You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -32,29 +32,30 @@ more reusable and leverage the underlying kubernetes platform. It aims to delive
32
32
of applications & services when it comes to rate limiting, authentication, authorization, discoverability, change management, usage contracts, insights, etc.
33
33
34
34
Kuadrant aims to produce a set of loosely coupled functionalities built directly on top of Kubernetes.
35
-
Furthermore it only strives to provide what Kubernetes doesn’t offer out of the box, i.e. Kuadrant won’t be designing a new Gateway/proxy,
35
+
Furthermore, it only strives to provide what Kubernetes doesn’t offer out of the box, i.e. Kuadrant won’t be designing a new Gateway/proxy,
36
36
instead it will opt to connect with what’s there and what’s being developed (think Envoy, Istio, GatewayAPI).
37
37
38
38
Kuadrant is a system of cloud-native k8s components that grows as users’ needs grow.
39
+
39
40
* From simple protection of a Service (via **AuthN**) that is used by teammates working on the same cluster, or “sibling” services, up to **AuthZ** of users using OIDC plus custom policies.
40
41
* From no rate-limiting to rate-limiting for global service protection on to rate-limiting by users/plans
41
42
42
43
## Architecture
43
44
44
45
Kuadrant relies on [Istio](https://istio.io/) and the [Gateway API](https://gateway-api.sigs.k8s.io/)
45
-
to operate the cluster (istio's) ingress gateway to provide API management with **authentication** (authN),
46
+
to operate the cluster (Istio's) ingress gateway to provide API management with **authentication** (authN),
46
47
**authorization** (authZ) and **rate limiting** capabilities.
| Control Plane | The control plane takes the customer desired configuration (declaratively as kubernetes custom resources) as input and ensures all components are configured to obey customer's desired behavior.<br> This repository contains the source code of the kuadrant control plane |
53
-
|[Kuadrant Operator](https://github.com/Kuadrant/kuadrant-operator)| A Kubernetes Operator to manage the lifecycle of the kuadrant deployment |
54
-
|[Authorino](https://github.com/Kuadrant/authorino)| The AuthN/AuthZ enforcer. As the [external istio authorizer](https://istio.io/latest/docs/tasks/security/authorization/authz-custom/) ([envoy external authorization](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/ext_authz_filter) serving gRPC service) |
55
-
|[Limitador](https://github.com/Kuadrant/limitador)| The external rate limiting service. It exposes a gRPC service implementing the [Envoy Rate Limit protocol (v3)](https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/ratelimit/v3/rls.proto)|
56
-
|[Authorino Operator](https://github.com/Kuadrant/authorino-operator)| A Kubernetes Operator to manage Authorino instances |
57
-
|[Limitador Operator](https://github.com/Kuadrant/limitador-operator)| A Kubernetes Operator to manage Limitador instances |
| Control Plane | The control plane takes the customer desired configuration (declaratively as kubernetes custom resources) as input and ensures all components are configured to obey customer's desired behavior.<br> This repository contains the source code of the kuadrant control plane|
54
+
|[Kuadrant Operator](https://github.com/Kuadrant/kuadrant-operator)| A Kubernetes Operator to manage the lifecycle of the kuadrant deployment|
55
+
|[Authorino](https://github.com/Kuadrant/authorino)| The AuthN/AuthZ enforcer. As the [external istio authorizer](https://istio.io/latest/docs/tasks/security/authorization/authz-custom/) ([envoy external authorization](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/ext_authz_filter) serving gRPC service) |
56
+
|[Limitador](https://github.com/Kuadrant/limitador)| The external rate limiting service. It exposes a gRPC service implementing the [Envoy Rate Limit protocol (v3)](https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/ratelimit/v3/rls.proto)|
57
+
|[Authorino Operator](https://github.com/Kuadrant/authorino-operator)| A Kubernetes Operator to manage Authorino instances |
58
+
|[Limitador Operator](https://github.com/Kuadrant/limitador-operator)| A Kubernetes Operator to manage Limitador instances |
58
59
59
60
### Provided APIs
60
61
@@ -86,7 +87,7 @@ Additionally, Kuadrant provides the following CRDs
86
87
87
88
### Installing Kuadrant
88
89
89
-
Installing Kuadrant is a two-step procedure. Firstly, install the Kuadrant Operator and seconly,
90
+
Installing Kuadrant is a two-step procedure. Firstly, install the Kuadrant Operator and secondly,
90
91
request a Kuadrant instance by creating a *Kuadrant* custom resource.
