Add a user guide for Istio Vault CA integration #3098

lei-tang · 2019-01-16T20:53:40Z

Add a user guide for Istio Vault CA integration.
This PR is for the issues:

It depends on istio/istio#11024.

geeknoid · 2019-01-16T20:54:12Z

Deploy preview for preliminary-istio failed.

Built with commit 1634eb3

https://app.netlify.com/sites/preliminary-istio/deploys/5c3f99d98a23e0000896ab19

lei-tang · 2019-01-16T20:54:32Z

/cc @myidpt

geeknoid · 2019-01-16T22:11:40Z

content/docs/tasks/security/vault-ca/index.md

+## Install Istio with SDS enabled
+
+1.  Use `git clone` to download the latest Istio source code.
+As the time of writing, the latest Istio code is on the release-1.1 branch


Er, I'm not sure we need or want any of this GitHub gymnastic in customer documentation.

Documentation checked into the master branch of this repo will only be made available to customers when 1.1 is officially released. So I presume the customers won't need to do custom builds of anything in order to get the functionality, correct?

Correct. The GitHub gymnastic has been removed.

quanjielin · 2019-01-17T04:02:01Z

probably merge this PR into https://github.com/istio/istio.io/blob/master/content/docs/tasks/security/auth-sds/index.md#before-you-begin ? since the only difference will be which helm value file to applied(citadel config or vault config).

lei-tang · 2019-01-17T04:21:13Z

This PR and https://github.com/istio/istio.io/blob/master/content/docs/tasks/security/auth-sds/index.md#before-you-begin both have a step to run helm template command. Other than that, they are quite different. This PR provides a user guide for plugging in Vault CA and observing the certificate signing requests routed to Vault CA; none of these content is in the tasks/security/auth-sds/index.md#before-you-begin.

geeknoid · 2019-01-17T16:26:14Z

content/docs/tasks/security/vault-ca/index.md

@@ -0,0 +1,148 @@
+---
+title: Istio Vault CA integration


integration -> Integration

geeknoid · 2019-01-17T16:27:25Z

content/docs/tasks/security/vault-ca/index.md

+
+* Create a new Kubernetes cluster to run the example in this tutorial.
+
+* On GKE, you may set the value of the `CLUSTER`, `ZONE`, and `PROJECT`


Do we need per-platform instructions? It's not great to have an explicit callout to GKE in an otherwise generic doc page.

Removed the per-platform instructions.

geeknoid · 2019-01-17T16:29:08Z

content/docs/tasks/security/vault-ca/index.md

+
+## Install Istio with SDS enabled
+
+1.  Use `git clone` to download the latest Istio source code.


Again, can we assume customers have access to the full 1.1 release bits and that they need/want our source code?

Revised to assume customers have access to the full 1.1 release bits. Removed downloading source code.

geeknoid · 2019-01-17T16:29:47Z

content/docs/tasks/security/vault-ca/index.md

+
+1.  Install Istio with SDS enabled and Node Agent sending certificate signing
+requests to a testing Vault CA (this example uses the latest release on
+2019-01-15, you may also use other releases):


This doc should be relative to the final 1.1 release, not a specific nightly build.

Revised accordingly.

geeknoid · 2019-01-17T16:32:33Z

content/docs/tasks/security/vault-ca/index.md

+the testing Vault server, so that Envoy will not intercept the traffic from
+Node Agent to Vault.
+
+The yaml file `install/kubernetes/helm/istio/values-istio-example-sds-vault.yaml`


Use {{< github_file >}}install/kubernetes/helm/istio/values-istio-example-sds-vault.yaml{{< /github_file >}} which will produce a link to the file in GitHub.

geeknoid · 2019-01-17T16:33:07Z

content/docs/tasks/security/vault-ca/index.md

+## Deploy a testing workload
+
+This section deploys a testing workload `httpbin`. When the sidecar of the
+testing workload requests for a certificate through SDS, Node Agent will send


geeknoid · 2019-01-17T16:34:00Z

content/docs/tasks/security/vault-ca/index.md

+testing workload requests for a certificate through SDS, Node Agent will send
+certificate signing requests to Vault.
+
+1.  Download the Istio install package


Again, we need to assume 1.1 is available and in use. Please look at how other pages handle this kind of step for an example.

Revised based on the comment.

geeknoid · 2019-01-17T16:35:40Z

content/docs/tasks/security/vault-ca/index.md

+1.  Generate the deployment for an example `httpbin` backend:
+
+    {{< text bash >}}
+    $ bin/istioctl kube-inject -f samples/httpbin/httpbin.yaml > httpbin-injected.yaml


No "bin/"
Surround the input yaml path name with @@. This will result in a link to the file on GitHub.

