Cloud Native Computing Foundation EnvoyCon 2019 (San Diego), 21 Nov 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Overview of Authentication and Authorization Features in Envoy - Wayne Zhang & Yangmin Zhu, Google

Description

Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io

Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects

Overview of Authentication and Authorization Features in Envoy - Wayne Zhang & Yangmin Zhu, Google

This session talks about and gives a high-level overview of the authentication and authorization features in Envoy, including JWT, RBAC, and External Authorization.
From this session, you’ll learn:
1) High-level description of jwt_authn filter, RBAC filter, ext_authz filter and etc.
2) How to use these filters to meet your security requirements
3) Caveats you should be aware of when using these filters

A

B

We have many different topics tree now. We have a slightly different one. We are going to talk about security, about the overview of authenticate authentication and also 18 features in our way. I'm Jung Ming, true I'm, a software engineer at Google and I'm working on is.

A

My name is wen Zhang I'm working for Google, so, okay.

B

Let's get nasty so before we look into the features, let's see what problem we're going to address, so we are going to you force access control based on authenticated identities or vowels, are the informations in our way. How do we do this? So we know our way is powerful and flexible, and we use many different filters together to do these things.

B

We will talk about the chart future for authentication or purchasing wave token, and we will talk about two other filters for the authorization so a bear filter it does authorization writing only and the extra rotation filter does authorization out of our way. We will also talk about some example use case and the cabbage about using these filters.

A

Jam filter is going to verify JWT token order, Phi, it's a signature issue in the audience, so the filter country will also allow you to specify where to is check the public key for verification and where to extract the JWT token, also allow you to specify which request has to you know, to enforce the verification.

A

So here is example of the filter country here. So here the providers mean the syndication provider, so you can allow you to specify aw diem and where to get jwk us. That means the public key for signature, verification and the okapi. You can fetch your own remote or you can fetch from like. You can impair that ability inside configure and also allow you to specify where, together and token and then wait and I'll prove how to you for Whirlpool.

A

You know, after what education, the JW payload will wear to uphold a pillow, so here also have a loo specify which it request does not require education, like a typical request, is a health for health past. You probably don't want to do the verification and for API request you one. You know to to what, if I, buy the provider one and then for I'll request you provide by provider to it's like a typical filter, happy sex.

B

Ring so nits after we have authenticated user identities. Through that, your token, let's move on to the authorization part, so first the up and filter it enforces access control inside our way. So our air filter is essentially two parts. It includes an action and a list of policies, the actions suppose either are now or July, which means you can configure the upper filter to be working as a vitalist or blacklist.

B

The policy includes three parts: permission principal and condition. The permission and principal is a built in AST using an or lot and other cymatics it's a fast, but it has limited cymatics. The condition is using the Google comma expression language. So you write something like a plus B equals C, it's more flexible, but also it's more slower. You can combine the permission, principal and conditions to meet your security requirements.

B

The Iban filter also supports a shadow policy, which means you can evaluate and log a policy, but without the enforce it. This is very useful when you are trying to test a policy before rolling it out to your production environment, so I been further suppose both HTTP and a TCP traffic, and it emits some useful states like us- are allowed and delighted requests. So you can see that your I've been process is really allowing and delighting in request.

B

So this is a sample event. Config, it is configured to use. Action are now which means configured for whitelist. It includes only one policy which is called a proton attached viewer. It has one permission in a one principle: we are not using condition here the permission and is specifying tree and it rules for our request, with the get measured for the pass with prefix national Ming and answer the prod 18 and the principle is allowing two separate principle. The principle could be a jar talking of subject are being.

B

It could also be a x.509 certificate or principal production. If the request matches a permission and a match is one of the principal it will be allowed. In other case, it will be delight next. The other future for authorization is external, also editing, filter. It does essentially the same thing as a parent filter palette, as its outside arm way is d, negates the authorizing decision to your external authorization service. The extraordinary filter includes meaning a service to finishing and some other configurations. The service Divine's variety information about the authorization service like we're to finite.

B

How to talk to it. You can implement it in either HTTP or RPC and what will be included in the request response. You can return. The direct are now out alive from your extra extra authorizing service, or you can include some additional header to the upstream service so that it can be used for like token exchange, the extension server filter will send a check request to your exercising service is inclusive tributes of the source states missing and the connection.

B

It also supports both HTTP and achieves to be traffic, and it it also emits some useful states, like as a requests, are now denied and as an arrow. Next is a sample config of the extras in config filter. So first, the also mention survive is defined as a HTTP service, which sets the failure mode and now to force, which means we will reject requests.

B

If is a communication between our Moya and as an authorization service has filled, it includes a metadata context, limb spaces, which means it will pass each other payload or indicated by the chart, filter to your authorization server. So you can do a custom authorization logic based on the chart entities, its sensor request to the X or C cluster. The findings are in the castro section. It says, gos context to verify the extraordinary service and encrypts the traffic.

B

So one example- and maybe a little bit extreme use case- is to use all of these filters together. You put the chart filter in front of the filter chain that does birth occasion and extracts all tokens. You put a filter in the second place, at enforce access control right in our way, and if that's not enough, you put your extorting filter is aimed that talks to your external authorization system. To do some additional.

B

Also, access control work each filter; they can share the output form press purchase through the Envoy dynamic metadata, and you can you don't need to use all of them? If you only need to add validation, you can just use Java filter. If you only need like in our access control, you can only use Java, filter and Ave and filter. It all depends on your actual requirements.

B

Nast here is some cabbage we have seen based on our experience is not a complete list. So, first make sure your filter is configured correctly for protecting your service. You really need to add a test for both positive and negative cases. The positive is on our case, and it selectively is a deal a case, because we have seen a case that user, the things that configure the access control, but they only the artistic control. You always are now like a read request.

B

If you do not have a test case for the delay, you you don't even know, it's like Adeline request.

B

Second, be careful when upgrading our way, if you are using the test equal or unknown field, especially if there is any luggage renaming in the API- and you are like you- are- writing the and we configure manually and you could be ignored silently.

B

Second generally, you should configure the chart abandoned and the exploration filter in front of other filters, because the do authentication and authorization, if you put them like after the TCP proxy, it means nothing right.

B

Next, the jar or something filter is the support posts, remote rocks and the local chugs. They have. The posts have accounts and a prose, for example the remote chugs, and we will fish chart public key for you from the external service, but it will introduce some additional latency here. If you use local chucks, you need to maintain the jocks rotating and facesheet memory lasts for the use of a bed and extra physician.

B

Our back is much faster because because it does all the access control right side right in the UM way, extradition is much flexible, but it does all those things out of our way and you should use TOS to encrypt your traffic. All of these choose it, depending on your QP s, go and requirements. That's it! Thank you.