Istio Role Based Access Control (RBAC)
You should have NO virtualservice, destinationrule, gateway or policy (in
In this chapter, we are going to see how to use Istio’s authorization feature to provide access control for services in an Istio Mesh.
The first thing to do is enable Istio Authorization by using
kubectl create -f istiofiles/authorization-enable-rbac.yml -n tutorial
Now RBAC is enabled on your mesh. Run next command:
curl http://istio-ingressgateway-istio-system.$(minishift ip).nip.io/customer RBAC: access denied
By default, Istio uses a deny by default strategy, meaning that nothing is permitted until you explicitly define access control policy to grant access to any service.
In this section, you’ll learn how to use a JWT claim to manage the access to the services.
The first thing you need to do is applying all the steps described at End-user authentication with JWT section so you enable JWT authentication logic inside the mesh.
After that, you are ready to use JWT in the authorization phase as well.
Now apply next Istio resource which makes that only tokens that contain a field named
role with value
kubectl create -f istiofiles/namespace-rbac-policy-jwt.yml -n tutorial
and then you can do a new call with the new token containing the
role claim with value
token=$(curl https://gist.githubusercontent.com/lordofthejars/f590c80b8d83ea1244febb2c73954739/raw/21ec0ba0184726444d99018761cf0cd0ece35971/token.role.jwt -s) curl -H "Authorization: Bearer $token" http://istio-ingressgateway-istio-system.$(minishift ip).nip.io/customer customer => preference => recommendation v1 from 'b4d67bcb7-7rp88': 4
Notice that now only valid JWT tokens containing the claim
role set to
customer will suceed, the rest you’ll get an access denied.
To validate that this is working correctly, do next thing:
istiofiles/namespace-rbac-policy-jwt.yml and change the
role with value
xxx and save the file.
spec: subjects: - user: "*" properties: request.auth.claims[role]: "xxx"
And then replace it:
kubectl replace -f istiofiles/namespace-rbac-policy-jwt.yml -n tutorial
After that, repeat the same request as before:
curl -H "Authorization: Bearer $token" http://istio-ingressgateway-istio-system.$(minishift ip).nip.io/customer RBAC: access denied
But notice that now the access is denied because the
role field value in the token is
customer instead of
In this chapter you’ve seen how to RBAC. Obviously, you should also enable mTLS to authenticate also your requests.
Check mTLS section to learn more about mTLS and Istio.
Follow End-user authentication with JWT Clean Up steps there to clean all JWT stuff and then call:
kubectl delete -f istiofiles/namespace-rbac-policy-jwt.yml -n tutorial kubectl create -f istiofiles/authorization-enable-rbac.yml -n tutorial