mirror of https://github.com/istio/istio.io.git
127 lines
31 KiB
HTML
127 lines
31 KiB
HTML
<!doctype html><html lang=en itemscope itemtype=https://schema.org/WebPage><head><meta charset=utf-8><meta http-equiv=x-ua-compatible content="IE=edge"><meta name=viewport content="width=device-width,initial-scale=1,shrink-to-fit=no"><meta name=theme-color content=#466BB0><meta name=title content="Security FAQ"><meta name=description content="Security Q & A."><meta name=keywords content=microservices,services,mesh><meta property=og:title content="Security FAQ"><meta property=og:type content=website><meta property=og:description content="Security Q & A."><meta property=og:url content=/v1.1/help/faq/security/><meta property=og:image content=/v1.1/img/istio-whitelogo-bluebackground-framed.svg><meta property=og:image:alt content="Istio Logo"><meta property=og:image:width content=112><meta property=og:image:height content=150><meta property=og:site_name content=Istio><meta name=twitter:card content=summary><meta name=twitter:site content=@IstioMesh><title>Istioldie 1.1 / Security FAQ</title><script async src="https://www.googletagmanager.com/gtag/js?id=UA-98480406-2"></script><script>window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}
|
|
gtag('js',new Date());gtag('config','UA-98480406-2');</script><link rel=alternate type=application/rss+xml title="Istio Blog" href=/v1.1/feed.xml><link rel="shortcut icon" href=/v1.1/favicons/favicon.ico><link rel=apple-touch-icon href=/v1.1/favicons/apple-touch-icon-180x180.png sizes=180x180><link rel=icon type=image/png href=/v1.1/favicons/favicon-16x16.png sizes=16x16><link rel=icon type=image/png href=/v1.1/favicons/favicon-32x32.png sizes=32x32><link rel=icon type=image/png href=/v1.1/favicons/android-36x36.png sizes=36x36><link rel=icon type=image/png href=/v1.1/favicons/android-48x48.png sizes=48x48><link rel=icon type=image/png href=/v1.1/favicons/android-72x72.png sizes=72x72><link rel=icon type=image/png href=/v1.1/favicons/android-96x96.png sizes=96xW96><link rel=icon type=image/png href=/v1.1/favicons/android-144x144.png sizes=144x144><link rel=icon type=image/png href=/v1.1/favicons/android-192x192.png sizes=192x192><link rel=manifest href=/v1.1/manifest.json><meta name=apple-mobile-web-app-title content=Istio><meta name=application-name content=Istio><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Work+Sans:400|Chivo:400|Work+Sans:500,300,600,300italic,400italic,500italic,600italic|Chivo:500,300,600,300italic,400italic,500italic,600italic"><link rel=stylesheet href=/v1.1/css/all.css></head><body class="language-unknown archive-site"><script src=/v1.1/js/themes_init.min.js></script><script>const branchName="release-1.1";const docTitle="Security FAQ";const iconFile="\/v1.1/img/icons.svg";const buttonCopy='Copy to clipboard';const buttonPrint='Print';const buttonDownload='Download';</script><script src="https://www.google.com/cse/brand?form=search-form" defer></script><script src=/v1.1/js/all.min.js data-manual defer></script><header><nav><a id=brand href=/v1.1/><span class=logo><svg viewBox="0 0 300 300"><circle cx="150" cy="150" r="146" stroke-width="2" /><path d="M65 240H225L125 270z"/><path d="M65 230l60-10V110z"/><path d="M135 220l90 10L135 30z"/></svg></span><span class=name>Istioldie 1.1</span></a><div id=hamburger><svg class="icon"><use xlink:href="/v1.1/img/icons.svg#hamburger"/></svg></div><div id=header-links><a title="Learn how to deploy, use, and operate Istio." href=/v1.1/docs/>Docs</a>
|
|
<a title="Posts about using Istio." href=/v1.1/blog/2019/announcing-1.1.9/>Blog</a>
|
|
<span title="A bunch of resources to help you deploy, configure and use Istio.">Help</span>
|
|
