User guide: Hello World
- Kubernetes server with permissions to install cluster-scoped resources (operator, CRDs and RBAC)
If you do not own a Kubernetes server already and just want to try out the steps in this guide, you can create a local containerized cluster by executing the command below. In this case, the main requirement is having Kind installed, with either Docker or Podman.
The next steps walk you through installing Authorino, deploying and configuring a sample service called Talker API to be protected by the authorization service.
If you are a user of Kuadrant, you can skip step ❸. You may already have Authorino installed and running as well. In this case, skip also step ❺. If you even have your workload cluster configured, with sample service application deployed, as well as your Gateway API network resources applied to route traffic to your service, go straight to step ❼.
At step ❼, instead of creating an
For more about using Kuadrant to enforce authorization, check out Kuadrant auth.
❶ Create the namespace
❷ Deploy the Talker API
The Talker API is a simple HTTP service that echoes back in the response whatever it gets in the request. We will use it in this guide as the sample service to be protected by Authorino.
❸ Setup Envoy
The following bundle from the Authorino examples deploys the Envoy proxy and configuration to wire up the Talker API behind the reverse-proxy, with external authorization enabled with the Authorino instance.1
The command above creates an
Ingress with host name
talker-api.127.0.0.1.nip.io. If you are using a local Kubernetes cluster created with Kind, forward requests from your local port 8000 to the Envoy service running inside the cluster:
❹ Consume the API (unprotected)
❺ Protect the API
Install the Authorino Operator
❻ Consume the API behind Envoy and Authorino
Authorino does not know about the
talker-api.127.0.0.1.nip.io host, hence the
404 Not Found. Let's teach Authorino about this host by applying an
❼ Apply the
Create an Authorino
AuthConfig custom resource declaring the auth rules to be enforced:
Kuadrant users –
Remember to create an
AuthPolicy instead of an AuthConfig.
For more, see Kuadrant auth.
❽ Consume the API without credentials
Grant access to the API with a tailor-made security scheme
Check out other user guides for several use-cases of authentication and authorization, and the instructions to implement them using Authorino.
A few examples of available ser guides: - Authentication with API keys - Authentication with JWTs and OpenID Connect Discovery - Authentication with Kubernetes tokens (TokenReview API) - Authorization with Open Policy Agent (OPA) Rego policies - Authorization with simple JSON pattern-matching rules (e.g. JWT claims) - Authorization with Kubernetes RBAC (SubjectAccessReview API) - Fetching auth metadata from external sources - Token normalization
If you have started a Kubernetes cluster locally with Kind to try this user guide, delete it by running:
Otherwise, delete the namespaces created in step 1 and 5:
To uninstall the Authorino Operator and manifests (CRDs, RBAC, etc), run:
For details and instructions to setup Envoy manually, see Protect a service > Setup Envoy in the Getting Started page. If you are running your ingress gateway in Kubernetes and wants to avoid setting up and configuring your proxy manually, check out Kuadrant. ↩