diff --git a/docs/addons/observability.adoc b/docs/addons/observability.adoc index f3a0e24def..380f26962c 100644 --- a/docs/addons/observability.adoc +++ b/docs/addons/observability.adoc @@ -29,7 +29,7 @@ The easiest way to get started with production-grade metrics collection is to us *Steps* . Create a ServiceMonitor for istiod. - ++ [source,yaml] ---- apiVersion: monitoring.coreos.com/v1 @@ -49,7 +49,7 @@ spec: ---- . Create a PodMonitor to scrape metrics from the istio-proxy containers. Note that *this resource has to be created in all namespaces where you are running sidecars*. - ++ [source,yaml] ---- apiVersion: monitoring.coreos.com/v1 @@ -107,7 +107,7 @@ This section describes how to setup Istio with OpenShift Distributed Tracing to *Steps* . Configure Istio to enable tracing and include the OpenTelemetry settings: - ++ [source,yaml] ---- meshConfig: @@ -121,9 +121,8 @@ meshConfig: The *service* field is the OpenTelemetry collector service in the `istio-system` namespace. -[start=2] . Create an Istio telemetry resource to active the OpenTelemetry tracer - ++ [source,yaml] ---- apiVersion: telemetry.istio.io/v1 @@ -138,14 +137,12 @@ spec: randomSamplingPercentage: 100 ---- -[start=3] . Validate the integration: Generate some traffic - ++ We can link:addons.adoc#deploy-gateway-and-bookinfo[Deploy Bookinfo] and generate some traffic. -[start=4] . Validate the integration: See the traces in the UI - ++ [source,bash,subs="attributes+"] ---- kubectl get routes -n tempo tempo-sample-query-frontend-tempo @@ -169,7 +166,7 @@ If you followed <>, you c *Steps* . Create a ClusterRoleBinding for Kiali, so it can view metrics from user-workload monitoring - ++ [source,yaml] ---- apiVersion: rbac.authorization.k8s.io/v1 @@ -186,9 +183,8 @@ subjects: namespace: istio-system ---- -[start=2] . Find out the revision name of your Istio instance. In our case it is `test`. - ++ [source,console,subs="attributes+"] ---- kubectl get istiorevisions.sailoperator.io @@ -196,9 +192,8 @@ NAME READY STATUS IN USE VERSION AGE test True Healthy True v{istio_latest_version} 119m ---- -[start=3] . Create a Kiali resource and point it to your Istio instance. Make sure to replace `test` with your revision name in the fields `config_map_name`, `istio_sidecar_injector_config_map_name`, `istiod_deployment_name` and `url_service_version`. - ++ [source,yaml] ---- apiVersion: kiali.io/v1alpha1 @@ -233,7 +228,7 @@ This section describes how to setup Kiali with OpenShift Distributed Tracing to *Steps* . Setup Kiali to access traces from the Tempo frontend: - ++ [source,yaml] ---- external_services: diff --git a/docs/common/create-and-configure-gateways.adoc b/docs/common/create-and-configure-gateways.adoc index 99c3800e80..2dddfb9124 100644 --- a/docs/common/create-and-configure-gateways.adoc +++ b/docs/common/create-and-configure-gateways.adoc @@ -39,28 +39,28 @@ a link:../../chart/samples/ingress-gateway.yaml[sample gateway configuration] th where the application is installed: . Create