{"action":"created","issue":{"url":"https://api.github.com/repos/istio/istio/issues/6707","repository_url":"https://api.github.com/repos/istio/istio","labels_url":"https://api.github.com/repos/istio/istio/issues/6707/labels{/name}","comments_url":"https://api.github.com/repos/istio/istio/issues/6707/comments","events_url":"https://api.github.com/repos/istio/istio/issues/6707/events","html_url":"https://github.com/istio/istio/issues/6707","id":336721909,"node_id":"MDU6SXNzdWUzMzY3MjE5MDk=","number":6707,"title":"Istio RBAC Guide Not Working as Explained","user":{"login":"jon-whit","id":2899204,"node_id":"MDQ6VXNlcjI4OTkyMDQ=","avatar_url":"https://avatars3.githubusercontent.com/u/2899204?v=4","gravatar_id":"","url":"https://api.github.com/users/jon-whit","html_url":"https://github.com/jon-whit","followers_url":"https://api.github.com/users/jon-whit/followers","following_url":"https://api.github.com/users/jon-whit/following{/other_user}","gists_url":"https://api.github.com/users/jon-whit/gists{/gist_id}","starred_url":"https://api.github.com/users/jon-whit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jon-whit/subscriptions","organizations_url":"https://api.github.com/users/jon-whit/orgs","repos_url":"https://api.github.com/users/jon-whit/repos","events_url":"https://api.github.com/users/jon-whit/events{/privacy}","received_events_url":"https://api.github.com/users/jon-whit/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-06-28T18:00:30Z","updated_at":"2018-08-03T19:40:43Z","closed_at":"2018-07-03T03:09:17Z","author_association":"NONE","body":"I'm trying to get the RBAC engine working. I'm following the [guide here](https://istio.io/docs/tasks/security/role-based-access-control/).\r\n\r\nI've followed the [Before You Begin](https://istio.io/docs/tasks/security/role-based-access-control/#before-you-begin) section and have successfully deployed the Bookinfo application. Here's a snippet of my `kubectl` output from the _istio-poc_ namespace.\r\n\r\n```\r\n$ kubectl get services\r\nNAME          TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE\r\ndetails       ClusterIP   10.X.X.X    <none>        9080/TCP   22h\r\nproductpage   ClusterIP   10.X.X.X   <none>        9080/TCP   22h\r\nratings       ClusterIP   10.X.X.X    <none>        9080/TCP   22h\r\nreviews       ClusterIP   10.X.X.X   <none>        9080/TCP   22h\r\n```\r\n\r\nI am able to hit the application through the browser using the Gateway IP and it shows the product reviews as expected.\r\n\r\nI followed the [Enabling Istio RBAC](https://istio.io/docs/tasks/security/role-based-access-control/#enabling-istio-rbac) section and have verified using `kubectl get` that the resource configurations are in place, but I am **not** getting Access Denied on the product page as expected. I did modify the `rbac` configuration to match the _istio-poc_ namespace.\r\n```\r\napiVersion: config.istio.io/v1alpha2\r\nkind: rule\r\nmetadata:\r\n  name: rbaccheck\r\n  namespace: istio-system\r\nspec:\r\n  actions:\r\n  - handler: handler.rbac\r\n    instances:\r\n    - requestcontext.authorization\r\n  match: destination.namespace == \"istio-poc\"\r\n```\r\n\r\nWhat is the best way to debug this problem? Any ideas why this would be occurring? "},"comment":{"url":"https://api.github.com/repos/istio/istio/issues/comments/410356296","html_url":"https://github.com/istio/istio/issues/6707#issuecomment-410356296","issue_url":"https://api.github.com/repos/istio/istio/issues/6707","id":410356296,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMDM1NjI5Ng==","user":{"login":"igoooor","id":1036285,"node_id":"MDQ6VXNlcjEwMzYyODU=","avatar_url":"https://avatars1.githubusercontent.com/u/1036285?v=4","gravatar_id":"","url":"https://api.github.com/users/igoooor","html_url":"https://github.com/igoooor","followers_url":"https://api.github.com/users/igoooor/followers","following_url":"https://api.github.com/users/igoooor/following{/other_user}","gists_url":"https://api.github.com/users/igoooor/gists{/gist_id}","starred_url":"https://api.github.com/users/igoooor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/igoooor/subscriptions","organizations_url":"https://api.github.com/users/igoooor/orgs","repos_url":"https://api.github.com/users/igoooor/repos","events_url":"https://api.github.com/users/igoooor/events{/privacy}","received_events_url":"https://api.github.com/users/igoooor/received_events","type":"User","site_admin":false},"created_at":"2018-08-03T19:40:43Z","updated_at":"2018-08-03T19:40:43Z","author_association":"NONE","body":"I'm facing the exact same issue. Any update here?"}}
{"actor":{"display_login":"igoooor"}}