Policy attributes design proposal

[elevran]

See also Issue #17

[zivnevo]

@elevran PTAL

[elevran]

@zivnevo thanks for the update. Pushed another iteration with more content. Might almost be there for initial sharing and feedback.

[elevran]

@zivnevo - is this ready to be reviewed from your point of view?

[zivnevo]

@zivnevo - is this ready to be reviewed from your point of view?

Yes, I think we are good

[gilshurek]

1. In reference to identity-based-connectivity and access-control concepts: clarify which attribute-scope’ hold source/target attributes which should be tied to the identities of source/target entities (workload & service) – and which scopes hold ‘context’ attributes, preferably tied to identities of infrastructure (?) entities (gateway, site, fabric).
2. Consistently use prefixes to denote attribute-scopes and sub-scopes.
   a. Why do we have a “cl” prefix? Is this the ‘gateway’ attribute-scope?
   b. Use different prefixes for Service and Workload k8s labels.
   c. In general, I suggest not to use ‘k8s’ as a prefix but as a sub-prefix. E.g., “service:k8s: …” “workload:k8s: …”
3. The Image SHA as a candidate workload attribute: The SHA is a prime identity authentication attribute (as a spire selector) but maybe not an attribute to be used by the ‘connectivity-autorization’ policies: Once the workload’s identity is established, the policy engine will use connectivity decision attributes that are derived from the identity.
4. “(note that the source site attributes are not sent to conserve resources - see note here)”: I faild to find the note.
5. Beyond this proposal: (how) Can we shift to a client handle which is not the IP-address?
6. Beyond this proposal: We use a ‘service’ abstraction for the connection target, which may indicate a collection of workloads. How about using a similar abstraction for the source, including the requirement to ‘register’ such services to CL?

[mrsabath]

This is a really good document that starts the conversation. I think we should have more discussion, as I started to add comments below.

[elevran]

@zivnevo can this be merged?