the `istio-ingressgateway` deployment and service: - ++ [source,bash,subs="attributes+"] ---- kubectl apply -f ingress-gateway.yaml ---- . Configure the `bookinfo` application with the new gateway: - ++ [source,bash,subs="attributes+"] ---- kubectl apply -f https://raw.githubusercontent.com/istio/istio/master/samples/bookinfo/networking/bookinfo-gateway.yaml ---- . On OpenShift, you can use a https://docs.openshift.com/container-platform/4.13/networking/routes/route-configuration.html[Route] to expose the gateway externally: - ++ [source,bash,subs="attributes+"] ---- kubectl expose service istio-ingressgateway ---- . Finally, obtain the gateway host name and the URL of the product page: - ++ [source,bash,subs="attributes+"] ---- HOST=$(kubectl get route istio-ingressgateway -o jsonpath='{.spec.host}') @@ -75,21 +75,21 @@ Verify that the `productpage` is accessible from a web browser. An egress gateway allows you to control outbound traffic from the service mesh, providing security and monitoring capabilities for external service access. Here's how to configure an egress gateway using gateway injection: . Create the `istio-egressgateway` namespace: - ++ [source,bash,subs="attributes+"] ---- kubectl create namespace istio-egressgateway ---- . Create the `istio-egressgateway` deployment and service using the provided https://raw.githubusercontent.com/istio-ecosystem/sail-operator/main/chart/samples/egress-gateway.yaml[sample egress gateway configuration]: - ++ [source,bash,subs="attributes+"] ---- kubectl apply -f https://raw.githubusercontent.com/istio-ecosystem/sail-operator/main/chart/samples/egress-gateway.yaml -n istio-egressgateway ---- . Configure traffic routing to use the egress gateway by creating these resources in the `istio-egressgateway` namespace. For example, to route traffic to `httpbin.org` through the egress gateway: - ++ [source,yaml] ---- apiVersion: networking.istio.io/v1beta1 @@ -168,8 +168,8 @@ spec: number: 80 ---- -Apply this configuration: - +. Apply this configuration: ++ [source,bash,subs="attributes+"] ---- kubectl apply -f egress-gateway-config.yaml @@ -177,7 +177,7 @@ kubectl apply -f egress-gateway-config.yaml . Test the egress gateway by making a request from a pod in the mesh (EG: using a bookinfo pod within the mesh): - ++ [source,bash,subs="attributes+"] ---- kubectl exec -it $(kubectl get pod -l app=productpage -o jsonpath='{.items[0].metadata.name}') -c productpage -- curl -v http://httpbin.org/get @@ -204,14 +204,14 @@ kubectl get crd gateways.gateway.networking.k8s.io &> /dev/null || { kubectl ku To configure `bookinfo` with a gateway using `Gateway API`: . Create and configure a gateway using a `Gateway` and `HTTPRoute` resource: - ++ [source,bash,subs="attributes+"] ---- kubectl apply -f https://raw.githubusercontent.com/istio/istio/master/samples/bookinfo/gateway-api/bookinfo-gateway.yaml ---- . Retrieve the host, port and gateway URL: - ++ [source,bash,subs="attributes+"] ---- export INGRESS_HOST=$(kubectl get gtw