Hi,
I installed Istio 1.1.2 in GKE cluster 1.12. It’s a new install.
I configured 2 clusters in multicluster configuration, one cluster with master control plane and second has minimul istio configuration.
Service discover works ok between clusters ( I can curl from pods across clusters ).
Then I want to test authorization, and it’s not fully working ( on single and multi cluster ) when I try to apply an authorization to specific service account.
what am I missing again… ? 
My goal is to authorize only deployment a to talk to service b-svc
Authorization is enabled, and I get access denied it’s all fine.
I can also authorize a to all others with user: "*"
I can then curl from all deployment pods to b-svc
example :
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRole
metadata:
name: b
namespace: default
spec:
rules:
- services: ["b-svc.default.svc.cluster.local"]
methods: ["GET"]
---
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRoleBinding
metadata:
name: a-b
namespace: default
spec:
subjects:
- user: "*"
roleRef:
kind: ServiceRole
name: b
but authorization is not working ( I still get access denied when trying to curl from pod a to service b-svc ) when I implement the user field with either :
user: “a-sa”
or
user: “cluster.local/ns/default/sa/a-sa”
Example :
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRole
metadata:
name: b
namespace: default
spec:
rules:
- services: ["b-svc.default.svc.cluster.local"]
methods: ["GET"]
---
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRoleBinding
metadata:
name: a-b
namespace: default
spec:
subjects:
- user: "cluster.local/ns/default/sa/a-sa"
roleRef:
kind: ServiceRole
name: b
Any ideas ?
I checked the dumps of proxy in a and b
a doesn’t get updated
b got updated with :
"name": "envoy.filters.http.rbac",
"config": {
"rules": {
"policies": {
"b": {
"permissions": [
{
"and_rules": {
"rules": [
{
"or_rules": {
"rules": [
{
"header": {
"exact_match": "GET",
"name": ":method"
My services :
francois_nature@cloudshell:~/myscripts/istio/abcd (still-freedom-234411)$ cat a-svc.yaml
apiVersion: v1
kind: Service
metadata:
name: a-svc
spec:
type: ClusterIP
ports:
- port: 80
name: http
selector:
name: a
francois_nature@cloudshell:~/myscripts/istio/abcd (still-freedom-234411)$ cat b-svc.yaml
apiVersion: v1
kind: Service
metadata:
name: b-svc
spec:
type: ClusterIP
ports:
- port: 80
name: http
selector:
name: b
roles and bindings :
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRole
metadata:
name: b
namespace: default
spec:
rules:
- services: ["b-svc.default.svc.cluster.local"]
methods: ["GET"]
---
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRoleBinding
metadata:
name: a-b
namespace: default
spec:
subjects:
- user: "cluster.local/ns/default/sa/a-sa"
roleRef:
kind: ServiceRole
name: b
deployment and service account
francois_nature@cloudshell:~/myscripts/istio/abcd (still-freedom-234411)$ cat a-p.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: a-sa
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: a
spec:
replicas: 1
template:
metadata:
labels:
name: a
spec:
serviceAccountName: a-sa
containers:
- name: a
image: fnature/ngnix-curl:1
ports:
- containerPort: 80
name: http
volumeMounts:
- name: html
mountPath: /usr/share/nginx/html/
volumes:
- name: html
configMap:
name: res-clust1
items:
- key: message
path: index.html