Thanks for getting back to me @leitang.
This is Istio 1.5.1. I am installing Istio via helm in AWS EKS.
In my values file, I define the following configuration.
gateways:
enabled: true
istio-ingressgateway:
serviceAnnotations:
service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
istio-egressgateway:
enabled: true
env:
# Needed to route traffic via egress gateway if desired.
ISTIO_META_REQUESTED_NETWORK_VIEW: "external"
security:
enabled: true
selfSigned: false
global:
mtls:
# Default setting for service-to-service mtls. Can be set explicitly using
# destination rules or service annotations.
enabled: true
# If set to true, and a given service does not have a corresponding DestinationRule configured,
# or its DestinationRule does not have TLSSettings specified, Istio configures client side
# TLS configuration automatically, based on the server side mTLS authentication policy and the
# availibity of sidecars.
auto: true
podDNSSearchNamespaces:
- global
- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global"
meshExpansion:
enabled: false
# If set to true, the pilot and citadel mtls and the plaintext pilot ports
# will be exposed on an internal gateway
useILB: false
multiCluster:
# Set to true to connect two kubernetes clusters via their respective
# ingressgateway services when pods in each cluster cannot directly
# talk to one another. All clusters should be using Istio mTLS and must
# have a shared root CA for this model to work.
enabled: true
# Should be set to the name of the cluster this installation will run in. This is required for sidecar injection
# to properly label proxies
clusterName: ${myCluster}
To configure the custom CA, I ported the Makefile on the Github.
.SUFFIXES: .csr .pem .conf
.PRECIOUS: %/ca-key.pem %/ca-cert.pem %/cert-chain.pem
.PRECIOUS: root-cert.csr root-ca.conf %/cluster-ca.csr %/intermediate.conf
.SECONDARY: root-cert.csr root-ca.conf %/cluster-ca.csr %/intermediate.conf
.DEFAULT_GOAL := help
#------------------------------------------------------------------------
# variables: root CA
ROOTCA_DAYS ?= 3650
ROOTCA_KEYSZ ?= 4096
ROOTCA_ORG ?= MyCompany
ROOTCA_CN ?= Root CA
# Additional variables are defined in root-ca.conf target below.
#------------------------------------------------------------------------
# variables: Intermediate CA
INT_SERIAL ?= $(shell echo $$RANDOM) # certificate serial number (uses current PID)
INT_DAYS ?= 3650
INT_KEYSZ ?= 4096
INT_ORG ?= MyCompany
INT_CN ?= Intermediate CA
INT_SAN_DNS ?= localhost
# Additional variables are defined in %/intermediate.conf target below.
#------------------------------------------------------------------------
# variables: intermediate CA (Istio)
ISTIO_SERIAL ?= $(shell echo $$RANDOM) # certificate serial number (uses current PID)
ISTIO_DAYS ?= 3650
ISTIO_KEYSZ ?= 4096
ISTIO_ORG ?= MyCompany
ISTIO_SAN_DNS ?= localhost
# Additional variables are defined in %/intermediate.conf target below.
#------------------------------------------------------------------------
##help: print this help message
.PHONY: help
help: Makefile
@sed -n 's/^##//p' $<
#------------------------------------------------------------------------
##root-ca: generate root CA files (key and certifcate) in current directory
.PHONY: root-ca
root-ca: root-key.pem root-cert.pem
root-cert.pem: root-cert.csr root-key.pem
@echo "generating $@"
@openssl x509 -req -days $(ROOTCA_DAYS) -signkey root-key.pem \
-extensions req_ext -extfile root-ca.conf \
-in $< -out $@
root-cert.csr: root-key.pem root-ca.conf
@echo "generating $@"
@openssl req -new -key $< -config root-ca.conf -out $@
root-ca.conf:
@echo "[ req ]" > $@
@echo "encrypt_key = no" >> $@
@echo "prompt = no" >> $@
@echo "utf8 = yes" >> $@
@echo "default_md = sha256" >> $@
@echo "default_bits = $(ROOTCA_KEYSZ)" >> $@
@echo "req_extensions = req_ext" >> $@
@echo "x509_extensions = req_ext" >> $@
@echo "distinguished_name = req_dn" >> $@
@echo "[ req_ext ]" >> $@
@echo "subjectKeyIdentifier = hash" >> $@
@echo "basicConstraints = critical, CA:true" >> $@
@echo "keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, keyCertSign" >> $@
@echo "[ req_dn ]" >> $@
@echo "O = $(ROOTCA_ORG)" >> $@
@echo "CN = $(ROOTCA_CN)" >> $@
root-key.pem:
@echo "generating $@"
@openssl genrsa -out $@ 4096
#------------------------------------------------------------------------
##intermediate-ca: generate intermediate certificate authority. Includes all PEM files needed.
