CODEWITHSUNDEEP
istioenvoyproxy
toonvanstrijp
toonvanstrijp

Reputation: 417

Istio AuthorizationPolicy only for external requests

Right now I'm having 3 services. A, B and C. They all are running in the same namespace. I'm making use of the EnvoyFilter to transcode the http requests to grpc calls.

Now I want to add security for those calls but I want each service to allow internal communication as well.

So I only want to check external requests for authentication.

Right now I have the following RequestAuthentication:

apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: jwt-authentication
spec:
  selector:
    matchLabels:
      sup.security: jwt-authentication
  jwtRules:
  - issuer: "http://keycloak-http/auth/realms/supporters"
    jwksUri: "http://keycloak-http/auth/realms/supporters/protocol/openid-connect/certs"

Then I added the following AuthorizationPolicy:

apiVersion: "security.istio.io/v1beta1"
kind: "AuthorizationPolicy"
metadata:
  name: "auth-policy-deny-default"
spec:
  selector:
    matchLabels:
      sup.security: jwt-authentication
  action: DENY
  rules: []

How do I configure istio in a way that it allows intercommunication without checking for authentication?

Upvotes: 0

Views: 2008

Answers (1)

Rinor
Rinor

Reputation: 1979

The recommended approach in Istio is not to think from the perspective of what you want to deny, but of what you want to allow, and then deny everything else.

To deny everything else create a catch-all deny rule as shown below:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-all
  namespace: YOUR_NAMESPACE
spec:
  {}

Now what you need to do is decide what are the cases when you want to allow requests. In your case, it would be:

  • All authenticated requests from within the cluster achieved with principals: ["*"].
  • All authenticated requests with a valid jwt token achieved with requestPrincipals: ["*"]

Putting those together give the policy below:

apiVersion: "security.istio.io/v1beta1"
kind: "AuthorizationPolicy"
metadata:
 name: "allow-all-in-cluster-and-authenticated"
 namespace: YOUR_NAMESPACE
spec:
  rules:                                 
  - from:
    - source:
        principals: ["*"]
    - source:
        requestPrincipals: ["*"]

The field principals has a value only if a workload can identify itself via a certificate (it must have the istio proxy) during PeerAuthentication. And the field requestPrincipals is extracted from the jwt token during RequestAuthentication.

Please let me know if it doesn't work or there are tweaks needed :)

Upvotes: 2

Related Questions