GoogleCloudPlatform / cloud-run-anthos-reference-web-app

An opinionated set of best practices aimed at demonstrating a reference architecture for building a web application on Google Cloud using Cloud Run for Anthos.

https://cloud.google.com/anthos/run

Apache License 2.0

37 stars 22 forks source link

Authorize user access to backend services #46

Closed ssmall closed 4 years ago

ssmall commented 4 years ago

Implement authorization using Istio.

Success Criteria:

We can control access to certain API per user/role (ACL)
Pass through user information to the backend service, so that it can used it to set properties like createdBy

Implementation Notes

This should be done in a way that is generalizable to multiple backend services
We need to make sure that services can still receive requests from other services within the cluster

josueetcom commented 4 years ago

After much poking around with this I haven't been able to get AuthorizationPolicy to successfully work with Istio 1.4, even when using Istio 1.4 + Knative and using their test JWT token and endpoint. However, I did manage to see the Authorization policies work in Istio 1.5 and Istio 1.6 so I plan on punting this until Cloud Run for GKE is using a newer version of Istio