feat!: implement operator authorization policy management by chance-coleman · Pull Request #1384 · defenseunicorns/uds-core

chance-coleman · 2025-03-25T15:05:50Z

Description

This PR implements dynamic generation of Istio AuthorizationPolicy resources in ambient mode based on the configuration defined in a UDSPackage. These policies enforce strict ALLOW-only traffic rules, supporting ingress controls, monitoring protection, and gateway exposure with per-port granularity.

Key Features

Allow Rules: Processed from spec.network.allow, with support for:
- remoteGenerated, remoteNamespace, and remoteServiceAccount logic
- Pod-level selector-based grouping for targeted policy generation
Expose Rules: Derived from spec.network.expose, mapped to appropriate source namespaces based on gateway type
Monitor Rules: One policy per monitor entry under spec.monitor, securing endpoints (e.g., Prometheus metrics)
Policy Grouping:
- Rules with selectors are grouped and merged into workload-specific policies
- Rules without selectors are merged into a namespace-wide policy
Port Handling:
- Rules include to blocks when port(s) are provided
- If no port is defined, only the from block is used
Metadata Labels: Policies include uds/package and uds/generation labels for traceability
Orphan Cleanup: Automatically purges outdated policies from previous generations

Additional Context

Documentation is included to explain the policy generation flow, source derivation logic, grouping behavior, and real-world examples. Also see jest tests for additional UDS Core Package examples.

Related Issue

Fixes #1245
Relates to #1248 #1280

Type of change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Other (security config, docs update, etc)

Steps to Validate

uds run test-uds-core
validate authpols that are created for UDS packages
apply additional packages to cluster and verify the generated authpols

Checklist before merging

Test, docs, adr added or updated as needed
Contributor Guide followed

BEGIN_COMMIT_OVERRIDE
feat!: ambient mesh authorization policy generation (#1384)

BREAKING CHANGE: dynamic generation of Istio AuthorizationPolicy resources in ambient mode based on the configuration defined in a UDSPackage. ALL requests to a pod with authservice protection MUST have a jwt from Keycloak. More fine-grained protection can be done with additional DENY policies, but there will always be a requirement for a Keycloak JWT in addition.
END_COMMIT_OVERRIDE

noahpb

One additional nit thing on docs. Apart from that LGTM!

