下一步

TLS

Ingress支持TLS设置。Istio也支持TLS设置，但相关的secret必须存在istio-ingressgateway deployment所在的命名空间中。可以使用cert-manager生成这些证书。

指定路径类型

默认情况下，Istio会将路径视为完全匹配，如果路径使用/*或*结尾，则该路径为前缀匹配。不支持其他正则匹配。

kubernetes 1.18中新增了一个字段pathType，允许声明为Exact或Prefix。

指定IngressClass

kubernetes 1.18中新增了一个资源IngressClass，替换了Ingress资源的 kubernetes.io/ingress.class annotation。如果使用该资源，则需要将controller设置为istio.io/ingress-controller：

apiVersion: networking.k8s.io/v1beta1
kind: IngressClass
metadata:
  name: istio
spec:
  controller: istio.io/ingress-controller
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: ingress
spec:
  ingressClassName: istio
  ...

卸载

$ kubectl delete ingress ingress
$ kubectl delete --ignore-not-found=true -f samples/httpbin/httpbin.yaml

安全网关

本节讲述如何使用simple或mutual TLS暴露安全的HTTPS服务。证书是通过SDS进行密钥发现的。

TLS需要的私钥，服务端证书，根证书是使用基于文件装载的方法配置的。

执行ingress流量控制中的Before you begin和Determining the ingress IP and ports小节的操作，部署httpbin服务，并获取 INGRESS_HOST 和SECURE_INGRESS_PORT变量。

生成服务端证书和私钥

下面使用openssl生成需要的证书和密钥

1. 生成一个根证书和一个私钥，用于签名服务的证书

   $ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=example Inc./CN=example.com' -keyout example.com.key -out example.com.crt
   

2. 为 httpbin.example.com生成一个证书和私钥

   $ openssl req -out httpbin.example.com.csr -newkey rsa:2048 -nodes -keyout httpbin.example.com.key -subj "/CN=httpbin.example.com/O=httpbin organization"
   $ openssl x509 -req -days 365 -CA example.com.crt -CAkey example.com.key -set_serial 0 -in httpbin.example.com.csr -out httpbin.example.com.crt
   

单主机配置TLS ingress网关

1. 为ingree网关创建一个secret

   secret的名字不能以istio或prometheus开头，且secret不应该包含token字段

   $ kubectl create -n istio-system secret tls httpbin-credential --key=httpbin.example.com.key --cert=httpbin.example.com.crt
   

2. 在server部分定义一个443端口的Gateway，将credentialName指定为httpbin-credential，与secret的名字相同，TLS的mode为SIMPLE。

   $ cat <

3. 配置进入Gateway的流量路由。与上一节中的VirtualService相同

   $ kubectl apply -f - <

4. 使用curl向SECURE_INGRESS_PORT发送HTTPS请求访问httpbin服务，请求中携带了公钥example.com.crt 。--resolve标记可以在使用curl访问TLS的网关IP时，在SNI中支持httpbin.example.com。--cacert选择支持使用生成的证书校验服务。

   -HHost:httpbin.example.com 选项仅在SECURE_INGRESS_PORT不同于实际的网关端口(443)时才会需要，例如，通过映射的NodePort方式访问服务时。

   通过将请求发送到/status/418 URL路径时，可以看到httpbin确实被访问了，httpbin服务会返回418 I’m a Teapot代码。.

   $ curl -v -HHost:httpbin.example.com --resolve "httpbin.example.com:$SECURE_INGRESS_PORT:$INGRESS_HOST" \
   --cacert example.com.crt "https://httpbin.example.com:$SECURE_INGRESS_PORT/status/418"
   
