Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ambient: stash hbone peer principal in endpoint metadata #50753

Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions pilot/pkg/model/service.go
Original file line number Diff line number Diff line change
Expand Up @@ -572,6 +572,7 @@ func (ep *IstioEndpoint) Metadata() *EndpointMetadata {
Namespace: ep.Namespace,
Labels: ep.Labels,
ClusterID: ep.Locality.ClusterID,
Identity: ep.ServiceAccount,
}
}

Expand Down Expand Up @@ -600,6 +601,9 @@ type EndpointMetadata struct {

// ClusterID where the endpoint is located
ClusterID cluster.ID

// Identity of the endpoint
Identity string
}

// EndpointDiscoverabilityPolicy determines the discoverability of an endpoint throughout the mesh.
Expand Down
36 changes: 29 additions & 7 deletions pilot/pkg/networking/core/cluster_waypoint.go
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@ import (
cluster "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
endpoint "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
internalupstream "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/internal_upstream/v3"
rawbuffer "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/raw_buffer/v3"
tls "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
http "github.com/envoyproxy/go-control-plane/envoy/extensions/upstreams/http/v3"
matcher "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
Expand All @@ -38,7 +40,6 @@ import (
"istio.io/istio/pkg/config/host"
"istio.io/istio/pkg/config/protocol"
"istio.io/istio/pkg/log"
"istio.io/istio/pkg/spiffe"
)

// buildInternalUpstreamCluster builds a single endpoint cluster to the internal listener.
Expand All @@ -57,9 +58,32 @@ func buildInternalUpstreamCluster(name string, internalListener string) *cluster
}
}

func buildEncapInternalUpstreamCluster(name string, internalListener string) *cluster.Cluster {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems identical to buildInternalUpstreamCluster. is it?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah this is from a former iteration where I had a custom filter. I'll clean this up once I get this all working locally

return &cluster.Cluster{
Name: name,
ClusterDiscoveryType: &cluster.Cluster_Type{Type: cluster.Cluster_STATIC},
LoadAssignment: &endpoint.ClusterLoadAssignment{
ClusterName: name,
Endpoints: util.BuildInternalEndpoint(internalListener, nil),
},
TransportSocket: &core.TransportSocket{
Name: "internal_upstream",
ConfigType: &core.TransportSocket_TypedConfig{TypedConfig: protoconv.MessageToAny(&internalupstream.InternalUpstreamTransport{
TransportSocket: &core.TransportSocket{
Name: "raw_buffer",
ConfigType: &core.TransportSocket_TypedConfig{TypedConfig: protoconv.MessageToAny(&rawbuffer.RawBuffer{})},
},
})},
},
TypedExtensionProtocolOptions: map[string]*anypb.Any{
v3.HttpProtocolOptionsType: passthroughHttpProtocolOptions,
},
}
}

var (
MainInternalCluster = buildInternalUpstreamCluster(MainInternalName, MainInternalName)
EncapCluster = buildInternalUpstreamCluster(EncapClusterName, ConnectOriginate)
EncapCluster = buildEncapInternalUpstreamCluster(EncapClusterName, ConnectOriginate)
)

func (configgen *ConfigGeneratorImpl) buildInboundHBONEClusters() *cluster.Cluster {
Expand Down Expand Up @@ -149,11 +173,9 @@ func (cb *ClusterBuilder) buildWaypointInboundVIP(proxy *model.Proxy, svcs map[h
}

func (cb *ClusterBuilder) buildWaypointConnectOriginate(proxy *model.Proxy, push *model.PushContext) *cluster.Cluster {
m := &matcher.StringMatcher{}
m.MatchPattern = &matcher.StringMatcher_Prefix{
Prefix: spiffe.URIPrefix + spiffe.GetTrustDomain() + "/ns/" + proxy.Metadata.Namespace + "/sa/",
}
return cb.buildConnectOriginate(proxy, push, m)
// TODO: Add more specific SAN match based on metadata once envoy supports retrieving it in
// validation context.
return cb.buildConnectOriginate(proxy, push, nil)
}

