前提条件
- 创建容器服务实例(https://cs.console.aliyun.com/)
- 创建服务网格实例(https://servicemesh.console.aliyun.com/)
- 已将服务容器实例加入到网格中
配置JWT请求授权
环境变量
# ASM实例kubeconfig
MESH_CONFIG=
# 用户ACK实例kubeconfig
USER_CONFIG=
# 本地istio路径
# 可以在https://github.com/istio/istio/releases选择合适版本下载
ISTIO_HOME=
1 部署示例服务
1.创建命名空间foo
,并启用istio-injection
。
2.在命名空间foo
中,部署官方示例服务httpbin
和sleep
。
kubectl \
--kubeconfig "$USER_CONFIG" \
-n foo \
apply -f "$ISTIO_HOME"/samples/httpbin/httpbin.yaml
kubectl \
--kubeconfig "$USER_CONFIG" \
-n foo \
apply -f "$ISTIO_HOME"/samples/sleep/sleep.yaml
3.确认pod就绪前请等待。
kubectl --kubeconfig "$USER_CONFIG" -n foo get po
kubectl --kubeconfig "$USER_CONFIG" -n foo wait --for=condition=ready pod -l app=httpbin
kubectl --kubeconfig "$USER_CONFIG" -n foo wait --for=condition=ready pod -l app=sleep
4.在sleep
容器内,验证是否可以请求httpbin
。期待的结果是http_code
值为200
。
sleep_pod=$(kubectl --kubeconfig "$USER_CONFIG" get pod -l app=sleep -n foo -o jsonpath={.items..metadata.name})
RESULT=$(kubectl \
--kubeconfig "$USER_CONFIG" \
exec "$sleep_pod" -c sleep -n foo -- curl http://httpbin.foo:8000/ip -s -o /dev/null -w "%{http_code}")
if [[ $RESULT != "200" ]]; then
echo "http_code($RESULT) should be 200"
exit
fi
2. 增加请求认证
1.在命名空间foo
中,新建RequestAuthentication CRD,创建请求认证:请求httpbin
服务时,须匹配jwtRules
中定义的规则,即请求头中如果包含ACCESS TOKEN信息,解码后iss
的值须为testing@secure.istio.io
。jwks
中定义了TOKEN生成的相关信息,详见jwk官方文档。
jwt-example.yaml
:
apiVersion: "security.istio.io/v1beta1"
kind: "RequestAuthentication"
metadata:
name: "jwt-example"
namespace: foo
spec:
selector:
matchLabels:
app: httpbin
jwtRules:
- issuer: "testing@secure.istio.io"
jwks: '{ "keys":[ {"e":"AQAB","kid":"DHFbpoIUqrY8t2zpA2qXfCmr5VO5ZEr4RzHU_-envvQ","kty":"RSA","n":"xAE7eB6qugXyCAG3yhh7pkDkT65pHymX-P7KfIupjf59vsdo91bSP9C8H07pSAGQO1MV_xFj9VswgsCg4R6otmg5PV2He95lZdHtOcU5DXIg_pbhLdKXbi66GlVeK6ABZOUW3WYtnNHD-91gVuoeJT_DwtGGcp4ignkgXfkiEm4sw-4sfb4qdt5oLbyVpmW6x9cfa7vs2WTfURiCrBoUqgBo_-4WTiULmmHSGZHOjzwa8WtrtOQGsAFjIbno85jp6MnGGGZPYZbDAa_b3y5u-YpW7ypZrvD8BgtKVjgtQgZhLAGezMt0ua3DRrWnKqTZ0BJ_EyxOGuHJrLsn00fnMQ"}]}'
2.验证请求认证策略生效。请求头中包含合法的ACCESS TOKEN时返回状态码200
,否则返回状态码401
。
for ((i = 1; i <= 5; i++)); do
RESULT=$(kubectl \
--kubeconfig "$USER_CONFIG" \
exec "$sleep_pod" \
-c sleep \
-n foo \
