Cloud Native Computing Foundation KubeCon + CloudNativeCon China 2019 (Shanghai), 5 Jul 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: How SPIFFE Helps Istio in Service Mesh Federation - Yonggang Liu & Wencheng Lu, Google

Description

Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io

Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects

How SPIFFE Helps Istio in Service Mesh Federation - Yonggang Liu & Wencheng Lu, Google

This proposal resolves the fundamental identity federation problem between different trust domains, using the trust domain and bundle standard proposed by SPIFFE. As an important collaborator of SPIFFE/SPIRE, Istio adopts this standard to support federations with SPIRE and other identity systems. The newly proposed standard enables multiple service meshes to securely establish trusts for cross-mesh secure communications. In this talk, we will explain how this new standard can help on federated service meshes and how Istio supports the standard. Finally, we will demonstrate how the federation can be set up between Istio and SPIRE systems.

https://sched.co/NrpL

A

Hello, everyone welcome to this session. My name is wen Chen.

A

My colleague, Oliver and I were talking about how spiffy helps you stay on your service match Federation today, those of us have been working on easier since the starts and how many of you have heard of each do great and how about a spiffy, wonderful, I'm, so glad to see that looks like popularity for both of them have increased quite rapidly over the past a year.

A

Let me start with the lady the background introduction. So SEO is mostly known as a surf smash to be most specific. It's an over service platform to manage the service interactions across workloads running from everywhere, kubernetes VM on purim public cloud. It assaults three major problems for service communication. First of visibility. It provides your uniform visibility into what's happening to your service. Who is accessing your service was the latency words error rates, which method is called and second operation operational agility.

A

Instead, as advanced loader balancing traffic shifting traffic shaping to help, you manage the traffic easily and roll out a new version of service safely. The third panelist is power, Stevens securities. They provide the Colorado policy, allows you to describe your intent and easier enforce the desired security for you. It has features like mutual chairs to encrypt data in transit. Also provides you cheaper protection against your service, which refers to authentication or senegal hook. It's access. Your service authorized. Allow you to conchagua to allow to access your service and audience.

A

So you know who access your service in order way.

A

Next is about spiffy spiffy, it's basically, a set of open source standards that help you build. Secure production at any different work in a heterogeneous environment, like is, do like a VN cuban air is unplanned and adding environments and spiffy standards include two parts. First, as VI d that defines what is PV identity is and how speaker identity is presented in the x.509 certificate.

A

Second, apart is pvap IDEs that describes how to secure a provision spirit, energy to each workload from a certificate authority, and if you have before identities, provision from different certificate authority how to repatriate them. So they can talk to each other.

A

And what relationship between spiffy and sto so to hopefully, this slide gives you a rough idea. So Israel gives you a secure identity framework that provides Joan identities for service to service authentication and is still heavily leverages PV to purities identity framework. First.

A

Every easier Waclaw identity is also spe adenosine, so basically the identity specifier in exponent form at following the species fallen s SPID standard.

A

We are also actively working on supporting specie federation api. We will talk more about this part in the following slides.

A

Now, let's talk about service smash Federation? Why do we need a service match federation? Imagine you have woken loads running from different matches. How these workloads can talk to each other, so the.

A

Main point of smash Federation's provide interoperability between two different matches and the message came from come from different organizations from different departments in the same organizations or you may have one match on cran another match on public cloud or you have one match: that's purely for Kira Nerys workloads, another man. She is for VM workloads and service and match. Federation allows you to make these workloads talk to each other.

A

The manage challenges on service met, identity, Federation service discovery, Federation and also absorb ility Federation. For this presentation we are about to focus on identity, Federation and the two fundamental challenges. First, we need to build a trust between matches like when you receive requests from another match how to adjust to identities. So I can apply a pro appropriate policy to give it the right privileges allow this identity to access your service and second, challenge identity. Isolations I, don't want the other match to issue the same identity as I didn't hit my match.

A

Otherwise, he can easily like initiate impersonation attack now I'm gonna hand off the Oliver to talk about how we are going to deal with this, which have challenges right.

