rvennam

Solo.io Istio FIPS Verification

Download Istio 1.11.5 CLI:

curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.11.5 sh -

Install Solo Istio 1.11.5 FIPS:

cd ~/istio-1.11.5/bin

rvennam

kubectl config use-context $CLUSTER1
kubectl create ns gloo-mesh-test
kubectl label ns gloo-mesh-test istio-injection=enabled

cat <<EOF | oc -n gloo-mesh-test create -f -
apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
  name: istio-cni
EOF

rvennam

#!/bin/sh

kubectl logs deployment/gloo-mesh-mgmt-server -n gloo-mesh > mgmt-server.log
kubectl port-forward deployment/gloo-mesh-mgmt-server -n gloo-mesh 9091 >/dev/null 2>&1 &
pid=$!

sleep 3

curl -s localhost:9091/snapshots/input > input.json
curl -s localhost:9091/snapshots/output > output.json

rvennam

openapi: '3.1.0'
info:
  version: '1.0.0'
  title: 'Currencies API'
  description: International currency support
servers:
  - url: https://currency.solo.io:443/
    description: Solo.io Currency server API
  - url: http://localhost:8080/
    description: Local development

rvennam

{
    "openapi": "3.0.0",
    "info": {
        "version": "1.0.0",
        "title": "Currencies API",
        "description": "International currency support"
    },
    "servers": [
        {
            "url": "https://currency.solo.io:443/",

rvennam

openapi: '3.0.0'
info:
  version: '1.0.0'
  title: 'Currencies API'
  description: International currency support
servers:
  - url: https://currency.solo.io:443/
    description: Solo.io Currency server API
  - url: http://localhost:8080/
    description: Local development

rvennam

apiVersion: networking.gloo.solo.io/v2
kind: ExternalService
metadata:
  name: mydb
  namespace: default
  labels:
    external-service: mydb
spec:
  hosts:
  - mydb.com

rvennam

apiVersion: networking.gloo.solo.io/v2
kind: RouteTable
metadata:
  name: ingress
  namespace: ops-team
spec:
  hosts:
    - '*'
  virtualGateways:
    - name: north-south-gw

rvennam

$ make SHELL='sh -x' -f Makefile.selfsigned.mk intermediate-certs VERBOSE=1
+ echo 'generating root-key.pem'
generating root-key.pem
+ openssl genrsa -out root-key.pem 4096
+ echo '[ req ]'
+ echo 'encrypt_key = no'
+ echo 'prompt = no'
+ echo 'utf8 = yes'
+ echo 'default_md = sha256'
+ echo 'default_bits = 4096'

rvennam

- accessLog:
  - filter:
      responseFlagFilter:
        flags:
        - NR
    name: envoy.access_loggers.file
    typedConfig:
      '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
      logFormat:
        textFormatSource: