mirror of https://github.com/istio/istio.io.git
2 lines
21 KiB
HTML
2 lines
21 KiB
HTML
<!DOCTYPE html><html lang="en" itemscope itemtype="https://schema.org/WebPage" style="overflow-y: scroll;"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="title" content="Auth"><meta name="og:title" content="Auth"><meta name="og:image" content="/v0.1/img/logo.png"/><meta name="description" content="Architectural deep-dive into the design of Auth, which provides the secure communication channel and strong identity for Istio."><meta name="og:description" content="Architectural deep-dive into the design of Auth, which provides the secure communication channel and strong identity for Istio."><title>Istioldie 0.1 / Auth</title><script> window.ga=window.ga||function(){(ga.q=ga.q||[]).push(arguments)};ga.l=+new Date; ga('create', 'UA-98480406-2', 'auto'); ga('send', 'pageview'); </script> <script async src='https://www.google-analytics.com/analytics.js'></script><link href='https://fonts.googleapis.com/css?family=Roboto:400,100,100italic,300,300italic,400italic,500,500italic,700,700italic,900,900italic' rel='stylesheet' type='text/css'><link rel="alternate" type="application/rss+xml" title="Istio Blog RSS" href="/v0.1/feed.xml"><link rel="apple-touch-icon" href="/v0.1/favicons/apple-touch-icon.png" sizes="180x180"><link rel="icon" type="image/png" href="/v0.1/favicons/android-chrome-96x96.png" sizes="96x96" ><link rel="icon" type="image/png" href="/v0.1/favicons/favicon-32x32.png" sizes="32x32"><link rel="icon" type="image/png" href="/v0.1/favicons/favicon-16x16.png" sizes="16x16"><link rel="manifest" href="/v0.1/favicons/manifest.json"><link rel="mask-icon" href="/v0.1/favicons/safari-pinned-tab.svg" color="#2DA6B0"><meta name="msapplication-TileColor" content="#ffffff"><meta name="msapplication-TileImage" content="/v0.1/favicons/mstile-150x150.png"><link href="//maxcdn.bootstrapcdn.com/bootstrap/3.3.1/css/bootstrap.min.css" rel="stylesheet"><link rel="stylesheet" href="/v0.1/css/all.css"><link rel="stylesheet" href="/v0.1/css/prism.css"><link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css"> <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js"></script></head><body class="language-unknown"><div class="nav-hero-container" style="z-index: 200000;"><nav id="header-nav" class="navbar navbar-inverse" role="navigation"><div class="container"><div class="row"><div class="col-md-11 nofloat center-block "><div class="navbar-header"> <button type="button" class="hamburger navbar-toggle collapsed" data-toggle="collapse" data-target="#navbar-collapse-1" aria-expanded="false"> <span class="sr-only">Toggle navigation</span> <span class="icon-bar"></span> <span class="icon-bar"></span> <span class="icon-bar"></span> </button> <a class="navbar-brand" href="/v0.1/"><div> <img src="/v0.1/img/logo.png" alt="Istio" width="36px" height="54px"/> <span class="brand-name">Istioldie 0.1</span></div></a></div><div class="collapse navbar-collapse" id="navbar-collapse-1"><ul class="nav navbar-nav navbar-right"><li><a href="/v0.1/about/" >About</a></li><li><a href="/v0.1/docs/" class='current'>Docs</a></li><li><a href="/v0.1/blog/" >Blog</a></li><li><a href="/v0.1/community/" >Community</a></li><li><a href="/v0.1/faq/" >FAQ</a></li><li class="dropdown"> <a class="dropdown-toggle" data-toggle="dropdown" href=""> <i class='fa fa-lg fa-cog'></i> <span class="caret"></span> </a><ul class="dropdown-menu"><h6 class="dropdown-header">Other versions of this site</h6><li> <a href="https://istio.io">Current Release</a></li><li> <a href="https://preliminary.istio.io">Next Release</a></li><li> <a href="https://archive.istio.io">Older Releases</a></li></ul></li><li><form name="cse" id="searchbox_demo" class="navbar-form navbar-right" role="search"> <input type="hidden" name="cx" value="013699703217164175118:iwwf17ikgf4" /> <input type="hidden" name="ie" value="utf-8" /> <input type="hidden" name="hl" value="en" /><div class="form-group"><div class="input-group"> <input name="q" class="form-control" type="text" size="30" /><div class="input-group-addon"> <span class="btn-search glyphicon glyphicon-search"></span></div></div></div></form> <script