🤖 I have created a release *beep* *boop* --- ## [0.39.0](v0.38.0...v0.39.0) (2025-04-01) ### ⚠ BREAKING CHANGES * dynamic generation of Istio AuthorizationPolicy resources in ambient mode based on the configuration defined in a UDSPackage. ALL requests to a pod with authservice protection MUST have a jwt from Keycloak. More fine-grained protection can be done with additional DENY policies, but there will always be a requirement for a Keycloak JWT in addition. ### Features * add alertmanager datasource to grafana ([#1374](#1374)) ([818a3a0](818a3a0)) * ambient mesh authorization policy generation (#1384) ([b47daba](b47daba)) * new webauth and mfa flows ([#1370](#1370)) ([1ac1b03](1ac1b03)) * theme customization ([#1382](#1382)) ([55ef41b](55ef41b)) * use Client Credentials for managing Keycloak Clients ([#1341](#1341)) ([4db9cc7](4db9cc7)) ### Bug Fixes * add delete credential keycloak secret value ([#1398](#1398)) ([d45b3e6](d45b3e6)) * broken selectors for internal dependencies on charts ([#1403](#1403)) ([d72b194](d72b194)) ### Miscellaneous * add additionalNetworkAllow to keycloak and loki ([#1379](#1379)) ([8200bce](8200bce)) * add docs for layer selection ([#1216](#1216)) ([c170322](c170322)) * **deps:** update grafana ([#1383](#1383)) ([122dc58](122dc58)) * **deps:** update grafana to v8.10.4 ([#1363](#1363)) ([fb163bd](fb163bd)) * **deps:** update istio to v1.25.0 ([#1335](#1335)) ([1803ea7](1803ea7)) * **deps:** update keycloak to v0.11.1 ([#1400](#1400)) ([6fdcd0c](6fdcd0c)) * **deps:** update keycloak to v26.1.4 ([#1356](#1356)) ([31152f7](31152f7)) * **deps:** update pepr to v0.46.3 ([#1365](#1365)) ([304a556](304a556)) * **deps:** update prometheus-stack ([#1362](#1362)) ([ae40b27](ae40b27)) * **deps:** update prometheus-stack ([#1380](#1380)) ([eec3337](eec3337)) * **deps:** update support dependencies to v22.13.17 ([#1401](#1401)) ([8a81eec](8a81eec)) * **deps:** update support-deps ([#1364](#1364)) ([7819bec](7819bec)) * **deps:** update support-deps ([#1376](#1376)) ([dd22589](dd22589)) * **deps:** update support-deps ([#1390](#1390)) ([f06bb70](f06bb70)) * **deps:** update support-deps ([#1392](#1392)) ([c0762a3](c0762a3)) * **deps:** update ts-jest to v29.3.0 ([#1377](#1377)) ([8b2174a](8b2174a)) * **deps:** update velero to v8.6.0 ([#1371](#1371)) ([93a44e6](93a44e6)) * remove kiali and tempo references from repo ([#1375](#1375)) ([8374de3](8374de3)) * update how to scrape metrics ([#1378](#1378)) ([e808f7d](e808f7d)) * update unicorn ztunnel image to 1.25.0 ([#1389](#1389)) ([7e446cb](7e446cb)) ### Documentation * velero csi vsphere backups ([#1385](#1385)) ([5ae33b2](5ae33b2)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## Description This PR implements dynamic generation of Istio AuthorizationPolicy resources in ambient mode based on the configuration defined in a UDSPackage. These policies enforce strict ALLOW-only traffic rules, supporting ingress controls, monitoring protection, and gateway exposure with per-port granularity. ## Key Features - Allow Rules: Processed from spec.network.allow, with support for: - `remoteGenerated`, `remoteNamespace`, and `remoteServiceAccount` logic - Pod-level selector-based grouping for targeted policy generation - Expose Rules: Derived from `spec.network.expose`, mapped to appropriate source namespaces based on gateway type - Monitor Rules: One policy per monitor entry under `spec.monitor`, securing endpoints (e.g., Prometheus metrics) - Policy Grouping: - Rules with selectors are grouped and merged into workload-specific policies - Rules without selectors are merged into a namespace-wide policy - Port Handling: - Rules include `to` blocks when port(s) are provided - If no port is defined, only the `from` block is used - Metadata Labels: Policies include `uds/package` and `uds/generation` labels for traceability - Orphan Cleanup: Automatically purges outdated policies from previous generations ## Additional Context Documentation is included to explain the policy generation flow, source derivation logic, grouping behavior, and real-world examples. Also see jest tests for additional UDS Core Package examples. ## Related Issue Fixes #1245 Relates to #1248 #1280 ## Type of change - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Other (security config, docs update, etc) ## Steps to Validate - `uds run test-uds-core` - validate authpols that are created for UDS packages - apply additional packages to cluster and verify the generated authpols ## Checklist before merging - [x] Test, docs, adr added or updated as needed - [x] [Contributor Guide](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md) followed BEGIN_COMMIT_OVERRIDE feat!: ambient mesh authorization policy generation (#1384) BREAKING CHANGE: dynamic generation of Istio AuthorizationPolicy resources in ambient mode based on the configuration defined in a UDSPackage. ALL requests to a pod with authservice protection MUST have a jwt from Keycloak. More fine-grained protection can be done with additional DENY policies, but there will always be a requirement for a Keycloak JWT in addition. END_COMMIT_OVERRIDE --------- Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>

