RBAC (deprecated)

Istio RBAC (Role Based Access Control) defines ServiceRole and ServiceRoleBinding objects.

A ServiceRole specification includes a list of rules (permissions). Each rule has the following standard fields:

methods: A list of HTTP methods. You can set the value to to include all HTTP methods. This field should not be set for TCP services. The policy will be ignored. For gRPC services, only POST is allowed; other methods will result in denying services.
paths: HTTP paths or gRPC methods. Note that gRPC methods should be presented in the form of “/packageName.serviceName/methodName” and are case sensitive.

In addition to the standard fields, operators can also use custom keys in the constraints field, the supported keys are listed in the “constraints and properties” page.

Below is an example of ServiceRole object “product-viewer”, which has “read” (“GET” and “HEAD”) access to “products.svc.cluster.local” service at versions “v1” and “v2”. “path” is not specified, so it applies to any path in the service.

A ServiceRoleBinding specification includes two parts:

The roleRef field that refers to a ServiceRole object in the same namespace.
A list of subjects that are assigned the roles.

In addition to a simple user field, operators can also use custom keys in the properties field, the supported keys are listed in the “constraints and properties” page.

Below is an example of ServiceRoleBinding object “test-binding-products”, which binds two subjects to ServiceRole “product-viewer”:

Services in “abc” namespace.

AccessRule defines a permission to access a list of services.

AccessRule.Constraint

Field	Type	Description	Required
`key`		Key of the constraint.	No
`values`	`string[]`	List of valid values for the constraint. Exact match, prefix match, and suffix match are supported. For example, the value “v1alpha2” matches “v1alpha2” (exact match), or “v1” (prefix match), or “alpha2” (suffix match).	No

RbacConfig

RbacConfig implements the ClusterRbacConfig Custom Resource Definition for controlling Istio RBAC behavior. The ClusterRbacConfig Custom Resource is a singleton where only one ClusterRbacConfig should be created globally in the mesh and the namespace should be the same to other Istio components, which usually is istio-system.

Below is an example of an ClusterRbacConfig resource called istio-rbac-config which enables Istio RBAC for all services in the default namespace.

Field	Type	Description	Required
`mode`	`Mode`	Istio RBAC mode.	No
`inclusion`		A list of services or namespaces that should be enforced by Istio RBAC policies. Note: This field have effect only when mode is ONWITHINCLUSION and will be ignored for any other modes.	No
`exclusion`	`Target`	A list of services or namespaces that should not be enforced by Istio RBAC policies. Note: This field have effect only when mode is ONWITHEXCLUSION and will be ignored for any other modes.	No

RbacConfig.Target

Target defines a list of services or namespaces.

Field	Type	Description	Required
`services`			No
`namespaces`	`string[]`	A list of namespaces.	No

RoleRef

RoleRef refers to a role object.

Field	Type	Description	Required
`kind`	`string`	The type of the role being referenced. Currently, “ServiceRole” is the only supported value for “kind”.	Yes
`name`	`string`	The name of the ServiceRole object being referenced. The ServiceRole object must be in the same namespace as the ServiceRoleBinding object.	Yes

ServiceRole specification contains a list of access rules (permissions).

ServiceRoleBinding

ServiceRoleBinding assigns a ServiceRole to a list of subjects.

Field	Type	Description	Required
`subjects`	`Subject[]`	List of subjects that are assigned the ServiceRole object.	Yes
`roleRef`		Reference to the ServiceRole object.	Yes

Subject

Subject defines an identity. The identity is either a user or identified by a set of properties. The supported keys in properties are listed in “constraint and properties” page.

Field	Type	Description	Required
`user`	`string`	Optional. The user name/ID that the subject represents.	No
	`map<string, string>`	Optional. The set of properties that identify the subject.	No