<p>I have been working on extending the GCP <a href="https://github.com/GoogleCloudPlatform/microservices-demo" rel="nofollow noreferrer">Online Boutique</a> microservices example, and I would like to add <a href="https://istio.io/latest/docs/reference/config/security/authorization-policy/" rel="nofollow noreferrer">Istio AuthorizationPolicy</a> resources to the system.</p>
<p>Concretely, I want an <code>AuthorizationPolicy</code> to block all not-whitelisted traffic to <code>cartservice</code>, and I want to whitelist traffic from <code>frontend</code> to <code>cartservice</code>.</p>
<p>Currently, I am able to block traffic with an <code>AuthorizationPolicy</code>, but I cannot whitelist traffic by principal or namespace.</p>
<p>For context, here is my system setup. (Anything not explicitly stated here is the default from the demo linked above)</p>
<p><em>Istio Version:</em></p>
<pre><code>$ istioctl version
client version: 1.4.6
control plane version: 1.4.6-gke.0
data plane version: 1.4.6-gke.0 (16 proxies)
</code></pre>
<p><em>Command I Ran to Enforce Strict mTLS:</em></p>
<p><code>gcloud beta container clusters update &lt;cluster-name&gt; --update-addons=Istio=ENABLED \--istio-config=auth=MTLS_STRICT --zone=us-central1-a</code></p>
<p><em>I added this ServiceAccount using <code>kubectl apply -f</code></em>:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: frontend-serviceaccount
---
</code></pre>
<p>To make this work, I added one line to the <code>spec</code> for the <code>frontend</code> <code>Deployment</code>, which was:</p>
<p><code>serviceAccountName: frontend-serviceaccount</code></p>
<p>Lastly, this is the AuthorizationPolicy I am trying to use to only permit traffic from the <code>frontend</code> to talk to the <code>cartservice</code>:</p>
<pre><code>kind: AuthorizationPolicy
metadata:
 name: allow-cart-and-frontend-comm
 namespace: default
spec:
 selector:
   matchLabels:
     app: cartservice
 rules:
  - from:
    - source:
       namespaces: 
         - &quot;default&quot;
      # principals: [&quot;cluster.local/ns/default/sa/frontend-serviceaccount&quot;, &quot;frontend&quot;, &quot;frontend-serviceaccount&quot;, &quot;frontend-serviceaccount.default.sa.cluster.local&quot;, &quot;/api/v1/namespaces/default/serviceaccounts/frontend-serviceaccount&quot;, &quot;frontend.default.svc.cluster.local&quot;]
</code></pre>
<p>The <code>Principals</code> commented out above are all of the different ways I have tried to refer to the service account defined above, and neither them nor the namespace work properly - as soon as this is applied the <code>frontend</code> cannot talk to the <code>cartservice</code>.</p>
<p><strong>Results of System Debugging Calls:</strong>
Note, these were made with the AuthPolicy applied for <code>principals: [&quot;cluster.local/ns/default/sa/frontend-serviceaccount&quot;]</code>.</p>
<pre><code>$ istioctl x authz check frontend-&lt;podID&gt;
</code></pre>
<pre><code>Checked 21/40 listeners with node IP 10.4.4.14.
LISTENER[FilterChain]     CERTIFICATE                   mTLS (MODE)          JWT (ISSUERS)     AuthZ (RULES)
0.0.0.0_80[0]             none                          no (none)            no (none)         no (none)
0.0.0.0_80[1]             none                          no (none)            no (none)         no (none)
0.0.0.0_443[0]            none                          no (none)            no (none)         no (none)
0.0.0.0_443[1]            none                          no (none)            no (none)         no (none)
0.0.0.0_443[2]            none                          no (none)            no (none)         no (none)
0.0.0.0_443[3]            none                          no (none)            no (none)         no (none)
0.0.0.0_3550[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_3550[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_5000[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_5000[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_5050[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_5050[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_7000[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_7000[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_7070[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_7070[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_8060[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_8060[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_8080[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_8080[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_9090[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_9090[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_9091[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_9091[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_9555[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_9555[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_9901[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_9901[1]           none                          no (none)            no (none)         no (none)
virtualOutbound[0]        none                          no (none)            no (none)         no (none)
virtualOutbound[1]        none                          no (none)            no (none)         no (none)
0.0.0.0_15004[0]          none                          no (none)            no (none)         no (none)
0.0.0.0_15004[1]          none                          no (none)            no (none)         no (none)
virtualInbound[0]         none                          no (none)            no (none)         no (none)
virtualInbound[1]         none                          no (none)            no (none)         no (none)
virtualInbound[2]         /etc/certs/cert-chain.pem     yes (PERMISSIVE)     no (none)         no (none)
virtualInbound[3]         none                          no (PERMISSIVE)      no (none)         no (none)
0.0.0.0_15010[0]          none                          no (none)            no (none)         no (none)
0.0.0.0_15010[1]          none                          no (none)            no (none)         no (none)
0.0.0.0_15014[0]          none                          no (none)            no (none)         no (none)
0.0.0.0_15014[1]          none                          no (none)            no (none)         no (none)
0.0.0.0_50051[0]          none                          no (none)            no (none)         no (none)
0.0.0.0_50051[1]          none                          no (none)            no (none)         no (none)
10.4.4.14_8080[0]         /etc/certs/cert-chain.pem     yes (PERMISSIVE)     no (none)         no (none)
10.4.4.14_8080[1]         none                          no (PERMISSIVE)      no (none)         no (none)
10.4.4.14_15020           none                          no (none)            no (none)         no (none)
</code></pre>
<pre><code>$ istioctl x authz check cartservice-69955dd686-wf5bt
</code></pre>
<pre><code>Checked 21/40 listeners with node IP 10.4.5.6.
