Creating an Istio Authorization Policy dinamically

[gaetanodigenio]

Hi everyone,
I wanted to create an Istio policy dynamically.
I've seen that a policy can be created most statically in this way for example:

AuthorizationPolicyBuilder builder = new AuthorizationPolicyBuilder()
                .withNewMetadata()
                .withName(policyName)
                .endMetadata()
                .withNewSpec()
                .withSelector(new WorkloadSelectorBuilder().withMatchLabels(Collections.singletonMap("app", appLabel)).build())
                .withAction(AuthorizationPolicyAction.DENY)
                .withRules(
                        new RuleBuilder()
                        .withFrom(
                                new RuleFromBuilder().withSource(new SourceBuilder().withNamespaces(fromNs).build()).build())
                        .withTo(new RuleToBuilder().withOperation(new OperationBuilder().withMethods(method).build()).build())
                        .build())
                .endSpec();

and then I can do:

        policy = client.v1beta1().authorizationPolicies().inNamespace(namespace).create(builder.build());

Assuming that all the parameters are given in input by a specific user.

I wanted to create now the same policy, but actually adding the rules only if there are any.
If an user sends some "fromNamespaces" in an array since they can be multiple, I want to iterate for each element of the array and create the rule to add to the rest of the policy later.
Same apply for other "from" parameters and also the "to" parameters.
Something like this:

AuthorizationPolicyBuilder builder = new AuthorizationPolicyBuilder()
                .withNewMetadata()
                .withName(policyName)
                .endMetadata()
                .withNewSpec()
                .withSelector(new WorkloadSelectorBuilder().withMatchLabels(Collections.singletonMap("app", appLabel)).build())
                .withAction((action.equalsIgnoreCase("DENY")) ? AuthorizationPolicyAction.DENY : AuthorizationPolicyAction.ALLOW)
                .endSpec();

 if(!fromNamespaces.isEmpty()){
      for (String fromNamespace: fromNamespaces){
           //create the rule with the specific parameter 
           //attach the rule to the builder
}}

How can this be achieved? I hope it's clear what I want to do.
Thanks in advance

[rohanKanojia]

@gaetanodigenio : Could you please check if this works?

if(!fromNamespaces.isEmpty()){
  for (String fromNamespace: fromNamespaces){
    builder.editSpec()
        .addToRules(new RuleBuilder()
            .withFrom(new RuleFromBuilder().withSource(new SourceBuilder().withNamespaces(fromNamespace).build()).build())
            .withTo(new RuleToBuilder().withOperation(new OperationBuilder().withMethods(method).build()).build())
            .build())
        .endSpec();
  }
}

[gaetanodigenio]

Nop, still creates the yaml in the second example i showed you

[rohanKanojia]

Sorry, I misunderstood your problem. So basically you don't want to create rules but just edit existing one. Could you please try this:

        for (String fromNamespace: fromNamespaces){
          builder.editSpec()
              .editFirstRule()
                  .addToFrom(new RuleFromBuilder().withSource(new SourceBuilder().withNamespaces(fromNamespace).build()).build())
                  .addToTo(new RuleToBuilder().withOperation(new OperationBuilder().withMethods(method).build()).build())
              .endRule()
              .endSpec();
        }

[gaetanodigenio]

No the problem is that i'm ok with this code:

if(!fromNamespaces.isEmpty()){
  for (String fromNamespace: fromNamespaces){
    builder.editSpec()
        .addToRules(new RuleBuilder()
            .withFrom(new RuleFromBuilder().withSource(new SourceBuilder().withNamespaces(fromNamespace).build()).build())
            .withTo(new RuleToBuilder().withOperation(new OperationBuilder().withMethods(method).build()).build())
            .build())
        .endSpec();
  }
}

It works properly.
But the thing is that I may have multiple "to" rules with multiple methods, right?
So I can have an array containing all the "to rules".
So the code above is not fine anymore, since it assumes only one single "to" method rule.
So I was thinking about removing the .withTo line from the code above, creating only the "from" rules in this way:

//fromNamespace fields
if(!fromNamespaces.isEmpty()){
            System.out.println("From namespaces not empty");
            for (String fromNamespace: fromNamespaces){
                System.out.println("Namespace to build: " + fromNamespace);
                builder.editSpec()
                        .addToRules(new RuleBuilder()
                                .withFrom(new RuleFromBuilder().withSource(new SourceBuilder().withNamespaces(fromNamespace).build()).build())
                                .build())
                        .endSpec();
            }
        }

And now I can add the "to" rules using a similar logic:

//to fields
        if(!toMethodList.isEmpty()){
            for(String toMethod: toMethodList){
                builder.editSpec()
                        .addToRules(new RuleBuilder()
                                .withTo(new RuleToBuilder().withOperation(new OperationBuilder().withMethods(toMethod).build()).build())
                                .build())
                        .endSpec();
            }
        }

The problem is these 2 approaches creates different YAML file, the first approach is working, the second one don't.
You can see the yaml files generated above, the "to" field is not properly indented and has a strange "-" before.
Also replacing the .withTo method with .addToTo doesn't work.
I hope it's clear

[rohanKanojia]

Sorry, I'm not sure if I still understand complete problem. Is there 1-1 mapping of method - to and fromNamespace - from ?

Could you please share expected YAML input/output?

[gaetanodigenio]

Yes, you're right about the 1-1 mapping. But what if I want to apply to a from "namespacex" multiple "to" rules?
For example a policy that DENY from a namespace called "ns1" the GET and POST requests?

[gaetanodigenio]

I also have a problem adding the "action" field. It doesn't add anything in the final policy, the action field doesn't exists.

        System.out.println("Creating a AuthorizationPolicy entry");
        AuthorizationPolicyBuilder builder = new AuthorizationPolicyBuilder()
                .withNewMetadata()
                .withName(policyName)
                .endMetadata()
                .withNewSpec()
                .withSelector(new WorkloadSelectorBuilder().withMatchLabels(Collections.singletonMap("app", appLabel)).build())
                .withAction(AuthorizationPolicyAction.ALLOW)
                .endSpec();

Maybe I should add the action field later? How can I do that?

[rohanKanojia]

@gaetanodigenio : Are you saying after constructing an object via builder, you see .spec.action as null?

[gaetanodigenio]

yes, no action field at all in the final policy.

[rohanKanojia]

strange, I don't see this behavior. For me, it seems to be getting set correctly. If I build your builder object and try to print action it seems to work:

AuthorizationPolicy authorizationPolicy = builder.build();
System.out.println(authorizationPolicy.getSpec().getAction());

[gaetanodigenio]

Oh actually it works for me too, the problem is with Kiali. If I kubectl describe the policy via CLI I see the action field, with Kiali I don't (when I set the action to ALLOW). The fun fact is that if I set the action to DENY, it appears also in Kiali. Idk why