<a title="Get a bit more in-depth info about the Istio project." href=/v1.1/about/>About</a><div class=menu><button id=gearDropdownButton class=menu-trigger title="Options and settings" aria-label="Options and Settings" aria-controls=gearDropdownContent><svg class="icon"><use xlink:href="/v1.1/img/icons.svg#gear"/></svg></button><div id=gearDropdownContent class=menu-content aria-labelledby=gearDropdownButton role=menu><a tabindex=-1 role=menuitem lang=en id=switch-lang-en class=active>English</a>
|
|
<a tabindex=-1 role=menuitem lang=zh id=switch-lang-zh>中文</a><div role=separator></div><a tabindex=-1 role=menuitem class=active id=light-theme-item>Light Theme</a>
|
|
<a tabindex=-1 role=menuitem id=dark-theme-item>Dark Theme</a><div role=separator></div><a tabindex=-1 role=menuitem id=syntax-coloring-item>Color Examples</a><div role=separator></div><h6>Other versions of this site</h6><a tabindex=-1 role=menuitem onclick="navigateToUrlOrRoot('https://istio.io/help\/faq\/security\/');return false;">Current Release</a>
|
|
<a tabindex=-1 role=menuitem onclick="navigateToUrlOrRoot('https://preliminary.istio.io/help\/faq\/security\/');return false;">Next Release</a>
|
|
<a tabindex=-1 role=menuitem href=https://archive.istio.io>Older Releases</a></div></div><button id=search-show title="Search this site" aria-label=Search><svg class="icon"><use xlink:href="/v1.1/img/icons.svg#magnifier"/></svg></button></div><form id=search-form name=cse role=search><input type=hidden name=cx value=013699703217164175118:iwwf17ikgf4>
|
|
<input type=hidden name=ie value=utf-8>
|
|
<input type=hidden name=hl value=en>
|
|
<input type=hidden id=search-page-url value=/v1.1/search.html>
|
|
<input id=search-textbox class=form-control name=q type=search aria-label="Search this site">
|
|
<button id=search-close title="Cancel search" type=reset aria-label="Cancel search"><svg class="icon"><use xlink:href="/v1.1/img/icons.svg#cancel-x"/></svg></button></form></nav></header><main class="primary notoc"><div id=sidebar-container class="sidebar-container sidebar-offcanvas"><nav id=sidebar aria-label="Section Navigation"><div class=directory><div class=card><div id=header0 class=header title="A bunch of resources to help you deploy, configure and use Istio."><svg class="icon"><use xlink:href="/v1.1/img/icons.svg#help"/></svg>Need Help?</div><div class="body default" aria-labelledby=header0><ul role=tree aria-expanded=true aria-labelledby=header0><li role=treeitem aria-label="Operations Guide"><button aria-hidden=true></button><a title="Hints, tips, tricks about running an Istio mesh." href=/v1.1/help/ops/>Operations Guide</a><ul role=group aria-expanded=false><li role=none><a role=treeitem title="Describes how to use component-level logging to get insights into a running component's behavior." href=/v1.1/help/ops/component-logging/>Component Logging</a></li><li role=none><a role=treeitem title="Describes how to use ControlZ to get insight into individual running components." href=/v1.1/help/ops/controlz/>Component Introspection</a></li><li role=none><a role=treeitem title="How to do low-level debugging of Istio components." href=/v1.1/help/ops/component-debugging/>Component Debugging</a></li><li role=treeitem aria-label="Traffic Management"><button aria-hidden=true></button><a title="Helps you manage the networking aspects of a running mesh." href=/v1.1/help/ops/traffic-management/>Traffic Management</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="An introduction to Istio networking operational aspects." href=/v1.1/help/ops/traffic-management/introduction/>Introduction to Network Operations</a></li><li role=none><a role=treeitem title="Provides specific deployment and configuration guidelines." href=/v1.1/help/ops/traffic-management/deploy-guidelines/>Deployment and Configuration Guidelines</a></li><li