Istio Security Mission

Purpose

Showcase Istio TLS and ACL via a set of Spring Boot applications.

Prerequisites

Openshift 3.10 cluster
Istio 1.0.x installed on the aforementioned cluster using the Istio Operator.
1. Follow these instructions for more information about the Operator
Login to the cluster with the admin user

Environment preparation

Create a new project/namespace on the cluster. This is where your application will be deployed.

oc new-project <whatever valid project name you want>

Build and deploy the application

With Fabric8 Maven Plugin (FMP)

Execute the following command to build the project and deploy it to OpenShift:

mvn clean fabric8:deploy -Popenshift

Configuration for FMP may be found both in pom.xml and src/main/fabric8 files/folders.

This configuration is used to define service names and deployments that control how pods are labeled/versioned on the OpenShift cluster.

With Source to Image build (S2I)

Run the following commands to apply and execute the OpenShift templates that will configure and deploy the applications:

find . | grep openshiftio | grep application | xargs -n 1 oc apply -f

oc new-app --template=spring-boot-istio-security-name -p SOURCE_REPOSITORY_URL=https://github.com/snowdrop/istio-security-example -p SOURCE_REPOSITORY_REF=master -p SOURCE_REPOSITORY_DIR=spring-boot-istio-security-name
oc new-app --template=spring-boot-istio-security-greeting -p SOURCE_REPOSITORY_URL=https://github.com/snowdrop/istio-security-example -p SOURCE_REPOSITORY_REF=master -p SOURCE_REPOSITORY_DIR=spring-boot-istio-security-greeting

Configure Istio gateway

This application uses v1alpha3 routing API. Execute the following command to configure gateway and virtual service:

oc apply -f rules/gateway.yml

Use Cases

Scenario #1. Mutual TLS

This scenario demonstrates a mutual transport level security between the services.

Open the example’s web page via Istio gateway route

echo http://$(oc get route istio-ingressgateway -o jsonpath='{.spec.host}{"\n"}' -n istio-system)/

"Hello, World!" should be returned after invoking greeting service.
Now modify greeting deployment to disable sidecar injection by replacing both sidecar.istio.io/inject values to false
```
oc edit deploymentconfigs/spring-boot-istio-security-greeting
```

Open the example’s web page via greeting service’s route

echo http://$(oc get route spring-boot-istio-security-greeting -o jsonpath='{.spec.host}{"\n"}' -n $(oc project -q))/

Greeting service invocation will fail with a reset connection, because the greeting service has to be inside a service mesh in order to access the name service.

Cleanup by setting sidecar.istio.io/inject values to true

oc edit deploymentconfigs/spring-boot-istio-security-greeting

Scenario #2. Access control

This scenario demonstrates access control when using mutual TLS. In order to access a name service, calling service has to have a specific label and service account name.

Open the example’s web page via Istio gateway route

echo http://$(oc get route istio-ingressgateway -o jsonpath='{.spec.host}{"\n"}' -n istio-system)/

"Hello, World!" should be returned after invoking greeting service.
Configure Istio Mixer to block greeting service from accessing name service
```
oc apply -f rules/block-greeting-service.yml
```
Greeting service invocations to the name service will be forbidden.
Configure Istio Mixer to only allow requests from greeting service and with sa-greeting service account to access name service
```
oc apply -f <(sed -e "s/TARGET_NAMESPACE/$(oc project -q)/g" rules/require-service-account-and-label.yml)
```
"Hello, World!" should be returned after invoking greeting service.

Cleanup

oc delete -f rules/require-service-account-and-label.yml

Remove gateway configuration

oc delete -f rules/gateway.yml

Undeploy the application

With Fabric8 Maven Plugin (FMP)

mvn fabric8:undeploy

With Source to Image build (S2I)

oc delete all --all
find . | grep openshiftio | grep application | xargs -n 1 oc delete -f

Remove the namespace

This will delete the project from the OpenShift cluster

oc delete project <your project name>

Integration tests

To run integration tests, create a new namespace and run maven job

oc new-project <project-name>
mvn clean verify -Popenshift,openshift-it

eye0fra / istio-security-example Goto Github PK

istio-security-example's Introduction

Istio Security Mission

Purpose

Prerequisites

Environment preparation

Build and deploy the application

With Fabric8 Maven Plugin (FMP)

With Source to Image build (S2I)

Configure Istio gateway

Use Cases

Scenario #1. Mutual TLS

Scenario #2. Access control

Remove gateway configuration

Undeploy the application

With Fabric8 Maven Plugin (FMP)

With Source to Image build (S2I)

Remove the namespace

Integration tests

istio-security-example's People

Watchers

Recommend Projects

Recommend Topics

Recommend Org