v1

package

v1.24.2 Latest Latest Go to latest Published: Dec 6, 2024 License: Apache-2.0 Imports: 5 Imported by: 35

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

Documentation ¶

Overview ¶

Package has auto-generated kube type wrappers for raw types. +k8s:openapi-gen=true +k8s:deepcopy-gen=package +groupName=security.istio.io

Index ¶

Constants
Variables
func Resource(resource string) schema.GroupResource
type AuthorizationPolicy
type AuthorizationPolicyList
type PeerAuthentication
type PeerAuthenticationList
type RequestAuthentication
type RequestAuthenticationList

Constants ¶

View Source

const (
	// Package-wide consts from generator "register".
	GroupName = "security.istio.io"
)

Variables ¶

View Source

var (
	// Package-wide variables from generator "register".
	SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
	SchemeBuilder      = runtime.NewSchemeBuilder(addKnownTypes)

	AddToScheme = localSchemeBuilder.AddToScheme
)

Functions ¶

func Resource ¶

func Resource(resource string) schema.GroupResource

Types ¶

type AuthorizationPolicy ¶

type AuthorizationPolicy struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	// Spec defines the implementation of this definition.
	// +optional
	Spec v1beta1.AuthorizationPolicy `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`

	Status v1alpha1.IstioStatus `json:"status"`
}

AuthorizationPolicy enables access control on workloads.

+kubebuilder:validation:XValidation:message="only one of targetRefs or selector can be set",rule="(has(self.selector)?1:0)+(has(self.targetRef)?1:0)+(has(self.targetRefs)?1:0)<=1"

func (*AuthorizationPolicy) DeepCopy ¶

func (in *AuthorizationPolicy) DeepCopy() *AuthorizationPolicy

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationPolicy.

func (*AuthorizationPolicy) DeepCopyInto ¶

func (in *AuthorizationPolicy) DeepCopyInto(out *AuthorizationPolicy)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*AuthorizationPolicy) DeepCopyObject ¶

func (in *AuthorizationPolicy) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type AuthorizationPolicyList ¶

type AuthorizationPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
	Items           []*AuthorizationPolicy `json:"items" protobuf:"bytes,2,rep,name=items"`
}

AuthorizationPolicyList is a collection of AuthorizationPolicies.

func (*AuthorizationPolicyList) DeepCopy ¶

func (in *AuthorizationPolicyList) DeepCopy() *AuthorizationPolicyList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthorizationPolicyList.

func (*AuthorizationPolicyList) DeepCopyInto ¶

func (in *AuthorizationPolicyList) DeepCopyInto(out *AuthorizationPolicyList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*AuthorizationPolicyList) DeepCopyObject ¶

func (in *AuthorizationPolicyList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type PeerAuthentication ¶ added in v1.22.0

type PeerAuthentication struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	// Spec defines the implementation of this definition.
	// +optional
	Spec v1beta1.PeerAuthentication `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`

	Status v1alpha1.IstioStatus `json:"status"`
}

PeerAuthentication defines mutual TLS (mTLS) requirements for incoming connections.

In sidecar mode, PeerAuthentication determines whether or not mTLS is allowed or required for connections to an Envoy proxy sidecar.

In ambient mode, security is transparently enabled for a pod by the ztunnel node agent. (Traffic between proxies uses the HBONE protocol, which includes encryption with mTLS.) Because of this, `DISABLE` mode is not supported. `STRICT` mode is useful to ensure that connections that bypass the mesh are not possible.

Examples:

Policy to require mTLS traffic for all workloads under namespace `foo`: ```yaml apiVersion: security.istio.io/v1 kind: PeerAuthentication metadata:

name: default
namespace: foo

spec:

mtls:
  mode: STRICT

``` For mesh level, put the policy in root-namespace according to your Istio installation.

Policies to allow both mTLS and plaintext traffic for all workloads under namespace `foo`, but require mTLS for workload `finance`. ```yaml apiVersion: security.istio.io/v1 kind: PeerAuthentication metadata:

name: default
namespace: foo

spec:

mtls:
  mode: PERMISSIVE

--- apiVersion: security.istio.io/v1 kind: PeerAuthentication metadata:

name: finance
namespace: foo

spec:

selector:
  matchLabels:
    app: finance
mtls:
  mode: STRICT

