Istio RBAC - v1.1.5 - K8S

Security
1

Hello,
I am using Istio v1.1.5 on GKE.
I deployed manually Istio using the helm chart and I am trying to setup the RBAC (https://istio.io/docs/reference/config/authorization/istio.rbac.v1alpha1/).
I have created the ClusterRbacConfig

    apiVersion: "rbac.istio.io/v1alpha1"
    kind: ClusterRbacConfig
    metadata:
      name: default
    spec:
      mode: 'ON'

However I can still access all my services.

I already tried to follow many suggestions:

  • enable MTLS
  • create destination rule with ISTIO_MUTUAL (got a code 56 error)
  • etc.

I am not yet working on ServiceRole/ServiceRoleBinding, what I would like as the moment is to get the Access Denied error if I call any of my services.

Thanks for your help.

2

AFAIK, you don’t need to turn on authentication if you just want to see access denied error. Could you try this first and see what went wrong? https://istio.io/help/ops/security/debugging-authorization/

3

So basically, I tried all of that but nothing worked on my cluster.
Therefore, I tried on a fresh cluster and it works well.
So I guess it’s a config problem on my end. I am gonna dig a bit more.
Thanks! :wink:

4

Glad it works now :slight_smile: