Alibaba Cloud Service Mesh:Configure mTLS for a gRPC service on an ingress gateway

Create the Gateway

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, find the ASM instance that you want to configure, and click the instance name or click Manage in the Actions column.

3. Create an Istio gateway.

   1. In the left-side navigation pane, choose ASM Gateways > Gateway.

   2. On the Gateway page, click Create from YAML.

   3. Select default from the Namespace drop-down list, copy the following YAML code to the code editor, and click Create.

      apiVersion: networking.istio.io/v1beta1
      kind: Gateway
      metadata:
        name: gw-grpc-443
        namespace: default
      spec:
        selector:
          istio: ingressgateway
        servers:
          - hosts:
              - '*'
            port:
              name: https
              number: 443
              protocol: HTTPS
            tls:
              credentialName: example-credential
              mode: MUTUAL

4. Key fields:

   Field	Value	Description
   tls.mode	MUTUAL	Enables mTLS. The gateway requires a valid client certificate for every connection.
   tls.credentialName	example-credential	References the Kubernetes Secret that stores the server certificate and the CA certificate for client verification. You create this Secret in Step 4.

Create the VirtualService

1. In the left-side navigation pane of the ASM instance, choose Traffic Management Center > VirtualService.

2. On the VirtualService page, click Create from YAML.

3. Select default from the Namespace drop-down list, copy the following YAML code to the code editor, and click Create.

   This VirtualService routes all traffic arriving on port 443 through the gw-grpc-443 Gateway to the istio-grpc-server backend.

   apiVersion: networking.istio.io/v1alpha3
   kind: VirtualService
   metadata:
     name: grpc-vs
   spec:
     hosts:
     - "*"
     gateways:
     - gw-grpc-443
     http:
       - match:
           - port: 443
         route:
           - destination:
               host: istio-grpc-server

Generate test certificates

For testing, generate a self-signed CA and the required server and client certificates. Run the following commands:

# Create a directory for the certificates
mkdir -p example_certs && cd example_certs

# Generate a self-signed CA certificate
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 \
  -subj '/O=example Inc./CN=example.com' \
  -keyout ca.key -out ca.crt

# Generate a server certificate signed by the CA
openssl req -newkey rsa:2048 -nodes \
  -subj '/CN=x.test.example.com/O=server' \
  -keyout server_key.pem -out server.csr
openssl x509 -req -sha256 -days 365 \
  -CA ca.crt -CAkey ca.key -set_serial 0 \
  -in server.csr -out server_cert.pem

# Generate a client certificate signed by the same CA
openssl req -newkey rsa:2048 -nodes \
  -subj '/CN=x.test.example.com/O=client' \
  -keyout client_key.pem -out client.csr
openssl x509 -req -sha256 -days 365 \
  -CA ca.crt -CAkey ca.key -set_serial 1 \
  -in client.csr -out client_cert.pem

Alternatively, use the sample certificates from the grpc-go examples.

Mount certificates for ASM versions earlier than 1.17

Run the following kubectl command to create a Secret in the istio-system namespace, where the ingress gateway runs:

kubectl create -n istio-system secret generic example-credential \
  --from-file=tls.key=server_key.pem \
  --from-file=tls.crt=server_cert.pem \
  --from-file=ca.crt=client_ca_cert.pem

The following table describes the Secret keys:

Mount certificates for ASM version 1.17 or later

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Certificate Management.

3. On the Certificate Management page, click Create. In the Certificate Information panel, configure the required parameters and click OK.

Install dependencies

Set up the Go gRPC development environment. See Quick start of gRPC in Go.

Clone the sample repository

Clone the grpc-go repository, which includes sample certificates and the helloworld example:

git clone https://github.com/grpc/grpc-go.git

The sample certificates are located at grpc-go/examples/data/x509/.

Update the client code

Replace the content of grpc-go/examples/helloworld/greeter_client/main.go with the following code. Set the addr flag to <ingress-gateway-ip>:443.

/*
 *
 * Copyright 2015 gRPC authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 */

// Package main implements a client for Greeter service.
package main

import (
    "context"
    "crypto/tls"
    "crypto/x509"
    "flag"
    "io/ioutil"
    "log"
    "time"

    "google.golang.org/grpc"
    "google.golang.org/grpc/credentials"
    pb "google.golang.org/grpc/examples/helloworld/helloworld"
)

const (
    defaultName = "world"
)

var (
    addr       = flag.String("addr", "localhost:50051", "the address to connect to")
    name       = flag.String("name", defaultName, "Name to greet")
    cert       = flag.String("cert", "./data/x509/client_cert.pem", "server cert for mTLS")
    key        = flag.String("key", "./data/x509/client_key.pem", "server key for mTLS")
    cacert     = flag.String("cacert", "./data/x509/ca_cert.pem", "ca cert for mTLS")
    servername = flag.String("servername", "x.test.example.com", "the cert name of server")
)

func main() {
    flag.Parse()

    // Load client certificate and private key
    certPair, err := tls.LoadX509KeyPair(*cert, *key)
    if err != nil {
        log.Fatalf("failed to load client cert: %v", err)
    }

    // Load CA certificate to verify the server
    ca := x509.NewCertPool()
    caFilePath := *cacert
    caBytes, err := ioutil.ReadFile(caFilePath)
    if err != nil {
        log.Fatalf("failed to read ca cert %q: %v", caFilePath, err)
    }
    if ok := ca.AppendCertsFromPEM(caBytes); !ok {
        log.Fatalf("failed to parse %q", caFilePath)
    }

    tlsConfig := &tls.Config{
        ServerName:   *servername,
        Certificates: []tls.Certificate{certPair},
        RootCAs:      ca,
    }

    // Establish a gRPC connection with mTLS credentials
    conn, err := grpc.Dial(*addr, grpc.WithTransportCredentials(credentials.NewTLS(tlsConfig)))
    if err != nil {
        log.Fatalf("did not connect: %v", err)
    }
    defer conn.Close()
    c := pb.NewGreeterClient(conn)

    // Send an RPC and print the response
    ctx, cancel := context.WithTimeout(context.Background(), time.Second)
    defer cancel()
    r, err := c.SayHello(ctx, &pb.HelloRequest{Name: *name})
    if err != nil {
        log.Fatalf("could not greet: %v", err)
    }
    log.Printf("Greeting: %s", r.GetMessage())
}

Replace the following placeholder with your actual value:

Run the client

Navigate to the grpc-go/examples directory and run:

go run helloworld/greeter_client/main.go -addr <ingress-gateway-ip>:443

Expected output:

Greeting: Hello World

Negative test with curl

Run the following command without a client certificate. Replace <ingress-gateway-ip> with the public IP address of your ingress gateway:

curl -v --cacert ca.crt \
  https://<ingress-gateway-ip>:443

Expected result: The TLS handshake fails with an error similar to certificate required or tlsv13 alert certificate required. This confirms the gateway rejects unauthenticated clients.

Positive test with curl

Run the following command with a valid client certificate:

curl -v --cacert ca.crt \
  --cert client_cert.pem --key client_key.pem \
  https://<ingress-gateway-ip>:443

Expected result: The TLS handshake succeeds and the gateway accepts the connection.