``` Policy that enables strict mTLS for all `finance` workloads, but leaves the port `8080` to plaintext. Note the port value in the `portLevelMtls` field refers to the port of the workload, not the port of the Kubernetes service. ```yaml apiVersion: security.istio.io/v1 kind: PeerAuthentication metadata:

name: default
namespace: foo

spec:

selector:
  matchLabels:
    app: finance
mtls:
  mode: STRICT
portLevelMtls:
  8080:
    mode: DISABLE

``` Policy that inherits mTLS mode from namespace (or mesh) settings, and disables mTLS for workload port `8080`. ```yaml apiVersion: security.istio.io/v1 kind: PeerAuthentication metadata:

name: default
namespace: foo

spec:

selector:
  matchLabels:
    app: finance
mtls:
  mode: UNSET
portLevelMtls:
  8080:
    mode: DISABLE

```

+kubebuilder:validation:XValidation:message="portLevelMtls requires selector",rule="(has(self.selector) && has(self.selector.matchLabels) && self.selector.matchLabels.size() > 0) || !has(self.portLevelMtls)"

func (*PeerAuthentication) DeepCopy ¶ added in v1.22.0

func (in *PeerAuthentication) DeepCopy() *PeerAuthentication

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PeerAuthentication.

func (*PeerAuthentication) DeepCopyInto ¶ added in v1.22.0

func (in *PeerAuthentication) DeepCopyInto(out *PeerAuthentication)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*PeerAuthentication) DeepCopyObject ¶ added in v1.22.0

func (in *PeerAuthentication) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type PeerAuthenticationList ¶ added in v1.22.0

type PeerAuthenticationList struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
	Items           []*PeerAuthentication `json:"items" protobuf:"bytes,2,rep,name=items"`
}

PeerAuthenticationList is a collection of PeerAuthentications.

func (*PeerAuthenticationList) DeepCopy ¶ added in v1.22.0

func (in *PeerAuthenticationList) DeepCopy() *PeerAuthenticationList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PeerAuthenticationList.

func (*PeerAuthenticationList) DeepCopyInto ¶ added in v1.22.0

func (in *PeerAuthenticationList) DeepCopyInto(out *PeerAuthenticationList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*PeerAuthenticationList) DeepCopyObject ¶ added in v1.22.0

func (in *PeerAuthenticationList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type RequestAuthentication ¶

type RequestAuthentication struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	// Spec defines the implementation of this definition.
	// +optional
	Spec v1beta1.RequestAuthentication `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`

	Status v1alpha1.IstioStatus `json:"status"`
}

RequestAuthentication defines what request authentication methods are supported by a workload. It will reject a request if the request contains invalid authentication information, based on the configured authentication rules. A request that does not contain any authentication credentials will be accepted but will not have any authenticated identity. To restrict access to authenticated requests only, this should be accompanied by an authorization rule. Examples:

- Require JWT for all request for workloads that have label `app:httpbin`

```yaml apiVersion: security.istio.io/v1 kind: RequestAuthentication metadata:

name: httpbin
namespace: foo

spec:

selector:
  matchLabels:
    app: httpbin
jwtRules:
- issuer: "issuer-foo"
  jwksUri: https://example.com/.well-known/jwks.json

--- apiVersion: security.istio.io/v1 kind: AuthorizationPolicy metadata:

name: httpbin
namespace: foo

spec:

selector:
  matchLabels:
    app: httpbin
rules:
- from:
  - source:
      requestPrincipals: ["*"]

```

- A policy in the root namespace ("istio-system" by default) applies to workloads in all namespaces in a mesh. The following policy makes all workloads only accept requests that contain a valid JWT token.

```yaml apiVersion: security.istio.io/v1 kind: RequestAuthentication metadata:

name: req-authn-for-all
namespace: istio-system

spec:

jwtRules:
- issuer: "issuer-foo"
  jwksUri: https://example.com/.well-known/jwks.json

--- apiVersion: security.istio.io/v1 kind: AuthorizationPolicy metadata:

name: require-jwt-for-all
namespace: istio-system

spec:

rules:
- from:
  - source:
      requestPrincipals: ["*"]

