コンテナ上のマイクロサービスの認証強化　～QuarkusとKeycloak～

リスト1：Mavenをインストール

$ apt install maven
$ mvn -v
Apache Maven 3.6.3

リスト2：プロジェクトの作成

$ mvn io.quarkus:quarkus-maven-plugin:1.9.2.Final:create -DprojectGroupId=org.acme -DprojectArtifactId=security-keycloak-authorization-quickstart -Dextensions="oidc, keycloak-authorization, resteasy-jsonb, kubernetes, container-image-docker"

リスト3：Book.javaの実装

package org.acme.security.keycloak.authorization;

import com.fasterxml.jackson.annotation.JsonProperty;

import io.quarkus.security.identity.SecurityIdentity;

public class Book {
    @JsonProperty
    private String type = "article";
    @JsonProperty
    private int pages = 3;
    @JsonProperty
    private String publisher;
    @JsonProperty
    private String language = "Japanese";
    @JsonProperty("ISBN-10")
    private String isbn10 = "1234567890";
    @JsonProperty("ISBN-13")
    private String isbn13 = "123-1234567890";

    public Book(SecurityIdentity identity) {
        this.publisher = identity.getPrincipal().getName();
    }
}

リスト4：BooksResource.javaの実装

package org.acme.security.keycloak.authorization;

import javax.inject.Inject;
import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;

import org.jboss.resteasy.annotations.cache.NoCache;

import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;

import io.quarkus.security.identity.SecurityIdentity;

@Path("/")
public class BooksResource {

    @Inject
    SecurityIdentity identity;

    @GET
    @Path("/health")
    public Response health() {
        return Response.ok().type(MediaType.APPLICATION_JSON).entity("{\"status\": \"Details is healthy\"}").build();
    }

    @GET
    @Path("/details/0")
    @NoCache
    public Response details() {
        ObjectMapper mapper = new ObjectMapper();
        String json = null;
        try {
            json = mapper.writeValueAsString(new Book(identity));
        } catch (JsonProcessingException e) {
            e.printStackTrace();
        }
        return Response.ok().type(MediaType.APPLICATION_JSON).entity(json).build();
    }

}

リスト5：application.propertiesに設定を追加

quarkus.http.port=9080
quarkus.oidc.auth-server-url=http://172.30.10.93:31385/auth/realms/bookinfo
quarkus.oidc.client-id=details
quarkus.oidc.credentials.secret=<client secret>

# Enable Policy Enforcement
quarkus.keycloak.policy-enforcer.enable=true

quarkus.kubernetes.part-of=details
quarkus.container-image.registry=
quarkus.container-image.group=
quarkus.container-image.name=details
quarkus.container-image.tag=1.0
quarkus.kubernetes.image-pull-policy=never
quarkus.kubernetes.labels.app=details
quarkus.kubernetes.labels.version=v2

リスト6：Quarkusアプリケーションのデプロイ

$ cd security-keycloak-authorization-quickstart/
$ ./mvnw clean package -Dquarkus.kubernetes.deploy=true

リスト7：デプロイされていることを確認

$ kubectl get pods
NAME                             READY   STATUS    RESTARTS   AGE
details-766f98fcf8-pc8fw         2/2     Running   1          10s
$ kubectl get deployments
NAME             READY   UP-TO-DATE   AVAILABLE   AGE
details          1/1     1            1           10s

リスト8：DestinationRuleの書き換え

……
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: details
spec:
  host: details
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
  subsets:
  - name: v2
    labels:
      version: v2
---

リスト9：変更したDestinationRuleの適用

$ kubectl apply -f destination-rule-all-mtls-v2.yaml