Use SDS to improve the security of Istio gateways

Step 1: Prepare server certificates and private key pairs for multiple servers

Generate a server certificate and private key pair for the aliyun.com domain name and store the pair in a secret.

If you have an available server certificate and private key pair for the aliyun.com domain name, rename the private key to aliyun.com.key and the server certificate to aliyun.com.crt. Alternatively, run the following openssl commands to create a server certificate and private key pair for aliyun.com.

1. Run the following command to create a root certificate and a private key:

   openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=myexample Inc./CN=aliyun.com' -keyout aliyun.root.key -out aliyun.root.crt 

2. Run the following commands to generate a server certificate and private key pair for the server of aliyun.com:

   openssl req -out aliyun.com.csr -newkey rsa:2048 -nodes -keyout aliyun.com.key -subj "/CN=aliyun.com/O=myexample organization"
   openssl x509 -req -days 365 -CA aliyun.root.crt -CAkey aliyun.root.key -set_serial 0 -in aliyun.com.csr -out aliyun.com.crt

3. Run the following command in the cluster to which the ingress gateway pod belongs to create a secret that contains the server certificate and private key pair in the istio-system namespace:

   kubectl create -n istio-system secret tls myexample-credential --key=aliyun.com.key --cert=aliyun.com.crt

   Notice The name of the secret cannot start with istio or prometheus and cannot contain the token field.

Step 2: Define an internal service for a.aliyun.com

The internal services in this example are implemented based on NGINX. You must create a configuration file for the NGINX server first. In this example, an internal service of the a.aliyun.com domain name is used. Define the requested root path to directly return the sentence Welcome to a.aliyun.com! and status code 200. The myexample-nginx.conf file contains the following content:

events {
}
http {
  log_format main '$remote_addr - $remote_user [$time_local]  $status '
  '"$request" $body_bytes_sent "$http_referer" '
  '"$http_user_agent" "$http_x_forwarded_for"';
  access_log /var/log/nginx/access.log main;
  error_log  /var/log/nginx/error.log;
  server {
    listen 80;
    location /hello {
        return 200 'Welcome to a.aliyun.com!';
        add_header Content-Type text/plain;
    }
  }
}

1. In the cluster to which the ingress gateway pod belongs, run the following command to create a ConfigMap for storing the configuration of the NGINX server:

   kubectl create configmap myexample-nginx-configmap --from-file=nginx.conf=./myexample-nginx.conf

2. In the ASM console, click the corresponding ASM instance. In the left-side navigation pane, click Namespace. Enable automatic sidecar injection for the default namespace.
3. Create a myexampleapp.yaml file that contains the following code. Then, run the kubectl apply -f myexampleapp.yaml command to create an internal service for the a.aliyun.com domain name.

   apiVersion: v1
   kind: Service
   metadata:
     name: myexampleapp
     labels:
       app: myexampleapp
   spec:
     ports:
     - port: 80
       protocol: TCP
     selector:
       app: myexampleapp
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: myexampleapp
   spec:
     selector:
       matchLabels:
         app: myexampleapp
     replicas: 1
     template:
       metadata:
         labels:
           app: myexampleapp
       spec:
         containers:
         - name: nginx
           image: nginx
           ports:
           - containerPort: 80
           volumeMounts:
           - name: nginx-config
             mountPath: /etc/nginx
             readOnly: true
         volumes:
         - name: nginx-config
           configMap:
             name: myexample-nginx-configmap

Step 3: Define an internal service for b.aliyun.com

The internal services in this example are implemented based on HTTPBin. Create a httpbin.example.yaml file that contains the following code. Then, run the kubectl apply -f httpbin.example.yaml command in the cluster to which the ingress gateway pod belongs to create an internal service for the b.aliyun.com domain name.

apiVersion: v1
kind: Service
metadata:
  name: httpbin
  labels:
    app: httpbin
spec:
  ports:
  - name: http
    port: 8000
  selector:
    app: httpbin
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin
spec:
  replicas: 1
  selector:
    matchLabels:
      app: httpbin
      version: v1
  template:
    metadata:
      labels:
        app: httpbin
        version: v1
    spec:
      containers:
      - image: docker.io/citizenstig/httpbin
        imagePullPolicy: IfNotPresent
        name: httpbin
        ports:
        - containerPort: 8000

Step 4: Define an Istio gateway

1. Log on to the ASM console.
2. In the left-side navigation pane, choose Service Mesh > Mesh Management.
3. On the Mesh Management page, find the ASM instance that you want to configure. Click the name of the ASM instance or click Manage in the Actions column.
4. On the details page of the ASM instance, choose Traffic Management > Gateway in the left-side navigation pane. On the Gateway page, click Create from YAML.
5. On the Create page, perform the following steps to define an Istio gateway. Then, click Create.
   1. Select a namespace as required. In this example, the default namespace is used.
   2. In the code editor, define an Istio gateway by using the following YAML template:

      apiVersion: networking.istio.io/v1alpha3
      kind: Gateway
      metadata:
        name: mysdsgateway
      spec:
        selector:
          istio: ingressgateway # use istio default ingress gateway
        servers:
        - port:
            number: 443
            name: https
            protocol: HTTPS
          tls:
            mode: SIMPLE
            credentialName: myexample-credential # must be the same as secret
          hosts:
          - '*.aliyun.com'
                                      

   On the Gateway page, you can view the defined Istio gateway.