role=none><a role=treeitem title="Describes common networking issues and how to recognize and avoid them." href=/v1.1/help/ops/traffic-management/troubleshooting/>Troubleshooting Networking Issues</a></li><li role=none><a role=treeitem title="Describes tools and techniques to diagnose Envoy configuration issues related to traffic management." href=/v1.1/help/ops/traffic-management/proxy-cmd/>Debugging Envoy and Pilot</a></li><li role=none><a role=treeitem title="Information on how to enable and understand Locality Load Balancing." href=/v1.1/help/ops/traffic-management/locality-load-balancing/>Locality Load Balancing</a></li></ul></li><li role=treeitem aria-label=Security><button aria-hidden=true></button><a title="Helps you manage the security aspects of a running mesh." href=/v1.1/help/ops/security/>Security</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Demonstrates how to debug authorization." href=/v1.1/help/ops/security/debugging-authorization/>Debugging Authorization</a></li><li role=none><a role=treeitem title="What to do if Citadel is not behaving properly." href=/v1.1/help/ops/security/repairing-citadel/>Repairing Citadel</a></li><li role=none><a role=treeitem title="What to do if you suspect problems with Istio keys and certificates." href=/v1.1/help/ops/security/keys-and-certs/>Keys and Certificates</a></li><li role=none><a role=treeitem title="What to do if mutual TLS authentication isn't working." href=/v1.1/help/ops/security/mutual-tls/>Mutual TLS</a></li><li role=none><a role=treeitem title="Authorization is enabled, but requests make it through anyway." href=/v1.1/help/ops/security/authorization-permissive/>Authorization Too Permissive</a></li><li role=none><a role=treeitem title="Authorization is enabled and no requests make it through to the service." href=/v1.1/help/ops/security/authorization-restrictive/>Authorization Too Restrictive</a></li><li role=none><a role=treeitem title="What to do if end-user authentication doesn't work." href=/v1.1/help/ops/security/end-user-auth/>End User Authentication</a></li><li role=none><a role=treeitem title="Learn how to extend the lifetime of the Istio self-signed root certificate." href=/v1.1/help/ops/security/root-transition/>Extending Self-Signed Certificate Lifetime</a></li></ul></li><li role=treeitem aria-label=Telemetry><button aria-hidden=true></button><a title="Helps you manage telemetry collection and visualization in a running mesh." href=/v1.1/help/ops/telemetry/>Telemetry</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Diagnose problems where metrics are not being collected." href=/v1.1/help/ops/telemetry/missing-metrics/>Missing Metrics</a></li><li role=none><a role=treeitem title="Dealing with Grafana issues." href=/v1.1/help/ops/telemetry/grafana/>Grafana</a></li><li role=none><a role=treeitem title="Fine-grained control of Envoy statistics." href=/v1.1/help/ops/telemetry/envoy-stats/>Envoy Statistics</a></li></ul></li><li role=treeitem aria-label="Installation and Setup"><button aria-hidden=true></button><a title="Helps you diagnose and repair Istio installations." href=/v1.1/help/ops/setup/>Installation and Setup</a><ul role=group aria-expanded=false class=leaf-section><li role=none><a role=treeitem title="Provides a general overview of Istio's use of Kubernetes webhooks and the related issues that can arise." href=/v1.1/help/ops/setup/webhook/>Dynamic Admission Webhooks Overview</a></li><li role=none><a role=treeitem title="Describes Istio's use of Kubernetes webhooks for server-side configuration validation." href=/v1.1/help/ops/setup/validation/>Configuration Validation Webhook</a></li><li role=none><a role=treeitem title="Describes Istio's use of Kubernetes webhooks for automatic sidecar injection." href=/v1.1/help/ops/setup/injection/>Sidecar