Building a Zero-Trust Service Mesh: Enforcing Mutual TLS and Fine-Grained Authorization Policies with Istio and SPIFFE/SPIRE — code snippets

snippet-1.yaml

apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterSPIFFEID
metadata:
  name: payment-service-spiffeid
spec:
  spiffeIdTemplate: "spiffe://prod.example.org/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"
  podSelector:
    matchLabels:
      app: payment-service
  workloadSelector:
    - "k8s:ns:prod"
    - "k8s:sa:payment-service-sa"

snippet-2.yaml

apiVersion: telemetry.istio.io/v1alpha1
kind: ProxyConfig
metadata:
  name: spire-sds-config
  namespace: prod
spec:
  image:
    imageType: default
  concurrency: 2
  environmentVariables:
    # Direct the Envoy proxy to fetch certificates via the SPIFFE CSI provider socket
    SPIFFE_WORKLOAD_API_SOCKET: "unix:///var/run/secrets/spiffe.io/provider/agent.sock"

snippet-3.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: payment-service
  namespace: prod
spec:
  replicas: 3
  selector:
    matchLabels:
      app: payment-service
  template:
    metadata:
      labels:
        app: payment-service
      annotations:
        # Override the sidecar injection template to mount the CSI driver volume
        sidecar.istio.io/inject: "true"
        sidecar.istio.io/userVolume: '[{"name": "spiffe-workload-api", "csi": {"driver": "spiffe.csi.spiffe.io", "readOnly": true}}]'
        sidecar.istio.io/userVolumeMount: '[{"name": "spiffe-workload-api", "mountPath": "/var/run/secrets/spiffe.io/provider", "readOnly": true}]'
    spec:
      serviceAccountName: payment-service-sa
      containers:
        - name: payment-app
          image: prod-registry.example.org/finance/payment-service:v2.4.1
          ports:
            - containerPort: 8080
          securityContext:
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 10001

snippet-4.yaml

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: prod
spec:
  mtls:
    mode: STRICT

snippet-5.yaml

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: ledger-auth-policy
  namespace: prod
spec:
  selector:
    matchLabels:
      app: ledger-service
  action: ALLOW
  rules:
    - from:
        - source:
            principals: ["prod.example.org/ns/prod/sa/payment-service-sa"]
      to:
        - operation:
            methods: ["POST"]
            paths: ["/transactions"]

snippet-6.go

package main

import (
	"context"
	"crypto/tls"
	"io"
	"log"
	"net/http"
	"time"

	"github.com/spiffe/go-spiffe/v2/spiffeid"
	"github.com/spiffe/go-spiffe/v2/spiffetls"
	"github.com/spiffe/go-spiffe/v2/workloadapi"
)

func main() {
	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
	defer cancel()

	// Connect to SPIFFE Workload API via local Unix Domain Socket
	socketPath := "unix:///var/run/secrets/spiffe.io/provider/agent.sock"
	source, err := workloadapi.NewX509Source(ctx, workloadapi.WithClientOptions(workloadapi.WithAddr(socketPath)))
	if err != nil {
		log.Fatalf("Unable to create X509Source: %v", err)
	}
	defer source.Close()

	// Define the allowed SPIFFE ID of the upstream service
	serverID := spiffeid.RequireFromString("spiffe://prod.example.org/ns/prod/sa/ledger-service-sa")

	// Create an TLS configuration using the SPIFFE source for certificates and validation
	tlsConfig := spiffetls.NewTLSConfig(source, spiffetls.AuthorizeID(serverID))

	client := &http.Client{
		Transport: &http.Transport{
			TLSClientConfig: tlsConfig,
		},
		Timeout: 5 * time.Second,
	}

	resp, err := client.Get("https://ledger-service.prod.svc.cluster.local:9090/transactions")
	if err != nil {
		log.Fatalf("HTTPS request failed: %v", err)
	}
	defer resp.Body.Close()

	body, _ := io.ReadAll(resp.Body)
	log.Printf("Response: %s", body)
}