🤖 I have created a release *beep* *boop* --- ## [0.39.0](v0.38.0...v0.39.0) (2025-04-01) ### ⚠ BREAKING CHANGES * dynamic generation of Istio AuthorizationPolicy resources in ambient mode based on the configuration defined in a UDSPackage. ALL requests to a pod with authservice protection MUST have a jwt from Keycloak. More fine-grained protection can be done with additional DENY policies, but there will always be a requirement for a Keycloak JWT in addition. ### Features * add alertmanager datasource to grafana ([#1374](#1374)) ([818a3a0](818a3a0)) * ambient mesh authorization policy generation (#1384) ([b47daba](b47daba)) * new webauth and mfa flows ([#1370](#1370)) ([1ac1b03](1ac1b03)) * theme customization ([#1382](#1382)) ([55ef41b](55ef41b)) * use Client Credentials for managing Keycloak Clients ([#1341](#1341)) ([4db9cc7](4db9cc7)) ### Bug Fixes * add delete credential keycloak secret value ([#1398](#1398)) ([d45b3e6](d45b3e6)) * broken selectors for internal dependencies on charts ([#1403](#1403)) ([d72b194](d72b194)) ### Miscellaneous * add additionalNetworkAllow to keycloak and loki ([#1379](#1379)) ([8200bce](8200bce)) * add docs for layer selection ([#1216](#1216)) ([c170322](c170322)) * **deps:** update grafana ([#1383](#1383)) ([122dc58](122dc58)) * **deps:** update grafana to v8.10.4 ([#1363](#1363)) ([fb163bd](fb163bd)) * **deps:** update istio to v1.25.0 ([#1335](#1335)) ([1803ea7](1803ea7)) * **deps:** update keycloak to v0.11.1 ([#1400](#1400)) ([6fdcd0c](6fdcd0c)) * **deps:** update keycloak to v26.1.4 ([#1356](#1356)) ([31152f7](31152f7)) * **deps:** update pepr to v0.46.3 ([#1365](#1365)) ([304a556](304a556)) * **deps:** update prometheus-stack ([#1362](#1362)) ([ae40b27](ae40b27)) * **deps:** update prometheus-stack ([#1380](#1380)) ([eec3337](eec3337)) * **deps:** update support dependencies to v22.13.17 ([#1401](#1401)) ([8a81eec](8a81eec)) * **deps:** update support-deps ([#1364](#1364)) ([7819bec](7819bec)) * **deps:** update support-deps ([#1376](#1376)) ([dd22589](dd22589)) * **deps:** update support-deps ([#1390](#1390)) ([f06bb70](f06bb70)) * **deps:** update support-deps ([#1392](#1392)) ([c0762a3](c0762a3)) * **deps:** update ts-jest to v29.3.0 ([#1377](#1377)) ([8b2174a](8b2174a)) * **deps:** update velero to v8.6.0 ([#1371](#1371)) ([93a44e6](93a44e6)) * remove kiali and tempo references from repo ([#1375](#1375)) ([8374de3](8374de3)) * update how to scrape metrics ([#1378](#1378)) ([e808f7d](e808f7d)) * update unicorn ztunnel image to 1.25.0 ([#1389](#1389)) ([7e446cb](7e446cb)) ### Documentation * velero csi vsphere backups ([#1385](#1385)) ([5ae33b2](5ae33b2)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…corns#1384) ## Description This PR implements dynamic generation of Istio AuthorizationPolicy resources in ambient mode based on the configuration defined in a UDSPackage. These policies enforce strict ALLOW-only traffic rules, supporting ingress controls, monitoring protection, and gateway exposure with per-port granularity. ## Key Features - Allow Rules: Processed from spec.network.allow, with support for: - `remoteGenerated`, `remoteNamespace`, and `remoteServiceAccount` logic - Pod-level selector-based grouping for targeted policy generation - Expose Rules: Derived from `spec.network.expose`, mapped to appropriate source namespaces based on gateway type - Monitor Rules: One policy per monitor entry under `spec.monitor`, securing endpoints (e.g., Prometheus metrics) - Policy Grouping: - Rules with selectors are grouped and merged into workload-specific policies - Rules without selectors are merged into a namespace-wide policy - Port Handling: - Rules include `to` blocks when port(s) are provided - If no port is defined, only the `from` block is used - Metadata Labels: Policies include `uds/package` and `uds/generation` labels for traceability - Orphan Cleanup: Automatically purges outdated policies from previous generations ## Additional Context Documentation is included to explain the policy generation flow, source derivation logic, grouping behavior, and real-world examples. Also see jest tests for additional UDS Core Package examples. ## Related Issue Fixes defenseunicorns#1245 Relates to defenseunicorns#1248 defenseunicorns#1280 ## Type of change - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Other (security config, docs update, etc) ## Steps to Validate - `uds run test-uds-core` - validate authpols that are created for UDS packages - apply additional packages to cluster and verify the generated authpols ## Checklist before merging - [x] Test, docs, adr added or updated as needed - [x] [Contributor Guide](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md) followed BEGIN_COMMIT_OVERRIDE feat!: ambient mesh authorization policy generation (defenseunicorns#1384) BREAKING CHANGE: dynamic generation of Istio AuthorizationPolicy resources in ambient mode based on the configuration defined in a UDSPackage. ALL requests to a pod with authservice protection MUST have a jwt from Keycloak. More fine-grained protection can be done with additional DENY policies, but there will always be a requirement for a Keycloak JWT in addition. END_COMMIT_OVERRIDE --------- Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>

