Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ambient: stash hbone peer principal in endpoint metadata #50753

Closed
wants to merge 4 commits into from
Closed

ambient: stash hbone peer principal in endpoint metadata #50753

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e2653c5
Preserve io.istio.peer_principal for downstream rbac; create new meta…
keithmattix Apr 30, 2024
44f2df7
stash: passthrough metadata approach
keithmattix Apr 30, 2024
836788f
Stash - set filter state to tcp
keithmattix May 1, 2024
06aa692
Stash identity in endpoint metadata
keithmattix May 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 4 additions & 0 deletions pilot/pkg/model/service.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -572,6 +572,7 @@ func (ep *IstioEndpoint) Metadata() *EndpointMetadata {
Namespace: ep.Namespace,
Labels: ep.Labels,
ClusterID: ep.Locality.ClusterID,
Identity: ep.ServiceAccount,
}
}

Expand Down Expand Up @@ -600,6 +601,9 @@ type EndpointMetadata struct {

// ClusterID where the endpoint is located
ClusterID cluster.ID

// Identity of the endpoint
Identity string
}

// EndpointDiscoverabilityPolicy determines the discoverability of an endpoint throughout the mesh.
Expand Down
36 changes: 29 additions & 7 deletions pilot/pkg/networking/core/cluster_waypoint.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@ import (
cluster "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
endpoint "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
internalupstream "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/internal_upstream/v3"
rawbuffer "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/raw_buffer/v3"
tls "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
http "github.com/envoyproxy/go-control-plane/envoy/extensions/upstreams/http/v3"
matcher "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
Expand All @@ -38,7 +40,6 @@ import (
"istio.io/istio/pkg/config/host"
"istio.io/istio/pkg/config/protocol"
"istio.io/istio/pkg/log"
"istio.io/istio/pkg/spiffe"
)

// buildInternalUpstreamCluster builds a single endpoint cluster to the internal listener.
Expand All @@ -57,9 +58,32 @@ func buildInternalUpstreamCluster(name string, internalListener string) *cluster
}
}

func buildEncapInternalUpstreamCluster(name string, internalListener string) *cluster.Cluster {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems identical to buildInternalUpstreamCluster. is it?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah this is from a former iteration where I had a custom filter. I'll clean this up once I get this all working locally

return &cluster.Cluster{
Name: name,
ClusterDiscoveryType: &cluster.Cluster_Type{Type: cluster.Cluster_STATIC},
LoadAssignment: &endpoint.ClusterLoadAssignment{
ClusterName: name,
Endpoints: util.BuildInternalEndpoint(internalListener, nil),
},
TransportSocket: &core.TransportSocket{
Name: "internal_upstream",
ConfigType: &core.TransportSocket_TypedConfig{TypedConfig: protoconv.MessageToAny(&internalupstream.InternalUpstreamTransport{
TransportSocket: &core.TransportSocket{
Name: "raw_buffer",
ConfigType: &core.TransportSocket_TypedConfig{TypedConfig: protoconv.MessageToAny(&rawbuffer.RawBuffer{})},
},
})},
},
TypedExtensionProtocolOptions: map[string]*anypb.Any{
v3.HttpProtocolOptionsType: passthroughHttpProtocolOptions,
},
}
}

var (
MainInternalCluster = buildInternalUpstreamCluster(MainInternalName, MainInternalName)
EncapCluster = buildInternalUpstreamCluster(EncapClusterName, ConnectOriginate)
EncapCluster = buildEncapInternalUpstreamCluster(EncapClusterName, ConnectOriginate)
)

func (configgen *ConfigGeneratorImpl) buildInboundHBONEClusters() *cluster.Cluster {
Expand Down Expand Up @@ -149,11 +173,9 @@ func (cb *ClusterBuilder) buildWaypointInboundVIP(proxy *model.Proxy, svcs map[h
}

