Authorization Policy - ISTIO

Security
1

Hi,
I have a requirement where the traffic for pods in a namespace must originate from that namespace or a specific url if hit from postman. I put in the following auth rule and it blocks traffic to all pods. mTLS is enabled.

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: istio-deny
 namespace: dev
spec:
 action: DENY
 rules:
 - from:
   - source:
       notNamespaces: ["dev"]
 - to:
   - operation:
       notHosts: ["dev.mydomain.com"]

I tried the folllowing and it allows traffic from the host but not from within the namespaces
apiVersion: security.istio.io/v1beta1

kind: AuthorizationPolicy
metadata:
 name: istio-deny
 namespace: dev
spec:
 action: DENY
 rules:
 - to:
   - operation:
       notHosts: ["dev.svc.cluster.local","dev.mydomain.com"]

Anh help please.

2

Can you explain what you would like to see vs what you actually see?

If i understand correctly, the first policy would block all request if they are not coming from dev namespace, and with HOST header not equal to dev.mydomain.com.

The second one would block all access except dev.svc.cluster.local and dev.mydomain.com.

What requests are denied/allowed unexpectedly?

Also what does it mean traffic from HOST, request with what host header?

3

@incfly The first one does not allow traffic from dev.mydomain.com or the namespace.
the second one allows traffic from dev.mydomain.com but not dev.svc.cluster.local.

I would have thought that the first one should have allowed traffic originating from the dev namespace and traffic with the having the domain name dev.mydomain.com, but that is not the case.

4

wierdly this works as expected

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: istio-deny
 namespace: dev
spec:
 action: ALLOW
 rules:
 - from:
   - source:
       namespaces: ["dev"]
 - to:
   - operation:
       hosts: ["dev.mydomain.com"]
5

Yes. It should work as that expectation. And I’m glad you also got the results! :smiley:

6

@incfly wonder why the 1st rule was not working? any idea?
The one with the DENY when the namespace is not “dev” and the host is not “dev.domain.com”

7

I’ve the similar case, where if I put DENY action, that action is not honoured.

envoy dump is as below

{
    "name": "envoy.filters.http.rbac",
    "typed_config": {
      "@type": "type.googleapis.com/envoy.config.filter.http.rbac.v2.RBAC",
      "rules": {
        "policies": {
          "ns[authpns]-policy[allow-path-abc]-rule[0]": {
            "permissions": [
              {
                "and_rules": {
                  "rules": [
                    {
                      "or_rules": {
                        "rules": [
                          {
                            "header": {
                              "name": ":path",
                              "exact_match": "/authp/abc"
                            }
                          }
                        ]
                      }
                    }
                  ]
                }
              }
            ],
            "principals": [
              {
                "and_ids": {
                  "ids": [
                    {
                      "any": true
                    }
                  ]
                }
              }
            ]
          },
          "ns[authpns]-policy[deny-get]-rule[0]": {
            "permissions": [
              {
                "and_rules": {
                  "rules": [
                    {
                      "or_rules": {
                        "rules": [
                          {
                            "header": {
                              "name": ":method",
                              "exact_match": "GET"
                            }
                          }
                        ]
                      }
                    }
                  ]
                }
              }
            ],
            "principals": [
              {
                "and_ids": {
                  "ids": [
                    {
                      "any": true
                    }
                  ]
                }
              }
            ]
          }
        }
      }
    }
  },

Corresponding AuthorizationPolicy is below

---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-all
  namespace: authpns
spec: {}
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-get
  namespace: authpns
spec:
  selector:
    matchLabels:
      app: authp
  action: DENY
  rules:
  - to:
    - operation:
        methods: ["GET"]
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-path-abc
  namespace: authpns
spec:
  action: ALLOW
  rules:
  - to:
    - operation:
        paths: ["/authp/abc"]

Can someone suggest, what may be wrong here and why DENY is still served as ALLOW ?