B

Thank you and Joan in the following slides I'm, going to talk about the technical details and various approaches that we recommend for their services service Federation's, going back to the question of what is a service, mesh and trust domain right in terms of security in the currency, currently steel, the applications in a service match. They share the common roots of trust and they are within the same trust domain. A trust Omen could represent an individual organization, environment or department under their own independent CBP infrastructure.

B

The trust domain is encoded in their East eo8 annotates, which is compliant with a spiffy standard in the following format. The spiffy colon, slash, slash, trust domain and slash namespace slash their service account, so indeed slides. We are talking about their identity Federation, specifically so in terms of the Federation of the mesh aids for the applications in two different service meshes to authenticate each other. We need to verify each other's duplicates using their own trust routes. So, for example, in this following, it is following graph.

B

We have service mesh one which is with their trust, domain phu, kham and service mesh. Two with the trust domain marcom, for example, if you want a service in service mesh, one to authenticate a service in service mesh to you, need to have this service, be able to authenticate the certificate presented by the other and using its own root of trust.

B

So how do we do it in terms of the scenarios? We first talked about this in their Federation within an organization.

B

If you have one organization that is using a common root CA as just showing in this picture, and then you will have like multiple trust domains, each of the trust- oh man, we'll have an intermediate CA, those intermediate CAS are using their certificates. You should buy the root CA.

B

Each of the intermediate Xia is responsible for issuing certificates for the services that are running in their own mash. So in this case, CA Y is eating certificate for service. A and C a2 is issuing certificate for service B. Both service, a and service B, are trusting in the route c8 certificate.

B

So through this complete certification chain, they can easily authenticate to each other right. Beyond that, our recommendation is intermediacy. A name constraints can be helpful for isolating the trust domains. For example, if you apply the name constraint for intermediacy a1 to only issuing certificate for team, one dot, phu kham, if this one is compromised it, for example, it you should dedicate for team 2, which is belongs. Learning to this part service B. We are very fighters named constraint and decline. This connection.

B

Okay, then we talk about Federation across the organization's. In this scenario, usually we'll have one root CA for each different trust domain. In this case, the left side is trust on me. Lucam. The right side is trust them in Perham.

B

The root CA is signing certificate for their services running in their own, so mesh, and you can see the service. The services are trusting their own root, CA certificates, talking about their service and Federation, their mash Federation. Some of the you might think about. Okay, we might be able to cross sy the root certificates so that we can build up a different certification chain to enable their mutual trust, so how this works?

B

This root, CA one signs, the certificate signs, they're public key root, CA two to generate a new certificate intermediate certificate, because this for root CA to the public key are represented by two certificates.

B

In this case, you are able to build a new certification chain from service B to this intermediate certificate to roots a1 and then for the service a to authenticate service, be it will use this new certification chain to verify service beads certificate using its own root CA certificate.

B

The drawback of this approach is high complexity. This cross signing is hard to automate and if you have, for example, an service message, you want to fail rate. There are n square cross signings for the entrace domains.

B

So what we recommend is this one CB feet respond, oh how it works, so the core advantages of the CBC trust bundle, its first automation of the root of trust exchange and, second, the authentication can use the Roosters corresponding to the peers trust domain.

B

In this graph we are showing the the it's the same, loosely a signing certificate for service. A you see a two significant first service too. But beyond that you will notice in the red box. There's our trust for food. Comm only use this red certificate, which means the root CA one certificate to verify it and bar.com. You should only use their roots, they tooth certificate to verify it.

B

How this entire thing works, be patient I will talk about it in the following slides, ok, so first let me spend one minute to talk about the CBP transponder. The CBP transponder is an RFC 75 y7 compliant GW case that continuing are trans domains, cryptographic keys for the validation of the certificates issued in that trust domain. If some of you are familiar with their tina bouquet as standard, you will figure out how this works, but here I'm going to give you an example.

B

This is an example of the TW KS.

