KIALI-2148 Adding mTLS status into status endpoint #803

xeviknal · 2019-01-24T15:57:17Z

** Describe the change **

We need to show whether or not mTLS is globally enabled or not. This PR adds that status in /api/status endpoint.

The idea is that the ui takes it and prints a padlock into the masthead.

** Issue reference **
https://issues.jboss.org/browse/KIALI-2148

** Backwards incompatible? **
yep.

jmazzitelli · 2019-01-24T16:50:24Z

"Kiali mTLS" - that doesn't seem right. This has nothing to do with Kiali right? You are talking about mTLS enabled globally in the Istio mesh. I think the name of this should be changed to better reflect what it means. Otherwise, people will see it and think Kiali has turned on mTLS in some way when I think this really means "Istio has mTLS enabled across the global mesh".

xeviknal · 2019-01-24T18:40:57Z

@jmazzitelli yep, this was one thing I was worried about. I will move it to Istio mTLS.
@lucasponce @aljesusg adding in this info in the status endpoint seems right to you guys?

rhqci · 2019-01-24T20:40:25Z

Jenkins CI: kiali-core-pr-e2e-test #443

🔴 run-kiali-e2e-tests #[1055]

rhqci · 2019-01-25T17:59:49Z

Jenkins CI: kiali-core-pr-e2e-test #463

✔️ run-kiali-e2e-tests #[1077]

rhqci · 2019-01-28T12:29:23Z

Jenkins CI: kiali-core-pr-e2e-test #472

✔️ run-kiali-e2e-tests #[1092]

deploy/openshift/clusterrole.yaml

status/mtls_status.go

status/status.go

xeviknal

Changes applied!

deploy/openshift/clusterrole.yaml

status/mtls_status.go

status/status.go

rhqci · 2019-01-28T18:29:59Z

Jenkins CI: kiali-core-pr-e2e-test #473

✔️ run-kiali-e2e-tests #[1093]

rhqci · 2019-01-29T17:12:06Z

Jenkins CI: kiali-core-pr-e2e-test #476

✔️ run-kiali-e2e-tests #[1098]

rhqci · 2019-01-29T17:14:13Z

Jenkins CI: kiali-core-pr-e2e-test #477

✔️ run-kiali-e2e-tests #[1099]

abonas · 2019-01-30T10:43:17Z

@xeviknal what are the different status options? right now I see GLOBALLY_ENABLED and NOT_GLOBALLY_ENABLED. if those are the only 2 statuses, why not just use boolean true/false? the field can be called something like MTLS_ENABLED.
also iirc there was a discussion about the word "global" that it could be confusing, perhaps it was on the UI PR.

rhqci · 2019-01-30T10:44:55Z

Jenkins CI: kiali-core-pr-e2e-test #482

✔️ run-kiali-e2e-tests #[1109]

xeviknal · 2019-01-30T11:56:38Z

@abonas we have 3 scenarios so far, as I understood from heiko. I just have mentioned them in here: kiali/kiali-ui#963 (comment)
Just updated this PR description's screenshots.

Regarding the naming, I will change that to mesh-y wording instead.

rhqci · 2019-01-30T12:26:47Z

Jenkins CI: kiali-core-pr-e2e-test #483

✔️ run-kiali-e2e-tests #[1111]

xeviknal · 2019-01-30T14:49:34Z

Instruccions to verify this Pull Request (on top of bookinfo):

To achieve ENABLED status:

Install MeshPolicy[1]
Install DR[2]

To achieve PARTIALLY_ENABLED status

Install only the MP[1]
OR
Install only the DR[2]

Try both options to fully verify the feature.

To achieve NOT_ENABLED status:
Remove both 1) and 2) in case you have installed already.

