Alibaba Cloud Service Mesh:Verify whether mTLS is enabled in an ASM instance

Use kubectl to connect to the ASM instance and create an ASMPacketInspector.yaml file that contains the following content:

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMPacketInspector
metadata:
  name: test
spec:
  pod:
    clusterId: ${ACK Cluster ID}
    namespace: default
    name: ${sleep pod name}
  tcpDumpParams: '-i any port 80'
  duration: 60s
  fileName: sleep.pcap

Run the following command to deploy ASMPacketInspector resources:

kubectl apply -f ASMPacketInspector.yaml

After the ASMPacketInspector resources are deployed, ASM automatically captures packets whose destination port is port 80 in the sleep pod. Port 80 is the service port exposed by the HTTPBin application. The packet capture duration is 60s. During this period, use kubectl to connect to the ACK managed cluster that is added to the ASM instance and run the following command:

kubectl exec -it <sleep pod name> -c sleep --  sh -c 'for i in $(seq 1 30); do curl httpbin:8000 -I ; echo "request $i done"; done'

This command automatically sends 30 requests from the sleep pod to the HTTPBin application.

Use kubectl to connect to the ASM instance and run the following command to view the packet capture results:

kubectl get ASMPacketInspector test -o yaml

Expected results:

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMPacketInspector
metadata:
  ******
spec:
  ******
status:
  completedAt: null
  conditions:
  - time: "2024-06-12T08:15:33Z"
    type: Inspecting
  - message: 'inspecting job status: Running'
    time: "2024-06-12T08:15:43Z"
    type: Inspecting
  - message: 'inspecting job status: Running'
    time: "2024-06-12T08:15:53Z"
    type: Inspecting
  - message: 'inspecting job status: Running'
    time: "2024-06-12T08:16:03Z"
    type: Inspecting
  - message: 'inspecting job status: Running'
    time: "2024-06-12T08:16:13Z"
    type: Inspecting
  - message: 'inspecting job status: Running'
    time: "2024-06-12T08:16:23Z"
    type: Inspecting
  filePath: /tmp/sleep.pcap
  phase: Inspecting
  runningOnNode: *******
  startAt: "2024-06-12T08:15:43Z"
  taskId: inspector-zumnmwdc

runningOnNode in the status section indicates the node where the packets are captured. filePath indicates the path of the output file. Log on to the specified node to download the file to your local computer.

Use kubectl to connect to the ACK managed cluster that is added to the ASM instance. Then, run the following command to check the node where the sleep application runs:

kubectl  get pod -o wide 

Expected output:

NAME                       READY   STATUS    RESTARTS   AGE     IP           NODE                       NOMINATED NODE   READINESS GATES
httpbin-6c8f47d9b9-stq72   2/2     Running   0          33m     172.16.*.*   cn-***.172.16.*.*   <none>           <none>
sleep-84f9785988-ft9rm     2/2     Running   0          3h56m   172.16.*.*   cn-***.172.16.*.*   <none>           <none>

Log on to the node where the sleep application runs. For more information, see Use Workbench to connect to a Linux instance over SSH.

1. Run the following command to view the CONTAINER ID of the container where the sleep application resides:

   sudo crictl ps | grep <Pod name>

   Expected output:

   CONTAINER           IMAGE               CREATED             STATE                      
   a1a214d2*****       35d28df4*****       2 days ago          Running

2. Run the following command with CONTAINER ID set to the one obtained in the preceding step to view the PID of the container:

   sudo crictl inspect  a1a214d2***** |grep -i PID

   Expected output:

      "pid": 2309838,    # The PID of the container. 
               "pid": 1
               "type": "pid"

3. Run the following command to capture packets:

   sudo nsenter -t <Container PID> tcpdump -i any port 80 -w /tmp/test.pcap

   Download the test.pcap file generated after the command is executed to your local computer.