Istio + SPIRE 통합 실전 가이드: SVID 자동 발급부터 멀티 클러스터 페더레이션까지

# SVID 인증서의 SAN 필드를 직접 확인
openssl x509 -in svid.pem -text -noout | grep -A2 "Subject Alternative Name"
# 출력 예시:
# X509v3 Subject Alternative Name:
#     URI:spiffe://cluster-a.example.com/ns/prod/sa/payment-service

┌─────────────────────────────────────────────────────────────┐
│  Kubernetes Pod                                             │
│  ┌──────────────┐  SDS/UNIX Socket  ┌──────────────────┐   │
│  │  Envoy Proxy │◄────────────────  │  SPIRE Agent     │   │
│  │  (Sidecar)   │  SVID X.509 cert  │  (DaemonSet)     │   │
│  └──────────────┘                   └──────┬───────────┘   │
└─────────────────────────────────────────────│───────────────┘
                                              │ gRPC (Node Attestation
                                              │ + SVID 서명 요청)
                                   ┌──────────▼──────────┐
                                   │  SPIRE Server       │
                                   │  (StatefulSet)      │
                                   │  ClusterSPIFFEID    │
                                   │  (Controller Mgr)   │
                                   └─────────────────────┘

cluster-a                              cluster-b
SPIRE Server ──── Bundle Exchange ──── SPIRE Server
(port 8443)     (루트 CA 자동 교환)     (port 8443)
     │                                      │
     ▼                                      ▼
Workload A                            Workload B
spiffe://cluster-a.../sa/frontend  spiffe://cluster-b.../sa/payment
          └──────── mTLS 수립 가능 ──────────┘

helm install spire spire/spire \
  --namespace spire-system \
  --set global.trustDomain="cluster.local" \
  --set spire-controller-manager.enabled=true \
  --set spiffe-csi-driver.enabled=true

kubectl get pods -n spire-system
# 기대 출력: spire-server, spire-agent(DaemonSet), spiffe-csi-driver 모두 Running

# istio-operator.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  meshConfig:
    defaultConfig:
      proxyMetadata:
        # Envoy가 SPIRE Agent 소켓을 SDS 소스로 인식하는 핵심 설정
        SPIFFE_ENDPOINT_SOCKET: "unix:///run/secrets/workload-spiffe-credentials/socket"
        PROXY_CONFIG_XDS_AGENT: "true"
  values:
    global:
      pilotCertProvider: "spire"  # Istiod가 SPIRE를 인증서 제공자로 인식
      sds:
        token:
          aud: istio-ca
  components:
    pilot:
      k8s:
        env:
          - name: ENABLE_CA_SERVER
            value: "false"

# ConfigMap: istio-sidecar-injector
spec:
  containers:
  - name: istio-proxy
    env:
    - name: SPIFFE_ENDPOINT_SOCKET
      value: "unix:///run/secrets/workload-spiffe-credentials/socket"
    volumeMounts:
    - name: workload-socket
      mountPath: /run/secrets/workload-spiffe-credentials
  volumes:
  - name: workload-socket
    csi:
      driver: "csi.spiffe.io"
      readOnly: true

apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterSPIFFEID
metadata:
  name: istio-workloads
spec:
  spiffeIDTemplate: "spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"
  podSelector:
    matchLabels:
      security.istio.io/tlsMode: "istio"
  workloadSelectorTemplates:
    - "k8s:ns:{{ .PodMeta.Namespace }}"
    - "k8s:sa:{{ .PodSpec.ServiceAccountName }}"

# SPIRE Server Pod 이름 조회 후 등록된 entry 확인
SPIRE_POD=$(kubectl get pod -n spire-system -l app=spire-server -o name | head -1)
kubectl exec -n spire-system $SPIRE_POD -- \
  /opt/spire/bin/spire-server entry show
# 출력: spiffe://cluster.local/ns/prod/sa/payment-service 등 자동 등록 확인

# spire-server.conf (cluster-a)
# 단순화된 예시 — 운영 환경에서는 datastore, key_manager, notifier 블록 추가 필요
server {
  trust_domain = "cluster-a.example.com"
 
  federation {
    bundle_endpoint {
      address = "0.0.0.0"
      port    = 8443
    }
    federates_with "cluster-b.example.com" {
      bundle_endpoint_url = "https://spire-server.cluster-b.svc:8443"
      bundle_endpoint_profile "https_spiffe" {
        endpoint_spiffe_id = "spiffe://cluster-b.example.com/spire/server"
      }
    }
  }
}

SPIRE_POD=$(kubectl get pod -n spire-system -l app=spire-server -o name | head -1)
kubectl exec -n spire-system $SPIRE_POD -- \
  /opt/spire/bin/spire-server bundle list
# 출력: cluster-b.example.com 번들이 정상 교환되었는지 확인

apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterFederatedTrustDomain
metadata:
  name: cluster-b-federation
spec:
  trustDomain: "cluster-b.example.com"
  bundleEndpointURL: "https://spire-server.cluster-b.svc:8443"
  bundleEndpointProfile:
    type: HTTPSSPIFFEAuthentication
    endpointSPIFFEID: "spiffe://cluster-b.example.com/spire/server"

apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterSPIFFEID
metadata:
  name: cross-cluster-workload
spec:
  spiffeIDTemplate: "spiffe://cluster-a.example.com/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"
  federatesWith:
    - "cluster-b.example.com"

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-cluster-b-workloads
spec:
  rules:
  - from:
    - source:
        principals:
          - "spiffe://cluster-b.example.com/ns/prod/sa/payment-service"

Root SPIRE Server (Global)
       │ X.509 발급 (Intermediate CA)
       ├── Intermediate SPIRE Server (cluster-a)
       │         └── Workload SVIDs (X.509 + JWT)
       │
       └── Intermediate SPIRE Server (cluster-b)
                 └── Workload SVIDs (X.509 + JWT)

# intermediate-spire-server.conf (cluster-a)
# 단순화된 예시 — 운영 환경에서는 datastore, key_manager 블록 추가 필요
UpstreamAuthority "spire" {
  plugin_data {
    server_address     = "root-spire-server.spire-root.svc"
    server_port        = 8081
    workload_api_socket_path = "/tmp/spire-agent/public/api.sock"
  }
}