Istio JWT verification against JWKS with internally signed certificate

Question

I'm attempting to configure Istio authentication policy to validate our JWT.

I set the policy and can see it takes affect. However it won't allow anything to connect. When applying the policy if I inspect the istio-pilot logs I can see it failing to retrieve the signing keys, giving a certificate error.

2018-10-24T03:22:41.052354Z error   model   Failed to fetch pubkey from "https://iam.company.com.au/oauth2/jwks":  Get https://iam.company.com.au/oauth2/jwks:  x509: certificate signed by unknown authority
2018-10-24T03:22:41.052371Z warn    Failed to fetch jwt public key from "https://iam.company.com.au/oauth2/jwks "

This I assume would be due to this server using a TLS certificate signed by our corporate CA.

How do I get istio-pilot to trust certs from our CA? I have tried installing ca-certificates and including our CA public key in the Ubuntu certificates but it still won't work.

Policy:

apiVersion: "authentication.istio.io/v1alpha1"
kind: "Policy"
metadata:
  name: "our-service-jwt-example"
spec:
  targets:
  - name: our-service
  origins:
  - jwt:
      issuer: iam.company.com.au
      audiences:
      - YRhT8xWtcLrOQmqJUGPA1p6O6mUa
      jwksUri: "https://iam.company.com.au/oauth2/jwks"
  principalBinding: USE_ORIGIN

user_3176125 · Answer

Pilot does the jwks resolving for the envoy. In that case, pilot needs to have the CA certificate. At the moment there is no way to add a CA cert to the pilot unless you add the cert when deploying pilot in the istio. https://github.com/istio/istio/blob/master/pilot/pkg/model/jwks_resolver.go

user_1746556 · Answer

This has been added as of Istio 1.4:

https://github.com//istio/istio/pull/17176

You can provide an extra root certificate in PEM format in the pilot.jwksResolverExtraRootCA helm chart value (also works with IstioOperator for more recent versions of Istio) and it will create a ConfigMap containing an extra.pem file that should get mounted into the istio pilot container as /cacerts/extra.pem. From there it should get picked up automatically.

Istio JWT verification against JWKS with internally signed certificate

2 Answers