   > --cacert example.com.crt "https://httpbin.example.com:$SECURE_INGRESS_PORT/status/418"
   * Added httpbin.example.com:31967:172.20.127.211 to DNS cache
   * About to connect() to httpbin.example.com port 31967 (#0)
   *   Trying 172.20.127.211...
   * Connected to httpbin.example.com (172.20.127.211) port 31967 (#0)
   * Initializing NSS with certpath: sql:/etc/pki/nssdb
   *   CAfile: example.com.crt
     CApath: none
   * SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
   * Server certificate:
   *       subject: O=httpbin organization,CN=httpbin.example.com
   *       start date: May 22 09:03:01 2020 GMT
   *       expire date: May 22 09:03:01 2021 GMT
   *       common name: httpbin.example.com
   *       issuer: CN=example.com,O=example Inc.
   > GET /status/418 HTTP/1.1
   > User-Agent: curl/7.29.0
   > Accept: */*
   > Host:httpbin.example.com
   >
   < HTTP/1.1 418 Unknown
   < server: istio-envoy
   < date: Fri, 22 May 2020 09:08:29 GMT
   < x-more-info: http://tools.ietf.org/html/rfc2324
   < access-control-allow-origin: *
   < access-control-allow-credentials: true
   < content-length: 135
   < x-envoy-upstream-service-time: 2
   <
   
       -=[ teapot ]=-
   
          _...._
        .'  _ _ `.
       | ."` ^ `". _,
       \_;`"---"`|//
         |       ;/
         \_     _/
           `"""`
   * Connection #0 to host httpbin.example.com left intact
   

   查看curl输出中的Server certificate中的信息，上述返回值的最后有一个茶壶的图片，说明运行成功。

5. 删除老的网关secret，创建一个新的secret，并使用该secret修改ingress网关的凭据

   $ kubectl -n istio-system delete secret httpbin-credential
   

   $ mkdir new_certificates
   $ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=example Inc./CN=example.com' -keyout new_certificates/example.com.key -out new_certificates/example.com.crt
   $ openssl req -out new_certificates/httpbin.example.com.csr -newkey rsa:2048 -nodes -keyout new_certificates/httpbin.example.com.key -subj "/CN=httpbin.example.com/O=httpbin organization"
   $ openssl x509 -req -days 365 -CA new_certificates/example.com.crt -CAkey new_certificates/example.com.key -set_serial 0 -in new_certificates/httpbin.example.com.csr -out new_certificates/httpbin.example.com.crt
   $ kubectl create -n istio-system secret tls httpbin-credential \
   --key=new_certificates/httpbin.example.com.key \
   --cert=new_certificates/httpbin.example.com.crt
   

6. 使用新的证书链访问httpbin服务

   $ curl -v -HHost:httpbin.example.com --resolve "httpbin.example.com:$SECURE_INGRESS_PORT:$INGRESS_HOST" \
   --cacert new_certificates/example.com.crt "https://httpbin.example.com:$SECURE_INGRESS_PORT/status/418"
   

7. 如果使用老的证书访问，则返回错误

   $ curl -v -HHost:httpbin.example.com --resolve "httpbin.example.com:$SECURE_INGRESS_PORT:$INGRESS_HOST" \
   > --cacert example.com.crt "https://httpbin.example.com:$SECURE_INGRESS_PORT/status/418"
   * Added httpbin.example.com:31967:172.20.127.211 to DNS cache
   * About to connect() to httpbin.example.com port 31967 (#0)
   *   Trying 172.20.127.211...
   * Connected to httpbin.example.com (172.20.127.211) port 31967 (#0)
   * Initializing NSS with certpath: sql:/etc/pki/nssdb
   *   CAfile: example.com.crt
     CApath: none
   * Server certificate:
   *       subject: O=httpbin organization,CN=httpbin.example.com
   *       start date: May 22 09:24:07 2020 GMT
   *       expire date: May 22 09:24:07 2021 GMT
   *       common name: httpbin.example.com
   *       issuer: CN=example.com,O=example Inc.
   * NSS error -8182 (SEC_ERROR_BAD_SIGNATURE)
   * Peer's certificate has an invalid signature.
   * Closing connection 0
   curl: (60) Peer's certificate has an invalid signature.
   

$ kubectl -n istio-system delete secret httpbin-credential
$ kubectl create -n istio-system secret generic httpbin-credential --from-file=tls.key=httpbin.example.com.key \
--from-file=tls.crt=httpbin.example.com.crt --from-file=ca.crt=example.com.crt