Istio AuthN policy for Service deployed in a different namespace

1

Hi,

This is my service deployment config.

apiVersion: v1
kind: Service
metadata:
  name: myservice
  namespace: test
  labels:
    app: test-app
spec:
  type: NodePort
  selector:
    app: test-app
  ports:
  - port: 8080
    protocol: TCP
    targetPort: 8080
    name: http

and Istio’s authN policy is deployed in a separate namespace istio-system. This is the config -

apiVersion: "authentication.istio.io/v1alpha1"
kind: "Policy"
metadata:
  name: authn-policy
  namespace: istio-system
spec:
  targets:
  - name: myservice
  origins:
  - jwt:
      issuer: "https://identity.oraclecloud.com/"
      jwksUri: "https://idcs-test.identity.oraclecloud.com/admin/v1/SigningCert/jwk"
  principalBinding: USE_ORIGIN

With this configuration , I can access the end-point without authorization (no token being passed). Is this because the target specification for the service myservice is unable to look outside istio-system namespace.

What is the right way to construct the AuthN-policy filter in this case ?

Appreciate any quick help.

2

Hi @YangminZhu, would you be able to help out on how to reference services deployed in a different namespace ?

3

Infact I tried deploying mesh-wide policy as below -

apiVersion: "authentication.istio.io/v1alpha1"
kind: "MeshPolicy"
metadata:
  name: default
  namespace: istio-system
spec:
  origins:
  - jwt:
      issuer: "https://identity.oraclecloud.com/"
      jwksUri: "https://idcs-test.identity.c9dev1.oc9qadev.com/admin/v1/SigningCert/jwk"
  principalBinding: USE_ORIGIN

But there is no effect. I can still access the rest end-point without passing the bearer token.

4

Having said this, when I created EnvoyFilter as below, I was restricted from accessing my rest end-point.

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: edge-jwt-authn
spec:
  workloadLabels:
    app: istio-ingressgateway
  filters:
  - listenerMatch:
      portNumber: 443
      listenerType: GATEWAY
    filterName: envoy.filters.http.jwt_authn
    filterType: HTTP
    filterConfig:
      providers:
        provider_idcs:
          issuer: https://identity.oraclecloud.com/
          local_jwks:
            inline_string: '<JWK>'
      rules:
      - match:
          prefix: /
        requires:
          provider_name: provider_idcs
5

For your first policy authn-policy, it should be added in the same namespace as the service which is test to make it work.

For your second mesh policy, you don’t need to specify the namespace because it’s cluster-scope resource. It should work and I guess there might be another authN policy in the test namespace that actually overrides its effect.