SPIRE SDS integration documentation #11057

alexandrealvino · 2022-03-15T20:47:25Z

Please provide a description for what this PR is for.

This PR adds documentation for the SPIRE SDS integration #37947

It depends on #37948

Co-authored-by: Maximiliano Churichi <mchurichi@gmail.com> Co-authored-by: Max Lambrecht <max.lambrecht@hpe.com> Co-authored-by: Juliano Fantozzi <juliano.fantozzi@gmail.com> Co-authored-by: sanderson042 <steve.anderson@hpe.com> * Apply PR feedbacks * Apply PR feedbacks, adds commands and bash outputs

Co-authored-by: Maximiliano Churichi <mchurichi@gmail.com> Co-authored-by: Max Lambrecht <max.lambrecht@hpe.com> Co-authored-by: Juliano Fantozzi <juliano.fantozzi@gmail.com> Co-authored-by: Steve Anderson <steve.anderson@hpe.com>

Co-authored-by: Maximiliano Churichi <mchurichi@gmail.com>

Adds Spire Integration Documentation

istio-policy-bot · 2022-03-15T20:47:28Z

😊 Welcome! This is either your first contribution to the Istio documentation repo, or
it's been awhile since you've been here. A few things you should know:

You can learn about how we write and maintain documentation, about our style guidelines,
and about all the available web site features by visiting Contributing to the Docs.
In the next few minutes, an automatic preview of your change will be
built as a full copy of the istio.io website. You can find this preview by clicking on
the Details link next to the deploy/netlify entry in the Status section of this
page.
We care about quality, so we've put in place a number of checks to ensure our documentation
is top notch. We do spell checking, we sanitize the markdown, we ensure all hyperlinks point
to valid location, and more. If your PR doesn't pass one of these checks, you'll see a red X in the
status section of the page. Click on the Details link to get a list of the problems with your PR.
Fix those problems and push an update to your PR. This will automatically rerun the tests and
hopefully this time everything will be perfect.
Once your changes are accepted and merged into the repository, they will initially show up
on https://preliminary.istio.io. The changes will be published to https://istio.io
the next time we do a major release (which typically happens every 3 months or so).

Thanks for contributing!

Courtesy of your friendly welcome wagon.

google-cla · 2022-03-15T20:47:31Z

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

For more information, open the CLA check for this pull request.

istio-testing · 2022-03-15T20:47:40Z

Hi @alexandrealvino. Thanks for your PR.

I'm waiting for a istio member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

craigbox · 2022-03-15T21:41:08Z

/ok-to-test

Excited to see this integration! Are you working with a maintainer to shepherd it through?

alexandrealvino · 2022-03-16T15:06:47Z

/ok-to-test

Excited to see this integration! Are you working with a maintainer to shepherd it through?

Yes, @howardjohn @linsun @lei-tang are aware of the integration

content/en/docs/ops/integrations/spire/index.md

hobbytp · 2022-03-17T02:05:41Z

content/en/docs/ops/integrations/spire/index.md

+        app: sleep
+      # Injects custom sidecar template
+      annotations:
+        inject.istio.io/templates: "sidecar,spire"


why spire enable or not is aware by every pod/deployment through the annotation? Is there a global flag for it ?

The annotation applies the custom spire template created on the configuration of the Install Istio section:

templates: spire: | spec: containers: - name: istio-proxy volumeMounts: - name: workload-socket mountPath: /run/secrets/workload-spiffe-uds readOnly: true volumes: - name: workload-socket csi: driver: "csi.spiffe.io"

The custom template feature facilitates the injection of the spiffe-csi-driver volume into workload pods.

But one can always do it manually by adding the volume to the workload spec:

volumes: - name: tmp emptyDir: {} # CSI volume - name: workload-socket csi: driver: "csi.spiffe.io"

ericvn

#11069 has changes for the two issues here as well as indention within the text blocks.

content/en/docs/ops/integrations/spire/index.md

…ding

ericvn · 2022-03-18T14:44:29Z

content/en/docs/ops/integrations/spire/index.md

+---
+title: SPIRE
+description: Describes how to configure Istio to integrate with SPIRE to get cryptographic identities through Envoy's SDS API.
+weight: 40


I'm fine leaving this last in the list, but it seems we currently have the weights having the integrations in alphabetical order. Since they are all separated by one, it's hard to add one into the list. We could change them all to be operated by 5 and add this into the mix.