B

Further trans bundle, you will have kids representing the certificates for this trust domain. It's an array, so that means you may have multiple kids, that you can use to verify the certificates in that trust domain. The youth part it's required for CPC standard to be x.509 as the ID as the ID means a spiffy, verifiable identity document.

B

The x5c this part is critical. It carries the base64 encoded dur of there expel the night certificate that you use to verify the certificates for that trans domain and one more interesting field. Is this one beefy refresh hint, which means this bundle will be valid for 10 minutes 600 seconds right, the key type and those four fields are redundant here. They are more useful for dot type trust bundles. So one thing to note here is the CBP.

B

Trust bundle not only serves for their x.509 certificate, but it also serves for setting up the trust for tokens. So in that case you won't have their ex levels see. You will use this one to verify their to obtain the public key. We put it here because this is a mandatory field for dirty wks standard.

B

The Federation, with the VV transponder, going a little bit into the technical details for a trust, bundle, there's a publishing site and there's a consuming side right. The publishing side needs to expose HTTP and point encrypted through the TLS certificate based on web PKI or the specie standard.

B

The consuming part e still at me is to configure a mapping from the trans domain to the end point and then, when II still gas that mapping it authenticates the end point and retrieves the bundle from it and then it will build up message, including the straddle trust domain and bundle to oppose and propagate them to their workloads, and the workloads can use it in the certificate. Verification to give you more vivid, explained. Explanation of this flow I taught this down into their pictures.

B

This is an example. On the left side you will have Citadel, so there is their CA in east eel on the right side. It's the spire server, which is the CA in CB v standard implemented by their sky trail company. Suppose you want to feather it in the left side with the right side and for this to work. You will have a transponder management module running in Seville and spire server. This module is in charge of both publishing their trust, bundle and point and also consuming the transponder from their other end points.

B

In this example, you see their CEO is exposing and point which is a HTTP endpoint one and the other side is HTTP endpoint to the east. Eo admin configures their consumer side to obtain, for example, the food comm certificate, it's a local.

B

So that means you don't need to go to and the point to look at that it's used locally, but for part of calm, which is this domain, it points to the endpoint to which is this guy right and on the other side, it's the same similar thing and after you configure all those they are up and running.

B

They're, just bundle management module start to retrieve the transponders this year that out the serial part which waved their distributes its trust bundle containing its own root certificate to the spire server. Vassar also distributes his transponder to Citadel.

B

After that, the serial side will create a trust, mundo message: mapping from phu kham with its own routes. The packet and bar comm, with the certificate from the sparrow server side and propagated it to service a and, on the other side, the same now service a will have the trust, bundle and service. B will have a very similar transponder on each side service. A can use bar comm mapped root certificate, which is the green one to authenticate service, B and service B will use the red certificate.

B

Mapped from foo.com to authenticate serves a so that's basically about this flow about the isolation, identity. Isolation right supports in a scenario the spiral server is compromised. So what will happen if the service server, the spire server, is issuing a certificate for, for example, food comm? What will happen is the source? A will gather service, beats defecate and exam its trust domain, and it will figure out. Oh it's from food calm which is wrong right and then it will use the trust. Don't trust bundle, see the trans bundle and see Oh food Oh calm.

B

We should use this red certificate to verify, and then it will try to use this guy. This is on root certificate and it will figure out. Oh it's wrong. It's actually not working, it's not signed by this guy. Then this handshake will fail. So that's how their identity isolation works in there, either in their service. Federation.

B

Sorry, their match, duration scenario. Okay, so I think that's it.

B

Have any questions.

C

B

Use the microphone, otherwise they can't harm and.

C

You're gonna need an email, even your amulet I use yours any minute. You don't even oh. That's.

B

A good question, so his question is: there's a 600 seconds. Expericence, further trust, bundle and I didn't show in this picture. So basically go back this one. This retrieving transponders, it's periodic every you should have have it in. In that case, it's a 600 seconds and you retrieve this new transponder and compare it with the transponder that you cashed. If it's any difference, you will propagate new transponders to their workloads.

