Authorization Policies having unexpected results on istio-1.9.0

Networking
1

Before I begin, I’m fairly new to Kubernetes and Istio so please keep in mind that I might be overlooking something simple.

What I want:
To deny access to all pods in a namespace (testing) from all external IP’s.

What I’ve tried:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: “block-non-local-subnets”
namespace: testing
spec:
action: DENY
rules:

  • from:
    • source:
      ipBlocks: [“0.0.0.0/0”]
      notIpBlocks: [“19.40.0.0/16”]

After applying that, I could still access everything in my testing namespace. So I tried the example listed here:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: deny-all
namespace: testing
spec:
{}

Again, everything to the namespace is allowed. Here’s a line from Envoy’s log:
[2021-02-22T18:42:13.934Z] “GET /links/ HTTP/2” 304 - via_upstream - “-” 0 0 4 3 “my pc’s IP” …
(I can’t post the rest of this line because it has various IP’s and this site tells me that new users can’t post more than 4 links)

It does work if I put it in the istio-system namespace:
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: “block-non-local-subnets”
namespace: istio-system
spec:
selector:
matchLabels:
app: istio-ingressgateway
action: DENY
rules:

  • from:
    • source:
      notIpBlocks: [“192.168.15.0/24”, “10.200.200.0/24”, “192.168.5.0/24”]

But then this blocks all access across every namespace.

2

I solved this. There were two issues:

  1. notIpBlocks did not work. I had to use notRemoteIpBlocks. I got lucky and it seems like I needed no extra configuration. Perhaps my loadbalancer (metallb?) supports the remote.ip header automatically. I’d love for someone to give some incite on this.

  2. The most important step is enabling automatic istio sidecar injection on the namespace. This was the key to getting any authorization policy to work at all in the namespace. This is not listed anywhere in the doc for authorization policies. I’d highly recommend this get added.