mirror of https://github.com/istio/istio.io.git
28 lines
9.2 KiB
XML
28 lines
9.2 KiB
XML
<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Security on Istio</title><link>/v1.3/docs/tasks/security/</link><description>Recent content in Security on Istio</description><generator>Hugo -- gohugo.io</generator><language>en-us</language><atom:link href="/v1.3/docs/tasks/security/feed.xml" rel="self" type="application/rss+xml"/><item><title>Authentication Policy</title><link>/v1.3/docs/tasks/security/authn-policy/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>/v1.3/docs/tasks/security/authn-policy/</guid><description>This task covers the primary activities you might need to perform when enabling, configuring, and using Istio authentication policies. Find out more about the underlying concepts in the authentication overview.
|
|
Before you begin Understand Istio authentication policy and related mutual TLS authentication concepts.
|
|
Have a Kubernetes cluster with Istio installed, without global mutual TLS enabled (e.g use install/kubernetes/istio-demo.yaml as described in installation steps, or set global.mtls.enabled to false using Helm).</description></item><item><title>Authorization for HTTP Services</title><link>/v1.3/docs/tasks/security/authz-http/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>/v1.3/docs/tasks/security/authz-http/</guid><description>This task covers the activities you might need to perform to set up Istio authorization, also known as Istio Role Based Access Control (RBAC), for HTTP services in an Istio mesh. You can read more in authorization and get started with a basic tutorial in Istio Security Basics.
|
|
Before you begin The activities in this task assume that you:
|
|
Read the authorization concept.
|
|
Follow the Kubernetes quick start to install Istio using the strict mutual TLS profile.</description></item><item><title>Authorization for TCP Services</title><link>/v1.3/docs/tasks/security/authz-tcp/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>/v1.3/docs/tasks/security/authz-tcp/</guid><description>This task covers the activities you might need to perform to set up Istio authorization, also known as Istio Role Based Access Control (RBAC), for TCP services in an Istio mesh. You can learn more about the Istio authorization in the authorization concept page.
|
|
Before you begin The activities in this task assume that you:
|
|
Read the authorization concept.
|
|
Follow the Kubernetes quick start to install Istio using the strict mutual TLS profile.</description></item><item><title>Authorization for groups and list claims</title><link>/v1.3/docs/tasks/security/rbac-groups/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>/v1.3/docs/tasks/security/rbac-groups/</guid><description>This tutorial walks you through examples to configure the groups-base authorization and the authorization of list-typed claims in Istio.
|
|
Before you begin Read the authorization concept and go through the guide on how to configure Istio authorization.
|
|
Read the Istio authentication policy and the related mutual TLS authentication concepts.
|
|
Create a Kubernetes cluster with Istio installed and mutual TLS enabled. To fulfill this prerequisite you can follow the Kubernetes installation instructions.</description></item><item><title>Authorization permissive mode</title><link>/v1.3/docs/tasks/security/authz-permissive/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>/v1.3/docs/tasks/security/authz-permissive/</guid><description>The authorization permissive mode allows you to verify authorization policies before applying them in a production environment.
|
|
The authorization permissive mode is an experimental feature in version 1.1. Its interface can change in future releases. If you do not want to try out the permissive mode feature, you can directly enable Istio authorization to skip enabling the permissive mode.
|
|
This task covers two scenarios regarding the use of the permissive mode for authorization:</description></item><item><title>Mutual TLS Deep-Dive</title><link>/v1.3/docs/tasks/security/mutual-tls/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>/v1.3/docs/tasks/security/mutual-tls/</guid><description>Through this task, you can have closer look at mutual TLS and learn its settings. This task assumes:
|
|
You have completed the authentication policy task. You are familiar with using authentication policy to enable mutual TLS. Istio runs on Kubernetes with global mutual TLS enabled. You can follow our instructions to install Istio. If you already have Istio installed, you can add or modify authentication policies and destination rules to enable mutual TLS as described in this task.</description></item><item><title>Plugging in External CA Key and Certificate</title><link>/v1.3/docs/tasks/security/plugin-ca-cert/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>/v1.3/docs/tasks/security/plugin-ca-cert/</guid><description>This task shows how operators can configure Citadel with existing root certificate, signing certificate and key.
