spiffe · MarcosDY · Sep 13, 2021
diff --git a/examples/envoy-federated/.gitignore b/examples/envoy-federated/.gitignore
@@ -0,0 +1,3 @@
+docker/web-domain/web-server
+docker/web-federated/web-server
+docker/echo/echo-server
diff --git a/examples/envoy-federated/1-start-services.sh b/examples/envoy-federated/1-start-services.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -e
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+bb=$(tput bold)
+nn=$(tput sgr0)
+
+# Start up the web server
+echo "${bb}Starting web server...${nn}"
+docker-compose -f "${DIR}"/docker-compose.yml exec -d web-domain web-server -log /tmp/web-server.log
+
+echo "${bb}Starting federated web server...${nn}"
+docker-compose -f "${DIR}"/docker-compose.yml exec -d web-federated web-server -log /tmp/web-server.log
+
+# Start up the echo server
+echo "${bb}Starting echo server...${nn}"
+docker-compose -f "${DIR}"/docker-compose.yml exec -d echo echo-server -log /tmp/echo-server.log
diff --git a/examples/envoy-federated/2-start-spire-agents.sh b/examples/envoy-federated/2-start-spire-agents.sh
@@ -0,0 +1,36 @@
+#!/bin/bash
+
+set -e
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+bb=$(tput bold)
+nn=$(tput sgr0)
+
+# Bootstrap trust to the SPIRE server for each agent by copying over the
+# trust bundle into each agent container. Alternatively, an upstream CA could
+# be configured on the SPIRE server and each agent provided with the upstream
+# trust bundle (see UpstreamAuthority under
+# https://github.com/spiffe/spire/blob/master/doc/spire_server.md#plugin-types)
+echo "${bb}Bootstrapping trust between SPIRE agents and federated SPIRE server...${nn}"
+docker-compose -f "${DIR}"/docker-compose.yml exec -T spire-server-federated bin/spire-server bundle show |
+	docker-compose -f "${DIR}"/docker-compose.yml exec -T web-federated tee conf/agent/bootstrap.crt > /dev/null
+
+echo "${bb}Bootstrapping trust between SPIRE agents and SPIRE server...${nn}"
+docker-compose -f "${DIR}"/docker-compose.yml exec -T spire-server-domain bin/spire-server bundle show |
+	docker-compose -f "${DIR}"/docker-compose.yml exec -T echo tee conf/agent/bootstrap.crt > /dev/null
+
+docker-compose -f "${DIR}"/docker-compose.yml exec -T spire-server-domain bin/spire-server bundle show |
+	docker-compose -f "${DIR}"/docker-compose.yml exec -T web-domain tee conf/agent/bootstrap.crt > /dev/null
+
+# Start up the web server SPIRE agent.
+echo "${bb}Starting web server SPIRE agent...${nn}"
+docker-compose -f "${DIR}"/docker-compose.yml exec -d web-domain bin/spire-agent run
+
+# Start up the web-federated server SPIRE agent.
+echo "${bb}Starting web-federated server SPIRE agent...${nn}"
+docker-compose -f "${DIR}"/docker-compose.yml exec -d web-federated bin/spire-agent run
+
+# Start up the echo server SPIRE agent.
+echo "${bb}Starting echo server SPIRE agent...${nn}"
+docker-compose -f "${DIR}"/docker-compose.yml exec -d echo bin/spire-agent run
diff --git a/examples/envoy-federated/3-create-registration-entries.sh b/examples/envoy-federated/3-create-registration-entries.sh
@@ -0,0 +1,55 @@
+#/bin/bash
+
+set -e
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+bb=$(tput bold)
+nn=$(tput sgr0)
+
+fingerprint() {
+	# calculate the SHA1 digest of the DER bytes of the certificate using the
+	# "coreutils" output format (`-r`) to provide uniform output from
+	# `openssl sha1` on macOS and linux.
