--- title: istio.rbac.v1alpha1 layout: protoc-gen-docs generator: protoc-gen-docs schema: istio.rbac.v1alpha1.RbacConfig schema: istio.rbac.v1alpha1.ServiceRole schema: istio.rbac.v1alpha1.ServiceRoleBinding number_of_entries: 0 ---
Note: The v1alpha1 RBAC policy is deprecated by the v1beta1 Authorization policy. This page is kept for migration purpose and will be removed in Istio 1.6.
Istio RBAC (Role Based Access Control) defines ServiceRole and ServiceRoleBinding objects.
A ServiceRole specification includes a list of rules (permissions). Each rule has the following standard fields:
["*"]
to include all HTTP methods.
This field should not be set for TCP services. The policy will be ignored.
For gRPC services, only POST
is allowed; other methods will result in denying services.In addition to the standard fields, operators can also use custom keys in the constraints
field,
the supported keys are listed in the “constraints and properties” page.
Below is an example of ServiceRole object “product-viewer”, which has “read” (“GET” and “HEAD”) access to “products.svc.cluster.local” service at versions “v1” and “v2”. “path” is not specified, so it applies to any path in the service.
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRole
metadata:
name: products-viewer
namespace: default
spec:
rules:
- services: ["products.svc.cluster.local"]
methods: ["GET", "HEAD"]
constraints:
- key: "destination.labels[version]"
values: ["v1", "v2"]
A ServiceRoleBinding specification includes two parts:
roleRef
field that refers to a ServiceRole object in the same namespace.subjects
that are assigned the roles.In addition to a simple user
field, operators can also use custom keys in the properties
field,
the supported keys are listed in the “constraints and properties” page.
Below is an example of ServiceRoleBinding object “test-binding-products”, which binds two subjects to ServiceRole “product-viewer”:
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRoleBinding
metadata:
name: test-binding-products
namespace: default
spec:
subjects:
- user: alice@yahoo.com
- properties:
source.namespace: "abc"
roleRef:
kind: ServiceRole
name: "products-viewer"