bookinfo-gateway -o jsonpath='{.status.addresses[0].value}') @@ -220,7 +220,7 @@ export GATEWAY_URL=$INGRESS_HOST:$INGRESS_PORT ---- . Obtain the `productpage` URL and check that you can visit it from a browser: - ++ [source,bash,subs="attributes+"] ---- echo "http://{$GATEWAY_URL}/productpage" @@ -235,7 +235,7 @@ You can also use the Kubernetes Gateway API to configure an egress gateway in Is To deploy an egress gateway using the Gateway API, follow these steps: . *Create the egress gateway namespace:* - ++ [source,bash,subs="attributes+"] ---- kubectl create namespace egress-gateway @@ -243,7 +243,7 @@ kubectl label namespace egress-gateway istio-injection=enabled ---- . *Apply the sample egress gateway configuration:* - ++ We provide a sample manifest that includes a `ServiceEntry`, `Gateway`, and `HTTPRoute`s for egress to `httpbin.org` https://raw.githubusercontent.com/istio-ecosystem/sail-operator/main/chart/samples/egress-gateway-gw-api.yaml[here]: [source,bash,subs="attributes+"] @@ -257,7 +257,7 @@ This will: - Create a `HTTPRoute`s to forward traffic from the mesh pod to the gateway and from the gateway to the external service. . *Test egress traffic:* - ++ From a pod in the mesh, you can test egress traffic to `httpbin.org`. Let's create a sample curl pod: [source,bash,subs="attributes+"] @@ -293,4 +293,4 @@ cluster 'outbound|80||httpbin.org' match for URL '/get' # the egress gateway rou - Ensure the namespace has istio-injection enabled - Verify HTTPRoute status: `kubectl describe httproute -n egress-gateway` -- Check that the egress gateway pod is running: `kubectl get pods -l gateway.networking.k8s.io/gateway-name=httpbin-egress-gateway -n egress-gateway` \ No newline at end of file +- Check that the egress gateway pod is running: `kubectl get pods -l gateway.networking.k8s.io/gateway-name=httpbin-egress-gateway -n egress-gateway` diff --git a/docs/general/plugin-ca.adoc b/docs/general/plugin-ca.adoc index 2dc8259147..5f3322603e 100644 --- a/docs/general/plugin-ca.adoc +++ b/docs/general/plugin-ca.adoc @@ -52,163 +52,172 @@ Now, when you create your new `cacerts` secret with an intermediate certificate === Avoiding traffic disruptions To achieve the no-downtime update of the certificates, it's necessary to ensure that all workloads at any given time are trusting certificates signed by either the old root or the new intermediate (which is signed by the new root). This can be achieved by enabling Istio's multi-root support. -1. Enable the multi root support: +. Enable the multi-root support: (Prepare the `istio-patch.yaml) - Prepare`istio-patch.yaml`: - ```yaml - apiVersion: sailoperator.io/v1 - kind: Istio - spec: - values: - pilot: - env: - ISTIO_MULTIROOT_MESH: "true" - meshConfig: - defaultConfig: - proxyMetadata: - PROXY_CONFIG_XDS_AGENT: "true" - ``` ++ +---- +apiVersion: sailoperator.io/v1 +kind: Istio +spec: + values: + pilot: + env: + ISTIO_MULTIROOT_MESH: "true" + meshConfig: + defaultConfig: + proxyMetadata: + PROXY_CONFIG_XDS_AGENT: "true" +---- > **_NOTE:_** Visit Istio documentation for details about `ISTIO_MULTIROOT_MESH` and `PROXY_CONFIG_XDS_AGENT`. - Patch the Istio resource: - ```bash - kubectl patch Istio default --type='merge' --patch-file=istio-patch.yaml - ``` -1. Prepare new root and intermediate certificates (you should be using trusted root CA for issuing the intermediate certificate). Here we are using [tooling](https://github.com/istio/istio/tree/master/tools/certs) from the istio repository: - ```bash - mkdir -p certs - pushd certs - make -f ../tools/certs/Makefile.selfsigned.mk root-ca - make -f ../tools/certs/Makefile.selfsigned.mk intermediate-cacerts - ``` -1. Create new `cacerts` secrets with old CA certificate, key and chain and new combined root certificates: +. Patch the Istio resource: ++ +---- +kubectl patch Istio default --type='merge' --patch-file=istio-patch.yaml +---- + +. Prepare new root and intermediate certificates (you should be using trusted root CA for issuing the intermediate certificate). Here we are using [tooling](https://github.com/istio/istio/tree/master/tools/certs) from the istio repository: ++ +---- +mkdir -p certs +pushd certs +make -f ../tools/certs/Makefile.selfsigned.mk root-ca +make -f ../tools/certs/Makefile.selfsigned.mk intermediate-cacerts +---- +. Create new `cacerts` secrets with old CA certificate, key and chain and new combined root certificates: ++ > **_NOTE:_** It's necessary to assure that all workloads trust both old and new root certificates before updating the certificate used for signing workload certificates to avoid traffic disruptions. Get the certificate and the key from existing Istio CA generated secrets and prepare combined root certificates: - ```bash - kubectl get secret istio-ca-secret -n istio-system -o jsonpath={.data.'ca-cert\.pem'} | base64 -d > ca-cert.pem - kubectl get secret istio-ca-secret -n istio-system -o jsonpath={.data.'ca-key\.pem'} | base64 -d > ca-key.pem - kubectl get secret istio-ca-secret -n istio-system -o jsonpath={.data.'ca-cert\.pem'} | base64 -d > cert-chain.pem - kubectl get secret istio-ca-secret -n istio-system -o jsonpath={.data.'ca-cert\.pem'} | base64 -d > combined-root.pem - cat root-cert.pem >> combined-root.pem - ``` - Create new `cacerts` secrets: - ```bash - kubectl create secret generic cacerts -n istio-system \ - --from-file=ca-cert.pem \ - --from-file=ca-key.pem \ - --from-file=root-cert.pem=combined-root.pem \ - --from-file=cert-chain.pem - ``` -1. Restart istiod to pick up new certificates: - [source,bash,subs="attributes+"] - ---- - kubectl rollout restart deployment/istiod -n istio-system - ---- -1. Verify that all workloads are trusting both old and new roots, e.g. for httpbin: - ```bash - istioctl proxy-config secret deployment/httpbin -n httpbin -o json | jq -r '.dynamicActiveSecrets[1].secret.validationContext.trustedCa.inlineBytes' | base64 --decode - -----BEGIN CERTIFICATE----- - MIIC/TCCAeWgAwIBAgIRAOJUkqyDi0j/BlG8jizlmucwDQYJKoZIhvcNAQELBQAw - GDEWMBQGA1UEChMNY2x1c3Rlci5sb2NhbDAeFw0yNTA2MjQxMjA4NDNaFw0zNTA2 - MjIxMjA4NDNaMBgxFjAUBgNVBAoTDWNsdXN0ZXIubG9jYWwwggEiMA0GCSqGSIb3 - DQEBAQUAA4IBDwAwggEKAoIBAQD+VPnSrL8JcESAaQT8xewSqacNfhDOpBT36HgR - UFx1TFPR+dw4uZDlFW+ANOffE2HGVj9sXhA69p51xfISdOYeneZRzd68k6mjZkXV - 0kXB6wf52T/T0NRkprq+17g5jgxbXEu+yvfeEUbL3GLx6NJCkgzHH3zaqBf0nZDX - tfVM14/uep2rGXIRf3/hnwO3qff0uRVLJebE/9lV6cOE1pbUPU4qPA7NEgiFqzzp - ap2FL1MoXa2ptYJ0kX7ZCobXDbOD5IIrFWC+MI2dDLL409EjIv5R22An4TiVV0Qx - oGkvdC5CXYrDes37jJsIdpMxzFBWeESxTd+w8bxXJiPzKOlTAgMBAAGjQjBAMA4G - A1UdDwEB/wQEAwICBDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTJjPo79+xn - WXWG+MSAf5i1nEOdBDANBgkqhkiG9w0BAQsFAAOCAQEAuOUF+zT90k4180bObsTS - QeRAKBp+A9tRIqHSt7kg4QSJFz+KeoQ1CResuquydVtFwJ84ulfATqL6IbfzUWiF - nWgNlQ/fVvW3MS1/0ZjA6qHr5LJABu8ouwsOqo9tWJifKYl6cD7InoKgViLGssL0 - guQzV+mJ8TY8s8RhtB5H5ZQ9nm9/c6Qy4RuoECf9e3PfY/hwNgLXcHIWgBinxYrt - 6N5/96gZ77nUDtbI4qBuHxiGZ0rxcGFJ+/fJTUbKV+QKuF16GRxURUfoyJ5iL9Si - AnmwFWYxglgunft9xqW6tg/+0v8J9hcO1uxe3M0LXj4xh5BUCAtOuGaPcE1uHBtI - qQ== - -----END CERTIFICATE----- - -----BEGIN CERTIFICATE----- - MIIFFDCCAvygAwIBAgIULu/YsgYLAcQ1kPc8kyzkDEGjhS8wDQYJKoZIhvcNAQEL - BQAwIjEOMAwGA1UECgwFSXN0aW8xEDAOBgNVBAMMB1Jvb3QgQ0EwHhcNMjUwNjI0 - MTIxMTA3WhcNMzUwNjIyMTIxMTA3WjAiMQ4wDAYDVQQKDAVJc3RpbzEQMA4GA1UE - AwwHUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJaj/7VE - AdTGAJoylinnqNzuKKV2ZRV6yqFhMeVknRWl4nGOuJp58sQPO0DXG2uxv1Oi6hKo - Q8A2uL3ReQVt60VqrVvoFKFFaBnicnJ9XWOzZWx07uz7PoBc9llj+azUuSrTOWF5 - wxtQ1RHM/v2fPyzoNQMwj6Xohggh1JboFUW09IRXmoDW/HNVuFdoDtlk47ZAeI7S - 9z3yHMhTlOJ1tDrQqQgh2booBfm8DhoDtdIkFCjG9kKj9nB2Wz4hM160fneAlg5m - aP0TZSECfWq3I0QCadXmveUth6jvU+0TI54O/O6/w/Tm9Sd0VuswoKkxFAH+PgJF - /8FifH3BWi0dmLRBSPVBlJiUloFtXeZAsYGjHVlz2hs0R1cL8D0STJwWgLTQGnak - CY9j7S/3CwGKMfuCxxDbFDhCcEoFDC4kO6CyU7GXNN8DZhZSBIjXF5Gj1Ua93Co/ - lmISOxVrFNCEdDODFLEe1dgffUn0m4kWUWaQzbsLWqFQFx1YZs0FjQ61Ap6Y8QjR - edhmTGROCZRm9y4HrHRAZJ2poIfXOSJgkyfu/o7kvkO/zhamYKNbmBMJGvlw7JdS - waMp4I5kFNql27AAFJVG1lyFGagr7fi7wDsY8ohRB5V/mFV1Hu06Ukz03Z+s5+hj - 6c2mPxoO5c/hY7QVt8G2gvYkvRpek2iI1IFHAgMBAAGjQjBAMB0GA1UdDgQWBBTB - thIKcqmem8YGPAkkqvkUdptflDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQE - AwIC5DANBgkqhkiG9w0BAQsFAAOCAgEAdE95pB1JOlmZkR9WEXb8F81FESti/z2V - nKkAQsYui39UK3jK93cMRg2axxLH/3hXxLJcVNZ/iV5aTNhL9naatui3dMz0zLBk - 2CduGwctlBooJzOa4c2jUbhpdycyIjsHFd6l9ezrWY/JOf1oLwwjNwPa1AO+VOt+ - ZC4tf4j/O0Q+6ThhGQfZVr0X6UN/jWV89Wpo00QsyACwcn2izbx9o25KSGioNJeS - ZcwpgbW1jzASSEUeklqyc1gfZgxM7HyHC+GUV/QSfJugUB4glyUZzpz6gTZWL6N5 - aq5xkQBSUAP8nOmy4aIAEEx4clL03iq62xbwamzjtET5M5NqRIPc2V2cZqQhs0TJ - iiGT98SBu2IydDGPXI/rruujShrIhmJ9WwiaPBdHBnSQQ+AkeDvA3AOcgFmy6Mbs - HfJ5vvwxtPYLc8VPNGWKlu+Jbknea+N5izpdSca+TqfqQ+QwVpcbAGgplT5CqmHU - Ap0ytVizhMxJpMMDU1GZ2C90SCX9N9hnD/Who/Py1BfbjEvBD9TuNdQ14cRWHDmU - Xmyv/zsOhCBskS7bnQNLqhBUS4JMvSDCb0CUMEzmGzJDCGXOTeYs2d1mcNTvDkLS - Hgv1jKTfpRXP4pMFOGGMY9XC3OYK/TtVhDAyrWewREMNQTtBKSEj2S6R5rT5MD02 - ir4ltxRVyHM= - -----END CERTIFICATE----- - ``` +---- +kubectl get secret istio-ca-secret -n istio-system -o jsonpath={.data.'ca-cert\.pem'} | base64 -d > ca-cert.pem +kubectl get secret istio-ca-secret -n istio-system -o jsonpath={.data.'ca-key\.pem'} | base64 -d > ca-key.pem +kubectl get secret istio-ca-secret -n istio-system -o jsonpath={.data.'ca-cert\.pem'} | base64 -d > cert-chain.pem +kubectl get secret istio-ca-secret -n istio-system -o jsonpath={.data.'ca-cert\.pem'} | base64 -d > combined-root.pem +cat root-cert.pem >> combined-root.pem +---- + +. Create new `cacerts` secrets: ++ +---- +kubectl create secret generic cacerts -n istio-system \ + --from-file=ca-cert.pem \ + --from-file=ca-key.pem \ + --from-file=root-cert.pem=combined-root.pem \ + --from-file=cert-chain.pem +---- +. Restart istiod to pick up new certificates: ++ +[source,bash,subs="attributes+"] +---- +kubectl rollout restart deployment/istiod -n istio-system +---- +. Verify that all workloads are trusting both old and new roots, e.g. for httpbin: ++ +---- +istioctl proxy-config secret deployment/httpbin -n httpbin -o json | jq -r '.dynamicActiveSecrets[1].secret.validationContext.trustedCa.inlineBytes' | base64 --decode +-----BEGIN CERTIFICATE----- +MIIC/TCCAeWgAwIBAgIRAOJUkqyDi0j/BlG8jizlmucwDQYJKoZIhvcNAQELBQAw +GDEWMBQGA1UEChMNY2x1c3Rlci5sb2NhbDAeFw0yNTA2MjQxMjA4NDNaFw0zNTA2 +MjIxMjA4NDNaMBgxFjAUBgNVBAoTDWNsdXN0ZXIubG9jYWwwggEiMA0GCSqGSIb3 +DQEBAQUAA4IBDwAwggEKAoIBAQD+VPnSrL8JcESAaQT8xewSqacNfhDOpBT36HgR +UFx1TFPR+dw4uZDlFW+ANOffE2HGVj9sXhA69p51xfISdOYeneZRzd68k6mjZkXV +0kXB6wf52T/T0NRkprq+17g5jgxbXEu+yvfeEUbL3GLx6NJCkgzHH3zaqBf0nZDX +tfVM14/uep2rGXIRf3/hnwO3qff0uRVLJebE/9lV6cOE1pbUPU4qPA7NEgiFqzzp +ap2FL1MoXa2ptYJ0kX7ZCobXDbOD5IIrFWC+MI2dDLL409EjIv5R22An4TiVV0Qx +oGkvdC5CXYrDes37jJsIdpMxzFBWeESxTd+w8bxXJiPzKOlTAgMBAAGjQjBAMA4G +A1UdDwEB/wQEAwICBDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTJjPo79+xn +WXWG+MSAf5i1nEOdBDANBgkqhkiG9w0BAQsFAAOCAQEAuOUF+zT90k4180bObsTS +QeRAKBp+A9tRIqHSt7kg4QSJFz+KeoQ1CResuquydVtFwJ84ulfATqL6IbfzUWiF +nWgNlQ/fVvW3MS1/0ZjA6qHr5LJABu8ouwsOqo9tWJifKYl6cD7InoKgViLGssL0 +guQzV+mJ8TY8s8RhtB5H5ZQ9nm9/c6Qy4RuoECf9e3PfY/hwNgLXcHIWgBinxYrt +6N5/96gZ77nUDtbI4qBuHxiGZ0rxcGFJ+/fJTUbKV+QKuF16GRxURUfoyJ5iL9Si +AnmwFWYxglgunft9xqW6tg/+0v8J9hcO1uxe3M0LXj4xh5BUCAtOuGaPcE1uHBtI +qQ== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIFFDCCAvygAwIBAgIULu/YsgYLAcQ1kPc8kyzkDEGjhS8wDQYJKoZIhvcNAQEL +BQAwIjEOMAwGA1UECgwFSXN0aW8xEDAOBgNVBAMMB1Jvb3QgQ0EwHhcNMjUwNjI0 +MTIxMTA3WhcNMzUwNjIyMTIxMTA3WjAiMQ4wDAYDVQQKDAVJc3RpbzEQMA4GA1UE +AwwHUm9vdCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJaj/7VE +AdTGAJoylinnqNzuKKV2ZRV6yqFhMeVknRWl4nGOuJp58sQPO0DXG2uxv1Oi6hKo +Q8A2uL3ReQVt60VqrVvoFKFFaBnicnJ9XWOzZWx07uz7PoBc9llj+azUuSrTOWF5 +wxtQ1RHM/v2fPyzoNQMwj6Xohggh1JboFUW09IRXmoDW/HNVuFdoDtlk47ZAeI7S +9z3yHMhTlOJ1tDrQqQgh2booBfm8DhoDtdIkFCjG9kKj9nB2Wz4hM160fneAlg5m +aP0TZSECfWq3I0QCadXmveUth6jvU+0TI54O/O6/w/Tm9Sd0VuswoKkxFAH+PgJF +/8FifH3BWi0dmLRBSPVBlJiUloFtXeZAsYGjHVlz2hs0R1cL8D0STJwWgLTQGnak +CY9j7S/3CwGKMfuCxxDbFDhCcEoFDC4kO6CyU7GXNN8DZhZSBIjXF5Gj1Ua93Co/ +lmISOxVrFNCEdDODFLEe1dgffUn0m4kWUWaQzbsLWqFQFx1YZs0FjQ61Ap6Y8QjR +edhmTGROCZRm9y4HrHRAZJ2poIfXOSJgkyfu/o7kvkO/zhamYKNbmBMJGvlw7JdS +waMp4I5kFNql27AAFJVG1lyFGagr7fi7wDsY8ohRB5V/mFV1Hu06Ukz03Z+s5+hj +6c2mPxoO5c/hY7QVt8G2gvYkvRpek2iI1IFHAgMBAAGjQjBAMB0GA1UdDgQWBBTB +thIKcqmem8YGPAkkqvkUdptflDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQE +AwIC5DANBgkqhkiG9w0BAQsFAAOCAgEAdE95pB1JOlmZkR9WEXb8F81FESti/z2V +nKkAQsYui39UK3jK93cMRg2axxLH/3hXxLJcVNZ/iV5aTNhL9naatui3dMz0zLBk +2CduGwctlBooJzOa4c2jUbhpdycyIjsHFd6l9ezrWY/JOf1oLwwjNwPa1AO+VOt+ +ZC4tf4j/O0Q+6ThhGQfZVr0X6UN/jWV89Wpo00QsyACwcn2izbx9o25KSGioNJeS +ZcwpgbW1jzASSEUeklqyc1gfZgxM7HyHC+GUV/QSfJugUB4glyUZzpz6gTZWL6N5 +aq5xkQBSUAP8nOmy4aIAEEx4clL03iq62xbwamzjtET5M5NqRIPc2V2cZqQhs0TJ +iiGT98SBu2IydDGPXI/rruujShrIhmJ9WwiaPBdHBnSQQ+AkeDvA3AOcgFmy6Mbs +HfJ5vvwxtPYLc8VPNGWKlu+Jbknea+N5izpdSca+TqfqQ+QwVpcbAGgplT5CqmHU +Ap0ytVizhMxJpMMDU1GZ2C90SCX9N9hnD/Who/Py1BfbjEvBD9TuNdQ14cRWHDmU +Xmyv/zsOhCBskS7bnQNLqhBUS4JMvSDCb0CUMEzmGzJDCGXOTeYs2d1mcNTvDkLS +Hgv1jKTfpRXP4pMFOGGMY9XC3OYK/TtVhDAyrWewREMNQTtBKSEj2S6R5rT5MD02 +ir4ltxRVyHM= +-----END CERTIFICATE----- +---- > **_NOTE:_** It might be necessary to restart the workload if you only see one certificate. -1. Update `combined-root.pem` by adding the new root certificate again. Using updated `root-cert.pem` will trigger a rotation of workload certificates even without a need to restart the workloads: - [source,bash,subs="attributes+"] - ---- - cat root-cert.pem >> combined-root.pem - ---- -1. Update `cacerts` secrets to use the new intermediate certificate, key and chain and updated combined root certificates: - [source,bash,subs="attributes+"] - ---- - kubectl delete secret cacerts -n istio-system --ignore-not-found && \ - kubectl create secret generic cacerts -n istio-system \ - --from-file=intermediate/ca-cert.pem \ - --from-file=intermediate/ca-key.pem \ - --from-file=root-cert.pem=combined-root.pem \ - --from-file=intermediate/cert-chain.pem - ---- -1. Restart istiod to pick up new certificates: - [source,bash,subs="attributes+"] - ---- - kubectl rollout restart deployment/istiod -n istio-system - ---- -1. Verify that workloads certificates have been rotated and issued by the new intermediate CA: - [source,bash,subs="attributes+"] - ---- - istioctl proxy-config secret deployment/httpbin -n httpbin -o json | jq -r '.dynamicActiveSecrets[0].secret.tlsCertificate.certificateChain.inlineBytes' | base64 -d | openssl x509 -text -noout - Certificate: - Data: - Version: 3 (0x2) - Serial Number: - 37:dc:72:ad:e1:ae:06:e3:0d:fd:3d:61:bb:37:10:16 - Signature Algorithm: sha256WithRSAEncryption - Issuer: O=Istio, CN=Intermediate CA, L=intermediate - Validity - Not Before: Jun 19 15:54:04 2025 GMT - Not After : Jun 20 15:56:04 2025 GMT - ... - ---- -1. Remove old root certificate: - [source,bash,subs="attributes+"] - ---- - kubectl delete secret cacerts -n istio-system --ignore-not-found && \ - kubectl create secret generic cacerts -n istio-system \ - --from-file=intermediate/ca-cert.pem \ - --from-file=intermediate/ca-key.pem \ - --from-file=root-cert.pem \ - --from-file=intermediate/cert-chain.pem - ---- -1. Restart istiod to pick up new certificates: - [source,bash,subs="attributes+"] - ---- - kubectl rollout restart deployment/istiod -n istio-system - ---- +. Update `combined-root.pem` by adding the new root certificate again. Using updated `root-cert.pem` will trigger a rotation of workload certificates even without a need to restart the workloads: ++ +---- +cat root-cert.pem >> combined-root.pem +---- +. Update `cacerts` secrets to use the new intermediate certificate, key and chain and updated combined root certificates: ++ +[source,bash,subs="attributes+"] +---- +kubectl delete secret cacerts -n istio-system --ignore-not-found && \ +kubectl create secret generic cacerts -n istio-system \ + --from-file=intermediate/ca-cert.pem \ + --from-file=intermediate/ca-key.pem \ + --from-file=root-cert.pem=combined-root.pem \ + --from-file=intermediate/cert-chain.pem +---- +. Restart istiod to pick up new certificates: ++ +---- +kubectl rollout restart deployment/istiod -n istio-system +---- +. Verify that workloads certificates have been rotated and issued by the new intermediate CA: ++ +---- +istioctl proxy-config secret deployment/httpbin -n httpbin -o json | jq -r '.dynamicActiveSecrets[0].secret.tlsCertificate.certificateChain.inlineBytes' | base64 -d | openssl x509 -text -noout +Certificate: +Data: + Version: 3 (0x2) + Serial Number: + 37:dc:72:ad:e1:ae:06:e3:0d:fd:3d:61:bb:37:10:16 + Signature Algorithm: sha256WithRSAEncryption + Issuer: O=Istio, CN=Intermediate CA, L=intermediate + Validity + Not Before: Jun 19 15:54:04 2025 GMT + Not After : Jun 20 15:56:04 2025 GMT +... +---- +. Remove old root certificate: ++ +---- +kubectl delete secret cacerts -n istio-system --ignore-not-found && \ +kubectl create secret generic cacerts -n istio-system \ + --from-file=intermediate/ca-cert.pem \ + --from-file=intermediate/ca-key.pem \ + --from-file=root-cert.pem \ + --from-file=intermediate/cert-chain.pem +---- +. Restart istiod to pick up new certificates: ++ +---- +kubectl rollout restart deployment/istiod -n istio-system +---- -At this point, rotation of the new intermediate certificate will be much simpler as long as it's issued by the same root CA. \ No newline at end of file +At this point, rotation of the new intermediate certificate will be much simpler as long as it's issued by the same root CA. diff --git a/docs/update-strategy/update-strategy.adoc b/docs/update-strategy/update-strategy.adoc index 727d2f668f..132aead70c 100644 --- a/docs/update-strategy/update-strategy.adoc +++ b/docs/update-strategy/update-strategy.adoc @@ -37,14 +37,14 @@ Prerequisites: Steps: . Create the `istio-system` namespace. - ++ [source,bash,subs="attributes+",name="inplace-update-strategy"] ---- kubectl create namespace istio-system ---- . Create the `Istio` resource. - ++ [source,bash,subs="attributes+",name="inplace-update-strategy"] ---- cat <