I've added 1 to the zipkin page and updated SPIRE page to be 31, is it ok?

content/en/docs/ops/integrations/spire/index.md

alexandrealvino · 2022-03-20T23:33:53Z

/retest

linsun · 2022-03-25T02:46:04Z

content/en/docs/ops/integrations/spire/index.md

+This integration with SPIRE provides flexible attestation options not available with the default Istio identity management while harnessing Istio's powerful service management.
+For example, SPIRE's plugin architecture enables diverse workload attestation options beyond the Kubernetes namespace and service account attestation offered by Istio.
+SPIRE's node attestation extends attestation to the physical or virtual hardware on which workloads run.
+


Let us make sure we add a warning that Istio 1.14 is required, assuming this feature lands in 1.14.

I am not sure I agree? This is the docs for Istio 1.14 - it should be assumed everything needs 1.14?

On the Istall Istio section, the doc recommends the latest version of Istio. Should I recommend 1.14+ then?

Thinking more about it, i think it would be useful to note both data plane and control plane are required to be 1.14. (Is this correct?)

Also would be useful to clarify if this only works with NEW istio 1.14 vs upgrading to Istio 1.14 @alexandrealvino

Hi @linsun, only the data plane and istioctl are required to be 1.14. I will clarify that on the docs.

That sounds great, thanks @alexandrealvino !

linsun · 2022-03-25T13:53:51Z

Hi @alexandrealvino nice doc! Any plan to cover migration as well? migrating from existing CA (either istiod) or an external CA to SPIRE? Or is this only for new install?

alexandrealvino · 2022-03-28T21:02:18Z

Hi @alexandrealvino nice doc! Any plan to cover migration as well? migrating from existing CA (either istiod) or an external CA to SPIRE? Or is this only for new install?

Hi @linsun, this is only for new installations. The code changes covers only the startup process of istio-agent, the are not recurrent checks for the detection of the SPIRE Agent instance.

christian-posta · 2022-04-07T18:14:14Z

I wrote this on istio/istio#37948, but it probably should be in this issue instead: "I think this "quickstart" install of the spire server also includes the k8s-workload-registrar for auto-registration... we should add that to the doc somewhere and possibly indicate manual registration wouldn't be necessary here"

alexandrealvino · 2022-04-07T19:11:01Z

I wrote this on istio/istio#37948, but it probably should be in this issue instead: "I think this "quickstart" install of the spire server also includes the k8s-workload-registrar for auto-registration... we should add that to the doc somewhere and possibly indicate manual registration wouldn't be necessary here"

Hi @christian-posta, I've pointed this out on this section from Option 1: Quick start "and the SPIRE Kubernetes Workload Registrar, a facilitator that performs automatic workload registration within Kubernetes. See Install Istio to configure Istio and integrate with the SPIFFE CSI Driver."

christian-posta · 2022-04-07T21:01:52Z

Ah, i see it now. I missed it. Can you also add under "Option 1: Automatic registration using the SPIRE workload registrar" that we do indeed set it up in this guide?

alexandrealvino · 2022-04-18T14:00:38Z

Ah, i see it now. I missed it. Can you also add under "Option 1: Automatic registration using the SPIRE workload registrar" that we do indeed set it up in this guide?

