istio - Knative Service to Service 通信的 Istio 授权

Question

我无法为 Knative 服务启用 Istio 授权以进行服务通信。

采取的步骤：

安装 Istio 并使用 STRICT 模式启用 mTLS
安装了 Knative 并启用了 mTLS PERMISSIVE [https://knative.dev/docs/serving/istio-authorization/]，因为请求可能由激活器基于 TargetBurstCapacity 转发。
创建了两个命名空间 serving-test1 & serving-test2
启用 istio sidecar 注入并在 serving-test1 和 serving-test2 中部署 Hello 服务 ** 忽略代码中使用的 IP，因为我尝试使用内部负载均衡器 IP。

期待：

访问服务测试 2 中的服务时，服务测试 1 中的服务应该拒绝 RBAC 访问
反之亦然#1

实际结果：

serving-test1 中的服务能够与 serving-test2 中的服务通信，反之亦然。

我也尝试使用 host="*.local" 和 tls mode=ISTIO_MUTUAL 添加目标规则，但没有运气。任何帮助表示赞赏。

下面完成安装和测试脚本。

export ISTIO_VERSION="1.8.2"
curl -L https://istio.io/downloadIstio | ISTIO_VERSION=${ISTIO_VERSION} TARGET_ARCH=x86_64 sh -
export PATH="$PATH:istio-${ISTIO_VERSION}/bin"
export ISTIO_HOME=istio-${ISTIO_VERSION}/
cat <<EOF > istio-minimal-operator.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  values:
    global:
      proxy:
        autoInject: enabled
      useMCP: false
      jwtPolicy: first-party-jwt
    meshConfig:
      enableAutoMtls: true
  addonComponents:
    pilot:
      enabled: true
  components:
    ingressGateways:
      - name: istio-ingressgateway
        enabled: true
        k8s:
          service:
            type: LoadBalancer
            loadBalancerIP: "10.173.128.70"
EOF

istioctl install -y -f istio-minimal-operator.yaml
kubectl -n istio-system annotate service istio-ingressgateway cloud.google.com/load-balancer-type=Internal --overwrite
kubectl ${OPERATION:-apply} -f - <<EOF
apiVersion: "security.istio.io/v1beta1"
kind: "PeerAuthentication"
metadata:
  name: "default"
  namespace: istio-system
spec:
  mtls:
    mode: STRICT
EOF


kubectl create namespace serving-test1
kubectl create namespace serving-test2
kubectl create namespace knative-serving
kubectl label namespace serving-test1 istio-injection=enabled
kubectl label namespace serving-test2 istio-injection=enabled
kubectl label namespace knative-serving istio-injection=enabled


export KNATIVE_VERSION="v0.20.0"
kubectl apply -f https://github.com/knative/serving/releases/download/${KNATIVE_VERSION}/serving-crds.yaml
kubectl apply -f https://github.com/knative/serving/releases/download/${KNATIVE_VERSION}/serving-core.yaml
kubectl apply -f https://github.com/knative/net-istio/releases/download/${KNATIVE_VERSION}/release.yaml

kubectl ${OPERATION:-apply} -f - <<EOF
apiVersion: "security.istio.io/v1beta1"
kind: "PeerAuthentication"
metadata:
  name: "default"
  namespace: "knative-serving"
spec:
  mtls:
    mode: PERMISSIVE
EOF

cat <<EOF | kubectl ${OPERATION:-apply} -f -
apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  labels:
    app: hello
  name: hello
  namespace: serving-test1
spec:
  template:
    metadata:
      annotations:
        autoscaling.knative.dev/minScale: "1"
    spec:
      containers:
      - env:
        - name: TARGET
          value: Go Sample v1
        image: gcr.io/knative-samples/helloworld-go
        name: user-container
---
apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  labels:
    app: hello
  name: hello
  namespace: serving-test2
spec:
  template:
    metadata:
      annotations:
        autoscaling.knative.dev/minScale: "1"
    spec:
      containers:
      - env:
        - name: TARGET
          value: Go Sample v2
        image: gcr.io/knative-samples/helloworld-go
        name: user-container
EOF

kubectl -n serving-test1 exec -it $(kubectl -n serving-test1 get pod -o jsonpath='{.items[0].metadata.name}') -- bash
curl -H "Host: hello.serving-test2.example.com" http://10.173.128.70
curl -H "Host: hello.serving-test2.example.com" http://istio-ingressgateway.istio-system.svc.cluster.local
curl -H "Host: hello.serving-test2.example.com" http://knative-local-gateway.istio-system.svc.cluster.local
curl http://hello.serving-test2.svc.cluster.local

kubectl -n serving-test2 exec -it $(kubectl -n serving-test2 get pod -o jsonpath='{.items[0].metadata.name}') -- bash
curl -H "Host: hello.serving-test1.example.com" http://10.173.128.70
curl -H "Host: hello.serving-test1.example.com" http://istio-ingressgateway.istio-system.svc.cluster.local
curl -H "Host: hello.serving-test1.example.com" http://knative-local-gateway.istio-system.svc.cluster.local
curl http://hello.serving-test1.svc.cluster.local


kubectl ${OPERATION:-apply} -f - <<EOF
apiVersion: "security.istio.io/v1beta1"
kind: "PeerAuthentication"
metadata:
  name: "default"
  namespace: serving-test1
spec:
  mtls:
    mode: STRICT
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-all
  namespace: serving-test1
spec:
  {}
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: allow-serving-tests
 namespace: serving-test1
spec:
 action: ALLOW
 rules:
 - from:
   - source:
      namespaces: ["serving-test1", "knative-serving"]
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allowlist-by-paths
  namespace: serving-test1
spec:
  action: ALLOW
  rules:
  - to:
    - operation:
        paths:
        - /metrics
        - /healthz
---
apiVersion: "security.istio.io/v1beta1"
kind: "PeerAuthentication"
metadata:
  name: "default"
  namespace: "serving-test2"
spec:
  mtls:
    mode: STRICT
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-all
  namespace: serving-test2
spec:
  {}
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: allow-serving-tests
 namespace: serving-test2
spec:
 action: ALLOW
 rules:
 - from:
   - source:
      namespaces: ["serving-test2", "knative-serving"]
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allowlist-by-paths
  namespace: serving-test2
spec:
  action: ALLOW
  rules:
  - to:
    - operation:
        paths:
        - /metrics
        - /healthz
EOF

istio - Knative Service to Service 通信的 Istio 授权

0 回答 0

Related

Reference