solo.io Open Source Demos, 29 Jul 2022

Previous Meeting

⏯

youtube image

►

From YouTube: Could network cache-based identity be mistaken?

Description

A few days ago, I published the Exploring Cilium Layer 7 Capabilities Compared to Istio blog where I mentioned network cache-based identity may fail when a pod dies, a new pod is created and gets the IP of the old pod but has a different identity. Thank you everyone for sending me feedback about the blog! In this video, I would like to demonstrate how identity could be mistaken for network cache-based identity.

Blog: https://www.solo.io/blog/could-network-cache-based-identity-be-mistaken/

A

Hey guys leah here today, I would like to show you how network cash-based identity could be mistaken. Let's get started.

A

I'm standing up for kubernetes kind cluster on my virtual machine with three worker vm priscillium's documentation, I disabled the default cli so that I could use cilium now, I'm using home to install ceiling, 112. notice them enables encryption with wild guide.

A

Opening up k9s to see my ceiling parts, it's coming up.

A

Let's review our application, we have sleep and hello world. Both have two versions: sleep version, one can call hollow version, one sleep version, 2 can call hollow version 2 and nothing else should be allowed per silliness network policy. We're going to install now that we have cylinder mostly running. Let's go ahead, deploy our applications.

A

Now we're going to deploy our psyllium network policy for version one. As you can see, we only allow sleep version. One service account to talk to hello world version one now: let's deploy cilia network policy for version 2..

A

Similarly, only sleep version 2 is allowed to talk to hollow version. 2.

A

Now that we have our parts mostly coming up notice, we have 15 replicas of version, one and one replica of version. Two all right looks like everything is up, including psyllium and our application. Let's go back to the other terminal to do some tests right. We want to see if the network policy is working right. Only the version, 1, client and server can talk. Only the version, 2, client and server can talk and nothing else. It works perfect.

A

That's great! Now we're going to figure out the node where hello, world version 1 is running and dump the ceiling ipcache for that node. As you can see, it's key value of ip address mapped to its identity and encryption information. I would guess 13174 is the sleep version one's identity? Let's see if I'm right, all right looks like it is right. uh Cylinder has endpoints which we can determine from endpoints to get the identity, and you can see the security label is sleep version one for this particular identity, one one, three one, seven four.

A

Now we're going to trigger a arrow scenario, because we don't live in a perfect world right. What if cilium pod, could not communicate to the api server? What if the ceiling part crashed so before we run our script, let's review it. The first thing we're going to do is capture the sleep version. Once I p address should be 15 of them.

A

Then we're going to try to scale sleep version, 1 down to 0 and scale up sleep version 2 to 15., and then we're trying to find sleep version 2 pod that happens to have the same ip address as one of the sleep version one part, and then we declare the winner, if not we'll, keep rolling, restart sleep version 2 until that's condition met once we declare our winner we're going to try to cur to form that part to hollywood version 1 and then we're going to also dump the psyllium ipcache on the from the celium agent.

A

So let's run the test script.

A

Check out how the pod is coming up and down, so you can see sleep version. Two. A lot of them are scaled up and there's no sleep version one. So you you can see. Parts are rapidly coming up and coming down because we're constantly checking on the conditions to see if there's any matching ip address from one of the prior ones. Oh looks like we already have a window all right, so this particular sleep version. 2 pod was able to call hollow wood version 1, even though the network policy says it should not be allowed.

A

So, let's check out the identity 13174. That sounds familiar remember. So, let's take a look of that sleep version version two parts identity.

A

So if you look at this identity, you can see it actually have sleep version, one's identity because it has this ip address that was used by one of the sleep version, one part, so, let's double check, dash or white uh double check the ip address, which is 2.65, let's search and making sure. Yes, that is the sleep version too.

A

So, let's recap what you have seen sleep version. 2 was assigned an ip address from one of the previous sleep version, one part, so that it was also mistakenly assigned the identity of sleep version one.

A

Even though we have network policy in place that says only the version, one of sleep is allowed to talk hollow version, one because sleep version two part has the wrong identity assigned. It was still able to call hollow version. One. Thank you so much for watching and please subscribe our channel for future educations uh istio envoy, sir liam and all other topics bye now.