Istio - Secured Flow

Orders to Payments authorization, restricted egress, external APIs and a database VM in the mesh. — Scroll to zoom · drag to panDownload PNG

Configuration

Existing workloads use the shown ServiceAccounts. The VM must already be joined to Istio as payments/vm-db. Replace example DNS names and addresses.

Namespace: istio-system

apiVersion: networking.istio.io/v1
kind: Sidecar
metadata:
  name: default
  namespace: istio-system
spec:
  egress:
  - hosts:
    - ./*
    - istio-system/*
  outboundTrafficPolicy:
    mode: REGISTRY_ONLY

Namespace: orders

apiVersion: v1
kind: Namespace
metadata:
  name: orders
  labels:
    istio-injection: enabled
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: orders
  namespace: orders
---
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: default
  namespace: orders
spec:
  mtls:
    mode: STRICT
---
apiVersion: networking.istio.io/v1
kind: Sidecar
metadata:
  name: default
  namespace: orders
spec:
  egress:
  - hosts:
    - ./*
    - istio-system/*
    - payments/payments.payments.svc.cluster.local
  outboundTrafficPolicy:
    mode: REGISTRY_ONLY

Namespace: payments

apiVersion: v1
kind: Namespace
metadata:
  name: payments
  labels:
    istio-injection: enabled
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: payments
  namespace: payments
---
apiVersion: v1
kind: Service
metadata:
  name: payments
  namespace: payments
spec:
  selector:
    app: payments
  ports:
  - name: http
    port: 80
    targetPort: 8080
---
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: default
  namespace: payments
spec:
  mtls:
    mode: STRICT
---
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: allow-orders
  namespace: payments
spec:
  selector:
    matchLabels:
      app: payments
  action: ALLOW
  rules:
  - from:
    - source:
        principals:
        - cluster.local/ns/orders/sa/orders
---
apiVersion: networking.istio.io/v1
kind: ServiceEntry
metadata:
  name: external-api
  namespace: payments
spec:
  hosts:
  - payments.api.example.com
  exportTo:
  - .
  location: MESH_EXTERNAL
  ports:
  - number: 80
    name: http
    protocol: HTTP
    targetPort: 443
  - number: 443
    name: https
    protocol: HTTPS
  resolution: STATIC
  endpoints:
  - address: 203.0.113.10
---
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: external-api-tls
  namespace: payments
spec:
  host: payments.api.example.com
  exportTo:
  - .
  trafficPolicy:
    portLevelSettings:
    - port:
        number: 80
      tls:
        mode: SIMPLE
        sni: payments.api.example.com
        subjectAltNames:
        - payments.api.example.com
---
apiVersion: networking.istio.io/v1
kind: Sidecar
metadata:
  name: default
  namespace: payments
spec:
  egress:
  - hosts:
    - ./*
  outboundTrafficPolicy:
    mode: REGISTRY_ONLY
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: vm-db
  namespace: payments
---
apiVersion: networking.istio.io/v1
kind: ServiceEntry
metadata:
  name: vm-db
  namespace: payments
spec:
  hosts:
  - payments.db.example.com
  addresses:
  - 10.100.50.20/32
  exportTo:
  - .
  location: MESH_INTERNAL
  ports:
  - number: 5432
    name: tcp-postgres
    protocol: TCP
  resolution: STATIC
  workloadSelector:
    labels:
      app: vm-db
---
apiVersion: networking.istio.io/v1
kind: WorkloadEntry
metadata:
  name: vm-db-1
  namespace: payments
spec:
  address: 10.100.50.20
  serviceAccount: vm-db
  labels:
    app: vm-db
---
apiVersion: networking.istio.io/v1
kind: ServiceEntry
metadata:
  name: other-db
  namespace: payments
spec:
  hosts:
  - other.db.example.com
  exportTo:
  - .
  location: MESH_EXTERNAL
  ports:
  - number: 5432
    name: tcp-postgres
    protocol: TCP
  resolution: DNS