https://archive-os-3-28.netlify.app/assets/js/5f4525a1.9b420138.js

1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([["4271"],{32535:function(e,i,n){n.r(i),n.d(i,{frontMatter:()=>r,toc:()=>h,default:()=>u,metadata:()=>t,assets:()=>d,contentTitle:()=>c});var t=JSON.parse('{"id":"network-policy/istio/app-layer-policy","title":"Enforce network policy for Istio","description":"Enforce network policy for Istio service mesh including matching on HTTP methods and paths.","source":"@site/calico_versioned_docs/version-3.28/network-policy/istio/app-layer-policy.mdx","sourceDirName":"network-policy/istio","slug":"/network-policy/istio/app-layer-policy","permalink":"/calico/3.28/network-policy/istio/app-layer-policy","draft":false,"unlisted":false,"editUrl":"https://github.com/tigera/docs/edit/main/calico_versioned_docs/version-3.28/network-policy/istio/app-layer-policy.mdx","tags":[],"version":"3.28","frontMatter":{"description":"Enforce network policy for Istio service mesh including matching on HTTP methods and paths."},"sidebar":"calicoSidebar","previous":{"title":"Policy for Istio","permalink":"/calico/3.28/network-policy/istio/"},"next":{"title":"Use HTTP methods and paths in policy rules","permalink":"/calico/3.28/network-policy/istio/http-methods"}}'),o=n(37937),a=n(17869),l=n(71018),s=n(38958);let r={description:"Enforce network policy for Istio service mesh including matching on HTTP methods and paths."},c="Enforce network policy for Istio",d={},h=[{value:"Big picture",id:"big-picture",level:2},{value:"Value",id:"value",level:2},{value:"Concepts",id:"concepts",level:2},{value:"Benefits of the Istio integration",id:"benefits-of-the-istio-integration",level:3},{value:"Before you begin",id:"before-you-begin",level:2},{value:"How to",id:"how-to",level:2},{value:"Enable application layer policy",id:"enable-application-layer-policy",level:3},{value:"Install Calico CSI Driver",id:"install-calico-csi-driver",level:3},{value:"Install Istio",id:"install-istio",level:3},{value:"Update Istio sidecar injector",id:"update-istio-sidecar-injector",level:3},{value:"Add Calico authorization services to the mesh",id:"add-calico-authorization-services-to-the-mesh",level:3},{value:"Add namespace labels",id:"add-namespace-labels",level:3},{value:"Additional resources",id:"additional-resources",level:2}];function p(e){let i={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,a.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(i.header,{children:(0,o.jsx)(i.h1,{id:"enforce-network-policy-for-istio",children:"Enforce network policy for Istio"})}),"\n",(0,o.jsx)(i.h2,{id:"big-picture",children:"Big picture"}),"\n",(0,o.jsx)(i.p,{children:"Calico integrates seamlessly with Istio to enforce network policy within the Istio service mesh."}),"\n",(0,o.jsx)(i.h2,{id:"value",children:"Value"}),"\n",(0,o.jsx)(i.p,{children:"Calico network policy for Istio lets you enforce application layer attributes like HTTP methods or paths, and cryptographically secure identities for Istio-enabled apps."}),"\n",(0,o.jsx)(i.h2,{id:"concepts",children:"Concepts"}),"\n",(0,o.jsx)(i.h3,{id:"benefits-of-the-istio-integration",children:"Benefits of the Istio integration"}),"\n",(0,o.jsx)(i.p,{children:"The Calico support for Istio service mesh has the following benefits:"}),"\n",(0,o.jsxs)(i.ul,{children:["\n",(0,o.jsxs)(i.li,{children:["\n",(0,o.jsx)(i.p,{children:(0,o.jsx)(i.strong,{children:"Pod traffic controls"})}),"\n",(0,o.jsx)(i.p,{children:"Lets you restrict ingress traffic inside and outside pods and mitigate common threats to Istio-enabled apps."}),"\n"]}),"\n",(0,o.jsxs)(i.li,{children:["\n",(0,o.jsx)(i.p,{children:(0,o.jsx)(i.strong,{children:"Supports security goals"})}),"\n",(0,o.jsx)(i.p,{children:"Enables adoption of a zero trust network model for security, including traffic encryption, multiple enforcement points, and multiple identity criteria for authentication."}),"\n"]}),"\n",(0,o.jsxs)(i.li,{children:["\n",(0,o.jsx)(i.p,{children:(0,o.jsx)(i.strong,{children:"Familiar policy language"})}),"\n",(0,o.jsx)(i.p,{children:"Kubernetes network policies and Calico network policies work as is; users do not need to learn another network policy model to adopt Istio."}),"\n"]}),"\n"]}),"\n",(0,o.jsxs)(i.p,{children:["See ",(0,o.jsx)(i.a,{href:"/calico/3.28/network-policy/istio/enforce-policy-istio",children:"Enforce network policy using Istio tutorial"})," to learn how application layer policy provides second-factor authentication for the mythical Yao Bank."]}),"\n",(0,o.jsx)(i.h2,{id:"before-you-begin",children:"Before you begin"}),"\n",(0,o.jsx)(i.p,{children:(0,o.jsx)(i.strong,{children:"Required"})}),"\n",(0,o.jsxs)(i.ul,{children:["\n",(0,o.jsx)(i.li,{children:(0,o.jsx)(i.a,{href:"/calico/3.28/getting-started/kubernetes/",children:"Calico is installed"})}),"\n",(0,o.jsx)(i.li,{children:(0,o.jsx)(i.a,{href:"/calico/3.28/operations/calicoctl/install",children:"calicoctl is installed and configured"})}),"\n"]}),"\n",(0,o.jsx)(i.p,{children:(0,o.jsx)(i.strong,{children:"Istio support"})}),"\n",(0,o.jsx)(i.p,{children:"Following Istio versions have been verified to work with application layer policies:"}),"\n",(0,o.jsxs)(i.ul,{children:["\n",(0,o.jsx)(i.li,{children:"Istio v1.15.2"}),"\n",(0,o.jsx)(i.li,{children:"Istio v1.10.2"}),"\n"]}),"\n",(0,o.jsxs)(i.p,{children:["Istio v1.9.x and lower are ",(0,o.jsx)(i.strong,{children:"not"})," supported."]}),"\n",(0,o.jsx)(i.p,{children:"Although we expect future minor versions to work with the corresponding manifest below (for example, v1.10.2 or v1.15.2), manifest compatibility depends entirely on the upstream changes in the respective Istio release."}),"\n",(0,o.jsx)(i.h2,{id:"how-to",children:"How to"}),"\n",(0,o.jsxs)(i.ol,{children:["\n",(0,o.jsx)(i.li,{children:(0,o.jsx)(i.a,{href:"#enable-application-layer-policy",children:"Enable application layer policy"})}),"\n",(0,o.jsx)(i.li,{children:(0,o.jsx)(i.a,{href:"#install-calico-csi-driver",children:"Install Calico CSI Driver"})}),"\n",(0,o.jsx)(i.li,{children:(0,o.jsx)(i.a,{href:"#install-istio",children:"Install Istio"})}),"\n",(0,o.jsx)(i.li,{children:(0,o.jsx)(i.a,{href:"#update-istio-sidecar-injector",children:"Update Istio sidecar injector"})}),"\n",(0,o.jsx)(i.li,{children:(0,o.jsx)(i.a,{href:"#add-calico-authorization-services-to-the-mesh",children:"Add Calico authorization services to the mesh"})}),"\n",(0,o.jsx)(i.li,{children:(0,o.jsx)(i.a,{href:"#add-namespace-labels",children:"Add namespace labels"})}),"\n"]}),"\n",(0,o.jsx)(i.h3,{id:"enable-application-layer-policy",children:"Enable application layer policy"}),"\n",(0,o.jsxs)(i.p,{children:["To enable the application layer policy, you must enable the ",(0,o.jsx)(i.strong,{children:"Policy Sync API"})," on Felix cluster-wide."]}),"\n",(0,o.jsxs)(i.p,{children:["In the default ",(0,o.jsx)(i.strong,{children:"FelixConfiguration"}

