1
apiVersion: v1
2
kind: Service
3
metadata:
4
  name: my-app
5
  annotations:
6
    run.googleapis.com/ingress: "internal"  # 禁止直接外部访问
7
---
8
apiVersion: v1
9
kind: Policy
10
metadata:
11
  name: iap-policy
12
spec:
13
  bindings:
14
    - role: roles/iap.httpsResourceAccessor
15
      members:
16
        - "group:engineers@example.com"
17
      condition:
18
        title: "限制访问时间和设备"
19
        expression: |
20
          request.time.getHours() >= 9 &&
21
          request.time.getHours() <= 18 &&
22
          device.isCorpOwned == true

1
cfssl gencert -initca ca-csr.json | cfssljson -bare ca
2

3
cat > ca-config.json << 'EOF'
4
{
5
  "signing": {
6
    "default": {
7
      "expiry": "720h"
8
    },
9
    "profiles": {
10
      "server": {
11
        "usages": ["signing", "key encipherment", "server auth"],
12
        "expiry": "720h"
13
      },
14
      "client": {
15
        "usages": ["signing", "key encipherment", "client auth"],
16
        "expiry": "720h"
17
      },
18
      "peer": {
19
        "usages": ["signing", "key encipherment", "server auth", "client auth"],
20
        "expiry": "720h"
21
      }
22
    }
23
  }
24
}
25
EOF
26

27
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem \
28
  -config=ca-config.json -profile=server \
29
  server-csr.json | cfssljson -bare server
30

31
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem \
32
  -config=ca-config.json -profile=client \
33
  client-csr.json | cfssljson -bare client
34

35
cfssl gencert -ca=ca.pem -ca-key=ca-key.pem \
36
  -config=ca-config.json -profile=peer \
37
  -hostname="service-a,service-a.default.svc.cluster.local" \
38
  peer-csr.json | cfssljson -bare service-a

1
import ssl
2
import http.client
3

4
def create_mtls_connection(host, port, certfile, keyfile, cafile):
5
    """创建 mTLS 连接"""
6
    context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
7

8
    context.load_cert_chain(certfile=certfile, keyfile=keyfile)
9

10
    context.load_verify_locations(cafile=cafile)
11

12
    context.verify_mode = ssl.CERT_REQUIRED
13

14
    context.minimum_version = ssl.TLSVersion.TLSv1_3
15

16
    conn = http.client.HTTPSConnection(
17
        host, port, context=context
18
    )
19
    return conn
20

21
conn = create_mtls_connection(
22
    host='api.internal.example.com',
23
    port=8443,
24
    certfile='/etc/certs/client.pem',
25
    keyfile='/etc/certs/client-key.pem',
26
    cafile='/etc/certs/ca.pem'
27
)
28
conn.request('GET', '/api/v1/data')
29
response = conn.getresponse()
30
print(response.status, response.read().decode())

1
apiVersion: spire.spiffe.io/v1alpha1
2
kind: ClusterSPIFFEID
3
metadata:
4
  name: billing-service
5
spec:
6
  className: spire-server
7
  spiffeIDTemplate: "spiffe://example.com/{{ .PodMeta.Namespace }}/{{ .PodMeta.Labels.app }}"
8
  podSelector:
9
    matchLabels:
10
      app: billing-service
11
  federatesWith:
12
    - "spiffe://partner.example.com"
13
  ttl: 3600  # 证书有效期 1 小时，自动轮换

1
apiVersion: security.istio.io/v1beta1
2
kind: PeerAuthentication
3
metadata:
4
  name: default
5
spec:
6
  mtls:
7
    mode: STRICT  # 强制 mTLS

1
apiVersion: security.istio.io/v1beta1
2
kind: AuthorizationPolicy
3
metadata:
4
  name: billing-service-policy
5
  namespace: production
6
spec:
7
  selector:
8
    matchLabels:
9
      app: billing-service
10
  rules:
11
    - from:
12
        - source:
13
            principals: ["cluster.local/ns/production/sa/order-service"]
14
            namespaces: ["production"]
15
      to:
16
        - operation:
17
            methods: ["GET", "POST"]
18
            paths: ["/api/v1/billing/*"]
19
      when:
20
        - key: request.headers[x-time-window]
21
          values: ["business-hours"]
22
    - {}
23
  action: DENY

1
apiVersion: apps/v1
2
kind: Deployment
3
metadata:
4
  name: billing-service
5
  annotations:
6
    linkerd.io/inject: enabled  # 注入 Linkerd proxy
7
spec:
8
  template:
9
    metadata:
10
      annotations:
11
        linkerd.io/inject: enabled
12
    spec:
13
      containers:
14
        - name: billing
15
          image: billing:latest

1
apiVersion: policy.linkerd.io/v1alpha1
2
kind: AuthorizationPolicy
3
metadata:
4
  name: billing-authz
5
spec:
6
  targetRef:
7
    group: ""
8
    kind: ServiceAccount
9
    name: billing-service
10
  requiredAuthenticationRefs:
11
    - name: order-service-identity
12
      group: ""
13
      kind: ServiceAccount

1
apiVersion: cilium.io/v2
2
kind: CiliumNetworkPolicy
3
metadata:
4
  name: billing-service-policy
5
spec:
6
  endpointSelector:
7
    matchLabels:
8
      app: billing-service
9
  ingress:
10
    - fromEndpoints:
11
        - matchLabels:
12
            app: order-service
13
      toPorts:
14
        - ports:
15
            - port: "8443"
16
              protocol: TCP
17
          rules:
18
            http:
19
              - method: GET
20
                path: "/api/v1/billing/.*"
21
              - method: POST
22
                path: "/api/v1/billing/charge"
23
    - fromEndpoints:
24
        - matchLabels:
25
            app: prometheus
26
      toPorts:
27
        - ports:
28
            - port: "9090"
29
              protocol: TCP
30
  egress:
31
    - toEndpoints:
32
        - matchLabels:
33
            app: postgres-billing
34
      toPorts:
35
        - ports:
36
            - port: "5432"
37
              protocol: TCP
38
    - toEndpoints:
39
        - matchLabels:
40
            k8s:io.k8s.pod.namespace: kube-system
41
            k8s-app: kube-dns
42
      toPorts:
43
        - ports:
44
            - port: "53"
45
              protocol: UDP

1
step ca init --name="Internal CA" --provisioner="admin@example.com" \
2
  --dns="ca.example.com" --address=":443" --deployment-type=standalone
3

4
step ca certificate "billing.internal.example.com" billing.pem billing-key.pem \
5
  --provisioner="admin@example.com" --not-after=24h
6

7
step ca renew billing.pem billing-key.pem --daemon --renew-before=8h
8

9
step mtls client billing.internal.example.com:8443 \
10
  --cacert root_ca.pem \
11
  --cert billing.pem \
12
  --key billing-key.pem \
13
  --server-name billing.internal.example.com