Authorization Policy

Istio Authorization Policy enables access control on workloads in the mesh.

Authorization policy supports CUSTOM, DENY and ALLOW actions for access control. When CUSTOM, DENY and ALLOW actions are used for a workload at the same time, the CUSTOM action is evaluated first, then the DENY action, and finally the ALLOW action. The evaluation is determined by the following rules:

  1. If there are any CUSTOM policies that match the request, evaluate and deny the request if the evaluation result is deny.
  2. If there are any DENY policies that match the request, deny the request.
  3. If there are no ALLOW policies for the workload, allow the request.
  4. If any of the ALLOW policies match the request, allow the request.
  5. Deny the request.

Istio Authorization Policy also supports the AUDIT action to decide whether to log requests. AUDIT policies do not affect whether requests are allowed or denied to the workload. Requests will be allowed or denied based solely on CUSTOM, DENY and ALLOW actions.

A request will be internally marked that it should be audited if there is an AUDIT policy on the workload that matches the request. A separate plugin must be configured and enabled to actually fulfill the audit decision and complete the audit behavior. The request will not be audited if there are no such supporting plugins enabled. Currently, the only supported plugin is the Stackdriver plugin.

Here is an example of Istio Authorization Policy:

It sets the action to “ALLOW” to create an allow policy. The default action is “ALLOW” but it is useful to be explicit in the policy.

It allows requests from:

  • service account “cluster.local/ns/default/sa/sleep” or
  • namespace “test”

to access the workload with:

  • “GET” method at paths of prefix “/info” or,
  • “POST” method at path “/data”.

when the request has a valid JWT token issued by “https://accounts.google.com”.

Any other requests will be denied.

  1. apiVersion: security.istio.io/v1beta1
  2. kind: AuthorizationPolicy
  3. metadata:
  4. name: httpbin
  5. namespace: foo
  6. spec:
  7. action: ALLOW
  8. rules:
  9. - from:
  10. - source:
  11. principals: ["cluster.local/ns/default/sa/sleep"]
  12. - source:
  13. namespaces: ["test"]
  14. to:
  15. - operation:
  16. methods: ["GET"]
  17. paths: ["/info*"]
  18. - operation:
  19. methods: ["POST"]
  20. paths: ["/data"]
  21. when:
  22. - key: request.auth.claims[iss]
  23. values: ["https://accounts.google.com"]

The following is another example that sets action to “DENY” to create a deny policy. It denies requests from the “dev” namespace to the “POST” method on all workloads in the “foo” namespace.

  1. apiVersion: security.istio.io/v1beta1
  2. kind: AuthorizationPolicy
  3. metadata:
  4. name: httpbin
  5. namespace: foo
  6. spec:
  7. action: DENY
  8. rules:
  9. - from:
  10. - source:
  11. namespaces: ["dev"]
  12. to:
  13. - operation:
  14. methods: ["POST"]

The following authorization policy sets the action to “AUDIT”. It will audit any GET requests to the path with the prefix “/user/profile”.

  1. apiVersion: security.istio.io/v1beta1
  2. kind: AuthorizationPolicy
  3. metadata:
  4. namespace: ns1
  5. name: anyname
  6. spec:
  7. selector:
  8. matchLabels:
  9. app: myapi
  10. action: AUDIT
  11. rules:
  12. - to:
  13. - operation:
  14. methods: ["GET"]
  15. paths: ["/user/profile/*"]

Authorization Policy scope (target) is determined by “metadata/namespace” and an optional “selector”.

  • “metadata/namespace” tells which namespace the policy applies. If set to root namespace, the policy applies to all namespaces in a mesh.
  • workload “selector” can be used to further restrict where a policy applies.

For example,

The following authorization policy applies to workloads containing label “app: httpbin” in namespace bar.

  1. apiVersion: security.istio.io/v1beta1
  2. kind: AuthorizationPolicy
  3. metadata:
  4. name: policy
  5. namespace: bar
  6. spec:
  7. selector:
  8. matchLabels:
  9. app: httpbin

The following authorization policy applies to all workloads in namespace foo.

