Skip to content

Commit 9e91ea2

Browse files
authored
Add feature page for following feature: Istio Authorization [Beta] (kubernetes#34)
* Add feature page for following feature: Istio Authorizatio [Beta] * Update authorization.md Add link to blog: Large Scale Security Policy Performance Tests
1 parent affda33 commit 9e91ea2

File tree

2 files changed

+206
-1
lines changed

2 files changed

+206
-1
lines changed

features.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,7 @@ features:
207207
id: "security.authorization"
208208
link: "/docs/concepts/security/#authorization"
209209
level:
210-
checklist: ""
210+
checklist: features/authorization.md
211211
maturity: Beta
212212
nextExpectedPromotion: ""
213213
area: Security and policy enforcement

features/authorization.md

+205
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
[//]: # (The syntax preceeding this line is a comment marker used to help guide the author in populating this document)
2+
[//]: # (to github. Unlike HTML comments commonly used throughout istio.io documentation, this comment will not be rendered)
3+
[//]: # (by github. Comments must be separated by carriage return preceding and concluding the text and be a single line.)
4+
5+
[//]: # (This is a living document representing the maturity of a feature. Completion of this template enables Istio work groups)
6+
[//]: # (to collect information on potential new functionality. This template should be completed before users are exposed to)
7+
[//]: # (any new experimental feature. Please complete this template during development.)
8+
9+
[//]: # (The feature implementation section must be completed before submission of the document.)
10+
11+
# Feature:
12+
13+
Istio Authorization
14+
15+
[//]: # (All information in this section is mandatory.)
16+
17+
**Feature name:**
18+
19+
Istio Authorization Policy
20+
21+
[//]: # (The name of the feature, e.g. Multiple control planes)
22+
23+
**Primary lead(s):**
24+
25+
Yangmin Zhu ([email protected])
26+
[//]: # (The primary lead or leads responsible for the feature. These individuals serve as a point of contact for the feature.)
27+
28+
**Short description:**
29+
30+
Istio Authorization provides access control for workloads in the mesh at the namespace, mesh and workload level.
31+
32+
[//]: # (A short description of the feature. One or two sentences maximum.)
33+
34+
35+
**Design Docs:**
36+
[Istio Authorization Policy v1beta1 Enforcement](https://docs.google.com/document/d/1EUmmYiUUuro_509NFK7NTxvbHJ7ehm9G8fCAaiYa3aw/edit#heading=h.hb4h97m77jmk)
37+
38+
[//]: # (Design docs for feature)
39+
40+
41+
**Relevant Documentation:**
42+
43+
[//]: # (Links to relevant documentation for feature)
44+
45+
**RFC:**
46+
47+
[//]: # (Link to RFC for feature)
48+
49+
50+
---
51+
52+
## Experimental
53+
54+
### Requirements:
55+
56+
[//]: # (All information in this section is mandatory for promotion. Please modify the links in this)
57+
[//]: # (section.)
58+
59+
- [ ] [User stories](insert_your_link_here) reviewed in a work group meeting.
60+
61+
[//]: # (User stories are a way to communicate user value. User stories follow the style)
62+
[//]: # (as a [type of user], I want [an action] so that [a benefit/a value]. Istio currently has no user)
63+
[//]: # (story template. Maybe you can make one?)
64+
65+
[//]: # (User stories must be presented in a work group meeting. They need no approval and are later integrated)
66+
[//]: # (into the RFCs, which do need approval for alpha. You may find value to negotiate within the work group where the)
67+
[//]: # (user stories are presented to help clarify the user stories.)
68+
69+
- [ ] [RFC Authored] - [create an RFC using template](https://docs.google.com/document/d/1ewJoCcw5-04crH-M0xw4zFxz1cfwVCPnNyW4K3m4Yyc/template/preview).
70+
71+
[//]: # (An RFC is mandatory to graduate to experimental. The RFC does not have to be reviewed in a work group)
72+
[//]: # (meeting to graduate to experimental.)
73+
74+
- [ ] [Documentation](insert_your_link_here) for enabling and using the feature.
75+
76+
[//]: # (The documentation instructions may exist on the developer wiki or the team drive. They may include instructions)
77+
[//]: # (for building running a `istioctl experimental command`, or using the preview profile,)
78+
