From 97addda5f41d28332ce5fb41ca0ca01d68a6b9da Mon Sep 17 00:00:00 2001 From: ston1th Date: Wed, 7 Aug 2019 00:42:25 +0200 Subject: [PATCH] istio improvements --- loop.sh | 2 +- testapp/api/api-v1-istio.yaml | 37 ++++++++++++++-- testapp/api/api-v1.yaml | 7 +++ testapp/db/db.yaml | 14 ++++++ testapp/istio/api-role.yaml | 32 ++++++++++++++ testapp/istio/cluster-rbac.yaml | 9 ++++ testapp/istio/db-role.yaml | 32 ++++++++++++++ testapp/istio/mtls.yaml | 62 ++++++++++++++++++++++++++ testapp/istio/redirect-role.yaml | 31 +++++++++++++ testapp/istio/srv-role.yaml | 31 +++++++++++++ testapp/redirect/redirect.yaml | 74 ++++++++++++++++++++++++++++++++ testapp/srv/srv-v1-istio.yaml | 54 ++++++++++++++++++++++- testapp/srv/srv-v1.yaml | 10 ++++- 13 files changed, 388 insertions(+), 7 deletions(-) create mode 100644 testapp/istio/api-role.yaml create mode 100644 testapp/istio/cluster-rbac.yaml create mode 100644 testapp/istio/db-role.yaml create mode 100644 testapp/istio/mtls.yaml create mode 100644 testapp/istio/redirect-role.yaml create mode 100644 testapp/istio/srv-role.yaml create mode 100644 testapp/redirect/redirect.yaml diff --git a/loop.sh b/loop.sh index 5cac7a5..cd366db 100755 --- a/loop.sh +++ b/loop.sh @@ -1,2 +1,2 @@ #!/bin/sh -while true; do curl $1 2>/dev/null;sleep ${2:-1}; done +while true; do curl -k -s -L $1 2>/dev/null;sleep ${2:-1}; done diff --git a/testapp/api/api-v1-istio.yaml b/testapp/api/api-v1-istio.yaml index 5890b66..af7b45c 100644 --- a/testapp/api/api-v1-istio.yaml +++ b/testapp/api/api-v1-istio.yaml @@ -1,3 +1,9 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: testapp-api + namespace: default +--- apiVersion: apps/v1 kind: Deployment metadata: @@ -17,9 +23,17 @@ spec: app: testapp-api version: v1 spec: + serviceAccountName: testapp-api containers: - name: testapp-api image: 127.0.0.1:5000/testapp/api:v1 + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 100m + memory: 64Mi imagePullPolicy: Always ports: - containerPort: 8080 @@ -61,10 +75,15 @@ spec: servers: - port: number: 80 - name: http - protocol: HTTP + name: https + protocol: HTTPS hosts: - httpbin.org + tls: + mode: MUTUAL + serverCertificate: /etc/certs/cert-chain.pem + privateKey: /etc/certs/key.pem + caCertificates: /etc/certs/root-cert.pem --- apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule @@ -74,11 +93,23 @@ spec: host: istio-egressgateway.istio-system.svc.cluster.local subsets: - name: httpbin + trafficPolicy: + loadBalancer: + simple: ROUND_ROBIN + portLevelSettings: + - port: + number: 80 + tls: + mode: ISTIO_MUTUAL + sni: httpbin.org +# trafficPolicy: +# tls: +# mode: ISTIO_MUTUAL --- apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: - name: httpbin-egress + name: httpbin spec: hosts: - httpbin.org diff --git a/testapp/api/api-v1.yaml b/testapp/api/api-v1.yaml index 4753187..e1287fc 100644 --- a/testapp/api/api-v1.yaml +++ b/testapp/api/api-v1.yaml @@ -20,6 +20,13 @@ spec: containers: - name: testapp-api image: 127.0.0.1:5000/testapp/api:v1 + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 100m + memory: 64Mi imagePullPolicy: Always ports: - containerPort: 8080 diff --git a/testapp/db/db.yaml b/testapp/db/db.yaml index ca009f4..05a3347 100644 --- a/testapp/db/db.yaml +++ b/testapp/db/db.yaml @@ -1,3 +1,9 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: testapp-db + namespace: default +--- apiVersion: apps/v1 kind: Deployment metadata: @@ -17,9 +23,17 @@ spec: app: testapp-db version: v1 spec: + serviceAccountName: testapp-db containers: - name: testapp-db image: 127.0.0.1:5000/testapp/db:v1 + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 100m + memory: 64Mi imagePullPolicy: Always ports: - containerPort: 8080 diff --git a/testapp/istio/api-role.yaml b/testapp/istio/api-role.yaml new file mode 100644 index 0000000..17efcaa --- /dev/null +++ b/testapp/istio/api-role.yaml @@ -0,0 +1,32 @@ +apiVersion: rbac.istio.io/v1alpha1 +kind: ServiceRole +metadata: + name: testapp-api + namespace: default +spec: + rules: + - services: ["testapp-api.default.svc.cluster.local"] +--- +apiVersion: rbac.istio.io/v1alpha1 +kind: ServiceRoleBinding +metadata: + name: testapp-api + namespace: default +spec: + subjects: + - user: "cluster.local/ns/default/sa/testapp-srv" + - user: "cluster.local/ns/default/sa/testapp-db" + roleRef: + kind: ServiceRole + name: testapp-api +--- +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + name: testapp-api + namespace: default +spec: + host: testapp-api.default.svc.cluster.local + trafficPolicy: + tls: + mode: ISTIO_MUTUAL diff --git a/testapp/istio/cluster-rbac.yaml b/testapp/istio/cluster-rbac.yaml new file mode 100644 index 0000000..383463c --- /dev/null +++ b/testapp/istio/cluster-rbac.yaml @@ -0,0 +1,9 @@ +apiVersion: rbac.istio.io/v1alpha1 +kind: ClusterRbacConfig +metadata: + name: default +spec: + mode: 'ON_WITH_INCLUSION' + inclusion: + namespaces: ["default", "redirect"] + #services: ["istio-egressgateway.istio-system.svc.cluster.local"] diff --git a/testapp/istio/db-role.yaml b/testapp/istio/db-role.yaml new file mode 100644 index 0000000..078c406 --- /dev/null +++ b/testapp/istio/db-role.yaml @@ -0,0 +1,32 @@ +apiVersion: rbac.istio.io/v1alpha1 +kind: ServiceRole +metadata: + name: testapp-db + namespace: default +spec: + rules: + - services: ["testapp-db.default.svc.cluster.local"] +--- +apiVersion: rbac.istio.io/v1alpha1 +kind: ServiceRoleBinding +metadata: + name: testapp-db + namespace: default +spec: + subjects: + - user: "cluster.local/ns/default/sa/testapp-srv" + - user: "cluster.local/ns/default/sa/testapp-api" + roleRef: + kind: ServiceRole + name: testapp-db +--- +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + name: testapp-db + namespace: default +spec: + host: testapp-db.default.svc.cluster.local + trafficPolicy: + tls: + mode: ISTIO_MUTUAL diff --git a/testapp/istio/mtls.yaml b/testapp/istio/mtls.yaml new file mode 100644 index 0000000..d34ed3d --- /dev/null +++ b/testapp/istio/mtls.yaml @@ -0,0 +1,62 @@ +apiVersion: authentication.istio.io/v1alpha1 +kind: MeshPolicy +metadata: + name: default +spec: + peers: + - mtls: {} +--- +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + name: default + namespace: istio-system +spec: + host: "*.local" + trafficPolicy: + tls: + mode: ISTIO_MUTUAL +--- +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + name: api-server + namespace: istio-system +spec: + host: "kubernetes.default.svc.cluster.local" + trafficPolicy: + tls: + mode: DISABLE +--- +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + name: rook + namespace: istio-system +spec: + host: "*.rook-ceph.svc.cluster.local" + trafficPolicy: + tls: + mode: DISABLE +--- +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + name: kiali + namespace: istio-system +spec: + host: "kiali.istio-system.svc.cluster.local" + trafficPolicy: + tls: + mode: DISABLE +--- +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + name: k8s-testapp-cert + namespace: istio-system +spec: + host: "k8s-testapp-cert.istio-system.svc.cluster.local" + trafficPolicy: + tls: + mode: DISABLE diff --git a/testapp/istio/redirect-role.yaml b/testapp/istio/redirect-role.yaml new file mode 100644 index 0000000..21bf063 --- /dev/null +++ b/testapp/istio/redirect-role.yaml @@ -0,0 +1,31 @@ +apiVersion: rbac.istio.io/v1alpha1 +kind: ServiceRole +metadata: + name: redirect + namespace: redirect +spec: + rules: + - services: ["redirect.redirect.svc.cluster.local"] +--- +apiVersion: rbac.istio.io/v1alpha1 +kind: ServiceRoleBinding +metadata: + name: redirect + namespace: redirect +spec: + subjects: + - user: "*" + roleRef: + kind: ServiceRole + name: "redirect" +--- +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + name: redirect + namespace: redirect +spec: + host: redirect.redirect.svc.cluster.local + trafficPolicy: + tls: + mode: ISTIO_MUTUAL diff --git a/testapp/istio/srv-role.yaml b/testapp/istio/srv-role.yaml new file mode 100644 index 0000000..3a16776 --- /dev/null +++ b/testapp/istio/srv-role.yaml @@ -0,0 +1,31 @@ +apiVersion: rbac.istio.io/v1alpha1 +kind: ServiceRole +metadata: + name: testapp-srv + namespace: default +spec: + rules: + - services: ["testapp-srv.default.svc.cluster.local"] +--- +apiVersion: rbac.istio.io/v1alpha1 +kind: ServiceRoleBinding +metadata: + name: testapp-srv + namespace: default +spec: + subjects: + - user: "*" + roleRef: + kind: ServiceRole + name: testapp-srv +--- +apiVersion: networking.istio.io/v1alpha3 +kind: DestinationRule +metadata: + name: testapp-srv + namespace: default +spec: + host: testapp-srv.default.svc.cluster.local + trafficPolicy: + tls: + mode: ISTIO_MUTUAL diff --git a/testapp/redirect/redirect.yaml b/testapp/redirect/redirect.yaml new file mode 100644 index 0000000..bb2eecb --- /dev/null +++ b/testapp/redirect/redirect.yaml @@ -0,0 +1,74 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: redirect + namespace: redirect +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: nginx-config + namespace: redirect +data: + nginx.conf: | + server { + listen 80 default_server; + server_name _; + return 301 https://$host$request_uri; + } +--- +apiVersion: v1 +kind: Service +metadata: + name: redirect + namespace: redirect + labels: + app: redirect +spec: + ports: + - port: 80 + name: http + selector: + app: redirect +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: redirect + namespace: redirect + labels: + app: redirect + version: v1 +spec: + replicas: 1 + selector: + matchLabels: + app: redirect + version: v1 + template: + metadata: + labels: + app: redirect + version: v1 + spec: + serviceAccountName: redirect + containers: + - name: redirect + image: nginx:stable + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 100m + memory: 128Mi + imagePullPolicy: IfNotPresent + ports: + - containerPort: 80 + volumeMounts: + - mountPath: /etc/nginx/conf.d + name: config + volumes: + - name: config + configMap: + name: nginx-config diff --git a/testapp/srv/srv-v1-istio.yaml b/testapp/srv/srv-v1-istio.yaml index 86a31d1..5a155f3 100644 --- a/testapp/srv/srv-v1-istio.yaml +++ b/testapp/srv/srv-v1-istio.yaml @@ -1,3 +1,9 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: testapp-srv + namespace: default +--- apiVersion: apps/v1 kind: Deployment metadata: @@ -17,9 +23,17 @@ spec: app: testapp-srv version: v1 spec: + serviceAccountName: testapp-srv containers: - - name: testapp-srv + - name: srv image: 127.0.0.1:5000/testapp/srv:v1 + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 100m + memory: 64Mi imagePullPolicy: Always ports: - containerPort: 8080 @@ -28,6 +42,8 @@ apiVersion: v1 kind: Service metadata: name: testapp-srv + labels: + app: testapp-srv spec: type: ClusterIP ports: @@ -50,6 +66,22 @@ spec: protocol: HTTP hosts: - "k8s-testapp.example.com" + - port: + number: 443 + name: https + protocol: HTTPS + hosts: + - "k8s-testapp.example.com" + tls: + mode: SIMPLE + serverCertificate: "sds" + privateKey: "sds" + credentialName: "k8s-testapp-cert" + minProtocolVersion: 3 #TLSv1_2 + cipherSuites: + - ECDHE-RSA-CHACHA20-POLY1305 + - ECDHE-RSA-AES256-GCM-SHA384 + - ECDHE-RSA-AES128-GCM-SHA256 --- apiVersion: networking.istio.io/v1alpha3 kind: VirtualService @@ -61,7 +93,25 @@ spec: hosts: - "k8s-testapp.example.com" http: - - route: + - match: + - port: 80 + uri: + prefix: "/.well-known/acme-challenge" + route: + - destination: + port: + number: 8089 + host: k8s-testapp-cert.istio-system.svc.cluster.local + - match: + - port: 80 + route: + - destination: + port: + number: 80 + host: redirect.redirect.svc.cluster.local + - match: + - port: 443 + route: - destination: port: number: 8080 diff --git a/testapp/srv/srv-v1.yaml b/testapp/srv/srv-v1.yaml index 7f69f83..2b17e4b 100644 --- a/testapp/srv/srv-v1.yaml +++ b/testapp/srv/srv-v1.yaml @@ -20,6 +20,13 @@ spec: containers: - name: testapp-srv image: 127.0.0.1:5000/testapp/srv:v1 + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 100m + memory: 64Mi imagePullPolicy: Always ports: - containerPort: 8080 @@ -28,6 +35,8 @@ apiVersion: v1 kind: Service metadata: name: testapp-srv + labels: + app: testapp-srv spec: type: ClusterIP ports: @@ -36,7 +45,6 @@ spec: selector: app: testapp-srv --- ---- apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: