Skip to content

Commit 460b6ec

Browse files
author
Zijun Wang
committed
Add IamAuthPolicy doc
1 parent 25621d0 commit 460b6ec

File tree

1 file changed

+211
-0
lines changed

1 file changed

+211
-0
lines changed

‎docs/reference/iam-auth-policy.md‎

Lines changed: 211 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,211 @@
1+
# IAMAuthPolicy API Reference
2+
3+
## Introduction
4+
5+
VPC Lattice auth policies are IAM policy documents that you attach to service networks or services to control whether a specified principal has access to a group of services or specific service (AuthZ).
6+
By attaching Kubernetes IAMAuthPolicy CRD to the k8s gateway or k8s route, you could apply auth policy to corresponding VPC Lattice service network or VPC Lattice service that you want to control access.
7+
Please check [VPC Lattice auth policy documentation](https://docs.aws.amazon.com/vpc-lattice/latest/ug/auth-policies.html) for more details.
8+
9+
[This article](https://aws.amazon.com/blogs/containers/implement-aws-iam-authentication-with-amazon-vpc-lattice-and-amazon-eks/) is also a good reference to understand how VPC Lattice auth policy works in the kubernetes.
10+
11+
## API Specification
12+
13+
<h3 id="application-networking.k8s.aws/v1alpha1.IAMAuthPolicy">IAMAuthPolicy</h3>
14+
<div></div>
15+
<table>
16+
<thead>
17+
<tr>
18+
<th>Field</th>
19+
<th>Description</th>
20+
</tr>
21+
</thead>
22+
<tbody>
23+
<tr>
24+
<td>
25+
<code>metadata</code><br/>
26+
<em>
27+
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#objectmeta-v1-meta">
28+
Kubernetes meta/v1.ObjectMeta
29+
</a>
30+
</em>
31+
</td>
32+
<td>
33+
Refer to the Kubernetes API documentation for the fields of the
34+
<code>metadata</code> field.
35+
</td>
36+
</tr>
37+
<tr>
38+
<td>
39+
<code>spec</code><br/>
40+
<em>
41+
<a href="#application-networking.k8s.aws/v1alpha1.IAMAuthPolicySpec">
42+
IAMAuthPolicySpec
43+
</a>
44+
</em>
45+
</td>
46+
<td>
47+
<br/>
48+
<br/>
49+
<table>
50+
<tr>
51+
<td>
52+
<code>policy</code><br/>
53+
<em>
54+
string
55+
</em>
56+
</td>
57+
<td>
58+
<p>IAM auth policy content. It is a JSON string that uses the same syntax as AWS IAM policies. Please check the VPC Lattice documentation to get <a href="https://docs.aws.amazon.com/vpc-lattice/latest/ug/auth-policies.html#auth-policies-common-elements">the common elements in an auth policy</a></p>
59+
</td>
60+
</tr>
61+
<tr>
62+
<td>
63+
<code>targetRef</code><br/>
64+
<em>
65+
sigs.k8s.io/gateway-api/apis/v1alpha2.PolicyTargetReference
66+
</em>
67+
</td>
68+
<td>
69+
<p>TargetRef points to the Kubernetes Gateway, HTTPRoute, or GRPCRoute resource that will have this policy attached.</p>
70+
<p>This field is following the guidelines of Kubernetes Gateway API policy attachment.</p>
71+
</td>
72+
</tr>
73+
</table>
74+
</td>
75+
</tr>
76+
<tr>
77+
<td>
78+
<code>status</code><br/>
79+
<em>
80+
<a href="#application-networking.k8s.aws/v1alpha1.IAMAuthPolicyStatus">
81+
IAMAuthPolicyStatus
82+
</a>
83+
</em>
84+
</td>
85+
<td>
86+
<p>Status defines the current state of IAMAuthPolicy.</p>
87+
</td>
88+
</tr>
89+
</tbody>
90+
</table>
91+
<h3 id="application-networking.k8s.aws/v1alpha1.IAMAuthPolicySpec">IAMAuthPolicySpec</h3>
92+
<p>
93+
(<em>Appears on:</em><a href="#application-networking.k8s.aws/v1alpha1.IAMAuthPolicy">IAMAuthPolicy</a>)
94+
</p>
95+
<div>
96+
<p>IAMAuthPolicySpec defines the desired state of IAMAuthPolicy.
97+
When the controller handles IAMAuthPolicy creation, if the targetRef k8s and VPC Lattice resource exists, the controller will change the auth_type of that VPC Lattice resource to AWS_IAM and attach this policy.