Sorry about the delay @christian-posta, missed the notification. Do you mean add a sentence explaining that it won't be necessary to add registrations manually on the "Option 1: Automatic registration using the SPIRE workload registrar" section?

christian-posta · 2022-04-18T21:33:01Z

Yeah, basically that since it's already being used... that we don't have to follow that Option it's already assumed in the guide... otherwise it seems optional (which it is -- but it actually is done in this doc) and that people should continue on to do it manually... which they don't need to do

alexandrealvino · 2022-04-18T21:59:32Z

Yeah, basically that since it's already being used... that we don't have to follow that Option it's already assumed in the guide... otherwise it seems optional (which it is -- but it actually is done in this doc) and that people should continue on to do it manually... which they don't need to do

Got it! I will add some comments clarifying that on "Option 2: Manual Registration" and "Option 1: Automatic registration using the SPIRE workload registrar" sections. Now I see the confusion, thanks for your suggestion @christian-posta

ericvn · 2022-05-02T20:02:20Z

@christian-posta Thoughts on is this is ready to merge?

christian-posta · 2022-05-03T15:45:19Z

yes @ericvn LGTM

ericvn

Some possible minor changes.

content/en/docs/ops/integrations/spire/index.md

alexandrealvino · 2022-05-05T17:43:08Z

Just to emphasize that this PR depends on #37948

alexandrealvino · 2022-05-05T18:33:16Z

/retest

ericvn · 2022-05-05T18:52:26Z

LGTM. Once Christian responds in the sample PR, I think they can both merge.

content/en/docs/ops/integrations/spire/index.md

lei-tang · 2022-05-15T17:54:32Z

@istio/wg-docs-maintainers-english Can you approve and merge this PR? #11264 depends on this PR for the link /docs/ops/integrations/spire/. So this PR needs to be merged first before #11264.

ericvn

Samples are now merged.

hobbytp · 2022-06-05T08:18:58Z

content/en/docs/ops/integrations/spire/index.md

+                - name: istio-proxy
+                  volumeMounts:
+                  - name: workload-socket
+                    mountPath: /run/secrets/workload-spiffe-uds


@alexandrealvino @maxlambrecht Why it is /run/secrets/xxx instead of /var/run/secrets/xxx? Why remove the /var prefix? I know this /run/secrets/xxxx is aligned with spire-agent configmap configuration, but istio-agent only check /var/run/secrets/workload-spiffe-uds/socket as following shows, or I missed anything?

WorkloadIdentitySocketPath = "./var/run/secrets/workload-spiffe-uds/socket" ... socketExists, err := checkSocket(ctx, security.WorkloadIdentitySocketPath) if err != nil { return nil, fmt.Errorf("failed to check SDS socket: %v", err) } if socketExists { log.Info("SDS socket found. Istio SDS Server won't be started") } else { log.Info("SDS socket not found. Starting Istio SDS Server") err = a.initSdsServer() if err != nil { return nil, fmt.Errorf("failed to start SDS server: %v", err) } }

/var/run is a symlink to /run

ok, thanks for clarification.

hobbytp · 2022-06-05T09:20:11Z

content/en/docs/ops/integrations/spire/index.md

+$ kubectl exec -i -t $SPIRE_SERVER_POD -n spire -c spire-server -- /bin/sh -c "bin/spire-server entry show -socketPath /run/spire/sockets/server.sock"
+Found 3 entries
+Entry ID         : c8dfccdc-9762-4762-80d3-5434e5388ae7
+SPIFFE ID        : spiffe://example.org/ns/istio-system/sa/istio-ingressgateway-service-account


@alexandrealvino How about the TLS communication between istiod and istio-proxy? which kind of certification is used here?

The TLS communication between istiod and istio-agent uses a certificate generated by istiod itself, as per default behavior. That communication wasn't changed at all.

The TLS communication between istiod and istio-agent uses a certificate generated by istiod itself, as per default behavior. That communication wasn't changed at all.

Thanks, in fact, my question is why not integrate istiod to SPIRE also. It will look more complete. Or will it be the next step or anything block this?