🤖 I have created a release *beep* *boop* --- ## [0.39.0](defenseunicorns/uds-core@v0.38.0...v0.39.0) (2025-04-01) ### ⚠ BREAKING CHANGES * dynamic generation of Istio AuthorizationPolicy resources in ambient mode based on the configuration defined in a UDSPackage. ALL requests to a pod with authservice protection MUST have a jwt from Keycloak. More fine-grained protection can be done with additional DENY policies, but there will always be a requirement for a Keycloak JWT in addition. ### Features * add alertmanager datasource to grafana ([defenseunicorns#1374](defenseunicorns#1374)) ([818a3a0](defenseunicorns@818a3a0)) * ambient mesh authorization policy generation (defenseunicorns#1384) ([b47daba](defenseunicorns@b47daba)) * new webauth and mfa flows ([defenseunicorns#1370](defenseunicorns#1370)) ([1ac1b03](defenseunicorns@1ac1b03)) * theme customization ([defenseunicorns#1382](defenseunicorns#1382)) ([55ef41b](defenseunicorns@55ef41b)) * use Client Credentials for managing Keycloak Clients ([defenseunicorns#1341](defenseunicorns#1341)) ([4db9cc7](defenseunicorns@4db9cc7)) ### Bug Fixes * add delete credential keycloak secret value ([defenseunicorns#1398](defenseunicorns#1398)) ([d45b3e6](defenseunicorns@d45b3e6)) * broken selectors for internal dependencies on charts ([defenseunicorns#1403](defenseunicorns#1403)) ([d72b194](defenseunicorns@d72b194)) ### Miscellaneous * add additionalNetworkAllow to keycloak and loki ([defenseunicorns#1379](defenseunicorns#1379)) ([8200bce](defenseunicorns@8200bce)) * add docs for layer selection ([defenseunicorns#1216](defenseunicorns#1216)) ([c170322](defenseunicorns@c170322)) * **deps:** update grafana ([defenseunicorns#1383](defenseunicorns#1383)) ([122dc58](defenseunicorns@122dc58)) * **deps:** update grafana to v8.10.4 ([defenseunicorns#1363](defenseunicorns#1363)) ([fb163bd](defenseunicorns@fb163bd)) * **deps:** update istio to v1.25.0 ([defenseunicorns#1335](defenseunicorns#1335)) ([1803ea7](defenseunicorns@1803ea7)) * **deps:** update keycloak to v0.11.1 ([defenseunicorns#1400](defenseunicorns#1400)) ([6fdcd0c](defenseunicorns@6fdcd0c)) * **deps:** update keycloak to v26.1.4 ([defenseunicorns#1356](defenseunicorns#1356)) ([31152f7](defenseunicorns@31152f7)) * **deps:** update pepr to v0.46.3 ([defenseunicorns#1365](defenseunicorns#1365)) ([304a556](defenseunicorns@304a556)) * **deps:** update prometheus-stack ([defenseunicorns#1362](defenseunicorns#1362)) ([ae40b27](defenseunicorns@ae40b27)) * **deps:** update prometheus-stack ([defenseunicorns#1380](defenseunicorns#1380)) ([eec3337](defenseunicorns@eec3337)) * **deps:** update support dependencies to v22.13.17 ([defenseunicorns#1401](defenseunicorns#1401)) ([8a81eec](defenseunicorns@8a81eec)) * **deps:** update support-deps ([defenseunicorns#1364](defenseunicorns#1364)) ([7819bec](defenseunicorns@7819bec)) * **deps:** update support-deps ([defenseunicorns#1376](defenseunicorns#1376)) ([dd22589](defenseunicorns@dd22589)) * **deps:** update support-deps ([defenseunicorns#1390](defenseunicorns#1390)) ([f06bb70](defenseunicorns@f06bb70)) * **deps:** update support-deps ([defenseunicorns#1392](defenseunicorns#1392)) ([c0762a3](defenseunicorns@c0762a3)) * **deps:** update ts-jest to v29.3.0 ([defenseunicorns#1377](defenseunicorns#1377)) ([8b2174a](defenseunicorns@8b2174a)) * **deps:** update velero to v8.6.0 ([defenseunicorns#1371](defenseunicorns#1371)) ([93a44e6](defenseunicorns@93a44e6)) * remove kiali and tempo references from repo ([defenseunicorns#1375](defenseunicorns#1375)) ([8374de3](defenseunicorns@8374de3)) * update how to scrape metrics ([defenseunicorns#1378](defenseunicorns#1378)) ([e808f7d](defenseunicorns@e808f7d)) * update unicorn ztunnel image to 1.25.0 ([defenseunicorns#1389](defenseunicorns#1389)) ([7e446cb](defenseunicorns@7e446cb)) ### Documentation * velero csi vsphere backups ([defenseunicorns#1385](defenseunicorns#1385)) ([5ae33b2](defenseunicorns@5ae33b2)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chance-coleman added 2 commits March 17, 2025 10:19

