You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "qwzhou89 (via GitHub)" <gi...@apache.org> on 2023/07/12 09:11:26 UTC
[GitHub] [apisix] qwzhou89 opened a new issue, #9823: help request: Is mTLS between APISIX and upstream supported inside stream_proxy?
qwzhou89 opened a new issue, #9823:
URL: https://github.com/apache/apisix/issues/9823
### Description
The mTLS between APISIX and upstream is already supported inside http_proxy and I configured it. I would like to ask if the mtls configuration is still not supported inside stream_proxy?
Referring to the document https://apisix.apache.org/zh/docs/apisix/2.13/stream-proxy/, I have configured stream_proxy, and I can already have normal mtls communication between client and apisix, but in the communication between apisix and upstream, although upstream is not supported, I can still use mtls. However, in the communication between apisix and upstream, even though client_cert and client_key are configured in upstream, the authorization error still occurs in upstream.
### Environment
- APISIX version (run `apisix version`):2.15.3
- Operating system (run `uname -a`):Linux k8s-m-2 4.19.225-0419225-generic #202201110859 SMP Tue Jan 11 14:15:40 UTC 2022 x86_64 GNU/Linux
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Revolyssup commented on issue #9823: help request: Is mTLS between APISIX and upstream supported inside stream_proxy?
Posted by "Revolyssup (via GitHub)" <gi...@apache.org>.
Revolyssup commented on issue #9823:
URL: https://github.com/apache/apisix/issues/9823#issuecomment-1632669576
Can you provide the configuration used and the details of the authorization error?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] github-actions[bot] commented on issue #9823: help request: Is mTLS between APISIX and upstream supported inside stream_proxy?
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #9823:
URL: https://github.com/apache/apisix/issues/9823#issuecomment-1678692574
This issue has been closed due to lack of activity. If you think that is incorrect, or the issue requires additional review, you can revive the issue at any time.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] qwzhou89 commented on issue #9823: help request: Is mTLS between APISIX and upstream supported inside stream_proxy?
Posted by "qwzhou89 (via GitHub)" <gi...@apache.org>.
qwzhou89 commented on issue #9823:
URL: https://github.com/apache/apisix/issues/9823#issuecomment-1654858135
> can you share more detail ?
>
> ```
> client <- mtls -> apisix <-mtls-> upstream (tcp)
> ```
I read the source code of apisix, it should be in the stream proxy, the mtls between apisx and upstream is not yet supported, that is, even if the apisix side is equipped with cert and key to communicate with upstream, it does not work.
But nginx itself supports it, so if there is only 1 upstream, which is fixed, then it can be achieved by combining stream_configuration_snippet.
Inside stream_configuration_snippet with upstream cert and key, then you can do mtls communication.
```yaml
stream_configuration_snippet: |
proxy_ssl on;
# ssl_upstream1_client.crt/key，配置的stream_routes里面upsteam的client证书和私钥。
# 如果是自签名的证书，那么需要把ca证书放到ca-bundle里面。
proxy_ssl_certificate cert/ssl_upstream1_client.crt;
proxy_ssl_certificate_key cert/ssl_upstream1_client.key;
proxy_ssl_trusted_certificate ssl/ca-bundle;
```
If there are multiple upstreams with different certificates, then you have to wait for apisix support. Or you can just configure the stream, ports and certificates yourself like nginx, without apisix configuration at all.
```yaml
stream_configuration_snippet: |
# Add custom Nginx stream configuration to nginx.conf.
# The configuration should be well indented!
upstream k8st1apisever {
server 192.168.11.1:6443;
server 192.168.11.2:6443;
server 192.168.11.3:6443;
}
server {
listen 7443 ssl reuseport;
ssl_certificate cert/server-k8st1-self.cer;
ssl_certificate_key cert/server-k8st1-self.key;
ssl_trusted_certificate ssl/ca-bundle;
proxy_pass k8st1apisever;
proxy_ssl on;
proxy_ssl_certificate cert/k8st1-client.crt;
proxy_ssl_certificate_key cert/k8st1-client.key;
proxy_ssl_trusted_certificate ssl/ca-bundle;
proxy_ssl_server_name on;
proxy_ssl_name "192.168.11.1";
}
# 另一个upstream和server的配置，证书，端口都不同。
upstream k8st2apisever {
server 192.168.12.1:6443;
server 192.168.12.2:6443;
server 192.168.12.3:6443;
}
server {
listen 8443 ssl reuseport;
ssl_certificate cert/server-k8st2-self.cer;
ssl_certificate_key cert/server-k8st2-self.key;
ssl_trusted_certificate ssl/ca-bundle;
proxy_pass k8st1apisever;
proxy_ssl on;
proxy_ssl_certificate cert/k8st2-client.crt;
proxy_ssl_certificate_key cert/k8st2-client.key;
proxy_ssl_trusted_certificate ssl/ca-bundle;
proxy_ssl_server_name on;
proxy_ssl_name "192.168.12.2";
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] github-actions[bot] commented on issue #9823: help request: Is mTLS between APISIX and upstream supported inside stream_proxy?
