Envoy-安全TLS(HTTPS-HTTPS-TLS)

HTTPS-HTTPS-TLS

Readme

#
[root@k8s-master01 https-https-proxy]# tree
.
├── docker-compose.yaml
├── envoy-sidecar-proxy.yaml
├── front-envoy.yaml
├── front-proxy-certs
│   ├── front-proxy.crt
│   └── front-proxy.key
├── README.md
└── sidecar-proxy-certs
    ├── webserver.crt
    └── webserver.key

[root@k8s-master01 https-https-proxy]# cat README.md
# TLS Front Proxy demo

### 环境说明
五个Service:
- envoy：Front Proxy,地址为172.31.8.2，监听于8443端口
- webserver01：第一个后端服务
- webserver01-sidecar：第一个后端服务的Sidecar Proxy,地址为172.31.8.11，监听于443端口
- webserver02：第二个后端服务
- webserver02-sidecar：第二个后端服务的Sidecar Proxy,地址为172.31.8.12, 监听于443端口

### 运行和测试
1. 创建

docker-compose up

2. 测试

# https请求测试
curl -k -v https://172.31.8.2:8443/
下面的命令输出示例，是因为我们在curl命令使用了-v选项所获取到的详细交互过程。
[root@k8s-master01 https-https-proxy]# curl -k -v https://172.31.8.2:8443/
* About to connect() to 172.31.8.2 port 8443 (#0)
*   Trying 172.31.8.2...
* Connected to 172.31.8.2 (172.31.8.2) port 8443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* skipping SSL peer certificate verification
* SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
*       subject: CN=www.magedu.com
*       start date: May 19 03:56:18 2021 GMT
*       expire date: May 17 03:56:18 2031 GMT
*       common name: www.magedu.com
*       issuer: CN=www.magedu.com
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: 172.31.8.2:8443
> Accept: */*
>
< HTTP/1.1 200 OK
< content-type: text/html; charset=utf-8
< content-length: 97
< server: envoy
< date: Tue, 27 Feb 2024 02:42:44 GMT
< x-envoy-upstream-service-time: 4
<
iKubernetes demoapp v1.0 !! ClientIP: 127.0.0.1, ServerName: webserver01, ServerIP: 172.31.8.11!
* Connection #0 to host 172.31.8.2 left intact

# 请求访问admin interface
curl http://172.31.8.2:9901/

File

#[root@k8s-master01 https-https-proxy]# cat docker-compose.yaml
version: '3.3'

services:
  envoy:
    image: envoyproxy/envoy:v1.23-latest
    environment:
      - ENVOY_UID=0
      - ENVOY_GID=0
    volumes:
    - ./front-envoy.yaml:/etc/envoy/envoy.yaml
    - ./front-proxy-certs/:/etc/envoy/certs/
    networks:
      envoymesh:
        ipv4_address: 172.31.8.2
        aliases:
        - front-proxy
    depends_on:
    - webserver01-sidecar
    - webserver02-sidecar

  webserver01-sidecar:
    image: envoyproxy/envoy:v1.23-latest
    environment:
      - ENVOY_UID=0
      - ENVOY_GID=0
    volumes:
    - ./envoy-sidecar-proxy.yaml:/etc/envoy/envoy.yaml
    - ./sidecar-proxy-certs/:/etc/envoy/certs/
    hostname: webserver01
    networks:
      envoymesh:
        ipv4_address: 172.31.8.11
        aliases:
        - webserver01-sidecar

  webserver01:
    image: ikubernetes/demoapp:v1.0
    environment:
      - PORT=8080
      - HOST=127.0.0.1
    network_mode: "service:webserver01-sidecar"
    depends_on:
    - webserver01-sidecar

  webserver02-sidecar:
    image: envoyproxy/envoy:v1.23-latest
    environment:
      - ENVOY_UID=0
      - ENVOY_GID=0
    volumes:
    - ./envoy-sidecar-proxy.yaml:/etc/envoy/envoy.yaml
    - ./sidecar-proxy-certs/:/etc/envoy/certs/
    hostname: webserver02
    networks:
      envoymesh:
        ipv4_address: 172.31.8.12
        aliases:
        - webserver02-sidecar

  webserver02:
    image: ikubernetes/demoapp:v1.0
    environment:
      - PORT=8080
      - HOST=127.0.0.1
    network_mode: "service:webserver02-sidecar"
    depends_on:
    - webserver02-sidecar

networks:
  envoymesh:
    driver: bridge
    ipam:
      config:
        - subnet: 172.31.8.0/24

#      transport_socket:
#[root@k8s-master01 https-https-proxy]# cat front-envoy.yaml
admin:
  profile_path: /tmp/envoy.prof
  access_log_path: /tmp/admin_access.log
  address:
    socket_address:
       address: 0.0.0.0
       port_value: 9901

static_resources:
  listeners:
  - name: listener_http
    address:
      socket_address: { address: 0.0.0.0, port_value: 8443 }
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          codec_type: AUTO
          route_config:
            name: local_route
            virtual_hosts:
            - name: web_service_01
              domains: ["*"]
              routes:
              - match: { prefix: "/" }
                route: { cluster: web_cluster_01 }
          http_filters:
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
      transport_socket:
        name: envoy.transport_sockets.tls
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
          common_tls_context:
            tls_certificates:
            # The following self-signed certificate pair is generated using:
            # $ openssl req -x509 -newkey rsa:2048 -keyout a/front-proxy.key -out  a/front-proxy.crt -days 3650 -nodes -subj '/CN=www.magedu.com'
            #
            - certificate_chain:
                filename: "/etc/envoy/certs/front-proxy.crt"
              private_key:
                filename: "/etc/envoy/certs/front-proxy.key"

  clusters:
  - name: web_cluster_01
    connect_timeout: 0.25s
    type: STATIC
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: web_cluster_01
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address: { address: 172.31.8.11, port_value: 443 }
        - endpoint:
            address:
              socket_address: { address: 172.31.8.12, port_value: 443 }
    transport_socket:
      name: envoy.transport_sockets.tls
      typed_config:
        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext

#[root@k8s-master01 https-https-proxy]# cat envoy-sidecar-proxy.yaml
admin:
  profile_path: /tmp/envoy.prof
  access_log_path: /tmp/admin_access.log
  address:
    socket_address:
       address: 0.0.0.0
       port_value: 9901

static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address: { address: 0.0.0.0, port_value: 443 }
    filter_chains:
    - filters:
      - name: envoy.filters.network.http_connection_manager
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          stat_prefix: ingress_http
          codec_type: AUTO
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              domains: ["*"]
              routes:
              - match: { prefix: "/" }
                route: { cluster: local_cluster }
          http_filters:
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
      transport_socket:
        name: envoy.transport_sockets.tls
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
          common_tls_context:
            tls_certificates:
            # The following self-signed certificate pair is generated using:
            # $ openssl req -x509 -newkey rsa:2048 -keyout webserver.key -out  webserver.crt -days 3650 -nodes -subj '/CN=webserver.magedu.com'
            #
            - certificate_chain:
                filename: "/etc/envoy/certs/webserver.crt"
              private_key:
                filename: "/etc/envoy/certs/webserver.key"

  clusters:
  - name: local_cluster
    connect_timeout: 0.25s
    type: STATIC
    lb_policy: ROUND_ROBIN
    load_assignment:
      cluster_name: local_cluster
      endpoints:
      - lb_endpoints:
        - endpoint:
            address:
              socket_address: { address: 127.0.0.1, port_value: 8080 }