-- curl "http://httpbin.foo:8000/headers" \
-s \
-o /dev/null \
-H "Authorization: Bearer invalidToken" \
-w "%{http_code}")
if [[ $RESULT != "401" ]]; then
echo "http_code($RESULT) should be 401"
exit
fi
done
for ((i = 1; i <= 10; i++)); do
RESULT=$(kubectl \
--kubeconfig "$USER_CONFIG" \
exec "$sleep_pod" \
-c sleep \
-n foo \
-- curl "http://httpbin.foo:8000/headers" \
-s \
-o /dev/null \
-w "%{http_code}")
if [[ $RESULT != "200" ]]; then
echo "http_code($RESULT) should be 200"
exit
fi
done
3. 增加JWT认证策略
1.在命名空间foo中,新建AuthorizationPolicy CRD,创建JWT认证策略:请求httpbin
服务时,只有请求头TOKEN解码后,符合iss
的值+/
+sub
的值(即source.requestPrincipals
)为testing@secure.istio.io/testing@secure.istio.io
,请求权限才为ALLOW
。
require-jwt.yaml
:
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: require-jwt
namespace: foo
spec:
selector:
matchLabels:
app: httpbin
action: ALLOW
rules:
- from:
- source:
requestPrincipals: ["testing@secure.istio.io/testing@secure.istio.io"]
2.TOKEN解析。
TOKEN='eyJhbGciOiJSUzI1NiIsImtpZCI6IkRIRmJwb0lVcXJZOHQyenBBMnFYZkNtcjVWTzVaRXI0UnpIVV8tZW52dlEiLCJ0eXAiOiJKV1QifQ.eyJleHAiOjQ2ODU5ODk3MDAsImZvbyI6ImJhciIsImlhdCI6MTUzMjM4OTcwMCwiaXNzIjoidGVzdGluZ0BzZWN1cmUuaXN0aW8uaW8iLCJzdWIiOiJ0ZXN0aW5nQHNlY3VyZS5pc3Rpby5pbyJ9.CfNnxWP2tcnR9q0vxyxweaF3ovQYHYZl82hAUsn21bwQd9zP7c-LS9qd_vpdLG4Tn1A15NxfCjp5f7QNBUo-KC9PJqYpgGbaXhaGx7bEdFWjcwv3nZzvc7M__ZpaCERdwU7igUmJqYGBYQ51vr2njU9ZimyKkfDe3axcyiBZde7G6dabliUosJvvKOPcKIWPccCgefSj_GNfwIip3-SsFdlR7BtbVUcqR-yv-XOxJ3Uc1MI0tz3uMiiZcyPV7sNCU4KRnemRIMHVOfuvHsU60_GhGbiSFzgPTAa9WTltbnarTbxudb_YEOx12JiwYToeX0DCPb43W1tzIBxgm8NxUg'
echo $TOKEN | cut -d '.' -f2 - | base64 --decode -
输出信息:
{"exp":4685989700,"foo":"bar","iat":1532389700,"iss":"testing@secure.istio.io","sub":"testing@secure.istio.io"}
JWT官网提供了同样的能力:
3.验证JWT认证策略生效。请求头中包含合法的ACCESS TOKEN时返回状态码200
,否则返回状态码403
。
for ((i = 1; i <= 10; i++)); do
RESULT=$(kubectl \
--kubeconfig "$USER_CONFIG" \
exec "$sleep_pod" \
-c sleep \
-n foo \
-- curl "http://httpbin.foo:8000/headers" \
-s \
-o /dev/null \
-H "Authorization: Bearer $TOKEN" \
-w "%{http_code}")
if [[ $RESULT != "200" ]]; then
echo "http_code($RESULT) should be 200"
exit
fi
done
for ((i = 1; i <= 10; i++)); do
RESULT=$(kubectl \
--kubeconfig "$USER_CONFIG" \
exec "$sleep_pod" \
-c sleep \
-n foo \