Injection Webhook</a></li><li role=none><a role=treeitem title="Describes how to check which capabilities are allowed for your pods." href=/v1.1/help/ops/setup/required-pod-capabilities/>Required Pod Capabilities</a></li><li role=none><a role=treeitem title="Shows how to do health checking for Istio services." href=/v1.1/help/ops/setup/app-health-check/>Health Checking of Istio Services</a></li></ul></li><li role=none><a role=treeitem title="Advice on tackling common problems with Istio." href=/v1.1/help/ops/misc/>Miscellaneous</a></li></ul></li><li role=treeitem aria-label=FAQ><button class=show aria-hidden=true></button><a title="Frequently Asked Questions about Istio." href=/v1.1/help/faq/>FAQ</a><ul role=group aria-expanded=true class=leaf-section><li role=none><a role=treeitem title="General Q & A." href=/v1.1/help/faq/general/>General</a></li><li role=none><a role=treeitem title="Setup Q & A." href=/v1.1/help/faq/setup/>Setup</a></li><li role=none><span role=treeitem class=current title="Security Q & A.">Security</span></li><li role=none><a role=treeitem title="Mixer Q & A." href=/v1.1/help/faq/mixer/>Mixer</a></li><li role=none><a role=treeitem title="Metrics and Logs Q & A." href=/v1.1/help/faq/metrics-and-logs/>Metrics and Logs</a></li><li role=none><a role=treeitem title="Distributed Tracing Q & A." href=/v1.1/help/faq/distributed-tracing/>Distributed Tracing</a></li><li role=none><a role=treeitem title="Traffic Management Q & A." href=/v1.1/help/faq/traffic-management/>Traffic Management</a></li></ul></li><li role=none><a role=treeitem title="A glossary of common Istio terms." href=/v1.1/help/glossary/>Glossary</a></li></ul></div></div></div></nav></div><div class=article-container><button tabindex=-1 id=sidebar-toggler title="Toggle the navigation bar"><svg class="icon"><use xlink:href="/v1.1/img/icons.svg#pull"/></svg></button><nav aria-label=Breadcrumb><ol><li><a href=/v1.1/ title="Connect, secure, control, and observe services.">Istio</a></li><li><a href=/v1.1/help/ title="A bunch of resources to help you deploy, configure and use Istio.">Help</a></li><li><a href=/v1.1/help/faq/ title="Frequently Asked Questions about Istio.">FAQ</a></li><li>Security</li></ol></nav><article aria-labelledby=title><div class=title-area><i class=title-icon><svg class="icon"><use xlink:href="/v1.1/img/icons.svg#faq"/></svg></i><div><h1 id=title>Security FAQ</h1></div></div><nav class="toc-inlined toc-forced"><hr><div class=directory role=directory><nav id=InlineTableOfContents><ol><li role=none aria-label="How can I enable/disable mutual TLS after I installed Istio?"><a href=#enabling-disabling-mtls>How can I enable/disable mutual TLS after I installed Istio?</a></li><li role=none aria-label="How can I check whether mutual TLS is enabled for a service?"><a href=#check-policy>How can I check whether mutual TLS is enabled for a service?</a></li><li role=none aria-label="Can I enable mutual TLS for some services while leaving it disabled for other services in the same cluster?"><a href=#auth-mix-and-match>Can I enable mutual TLS for some services while leaving it disabled for other services in the same cluster?</a></li><li role=none aria-label="If mutual TLS is globally enabled, can non-Istio services access Istio services?"><a href=#non-istio-to-istio>If mutual TLS is globally enabled, can non-Istio services access Istio services?</a></li><li role=none aria-label="How can services that use Istio access non-Istio services?"><a href=#accessing-non-istio-services>How can services that use Istio access non-Istio services?</a></li><li role=none aria-label="How can I use Kubernetes liveness and readiness for pod health checks when mutual TLS is enabled?"