Add a user guide for Istio Vault CA integration by lei-tang · Pull Request #3098 · istio/istio.io

lei-tang · 2019-01-16T20:53:40Z

Add a user guide for Istio Vault CA integration.
This PR is for the issues:

It depends on istio/istio#11024.

geeknoid · 2019-01-16T20:54:12Z

Deploy preview for preliminary-istio failed.

Built with commit 1634eb3

https://app.netlify.com/sites/preliminary-istio/deploys/5c3f99d98a23e0000896ab19

lei-tang · 2019-01-16T20:54:32Z

/cc @myidpt

geeknoid · 2019-01-16T22:11:40Z

+## Install Istio with SDS enabled
+
+1.  Use `git clone` to download the latest Istio source code.
+As the time of writing, the latest Istio code is on the release-1.1 branch


Er, I'm not sure we need or want any of this GitHub gymnastic in customer documentation.

Documentation checked into the master branch of this repo will only be made available to customers when 1.1 is officially released. So I presume the customers won't need to do custom builds of anything in order to get the functionality, correct?

Correct. The GitHub gymnastic has been removed.

quanjielin · 2019-01-17T04:02:01Z

probably merge this PR into https://github.com/istio/istio.io/blob/master/content/docs/tasks/security/auth-sds/index.md#before-you-begin ? since the only difference will be which helm value file to applied(citadel config or vault config).

lei-tang · 2019-01-17T04:21:13Z

This PR and https://github.com/istio/istio.io/blob/master/content/docs/tasks/security/auth-sds/index.md#before-you-begin both have a step to run helm template command. Other than that, they are quite different. This PR provides a user guide for plugging in Vault CA and observing the certificate signing requests routed to Vault CA; none of these content is in the tasks/security/auth-sds/index.md#before-you-begin.

geeknoid · 2019-01-17T16:26:14Z

@@ -0,0 +1,148 @@
+---
+title: Istio Vault CA integration


integration -> Integration

geeknoid · 2019-01-17T16:27:25Z

+
+* Create a new Kubernetes cluster to run the example in this tutorial.
+
+* On GKE, you may set the value of the `CLUSTER`, `ZONE`, and `PROJECT`


Do we need per-platform instructions? It's not great to have an explicit callout to GKE in an otherwise generic doc page.

Removed the per-platform instructions.

geeknoid · 2019-01-17T16:29:08Z

+
+## Install Istio with SDS enabled
+
+1.  Use `git clone` to download the latest Istio source code.


Again, can we assume customers have access to the full 1.1 release bits and that they need/want our source code?

Revised to assume customers have access to the full 1.1 release bits. Removed downloading source code.

geeknoid · 2019-01-17T16:29:47Z

+
+1.  Install Istio with SDS enabled and Node Agent sending certificate signing
+requests to a testing Vault CA (this example uses the latest release on
+2019-01-15, you may also use other releases):


This doc should be relative to the final 1.1 release, not a specific nightly build.

Revised accordingly.

geeknoid · 2019-01-17T16:32:33Z

+the testing Vault server, so that Envoy will not intercept the traffic from
+Node Agent to Vault.
+
+The yaml file `install/kubernetes/helm/istio/values-istio-example-sds-vault.yaml`


Use {{< github_file >}}install/kubernetes/helm/istio/values-istio-example-sds-vault.yaml{{< /github_file >}} which will produce a link to the file in GitHub.

geeknoid · 2019-01-17T16:33:07Z

+## Deploy a testing workload
+
+This section deploys a testing workload `httpbin`. When the sidecar of the
+testing workload requests for a certificate through SDS, Node Agent will send


geeknoid · 2019-01-17T16:34:00Z

+testing workload requests for a certificate through SDS, Node Agent will send
+certificate signing requests to Vault.
+
+1.  Download the Istio install package


Again, we need to assume 1.1 is available and in use. Please look at how other pages handle this kind of step for an example.

Revised based on the comment.

geeknoid · 2019-01-17T16:35:40Z

+1.  Generate the deployment for an example `httpbin` backend:
+
+    {{< text bash >}}
+    $ bin/istioctl kube-inject -f samples/httpbin/httpbin.yaml > httpbin-injected.yaml


No "bin/"
Surround the input yaml path name with @@. This will result in a link to the file on GitHub.

