100 lines
4.2 KiB
Markdown
100 lines
4.2 KiB
Markdown
# Ext Authz Service
|
|
|
|
[Ext Authz server](cmd/extauthz) implements the external server for the [Envoy ext_authz filter](https://www.envoyproxy.io/docs/envoy/v1.16.0/intro/arch_overview/security/ext_authz_filter)
|
|
as an example of integrating custom authorization system into Istio.
|
|
|
|
The Ext Authz server supports authorization check request using either HTTP (port 8000) or gRPC v2/v3 (port 9000) API and
|
|
will allow the request if it includes the header `x-ext-authz: allow` or if the service account of the source workload is `a`.
|
|
Note that `a` is just a default value for testing. It can be changed with the flag `-allow_service_account` when running the ext authz server.
|
|
|
|
## Usage
|
|
|
|
1. Deploy the Ext Authz service in a dedicated pod:
|
|
|
|
```console
|
|
$ kubectl apply -f ext-authz.yaml
|
|
service/ext-authz created
|
|
deployment.apps/ext-authz created
|
|
```
|
|
|
|
Note, you can also deploy the Ext Authz service locally with the application container in the same pod, see the example in `local-ext-authz.yaml`.
|
|
|
|
1. Verify the Ext Authz server is up and running:
|
|
|
|
Deploy a sleep pod to send the request:
|
|
|
|
```console
|
|
$ kubectl apply -f ../sleep/sleep.yaml
|
|
```
|
|
|
|
Send a check request with header `x-ext-authz: allow` to the Ext Authz server:
|
|
|
|
```console
|
|
$ kubectl exec -it $(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c sleep -- curl -v ext-authz:8000 -H "x-ext-authz: allow"
|
|
* Trying 10.97.88.183:8000...
|
|
* Connected to ext-authz-server (10.97.88.183) port 8000 (#0)
|
|
> GET / HTTP/1.1
|
|
> Host: ext-authz-server:8000
|
|
> User-Agent: curl/7.73.0-DEV
|
|
> Accept: */*
|
|
> x-ext-authz: allow
|
|
>
|
|
* Mark bundle as not supporting multiuse
|
|
< HTTP/1.1 200 OK
|
|
< x-ext-authz-result: allowed
|
|
< date: Tue, 03 Nov 2020 03:06:11 GMT
|
|
< content-length: 0
|
|
< x-envoy-upstream-service-time: 19
|
|
< server: envoy
|
|
<
|
|
* Connection #0 to host ext-authz-server left intact
|
|
```
|
|
|
|
As you observe, the check request with header `x-ext-authz: allow` is allowed by the Ext Authz server.
|
|
|
|
Send another check request with `x-ext-authz: blabla` to the Ext Authz server:
|
|
|
|
```console
|
|
$ kubectl exec -it $(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name}) -c sleep -- curl -v ext-authz:8000 -H "x-ext-authz: bla"
|
|
> GET / HTTP/1.1
|
|
> Host: ext-authz-server:8000
|
|
> User-Agent: curl/7.73.0-DEV
|
|
> Accept: */*
|
|
> x-ext-authz: allowx
|
|
>
|
|
* Mark bundle as not supporting multiuse
|
|
< HTTP/1.1 403 Forbidden
|
|
< x-ext-authz-check-result: denied
|
|
< date: Tue, 03 Nov 2020 03:14:02 GMT
|
|
< content-length: 76
|
|
< content-type: text/plain; charset=utf-8
|
|
< x-envoy-upstream-service-time: 44
|
|
< server: envoy
|
|
<
|
|
* Connection #0 to host ext-authz-server left intact
|
|
denied by ext_authz for not found header `x-ext-authz: allow` in the request
|
|
```
|
|
|
|
As you observe, the check request with header `x-ext-authz: bla` is denied by the Ext Authz server.
|
|
|
|
1. To clean up, execute the following commands:
|
|
|
|
```console
|
|
$ kubectl delete -f ../sleep/sleep.yaml
|
|
$ kubectl delete -f ext-authz.yaml
|
|
```
|
|
|
|
## Advanced features
|
|
|
|
The Ext Authz server supports the following advanced features that are useful for testing:
|
|
|
|
- The ext authz server will add the `x-ext-authz-check-received` header to the user request. The content is the dump of
|
|
the check request it received from the ext-authz filter. This header is useful in verifying the ext-authz filter sending
|
|
the expected request to the ext authz server.
|
|
|
|
- The ext authz server will add (or override if it already exists) the header `x-ext-authz-additional-header-override` to
|
|
the user request. The value of the header depends on the type of ext-authz server.
|
|
The ext authz HTTP server will set it to the value of the same `x-ext-authz-additional-header-override` header in the
|
|
check request. The ext authz gRPC server will set it to the constant value `grpc-additional-header-override-value`.
|
|
This header is useful in verifying the header override behavior in the ext-authz filter.
|