+	cat $1 | openssl x509 -outform DER | openssl sha1 -r | awk '{print $1}'
+}
+
+WEB_FEDERATED_AGENT_FINGERPRINT=$(fingerprint "${DIR}"/docker/web-federated/conf/agent.crt.pem)
+WEB_AGENT_FINGERPRINT=$(fingerprint "${DIR}"/docker/web-domain/conf/agent.crt.pem)
+ECHO_AGENT_FINGERPRINT=$(fingerprint "${DIR}"/docker/echo/conf/agent.crt.pem)
+
+echo "${bb}Storing bundles...${nn}"
+docker-compose -f "${DIR}"/docker-compose.yml exec spire-server-federated bin/spire-server bundle show |
+	docker-compose -f "${DIR}"/docker-compose.yml exec -T spire-server-domain tee /opt/spire/federatedServerBundle.pem > /dev/null
+docker-compose -f "${DIR}"/docker-compose.yml exec spire-server-domain bin/spire-server bundle show |
+	docker-compose -f "${DIR}"/docker-compose.yml exec -T spire-server-federated tee /opt/spire/domainServerBundle.pem > /dev/null
+
+echo "${bb}Creating federated bundle: domain...${nn}"
+docker-compose -f "${DIR}"/docker-compose.yml exec spire-server-federated bin/spire-server bundle set \
+	-id spiffe://domain.test \
+	-path /opt/spire/domainServerBundle.pem
+
+echo "${bb}Creating federated bundle: federated...${nn}"
+docker-compose -f "${DIR}"/docker-compose.yml exec spire-server-domain bin/spire-server bundle set \
+	-id spiffe://federated.test \
+	-path /opt/spire/federatedServerBundle.pem
+
+echo "${bb}Creating registration entry for the federated web server...${nn}"
+docker-compose -f "${DIR}"/docker-compose.yml exec spire-server-federated bin/spire-server entry create \
+	-parentID spiffe://federated.test/spire/agent/x509pop/${WEB_FEDERATED_AGENT_FINGERPRINT} \
+	-spiffeID spiffe://federated.test/web-server \
+	-selector unix:user:envoy \
+	-federatesWith spiffe://domain.test
+
+echo "${bb}Creating registration entry for the domain server...${nn}"
+docker-compose -f "${DIR}"/docker-compose.yml exec spire-server-domain bin/spire-server entry create \
+	-parentID spiffe://domain.test/spire/agent/x509pop/${ECHO_AGENT_FINGERPRINT} \
+	-spiffeID spiffe://domain.test/echo-server \
+	-selector unix:user:envoy \
+	-federatesWith spiffe://federated.test
+
+echo "${bb}Creating registration entry for the web server...${nn}"
+docker-compose -f "${DIR}"/docker-compose.yml exec spire-server-domain bin/spire-server entry create \
+	-parentID spiffe://domain.test/spire/agent/x509pop/${WEB_AGENT_FINGERPRINT} \
+	-spiffeID spiffe://domain.test/web-server \
+	-selector unix:user:envoy 
diff --git a/examples/envoy-federated/README.md b/examples/envoy-federated/README.md
@@ -0,0 +1,85 @@
+# Envoy 1.19.0 SDS Example with SPIRE 1.0.2
+
+## Requirements
+
+- Go 1.14
+- docker-compose
+
+## Diagram
+
+![diagram](./images/envoy-federated.png)
+
+## Build
+
+```
+$ ./build.sh
+```
+
+## Run
+
+```
+$ docker-compose up -d
+```
+
+## Start Web and Echo Servers
+
+```
+$ ./1-start-services.sh
+```
+
+## Start SPIRE Agents 
+
+```
+$ ./2-start-spire-agents.sh
+```
+
+## Create Workload Registration Entries
+
+```
+$ ./3-create-registration-entries.sh
+```
+
+## Interact with Web Server
+
+Open up a browser to http://localhost:8080 to test out:
+
+- Direct connection between Web and Echo servers
+- mTLS connection between Web and Echo servers via Envoy
+- TLS connection between Web and Echo servers via Envoy
+
+## Interact with Federated Web Server
+
+Open up a browser to http://localhost:8088 to test out:
+
+- Direct connection between Web and Echo servers
+- mTLS connection between Web and Echo servers via Envoy
+- TLS connection between Web and Echo servers via Envoy
+**NOTE** It may take a 30 seconds or so for Envoy to reconnect to upstream
+after the registration entries are created.
+
+## Clean up
+
+```
+$ docker-compose down
+```
+
+## Miscellaneous
+
+### Regenerating Agent Certificates for X509PoP attestation
+
+If you want to regenerate the agent certificates, you use
+the gencerts.go Go script, supplying the names of all the services.
+
+```
+$ go run gencerts.go web echo
+74613bb92549782b5d01ad5e6e93cedd78841683 web
+14e6255ca2a1f32198656fc400f82d242ccf44f2 echo
+```
+
+This script creates a new CA keypair that is used to sign the service
+certificates. It replaces the agent keypairs in the docker
+configurations for each service, as well as the agent cacert in the
+spire-server configuration.
+
+After running, you must rerun `build.sh` to rebuild the containers with the
+changes.
