{"action":"created","issue":{"url":"https://api.github.com/repos/istio/istio/issues/8615","repository_url":"https://api.github.com/repos/istio/istio","labels_url":"https://api.github.com/repos/istio/istio/issues/8615/labels{/name}","comments_url":"https://api.github.com/repos/istio/istio/issues/8615/comments","events_url":"https://api.github.com/repos/istio/istio/issues/8615/events","html_url":"https://github.com/istio/istio/issues/8615","id":358983326,"node_id":"MDU6SXNzdWUzNTg5ODMzMjY=","number":8615,"title":"Istio allows to break Kubernetes Namespace isolation when using `Ingress Gateway` and `VirtualService`","user":{"login":"yskopets","id":19395458,"node_id":"MDQ6VXNlcjE5Mzk1NDU4","avatar_url":"https://avatars3.githubusercontent.com/u/19395458?v=4","gravatar_id":"","url":"https://api.github.com/users/yskopets","html_url":"https://github.com/yskopets","followers_url":"https://api.github.com/users/yskopets/followers","following_url":"https://api.github.com/users/yskopets/following{/other_user}","gists_url":"https://api.github.com/users/yskopets/gists{/gist_id}","starred_url":"https://api.github.com/users/yskopets/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yskopets/subscriptions","organizations_url":"https://api.github.com/users/yskopets/orgs","repos_url":"https://api.github.com/users/yskopets/repos","events_url":"https://api.github.com/users/yskopets/events{/privacy}","received_events_url":"https://api.github.com/users/yskopets/received_events","type":"User","site_admin":false},"labels":[{"id":753784566,"node_id":"MDU6TGFiZWw3NTM3ODQ1NjY=","url":"https://api.github.com/repos/istio/istio/labels/area/config","name":"area/config","color":"0e8a16","default":false},{"id":735781806,"node_id":"MDU6TGFiZWw3MzU3ODE4MDY=","url":"https://api.github.com/repos/istio/istio/labels/area/networking","name":"area/networking","color":"0e8a16","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/istio/istio/milestones/4","html_url":"https://github.com/istio/istio/milestone/4","labels_url":"https://api.github.com/repos/istio/istio/milestones/4/labels","id":2599056,"node_id":"MDk6TWlsZXN0b25lMjU5OTA1Ng==","number":4,"title":"Nebulous Future","description":"Issues unlikely to get addressed in the near term\r\n","creator":{"login":"geeknoid","id":22780957,"node_id":"MDQ6VXNlcjIyNzgwOTU3","avatar_url":"https://avatars3.githubusercontent.com/u/22780957?v=4","gravatar_id":"","url":"https://api.github.com/users/geeknoid","html_url":"https://github.com/geeknoid","followers_url":"https://api.github.com/users/geeknoid/followers","following_url":"https://api.github.com/users/geeknoid/following{/other_user}","gists_url":"https://api.github.com/users/geeknoid/gists{/gist_id}","starred_url":"https://api.github.com/users/geeknoid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geeknoid/subscriptions","organizations_url":"https://api.github.com/users/geeknoid/orgs","repos_url":"https://api.github.com/users/geeknoid/repos","events_url":"https://api.github.com/users/geeknoid/events{/privacy}","received_events_url":"https://api.github.com/users/geeknoid/received_events","type":"User","site_admin":false},"open_issues":132,"closed_issues":178,"state":"open","created_at":"2017-06-22T18:35:16Z","updated_at":"2018-11-05T21:12:51Z","due_on":null,"closed_at":null},"comments":8,"created_at":"2018-09-11T10:25:44Z","updated_at":"2018-11-06T01:49:10Z","closed_at":null,"author_association":"NONE","body":"**Describe the bug**\r\nIn order to enforce Namespace isolation, `Kubernetes Ingress` resource only allows references to `Services` in the same `Namespace`.\r\n\r\nIn contrast, with `Istio` it's possible to create a `VirtualService` resource that references a `Service` from another Namespace and expose that `Service` to the outside world via `Ingress Gateway`.\r\n\r\n**Expected behavior**\r\n`Istio` should consistently enforce Kubernetes Namespace isolation.