Istio IstioCon 2021, 10 Mar 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Automate mTLS communication with GoPay partners with Istio

Description

#IstioCon2021

Presented at IstioCon 2021 by Zufar Dhiyaulhaq & Vijay Dhama.

One of our main goals in GoPay is to automate mutual TLS communication between GoPay and our partner. We will share how we decide to use and manage Istio, change the configuration to suit our mTLS use cases, how we adapt Istio changes related to mutual TLS, and how our central certificate is managed, and how to set up automatic mutual TLS communication with Istio Egress TLS origination and Istio Gateway.

A

Hello welcome everyone. uh My name is vichy tama, I'm with my colleague, sufa ghilhar. Today we're going to talk about how, in copay we automate mdls communication with our gopi partners using its theo.

A

We both are working as a sres in payments arm of project uh called copay. As a brief introduction go check is a super app uh which basically provides, which is basically a tech platform that provides access to wide range of services like transport, payments, for delivery, logistics, etc.

A

Copay is basically the digital payment power provider for under go check in southeast asia. We you operate out of indonesia with thailand and singapore um in our ancient art. Today we're going to talk about gopay and istio role and basically setting up mdls.

A

Secondly, we're going to talk about how we, um how the world look like before virtual mtrs, I'm also going to talk about how we implemented our mutual dls setup uh in increased eps, etc, and we're also going to talk about challenges that we faced and the future work. We expect to do after this uh now we're going to start with the gopi and istio.

B

So in gopay we have a multiple kubernetes cluster, uh more than 250 micro services, 3 000 deployment every week and 150 million api calls also. We have both res and grpc services and we have also service written in golan java, clojure and ruby.

B

uh Basically, gopay has been using grpc since 2016, and we decided to use enfoy and console before uh to migrate uh fertile surface to container, because it have ability to load balance traffic between the vm and container itself over time. uh Managing enfi and console become uh a slightly burdened because we need to maintain all of the configuration uh for to uh for all the microservices that we have.

B

We choose steel as our service mess, because we are using enfoy before we have an experience in the envoy and it's easy to migrate and adopt the existing info filter using steel. So we will talk about our previous setup in steel.

A

Before mutual tls, in the setup that we had with our groupie partners, was either use vpn or use basically https with uh allow listing. Basically, what we did was uh have basically stored, netgate ips from the uh from the our gopa partner and then allow only those ips to connect to our and https endpoints. This restricted and this improves the security of our endpoints, and we knew who we were allowing to connect to, and the issue with this approach is that you need a lot of maintenance effort in terms of uh managing those endpoints.

A

So in case, if the net ips of our group departments change, we need to update those endpoints and vice versa. If we need to do the same thing for our group departments, um this also is not a preferred approach uh suggested from our security team, so this is when we decided that we want to move away from this and move to mtls, uh which is what our security team suggests.

A

This also uh allows for internal attacks uh if the ips can be changed, and that is not what we wanted um so now we will move on to implementing mutual dls. uh The first step was, uh we wanted. uh uh We have the service questions, provide certificate management service that is responsible for maintaining our mdls certificates, uh renewing those certificates and updating those certificates back into our basically services.

A

So the certificate management service is responsible for creating those mta certificates and store those in secrets, so that services can read those secrets and basically mount those certificates onto the service.

A

This makes it easier and makes the process hollow hollow. Automated, basically end to end, so we don't have to deal with secrets anymore and shortly even short-lived certificates can be renewed and updated.

A

um Moving on uh next, uh we will talk about and jump on to english mtls.

B

Okay, so uh our mutual or mutual setup in istio, it's divided into two parts. The first is ingress and address traffic so for invest. Traffic to our cluster, basically is external client calling our services using mutual telus.

B

We use gateway mechanism with mod mutual. Also, we leverage subject alter alternative name in the gateway, manifest to verify the client side. In case we are using public certificate and we also can have additional ipl listing if necessary, in this setup for address traffic. We are using address cell as origination concept from istio, so the client in this case only need to talk with http protocol and the istiocar will automatically upgrade the connection. The http connection to mutual telus traffic add the certificate automatically.

B

This is the sidecar and we have mutual tales connection working the certificate in this case is mount in the sidecar, with annotation from stu, so only specific deployment can talk to the server itself.

B

Also, we will discuss about the challenge and feature work for this use case.

B

We counter a problem when sometimes we get 503 error in address communication, so we try to debug this and we fix this by adding retrieve mechanism in the filter. Service object itself.

B

Also in the future work uh we plan to be getting the address style as origination mechanism uh to use address gateway, because we do not need to mount the certificate directly into the sector and just let the advanced gateway handle the certificate itself.

B

We cannot do this before because we are using steel 1.6 currently and the address gateway is not super support, adding certificate via via sds and yeah. Okay. uh Thank you. Everyone, please ask questions in the slack channel and give us some feedback and thank you for following our.

B