Step 5: Define a virtual service

1. Log on to the ASM console.
2. In the left-side navigation pane, choose Service Mesh > Mesh Management.
3. On the Mesh Management page, find the ASM instance that you want to configure. Click the name of the ASM instance or click Manage in the Actions column.
4. On the details page of the ASM instance, choose Traffic Management > VirtualService in the left-side navigation pane. On the VirtualService page, click Create from YAML.
5. On the Create page, perform the following steps to define a virtual service. Then, click Create.
   1. Select a namespace as required. In this example, the default namespace is used.
   2. In the code editor, define a virtual service by using the following YAML template:

      apiVersion: networking.istio.io/v1alpha3
      kind: VirtualService
      metadata:
        name: mysdsgateway-myexamplevs
      spec:
        hosts:
        - "a.aliyun.com"
        gateways:
        - mysdsgateway
        http:
        - match:
          - uri:
              exact: /hello
          route:
          - destination:
              host: myexampleapp.default.svc.cluster.local
              port:
                number: 80      

      Define a virtual service for httpbin.example.com in a similar way.

      apiVersion: networking.istio.io/v1alpha3
      kind: VirtualService
      metadata:
        name: mysdsgateway-httpbinvs
      spec:
        hosts:
        - "b.aliyun.com"
        gateways:
        - mysdsgateway
        http:
        - match:
          - uri:
              prefix: /status
          - uri:
              prefix: /delay
          route:
          - destination:
              port:
                number: 8000
              host: httpbin.default.svc.cluster.local        

   On the VirtualService page, you can view the defined virtual service.

View the result

Use one of the following methods to query the IP address of the ingress gateway:

• View the IP address of the ingress gateway in the ASM console: In the ASM console, click the corresponding ASM instance. In the left-side navigation pane, click ASM Gateways. On the ASM Gateways page, view the IP address of the ingress gateway.
• View the IP address of the ingress gateway in the ACK console. For more information, see Deploy an ingress gateway service.

Run the following commands to access the ingress gateway service:

• Run the following command to access the aliyun.com domain name over HTTPS:

  curl -k -H Host:a.aliyun.com --resolve a.aliyun.com:443:{IP address of the ingress gateway}  https://a.aliyun.com/hello

  Expected output:

  Welcome to aliyun.com!

• Run the following command to access the httpbin.example.com domain name over HTTPS:

  curl -k -H Host:b.aliyun.com --resolve b.aliyun.com:443:{IP address of the ingress gateway}  https://b.aliyun.com/status/418  

  Expected output:

      -=[ teapot ]=-
  
         _...._
       .'  _ _ `.
      | ."` ^ `". _,
      \_;`"---"`|//
        |       ;/
        \_     _/
          `"""`

Update gateway certificates

After you recreate a secret that is used to load a certificate on the data plane, you must manually modify the credentialName parameter to the new secret name for a gateway to update the gateway certificate. In this following example, the secret named new-istio-ingressgateway-certs for the server of example.com is created.

1. Create a certificate whose issuer is myexample.
   1. Run the following openssl command to create a root certificate and a private key:

      openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=myexample Inc./CN=example.com' -keyout example.root.key -out example.root.crt

   2. Run the following commands to generate a server certificate and private key pair for the server of example.com:

      openssl req -out example.com.csr -newkey rsa:2048 -nodes -keyout example.com.key -subj "/CN=example.com/O=myexample organization"
      openssl x509 -req -days 365 -CA example.root.crt -CAkey example.root.key -set_serial 0 -in example.com.csr -out example.com.crt

   3. Connect to ACK clusters by using kubectl.
   4. Run the following command to create a secret named new-istio-ingressgateway-certs:

      kubectl create -n istio-system secret tls new-istio-ingressgateway-certs --key example.com.key --cert example.com.crt

2. Run the following command in the cluster to delete the earlier secret:

   kubectl delete secret  istio-ingressgateway-certs -n istio-system

3. Update a gateway.
   1. Log on to the ASM console.
   2. In the left-side navigation pane, choose Service Mesh > Mesh Management.
   3. On the Mesh Management page, find the ASM instance that you want to configure. Click the name of the ASM instance or click Manage in the Actions column.
   4. On the details page of the ASM instance, choose Traffic Management > Gateway in the left-side navigation pane.
   5. On the Gateway page, find the gateway that you want to update and click YAML in the Actions column.
   6. In the Edit panel, change the value of the credentialName parameter to new-istio-ingressgateway-certs, and click OK.
4. Verify that the gateway certificate is updated.
   1. Run the following command in the cluster to view the current certificate information:

      kubectl exec istio-ingressgateway-xxxx -n istio-system -- curl localhost:15000/config_dump  > ingressgateway_dump.yaml

   2. Run the following command to search for and display the new-istio-ingressgateway-certs certificate:

      cat ingressgateway_dump.yaml | grep new-istio-ingressgateway-certs -A 3

      The following figure shows the expected output.

      

      Copy the content of the inline_bytes parameter to obtain the Base64-encoded certificate.

   3. Run the following command in an on-premises command-line tool to decode the Base64-encoded certificate:

      echo <Base64-encoded certificate> | base64 --decode

   4. Save the decoded content as the test.com.crt file.
   5. Run the following openssl command to view the organization of the certificate:

      openssl x509 -in test.com.crt -text -noout

      The following figure shows the expected output.

      

      The organization is changed to myexample. This indicates that the gateway certificate is updated.