><a href=#k8s-health-checks>How can I use Kubernetes liveness and readiness for pod health checks when mutual TLS is enabled?</a></li><li role=none aria-label="How to configure the lifetime for Istio certificates?"><a href=#cert-lifetime-config>How to configure the lifetime for Istio certificates?</a></li><li role=none aria-label="MySQL Connectivity Troubleshooting"><a href=#mysql-with-mtls>MySQL Connectivity Troubleshooting</a></li><li role=none aria-label="Does Istio support authorization?"><a href=#does-istio-support-authorization>Does Istio support authorization?</a></li><li role=none aria-label="Does Istio authentication use Kubernetes secrets?"><a href=#use-k8s-secrets>Does Istio authentication use Kubernetes secrets?</a></li><li role=none aria-label="Is the secret encrypted for workload key and cert?"><a href=#secret-encryption>Is the secret encrypted for workload key and cert?</a></li><li role=none aria-label="How to configure Istio Ingress to only accept TLS traffic?"><a href=#secure-ingress>How to configure Istio Ingress to only accept TLS traffic?</a></li><li role=none aria-label="Can I install Istio sidecar for HTTPS services?"><a href=#https-overlay>Can I install Istio sidecar for HTTPS services?</a></li></ol></nav></div><hr></nav><div class=faq><h5 id=enabling-disabling-mtls class=question>How can I enable/disable mutual TLS after I installed Istio?</h5><div class=answer><p>You can change mutual TLS settings for your services at any time using <a href=/v1.1/docs/concepts/security/#authentication-policies>authentication policy</a>
|
|
and <a href=/v1.1/docs/concepts/traffic-management/#destination-rules>destination rule</a>. See <a href=/v1.1/docs/tasks/security/authn-policy>task</a> for more details.</p></div><h5 id=check-policy class=question>How can I check whether mutual TLS is enabled for a service?</h5><div class=answer><p>The <code>istioctl</code> tool provides an option for this purpose. You can do:</p><pre><code class=language-bash data-expandlinks=true>$ istioctl authn tls-check $CLIENT_POD httpbin.default.svc.cluster.local
|
|
HOST:PORT STATUS SERVER CLIENT AUTHN POLICY DESTINATION RULE
|
|
httpbin.default.svc.cluster.local:8000 OK mTLS mTLS default/ default/istio-system
|
|
</code></pre><p>Where <code>$CLIENT_POD</code> is the ID of one of the client service’s pods.</p><p>Refer to <a href=/v1.1/docs/tasks/security/mutual-tls/#verify-mutual-tls-configuration>Verify mutual TLS configuration</a> for more information.</p></div><h5 id=auth-mix-and-match class=question>Can I enable mutual TLS for some services while leaving it disabled for other services in the same cluster?</h5><div class=answer><p><a href=/v1.1/docs/concepts/security/#authentication-policies>Authentication policy</a> can be mesh-wide (which affects all services in the mesh), namespace-wide
|
|
(all services in the same namespace) or service specific. You can have policy or policies to setup mutual TLS for services in a cluster in any way as you want.</p></div><h5 id=non-istio-to-istio class=question>If mutual TLS is globally enabled, can non-Istio services access Istio services?</h5><div class=answer><p>Non-Istio services cannot communicate to Istio services unless they can present a valid certificate, which is less likely to happen.
|
|
This is the expected behavior for <em>mutual TLS</em>. However, you can override the
|
|
global flag for specific namespaces or services. See
|
|
<a href=/v1.1/docs/tasks/security/authn-policy>task</a> for more details.</p></div><h5 id=accessing-non-istio-services class=question>How can services that use Istio access non-Istio services?</h5><div class=answer><p>When mutual TLS is globally enabled, the <em>global</em> destination rule matches all services in the cluster, whether or not these services have an Istio sidecar.
