Peer Authentication for workload without sidecar

Security
1

kubernetes version 1.17
istio version 1.5.2

we are currently bringing up 1 workload without sidecar and remaining 3 workload with sidecar in a same namespace.
And we have created peerauthentication for all the 4 work-loads.
Want to know whether setting peerauthentication to PERMISSIVE on the workload without sidecar will have any effect on traffic from and to this workload.

2

cc @YangminZhu, @incfly take a look.

please whether setting peerauthentication to PERMISSIVE on the workload without sidecar will have any effect on traffic from and to this workload.

3

No. Policy either peer authentication or the authorization only enforce at the workloads with sidecar. otherwise Istio can’t control the enforcement point.

4

hi @incfly,

is it applicable to service entry also ?? (For workload without sidecar).