一簿训、Envoy安全示例
- https-https-proxy
cd servicemesh_in_practise/Envoy-Mesh/https-https-proxy
# 啟動(dòng)
docker-compose up
# 驗(yàn)證
curl -k https://172.31.8.2:8443
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.1, ServerName: webserver02, ServerIP: 172.31.8.12!
# 查看證書
curl http://172.31.8.12:9901/certs
{
"certificates": [
{
"ca_cert": [],
"cert_chain": [
{
"path": "/etc/envoy/certs/webserver.crt",
"serial_number": "494ead58e545b429fa3fbebd5fe053797543dd1f",
"subject_alt_names": [],
"days_until_expiration": "3298",
"valid_from": "2021-05-19T04:25:28Z",
"expiration_time": "2031-05-17T04:25:28Z"
}
]
}
]
}
- https-passthrough
cd servicemesh_in_practise/Envoy-Mesh/https-passthrough
# 啟動(dòng)
docker-compose up
# 驗(yàn)證
curl -k https://172.31.9.2:8443
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.1, ServerName: webserver01, ServerIP: 172.31.9.11!
- tls-static
cd servicemesh_in_practise/Security/tls-static
# 啟動(dòng)
docker-compose up
# 驗(yàn)證
curl 172.31.90.10:9901/listeners
listener_http::0.0.0.0:80
listener_https::0.0.0.0:443
# 查看服務(wù)跳轉(zhuǎn)
curl -I 172.31.90.10
HTTP/1.1 301 Moved Permanently
location: https://172.31.90.10:443/
date: Fri, 06 May 20xx xx:39:45 GMT
server: envoy
transfer-encoding: chunked
# 查看https服務(wù)
curl -k -I https://172.31.90.10:443
HTTP/1.1 200 OK
content-type: text/html; charset=utf-8
content-length: 75
server: envoy
date: Fri, 06 May 20xx xx:41:17 GMT
x-envoy-upstream-service-time: 1013
# 驗(yàn)證服務(wù)
curl -k https://172.31.90.10/service/gray
Hello from App behind Envoy (service gray)! hostname: e6c9e46ddb6a resolved hostname: 172.31.90.15
curl -k https://172.31.90.10/service/purple
Hello from App behind Envoy (service purple)! hostname: f9fd24599831 resolved hostname: 172.31.90.16
- spire-example
cd servicemesh_in_practise/Security/spire-example
# 啟動(dòng)
bash build.sh
docker-compose up
bash 1-start-services.sh
bash 2-start-spire-agents.sh
bash 3-create-registration-entries.sh
驗(yàn)證
image.png
image.png
二柳洋、部署Istio
wget https://github.com/istio/istio/releases/download/1.13.3/istio-1.13.3-linux-amd64.tar.gz
tar xf istio-1.13.3-linux-amd64.tar.gz
ln -sf istio-1.13.3/bin/istioctl /usr/local/bin/
# 安裝
istioctl install -y --set profile=demo
? Istio core installed
? Istiod installed
? Ingress gateways installed
? Egress gateways installed
? Installation complete Making this installation the default for injection and validation.
