/docs/reference/config/policy-and-telemetry/adapters/list/)
|
|
adapter that lists versions `v1, v2`.
|
|
Save the following YAML snippet as `whitelist-handler.yaml`:
|
|
|
|
```yaml
|
|
apiVersion: config.istio.io/v1alpha2
|
|
kind: listchecker
|
|
metadata:
|
|
name: whitelist
|
|
spec:
|
|
# providerUrl: ordinarily black and white lists are maintained
|
|
# externally and fetched asynchronously using the providerUrl.
|
|
overrides: ["v1", "v2"] # overrides provide a static list
|
|
blacklist: false
|
|
```
|
|
|
|
and then run the following command:
|
|
|
|
```command
|
|
$ istioctl create -f whitelist-handler.yaml
|
|
```
|
|
|
|
1. Extract the version label by creating an instance of the [`listentry`](/docs/reference/config/policy-and-telemetry/templates/listentry/) template.
|
|
Save the following YAML snippet as `appversion-instance.yaml`:
|
|
|
|
```yaml
|
|
apiVersion: config.istio.io/v1alpha2
|
|
kind: listentry
|
|
metadata:
|
|
name: appversion
|
|
spec:
|
|
value: source.labels["version"]
|
|
```
|
|
|
|
and then run the following command:
|
|
|
|
```command
|
|
$ istioctl create -f appversion-instance.yaml
|
|
```
|
|
|
|
1. Enable `whitelist` checking for the ratings service.
|
|
Save the following YAML snippet as `checkversion-rule.yaml`:
|
|
|
|
```yaml
|
|
apiVersion: config.istio.io/v1alpha2
|
|
kind: rule
|
|
metadata:
|
|
name: checkversion
|
|
spec:
|
|
match: destination.labels["app"] == "ratings"
|
|
actions:
|
|
- handler: whitelist.listchecker
|
|
instances:
|
|
- appversion.listentry
|
|
```
|
|
|
|
and then run the following command:
|
|
|
|
```command
|
|
$ istioctl create -f checkversion-rule.yaml
|
|
```
|
|
|
|
1. Verify that when you access the Bookinfo `productpage` (http://$GATEWAY_URL/productpage) without logging in, you see **no** stars.
|
|
Verify that after logging in as "jason" you see black stars.
|
|
|
|
## Cleanup
|
|
|
|
* Remove the mixer configuration:
|
|
|
|
```command
|
|
$ istioctl delete -f checkversion-rule.yaml
|
|
$ istioctl delete -f appversion-instance.yaml
|
|
$ istioctl delete -f whitelist-handler.yaml
|
|
```
|
|
|
|
* Remove the application routing rules:
|
|
|
|
```command
|
|
$ istioctl delete -f samples/bookinfo/kube/route-rule-reviews-test-v2.yaml
|
|
$ istioctl delete -f samples/bookinfo/kube/route-rule-reviews-v3.yaml
|
|
```
|
|
|
|
* If you are not planning to explore any follow-on tasks, refer to the
|
|
[Bookinfo cleanup](/docs/guides/bookinfo/#cleanup) instructions
|
|
to shutdown the application.
|
|
|
|
## What's next
|
|
|
|
* Learn how to securely control access based on the service account [here](/docs/tasks/security/secure-access-control/).
|
|
|
|
* Learn more about [Mixer](/docs/concepts/policies-and-telemetry/overview/) and [Mixer Config](/docs/concepts/policies-and-telemetry/config/).
|
|
|
|
* Discover the full [Attribute Vocabulary](/docs/reference/config/policy-and-telemetry/attribute-vocabulary/).
|
|
|
|
* Understand the differences between Kubernetes network policies and Istio
|
|
access control policies from this
|
|
[blog](/blog/2017/0.1-using-network-policy/).
|