如何编写SIMPLE模式的Istio EnvoyFilter以添加证书链至X-Forwarded-Client-Cert

问题描述 #

当前X-Forwarded-Client-Cert请求头仅包含客户端证书，无法展示完整证书链，示例如下：

{
  "x-forwarded-proto": "https",
  "x-request-id": "7fd003cb-baf0-4fcd-b2e6-708515850021",
  "x-forwarded-client-cert": "Hash=76d029c42d62b6d4e00e633cae70cfedd9e6ea05689292d9227393a657e1dbc3;Cert=\"-----BEGIN%20CERTIFICATE-----%0AMIIF1zCCA7%2BgAwIBAgIQFhFNeCm5MuCEeiG2PlAVMjANBgkqhkiG9w0BAQsFADB5%0AMQswCQYDVQQGEwJERTENMAsGA1UEBwwERVUxMDEPMA0GA1UECgwGU0FQIFNFMSMw%0AIQYDVQQLDBpTQVAgQ2xvdWQgUGxhdGZvcm0gQ2xpZW50czElMCMGA1UEAwwcU0FQ%0AIENsb3VkIFBsYXRmb3JtIENsaWVudCBDQTAeFw0yMjA4MDcwNzI1MDBaFw0yMzA4%0AMDcwODI1MDBaMIHQMQswCQYDVQQGEwJERTEPMA0GA1UEChMGU0FQIFNFMSMwIQYD%0AVQQLExpTQVAgQ2xvdWQgUGxhdGZvcm0gQ2xpZW50czEtMCsGA1UECxMkMjUyNWM4%0AYzctOWRjNi00NjFhLWJjM2ItMTlkNTJiNzE1YTM2MS0wKwYDVQQHEyQ1MGUzOThm%0AYy1hNDAzLTQ2MWQtYTIyOC1kOGEwOWRhZGFmYzYxLTArBgNVBAMTJDUwZTM5OGZj%0ALWE0MDMtNDYxZC1hMjI4LWQ4YTA5ZGFkYWZjNjCCASIwDQYJKoZIhvcNAQEBBQAD%0AggEPADCCAQoCggEBANl2mHqbQ%2B4SC2lw6rQ73cJajFljICpL1bGC39NM%2BlZvhi%2Fz%0AL2%2FDdSayFUab5fHCvF7A8VDOMbGh%2BsDLvQV5BC0dO97W0tOo21QLFUAS1ttv8YYH%0AcL2IbfPGYXfE4rP3O5xX0m8%2FT9mLudXxfbjZhxBz%2BOHLjplDAo3b6hhk6COh7BEh%0AKSRmzBCkrruvWOnYnJoAmprmwnP6%2BEsWE9HDk5xgnEa5MiGwRbut3Dd%2BsEzaNYff%0AZ9A%2BDlrFS8m2KDuNBY8AXt3aqrz3J0hhnUTGaZ11%2FHx1BmFgCht1bgSRylqI4HmP%0AfIve3ccVpDvNYDCCpYW%2BCdNeuqAaOIK9YWL4dGUCAwEAAaOCAQEwgf4wCQYDVR0T%0ABAIwADAfBgNVHSMEGDAWgBRNsO7sXVfhqDUo%2Fx%2BHfVKxn0UzZDAdBgNVHQ4EFgQU%0AlOuguNi%2BHX%2BdCgqAdoQ%2FwUtQGi8wDgYDVR0PAQH%2FBAQDAgWgMBMGA1UdJQQMMAoG%0ACCsGAQUFBwMCMIGLBgNVHR8EgYMwgYAwfqB8oHqGeGh0dHA6Ly9zYXAtY2xvdWQt%0AcGxhdGZvcm0tY2xpZW50LWNhLWV1MTAtY3Jscy5zMy5ldS1jZW50cmFsLTEuYW1h%0Aem9uYXdzLmNvbS9jcmwvOTJkNzUxODYtM2Y1Mi00NzMzLTg1MTAtZDZkNjJhNmMx%0AOTZmLmNybDANBgkqhkiG9w0BAQsFAAOCAgEAYztKM3cmoQhyoxLWSgoK3ag9iXCO%0AVZ73BxEFIAU4hp%2B1VkNrHSV6nx443GEoSx9Cu99TkU0PVaefNc1DyA4lSz%2FYL%2FlL%0AEl5a4JZ4agzoZr%2BeTVyoYHbBZvQ6UV4T2xfeKhMV1v%2BFG1AL7LNkelnqsIn25vLe%0AjtbswEDhlPTGy8OjNgL%2FOwKf67DLVZosXGUOcEbpP%2FGAGZnmbU%2B5kiO8dO6%2Feq8i%0AvVrODyKEtlsGy1D%2FqgUyVB48sNzqVV6inPQAZhtZqq5ReyX7UzkxfCR6wxOVHx6o%0Az8jV7GYVyG0L3aD4sAUJ%2F6IYD2MI7C3z79Am9AM809%2BnEBvUY%2B0Y22GfpyoSOfNW%0AkhGLvGVzb%2BPg0R%2B60fQg0RkmzHNKrMfYFSzB%2BPh6sDqDo6HZzrGbeYv7vgV%2FLbdR%0AjKLtakNrX5fZ0M%2F%2FLuhmzpDiZ3qenL5s2S9XhQ%2FhwQUNyCzG0E7v7x6eQOK7v8ZA%0AJny9DQPnaPHqXqssp3vYiFQt%2B38zgI7bevlkHD%2BU2%2BrlydIzIOAkqY%2BWwGTPaZFS%0ANC4PO6JasXMQIS1iTYLsNncw5dNUgJCPGclZ5I7r400CvfALOpDhQEu7NxA2ZV9N%0A5EQvZqusHDF0zSHpVlw7z1KL3KTShlr75zK%2FhRyYsi4Y8vcLG2Se0YqwpontspnL%0A0GeeMMkt9Dpn22w%3D%0A-----END%20CERTIFICATE-----%0A\";Subject=\"CN=50e398fc-a403-461d-a228-d8a09dadafc6,L=50e398fc-a403-461d-a228-d8a09dadafc6,OU=2525c8c7-9dc6-461a-bc3b-19d52b715a36,OU=SAP Cloud Platform Clients,O=SAP SE,C=DE\";URI=,By=spiffe://cluster.local/ns/resource-manager/sa/default;Hash=da4ccc5ea3b4f155b2130eb2ecb2cbabc878303215d0fdcbe168601d283fe72b;Subject=\"\";URI=spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",
  "x-envoy-attempt-count": "1",
  "x-client-ssl-cn": "CN=50e398fc-a403-461d-a228-d8a09dadafc6,L=50e398fc-a403-461d-a228-d8a09dadafc6,OU=2525c8c7-9dc6-461a-bc3b-19d52b715a36,OU=SAP Cloud Platform Clients,O=SAP SE,C=DE"
}

