ClusterPolicy for enforcing securityStandard Istio Authorization Policies

[nischay30]

Problem Statement

A ClusterPolicy to deny any bad IstioAuthorization Policies in the Kubernetes Cluster.

Solution Description

Cluster Policy should meet the below criteria:

• Each Policy should have a from block
• Each Policy should have a to block
• Each policy should have a port defined in the to block
• Each policy should only use requestPrincipals and principals in the source block.
• Wildcards * should never be allowed as a value to any of the field in the AuthorizationPolicy

Example "Good" Resource

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: httpbin
  namespace: foo
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/default/sa/sleep"]
    - source:
       requestPrincipals: ["cluster.local/ns/sleep"]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/data"]
        ports: ["8080"]

Example "Bad" Resource

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: badpolicy1
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["*"]
    - source:
       requestPrincipals: ["cluster.local/ns/sleep"]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/data"]
        ports: ["8080"]


---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: badpolicy2
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/sleep"]
    - source:
       requestPrincipals: ["*"]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/data"]
        ports: ["8080"]

---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: badpolicy3
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/sleep"]
    - source:
       requestPrincipals: ["*"]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/data"]
        ports: ["8080"]

---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: badpolicy4
spec:
  action: ALLOW
  rules:
  - from:
    - source:
        notNamespaces: ["test"]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/data"]
        ports: ["*"]

Other Comments

No response

Slack discussion

No response

Troubleshooting

• I have read and followed the documentation AND the troubleshooting guide.
• I have verified the policy does not exist in the samples library.

[chipzoller]

This passes all tests.

apiVersion: kyverno.io/v2beta1
kind: ClusterPolicy
metadata:
  name: istio-authorization-policy
  annotations:
    pod-policies.kyverno.io/autogen-controllers: none
spec:
  background: false
  validationFailureAction: Enforce
  rules:
    - name: one-require-from
      match:
        any:
        - resources:
            kinds:
            - security.istio.io/v1beta1/AuthorizationPolicy
      validate:
        message: The from field is required.
        pattern:
          spec:
            rules:
            - from: "*"
    - name: two-require-to
      match:
        any:
        - resources:
            kinds:
            - security.istio.io/v1beta1/AuthorizationPolicy
      validate:
        message: The to field is required.
        pattern:
          spec:
            rules:
            - to: "*"
    - name: three-require-port-in-to
      match:
        any:
        - resources:
            kinds:
            - security.istio.io/v1beta1/AuthorizationPolicy
      validate:
        message: The to field must have the port field defined.
        pattern:
          spec:
            rules:
            - to:
              - operation:
                  ports: "*"
    - name: four-from-source-only-requestprincipals-and-principals
      match:
        any:
        - resources:
            kinds:
            - security.istio.io/v1beta1/AuthorizationPolicy
      validate:
        message: The from field in source may only have requestPrincipals and principals fields defined.
        deny:
          conditions:
            all:
            - key: "{{ request.object.spec.rules[].from[].source.keys(@)[] }}"
              operator: AnyNotIn
              value:
              - principals
              - requestPrincipals
    - name: five-no-wildcards
      match:
        any:
        - resources:
            kinds:
            - security.istio.io/v1beta1/AuthorizationPolicy
      validate:
        message: Wildcards may not be used.
        deny:
          conditions:
            all:
            - key: "{{ to_string(request.object.spec) | contains(@, '*') }}"
              operator: Equals
              value: true

[chipzoller]

Any feedback, @nischay30 ?

[nischay30]

Hi @chipzoller , Policies looks good and I have tested it. Thanks

[chipzoller]

Thank you for the confirmation.