<p>I'm new to Istio and learning from the official website examples. The one I can't understand is <a href="https://istio.io/docs/tasks/security/authn-policy/#globally-enabling-istio-mutual-tls" rel="nofollow noreferrer">globally enabling Istio mutual TLS</a>.</p>

<p>I can run the example with the yaml code present on the web. After that, I changed the <code>DestinationRule</code>:</p>

<pre><code>kubectl apply -f - &lt;&lt;EOF
apiVersion: "networking.istio.io/v1alpha3"
kind: "DestinationRule"
metadata:
  name: "default"
  namespace: "foo"
spec:
  host: "*.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
EOF
</code></pre>

<p>The only part I changed is replacing the namespace of the example from <code>istio-system</code> to <code>foo</code>. Then I switch to <code>foo</code> namespace, and I run the following test command：</p>

<pre><code>$ for from in "foo" "bar"; do for to in "foo" "bar"; do kubectl exec $(kubectl get pod -l app=sleep -n ${from} -o jsonpath={.items..metadata.name}) -c sleep -n ${from} -- curl "http://httpbin.${to}:8000/ip" -s -o /dev/null -w "sleep.${from} to httpbin.${to}: %{http_code}\n"; done; done
</code></pre>

<p>and the result is below:</p>

<pre><code>sleep.foo to httpbin.foo: 503
sleep.foo to httpbin.bar: 200
sleep.bar to httpbin.foo: 503
sleep.bar to httpbin.bar: 503
</code></pre>

<p>what I expect is:</p>

<pre><code>sleep.foo to httpbin.foo: 200
sleep.foo to httpbin.bar: 503
sleep.bar to httpbin.foo: 503
sleep.bar to httpbin.bar: 503
</code></pre>

<p>Followed the official example, I set a mesh-wide authentication policy that enables mutual TLS, and I then configured the client side mutual TLS on namespace <code>foo</code>, I think it should work on namespace <code>foo</code>, but it does not work.</p>

<p>Questions:</p>

<ol>
<li>why the status of <code>sleep.foo to httpbin.foo: 503</code> is 503 instead of 200?</li>
<li>why the status of <code>sleep.foo to httpbin.bar: 200</code> is 200 instead of 503?</li>
</ol>

<p>Is there anyone to explain this? thanks.</p>

leo
<p>You should wait for 1-2 minutes before the policies will be fully enforced. </p>