Thank you for installing Istio 1.13. Please take a few minutes to tell us about your install/upgrade experience! https://forms.gle/pzWZpAvMVBecaQ9h9
# 部署配件
kubectl apply -f samples/addons/
serviceaccount/grafana created
configmap/grafana created
service/grafana created
deployment.apps/grafana created
configmap/istio-grafana-dashboards created
configmap/istio-services-grafana-dashboards created
deployment.apps/jaeger created
service/tracing created
service/zipkin created
service/jaeger-collector created
serviceaccount/kiali created
configmap/kiali created
clusterrole.rbac.authorization.k8s.io/kiali-viewer created
clusterrole.rbac.authorization.k8s.io/kiali created
clusterrolebinding.rbac.authorization.k8s.io/kiali created
role.rbac.authorization.k8s.io/kiali-controlplane created
rolebinding.rbac.authorization.k8s.io/kiali-controlplane created
service/kiali created
deployment.apps/kiali created
serviceaccount/prometheus created
configmap/prometheus created
clusterrole.rbac.authorization.k8s.io/prometheus created
clusterrolebinding.rbac.authorization.k8s.io/prometheus created
service/prometheus created
deployment.apps/prometheus created
# 驗(yàn)證
kubectl -n istio-system get po
NAME READY STATUS RESTARTS AGE
grafana-67f5ccd9d7-lzrwm 1/1 Running 0 6m44s
istio-egressgateway-7569bf4864-q5txl 1/1 Running 0 7m57s
istio-ingressgateway-5d6f5f9d78-fmfdp 1/1 Running 0 7m57s
istiod-d56576b74-4nr7g 1/1 Running 0 9m14s
jaeger-78cb4f7d4b-wr8gt 1/1 Running 0 6m44s
kiali-c946fb5bc-m8dfh 1/1 Running 0 6m43s
prometheus-7cc96d969f-5qx24 2/2 Running 0 6m42s
# 給default命名空間打標(biāo)簽谆沃，在這個(gè)命名空間啟動(dòng)的容器快骗，都會(huì)自動(dòng)注入sidecar的容器
kubectl label namespace default istio-injection=enabled
namespace/default labeled
# 驗(yàn)證
kubectl apply -f samples/sleep/sleep.yaml
serviceaccount/sleep created
service/sleep created
deployment.apps/sleep created
kubectl get po
NAME READY STATUS RESTARTS AGE
sleep-698cfc4445-ldm4l 2/2 Running 0 90s
# 查看pod同步到istio信息
istioctl ps
NAME CLUSTER CDS LDS EDS RDS ISTIOD VERSION
istio-egressgateway-7569bf4864-q5txl.istio-system Kubernetes SYNCED SYNCED SYNCED NOT SENT istiod-d56576b74-4nr7g 1.13.3
istio-ingressgateway-5d6f5f9d78-fmfdp.istio-system Kubernetes SYNCED SYNCED SYNCED NOT SENT istiod-d56576b74-4nr7g 1.13.3
sleep-698cfc4445-ldm4l.default Kubernetes SYNCED SYNCED SYNCED SYNCED istiod-d56576b74-4nr7g 1.13.3
# 查看listener信息
istioctl pc listener sleep-698cfc4445-ldm4l
ADDRESS PORT MATCH DESTINATION
10.96.0.10 53 ALL Cluster: outbound|53||kube-dns.kube-system.svc.cluster.local
0.0.0.0 80 Trans: raw_buffer; App: http/1.1,h2c Route: 80
0.0.0.0 80 ALL PassthroughCluster
10.100.213.173 443 ALL Cluster: outbound|443||istio-ingressgateway.istio-system.svc.cluster.local
10.106.15.6 443 ALL Cluster: outbound|443||istiod.istio-system.svc.cluster.local
10.108.102.187 443 ALL Cluster: outbound|443||istio-egressgateway.istio-system.svc.cluster.local
10.96.0.1 443 ALL Cluster: outbound|443||kubernetes.default.svc.cluster.local
10.100.69.105 3000 Trans: raw_buffer; App: http/1.1,h2c Route: grafana.istio-system.svc.cluster.local:3000
10.100.69.105 3000 ALL Cluster: outbound|3000||grafana.istio-system.svc.cluster.local
