How do I properly HTTPS secure an application when using Istio?

情到浓时终转凉″ 提交于 2021-02-19 06:04:38

问题


I'm currently trying to wrap my head around how the typical application flow looks like for a kubernetes application in combination with Istio.

So, for my app I have an asp.net application hosted within a Kubernetes cluster, and I added Istio on top. Here is my gateway & VirtualService:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: appgateway
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "*"
      tls:
        httpsRedirect: true
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
        privateKey: /etc/istio/ingressgateway-certs/tls.key
      hosts:
        - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: appvservice
spec:
  hosts:
    - "*"
  gateways:
    - appgateway
  tls:
    - match:
        - port: 443
          sniHosts:
            - "*"
      route:
        - destination:
            host: frontendservice.default.svc.cluster.local
            port:
              number: 443

This is what I came up with after reading through the Istio documentation.

Note that my frontendservice is a very basic ClusterIP service routing to an Asp.Net application which also offers standard 80 / 443 ports.

I have a few questions now:

  • Is this the proper approach to securing my application? In essence I want to redirect incoming traffic on port 80 straight to https enabled 443 right at the edge. However, when I try this, there's no redirect going on on port 80 at all.
  • Also, the tls route on my VirtualService does not work. There's just no traffic ending up on my pod
  • I'm also wondering, is it necessary to even manually add HTTPs to my internal applications, or is this something where Istios internal CA functionality comes in?

I have imagined it to work like this:

  1. Request comes in. If it's on port 80, send a redirect to the client in order to send a https request. If it's on port 443, allow the request.
  2. The VirtualService providers the instructions what should happen with requests on port 443, and forward it to the service.
  3. The service now forwards the request to my app's 443 port.

Thanks in advance - I'm just learning Istio, and I'm a bit baffled why my seemingly proper setup does not work here.


回答1:


Your Gateway terminates TLS connections, but your VirtualService is configured to accept unterminated TLS connections with TLSRoute.

Compare the example without TLS termination and the example which terminates TLS. Most probably, the "default" setup would be to terminate the TLS connection and configure the VirtualService with a HTTPRoute.




回答2:


We are also using a similar setup.

  • SSL is terminated on ingress gateway, but we use mTLS mode via Gateway CR.
  • Services are listening on non-ssl ports but sidecars use mTLS between them so that any container without sidecar cannot talk to service.
  • VirtualService is routing to non-ssl port of service.
  • Sidecar CR intercepts traffic going to and from non-ssl port of service.
  • PeerAuthentication sets mTLS between sidecars.


来源:https://stackoverflow.com/questions/65836627/how-do-i-properly-https-secure-an-application-when-using-istio

标签
易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!