```

- The next example shows how to set a different JWT requirement for a different `host`. The `RequestAuthentication` declares it can accept JWTs issued by either `issuer-foo` or `issuer-bar` (the public key set is implicitly set from the OpenID Connect spec).

```yaml apiVersion: security.istio.io/v1 kind: RequestAuthentication metadata:

name: httpbin
namespace: foo

spec:

selector:
  matchLabels:
    app: httpbin
jwtRules:
- issuer: "issuer-foo"
- issuer: "issuer-bar"

--- apiVersion: security.istio.io/v1 kind: AuthorizationPolicy metadata:

name: httpbin
namespace: foo

spec:

selector:
  matchLabels:
    app: httpbin
rules:
- from:
  - source:
      requestPrincipals: ["issuer-foo/*"]
  to:
  - operation:
      hosts: ["example.com"]
- from:
  - source:
      requestPrincipals: ["issuer-bar/*"]
  to:
  - operation:
      hosts: ["another-host.com"]

```

- You can fine tune the authorization policy to set different requirement per path. For example, to require JWT on all paths, except /healthz, the same `RequestAuthentication` can be used, but the authorization policy could be:

```yaml apiVersion: security.istio.io/v1 kind: AuthorizationPolicy metadata:

name: httpbin
namespace: foo

spec:

selector:
  matchLabels:
    app: httpbin
rules:
- from:
  - source:
      requestPrincipals: ["*"]
- to:
  - operation:
      paths: ["/healthz"]

```

[Experimental] Routing based on derived [metadata](https://istio.io/latest/docs/reference/config/security/conditions/) is now supported. A prefix '@' is used to denote a match against internal metadata instead of the headers in the request. Currently this feature is only supported for the following metadata:

- `request.auth.claims.{claim-name}[.{nested-claim}]*` which are extracted from validated JWT tokens. Use the `.` or `[]` as a separator for nested claim names. Examples: `request.auth.claims.sub`, `request.auth.claims.name.givenName` and `request.auth.claims[foo.com/name]`. For more information, see [JWT claim based routing](https://istio.io/latest/docs/tasks/security/authentication/jwt-route/).

The use of matches against JWT claim metadata is only supported in Gateways. The following example shows:

- RequestAuthentication to decode and validate a JWT. This also makes the `@request.auth.claims` available for use in the VirtualService. - AuthorizationPolicy to check for valid principals in the request. This makes the JWT required for the request. - VirtualService to route the request based on the "sub" claim.

```yaml apiVersion: security.istio.io/v1 kind: RequestAuthentication metadata:

name: jwt-on-ingress
namespace: istio-system

spec:

selector:
  matchLabels:
    app: istio-ingressgateway
jwtRules:
- issuer: "example.com"
  jwksUri: https://example.com/.well-known/jwks.json

--- apiVersion: security.istio.io/v1 kind: AuthorizationPolicy metadata:

name: require-jwt
namespace: istio-system

spec:

selector:
  matchLabels:
    app: istio-ingressgateway
rules:
- from:
  - source:
      requestPrincipals: ["*"]

--- apiVersion: networking.istio.io/v1 kind: VirtualService metadata:

name: route-jwt

spec:

hosts:
- foo.prod.svc.cluster.local
gateways:
- istio-ingressgateway
http:
- name: "v2"
  match:
  - headers:
      "@request.auth.claims.sub":
        exact: "dev"
  route:
  - destination:
      host: foo.prod.svc.cluster.local
      subset: v2
- name: "default"
  route:
  - destination:
      host: foo.prod.svc.cluster.local
      subset: v1

```

+kubebuilder:validation:XValidation:message="only one of targetRefs or selector can be set",rule="(has(self.selector)?1:0)+(has(self.targetRef)?1:0)+(has(self.targetRefs)?1:0)<=1"

func (*RequestAuthentication) DeepCopy ¶

func (in *RequestAuthentication) DeepCopy() *RequestAuthentication

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RequestAuthentication.

func (*RequestAuthentication) DeepCopyInto ¶

func (in *RequestAuthentication) DeepCopyInto(out *RequestAuthentication)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*RequestAuthentication) DeepCopyObject ¶

func (in *RequestAuthentication) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type RequestAuthenticationList ¶

type RequestAuthenticationList struct {
	metav1.TypeMeta `json:",inline"`
	// +optional
	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
	Items           []*RequestAuthentication `json:"items" protobuf:"bytes,2,rep,name=items"`
}

RequestAuthenticationList is a collection of RequestAuthentications.

func (*RequestAuthenticationList) DeepCopy ¶

func (in *RequestAuthenticationList) DeepCopy() *RequestAuthenticationList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RequestAuthenticationList.

func (*RequestAuthenticationList) DeepCopyInto ¶

func (in *RequestAuthenticationList) DeepCopyInto(out *RequestAuthenticationList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*RequestAuthenticationList) DeepCopyObject ¶

func (in *RequestAuthenticationList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL