Welcome to OStack Knowledge Sharing Community for programmer and developer-Open, Learning and Share
Welcome To Ask or Share your Answers For Others

Categories

0 votes
1.3k views
in Technique[技术] by (71.8m points)

kubernetes - How do I properly HTTPS secure an application when using Istio?

I'm currently trying to wrap my head around how the typical application flow looks like for a kubernetes application in combination with Istio.

So, for my app I have an asp.net application hosted within a Kubernetes cluster, and I added Istio on top. Here is my gateway & VirtualService:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: appgateway
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "*"
      tls:
        httpsRedirect: true
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
        privateKey: /etc/istio/ingressgateway-certs/tls.key
      hosts:
        - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: appvservice
spec:
  hosts:
    - "*"
  gateways:
    - appgateway
  tls:
    - match:
        - port: 443
          sniHosts:
            - "*"
      route:
        - destination:
            host: frontendservice.default.svc.cluster.local
            port:
              number: 443

This is what I came up with after reading through the Istio documentation.

Note that my frontendservice is a very basic ClusterIP service routing to an Asp.Net application which also offers standard 80 / 443 ports.

I have a few questions now:

  • Is this the proper approach to securing my application? In essence I want to redirect incoming traffic on port 80 straight to https enabled 443 right at the edge. However, when I try this, there's no redirect going on on port 80 at all.
  • Also, the tls route on my VirtualService does not work. There's just no traffic ending up on my pod
  • I'm also wondering, is it necessary to even manually add HTTPs to my internal applications, or is this something where Istios internal CA functionality comes in?

I have imagined it to work like this:

  1. Request comes in. If it's on port 80, send a redirect to the client in order to send a https request. If it's on port 443, allow the request.
  2. The VirtualService providers the instructions what should happen with requests on port 443, and forward it to the service.
  3. The service now forwards the request to my app's 443 port.

Thanks in advance - I'm just learning Istio, and I'm a bit baffled why my seemingly proper setup does not work here.

question from:https://stackoverflow.com/questions/65836627/how-do-i-properly-https-secure-an-application-when-using-istio

与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
Welcome To Ask or Share your Answers For Others

1 Answer

0 votes
by (71.8m points)

Your Gateway terminates TLS connections, but your VirtualService is configured to accept unterminated TLS connections with TLSRoute.

Compare the example without TLS termination and the example which terminates TLS. Most probably, the "default" setup would be to terminate the TLS connection and configure the VirtualService with a HTTPRoute.


与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
Welcome to OStack Knowledge Sharing Community for programmer and developer-Open, Learning and Share
Click Here to Ask a Question

...