1),", set the field, ",(0,o.jsx)(i.code,{children:"policySyncPathPrefix"})," to ",(0,o.jsx)(i.code,{children:"/var/run/nodeagent"}),":"]}),"\n",(0,o.jsxs)(l.A,{children:[(0,o.jsx)(s.A,{label:"calicoctl",value:"calicoctl-0",children:(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.code,{className:"language-bash",children:'calicoctl patch FelixConfiguration default --patch \\\n   \'{"spec": {"policySyncPathPrefix": "/var/run/nodeagent"}}\'\n'})})}),(0,o.jsx)(s.A,{label:"kubectl",value:"kubectl-1",children:(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.code,{className:"language-bash",children:'kubectl patch FelixConfiguration default --type=merge --patch \\\n   \'{"spec": {"policySyncPathPrefix": "/var/run/nodeagent"}}\'\n'})})})]}),"\n",(0,o.jsx)(i.p,{children:"Additionally, if you have installed Calico via the operator, you can optionally disable flexvolumes.\nFlexvolumes were used in earlier implementations and have since been deprecated."}),"\n",(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.code,{className:"language-bash",children:'kubectl patch installation default --type=merge -p \'{"spec": {"flexVolumePath": "None"}}\'\n'})}),"\n",(0,o.jsx)(i.h3,{id:"install-calico-csi-driver",children:"Install Calico CSI Driver"}),"\n",(0,o.jsx)(i.p,{children:"Calico utilizes a Container Storage Interface (CSI) driver to help set up the policy sync API on every node.\nApply the following to install the Calico CSI driver"}),"\n",(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.code,{className:"language-bash",children:"kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.5/manifests/csi-driver.yaml\n"})}),"\n",(0,o.jsx)(i.h3,{id:"install-istio",children:"Install Istio"}),"\n",(0,o.jsxs)(i.ol,{children:["\n",(0,o.jsxs)(i.li,{children:["Verify ",(0,o.jsx)(i.a,{href:"/calico/3.28/getting-started/kubernetes/requirements#application-layer-policy-requirements",children:"application layer policy requirements"}),"."]}),"\n",(0,o.jsxs)(i.li,{children:["Install Istio using ",(0,o.jsx)(i.a,{href:"https://istio.io/v1.15/docs/setup/install/",children:"installation guide in the project documentation"}),"."]}),"\n"]}),"\n",(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.code,{className:"language-bash",children:"curl -L https://git.io/getLatestIstio | ISTIO_VERSION=1.15.2 sh -\ncd $(ls -d istio-* --color=never)\n./bin/istioctl install\n"})}),"\n",(0,o.jsxs)(i.p,{children:["Next, create the following ",(0,o.jsx)(i.a,{href:"https://istio.io/v1.15/docs/reference/config/security/peer_authentication/",children:"PeerAuthentication"})," policy."]}),"\n",(0,o.jsxs)(i.p,{children:["Replace ",(0,o.jsx)(i.code,{children:"namespace"})," below by ",(0,o.jsx)(i.code,{children:"rootNamespace"})," value, if it's customized in your environment."]