PeerAuthentication详解

最新推荐文章于 2024-09-26 10:19:20 发布

hxpjava1

最新推荐文章于 2024-09-26 10:19:20 发布

阅读量1k

点赞数

分类专栏： k8s实战之kubectl源码分析文章标签：云原生

本文链接：https://blog.csdn.net/hxpjava1/article/details/117414262

版权

k8s实战之kubectl源码分析专栏收录该内容

104 篇文章

订阅专栏

该公众号分享了一系列关于Istio的文章，涵盖多集群部署、链路追踪、故障注入、业务权限控制、 EnvoyFilter 使用等多个方面，深入探讨Istio的安全配置，包括PeerAuthentication的模式设置及其对工作负载的影响，帮助读者理解并掌握Istio的高级用法。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

欢迎关注我的公众号：

目前刚开始写一个月，一共写了18篇原创文章，文章目录如下：

istio多集群探秘，部署了50次多集群后我得出的结论

istio多集群链路追踪，附实操视频

istio防故障利器，你知道几个,istio新手不要读，太难！

istio业务权限控制，原来可以这么玩

istio实现非侵入压缩，微服务之间如何实现压缩

不懂envoyfilter也敢说精通istio系列-http-rbac-不要只会用AuthorizationPolicy配置权限

不懂envoyfilter也敢说精通istio系列-02-http-corsFilter-不要只会vs

不懂envoyfilter也敢说精通istio系列-03-http-csrf filter-再也不用再代码里写csrf逻辑了

不懂envoyfilter也敢说精通istio系列http-jwt_authn-不要只会RequestAuthorization

不懂envoyfilter也敢说精通istio系列-05-fault-filter-故障注入不止是vs

不懂envoyfilter也敢说精通istio系列-06-http-match-配置路由不只是vs

不懂envoyfilter也敢说精通istio系列-07-负载均衡配置不止是dr

不懂envoyfilter也敢说精通istio系列-08-连接池和断路器

不懂envoyfilter也敢说精通istio系列-09-http-route filter

不懂envoyfilter也敢说精通istio系列-network filter-redis proxy

不懂envoyfilter也敢说精通istio系列-network filter-HttpConnectionManager

不懂envoyfilter也敢说精通istio系列-ratelimit-istio ratelimit完全手册

学习目标

什么是PeerAuthentication

PeerAuthentication defines how traffic will be（mtls） tunneled (or not) to the sidecar.

资源详解

Field	Type	Description	Required
`selector`	`WorkloadSelector`	The selector determines the workloads to apply the ChannelAuthentication on. If not set, the policy will be applied to all workloads in the same namespace as the policy.	No
`mtls`	`MutualTLS`	Mutual TLS settings for workload. If not defined, inherit from parent.	No
`portLevelMtls`	`map`	Port specific mutual TLS settings.	No

没有selector

全局有效

pa-default-global.yaml

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT

For mesh level, put the policy in root-namespace according to your Istio installation.

默认工作负载都启用mtls

关闭productpage mtls

dr-productpage-mtls-disable.yaml

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: productpage
spec:
  host: productpage
  subsets:
  - labels:
      version: v1
    name: v1
  trafficPolicy:
    tls:
      mode: DISABLE

访问失败

名称空间有效

pa-default.yaml

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
spec:
  mtls:
    mode: STRICT

selector

pa-productpage-selector.yaml

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: productpage
spec:
  selector:
    matchLabels:
      app: productpage
  mtls:
    mode: STRICT

mtls

PeerAuthentication.MutualTLS.Mode

Name	Description
`UNSET`	Inherit from parent, if has one. Otherwise treated as PERMISSIVE.
`DISABLE`	Connection is not tunneled.
`PERMISSIVE`	Connection can be either plaintext or mTLS tunnel.
`STRICT`	Connection is an mTLS tunnel (TLS with client cert must be presented).

mode

UNSET

pa-productpage-mode-UNSET.yaml

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: productpage
spec:
  selector:
    matchLabels:
      app: productpage
  mtls:
    mode: UNSET

DISABLE

pa-productpage-mode-DISABLE.yaml

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: productpage
spec:
  selector:
    matchLabels:
      app: productpage
  mtls:
    mode: DISABLE

PERMISSIVE

pa-productpage-mode-PERMISSIVE.yaml

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: productpage
spec:
  selector:
    matchLabels:
      app: productpage
  mtls:
    mode: PERMISSIVE

STRICT

pa-productpage-mode-STRICT.yaml

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: productpage
spec:
  selector:
    matchLabels:
      app: productpage
  mtls:
    mode: STRICT

portLevelMtls

pa-productpage-portLevelMtls.yaml

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: productpage
spec:
  selector:
    matchLabels:
      app: productpage
  mtls:
    mode: STRICT
  portLevelMtls:
    9080:
      mode: DISABLE