diff --git a/examples/envoy-federated/build.sh b/examples/envoy-federated/build.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -e
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+(cd "${DIR}"/src/web-server && GOOS=linux go build -v -o $DIR/docker/web-domain/web-server)
+(cd "${DIR}"/src/web-server && GOOS=linux go build -v -o $DIR/docker/web-federated/web-server)
+(cd "${DIR}"/src/echo-server && GOOS=linux go build -v -o $DIR/docker/echo/echo-server)
+
+docker-compose -f "${DIR}"/docker-compose.yml build
diff --git a/examples/envoy-federated/docker-compose.yml b/examples/envoy-federated/docker-compose.yml
@@ -0,0 +1,39 @@
+version: '3'
+services:
+  spire-server-federated:
+    build: ./docker/spire-server-federated
+    hostname: spire-server-federated
+    tty: true
+    privileged: true
+  spire-server-domain:
+    build: ./docker/spire-server-domain
+    hostname: spire-server-domain
+    tty: true
+    privileged: true
+  echo:
+    build: ./docker/echo
+    hostname: echo
+    tty: true
+    privileged: true
+    links:
+      - spire-server-domain
+  web-domain:
+    build: ./docker/web-domain
+    hostname: web-domain
+    tty: true
+    privileged: true
+    links:
+      - spire-server-domain
+      - echo
+    ports:
+      - 8080:8080
+  web-federated:
+    build: ./docker/web-federated
+    hostname: web-federated
+    tty: true
+    privileged: true
+    links:
+      - spire-server-federated
+      - echo
+    ports:
+      - 8088:8080
diff --git a/examples/envoy-federated/docker/echo/Dockerfile b/examples/envoy-federated/docker/echo/Dockerfile
@@ -0,0 +1,14 @@
+FROM gcr.io/spiffe-io/spire-agent:1.0.2 as spire
+
+FROM envoyproxy/envoy-alpine:v1.19.0
+RUN mkdir -p /opt/spire/conf/agent
+RUN mkdir -p /opt/spire/data/agent
+COPY --from=spire /opt/spire/bin/spire-agent /opt/spire/bin/spire-agent
+COPY conf/envoy.yaml /etc/envoy/envoy.yaml
+COPY conf/spire-agent.conf /opt/spire/conf/agent/agent.conf
+COPY conf/agent.key.pem /opt/spire/conf/agent/agent.key.pem
+COPY conf/agent.crt.pem /opt/spire/conf/agent/agent.crt.pem
+COPY echo-server /usr/local/bin/echo-server
+
+WORKDIR /opt/spire
+CMD /usr/local/bin/envoy -l debug -c /etc/envoy/envoy.yaml --log-path /tmp/envoy.log
diff --git a/examples/envoy-federated/docker/echo/conf/agent.crt.pem b/examples/envoy-federated/docker/echo/conf/agent.crt.pem
@@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE-----
+MIIBZjCB8aADAgECAgEBMA0GCSqGSIb3DQEBCwUAMAAwIhgPMDAwMTAxMDEwMDAw
+MDBaGA85OTk5MTIzMTIzNTk1OVowIDEeMBwGA1UEAxMVRWNobyBYNTA5UG9QIElk
+ZW50aXR5MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAMyss5CqRpvL6jzXDggSV/+A
+NBaYhAyWgRRkRKKcKE+1GfXutd4ewrrsC5DRncSH1HxTnwO9H7YmobKu7kVUZegB
+EfeydefNQqvBnHqMooUWUgfiwAN01CKOxEURn+dtzQIDAQABoxIwEDAOBgNVHQ8B
+Af8EBAMCB4AwDQYJKoZIhvcNAQELBQADYQAj+ukSTrT5aJFOtDkpA4dHGOgJNFQ+
+Lf03GEBuvNCzM/XKaxr+/j0PbtcE+SwtOn/rTV1aGcKHT+jOSQuLUW7wguB7Scvd
+p/ecQJ2D1C98EEiJ0zEDuuCEXQhPmFjSOkk=
+-----END CERTIFICATE-----
diff --git a/examples/envoy-federated/docker/echo/conf/agent.key.pem b/examples/envoy-federated/docker/echo/conf/agent.key.pem
@@ -0,0 +1,13 @@
+-----BEGIN PRIVATE KEY-----
+MIIB5gIBADANBgkqhkiG9w0BAQEFAASCAdAwggHMAgEAAmEAzKyzkKpGm8vqPNcO
+CBJX/4A0FpiEDJaBFGREopwoT7UZ9e613h7CuuwLkNGdxIfUfFOfA70ftiahsq7u
+RVRl6AER97J1581Cq8GceoyihRZSB+LAA3TUIo7ERRGf523NAgMBAAECYGKA94a3
+PHY8xIX1Zk5iLbHMzMTXMC4yvPrIavPrvcbmvRDMiwDUwxldAw/2ojx0teVHsdxM
+AJmQ7WIfEgseRdZIalQREOscdapzOM/UA3VIJwZkaAWbnTt7A6E52xavrQIxAPMv
+eqvzIKX+GTCXWYVH5/ITebDVByxkS7xXk/1T66W7MqtDbI+RV083KkxcqSnm9wIx
+ANd1uA3AjsrMm2kyA9BR1LqSF+2OioNc8ivuXofpi2HfAwf03JAxi2TNe8KfjNdM
+WwIxAMF5SLN8nsDxQ8Ew6HvtFU+2xt403Zwnv0l8s7ScC6KzKECxR7GBBGF1liVi
+owM/SQIxALGTpjQ/ZfCjHdtfi2EgcJGsYug5uNN3wWiPt32Q8H2jjh36o+Z7zwUv
+jjbjxPKVTQIxANEUsYQBcq1dvpwfmIzy73vrZTIdCyCzgm12KIQHxKvaRiGLFcxD
+3iNplWkDRezhLg==
+-----END PRIVATE KEY-----