๋กœ์ผ“๐Ÿพ
article thumbnail

 

 

์ง€๋‚œ ๊ธ€์—์„œ Istio mTLS ์— ๋Œ€ํ•ด ์•Œ์•„๋ณด์•˜๊ณ , ์ ์šฉ๋„ ํ•ด๋ดค์Šต๋‹ˆ๋‹ค. ๋˜ Kiali ๋ฅผ ํ†ตํ•ด์„œ ์‹ค์ œ mTLS ๊ฐ€ ์ ์šฉ ๋˜์—ˆ๋Š” ์ง€๋„ ์•Œ์•„๋ดค์ฃ .

 

Kiali ์—์„œ mTLS ๊ฐ€ ์ ์šฉ๋๋‹ค๊ณ  ์•„์ด์ฝ˜์œผ๋กœ ํ‘œ์‹œ๋ฅผ ํ•ด์ฃผ๊ธด ํ•˜๋Š”๋ฐ ์ œ ๋ˆˆ์œผ๋กœ ์ง์ ‘ ์•”ํ˜ธํ™”๊ฐ€ ๋˜๋Š”์ง€ ํ™•์ธํ•˜๊ณ  ์‹ถ์Šต๋‹ˆ๋‹ค.

 

๊ทธ๋ž˜์„œ ์ด๋ฒˆ ๊ธ€์—์„œ๋Š” Istio ๊ณต์‹ ๋ฌธ์„œ์—์„œ ์ œ๊ณตํ•ด์ฃผ๋Š” ์˜ˆ์ œ์™€ tcpdump ๋ฅผ ์ด์šฉํ•ด์„œ ํ•œ๋ฒˆ ํ™•์ธํ•ด๋ณด์ฃ !

 

๋ ›์ธ ๋‘๋”์ฝ”๋“œ~

 

 

๋“ค์–ด๊ฐ€๊ธฐ ์•ž์„œ ์ฃผ์˜ํ•  ์ ์ด ์žˆ์Šต๋‹ˆ๋‹ค!

istio-proxy container ์—์„œ tcpdump ๋ฅผ ์‚ฌ์šฉํ•˜๋ ค๋ฉด sudo ๋ฅผ ๊ถŒํ•œ์„ ๊ฐ€์งˆ ์ˆ˜ ์žˆ๋„๋ก privilege ๋ฅผ true ๋กœ ์ฃผ์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. 

 

๋”ฐ๋ผ์„œ ์•„๋ž˜ ๋ช…๋ น์–ด๋ฅผ ํ†ตํ•ด istio ๋ฅผ ์„ค์น˜ํ•ฉ๋‹ˆ๋‹ค.

$ istioctl install --set values.global.proxy.privileged=true

 

Istio ๊ณต์‹ ๋ฌธ์„œ์— ์ œ๊ณต๋˜๋Š” ์˜ˆ์ œ๋ฅผ ์ „๋ถ€ ์„ค์น˜ํ–ˆ๋Š”๋ฐ ์šฐ์„  ํ‰๋ฌธ์„ ํ™•์ธํ•˜๊ธฐ ์œ„ํ•ด์„œ Istio ๋ฅผ ์‚ฌ์šฉํ•˜์ง€ ์•Š๋Š” ํŒŒ๋“œ๋“ค์„ ๋ฐฐํฌํ–ˆ์Šต๋‹ˆ๋‹ค.

 

httpbin ์˜ nginx container ์— ์ ‘๊ทผํ•ด์„œ tcpdump ๋ฅผ ์‹คํ–‰ํ•ด๋ณด๊ฒ ์Šต๋‹ˆ๋‹ค.

 

์ดํ›„ ํŠธ๋ž˜ํ”ฝ์„ ๋ฐœ์ƒ์‹œ์ผœ์„œ ํŒจํ‚ท์„ ํ™•์ธํ•ฉ๋‹ˆ๋‹ค. (์•„๋ž˜ ์ฝ”๋“œ๋Š” ๊ณต์‹ ๋ฌธ์„œ์—์„œ ์ œ๊ณต๋จ)

for from in "foo" "bar" "legacy"; do for to in "foo" "bar"; do kubectl exec "$(kubectl get pod -l app=sleep -n ${from} -o jsonpath={.items..metadata.name})" -c sleep -n ${from} -- curl http://httpbin.${to}:8000/ip -s -o /dev/null -w "sleep.${from} to httpbin.${to}: %{http_code}\n"; done; done

 

์‘๋‹ต๊ฐ’์ด JSON ํ˜•์‹์˜ {"origin" : "10.36.0.7"} ์ธ ๊ฑธ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

์™„์ „ํ•œ ํ‰๋ฌธ์ด์ฃ . ๋น„๋ฐ€๋ฒˆํ˜ธ๋ผ๋„ ์žˆ์—ˆ๋‹ค๋ฉด ๊ทธ๋Œ€๋กœ ๋…ธ์ถœ๋  ์œ„ํ—˜์ด ์žˆ์Šต๋‹ˆ๋‹ค.