-- curl "http://httpbin.foo:8000/headers" \
-s \
-o /dev/null \
-w "%{http_code}")
if [[ $RESULT != "403" ]]; then
echo "http_code($RESULT) should be 403"
exit
fi
done
4. 追加JWT认证策略
1.在命名空间foo中,更新JWT认证策略require-jwt
,增加规则:请求httpbin
服务时,只有请求头TOKEN解码后,符合groups
的值包含group1
,请求权限才为ALLOW
。
require-jwt-group.yaml
:
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: require-jwt
namespace: foo
spec:
selector:
matchLabels:
app: httpbin
action: ALLOW
rules:
- from:
- source:
requestPrincipals: ["testing@secure.istio.io/testing@secure.istio.io"]
when:
- key: request.auth.claims[groups]
values: ["group1"]
2.TOKEN解析。
TOKEN_GROUP='eyJhbGciOiJSUzI1NiIsImtpZCI6IkRIRmJwb0lVcXJZOHQyenBBMnFYZkNtcjVWTzVaRXI0UnpIVV8tZW52dlEiLCJ0eXAiOiJKV1QifQ.eyJleHAiOjM1MzczOTExMDQsImdyb3VwcyI6WyJncm91cDEiLCJncm91cDIiXSwiaWF0IjoxNTM3MzkxMTA0LCJpc3MiOiJ0ZXN0aW5nQHNlY3VyZS5pc3Rpby5pbyIsInNjb3BlIjpbInNjb3BlMSIsInNjb3BlMiJdLCJzdWIiOiJ0ZXN0aW5nQHNlY3VyZS5pc3Rpby5pbyJ9.EdJnEZSH6X8hcyEii7c8H5lnhgjB5dwo07M5oheC8Xz8mOllyg--AHCFWHybM48reunF--oGaG6IXVngCEpVF0_P5DwsUoBgpPmK1JOaKN6_pe9sh0ZwTtdgK_RP01PuI7kUdbOTlkuUi2AO-qUyOm7Art2POzo36DLQlUXv8Ad7NBOqfQaKjE9ndaPWT7aexUsBHxmgiGbz1SyLH879f7uHYPbPKlpHU6P9S-DaKnGLaEchnoKnov7ajhrEhGXAQRukhDPKUHO9L30oPIr5IJllEQfHYtt6IZvlNUGeLUcif3wpry1R5tBXRicx2sXMQ7LyuDremDbcNy_iE76Upg'
echo "$TOKEN_GROUP" | cut -d '.' -f2 - | base64 --decode - | jq
输出信息:
{
"exp": 3537391104,
"groups": [
"group1",
"group2"
],
"iat": 1537391104,
"iss": "testing@secure.istio.io",
"scope": [
"scope1",
"scope2"
],
"sub": "testing@secure.istio.io"
}
3.验证JWT认证策略生效。请求头中包含合法的ACCESS TOKEN时返回状态码200
,否则返回状态码403
。
for ((i = 1; i <= 10; i++)); do
RESULT=$(kubectl \
--kubeconfig "$USER_CONFIG" \
exec "$sleep_pod" \
-c sleep \
-n foo \
-- curl "http://httpbin.foo:8000/headers" \
-s \
-o /dev/null \
-H "Authorization: Bearer $TOKEN_GROUP" \
-w "%{http_code}")
if [[ $RESULT != "200" ]]; then
echo "http_code($RESULT) should be 200"
exit
fi
done
for ((i = 1; i <= 10; i++)); do
RESULT=$(kubectl \
--kubeconfig "$USER_CONFIG" \
exec "$sleep_pod" \
-c sleep \
-n foo \
-- curl "http://httpbin.foo:8000/headers" \
-s \
-o /dev/null \
-H "Authorization: Bearer $TOKEN" \
-w "%{http_code}")
if [[ $RESULT != "403" ]]; then
echo "http_code($RESULT) should be 200"
exit
fi
done