Istio Security 基础

环境

配置

root@master01:/opt/istio-in-practise/Traffic-Management-Basics/ms-demo/02-demoapp-v11# cat deploy-proxy.yaml 
apiVersion: apps/v1
kind: Deployment
metadata:
  name: proxy
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  selector:
    matchLabels:
      app: proxy
  template:
    metadata:
      labels:
        app: proxy
    spec:
      containers:
        - env:
          - name: PROXYURL
            value: http://demoapp:8080
          image: ikubernetes/proxy:v0.1.1
          imagePullPolicy: IfNotPresent
          name: proxy
          ports:
            - containerPort: 8080
              name: web
              protocol: TCP
          resources:
            limits:
              cpu: 50m
---
apiVersion: v1
kind: Service
metadata:
  name: proxy
spec:
  ports:
    - name: http-80
      port: 80
      protocol: TCP
      targetPort: 8080
  selector:
    app: proxy
---

root@master01:/opt/istio-in-practise/Traffic-Management-Basics/ms-demo/01-demoapp-v10# cat deploy-demoappv10.yaml 
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: demoappv10
    version: v1.0
  name: demoappv10
spec:
  progressDeadlineSeconds: 600
  replicas: 3
  selector:
    matchLabels:
      app: demoapp
      version: v1.0
  template:
    metadata:
      labels:
        app: demoapp
        version: v1.0
    spec:
      containers:
      - image: ikubernetes/demoapp:v1.0
        imagePullPolicy: IfNotPresent
        name: demoapp
        env:
        - name: "PORT"
          value: "8080"
        ports:
        - containerPort: 8080
          name: web
          protocol: TCP
        resources:
          limits:
            cpu: 50m
---
apiVersion: v1
kind: Service
metadata:
  name: demoappv10
spec:
  ports:
    - name: http
      port: 8080
      protocol: TCP
      targetPort: 8080
  selector:
    app: demoapp
    version: v1.0
  type: ClusterIP
---

root@master01:/opt/istio-in-practise/Traffic-Management-Basics/ms-demo/02-demoapp-v11# cat deploy-demoapp-v11.yaml
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: demoappv11
    version: v1.1
  name: demoappv11
spec:
  progressDeadlineSeconds: 600
  replicas: 2
  selector:
    matchLabels:
      app: demoapp
      version: v1.1
  template:
    metadata:
      labels:
        app: demoapp
        version: v1.1
    spec:
      containers:
      - image: ikubernetes/demoapp:v1.1
        imagePullPolicy: IfNotPresent
        name: demoapp
        env:
        - name: "PORT"
          value: "8080"
        ports:
        - containerPort: 8080
          name: web
          protocol: TCP
        resources:
          limits:
            cpu: 50m
---
apiVersion: v1
kind: Service
metadata:
  name: demoappv11
spec:
  ports:
    - name: http-8080
      port: 8080
      protocol: TCP
      targetPort: 8080
  selector:
    app: demoapp
    version: v1.1
  type: ClusterIP
---

root@master01:/opt/istio-in-practise/Traffic-Management-Basics/ms-demo/02-demoapp-v11# cat service-demoapp.yaml
---
apiVersion: v1
kind: Service
metadata:
  name: demoapp
spec:
  ports:
    - name: http
      port: 8080
      protocol: TCP
      targetPort: 8080
  selector:
    app: demoapp
  type: ClusterIP
---

root@master01:/opt/istio-in-practise/Traffic-Management-Basics/ms-demo/03-demoapp-subset# cat destinationrule-demoapp.yaml 
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: demoapp
spec:
  host: demoapp
  subsets:
  - name: v10
    labels:
      version: v1.0
  - name: v11
    labels:
      version: v1.1

root@master01:/opt/istio-in-practise/Traffic-Management-Basics/ms-demo/06-weight-based-routing# cat virtualservice-demoapp.yaml 
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: demoapp
spec:
  hosts:
  - demoapp
  http:
  - name: weight-based-routing
    route:
    - destination:
        host: demoapp
        subset: v10
      weight: 90
    - destination:
        host: demoapp
        subset: v11
      weight: 10

1.1 Istio认证机制

 Istio沿用了Envoy所支持的认证方式，它为网格内的服务提供两种身份验证机制

　　◼ Peer authentication：即service-to-service身份验证，或简称为服务认证，用以验证发起连接请求的客户端；为此，Istio支持双向TLS认证，即mTLS，以实现如下特性

