Istio ext_authz

Client
   |
   v  POST /tools/hello (with x-chio-capability-token)
+---------------------+
| Envoy sidecar       |   <-- AuthorizationPolicy CUSTOM matches
| (demo-tool pod)     |       and routes ext_authz to chio
+---------------------+
   |  gRPC Authorization/Check (port 9091)
   v
+----------------------------+
| chio-sidecar Deployment    |   chio-system namespace
| chio-envoy-ext-authz       |   Service: chio-sidecar:9091/gRPC, 9090/HTTP
| (kernel pipeline + signer) |   /health on 9090
+----------------------------+
   |  CheckResponse: OK, no response headers,
   |  dynamic metadata chio.verdict = "allow"
   v
+---------------------+
| Envoy sidecar       |   forwards upstream
+---------------------+
   |
   v
demo-tool app (go-httpbin)

examples/istio-ext-authz/
  00-chio-sidecar-deployment.yaml   Namespace, ServiceAccount, Deployment,
                                    ConfigMap, Secret, Service
  01-meshconfig-patch.yaml          IstioOperator overlay; registers chio-ext-authz
  02-authorization-policy.yaml      CUSTOM (opt-in), DENY (backstop), ALLOW (probes)
  03-demo-workload.yaml             Namespace, ServiceAccount, Deployment,
                                    Service, VirtualService (go-httpbin demo)
  README.md
  ci-validation.md                  kubeconform + istioctl analyze recipes
  test-harness.sh                   port-forward + curl harness

kubectl apply -f examples/istio-ext-authz/00-chio-sidecar-deployment.yaml
kubectl -n chio-system rollout status deploy/chio-sidecar --timeout=120s
kubectl -n chio-system get svc chio-sidecar

kubectl run chio-smoke --rm -it --restart=Never \
  --image=curlimages/curl:8.9.1 -- \
  curl -sS http://chio-sidecar.chio-system.svc.cluster.local:9090/health

istioctl install -y \
  -f examples/istio-ext-authz/01-meshconfig-patch.yaml

kubectl -n istio-system apply \
  -f examples/istio-ext-authz/01-meshconfig-patch.yaml
kubectl -n istio-system rollout restart deploy/istiod

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: chio-ext-authz-meshconfig
  namespace: istio-system
spec:
  # Minimum Istio version. Earlier 1.20/1.21 builds also work for gRPC
  # ext_authz but 1.22 stabilised the typed header forwarding knobs below.
  meshConfig:
    extensionProviders:
      - name: chio-ext-authz
        envoyExtAuthzGrpc:
          # Fully-qualified cluster DNS name of the Service created in
          # 00-chio-sidecar-deployment.yaml.
          service: chio-sidecar.chio-system.svc.cluster.local
          port: 9091
          # Chio evaluation budget. Increase if your guard pipeline is slow.
          timeout: 0.25s
          # Forward identity + capability headers into the CheckRequest.
          # `chio-envoy-ext-authz::translate` pulls identity from these names.
          includeRequestHeadersInCheck:
            - authorization
            - x-chio-capability-token
            - x-chio-session-id
            - x-request-id
          # Chio never stores or forwards raw request bodies, but small
          # bodies must be available for guards that inspect content.
          includeAdditionalHeadersInCheck:
            x-chio-source: istio-mesh
          # Status propagated back to the client on Chio failure. See
          # docs/protocols/ENVOY-EXT-AUTHZ-INTEGRATION.md section 11.3.
          statusOnError: "403"
          # Inject the Envoy downstream peer certificate so Chio can derive a
          # SPIFFE-style CallerIdentity from the mTLS handshake.
          includePeerCertificate: true

kubectl -n istio-system logs deploy/istiod | grep -i extensionprovider
istioctl proxy-config bootstrap -n istio-system deploy/istiod \
  | grep -A3 chio-ext-authz

kubectl apply -f examples/istio-ext-authz/03-demo-workload.yaml
kubectl -n agent-tools rollout status deploy/demo-tool --timeout=120s
kubectl apply -f examples/istio-ext-authz/02-authorization-policy.yaml
kubectl -n agent-tools get authorizationpolicies