type="text/javascript" src="https://www.google.com/cse/brand?form=searchbox_demo"></script></li></ul></div></div></div></div></nav></div><div class="container"><div class="row"><div class="col-md-11 nofloat center-block" style="margin-top: 3px;"><ul class="col-sm-10 nav nav-tabs"><li role="presentation" ><a href="/v0.1/docs/index.html">Welcome</a></li><li role="presentation" class='active'><a href="/v0.1/docs/concepts/index.html">Concepts</a></li><li role="presentation" ><a href="/v0.1/docs/tasks/index.html">Tasks</a></li><li role="presentation" ><a href="/v0.1/docs/samples/index.html">Samples</a></li><li role="presentation" ><a href="/v0.1/docs/reference/index.html">Reference</a></li></ul></div></div></div><script src="/v0.1/js/navtree.js"></script><div class="container docs"><div class="row"><div class="col-md-11 nofloat center-block"><div class="row"><div id="sidebar-container" class="col-sm-3"><ul class="doc-side-nav"><li><h5 class='doc-side-nav-title'>Concepts</h5></li><script type="text/javascript"> var docs = []; docs.push({path: [ "index.md", ], url: "/docs/concepts/index.html", title: "Concepts", order: 10, overview: "Concepts help you learn about the different parts of the Istio system and the abstractions it uses."}); docs.push({path: [ "network-and-auth", "auth.md", ], url: "/docs/concepts/network-and-auth/auth.html", title: "Auth", order: 10, overview: "Architectural deep-dive into the design of Auth, which provides the secure communication channel and strong identity for Istio."}); docs.push({path: [ "network-and-auth", "index.md", ], url: "/docs/concepts/network-and-auth/index.html", title: "Network and Auth", order: 30, overview: "Introduces core network and authentication functionality."}); docs.push({path: [ "policy-and-control", "attributes.md", ], url: "/docs/concepts/policy-and-control/attributes.html", title: "Attributes", order: 10, overview: "Explains the important notion of attributes, which is a central mechanism for how policies and control are applied to services within the mesh."}); docs.push({path: [ "policy-and-control", "index.md", ], url: "/docs/concepts/policy-and-control/index.html", title: "Policies and Control", order: 40, overview: "Introduces the policy control mechanisms."}); docs.push({path: [ "policy-and-control", "mixer-aspect-config.md", ], url: "/docs/concepts/policy-and-control/mixer-aspect-config.html", title: "Mixer Aspect Configuration", order: 38, overview: "Explains how to configure a Mixer Aspect and its dependencies."}); docs.push({path: [ "policy-and-control", "mixer-config.md", ], url: "/docs/concepts/policy-and-control/mixer-config.html", title: "Mixer Configuration", order: 30, overview: "An overview of the key concepts used to configure Mixer."}); docs.push({path: [ "policy-and-control", "mixer.md", ], url: "/docs/concepts/policy-and-control/mixer.html", title: "Mixer", order: 20, overview: "Architectural deep-dive into the design of Mixer, which provides the policy and control mechanisms within the service mesh."}); docs.push({path: [ "traffic-management", "fault-injection.md", ], url: "/docs/concepts/traffic-management/fault-injection.html", title: "Fault Injection", order: 40, overview: "Introduces the idea of systematic fault injection that can be used to uncover conflicting failure recovery policies across services."}); docs.push({path: [ "traffic-management", "handling-failures.md", ], url: "/docs/concepts/traffic-management/handling-failures.html", title: "Handling Failures", order: 30, overview: "An overview of failure recovery capabilities in Envoy that can be leveraged by unmodified applications to improve robustness and prevent cascading failures."}); docs.push({path: [ "traffic-management", "index.md", ], url: "/docs/concepts/traffic-management/index.html", title: "Traffic Management", order: 20, overview: "Describes the various Istio features focused on traffic routing and control."}); docs.push({path: [ "traffic-management", "load-balancing.md", ], url: "/docs/concepts/traffic-management/load-balancing.html", title: "Discovery & Load Balancing", order: 25, overview: "Describes how traffic is load balanced across instances of a service in the mesh."