LISTENER[FilterChain]     CERTIFICATE                   mTLS (MODE)          JWT (ISSUERS)     AuthZ (RULES)
0.0.0.0_80[0]             none                          no (none)            no (none)         no (none)
0.0.0.0_80[1]             none                          no (none)            no (none)         no (none)
0.0.0.0_443[0]            none                          no (none)            no (none)         no (none)
0.0.0.0_443[1]            none                          no (none)            no (none)         no (none)
0.0.0.0_443[2]            none                          no (none)            no (none)         no (none)
0.0.0.0_443[3]            none                          no (none)            no (none)         no (none)
0.0.0.0_3550[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_3550[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_5000[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_5000[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_5050[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_5050[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_7000[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_7000[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_7070[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_7070[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_8060[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_8060[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_8080[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_8080[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_9090[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_9090[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_9091[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_9091[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_9555[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_9555[1]           none                          no (none)            no (none)         no (none)
0.0.0.0_9901[0]           none                          no (none)            no (none)         no (none)
0.0.0.0_9901[1]           none                          no (none)            no (none)         no (none)
virtualOutbound[0]        none                          no (none)            no (none)         no (none)
virtualOutbound[1]        none                          no (none)            no (none)         no (none)
0.0.0.0_15004[0]          none                          no (none)            no (none)         no (none)
0.0.0.0_15004[1]          none                          no (none)            no (none)         no (none)
virtualInbound[0]         none                          no (none)            no (none)         yes (1: ns[default]-policy[allow-cart-and-frontend-comm]-rule[0])
virtualInbound[1]         none                          no (none)            no (none)         no (none)
virtualInbound[2]         /etc/certs/cert-chain.pem     yes (PERMISSIVE)     no (none)         yes (1: ns[default]-policy[allow-cart-and-frontend-comm]-rule[0])
virtualInbound[3]         none                          no (PERMISSIVE)      no (none)         yes (1: ns[default]-policy[allow-cart-and-frontend-comm]-rule[0])
0.0.0.0_15010[0]          none                          no (none)            no (none)         no (none)
0.0.0.0_15010[1]          none                          no (none)            no (none)         no (none)
0.0.0.0_15014[0]          none                          no (none)            no (none)         no (none)
0.0.0.0_15014[1]          none                          no (none)            no (none)         no (none)
0.0.0.0_50051[0]          none                          no (none)            no (none)         no (none)
0.0.0.0_50051[1]          none                          no (none)            no (none)         no (none)
10.4.5.6_7070[0]          /etc/certs/cert-chain.pem     yes (PERMISSIVE)     no (none)         yes (1: ns[default]-policy[allow-cart-and-frontend-comm]-rule[0])
10.4.5.6_7070[1]          none                          no (PERMISSIVE)      no (none)         yes (1: ns[default]-policy[allow-cart-and-frontend-comm]-rule[0])
10.4.5.6_15020            none                          no (none)            no (none)         no (none)
</code></pre>

K. Dackow
<p>For reference, after debugging in person with OP, we discovered that the cluster was underspecified in terms of CPU usage. On resizing the cluster to have additional CPU (1 vCPU -&gt; 4 vCPUs), we were able to get <code>authz</code> policies working and respected.</p>
<p>Our hypothesis is that <code>istiod</code> was failing to respond to requests because of this issue. We do not know why.</p>