}),"\n",(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.code,{className:"language-bash",children:"kubectl create -f - <<EOF\napiVersion: security.istio.io/v1beta1\nkind: PeerAuthentication\nmetadata:\n  name: default-strict-mode\n  namespace: istio-system\nspec:\n  mtls:\n    mode: STRICT\nEOF\n"})}),"\n",(0,o.jsx)(i.h3,{id:"update-istio-sidecar-injector",children:"Update Istio sidecar injector"}),"\n",(0,o.jsx)(i.p,{children:"The sidecar injector automatically modifies pods as they are created to work with Istio. This step modifies the injector configuration to add Dikastes (a Calico component), as sidecar containers."}),"\n",(0,o.jsxs)(i.ol,{children:["\n",(0,o.jsxs)(i.li,{children:["Follow the ",(0,o.jsx)(i.a,{href:"https://archive.istio.io/v1.15/docs/setup/additional-setup/sidecar-injection/#automatic-sidecar-injection",children:"Automatic sidecar injection instructions"})," to install the sidecar injector and enable it in your chosen namespace(s)."]}),"\n",(0,o.jsxs)(i.li,{children:["Patch the istio-sidecar-injector ",(0,o.jsx)(i.code,{children:"ConfigMap"})," to enable injection of Dikastes alongside Envoy."]}),"\n"]}),"\n",(0,o.jsxs)(l.A,{children:[(0,o.jsxs)(s.A,{label:"Istio v1.15.x",value:"Istio v1.15.x-2",children:[(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.code,{className:"language-bash",children:'curl https://raw.githubusercontent.com/projectcalico/calico/v3.28.5/manifests/alp/istio-inject-configmap-1.15.yaml -o istio-inject-configmap.yaml\nkubectl patch configmap -n istio-system istio-sidecar-injector --patch "$(cat istio-inject-configmap.yaml)"\n'})}),(0,o.jsx)(i.p,{children:(0,o.jsx)(i.a,{href:"https://raw.githubusercontent.com/projectcalico/calico/v3.28.5/manifests/alp/istio-inject-configmap-1.15.yaml",children:"View sample manifest"})})]}),(0,o.jsxs)(s.A,{label:"Istio v1.10.x",value:"Istio v1.10.x-3",children:[(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.co

1de,{className:"language-bash",children:'curl https://raw.githubusercontent.com/projectcalico/calico/v3.28.5/manifests/alp/istio-inject-configmap-1.10.yaml -o istio-inject-configmap.yaml\nkubectl patch configmap -n istio-system istio-sidecar-injector --patch "$(cat istio-inject-configmap.yaml)"\n'})}),(0,o.jsx)(i.p,{children:(0,o.jsx)(i.a,{href:"https://raw.githubusercontent.com/projectcalico/calico/v3.28.5/manifests/alp/istio-inject-configmap-1.10.yaml",children:"View sample manifest"})})]})]}),"\n",(0,o.jsx)(i.h3,{id:"add-calico-authorization-services-to-the-mesh",children:"Add Calico authorization services to the mesh"}),"\n",(0,o.jsx)(i.p,{children:"Apply the following manifest to configure Istio to query Calico for application layer policy authorization decisions."}),"\n",(0,o.jsx)(i.p,{children:"This applies to Istio v1.15.x and v1.10.x:"}),"\n",(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.code,{className:"language-bash",children:"kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.28.5/manifests/alp/istio-app-layer-policy-envoy-v3.yaml\n"})}),"\n",(0,o.jsx)(i.p,{children:(0,o.jsx)(i.a,{href:"https://raw.githubusercontent.com/projectcalico/calico/v3.28.5/manifests/alp/istio-app-layer-policy-envoy-v3.yaml",children:"View sample manifest"})}),"\n",(0,o.jsx)(i.h3,{id:"add-namespace-labels",children:"Add namespace labels"}),"\n",(0,o.jsx)(i.p,{children:"You can control enforcement of application layer policy on a per-namespace basis. However, this only works on pods that are started with the Envoy and Calico Dikastes sidecars (as noted in the step, Update Istio sidecar injector). Pods that do not have the Calico sidecars, enforce only standard Calico network policy."