概述

Istio 為運(yùn)行于不可信環(huán)境內(nèi)的服務(wù)網(wǎng)格提供了無須代碼侵入的安全加固能力。微服務(wù)改造之后，在流量瞒斩、監(jiān)控等基本業(yè)務(wù)目標(biāo)之外抒蚜，安全問題也要引起重視。
原本在單體應(yīng)用內(nèi)通過進(jìn)程內(nèi)訪問控制框架完成的任務(wù)院究，被分散到各個微服中洽瞬；在容器集群中還可能出現(xiàn)不同命名空間及不同業(yè)務(wù)域的互訪問題。
Istio中也提供了無侵入的安全解決方案业汰，能夠提供網(wǎng)格內(nèi)部伙窃、網(wǎng)格和邊緣之間的安全通信和訪問控制能力。

Citadel 提供證書和認(rèn)證管理功能样漆；
Sidecar 建立加密通道为障，為其代理的應(yīng)用進(jìn)行協(xié)議升級，為客戶端和服務(wù)端之間提供基于 mTLS 的加密通信；
Pilot 負(fù)責(zé)傳播加密身份和認(rèn)證策略鳍怨。

實戰(zhàn)

測試默認(rèn)訪問

# http http://httpbin:8000/get
HTTP/1.1 200 OK
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 423
content-type: application/json
date: Wed, 15 Jul 2020 07:19:59 GMT
server: envoy
x-envoy-upstream-service-time: 343
{
    "args": {},
    "headers": {
        "Accept": "*/*",
        "Accept-Encoding": "gzip, deflate",
        "Content-Length": "0",
        "Host": "httpbin:8000",
        "User-Agent": "HTTPie/2.1.0",
        "X-B3-Parentspanid": "18d852cdd8dd75f1",
        "X-B3-Sampled": "0",
        "X-B3-Spanid": "b15acfa72373229e",
        "X-B3-Traceid": "f3146b46ba6fc96f18d852cdd8dd75f1"
    },
    "origin": "127.0.0.1",
    "url": "http://httpbin:8000/get"
}

啟用 mTLS

apiVersion: "authentication.istio.io/v1alpha1"
kind: "MeshPolicy"
metadata:
  name: "default"
spec:
  peers:
    - mtls: {}

測試默認(rèn)訪問

http http://httpbin:8000/get 
HTTP/1.1 503 Service Unavailable
content-length: 57
content-type: text/plain
date: Wed, 15 Jul 2020 07:32:51 GMT
server: envoy

upstream connect error or disconnect/reset before headers

所有的服務(wù)端 Sidecar 都只接受 mTLS 客戶端的接人,客戶端 DestinationRule 對象來顯式聲明這個接人要求:

apiVersion: "networking.istio.io/v1alpha3"
kind: "DestinationRule"
metadata:
  name: "httpbin"
spec:
  host: "httpbin.default.svc.cluster.local"
  trafficPolicy:
   tls:
     mode: ISTIO_MUTUAL

接入dr客戶端測試結(jié)果：


http http://httpbin:8000/get
HTTP/1.1 200 OK
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 708
content-type: application/json
date: Wed, 15 Jul 2020 08:28:36 GMT
server: envoy
x-envoy-upstream-service-time: 37

{
    "args": {},
    "headers": {
        "Accept": "*/*",
        "Accept-Encoding": "gzip, deflate",
        "Content-Length": "0",
        "Host": "httpbin:8000",
        "User-Agent": "HTTPie/2.1.0",
        "X-B3-Parentspanid": "4ac341b2375f5855",
        "X-B3-Sampled": "0",
        "X-B3-Spanid": "ed42d2b48f4873b0",
        "X-B3-Traceid": "e7f321984fc7b4524ac341b2375f5855",
        "X-Forwarded-Client-Cert": "By=spiffe://cluster.local/ns/27a89b94b77f459e81a6010905c33a1e-book2mesh/sa/default;Hash=0861af59ac9db940e67ed01281692b0862568ba08368dd7381ca9f89e532053c;Subject=\"\";URI=spiffe://cluster.local/ns/27a89b94b77f459e81a6010905c33a1e-book2mesh/sa/default"
    },
    "origin": "127.0.0.1",
    "url": "http://httpbin:8000/get"
}

設(shè)置 RBAC

為所有default 命名空間中的服務(wù)都啟動 RBAC 策略:

apiVersion: "rbac.istio.io/v1alpha1"
kind: RbacConfig
metadata:
  name: default
spec:
  mode: "ON_WITH_INCLUSION"
  inclusion:
    namespaces: ["default"]

再次啟動測試：

HTTP/1.1 403 Forbidden
content-length: 19
content-type: text/plain
date: Wed, 15 Jul 2020 08:55:57 GMT
server: envoy
x-envoy-upstream-service-time: 25

RBAC: access denied

RBAC 啟動之后鹅髓，在默認(rèn)情況下，所有服務(wù)的調(diào)用都會被拒絕京景。

一般來說窿冯， RBAC 系統(tǒng)中的授權(quán)過程都是通過以下幾步進(jìn)行設(shè)置的：
-( 1）在系統(tǒng)中定義原子粒度的權(quán)限；
-( 2）將一個或者多個權(quán)限組合為角色
-( 3）將角色和用戶進(jìn)行綁定确徙，從而讓用戶具備綁定的角色所擁有的權(quán)限

設(shè)置service role：

定義service-viewer 角色醒串，在 rules 字段中進(jìn)行授權(quán)，允許該角色使用 GET 方法訪問所有服務(wù)鄙皇。

apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRole
metadata:
  name: service-viewer
spec:
  rules:
  - services:
    - "*"
    methods:
    - "GET"

將上面的角色綁到所有 default 命名空間的ServiceAccount 上：

apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRoleBinding
metadata:
  name: bind-service-viewer
spec:
  subjects:
    - properties:
        source.namespace: "default"
  roleRef:
    kind: ServiceRole
    name: "service-viewer"

subject 用了一個屬性限制來指定綁定目標(biāo)：所有來自 default 命名空間的調(diào)用者的用戶都被綁定 service viewer 這個角色上芜赌。
測試結(jié)果：

http http://httpbin:8000/ip
HTTP/1.1 200 OK
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 28
content-type: application/json
date: Wed, 15 Jul 2020 09:45:14 GMT
server: envoy
x-envoy-upstream-service-time: 6

{
    "origin": "127.0.0.1"
}

測試有沒有授權(quán)的 POST 方法：

http -f POST http http://httpbin:8000/post name=vincent
HTTP/1.1 404 Not Found
connection: close
content-length: 0
date: Wed, 15 Jul 2020 09:47:43 GMT
server: envoy

深入淺出Istio 安全加固

深入淺出Istio 安全加固

概述

實戰(zhàn)

測試默認(rèn)訪問

啟用 mTLS

設(shè)置 RBAC

設(shè)置service role：