　　　　◆ 为每个服务提供一个专用的可表示其角色的身份标识，以实现跨集群和跨云的互操作；

　　　　◆ 安全实现service-to-service通信；

　　　　◆ 提供密钥管理系统以自动完成密钥和证书生成、分发及轮替；

　　◼ Request authentication：也称为最终用户认证，它将发出请求的原始客户端认证为最终用户或设备；

　　　　◆ Istio基于JWT验证机制启用请求级身份认证功能

　　　　◆ 支持使用自定义的身份认证服务，或任何中OIDC认证系统，例如Keycloak、Auth0、Firebase Auth等

 Istio将身份认证策略通过Kubernetes API存储于Istio configuration storage之中

　　◼ istiod负责确诊每个代理保持最新状态，并在适当时提供密钥；

　　◼ Istio的认证机制还支持许可模式（permissive mode）

1.2 Peer Authentication Policy 使用要点

Peer Authentication Policy负责为工作负载指定其作为服务器端时实施TLS通信的方式，它支持如下模式

　　◼ PERMISSIVE：工作负载支持mTLS流量和纯文本（明文）流量，通常仅应该于将应用迁移至网格过程中的过渡期间使用；默认

　　◼ STRICT：工作负载仅支持mTLS流量；

　　◼ DISABLE：禁用mTLS；

　　◼ UNSET：从上级继承认证策略的设定；

 另外，在使用了非空selector（即特定于某工作负载）的Peer Authentication Policy上，还可以为不同的端口指定不同的mTLS设定；

1.3 默认都能访问，区别明文密文

root@client /# while true;do curl demoappv10:8080;sleep 1;done

root@master01:~# kubectl get po -owide
NAME                          READY   STATUS    RESTARTS   AGE   IP              NODE             NOMINATED NODE   READINESS GATES
client                        2/2     Running   0          10m   10.200.59.214   192.168.80.203   <none>           <none>
root@master02:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.200.59.214   0.0.0.0         255.255.255.255 UH    0      0        0 calia7a3e029a7b

root@master02:~# tcpdump -i calia7a3e029a7b -nn -X tcp port 8080   #默认envoy全网格密文
                          端口   以数字的形式显示ip和端口 明文密文显示  协议和端口 

    0x0000:  4500 0468 7741 4000 4006 7c95 0ac8 3bd6  E..hwA@.@.|...;.
    0x0010:  0ac8 f153 8196 1f90 512e 201f 3d2e 55cf  ...S....Q...=.U.
    0x0020:  8018 01f6 4714 0000 0101 080a 9af3 69ef  ....G.........i.
    0x0030:  e878 8585 1703 0304 2f00 0000 0000 0000  .x....../.......

root@master01:~# kubectl run client-test --image=ikubernetes/admin-box:v1.2  --restart=Never -it -n test --command -- /bin/bash

root@client-test # while true;do curl demoapp.default:8080;sleep 1;done
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-9r4l7, ServerIP: 10.200.241.90!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-gqdw8, ServerIP: 10.200.241.86!

root@master03:~# tcpdump -i cali71173565fbc -nn -X tcp port 8080  #test 名称空间明文

PeerAuthentication CR

root@master01:/opt/istio-in-practise/Security/01-PeerAuthentication-Policy-Basics# cat 01-namespace-default-peerauthn.yaml 
---
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: default
spec:
  mtls:
    mode: PERMISSIVE
---

root@master01:/opt/istio-in-practise/Security/01-PeerAuthentication-Policy-Basics# kubectl get sa -A |grep  default
default                default                                1         2d19h
istio-system           default                                1         47h
kube-node-lease        default                                1         2d19h
kube-public            default                                1         2d19h
kube-system            default                                1         2d19h
kubernetes-dashboard   default                                1         2d19h
test                   default                                1         4h50m

1.4 pa strict,同名称空间可以，不同名称空间不能访问

demoapp服务

root@master01:/opt/istio-in-practise/Security/01-PeerAuthentication-Policy-Basics# cat 03-destinationrule-demoapp-mtls.yaml 
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: demoapp
spec:
  host: demoapp
  trafficPolicy:
    loadBalancer:
      simple: LEAST_CONN
#    tls:
#      mode: ISTIO_MUTUAL
  subsets:
  - name: v10
    labels:
      version: v1.0
  - name: v11
    labels:
      version: v1.1

root@master01:/opt/istio-in-practise/Security/01-PeerAuthentication-Policy-Basics# cat 02-demoapp-peerauthn.yaml 
---
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: demoapp
  namespace: default
spec:
  selector:
    matchLabels:
      app: demoapp
  mtls:
    mode: STRICT
---

root@client /# while true;do curl demoapp:8080;sleep 1;done   #能建立mtls的可以访问
iKubernetes demoapp v1.1 !! ClientIP: 127.0.0.6, ServerName: demoappv11-7984f579f5-8lw2z, ServerIP: 10.200.241.103!
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.6, ServerName: demoappv10-6ff964cbff-njq8q, ServerIP: 10.200.241.102!

