Authorization in Cloud Service Mesh
1. Authorization in Cloud Service Mesh
Once a request has been authenticated, the information from the request can be used for authorization. Sidecar and perimeter proxies act as policy enforcement points, or PEPs, and help authorize requests. Operators specify mesh authorization policies using YAML files. When a proxy receives a request, it's evaluated against authorization policies by an authorization engine, and the request is either allowed or denied. Authorization policies act as gatekeepers for your mesh workloads, controlling access between services, as well as between end users and services. They're defined using a single authorization policy CRD, which provides flexible semantics with custom conditions and audit, custom, deny, and allow actions. These conditions are natively enforced by Envoy. Authorization policies support a range of protocols, such as gRPC, HTTP, HTTPS, and HTTP/2 natively, and any TCP protocol. An authorization policy includes a selector, an action, and a list of rules. The selector field specifies the workloads affected by the policy. The action field specifies whether to allow or deny requests. The rules specify when to trigger an action. The from field in the rules specify sources of requests. The to field in the rules specifies the methods and paths allowed or denied. Notice that we apply these rules to layer 7 networking, while in Kubernetes, we can only apply network policies at layer 4. The when field specifies the conditions that would cause a request to match the rule.2. Let's practice!
Create Your Free Account
or
By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.