  1. apiVersion: security.istio.io/v1beta1
  2. kind: AuthorizationPolicy
  3. metadata:
  4. name: policy
  5. namespace: foo
  6. spec:
  7. {}

The following authorization policy applies to workloads containing label “version: v1” in all namespaces in the mesh. (Assuming the root namespace is configured to “istio-config”).

  1. apiVersion: security.istio.io/v1beta1
  2. kind: AuthorizationPolicy
  3. metadata:
  4. name: policy
  5. namespace: istio-config
  6. spec:
  7. selector:
  8. matchLabels:
  9. version: v1

AuthorizationPolicy

AuthorizationPolicy enables access control on workloads.

For example, the following authorization policy allows nothing and effectively denies all requests to workloads in namespace foo.

  1. apiVersion: security.istio.io/v1beta1
  2. kind: AuthorizationPolicy
  3. metadata:
  4. name: allow-nothing
  5. namespace: foo
  6. spec:
  7. {}

The following authorization policy allows all requests to workloads in namespace foo.

  1. apiVersion: security.istio.io/v1beta1
  2. kind: AuthorizationPolicy
  3. metadata:
  4. name: allow-all
  5. namespace: foo
  6. spec:
  7. rules:
  8. - {}
FieldTypeDescriptionRequired
selectorWorkloadSelector

Optional. Workload selector decides where to apply the authorization policy. If not set, the authorization policy will be applied to all workloads in the same namespace as the authorization policy.

No
rulesRule[]

Optional. A list of rules to match the request. A match occurs when at least one rule matches the request.

If not set, the match will never occur. This is equivalent to setting a default of deny for the target workloads.

No
actionAction

Optional. The action to take if the request is matched with the rules.

No
providerExtensionProvider (oneof)

Specifies detailed configuration of the CUSTOM action. Must be used only with CUSTOM action.

No

Rule

Rule matches requests from a list of sources that perform a list of operations subject to a list of conditions. A match occurs when at least one source, one operation and all conditions matches the request. An empty rule is always matched.

Any string field in the rule supports Exact, Prefix, Suffix and Presence match:

  • Exact match: “abc” will match on value “abc”.
  • Prefix match: “abc*” will match on value “abc” and “abcd”.
  • Suffix match: “*abc” will match on value “abc” and “xabc”.
  • Presence match: “*” will match when value is not empty.
FieldTypeDescriptionRequired
fromFrom[]

Optional. from specifies the source of a request.

If not set, any source is allowed.

No
toTo[]

Optional. to specifies the operation of a request.

If not set, any operation is allowed.

No
whenCondition[]

Optional. when specifies a list of additional conditions of a request.

If not set, any condition is allowed.

No

Source

Source specifies the source identities of a request. Fields in the source are ANDed together.

For example, the following source matches if the principal is “admin” or “dev” and the namespace is “prod” or “test” and the ip is not “1.2.3.4”.

  1. principals: ["admin", "dev"]
  2. namespaces: ["prod", "test"]
  3. notIpBlocks: ["1.2.3.4"]
FieldTypeDescriptionRequired
principalsstring[]

Optional. A list of source peer identities (i.e. service account), which matches to the “source.principal” attribute. This field requires mTLS enabled.

If not set, any principal is allowed.

No
notPrincipalsstring[]

Optional. A list of negative match of source peer identities.

No
requestPrincipalsstring[]

Optional. A list of request identities (i.e. “iss/sub” claims), which matches to the “request.auth.principal” attribute.

If not set, any request principal is allowed.

No
notRequestPrincipalsstring[]

Optional. A list of negative match of request identities.

No
namespacesstring[]

Optional. A list of namespaces, which matches to the “source.namespace” attribute. This field requires mTLS enabled.

If not set, any namespace is allowed.

No
notNamespacesstring[]

Optional. A list of negative match of namespaces.

No
ipBlocksstring[]

Optional. A list of IP blocks, which matches to the “source.ip” attribute. Populated from the source address of the IP packet. Single IP (e.g. “1.2.3.4”) and CIDR (e.g. “1.2.3.0/24”) are supported.

If not set, any IP is allowed.

No
notIpBlocksstring[]

Optional. A list of negative match of IP blocks.