It's the next step.

alexandrealvino and others added 8 commits March 15, 2022 15:12

Adds Spire integration documentation

158315a

* Adds httpbin workload

9e4b938

Co-authored-by: Maximiliano Churichi <mchurichi@gmail.com> Co-authored-by: Max Lambrecht <max.lambrecht@hpe.com> Co-authored-by: Juliano Fantozzi <juliano.fantozzi@gmail.com> Co-authored-by: Steve Anderson <steve.anderson@hpe.com>

Update content/en/docs/ops/integrations/spire/index.md

61171b2

Co-authored-by: Maximiliano Churichi <mchurichi@gmail.com>

Apply pr feedbacks

646300e

Fixs end of line paragraphs

9511742

Fix typo

edc2c28

Merge pull request #1 from alexandrealvino/spire-doc

39468dd

Adds Spire Integration Documentation

alexandrealvino requested a review from a team as a code owner March 15, 2022 20:47

istio-policy-bot added the kind/docs label Mar 15, 2022

istio-testing added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. needs-ok-to-test labels Mar 15, 2022

istio-testing added ok-to-test Set this label allow normal testing to take place for a PR not submitted by an Istio org member. and removed needs-ok-to-test labels Mar 15, 2022

howardjohn reviewed Mar 16, 2022

View reviewed changes

content/en/docs/ops/integrations/spire/index.md Outdated Show resolved Hide resolved

alexandrealvino added 2 commits March 16, 2022 13:23

Adress linting issues

b2e179e

Updates title and fix identation of code blocks

5cf436f

hobbytp reviewed Mar 17, 2022

View reviewed changes

ericvn reviewed Mar 17, 2022

View reviewed changes

content/en/docs/ops/integrations/spire/index.md Outdated Show resolved Hide resolved

Fix lint issues, remove unnecessary formating and improve command rea…

931bb39

…ding

ericvn mentioned this pull request Mar 18, 2022

Test PR to check linting #11069

Closed

10 tasks

ericvn reviewed Mar 18, 2022

View reviewed changes

Fix typos and page weights

385340d

linsun reviewed Mar 25, 2022

View reviewed changes

Adds required version clarifications

ddfe8f9

jufantozzi mentioned this pull request Apr 8, 2022

Adds example under /samples for envoy SDS integration istio/istio#37948

Merged

Adds clarifying comments

969b006

ericvn mentioned this pull request May 3, 2022

Istio 1.14 release announcement, change-notes, and upgrade-notes #11264

Merged

9 tasks

ericvn reviewed May 5, 2022

View reviewed changes

Applys minor changes

e325884

jufantozzi reviewed May 6, 2022

View reviewed changes

content/en/docs/ops/integrations/spire/index.md Outdated Show resolved Hide resolved

Corrects typo

6c0200b

lei-tang approved these changes May 15, 2022

View reviewed changes

ericvn approved these changes May 16, 2022

View reviewed changes

istio-testing merged commit 587e85a into istio:master May 16, 2022

hobbytp reviewed Jun 5, 2022

View reviewed changes

SPIRE SDS integration documentation #11057

SPIRE SDS integration documentation #11057

Uh oh!

Conversation

alexandrealvino commented Mar 15, 2022

Uh oh!

istio-policy-bot commented Mar 15, 2022

Uh oh!

google-cla bot commented Mar 15, 2022

Uh oh!

istio-testing commented Mar 15, 2022

Uh oh!

craigbox commented Mar 15, 2022

Uh oh!

alexandrealvino commented Mar 16, 2022

Uh oh!

Uh oh!

hobbytp Mar 17, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ericvn left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

alexandrealvino commented Mar 20, 2022

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

linsun Apr 4, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

linsun commented Mar 25, 2022

Uh oh!

alexandrealvino commented Mar 28, 2022

Uh oh!

christian-posta commented Apr 7, 2022

Uh oh!

alexandrealvino commented Apr 7, 2022

Uh oh!

christian-posta commented Apr 7, 2022

Uh oh!

alexandrealvino commented Apr 18, 2022

Uh oh!

christian-posta commented Apr 18, 2022

Uh oh!

alexandrealvino commented Apr 18, 2022

Uh oh!

ericvn commented May 2, 2022

Uh oh!

christian-posta commented May 3, 2022

Uh oh!

ericvn left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

hobbytp Mar 17, 2022 •

edited

Loading

linsun Apr 4, 2022 •

edited

Loading

hobbytp Jun 5, 2022 •

edited

Loading