# Route mesh traffic through Chio via Istio's AuthorizationPolicy CUSTOM action.
#
# The CUSTOM action delegates the allow/deny decision to the named provider
# registered in MeshConfig (see 01-meshconfig-patch.yaml). This file contains
# three policies:
#
#   1. chio-tool-authorization     -- opts workloads labelled
#                                    `chio.world/secured=true` in the
#                                    `agent-tools` namespace into Chio
#                                    evaluation, with a header-driven filter
#                                    so only capability-bearing requests pay
#                                    the ext_authz latency.
#   2. chio-deny-unauthenticated   -- fail-closed backstop: anonymous requests
#                                    that slip past the CUSTOM match above
#                                    are denied outright. Ensures there is
#                                    no bypass path when the capability
#                                    header is missing.
#   3. chio-allow-health-probes    -- excludes kubelet probe traffic so the
#                                    demo workload's `/healthz` path stays
#                                    reachable without a capability token.
#
# All policies use `security.istio.io/v1` (GA in Istio 1.22+). The CUSTOM
# action uses the provider:name field -- the deprecated
# `.external.httpAuthorizationService` style is explicitly NOT used.
---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: chio-tool-authorization
  namespace: agent-tools
  labels:
    app.kubernetes.io/part-of: chio-protocol
spec:
  # Apply only to workloads that opted in by labelling themselves.
  selector:
    matchLabels:
      chio.world/secured: "true"
  action: CUSTOM
  provider:
    name: chio-ext-authz
  rules:
    # Allow-rule #1: route POSTs to /tools/* through Chio when either an
    # Chio capability token header or a Bearer Authorization header is
    # present. This is the hot path for agent tool invocation.
    - to:
        - operation:
            methods: ["POST"]
            paths: ["/tools/*", "/invoke/*"]
      when:
        - key: request.headers[x-chio-capability-token]
          notValues: [""]
    # Allow-rule #2: route POSTs through Chio when the request authenticates
    # with a Bearer token instead of a capability header.
    - to:
        - operation:
            methods: ["POST"]
            paths: ["/tools/*", "/invoke/*"]
      when:
        - key: request.headers[authorization]
          values: ["Bearer *"]
    # Allow-rule #3: route GETs on /tools/* (listings, schema fetches)
    # through Chio only when an Authorization header is present. This
    # illustrates header-based routing -- unauthenticated GETs fall
    # through to the deny policy below.
    - to:
        - operation:
            methods: ["GET"]
            paths: ["/tools/*"]
      when:
        - key: request.headers[authorization]
          values: ["Bearer *"]
---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: chio-deny-unauthenticated
  namespace: agent-tools
  labels:
    app.kubernetes.io/part-of: chio-protocol
spec:
  selector:
    matchLabels:
      chio.world/secured: "true"
  action: DENY
  rules:
    # Anything hitting /tools/* without either header is denied before it
    # ever reaches Chio. Saves the ext_authz RTT and keeps receipts focused
    # on real authenticated traffic.
    - to:
        - operation:
            paths: ["/tools/*", "/invoke/*"]
      when:
        - key: request.headers[x-chio-capability-token]
          values: [""]
        - key: request.headers[authorization]
          notValues: ["Bearer *"]
---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: chio-allow-health-probes
  namespace: agent-tools
  labels:
    app.kubernetes.io/part-of: chio-protocol
spec:
  selector:
    matchLabels:
      chio.world/secured: "true"
  action: ALLOW
  rules:
    - to:
        - operation:
            methods: ["GET"]
            paths: ["/healthz", "/readyz", "/metrics"]

POD="$(kubectl -n agent-tools get pod \
  -l app.kubernetes.io/name=demo-tool \
  -o jsonpath='{.items[0].metadata.name}')"
istioctl proxy-config listener -n agent-tools "${POD}" \
  --port 8080 -o json | grep chio-ext-authz

export CHIO_DEMO_CAPABILITY_TOKEN="$(cat ~/.chio/demo.token)"
./examples/istio-ext-authz/test-harness.sh

kubectl -n agent-tools port-forward svc/demo-tool 18080:80 &

# Allow path: the CUSTOM rule matches, so chio evaluates
curl -i -X POST \
  -H "x-chio-capability-token: ${CHIO_DEMO_CAPABILITY_TOKEN}" \
  --data '{"hello":"world"}' \
  http://127.0.0.1:18080/tools/hello

# Deny path: no header, so no CUSTOM rule matches and the DENY policy fires
curl -i -X POST --data '{}' http://127.0.0.1:18080/tools/hello

log "issuing allow request (capability token present)..."
ALLOW_STATUS="$(
  "${CURL}" -sS \
    -o "${ALLOW_BODY}" \
    -D "${ALLOW_HEADERS}" \
    -w '%{http_code}' \
    -H "x-chio-capability-token: ${CAPABILITY_TOKEN}" \
    -H "authorization: Bearer ${CAPABILITY_TOKEN}" \
    -X POST \
    --data '{"hello":"world"}' \
    "http://127.0.0.1:${LOCAL_PORT}/tools/hello"
)"

if [[ "${ALLOW_STATUS}" != "200" ]]; then
  log "allow response headers:"
  cat "${ALLOW_HEADERS}" >&2 || true
  fail "expected HTTP 200 on allow, got ${ALLOW_STATUS}"
fi

# Header names are case-insensitive per RFC 7230. Match loosely.
RECEIPT_ID="$(
  awk 'BEGIN{IGNORECASE=1} /^x-chio-receipt-id:/ { sub(/\r$/, ""); print $2; exit }' \
    "${ALLOW_HEADERS}"
)"

if [[ -z "${RECEIPT_ID}" ]]; then
  log "allow response headers:"
  cat "${ALLOW_HEADERS}" >&2 || true
  fail "allow response missing x-chio-receipt-id header"
fi

log "allow OK: status=200 receipt=${RECEIPT_ID}"

log "issuing deny request (no credentials)..."
DENY_STATUS="$(
  "${CURL}" -sS \
    -o "${DENY_BODY}" \
    -D "${DENY_HEADERS}" \
    -w '%{http_code}' \
    -X POST \
    --data '{"hello":"denied"}' \
    "http://127.0.0.1:${LOCAL_PORT}/tools/hello"
)"

if [[ "${DENY_STATUS}" != "403" ]]; then
  log "deny response headers:"
  cat "${DENY_HEADERS}" >&2 || true
  fail "expected HTTP 403 on deny, got ${DENY_STATUS}"
fi

log "deny OK: status=403"

kubectl delete -f examples/istio-ext-authz/02-authorization-policy.yaml
kubectl delete -f examples/istio-ext-authz/03-demo-workload.yaml
kubectl delete -f examples/istio-ext-authz/00-chio-sidecar-deployment.yaml
# Optional: remove the extension provider from MeshConfig by editing the
# istio ConfigMap (or reinstall without 01-meshconfig-patch.yaml).