update authz concept page for the new v1beta1 policy #5165

yangminzhu · 2019-10-16T00:41:40Z

Please provide a description for what this PR is for.

And to help us figure out who should review this PR, please
put an X in all the areas that this PR affects.

[ ] Configuration Infrastructure
[ ] Docs
[ ] Installation
[ ] Networking
[ ] Performance and Scalability
[ ] Policies and Telemetry
[X] Security
[ ] Test and Release
[ ] User Experience
[ ] Developer Infrastructure

yangminzhu · 2019-10-16T01:04:09Z

/cc @liminw

yangminzhu · 2019-10-16T01:10:18Z

/test lint_istio.io

yangminzhu · 2019-10-18T00:09:25Z

@rcaballeromx Could you review the PR? it's needed for the 1.4 release. thanks.

content/en/docs/concepts/security/index.md

geeknoid · 2019-10-19T13:21:28Z

content/en/docs/concepts/security/index.md

-updated authorization policies if it sees any changes. Pilot distributes Istio
-authorization policies to the Envoy proxies that are co-located with the
-service instances.
+Galley watches for changes to Istio authorization policies. It fetches the


I think we should remove this paragraph, or move it to the architecture document. In general, we want to be talking about the features and not how the features are implemented.

@rcaballeromx

@geeknoid I agree. This information doesn't belong here and we should move it to, at the very least an architecture section, or ideally the Architecture page under reference.

yangminzhu · 2019-10-24T17:39:10Z

@rcaballeromx ping

content/en/docs/concepts/security/index.md

liminw · 2019-10-24T23:03:07Z

One more thing, I think we also need to mention that the policy can be applied to Ingress and Egress, and give an example about it. This is a new feature that should be highlighted. Ideally, we should have a task demonstrating ingress/egress authorization.

yangminzhu · 2019-10-24T23:27:41Z

@liminw updated the doc for your comments, for the ingress/egress part, how about let me do it in a follow-up PR together with adding the new task for it? It's already quite a lot changes here.

content/en/docs/concepts/security/index.md

yangminzhu · 2019-10-25T00:23:25Z

@liminw Done, I think we had a bug for the support of "*" for presence match. Currently I'm afraid it matches on any instead of non-empty, will verify and fix soon.

liminw · 2019-10-25T00:56:55Z

@liminw Done, I think we had a bug for the support of "*" for presence match. Currently I'm afraid it matches on any instead of non-empty, will verify and fix soon.

Thanks @yangminzhu Yes. we need to fix it.

liminw · 2019-10-25T01:08:42Z

@yangminzhu Let's also clearly document "implicit enablement" behavior. See design doc. It is a big behavior change from alpha policy.

yangminzhu · 2019-10-25T22:01:01Z

@yangminzhu Let's also clearly document "implicit enablement" behavior. See design doc. It is a big behavior change from alpha policy.

I updated to the Enabling authorization section for the description of implicit enablement.

content/en/docs/concepts/security/index.md

yangminzhu · 2019-11-08T01:10:32Z

@nrjpoddar @zjory Thank you very much for helping to review the PR. I have updated the PR for your comments, hope we can get it in before the 1.4 release :)

content/en/docs/ops/common-problems/security-issues/index.md

content/en/docs/reference/config/authorization/conditions/index.md

content/en/docs/concepts/security/index.md

Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

…x.md Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

…-properties/index.md Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

yangminzhu · 2019-11-09T02:01:20Z

@geeknoid Updated for the comments, PTAL, thanks!

istio-testing added the do-not-merge/work-in-progress Block merging of a PR because it isn't ready yet. label Oct 16, 2019

googlebot added the cla: yes Set by the Google CLA bot to indicate the author of a PR has signed the Google CLA. label Oct 16, 2019

istio-testing added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Oct 16, 2019

yangminzhu force-pushed the authz branch from ef702eb to cb021d0 Compare October 16, 2019 01:03

yangminzhu marked this pull request as ready for review October 16, 2019 01:03

yangminzhu requested a review from a team as a code owner October 16, 2019 01:03

istio-testing removed the do-not-merge/work-in-progress Block merging of a PR because it isn't ready yet. label Oct 16, 2019