feat: init authpol operator

c1526e2

feat: authpol operator changes

7c70bd4

chance-coleman self-assigned this Mar 25, 2025

Merge branch 'main' into ambient-mesh-operator

b5404cb

chance-coleman commented Mar 25, 2025

View reviewed changes

Comment thread .gitignore

chance-coleman and others added 2 commits March 27, 2025 12:09

feat: another interation of tests and refactors

d5372c7

Merge branch 'main' into ambient-mesh-operator

2d506c6

chance-coleman marked this pull request as ready for review March 28, 2025 17:29

chance-coleman requested a review from a team as a code owner March 28, 2025 17:29

mjnagel reviewed Mar 28, 2025

View reviewed changes

chance-coleman changed the title ~~feat: ambient mesh operator~~ feat!: ambient mesh operator Mar 29, 2025

fix: refactor naming and other fixes

69cf560

noahpb reviewed Mar 31, 2025

View reviewed changes

chance-coleman and others added 3 commits March 31, 2025 08:57

fix: for pr comments

cf78297

fix: doc wording and passthrough gateway

26353b1

Merge branch 'main' into ambient-mesh-operator

7827f41

mjnagel reviewed Mar 31, 2025

View reviewed changes

Comment thread src/pepr/operator/controllers/network/authorizationPolicies.ts Outdated

chore(docs): update auth service doc

e2accb0

chance-coleman changed the title ~~feat!: ambient mesh operator~~ feat!: implement operator authorization policy management Mar 31, 2025

chance-coleman and others added 4 commits March 31, 2025 10:06

fix: missing authpol counter and prometheus principal

c2b3ece

fix: tests for prometheus principal

557adcd

fix: prometheus principal, kubeapi, kubenode upgrade

416e8fa

Merge branch 'main' into ambient-mesh-operator

fee8e76

mjnagel previously approved these changes Apr 1, 2025

View reviewed changes

mjnagel reviewed Apr 1, 2025

View reviewed changes

Comment thread src/pepr/operator/controllers/network/generators/kubeNodes.ts Outdated

mjnagel reviewed Apr 1, 2025

View reviewed changes

Comment thread src/pepr/operator/controllers/network/generators/kubeNodes.ts Outdated

mjnagel reviewed Apr 1, 2025

View reviewed changes

Comment thread src/pepr/operator/controllers/network/authorizationPolicies.ts Outdated

mjnagel reviewed Apr 1, 2025

View reviewed changes

Comment thread src/pepr/operator/controllers/network/authorizationPolicies.ts Outdated

fix: logging

63ba73e

chance-coleman dismissed mjnagel’s stale review via 63ba73e April 1, 2025 18:19

chance-coleman and others added 2 commits April 1, 2025 12:32

fix: tests

d08e3e3

Merge branch 'main' into ambient-mesh-operator

af0e39e

mjnagel previously approved these changes Apr 1, 2025

View reviewed changes

noahpb reviewed Apr 1, 2025

View reviewed changes

Comment thread docs/dev/authorization-policy-generation.md Outdated

chore(docs): update wording

502fc2a

chance-coleman dismissed mjnagel’s stale review via 502fc2a April 1, 2025 19:42

Merge branch 'main' into ambient-mesh-operator

d814310

mjnagel approved these changes Apr 1, 2025

View reviewed changes

chance-coleman merged commit b47daba into main Apr 1, 2025
22 checks passed

chance-coleman deleted the ambient-mesh-operator branch April 1, 2025 20:14

github-actions Bot mentioned this pull request Apr 1, 2025

chore(main): release 0.39.0 #1373

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat!: implement operator authorization policy management#1384

feat!: implement operator authorization policy management#1384
chance-coleman merged 19 commits intomainfrom
ambient-mesh-operator

chance-coleman commented Mar 25, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

noahpb left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

chance-coleman commented Mar 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Key Features

Additional Context

Related Issue

Type of change

Steps to Validate

Checklist before merging

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

noahpb left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

chance-coleman commented Mar 25, 2025 •

edited

Loading