91
92
92
93
#### 1. Install the Kuadrant Operator
@@ -98,14 +99,14 @@ The Kuadrant Operator is available in public community operator catalogs, such a
98
99
The operator is available from [OperatorHub.io](https://operatorhub.io/operator/kuadrant-operator).
99
100
Just go to the linked page and follow installation steps (or just run these two commands):
100
101
101
-
```
102
+
```sh
102
103
# Install Operator Lifecycle Manager (OLM), a tool to help manage the operators running on your cluster.
Copy file name to clipboardexpand all lines: doc/logging.md
+2
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,7 @@
1
1
# Logging
2
2
3
3
The kuadrant operator outputs 3 levels of log messages: (from lowest to highest level)
4
+
4
5
1.`debug`
5
6
2.`info` (default)
6
7
3.`error`
@@ -12,6 +13,7 @@ Only `debug` logging will include processing details.
12
13
To configure the desired log level, set the environment variable `LOG_LEVEL` to one of the supported values listed above. Default log level is `info`.
13
14
14
15
Apart from log level, the operator can output messages to the logs in 2 different formats:
16
+
15
17
-`production` (default): each line is a parseable JSON object with properties `{"level":string, "ts":int, "msg":string, "logger":string, extra values...}`
16
18
-`development`: more human-readable outputs, extra stack traces and logging info, plus extra values output as JSON, in the format: `<timestamp-iso-8601>\t<log-level>\t<logger>\t<message>\t{extra-values-as-json}`
Copy file name to clipboardexpand all lines: doc/proposals/authpolicy-crd.md
+5-5
Original file line number
Diff line number
Diff line change
@@ -9,14 +9,14 @@ The new [GatewayAPI](https://gateway-api.sigs.k8s.io/) defines a standard [polic
9
9
## Goals
10
10
11
11
With `targetRef` from policy attachment concept, following are the goals:
12
-
- Application developer should be able target [`HTTPRoute`](https://gateway-api.sigs.k8s.io/v1alpha2/references/spec/#gateway.networking.k8s.io/v1alpha2.HTTPRoute) object in their own namespace. This will define authorization policy at the hostname/domain/vHost level.
12
+
- Application developer should be able to target [`HTTPRoute`](https://gateway-api.sigs.k8s.io/v1alpha2/references/spec/#gateway.networking.k8s.io/v1alpha2.HTTPRoute) object in their own namespace. This will define authorization policy at the hostname/domain/vHost level.
13
13
- Cluster operator should be able to target [`Gateway`](https://gateway-api.sigs.k8s.io/v1alpha2/references/spec/#gateway.networking.k8s.io/v1alpha2.Gateway) object along with HTTPRoute in the gateway's namespace. This will define policy at the <ins>listener</ins> level.
14
14
- To reduce context sharing at the gateway and external authorization provider, action type and auth-provider are defaulted to `CUSTOM` and authorino respectively.
15
15
16
16
## Proposed Solution
17
17
Following is the proposed new CRD that combines policy attachment concepts with Istio's AuthorizationPolicy:
18
18
19
-
```yaml=
19
+
```yaml
20
20
apiVersion: kuadrant.io/v1beta1
21
21
kind: AuthPolicy
22
22
metadata:
@@ -50,7 +50,7 @@ status:
50
50
reason: HTTPRouteProtected/GatewayProtected/Error
51
51
status: "True"| "False"
52
52
type: Available
53
-
observedGeneration: 1
53
+
observedGeneration: 1
54
54
```
55
55
56
56
### Target Reference
@@ -84,7 +84,7 @@ status:
84
84
- `methods`: a method matches over request method like `DELETE`.
85
85
86
86
Fields in a rule object are ANDed together but inner fields follow OR semantics. For example,
87
-
```
87
+
```yaml
88
88
hosts: ["*.toystore.com"]
89
89
methods: ["GET", "POST"]
90
90
paths: ["/admin"]
@@ -100,7 +100,7 @@ AuthScheme is embedded form of [Authorino's AuthConfig](https://github.com/Kuadr
100
100
101
101
The example AuthPolicy showed above will create the following AuthConfig:
0 commit comments