|
|
By default, Citadel generates self-signed root certificate and key, and uses them to sign the workload certificates. Citadel can also use the operator-specified certificate and key to sign workload certificates, with operator-specified root certificate. This task demonstrates an example to plug certificates and key into Citadel.
|
|
Before you begin Set up Istio by following the instructions in the quick start with global mutual TLS enabled: Follow the installation instructions install Istio with the strict mutual TLS mode enabled.</description></item><item><title>Citadel Health Checking</title><link>/v1.3/docs/tasks/security/health-check/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>/v1.3/docs/tasks/security/health-check/</guid><description>You can enable Citadel&rsquo;s health checking feature to detect the failures of the Citadel CSR (Certificate Signing Request) service. When a failure is detected, Kubelet automatically restarts the Citadel container.
|
|
When the health checking feature is enabled, the prober client module in Citadel periodically checks the health status of Citadel&rsquo;s CSR gRPC server. It does this by sending CSRs to the gRPC server and verifies the responses. If Citadel is healthy, the prober client updates the modification time of the health status file.</description></item><item><title>Provisioning Identity through SDS</title><link>/v1.3/docs/tasks/security/auth-sds/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>/v1.3/docs/tasks/security/auth-sds/</guid><description>This task shows how to enable SDS (secret discovery service) for Istio identity provisioning.
|
|
Prior to Istio 1.1, the keys and certificates of Istio workloads were generated by Citadel and distributed to sidecars through secret-volume mounted files, this approach has the following minor drawbacks:
|
|
Performance regression during certificate rotation: When certificate rotation happens, Envoy is hot restarted to pick up the new key and certificate, causing performance regression.</description></item><item><title>Configure Citadel Service Account Secret Generation</title><link>/v1.3/docs/tasks/security/ca-namespace-targeting/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>/v1.3/docs/tasks/security/ca-namespace-targeting/</guid><description>A cluster operator might decide not to generate ServiceAccount secrets for some subset of namespaces, or to make ServiceAccount secret generation opt-in per namespace. This task describes how an operator can configure their cluster for these situations. Full documentation of the Citadel namespace targeting mechanism can be found here.
|
|
Before you begin To complete this task, you should first take the following actions:
|
|
Read the security concept.
|
|
Follow the Kubernetes quick start to install Istio using the strict mutual TLS profile.</description></item><item><title>Mutual TLS Migration</title><link>/v1.3/docs/tasks/security/mtls-migration/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>/v1.3/docs/tasks/security/mtls-migration/</guid><description>This task shows how to migrate your existing Istio services&rsquo; traffic from plain text to mutual TLS without breaking live traffic.
|
|
In the scenario where there are many services communicating over the network, it may be desirable to gradually migrate them to Istio. During the migration, some services have Envoy sidecars while some do not. For a service with a sidecar, if you enable mutual TLS on the service, the connections from legacy clients (i.</description></item><item><title>Mutual TLS over HTTPS</title><link>/v1.3/docs/tasks/security/https-overlay/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>/v1.3/docs/tasks/security/https-overlay/</guid><description>This task shows how mutual TLS works with HTTPS services. It includes:
|
|
Deploying an HTTPS service without Istio sidecar
|
|
Deploying an HTTPS service with Istio with mutual TLS disabled
|
|
Deploying an HTTPS service with mutual TLS enabled. For each deployment, connect to this service and verify it works.
|
|
When the Istio sidecar is deployed with an HTTPS service, the proxy automatically downgrades from L7 to L4 (no matter mutual TLS is enabled or not), which means it does not terminate the original HTTPS traffic.</description></item></channel></rss> |