Done, but "surround the input yaml path name with @@" does not result in a link when previewing the page through the localhost:1313 server (perhaps because it is in {{< text bash >}} block?)

The @@ syntax is specifically only supported in text blocks. Check out other pages for examples. But it should be:

$ istioctl kube-inject -f @samples/httpbin/httpbin.yaml@ > httpbin-injected.yaml

Fixed, thanks!

geeknoid · 2019-01-17T16:36:00Z

+    $ kubectl apply -f httpbin-injected.yaml
+    {{< /text >}}
+
+1.  List the pods of Node Agent:


List Node Agent's pods:

geeknoid · 2019-01-17T16:36:20Z

+    $ kubectl get pod -n istio-system -l app=nodeagent -o jsonpath={.items..metadata.name}
+    {{< /text >}}
+
+1.  View the logs of each Node Agent. The Node Agent residing on


View each Node Agent's logs.

geeknoid

Getting close :-)

geeknoid · 2019-01-17T22:34:25Z

+1.  Generate the deployment for an example `httpbin` backend:
+
+    {{< text bash >}}
+    $ istioctl kube-inject -f @@samples/httpbin/httpbin.yaml@@ > httpbin-injected.yaml


Sorry, my comment was ambiguous. Just a single @ on either end is what is needed, not two.

geeknoid · 2019-01-17T22:34:56Z

+    $ kubectl logs -n istio-system THE-POD-NAME-FROM-PREVIOUS-COMMAND
+    {{< /text >}}
+
+1.  Because in this example, Vault is not configured to accept the k8s JWT


Replace any uses of k8s with Kubernetes within the doc.

geeknoid · 2019-01-17T22:35:31Z

+
+1.  Because in this example, Vault is not configured to accept the k8s JWT
+service account from the `httpbin` workload, you should see that Vault rejects the
+signing requests with the following logs.


logs. -> logs:

geeknoid · 2019-01-18T02:47:21Z

/lgtm
/approve

istio-testing · 2019-01-18T02:47:28Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: geeknoid, lei-tang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~content/OWNERS~~ [geeknoid]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Add a user guide for Istio Vault CA integration

1634eb3

googlebot added the cla: yes label Jan 16, 2019

istio-testing requested review from frankbu and sdake January 16, 2019 20:53

istio-testing requested a review from myidpt January 16, 2019 20:54

lei-tang mentioned this pull request Jan 16, 2019

Add an example helm values yaml for Vault integration user guide istio/istio#11024

Merged

geeknoid reviewed Jan 16, 2019

View reviewed changes

lei-tang force-pushed the user_guide_vault_integration branch 3 times, most recently from 2343193 to 68908f7 Compare January 16, 2019 22:50

Fix lint errors

0ef8c23

lei-tang force-pushed the user_guide_vault_integration branch from 68908f7 to 0ef8c23 Compare January 16, 2019 22:53

Use helm template values to simplify the config

96c7cd7

lei-tang force-pushed the user_guide_vault_integration branch from d306888 to 96c7cd7 Compare January 17, 2019 02:33

geeknoid reviewed Jan 17, 2019

View reviewed changes

lei-tang added 2 commits January 17, 2019 11:30

Address review comments

59c840f

Fix the link in a command

25446cd

geeknoid reviewed Jan 17, 2019

View reviewed changes

Small fixes

3932a09

istio-testing assigned geeknoid Jan 18, 2019

istio-testing added the lgtm label Jan 18, 2019

istio-testing added the approved label Jan 18, 2019

istio-testing merged commit 8bf8d66 into istio:master Jan 18, 2019

aerotog mentioned this pull request Mar 12, 2019

User guide for Istio Vault integration istio/istio#10968

Closed


		* Create a new Kubernetes cluster to run the example in this tutorial.

		* On GKE, you may set the value of the `CLUSTER`, `ZONE`, and `PROJECT`


		## Install Istio with SDS enabled

		1. Use `git clone` to download the latest Istio source code.

Conversation

lei-tang commented Jan 16, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

geeknoid commented Jan 16, 2019

Uh oh!

lei-tang commented Jan 16, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

quanjielin commented Jan 17, 2019

Uh oh!

lei-tang commented Jan 17, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

geeknoid left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

geeknoid commented Jan 18, 2019

Uh oh!

istio-testing commented Jan 18, 2019

Uh oh!

Reviewers

lei-tang commented Jan 16, 2019 •

edited

Loading