}); docs.push({path: [ "traffic-management", "overview.md", ], url: "/docs/concepts/traffic-management/overview.html", title: "Overview", order: 0, overview: "Provides a conceptual overview of traffic management in Istio and the features it enables."}); docs.push({path: [ "traffic-management", "pilot.md", ], url: "/docs/concepts/traffic-management/pilot.html", title: "Pilot", order: 10, overview: "Introduces Pilot, the component responsible for managing a distributed deployment of Envoy proxies in the service mesh."}); docs.push({path: [ "traffic-management", "request-routing.md", ], url: "/docs/concepts/traffic-management/request-routing.html", title: "Request Routing", order: 20, overview: "Describes how requests are routed between services in an Istio service mesh."}); docs.push({path: [ "traffic-management", "rules-configuration.md", ], url: "/docs/concepts/traffic-management/rules-configuration.html", title: "Rules Configuration", order: 50, overview: "Provides a high-level overview of the domain-specific language used by Istio to configure traffic management rules in the service mesh."}); docs.push({path: [ "what-is-istio", "goals.md", ], url: "/docs/concepts/what-is-istio/goals.html", title: "Design Goals", order: 20, overview: "Describes the core principles that Istio's design adheres to."}); docs.push({path: [ "what-is-istio", "index.md", ], url: "/docs/concepts/what-is-istio/index.html", title: "What is Istio?", order: 10, overview: "A broad overview of the Istio system."}); docs.push({path: [ "what-is-istio", "overview.md", ], url: "/docs/concepts/what-is-istio/overview.html", title: "Overview", order: 15, overview: "Provides a conceptual introduction to Istio, including the problems it solves and its high-level architecture."}); genNavBarTree(docs) </script></ul></div><div id="tab-container" class="col-xs-1 tab-neg-margin pull-left"> <a id="sidebar-tab" class="glyphicon glyphicon-chevron-left" href="javascript:void 0;"></a></div><div id="content-container" class="thin-left-border col-sm-9 markdown"><div id="toc" class="toc"></div><div id="doc-content"><h1>Auth</h1><h2 id="overview">Overview</h2><p>Istio Auth’s aim is to enhance the security of microservices and their communication without requiring service code changes. It is responsible for:</p><ul><li><p>Providing each service with a strong identity that represents its role to enable interoperability across clusters and clouds</p></li><li><p>Securing service to service communication</p></li><li><p>Providing a key management system to automate key and certificate generation, distribution, rotation, and revocation</p></li></ul><p>In future versions it will also provide:</p><ul><li><p>Securing end-user to service communication</p></li><li><p>Fine-grained authorization and auditing to control and monitor who accesses your services, apis, or resources</p></li><li><p>Multiple authorization mechanisms: <a href="https://en.wikipedia.org/wiki/Attribute-Based_Access_Control">ABAC</a>, <a href="https://en.wikipedia.org/wiki/Role-based_access_control">RBAC</a>, Authorization hooks</p></li></ul><h2 id="architecture">Architecture</h2><p>The figure below shows the Istio Auth architecture, which includes three components: identity, key management, and communication security. It describes how Istio Auth is used to secure service-to-service communication between service A, running as service account “foo”, and service B, running as service account “bar”.</p><figure><img src="./img/auth/auth.svg" alt="Components making up the Istio auth model." title="Istio Auth Architecture" /><figcaption>Istio Auth Architecture</figcaption></figure><h2 id="components">Components</h2><h3 id="identity">Identity</h3><p>When running on Kubernetes, Istio Auth uses <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/">Kubernetes service accounts</a> to identify who runs the service because of the following reasons:</p><ul><li><p>A service account is <strong>the identity (or role) a workload runs as</strong>, which represents that workload’s privileges. For systems requiring strong security, the amount of privilege for a workload should not be identified by a random string (i.e., service name, label, etc), or by the binary that is deployed.