コンテナ上のマイクロサービスの認証強化　～IstioとKeycloak～

リスト1：kubernetes-example

$ kubectl create namespace keycloak
$ wget -q -O - https://raw.githubusercontent.com/keycloak/keycloak-quickstarts/latest/kubernetes-examples/keycloak.yaml | sed "s/default/keycloak/" | kubectl create -f -　-n keycloak

リスト2：Keycloakの管理コンソールにアクセス

$ echo $(minikube ip)
172.30.10.93
$ echo $(kubectl get services/keycloak -o go-template='{{(index .spec.ports 0).nodePort}}
' -n keycloak)
31385

リスト3：IstioとBookinfoアプリケーション

$ curl -L https://istio.io/downloadIstio | sh -
$ export PATH="$PATH:/root/istio-1.7.4/bin"
$ istioctl install --set profile=demo
$ kubectl label namespace default istio-injection=enabled
$ kubectl apply -f istio-1.7.4/samples/bookinfo/platform/kube/bookinfo.yaml
$ kubectl apply -f istio-1.7.4/samples/bookinfo/networking/bookinfo-gateway.yaml
$ kubectl apply -f istio-1.7.4/samples/addons
$ kubectl patch svc -n istio-system kiali -p '{"spec": {"type": "LoadBalancer"}}'

リスト4：Bookinfoアプリケーションにアクセス

$ echo $(minikube ip)
172.30.10.93
$ echo $(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http2")].nodePort}')
30986

リスト5：Kialiのダッシュボードにアクセス

$ echo $(minikube ip)
172.30.10.93
$ echo $(kubectl -n istio-system get service kiali -o jsonpath='{.spec.ports[?(@.name=="http")].nodePort}')
31097

リスト6：設定ファイルのサンプルをコピー

$ cp istio-1.7.4/samples/bookinfo/networking/destination-rule-all-mtls.yaml destination-rule-all-mtls-v2.yaml

リスト7：destination-rule-all-mtls-v2.yaml

……
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: ratings
spec:
  host: ratings
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2                // 以下9行を削除
    labels:
      version: v2
  - name: v2-mysql
    labels:
      version: v2-mysql
  - name: v2-mysql-vm
    labels:
      version: v2-mysql-vm} // ここまで削除
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: details
spec:
  host: details
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2       // 以下3行を削除
    labels:
      version: v2  // ここまで削除
---

リスト8：DestinationRuleの適用

$ kubectl apply -f destination-rule-all-mtls-v2.yaml

リスト9：peer-authentication-mtls.yaml

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: mtls
spec:
  mtls:
    mode: STRICT

リスト10：PeerAuthenticationの適用

$ kubectl apply -f peer-authentication-mtls.yaml

リスト11：Bookinfoアプリケーションの実装を変更

$ git clone https://github.com/istio/istio.git -b 1.7.4 --depth 1

リスト12：productpage.pyを変更

def getForwardHeaders(request):
    ……
    incoming_headers = ['x-request-id', 'x-datadog-trace-id', 'x-datadog-parent-id', 'x-datadog-sampled', 'Authorization'] // Authorizationを追加
    ……
    return headers

リスト13：LibertyRestEndpoint.javaを変更

……
    private final static String[] headers_to_propagate = {"x-request-id","x-b3-traceid","x-b3-spanid","x-b3-sampled","x-b3-flags",
      "x-ot-span-context","x-datadog-trace-id","x-datadog-parent-id","x-datadog-sampled", "end-user","user-agent", "Authorization"}; // Authorizationを追加
……

リスト14：Bookinfoアプリケーションをビルド

$ istio/samples/bookinfo/src/build-services.sh 2.0.0 docker.io/istio

リスト15：作成したイメージをDeploymentに設定

……
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: reviews-v1
  ……
spec:
  ……
  template:
    ……
    spec:
      ……
      containers:
      - name: reviews
        image: docker.io/istio/examples-bookinfo-reviews-v1:2.0.0
        ……
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: reviews-v2
  ……
spec:
  ……
  template:
    ……
    spec:
      ……
      containers:
      - name: reviews
        image: docker.io/istio/examples-bookinfo-reviews-v2:2.0.0
        ……
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: reviews-v3
  ……
spec:
  ……
  template:
    ……
    spec:
      ……
      containers:
      - name: reviews
        image: docker.io/istio/examples-bookinfo-reviews-v3:2.0.0
        ……
---
……
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: productpage-v1
  ……
spec:
  ……
  template:
    ……
    spec:
      ……
      containers:
      - name: productpage
        image: docker.io/istio/examples-bookinfo-productpage-v1:2.0.0
        ……
---

リスト16：Deploymentを適用

$ kubectl apply -f istio-1.7.4/samples/bookinfo/platform/kube/bookinfo.yaml

リスト17：アクセストークンを発行するコマンド

$ curl http://172.30.10.93:31385/auth/realms/bookinfo/protocol/openid-connect/token -d "grant_type=password&username=sample_user&password=<password>&client_id=sample_application&client_secret=<client secret>&scope=openid"

リスト18：request-authentication-keycloak.yaml

apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: keycloak
spec:
  jwtRules:
  - issuer: http://172.30.10.93:31385/auth/realms/bookinfo
    jwksUri: http://172.30.10.93:31385/auth/realms/bookinfo/protocol/openid-connect/certs
    fromHeaders:
    - name: Authorization
      prefix: "Bearer "
    forwardOriginalToken: true

リスト19：RequestAuthenticationの適用

$ kubectl apply -f request-authentication-keycloak.yaml

リスト20：authorization-policy-keycloak.yaml

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: keycloak
spec:
 action: ALLOW
 rules:
 - when:
   - key: request.auth.claims[iss]
     values: ["http://172.30.10.93:31385/auth/realms/bookinfo"]

リスト21：AuthorizationPolicyの適用

$ kubectl apply -f authorization-policy-keycloak.yaml

リスト22：authorization-policy-product-page-aud.yaml

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: product-page-aud
spec:
 selector:
  matchLabels:
   app: productpage
 action: DENY
 rules:
 - when:
   - key: request.auth.claims[aud]
     notValues: ["product_page"]

リスト23：authorization-policy-details-aud.yaml

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
 name: details-aud
spec:
 selector:
  matchLabels:
   app: details
 action: DENY
 rules:
 - when:
   - key: request.auth.claims[aud]
     notValues: ["details"]

リスト24：AuthorizationPolicyの適用

$ kubectl apply -f authorization-policy-product-page-aud.yaml
$ kubectl apply -f authorization-policy-details-aud.yaml