Hi,
I’m setting up a cluster with istio autoinject enabled on the whole namespace. In addition I also created an extra pod (a nginx container) which does not have any sidecar (I manually deactivated it from this pod adding an annotation). I then enforced mTLS communication in the name space through the policy:
apiVersion: “security.istio.io/v1beta1”
kind: “PeerAuthentication”
metadata:
name: mtld-demo
namespace: demo
spec:
selector: {}
mtls:
mode: STRICT
Analyzing the traffic I noticed the pod without sidecar is still able to receive the traffic from the other pods. (I also verified that it is not able to send traffic to the other pods as expected)
Is this the intended behaviour or I could have some missconfiguration in my environment?
If yes, does this mean that the mTLS is enforced only from the receiver side of the communication?
Thanks