Implement Istio security policies with authorization and authentication for Kubernetes service mesh

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Default values
NAMESPACE="${1:-production}"
JWKS_ISSUER="${2:-https://auth.example.com}"
JWKS_AUDIENCE="${3:-api.example.com}"

# Usage message
usage() {
    echo "Usage: $0 [namespace] [jwks-issuer] [jwks-audience]"
    echo "Example: $0 production https://auth.example.com api.example.com"
    exit 1
}

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Cleanup function
cleanup() {
    if [[ $? -ne 0 ]]; then
        log_error "Installation failed. Cleaning up..."
        kubectl delete namespace "$NAMESPACE" --ignore-not-found=true 2>/dev/null || true
        rm -f /tmp/istio-security-*.yaml
    fi
}
trap cleanup ERR

# Check prerequisites
check_prerequisites() {
    log_info "[1/8] Checking prerequisites..."
    
    if [[ $EUID -ne 0 ]] && ! groups | grep -q sudo; then
        log_error "This script requires root privileges or sudo access"
        exit 1
    fi
    
    # Check for kubectl
    if ! command -v kubectl &> /dev/null; then
        log_error "kubectl is required but not installed"
        exit 1
    fi
    
    # Test kubectl connectivity
    if ! kubectl cluster-info &> /dev/null; then
        log_error "Cannot connect to Kubernetes cluster"
        exit 1
    fi
    
    # Verify Istio installation
    if ! kubectl get pods -n istio-system &> /dev/null; then
        log_error "Istio system namespace not found. Install Istio first."
        exit 1
    fi
    
    local istio_pods
    istio_pods=$(kubectl get pods -n istio-system --no-headers | grep -E "(istiod|pilot)" | grep Running | wc -l)
    if [[ $istio_pods -eq 0 ]]; then
        log_error "Istio control plane not running"
        exit 1
    fi
}

# Auto-detect package manager
detect_package_manager() {
    log_info "[2/8] Detecting operating system..."
    
    if [[ ! -f /etc/os-release ]]; then
        log_error "Cannot detect OS. /etc/os-release not found."
        exit 1
    fi
    
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt-get install -y"
            PKG_UPDATE="apt-get update"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf check-update || true"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum check-update || true"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
    
    log_info "Detected OS: $PRETTY_NAME"
    log_info "Package manager: $PKG_MGR"
}

# Install required packages
install_packages() {
    log_info "[3/8] Installing required packages..."
    
    if [[ $EUID -eq 0 ]]; then
        $PKG_UPDATE
        $PKG_INSTALL curl wget jq
    else
        sudo $PKG_UPDATE
        sudo $PKG_INSTALL curl wget jq
    fi
}

# Create and configure namespace
setup_namespace() {
    log_info "[4/8] Setting up namespace: $NAMESPACE"
    
    # Delete namespace if exists to start fresh
    kubectl delete namespace "$NAMESPACE" --ignore-not-found=true
    kubectl create namespace "$NAMESPACE"
    kubectl label namespace "$NAMESPACE" istio-injection=enabled
    
    # Wait for namespace to be ready
    kubectl wait --for=condition=Ready --timeout=60s namespace/"$NAMESPACE"
}

# Deploy sample applications
deploy_applications() {
    log_info "[5/8] Deploying sample applications..."
    
    cat > /tmp/istio-security-apps.yaml << EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: frontend
  namespace: $NAMESPACE
spec:
  replicas: 1
  selector:
    matchLabels:
      app: frontend
      version: v1
  template:
    metadata:
      labels:
        app: frontend
        version: v1
    spec:
      containers:
      - name: frontend
        image: nginx:1.24-alpine
        ports:
        - containerPort: 80
        resources:
          requests:
            memory: "64Mi"
            cpu: "50m"
          limits:
            memory: "128Mi"
            cpu: "100m"
---
apiVersion: v1
kind: Service
metadata:
  name: frontend
  namespace: $NAMESPACE
spec:
  selector:
    app: frontend
  ports:
  - port: 80
    targetPort: 80
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: backend
  namespace: $NAMESPACE
spec:
  replicas: 1
  selector:
    matchLabels:
      app: backend
      version: v1
  template:
    metadata:
      labels:
        app: backend
        version: v1
    spec:
      containers:
      - name: backend
        image: httpd:2.4-alpine
        ports:
        - containerPort: 80
        resources:
          requests:
            memory: "64Mi"
            cpu: "50m"
          limits:
            memory: "128Mi"
            cpu: "100m"
---
apiVersion: v1
kind: Service
metadata:
  name: backend
  namespace: $NAMESPACE
spec:
  selector:
    app: backend
  ports:
  - port: 80
    targetPort: 80
EOF
    
    kubectl apply -f /tmp/istio-security-apps.yaml
    kubectl wait --for=condition=Available --timeout=300s deployment/frontend -n "$NAMESPACE"
    kubectl wait --for=condition=Available --timeout=300s deployment/backend -n "$NAMESPACE"
}