0.0.0.0 9090 Trans: raw_buffer; App: http/1.1,h2c Route: 9090
0.0.0.0 9090 ALL PassthroughCluster
10.96.0.10 9153 Trans: raw_buffer; App: http/1.1,h2c Route: kube-dns.kube-system.svc.cluster.local:9153
10.96.0.10 9153 ALL Cluster: outbound|9153||kube-dns.kube-system.svc.cluster.local
0.0.0.0 9411 Trans: raw_buffer; App: http/1.1,h2c Route: 9411
0.0.0.0 9411 ALL PassthroughCluster
10.106.78.117 14250 Trans: raw_buffer; App: http/1.1,h2c Route: jaeger-collector.istio-system.svc.cluster.local:14250
10.106.78.117 14250 ALL Cluster: outbound|14250||jaeger-collector.istio-system.svc.cluster.local
10.106.78.117 14268 Trans: raw_buffer; App: http/1.1,h2c Route: jaeger-collector.istio-system.svc.cluster.local:14268
10.106.78.117 14268 ALL Cluster: outbound|14268||jaeger-collector.istio-system.svc.cluster.local
0.0.0.0 15001 ALL PassthroughCluster
0.0.0.0 15001 Addr: *:15001 Non-HTTP/Non-TCP
0.0.0.0 15006 Addr: *:15006 Non-HTTP/Non-TCP
0.0.0.0 15006 Trans: tls; App: istio-http/1.0,istio-http/1.1,istio-h2; Addr: 0.0.0.0/0 InboundPassthroughClusterIpv4
0.0.0.0 15006 Trans: raw_buffer; App: http/1.1,h2c; Addr: 0.0.0.0/0 InboundPassthroughClusterIpv4
0.0.0.0 15006 Trans: tls; App: TCP TLS; Addr: 0.0.0.0/0 InboundPassthroughClusterIpv4
0.0.0.0 15006 Trans: raw_buffer; Addr: 0.0.0.0/0 InboundPassthroughClusterIpv4
0.0.0.0 15006 Trans: tls; Addr: 0.0.0.0/0 InboundPassthroughClusterIpv4
0.0.0.0 15006 Trans: tls; App: istio,istio-peer-exchange,istio-http/1.0,istio-http/1.1,istio-h2; Addr: *:80 Cluster: inbound|80||
0.0.0.0 15006 Trans: raw_buffer; Addr: *:80 Cluster: inbound|80||
0.0.0.0 15010 Trans: raw_buffer; App: http/1.1,h2c Route: 15010
0.0.0.0 15010 ALL PassthroughCluster
10.106.15.6 15012 ALL Cluster: outbound|15012||istiod.istio-system.svc.cluster.local
0.0.0.0 15014 Trans: raw_buffer; App: http/1.1,h2c Route: 15014
0.0.0.0 15014 ALL PassthroughCluster
0.0.0.0 15021 ALL Inline Route: /healthz/ready*
10.100.213.173 15021 Trans: raw_buffer; App: http/1.1,h2c Route: istio-ingressgateway.istio-system.svc.cluster.local:15021
10.100.213.173 15021 ALL Cluster: outbound|15021||istio-ingressgateway.istio-system.svc.cluster.local
0.0.0.0 15090 ALL Inline Route: /stats/prometheus*
10.100.213.173 15443 ALL Cluster: outbound|15443||istio-ingressgateway.istio-system.svc.cluster.local
0.0.0.0 16685 Trans: raw_buffer; App: http/1.1,h2c Route: 16685
0.0.0.0 16685 ALL PassthroughCluster
0.0.0.0 20001 Trans: raw_buffer; App: http/1.1,h2c Route: 20001
0.0.0.0 20001 ALL PassthroughCluster
10.100.213.173 31400 ALL Cluster: outbound|31400||istio-ingressgateway.istio-system.svc.cluster.local
# 查看cluster
istioctl pc cluster sleep-698cfc4445-ldm4l.default
SERVICE FQDN PORT SUBSET DIRECTION TYPE DESTINATION RULE
80 - inbound ORIGINAL_DST
BlackHoleCluster - - - STATIC
InboundPassthroughClusterIpv4 - - - ORIGINAL_DST
PassthroughCluster - - - ORIGINAL_DST
agent - - - STATIC
grafana.istio-system.svc.cluster.local 3000 - outbound EDS
istio-egressgateway.istio-system.svc.cluster.local 80 - outbound EDS
istio-egressgateway.istio-system.svc.cluster.local 443 - outbound EDS