MP[1] - Mesh policy enabling mesh-wide mTLS

apiVersion: "authentication.istio.io/v1alpha1"
kind: "MeshPolicy"
metadata:
  name: "default"
spec:
  peers:
  - mtls: {}

DR[2] - Destination Rule with mesh-wide enabling

apiVersion: "networking.istio.io/v1alpha3"
kind: "DestinationRule"
metadata:
  name: "default"
  namespace: "default"
spec:
  host: "*.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL

Mesh-wide installation: https://istio.io/docs/tasks/security/authn-policy/#globally-enabling-istio-mutual-tls
Namespace-wide installation: https://istio.io/docs/tasks/security/authn-policy/#namespace-wide-policy

hhovsepy · 2019-01-30T16:08:02Z

2 question here:

When Istio itself is installed in 'auth' mode, it should be considered as ENABLED without any MP or DR creation, right?
When mTLS mode is enabled for Namespace wide, or Service specific, where the secure icon should be shown?

xeviknal · 2019-01-30T16:25:39Z

Regarding to 1), I just realized that the DR might be installed in different namespaces than the default as is in the example in istio webpage. It works whenever the NS is installed: i.e. istio-system, myproject, bookinfo, etc. (always talking about the mesh-wide mtls installation). Should we check all the DR? should we force the user to install it in istio-system?

rhqci · 2019-01-30T18:47:48Z

Jenkins CI: kiali-core-pr-e2e-test #485

✔️ run-kiali-e2e-tests #[1114]

xeviknal · 2019-01-30T19:37:32Z

@hhovsepy added a commit to show green lock for istio-demo-auth.yaml installation. Can you check i out?
@pilhuhn could you please check the doubts here out and verify the feature here is align with what you suggest in previous comments?

pilhuhn · 2019-01-30T19:46:17Z

@xeviknal the combo MeshPolicy+DR in default is what enables mesh-wide mTLS.
Other *.DRs in other namespaces are used for namespace wide enabling. Here the counterpart is a Policy and not a MeshPolicy. See also
https://itnext.io/musings-about-istio-with-mtls-c64b551fe104

xeviknal · 2019-01-30T20:39:37Z

@pilhuhn if you check the istio-demo-auth.yaml installation file, the DR is installed in istio-system namespace. That is why @hhovsepy spot that oddness.

# Authentication policy to enable mutual TLS for all services (that have sidecar) in the mesh.
    apiVersion: "authentication.istio.io/v1alpha1"
    kind: "MeshPolicy"
    metadata:
      name: "default"
      labels:
        app: istio-security
        chart: security-1.0.5
        release: istio
        heritage: Tiller
    spec:
      peers:
      - mtls: {}
    ---
    # Corresponding destination rule to configure client side to use mutual TLS when talking to
    # any service (host) in the mesh.
    apiVersion: networking.istio.io/v1alpha3
    kind: DestinationRule
    metadata:
      name: "default"
      labels:
        app: istio-security
        chart: security-1.0.5
        release: istio
        heritage: Tiller
    spec:
      host: "*.local"
      trafficPolicy:
        tls:
          mode: ISTIO_MUTUAL

//from istio-demo-auth.yaml

$ oc describe destinationrules default -n istio-system
Name:         default
Namespace:    istio-system
Labels:       app=istio-security
              chart=security-1.0.4
              heritage=Tiller
              release=istio
Annotations:  kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"networking.istio.io/v1alpha3","kind":"DestinationRule","metadata":{"annotations":{},"labels":{"app":"istio-security","chart":"security-1...
API Version:  networking.istio.io/v1alpha3
Kind:         DestinationRule
Metadata:
  Creation Timestamp:  2019-01-30T19:33:30Z
  Generation:          1
  Resource Version:    3893
  Self Link:           /apis/networking.istio.io/v1alpha3/namespaces/istio-system/destinationrules/default
  UID:                 ec2a3c68-24c5-11e9-9928-525400fc4f79
Spec:
  Host:  *.local
  Traffic Policy:
    Tls:
      Mode:  ISTIO_MUTUAL
Events:      <none>