root@client-test /# while true;do curl demoapp.default:8080;sleep 1;done   #不能建立mtls的禁止访问
curl: (56) Recv failure: Connection reset by peer
curl: (56) Recv failure: Connection reset by peer

proxy服务

root@master01:/opt/istio-in-practise/Security/01-PeerAuthentication-Policy-Basics# cat 04-proxy-peerauthn.yaml 
---
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: proxy
  namespace: default
spec:
  selector:
    matchLabels:
      app: proxy
  mtls:
    mode: STRICT
---

1.5 DR+PA

客户端可用的TLS模式

　　◼ DISABLE：禁止同上游端点创建TLS连接；

　　◼ SIMPLE：向上游发起一个TLS连接（单向验证服务端的证书）；

　　◼ MUTUAL：同上游建立双向认证的TLS连接，向上游提供客户端证书由clientCertificate字段指定；

　　◼ ISTIO_MUTIAL：同上游建立双向认证的TLS连接，但会使用由Istio自动生成的证书；因此，该模式要求

ClientTLSSettings字段中嵌套其它字段统统使用空值；

DestinationRule上的TLS客户端与PeerAuthentication上的TLS服务端的组合要点：

　　◆PeerAuthentication使用PERMISSIVE时，DestinationRule可以使用任意模式；

　　◆PeerAuthentication使用STRICT时，DestinationRule可以使用MUTUAL或ISTIO_MUTUAL；

　　◆PeerAuthentication使用DISABLE时，DestinationRule也需要使用DISABLE模式；

root@master01:/opt/istio-in-practise/Security/01-PeerAuthentication-Policy-Basics# kubectl delete -f 02-demoapp-peerauthn.yaml 
---
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: demoapp
  namespace: default
spec:
  selector:
    matchLabels:
      app: demoapp
  mtls:
    mode: STRICT
---

root@master01:/opt/istio-in-practise/Security/01-PeerAuthentication-Policy-Basics# cat 03-destinationrule-demoapp-mtls.yaml 
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: demoapp
spec:
  host: demoapp
  trafficPolicy:
    loadBalancer:
      simple: LEAST_CONN
    tls:
      mode: ISTIO_MUTUAL
  subsets:
  - name: v10
    labels:
      version: v1.0
  - name: v11
    labels:
      version: v1.1

不同名称空间密文通信

root@master01:/opt/istio-in-practise/Security/01-PeerAuthentication-Policy-Basics# cat 05-destinationrule-demoapp-tls-disable.yaml 
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: demoapp
spec:
  host: demoapp
  trafficPolicy:
    loadBalancer:
      simple: LEAST_CONN
    tls:
      mode: DISABLE
  subsets:
  - name: v10
    labels:
      version: v1.0
  - name: v11
    labels:
      version: v1.1

不同名称空间也是明文通信

总结

PA定义服务端tls通信模式，DR定义客户端tls模式

PA STRICT 能建立mtls的可以访问，不能建立mtls的不能访问

PA PERMISSIVE DR mtls 都能访问，能建立双向mtls的加密访问，不能建立双向mtls的明文访问

PA PERMISSIVE DR disable 都能访问，能建立双向mtls的明文访问，不能建立双向mtls的明文访问

posted @ 2022-02-12 22:21 gg888666 阅读(114) 评论(0) 编辑收藏举报

刷新页面返回顶部

登录后才能查看或发表评论，立即登录或者逛逛博客园首页

相关博文：

· Request Authentication

· Muliti-Cluster-demo

· Istio(八)：istio安全之认证，启用mTLS

· Peer Authentication Policy使用要点测试案例

· Isito 入门（九）：安全认证

公告

昵称： gg888666
园龄： 5年5个月
粉丝： 4
关注： 2

+加关注

2025年3月

日

一

二

三

四

五

六

gg888666

Istio Security 基础

环境

配置

1.1 Istio认证机制

1.2 Peer Authentication Policy 使用要点

1.3 默认都能访问，区别明文密文

1.4 pa strict,同名称空间可以，不同名称空间不能访问

1.5 DR+PA

总结

公告

搜索

常用链接

随笔分类

随笔档案

阅读排行榜

目录导航