98+
When the controller handles IAMAuthPolicy deletion, if the targetRef k8s and VPC Lattice resource exists, the controller will change the auth_type of that VPC Lattice resource to NONE and detach this policy.
99+
</p>
100+
</div>
101+
<table>
102+
<thead>
103+
<tr>
104+
<th>Field</th>
105+
<th>Description</th>
106+
</tr>
107+
</thead>
108+
<tbody>
109+
<tr>
110+
<td>
111+
<code>policy</code><br/>
112+
<em>
113+
string
114+
</em>
115+
</td>
116+
<td>
117+
<p>IAM auth policy content. It is a JSON string that uses the same syntax as AWS IAM policies. Please check the VPC Lattice documentation to get <a href="https://docs.aws.amazon.com/vpc-lattice/latest/ug/auth-policies.html#auth-policies-common-elements">the common elements in an auth policy</a></p>
118+
</td>
119+
</tr>
120+
<tr>
121+
<td>
122+
<code>targetRef</code><br/>
123+
<em>
124+
sigs.k8s.io/gateway-api/apis/v1alpha2.PolicyTargetReference
125+
</em>
126+
</td>
127+
<td>
128+
<p>TargetRef points to the Kubernetes Gateway, HTTPRoute, or GRPCRoute resource that will have this policy attached.</p>
129+
<p>This field is following the guidelines of Kubernetes Gateway API policy attachment.</p>
130+
</td>
131+
</tr>
132+
</tbody>
133+
</table>
134+
<h3 id="application-networking.k8s.aws/v1alpha1.IAMAuthPolicyStatus">IAMAuthPolicyStatus</h3>
135+
<p>
136+
(<em>Appears on:</em><a href="#application-networking.k8s.aws/v1alpha1.IAMAuthPolicy">IAMAuthPolicy</a>)
137+
</p>
138+
<div>
139+
<p>IAMAuthPolicyStatus defines the observed state of IAMAuthPolicy.</p>
140+
</div>
141+
<table>
142+
<thead>
143+
<tr>
144+
<th>Field</th>
145+
<th>Description</th>
146+
</tr>
147+
</thead>
148+
<tbody>
149+
<tr>
150+
<td>
151+
<code>conditions</code><br/>
152+
<em>
153+
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#condition-v1-meta">
154+
[]Kubernetes meta/v1.Condition
155+
</a>
156+
</em>
157+
</td>
158+
<td>
159+
<em>(Optional)</em>
160+
<p>Conditions describe the current conditions of the IAMAuthPolicy.</p>
161+
<p>Implementations should prefer to express Policy conditions
162+
using the <code>PolicyConditionType</code> and <code>PolicyConditionReason</code>
163+
constants so that operators and tools can converge on a common
164+
vocabulary to describe IAMAuthPolicy state.
165+
</p>
166+
<p>Known condition types are:</p>
167+
<ul>
168+
<li>&ldquo;Accepted&rdquo;</li>
169+
<li>&ldquo;Ready&rdquo;</li>
170+
</ul>
171+
</td>
172+
</tr>
173+
</tbody>
174+
</table>
175+
176+
177+
## IAMAauthPolicy Example
178+
179+
```yaml
180+
apiVersion: application-networking.k8s.aws/v1alpha1
181+
kind: IAMAuthPolicy
182+
metadata:
183+
name: test-iam-auth-policy
184+
spec:
185+
targetRef:
186+
group: "gateway.networking.k8s.io"
187+
kind: HTTPRoute
188+
name: my-route
189+
policy: |
190+
{
191+
"Version": "2012-10-17",
192+
"Statement": [
193+
{
194+
"Effect": "Allow",
195+
"Principal": "*",
196+
"Action": "vpc-lattice-svcs:Invoke",
197+
"Resource": "*",
198+
"Condition": {
199+
"StringEquals": {
200+
"vpc-lattice-svcs:RequestHeader/header1": "value1"
201+
}
202+
}
203+
}
204+
]
205+
}
206+
```
207+
208+
If you create the above IAMAuthPolicy in the k8s cluster, the `my-route` (and it's corresponding VPC Lattice service) will be attached with the given IAM auth policy. Only HTTP traffic with header `header1:value1` will be allowed to access the my-route(and it's corresponding VPC Lattice service). Please check the [VPC Lattice documentation]("https://docs.aws.amazon.com/vpc-lattice/latest/ug/auth-policies.html#auth-policies-common-elements) to get the detail on how lattice auth policy work.
209+
210+
211+

0 commit comments

Comments
 (0)