consul/website/content/docs/connect/proxies/envoy-extensions/usage/apigee-ext-authz.mdx

200 lines
6.0 KiB
Plaintext

---
layout: docs
page_title: Delegate authorization to Apigee
description: Learn how to use the `ext-authz` Envoy extension to delegate data plane authorization requests to Apigee.
---
# Delegate authorization to Apigee
This topic describes how to use the external authorization Envoy extension to delegate data plane authorization requests to Apigee.
For more detailed guidance, refer to the [`learn-consul-apigee-external-authz` repo](https://github.com/hashicorp-education/learn-consul-apigee-external-authz) on GitHub.
## Workflow
Complete the following steps to use the external authorization extension with Apigee:
1. Deploy the Apigee Adapter for Envoy and register the service in Consul.
1. Configure the `EnvoyExtensions` block in a service defaults or proxy defaults configuration entry.
1. Apply the configuration entry.
## Deploy the Apigee Adapter for Envoy
The [Apigee Adapter for Envoy](https://cloud.google.com/apigee/docs/api-platform/envoy-adapter/v2.0.x/concepts) is an Apigee-managed API gateway that uses Envoy to proxy API traffic.
To download and install Apigee Adapter for Envoy, refer to the [getting started documentation](https://cloud.google.com/apigee/docs/api-platform/envoy-adapter/v2.0.x/getting-started) or follow along with the [`learn-consul-apigee-external-authz` repo](https://github.com/hashicorp-education/learn-consul-apigee-external-authz) on GitHub.
After you deploy the service in your desired runtime, create a service defaults configuration entry for the service's gRPC protocol.
<Tabs>
<Tab heading="HCL" group="hcl">
<CodeBlockConfig filename="apigee-remote-service-envoy.hcl">
```hcl
Kind = "service-defaults"
Name = "apigee-remote-service-envoy"
Protocol = "grpc"
```
</CodeBlockConfig>
</Tab>
<Tab heading="JSON" group="json">
<CodeBlockConfig filename="apigee-remote-service-envoy.json">
```json
{
"kind": "service-defaults",
"name": "apigee-remote-service-envoy",
"protocol": "grpc"
}
```
</CodeBlockConfig>
</Tab>
<Tab heading="YAML" group="yaml">
<CodeBlockConfig filename="apigee-remote-service-envoy.yaml">
```yaml
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceDefaults
metadata:
name: apigee-remote-service-envoy
namespace: apigee
spec:
protocol: grpc
```
</CodeBlockConfig>
</Tab>
</Tabs>
## Configure the `EnvoyExtensions`
Add Envoy extension configurations to a proxy defaults or service defaults configuration entry. Place the extension configuration in an `EnvoyExtensions` block in the configuration entry.
- When you configure Envoy extensions on proxy defaults, they apply to every service.
- When you configure Envoy extensions on service defaults, they apply to all instances of a service with that name.
<Warning>
Adding Envoy extensions default proxy configurations may have unintended consequences. We recommend configuring `EnvoyExtensions` in service defaults configuration entries in most cases.
</Warning>
Consul applies Envoy extensions configured in proxy defaults before it applies extensions in service defaults. As a result, the Envoy extension configuration in service defaults may override configurations in proxy defaults.
The following example configures the default behavior for all services named `api` so that the Envoy proxies running as sidecars for those service instances target the apigee-remote-service-envoy service for gRPC authorization requests:
<Tabs>
<Tab heading="HCL" group="hcl">
<CodeBlockConfig filename="api-auth-service-defaults.hcl">
```hcl
Kind = "service-defaults"
Name = "api"
EnvoyExtensions = [
{
Name = "builtin/ext-authz"
Arguments = {
ProxyType = "connect-proxy"
Config = {
GrpcService = {
Target = {
Service = {
Name = "apigee-remote-service-envoy"
}
}
}
}
}
}
]
```
</CodeBlockConfig>
</Tab>
<Tab heading="JSON" group="json">
<CodeBlockConfig filename="api-auth-service-defaults.json">
```json
{
"Kind": "service-defaults",
"Name": "api",
"EnvoyExtensions": [{
"Name": "builtin/ext-authz",
"Arguments": {
"ProxyType": "connect-proxy",
"Config": {
"GrpcService": {
"Target": {
"Service": {
"Name": "apigee-remote-service-envoy"
}
}
}
}
}
}
]
}
```
</CodeBlockConfig>
</Tab>
<Tab heading="YAML" group="yaml">
<CodeBlockConfig filename="api-auth-service-defaults.yaml">
```yaml
apiVersion: consul.hashicorp.com/v1alpha1
kind: ServiceDefaults
metadata:
name: api
namespace: default
spec:
envoyExtensions:
- name: builtin/ext-authz
arguments:
proxyType: connect-proxy
config:
grpcService:
target:
service:
name: apigee-remote-service-envoy
namespace: apigee
```
</CodeBlockConfig>
</Tab>
</Tabs>
Refer to the [external authorization extension configuration reference](/consul/docs/connect/proxies/envoy-extensions/configuration/ext-authz) for details on how to configure the extension.
Refer to the [proxy defaults configuration entry reference](/consul/docs/connect/config-entries/proxy-defaults) and [service defaults configuration entry reference](/consul/docs/connect/config-entries/service-defaults) for details on how to define the configuration entries.
## Apply the configuration entry
On the CLI, you can use the `consul config write` command and specify the names of the configuration entries to apply them to Consul. For Kubernetes-orchestrated networks, use the `kubectl apply` command to update the relevant CRD.
<Tabs>
<Tab heading="HCL" group="hcl">
```shell-session
$ consul config write apigee-remote-service-envoy.hcl
$ consul config write api-auth-service-defaults.hcl
```
</Tab>
<Tab heading="JSON" group="json">
```shell-session
$ consul config write apigee-remote-service-envoy.json
$ consul config write api-auth-service-defaults.json
```
</Tab>
<Tab heading="YAML" group="yaml">
```shell-session
$ kubectl apply -f apigee-remote-service-envoy.yaml
$ kubectl apply -f api-auth-service-defaults.yaml
```
</Tab>
</Tabs>