 

mTLS ๋ฅผ ์‚ฌ์šฉํ•˜์ง€ ์•Š๋Š”๋‹ค๋ฉด ํŒŒ๋“œ๋ผ๋ฆฌ๋Š” ํ‰๋ฌธ์œผ๋กœ ํ†ต์‹ ํ•œ๋‹ค๋Š” ๊ฑธ ์•Œ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

 

๊ทธ๋Ÿผ Istio Proxy ๋ฅผ ์‚ฌ์šฉํ•ด์„œ mTLS ๊ฐ€ ์ ์šฉ๋˜๋„๋ก ํ•ด๋ณด์ฃ .

READY ๊ฐ€ 2/2 ์ธ ๊ฒƒ์„ ๋ณด๋‹ˆ Istio Proxy Container ๊ฐ€ ์‹คํ–‰๋˜๊ณ  ์žˆ๋‹ค๋Š” ๊ฑธ ์•Œ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

 

๊ทธ๋Ÿผ ์ด๋ฒˆ์—๋„ ์ปจํ…Œ์ด๋„ˆ์— ์ ‘๊ทผ์„ ํ•ด๋ณด์ฃ !

k exec -it -n foo httpbin-5c5944c58c-fqxcx -c istio-proxy -- bash

-c ์˜ต์…˜์œผ๋กœ istio-proxy ์— ์ ‘๊ทผํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค!!
istio-proxy ๊ฐ€ ๊ฒฐ๊ตญ ์•”ํ˜ธํ™”, ๋ณตํ˜ธํ™”๋ฅผ ํ•ด์ฃผ๊ธฐ ๋•Œ๋ฌธ์— httpbin container ์— ์ ‘๊ทผํ•ด์„œ ํ™•์ธํ•˜๋ฉด ์—ฌ์ „ํžˆ ํ‰๋ฌธ์œผ๋กœ ๋ณด์ž…๋‹ˆ๋‹ค!!

 

 

์œ„์—์„œ privileged=true ๋ฅผ ํ•ด์คฌ๊ธฐ ๋•Œ๋ฌธ์— sudo ๋ช…๋ น์–ด๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

 

๋šœ๋‘”!! source ์™€ destination ์„ ๋น„๊ตํ•ด๋ดค์„ ๋•Œ ๋นจ๊ฐ„์ƒ‰ ๋„ค๋ชจ๊ฐ€ ์šฐ๋ฆฌ๊ฐ€ ์ฐพ๋Š” ๋ฐ์ดํ„ฐ๊ฐ€ ๋งž๊ณ , ์‹ค์ œ๋กœ ์•”ํ˜ธํ™”๊ฐ€ ๋œ ๊ฒƒ์„ ํ™•์ธ ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

 

SSL Termination ์œผ๋กœ ์ธํ•ด ์„œ๋ฒ„๋ผ๋ฆฌ์˜ ํ†ต์‹ ์€ ํ‰๋ฌธ์œผ๋กœ ๋˜์ง€๋งŒ, mTLS ์„ ์‚ฌ์šฉํ•˜๋ฉด ์•„์ฃผ ์‰ฝ๊ฒŒ ์ธ์ฆ์„œ๋ฅผ ๊ด€๋ฆฌํ•  ํ•„์š” ์—†์ด ์•”ํ˜ธํ™”๋ฅผ ํ†ตํ•œ ํ†ต์‹ ์ด ๊ฐ€๋Šฅํ•ด์ง‘๋‹ˆ๋‹ค! Istio ์˜ ํ•ต์‹ฌ ๊ธฐ๋Šฅ๋‹ต์Šต๋‹ˆ๋‹ค.

 

์˜ˆ์ „๋ถ€ํ„ฐ mTLS ๋ฅผ ์‚ฌ์šฉํ•˜๋ฉด ์ง„์งœ ์•”ํ˜ธํ™”๊ฐ€ ๋˜๋Š”์ง€ ๊ถ๊ธˆํ–ˆ๋Š”๋ฐ, ์ด๋ฒˆ ์‹ค์Šต์œผ๋กœ ๊ถ๊ธˆ์ฆ์ด ํ’€๋ ธ๋„ค์š”!

 

๊ทธ๋Ÿผ ์˜ค๋Š˜์€ ์—ฌ๊ธฐ๊นŒ์ง€!

profile on loading

Loading...