Chapter 12. Authorization and EventPolicy in Knative Eventing

Procedure

1. Create two namespaces, deploy a Broker in namespace-1, and configure one PingSource in each namespace as shown in the following example:

   apiVersion: v1
   kind: Namespace
   metadata:
     name: namespace-1
   ---
   apiVersion: v1
   kind: Namespace
   metadata:
     name: namespace-2
   ---
   apiVersion: eventing.knative.dev/v1
   kind: Broker
   metadata:
     name: broker
     namespace: namespace-1
   ---
   # PingSource in namespace-1
   apiVersion: sources.knative.dev/v1
   kind: PingSource
   metadata:
     name: pingsource-1
     namespace: namespace-1
   spec:
     data: '{"message": "Hi from pingsource-1 from namespace-1"}'
     schedule: '*/1 * * * *'
     sink:
       ref:
         apiVersion: eventing.knative.dev/v1
         kind: Broker
         name: broker
         namespace: namespace-1
   ---
   # PingSource in namespace-2
   apiVersion: sources.knative.dev/v1
   kind: PingSource
   metadata:
     name: pingsource-2
     namespace: namespace-2
   spec:
     data: '{"message": "Hi from pingsource-2 from namespace-2"}'
     schedule: '*/1 * * * *'
     sink:
       ref:
         apiVersion: eventing.knative.dev/v1
         kind: Broker
         name: broker
         namespace: namespace-1

2. Create an event-display service to show incoming events and add a Trigger to connect it to the Broker as shown in the following example:

   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: event-display
     namespace: namespace-1
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: event-display
     template:
       metadata:
         labels:
           app: event-display
       spec:
         containers:
           - name: event-display
             image: gcr.io/knative-releases/knative.dev/eventing/cmd/event_display
             ports:
             - containerPort: 8080
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: event-display
     namespace: namespace-1
   spec:
     selector:
       app: event-display
     ports:
       - name: http
         port: 80
         targetPort: 8080
   ---
   apiVersion: eventing.knative.dev/v1
   kind: Trigger
   metadata:
     name: trigger
     namespace: namespace-1
   spec:
     broker: broker
     subscriber:
       ref:
         apiVersion: v1
         kind: Service
         name: event-display

   At this stage, OIDC remains disabled and no EventPolicy exists, so the event-display service shows events from both PingSources.

3. Enable OIDC in Knative Eventing and create an EventPolicy by running the following example command:

   $ oc -n knative-eventing patch KnativeEventing knative-eventing \
     --type merge \
     -p '{"spec":{"config":{"features":{"authentication-oidc":"enabled"}}}}'

4. After you enable OIDC, create an EventPolicy that authorizes only the PingSource from namespace-2, as shown in the following example:

   apiVersion: eventing.knative.dev/v1alpha1
   kind: EventPolicy
   metadata:
     name: event-policy
     namespace: namespace-1
   spec:
     to:
       - ref:
           apiVersion: eventing.knative.dev/v1
           kind: Broker
           name: broker
     from:
       - ref:
           apiVersion: sources.knative.dev/v1
           kind: PingSource
           name: pingsource-2
           namespace: namespace-2

Verification

1. Verify the EventPolicy to check the Broker status by running the following command:

   $ oc -n namespace-1 get broker broker -o yaml

2. View logs from the event-display service to confirm only pingsource-2 events arrive by running the following command:

   $ oc -n namespace-1 logs -f -l app=event-display

3. Delete the EventPolicy by running the following command:

   $ oc -n namespace-1 delete eventpolicy event-policy

4. Check the Broker status to confirm it has returned to the default allow-same-namespace mode by running the following command:

   $ oc -n namespace-1 get broker broker -o yaml

5. View the event-display service logs to confirm that only pingsource-1 events from the same namespace appear by running the following command:

   $ oc -n namespace-1 logs -f -l app=event-display