</p><ul><li>For example, let’s say we have a workload pulling data from a multi-tenant database. If Alice ran this workload, she will be able to pull a different set of data than if Bob ran this workload.</li></ul></li><li><p>Service accounts enable strong security policies by offering the flexibility to identify a machine, a user, a workload, or a group of workloads (different workloads can run as the same service account).</p></li><li><p>The service account a workload runs as won’t change during the lifetime of the workload.</p></li><li><p>Service account uniqueness can be ensured with domain name constraint</p></li></ul><h3 id="communication-security">Communication security</h3><p>Service-to-service communication is tunneled through the client side <a href="https://lyft.github.io/envoy/">Envoy</a> and the server side Envoy. End-to-end communication is secured by:</p><ul><li><p>Local TCP connections between the service and Envoy</p></li><li><p>Mutual TLS connections between proxies</p></li><li><p>Secure Naming: during the handshake process, the client side Envoy checks that the service account provided by the server side certificate is allowed to run the target service</p></li></ul><h3 id="key-management">Key management</h3><p>Istio Auth provides a per-cluster CA (Certificate Authority) to automate key and certificate management. It performs four key operations:</p><ul><li><p>Generate a <a href="https://spiffe.github.io/docs/svid">SPIFFE</a> key and certificate pair for each service account</p></li><li><p>Distribute a key and certificate pair to each pod according to the service account</p></li><li><p>Rotate keys and certificates periodically</p></li><li><p>Revoke a specific key and certificate pair when necessary</p></li></ul><h2 id="workflow">Workflow</h2><p>Istio Auth workflow consists of two phases, deployment and runtime. This section covers both of them.</p><h3 id="deployment-phase">Deployment phase</h3><ol><li><p>Istio CA watches Kubernetes API Server, creates a <a href="https://spiffe.github.io/docs/svid">SPIFFE</a> key and certificate pair for each of the existing and new service accounts, and sends them to API Server.</p></li><li><p>When a pod is created, API Server mounts the key and certificate pair according to the service account using <a href="https://kubernetes.io/docs/concepts/configuration/secret/">Kubernetes secrets</a>.</p></li><li><p><a href="/v0.1/docs/concepts/traffic-management/pilot.html">Pilot</a> generates the config with proper key and certificate and secure naming information, which defines what service account(s) can run a certain service, and passes it to Envoy.</p></li></ol><h3 id="runtime-phase">Runtime phase</h3><ol><li><p>The outbound traffic from a client service is rerouted to its local Envoy.</p></li><li><p>The client side Envoy starts a mutual TLS handshake with the server side Envoy. During the handshake, it also does a secure naming check to verify that the service account presented in the server certificate can run the server service.</p></li><li><p>The traffic is forwarded to the server side Envoy after mTLS connection is established, which is then forwarded to the server service through local TCP connections.</p></li></ol><h2 id="best-practices">Best practices</h2><p>In this section, we provide a few deployment guidelines and then discuss a real-world scenario.</p><h3 id="deployment-guidelines">Deployment guidelines</h3><ul><li><p>If there are multiple service operators (a.k.a. <a href="https://en.wikipedia.org/wiki/Site_reliability_engineering">SREs</a>) deploying different services in a cluster (typically in a medium- or large-size cluster), we recommend creating a separate <a href="https://kubernetes.io/docs/tasks/administer-cluster/namespaces-walkthrough/">namespace</a> for each SRE team to isolate their access. For example, you could create a “team1-ns” namespace for team1, and “team2-ns” namespace for team2, such that both teams won’t be able to access each other’s services.</p></li><li><p>If Istio CA is compromised, all its managed keys and certificates in the cluster may be exposed. We <em>strongly</em> recommend running Istio CA on a dedicated namespace (for example, istio-ca-ns), which only cluster admins have access to.