Istio RBAC (Role Based Access Control) defines ServiceRole and ServiceRoleBinding objects.
A ServiceRole specification includes a list of rules (permissions). Each rule has the following standard fields:
- services: a list of services.
- methods: HTTP methods. In the case of gRPC, this field is ignored because the value is always “POST”.
- paths: HTTP paths or gRPC methods. Note that gRPC methods should be presented in the form of “/packageName.serviceName/methodName” and are case sensitive.
In addition to the standard fields, operators can also use custom keys in the
constraints field, the supported keys are listed in the “constraints and properties” page.
Below is an example of ServiceRole object “product-viewer”, which has “read” (“GET” and “HEAD”) access to “products.svc.cluster.local” service at versions “v1” and “v2”. “path” is not specified, so it applies to any path in the service.
apiVersion: "rbac.istio.io/v1alpha1" kind: ServiceRole metadata: name: products-viewer namespace: default spec: rules: - services: ["products.svc.cluster.local"] methods: ["GET", "HEAD"] constraints: - key: "destination.labels[version]" value: ["v1", "v2"]
A ServiceRoleBinding specification includes two parts:
roleReffield that refers to a ServiceRole object in the same namespace.
- A list of
subjectsthat are assigned the roles.
In addition to a simple
user field, operators can also use custom keys in the
properties field, the supported keys are listed in the “constraints and properties” page.
Below is an example of ServiceRoleBinding object “test-binding-products”, which binds two subjects to ServiceRole “product-viewer”:
- User “firstname.lastname@example.org”
- Services in “abc” namespace.
apiVersion: "rbac.istio.io/v1alpha1" kind: ServiceRoleBinding metadata: name: test-binding-products namespace: default spec: subjects: - user: email@example.com - properties: source.namespace: "abc" roleRef: kind: ServiceRole name: "products-viewer"
AccessRule defines a permission to access a list of services.
Definition of a custom constraint. The supported keys are listed in the “constraint and properties” page.
RbacConfig defines the global config to control Istio RBAC behavior. This Custom Resource is a singleton where only one Custom Resource should be created globally in the mesh and the namespace should be the same to other Istio components, which usually is istio-system. Note: This is enforced in both istioctl and server side, new Custom Resource will be rejected if found any existing one, the user should either delete the existing one or change the existing one directly.
Below is an example of RbacConfig object “istio-rbac-config” which enables Istio RBAC for all services in the default namespace.
apiVersion: "rbac.istio.io/v1alpha1" kind: RbacConfig metadata: name: default namespace: istio-system spec: mode: ON_WITH_INCLUSION inclusion: namespaces: [ "default" ]
Disable Istio RBAC completely, any other config in RbacConfig will be ignored and Istio RBAC policies will not be enforced.
Enable Istio RBAC for all services and namespaces.
Enable Istio RBAC only for services and namespaces specified in the inclusion field. Any other services and namespaces not in the inclusion field will not be enforced by Istio RBAC policies.
Enable Istio RBAC for all services and namespaces except those specified in the exclusion field. Any other services and namespaces not in the exclusion field will be enforced by Istio RBAC policies.
Target defines a list of services or namespaces.
RoleRef refers to a role object.
ServiceRole specification contains a list of access rules (permissions). This represent the “Spec” part of the ServiceRole object. The name and namespace of the ServiceRole is specified in “metadata” section of the ServiceRole object.
ServiceRoleBinding assigns a ServiceRole to a list of subjects. This represents the “Spec” part of the ServiceRoleBinding object. The name and namespace of the ServiceRoleBinding is specified in “metadata” section of the ServiceRoleBinding object.
Subject defines an identity. The identity is either a user or identified by a set of
properties. The supported keys in
properties are listed in “constraint and properties” page.