func (cb *ClusterBuilder) buildConnectOriginate(proxy *model.Proxy, push *model.PushContext, uriSanMatchers ...*matcher.StringMatcher) *cluster.Cluster {
Expand Down
26 changes: 14 additions & 12 deletions pilot/pkg/networking/core/listener_waypoint.go
Original file line number Diff line number Diff line change
Expand Up @@ -339,19 +339,21 @@ func buildConnectOriginateListener() *listener.Listener {
xdsfilters.OriginalDestination,
},
FilterChains: []*listener.FilterChain{{
Filters: []*listener.Filter{{
Name: wellknown.TCPProxy,
ConfigType: &listener.Filter_TypedConfig{
TypedConfig: protoconv.MessageToAny(&tcp.TcpProxy{
StatPrefix: ConnectOriginate,
ClusterSpecifier: &tcp.TcpProxy_Cluster{Cluster: ConnectOriginate},
TunnelingConfig: &tcp.TcpProxy_TunnelingConfig{
Hostname: "%DOWNSTREAM_LOCAL_ADDRESS%",
HeadersToAdd: headers,
},
}),
Filters: []*listener.Filter{
{
Name: wellknown.TCPProxy,
ConfigType: &listener.Filter_TypedConfig{
TypedConfig: protoconv.MessageToAny(&tcp.TcpProxy{
StatPrefix: ConnectOriginate,
ClusterSpecifier: &tcp.TcpProxy_Cluster{Cluster: ConnectOriginate},
TunnelingConfig: &tcp.TcpProxy_TunnelingConfig{
Hostname: "%DOWNSTREAM_LOCAL_ADDRESS%",
HeadersToAdd: headers,
},
}),
},
},
}},
},
}},
}
return l
Expand Down
1 change: 1 addition & 0 deletions pilot/pkg/networking/util/util.go
Original file line number Diff line number Diff line change
Expand Up @@ -635,6 +635,7 @@ func BuildInternalEndpoint(dest string, meta *core.Metadata) []*endpoint.Localit
}

const OriginalDstMetadataKey = "envoy.filters.listener.original_dst"
const UpstreamPrincipalMetadataKey = "io.istio.upstream_peer_principal"

// BuildInternalLbEndpoint builds an lb endpoint pointing to the internal listener named dest.
// If the metadata contains ORIGINAL_DST destination that will become the "endpointId" to prevent deduplication.
Expand Down
4 changes: 4 additions & 0 deletions pilot/pkg/xds/endpoints/endpoint_builder.go
Original file line number Diff line number Diff line change
Expand Up @@ -667,6 +667,10 @@ func buildEnvoyLbEndpoint(b *EndpointBuilder, e *model.IstioEndpoint, mtlsEnable
ep.HostIdentifier = &endpoint.LbEndpoint_Endpoint{Endpoint: &endpoint.Endpoint{
Address: util.BuildInternalAddressWithIdentifier(connectOriginate, net.JoinHostPort(address, strconv.Itoa(port))),
}}
peerPrincipal, _ := structpb.NewStruct(map[string]any{
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need this for everything doing hbone or just waypoints?

Like does sidecar have the issue today? Seems like probably yes?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah I would think so; the simplest implementation seemed to be just always adding the identity in endpoint metadata

"uri_san": meta.Identity,
})
ep.Metadata.FilterMetadata[util.UpstreamPrincipalMetadataKey] = peerPrincipal
ep.Metadata.FilterMetadata[util.OriginalDstMetadataKey] = util.BuildTunnelMetadataStruct(address, port)
if b.dir != model.TrafficDirectionInboundVIP {
// Add TLS metadata matcher to indicate we can use HBONE for this endpoint.
Expand Down