\r\n\r\n**Steps to reproduce the bug**\r\n\r\nUse 3 namespaces:\r\n1. `namespace-a` - a namespace owned by \"Istio Operator\", where a cluster-wide `Istio Ingress Gateway` is defined\r\n2. `namespace-b` - a namespace owned by \"Team #1\", where `httpbin` sample application is deployed \r\n3. `namespace-c` - a namespace owned by \"Team #2\", where `Istio VirtualService` resource is abused to expose to the outside world `httpbin` service owned by \"Team #1\"\r\n```\r\n---\r\napiVersion: networking.istio.io/v1alpha3\r\nkind: Gateway\r\nmetadata:\r\n  name: shared-gateway\r\n  namespace: namespace-a\r\nspec:\r\n  selector:\r\n    istio: ingressgateway\r\n  servers:\r\n  - port:\r\n      number: 80\r\n      name: http\r\n      protocol: HTTP\r\n    hosts:\r\n    # one Gateway for all services\r\n    - \"*\"\r\n---\r\napiVersion: v1\r\nkind: Service\r\nmetadata:\r\n  labels:\r\n    app: httpbin\r\n  name: httpbin\r\n  namespace: namespace-b\r\nspec:\r\n  ports:\r\n  - name: http\r\n    port: 8000\r\n    protocol: TCP\r\n    targetPort: 8000\r\n  selector:\r\n    app: httpbin\r\n  sessionAffinity: None\r\n  type: ClusterIP\r\n---\r\napiVersion: networking.istio.io/v1alpha3\r\nkind: VirtualService\r\nmetadata:\r\n  name: httpbin\r\n  namespace: namespace-c\r\nspec:\r\n  hosts:\r\n  - \"httbin-c.example.org\"\r\n  gateways:\r\n  - shared-gateway.namespace-a.svc.cluster.local\r\n  http:\r\n  - match:\r\n    - uri:\r\n        prefix: /\r\n    route:\r\n    - destination:\r\n        port:\r\n          number: 8000\r\n        # Notice: here we intentionally expose a service from somebody's else namespace !!!\r\n        host: httpbin.namespace-b.svc.cluster.local\r\n```\r\n\r\n**Version**\r\n`istioctl version`:\r\n```\r\nVersion: 1.0.1\r\nGitRevision: 42773aacced474d97159902d20579a25b1f98106\r\nUser: root@832d5020b1d4\r\nHub: gcr.io/istio-release\r\nGolangVersion: go1.10.1\r\nBuildStatus: Clean\r\n```\r\n\r\n`kubectl version`:\r\n```\r\nClient Version: version.Info{Major:\"1\", Minor:\"10\", GitVersion:\"v1.10.0\", GitCommit:\"fc32d2f3698e36b93322a3465f63a14e9f0eaead\", GitTreeState:\"clean\", BuildDate:\"2018-03-27T00:13:02Z\", GoVersion:\"go1.9.4\", Compiler:\"gc\", Platform:\"darwin/amd64\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"10+\", GitVersion:\"v1.10.6-gke.2\", GitCommit:\"384b4eaa132ca9a295fcb3e5dfc74062b257e7df\", GitTreeState:\"clean\", BuildDate:\"2018-08-15T00:10:14Z\", GoVersion:\"go1.9.3b4\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\n```\r\n\r\n**Is Istio Auth enabled or not?**\r\nYes\r\n\r\n**Environment**\r\nGKE\r\n\r\n**Cluster state**\r\n[istio-dump.tar.gz](https://github.com/istio/istio/files/2372615/istio-dump.tar.gz)"},"comment":{"url":"https://api.github.com/repos/istio/istio/issues/comments/436102708","html_url":"https://github.com/istio/istio/issues/8615#issuecomment-436102708","issue_url":"https://api.github.com/repos/istio/istio/issues/8615","id":436102708,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNjEwMjcwOA==","user":{"login":"sh777","id":5615648,"node_id":"MDQ6VXNlcjU2MTU2NDg=","avatar_url":"https://avatars0.githubusercontent.com/u/5615648?v=4","gravatar_id":"","url":"https://api.github.com/users/sh777","html_url":"https://github.com/sh777","followers_url":"https://api.github.com/users/sh777/followers","following_url":"https://api.github.com/users/sh777/following{/other_user}","gists_url":"https://api.github.com/users/sh777/gists{/gist_id}","starred_url":"https://api.github.com/users/sh777/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sh777/subscriptions","organizations_url":"https://api.github.com/users/sh777/orgs","repos_url":"https://api.github.com/users/sh777/repos","events_url":"https://api.github.com/users/sh777/events{/privacy}","received_events_url":"https://api.github.com/users/sh777/received_events","type":"User","site_admin":false},"created_at":"2018-11-06T01:49:10Z","updated_at":"2018-11-06T01:49:10Z","author_association":"NONE","body":"@mabushey Thanks a lot!\r\nIt's working now. Figured out that my issue was just missing \"svc\" in gateway's FQDN"}}
{"actor":{"display_login":"sh777"}}