Istio与OPA应用授权方案

1、How We Use Istio and OPA for AuthorizationIstio 与 OPA 应用授权方案What is AuthorizationDefinitionAuthorization is to verify if an identity has the permission to do something.Common ApproachesRole-based access controlGrant access by rolesCoarse-grainedKubernetes RBAC, service account and role bindingMay ca

2、use role explosionsPolicy/Attributes-based access controlGrant access by policiesFined-grainedAWS IAM PoliciesPolicy is hard to writeFitStation PlatformA Custom Shoe PlatformPartners3D Foot ScanningShoe brandsShoe retailersShoe manufacturers3D shoe recommendationSports leagueHigh-level ArchitectureL

3、1 AuthorizationRequirementsEnforced role-based access control in infrastructure layerDesign considerationsL1 services has common requirements for role-based access controlL1 services are mostly from 3rd party, we cant enforce access control in code layerRBAC enforced with MixerAuthZ AdapterServices

4、are labeled with the layer theyre inOnly requests to the service with the layer equals ”L1” will be handled by AuthZ adapterAdapter ruleAuthZ AdapterAuthorization templateLeverage RESTful API in Permission definition. Each RESTful API as a permissionExtracts token, service, namespace, method and pat

5、h from istio.L2 AuthorizationRequirementsFined-grained access controlExternalized authorization logic from business logicDynamic and configurable access controlDesign considerationsL2 services are resources from different parties, resource access should be separatedDifferent solutions may have different resource access policiesPolicies may change from time to timeABAC enforced with OPAOpen Policy AgentA general-purpose Authorization engine that loads your policy data and rules and make a decisionPolicy data is JSON format filesPolicy rule is written