Istio External Authorization Server Demo

A demo for istio grpc external authorization server.

Precondition

Please ensure you have installed k8s and istio related.

Usage

1. run ext_authz_server/pack.sh to build a external authorization image to docker hub. Note that you should change the docker user name. You can use my image built by this repository's code as well.

   #!/bin/bash
   
   # ext_authz_server/pack.sh
   # change to your docker hub user name
   USERNAME="sasakiyori"

2. apply config/ext-authz-server.yaml to build the Service and Deployment of external authorization server: kubectl apply -f ext-authz-server.yaml

3. config map processing

   • kubectl edit configmap istio -n istio-system
   • add extensionProviders config by config/istio-config-map.yaml
   • kubectl rollout restart deployment/istiod -n istio-system

4. add istio ingress config by config/istio-ingressgateway.yaml

5. check if your external authorization server runs normally

References

• istio sample
• authorization-policy
• envoy auth proto