Istio ingressgateway 静态TLS证书加载与SDS发现方式配置区别

静态挂载模式

ingressgateway的deployment中默认将名为istio-ingressgateway-certs的secret mount到/etc/istio/ingressgateway-certs下 ，然后在gateway中指明对应的crt及key的文件路径

pod volume来源：

  - name: ingressgateway-certs
    secret:
      defaultMode: 420
      optional: true
      secretName: istio-ingressgateway-certs
  - name: ingressgateway-ca-certs
    secret:
      defaultMode: 420
      optional: true
      secretName: istio-ingressgateway-ca-certs

mount到目录：

    - mountPath: /etc/istio/ingressgateway-certs
      name: ingressgateway-certs
      readOnly: true
    - mountPath: /etc/istio/ingressgateway-ca-certs
      name: ingressgateway-ca-certs
      readOnly: true

gateway中指定：

    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key

最终产生的envoy配置如下：

         "tlsCertificates": [
                                {
                                    "certificateChain": {
                                        "filename": "/etc/istio/ingressgateway-certs/tls.crt"
                                    },
                                    "privateKey": {
                                        "filename": "[redacted]"
                                    }
                                }
                            ],

动态SDS发现模式

此模式，采用sds从 “unix:/var/run/ingress_gateway/sds” 发现证书。具体做法为，创建一个secret，然后在gateway里直接指定secret名字即可，无需额外mount。

istio-system namespace下的secret：

[root@k8s-master-v1-16 ~]# kubectl get secrets httpbin-credential -n istio-system  -o yaml
apiVersion: v1
data:
  cert: ***
  key: ****
kind: Secret
metadata:
  creationTimestamp: "2020-07-10T14:40:26Z"
  name: httpbin-credential
  namespace: istio-system
  resourceVersion: "32803482"
  selfLink: /api/v1/namespaces/istio-system/secrets/httpbin-credential
  uid: bc543747-7366-4661-9f2e-39ae62e7808a
type: Opaque

gateway里指定credentialName为对应的secret

      tls:
        credentialName: httpbin-credential
        mode: SIMPLE

envoy产生的配置：

                        "commonTlsContext": {
                            "tlsCertificateSdsSecretConfigs": [
                                {
                                    "name": "httpbin-credential",
                                    "sdsConfig": {
                                        "apiConfigSource": {
                                            "apiType": "GRPC",
                                            "grpcServices": [
                                                {
                                                    "googleGrpc": {
                                                        "targetUri": "unix:/var/run/ingress_gateway/sds",
                                                        "statPrefix": "sdsstat"
                                                    }