mirror of https://github.com/istio/istio.io.git
[Release-1.5] Remove mTLS tutorial module (#6735)
Co-authored-by: adammil2000 <adammil2000@users.noreply.github.com>
This commit is contained in:
Istio Automation
GitHub
parent
3d8165c7d4
commit
0d13a9b85a
|
|
@ -94,7 +94,10 @@ disrupt your application, it continues to run and serve user requests.
|
|||
|
||||
1. Check the Istio dashboard, using the custom URL you set in your `/etc/hosts` file
|
||||
[previously](/docs/examples/microservices-istio/bookinfo-kubernetes/#update-your-etc-hosts-configuration-file)):
|
||||
[http://my-istio-dashboard.io/dashboard/db/istio-mesh-dashboard](http://my-istio-dashboard.io/dashboard/db/istio-mesh-dashboard).
|
||||
|
||||
{{< text plain >}}
|
||||
http://my-istio-dashboard.io/dashboard/db/istio-mesh-dashboard
|
||||
{{< /text >}}
|
||||
|
||||
In the top left drop-down menu, select _Istio Mesh Dashboard_.
|
||||
|
||||
|
|
|
|||
Binary file not shown.
|
Before Width: | Height: | Size: 100 KiB |
|
|
@ -1,112 +0,0 @@
|
|||
---
|
||||
title: Enable mutual TLS Authentication with Istio
|
||||
overview: Enable Mutual TLS Authentication on the traffic between microservices
|
||||
weight: 75
|
||||
|
||||
---
|
||||
|
||||
In your current configuration, microservices communicate using HTTP, which means the traffic
|
||||
is not encrypted.
|
||||
|
||||
Istio helps solve this problem by encrypting the traffic between the
|
||||
sidecars. This leaves only the traffic inside the application pods, and traffic
|
||||
between microservices and sidecars unencrypted.
|
||||
|
||||
In this module, you enable Istio
|
||||
[mutual TLS authentication](/docs/reference/glossary#mutual-tls-authentication)
|
||||
for the traffic between microservices in your namespace.
|
||||
|
||||
1. First, check that your microservices accept unencrypted traffic. Send an
|
||||
HTTP request to `ratings` from your testing pod, `sleep`:
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl exec -it $(kubectl get pod -l app=sleep -o jsonpath='{.items[0].metadata.name}') -- curl http://ratings:9080/ratings/7
|
||||
{"id":7,"ratings":{"Reviewer1":5,"Reviewer2":4}}
|
||||
{{< /text >}}
|
||||
|
||||
1. Enable mutual TLS authentication in your namespace:
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl apply -f - <<EOF
|
||||
apiVersion: authentication.istio.io/v1alpha1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: default
|
||||
spec:
|
||||
peers:
|
||||
- mtls: {}
|
||||
EOF
|
||||
$ kubectl apply -f {{< github_file >}}/samples/bookinfo/networking/destination-rule-all-mtls.yaml
|
||||
{{< /text >}}
|
||||
|
||||
{{< warning >}}
|
||||
In case you did not enable the Istio Ingress Gateway, run the following command, in addition to the command above.
|
||||
{{< /warning >}}
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl apply -f - <<EOF
|
||||
apiVersion: authentication.istio.io/v1alpha1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: disable-mtls-productpage
|
||||
spec:
|
||||
targets:
|
||||
- name: productpage
|
||||
peers: []
|
||||
---
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: DestinationRule
|
||||
metadata:
|
||||
name: productpage
|
||||
spec:
|
||||
host: productpage
|
||||
trafficPolicy:
|
||||
tls:
|
||||
mode: DISABLE
|
||||
EOF
|
||||
{{< /text >}}
|
||||
|
||||
1. Access your application's web page to verify that everything continues to work as expected. Recall that you
|
||||
recently changed the URL of the application, e.g. `http://istio.tutorial.bookinfo.com/productpage`).
