Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

proposal: provide istio mTLS resources

See original GitHub issue

Currently the manifests in release/istio-manifests.yaml are designed for PERMISSIVE mTLS authentication.

If the user sets mTLS is set to STRICT for either the Hipstershop service(s), globally, or for the namespace in which Hipstershop is , frontend (and potentially other services) will not start up due to the Liveness/Readiness probes.

I propose we create Istio manifests for both PERMISSIVE and STRICT mTLS – and instruct users to use the PERMISSIVE manifests by default.

See Bookinfo for an example of how we might separate out the manifests.

Issue Analytics

State:
Created 5 years ago
Comments:11 (6 by maintainers)

Top GitHub Comments

1reaction

askmeegscommented, Sep 17, 2019

Readiness and liveness probes should now work with istio mTLS.

Will address in: https://github.com/GoogleCloudPlatform/microservices-demo/issues/211

0reactions

therealmitchconnorscommented, Mar 25, 2019

we primarily suggest users to try this out with GKE Istio add-on where they can’t customize such values.

For existing deployments, such as Istio on GKE, the way to rewrite probes is to modify the istio-sidecar-injector configmap to set rewriteAppHTTPProbe to true. The primary complication there is that this value appears to have been added in 1.1, and I assume you would like to allow 1.0.x deployments (such as Istio on GKE).

I will investigate the viability of this feature on releases back through whatever Istio on GKE is using.

Top Results From Across the Web

Security Best Practices - Istio

Istio security features provide strong identity, powerful policy, transparent TLS encryption, and authentication, authorization and audit (AAA) tools to ...

How to Secure & Scale Istio Mtls with Enterprise PKI - Keyfactor

If you're making the move to Istio service mesh, there are a lot of things you'll need to consider – security being number...

Securing Istio workloads with mTLS using cert-manager - Venafi

As Kubernetes adoption grows, there is now increased interest in service mesh to securely connect workloads, as well as provide dynamic ...

Anthos Service Mesh by example: mTLS - Google Cloud

With auto mTLS, a client sidecar proxy automatically detects if the server has a sidecar. The client sidecar sends mTLS to workloads with...

Managing Policies and Security with Istio

Incrementally adopting Istio mutual TLS authentication across the service ... how long Google Cloud resources will be made available to you.