From bdd1c3b9e9f24ef3b9d378612b39482b21b7e45f Mon Sep 17 00:00:00 2001 From: Ignasi Barrera Date: Fri, 19 Apr 2024 13:03:42 +0200 Subject: [PATCH] Add minimal examples to make it easier to get started (#252) * Add minimal examples to make it easier to get started Signed-off-by: Ignasi Barrera * Add policies Signed-off-by: Ignasi Barrera --------- Signed-off-by: Ignasi Barrera --- examples/minimal/authservice-config.yaml | 68 ++++++++++++++++ examples/minimal/authservice.yaml | 89 +++++++++++++++++++++ examples/minimal/authz-policy.yaml | 38 +++++++++ examples/minimal/istiod-values.yaml | 24 ++++++ examples/minimal/oidc-intercept-policy.yaml | 31 +++++++ examples/minimal/rbac.yaml | 37 +++++++++ 6 files changed, 287 insertions(+) create mode 100644 examples/minimal/authservice-config.yaml create mode 100644 examples/minimal/authservice.yaml create mode 100644 examples/minimal/authz-policy.yaml create mode 100644 examples/minimal/istiod-values.yaml create mode 100644 examples/minimal/oidc-intercept-policy.yaml create mode 100644 examples/minimal/rbac.yaml diff --git a/examples/minimal/authservice-config.yaml b/examples/minimal/authservice-config.yaml new file mode 100644 index 00000000..33658426 --- /dev/null +++ b/examples/minimal/authservice-config.yaml @@ -0,0 +1,68 @@ +# Copyright 2024 Tetrate +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Secret +metadata: + name: client-secret +type: Opaque +stringData: + client-secret: "authservice-secret" +--- +kind: ConfigMap +apiVersion: v1 +metadata: + name: authservice-config +data: + config.json: | + { + "listen_address": "0.0.0.0", + "listen_port": "10003", + "log_level": "debug", + "allow_unmatched_requests": false, + "chains": [ + { + "name": "oidc", + "filters": [ + { + "oidc": + { + "configuration_uri": "https://OIDC_PROVIDER_WELLKNOWN_URI/.well-known/openid-configuration", + + "callback_uri": "https://APPLICATION_URI/callback", + "client_id": "authservice-client", + "client_secret_ref": { + "namespace": "CHANGEME", + "name": "client-secret" + }, + "id_token": { + "preamble": "Bearer", + "header": "authorization" + }, + "access_token": { + "header": "x-access-token" + } + } + } + ] + } + ] + } diff --git a/examples/minimal/authservice.yaml b/examples/minimal/authservice.yaml new file mode 100644 index 00000000..860bec34 --- /dev/null +++ b/examples/minimal/authservice.yaml @@ -0,0 +1,89 @@ +# Copyright 2024 Tetrate +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Service +metadata: + name: authservice + labels: + app: authservice +spec: + ports: + # Main port where the authservice listens for gRPC requests. + # This is the port that needs to be set when configuring the `extensionProviders` + # in the Istio configuration.ß + - port: 10003 + targetPort: 10003 + name: grpc-authservice + protocol: TCP + - port: 10004 + targetPort: 10004 + name: grpc-health + protocol: TCP + selector: + app: authservice +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: authservice + labels: + app: authservice +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: authservice +spec: + replicas: 1 + selector: + matchLabels: + app: authservice + version: v1 + template: + metadata: + labels: + app: authservice + version: v1 + spec: + serviceAccountName: authservice + containers: + - name: authservice + image: ghcr.io/istio-ecosystem/authservice/authservice:1.0.0 + imagePullPolicy: IfNotPresent + ports: + - name: authz + containerPort: 10003 + protocol: TCP + - name: health + containerPort: 10004 + protocol: TCP + volumeMounts: + - name: config + mountPath: /etc/authservice + livenessProbe: + initialDelaySeconds: 1 + periodSeconds: 5 + tcpSocket: + port: 10003 + readinessProbe: + initialDelaySeconds: 5 + periodSeconds: 5 + httpGet: + port: 10004 + path: /healthz + volumes: + - name: config + configMap: + name: authservice-config diff --git a/examples/minimal/authz-policy.yaml b/examples/minimal/authz-policy.yaml new file mode 100644 index 00000000..17c6cfd4 --- /dev/null +++ b/examples/minimal/authz-policy.yaml @@ -0,0 +1,38 @@ +# Copyright 2024 Tetrate +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Set a policy to make sure all requests targeting services in the namespace where +# this policy is applied, contain a token issued by the OIDC provider. +apiVersion: security.istio.io/v1beta1 +kind: RequestAuthentication +metadata: + name: example-authn +spec: + jwtRules: + - issuer: "OIDC_PROVIDER_ISSUER" + jwksUri: "http://OIDC_PROVIDER_JWKS_URI" # can be omitted if the issuer has a well-known endpoint + forwardOriginalToken: true +--- +# Set a policy to enforce that the token is present. The policy allows any subject, but it can be +# further refined with constraints based on the JWT token claims. +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + name: example-authz +spec: + action: ALLOW + rules: + - from: + - source: + requestPrincipals: ["*"] diff --git a/examples/minimal/istiod-values.yaml b/examples/minimal/istiod-values.yaml new file mode 100644 index 00000000..1551a152 --- /dev/null +++ b/examples/minimal/istiod-values.yaml @@ -0,0 +1,24 @@ +# Copyright 2024 Tetrate +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Example Istiod values.yaml that configures the Authservice as an extension provider +meshConfig: + extensionProviders: + # Configure the backend for the Auth Service provider that can be used in AuthorizationPolicies + # in CUSTOM mode. + - name: authservice-grpc + envoyExtAuthzGrpc: + # This must match the Kubernetes service and port where the authservice is listening. + service: "authservice.authservice.svc.cluster.local" + port: "10003" # This port is the one to be set in the authservice config diff --git a/examples/minimal/oidc-intercept-policy.yaml b/examples/minimal/oidc-intercept-policy.yaml new file mode 100644 index 00000000..be283434 --- /dev/null +++ b/examples/minimal/oidc-intercept-policy.yaml @@ -0,0 +1,31 @@ +# Copyright 2024 Tetrate +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: security.istio.io/v1beta1 +kind: AuthorizationPolicy +metadata: + name: authservice + # Applying this policy to the application namespace will intercept all requests + # that get to the sidecars in the namespace and forward them to the Authservice. +spec: + action: CUSTOM + provider: + # Name defined in the extensionProviders property in the MeshConfig + # (the `istio` ConfigMap in the istio-system namespace) + name: authservice-grpc + # A single empty rule will force all requests to be forwarded to the external + # authorization backend, as long as the workload is captured by the selectors + # configured above. + rules: + - {} diff --git a/examples/minimal/rbac.yaml b/examples/minimal/rbac.yaml new file mode 100644 index 00000000..0d5d927c --- /dev/null +++ b/examples/minimal/rbac.yaml @@ -0,0 +1,37 @@ +# Copyright 2024 Tetrate +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: authservice-secrets +rules: + # Allow authservice to read the secrets in its namespace so it can read + # the OIDC client-secret from a Kubernetes secret instead of having it in clear text + # in the ConfigMap + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "watch", "list"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: authservice-secrets +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: authservice-secrets +subjects: + - kind: ServiceAccount + name: authservice