Istio is an open source service mesh for managing the different microservices that make up a cloud-native application. Istio provides a mechanism to customize the Envoy configuration generated by Istio Pilot using .

This tutorial shows how Istio’s EnvoyFilter can be configured to include Envoy’s External Authorization filter to delegate authorization decisions to OPA.

This tutorial requires Kubernetes 1.14 or later. To run the tutorial locally, we recommend using in version v1.0+ with Kubernetes 1.14+.

The tutorial also requires Istio v1.8.0 or later. It assumes you have Istio deployed on top of Kubernetes. See Istio’s Quick Start page to get started.

The quick_start.yaml manifest defines the following resources:

  • Kubernetes namespace (opa-istio) for OPA-Envoy control plane components.

  • Kubernetes admission controller in the opa-istio namespace that automatically injects the OPA-Envoy sidecar into pods in namespaces labelled with opa-istio-injection=enabled.

  • OPA configuration file and an OPA policy into ConfigMaps in the namespace where the app will be deployed, e.g., default. The following is the example OPA policy:

    • alice is granted a guest role and can perform a GET request to /productpage.
    • bob is granted an admin role and can perform a GET to /productpage and /api/v1/products.
  1. ```
  2. package istio.authz
  4. import input.attributes.request.http as http_request
  5. import input.parsed_path
  7. default allow = false
  9. allow {
  10.     parsed_path[0] == "health"
  11.     http_request.method == "GET"
  12. }
  14. allow {
  15.     roles_for_user[r]
  16.     required_roles[r]
  17. }
  19. roles_for_user[r] {
  20.     r := user_roles[user_name][_]
  21. }
  23. required_roles[r] {
  24.     perm.method = http_request.method
  26. }
  28. user_name = parsed {
  29.     [_, encoded] := split(http_request.headers.authorization, " ")
  30.     [parsed, _] := split(base64url.decode(encoded), ":")
  31. }
  33. user_roles = {
  34.     "alice": ["guest"],
  35.     "bob": ["admin"]
  36. }
  38. role_perms = {
  39.     "guest": [
  40.         {"method": "GET",  "path": "/productpage"},
  41.     ],
  42.     "admin": [
  43.         {"method": "GET",  "path": "/productpage"},
  44.         {"method": "GET",  "path": "/api/v1/products"},
  45.     ],
  46. }
  47. ```
  49. OPA is configured to query for the `data.istio.authz.allow` decision. If the response is `true` the operation is allowed, otherwise the operation is denied. Sample input received by OPA is shown below:
  51. ![](/projects/openpolicyagent-0.28-en/5cf07a0029fd3f32bef77129f190b677.svg)
  53. ```
  54. data.istio.authz.allow
  55. ```
  57. ![](/projects/openpolicyagent-0.28-en/283d4c145904938f2e4b83853669d94c.svg)
  59. ```
  60.     "attributes": {
  61.         "request": {
  62.             "http": {
  64.                 "path": "/productpage",
  65.                 "headers": {
  66.                     "authorization": "Basic YWxpY2U6cGFzc3dvcmQ="
  67.                 }
  68.             }
  69.         }
  70.     }
  71. }
  72. ```
  74. With the input value above, the answer is:
  76. ![](/projects/openpolicyagent-0.28-en/51580f8fbb31eb4eafc68afb33107a09.svg)
  78. ```
  79. true
  80. ```
  82. An example of the complete input received by OPA can be seen [here](https://github.com/open-policy-agent/opa-envoy-plugin/tree/master/examples/istio#example-input).
  84. > In typical deployments the policy would either be built into the OPA container image or it would fetched dynamically via the [Bundle API](https://www.openpolicyagent.org/docs/latest/bundles/). ConfigMaps are used in this tutorial for test purposes.
  1. kubectl label namespace default opa-istio-injection="enabled"
  2. kubectl label namespace default istio-injection="enabled"
  1. kubectl apply -f https://raw.githubusercontent.com/istio/istio/master/samples/bookinfo/networking/bookinfo-gateway.yaml

minikube:

  1. export INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http2")].nodePort}')
  2. export INGRESS_HOST=$(minikube ip)
  3. export GATEWAY_URL=$INGRESS_HOST:$INGRESS_PORT
  4. echo $GATEWAY_URL

minikube (example):

Check that alice can access /productpage BUT NOT /api/v1/products.

  1. curl --user alice:password -i http://$GATEWAY_URL/productpage
  2. curl --user alice:password -i http://$GATEWAY_URL/api/v1/products

Check that bob can access /productpage AND /api/v1/products.

  1. curl --user bob:password -i http://$GATEWAY_URL/productpage
  2. curl --user bob:password -i http://$GATEWAY_URL/api/v1/products

Congratulations for finishing the tutorial !

This tutorial showed how Istio’s can be configured to use OPA as an External authorization service.

This tutorial also showed a sample OPA policy that returns a decision to indicate whether a request should be allowed or not.