{"action":"created","comment":{"url":"https://api.github.com/repos/istio/istio.github.io/pulls/comments/114160003","pull_request_review_id":35602275,"id":114160003,"diff_hunk":"@@ -0,0 +1,150 @@\n+---\n+title: Auth\n+overview: Architectural deep-dive into the design of Auth, which provides the secure communication channel and strong identity for Istio.\n+              \n+order: 10\n+\n+bodyclass: docs\n+layout: docs\n+type: markdown\n+---\n+\n+## Overview\n+\n+Istio Auth's aim is to enhance the security of microservices and their communication without requiring service code changes. It is responsible for:\n+\n+\n+\n+*   Providing each service with a strong identity that represents its role to enable interoperability across clusters and clouds\n+\n+*   Securing both service to service communication and end-user to service communication\n+\n+*   Providing a key management system to automate key/cert generation, distribution, rotation, and revocation\n+\n+In future versions it will also provide:\n+\n+*   Fine-grained authorization and auditing to control and monitor who accesses your services, apis, or resources\n+\n+*   Powerful authorization mechanisms: [ABAC](https://en.wikipedia.org/wiki/Attribute-Based_Access_Control), [RBAC](https://en.wikipedia.org/wiki/Role-based_access_control), Authorization hooks\n+\n+## Architecture\n+\n+The figure below shows the Istio Auth architecture, which includes three important components: identity, key management, and communication security. It describes how Istio Auth is used to secure the service-to-service communication between service A, running as the service account \"foo\", and service B, running as the service account \"bar\".\n+\n+<img style=\"display:block;margin:auto\" src=\"./img/auth/auth.svg\" alt=\"Istio Auth Architecture.\" />\n+\n+## Components\n+\n+### Identity\n+\n+Istio Auth uses [Kubernetes service accounts](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) to identify who runs the service because of the following reasons:\n+\n+\n+\n+*   A service account is **the identity (or role) a workload runs as**, which represents that workload's privileges. For the system requiring strong security, the amount of privilege for a workload should not be identified by a random string (i.e., service name, label, etc), or by the binary that is deployed.\n+\n+    *   For example, let's say we have a workload pulling data from a multi-tenant database. If Alice ran this workload, she will be able to pull a different set of data than if Bob ran this workload.\n+\n+*   Service accounts enable powerful security policies by offering the flexibility to identify a machine, a user, a workload, or a group of workloads (different workloads can run as the same service account).\n+\n+*   The service account a workload runs as won't change during the lifetime of the workload.\n+\n+*   Service account uniqueness can be ensured with domain name constraint\n+\n+### Communication Security\n+\n+Service-to-service communication is tunneled through the client side [Envoy](https://lyft.github.io/envoy/) and the server side Envoy. The end-to-end communication is secured by:\n+\n+\n+\n+*   Local TCP connections between the service and Envoy\n+\n+*   Mutual TLS connections between proxies\n+\n+*   Secure Naming: during the handshake process, the client side Envoy checks that the service account provided by the server side certificate is allowed to run the target service\n+\n+### Key Management\n+\n+Istio Auth provides a per-cluster CA (Certificate Authority) to automate key & cert management. It performs four key operations:\n+\n+\n+\n+*   Generate a key/cert pair for each service account\n+\n+*   Distribute key/cert to each pod according to the service account\n+\n+*   Rotate key/cert periodically\n+\n+*   Revoke a specific key/cert pair when necessary\n+\n+## Workflow\n+\n+Istio Auth workflow consists of two phases, deployment and runtime. This section covers both of them.\n+\n+### Deployment Phase","path":"_docs/concepts/network-and-auth/auth.md","position":84,"original_position":84,"commit_id":"8ea0348ffd6f185fa5d4a89992dce4b77fb9e7f4","original_commit_id":"8ea0348ffd6f185fa5d4a89992dce4b77fb9e7f4","user":{"login":"geeknoid","id":22780957,"avatar_url":"https://avatars0.githubusercontent.com/u/22780957?v=3","gravatar_id":"","url":"https://api.github.com/users/geeknoid","html_url":"https://github.com/geeknoid","followers_url":"https://api.github.com/users/geeknoid/followers","following_url":"https://api.github.com/users/geeknoid/following{/other_user}","gists_url":"https://api.github.com/users/geeknoid/gists{/gist_id}","starred_url":"https://api.github.com/users/geeknoid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geeknoid/subscriptions","organizations_url":"https://api.github.com/users/geeknoid/orgs","repos_url":"https://api.github.com/users/geeknoid/repos","events_url":"https://api.github.com/users/geeknoid/events{/privacy}","received_events_url":"https://api.github.com/users/geeknoid/received_events","type":"User","site_admin":false},"body":"Phase -> phase","created_at":"2017-05-01T17:28:42Z","updated_at":"2017-05-01T17:33:41Z","html_url":"https://github.com/istio/istio.github.io/pull/71#discussion_r114160003","pull_request_url":"https://api.github.com/repos/istio/istio.github.io/pulls/71","_links":{"self":{"href":"https://api.github.com/repos/istio/istio.github.io/pulls/comments/114160003"},"html":{"href":"https://github.com/istio/istio.github.io/pull/71#discussion_r114160003"},"pull_request":{"href":"https://api.github.com/repos/istio/istio.github.io/pulls/71"}}},"pull_request":{"url":"https://api.github.com/repos/istio/istio.github.io/pulls/71","id":117986724,"html_url":"https://github.com/istio/istio.github.io/pull/71","diff_url":"https://github.com/istio/istio.github.io/pull/71.diff","patch_url":"https://github.com/istio/istio.github.io/pull/71.patch","issue_url":"https://api.github.com/repos/istio/istio.github.io/issues/71","number":71,"state":"open","locked":false,"title":"Add auth concept doc","user":{"login":"wattli","id":24381542,"avatar_url":"https://avatars2.githubusercontent.com/u/24381542?v=3","gravatar_id":"","url":"https://api.github.com/users/wattli","html_url":"https://github.com/wattli","followers_url":"https://api.github.com/users/wattli/followers","following_url":"https://api.github.com/users/wattli/following{/other_user}","gists_url":"https://api.github.com/users/wattli/gists{/gist_id}","starred_url":"https://api.github.com/users/wattli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wattli/subscriptions","organizations_url":"https://api.github.com/users/wattli/orgs","repos_url":"https://api.github.com/users/wattli/repos","events_url":"https://api.github.com/users/wattli/events{/privacy}","received_events_url":"https://api.github.com/users/wattli/received_events","type":"User","site_admin":false},"body":"@LisaFC , please help to take a look. Thanks.","created_at":"2017-04-27T17:03:42Z","updated_at":"2017-05-01T17:33:42Z","closed_at":null,"merged_at":null,"merge_commit_sha":"660b10311105f6296a7f04c356bced2111f2c642","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/istio/istio.github.io/pulls/71/commits","review_comments_url":"https://api.github.com/repos/istio/istio.github.io/pulls/71/comments","review_comment_url":"https://api.github.com/repos/istio/istio.github.io/pulls/comments{/number}","comments_url":"https://api.github.com/repos/istio/istio.github.io/issues/71/comments","statuses_url":"https://api.github.com/repos/istio/istio.github.io/statuses/8ea0348ffd6f185fa5d4a89992dce4b77fb9e7f4","head":{"label":"wattli:master","ref":"master","sha":"8ea0348ffd6f185fa5d4a89992dce4b77fb9e7f4","user":{"login":"wattli","id":24381542,"avatar_url":"https://avatars2.githubusercontent.com/u/24381542?v=3","gravatar_id":"","url":"https://api.github.com/users/wattli","html_url":"https://github.com/wattli","followers_url":"https://api.github.com/users/wattli/followers","following_url":"https://api.github.com/users/wattli/following{/other_user}","gists_url":"https://api.github.com/users/wattli/gists{/gist_id}","starred_url":"https://api.github.com/users/wattli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wattli/subscriptions","organizations_url":"https://api.github.com/users/wattli/orgs","repos_url":"https://api.github.com/users/wattli/repos","events_url":"https://api.github.com/users/wattli/events{/privacy}","received_events_url":"https://api.github.com/users/wattli/received_events","type":"User","site_admin":false},"repo":{"id":89618786,"name":"istio.github.io","full_name":"wattli/istio.github.io","owner":{"login":"wattli","id":24381542,"avatar_url":"https://avatars2.githubusercontent.com/u/24381542?v=3","gravatar_id":"","url":"https://api.github.com/users/wattli","html_url":"https://github.com/wattli","followers_url":"https://api.github.com/users/wattli/followers","following_url":"https://api.github.com/users/wattli/following{/other_user}","gists_url":"https://api.github.com/users/wattli/gists{/gist_id}","starred_url":"https://api.github.com/users/wattli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wattli/subscriptions","organizations_url":"https://api.github.com/users/wattli/orgs","repos_url":"https://api.github.com/users/wattli/repos","events_url":"https://api.github.com/users/wattli/events{/privacy}","received_events_url":"https://api.github.com/users/wattli/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/wattli/istio.github.io","description":"Source for the istio.io site","fork":true,"url":"https://api.github.com/repos/wattli/istio.github.io","forks_url":"https://api.github.com/repos/wattli/istio.github.io/forks","keys_url":"https://api.github.com/repos/wattli/istio.github.