No
remoteIpBlocksstring[]

Optional. A list of IP blocks, which matches to the “remote.ip” attribute. Populated from X-Forwarded-For header or proxy protocol. To make use of this field, you must configure the numTrustedProxies field of the gatewayTopology under the meshConfig when you install Istio or using an annotation on the ingress gateway. See the documentation here: Configuring Gateway Network Topology. Single IP (e.g. “1.2.3.4”) and CIDR (e.g. “1.2.3.0/24”) are supported.

If not set, any IP is allowed.

No
notRemoteIpBlocksstring[]

Optional. A list of negative match of remote IP blocks.

No

Operation

Operation specifies the operations of a request. Fields in the operation are ANDed together.

For example, the following operation matches if the host has suffix “.example.com” and the method is “GET” or “HEAD” and the path doesn’t have prefix “/admin”.

  1. hosts: ["*.example.com"]
  2. methods: ["GET", "HEAD"]
  3. notPaths: ["/admin*"]
FieldTypeDescriptionRequired
hostsstring[]

Optional. A list of hosts, which matches to the “request.host” attribute.

If not set, any host is allowed. Must be used only with HTTP.

No
notHostsstring[]

Optional. A list of negative match of hosts.

No
portsstring[]

Optional. A list of ports, which matches to the “destination.port” attribute.

If not set, any port is allowed.

No
notPortsstring[]

Optional. A list of negative match of ports.

No
methodsstring[]

Optional. A list of methods, which matches to the “request.method” attribute. For gRPC service, this will always be “POST”.

If not set, any method is allowed. Must be used only with HTTP.

No
notMethodsstring[]

Optional. A list of negative match of methods.

No
pathsstring[]

Optional. A list of paths, which matches to the “request.url_path” attribute. For gRPC service, this will be the fully-qualified name in the form of “/package.service/method”.

If not set, any path is allowed. Must be used only with HTTP.

No
notPathsstring[]

Optional. A list of negative match of paths.

No

Condition

Condition specifies additional required attributes.

FieldTypeDescriptionRequired
keystring

The name of an Istio attribute. See the full list of supported attributes.

Yes
valuesstring[]

Optional. A list of allowed values for the attribute. Note: at least one of values or not_values must be set.

No
notValuesstring[]

Optional. A list of negative match of values for the attribute. Note: at least one of values or not_values must be set.

No

AuthorizationPolicy.ExtensionProvider

FieldTypeDescriptionRequired
namestring

Specifies the name of the extension provider. The list of available providers is defined in the MeshConfig. Note, currently at most 1 extension provider is allowed per workload. Different workloads can use different extension provider.

No

Rule.From

From includes a list or sources.

FieldTypeDescriptionRequired
sourceSource

Source specifies the source of a request.

No

Rule.To

To includes a list or operations.

FieldTypeDescriptionRequired
operationOperation

Operation specifies the operation of a request.

No

AuthorizationPolicy.Action

Action specifies the operation to take.

NameDescription
ALLOW

Allow a request only if it matches the rules. This is the default type.

DENY

Deny a request if it matches any of the rules.

AUDIT

Audit a request if it matches any of the rules.

CUSTOM

The CUSTOM action allows an extension to handle the user request if the matching rules evaluate to true. The extension is evaluated independently and before the native ALLOW and DENY actions. When used together, A request is allowed if and only if all the actions return allow, in other words, the extension cannot bypass the authorization decision made by ALLOW and DENY action. Extension behavior is defined by the named providers declared in MeshConfig. The authorization policy refers to the extension by specifying the name of the provider. One example use case of the extension is to integrate with a custom external authorization system to delegate the authorization decision to it.

Note: The CUSTOM action is currently an experimental feature and is subject to breaking changes in later versions.

The following authorization policy applies to an ingress gateway and delegates the authorization check to a named extension “my-custom-authz” if the request path has prefix “/admin/”.

  1. apiVersion: security.istio.io/v1beta1
  2. kind: AuthorizationPolicy
  3. metadata:
  4. name: ext-authz
  5. namespace: istio-system
  6. spec:
  7. selector:
  8. matchLabels:
  9. app: istio-ingressgateway
  10. action: CUSTOM
  11. provider:
  12. name: my-custom-authz
  13. rules:
  14. - to:
  15. - operation:
  16. paths: [“/admin/*”]