现有可正常获取客户端证书的EnvoyFilter配置 #

以下配置已能让X-Forwarded-Client-Cert显示客户端证书，但缺少完整链：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: add-validation-context-to-simple-mode
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
    - applyTo: FILTER_CHAIN
      match:
        context: GATEWAY
        listener:
          portNumber: 8443
      patch:
        operation: MERGE
        value:
          transport_socket:
            name: envoy.transport_sockets.tls
            typed_config:
              '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
              common_tls_context:
                combined_validation_context:
                  default_validation_context: {}
                  validation_context_sds_secret_config:
                    name: kubernetes://api-mtls-cacert
                    sds_config:
                      ads: {}
                      resource_api_version: V3

尝试过的无效配置 #

IstioOperator配置 #

spec:
  meshConfig:
    defaultConfig:
      gatewayTopology:
        forwardClientCertDetails: ALWAYS_FORWARD_ONLY

无效的EnvoyFilter配置 #

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: xfcc-forward
  namespace: xfcc
spec:
  configPatches:
  - applyTo: NETWORK_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: "envoy.http_connection_manager"
    patch:
      operation: MERGE
      value:
        typed_config:
          "@type": "type.googleapis.com/envoy.config.filter.network.http_connection_manager.v2.HttpConnectionManager"
          forward_client_cert_details: ALWAYS_FORWARD_ONLY
          set_current_client_cert_details:
            subject: true
            cert: true
            chain: true

可行的配置方案 #

需要针对IngressGateway的HTTP连接管理器添加正确的证书转发配置，注意使用v3版本的API，并确保配置作用于正确的组件：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: xfcc-full-chain-forward
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
    - applyTo: NETWORK_FILTER
      match:
        context: GATEWAY
        listener:
          portNumber: 8443
          filterChain:
            filter:
              name: "envoy.filters.network.http_connection_manager"
      patch:
        operation: MERGE
        value:
          typed_config:
            "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
            forward_client_cert_details: ALWAYS
            set_current_client_cert_details:
              subject: true
              cert: true
              chain: true
              hash: true

关键说明 #

• 使用envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager（v3 API）替代v2版本，适配Istio 1.10+的Envoy版本
• forward_client_cert_details设置为ALWAYS，确保始终转发客户端证书信息
• set_current_client_cert_details中chain: true开启完整证书链的转发
• 匹配条件指定portNumber: 8443，确保只作用于HTTPS网关端口
• 配置放在istio-system命名空间，匹配IngressGateway的workload标签

内容的提问来源于stack exchange，提问作者wael mashal