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/wattli/istio.github.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/wattli/istio.github.io/teams","hooks_url":"https://api.github.com/repos/wattli/istio.github.io/hooks","issue_events_url":"https://api.github.com/repos/wattli/istio.github.io/issues/events{/number}","events_url":"https://api.github.com/repos/wattli/istio.github.io/events","assignees_url":"https://api.github.com/repos/wattli/istio.github.io/assignees{/user}","branches_url":"https://api.github.com/repos/wattli/istio.github.io/branches{/branch}","tags_url":"https://api.github.com/repos/wattli/istio.github.io/tags","blobs_url":"https://api.github.com/repos/wattli/istio.github.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/wattli/istio.github.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/wattli/istio.github.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/wattli/istio.github.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/wattli/istio.github.io/statuses/{sha}","languages_url":"https://api.github.com/repos/wattli/istio.github.io/languages","stargazers_url":"https://api.github.com/repos/wattli/istio.github.io/stargazers","contributors_url":"https://api.github.com/repos/wattli/istio.github.io/contributors","subscribers_url":"https://api.github.com/repos/wattli/istio.github.io/subscribers","subscription_url":"https://api.github.com/repos/wattli/istio.github.io/subscription","commits_url":"https://api.github.com/repos/wattli/istio.github.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/wattli/istio.github.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/wattli/istio.github.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/wattli/istio.github.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/wattli/istio.github.io/contents/{+path}","compare_url":"https://api.github.com/repos/wattli/istio.github.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/wattli/istio.github.io/merges","archive_url":"https://api.github.com/repos/wattli/istio.github.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/wattli/istio.github.io/downloads","issues_url":"https://api.github.com/repos/wattli/istio.github.io/issues{/number}","pulls_url":"https://api.github.com/repos/wattli/istio.github.io/pulls{/number}","milestones_url":"https://api.github.com/repos/wattli/istio.github.io/milestones{/number}","notifications_url":"https://api.github.com/repos/wattli/istio.github.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/wattli/istio.github.io/labels{/name}","releases_url":"https://api.github.com/repos/wattli/istio.github.io/releases{/id}","deployments_url":"https://api.github.com/repos/wattli/istio.github.io/deployments","created_at":"2017-04-27T16:34:26Z","updated_at":"2017-04-27T16:34:27Z","pushed_at":"2017-04-28T19:03:02Z","git_url":"git://github.com/wattli/istio.github.io.git","ssh_url":"git@github.com:wattli/istio.github.io.git","clone_url":"https://github.com/wattli/istio.github.io.git","svn_url":"https://github.com/wattli/istio.github.io","homepage":"http://istio.io","size":3370,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"istio:master","ref":"master","sha":"9a613ba637e3b6af94e2c53a12bba7c8c71c07b2","user":{"login":"istio","id":23534644,"avatar_url":"https://avatars2.githubusercontent.com/u/23534644?v=3","gravatar_id":"","url":"https://api.github.com/users/istio","html_url":"https://github.com/istio","followers_url":"https://api.github.com/users/istio/followers","following_url":"https://api.github.com/users/istio/following{/other_user}","gists_url":"https://api.github.com/users/istio/gists{/gist_id}","starred_url":"https://api.github.com/users/istio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/istio/subscriptions","organizations_url":"https://api.github.com/users/istio/orgs","repos_url":"https://api.github.com/users/istio/repos","events_url":"https://api.github.com/users/istio/events{/privacy}","received_events_url":"https://api.github.com/users/istio/received_events","type":"Organization","site_admin":false},"repo":{"id":82706976,"name":"istio.github.io","full_name":"istio/istio.github.io","owner":{"login":"istio","id":23534644,"avatar_url":"https://avatars2.githubusercontent.com/u/23534644?v=3","gravatar_id":"","url":"https://api.github.com/users/istio","html_url":"https://github.com/istio","followers_url":"https://api.github.com/users/istio/followers","following_url":"https://api.github.com/users/istio/following{/other_user}","gists_url":"https://api.github.com/users/istio/gists{/gist_id}","starred_url":"https://api.github.com/users/istio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/istio/subscriptions","organizations_url":"https://api.github.com/users/istio/orgs","repos_url":"https://api.github.com/users/istio/repos","events_url":"https://api.github.com/users/istio/events{/privacy}","received_events_url":"https://api.github.com/users/istio/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/istio/istio.github.io","description":"Source