# Configure mTLS policies
configure_mtls() {
    log_info "[6/8] Configuring mutual TLS policies..."
    
    cat > /tmp/istio-security-mtls.yaml << EOF
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: $NAMESPACE
spec:
  mtls:
    mode: STRICT
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: default
  namespace: $NAMESPACE
spec:
  host: "*.$NAMESPACE.svc.cluster.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
EOF
    
    kubectl apply -f /tmp/istio-security-mtls.yaml
}

# Configure JWT authentication
configure_jwt() {
    log_info "[7/8] Configuring JWT authentication..."
    
    cat > /tmp/istio-security-jwt.yaml << EOF
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: jwt-auth
  namespace: $NAMESPACE
spec:
  selector:
    matchLabels:
      app: frontend
  jwtRules:
  - issuer: "$JWKS_ISSUER"
    audiences:
    - "$JWKS_AUDIENCE"
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: frontend-authz
  namespace: $NAMESPACE
spec:
  selector:
    matchLabels:
      app: frontend
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/$NAMESPACE/sa/default"]
  - when:
    - key: request.auth.claims[iss]
      values: ["$JWKS_ISSUER"]
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: backend-authz
  namespace: $NAMESPACE
spec:
  selector:
    matchLabels:
      app: backend
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/$NAMESPACE/sa/default"]
    to:
    - operation:
        methods: ["GET", "POST"]
EOF
    
    kubectl apply -f /tmp/istio-security-jwt.yaml
}

# Verify installation
verify_installation() {
    log_info "[8/8] Verifying Istio security policies..."
    
    # Check if policies are applied
    local peer_auth_count
    peer_auth_count=$(kubectl get peerauthentication -n "$NAMESPACE" --no-headers | wc -l)
    if [[ $peer_auth_count -eq 0 ]]; then
        log_error "PeerAuthentication policies not found"
        return 1
    fi
    
    local dest_rules_count
    dest_rules_count=$(kubectl get destinationrule -n "$NAMESPACE" --no-headers | wc -l)
    if [[ $dest_rules_count -eq 0 ]]; then
        log_error "DestinationRule policies not found"
        return 1
    fi
    
    local authz_count
    authz_count=$(kubectl get authorizationpolicy -n "$NAMESPACE" --no-headers | wc -l)
    if [[ $authz_count -lt 2 ]]; then
        log_error "Authorization policies not properly configured"
        return 1
    fi
    
    # Check pod status
    local ready_pods
    ready_pods=$(kubectl get pods -n "$NAMESPACE" --no-headers | grep Running | wc -l)
    if [[ $ready_pods -lt 2 ]]; then
        log_error "Not all pods are running"
        return 1
    fi
    
    log_info "Verification completed successfully!"
    log_info "Namespace: $NAMESPACE"
    log_info "Applications deployed: frontend, backend"
    log_info "Security policies: mTLS (STRICT), JWT authentication, RBAC authorization"
    
    # Show status
    echo ""
    log_info "Current status:"
    kubectl get pods,svc,peerauthentication,destinationrule,authorizationpolicy -n "$NAMESPACE"
}

# Main execution
main() {
    if [[ $# -gt 3 ]]; then
        usage
    fi
    
    log_info "Starting Istio security policies installation..."
    log_info "Target namespace: $NAMESPACE"
    log_info "JWKS issuer: $JWKS_ISSUER"
    log_info "JWKS audience: $JWKS_AUDIENCE"
    
    check_prerequisites
    detect_package_manager
    install_packages
    setup_namespace
    deploy_applications
    configure_mtls
    configure_jwt
    verify_installation
    
    # Cleanup temporary files
    rm -f /tmp/istio-security-*.yaml
    
    log_info "Istio security policies installation completed successfully!"
}

main "$@"