.PHONY: intermediate-ca
intermediate-ca: int/int-cert-chain.pem root-cert.pem
@echo "int inputs stored in $(dir $<)"
@cp root-cert.pem $(dir $<)
int/int-cert-chain.pem: int/int-ca-cert.pem root-cert.pem
@echo "generating $@"
@cat $^ > $@
int/int-ca-cert.pem: int/int-ca.csr root-key.pem root-cert.pem
@echo "generating $@"
@openssl x509 -req -days $(INT_DAYS) \
-CA root-cert.pem -CAkey root-key.pem -set_serial $(INT_SERIAL) \
-extensions req_ext -extfile $(dir $<)/int-intermediate.conf \
-in $< -out $@
int/int-ca.csr: L=$(dir $@)
int/int-ca.csr: int/int-ca-key.pem int/int-intermediate.conf
@echo "generating $@"
@openssl req -new -config $(L)/int-intermediate.conf -key $< -out $@
int/int-ca-key.pem:
@echo "generating $@"
@mkdir -p $(dir $@)
@openssl genrsa -out $@ 4096
int/int-intermediate.conf: L=$(dir $@)
int/int-intermediate.conf:
@echo "[ req ]" > $@
@echo "encrypt_key = no" >> $@
@echo "prompt = no" >> $@
@echo "utf8 = yes" >> $@
@echo "default_md = sha256" >> $@
@echo "default_bits = $(INT_KEYSZ)" >> $@
@echo "req_extensions = req_ext" >> $@
@echo "x509_extensions = req_ext" >> $@
@echo "distinguished_name = req_dn" >> $@
@echo "[ req_ext ]" >> $@
@echo "subjectKeyIdentifier = hash" >> $@
@echo "basicConstraints = critical, CA:true" >> $@
@echo "keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, keyCertSign" >> $@
@echo "subjectAltName=@san" >> $@
@echo "[ san ]" >> $@
@echo "DNS.1 = $(INT_SAN_DNS)" >> $@
@echo "[ req_dn ]" >> $@
@echo "O = $(INT_ORG)" >> $@
@echo "CN = $(INT_CN)" >> $@
@echo "L = $(L:/=)" >> $@
#------------------------------------------------------------------------
##<name>-certs: generate Istio certificate authority for <name>. Includes all PEM files needed.
.PHONY: %-certs
%-certs: %/cert-chain.pem int/int-ca-cert.pem int/int-cert-chain.pem int/root-cert.pem
@echo "ISTIO inputs stored in $(dir $<)"
@cp int/int-ca-cert.pem $(dir $<)
@cp int/root-cert.pem $(dir $<)/root-cert.pem
%/cert-chain.pem: %/ca-cert.pem int/int-ca-cert.pem int/root-cert.pem
@echo "generating $@"
@cat $^ > $@
%/ca-cert.pem: %/cluster-ca.csr int/int-ca-key.pem int/int-ca-cert.pem
@echo "generating $@"
@openssl x509 -req -days $(ISTIO_DAYS) \
-CA int/int-ca-cert.pem -CAkey int/int-ca-key.pem -set_serial $(ISTIO_SERIAL) \
-extensions req_ext -extfile $(dir $<)/intermediate.conf \
-in $< -out $@
%/cluster-ca.csr: L=$(dir $@)
%/cluster-ca.csr: %/ca-key.pem %/intermediate.conf
@echo "generating $@"
@openssl req -new -config $(L)/intermediate.conf -key $< -out $@
%/ca-key.pem:
@echo "generating $@"
@mkdir -p $(dir $@)
@openssl genrsa -out $@ 4096
%/intermediate.conf: L=$*_eks_cluster
%/intermediate.conf:
@echo "[ req ]" > $@
@echo "encrypt_key = no" >> $@
@echo "prompt = no" >> $@
@echo "utf8 = yes" >> $@
@echo "default_md = sha256" >> $@
@echo "default_bits = $(ISTIO_KEYSZ)" >> $@
@echo "req_extensions = req_ext" >> $@
@echo "x509_extensions = req_ext" >> $@
@echo "distinguished_name = req_dn" >> $@
@echo "[ req_ext ]" >> $@
@echo "subjectKeyIdentifier = hash" >> $@
@echo "basicConstraints = critical, CA:true" >> $@
@echo "keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, keyCertSign" >> $@
@echo "subjectAltName=@san" >> $@
@echo "[ san ]" >> $@
@echo "URI.1 = spiffe://cluster.local/ns/istio-system/sa/citadel" >> $@
@echo "URI.2 = spiffe://$(L:/=)/ns/istio-system/sa/citadel" >> $@
@echo "URI.3 = spiffe://cluster.global/ns/istio-system/sa/citadel" >> $@
@echo "DNS.1 = $(ISTIO_SAN_DNS)" >> $@
@echo "[ req_dn ]" >> $@
@echo "O = $(ISTIO_ORG)" >> $@
@echo "CN = $*_eks_cluster Intermediate CA" >> $@
@echo "L = $(L:/=)" >> $@
When this is setup in both cluster, I create a service entry for a remote service for Cluster B in cluster A.
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: details
spec:
hosts:
# must be of form name.namespace.global
- details.default.global
# Treat remote cluster services as part of the service mesh
# as all clusters in the service mesh share the same root of trust.
location: MESH_INTERNAL
ports:
- name: http
number: 9080
protocol: http
resolution: DNS
addresses:
# the IP address to which httpbin.bar.global will resolve to
# must be unique for each remote service, within a given cluster.
# This address need not be routable. Traffic for this IP will be captured
# by the sidecar and routed appropriately.
- 240.0.1.4
endpoints:
# This is the routable address of the ingress gateway in cluster2 that
# sits in front of sleep.foo service. Traffic from the sidecar will be
# routed to this address.
- address: ${DNS OF INGRESS CONTROLLER NLB}
ports:
http: 15443 # Do not change this port value
EOF