[//]: # (or any other relevant information.)
79+
80+
- [ ] [Feedback plan](insert_your_link_here).
81+
82+
[//]: # (This may include user feedback meetings, discuss.istio.io conversations, GitHub issues, or mailing lists.)
83+
84+
- [ ] Disabled by default.
85+
86+
- [ ] No impact on performance when the feature is disabled.
87+
88+
---
89+
90+
## Alpha
91+
92+
### Requirements:
93+
94+
**Design**
95+
96+
- [X] RFC has been approved describing the intention of the feature as well as the user stories behind the feature.
97+
98+
**Config**
99+
100+
- [X] Explicit user action is required to enable this feature (e.g. a config field, config resource, or installation action).
101+
102+
> Link to instructions for enabling
103+
104+
**Docs**
105+
106+
- [X] Reference docs are published to preliminary.istio.io or the Istio wiki.
107+
- [X] Basic feature docs are published on preliminary.istio.io describing what the feature does, how to use it, and any caveats.
108+
- [X] Release notes entries added as appropriate
109+
- [X] Upgrade notes entries added as appropriate
110+
111+
**Tests**
112+
113+
- [X] Automated integration tests cover core use cases with the feature enabled.
114+
- [X] When disabled, the feature does not affect system stability or performance.
115+
116+
**API**
117+
118+
- [X] Initial API review.
119+
120+
**Approvals**
121+
122+
- [X] The appropriate work group(s) have reviewed and approved promotion of the feature.
123+
- [X] The TOC has reviewed and approved promotion of the feature as part of the
124+
roadmap for a release.
125+
126+
---
127+
128+
## Beta
129+
130+
### Requirements:
131+
132+
**Design**
133+
134+
- [X] Design doc describing the intention of the feature, how it will be
135+
implemented, and any thoughts on how to test the feature has been approved by
136+
relevant work group leads
137+
[Deny and exclude in AuthorizationPolicy](https://docs.google.com/document/d/1aJ1hffHz9JYGXIM9btnKaWmwVdn1Qg34FJScnDyZPw4/edit#)
138+
139+
- [X] Feature coverage and test plans written and approved.
140+
141+
**Docs**
142+
143+
- [X] Documentation on istio.io includes performance expectations; may have caveats.
144+
[Large Scale Security Policy Performance Tests](https://istio.io/latest/blog/2020/large-scale-security-policy-performance-tests/)
145+
146+
- [X] Documentation on istio.io includes samples/tutorials.
147+
- [ ] Documentation on istio.io includes appropriate glossary entries.
148+
- [X] All new documentation containing user actions includes istio.io tests.
149+
- [X] Release notes have been added.
150+
- [X] Upgrade notes have been added.
151+
152+
**Tests**
153+
154+
- [X] Integration tests cover feature edge cases
155+
- [X] End-to-end tests cover samples/tutorials
156+
- [X] Fixed issues have tests to prevent regressions
157+
- [X] Stability/stress test suite includes coverage for the feature.
158+
159+
**Performance**
160+
161+
- [X] Feature coverage and test plans written and approved
162+
- [X] Tests exist with the feature enabled that can be integrated with our automated performance testing.
163+
164+
**API**
165+
166+
- [X] TOC has reviewed the API and determined it to be complete.
167+
168+
**Tooling**
169+
170+
- [ ] Any necessary tooling to use/debug the feature has been implemented and is complete.
171+
172+
**Bugs**
173+
174+
- [X] Feature has no known major issues.
175+
176+
**Approvals**
177+
178+
- [X] The appropriate work group(s) have reviewed and approved promotion of the feature.
179+
- [X] The supportability review panel has reviewed promotion of the feature.
180+
- [X] The TOC has reviewed and approved promotion of the feature as part of the
181+
road map for a release.
182+
183+
---
184+
185+
## Stable
186+
187+
### Requirements:
188+
189+
**Performance**
190+
191+
- [ ] Latency, throughput, and scalability are quantified and documented on
192+
istio.io.
193+
194+
**Bugs**
195+
196+
- [ ] Feature has no known major issues.
197+
198+
**Approvals**
199+
200+
- [ ] The appropriate work group(s) have reviewed and approved promotion of the feature.
201+
- [ ] The supportability review panel has reviewed promotion of the feature.
202+
- [ ] The TOC has reviewed and approved promotion of the feature as part of the
203+
roadmap for a release.
204+
205+

0 commit comments

Comments
 (0)