Istio

Jump to bottom

Andres Olarte edited this page Aug 9, 2019 · 3 revisions

Sidecar injection

Check config:

kubectl get mutatingwebhookconfiguration istio-sidecar-injector -o yaml

Normally is with inclusion or exclusion:

kubectl label namespace xxxx istio-injection=enabled --overwrite

Istio Ingress

Get Istio Ingress external IP

kubectl get service -n istio-system --field-selector "metadata.name=istio-ingressgateway" -o jsonpath='{.items[].status.loadBalancer.ingress[].ip}'

mTLS

mTLS policies:
- MeshPolicy (mesh scoped, but not multi-tenant friendly)
- Policy (namespace scoped)
- STRICT by default.

Mesh-wide Permissive

apiVersion: "authentication.istio.io/v1alpha1"
kind: "MeshPolicy"
metadata:
  name: "default"
spec:
  peers:
  - mtls: 
      mode: PERMISSIVE