Istio 1.0.6 - set mtls mode to strict from Helm


Hello, my team recently upgraded our test environment from Istio 1.0.2, to 1.0.6. This ugprade includes the change from 1.0.3 that defaults the mtls mode to permissive in the default mesh policy.

We perform our installation with Helm, pulling the chart down from the Istio Github repo on a clean install. As part of our installation, we require the mtls mode to be set to strict, but I have been unable to find an install option for this.

I’ve been working on using kubectl patch to update the default meshpolicy, but it does not seem to be applied.

I am using the following patch on the default mesh policy

  - mtls:
      mode: STRICT

This is appended to the end of the policy when I do output formatted as yaml, but the actual policy does not appear to have the change made, as I still see the following:

kind: MeshPolicy
  annotations: |

I would expect to see STRICT within the mtls json block at the end.


“peers”:[{“mtls”:{}} is the proper STRICT mode, you can verify it by sending http traffic to it (it should be rejected)