C

C

B

So the question is for this encoding: what's there how its work, how its encoded right yeah, so that fellow cx-5 see certificate it's encoded in base64, so it's not using a public key, but this one. This public key is the same with there's the public key in the certificate it's kind of redundant here, just because this is required by their twk as standard. We have to put something there, but beyond that, if you have x.509 dot suppose their transponder is for chart, you won't have this field, and in that case this will will be meaningful.

C

Chairman that you don't have any champion looking into is fanciful but hanging I didn't Pocoyo yeah much ahora negative.

B

That's right, yeah, this is a elliptic whole curve, encoding and algorithm. Sorry and XY are there are coordinates and you can use this to get the public key.

C

How you gonna get a bastard, an institution is to build what or what I not seen critici-- machine magazine. So what kind of yes.

B

That's right, one, you Lamia yeah yeah yeah! You can change this to a larger number. That's no problem! Yeah yeah sure practically! This is very short. You you don't want it to be destroyed. Any.

D

Other question.

E

A

A follow-up question for the Refresh seconds. So what happened for the existing connections when I get refreshed? That's.

B

A good question, so if this refresh second, if this is smart and it's changed right there, TLS handshake will detect, will verify the certificates only at the beginning of the connection, and currently we don't have a renegotiation mechanism implemented in my by default in you steal. So if you created the connection before this changes, it will still work be working unless you disconnect and then you try to redo the handshake, and if this is changed and it's not valid anymore, you will fail.

E

How do you think about a thicker food connection of to be and I am and it's creating sorry.

B

E

You repeat your.

B

E

A

It's mostly about authorization right and your question is once we have this beef identity. How do we leverage I am to enforce the policy apply.

E

Access control in.

A

The other case is orthogonal to Federation and the key is you want to understand. Who is calling you which identity is being used, and then you can apply policy to that identity? The things that is specific to mesh Federation is that when identity come from another idea, another mesh, they trust domain in which you can use to identify which I don't which matches are in the come from so in the know, I am policy.

A

You can set it up properly like for identity within your mesh, you can know price design policies, but identity from different mashup lighters separately. The answer question no.

E

F

F

Just wondered how easy this is to use today. How do I turn that on? Is it like command-line arguments to Citadel, or is there a yama resource or a like helm, values file for this? So.

B

You are talking about how easy it hits yours right, yeah.

F

So I already have like three kubernetes clusters: each with a service mouse that it's federated using the new 1.1 features right and they currently they just share a root. Ca cert I I want to move to this. It looks better, but how much work is that I.

B

Think you are talking about this feathery teens through their spiffy transponders right.

F

Yeah yeah sorry I hear to configure each Citadel with all the em I have to turn on my local endpoint to publish and I have to configure with the map of all the remote end. Points like right do I have to go hacking around in the Citadel pod today or is there a nice yeah mall like.

B

This is a working progress. Okay, first of all, yes,.

D

B

In their final stage, it will be very easy. Okay, what you need to do is configure this endpoint and the trust trust fund on config is basically Yama file or.

F

That there is a llamo, yes, yes, 1.2! What do I have to wait.

B

It's a good question is still working in progress. We are trying to make it happen, yeah very good yeah. What.

F

Is what is the trust the main string come from because, like communities classes, don't have a first class name, I've? Actually don't yeah.

B

It's set to today, so this trust dome in part. It's configured now it's configurable. Okay, still right. Yes, it's not correlated to their gke clusters; yeah, it's totally a sto concept. Okay,.

C

B

Cool: it's not a community concept, yet.

F

No I show right.

B

Yeah, but you could maybe in the future like or you customize it to good.

F

If I don't say, yeah yeah, like string because I can't think what you defaulted to. Otherwise the.

B

Default one is the cluster dot local other. You right know you configure it so.

F

I need to override it if I want to fit it right, yes, override it. Okay, yeah thanks.

D

And has a question.

B

All right, thank you guys, all right. Thank you.