Authservice

Overview

This package is a bundle of applications which create an OIDC proxy to provide SSO for other services running in the cluster.

Authservice

Authservice is an implementation of Envoy External Authorization, focused on delivering authN/Z solutions for Istio and Kubernetes. Authservice handles incoming authN/Z requests and delegates part of the OIDC token-granting workflow to the backend SSO provider.

Redis

Redis is an in-memory data structure store, used as a database, cache, and message broker. It is optional to deploy and is used by Authservice to cache session data. See backup.md for more details.

Dependencies

This package depends on the istio-controlplane and istio-operator Big Bang packages.

How it works

First, Authservice must be enabled through the addons functionality of Big Bang. This will cause an instance of Authservice to be deployed into the authservice namespace. For every workload in the cluster that is labeled with the value of the selector, the respective application will then redirect all requests through Authservice which will then validate a user through the backend SSO provider and then forward to the workload as normal. Each workload placed behind authservice must have a matching individual chain.

Please review the BigBang Authservice Architecture Document for more information about its role within BigBang.