yangminzhu added this to the 1.4 milestone Oct 16, 2019

yangminzhu assigned rcaballeromx Oct 18, 2019

yangminzhu requested a review from a team October 18, 2019 17:27

yangminzhu force-pushed the authz branch from cb021d0 to e3460df Compare October 18, 2019 17:32

yangminzhu mentioned this pull request Oct 18, 2019

remove deprecated authz permissive task #5191

Merged

pitlv2109 reviewed Oct 18, 2019

View reviewed changes

content/en/docs/concepts/security/index.md Outdated Show resolved Hide resolved

content/en/docs/concepts/security/index.md Outdated Show resolved Hide resolved

geeknoid reviewed Oct 19, 2019

View reviewed changes

content/en/docs/concepts/security/index.md Outdated Show resolved Hide resolved

geeknoid reviewed Oct 19, 2019

View reviewed changes

yangminzhu force-pushed the authz branch from e3460df to 98fcc74 Compare October 22, 2019 18:25

geeknoid requested a review from rcaballeromx October 22, 2019 18:36

liminw reviewed Oct 24, 2019

View reviewed changes

liminw reviewed Oct 25, 2019

View reviewed changes

yangminzhu added 8 commits November 7, 2019 16:56

address comments.

c18ab98

use master

3943017

address more comments

3075941

implicit enablement

c5d5fcf

comments

20122b4

link to ref page

3e20a4e

fix lint

92a1c68

address more comments

b2fc245

yangminzhu force-pushed the authz branch from d475170 to b2fc245 Compare November 8, 2019 01:09

geeknoid reviewed Nov 9, 2019

View reviewed changes

yangminzhu and others added 15 commits November 8, 2019 17:31

Update content/en/docs/ops/common-problems/security-issues/index.md

43c73b0

Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

Update content/en/docs/reference/config/authorization/conditions/inde…

51aa4ec

…x.md Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

Update content/en/docs/reference/config/authorization/conditions/inde…

1337408

…x.md Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

Update content/en/docs/reference/config/authorization/conditions/inde…

e9a1105

…x.md Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

Update content/en/docs/reference/config/authorization/constraints-and…

99f1644

…-properties/index.md Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

Update content/en/docs/concepts/security/index.md

a775988

Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

Update content/en/docs/concepts/security/index.md

df65ca4

Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

Update content/en/docs/concepts/security/index.md

79f7aa8

Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

Update content/en/docs/concepts/security/index.md

2fa16d0

Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

Update content/en/docs/concepts/security/index.md

3ff6cc0

Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

Update content/en/docs/concepts/security/index.md

ca1c3c6

Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

Update content/en/docs/concepts/security/index.md

beb1935

Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

Update content/en/docs/concepts/security/index.md

c924fa7

Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

Update content/en/docs/concepts/security/index.md

1dcbdf1

Co-Authored-By: Martin Taillefer <geeknoid@users.noreply.github.com>

more fix

e1e9f1b

geeknoid approved these changes Nov 9, 2019

View reviewed changes

istio-testing merged commit 9a57887 into istio:master Nov 9, 2019

yangminzhu deleted the authz branch November 11, 2019 18:58

update authz concept page for the new v1beta1 policy #5165

update authz concept page for the new v1beta1 policy #5165

Uh oh!

Conversation

yangminzhu commented Oct 16, 2019

Uh oh!

yangminzhu commented Oct 16, 2019

Uh oh!

yangminzhu commented Oct 16, 2019

Uh oh!

yangminzhu commented Oct 18, 2019

Uh oh!

Uh oh!

Uh oh!

Uh oh!

geeknoid Oct 19, 2019

Choose a reason for hiding this comment

Uh oh!

rcaballeromx Nov 6, 2019

Choose a reason for hiding this comment

Uh oh!

yangminzhu commented Oct 24, 2019

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

liminw commented Oct 24, 2019

Uh oh!

yangminzhu commented Oct 24, 2019

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yangminzhu commented Oct 25, 2019

Uh oh!

liminw commented Oct 25, 2019

Uh oh!

liminw commented Oct 25, 2019

Uh oh!

yangminzhu commented Oct 25, 2019

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yangminzhu commented Nov 8, 2019

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yangminzhu commented Nov 9, 2019

Uh oh!

Uh oh!