</p></li></ul><h3 id="example">Example</h3><p>Let’s consider a 3-tier application with three services: photo-frontend, photo-backend, and datastore. Photo-frontend and photo-backend services are managed by the photo SRE team while the datastore service is managed by the datastore SRE team. Photo-frontend can access photo-backend, and photo-backend can access datastore. However, photo-frontend cannot access datastore.</p><p>In this scenario, a cluster admin creates 3 namespaces: istio-ca-ns, photo-ns, and datastore-ns. Admin has access to all namespaces, and each team only has access to its own namespace. The photo SRE team creates 2 service accounts to run photo-frontend and photo-backend respectively in namespace photo-ns. The datastore SRE team creates 1 service account to run the datastore service in namespace datastore-ns. Moreover, we need to enforce the service access control in <a href="/v0.1/docs/concepts/policy-and-control/mixer.html">Istio Mixer</a> such that photo-frontend cannot access datastore.</p><p>In this setup, Istio CA is able to provide keys and certificates management for all namespaces, and isolate microservice deployments from each other.</p><h2 id="future-work">Future work</h2><ul><li><p>Fine-grained authorization and auditing</p></li><li><p>Secure Istio components (Mixer, Pilot, etc.)</p></li><li><p>Inter-cluster service-to-service authentication</p></li><li><p>End-user to service authentication using JWT/OAuth2/OpenID_Connect</p></li><li><p>Support GCP service account and AWS service account</p></li><li><p>Non-http traffic (MySql, Redis, etc.) support</p></li><li><p>Unix domain socket for local communication between service and Envoy</p></li><li><p>Middle proxy support</p></li><li><p>Pluggable key management component</p></li></ul></div></div></div></div></div></div><script src="/v0.1/js/sidemenu.js"></script><footer><div class="container"><div class="row"><div class="col-md-2"></div><div class="col-md-3 col-sm-4 col-xs-12 center-block"><ul class="toggle"><p class="header">Docs</p><li><a href="/v0.1/docs/">Welcome</a></li><li><a href="/v0.1/docs/concepts">Concepts</a></li><li><a href="/v0.1/docs/tasks">Tasks</a></li><li><a href="/v0.1/docs/samples">Samples</a></li><li><a href="/v0.1/docs/reference">Reference</a></li></ul></div><hr class="footer-sections" /><div class="col-md-3 col-sm-4 col-xs-12 center-block"><ul class="toggle"><p class="header">Resources</p><li><a href="/v0.1/faq">Frequently Asked Questions</a></li><li><a href="/v0.1/troubleshooting">Troubleshooting Guide</a></li><li><a href="/v0.1/bugs">Report a Bug</a></li><li><a href="https://github.com/istio/istio.github.io/issues/new?title=Issue with _docs/concepts/network-and-auth/auth.md">Report a Doc Issue</a></li><li><a href="https://github.com/istio/istio.github.io/edit/master/_docs/concepts/network-and-auth/auth.md">Edit This Page on GitHub</a></li></ul></div><hr class="footer-sections" /><div class="col-md-3 col-sm-4 col-xs-12 center-block"><ul class="toggle"><p class="header">Community</p><li><a href="https://groups.google.com/forum/#!forum/istio-users" target="_blank"><span class="group">User</span></a> | <a href="https://groups.google.com/forum/#!forum/istio-dev" target="_blank">Dev Mailing Lists</a></li><li><a href="https://twitter.com/IstioMesh" target="_blank"><span class="twitter">Twitter</span></a></li><li><a href="https://github.com/istio/istio" target="_blank"><span class="github">GitHub</span></a></li></ul></div><div class="col-md-1"></div></div><div class="row"><p class="description small text-center"> Copyright © 2017 Istio Authors<br> Istio 0.1<br> Archived on 20-Jul-2017</p></div></div></footer><script src="https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.15.0/jquery.validate.min.js"></script> <script src="/v0.1/js/jquery.form.min.js"></script> <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.1/js/bootstrap.min.js"></script> <script src="/v0.1/js/slick.min.js"></script> <script src="/v0.1/js/jquery.visible.min.js"></script> <script src="/v0.1/js/common.js" type="text/javascript" charset="utf-8"></script> <script src="/v0.1/js/buttons.js"></script> <script src="/v0.1/js/search.js"></script> <script src="/v0.1/js/prism.js"></script></body></html>
|