<p>I’ve been testing istio (1.6) authorization policies and would like to confirm the following:</p>

<ol>
<li>Can I use k8s service names as shown below where <code>httpbin.bar</code> is the service name for deployment/workload httpbin:</li>
</ol>

<pre><code>   - to:
     - operation:
         hosts: ["httpbin.bar"]
</code></pre>

<ol start="2">
<li>I have the following rule; only ALLOW access to the <code>httpbin.bar</code> service from service account <code>sleep</code> in <code>foo</code> namespace.</li>
</ol>

<pre><code>---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: whitelist-httpbin-bar
  namespace: bar
  action: ALLOW 
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/foo/sa/sleep"]
  - to:
    - operation:
        hosts: ["httpbin.bar"]
</code></pre>

<p>I setup 2 services; <code>httpbin.bar</code> and <code>privatehttpbin.bar</code>. My assumption was that it would block access to <code>privatehttpbin.bar</code> but this is not the case. On a side note, I deliberately avoided adding <code>selector.matchLabels</code> because as far as I can tell the rule should only succeed for <code>httpbin.bar</code>.</p>

<p>The docs state:</p>

<blockquote>
  <p>A match occurs when at least one source, operation and condition matches the request.</p>
</blockquote>

<p>as per <a href="https://istio.io/latest/docs/reference/config/security/authorization-policy/#Rule" rel="nofollow noreferrer">here</a>.</p>

<p>I interpreted that AND logic will apply to the <code>source</code> and <code>operation</code>. </p>

<p>Would appreciate if I can find out why this may not be working or if my understanding needs to be corrected.</p>

kaizenCoder
<p>On the first point You can specify the host name by k8s service name.Therefore httpbin.bar is acceptable for the host field.</p>

<p>On the second point,
As per <a href="https://istio.io/latest/docs/reference/config/security/authorization-policy/" rel="nofollow noreferrer">here</a> ,</p>

<blockquote>
  <p>Authorization Policy scope (target) is determined by
  “metadata/namespace” and an optional “selector”.</p>
  
  <p>“metadata/namespace” tells which namespace the policy applies. If set
  to root namespace, the policy applies to all namespaces in a mesh.</p>
</blockquote>

<p>So the authorization policy <code>whitelist-httpbin-bar</code> applies to workloads in the namespace <code>foo</code>.But the services <code>httpbin</code> and <code>privatehttpbin</code> you want to authorize lies in <code>bar</code> namespace.So your authorization policy does not restrict access to these services.</p>

<blockquote>
  <p>If there are no ALLOW policies for the workload, allow the request.</p>
</blockquote>

<p>The above criteria makes the request a valid one. </p>

<p>Hope this helps.</p>