hhovsepy · 2019-01-31T12:24:00Z

Testing results for different configurations:

mesh wide mTLS: green lock icon
EDIT namespace wide mTLS: no lock icon
EDIT service wide mTLS: no lock icon
VS or DR missing: red opened lock icon
Istio configured in auth mode: green lock icon

business/istio_config.go

business/istio_config_test.go

kubernetes/istio_details_service.go

rhqci · 2019-02-05T16:54:06Z

Jenkins CI: kiali-core-pr-e2e-test #507

✔️ run-kiali-e2e-tests #[1150]

rhqci · 2019-02-05T17:17:24Z

Jenkins CI: kiali-core-pr-e2e-test #508

✔️ run-kiali-e2e-tests #[1151]

xeviknal · 2019-02-05T17:26:26Z

@lucasponce comments approached :)

…LS status

lucasponce

Tested locally with PR UI kiali/kiali-ui#963 and discussed with @xeviknal

xeviknal added do not merge A PR is not ready to merge requires UI PR A PR sent to the backend kiali/kiali requires changes on frontend kiali/kiali-ui labels Jan 24, 2019

xeviknal force-pushed the KIALI-2148 branch from c394761 to 4e8cc76 Compare January 24, 2019 16:05

xeviknal force-pushed the KIALI-2148 branch 2 times, most recently from d1df034 to 1b89709 Compare January 25, 2019 17:44

xeviknal mentioned this pull request Jan 25, 2019

KIALI-2148 Add padlock next to Kiali logo when mTLS is gloablly enabled kiali/kiali-ui#963

Merged

xeviknal requested review from lucasponce and aljesusg January 28, 2019 09:48

xeviknal force-pushed the KIALI-2148 branch from 1b89709 to ae2c1f1 Compare January 28, 2019 12:15

lucasponce reviewed Jan 28, 2019

View reviewed changes

deploy/openshift/clusterrole.yaml Show resolved Hide resolved

lucasponce reviewed Jan 28, 2019

View reviewed changes

status/mtls_status.go Outdated Show resolved Hide resolved

lucasponce reviewed Jan 28, 2019

View reviewed changes

status/status.go Outdated Show resolved Hide resolved

xeviknal force-pushed the KIALI-2148 branch from 570b3a0 to a7e2e3f Compare January 28, 2019 18:15

xeviknal commented Jan 28, 2019

View reviewed changes

deploy/openshift/clusterrole.yaml Show resolved Hide resolved

status/mtls_status.go Outdated Show resolved Hide resolved

status/status.go Outdated Show resolved Hide resolved

xeviknal force-pushed the KIALI-2148 branch from a41f127 to b1041ff Compare January 29, 2019 16:59

xeviknal force-pushed the KIALI-2148 branch from b1041ff to 2d12ebc Compare January 30, 2019 10:29

xeviknal force-pushed the KIALI-2148 branch from 2d12ebc to 5f8d205 Compare January 30, 2019 12:11

xeviknal removed the do not merge A PR is not ready to merge label Jan 30, 2019

lucasponce reviewed Feb 4, 2019

View reviewed changes

business/istio_config.go Outdated Show resolved Hide resolved

lucasponce reviewed Feb 4, 2019

View reviewed changes

business/istio_config_test.go Show resolved Hide resolved

lucasponce requested changes Feb 4, 2019

View reviewed changes

kubernetes/istio_details_service.go Outdated Show resolved Hide resolved

lucasponce reviewed Feb 4, 2019

View reviewed changes

kubernetes/istio_details_service.go Outdated Show resolved Hide resolved

xeviknal force-pushed the KIALI-2148 branch from 0946f8c to 3a5ddf1 Compare February 5, 2019 17:01