for the istio.io site","fork":false,"url":"https://api.github.com/repos/istio/istio.github.io","forks_url":"https://api.github.com/repos/istio/istio.github.io/forks","keys_url":"https://api.github.com/repos/istio/istio.github.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/istio/istio.github.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/istio/istio.github.io/teams","hooks_url":"https://api.github.com/repos/istio/istio.github.io/hooks","issue_events_url":"https://api.github.com/repos/istio/istio.github.io/issues/events{/number}","events_url":"https://api.github.com/repos/istio/istio.github.io/events","assignees_url":"https://api.github.com/repos/istio/istio.github.io/assignees{/user}","branches_url":"https://api.github.com/repos/istio/istio.github.io/branches{/branch}","tags_url":"https://api.github.com/repos/istio/istio.github.io/tags","blobs_url":"https://api.github.com/repos/istio/istio.github.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/istio/istio.github.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/istio/istio.github.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/istio/istio.github.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/istio/istio.github.io/statuses/{sha}","languages_url":"https://api.github.com/repos/istio/istio.github.io/languages","stargazers_url":"https://api.github.com/repos/istio/istio.github.io/stargazers","contributors_url":"https://api.github.com/repos/istio/istio.github.io/contributors","subscribers_url":"https://api.github.com/repos/istio/istio.github.io/subscribers","subscription_url":"https://api.github.com/repos/istio/istio.github.io/subscription","commits_url":"https://api.github.com/repos/istio/istio.github.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/istio/istio.github.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/istio/istio.github.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/istio/istio.github.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/istio/istio.github.io/contents/{+path}","compare_url":"https://api.github.com/repos/istio/istio.github.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/istio/istio.github.io/merges","archive_url":"https://api.github.com/repos/istio/istio.github.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/istio/istio.github.io/downloads","issues_url":"https://api.github.com/repos/istio/istio.github.io/issues{/number}","pulls_url":"https://api.github.com/repos/istio/istio.github.io/pulls{/number}","milestones_url":"https://api.github.com/repos/istio/istio.github.io/milestones{/number}","notifications_url":"https://api.github.com/repos/istio/istio.github.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/istio/istio.github.io/labels{/name}","releases_url":"https://api.github.com/repos/istio/istio.github.io/releases{/id}","deployments_url":"https://api.github.com/repos/istio/istio.github.io/deployments","created_at":"2017-02-21T17:19:49Z","updated_at":"2017-04-23T15:18:44Z","pushed_at":"2017-05-01T15:27:37Z","git_url":"git://github.com/istio/istio.github.io.git","ssh_url":"git@github.com:istio/istio.github.io.git","clone_url":"https://github.com/istio/istio.github.io.git","svn_url":"https://github.com/istio/istio.github.io","homepage":"http://istio.io","size":3367,"stargazers_count":3,"watchers_count":3,"language":"JavaScript","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":21,"mirror_url":null,"open_issues_count":10,"forks":21,"open_issues":10,"watchers":3,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/istio/istio.github.io/pulls/71"},"html":{"href":"https://github.com/istio/istio.github.io/pull/71"},"issue":{"href":"https://api.github.com/repos/istio/istio.github.io/issues/71"},"comments":{"href":"https://api.github.com/repos/istio/istio.github.io/issues/71/comments"},"review_comments":{"href":"https://api.github.com/repos/istio/istio.github.io/pulls/71/comments"},"review_comment":{"href":"https://api.github.com/repos/istio/istio.github.io/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/istio/istio.github.io/pulls/71/commits"},"statuses":{"href":"https://api.github.com/repos/istio/istio.github.io/statuses/8ea0348ffd6f185fa5d4a89992dce4b77fb9e7f4"}}}}
{"actor":{"display_login":"geeknoid"}}