Secure Istio Gateway and Services in Kubernetes

In today’s interconnected world, microservices have become the backbone of modern software development. However, ensuring the security of these microservices is paramount to safeguarding your applications and data. In this comprehensive guide, we’ll explore how you can enhance the security of your microservices architecture using Istio, a powerful service mesh platform.

Istio is an open-source service mesh platform designed to connect, manage, and secure microservices. A service mesh is a dedicated infrastructure layer that handles communication between microservices, providing a way to manage and secure the interactions between them. Learn how to enhance the security of your Istio Gateway with our comprehensive guide. Discover best practices, tips, and tools to fortify your network and protect your services from potential threats.

Before you begin.

1. First Create a Kubernetes cluster using specific cloud provider or in minikube.

2. Setup Istio by following the instructions in the Istio.

3. Deploy a sample hello world application through the yaml.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-world-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hello-world
  template:
    metadata:
      labels:
        app: hello-world
    spec:
      containers:
      - name: hello-world
        image: gcr.io/google-samples/hello-app:1.0
        ports:
        - containerPort: 8080

4. Expose the deployment with a Service.

apiVersion: v1
kind: Service
metadata:
  name: hello-world-service
spec:
  selector:
    app: hello-world
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8080
  type: ClusterIP

5. Generate server certificates and keys

Before we start we required a domain name

Lets assume that devstackops.com is my domain name. You have the option to choose according to your preference.

mkdir certs
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=devstackops.com Inc./CN=devstackops.com' -keyout certs/devstackops.com.key -out certs/devstackops.com.crt

6.Generate a client certificate and a private key for your required subdomain

In my case my subdomain is hello.devstackops.com. You have the option to choose according to your preference.

openssl req -out certs/hello.devstackops.com.csr -newkey rsa:2048 -nodes -keyout certs/hello.devstackops.com.key -subj "/CN=hello.devstackops.com/O=devstackops organization"

7. Verify client certificate with the server certificate

openssl x509 -req -sha256 -days 365 -CA certs/devstackops.com.crt -CAkey certs/devstackops.com.key -set_serial 0 -in certs/hello.devstackops.com.csr -out certs/hello.devstackops.com.crt

8. Create a secret for the ingress gateway

 kubectl create -n istio-system secret tls hello-credential \
  --key=certs/hello.devstackops.com.key \
  --cert=certs/hello.devstackops.com.crt

9. Configure the ingress gateway

kind: Gateway
metadata:
  name: hello-gateway
spec:
  selector:
    istio: ingressgateway # use istio default ingress gateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: hello-credential # must be the same as secret
    hosts:
    - hello.devstackops.com

10. Configure the virtual service for Istio

kind: VirtualService
metadata:
  name: hello-virtual-service
spec:
  hosts:
  - hello.devstackops.com
  gateways:
  - hello-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: hello-service
        port:
         number: 8080

Then deploy the gateway and virtual services to see your result.

If you find it’s useful, please don’t hesitate to share your thoughts in comments.