# Generating authorization policies for an existing application

Buoyant Enterprise for Linkerd provides powerful and expressive [authorization
policies](https://linkerd.io/2.20/features/server-policy/)
that allow you to control the types of traffic that are allowed in your cluster,
even at the level of individual HTTP routes or gRPC methods.

The BEL CLI includes a `linkerd policy generate` command to automatically
generate policy based on existing traffic on your Kubernetes cluster.

## Prerequisites

- [Buoyant Enterprise for Linkerd](/buoyant-enterprise-linkerd/latest/installation/) installed on a Kubernetes
  cluster
- The `BUOYANT_LICENSE` environment variable set, with functioning BEL CLI

## Step 1: Install sample app

If you do not already have meshed workloads on your cluster, you can install
this sample app to demonstrate policy generation:

```bash
curl https://run.linkerd.io/emojivoto.yml |
  linkerd inject - |
  kubectl apply -f -

linkerd check --proxy
```

## Step 2: Generate policy

To generate policy for all meshed workloads on your cluster, run:

```bash
linkerd policy generate
```

Depending on the number of Linkerd proxies running on your cluster, this command
may take several seconds to minutes. To speed it up, you may increase the
`--concurrency` flag above the default `10`. This command will examine traffic
patterns for all running proxies. For each meshed server and port combination
found, the output will include the following resources:

| Resource                                                                                                                    | Name            |
| --------------------------------------------------------------------------------------------------------------------------- | --------------- |
| [Server](https://linkerd.io/2.20/reference/authorization-policy/#server)                               | [server]-[port] |
| [MeshTLSAuthentication](https://linkerd.io/2.20/reference/authorization-policy/#meshtlsauthentication) | [server]-[port] |
| [AuthorizationPolicy](https://linkerd.io/2.20/reference/authorization-policy/#authorizationpolicy)     | [server]-[port] |

The `Server` defines the meshed workload and port that is receiving traffic. The
subsequent `MeshTLSAuthentication` and `AuthorizationPolicy` define which meshed
workloads are authorized to connect to the `Server`.

All `Server` resources have `accessPolicy: audit` set. In this mode, all meshed
and unmeshed traffic is allowed, to ensure that you can apply the generated
policy to your cluster without inadvertently denying traffic.

To apply the policy, run:

```bash
linkerd policy generate | kubectl apply -f -
```

If a request doesn't abide to the policy rules, it won't get denied, but it will
generate a log entry in the proxy at the `INFO` level with the tag
`authz.name=audit` along with other useful information.

Once you are confident that all authorized traffic is captured via policy, you
may remove the `accessPolicy: audit` lines, or re-run the command with the
`--disable-audit` flag.

## Learning more

For more information about using `linkerd policy generate`, see the
[BEL CLI reference](/buoyant-enterprise-linkerd/latest/reference/bel-cli/#policy-generate) page.

## Walkthrough

[Video](https://vimeo.com/936785424)