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #9823:
URL: https://github.com/apache/apisix/issues/9823#issuecomment-1675826192
Due to lack of the reporter's response this issue has been labeled with "no response". It will be close in 3 days if no further activity occurs. If this issue is still relevant, please simply write any comment. Even if closed, you can still revive the issue at any time or discuss it on the dev@apisix.apache.org list. Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] qwzhou89 commented on issue #9823: help request: Is mTLS between APISIX and upstream supported inside stream_proxy?
Posted by "qwzhou89 (via GitHub)" <gi...@apache.org>.
qwzhou89 commented on issue #9823:
URL: https://github.com/apache/apisix/issues/9823#issuecomment-1646546624
> sorry I not very unstander "although upstream is not supported, I can still use mtls. "
>
Sorry, I misspoke. What I meant to say was
According to the
https://apisix.apache.org/zh/docs/apisix/next/admin-api/#route-request-body-parameters
There is no way to set client_cert and client_key inside the upstream in the route.
If we use upstream_id then according to
https://apisix.apache.org/zh/docs/apisix/next/admin-api/#upstream-body-request-methods
I can set tls.client_cert, tls.client_key inside upstream object.
So, I am not configuring stream_routes like the
https://apisix.apache.org/zh/docs/apisix/next/stream-proxy/#%E4%BB%A3%E7%90%86%E5%88%B0-tls-over-tcp-%E4%B8%8A%E6%B8%B8
configured an upstream object , but rather configured the upstream_id
> can you share more detail ?
>
> ```
> client <- mtls -> apisix <-mtls-> upstream (tcp)
> ```
>
In stream-proxy ，Inside `apisix <-mtls-> upstream,` how do I configure mtls on the apisix side?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] Sn0rt commented on issue #9823: help request: Is mTLS between APISIX and upstream supported inside stream_proxy?
Posted by "Sn0rt (via GitHub)" <gi...@apache.org>.
Sn0rt commented on issue #9823:
URL: https://github.com/apache/apisix/issues/9823#issuecomment-1643322636
sorry I not very unstander "although upstream is not supported, I can still use mtls. "
can you share more detail ?
```
client <- mtls -> apisix <-mtls-> upstream (tcp)
```
1. paste the error info
2. how the traffic passthough
...
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] github-actions[bot] closed issue #9823: help request: Is mTLS between APISIX and upstream supported inside stream_proxy?
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed issue #9823: help request: Is mTLS between APISIX and upstream supported inside stream_proxy?
URL: https://github.com/apache/apisix/issues/9823
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [apisix] qwzhou89 commented on issue #9823: help request: Is mTLS between APISIX and upstream supported inside stream_proxy?
Posted by "qwzhou89 (via GitHub)" <gi...@apache.org>.
qwzhou89 commented on issue #9823:
URL: https://github.com/apache/apisix/issues/9823#issuecomment-1641848696
> Can you provide the configuration used and the details of the authorization error?
This one is more difficult.
Let me ask the question differently.
https://apisix.apache.org/docs/apisix/stream-proxy/#proxy-to-tls-over-tcp-upstream
It's written inside the document linked above:
>APISIX also supports proxying to TLS over TCP upstream.
>
```shell
curl http://127.0.0.1:9180/apisix/admin/stream_routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
"upstream": {
"scheme": "tls",
"nodes": {
"127.0.0.1:1995": 1
},
"type": "roundrobin"
}
}'
```
>By setting the scheme to "tls", APISIX will do TLS handshake with the upstream.
I would like to know if it supports configuring client_key and client_cert to be used for mtls communication with upstream? If it does, how do I configure it, like this?
```shell
curl http://127.0.0.1:9180/apisix/admin/stream_routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
"upstream": {
"scheme": "tls",
"nodes": {
"127.0.0.1:1995": 1
},
"tls": {
"client_cert": "YOUR UPSTREAM CLIENT CERT",
"client_key": "YOUR UPSTREAM CLIENT KEY"
},
"type": "roundrobin"
}
}'
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org