istio-ingressgateway.istio-system.svc.cluster.local 80 - outbound EDS
istio-ingressgateway.istio-system.svc.cluster.local 443 - outbound EDS
istio-ingressgateway.istio-system.svc.cluster.local 15021 - outbound EDS
istio-ingressgateway.istio-system.svc.cluster.local 15443 - outbound EDS
istio-ingressgateway.istio-system.svc.cluster.local 31400 - outbound EDS
istiod.istio-system.svc.cluster.local 443 - outbound EDS
istiod.istio-system.svc.cluster.local 15010 - outbound EDS
istiod.istio-system.svc.cluster.local 15012 - outbound EDS
istiod.istio-system.svc.cluster.local 15014 - outbound EDS
jaeger-collector.istio-system.svc.cluster.local 9411 - outbound EDS
jaeger-collector.istio-system.svc.cluster.local 14250 - outbound EDS
jaeger-collector.istio-system.svc.cluster.local 14268 - outbound EDS
kiali.istio-system.svc.cluster.local 9090 - outbound EDS
kiali.istio-system.svc.cluster.local 20001 - outbound EDS
kube-dns.kube-system.svc.cluster.local 53 - outbound EDS
kube-dns.kube-system.svc.cluster.local 9153 - outbound EDS
kubernetes.default.svc.cluster.local 443 - outbound EDS
prometheus.istio-system.svc.cluster.local 9090 - outbound EDS
prometheus_stats - - - STATIC
sds-grpc - - - STATIC
sleep.default.svc.cluster.local 80 - outbound EDS
tracing.istio-system.svc.cluster.local 80 - outbound EDS
tracing.istio-system.svc.cluster.local 16685 - outbound EDS
xds-grpc - - - STATIC
zipkin - - - STRICT_DNS
zipkin.istio-system.svc.cluster.local 9411 - outbound EDS
# 查看route信息
istioctl pc route sleep-698cfc4445-ldm4l.default
NAME DOMAINS MATCH VIRTUAL SERVICE
* /healthz/ready*
istio-ingressgateway.istio-system.svc.cluster.local:15021 * /*
80 istio-egressgateway.istio-system, 10.108.102.187 /*
80 istio-ingressgateway.istio-system, 10.100.213.173 /*
80 sleep, sleep.default + 1 more... /*
80 tracing.istio-system, 10.97.164.49 /*
InboundPassthroughClusterIpv4 * /*
jaeger-collector.istio-system.svc.cluster.local:14250 * /*
inbound|80|| * /*
inbound|80|| * /*
InboundPassthroughClusterIpv4 * /*
jaeger-collector.istio-system.svc.cluster.local:14268 * /*
grafana.istio-system.svc.cluster.local:3000 * /*
kube-dns.kube-system.svc.cluster.local:9153 * /*
9090 kiali.istio-system, 10.107.148.152 /*
9090 prometheus.istio-system, 10.106.229.76 /*
9411 jaeger-collector.istio-system, 10.106.78.117 /*
9411 zipkin.istio-system, 10.99.122.65 /*
15010 istiod.istio-system, 10.106.15.6 /*
15014 istiod.istio-system, 10.106.15.6 /*
16685 tracing.istio-system, 10.97.164.49 /*
20001 kiali.istio-system, 10.107.148.152 /*
* /stats/prometheus*
istio官網(wǎng)：https://istio.io/latest/docs/setup/getting-started/
三纫谅、頁面展示
- kiali
# 下載示例代碼
git clone https://github.com/iKubernetes/istio-in-practise.git
cd istio-in-practise/Traffic-Management-Basics/kiali-80
kubectl apply -f .
添加域名解析株旷，訪問kiali
image.png
image.png
image.png
- prometheus
cd istio-in-practise/Traffic-Management-Basics/prometheus
kubectl apply -f .
添加域名解析再登，訪問prometheus
image.png
- grafana
cd istio-in-practise/Traffic-Management-Basics/grafana
kubectl apply -f .
添加域名解析，訪問grafana
image.png
- jaeger
cd istio-in-practise/Traffic-Management-Basics/tracing
kubectl apply -f .
添加域名解析晾剖，訪問jaeger
image.png