func (cb *ClusterBuilder) buildWaypointConnectOriginate(proxy *model.Proxy, push *model.PushContext) *cluster.Cluster {
m := &matcher.StringMatcher{}
m.MatchPattern = &matcher.StringMatcher_Prefix{
Prefix: spiffe.URIPrefix + spiffe.GetTrustDomain() + "/ns/" + proxy.Metadata.Namespace + "/sa/",
}
return cb.buildConnectOriginate(proxy, push, m)
// TODO: Add more specific SAN match based on metadata once envoy supports retrieving it in
// validation context.
return cb.buildConnectOriginate(proxy, push, nil)
}

func (cb *ClusterBuilder) buildConnectOriginate(proxy *model.Proxy, push *model.PushContext, uriSanMatchers ...*matcher.StringMatcher) *cluster.Cluster {
Expand Down
26 changes: 14 additions & 12 deletions pilot/pkg/networking/core/listener_waypoint.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -339,19 +339,21 @@ func buildConnectOriginateListener() *listener.Listener {
xdsfilters.OriginalDestination,
},
FilterChains: []*listener.FilterChain{{
Filters: []*listener.Filter{{
Name: wellknown.TCPProxy,
ConfigType: &listener.Filter_TypedConfig{
TypedConfig: protoconv.MessageToAny(&tcp.TcpProxy{
StatPrefix: ConnectOriginate,
ClusterSpecifier: &tcp.TcpProxy_Cluster{Cluster: ConnectOriginate},
TunnelingConfig: &tcp.TcpProxy_TunnelingConfig{
Hostname: "%DOWNSTREAM_LOCAL_ADDRESS%",
HeadersToAdd: headers,
},
}),
Filters: []*listener.Filter{
{
Name: wellknown.TCPProxy,
ConfigType: &listener.Filter_TypedConfig{
TypedConfig: protoconv.MessageToAny(&tcp.TcpProxy{
StatPrefix: ConnectOriginate,
ClusterSpecifier: &tcp.TcpProxy_Cluster{Cluster: ConnectOriginate},
TunnelingConfig: &tcp.TcpProxy_TunnelingConfig{
Hostname: "%DOWNSTREAM_LOCAL_ADDRESS%",
HeadersToAdd: headers,
},
}),
},
},
}},
},
}},
}
return l
Expand Down
1 change: 1 addition & 0 deletions pilot/pkg/networking/util/util.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -635,6 +635,7 @@ func BuildInternalEndpoint(dest string, meta *core.Metadata) []*endpoint.Localit
}

const OriginalDstMetadataKey = "envoy.filters.listener.original_dst"
const UpstreamPrincipalMetadataKey = "io.istio.upstream_peer_principal"

// BuildInternalLbEndpoint builds an lb endpoint pointing to the internal listener named dest.
// If the metadata contains ORIGINAL_DST destination that will become the "endpointId" to prevent deduplication.
Expand Down
4 changes: 4 additions & 0 deletions pilot/pkg/xds/endpoints/endpoint_builder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -667,6 +667,10 @@ func buildEnvoyLbEndpoint(b *EndpointBuilder, e *model.IstioEndpoint, mtlsEnable
ep.HostIdentifier = &endpoint.LbEndpoint_Endpoint{Endpoint: &endpoint.Endpoint{
Address: util.BuildInternalAddressWithIdentifier(connectOriginate, net.JoinHostPort(address, strconv.Itoa(port))),
}}
peerPrincipal, _ := structpb.NewStruct(map[string]any{
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need this for everything doing hbone or just waypoints?

Like does sidecar have the issue today? Seems like probably yes?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah I would think so; the simplest implementation seemed to be just always adding the identity in endpoint metadata

"uri_san": meta.Identity,
})
ep.Metadata.FilterMetadata[util.UpstreamPrincipalMetadataKey] = peerPrincipal
ep.Metadata.FilterMetadata[util.OriginalDstMetadataKey] = util.BuildTunnelMetadataStruct(address, port)
if b.dir != model.TrafficDirectionInboundVIP {
// Add TLS metadata matcher to indicate we can use HBONE for this endpoint.
Expand Down