Done, but "surround the input yaml path name with @@" does not result in a link when previewing the page through the localhost:1313 server (perhaps because it is in {{< text bash >}} block?)

The @@ syntax is specifically only supported in text blocks. Check out other pages for examples. But it should be:

$ istioctl kube-inject -f @samples/httpbin/httpbin.yaml@ > httpbin-injected.yaml

Fixed, thanks!

geeknoid · 2019-01-17T16:36:00Z

content/docs/tasks/security/vault-ca/index.md

+    $ kubectl apply -f httpbin-injected.yaml
+    {{< /text >}}
+
+1.  List the pods of Node Agent:


List Node Agent's pods:

geeknoid · 2019-01-17T16:36:20Z

content/docs/tasks/security/vault-ca/index.md

+    $ kubectl get pod -n istio-system -l app=nodeagent -o jsonpath={.items..metadata.name}
+    {{< /text >}}
+
+1.  View the logs of each Node Agent. The Node Agent residing on


View each Node Agent's logs.

geeknoid

Getting close :-)

geeknoid · 2019-01-17T22:34:25Z

content/docs/tasks/security/vault-ca/index.md

+1.  Generate the deployment for an example `httpbin` backend:
+
+    {{< text bash >}}
+    $ istioctl kube-inject -f @@samples/httpbin/httpbin.yaml@@ > httpbin-injected.yaml


Sorry, my comment was ambiguous. Just a single @ on either end is what is needed, not two.

geeknoid · 2019-01-17T22:34:56Z

content/docs/tasks/security/vault-ca/index.md

+    $ kubectl logs -n istio-system THE-POD-NAME-FROM-PREVIOUS-COMMAND
+    {{< /text >}}
+
+1.  Because in this example, Vault is not configured to accept the k8s JWT


Replace any uses of k8s with Kubernetes within the doc.

geeknoid · 2019-01-17T22:35:31Z

content/docs/tasks/security/vault-ca/index.md

+
+1.  Because in this example, Vault is not configured to accept the k8s JWT
+service account from the `httpbin` workload, you should see that Vault rejects the
+signing requests with the following logs.


logs. -> logs:

geeknoid · 2019-01-18T02:47:21Z

/lgtm
/approve

istio-testing · 2019-01-18T02:47:28Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: geeknoid, lei-tang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/OWNERS~~ [geeknoid]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Add a user guide for Istio Vault CA integration

1634eb3

googlebot added the cla: yes label Jan 16, 2019

istio-testing requested review from frankbu and sdake January 16, 2019 20:53

istio-testing requested a review from myidpt January 16, 2019 20:54

lei-tang mentioned this pull request Jan 16, 2019

Add an example helm values yaml for Vault integration user guide istio/istio#11024

Merged

geeknoid reviewed Jan 16, 2019

View reviewed changes

lei-tang force-pushed the user_guide_vault_integration branch 3 times, most recently from 2343193 to 68908f7 Compare January 16, 2019 22:50

Fix lint errors

0ef8c23

lei-tang force-pushed the user_guide_vault_integration branch from 68908f7 to 0ef8c23 Compare January 16, 2019 22:53

Use helm template values to simplify the config

96c7cd7

lei-tang force-pushed the user_guide_vault_integration branch from d306888 to 96c7cd7 Compare January 17, 2019 02:33

geeknoid reviewed Jan 17, 2019

View reviewed changes

lei-tang added 2 commits January 17, 2019 11:30

Address review comments

59c840f

Fix the link in a command

25446cd

geeknoid reviewed Jan 17, 2019

View reviewed changes

Small fixes

3932a09

istio-testing assigned geeknoid Jan 18, 2019

istio-testing added the lgtm label Jan 18, 2019

istio-testing added the approved label Jan 18, 2019

istio-testing merged commit 8bf8d66 into istio:master Jan 18, 2019

aerotog mentioned this pull request Mar 12, 2019

User guide for Istio Vault integration istio/istio#10968

Closed


		* Create a new Kubernetes cluster to run the example in this tutorial.

		* On GKE, you may set the value of the `CLUSTER`, `ZONE`, and `PROJECT`


		## Install Istio with SDS enabled

		1. Use `git clone` to download the latest Istio source code.

Add a user guide for Istio Vault CA integration #3098

Add a user guide for Istio Vault CA integration #3098

Conversation

lei-tang commented Jan 16, 2019 • edited Loading

geeknoid commented Jan 16, 2019

lei-tang commented Jan 16, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

quanjielin commented Jan 17, 2019

lei-tang commented Jan 17, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

geeknoid left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

geeknoid commented Jan 18, 2019

istio-testing commented Jan 18, 2019

lei-tang commented Jan 16, 2019 •

edited

Loading