envoy/lds: use rbac policy builder
This change uses the RBAC policy builder added by commit
to generate the policies. No functional change introduced apart
from additional error checking due to usage of a new api.
@@ -6,10 +6,10 @@ import (
xds_listener "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
xds_rbac "github.com/envoyproxy/go-control-plane/envoy/config/rbac/v3"
xds_network_rbac "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/rbac/v3"
- xds_matcher "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
"github.com/envoyproxy/go-control-plane/pkg/wellknown"
"github.com/openservicemesh/osm/pkg/envoy"
+ "github.com/openservicemesh/osm/pkg/envoy/rbac"
"github.com/openservicemesh/osm/pkg/identity"
"github.com/openservicemesh/osm/pkg/service"
)
@@ -53,7 +53,11 @@ func (lb *listenerBuilder) buildInboundRBACPolicies() (*xds_network_rbac.RBAC, e
for _, downstreamSvcAccount := range allowsInboundSvcAccounts {
policyName := getPolicyName(downstreamSvcAccount, lb.svcAccount)
principal := identity.GetKubernetesServiceIdentity(downstreamSvcAccount, identity.ClusterLocalTrustDomain)
- rbacPolicies[policyName] = buildAllowAllPermissionsPolicy(principal)
+ if policy, err := buildAllowAllPermissionsPolicy(principal); err != nil {
+ log.Error().Err(err).Msgf("Error building RBAC policy for ServiceAccount %q and downstream %q", lb.svcAccount, downstreamSvcAccount)
+ } else {
+ rbacPolicies[policyName] = policy
+ }
}
// Create an inbound RBAC policy that denies a request by default, unless a policy explicitly allows it
@@ -69,43 +73,22 @@ func (lb *listenerBuilder) buildInboundRBACPolicies() (*xds_network_rbac.RBAC, e
}
// buildAllowAllPermissionsPolicy creates an XDS RBAC policy for the given client principal to be granted all access
-func buildAllowAllPermissionsPolicy(clientPrincipal identity.ServiceIdentity) *xds_rbac.Policy {
- return &xds_rbac.Policy{
- Permissions: []*xds_rbac.Permission{
- {
- // Grant the given principal all access
- Rule: &xds_rbac.Permission_Any{Any: true},
- },
- },
- Principals: []*xds_rbac.Principal{
+func buildAllowAllPermissionsPolicy(clientPrincipal identity.ServiceIdentity) (*xds_rbac.Policy, error) {
+ policy := &rbac.Policy{
+ Principals: []rbac.RulesList{
{
- Identifier: &xds_rbac.Principal_OrIds{
- OrIds: &xds_rbac.Principal_Set{
- Ids: []*xds_rbac.Principal{
- getPrincipalAuthenticated(clientPrincipal.String()),
- },
- },
+ OrRules: []rbac.Rule{
+ {Attribute: rbac.DownstreamAuthPrincipal, Value: clientPrincipal.String()},
},
},
},
+ // Permissions set to ANY if not specified, which grants all access for the given Principals
}
+
+ return policy.Generate()
}
// getPolicyName returns a policy name for the policy used to authorize a downstream service account by the upstream
func getPolicyName(downstream, upstream service.K8sServiceAccount) string {
return fmt.Sprintf("%s to %s", downstream, upstream)
}
-
-func getPrincipalAuthenticated(principalName string) *xds_rbac.Principal {
- return &xds_rbac.Principal{
- Identifier: &xds_rbac.Principal_Authenticated_{
- Authenticated: &xds_rbac.Principal_Authenticated{
- PrincipalName: &xds_matcher.StringMatcher{
- MatchPattern: &xds_matcher.StringMatcher_Exact{
- Exact: principalName,
- },
- },
- },
- },
- }
-}
