91 lines
4.1 KiB
Markdown
91 lines
4.1 KiB
Markdown
# Integrating SPIRE as a CA through Envoy's SDS API
|
|
|
|
This sample deploys a setup of [SPIRE](https://github.com/spiffe/spire) (the SPIFFE Runtime Environment) as an example of integrating with [Envoy's SDS](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret) API. For more information
|
|
on the SPIFFE specs, refer to the [SPIFFE Overview](https://spiffe.io/docs/latest/spiffe-about/overview/).
|
|
|
|
Once SPIRE is deployed and integrated with Istio, this sample deploys a modified version of the [sleep](/samples/sleep/README.md) service and validates that its [identity](https://spiffe.io/docs/latest/spiffe-about/spiffe-concepts/#spiffe-verifiable-identity-document-svid) was issued by SPIRE. Workload registration is handled by the [SPIRE Controller Manager](https://github.com/spiffe/spire-controller-manager).
|
|
|
|
See [Istio CA Integration with SPIRE](https://istio.io/latest/docs/ops/integrations/spire) for further details about this integration.
|
|
|
|
## Deploy the integration
|
|
|
|
1. Deploy SPIRE. For proper socket injection, this **must** be done prior to installing Istio in your cluster:
|
|
|
|
```bash
|
|
$ kubectl apply -f spire-quickstart.yaml
|
|
```
|
|
|
|
1. Ensure that the deployment is completed before moving to the next step. This can be verified by waiting on the `spire-agent` pod to become ready:
|
|
|
|
```bash
|
|
$ kubectl wait pod --for=condition=ready -n spire -l app=spire-agent
|
|
```
|
|
|
|
1. Use the configuration profile provided to install Istio (requires istioctl v1.14+):
|
|
|
|
```bash
|
|
$ istioctl install -f istio-spire-config.yaml
|
|
```
|
|
|
|
1. Create a ClusterSPIFFEID to create a registration entry for all workloads with the `spiffe.io/spire-managed-identity: true` label:
|
|
|
|
```bash
|
|
$ kubectl apply -f clusterspiffeid.yaml
|
|
```
|
|
|
|
1. Add the `spiffe.io/spire-managed-identity: true` label to the Ingress-gateway Deployment:
|
|
|
|
```bash
|
|
$ kubectl patch deployment istio-ingressgateway -n istio-system -p '{"spec":{"template":{"metadata":{"labels":{"spiffe.io/spire-managed-identity": "true"}}}}}'
|
|
```
|
|
|
|
1. Deploy the `sleep-spire.yaml` version of the [sleep](/samples/sleep/README.md) service, which injects the custom istio-agent template defined in `istio-spire-config.yaml` and has the `spiffe.io/spire-managed-identity: true` label.
|
|
|
|
If you have [automatic sidecar injection](https://istio.io/docs/setup/additional-setup/sidecar-injection/#automatic-sidecar-injection) enabled:
|
|
|
|
```bash
|
|
$ kubectl apply -f sleep-spire.yaml
|
|
```
|
|
|
|
Otherwise, manually inject the sidecar before applying:
|
|
|
|
```bash
|
|
$ kubectl apply -f <(istioctl kube-inject -f sleep-spire.yaml)
|
|
```
|
|
|
|
1. Retrieve sleep's SVID identity document using the `istioctl proxy-config secret` command:
|
|
|
|
```bash
|
|
$ export SLEEP_POD=$(kubectl get pod -l app=sleep -o jsonpath="{.items[0].metadata.name}")
|
|
$ istioctl pc secret $SLEEP_POD -o json | jq -r \
|
|
'.dynamicActiveSecrets[0].secret.tlsCertificate.certificateChain.inlineBytes' | base64 --decode > chain.pem
|
|
```
|
|
|
|
1. Inspect the certificate content and verify that SPIRE was the issuer:
|
|
|
|
```bash
|
|
$ openssl x509 -in chain.pem -text | grep SPIRE
|
|
Subject: C = US, O = SPIRE, CN = sleep-5d6df95bbf-kt2tt
|
|
```
|
|
|
|
## Tear down
|
|
|
|
1. Delete all deployments and configurations for the SPIRE Agent, Server, and namespace:
|
|
|
|
```bash
|
|
$ kubectl delete namespace spire
|
|
```
|
|
|
|
1. Delete the ClusterRole, ClusterRoleBinding, Role, RoleBindings, ValidatingWebhookConfiguration, CSIDriver, and CustomResourceDefinition:
|
|
|
|
```bash
|
|
$ kubectl delete clusterrole spire-server-cluster-role spire-agent-cluster-role manager-role
|
|
$ kubectl delete clusterrolebinding spire-server-cluster-role-binding spire-agent-cluster-role-binding manager-role-binding
|
|
$ kubectl delete role spire-server-role leader-election-role
|
|
$ kubectl delete rolebinding spire-server-role-binding leader-election-role-binding
|
|
$ kubectl delete ValidatingWebhookConfiguration spire-controller-manager-webhook
|
|
$ kubectl delete csidriver csi.spiffe.io
|
|
$ kubectl delete CustomResourceDefinition clusterspiffeids.spire.spiffe.io
|
|
$ kubectl delete CustomResourceDefinition clusterfederatedtrustdomains.spire.spiffe.io
|
|
```
|