istio.io/istio@v0.0.0-20240520182934-d79c90f27776/istioctl/pkg/authz/analyzer.go (about) 1 // Copyright Istio Authors 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // http://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 // The auth package provides support for checking the authentication and authorization policy applied 16 // in the mesh. It aims to increase the debuggability and observability of auth policies. 17 // Note: this is still under active development and is not ready for real use. 18 package authz 19 20 import ( 21 "fmt" 22 "io" 23 24 envoy_admin "github.com/envoyproxy/go-control-plane/envoy/admin/v3" 25 listener "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3" 26 27 "istio.io/istio/istioctl/pkg/util/configdump" 28 v3 "istio.io/istio/pilot/pkg/xds/v3" 29 ) 30 31 // Analyzer that can be used to check authorization policy. 32 type Analyzer struct { 33 listenerDump *envoy_admin.ListenersConfigDump 34 } 35 36 // NewAnalyzer creates a new analyzer for a given pod based on its envoy config. 37 func NewAnalyzer(envoyConfig *configdump.Wrapper) (*Analyzer, error) { 38 listeners, err := envoyConfig.GetDynamicListenerDump(true) 39 if err != nil { 40 return nil, fmt.Errorf("failed to get dynamic listener dump: %s", err) 41 } 42 43 return &Analyzer{listenerDump: listeners}, nil 44 } 45 46 // Print print the analysis results. 47 func (a *Analyzer) Print(writer io.Writer) { 48 var listeners []*listener.Listener 49 for _, l := range a.listenerDump.DynamicListeners { 50 listenerTyped := &listener.Listener{} 51 // Support v2 or v3 in config dump. See ads.go:RequestedTypes for more info. 52 l.ActiveState.Listener.TypeUrl = v3.ListenerType 53 err := l.ActiveState.Listener.UnmarshalTo(listenerTyped) 54 if err != nil { 55 return 56 } 57 listeners = append(listeners, listenerTyped) 58 } 59 Print(writer, listeners) 60 }