Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

zh-translation: /docs/tasks/security/authentication/mtls-migration/index.md #7421

Merged
merged 2 commits into from
Jul 3, 2020
Merged

zh-translation: /docs/tasks/security/authentication/mtls-migration/index.md #7421

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2526652
Update zh translation for 1985
6boris May 28, 2020
bc5f55c
Update zh translation 1985
6boris May 28, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions content/zh/docs/tasks/security/authentication/mtls-migration/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,6 +125,16 @@ sleep.bar to httpbin.foo: 200
sleep.legacy to httpbin.foo: 503
{{< /text >}}

如果你安装 Istio 时带有参数 `values.global.proxy.privileged=true`，那么你可以使用 `tcpdump` 来验证流量是否被加密。

{{< text bash >}}
$ kubectl exec -nfoo "$(kubectl get pod -nfoo -lapp=httpbin -ojsonpath={.items..metadata.name})" -c istio-proxy -it -- sudo tcpdump dst port 80 -A
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
{{< /text >}}

当分别从 `sleep.legacy` 和 `sleep.foo` 发送请求时，您将在输出中看到纯文本和加密文本。

若无法将所有服务迁移至 Istio （注入 Envoy sidecar），则必须开启 `PERMISSIVE` 模式。
然而，开启 `PERMISSIVE` 模式时，系统默认不对明文请求进行认证或授权检查。
推荐使用 [Istio 授权](/zh/docs/tasks/security/authorization/authz-http/)来为不同的请求路径配置不同的授权策略。
Expand Down