Istio practical skills: implement header based authorization

This article excerpts from istio Learning notes

background

Some business scenarios are http header or grpc metadata There will be user information in , Want to be in mesh This layer authorizes requests based on user information , If the conditions are not met, the interface will not return the corresponding data .

Solution

Istio Of AuthorizationPolicy Based on is not supported Header Authorization of , But you can use VirtualService To achieve , matching http header ( Include grpc metadata), Then add a default route , Fixed fault injection used returns 401, Example :

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: helloworld-server
spec:
  hosts:
  - helloworld-server
  http:
  - name: whitelist
    match:
    - headers:
        end-user:
          regex: "roc"
    route:
    - destination:
        host: helloworld-server
        port:
          number: 9000
  - name: default
    route:
    - destination:
        host: helloworld-server
        port:
          number: 9000
    fault:
      abort:
        percentage:
          value: 100
        httpStatus: 401