|
||||
|
||||
1. Verify that your microservices do not accept unencrypted traffic anymore.
|
||||
Send an HTTP request to `ratings` from your testing pod, `sleep`:
|
||||
|
||||
{{< text bash >}}
|
||||
$ kubectl exec -it $(kubectl get pod -l app=sleep -o jsonpath='{.items[0].metadata.name}') -- curl http://ratings:9080/ratings/7
|
||||
curl: (56) Recv failure: Connection reset by peer
|
||||
command terminated with exit code 56
|
||||
{{< /text >}}
|
||||
|
||||
The last command failed as expected because your testing pod has no Istio
|
||||
sidecar and it sent an unencrypted HTTP request to your service that requires
|
||||
mutual TLS Authentication. Now communication is limited between services
|
||||
where Istio sidecars are injected and only if the traffic is encrypted by the sidecar.
|
||||
|
||||
1. Access the Istio dashboard at
|
||||
[http://my-istio-dashboard.io/dashboard/db/istio-mesh-dashboard](http://my-istio-dashboard.io/dashboard/db/istio-mesh-dashboard). Check `ratings` in _Istio Service Dashboard_. Notice that now a lock icon with text `mTLS` appears in
|
||||
_Service Workload_.
|
||||
|
||||
{{< image width="80%"
|
||||
link="dashboard-ratings-mtls.png"
|
||||
caption="Istio Service Dashboard"
|
||||
>}}
|
||||
|
||||
1. Check your Kiali console,
|
||||
[http://my-kiali.io/kiali/console](http://my-kiali.io/kiali/console), the graph of your namespace.
|
||||
|
||||
In the _Display_ drop-down menu mark the _Security_ check box to see locks
|
||||
that designate mutual TLS on the graph's edges.
|
||||
|
||||
{{< tip >}}
|
||||
You might zoom in to the graph view to see the lock icons clearly.
|
||||
{{< /tip >}}
|
||||
|
||||
{{< image width="80%"
|
||||
link="kiali-mtls.png"
|
||||
caption="Kiali Graph Tab with mutual TLS"
|
||||
>}}
|
||||
|
||||
Note that you made all the traffic between the pods in your cluster encrypted,
|
||||
transparently to your microservice, while changing neither code nor
|
||||
configuration of your microservices.
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 165 KiB |
|
|
@ -50,9 +50,14 @@ enable Istio on all the remaining microservices in one step.
|
|||
sleep-88ddbcfdd-cc85s 1/1 Running 0 7h
|
||||
{{< /text >}}
|
||||
|
||||
1. Access the Istio dashboard at
|
||||
[`http://my-istio-dashboard.io/dashboard/db/istio-mesh-dashboard`](http://my-istio-dashboard.io/dashboard/db/istio-mesh-dashboard).
|
||||
In the top left drop-down menu, select _Istio Mesh Dashboard_. Note that now all the services from your namespace
|
||||
1. Access the Istio dashboard using the custom URL you set in your `/etc/hosts` file
|
||||
[previously](/docs/examples/microservices-istio/bookinfo-kubernetes/#update-your-etc-hosts-configuration-file):
|
||||
|
||||
{{< text plain >}}
|
||||
http://my-istio-dashboard.io/dashboard/db/istio-mesh-dashboard
|
||||
{{< /text >}}
|
||||
|
||||
1. In the top left drop-down menu, select _Istio Mesh Dashboard_. Note that now all the services from your namespace
|
||||
appear in the list of services.
|
||||
|
||||
{{< image width="80%"
|
||||
|
|
@ -67,13 +72,19 @@ enable Istio on all the remaining microservices in one step.
|
|||
caption="Istio Service Dashboard"
|
||||
>}}
|
||||
|
||||
1. Visualize your application's topology by using the [Kiali](https://www.kiali.io) console, which is not a part of Istio.
|
||||
Access
|
||||
[`http://my-kiali.io/kiali/console`](http://my-kiali.io/kiali/console).