}),"\n",(0,o.jsxs)(i.p,{children:["To enable Istio and application layer policy in a namespace, add the label ",(0,o.jsx)(i.code,{children:"istio-injection=enabled"}),"."]}),"\n",(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.code,{className:"language-bash",children:"kubectl label namespace <your namespace name> istio-injection=enabled\n"})}),"\n",(0,o.jsx)(i.p,{children:"If the namespace already has pods in it, you must recreate them for this to take effect."}),"\n",(0,o.jsxs)(i.admonition,{type:"note",children:[(0,o.jsxs)(i.p,{children:["Envoy must be able to communicate with the ",(0,o.jsx)(i.code,{children:"istio-pilot.istio-system service"}),". If you apply any egress policies to your pods, you ",(0,o.jsx)(i.em,{children:"must"})," enable access."]}),(0,o.jsx)(i.pre,{children:(0,o.jsx)(i.code,{className:"language-bash",children:"kubectl apply -f https://docs.tigera.io/files/allow-istio-pilot.yaml\n"})})]}),"\n",(0,o.jsx)(i.h2,{id:"additional-resources",children:"Additional resources"}),"\n",(0,o.jsxs)(i.ul,{children:["\n",(0,o.jsx)(i.li,{children:(0,o.jsx)(i.a,{href:"/calico/3.28/network-policy/istio/enforce-policy-istio",children:"Enforce network policy using Istio tutorial"})}),"\n",(0,o.jsx)(i.li,{children:(0,o.jsx)(i.a,{href:"/calico/3.28/network-policy/istio/http-methods",children:"Use HTTP methods and paths in policy rules"})}),"\n",(0,o.jsx)(i.li,{children:(0,o.jsx)(i.a,{href:"https://www.tigera.io/tutorials/?_sf_s=Deploy%20Service%20Mesh",children:"Hands-on workshop: Learn how to deploy access control, encryption & auth at the application level"})}),"\n"]})]})}function u(e={}){let{wrapper:i}={...(0,a.R)(),...e.components};return i?(0,o.jsx)(i,{...e,children:(0,o.jsx)(p,{...e})}):p(e)}},38958:function(e,i,n){n.d(i,{A:()=>a});var t=n(37937);n(82645);var o=n(71918);function a({children:e,hidden:i,className:n}){return(0,t.jsx)("div",{role:"tabpanel",className:(0,o.A)("tabItem_lI36",n),hidden:i,children:e})}},71018:function(e,i,n){n.d(i,{A:()=>v});var t=n(37937),o=n(82645),a=n(71918),l=n(22669),s=n(52678),r=n(13526),c=n(64855),d=n(66235),h=n(77848),p=n(24947);function u(e){return o.Children.toArray(e).filter(e=>"\n"!==e).map(e=>{if(!e||(0,o.isValidElement)(e)&&function(e){let{props:i}=e;return!!i&&"object"==typeof i&&"value"in i}(e))return e;throw Error(`Docusaurus error: Bad <Tabs> child <${"string"==typeof e.type?e.type:e.type.name}>: all children of the <Tabs> component should be <TabItem>, and every <TabItem> should have a unique "value" prop.`)})?.filter(Boolean)??[]}function f({value:e,tabValues:i}){return i.some(i=>i.value===e)}var m=n(21);function j({className:e,block:i,selectedValue:n,selectValue:o,tabValues:l}){let r=[],{blockElementScrollPositionUntilNextRender:c}=(0,s.a_)(),d=e=>{let i=e.currentTarget,t=l[r.indexOf(i)].value;t!==n&&(c(i),o(t))}

1,h=e=>{let i=null;switch(e.key){case"Enter":d(e);break;case"ArrowRight":{let n=r.indexOf(e.currentTarget)+1;i=r[n]??r[0];break}case"ArrowLeft":{let n=r.indexOf(e.currentTarget)-1;i=r[n]??r[r.length-1]}}i?.focus()};return(0,t.jsx)("ul",{role:"tablist","aria-orientation":"horizontal",className:(0,a.A)("tabs",{"tabs--block":i},e),children:l.map(({value:e,label:i,attributes:o})=>(0,t.jsx)("li",{role:"tab",tabIndex:n===e?0:-1,"aria-selected":n===e,ref:e=>{r.push(e)},onKeyDown:h,onClick:d,...o,className:(0,a.A)("tabs__item","tabItem_tQpp",o?.className,{"tabs__item--active":n===e}),children:i??e},e))})}function x({lazy:e,children:i,selectedValue:n}){let l=(Array.isArray(i)?i:[i]).filter(Boolean);if(e){let e=l.find(e=>e.props.value===n);return e?(0,o.cloneElement)(e,{className:(0,a.A)("margin-top--md",e.props.className)}):null}return(0,t.jsx)("div",{className:"margin-top--md",children:l.map((e,i)=>(0,o.cloneElement)(e,{key:i,hidden:e.props.value!==n}))})}function y(e){let i=function(e){let i,{defaultValue:n,queryString:t=!1,groupId:a}=e,l=function(e){let{values:i,children:n}=e;return(0,o.useMemo)(()=>{let e=i??u(n).map(({props:{value:e,label:i,attributes:n,default:t}})=>({value:e,label:i,attributes:n,default:t})),t=(0,h.XI)(e,(e,i)=>e.value===i.value);if(t.length>0)throw Error(`Docusaurus error: Duplicate values "${t.map(e=>e.value).join(", ")}" found in <Tabs>. Every value needs to be unique.`);return e},[i,n])}(e),[s,m]=(0,o.useState)(()=>(function({defaultValue:e,tabValues:i}){if(0===i.length)throw Error("Docusaurus error: the <Tabs> component requires at least one <TabItem> children component");if(e){if(!f({value:e,tabValues:i}))throw Error(`Docusaurus error: The <Tabs> has a defaultValue "${e}" but none of its children has the corresponding value. Available values are: ${i.map(e=>e.value).join(", ")}. If you intend to show no default tab, use defaultValue={null} instead.`);return e}let n=i.find(e=>e.default)??i[0];if(!n)throw Error("Unexpected error: 0 tabValues");return n.value})({defaultValue:n,tabValues:l})),[j,x]=function({queryString:e=!1,groupId:i}){let n=(0,r.W6)(),t=function({queryString:e=!1,groupId:i}){if("string"==typeof e)return e;if(!1===e)return null;if(!0===e&&!i)throw Error('Docusaurus error: The <Tabs> component groupId prop is required if queryString=true, because this value is used as the search param name. You can also provide an explicit value such as queryString="my-search-param".');return i??null}({queryString:e,groupId:i});return[(0,d.aZ)(t),(0,o.useCallback)(e=>{if(!t)return;let i=new URLSearchParams(n.location.search);i.set(t,e),n.replace({...n.location,search:i.toString()})},[t,n])]}({queryString:t,groupId:a}),[y,v]=function({groupId:e}){let i=e?`docusaurus.tab.${e}`:null,[n,t]=(0,p.Dv)(i);return[n,(0,o.useCallback)(e=>{i&&t.set(e)},[i,t])]}({groupId:a}),g=f({value:i=j??y,tabValues:l})?i:null;return(0,c.A)(()=>{g&&m(g)},[g]),{selectedValue:s,selectValue:(0,o.useCallback)(e=>{if(!f({value:e,tabValues:l}))throw Error(`Can't select invalid tab value=${e}`);m(e),x(e),v(e)},[x,v,l]),tabValues:l}}(e);return(0,t.jsxs)("div",{className:(0,a.A)(l.G.tabs.container,"tabs-container","tabList_HImo"),children:[(0,t.jsx)(j,{...i,...e}),(0,t.jsx)(x,{...i,...e})]})}function v(e){let i=(0,m.A)();return(0,t.jsx)(y,{...e,children:u(e.children)},String(i))}},17869:function(e,i,n){n.d(i,{R:()=>l,x:()=>s});var t=n(82645);let o={},a=t.createContext(o);function l(e){let i=t.useContext(a);return t.useMemo(function(){return"function"==typeof e?e(i):{...i,...e}},[i,e])}function s(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:l(e.components),t.createElement(a.Provider,{value:i},e.children)}}}]);