|
|
This includes the Kubernetes API server, as well as any non-Istio services in the cluster. To communicate with such services from services that have an Istio
|
|
sidecar, you need to set a destination rule to exempt the service. For example:</p><pre><code class=language-bash data-expandlinks=true>$ kubectl apply -f - <<EOF
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: DestinationRule
|
|
metadata:
|
|
name: "api-server"
|
|
spec:
|
|
host: "kubernetes.default.svc.cluster.local"
|
|
trafficPolicy:
|
|
tls:
|
|
mode: DISABLE
|
|
EOF
|
|
</code></pre><div><aside class="callout tip"><div class=type><svg class="large-icon"><use xlink:href="/v1.1/img/icons.svg#callout-tip"/></svg></div><div class=content>This destination rule is already added to the system when
|
|
Istio is installed with mutual TLS enabled.</div></aside></div><p>Similarly, you can add destination rules for other non-Istio services. For more examples, see <a href=/v1.1/docs/tasks/security/authn-policy/#request-from-istio-services-to-non-istio-services>task</a>.</p></div><h5 id=k8s-health-checks class=question>How can I use Kubernetes liveness and readiness for pod health checks when mutual TLS is enabled?</h5><div class=answer><p>If mutual TLS is enabled, HTTP and TCP health checks from the kubelet will not work without modification, since the kubelet does not have Istio-issued certificates.</p><p>As of Istio 1.1, we have several options to solve this issue.</p><ol><li><p>Using probe rewrite to rewrite the liveness/readiness probe such that the probe request will be redirected to the workload directly. Please refer to <a href=/v1.1/help/ops/setup/app-health-check/#probe-rewrite>Probe Rewrite</a> for more information.</p></li><li><p>Using a separate port for health checks and enabling mutual TLS only on the regular service port. Please refer to <a href=/v1.1/help/ops/setup/app-health-check/#separate-port>Health Checking of Istio Services</a> for more information.</p></li><li><p>Using the <a href=/v1.1/docs/tasks/security/mtls-migration><code>PERMISSIVE</code> mode</a> for Istio services so they can accept both HTTP and mutual TLS traffic. Please keep in mind that mutual TLS is not enforced since others can communicate with the service with HTTP traffic.</p></li><li><p>Using a <a href=https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#define-a-liveness-command>liveness command</a> for health checks, e.g., one can install <code>curl</code> in the service pod and
|
|
<code>curl</code> itself within the pod.</p></li></ol><p>An example of a readiness probe:</p><pre><code class=language-yaml data-expandlinks=true>livenessProbe:
|
|
exec:
|
|
command:
|
|
- curl
|
|
- -f
|
|
- http://localhost:8080/healthz # Replace port and URI by your actual health check
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 5
|
|
</code></pre></div><h5 id=cert-lifetime-config class=question>How to configure the lifetime for Istio certificates?</h5><div class=answer><p>For the workloads running in Kubernetes, the lifetime of their Istio certificates is controlled by the
|
|
<code>workload-cert-ttl</code> flag on Citadel. The default value is 90 days. This value should be no greater than
|
|
<code>max-workload-cert-ttl</code> of Citadel.</p><p>Citadel uses a flag <code>max-workload-cert-ttl</code> to control the maximum lifetime for Istio certificates issued to
|
|
workloads. The default value is 90 days. If <code>workload-cert-ttl</code> on Citadel or node agent is greater than
|
|
<code>max-workload-cert-ttl</code>, Citadel will fail issuing the certificate.</p><p>Modify the <code>istio-demo-auth.yaml</code> file to customize the Citadel configuration.
|
|
The following modification specifies that the Istio certificates for workloads running in Kubernetes
|
|
has 1 hours lifetime. Besides that, the maximum allowed Istio certificate lifetime is 48 hours.</p><pre><code class=language-plain data-expandlinks=true>...
|
|
kind: Deployment
|
|
...
|
|
metadata:
|
|
name: istio-citadel
|
|
namespace: istio-system
|
|
spec:
|
|
...
|
|
template:
|
|
...
|
|
spec:
|
|
...
|
|
containers:
|
|
- name: citadel
|
|
...
|
|
args:
|
|
- --workload-cert-ttl=1h # Lifetime of certificates issued to workloads in Kubernetes.
|
|
- --max-workload-cert-ttl=48h # Maximum lifetime of certificates issued to workloads by Citadel.
|
|
</code></pre><p>For the workloads running on VMs and bare metal hosts, the lifetime of their Istio certificates is specified by the
|
|
<code>workload-cert-ttl</code> flag on each node agent. The default value is also 90 days. This value should be no greater than
|
|
<code>max-workload-cert-ttl</code> of Citadel.</p><p>To customize this configuration, the argument for the node agent service should be modified.
|
|
After <a href=/v1.1/docs/setup/kubernetes/additional-setup/mesh-expansion/#setting-up-the-vm>setting up the machines</a> for Istio
|
|
mesh expansion, modify the file <code>/lib/systemd/system/istio-auth-node-agent.service</code> on the VMs or bare metal hosts:</p><pre><code class=language-plain data-expandlinks=true>...