|
||||
(The `my-kiali.io` URL should be in your /etc/hosts file, you set it
|
||||
[previously](/docs/examples/microservices-istio/bookinfo-kubernetes/#update-your-etc-hosts-configuration-file)). If you installed Kiali as part of the [getting started](/docs/setup/getting-started/) instructions, your Kiali console user name is `admin` and the password is `admin`.
|
||||
1. Visualize your application's topology by using the
|
||||
[Kiali](https://www.kiali.io) console, which is not a part of Istio, but is
|
||||
installed as part of the `demo` configuration.
|
||||
Access the dashboard using the custom URL you set in your `/etc/hosts` file
|
||||
[previously](/docs/examples/microservices-istio/bookinfo-kubernetes/#update-your-etc-hosts-configuration-file):
|
||||
|
||||
Click on the Graph tab and select your namespace in the _Namespace_ drop-down menu in the top level corner.
|
||||
{{< text plain >}}
|
||||
http://my-kiali.io/kiali/console
|
||||
{{< /text >}}
|
||||
|
||||
If you installed Kiali as part of the [getting started](/docs/setup/getting-started/) instructions, your Kiali console user name is `admin` and the password is `admin`.
|
||||
|
||||
1. Click on the Graph tab and select your namespace in the _Namespace_ drop-down menu in the top level corner.
|
||||
In the _Display_ drop-down menu mark the _Traffic Animation_ check box to see some cool traffic animation.
|
||||
|
||||
{{< image width="80%"
|
||||
|
|
@ -81,7 +92,7 @@ enable Istio on all the remaining microservices in one step.
|
|||
caption="Kiali Graph Tab, display drop-down menu"
|
||||
>}}
|
||||
|
||||
Try different options in the _Edge Labels_ drop-down menu. Hover with the mouse over the nodes and edges of the
|
||||
1. Try different options in the _Edge Labels_ drop-down menu. Hover with the mouse over the nodes and edges of the
|
||||
graph. Notice the traffic metrics on the right.
|
||||
|
||||
{{< image width="80%"
|
||||
|
|
|
|||
|
|
@ -54,4 +54,30 @@ The queries above use the `istio_requests_total` metric, which is a standard Ist
|
|||
other metrics, in particular, the ones of Envoy ([Envoy](https://www.envoyproxy.io) is the sidecar proxy of Istio). You
|
||||
can see the collected metrics in the _insert metric at cursor_ drop-down menu.
|
||||
|
||||
You are ready to [enable mutual TLS authentication with Istio](/docs/examples/microservices-istio/add-mtls).
|
||||
## Next steps
|
||||
|
||||
Congratulations on completing the tutorial!
|
||||
|
||||
These tasks are a great place for beginners to further evaluate Istio's
|
||||
features using this `demo` installation:
|
||||
|
||||
- [Request routing](/docs/tasks/traffic-management/request-routing/)
|
||||
- [Fault injection](/docs/tasks/traffic-management/fault-injection/)
|
||||
- [Traffic shifting](/docs/tasks/traffic-management/traffic-shifting/)
|
||||
- [Querying metrics](/docs/tasks/observability/metrics/querying-metrics/)
|
||||
- [Visualizing metrics](/docs/tasks/observability/metrics/using-istio-dashboard/)
|
||||
- [Rate limiting](/docs/tasks/policy-enforcement/rate-limiting/)
|
||||
- [Accessing external services](/docs/tasks/traffic-management/egress/egress-control/)
|
||||
- [Visualizing your mesh](/docs/tasks/observability/kiali/)
|
||||
|
||||
Before you customize Istio for production use, see these resources:
|
||||
|
||||
- [Deployment models](/docs/ops/deployment/deployment-models/)
|
||||
- [Deployment best practices](/docs/ops/best-practices/deployment/)
|
||||
- [Pod requirements](/docs/ops/deployment/requirements/)
|
||||
- [General installation instructions](/docs/setup/)
|
||||
|
||||
## Join the Istio community
|
||||
|
||||
We welcome you to ask questions and give us feedback by joining the
|
||||
[Istio community](/about/community/join/).
|
||||
|
|
|
|||
Loading…
Reference in New Issue