<p>I am bit confused about using Istio with EKS. We have 2 spring boot microservices, one is a REST service provider and the other the consumer. We want to implement Authn and authz using Istio.</p>

<p>FOr that:
1. On provider service side : I have the a VirtualService, a Destination Rule (stating that the TLS mode should be ISTIO_MUTUAL for incoming traffic) , an AuthorizationPolicy which basically whitelists the client serviceaccounts. I also have a AuthenticationPolicy as below:</p>

<pre><code>apiVersion: "authentication.istio.io/v1alpha1"
kind: "Policy"
metadata:
  name: $APP_NAME-$FEATURE_NAME-authenticationpolicy
  namespace: $NAME_SPACE
spec:
  targets:
  - name: "$APP_NAME-$FEATURE_NAME"
  peers:
  - mtls:
      mode: STRICT
</code></pre>

<p>My understanding here is that this policy wont allow any incoming traffic which is non mtls.</p>

<p>Now I have a doubt that how do I configure my client pod to send all mtls outgoing traffic.I understand I have to create a ServiceAccount which is whitelisted at the provider side using Authz Policy.I am more concerned about my client pod here since I am not sure how to enable mtls at the pod level. FYI, I dont want to enable mtls at the namespace level.I want to do it at the pod level using a yaml file.</p>

<p>Is my understanding about the usage of the Destination rule, Authn and Authz policies correct? Is it correct that Destination rule, Authn and Authz policies have to be at the service provider level? And the client just has to enable MTLS for the communication to work successfully? I have been go thru Istio documentation but this is where I have a doubt</p>

Amol Kshirsagar
<blockquote>
  <p>My understanding here is that this policy wont allow any incoming traffic which is non mtls.</p>
</blockquote>

<p>That's true, if you set the tls mode to strict then client cert must be presented, connection is in TLS.</p>

<hr>

<blockquote>
  <p>I am more concerned about my client pod here since I am not sure how to enable mtls at the pod level.</p>
</blockquote>

<p>There is good <a href="https://itnext.io/musings-about-istio-with-mtls-c64b551fe104" rel="nofollow noreferrer">article</a> about how to make that work, specially the part </p>

<p><strong>Setting up mTLS for a single connection between two services</strong></p>

<blockquote>
  <p>As Bookinfo is the Hello World of Istio, I am going to use this to explain how to set up mTLS from productpage to details service as shown in the above graph snippet.</p>
  
  <p>There are two parts to this:</p>
  
  <p>Install a Policy to tell Details that it wants to receive TLS traffic (only):</p>
</blockquote>

<pre><code>apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
  name: details-receive-tls
spec:
  targets:
  - name: details
  peers:
  - mtls: {}
</code></pre>

<blockquote>
  <ol start="2">
  <li>Install a DestinationRule to tell clients (productpage) to talk TLS with details:</li>
  </ol>
</blockquote>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: details-istio-mtls
spec:
  host: details.bookinfo.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
</code></pre>

<blockquote>
  <p>The following is a graphical representation of the involved services and where the previous two configuration documents apply.</p>
</blockquote>

<p><a href="https://i.stack.imgur.com/Z8Srp.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Z8Srp.png" alt="enter image description here"></a></p>

<blockquote>
  <p>Now when you look closely at the Policy above you will see and entry for the peer authentication</p>
</blockquote>

<pre><code>peers:
- mtls: {}
</code></pre>

<blockquote>
  <p>This means that TLS verification is strict and Istio (or rather the Envoy proxy in the pod) requires TLS traffic and a valid certificate. We can pass a flag to get permissive mode:</p>
</blockquote>

<pre><code>peers:
- mtls: 
    mode: PERMISSIVE
</code></pre>

<hr>

<blockquote>
  <p>Is it correct that Destination rule, Authn and Authz policies have to be at the service provider level?</p>
</blockquote>

<p>As far as I know yes.</p>

<blockquote>
  <p>And the client just has to enable MTLS for the communication to work successfully?</p>
</blockquote>

<p>I'm not sure about that, since MTLS works inside mesh, it depends on your application requirements.</p>

<hr>

<blockquote>
  <p>I want to do it at the pod level using a yaml file.</p>
</blockquote>

<p>There is a link to <a href="https://istio.io/docs/tasks/security/authentication/" rel="nofollow noreferrer">istio documentation</a> about authentication which include</p>

<ul>
<li><a href="https://istio.io/docs/tasks/security/authentication/https-overlay/#create-an-https-service-with-istio-sidecar-with-mutual-tls-enabled" rel="nofollow noreferrer">Create an HTTPS service with Istio sidecar with mutual TLS enabled</a> </li>
<li><a href="https://istio.io/docs/tasks/security/authentication/mutual-tls/" rel="nofollow noreferrer">Mutual TLS Deep-Dive</a></li>
</ul>

<p>And another one from github</p>

<ul>
<li><a href="https://github.com/GoogleCloudPlatform/istio-samples/tree/6fa69cf46424c055535ddbdc22f715e866c4d179/security-intro#enable-mtls-for-the-frontend-service" rel="nofollow noreferrer">Enable mtls for frontend service</a></li>
</ul>

<p>Or you can extend your gateway’s definition to support mutual TLS. Change the credentials of the ingress gateway by deleting its secret and creating a new one. The server uses the CA certificate to verify its clients, and we must use the name cacert to hold the CA certificate. You can use cert-manager to generate a client certificate.</p>

<ul>
<li><a href="https://istio.io/docs/tasks/traffic-management/ingress/secure-ingress-sds/#configure-a-mutual-tls-ingress-gateway" rel="nofollow noreferrer">https://istio.io/docs/tasks/traffic-management/ingress/secure-ingress-sds/#configure-a-mutual-tls-ingress-gateway</a></li>
<li><a href="https://istio.io/docs/tasks/traffic-management/ingress/ingress-certmgr/" rel="nofollow noreferrer">https://istio.io/docs/tasks/traffic-management/ingress/ingress-certmgr/</a></li>
</ul>

<hr>

<p>I have found some tutorials which might be helpful, check it out.</p>

<ul>
<li><a href="https://banzaicloud.com/blog/istio-mtls/?fbclid=IwAR1--yRJNBRWK8cyYCnpCOxAy0yQaho-PKPsl5tNefs9Iy28dIDjz3AFygQ" rel="nofollow noreferrer">Managing mutual TLS between services with Istio</a></li>
<li><a href="https://istiobyexample.dev/authorization/" rel="nofollow noreferrer">Authorization</a></li>
<li><a href="https://istiobyexample.dev/jwt/" rel="nofollow noreferrer">JWT</a></li>
<li><a href="https://www.youtube.com/watch?v=pKN4x4uXswU" rel="nofollow noreferrer">istio mtls,jwt,authn</a></li>
</ul>

<hr>

<p>Let me know if you have any more questions.</p>