xeviknal added 8 commits February 6, 2019 13:21

KIALI-2148 Add GetPolicies method to client

798c0a3

KIALI-2148 Remove unused moch method

de4fc72

KIALI-2148 Add Status telling about mTLS globally enabling

3be677a

KIALI-2148 Considering Default DestinationRule to compute MeshWide mT…

354ce29

…LS status

KIALI-2148 DR enabling mTLS into cluster placed into istio-system ns

44040c3

KIALI-2148 Looking for enabling DR in whole namespaces

75d21a1

KIALI-2148 Check DestinationRules iterating by namespaces

bfdb2c9

KIALI-2148 Allow restricted access users to retrieve MeshPolicies

4dfaf44

xeviknal force-pushed the KIALI-2148 branch from 3a5ddf1 to 4dfaf44 Compare February 6, 2019 12:21

KIALI-2148 Move GetAllDestinationRules to business layer

a483465

lucasponce approved these changes Feb 6, 2019

View reviewed changes

lucasponce merged commit 3992111 into kiali:master Feb 6, 2019

xeviknal deleted the KIALI-2148 branch February 6, 2019 15:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

KIALI-2148 Adding mTLS status into status endpoint #803

KIALI-2148 Adding mTLS status into status endpoint #803

xeviknal commented Jan 24, 2019 •

edited

jmazzitelli commented Jan 24, 2019

xeviknal commented Jan 24, 2019

rhqci commented Jan 24, 2019

rhqci commented Jan 25, 2019

rhqci commented Jan 28, 2019

xeviknal left a comment

rhqci commented Jan 28, 2019

rhqci commented Jan 29, 2019

rhqci commented Jan 29, 2019

abonas commented Jan 30, 2019

rhqci commented Jan 30, 2019

xeviknal commented Jan 30, 2019 •

edited

rhqci commented Jan 30, 2019

xeviknal commented Jan 30, 2019 •

edited

hhovsepy commented Jan 30, 2019

xeviknal commented Jan 30, 2019

rhqci commented Jan 30, 2019

xeviknal commented Jan 30, 2019 •

edited

pilhuhn commented Jan 30, 2019

xeviknal commented Jan 30, 2019 •

edited

hhovsepy commented Jan 31, 2019 •

edited

rhqci commented Feb 5, 2019

rhqci commented Feb 5, 2019

xeviknal commented Feb 5, 2019

lucasponce left a comment

Navigation Menu

KIALI-2148 Adding mTLS status into status endpoint #803

KIALI-2148 Adding mTLS status into status endpoint #803

Conversation

xeviknal commented Jan 24, 2019 • edited

jmazzitelli commented Jan 24, 2019

xeviknal commented Jan 24, 2019

rhqci commented Jan 24, 2019

rhqci commented Jan 25, 2019

rhqci commented Jan 28, 2019

xeviknal left a comment

Choose a reason for hiding this comment

rhqci commented Jan 28, 2019

rhqci commented Jan 29, 2019

rhqci commented Jan 29, 2019

abonas commented Jan 30, 2019

rhqci commented Jan 30, 2019

xeviknal commented Jan 30, 2019 • edited

rhqci commented Jan 30, 2019

xeviknal commented Jan 30, 2019 • edited

hhovsepy commented Jan 30, 2019

xeviknal commented Jan 30, 2019

rhqci commented Jan 30, 2019

xeviknal commented Jan 30, 2019 • edited

pilhuhn commented Jan 30, 2019

xeviknal commented Jan 30, 2019 • edited

hhovsepy commented Jan 31, 2019 • edited

rhqci commented Feb 5, 2019

rhqci commented Feb 5, 2019

xeviknal commented Feb 5, 2019

lucasponce left a comment

Choose a reason for hiding this comment

xeviknal commented Jan 24, 2019 •

edited

xeviknal commented Jan 30, 2019 •

edited

xeviknal commented Jan 30, 2019 •

edited

xeviknal commented Jan 30, 2019 •

edited

xeviknal commented Jan 30, 2019 •

edited

hhovsepy commented Jan 31, 2019 •

edited