|
|
[Service]
|
|
ExecStart=/usr/local/bin/node_agent --workload-cert-ttl=24h # Specify certificate lifetime for workloads on this machine.
|
|
Restart=always
|
|
StartLimitInterval=0
|
|
RestartSec=10
|
|
...
|
|
</code></pre><p>The above configuration specifies that the Istio certificates for workloads running on this VM or bare metal host
|
|
will have 24 hours lifetime.</p><p>After configuring the service, restart the node agent by running <code>systemctl daemon-reload</code>.</p></div><h5 id=mysql-with-mtls class=question>MySQL Connectivity Troubleshooting</h5><div class=answer><p>You may find MySQL can’t be connected after installing Istio. This is because of <code>PERMISSIVE</code> mode which is enabled in <code>istio-demo.yaml</code> by default, does not work with MySQL.</p><p>There have two options to solve the problem.</p><ol><li><p>Disable Mutual TLS</p><p>Choose this option if you don’t want Istio mutual TLS. You achieve this by disabling mutual TLS on the MySQL
|
|
service explicitly.</p><pre><code class=language-bash data-expandlinks=true>$ kubectl apply -f <<EOF
|
|
apiVersion: "authentication.istio.io/v1alpha1"
|
|
kind: "Policy"
|
|
metadata:
|
|
name: mysql-nomtls-authn
|
|
spec:
|
|
targets:
|
|
- name: mysql-service
|
|
EOF
|
|
</code></pre></li><li><p>Enable mutual TLS in STRICT mode.</p><p>If you want mutual TLS protection for MySQL, enable mutual TLS using a destination rule and an authentication policy.</p><pre><code class=language-bash data-expandlinks=true>$ kubectl apply -f <<EOF
|
|
apiVersion: "authentication.istio.io/v1alpha1"
|
|
kind: "Policy"
|
|
metadata:
|
|
name: mysql-mtls-authn
|
|
spec:
|
|
targets:
|
|
- name: mysql-service
|
|
peers:
|
|
- mtls:
|
|
mode: STRICT
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: DestinationRule
|
|
metadata:
|
|
name: mysql-mtls-dr
|
|
spec:
|
|
host: "mysql-service"
|
|
trafficPolicy:
|
|
tls:
|
|
mode: ISTIO_MUTUAL
|
|
EOF
|
|
</code></pre></li></ol></div><h5 id=does-istio-support-authorization class=question>Does Istio support authorization?</h5><div class=answer><p>Yes. Istio provides authorization features for both HTTP and plain TCP services in the mesh.
|
|
<a href=/v1.1/docs/concepts/security/#authorization>Learn more</a>.</p></div><h5 id=use-k8s-secrets class=question>Does Istio authentication use Kubernetes secrets?</h5><div class=answer><p>Yes. The key and certificate distribution in Istio Authentication is based on <a href=https://kubernetes.io/docs/concepts/configuration/secret/>Kubernetes secrets</a>.</p><p>Secrets have known <a href=https://kubernetes.io/docs/concepts/configuration/secret/#risks>security risks</a>. The Kubernetes team is working on
|
|
<a href=https://docs.google.com/document/d/1T2y-9geg9EfHHtCDYTXptCa-F4kQ0RyiH-c_M1SyD0s>several features</a> to improve
|
|
Kubernetes secret security, from secret encryption to node-level access control. And as of version 1.6, Kubernetes introduces
|
|
<a href=https://kubernetes.io/docs/reference/access-authn-authz/rbac/>RBAC authorization</a>, which can provide fine-grained secrets management.</p></div><h5 id=secret-encryption class=question>Is the secret encrypted for workload key and cert?</h5><div class=answer><p>By default, they are base64 encoded but not encrypted. However, the <a href=https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/>secret encryption feature</a> is supported in Kubernetes and you can do it by following the instruction.</p><p>Notice that this feature is not enabled yet in Google Container Engine (GKE). While the data may not be encrypted inside the etcd running on the master node, the contents of the master node itself are encrypted, see <a href=https://cloud.google.com/security/encryption-at-rest/default-encryption/#encryption_of_data_at_rest>here</a> for more info.</p></div><h5 id=secure-ingress class=question>How to configure Istio Ingress to only accept TLS traffic?</h5><div class=answer><p>By following the instructions in the
|
|
<a href=/v1.1/docs/tasks/traffic-management/secure-ingress>Secure Ingress Traffic</a> task,
|
|
Istio Ingress can be secured to only accept TLS traffic.</p></div><h5 id=https-overlay class=question>Can I install Istio sidecar for HTTPS services?</h5><div class=answer><p>Yes, you can. It works both with mutual TLS enabled and disabled. Refer to
|
|
<a href=/v1.1/docs/tasks/security/https-overlay/>how mutual TLS works with HTTPS services</a> for more information.</p></div></div></article><nav class=pagenav><div class=left><a title="Setup Q & A." href=/v1.1/help/faq/setup/><svg class="icon"><use xlink:href="/v1.1/img/icons.svg#left-arrow"/></svg>Setup</a></div><div class=right><a title="Mixer Q & A." href=/v1.1/help/faq/mixer/>Mixer<svg class="icon"><use xlink:href="/v1.1/img/icons.svg#right-arrow"/></svg></a></div></nav><div id=endnotes-container aria-hidden=true><h2>Links</h2><ol id=endnotes></ol></div></div></main><footer><div class=user-links><a class=channel title="Go download Istio 1.1.9 now" href=https://github.com/istio/istio/releases/tag/1.1.9 aria-label="Download Istio"><span>download</span><svg class="icon"><use xlink:href="/v1.1/img/icons.svg#download"/></svg>
|
|
</a><a class=channel title="Join the Istio discussion board to participate in discussions and get help troubleshooting problems" href=https://discuss.istio.io aria-label="Istio discussion board"><span>discuss</span><svg class="icon"><use xlink:href="/v1.1/img/icons.svg#discourse"/></svg></a>
|
|
<a class=channel title="Stack Overflow is where you can ask questions and find curated answers on deploying, configuring, and using Istio" href=https://stackoverflow.com/questions/tagged/istio aria-label="Stack Overflow"><span>stack overflow</span><svg class="icon"><use xlink:href="/v1.1/img/icons.svg#stackoverflow"/></svg></a>
|
|
<a class=channel title="Follow us on Twitter to get the latest news" href=https://twitter.com/IstioMesh aria-label=Twitter><span>twitter</span><svg class="icon"><use xlink:href="/v1.1/img/icons.svg#twitter"/></svg></a><div class=tag>for everyone</div></div><div class=info><p class=copyright>Istio Archive
|
|
1.1.9<br>© 2019 Istio Authors, <a href=https://policies.google.com/privacy>Privacy Policy</a><br>Archived on June 18, 2019</p></div><div class=dev-links><a class=channel title="GitHub is where development takes place on Istio code" href=https://github.com/istio/community aria-label=GitHub><span>github</span><svg class="icon"><use xlink:href="/v1.1/img/icons.svg#github"/></svg></a>
|
|
<a class=channel title="Interactively discuss issues with the Istio community on Slack" href=https://istio.slack.com aria-label=slack><span>slack</span><svg class="icon"><use xlink:href="/v1.1/img/icons.svg#slack"/></svg></a>
|
|
<a class=channel title="Access our team drive if you'd like to take a look at the Istio technical design documents" href=https://groups.google.com/forum/#!forum/istio-team-drive-access aria-label="team drive"><span>drive</span><svg class="icon"><use xlink:href="/v1.1/img/icons.svg#drive"/></svg></a>
|
|
<a class=channel title="If you'd like to contribute to the Istio project, consider participating in our working groups" href=https://github.com/istio/community/blob/master/WORKING-GROUPS.md aria-label="working groups"><span>working groups</span><svg class="icon"><use xlink:href="/v1.1/img/icons.svg#working-groups"/></svg></a><div class=tag>for developers</div></div></footer><div id=scroll-to-top-container aria-hidden=true><button id=scroll-to-top title="Back to top"><svg class="icon"><use xlink:href="/v1.1/img/icons.svg#top"/></svg></button></div></body></html> |